VYPR

CVEs

346,118 total · page 6025 of 6,923

AllCriticalHighKEV
  • CVE-2010-3270Feb 2, 2011
    Cisco Systems, Inc.
    Webex Meeting Center
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in Cisco WebEx Meeting Center T27LB before SP21 EP3 and T27LC before SP22 allows user-assisted remote authenticated users to execute arbitrary code by providing a crafted .atp file and then disconnecting from a meeting. NOTE: since this is a…

  • CVE-2010-3269Feb 2, 2011
    Cisco Systems, Inc.
    Webex Recording Format Player
    risk 0.01cvss —epss 0.11

    Multiple stack-based buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to execute arbitrary code via a crafted (1) .wrf or (2) .arf file, related to use of a…

  • CVE-2010-3044Feb 2, 2011
    Cisco Systems, Inc.
    Webex Recording Format Player
    risk 0.00cvss —epss 0.06

    Multiple buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted…

  • CVE-2010-3043Feb 2, 2011
    Cisco Systems, Inc.
    Webex Recording Format Player
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted…

  • CVE-2010-3042Feb 2, 2011
    Cisco Systems, Inc.
    Webex Recording Format Player
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted…

  • CVE-2010-3041Feb 2, 2011
    Cisco Systems, Inc.
    Webex Recording Format Player
    risk 0.00cvss —epss 0.06

    Multiple buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted…

  • CVE-2011-0755Feb 2, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    Integer overflow in the mt_rand function in PHP before 5.3.4 might make it easier for context-dependent attackers to predict the return values by leveraging a script's use of a large max parameter, as demonstrated by a value that exceeds mt_getrandmax.

  • CVE-2011-0754Feb 2, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.00

    The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross-platform differences in the stat…

  • CVE-2011-0753Feb 2, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    Race condition in the PCNTL extension in PHP before 5.3.4, when a user-defined signal handler exists, might allow context-dependent attackers to cause a denial of service (memory corruption) via a large number of concurrent signals.

  • CVE-2011-0752Feb 2, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The extract function in PHP before 5.2.15 does not prevent use of the EXTR_OVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures…

  • CVE-2011-0742Feb 2, 2011
    Novell
    Zenworks Handheld Management
    risk 0.01cvss —epss 0.09

    Buffer overflow in ZfHIPCND.exe in Novell ZENworks Handheld Management 7.0 allows remote attackers to execute arbitrary code via a crafted IP Conduit packet to TCP port 2400.

  • CVE-2011-0741Feb 2, 2011
    Modxcms
    Evolution
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ModX Evolution before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) installer or (2) image editor.

  • CVE-2011-0740Feb 2, 2011
    Pleer
    Rss Feed Reader
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in RSS Feed Reader 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter.

  • CVE-2011-0739Feb 2, 2011
    Mikel Lindsaar
    Mail
    risk 0.00cvss —epss 0.03

    The deliver function in the sendmail delivery agent (lib/mail/network/delivery_methods/sendmail.rb) in Ruby Mail gem 2.2.14 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address.

  • CVE-2011-0738Feb 2, 2011
    Globus
    Toolkit
    risk 0.00cvss —epss 0.02

    MyProxy 5.0 through 5.2, as used in Globus Toolkit 5.0.0 through 5.0.2, does not properly verify the (1) hostname or (2) identity in the X.509 certificate for the myproxy-server, which allows remote attackers to spoof the server and conduct man-in-the-middle (MITM) attacks via a…

  • CVE-2011-0276Feb 2, 2011
    Microfocus
    Performance Insight
    risk 0.10cvss —epss 0.82

    HP OpenView Performance Insight Server 5.2, 5.3, 5.31, 5.4, and 5.41 contains a "hidden account" in the com.trinagy.security.XMLUserManager Java class, which allows remote attackers to execute arbitrary code via the doPost method in the com.trinagy.servlet.HelpManagerServlet…

  • CVE-2011-0017Feb 2, 2011
    Exim
    Exim
    risk 0.00cvss —epss 0.00

    The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.

  • CVE-2010-4652Feb 2, 2011
    Proftpd
    Proftpd
    risk 0.01cvss —epss 0.11

    Heap-based buffer overflow in the sql_prepare_where function (contrib/mod_sql.c) in ProFTPD before 1.3.3d, when mod_sql is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted username containing substitution…

  • CVE-2010-4015Feb 2, 2011
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.05

    Buffer overflow in the gettoken function in contrib/intarray/_int_bool.c in the intarray array module in PostgreSQL 9.0.x before 9.0.3, 8.4.x before 8.4.7, 8.3.x before 8.3.14, and 8.2.x before 8.2.20 allows remote authenticated users to cause a denial of service (crash) and…

  • CVE-2010-3930Feb 2, 2011
    Modxcms
    Evolution
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to read arbitrary files via unspecified vectors related to AjaxSearch, a different vulnerability than CVE-2010-1427.

  • CVE-2010-3929Feb 2, 2011
    Modx
    MODX
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to AjaxSearch.

  • CVE-2010-3854Feb 2, 2011
    Apache
    Couchdb
    risk 0.00cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-3719Feb 2, 2011
    Symantec
    Im Manager
    risk 0.01cvss —epss 0.13

    Eval injection vulnerability in IMAdminSchedTask.asp in the administrative interface for Symantec IM Manager 8.4.16 and earlier allows remote attackers to execute arbitrary code via unspecified parameters to the ScheduleTask method.

  • CVE-2010-4721Feb 1, 2011
    Immo Makler
    Immo Makler
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in news.php in Immo Makler allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-4720Feb 1, 2011
    Jextensions
    JE Auto
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the JExtensions JE Auto (com_jeauto) component before 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to the view item page.

  • CVE-2010-4719Feb 1, 2011
    Joomla
    JRadio
    risk 0.04cvss —epss 0.16

    Directory traversal vulnerability in JRadio (com_jradio) component before 1.5.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.

  • CVE-2010-4718Feb 1, 2011
    Joomla
    Lyftenbloggie
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Lyftenbloggie (com_lyftenbloggie) component 1.1.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) tag and (2) category parameters to index.php.

  • CVE-2011-0737MedFeb 1, 2011
    Adobe Inc.
    Coldfusion
    risk 0.35cvss 5.3epss 0.03

    Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message. NOTE: the vendor disputes the significance of this issue because the Site-wide Error…

  • CVE-2011-0736MedFeb 1, 2011
    Adobe Inc.
    Coldfusion
    risk 0.35cvss 5.3epss 0.03

    Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file. NOTE: the vendor disputes the significance of this…

  • CVE-2011-0735Feb 1, 2011
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via vectors involving a "tag script."

  • CVE-2011-0734Feb 1, 2011
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element, related to a "tag body" attack. NOTE: this was…

  • CVE-2011-0733Feb 1, 2011
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header in an id=- query to a .cfm file.

  • CVE-2011-0732Feb 1, 2011
    IBM
    Tivoli Integrated Portal
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in IBM Tivoli Integrated Portal (TIP) 1.1.1.1, as used in IBM Tivoli Common Reporting (TCR) 1.2.0 before Interim Fix 9, have unknown impact and attack vectors, related to "security vulnerabilities of Websphere Application Server bundled…

  • CVE-2011-0731Feb 1, 2011
    IBM
    Db2
    risk 0.00cvss —epss 0.04

    Buffer overflow in the DB2 Administration Server (DAS) component in IBM DB2 9.1 before FP10, 9.5 before FP7, and 9.7 before FP3 on Linux, UNIX, and Windows allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2011-0321Feb 1, 2011
    EMC Corporation
    Networker
    risk 0.00cvss —epss 0.03

    librpc.dll in nsrexecd in EMC NetWorker before 7.5 SP4, 7.5.3.x before 7.5.3.5, and 7.6.x before 7.6.1.2 does not properly mitigate the possibility of a spoofed localhost source IP address, which allows remote attackers to (1) register or (2) unregister RPC services, and…

  • CVE-2011-0688Jan 31, 2011
    Symantec
    System Center
    risk 0.00cvss —epss 0.04

    Intel Alert Management System (aka AMS or AMS2), as used in Symantec Antivirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec Quarantine Server 3.5 and 3.6, allows remote attackers to execute arbitrary commands via crafted…

  • CVE-2011-0687Jan 31, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 11.01 does not properly implement Wireless Application Protocol (WAP) dropdown lists, which allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted WAP document.

  • CVE-2011-0686Jan 31, 2011
    Opera
    Opera Browser
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Opera before 11.01 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by vkontakte.ru.

  • CVE-2011-0685Jan 31, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.00

    The Delete Private Data feature in Opera before 11.01 does not properly implement the "Clear all email account passwords" option, which might allow physically proximate attackers to access an e-mail account via an unattended workstation.

  • CVE-2011-0684Jan 31, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 11.01 does not properly handle redirections and unspecified other HTTP responses, which allows remote web servers to obtain sufficient access to local files to use these files as page resources, and consequently obtain potentially sensitive information from the…

  • CVE-2011-0683Jan 31, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 11.01 does not properly restrict the use of opera: URLs, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

  • CVE-2011-0682Jan 31, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.06

    Integer truncation error in opera.dll in Opera before 11.01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTML form with a select element that contains a large number of children.

  • CVE-2011-0681Jan 31, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    The Cascading Style Sheets (CSS) Extensions for XML implementation in Opera before 11.01 recognizes links to javascript: URLs in the -o-link property, which makes it easier for remote attackers to bypass CSS filtering via a crafted URL.

  • CVE-2011-0413Jan 31, 2011
    Isc
    DHCP
    risk 0.03cvss —epss 0.33

    The DHCPv6 server in ISC DHCP 4.0.x and 4.1.x before 4.1.2-P1, 4.0-ESV and 4.1-ESV before 4.1-ESV-R1, and 4.2.x before 4.2.1b1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) by sending a message over IPv6 for a declined and abandoned…

  • CVE-2010-4393Jan 31, 2011
    RealNetworks
    Realplayer
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in vidplin.dll in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.x before 14.0.2, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via a crafted header in an AVI file.

  • CVE-2010-0111Jan 31, 2011
    Symantec
    System Center
    risk 0.06cvss —epss 0.35

    HDNLRSVC.EXE in the Intel Alert Handler service (aka Symantec Intel Handler service) in Intel Alert Management System (aka AMS or AMS2), as used in Symantec AntiVirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec Quarantine…

  • CVE-2010-0110Jan 31, 2011
    Symantec
    System Center
    risk 0.00cvss —epss 0.05

    Multiple stack-based buffer overflows in Intel Alert Management System (aka AMS or AMS2), as used in Symantec AntiVirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec Quarantine Server 3.5 and 3.6, allow remote attackers to…

  • CVE-2011-0680Jan 31, 2011
    Google
    Android
    risk 0.00cvss —epss 0.02

    data/WorkingMessage.java in the Mms application in Android before 2.2.2 and 2.3.x before 2.3.2 does not properly manage the draft cache, which allows remote attackers to read SMS messages intended for other recipients in opportunistic circumstances via a standard text messaging…

  • CVE-2011-0450Jan 31, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.05

    The downloads manager in Opera before 11.01 on Windows does not properly determine the pathname of the filesystem-viewing application, which allows user-assisted remote attackers to execute arbitrary code via a crafted web site that hosts an executable file.

  • CVE-2011-0096MedJan 31, 2011
    Microsoft
    Windows
    risk 0.46cvss 6.1epss 0.47

    The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for content blocks in a document,…