VYPR

CVEs

345,196 total · page 6166 of 6,904

AllCriticalHighKEV
  • CVE-2009-1530Jun 10, 2009
    Microsoft
    Internet Explorer
    risk 0.03cvss —epss 0.34

    Use-after-free vulnerability in Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 allows remote attackers to execute arbitrary code by repeatedly adding HTML document nodes and calling event…

  • CVE-2009-1529HigJun 10, 2009
    Microsoft
    Internet Explorer
    risk 0.55cvss 8.1epss 0.29

    Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by calling the setCapture method on a…

  • CVE-2009-1528Jun 10, 2009
    Microsoft
    Internet Explorer
    risk 0.03cvss —epss 0.35

    Microsoft Internet Explorer 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not properly synchronize AJAX requests, which allows allows remote attackers to execute arbitrary code via a large number…

  • CVE-2009-1141Jun 10, 2009
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.28

    Microsoft Internet Explorer 6 for Windows XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via unspecified DHTML function calls related to a tr element and the "insertion, deletion and attributes of a table cell," which trigger memory…

  • CVE-2009-1140Jun 10, 2009
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.25

    Microsoft Internet Explorer 5.01 SP4; 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not prevent HTML rendering of cached content, which allows remote attackers to bypass the Same Origin…

  • CVE-2009-1134Jun 10, 2009
    Microsoft
    Office
    risk 0.03cvss —epss 0.36

    Excel in 2007 Microsoft Office System SP1 and SP2; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a BIFF file with a malformed Qsir (0x806)…

  • CVE-2009-1126Jun 10, 2009
    Microsoft
    Windows 2000
    risk 0.00cvss —epss 0.01

    The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly validate the user-mode input associated with the editing of an unspecified desktop parameter, which allows local users to gain privileges via a crafted application, aka "Windows…

  • CVE-2009-1125Jun 10, 2009
    Microsoft
    Windows 2000
    risk 0.00cvss —epss 0.01

    The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate an argument to an unspecified system call, which allows local users to gain privileges via a crafted application, aka "Windows…

  • CVE-2009-1124Jun 10, 2009
    Microsoft
    Windows 2000
    risk 0.00cvss —epss 0.01

    The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate user-mode pointers in unspecified error conditions, which allows local users to gain privileges via a crafted application, aka…

  • CVE-2009-1123HigKEVJun 10, 2009
    Microsoft
    Windows 2000
    risk 0.63cvss 7.8epss 0.05

    The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application, aka "Windows Kernel…

  • CVE-2009-1122Jun 10, 2009
    Microsoft
    IIS
    risk 0.11cvss —epss 0.98

    The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication…

  • CVE-2009-0561Jun 10, 2009
    Microsoft
    Office
    risk 0.03cvss —epss 0.37

    Integer overflow in Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel…

  • CVE-2009-0560Jun 10, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.28

    Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft…

  • CVE-2009-0559Jun 10, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.29

    Stack-based buffer overflow in Excel in Microsoft Office 2000 SP3 and Office XP SP3 allows remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "String Copy Stack-Based Overrun Vulnerability."

  • CVE-2009-0558Jun 10, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.31

    Array index error in Excel in Microsoft Office 2000 SP3 and Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac, allows remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "Array Indexing Memory Corruption…

  • CVE-2009-0557HigKEVJun 10, 2009
    Microsoft
    Office
    risk 0.67cvss 7.8epss 0.59

    Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft…

  • CVE-2009-0549Jun 10, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.28

    Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; and Microsoft Office Excel Viewer 2003 SP3 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed…

  • CVE-2009-1718Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to obtain sensitive information via vectors involving drag events and the dragging of content over a crafted web page.

  • CVE-2009-1716Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.00

    CFNetwork in Apple Safari before 4.0 on Windows does not properly protect the temporary files created for downloads, which allows local users to obtain sensitive information by reading these files.

  • CVE-2009-1715Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to script execution with incorrect privileges.

  • CVE-2009-1714Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to the improper escaping of HTML attributes.

  • CVE-2009-1713Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    The XSLT functionality in WebKit in Apple Safari before 4.0 does not properly implement the document function, which allows remote attackers to read (1) arbitrary local files and (2) files from different security zones via unspecified vectors.

  • CVE-2009-1712Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.01cvss —epss 0.08

    WebKit in Apple Safari before 4.0 does not prevent remote loading of local Java applets, which allows remote attackers to execute arbitrary code, gain privileges, or obtain sensitive information via an APPLET or OBJECT element.

  • CVE-2009-1711Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.01cvss —epss 0.07

    WebKit in Apple Safari before 4.0 does not properly initialize memory for Attr DOM objects, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document.

  • CVE-2009-1710Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit in Apple Safari before 4.0 allows remote attackers to spoof the browser's display of (1) the host name, (2) security indicators, and unspecified other UI elements via a custom cursor in conjunction with a modified CSS3 hotspot property.

  • CVE-2009-1709Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.01cvss —epss 0.07

    Use-after-free vulnerability in the garbage-collection implementation in WebCore in WebKit in Apple Safari before 4.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via an SVG animation element, related to…

  • CVE-2009-1708Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.05

    Apple Safari before 4.0 does not prevent calls to the open-help-anchor URL handler by web sites, which allows remote attackers to open arbitrary local help files, and execute arbitrary code or obtain sensitive information, via a crafted call.

  • CVE-2009-1707Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.00

    Race condition in the Reset Safari implementation in Apple Safari before 4.0 on Windows might allow local users to read stored web-site passwords via unspecified vectors.

  • CVE-2009-1706Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    The Private Browsing feature in Apple Safari before 4.0 on Windows does not remove cookies from the alternate cookie store in unspecified circumstances upon (1) disabling of the feature or (2) exit of the application, which makes it easier for remote web servers to track users…

  • CVE-2009-1705Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.05

    CoreGraphics in Apple Safari before 4.0 on Windows does not properly use arithmetic during automatic hinting of TrueType fonts, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted font data.

  • CVE-2009-1704Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    CFNetwork in Apple Safari before 4.0 misinterprets downloaded image files as local HTML documents in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript code by placing it in an image file.

  • CVE-2009-1703Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit in Apple Safari before 4.0 does not prevent references to file: URLs within (1) audio and (2) video elements, which allows remote attackers to determine the existence of arbitrary files via a crafted HTML document.

  • CVE-2009-1702Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to improper handling of Location and…

  • CVE-2009-1701Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.01cvss —epss 0.08

    Use-after-free vulnerability in the JavaScript DOM implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash)…

  • CVE-2009-1700Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    The XSLT implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle redirects, which allows remote attackers to read XML content from arbitrary web pages via a crafted document.

  • CVE-2009-1699HigJun 10, 2009
    Apple Inc.
    Safari
    risk 0.54cvss 7.5epss 0.29

    The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as…

  • CVE-2009-1698Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.01cvss —epss 0.08

    WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not initialize a pointer during handling of a Cascading Style Sheets (CSS) attr function call with a large numerical argument, which allows remote attackers to…

  • CVE-2009-1697Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    CRLF injection vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject HTTP headers and bypass the Same Origin Policy via a crafted HTML document, related to cross-site…

  • CVE-2009-1696Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 uses predictable random numbers in JavaScript applications, which makes it easier for remote web servers to track the behavior of a Safari user during a session.

  • CVE-2009-1695Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving access to frame contents after…

  • CVE-2009-1533Jun 10, 2009
    Microsoft
    Office
    risk 0.03cvss —epss 0.36

    Buffer overflow in the Works for Windows document converters in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, Office 2007 SP1, and Works 8.5 and 9 allows remote attackers to execute arbitrary code via a crafted Works .wps file that triggers memory corruption, aka…

  • CVE-2009-1139Jun 10, 2009
    Microsoft
    Windows 2000
    risk 0.03cvss —epss 0.39

    Memory leak in the LDAP service in Active Directory on Microsoft Windows 2000 SP4 and Server 2003 SP2, and Active Directory Application Mode (ADAM) on Windows XP SP2 and SP3 and Server 2003 SP2, allows remote attackers to cause a denial of service (memory consumption and service…

  • CVE-2009-1138Jun 10, 2009
    Microsoft
    Windows 2000
    risk 0.03cvss —epss 0.39

    The LDAP service in Active Directory on Microsoft Windows 2000 SP4 does not properly free memory for LDAP and LDAPS requests, which allows remote attackers to execute arbitrary code via a request that uses hexadecimal encoding, whose associated memory is not released, related to…

  • CVE-2009-0568Jun 10, 2009
    Microsoft
    Windows 2000
    risk 0.03cvss —epss 0.32

    The RPC Marshalling Engine (aka NDR) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly maintain its internal state, which allows remote attackers to overwrite arbitrary memory locations via a crafted…

  • CVE-2009-0565Jun 10, 2009
    Microsoft
    Office
    risk 0.06cvss —epss 0.41

    Buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote…

  • CVE-2009-0563HigKEVJun 10, 2009
    Microsoft
    Office
    risk 0.68cvss 7.8epss 0.63

    Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility…

  • CVE-2009-0239Jun 10, 2009
    Microsoft
    Windows
    risk 0.03cvss —epss 0.33

    Cross-site scripting (XSS) vulnerability in Windows Search 4.0 for Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted file that appears in a preview in a search result, aka "Script…

  • CVE-2009-0230Jun 10, 2009
    Microsoft
    Windows 2000
    risk 0.03cvss —epss 0.35

    The Windows Print Spooler in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 allows remote authenticated users to gain privileges via a crafted RPC message that triggers loading of a DLL file from an arbitrary directory,…

  • CVE-2009-0229Jun 10, 2009
    Microsoft
    Windows 2000
    risk 0.00cvss —epss 0.04

    The Windows Printing Service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 allows local users to read arbitrary files via a crafted separator page, aka "Print Spooler Read File Vulnerability."

  • CVE-2009-0228Jun 10, 2009
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.20

    Stack-based buffer overflow in the EnumeratePrintShares function in Windows Print Spooler Service (win32spl.dll) in Microsoft Windows 2000 SP4 allows remote printer servers to execute arbitrary code via a crafted ShareName in a response to an RPC request, related to "printing…