VYPR

CVEs

390,272 total · page 6559 of 7,806

AllCriticalHighKEV
  • CVE-2014-4695Jul 2, 2014
    Pfsense
    Snort Package
    risk 0.00cvss —epss 0.02

    Multiple open redirect vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the referer parameter to snort_rules_flowbits.php or (2) the returl parameter…

  • CVE-2014-4694Jul 2, 2014
    Pfsense
    Suricata Package
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in suricata_select_alias.php in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via unspecified variables.

  • CVE-2014-4693Jul 2, 2014
    Pfsense
    Snort Package
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the eng parameter to snort_import_aliases.php or (2) unspecified variables to…

  • CVE-2014-4692Jul 2, 2014
    Pfsense
    Pfsense
    risk 0.00cvss —epss 0.02

    pfSense before 2.1.4, when HTTP is used, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

  • CVE-2014-4691Jul 2, 2014
    Pfsense
    Pfsense
    risk 0.00cvss —epss 0.03

    Session fixation vulnerability in pfSense before 2.1.4 allows remote attackers to hijack web sessions via a firewall login cookie.

  • CVE-2014-4690Jul 2, 2014
    Pfsense
    Pfsense
    risk 0.00cvss —epss 0.04

    Multiple directory traversal vulnerabilities in pfSense before 2.1.4 allow (1) remote attackers to read arbitrary .info files via a crafted path in the pkg parameter to pkg_mgr_install.php and allow (2) remote authenticated users to read arbitrary files via the downloadbackup…

  • CVE-2014-4689Jul 2, 2014
    Pfsense
    Pfsense
    risk 0.00cvss —epss 0.03

    Absolute path traversal vulnerability in pkg_edit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full pathname in the xml parameter.

  • CVE-2014-4688Jul 2, 2014
    Pfsense
    Pfsense
    risk 0.04cvss —epss 0.07

    pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via (1) the hostname value to diag_dns.php in a Create Alias action, (2) the smartmonemail value to diag_smart.php, or (3) the database value to status_rrd_graph_img.php.

  • CVE-2014-4687Jul 2, 2014
    Pfsense
    Pfsense
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the starttime0 parameter to firewall_schedule.php, (2) the rssfeed parameter to rss.widget.php, (3) the servicestatusfilter parameter…

  • CVE-2014-3307Jul 2, 2014
    Cisco Systems, Inc.
    Universal Small Cell
    risk 0.00cvss —epss 0.01

    The DHCP client implementation in Universal Small Cell firmware on Cisco Small Cell products allows remote attackers to execute arbitrary commands via crafted DHCP messages, aka Bug ID CSCup47513.

  • CVE-2014-3298Jul 2, 2014
    Cisco Systems, Inc.
    Cloud Portal
    risk 0.00cvss —epss 0.02

    Form Data Viewer in Cisco Intelligent Automation for Cloud in Cisco Cloud Portal places passwords in form data, which allows remote authenticated users to obtain sensitive information by reading HTML source code, aka Bug ID CSCui36976.

  • CVE-2014-3297Jul 2, 2014
    Cisco Systems, Inc.
    Cloud Portal
    risk 0.00cvss —epss 0.02

    Cisco Intelligent Automation for Cloud in Cisco Cloud Portal does not properly restrict the content of MyServices action URLs, which allows remote authenticated users to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the…

  • CVE-2014-3074Jul 2, 2014
    IBM
    Aix
    risk 0.00cvss —epss 0.01

    The runtime linker in IBM AIX 6.1 and 7.1 and VIOS 2.2.x allows local users to create a mode-666 root-owned file, and consequently gain privileges, by setting crafted MALLOCOPTIONS and MALLOCBUCKETS environment-variable values and then executing a setuid program.

  • CVE-2014-3066Jul 2, 2014
    IBM
    Tivoli Endpoint Manager
    risk 0.00cvss —epss 0.02

    IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

  • CVE-2014-4668Jul 2, 2014
    Cherokee
    Cherokee Httpd
    risk 0.00cvss —epss 0.03

    The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.

  • CVE-2014-3100Jul 2, 2014
    Google
    Android
    risk 0.00cvss —epss 0.02

    Stack-based buffer overflow in the encode_key function in /system/bin/keystore in the KeyStore service in Android 4.3 allows attackers to execute arbitrary code, and consequently obtain sensitive key information or bypass intended restrictions on cryptographic operations, via a…

  • CVE-2014-3088Jul 1, 2014
    IBM
    Sametime Meeting Server
    risk 0.00cvss —epss 0.02

    stconf.nsf in IBM Sametime Meeting Server 8.5.1 relies on the client to validate the file format used in wAttach?OpenForm multipart/form-data POST requests, which allows remote authenticated users to bypass intended upload restrictions by modifying the Content-Type header and…

  • CVE-2013-3004Jul 1, 2014
    IBM
    Tivoli Application Dependency Discovery Manager
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in BIRT-Report Viewer in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.x and 7.2.x before 7.2.1.5 allows remote authenticated users to read arbitrary files via unspecified vectors.

  • CVE-2014-3477MedJul 1, 2014
    Xorg
    Dbus
    risk 0.26cvss 4.0epss 0.00

    The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service…

  • CVE-2013-7388Jul 1, 2014
    Google
    Sketchup
    risk 0.01cvss —epss 0.13

    Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689), allows remote attackers to execute arbitrary code via a crafted RLE4-compressed bitmap (BMP). NOTE: this issue was SPLIT from CVE-2013-3664 due to different…

  • CVE-2013-3664Jul 1, 2014
    Google
    Sketchup
    risk 0.02cvss —epss 0.30

    Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers an out-of-bounds stack write. NOTE: this vulnerability exists because of an incomplete…

  • CVE-2013-3662Jul 1, 2014
    Google
    Sketchup
    risk 0.03cvss —epss 0.32

    Timbre SketchUp (formerly Google SketchUp) before 8 Maintenance 2 allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers a stack-based buffer overflow.

  • CVE-2014-3494Jul 1, 2014
    KDE
    Kdelibs
    risk 0.00cvss —epss 0.01

    kio/usernotificationhandler.cpp in the POP3 kioslave in kdelibs 4.10.95 before 4.13.3 does not properly generate warning notifications, which allows man-in-the-middle attackers to obtain sensitive information via an invalid certificate.

  • CVE-2014-3492Jul 1, 2014
    Theforeman
    Foreman
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attackers to inject arbitrary web script or HTML via a parameter (1) name or (2) value related to the host.

  • CVE-2014-3491Jul 1, 2014
    Theforeman
    Foreman
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page, related to create, update, and destroy notification boxes.

  • CVE-2014-4602Jul 1, 2014
    Xen Carousel Plugin Project
    Xen Carousel
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in xencarousel-admin.js.php in the XEN Carousel plugin 0.12.2 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) path or (2) ajaxpath parameter.

  • CVE-2014-4585Jul 1, 2014
    WordPress
    WP-FaceThumb
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the WP-FaceThumb plugin possibly 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the ajax_url parameter to index.php.

  • CVE-2014-4584Jul 1, 2014
    WordPress
    wp-easybooking
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/editFacility.php in the wp-easybooking plugin 1.0.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the fID parameter.

  • CVE-2014-4583Jul 1, 2014
    WordPress
    WP-Contact
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in forms/messages.php in the WP-Contact (wp-contact-sidebar-widget) plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) edit, (2) order_direction, (3) limit_start, (4)…

  • CVE-2014-4575Jul 1, 2014
    WordPress
    Wikipop
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in js/window.php in the Wikipop plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2014-4569Jul 1, 2014
    Videowhisper
    Videowhisper Live Streaming Integration
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ls/vv_login.php in the VideoWhisper Live Streaming Integration plugin 4.27.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the room_name parameter.

  • CVE-2014-4564Jul 1, 2014
    WordPress
    Validated
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in check.php in the Validated plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter.

  • CVE-2014-4556Jul 1, 2014
    WordPress
    Swipe Checkout for eShop
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for eShop plugin 3.7.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter.

  • CVE-2014-4545Jul 1, 2014
    WordPress
    Pro Quoter
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in pq_dialog.php in the Pro Quoter plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) leftorright or (2) author parameter.

  • CVE-2014-4538Jul 1, 2014
    WordPress
    Malware Finder
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in process.php in the Malware Finder plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the query parameter.

  • CVE-2014-4533Jul 1, 2014
    WordPress
    GEO Redirector
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ajax_functions.php in the GEO Redirector plugin 1.0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the hid_id parameter.

  • CVE-2014-4528Jul 1, 2014
    WordPress
    Fbpromotions
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator (fbpromotions) plugin 1.3.4 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) promo_type, (2)…

  • CVE-2014-4521Jul 1, 2014
    WordPress
    dsIDXpress
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX plugin before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.

  • CVE-2014-4520Jul 1, 2014
    Dmca
    Dmca Watermarker
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in phprack.php in the DMCA WaterMarker plugin before 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the plugin_dir parameter.

  • CVE-2014-4518Jul 1, 2014
    WordPress
    Contact Form by ContactMe.com
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in xd_resize.php in the Contact Form by ContactMe.com plugin 2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter.

  • CVE-2014-4516Jul 1, 2014
    Bic Media Widget Plugin
    Bic Media Widget
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in bicm-carousel-preview.php in the BIC Media Widget plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the param parameter.

  • CVE-2014-4515Jul 1, 2014
    WordPress
    AnyFont
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in mce_anyfont/dialog.php in the AnyFont plugin 2.2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the text parameter.

  • CVE-2014-4513Jul 1, 2014
    Activehelper
    Activehelper Livehelp Live Chat
    risk 0.00cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MESSAGE, (2) EMAIL, or (3) NAME parameter.

  • CVE-2014-1383Jul 1, 2014
    Apple Inc.
    TV
    risk 0.00cvss —epss 0.01

    Apple TV before 6.1.2 allows remote authenticated users to bypass an intended password requirement for iTunes Store purchase transactions via unspecified vectors.

  • CVE-2014-1382Jul 1, 2014
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different…

  • CVE-2014-1381Jul 1, 2014
    Apple Inc.
    OS X
    risk 0.00cvss —epss 0.03

    Thunderbolt in Apple OS X before 10.9.4 does not properly restrict IOThunderBoltController API calls, which allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted call.

  • CVE-2014-1380Jul 1, 2014
    Apple Inc.
    OS X
    risk 0.00cvss —epss 0.00

    The Security - Keychain component in Apple OS X before 10.9.4 does not properly implement keystroke observers, which allows physically proximate attackers to bypass the screen-lock protection mechanism, and enter characters into an arbitrary window under the lock window, via…

  • CVE-2014-1379Jul 1, 2014
    Apple Inc.
    OS X
    risk 0.00cvss —epss 0.02

    Graphics Drivers in Apple OS X before 10.9.4 allows attackers to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a 32-bit executable file for a crafted application.

  • CVE-2014-1378Jul 1, 2014
    Apple Inc.
    OS X
    risk 0.00cvss —epss 0.00

    IOGraphicsFamily in Apple OS X before 10.9.4 allows local users to bypass the ASLR protection mechanism by leveraging read access to a kernel pointer in an IOKit object.

  • CVE-2014-1377Jul 1, 2014
    Apple Inc.
    OS X
    risk 0.00cvss —epss 0.04

    Array index error in IOAcceleratorFamily in Apple OS X before 10.9.4 allows attackers to execute arbitrary code via a crafted application.