VYPR

CVEs

390,318 total · page 6557 of 7,807

AllCriticalHighKEV
  • CVE-2014-2792Jul 8, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.16

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2786 and…

  • CVE-2014-2791Jul 8, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.16

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2014-2790Jul 8, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.16

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2787, CVE-2014-2802, and…

  • CVE-2014-2789Jul 8, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.16

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2795,…

  • CVE-2014-2788Jul 8, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.16

    Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2794.

  • CVE-2014-2787Jul 8, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.16

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2790, CVE-2014-2802, and…

  • CVE-2014-2786Jul 8, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.15

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2792 and…

  • CVE-2014-2785Jul 8, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.15

    Microsoft Internet Explorer 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2014-2783Jul 8, 2014
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.09

    Microsoft Internet Explorer 7 through 11 does not prevent use of wildcard EV SSL certificates, which might allow remote attackers to spoof a trust level by leveraging improper issuance of a wildcard certificate by a recognized Certification Authority, aka "Extended Validation…

  • CVE-2014-2781Jul 8, 2014
    Microsoft
    Windows
    risk 0.00cvss —epss 0.06

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly restrict the exchange of keyboard and mouse data between programs at different integrity levels,…

  • CVE-2014-2780Jul 8, 2014
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    DirectShow in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows local users to gain privileges by leveraging control over a low-integrity process to execute a crafted application,…

  • CVE-2014-1824Jul 8, 2014
    Microsoft
    Windows
    risk 0.01cvss —epss 0.19

    Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted Journal (aka .JNT) file, aka…

  • CVE-2014-1767Jul 8, 2014
    Microsoft
    Windows
    risk 0.04cvss —epss 0.13

    Double free vulnerability in the Ancillary Function Driver (AFD) in afd.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows…

  • CVE-2014-2956Jul 8, 2014
    AVG Technologies
    Safeguard
    risk 0.00cvss —epss 0.04

    ScriptHelperApi in the AVG ScriptHelper ActiveX control in ScriptHelper.exe in AVG Secure Search toolbar before 18.1.7.598 and AVG Safeguard before 18.1.7.644 does not implement domain-based access control for method calls, which allows remote attackers to trigger the…

  • CVE-2014-2514Jul 8, 2014
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.03

    EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization and does not properly restrict object types, which allows remote authenticated users to run save RPC commands with super-user…

  • CVE-2014-2513Jul 8, 2014
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.03

    EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization after creation of an object, which allows remote authenticated users to execute arbitrary code with super-user privileges via a custom…

  • CVE-2014-2510Jul 8, 2014
    EMC Corporation
    Documentum Foundation Services
    risk 0.00cvss —epss 0.02

    The JAXB XML parser in EMC Documentum Foundation Services (DFS) 6.6 before P39, 6.7 SP1 before P28, and 6.7 SP2 before P15, as used in My Documentum for Desktop, My Documentum for Microsoft Outlook, and CenterStage, allows remote authenticated users to read arbitrary files via…

  • CVE-2014-4724Jul 7, 2014
    WordPress
    Custom Banners
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Custom Banners plugin 1.2.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the custom_banners_registered_name parameter to wp-admin/options.php.

  • CVE-2014-4723Jul 7, 2014
    WordPress
    Easy Banners
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Easy Banners plugin 1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter to wp-admin/options-general.php.

  • CVE-2014-4722Jul 7, 2014
    Ocsinventory Ng
    Ocsinventory Ng
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the OCS Reports Web Interface in OCS Inventory NG allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-4646Jul 7, 2014
    Foxitsoftware
    PDF SDK
    risk 0.00cvss —epss 0.02

    Buffer overflow in the FPDFBookmark_GetTitle method in Foxit PDF SDK DLL before 3.1.1.5005 allows context-dependent attackers to execute arbitrary code via unspecified vectors.

  • CVE-2014-3489Jul 7, 2014
    Red Hat
    Cloudforms 3.0 Management Engine
    risk 0.00cvss —epss 0.02

    lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords via a brute force attack.

  • CVE-2014-3486Jul 7, 2014
    Red Hat
    Cloudforms 3.0 Management Engine
    risk 0.00cvss —epss 0.00

    The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a…

  • CVE-2014-3481Jul 7, 2014
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.00cvss —epss 0.03

    org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity (XXE) issue.

  • CVE-2014-0248Jul 7, 2014
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.00cvss —epss 0.04

    org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss Enterprise Application Platform (JBEAP) 5.2.0, and JBoss Enterprise Web Platform (JBEWP) 5.2.0 allows remote attackers to execute arbitrary code via a crafted authentication header, related…

  • CVE-2014-0184Jul 7, 2014
    Red Hat
    Cloudforms 3.0 Management Engine
    risk 0.00cvss —epss 0.00

    Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.

  • CVE-2014-0180Jul 7, 2014
    Red Hat
    Cloudforms 3.0 Management Engine
    risk 0.00cvss —epss 0.02

    The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via unspecified vectors.

  • CVE-2014-0176Jul 7, 2014
    Red Hat
    Cloudforms 3.0 Management Engine
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-0035Jul 7, 2014
    Apache
    Cxf
    risk 0.00cvss —epss 0.07

    The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive…

  • CVE-2014-0034Jul 7, 2014
    Apache
    Cxf
    risk 0.00cvss —epss 0.07

    The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.

  • CVE-2013-7389Jul 7, 2014
    Dlink
    DIR-645 Router
    risk 0.05cvss —epss 0.28

    Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceid parameter to parentalcontrols/bind.php, (2) RESULT parameter to info.php, or (3)…

  • CVE-2014-3483Jul 7, 2014
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.04

    SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging…

  • CVE-2014-3482Jul 7, 2014
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.04

    SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper…

  • CVE-2014-3308Jul 7, 2014
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.03

    Cisco IOS XR on Trident line cards in ASR 9000 devices lacks a static punt policer, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted packets, aka Bug ID CSCun83985.

  • CVE-2014-3300Jul 7, 2014
    Cisco Systems, Inc.
    Unified Communications Domain Manager
    risk 0.05cvss —epss 0.22

    The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application Software before 10 does not properly implement access control, which allows remote attackers to modify user information via a crafted URL, aka Bug ID…

  • CVE-2014-3113Jul 7, 2014
    RealNetworks
    Realplayer
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in RealNetworks RealPlayer before 17.0.10.8 allow remote attackers to execute arbitrary code via a malformed (1) elst or (2) stsz atom in an MP4 file.

  • CVE-2014-2969Jul 7, 2014
    Netgear
    Gs108pe
    risk 0.00cvss —epss 0.02

    NETGEAR GS108PE Prosafe Plus switches with firmware 1.2.0.5 have a hardcoded password of debugpassword for the ntgruser account, which allows remote attackers to upload firmware or read or modify memory contents, and consequently execute arbitrary code, via a request to (1)…

  • CVE-2014-2967Jul 7, 2014
    Autodesk
    Vred
    risk 0.00cvss —epss 0.05

    Autodesk VRED Professional 2014 before SR1 SP8 allows remote attackers to execute arbitrary code via Python os library calls in Python API commands to the integrated web server.

  • CVE-2014-2617Jul 7, 2014
    Microfocus
    Universal Cmdb
    risk 0.01cvss —epss 0.12

    Unspecified vulnerability in HP Universal CMDB 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors, aka ZDI-CAN-2104.

  • CVE-2014-2616Jul 7, 2014
    Microfocus
    Universal Cmdb
    risk 0.01cvss —epss 0.08

    Unspecified vulnerability in HP Universal CMDB 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors, aka ZDI-CAN-2091.

  • CVE-2014-2615Jul 7, 2014
    Microfocus
    Universal Cmdb
    risk 0.01cvss —epss 0.08

    Unspecified vulnerability in HP Universal CMDB 10.01 and 10.10 allows remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors, aka ZDI-CAN-2083.

  • CVE-2014-2614Jul 7, 2014
    Microfocus
    Sitescope
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in HP SiteScope 11.1x through 11.13 and 11.2x through 11.24 allows remote attackers to bypass authentication via unknown vectors, aka ZDI-CAN-2140.

  • CVE-2014-2198Jul 7, 2014
    Cisco Systems, Inc.
    Unified Communications Domain Manager
    risk 0.00cvss —epss 0.04

    Cisco Unified Communications Domain Manager (CDM) in Unified CDM Platform Software before 4.4.2 has a hardcoded SSH private key, which makes it easier for remote attackers to obtain access to the support and root accounts by extracting this key from a binary file found in a…

  • CVE-2014-2197Jul 7, 2014
    Cisco Systems, Inc.
    Unified Communications Domain Manager
    risk 0.00cvss —epss 0.03

    The Administration GUI in the web framework in Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application Software before 8.1.4 does not properly implement access control, which allows remote authenticated users to modify administrative credentials via a…

  • CVE-2014-0894Jul 7, 2014
    IBM
    Algo Credit Limits
    risk 0.03cvss —epss 0.04

    RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows context-dependent attackers to discover database credentials by reading the DbUser and DbPass fields in an XML document.

  • CVE-2014-0875Jul 7, 2014
    IBM
    Storwize Unified V7000
    risk 0.00cvss —epss 0.01

    Active Cloud Engine (ACE) in IBM Storwize V7000 Unified 1.3.0.0 through 1.4.3.x allows remote attackers to bypass intended ACL restrictions in opportunistic circumstances by leveraging incorrect ACL synchronization over an unreliable NFS connection that requires retransmissions.

  • CVE-2014-0871Jul 7, 2014
    IBM
    Algo Credit Limits
    risk 0.03cvss —epss 0.06

    RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote attackers to obtain potentially sensitive Tomcat stack-trace information via non-printing characters in a cookie to the /classes/ URI, as demonstrated by the \x00…

  • CVE-2014-0870Jul 7, 2014
    IBM
    Algo Credit Limits
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allow remote attackers to inject arbitrary web script or HTML via (1) the Message parameter to rcore6/main/showerror.jsp,…

  • CVE-2014-0869Jul 7, 2014
    IBM
    Algo Credit Limits
    risk 0.03cvss —epss 0.05

    The decrypt function in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics does not require a key, which makes it easier for remote attackers to obtain cleartext passwords by sniffing the network and then providing a string…

  • CVE-2014-0868Jul 7, 2014
    IBM
    Algo Credit Limits
    risk 0.03cvss —epss 0.04

    RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via a crafted XML document, as…