VYPR

CVEs

346,117 total · page 6031 of 6,923

AllCriticalHighKEV
  • CVE-2010-4537Jan 13, 2011
    Crawltrack
    Crawltrack
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in CrawlTrack before 3.2.7, when a public stats page is provided, allows remote attackers to execute arbitrary PHP code via unknown vectors.

  • CVE-2010-4529Jan 13, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Integer underflow in the irda_getsockopt function in net/irda/af_irda.c in the Linux kernel before 2.6.37 on platforms other than x86 allows local users to obtain potentially sensitive information from kernel heap memory via an IRLMP_ENUMDEVICES getsockopt call.

  • CVE-2010-4527Jan 13, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The load_mixer_volumes function in sound/oss/soundcard.c in the OSS sound subsystem in the Linux kernel before 2.6.37 incorrectly expects that a certain name field ends with a '\0' character, which allows local users to conduct buffer overflow attacks and gain privileges, or…

  • CVE-2010-4052Jan 13, 2011
    GNU
    Glibc
    risk 0.07cvss —epss 0.51

    Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent…

  • CVE-2010-4051Jan 13, 2011
    GNU
    Glibc
    risk 0.06cvss —epss 0.40

    The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the…

  • CVE-2010-3925Jan 13, 2011
    Wb I
    Contents Mall
    risk 0.00cvss —epss 0.01

    Contents-Mall before 15 does not properly handle passwords, which allows remote attackers to discover the administrative password, and consequently obtain sensitive information or modify data, via unspecified vectors.

  • CVE-2010-3924Jan 13, 2011
    Aimluck
    Aipo
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Aimluck Aipo before 5.1.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-7271Jan 13, 2011
    Eclipse
    Eclipse Ide
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE, possibly 3.3.2, allow remote attackers to inject arbitrary web script or HTML via (1) the searchWord parameter to help/advanced/searchView.jsp or (2)…

  • CVE-2011-0445Jan 13, 2011
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The ASN.1 BER dissector in Wireshark 1.4.0 through 1.4.2 allows remote attackers to cause a denial of service (assertion failure) via crafted packets, as demonstrated by fuzz-2010-12-30-28473.pcap.

  • CVE-2011-0444Jan 13, 2011
    Wireshark
    Wireshark
    risk 0.01cvss —epss 0.07

    Buffer overflow in the MAC-LTE dissector (epan/dissectors/packet-mac-lte.c) in Wireshark 1.2.0 through 1.2.13 and 1.4.0 through 1.4.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of RARs.

  • CVE-2011-0443Jan 13, 2011
    Tinybb
    Tinybb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in inc/tinybb-settings.php in tinyBB 1.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action to index.php. NOTE: some of these details are obtained from third party…

  • CVE-2010-3912Jan 13, 2011
    Novell
    Suse Linux
    risk 0.00cvss —epss 0.02

    The supportconfig script in supportutils in SUSE Linux Enterprise 11 SP1 and 10 SP3 does not "disguise passwords" in configuration files, which has unknown impact and attack vectors.

  • CVE-2010-2604Jan 13, 2011
    Rim
    Blackberry Enterprise Server
    risk 0.00cvss —epss 0.06

    Multiple buffer overflows in the PDF Distiller in the BlackBerry Attachment Service component in Research In Motion (RIM) BlackBerry Enterprise Server 4.1.3 through 5.0.2, and Enterprise Server Express 5.0.1 and 5.0.2, allow remote attackers to execute arbitrary code via a…

  • CVE-2010-2599Jan 13, 2011
    Rim
    Blackberry Device Software
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Research In Motion (RIM) BlackBerry Device Software before 6.0.0 allows remote attackers to cause a denial of service (browser hang) via a crafted web page.

  • CVE-2011-0423Jan 12, 2011
    Polyvision
    Roomwizard
    risk 0.00cvss —epss 0.02

    The PolyVision RoomWizard with firmware 3.2.3 has a default password of roomwizard for the administrator account, which makes it easier for remote attackers to obtain console access via an HTTP session, a different vulnerability than CVE-2010-0214.

  • CVE-2011-0316Jan 12, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    The Administrative Console component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.35 and 7.0 before 7.0.0.15 does not properly restrict access to console servlets, which allows remote attackers to obtain potentially sensitive status information via a direct request.

  • CVE-2011-0315Jan 12, 2011
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Servlet Engine / Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.35 and 7.0 before 7.0.0.15 allows remote attackers to inject arbitrary web script or HTML via vectors related to the lack of an…

  • CVE-2011-0314Jan 12, 2011
    IBM
    Websphere Mq
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in IBM WebSphere MQ 6.0 before 6.0.2.11 and 7.0 before 7.0.1.5 allows remote authenticated users to execute arbitrary code or cause a denial of service (queue manager crash) by inserting an invalid message into the queue.

  • CVE-2011-0027Jan 12, 2011
    Microsoft
    Data Access Components
    risk 0.07cvss —epss 0.54

    Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, does not properly validate memory allocation for internal data structures, which allows remote attackers to execute arbitrary code, possibly via a large CacheSize property…

  • CVE-2011-0026Jan 12, 2011
    Microsoft
    Data Access Components
    risk 0.03cvss —epss 0.34

    Integer signedness error in the SQLConnectW function in an ODBC API (odbc32.dll) in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, allows remote attackers to execute arbitrary code via a long string in the Data Source Name…

  • CVE-2010-3926Jan 12, 2011
    Wb I
    Sgx Sp Final Ne
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Shop.cgi in SGX-SP Final before 11.00 and SGX-SP Final NE before 11.00 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0214Jan 12, 2011
    Polyvision
    Roomwizard
    risk 0.00cvss —epss 0.02

    The administrative interface on the PolyVision RoomWizard with firmware 3.2.3 places the Sync Connector Active Directory (AD) credentials in a web form that is accessed over HTTP on port 80, which allows remote attackers to obtain sensitive information by reading the HTML source…

  • CVE-2010-3683Jan 11, 2011
    MySQL
    MySQL
    risk 0.04cvss —epss 0.12

    Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 sends an OK packet when a LOAD DATA INFILE request generates SQL errors, which allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a crafted request.

  • CVE-2010-3682Jan 11, 2011
    MySQL
    MySQL
    risk 0.04cvss —epss 0.11

    Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using EXPLAIN with crafted "SELECT ... UNION ... ORDER BY (SELECT ... WHERE ...)" statements, which triggers a NULL pointer dereference in…

  • CVE-2010-3681Jan 11, 2011
    MySQL
    MySQL
    risk 0.04cvss —epss 0.12

    Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using the HANDLER interface and performing "alternate reads from two indexes on a table," which triggers an assertion failure.

  • CVE-2010-3680Jan 11, 2011
    MySQL
    MySQL
    risk 0.04cvss —epss 0.12

    Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by creating temporary tables with nullable columns while using InnoDB, which triggers an assertion failure.

  • CVE-2010-3679Jan 11, 2011
    MySQL
    MySQL
    risk 0.04cvss —epss 0.12

    Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via certain arguments to the BINLOG command, which triggers an access of uninitialized memory, as demonstrated by valgrind.

  • CVE-2010-3678Jan 11, 2011
    MySQL
    MySQL
    risk 0.04cvss —epss 0.12

    Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (crash) via (1) IN or (2) CASE operations with NULL arguments that are explicitly specified or indirectly provided by the WITH ROLLUP modifier.

  • CVE-2010-3677Jan 11, 2011
    MySQL
    MySQL
    risk 0.00cvss —epss 0.02

    Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a join query that uses a table with a unique SET column.

  • CVE-2010-3676Jan 11, 2011
    MySQL
    MySQL
    risk 0.04cvss —epss 0.09

    storage/innobase/dict/dict0crea.c in mysqld in Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (assertion failure) by modifying the (1) innodb_file_format or (2) innodb_file_per_table configuration parameters for the InnoDB storage…

  • CVE-2011-0407Jan 11, 2011
    Phenotype CMS
    Phenotype CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the store function in _phenotype/system/class/PhenoTypeDataObject.class.php in Phenotype CMS 3.0 allows remote attackers to execute arbitrary SQL commands via a crafted URI, as demonstrated by Gallery/gal_id/1/image1,1.html. NOTE: some of these…

  • CVE-2011-0406Jan 11, 2011
    Wellintech
    Kingview
    risk 0.05cvss —epss 0.21

    Heap-based buffer overflow in HistorySvr.exe in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a long request to TCP port 777.

  • CVE-2011-0405Jan 11, 2011
    Phpgedview
    Phpgedview
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in module.php in PhpGedView 4.2.3 and possibly other versions, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the pgvaction parameter.

  • CVE-2011-0404Jan 11, 2011
    Netsupport
    Manager Agent
    risk 0.08cvss —epss 0.65

    Stack-based buffer overflow in NetSupport Manager Agent for Linux 11.00, for Solaris 9.50, and for Mac OS X 11.00 allows remote attackers to execute arbitrary code via a long control hostname to TCP port 5405, probably a different vulnerability than CVE-2007-5252.

  • CVE-2011-0403Jan 11, 2011
    Imgburn
    Imgburn
    risk 0.04cvss —epss 0.07

    Untrusted search path vulnerability in ImgBurn.exe in ImgBurn 2.4.0.0, 2.5.4.0, and other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a…

  • CVE-2011-0402Jan 11, 2011
    Debian
    Dpkg
    risk 0.00cvss —epss 0.03

    dpkg-source in dpkg before 1.14.31 and 1.15.x allows user-assisted remote attackers to modify arbitrary files via a symlink attack on unspecified files in the .pc directory.

  • CVE-2011-0007Jan 11, 2011
    Pimd
    pimd
    risk 0.00cvss —epss 0.00

    pimd 2.1.5 and possibly earlier versions allows user-assisted local users to overwrite arbitrary files via a symlink attack on (1) pimd.dump when a USR1 signal is sent, or (2) pimd.cache when USR2 is sent.

  • CVE-2011-0005Jan 11, 2011
    Joomla
    Com Search
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the com_search module for Joomla! 1.0.x through 1.0.15 allows remote attackers to inject arbitrary web script or HTML via the ordering parameter to index.php.

  • CVE-2011-0003Jan 11, 2011
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    MediaWiki before 1.16.1, when user or site JavaScript or CSS is enabled, allows remote attackers to conduct clickjacking attacks via unspecified vectors.

  • CVE-2010-4693Jan 11, 2011
    Coppermine
    Coppermine Photo Gallery
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Coppermine Photo Gallery 1.5.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) h and (2) t parameters to help.php, or (3) picfile_XXX parameter to searchnew.php.

  • CVE-2010-4645Jan 11, 2011
    PHP
    PHP
    risk 0.04cvss —epss 0.15

    strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other products, allows context-dependent attackers to cause a denial of service (infinite loop) via a certain floating-point value in scientific notation, which is not properly…

  • CVE-2010-4526Jan 11, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    Race condition in the sctp_icmp_proto_unreachable function in net/sctp/input.c in Linux kernel 2.6.11-rc2 through 2.6.33 allows remote attackers to cause a denial of service (panic) via an ICMP unreachable message to a socket that is already locked by a user, which causes the…

  • CVE-2010-4525Jan 11, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Linux kernel 2.6.33 and 2.6.34.y does not initialize the kvm_vcpu_events->interrupt.pad structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via unspecified vectors.

  • CVE-2010-4247Jan 11, 2011
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    The do_block_io_op function in (1) drivers/xen/blkback/blkback.c and (2) drivers/xen/blktap/blktap.c in Xen before 3.4.0 for the Linux kernel 2.6.18, and possibly other versions, allows guest OS users to cause a denial of service (infinite loop and CPU consumption) via a large…

  • CVE-2010-4242Jan 11, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The hci_uart_tty_open function in the HCI UART driver (drivers/bluetooth/hci_ldisc.c) in the Linux kernel 2.6.36, and possibly other versions, does not verify whether the tty has a write operation, which allows local users to cause a denial of service (NULL pointer dereference)…

  • CVE-2010-4225Jan 11, 2011
    Mono
    Mono
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the mod_mono module for XSP in Mono 2.8.x before 2.8.2 allows remote attackers to obtain the source code for .aspx (ASP.NET) applications via unknown vectors related to an "unloading bug."

  • CVE-2010-4175Jan 11, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Integer overflow in the rds_cmsg_rdma_args function (net/rds/rdma.c) in Linux kernel 2.6.35 allows local users to cause a denial of service (crash) and possibly trigger memory corruption via a crafted Reliable Datagram Sockets (RDS) request, a different vulnerability than…

  • CVE-2010-3865Jan 11, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Integer overflow in the rds_rdma_pages function in net/rds/rdma.c in the Linux kernel allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted iovec struct in a Reliable Datagram Sockets (RDS) request, which triggers a buffer…

  • CVE-2010-3444Jan 11, 2011
    Fribidi
    Gnu Fribidi
    risk 0.00cvss —epss 0.04

    Buffer overflow in the log2vis_utf8 function in pyfribidi.c in GNU FriBidi 0.19.1, 0.19.2, and possibly other versions, as used in PyFriBidi 0.10.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Arabic UTF-8 string…

  • CVE-2010-1679Jan 11, 2011
    dpkg
    dpkg
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in dpkg-source in dpkg before 1.14.31 and 1.15.x allows user-assisted remote attackers to modify arbitrary files via directory traversal sequences in a patch for a source-format 3.0 package.