VYPR

CVEs

346,118 total · page 6014 of 6,923

AllCriticalHighKEV
  • CVE-2011-1146Mar 15, 2011
    Libvirt
    Libvirt
    risk 0.00cvss —epss 0.02

    libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset,…

  • CVE-2011-1092Mar 15, 2011
    PHP
    PHP
    risk 0.04cvss —epss 0.18

    Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possibly read sensitive memory via a large third argument to the shmop_read function.

  • CVE-2011-0695Mar 15, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Race condition in the cm_work_handler function in the InfiniBand driver (drivers/infiniband/core/cma.c) in Linux kernel 2.6.x allows remote attackers to cause a denial of service (panic) by sending an InfiniBand request while other request handlers are still running, which…

  • CVE-2011-0609HigKEVMar 15, 2011
    Adobe Inc.
    Acrobat
    risk 0.71cvss 7.8epss 0.67

    Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x…

  • CVE-2011-0457Mar 15, 2011
    E107
    E107
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in e107 0.7.22 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-0438Mar 15, 2011
    Nss Pam Ldapd
    nss-pam-ldapd
    risk 0.00cvss —epss 0.02

    nslcd/pam.c in the nss-pam-ldapd 0.8.0 PAM module returns a success code when a user is not found in LDAP, which allows remote attackers to bypass authentication.

  • CVE-2011-0063Mar 15, 2011
    Majordomo
    Majordomo
    risk 0.10cvss —epss 0.85

    The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ./.../ sequence in the "extra" parameter to the help command, which causes the regular expression to…

  • CVE-2011-0001Mar 15, 2011
    tgt
    tgt
    risk 0.00cvss —epss 0.05

    Double free vulnerability in the iscsi_rx_handler function (usr/iscsi/iscsid.c) in the tgt daemon (tgtd) in Linux SCSI target framework (tgt) before 1.0.14, aka scsi-target-utils, allows remote attackers to cause a denial of service (memory corruption and crash) and possibly…

  • CVE-2010-4757Mar 15, 2011
    E107
    E107
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in submitnews.php in e107 before 0.7.23 allows remote attackers to inject arbitrary web script or HTML via the submitnews_title parameter, a different vector than CVE-2008-6208. NOTE: some of these details are obtained from third party…

  • CVE-2011-1419Mar 14, 2011
    Apache
    Tomcat
    risk 0.00cvss —epss 0.07

    Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an…

  • CVE-2011-1091Mar 14, 2011
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.03

    libymsg.c in the Yahoo! protocol plugin in libpurple in Pidgin 2.6.0 through 2.7.10 allows (1) remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG notification packet, and allows (2) remote Yahoo! servers…

  • CVE-2011-1088Mar 14, 2011
    Apache
    Tomcat
    risk 0.00cvss —epss 0.06

    Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.

  • CVE-2011-0701Mar 14, 2011
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter.

  • CVE-2011-0700Mar 14, 2011
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title), (2) post_status, (3) comment_status, (4)…

  • CVE-2011-0432Mar 14, 2011
    Simon Pamies
    Pywebdav
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are…

  • CVE-2011-0280Mar 14, 2011
    Microfocus
    Power Manager
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in HP Power Manager (HPPM) 4.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the logType parameter to Contents/exportlogs.asp, (2) the Id parameter to Contents/pagehelp.asp, or the (3)…

  • CVE-2011-1418Mar 11, 2011
    Apple Inc.
    TV
    risk 0.00cvss —epss 0.01

    The stateless address autoconfiguration (aka SLAAC) functionality in the IPv6 networking implementation in Apple iOS before 4.3 and Apple TV before 4.2 places the MAC address into the IPv6 address, which makes it easier for remote IPv6 servers to track users by logging source…

  • CVE-2011-0715Mar 11, 2011
    Apache
    Subversion
    risk 0.01cvss —epss 0.06

    The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.

  • CVE-2011-0169Mar 11, 2011
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    WebKit in Apple Safari before 5.0.4, when the Web Inspector is used, does not properly handle the window.console._inspectorCommandLineAPI property, which allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a…

  • CVE-2011-0167Mar 11, 2011
    Apple Inc.
    Safari
    risk 0.03cvss —epss 0.03

    The windows functionality in WebKit in Apple Safari before 5.0.4 allows remote attackers to bypass the Same Origin Policy, and force the upload of arbitrary local files from a client computer, via a crafted web site.

  • CVE-2011-0166Mar 11, 2011
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    The HTML5 drag and drop functionality in WebKit in Apple Safari before 5.0.4 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via vectors related to the dragging of content. NOTE: this might overlap CVE-2011-0778.

  • CVE-2011-0163Mar 11, 2011
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle unspecified "cached resources," which allows remote attackers to cause a denial of service (resource unavailability) via a crafted web site that conducts a cache-poisoning attack.

  • CVE-2011-0162Mar 11, 2011
    Apple Inc.
    TV
    risk 0.00cvss —epss 0.03

    Wi-Fi in Apple iOS before 4.3 and Apple TV before 4.2 does not properly perform bounds checking for Wi-Fi frames, which allows remote attackers to cause a denial of service (device reset) via unspecified traffic on the local wireless network.

  • CVE-2011-0161Mar 11, 2011
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle the Attr.style accessor, which allows remote attackers to bypass the Same Origin Policy and inject Cascading Style Sheets (CSS) token sequences via a crafted web site.

  • CVE-2011-0160Mar 11, 2011
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle redirects in conjunction with HTTP Basic Authentication, which might allow remote web servers to capture credentials by logging the Authorization HTTP header.

  • CVE-2011-0159Mar 11, 2011
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    The Safari Settings feature in Safari in Apple iOS 4.x before 4.3 does not properly implement the clearing of cookies during execution of the Safari application, which might make it easier for remote web servers to track users by setting a cookie.

  • CVE-2011-0158Mar 11, 2011
    Apple Inc.
    MobileSafari
    risk 0.00cvss —epss 0.01

    MobileSafari in Apple iOS before 4.3 does not properly implement application launching through URL handlers, which allows remote attackers to cause a denial of service (persistent application crash) via crafted JavaScript code.

  • CVE-2011-0157Mar 11, 2011
    Apple Inc.
    Webkit
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple iOS before 4.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-09-1.

  • CVE-2010-4651Mar 11, 2011
    GNU
    Patch
    risk 0.00cvss —epss 0.05

    Directory traversal vulnerability in util.c in GNU patch 2.6.1 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a filename that is specified with a .. (dot dot) or full pathname, a related issue to CVE-2010-1679.

  • CVE-2011-1290Mar 11, 2011
    Rim
    Blackberry Torch 9800
    risk 0.01cvss —epss 0.10

    Integer overflow in WebKit, as used on the Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246, in Google Chrome before 10.0.648.133, and in Apple Safari before 5.0.5, allows remote attackers to execute arbitrary code via unknown vectors related to CSS "style…

  • CVE-2011-1417Mar 11, 2011
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.05

    Integer overflow in QuickLook, as used in Apple Mac OS X before 10.6.7 and MobileSafari in Apple iOS before 4.2.7 and 4.3.x before 4.3.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a Microsoft…

  • CVE-2011-1416Mar 11, 2011
    Rim
    Blackberry Torch 9800
    risk 0.00cvss —epss 0.01

    The Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246 allows attackers to read the contents of memory locations via unknown vectors, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest…

  • CVE-2011-1137Mar 11, 2011
    Proftpd
    Proftpd
    risk 0.05cvss —epss 0.28

    Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumption leading to OOM kill) via a malformed SSH message.

  • CVE-2011-0456Mar 11, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.03

    webscript.pl in Open Ticket Request System (OTRS) 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."

  • CVE-2010-3609Mar 11, 2011
    Openslp
    Openslp
    risk 0.04cvss —epss 0.17

    The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a…

  • CVE-2011-1413Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 on Linux does not properly mitigate an unspecified flaw in an X server, which allows remote attackers to cause a denial of service (application crash) via vectors involving long messages.

  • CVE-2011-1286Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google V8, as used in Google Chrome before 10.0.648.127, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger incorrect access to memory.

  • CVE-2011-1285Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The regular-expression functionality in Google Chrome before 10.0.648.127 does not properly implement reentrancy, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-1204Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 does not properly handle attributes, which allows remote attackers to cause a denial of service (DOM tree corruption) or possibly have unspecified other impact via a crafted document.

  • CVE-2011-1203Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 does not properly handle SVG cursors, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

  • CVE-2011-1202Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a…

  • CVE-2011-1201Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The context implementation in WebKit, as used in Google Chrome before 10.0.648.127, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

  • CVE-2011-1200Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 10.0.648.127 does not properly perform a cast of an unspecified variable during text rendering, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.

  • CVE-2011-1199Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 does not properly handle DataView objects, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-1198Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The video functionality in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger use of a malformed "out-of-bounds structure."

  • CVE-2011-1197Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 does not properly perform table painting, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

  • CVE-2011-1196Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The OGG container implementation in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.

  • CVE-2011-1195Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to "document script lifetime handling."

  • CVE-2011-1194Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Google Chrome before 10.0.648.127 allow remote attackers to bypass the pop-up blocker via unknown vectors.

  • CVE-2011-1193Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google V8, as used in Google Chrome before 10.0.648.127, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.