VYPR

CVEs

346,118 total · page 6026 of 6,923

AllCriticalHighKEV
  • CVE-2010-4717Jan 31, 2011
    Novell
    Groupwise
    risk 0.04cvss —epss 0.10

    Multiple stack-based buffer overflows in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a long (1) LIST or (2) LSUB command.

  • CVE-2010-4716Jan 31, 2011
    Novell
    Groupwise
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the WebPublisher component in Novell GroupWise before 8.02HP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-4715Jan 31, 2011
    Novell
    Groupwise
    risk 0.05cvss —epss 0.28

    Multiple directory traversal vulnerabilities in the (1) WebAccess Agent and (2) Document Viewer Agent components in Novell GroupWise before 8.02HP allow remote attackers to read arbitrary files via unspecified vectors. NOTE: some of these details are obtained from third party…

  • CVE-2010-4714Jan 31, 2011
    Novell
    Groupwise
    risk 0.00cvss —epss 0.06

    Multiple stack-based buffer overflows in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a long HTTP Host header to (1) gwpoa.exe in the Post Office Agent, (2) gwmta.exe in the Message Transfer Agent, (3) gwia.exe in the Internet Agent, (4)…

  • CVE-2010-4713Jan 31, 2011
    Novell
    Groupwise
    risk 0.00cvss —epss 0.06

    Integer signedness error in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allows remote attackers to execute arbitrary code via a signed integer value in the Content-Type header.

  • CVE-2010-4712Jan 31, 2011
    Novell
    Groupwise
    risk 0.01cvss —epss 0.07

    Multiple stack-based buffer overflows in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a Content-Type header containing (1) multiple items separated by ; (semicolon) characters or (2) crafted…

  • CVE-2010-4711Jan 31, 2011
    Novell
    Groupwise
    risk 0.04cvss —epss 0.14

    Double free vulnerability in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allows remote attackers to execute arbitrary code via a large parameter in a LIST command.

  • CVE-2011-0350Jan 28, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Cisco IOS 12.4(24)MD before 12.4(24)MD2 on the Cisco Content Services Gateway Second Generation (aka CSG2) allows remote attackers to cause a denial of service (device hang or reload) via crafted TCP packets, aka Bug ID CSCth41891, a different…

  • CVE-2011-0349Jan 28, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Cisco IOS 12.4(24)MD before 12.4(24)MD2 on the Cisco Content Services Gateway Second Generation (aka CSG2) allows remote attackers to cause a denial of service (device hang or reload) via crafted TCP packets, aka Bug ID CSCth17178, a different…

  • CVE-2011-0348Jan 28, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.4(11)MD, 12.4(15)MD, 12.4(22)MD, 12.4(24)MD before 12.4(24)MD3, 12.4(22)MDA before 12.4(22)MDA5, and 12.4(24)MDA before 12.4(24)MDA3 on the Cisco Content Services Gateway Second Generation (aka CSG2) allows remote attackers to bypass intended access restrictions and…

  • CVE-2010-4643Jan 28, 2011
    Openoffice
    Openoffice
    risk 0.01cvss —epss 0.10

    Heap-based buffer overflow in Impress in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file in an ODF or Microsoft Office document.

  • CVE-2010-4253Jan 28, 2011
    Openoffice
    Openoffice
    risk 0.01cvss —epss 0.10

    Heap-based buffer overflow in Impress in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file in an ODF or Microsoft Office document, as demonstrated by a…

  • CVE-2010-3689Jan 28, 2011
    Openoffice
    Openoffice
    risk 0.00cvss —epss 0.01

    soffice in OpenOffice.org (OOo) 3.x before 3.3 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

  • CVE-2010-3454Jan 28, 2011
    Openoffice
    Openoffice
    risk 0.01cvss —epss 0.10

    Multiple off-by-one errors in the WW8DopTypography::ReadFromMem function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted typography information in a…

  • CVE-2010-3453Jan 28, 2011
    Openoffice
    Openoffice
    risk 0.01cvss —epss 0.10

    The WW8ListManager::WW8ListManager function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle an unspecified number of list levels in user-defined list styles in WW8 data in a Microsoft Word document, which allows remote attackers to cause a…

  • CVE-2010-3452Jan 28, 2011
    Openoffice
    Openoffice
    risk 0.01cvss —epss 0.10

    Use-after-free vulnerability in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted tags in an RTF document.

  • CVE-2010-3451Jan 28, 2011
    Openoffice
    Openoffice
    risk 0.01cvss —epss 0.10

    Use-after-free vulnerability in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via malformed tables in an RTF document.

  • CVE-2010-3450Jan 28, 2011
    Openoffice
    Openoffice
    risk 0.01cvss —epss 0.11

    Multiple directory traversal vulnerabilities in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to overwrite arbitrary files via a .. (dot dot) in an entry in (1) an XSLT JAR filter description file, (2) an Extension (aka OXT) file, or unspecified other (3)…

  • CVE-2010-2779Jan 28, 2011
    Novell
    Groupwise
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in WebAccess in Novell GroupWise 8.x before 8.0 SP2 allows remote attackers to inject arbitrary web script or HTML via a crafted message, related to "replies."

  • CVE-2010-2778Jan 28, 2011
    Novell
    Groupwise
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in WebAccess in Novell GroupWise 7.x before 7.0 post-SP4 FTF and 8.x before 8.0 SP2 allows remote attackers to inject arbitrary web script or HTML via a crafted message, related to a "Javascript XSS exploit."

  • CVE-2010-2777Jan 28, 2011
    Novell
    Groupwise
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise 7.x before 7.0 post-SP4 FTF and 8.x before 8.0 SP2 allows remote attackers to execute arbitrary code via a long mailbox name in a CREATE command.

  • CVE-2011-0679Jan 28, 2011
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.04

    IBM WebSphere Portal 6.0.1.1 through 7.0.0.0, as used in IBM Lotus Web Content Management (WCM) and IBM Lotus Quickr for WebSphere Portal, allows remote attackers to obtain sensitive information via a "modified message."

  • CVE-2011-0678Jan 28, 2011
    Lomtec
    Activeweb
    risk 0.04cvss —epss 0.09

    Unrestricted file upload vulnerability in the EasyEdit module in Lomtec ActiveWeb Professional 3.0 allows remote attackers to execute arbitrary code by uploading an executable file via the UploadDirectory and Accepted Extensions fields in the getImagefile component of…

  • CVE-2011-0275Jan 28, 2011
    Microfocus
    Storage Data Protector
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in HP OpenView Storage Data Protector 6.0, 6.10, and 6.11 allows remote attackers to cause a denial of service via unknown vectors.

  • CVE-2010-4710Jan 28, 2011
    Yahoo
    Yui
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the addItem method in the Menu widget in YUI before 2.9.0 allows remote attackers to inject arbitrary web script or HTML via a field that is added to a menu, related to documentation that specifies this field as a text field rather…

  • CVE-2010-4326Jan 28, 2011
    Novell
    Groupwise
    risk 0.01cvss —epss 0.10

    Multiple buffer overflows in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via variables in a VCALENDAR message, as demonstrated by a long (1) REQUEST-STATUS, (2) TZNAME, (3) COMMENT, or (4) RRULE…

  • CVE-2010-4325Jan 28, 2011
    Novell
    Groupwise
    risk 0.01cvss —epss 0.10

    Buffer overflow in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP2 allows remote attackers to execute arbitrary code via a crafted TZID variable in a VCALENDAR message.

  • CVE-2011-0652Jan 28, 2011
    Looknstop
    Look \'n\' Stop Firewall
    risk 0.03cvss —epss 0.01

    lnsfw1.sys 6.0.2900.5512 in Look 'n' Stop Firewall 2.06p4 and 2.07 allows local users to cause a denial of service (crash) via a crafted 0x80000064 IOCTL request that triggers an assertion failure. NOTE: some of these details are obtained from third party information.

  • CVE-2011-0651Jan 28, 2011
    Icon Labs
    Iconfidant SSL Server
    risk 0.00cvss —epss 0.05

    Buffer overflow in the key exchange functionality in Icon Labs Iconfidant SSL Server before 1.3.0 allows remote attackers to execute arbitrary code via a client master key packet in which the sum of unspecified length fields is greater than a certain value.

  • CVE-2011-0650Jan 28, 2011
    Greenbone
    Greenbone Security Assistant
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Greenbone Security Assistant (GSA) before 2.0+rc3 allows remote attackers to hijack the authentication of users for requests that send email via an OMP request to OpenVAS Manager. NOTE: this issue can be leveraged to bypass…

  • CVE-2011-0520Jan 28, 2011
    Maradns
    Maradns
    risk 0.00cvss —epss 0.05

    The compress_add_dlabel_points function in dns/Compress.c in MaraDNS 1.4.03, 1.4.05, and probably other versions allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long DNS hostname with a large number of labels,…

  • CVE-2011-0343Jan 28, 2011
    Oneidentity
    Syslog Ng
    risk 0.00cvss —epss 0.00

    Balabit syslog-ng 2.0, 3.0, 3.1, 3.2 OSE and PE, when running on FreeBSD or HP-UX, does not properly perform cast operations, which causes syslog-ng to use a default value of -1 to create log files with insecure permissions (07777), which allows local users to read and write to…

  • CVE-2011-0048Jan 28, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates a clickable link for a (1) javascript: or (2) data: URI in the URL (aka bug_file_loc) field, which allows remote attackers to conduct cross-site scripting (XSS) attacks against…

  • CVE-2011-0046Jan 28, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow remote attackers to hijack the authentication of arbitrary users for requests related to (1) adding a saved search in…

  • CVE-2011-0018Jan 28, 2011
    Openvas
    Manager
    risk 0.04cvss —epss 0.09

    The email function in manage_sql.c in OpenVAS Manager 1.0.x through 1.0.3 and 2.0.x through 2.0rc2 allows remote authenticated users to execute arbitrary commands via the (1) To or (2) From e-mail address in an OMP request to the Greenbone Security Assistant (GSA).

  • CVE-2010-4709Jan 28, 2011
    Automatedsolutions
    Modbus\/TCP Master Opc Server
    risk 0.04cvss —epss 0.16

    Heap-based buffer overflow in Automated Solutions Modbus/TCP Master OPC Server before 3.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a MODBUS response packet with a crafted length field.

  • CVE-2010-4572Jan 28, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in chart.cgi in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the query string, a different…

  • CVE-2010-4570Jan 28, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the duplicate-detection functionality in Bugzilla 3.7.1, 3.7.2, 3.7.3, and 4.0rc1 allows remote attackers to inject arbitrary web script or HTML via the summary field, related to the DataTable widget in YUI.

  • CVE-2010-4569Jan 28, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Bugzilla 3.7.1, 3.7.2, 3.7.3, and 4.0rc1 allows remote attackers to inject arbitrary web script or HTML via the real name field of a user account, related to the AutoComplete widget in YUI.

  • CVE-2010-4568Jan 28, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.03

    Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via…

  • CVE-2010-4567Jan 28, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 does not properly handle whitespace preceding a (1) javascript: or (2) data: URI, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the URL (aka bug_file_loc)…

  • CVE-2011-0646Jan 25, 2011
    PHP LOW BIDS
    PHP LOW BIDS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in viewfaqs.php in PHP LOW BIDS allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2011-0645Jan 25, 2011
    Phpcms
    Phpcms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in data.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the where_time parameter in a get action.

  • CVE-2011-0644Jan 25, 2011
    Phpcms
    Phpcms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in include/admin/model_field.class.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the modelid parameter to flash_upload.php.

  • CVE-2011-0643Jan 25, 2011
    PHP Link Directory
    PHP Link Directory
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin/conf_users_edit.php in PHP Link Directory (phpLD) 4.1.0 allows remote attackers to hijack the authentication of administrators for requests that add an administrator via the N action.

  • CVE-2011-0642Jan 25, 2011
    N 13
    News
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in news/admin.php in N-13 News 3.4, 3.7, and 4.0 allows remote attackers to hijack the authentication of administrators for requests that create new users via the options action. NOTE: some of these details are obtained from third…

  • CVE-2011-0641Jan 25, 2011
    WordPress
    Statpresscn
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) what1, (2) what2, (3) what3, (4) what4, and (5) what5 parameters. NOTE: the…

  • CVE-2011-0021Jan 25, 2011
    VideoLAN
    VLC media player
    risk 0.00cvss —epss 0.06

    Multiple heap-based buffer overflows in cdg.c in the CDG decoder in VideoLAN VLC Media Player before 1.1.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted CDG video.

  • CVE-2011-0009Jan 25, 2011
    Bestpractical
    Rt
    risk 0.00cvss —epss 0.02

    Best Practical Solutions RT 3.x before 3.8.9rc2 and 4.x before 4.0.0rc4 uses the MD5 algorithm for password hashes, which makes it easier for context-dependent attackers to determine cleartext passwords via a brute-force attack on the database.

  • CVE-2010-4256Jan 25, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The pipe_fcntl function in fs/pipe.c in the Linux kernel before 2.6.37 does not properly determine whether a file is a named pipe, which allows local users to cause a denial of service via an F_SETPIPE_SZ fcntl call.