VYPR

CVEs

390,250 total · page 6561 of 7,805

AllCriticalHighKEV
  • CVE-2014-4336Jun 22, 2014
    Openprinting
    cups-filters
    risk 0.00cvss —epss 0.01

    The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name. NOTE: this vulnerability exists because of an incomplete fix for…

  • CVE-2014-4509Jun 21, 2014
    Novell
    Identity Manager
    risk 0.00cvss —epss 0.00

    The MKDQUOTESAFE function in the Fan-out driver scripts in Fan-Out Platform Services in Novell Identity Manager (aka IDM) 4.0.2 allows local users to execute arbitrary commands by leveraging eDirectory POSIX attribute changes to insert shell metacharacters.

  • CVE-2014-3883Jun 21, 2014
    Usermin
    Usermin
    risk 0.00cvss —epss 0.01

    Usermin before 1.600 allows remote attackers to execute arbitrary operating-system commands via unspecified vectors related to a user action.

  • CVE-2014-3431Jun 21, 2014
    Symantec
    Encryption Desktop
    risk 0.00cvss —epss 0.00

    Symantec PGP Desktop 10.x, and Encryption Desktop Professional 10.3.x before 10.3.2 MP2, on OS X uses world-writable permissions for temporary files, which allows local users to bypass intended restrictions on file reading, modification, creation, and permission changes via…

  • CVE-2014-3296Jun 21, 2014
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.00cvss —epss 0.01

    The XML programmatic interface (XML PI) in Cisco WebEx Meeting Server 1.5(.1.131) and earlier allows remote authenticated users to obtain sensitive meeting information via a crafted URL, aka Bug ID CSCum03527.

  • CVE-2014-3073Jun 21, 2014
    IBM
    Security Access Manager For Web 8.0 Firmware
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in IBM Security Access Manager (ISAM) for Mobile 8.0 and IBM Security Access Manager for Web 7.0 and 8.0 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2014-3053Jun 21, 2014
    IBM
    Security Access Manager For Web 8.0 Firmware
    risk 0.00cvss —epss 0.01

    The Local Management Interface (LMI) in IBM Security Access Manager (ISAM) for Mobile 8.0 with firmware 8.0.0.0 through 8.0.0.3 and IBM Security Access Manager for Web 7.0, and 8.0 with firmware 8.0.0.2 and 8.0.0.3, allows remote attackers to bypass authentication via a login…

  • CVE-2014-3052Jun 21, 2014
    IBM
    Security Access Manager For Web 8.0 Firmware
    risk 0.00cvss —epss 0.00

    The reverse-proxy feature in IBM Security Access Manager (ISAM) for Web 8.0 with firmware 8.0.0.2 and 8.0.0.3 interprets the jct-nist-compliance parameter in the opposite of the intended manner, which makes it easier for remote attackers to obtain sensitive information by…

  • CVE-2013-6737Jun 21, 2014
    IBM
    Storwize Unified V7000
    risk 0.00cvss —epss 0.02

    IBM System Storage Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.0 does not properly restrict the content of a dump file upon encountering a 1691 hardware fault, which allows remote authenticated users to obtain sensitive customer-data fragments by reading this file after…

  • CVE-2012-5106Jun 20, 2014
    Freefloat
    FTP Server
    risk 0.04cvss —epss 0.14

    Stack-based buffer overflow in FreeFloat FTP Server 1.0 allows remote authenticated users to execute arbitrary code via a long string in a PUT command.

  • CVE-2014-4507Jun 20, 2014
    Theforeman
    Foreman
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the dst parameter to tftp/fetch_boot_file.

  • CVE-2014-4506Jun 20, 2014
    Drupal
    Custom Meta
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Custom Meta module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "administer custom meta settings" permission to inject arbitrary web script or HTML via the (1) attribute or…

  • CVE-2014-4505Jun 20, 2014
    Drupal
    Easy Breadcrumb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Easy Breadcrumb module 7.x-2.x before 7.x-2.10 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-3496Jun 20, 2014
    Red Hat
    Openshift
    risk 0.00cvss —epss 0.05

    cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a (1) .tar.gz, (2) .zip, (3) .tgz, or (4) .tar file extension in a cartridge manifest file.

  • CVE-2014-0007Jun 20, 2014
    Theforeman
    Foreman
    risk 0.04cvss —epss 0.09

    The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.

  • CVE-2012-2591Jun 20, 2014
    Emailarchitect
    Email Server
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 10.0 and 10.0.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) From or (2) Date field in an email.

  • CVE-2012-2580Jun 20, 2014
    WordPress
    Postie
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Postie plugin 1.4.3, and possibly before 1.5.15, for WordPress allows remote attackers to inject arbitrary web script or HTML via the From field of an email.

  • CVE-2012-2579Jun 20, 2014
    WordPress
    WP SimpleMail
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in the WP SimpleMail plugin 1.0.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) To, (2) From, (3) Date, or (4) Subject field of an email.

  • CVE-2012-0273Jun 20, 2014
    Hans Alshoff
    Minalic
    risk 0.00cvss —epss 0.03

    Multiple stack-based buffer overflows in MinaliC 2.0.0 allow remote attackers to execute arbitrary code via a (1) session_id cookie in a request to the get_cookie_value function in response.c, (2) directory name in a request to the add_default_file function in response.c, or (3)…

  • CVE-2011-4821Jun 20, 2014
    Dlink
    Dir 601 Firmware
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the TFTP server in D-Link DIR-601 Wireless N150 Home Router with firmware 1.02NA allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2012-2052Jun 19, 2014
    Adobe Inc.
    Photoshop
    risk 0.05cvss —epss 0.23

    Stack-based buffer overflow in the U3D.8BI library plugin in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to execute arbitrary code via a long Collada asset element in a DAE file, as demonstrated by the cameraYFov value in the…

  • CVE-2013-1068Jun 19, 2014
    Ubuntu
    OpenStack Nova (python-nova)
    risk 0.00cvss —epss 0.01

    The OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.2 and 1:2014.1-0 before 1:2014.1-0ubuntu1.2 and Openstack Cinder (python-cinder) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.1 and 1:2014.1-0 before 1:2014.1-0ubuntu1.1 for Ubuntu 13.10 and…

  • CVE-2014-4335Jun 19, 2014
    Barracudadrive
    Barracudadrive
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) host or (2) password parameter to rtl/protected/admin/ddns/.

  • CVE-2014-4334Jun 19, 2014
    Ubi
    Rayman Legends
    risk 0.04cvss —epss 0.15

    Stack-based buffer overflow in Ubisoft Rayman Legends before 1.3.140380 allows remote attackers to execute arbitrary code via a long string in the "second connection" to TCP port 1001.

  • CVE-2014-4333Jun 19, 2014
    Boonex
    Dolphin
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in administration/profiles.php in Dolphin 7.1.4 and earlier allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the members[] parameter, related to…

  • CVE-2014-4155Jun 19, 2014
    Zte
    Zxv10 W300 Firmware
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in the ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a request to Forms/tools_admin_1.

  • CVE-2014-3810Jun 19, 2014
    Boonex
    Dolphin
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in administration/profiles.php in BoonEx Dolphin 7.1.4 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the members[] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-4333.

  • CVE-2014-3778Jun 19, 2014
    Arris
    SBG901 SURFboard Wireless Cable Modem
    risk 0.03cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in goform/RgDdns in ARRIS (formerly Motorola) SBG901 SURFboard Wireless Cable Modem allow remote attackers to hijack the authentication of administrators for requests that (1) change the dns service via the DdnsService…

  • CVE-2012-2572Jun 19, 2014
    WordPress
    ThreeWP Email Reflector
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the ThreeWP Email Reflector plugin before 1.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the Subject of an email.

  • CVE-2012-2569Jun 19, 2014
    Synametrics
    Xeams
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Synametrics Technologies Xeams 4.4 Build 5720 allows remote attackers to inject arbitrary web script or HTML via the body of an email.

  • CVE-2012-1621Jun 19, 2014
    Apache
    Ofbiz
    risk 0.00cvss —epss 0.10

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.02 allow remote attackers to inject arbitrary web script or HTML via (1) a parameter array in freemarker templates, the (2) contentId or (3) mapKey parameter…

  • CVE-2011-4367Jun 19, 2014
    Apache
    Myfaces
    risk 0.00cvss —epss 0.34

    Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2)…

  • CVE-2014-4329Jun 19, 2014
    Ntop
    Ntopng
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows remote attackers to inject arbitrary web script or HTML via the host parameter.

  • CVE-2014-2962Jun 19, 2014
    Belkin
    N150 F9k1009
    risk 0.07cvss —epss 0.47

    Absolute path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware before 1.00.08 allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.

  • CVE-2014-2782Jun 19, 2014
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.22

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,…

  • CVE-2014-2611Jun 19, 2014
    Microfocus
    Executive Scorecard
    risk 0.01cvss —epss 0.12

    Directory traversal vulnerability in the fndwar web application in HP Executive Scorecard 9.40 and 9.41 allows remote authenticated users to execute arbitrary code, or obtain sensitive information or delete data, via unspecified vectors, aka ZDI-CAN-2120.

  • CVE-2014-2610Jun 19, 2014
    Microfocus
    Executive Scorecard
    risk 0.00cvss —epss 0.05

    Directory traversal vulnerability in the Content Acceleration Pack (CAP) web application in HP Executive Scorecard 9.40 and 9.41 allows remote authenticated users to execute arbitrary code by uploading an executable file, aka ZDI-CAN-2117.

  • CVE-2014-2609Jun 19, 2014
    Microfocus
    Executive Scorecard
    risk 0.01cvss —epss 0.13

    The Java Glassfish Admin Console in HP Executive Scorecard 9.40 and 9.41 does not require authentication, which allows remote attackers to execute arbitrary code via a session on TCP port 10001, aka ZDI-CAN-2116.

  • CVE-2014-2001Jun 19, 2014
    East Japan Railway Company
    JR East Japan
    risk 0.00cvss —epss 0.01

    The East Japan Railway Company JR East Japan application before 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate.

  • CVE-2014-4153Jun 18, 2014
    Alienvault
    Ossim
    risk 0.04cvss —epss 0.07

    The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to read arbitrary files via a crafted get_file request.

  • CVE-2014-4152Jun 18, 2014
    Alienvault
    Ossim
    risk 0.00cvss —epss 0.06

    The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to execute arbitrary code via a crafted remote_task request, related to injecting an ssh public key.

  • CVE-2014-4151Jun 18, 2014
    Alienvault
    Ossim
    risk 0.01cvss —epss 0.07

    The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to create arbitrary files and execute arbitrary code via a crafted set_file request.

  • CVE-2014-4049Jun 18, 2014
    PHP
    PHP
    risk 0.00cvss —epss 0.11

    Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dns_get_record function.

  • CVE-2014-4021Jun 18, 2014
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    Xen 3.2.x through 4.4.x does not properly clean memory pages recovered from guests, which allows local guest OS users to obtain sensitive information via unspecified vectors.

  • CVE-2014-1652Jun 18, 2014
    Symantec
    Web Gateway
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the management console in Symantec Web Gateway (SWG) before 5.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified report parameters.

  • CVE-2014-1651Jun 18, 2014
    Symantec
    Web Gateway
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in clientreport.php in the management console in Symantec Web Gateway (SWG) before 5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2014-1650Jun 18, 2014
    Symantec
    Web Gateway
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in user.php in the management console in Symantec Web Gateway (SWG) before 5.2.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-5017CriJun 18, 2014
    Symantec
    Web Gateway
    risk 0.64cvss 9.8epss 0.07

    SNMPConfig.php in the management console in Symantec Web Gateway (SWG) before 5.2.1 allows remote attackers to execute arbitrary commands via unspecified vectors.

  • CVE-2012-2592Jun 18, 2014
    Gecad Technologies
    Mail Server
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Axigen Mail Server 8.0.1 allows remote attackers to inject arbitrary web script or HTML via the body of an email.

  • CVE-2014-0599Jun 18, 2014
    Novell
    Open Enterprise Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in iPrint in Novell Open Enterprise Server (OES) 11 SP1 before Maintenance Update 9151 on Linux allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.