VYPR

CVEs

345,986 total · page 6078 of 6,920

AllCriticalHighKEV
  • CVE-2010-2166Jun 15, 2010
    Macromedia
    Flash Player
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-2160,…

  • CVE-2010-2165Jun 15, 2010
    Macromedia
    Flash Player
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-2160,…

  • CVE-2010-2164Jun 15, 2010
    Macromedia
    Flash Player
    risk 0.01cvss —epss 0.07

    Use-after-free vulnerability in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, might allow attackers to execute arbitrary code via unspecified vectors related to an unspecified "image type within a certain function."

  • CVE-2010-2163Jun 15, 2010
    Macromedia
    Flash Player
    risk 0.01cvss —epss 0.07

    Multiple unspecified vulnerabilities in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, might allow attackers to execute arbitrary code via unknown vectors.

  • CVE-2010-2162Jun 15, 2010
    Macromedia
    Flash Player
    risk 0.01cvss —epss 0.07

    Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via vectors related to improper length calculation and the (1) STSC, (2)…

  • CVE-2010-2161Jun 15, 2010
    Macromedia
    Flash Player
    risk 0.01cvss —epss 0.07

    Array index error in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, might allow attackers to execute arbitrary code via unspecified "types of Adobe Flash code."

  • CVE-2010-2160Jun 15, 2010
    Macromedia
    Flash Player
    risk 0.01cvss —epss 0.07

    Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via an invalid offset in an unspecified undocumented opcode in ActionScript…

  • CVE-2009-3793Jun 15, 2010
    Macromedia
    Flash Player
    risk 0.01cvss —epss 0.09

    Unspecified vulnerability in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service (memory consumption) or possibly execute arbitrary code via unknown vectors.

  • CVE-2010-2282Jun 15, 2010
    Tomatocms
    Tomatocms
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in TomatoCMS 2.0.6 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password.

  • CVE-2010-2281Jun 15, 2010
    Tomatocms
    Tomatocms
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS 2.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword or (2) bannerid parameter in conjunction with a /admin/ad/banner/list PATH_INFO; and allow remote authenticated…

  • CVE-2010-2280Jun 15, 2010
    IBM
    Connections
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in the Mobile component in IBM Lotus Connections 2.5.x before 2.5.0.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, related to "mobile edit actions," aka SPR ASRE83PPVH.

  • CVE-2010-2279Jun 15, 2010
    IBM
    Connections
    risk 0.00cvss —epss 0.01

    The Top Updates implementation in the Homepage component in IBM Lotus Connections 2.5.x before 2.5.0.2, when "forced SSL" is enabled, uses http for links, which has unspecified impact and remote attack vectors.

  • CVE-2010-2278Jun 15, 2010
    IBM
    Connections
    risk 0.00cvss —epss 0.01

    The bookmarklet pop-up in the Bookmarks component in IBM Lotus Connections 2.5.x before 2.5.0.2 does not properly follow the "force SSL" setting, which might make it easier for remote attackers to obtain the cleartext of network communication by sniffing the network, or spoof…

  • CVE-2010-2277Jun 15, 2010
    IBM
    Connections
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Connections 2.5.x before 2.5.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) create or (2) edit form in the Communities component, the (3) verbiage field in the Bookmarks component, or…

  • CVE-2010-2276Jun 15, 2010
    Dojotoolkit
    Dojo
    risk 0.00cvss —epss 0.03

    The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 has the copyTests=true and mini=false options, which makes it easier for remote attackers to have an…

  • CVE-2010-2275Jun 15, 2010
    Dojotoolkit
    Dojo
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the theme parameter, as demonstrated by an attack against dijit/tests/form/test_Button.html.

  • CVE-2010-2274Jun 15, 2010
    Dojotoolkit
    Dojo
    risk 0.00cvss —epss 0.02

    Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly…

  • CVE-2010-2273Jun 15, 2010
    Dojotoolkit
    Dojo
    risk 0.00cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to…

  • CVE-2010-2272Jun 15, 2010
    Dojotoolkit
    Dojo
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in iframe_history.html in Dojo 0.4.x before 0.4.4 has unknown impact and remote attack vectors.

  • CVE-2010-2271Jun 15, 2010
    Accoria
    Rock Web Server
    risk 0.00cvss —epss 0.01

    Format string vulnerability in authcfg.cgi in Accoria Web Server (aka Rock Web Server) 1.4.7 allows remote attackers to have an unspecified impact via format string specifiers in the path (aka Password File) parameter.

  • CVE-2010-2270Jun 15, 2010
    Accoria
    Rock Web Server
    risk 0.00cvss —epss 0.01

    Accoria Web Server (aka Rock Web Server) 1.4.7 uses a predictable httpmod-sessionid cookie, which makes it easier for remote attackers to hijack sessions via a modified cookie.

  • CVE-2010-2269Jun 15, 2010
    Accoria
    Rock Web Server
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in loadstatic.cgi in Accoria Web Server (aka Rock Web Server) 1.4.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the name parameter.

  • CVE-2010-2268Jun 15, 2010
    Accoria
    Rock Web Server
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in authcfg.cgi in Accoria Web Server (aka Rock Web Server) 1.4.7 allows remote attackers to hijack the authentication of administrators for requests that create user accounts.

  • CVE-2010-2267Jun 15, 2010
    Accoria
    Rock Web Server
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Accoria Web Server (aka Rock Web Server) 1.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the getenv sample program, (2) the desc parameter to loadstatic.cgi, (3) the name…

  • CVE-2010-2054Jun 15, 2010
    SBLIM
    SFCB
    risk 0.00cvss —epss 0.05

    Integer overflow in httpAdapter.c in httpAdapter in SBLIM SFCB 1.3.4 through 1.3.7, when the configuration sets httpMaxContentLength to a zero value, allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via a large…

  • CVE-2010-1937Jun 15, 2010
    SBLIM
    SFCB
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in httpAdapter.c in httpAdapter in SBLIM SFCB before 1.3.8 might allow remote attackers to execute arbitrary code via a Content-Length HTTP header that specifies a value too small for the amount of POST data, aka bug #3001896.

  • CVE-2010-1515Jun 15, 2010
    Tomatocms
    Tomatocms
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS 2.0.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) keyword or (2) article-id parameter in conjunction with a /admin/news/article/list PATH_INFO; the (3) keyword…

  • CVE-2010-1514Jun 15, 2010
    Tomatocms
    Tomatocms
    risk 0.00cvss —epss 0.01

    Unrestricted file upload vulnerability in TomatoCMS 2.0.6 and earlier allows remote authenticated users, with certain privileges, to execute arbitrary PHP code by uploading an image file, and then accessing it via a direct request to the file in an unspecified directory.

  • CVE-2010-2294Jun 15, 2010
    Plume CMS
    CMS
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Plume CMS 1.2.4 and possibly earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspecified vectors.

  • CVE-2010-2293Jun 15, 2010
    Dlink
    Di 604\+
    risk 0.00cvss —epss 0.01

    The Ping tools web interface in Dlink Di-604 router allows remote authenticated users to cause a denial of service via a large "ip textfield" size.

  • CVE-2010-2292Jun 15, 2010
    Dlink
    Di 604\+
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Ping tools web interface in Dlink Di-604 router allows remote attackers to inject arbitrary web script or HTML via the IP field.

  • CVE-2010-2291Jun 15, 2010
    Snom
    Voip Phone Firmware
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the web interface in snom VoIP Phone firmware 8 before 8.2.35 allows remote attackers to bypass intended restrictions and modify user credentials via unknown vectors. NOTE: some of these details are obtained from third party information.

  • CVE-2010-2290Jun 15, 2010
    McAfee
    Unified Threat Management Firewall Firmware
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cgi-bin/cgix/help in McAfee Unified Threat Management (UTM) Firewall (formerly SnapGear) firmware 3.0.0 through 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2010-2289Jun 15, 2010
    Juniper Networks
    Secure Access 2000
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in dana/home/homepage.cgi in Juniper Networks IVE 6.5R1 (Build 14599) and 6.5R2 (Build 14951) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the Location parameter.

  • CVE-2010-2288Jun 15, 2010
    Juniper Networks
    Secure Access 2000
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in dana/nc/ncrun.cgi in Juniper Networks IVE 6.5R1 (Build 14599) and 6.5R2 (Build 14951) allows remote attackers to inject arbitrary web script or HTML via the DSSignInURL cookie.

  • CVE-2010-2287Jun 15, 2010
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.01

    Buffer overflow in the SigComp Universal Decompressor Virtual Machine dissector in Wireshark 0.10.8 through 1.0.13 and 1.2.0 through 1.2.8 has unknown impact and remote attack vectors.

  • CVE-2010-2286Jun 15, 2010
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.01

    The SigComp Universal Decompressor Virtual Machine dissector in Wireshark 0.10.7 through 1.0.13 and 1.2.0 through 1.2.8 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.

  • CVE-2010-2285Jun 15, 2010
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.01

    The SMB PIPE dissector in Wireshark 0.8.20 through 1.0.13 and 1.2.0 through 1.2.8 allows remote attackers to cause a denial of service (NULL pointer dereference) via unknown vectors.

  • CVE-2010-2284Jun 15, 2010
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.01

    Buffer overflow in the ASN.1 BER dissector in Wireshark 0.10.13 through 1.0.13 and 1.2.0 through 1.2.8 has unknown impact and remote attack vectors.

  • CVE-2010-2283Jun 15, 2010
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.01

    The SMB dissector in Wireshark 0.99.6 through 1.0.13, and 1.2.0 through 1.2.8 allows remote attackers to cause a denial of service (NULL pointer dereference) via unknown vectors.

  • CVE-2010-2075Jun 15, 2010
    Unrealircd
    Unrealircd
    risk 0.10cvss —epss 0.84

    UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally introduced modification (Trojan Horse) in the DEBUG3_DOLOG_SYSTEM macro, which allows remote attackers to execute arbitrary commands.

  • CVE-2009-4894Jun 15, 2010
    Punbb
    Punbb
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in profile.php in PunBB before 1.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) password or (2) e-mail.

  • CVE-2009-4893Jun 15, 2010
    Unrealircd
    Unrealircd
    risk 0.00cvss —epss 0.03

    Buffer overflow in UnrealIRCd 3.2beta11 through 3.2.8, when allow::options::noident is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

  • CVE-2010-2266Jun 15, 2010
    Nginx
    Nginx
    risk 0.05cvss —epss 0.24

    nginx 0.8.36 allows remote attackers to cause a denial of service (crash) via certain encoded directory traversal sequences that trigger memory corruption, as demonstrated using the "%c0.%c0." sequence.

  • CVE-2010-2265Jun 15, 2010
    Microsoft
    Windows Xp
    risk 0.05cvss —epss 0.21

    Cross-site scripting (XSS) vulnerability in the GetServerName function in sysinfo/commonFunc.js in Microsoft Windows Help and Support Center for Windows XP and Windows Server 2003 allows remote attackers to inject arbitrary web script or HTML via the svr parameter to…

  • CVE-2010-2263Jun 15, 2010
    Nginx
    Nginx
    risk 0.09cvss —epss 0.74

    nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI.

  • CVE-2010-1885Jun 15, 2010
    Microsoft
    Windows Xp
    risk 0.09cvss —epss 0.75

    The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute…

  • CVE-2010-0990Jun 15, 2010
    Creative
    Autoupdate Engine Activex Control
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in Creative Software AutoUpdate Engine ActiveX Control 2.0.12.0, as used in Creative Software AutoUpdate 1.40.01, allows remote attackers to execute arbitrary code via vectors related to the BrowseFolder method.

  • CVE-2010-2264Jun 11, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information…

  • CVE-2010-1774Jun 11, 2010
    Apple Inc.
    Safari
    risk 0.01cvss —epss 0.07

    WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, accesses out-of-bounds memory during processing of HTML tables, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash)…