VYPR

CVEs

390,455 total · page 6549 of 7,810

AllCriticalHighKEV
  • CVE-2014-2819Aug 12, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.12

    Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."

  • CVE-2014-2818Aug 12, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.17

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2014-2817HigKEVAug 12, 2014
    Microsoft
    Internet Explorer
    risk 0.71cvss 8.8epss 0.26

    Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."

  • CVE-2014-2816Aug 12, 2014
    Microsoft
    Sharepoint Server
    risk 0.01cvss —epss 0.16

    Microsoft SharePoint Server 2013 Gold and SP1 and SharePoint Foundation 2013 Gold and SP1 allow remote authenticated users to gain privileges via a Trojan horse app that executes a custom action in the context of the SharePoint extensibility model, aka "SharePoint Page Content…

  • CVE-2014-2815HigAug 12, 2014
    Microsoft
    Onenote
    risk 0.61cvss 8.8epss 0.44

    Microsoft OneNote 2007 SP3 allows remote attackers to execute arbitrary code via a crafted OneNote file that triggers creation of an executable file in a startup folder, aka "OneNote Remote Code Execution Vulnerability."

  • CVE-2014-2811Aug 12, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.16

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2810, CVE-2014-2822,…

  • CVE-2014-2810Aug 12, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.16

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2811, CVE-2014-2822,…

  • CVE-2014-2808Aug 12, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.17

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2796, CVE-2014-2825,…

  • CVE-2014-2796Aug 12, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.17

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2808, CVE-2014-2825,…

  • CVE-2014-2784Aug 12, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.17

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-4051.

  • CVE-2014-2774Aug 12, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.17

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2820,…

  • CVE-2014-1820Aug 12, 2014
    Microsoft
    SQL Server
    risk 0.01cvss —epss 0.15

    Cross-site scripting (XSS) vulnerability in Master Data Services (MDS) in Microsoft SQL Server 2012 SP1 and 2014 on 64-bit platforms allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "SQL Master Data Services XSS Vulnerability."

  • CVE-2014-1819Aug 12, 2014
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly control access to objects…

  • CVE-2014-1814Aug 12, 2014
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    The Windows Installer in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application…

  • CVE-2014-0546CriKEVAug 12, 2014
    Adobe Inc.
    Acrobat
    risk 0.77cvss 9.8epss 0.22

    Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via unspecified vectors.

  • CVE-2014-0318Aug 12, 2014
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly control access to thread-owned…

  • CVE-2014-0316Aug 12, 2014
    Microsoft
    Windows Server 2008
    risk 0.01cvss —epss 0.11

    Memory leak in the Local RPC (LRPC) server implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to cause a denial of service (memory consumption) and…

  • CVE-2014-5201Aug 12, 2014
    WordPress
    Gallery Objects
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter in a go_view_object action to wp-admin/admin-ajax.php.

  • CVE-2014-5200Aug 12, 2014
    WordPress
    FB Gorilla
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in game_play.php in the FB Gorilla plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2014-5199Aug 12, 2014
    Wordpress File Upload Project
    Wordpress File Upload
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of…

  • CVE-2014-5198Aug 12, 2014
    Splunk
    Splunk
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.1.x before 6.1.3 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header.

  • CVE-2014-5197Aug 12, 2014
    Splunk
    Splunk
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in (1) Splunk Web or the (2) Splunkd HTTP Server in Splunk Enterprise 6.1.x before 6.1.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a URI, related to search ids.

  • CVE-2014-5196Aug 12, 2014
    WordPress
    Improved User Search in Backend
    risk 0.00cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS…

  • CVE-2012-4241Aug 12, 2014
    Microcart Project
    Microcart
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Microcart 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO or (2) query string to _admin/index.php or (3) first_name, (4) last_name, (5) cc, (6) exp, (7) cvv, (8) address1, (9)…

  • CVE-2011-2944Aug 12, 2014
    Megalab
    The Uploader
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2011-2593Aug 12, 2014
    Citrix Systems
    Access Gateway Enterprise Edition Plug-in for Windows
    risk 0.00cvss —epss 0.04

    Integer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and 10.0 before 10.0-69.4 allows remote attackers to execute arbitrary code via a crafted Content-Length HTTP…

  • CVE-2013-7395Aug 12, 2014
    Zoll
    Monitor\/defibrillator
    risk 0.00cvss —epss 0.00

    ZOLL Defibrillator / Monitor X Series has a default (1) supervisor password and (2) service password, which allows physically proximate attackers to modify device configuration and cause a denial of service (adverse human health effects).

  • CVE-2007-6756Aug 12, 2014
    Zoll
    Monitor\/defibrillator
    risk 0.00cvss —epss 0.00

    ZOLL Defibrillator / Monitor M Series, E Series, and R Series have a default password for System Configuration mode, which allows physically proximate attackers to modify device configuration and cause a denial of service (adverse human health effects).

  • CVE-2014-3072Aug 12, 2014
    IBM
    Security Appscan Source
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Automation Server in IBM Security AppScan Source 8 through 8.0.0.2, 8.5 through 8.5.0.1, 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, and 9.0 through 9.0.0.1 allows local users to gain privileges by executing a crafted service.

  • CVE-2014-2629Aug 12, 2014
    Microfocus
    NonStop Safeguard Security Software
    risk 0.00cvss —epss 0.02

    HP NonStop Safeguard Security Software G, H06.03 through H06.28.01, and J06.03 through J06.17.01 does not properly evaluate the DISKFILE-PATTERN ACL of a program object file, which allows remote authenticated users to bypass intended restrictions on program access via vectors…

  • CVE-2014-4760Aug 12, 2014
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.02

    Open redirect vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF28, 8.0.0 before 8.0.0.1 CF13, and 8.5.0 before CF01 allows remote attackers to redirect users to arbitrary web sites and conduct phishing…

  • CVE-2014-4751Aug 12, 2014
    IBM
    Security Access Manager For Mobile
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in IBM Security Access Manager for Mobile 8.0.0.0, 8.0.0.1, and 8.0.0.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2014-4746Aug 12, 2014
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.02

    IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF13 and 8.5.0 through CF01 provides different error codes for firewall-traversal requests depending on whether the intranet host exists, which allows remote attackers to map the intranet network via a series of requests.

  • CVE-2014-3899Aug 12, 2014
    Gretech
    GOM Player
    risk 0.00cvss —epss 0.02

    Gretech GOM Player 2.2.51.5149 and earlier allows remote attackers to cause a denial of service (launch outage) via a crafted image file.

  • CVE-2014-3102Aug 12, 2014
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF28 and 8.0.0 before 8.0.0.1 CF13 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2014-2630Aug 12, 2014
    Microfocus
    Operations Agent
    risk 0.04cvss —epss 0.07

    Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via unknown vectors.

  • CVE-2014-0953Aug 12, 2014
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF28, and 8.0.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2014-4757Aug 12, 2014
    IBM
    Content Collector
    risk 0.00cvss —epss 0.00

    The Outlook Extension in IBM Content Collector 4.0.0.x before 4.0.0.0-ICC-OE-IF004 allows local users to bypass the intended Reviewer privilege requirement and read e-mail messages from an arbitrary mailbox by invoking the Search function.

  • CVE-2014-3086Aug 12, 2014
    IBM
    Websphere Real Time
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh 7 FP1 and other products, allows remote attackers to gain privileges by leveraging the ability to execute code in the context of a security manager.

  • CVE-2014-3069Aug 12, 2014
    IBM
    Curam Social Program Management
    risk 0.00cvss —epss 0.01

    Multiple CRLF injection vulnerabilities in the Universal Access component in IBM Curam Social Program Management (SPM) 6.0.5.5, when WebSphere Application Server is not used, allow remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting…

  • CVE-2014-3031Aug 12, 2014
    IBM
    Tivoli Business Service Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 4.2.0 before 4.2.0.0 IF12 and 4.2.1 before 4.2.1.3 IF9 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2014-2631Aug 12, 2014
    Microfocus
    Application LifeCycle Management
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in HP Application Lifecycle Management (aka Quality Center) 11.5x and 12.0x allows local users to gain privileges via unknown vectors, aka ZDI-CAN-2138.

  • CVE-2014-2628Aug 12, 2014
    Microfocus
    Enterprise Maps
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP Enterprise Maps 1 allows remote authenticated users to obtain sensitive information via unknown vectors.

  • CVE-2013-5433Aug 12, 2014
    IBM
    InfoSphere Optim
    risk 0.00cvss —epss 0.01

    The Data Growth Solution for JD Edwards EnterpriseOne in IBM InfoSphere Optim 3.0 through 9.1 has hardcoded database credentials, which allows remote authenticated users to obtain sensitive information by reading an unspecified field in an XML document.

  • CVE-2014-3330Aug 11, 2014
    Cisco Systems, Inc.
    Nexus 9000
    risk 0.00cvss —epss 0.02

    Cisco NX-OS 6.1(2)I2(1) on Nexus 9000 switches does not properly process packet-drop policy checks for logged packets, which allows remote attackers to bypass intended access restrictions via a flood of packets matching a policy that contains the log keyword, aka Bug ID…

  • CVE-2014-3327Aug 11, 2014
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    The EnergyWise module in Cisco IOS 12.2, 15.0, 15.1, 15.2, and 15.4 and IOS XE 3.2.xXO, 3.3.xSG, 3.4.xSG, and 3.5.xE before 3.5.3E allows remote attackers to cause a denial of service (device reload) via a crafted IPv4 packet, aka Bug ID CSCup52101.

  • CVE-2014-3076Aug 11, 2014
    IBM
    Business Process Manager
    risk 0.00cvss —epss 0.02

    IBM Business Process Manager (BPM) 8.5 through 8.5.5 allows remote attackers to obtain potentially sensitive information by visiting an unspecified JSP diagnostic page.

  • CVE-2014-2357Aug 11, 2014
    SUBNET Solutions Inc.
    Substation Server
    risk 0.00cvss —epss 0.03

    The GPT library in the Telegyr 8979 Master Protocol application in SUBNET SubSTATION Server 2 before SSNET 2.12 HF18808 allows remote attackers to cause a denial of service (persistent service crash) via a long RTU-to-Master message.

  • CVE-2014-3336Aug 11, 2014
    Cisco Systems, Inc.
    Unity Connection
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the web framework in Cisco Unity Connection 9.1(2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted request, aka Bug ID CSCuq31016.

  • CVE-2014-3333Aug 11, 2014
    Cisco Systems, Inc.
    Unity Connection
    risk 0.00cvss —epss 0.03

    The server in Cisco Unity Connection 9.1(1) and 9.1(2) allows remote authenticated users to obtain privileged access by conducting an "HTTP Intercept" attack and leveraging the ability to read files within the context of the web-server user account, aka Bug ID CSCup41014.