VYPR

CVEs

390,249 total · page 6562 of 7,805

AllCriticalHighKEV
  • CVE-2014-4174Jun 18, 2014
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.06

    wiretap/libpcap.c in the libpcap file parser in Wireshark 1.10.x before 1.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted packet-trace file that includes a large packet.

  • CVE-2014-4020Jun 18, 2014
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.01

    The dissect_frame function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark 1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to represent an error condition, which allows remote attackers to cause a denial…

  • CVE-2014-3013Jun 18, 2014
    IBM
    Curam Social Program Management
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in IBM Curam Social Program Management 4.5 SP10 through 6.0.5.4 allow remote authenticated users to inject arbitrary web script or HTML via crafted input to a (1) custom JSP or (2) custom renderer.

  • CVE-2014-3012Jun 18, 2014
    IBM
    Curam Social Program Management
    risk 0.00cvss —epss 0.01

    Multiple CRLF injection vulnerabilities in IBM Curam Social Program Management 5.2 SP1 through 6.0.5.4 allow remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified parameters to custom JSPs.

  • CVE-2014-2949Jun 18, 2014
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the web service in F5 ARX Data Manager 3.0.0 through 3.1.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2014-2779Jun 18, 2014
    Microsoft
    Malware Protection Engine
    risk 0.01cvss —epss 0.13

    mpengine.dll in Microsoft Malware Protection Engine before 1.1.10701.0 allows remote attackers to cause a denial of service (system hang) via a crafted file.

  • CVE-2014-2151Jun 18, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.01

    The WebVPN portal in Cisco Adaptive Security Appliance (ASA) Software 8.4(.7.15) and earlier allows remote authenticated users to obtain sensitive information via a crafted JavaScript file, aka Bug ID CSCui04520.

  • CVE-2014-2000Jun 18, 2014
    Ntt
    050 Plus
    risk 0.00cvss —epss 0.01

    The NTT 050 plus application before 4.2.1 for Android allows attackers to obtain sensitive information by leveraging the ability to read system log files.

  • CVE-2014-0910Jun 18, 2014
    IBM
    Websphere Portal
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, and 7.0.0 through 7.0.0.2 CF28 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6221Jun 18, 2014
    Microfocus
    Service Virtualization
    risk 0.09cvss —epss 0.78

    Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1, when the AutoPass license server is enabled, allows remote attackers to create arbitrary files and consequently execute arbitrary code via unspecified vectors, aka…

  • CVE-2014-4309Jun 18, 2014
    Openfiler
    Openfiler
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Openfiler 2.99 allow remote attackers to inject arbitrary web script or HTML via the (1) TinkerAjax parameter to uptime.html, or remote authenticated users to inject arbitrary web script or HTML via the (2) MaxInstances, (3)…

  • CVE-2014-4308Jun 18, 2014
    Nice
    Recording Express
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in NICE Recording eXpress (aka Cybertech eXpress) before 6.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) USRLNM parameter to myaccount/mysettings.edit.validate.asp or the frame parameter to (2)…

  • CVE-2014-4307Jun 18, 2014
    Webtitan
    Webtitan
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in categories-x.php in WebTitan before 4.04 allows remote attackers to execute arbitrary SQL commands via the sortkey parameter.

  • CVE-2014-4306Jun 18, 2014
    Webtitan
    Webtitan
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in logs-x.php in WebTitan before 4.04 allows remote attackers to read arbitrary files via a .. (dot dot) in the logfile parameter in a download action.

  • CVE-2014-4305Jun 18, 2014
    Nice
    Recording Express
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in NICE Recording eXpress (aka Cybertech eXpress) 6.5.7 and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2014-4304Jun 18, 2014
    Sqlbuddy
    SQL Buddy
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in browse.php in SQL Buddy 1.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter.

  • CVE-2014-4303Jun 18, 2014
    Drupac
    Touch
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the (1) Twitter and (2) Facebook username…

  • CVE-2014-4302Jun 18, 2014
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in rating/rating.php in HAM3D Shop Engine allows remote attackers to inject arbitrary web script or HTML via the ID parameter.

  • CVE-2014-4301Jun 18, 2014
    Ajenti
    Ajenti
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the respond_error function in routing.py in Eugene Pankov Ajenti before 1.2.21.7 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) resources.js or (2) resources.css in ajenti:static/,…

  • CVE-2014-3877Jun 18, 2014
    Ulli Horlacher
    Fex
    risk 0.00cvss —epss 0.02

    Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allows remote attackers to conduct cross-site scripting (XSS) attacks via the addto parameter to fup.

  • CVE-2014-3876Jun 18, 2014
    Ulli Horlacher
    Fex
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allow remote attackers to inject arbitrary web script or HTML via the (1) akey parameter to rup or (2) disclaimer or (3) gm parameter to fuc.

  • CVE-2011-2592Jun 18, 2014
    Citrix Systems
    Access Gateway Enterprise Edition Plug-in for Windows
    risk 0.01cvss —epss 0.15

    Heap-based buffer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and 10.0 before 10.0-69.4 allows remote attackers to execute arbitrary code via a long CSEC HTTP…

  • CVE-2014-4193Jun 17, 2014
    Dell
    Bsafe Share
    risk 0.00cvss —epss 0.02

    The TLS implementation in EMC RSA BSAFE-Java Toolkits (aka Share for Java) supports the Extended Random extension during use of the Dual_EC_DRBG algorithm, which makes it easier for remote attackers to obtain plaintext from TLS sessions by requesting long nonces from a server, a…

  • CVE-2014-4192Jun 17, 2014
    Dell
    Bsafe Share
    risk 0.00cvss —epss 0.02

    The Dual_EC_DRBG implementation in EMC RSA BSAFE-C Toolkits (aka Share for C and C++) processes certain requests for output bytes by considering only the requested byte count and not the use of cached bytes, which makes it easier for remote attackers to obtain plaintext from TLS…

  • CVE-2014-4191Jun 17, 2014
    Dell
    Bsafe Share
    risk 0.00cvss —epss 0.02

    The TLS implementation in EMC RSA BSAFE-C Toolkits (aka Share for C and C++) sends a long series of random bytes during use of the Dual_EC_DRBG algorithm, which makes it easier for remote attackers to obtain plaintext from TLS sessions by recovering the algorithm's inner state,…

  • CVE-2014-4040Jun 17, 2014
    Powerpc Utils Project
    Powerpc Utils
    risk 0.00cvss —epss 0.02

    snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by…

  • CVE-2014-4039Jun 17, 2014
    Ppc64 Diagnostic Tools
    ppc64-diag
    risk 0.00cvss —epss 0.00

    ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and…

  • CVE-2014-4038Jun 17, 2014
    Ppc64 Diag Project
    Ppc64 Diag
    risk 0.00cvss —epss 0.00

    ppc64-diag 2.6.1 allows local users to overwrite arbitrary files via a symlink attack related to (1) rtas_errd/diag_support.c and /tmp/get_dt_files, (2) scripts/ppc64_diag_mkrsrc and /tmp/diagSEsnap/snapH.tar.gz, or (3) lpd/test/lpd_ela_test.sh and /var/tmp/ras.

  • CVE-2013-6078Jun 17, 2014
    EMC Corporation
    Rsa Bsafe Toolkits
    risk 0.00cvss —epss 0.01

    The default configuration of EMC RSA BSAFE Toolkits and RSA Data Protection Manager (DPM) 20130918 uses the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm, which makes it easier for context-dependent attackers to defeat cryptographic protection…

  • CVE-2014-4190Jun 17, 2014
    Huawei
    Campus series switch
    risk 0.00cvss —epss 0.01

    Multiple heap-based buffer overflows in Huawei Campus Series Switches S3700HI, S5700, S6700, S3300HI, S5300, S6300, S9300, S7700, and LSW S9700 with software V200R001 before V200R001SPH013; S5700, S6700, S5300, and S6300 with software V200R002 before V200R002SPH005; S7700,…

  • CVE-2014-4189Jun 17, 2014
    Hitachi
    Tuning Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Hitachi Tuning Manager before 7.6.1-06 and 8.x before 8.0.0-04 and JP1/Performance Management - Manager Web Option 07-00 through 07-54 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-4188Jun 17, 2014
    Hitachi
    Tuning Manager
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Hitachi Tuning Manager before 7.6.1-06 and 8.x before 8.0.0-04 and JP1/Performance Management - Manager Web Option 07-00 through 07-54 allows remote attackers to hijack the authentication of unspecified victims via unknown…

  • CVE-2014-4187Jun 17, 2014
    Clip Bucket
    Clipbucket
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in signup.php in ClipBucket allows remote attackers to inject arbitrary web script or HTML via the Username field.

  • CVE-2014-4048Jun 17, 2014
    Asterisk
    Asterisk Open Source
    risk 0.00cvss —epss 0.03

    The PJSIP Channel Driver in Asterisk Open Source before 12.3.1 allows remote attackers to cause a denial of service (deadlock) by terminating a subscription request before it is complete, which triggers a SIP transaction timeout.

  • CVE-2014-4047Jun 17, 2014
    Asterisk
    Certified Asterisk
    risk 0.00cvss —epss 0.05

    Asterisk Open Source 1.8.x before 1.8.28.1, 11.x before 11.10.1, and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 and 11.6 before 11.6-cert3 allows remote attackers to cause a denial of service (connection consumption) via a large number of (1) inactive…

  • CVE-2014-4046Jun 17, 2014
    Asterisk
    Certified Asterisk
    risk 0.00cvss —epss 0.06

    Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action.

  • CVE-2014-4045Jun 17, 2014
    Asterisk
    Asterisk
    risk 0.00cvss —epss 0.03

    The Publish/Subscribe Framework in the PJSIP channel driver in Asterisk Open Source 12.x before 12.3.1, when sub_min_expiry is set to zero, allows remote attackers to cause a denial of service (assertion failure and crash) via an unsubscribe request when not subscribed to the…

  • CVE-2014-4044Jun 17, 2014
    Openafs
    Openafs
    risk 0.00cvss —epss 0.02

    OpenAFS 1.6.8 does not properly clear the fields in the host structure, which allows remote attackers to cause a denial of service (uninitialized memory access and crash) via unspecified vectors related to TMAY requests.

  • CVE-2014-3476Jun 17, 2014
    OpenStack
    Keystone
    risk 0.00cvss —epss 0.02

    OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create…

  • CVE-2014-3249Jun 17, 2014
    Puppet (software)
    Puppet Enterprise
    risk 0.00cvss —epss 0.02

    Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes.

  • CVE-2014-0478Jun 17, 2014
    Debian
    Apt
    risk 0.00cvss —epss 0.02

    APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.

  • CVE-2014-4166Jun 16, 2014
    Shoutcast
    Dnas
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the song history in SHOUTcast DNAS 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the mp3 title field.

  • CVE-2014-4165Jun 16, 2014
    Ntop
    Ntop
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ntop allows remote attackers to inject arbitrary web script or HTML via the title parameter in a list action to plugins/rrdPlugin.

  • CVE-2014-4164Jun 16, 2014
    Manageengine
    Fireflow
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in AlgoSec FireFlow 6.3-b230 allows remote attackers to inject arbitrary web script or HTML via a user signature to SelfService/Prefs.html.

  • CVE-2014-4163Jun 16, 2014
    WordPress
    Featured Comments
    risk 0.03cvss —epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the (1) buried or (2) featured status of a comment via a request to…

  • CVE-2014-4162Jun 16, 2014
    Zyxel
    P 660hw
    risk 0.03cvss —epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Zyxel P-660HW-T1 (v3) wireless router allow remote attackers to hijack the authentication of administrators for requests that change the (1) wifi password or (2) SSID via a request to Forms/WLAN_General_1.

  • CVE-2014-3995Jun 16, 2014
    Reviewboard
    Djblets
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name.

  • CVE-2014-3994Jun 16, 2014
    Reviewboard
    Djblets
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field…

  • CVE-2014-3428Jun 16, 2014
    Yealink
    phones
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary web script or HTML via the model parameter to servlet.

  • CVE-2010-5111Jun 16, 2014
    Echoping Project
    Echoping
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in readline.c in Echoping 6.0.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted reply in the (1) TLS_readline or (2) SSL_readline function, related to the EchoPingHttps Smokeping probe.