VYPR

CVEs

346,118 total · page 6015 of 6,923

AllCriticalHighKEV
  • CVE-2011-1192Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 on Linux does not properly handle Unicode ranges, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2011-1191Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of DOM URLs.

  • CVE-2011-1190Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The Web Workers implementation in Google Chrome before 10.0.648.127 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, related to an "error message leak."

  • CVE-2011-1189Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 does not properly perform box layout, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale node."

  • CVE-2011-1188Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 does not properly handle counter nodes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-1187Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, related to an "error message leak."

  • CVE-2011-1186Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    Google Chrome before 10.0.648.127 on Linux does not properly handle parallel execution of calls to the print method, which might allow remote attackers to cause a denial of service (application crash) via crafted JavaScript code.

  • CVE-2011-1185Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 10.0.648.127 does not prevent (1) navigation and (2) close operations on the top location of a sandboxed frame, which has unspecified impact and remote attack vectors.

  • CVE-2011-1347Mar 10, 2011
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.28

    Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to bypass Protected Mode and create arbitrary files by leveraging access to a Low integrity process, as demonstrated by Stephen Fewer as the third of three chained vulnerabilities…

  • CVE-2011-1346Mar 10, 2011
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.26

    Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by Stephen Fewer as the second of three chained vulnerabilities during a Pwn2Own competition at CanSecWest 2011.

  • CVE-2011-1345Mar 10, 2011
    Microsoft
    Internet Explorer
    risk 0.03cvss —epss 0.41

    Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, as demonstrated by Stephen Fewer as the first of three…

  • CVE-2011-1344Mar 10, 2011
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in WebKit, as used in Apple Safari before 5.0.5; iOS before 4.3.2 for iPhone, iPod, and iPad; iOS before 4.2.7 for iPhone 4 (CDMA); and possibly other products allows remote attackers to execute arbitrary code by adding children to a WBR tag and then…

  • CVE-2011-1343Mar 9, 2011
    IBM
    Tivoli Netcool\/omnibus
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Web GUI in IBM Tivoli Netcool/OMNIbus before 7.3.0.4 allows remote attackers to execute arbitrary SQL commands via "dynamic SQL parameters."

  • CVE-2011-1099Mar 9, 2011
    Focalmedia.net
    Quick Polls
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in FocalMedia.Net Quick Polls before 1.0.2 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the p parameter in a preview action to index.php, or (2) delete arbitrary files via a .. (dot dot) in the p parameter…

  • CVE-2011-0464Mar 9, 2011
    Novell
    Vibe Onprem
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in Novell Vibe OnPrem 3.0 before Hot Patch 1 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2011-0042HigMar 9, 2011
    Microsoft
    Windows
    risk 0.53cvss 7.8epss 0.33

    SBE.dll in the Stream Buffer Engine in Windows Media Player and Windows Media Center in Microsoft Windows XP SP2 and SP3, Windows XP Media Center Edition 2005 SP3, Windows Vista SP1 and SP2, Windows 7 Gold and SP1, and Windows Media Center TV Pack for Windows Vista does not…

  • CVE-2011-0032Mar 9, 2011
    Microsoft
    Windows
    risk 0.01cvss —epss 0.10

    Untrusted search path vulnerability in DirectShow in Microsoft Windows Vista SP1 and SP2, Windows 7 Gold and SP1, Windows Server 2008 R2 and R2 SP1, and Windows Media Center TV Pack for Windows Vista allows local users to gain privileges via a Trojan horse DLL in the current…

  • CVE-2011-0029HigMar 9, 2011
    Microsoft
    Remote Desktop Connection
    risk 0.49cvss 7.4epss 0.07

    Untrusted search path vulnerability in the client in Microsoft Remote Desktop Connection 5.2, 6.0, 6.1, and 7.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rdp file, aka "Remote…

  • CVE-2011-1322Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    The SOAP with Attachments API for Java (SAAJ) implementation in the Web Services component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.37 and 7.x before 7.0.0.15 allows remote attackers to cause a denial of service (memory consumption) via encrypted SOAP…

  • CVE-2011-1321Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    The AuthCache purge implementation in the Security component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.37 and 7.x before 7.0.0.15 does not purge a user from the PlatformCredential cache, which might allow remote authenticated users to gain privileges by…

  • CVE-2011-1320Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    The Security component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.35 and 7.x before 7.0.0.15, when the Tivoli Integrated Portal / embedded WebSphere Application Server (TIP/eWAS) framework is used, does not properly delete AuthCache entries upon a logout,…

  • CVE-2011-1319Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    The Security component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.35 and 7.x before 7.0.0.15 allows remote authenticated users to cause a denial of service (memory consumption) by using a Lightweight Third-Party Authentication (LTPA) token for authentication.

  • CVE-2011-1318Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    Memory leak in org.apache.jasper.runtime.JspWriterImpl.response in the JavaServer Pages (JSP) component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of service (memory consumption) by accessing a JSP page of an application…

  • CVE-2011-1317Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    Memory leak in com.ibm.ws.jsp.runtime.WASJSPStrBufferImpl in the JavaServer Pages (JSP) component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.37 and 7.x before 7.0.0.15 allows remote attackers to cause a denial of service (memory consumption) by sending many…

  • CVE-2011-1316Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    The Session Initiation Protocol (SIP) Proxy in the HTTP Transport component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of service (worker thread exhaustion and UDP messaging outage) by sending many UDP messages.

  • CVE-2011-1315Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    Memory leak in the messaging engine in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of service (memory consumption) via network connections associated with a NULL return value from a synchronous JMS receive call.

  • CVE-2011-1314Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    The Service Integration Bus (SIB) messaging engine in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of service (daemon hang) by performing close operations via network connections to a queue manager.

  • CVE-2011-1313Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    Double free vulnerability in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.35 and 7.x before 7.0.0.15 allows remote backend IIOP servers to cause a denial of service (S0C4 ABEND and storage corruption) by rejecting IIOP requests at opportunistic time instants, as…

  • CVE-2011-1312Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    The Administrative Console component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.31 and 7.x before 7.0.0.15 does not prevent modifications of the primary admin id, which allows remote authenticated administrators to bypass intended access restrictions by…

  • CVE-2011-1311Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    The Security component in IBM WebSphere Application Server (WAS) before 7.0.0.15, when a J2EE 1.4 application is used, determines the security role mapping on the basis of the ibm-application-bnd.xml file instead of the intended ibm-application-bnd.xmi file, which might allow…

  • CVE-2011-1310Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.00

    The Administrative Scripting Tools component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.35 and 7.x before 7.0.0.15, when tracing is enabled, places wsadmin command parameters into the (1) wsadmin.traceout and (2) trace.log files, which allows local users to…

  • CVE-2011-1309Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    The Plug-in component in IBM WebSphere Application Server (WAS) before 7.0.0.15 does not properly handle trace requests, which has unspecified impact and attack vectors.

  • CVE-2011-1308Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Installation Verification Test (IVT) application in the Install component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-1307Mar 8, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.00

    The installer in IBM WebSphere Application Server (WAS) before 7.0.0.15 uses 777 permissions for a temporary log directory, which allows local users to have unintended access to log files via standard filesystem operations, a different vulnerability than CVE-2009-1173.

  • CVE-2011-1306Mar 8, 2011
    Google
    ChromeOS
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Scratchpad application in Google Chrome OS before R10 0.10.156.46 Beta has unknown impact and attack vectors.

  • CVE-2011-0345Mar 8, 2011
    Alcatel Lucent
    Omnivista
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in the NMS server in Alcatel-Lucent OmniVista 4760 R5.1.06.03 and earlier allows remote attackers to read arbitrary files via directory traversal sequences in HTTP GET requests, related to the lang variable.

  • CVE-2011-0344Mar 8, 2011
    Alcatel Lucent
    Omnipcx
    risk 0.00cvss —epss 0.02

    Multiple stack-based buffer overflows in unspecified CGI programs in the Unified Maintenance Tool web interface in the embedded web server in the Communication Server (CS) in Alcatel-Lucent OmniPCX Enterprise before R9.0 H1.301.50 allow remote attackers to execute arbitrary code…

  • CVE-2011-0437Mar 7, 2011
    Gplhost
    Domain Technologie Control
    risk 0.00cvss —epss 0.02

    shared/inc/sql/ssh.php in the SSH accounts management implementation in Domain Technologie Control (DTC) before 0.32.9 allows remote authenticated users to delete arbitrary accounts via the edssh_account parameter in a deletesshaccount Delete action.

  • CVE-2011-0436Mar 7, 2011
    Gplhost
    Domain Technologie Control
    risk 0.00cvss —epss 0.02

    The register_user function in client/new_account_form.php in Domain Technologie Control (DTC) before 0.32.9 includes a cleartext password in an e-mail message, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2011-0435Mar 7, 2011
    Gplhost
    Domain Technologie Control
    risk 0.00cvss —epss 0.02

    Domain Technologie Control (DTC) before 0.32.9 does not require authentication for (1) admin/bw_per_month.php and (2) client/bw_per_month.php, which allows remote attackers to obtain potentially sensitive bandwidth information via a direct request.

  • CVE-2011-0434Mar 7, 2011
    Gplhost
    Domain Technologie Control
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Domain Technologie Control (DTC) before 0.32.9 allow remote attackers to execute arbitrary SQL commands via the cid parameter to (1) admin/bw_per_month.php or (2) client/bw_per_month.php.

  • CVE-2011-0279Mar 7, 2011
    Microfocus
    Digital Sending Software
    risk 0.00cvss —epss 0.01

    HP Multifunction Peripheral (MFP) Digital Sending Software (DSS) 4.91.00 does not properly configure authentication settings of managed devices within device templates, which allows attackers to access these devices via actions that were intended to require authentication.

  • CVE-2011-0064Mar 7, 2011
    Pango
    Pango
    risk 0.00cvss —epss 0.03

    The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or…

  • CVE-2009-3028Mar 7, 2011
    Symantec
    Management Platform
    risk 0.06cvss —epss 0.43

    The Altiris eXpress NS SC Download ActiveX control in AeXNSPkgDLLib.dll, as used in Symantec Altiris Deployment Solution 6.9.x, Notification Server 6.0.x, and Symantec Management Platform 7.0.x exposes an unsafe method, which allows remote attackers to force the download of…

  • CVE-2011-1074Mar 4, 2011
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.01

    crontab.c in crontab in FreeBSD allows local users to determine the existence of arbitrary directories via a command-line argument composed of a directory name concatenated with a directory traversal sequence that leads to the /etc/crontab pathname.

  • CVE-2011-1073Mar 4, 2011
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    crontab.c in crontab in FreeBSD and Apple Mac OS X allows local users to (1) determine the existence of arbitrary files via a symlink attack on a /tmp/crontab.XXXXXXXXXX temporary file and (2) perform MD5 checksum comparisons on arbitrary pairs of files via two symlink attacks…

  • CVE-2011-0192Mar 3, 2011
    LibTIFF
    Libtiff
    risk 0.01cvss —epss 0.07

    Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF…

  • CVE-2011-0191Mar 3, 2011
    LibTIFF
    Libtiff
    risk 0.01cvss —epss 0.07

    Buffer overflow in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image with JPEG…

  • CVE-2011-0170Mar 3, 2011
    Apple Inc.
    iTunes
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in ImageIO in CoreGraphics in Apple iTunes before 10.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted International Color Consortium (ICC) profile in a JPEG image.

  • CVE-2011-0168Mar 3, 2011
    Apple Inc.
    iTunes
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs…