VYPR

CVEs

346,031 total · page 6043 of 6,921

AllCriticalHighKEV
  • CVE-2010-3648Nov 7, 2010
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a…

  • CVE-2010-3647Nov 7, 2010
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a…

  • CVE-2010-3646Nov 7, 2010
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a…

  • CVE-2010-3645Nov 7, 2010
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a…

  • CVE-2010-3644Nov 7, 2010
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a…

  • CVE-2010-3643Nov 7, 2010
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a…

  • CVE-2010-3642Nov 7, 2010
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a…

  • CVE-2010-3641Nov 7, 2010
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a…

  • CVE-2010-3640Nov 7, 2010
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a…

  • CVE-2010-3639Nov 7, 2010
    Adobe Inc.
    Flashplayer
    risk 0.05cvss —epss 0.22

    Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors.

  • CVE-2010-3638Nov 7, 2010
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Mac OS X, when Safari is used, allows attackers to obtain sensitive information via unknown vectors.

  • CVE-2010-3637Nov 7, 2010
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.06

    An unspecified ActiveX control in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 (Flash10h.ocx) on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FLV video.

  • CVE-2010-3636Nov 7, 2010
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.05

    Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended…

  • CVE-2010-4206HigNov 6, 2010
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.03

    Array index error in the FEBlend::apply function in WebCore/platform/graphics/filters/FEBlend.cpp in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows remote attackers to cause a denial of service and possibly execute…

  • CVE-2010-4205CriNov 6, 2010
    Google
    Chrome
    risk 0.64cvss 9.8epss 0.01

    Google Chrome before 7.0.517.44 does not properly handle the data types of event objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2010-4204CriNov 6, 2010
    Google
    Chrome
    risk 0.64cvss 9.8epss 0.02

    WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, accesses a frame object after this object has been destroyed, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2010-4203CriNov 6, 2010
    Google
    Chrome
    risk 0.64cvss 9.8epss 0.05

    WebM libvpx (aka the VP8 Codec SDK) before 0.9.5, as used in Google Chrome before 7.0.517.44, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via invalid frames.

  • CVE-2010-4202CriNov 6, 2010
    Google
    Chrome
    risk 0.64cvss 9.8epss 0.01

    Multiple integer overflows in Google Chrome before 7.0.517.44 on Linux allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted font.

  • CVE-2010-4201CriNov 6, 2010
    Google
    Chrome
    risk 0.64cvss 9.8epss 0.01

    Use-after-free vulnerability in Google Chrome before 7.0.517.44 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving text control selections.

  • CVE-2010-4199HigNov 6, 2010
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    Google Chrome before 7.0.517.44 does not properly perform a cast of an unspecified variable during processing of an SVG use element, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SVG document.

  • CVE-2010-4198HigNov 6, 2010
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, does not properly handle large text areas, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted HTML…

  • CVE-2010-4197CriNov 6, 2010
    Google
    Chrome
    risk 0.64cvss 9.8epss 0.02

    Use-after-free vulnerability in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving text editing.

  • CVE-2010-4005Nov 6, 2010
    GNOME Foundation
    Tomboy
    risk 0.00cvss —epss 0.00

    The (1) tomboy and (2) tomboy-panel scripts in GNOME Tomboy 1.5.2 and earlier place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: vector 1 exists because…

  • CVE-2010-4001Nov 6, 2010
    Gromacs
    Gromacs
    risk 0.00cvss —epss 0.00

    GMXRC.bash in Gromacs 4.5.1 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: CVE disputes this issue because the GMXLDLIB value is always…

  • CVE-2010-4000Nov 6, 2010
    GNOME Foundation
    Gnome Shell
    risk 0.00cvss —epss 0.00

    gnome-shell in GNOME Shell 2.31.5 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

  • CVE-2010-3998Nov 6, 2010
    Banshee Project
    Banshee
    risk 0.00cvss —epss 0.00

    The (1) banshee-1 and (2) muinshee scripts in Banshee 1.8.0 and earlier place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: Banshee might also be…

  • CVE-2010-3916Nov 6, 2010
    Justsystems
    Ichitaro
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in JustSystems Ichitaro and Ichitaro Government allows remote attackers to execute arbitrary code via a crafted document, a different vulnerability than CVE-2010-3915.

  • CVE-2010-3915Nov 6, 2010
    Justsystems
    Ichitaro
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in JustSystems Ichitaro and Ichitaro Government allows remote attackers to execute arbitrary code via a crafted document, a different vulnerability than CVE-2010-3916.

  • CVE-2010-3852Nov 6, 2010
    Red Hat
    Luci
    risk 0.00cvss —epss 0.02

    The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "[INSERT SECRET HERE]" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie.

  • CVE-2010-2477Nov 6, 2010
    Pythonpaste
    Paste
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the paste.httpexceptions implementation in Paste before 1.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving a 404 status code, related to (1) paste.urlparser.StaticURLParser, (2)…

  • CVE-2010-1523Nov 6, 2010
    Winamp
    Winamp
    risk 0.00cvss —epss 0.05

    Multiple heap-based buffer overflows in vp6.w5s (aka the VP6 codec) in Winamp before 5.59 Beta build 3033 might allow remote attackers to execute arbitrary code via a crafted VP6 (1) video file or (2) video stream.

  • CVE-2009-5015Nov 6, 2010
    Turbogears
    Turbogears2
    risk 0.00cvss —epss 0.01

    The URL dispatch mechanism in TurboGears2 (aka tg2) before 2.0.2 exposes controller methods even when an @expose decoration is not used, which has unspecified impact and attack vectors.

  • CVE-2009-5014Nov 6, 2010
    Turbogears
    Turbogears2
    risk 0.00cvss —epss 0.01

    The default quickstart configuration of TurboGears2 (aka tg2) before 2.0.2 has a weak cookie salt, which makes it easier for remote attackers to bypass repoze.who authentication via a forged authorization cookie, a related issue to CVE-2010-3852.

  • CVE-2010-4092Nov 5, 2010
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in an unspecified compatibility component in Adobe Shockwave Player before 11.5.9.620 allows user-assisted remote attackers to execute arbitrary code via a crafted web site, related to the Shockwave Settings window and an unloaded library. NOTE: some…

  • CVE-2010-4186Nov 5, 2010
    Onlinetechtools.com
    Online Work Order System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in process.asp in OnlineTechTools Online Work Order System (OWOS) Professional Edition 2.10 allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-4185Nov 5, 2010
    Energine
    Energine
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Energine, possibly 2.3.8 and earlier, allows remote attackers to execute arbitrary SQL commands via the NRGNSID cookie.

  • CVE-2010-3704Nov 5, 2010
    KDE
    Kdegraphics
    risk 0.00cvss —epss 0.04

    The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) and possibly…

  • CVE-2010-3703Nov 5, 2010
    Poppler (software)
    Poppler
    risk 0.00cvss —epss 0.03

    The PostScriptFunction::PostScriptFunction function in poppler/Function.cc in the PDF parser in poppler 0.8.7 and possibly other versions up to 0.15.1, and possibly other products, allows context-dependent attackers to cause a denial of service (crash) via a PDF file that…

  • CVE-2010-3702Nov 5, 2010
    Xpdf
    Xpdf
    risk 0.00cvss —epss 0.03

    The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an…

  • CVE-2010-4184Nov 5, 2010
    Netsupport
    Netsupport Manager
    risk 0.00cvss —epss 0.03

    NetSupport Manager (NSM) before 11.00.0005 sends HTTP headers with cleartext fields containing details about client machines, which allows remote attackers to obtain potentially sensitive information by sniffing the network.

  • CVE-2010-4183Nov 5, 2010
    Htmlpurifier
    Htmlpurifier
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS)…

  • CVE-2010-3999Nov 5, 2010
    Gnucash
    Gnucash
    risk 0.00cvss —epss 0.00

    gnc-test-env in GnuCash 2.3.15 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

  • CVE-2010-3996Nov 5, 2010
    Cstr
    Festival
    risk 0.00cvss —epss 0.00

    festival_server in Centre for Speech Technology Research (CSTR) Festival, probably 2.0.95-beta and earlier, places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

  • CVE-2010-3962HigKEVNov 5, 2010
    Microsoft
    Internet Explorer
    risk 0.75cvss 8.1epss 0.97

    Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory…

  • CVE-2010-3913Nov 5, 2010
    Transware
    Active\! Mail
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in TransWARE Active! mail 6 build 6.40.010047750 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

  • CVE-2010-3863Nov 5, 2010
    Apache
    Shiro
    risk 0.07cvss —epss 0.55

    Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.

  • CVE-2010-3846Nov 5, 2010
    Nongnu
    Cvs
    risk 0.00cvss —epss 0.00

    Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow.

  • CVE-2010-3764Nov 5, 2010
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    The Old Charts implementation in Bugzilla 2.12 through 3.2.8, 3.4.8, 3.6.2, 3.7.3, and 4.1 creates graph files with predictable names in graphs/, which allows remote attackers to obtain sensitive information via a modified URL.

  • CVE-2010-3172Nov 5, 2010
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in Bugzilla before 3.2.9, 3.4.x before 3.4.9, 3.6.x before 3.6.3, and 4.0.x before 4.0rc1, when Server Push is enabled in a web browser, allows remote attackers to inject arbitrary HTTP headers and content, and conduct HTTP response splitting…

  • CVE-2010-2941CriNov 5, 2010
    Apple Inc.
    Cups
    risk 0.64cvss 9.8epss 0.06

    ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP…