VYPR

CVEs

346,117 total · page 6032 of 6,923

AllCriticalHighKEV
  • CVE-2011-0401Jan 10, 2011
    Piwik
    Piwik
    risk 0.00cvss —epss 0.02

    Piwik before 1.1 does not properly limit the number of files stored under tmp/sessions/, which might allow remote attackers to cause a denial of service (inode consumption) by establishing many sessions.

  • CVE-2011-0400Jan 10, 2011
    Piwik
    Piwik
    risk 0.00cvss —epss 0.01

    Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

  • CVE-2011-0399Jan 10, 2011
    Piwik
    Piwik
    risk 0.00cvss —epss 0.01

    Piwik before 1.1 does not prevent the rendering of the login form inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

  • CVE-2011-0398Jan 10, 2011
    Piwik
    Piwik
    risk 0.00cvss —epss 0.01

    The Piwik_Common::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to bypass intended geolocation and logging functionality via (1) use of a private (aka RFC 1918) address behind a proxy server or (2) spoofing of…

  • CVE-2011-0004Jan 10, 2011
    Piwik
    Piwik
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-4535Jan 10, 2011
    Djangoproject
    Django
    risk 0.00cvss —epss 0.03

    The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource…

  • CVE-2010-4534Jan 10, 2011
    Djangoproject
    Django
    risk 0.00cvss —epss 0.02

    The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive…

  • CVE-2010-4013Jan 10, 2011
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Format string vulnerability in PackageKit in Apple Mac OS X 10.6.x before 10.6.6 allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to interaction between Software Update and distribution scripts.

  • CVE-2011-0347Jan 7, 2011
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.22

    Microsoft Internet Explorer on Windows XP allows remote attackers to trigger an incorrect GUI display and have unspecified other impact via vectors related to the DOM implementation, as demonstrated by cross_fuzz.

  • CVE-2011-0346HigJan 7, 2011
    Microsoft
    Internet Explorer
    risk 0.55cvss 8.1epss 0.31

    Use-after-free vulnerability in the ReleaseInterface function in MSHTML.DLL in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the DOM implementation and the…

  • CVE-2010-4692Jan 7, 2011
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.3(2) allows remote attackers to cause a denial of service (device crash) via a large number of LAN-to-LAN (aka L2L) IPsec sessions, aka Bug ID CSCth36592.

  • CVE-2010-4691Jan 7, 2011
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.3(2) allows remote attackers to cause a denial of service (device crash) via multicast traffic, aka Bug IDs CSCtg61810 and CSCtg69742.

  • CVE-2010-4690Jan 7, 2011
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    The Mobile User Security (MUS) service on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.3(2) does not properly authenticate HTTP requests from a Web Security appliance (WSA), which might allow remote attackers to obtain sensitive information…

  • CVE-2010-4689Jan 7, 2011
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.03

    Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.3(2) do not properly preserve ACL behavior after a migration, which allows remote attackers to bypass intended access restrictions via an unspecified type of network traffic that had previously…

  • CVE-2010-4688Jan 7, 2011
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the SIP inspection feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.3(2) allows remote attackers to cause a denial of service (device crash) by making many SIP calls, aka Bug ID CSCte20030.

  • CVE-2010-4322Jan 7, 2011
    Novell
    Vibe Onprem
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in gwtTeaming.rpc in Novell Vibe OnPrem 3 BETA allows remote authenticated users to inject arbitrary web script or HTML via the Micro Blog (aka What Are You Working On?) field.

  • CVE-2010-3984Jan 7, 2011
    Ca
    Xosoft Content Distribution
    risk 0.00cvss —epss 0.05

    Buffer overflow in mng_core_com.dll in CA XOsoft Replication r12.0 SP1 and r12.5 SP2 rollup, CA XOsoft High Availability r12.0 SP1 and r12.5 SP2 rollup, CA XOsoft Content Distribution r12.0 SP1 and r12.5 SP2 rollup, and CA ARCserve Replication and High Availability (RHA) r15.0…

  • CVE-2010-3311Jan 7, 2011
    FreeType
    Freetype
    risk 0.01cvss —epss 0.07

    Integer overflow in base/ftstream.c in libXft (aka the X FreeType library) in FreeType before 2.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Compact Font Format (CFF) font file that triggers a…

  • CVE-2010-3201Jan 7, 2011
    Netwin
    Surgemail
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in NetWin Surgemail before 4.3g allows remote attackers to inject arbitrary web script or HTML via the username_ex parameter to the surgeweb program.

  • CVE-2010-0215Jan 7, 2011
    Activecollab
    Activecollab
    risk 0.00cvss —epss 0.02

    ActiveCollab before 2.3.2 allows remote authenticated users to bypass intended access restrictions, and (1) delete an attachment or (2) subscribe to an object, via a crafted URL.

  • CVE-2010-4543Jan 7, 2011
    GIMP
    Gimp
    risk 0.04cvss —epss 0.16

    Heap-based buffer overflow in the read_channel_data function in file-psp.c in the Paint Shop Pro (PSP) plugin in GIMP 2.6.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a PSP_COMP_RLE (aka RLE compression) image…

  • CVE-2010-4542Jan 7, 2011
    GIMP
    Gimp
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in the gfig_read_parameter_gimp_rgb function in plug-ins/gfig/gfig-style.c in the GFIG plugin in GIMP 2.6.11 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long…

  • CVE-2010-4541Jan 7, 2011
    GIMP
    Gimp
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in the loadit function in plug-ins/common/sphere-designer.c in the SPHERE DESIGNER plugin in GIMP 2.6.11 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long "Number of…

  • CVE-2010-4540Jan 7, 2011
    GIMP
    Gimp
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in the load_preset_response function in plug-ins/lighting/lighting-ui.c in the "LIGHTING EFFECTS > LIGHT" plugin in GIMP 2.6.11 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code…

  • CVE-2010-4523Jan 7, 2011
    Opensc Project
    Opensc
    risk 0.00cvss —epss 0.01

    Multiple stack-based buffer overflows in libopensc in OpenSC 0.11.13 and earlier allow physically proximate attackers to execute arbitrary code via a long serial-number field on a smart card, related to (1) card-acos5.c, (2) card-atrust-acos.c, and (3) card-starcos.c.

  • CVE-2010-4687Jan 7, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    STCAPP (aka the SCCP telephony control application) on Cisco IOS before 15.0(1)XA1 does not properly handle multiple calls to a shared line, which allows remote attackers to cause a denial of service (port hang) by simultaneously ending two calls that were controlled by…

  • CVE-2010-4686Jan 7, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    CallManager Express (CME) on Cisco IOS before 15.0(1)XA1 does not properly handle SIP TRUNK traffic that contains rate bursts and a "peculiar" request size, which allows remote attackers to cause a denial of service (memory consumption) by sending this traffic over a long…

  • CVE-2010-4685Jan 7, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Cisco IOS before 15.0(1)XA1 does not clear the public key cache upon a change to a certificate map, which allows remote authenticated users to bypass a certificate ban by connecting with a banned certificate that had previously been valid, aka Bug ID CSCta79031.

  • CVE-2010-4684Jan 7, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Cisco IOS before 15.0(1)XA1, when certain TFTP debugging is enabled, allows remote attackers to cause a denial of service (device crash) via a TFTP copy over IPv6, aka Bug ID CSCtb28877.

  • CVE-2010-4683Jan 7, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Memory leak in Cisco IOS before 15.0(1)XA5 might allow remote attackers to cause a denial of service (memory consumption) by sending a crafted SIP REGISTER message over UDP, aka Bug ID CSCtg41733.

  • CVE-2010-4644Jan 7, 2011
    Apache
    Subversion
    risk 0.00cvss —epss 0.04

    Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command.

  • CVE-2010-4539Jan 7, 2011
    Apache
    Subversion
    risk 0.00cvss —epss 0.05

    The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger the walking…

  • CVE-2010-4538Jan 7, 2011
    Wireshark
    Wireshark
    risk 0.05cvss —epss 0.29

    Buffer overflow in the sect_enttec_dmx_da function in epan/dissectors/packet-enttec.c in Wireshark 1.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ENTTEC DMX packet with Run Length Encoding (RLE)…

  • CVE-2010-4499Jan 7, 2011
    TIBCO Software
    Activecatalog
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in Collaborative Information Manager server, as used in TIBCO Collaborative Information Manager before 8.1.0 and ActiveCatalog before 1.0.1, allows remote attackers to hijack web sessions via unspecified vectors.

  • CVE-2010-4498Jan 7, 2011
    TIBCO Software
    Activecatalog
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Collaborative Information Manager server, as used in TIBCO Collaborative Information Manager before 8.1.0 and ActiveCatalog before 1.0.1, allows remote attackers to modify data or obtain sensitive information via a crafted URL.

  • CVE-2010-4497Jan 7, 2011
    TIBCO Software
    Activecatalog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Collaborative Information Manager server, as used in TIBCO Collaborative Information Manager before 8.1.0 and ActiveCatalog before 1.0.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-4496Jan 7, 2011
    TIBCO Software
    Activecatalog
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Collaborative Information Manager server, as used in TIBCO Collaborative Information Manager before 8.1.0 and ActiveCatalog before 1.0.1, allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-4324Jan 7, 2011
    Novell
    Identity Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Approval Form in the User Application in the Roles Based Provisioning Module 3.7.0 before 370D in Novell Identity Manager (aka IDM) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-3856Jan 7, 2011
    GNU
    Glibc
    risk 0.04cvss —epss 0.10

    ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LD_AUDIT environment variable to reference dynamic shared objects (DSOs) as audit objects, which allows local users to gain privileges by leveraging an…

  • CVE-2010-3847Jan 7, 2011
    GNU
    Glibc
    risk 0.04cvss —epss 0.09

    elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LD_AUDIT environment variable, which allows local users to gain privileges via a crafted dynamic shared object (DSO)…

  • CVE-2010-2643Jan 7, 2011
    GNOME Foundation
    Evince
    risk 0.00cvss —epss 0.06

    Integer overflow in the TFM font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.

  • CVE-2010-2642Jan 7, 2011
    Tetex
    Tetex
    risk 0.01cvss —epss 0.14

    Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince 2.32 and earlier, teTeX 3.0, t1lib 5.1.2, and possibly other products allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a…

  • CVE-2010-2641Jan 7, 2011
    GNOME Foundation
    Evince
    risk 0.00cvss —epss 0.05

    Array index error in the VF font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the…

  • CVE-2010-2640Jan 7, 2011
    GNOME Foundation
    Evince
    risk 0.00cvss —epss 0.05

    Array index error in the PK font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the…

  • CVE-2009-5040Jan 7, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    CallManager Express (CME) on Cisco IOS before 15.0(1)XA allows remote authenticated users to cause a denial of service (device crash) by using an extension mobility (EM) phone to interact with the menu for SNR number changes, aka Bug ID CSCta63555.

  • CVE-2009-5039Jan 7, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Memory leak in the gk_circuit_info_do_in_acf function in the H.323 implementation in Cisco IOS before 15.0(1)XA allows remote attackers to cause a denial of service (memory consumption) via a large number of calls over a long duration, as demonstrated by InterZone Clear Token…

  • CVE-2009-5038Jan 7, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Cisco IOS before 15.0(1)XA does not properly handle IRC traffic during a specific time period after an initial reload, which allows remote attackers to cause a denial of service (device reload) via an attempted connection to a certain IRC server, related to a "corrupted magic…

  • CVE-2010-4682Jan 7, 2011
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.03

    Memory leak on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) allows remote attackers to cause a denial of service (memory consumption) by making multiple incorrect LDAP authentication attempts, aka Bug ID CSCtf29867.

  • CVE-2010-4681Jan 7, 2011
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) allows remote attackers to bypass SMTP inspection via vectors involving a prepended space character, aka Bug ID CSCte14901.

  • CVE-2010-4680Jan 7, 2011
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.03

    The WebVPN implementation on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) permits the viewing of CIFS shares even when CIFS file browsing has been disabled, which allows remote authenticated users to bypass intended access restrictions…