VYPR

CVEs

346,044 total · page 6037 of 6,921

AllCriticalHighKEV
  • CVE-2010-3800Dec 9, 2010
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Apple QuickTime before 7.6.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted PICT file.

  • CVE-2010-2235Dec 9, 2010
    Cobbler Project
    Cobbler
    risk 0.00cvss —epss 0.03

    template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute…

  • CVE-2010-1508Dec 9, 2010
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in Apple QuickTime before 7.6.9 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Track Header (aka tkhd) atoms.

  • CVE-2010-0530Dec 9, 2010
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.00

    Apple QuickTime before 7.6.9 on Windows sets weak permissions for the Apple Computer directory in the profile of a user account, which allows local users to obtain sensitive information by reading files in this directory.

  • CVE-2009-5021Dec 9, 2010
    Cobbler Project
    Cobbler
    risk 0.00cvss —epss 0.01

    Cobbler before 1.6.1 does not properly determine whether an installation has the default password, which makes it easier for attackers to obtain access by using this password.

  • CVE-2010-4505Dec 8, 2010
    Injader
    Injader
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.php in Injader 2.4.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) un and (2) pw parameters.

  • CVE-2010-4504Dec 8, 2010
    Esyndicat
    Directory
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in eSyndiCat Directory 2.3 allow remote attackers to inject arbitrary web script or HTML via the title parameter to (1) suggest-category.php and (2) suggest-listing.php.

  • CVE-2010-4503Dec 8, 2010
    Aigaion
    Aigaion
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in indexlight.php in Aigaion 1.3.4 allows remote attackers to execute arbitrary SQL commands via the ID parameter in an export action.

  • CVE-2010-4502Dec 8, 2010
    Ca
    Internet Security Suite 2008
    risk 0.03cvss —epss 0.01

    Integer overflow in KmxSbx.sys 6.2.0.22 in CA Internet Security Suite Plus 2010 allows local users to cause a denial of service (pool corruption) and execute arbitrary code via crafted arguments to the 0x88000080 IOCTL, which triggers a buffer overflow.

  • CVE-2010-4012Dec 8, 2010
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    Race condition in Apple iOS 4.0 through 4.1 for iPhone 3G and later allows physically proximate attackers to bypass the passcode lock by making a call from the Emergency Call screen, then quickly pressing the Sleep/Wake button.

  • CVE-2010-3920Dec 8, 2010
    Epson
    LP-S9000
    risk 0.00cvss —epss 0.00

    The Seiko Epson printer driver installers for LP-S9000 before 4.1.11 and LP-S7100 before 4.1.7, or as downloaded from the vendor between May 2010 and 20101125, set weak permissions for the "C:\Program Files" folder, which might allow local users to bypass intended access…

  • CVE-2010-3860Dec 8, 2010
    IcedTea
    IcedTea6
    risk 0.00cvss —epss 0.03

    IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system…

  • CVE-2010-3699Dec 8, 2010
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    The backend driver in Xen 3.x allows guest OS users to cause a denial of service via a kernel thread leak, which prevents the device and guest OS from being shut down or create a zombie domain, causes a hang in zenwatch, or prevents unspecified xm commands from working properly,…

  • CVE-2010-4109Dec 8, 2010
    Microfocus
    Palm webOS
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Contacts Application in HP Palm webOS before 2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted vCard file.

  • CVE-2010-4108Dec 8, 2010
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.03

    HP HP-UX B.11.11, B.11.23, and B.11.31 does not properly support threaded processes, which allows remote authenticated users to cause a denial of service via unspecified vectors.

  • CVE-2010-3372Dec 8, 2010
    Nordugrid
    Nordugrid Arc
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in NorduGrid Advanced Resource Connector (ARC) before 0.8.3 allows local users to gain privileges via vectors related to the LD_LIBRARY_PATH environment variable. NOTE: some of these details are obtained from third party information.

  • CVE-2010-2793Dec 8, 2010
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.01

    Race condition in the SPICE (aka spice-activex) plug-in for Internet Explorer in Red Hat Enterprise Virtualization (RHEV) Manager before 2.2.4 allows local users to create a certain named pipe, and consequently gain privileges, via vectors involving knowledge of the name of this…

  • CVE-2010-4500Dec 8, 2010
    Mrcgiguy
    Freeticket
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in contact.php in MRCGIGUY (MCG) FreeTicket 1.0.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) email, (3) subject, and (4) message parameters in a sendmess action. NOTE:…

  • CVE-2010-4480Dec 8, 2010
    PhpMyAdmin
    phpMyAdmin
    risk 0.03cvss —epss 0.06

    error.php in PhpMyAdmin 3.3.8.1, and other versions before 3.4.0-beta1, allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing "@" characters, as demonstrated using "[a@url@page]".

  • CVE-2010-4179Dec 7, 2010
    Red Hat
    MRG
    risk 0.00cvss —epss 0.02

    The installation documentation for Red Hat Enterprise Messaging, Realtime and Grid (MRG) 1.3 recommends that Condor should be configured so that the MRG Management Console (cumin) can submit jobs for users, which creates a trusted channel with insufficient access control that…

  • CVE-2010-4176Dec 7, 2010
    Systemd Project
    Udev
    risk 0.00cvss —epss 0.02

    plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.

  • CVE-2010-4171Dec 7, 2010
    Systemtap
    Systemtap
    risk 0.00cvss —epss 0.00

    The staprun runtime tool in SystemTap 1.3 does not verify that a module to unload was previously loaded by SystemTap, which allows local users to cause a denial of service (unloading of arbitrary kernel modules).

  • CVE-2010-4170Dec 7, 2010
    Systemtap
    Systemtap
    risk 0.03cvss —epss 0.05

    The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.

  • CVE-2010-4150Dec 7, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.06

    Double free vulnerability in the imap_do_open function in the IMAP extension (ext/imap/php_imap.c) in PHP 5.2 before 5.2.15 and 5.3 before 5.3.4 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors.

  • CVE-2010-4494Dec 7, 2010
    Google
    Chrome
    risk 0.01cvss —epss 0.08

    Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.

  • CVE-2010-4493Dec 7, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 8.0.552.215 allows remote attackers to cause a denial of service via vectors related to the handling of mouse dragging events.

  • CVE-2010-4492Dec 7, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 8.0.552.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG animations.

  • CVE-2010-4491Dec 7, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 8.0.552.215 does not properly restrict privileged extensions, which allows remote attackers to cause a denial of service (memory corruption) via a crafted extension.

  • CVE-2010-4490Dec 7, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 8.0.552.215 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via malformed video content that triggers an indexing error.

  • CVE-2010-4489Dec 7, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    libvpx, as used in Google Chrome before 8.0.552.215 and possibly other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebM video. NOTE: this vulnerability exists because of a regression.

  • CVE-2010-4488Dec 7, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 8.0.552.215 does not properly handle HTTP proxy authentication, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.

  • CVE-2010-4487Dec 7, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Incomplete blacklist vulnerability in Google Chrome before 8.0.552.215 on Linux and Mac OS X allows remote attackers to have an unspecified impact via a "dangerous file."

  • CVE-2010-4486Dec 7, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 8.0.552.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to history handling.

  • CVE-2010-4485Dec 7, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 8.0.552.215 does not properly restrict the generation of file dialogs, which allows remote attackers to cause a denial of service (reduced usability and possible application crash) via a crafted web site.

  • CVE-2010-4484Dec 7, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 8.0.552.215 does not properly handle HTML5 databases, which allows attackers to cause a denial of service (application crash) via unspecified vectors.

  • CVE-2010-4483Dec 7, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 8.0.552.215 does not properly restrict read access to videos derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive video data via a crafted web site.

  • CVE-2010-4482Dec 7, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Google Chrome before 8.0.552.215 allows remote attackers to bypass the pop-up blocker via unknown vectors.

  • CVE-2010-4479Dec 7, 2010
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in pdf.c in libclamav in ClamAV before 0.96.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document, aka "bb #2380," a different vulnerability than CVE-2010-4260.

  • CVE-2010-4412Dec 7, 2010
    Pfsense
    Pfsense
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in pfSense 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via (1) the id parameter in an olsrd.xml action to pkg_edit.php, (2) the xml parameter to pkg.php, or the if parameter to (3) status_graph.php or…

  • CVE-2010-4330Dec 7, 2010
    Pulse
    Pulse CMS Basic
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in includes/controller.php in Pulse CMS Basic before 1.2.9 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p parameter to index.php.

  • CVE-2010-4261Dec 7, 2010
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.05

    Off-by-one error in the icon_cb function in pe_icons.c in libclamav in ClamAV before 0.96.5 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors. NOTE: some of these details are…

  • CVE-2010-4260Dec 7, 2010
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in pdf.c in libclamav in ClamAV before 0.96.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document, aka (1) "bb #2358" and (2) "bb #2396."

  • CVE-2010-4259Dec 7, 2010
    Fontforge
    Fontforge
    risk 0.04cvss —epss 0.11

    Stack-based buffer overflow in FontForge 20100501 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long CHARSET_REGISTRY header in a BDF font file.

  • CVE-2010-4257Dec 7, 2010
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field.

  • CVE-2010-4246Dec 7, 2010
    Pfsense
    Pfsense
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in graph.php in pfSense 1.2.3 and 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via the (1) ifnum or (2) ifname parameter, a different vulnerability than CVE-2008-1182.

  • CVE-2010-4478CriDec 6, 2010
    OpenSSH
    OpenSSH
    risk 0.64cvss 9.8epss 0.04

    OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round…

  • CVE-2008-7270Dec 6, 2010
    OpenSSL Project
    OpenSSL
    risk 0.00cvss —epss 0.03

    OpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a disabled cipher via vectors involving sniffing network traffic to discover a…

  • CVE-2010-4297Dec 6, 2010
    VMware
    Workstation
    risk 0.03cvss —epss 0.05

    The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player 2.5.x before 2.5.5 build 328052 and 3.1.x before 3.1.2 build 301548; VMware Server 2.0.2; VMware Fusion 2.x before 2.0.8 build 328035 and…

  • CVE-2010-4296Dec 6, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux, VMware Player 3.1.x before 3.1.2 build 301548 on Linux, VMware Server 2.0.2 on Linux, and VMware Fusion 3.1.x before 3.1.2 build 332101 does not properly load libraries, which allows host OS users to gain…

  • CVE-2010-4295Dec 6, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    Race condition in the mounting process in vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux, VMware Player 3.1.x before 3.1.2 build 301548 on Linux, VMware Server 2.0.2 on Linux, and VMware Fusion 3.1.x before 3.1.2 build 332101 allows host OS users to…