VYPR

CVEs

346,118 total · page 6024 of 6,923

AllCriticalHighKEV
  • CVE-2010-4729Feb 8, 2011
    Zikula
    Zikula
    risk 0.00cvss —epss 0.01

    Zikula before 1.2.3 does not use the authid protection mechanism for (1) the lostpassword form and (2) mailpasswd processing, which makes it easier for remote attackers to generate a flood of password requests and possibly conduct cross-site request forgery (CSRF) attacks via…

  • CVE-2010-4728Feb 8, 2011
    Zikula
    Zikula
    risk 0.00cvss —epss 0.01

    Zikula before 1.3.1 uses the rand and srand PHP functions for random number generation, which makes it easier for remote attackers to defeat protection mechanisms based on randomization by predicting a return value, as demonstrated by the authid protection mechanism.

  • CVE-2011-0910Feb 8, 2011
    Vanilla Forums
    Vanilla Forums
    risk 0.00cvss —epss 0.01

    The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing attacks.

  • CVE-2011-0909Feb 8, 2011
    Vanilla Forums
    Vanilla Forums
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Vanilla Forums before 2.0.17.6 allows remote attackers to inject arbitrary web script or HTML via the p parameter to an unspecified component, a different vulnerability than CVE-2011-0526.

  • CVE-2011-0908Feb 8, 2011
    Vanilla Forums
    Vanilla Forums
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in Vanilla Forums before 2.0.17.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the Target parameter to an unspecified component, a different vulnerability than CVE-2011-0526.

  • CVE-2011-0526Feb 8, 2011
    Vanilla Forums
    Vanilla Forums
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Vanilla Forums before 2.0.17 allows remote attackers to inject arbitrary web script or HTML via the Target parameter in a /entry/signin action.

  • CVE-2011-0903Feb 7, 2011
    AR
    AR Web Content Manager
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in AR Web Content Manager (AWCM) 2.2 allow remote attackers to read arbitrary files and possibly have other unspecified impact via a .. (dot dot) in the (1) awcm_theme or (2) awcm_lang cookie to (a) index.php or (b) header.php.

  • CVE-2011-0902Feb 7, 2011
    Sun Corporation
    SunScreen Firewall
    risk 0.03cvss —epss 0.02

    Multiple untrusted search path vulnerabilities in the Java Service in Sun Microsystems SunScreen Firewall on SunOS 5.9 allow local users to execute arbitrary code via a modified (1) PATH or (2) LD_LIBRARY_PATH environment variable.

  • CVE-2011-0901Feb 7, 2011
    Tsclient
    Terminal Server Client
    risk 0.03cvss —epss 0.05

    Multiple stack-based buffer overflows in the tsc_launch_remote function (src/support.c) in Terminal Server Client (tsclient) 0.150, and possibly other versions, allow user-assisted remote attackers to execute arbitrary code via a .RDP file with a long (1) username, (2) password,…

  • CVE-2011-0900Feb 7, 2011
    Tsclient
    Terminal Server Client
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in the tsc_launch_remote function (src/support.c) in Terminal Server Client (tsclient) 0.150, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via a .RDP file with a long hostname argument.

  • CVE-2011-0899Feb 7, 2011
    Drupal
    AES encryption module
    risk 0.00cvss —epss 0.01

    The AES encryption module 7.x-1.4 for Drupal leaves certain debugging code enabled in release, which records the plaintext password of the last logged-in user and allows remote attackers to gain privileges as that user.

  • CVE-2011-0531Feb 7, 2011
    VideoLAN
    VLC media player
    risk 0.06cvss —epss 0.42

    demux/mkv/mkv.hpp in the MKV demuxer plugin in VideoLAN VLC media player 1.1.6.1 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary commands via a crafted MKV (WebM or Matroska) file that triggers memory corruption, related to "class…

  • CVE-2011-0522Feb 7, 2011
    VideoLAN
    VLC media player
    risk 0.07cvss —epss 0.51

    The StripTags function in (1) the USF decoder (modules/codec/subtitles/subsdec.c) and (2) the Text decoder (modules/codec/subtitles/subsusf.c) in VideoLAN VLC Media Player 1.1 before 1.1.6-rc allows remote attackers to execute arbitrary code via a subtitle with an opening "<"…

  • CVE-2011-0324Feb 7, 2011
    Topazsystems
    Sigplus Pro Activex Control
    risk 0.00cvss —epss 0.06

    Multiple heap-based buffer overflows in Topaz Systems SigPlus Pro ActiveX Control 3.95, and possibly other versions before 4.29, allow remote attackers to execute arbitrary code via a long (1) KeyString property, (2) NewPath parameter to the SetLocalIniFilePath method, or (3)…

  • CVE-2011-0323Feb 7, 2011
    Topazsystems
    Sigplus Pro Activex Control
    risk 0.00cvss —epss 0.05

    Topaz Systems SigPlus Pro ActiveX Control 3.95, and possibly other versions before 4.29, allows remote attackers to execute arbitrary code by calling the exposed unsafe (1) SetLogFilePath and (2) SigMessage methods to create arbitrary files with arbitrary content.

  • CVE-2010-4506Feb 7, 2011
    Passlogix
    v-GO Self-Service Password Reset (SSPR)
    risk 0.00cvss —epss 0.01

    Passlogix v-GO Self-Service Password Reset (SSPR) and OEM before 7.0A allows physically proximate attackers to execute arbitrary programs without authentication by triggering use of an invalid SSL certificate and using the Internet Explorer interface to navigate through the…

  • CVE-2011-0025Feb 4, 2011
    IcedTea
    IcedTea6
    risk 0.00cvss —epss 0.03

    IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a…

  • CVE-2011-0784Feb 4, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Race condition in Google Chrome before 9.0.597.84 allows remote attackers to execute arbitrary code via vectors related to audio.

  • CVE-2011-0783Feb 4, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Google Chrome before 9.0.597.84 allows user-assisted remote attackers to cause a denial of service (application crash) via vectors involving a "bad volume setting."

  • CVE-2011-0782Feb 4, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 9.0.597.84 on Mac OS X does not properly mitigate an unspecified flaw in the Mac OS X 10.5 SSL libraries, which allows remote attackers to cause a denial of service (application crash) via unknown vectors.

  • CVE-2011-0781Feb 4, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 9.0.597.84 does not properly handle autofill profile merging, which has unspecified impact and remote attack vectors.

  • CVE-2011-0780Feb 4, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The PDF event handler in Google Chrome before 9.0.597.84 does not properly interact with print operations, which allows user-assisted remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-0779Feb 4, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 9.0.597.84 does not properly handle a missing key in an extension, which allows remote attackers to cause a denial of service (application crash) via a crafted extension.

  • CVE-2011-0778Feb 4, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 9.0.597.84 does not properly restrict drag and drop operations, which might allow remote attackers to bypass the Same Origin Policy via unspecified vectors.

  • CVE-2011-0777Feb 4, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 9.0.597.84 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to image loading.

  • CVE-2011-0776Feb 4, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The sandbox implementation in Google Chrome before 9.0.597.84 on Mac OS X might allow remote attackers to obtain potentially sensitive information about local files via vectors related to the stat system call.

  • CVE-2011-0775Feb 4, 2011
    Pivotx
    Pivotx
    risk 0.00cvss —epss 0.01

    pivotx/modules/module_image.php in PivotX 2.2.2 allows remote attackers to obtain sensitive information via a non-existent file in the image parameter, which reveals the installation path in an error message. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2011-0774Feb 4, 2011
    Pivotx
    Pivotx
    risk 0.00cvss —epss 0.01

    PivotX before 2.2.2 allows remote attackers to obtain sensitive information via a direct request to (1) includes/ping.php and (2) includes/spamping.php, which reveals the installation path in an error message.

  • CVE-2011-0773Feb 4, 2011
    Pivotx
    Pivotx
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in pivotx/modules/module_image.php in PivotX before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the image parameter.

  • CVE-2011-0772Feb 4, 2011
    Pivotx
    Pivotx
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in PivotX 2.2.0, and possibly other versions before 2.2.2, allow remote attackers to inject arbitrary web script or HTML via the (1) color parameter to includes/blogroll.php or (2) src parameter to includes/timwrapper.php.

  • CVE-2011-0771Feb 4, 2011
    Janrain
    Rpx
    risk 0.00cvss —epss 0.02

    The Janrain Engage (formerly RPX) module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks and possibly execute arbitrary PHP code by causing a crafted avatar to be downloaded…

  • CVE-2011-0649Feb 4, 2011
    TIBCO Software
    Runtime Agent
    risk 0.00cvss —epss 0.00

    Multiple unspecified vulnerabilities in TIBCO Rendezvous 8.2.1 through 8.3.0, Enterprise Message Service (EMS) 5.1.0 through 6.0.0, Runtime Agent (TRA) 5.6.2 through 5.7.0, Silver BPM Service before 1.0.4, Silver CAP Service vebefore 1.0.2, and Silver BusinessWorks Service…

  • CVE-2011-0537Feb 4, 2011
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.03

    Multiple directory traversal vulnerabilities in (1) languages/Language.php and (2) includes/StubObject.php in MediaWiki 1.8.0 and other versions before 1.16.2, when running on Windows and possibly Novell Netware, allow remote attackers to include and execute arbitrary local PHP…

  • CVE-2011-0049Feb 4, 2011
    Great Circle Associates
    Majordomo
    risk 0.11cvss —epss 0.95

    Directory traversal vulnerability in the _list_file_get function in lib/Majordomo.pm in Majordomo 2 before 20110131 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the help command, as demonstrated using (1) a crafted email and (2) cgi-bin/mj_wwwusr…

  • CVE-2011-0047Feb 4, 2011
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.2 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) comments, aka "CSS injection vulnerability."

  • CVE-2004-0694Feb 4, 2011
    LHA
    LHA
    risk 0.00cvss —epss 0.03

    Buffer overflow in LHA 1.14 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to "command line processing," a different vulnerability than CVE-2004-0771. NOTE: this issue may be REJECTED if…

  • CVE-2011-0720Feb 3, 2011
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.

  • CVE-2010-4727Feb 3, 2011
    Smarty
    Smarty
    risk 0.00cvss —epss 0.02

    Smarty before 3.0.0 beta 7 does not properly handle the <?php and ?> tags, which has unspecified impact and remote attack vectors.

  • CVE-2010-4726Feb 3, 2011
    Smarty
    Smarty
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the math plugin in Smarty before 3.0.0 RC1 has unknown impact and remote attack vectors. NOTE: this might overlap CVE-2009-1669.

  • CVE-2010-4725Feb 3, 2011
    Smarty
    Smarty
    risk 0.00cvss —epss 0.02

    Smarty before 3.0.0 RC3 does not properly handle an on value of the asp_tags option in the php.ini file, which has unspecified impact and remote attack vectors.

  • CVE-2010-4724Feb 3, 2011
    Smarty
    Smarty
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in the parser implementation in Smarty before 3.0.0 RC3 have unknown impact and remote attack vectors.

  • CVE-2010-4723Feb 3, 2011
    Smarty
    Smarty
    risk 0.00cvss —epss 0.02

    Smarty before 3.0.0, when security is enabled, does not prevent access to the (1) dynamic and (2) private object members of an assigned object, which has unspecified impact and remote attack vectors.

  • CVE-2010-4722Feb 3, 2011
    Smarty
    Smarty
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the fetch plugin in Smarty before 3.0.2 has unknown impact and remote attack vectors.

  • CVE-2009-5054Feb 3, 2011
    Smarty
    Smarty
    risk 0.00cvss —epss 0.02

    Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.

  • CVE-2009-5053Feb 3, 2011
    Smarty
    Smarty
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Smarty before 3.0.0 beta 6 allows remote attackers to execute arbitrary PHP code by injecting this code into a cache file.

  • CVE-2009-5052Feb 3, 2011
    Smarty
    Smarty
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Smarty before 3.0.0 beta 6 have unknown impact and attack vectors.

  • CVE-2011-0451Feb 3, 2011
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in (1) data/Smarty/templates/default/list.tpl and (2) data/Smarty/templates/default/campaign/bloc/cart_tag.tpl in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-0354Feb 3, 2011
    Cisco Systems, Inc.
    Tandberg C Series Endpoints
    risk 0.04cvss —epss 0.14

    The default configuration of Cisco Tandberg C Series Endpoints, and Tandberg E and EX Personal Video units, with software before TC4.0.0 has a blank password for the root account, which makes it easier for remote attackers to obtain access via an unspecified login method.

  • CVE-2011-0757Feb 2, 2011
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    IBM DB2 9.1 before FP10, 9.5 before FP6a, and 9.7 before FP2 on Linux, UNIX, and Windows does not properly revoke the DBADM authority, which allows remote authenticated users to execute non-DDL statements by leveraging previous possession of this authority.

  • CVE-2011-0521Feb 2, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel before 2.6.38-rc2 does not check the sign of a certain integer field, which allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a…