VYPR

CVEs

390,222 total · page 6563 of 7,805

AllCriticalHighKEV
  • CVE-2012-3522Jun 13, 2014
    Geshi
    Geshi
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-3521Jun 13, 2014
    Geshi
    Geshi
    risk 0.00cvss —epss 0.03

    Multiple directory traversal vulnerabilities in the cssgen contrib module in GeSHi before 1.0.8.11 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) geshi-path or (2) geshi-lang-path parameter.

  • CVE-2010-5301Jun 13, 2014
    Kolibri
    Kolibri
    risk 0.04cvss —epss 0.11

    Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a HEAD request.

  • CVE-2014-3859Jun 13, 2014
    Isc
    Bind
    risk 0.01cvss —epss 0.07

    libdns in ISC BIND 9.10.0 before P2 does not properly handle EDNS options, which allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted packet, as demonstrated by an attack against named, dig, or delv.

  • CVE-2014-4037Jun 11, 2014
    Fckeditor
    Fckeditor
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor before 2.6.11 and earlier allows remote attackers to inject arbitrary web script or HTML via an array key in the textinputs[] parameter, a…

  • CVE-2014-4036Jun 11, 2014
    Impresscms
    Impresscms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a listimg action.

  • CVE-2014-4035Jun 11, 2014
    Bestsoftinc
    Advance Hotel Booking System
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in booking_details.php in Best Soft Inc. (BSI) Advance Hotel Booking System 2.0 allows remote attackers to inject arbitrary web script or HTML via the title parameter.

  • CVE-2014-4034Jun 11, 2014
    Zero CMS
    Zerocms
    risk 0.03cvss —epss 0.06

    SQL injection vulnerability in zero_view_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the article_id parameter.

  • CVE-2014-4033Jun 11, 2014
    Epignosis
    Efront
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in libraries/includes/personal/profile.php in Epignosis eFront 3.6.14.4 allows remote attackers to inject arbitrary web script or HTML via the surname parameter to student.php.

  • CVE-2014-4032Jun 11, 2014
    Fiyo
    CMS
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in apps/app_comment/form_comment.php in Fiyo CMS 1.5.7 allows remote attackers to inject arbitrary web script or HTML via the Nama field.

  • CVE-2014-3980Jun 11, 2014
    Libfep
    libfep
    risk 0.00cvss —epss 0.00

    libfep 0.0.5 before 0.1.0 does not properly use UNIX domain sockets in the abstract namespace, which allows local users to gain privileges via unspecified vectors.

  • CVE-2014-3970Jun 11, 2014
    Pulseaudio
    Pulseaudio
    risk 0.00cvss —epss 0.01

    The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allows remote attackers to cause a denial of service (assertion failure and abort) via an empty UDP packet.

  • CVE-2014-3915Jun 11, 2014
    Rocketsoftware
    Rocket Servergraph
    risk 0.00cvss —epss 0.03

    The userRequest servlet in the Admin Center for Tivoli Storage Manager in Rocket Servergraph allows remote attackers to execute arbitrary commands via a (1) auth, (2) auth_session, (3) auth_simple, (4) add, (5) add_flat, (6) remove, (7) set_pwd, (8) add_permissions, (9)…

  • CVE-2014-3911Jun 11, 2014
    Samsung Mobile
    Ipolis Device Manager
    risk 0.00cvss —epss 0.06

    Samsung iPOLiS Device Manager before 1.8.7 allow remote attackers to execute arbitrary code via unspecified values to the (1) Start, (2) ChangeControlLocalName, (3) DeleteDeviceProfile, (4) FrameAdvanceReader, or other unknown method in the XNSSDKDEVICE.XnsSdkDeviceCtrlForIpInsta…

  • CVE-2014-3850Jun 11, 2014
    WordPress
    Member Approval
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to…

  • CVE-2014-3782Jun 11, 2014
    Dotclear
    Dotclear
    risk 0.00cvss —epss 0.01

    Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear before 2.6.3 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) double extension or (2) .php5, (3) .phtml, or some…

  • CVE-2014-3781Jun 11, 2014
    Dotclear
    Dotclear
    risk 0.00cvss —epss 0.02

    The dcXmlRpc::setUser method in nc/core/class.dc.xmlrpc.php in Dotclear before 2.6.3 allows remote attackers to bypass authentication via an empty password in an XML-RPC request.

  • CVE-2014-3004Jun 11, 2014
    Castor Project
    Castor
    risk 0.04cvss —epss 0.09

    The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.

  • CVE-2014-2978Jun 11, 2014
    Directfb
    Directfb
    risk 0.00cvss —epss 0.06

    The Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers an out-of-bounds write.

  • CVE-2014-2977Jun 11, 2014
    Directfb
    Directfb
    risk 0.01cvss —epss 0.07

    Multiple integer signedness errors in the Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.13 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers a…

  • CVE-2014-0249Jun 11, 2014
    SSSD
    Sssd
    risk 0.00cvss —epss 0.00

    The System Security Services Daemon (SSSD) 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membership chain, which allows local users to bypass access restrictions via unspecified vectors.

  • CVE-2011-3625Jun 11, 2014
    MPlayer
    Mplayer
    risk 0.05cvss —epss 0.24

    Stack-based buffer overflow in the sub_read_line_sami function in subreader.c in MPlayer, as used in SMPlayer 0.6.9, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a SAMI subtitle file.

  • CVE-2010-5300Jun 11, 2014
    Jzip
    Jzip
    risk 0.04cvss —epss 0.15

    Stack-based buffer overflow in Jzip 1.3 through 2.0.0.132900 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long file name in a zip archive.

  • CVE-2014-3157Jun 11, 2014
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Heap-based buffer overflow in the FFmpegVideoDecoder::GetVideoBuffer function in media/filters/ffmpeg_video_decoder.cc in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging VideoFrame…

  • CVE-2014-3156Jun 11, 2014
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Buffer overflow in the clipboard implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data, related to content/renderer/renderer_clipboard_cli…

  • CVE-2014-3155Jun 11, 2014
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    net/spdy/spdy_write_queue.cc in the SPDY implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging incorrect queue maintenance.

  • CVE-2014-3154Jun 11, 2014
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the ChildThread::Shutdown function in content/child/child_thread.cc in the filesystem API in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to a…

  • CVE-2014-1545Jun 11, 2014
    Mozilla Corporation
    Netscape Portable Runtime
    risk 0.01cvss —epss 0.06

    Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions.

  • CVE-2014-1543Jun 11, 2014
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Multiple heap-based buffer overflows in the navigator.getGamepads function in the Gamepad API in Mozilla Firefox before 30.0 allow remote attackers to execute arbitrary code by using non-contiguous axes with a (1) physical or (2) virtual Gamepad device.

  • CVE-2014-1542Jun 11, 2014
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Buffer overflow in the Speex resampler in the Web Audio subsystem in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code via vectors related to a crafted AudioBuffer channel count and sample rate.

  • CVE-2014-1541Jun 11, 2014
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Use-after-free vulnerability in the RefreshDriverTimer::TickDriver function in the SMIL Animation Controller in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service…

  • CVE-2014-1540Jun 11, 2014
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Use-after-free vulnerability in the nsEventListenerManager::CompileEventHandlerInternal function in the Event Listener Manager in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web…

  • CVE-2014-1539Jun 11, 2014
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 30.0 and Thunderbird through 24.6 on OS X do not ensure visibility of the cursor after interaction with a Flash object and a DIV element, which makes it easier for remote attackers to conduct clickjacking attacks via JavaScript code that produces a fake…

  • CVE-2014-1538Jun 11, 2014
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via…

  • CVE-2014-1537Jun 11, 2014
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the mozilla::dom::workers::WorkerPrivateParent function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

  • CVE-2014-1536Jun 11, 2014
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    The PropertyProvider::FindJustificationRange function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2014-1534Jun 11, 2014
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

  • CVE-2014-1533Jun 11, 2014
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code…

  • CVE-2014-0536Jun 11, 2014
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.11

    Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allow attackers to execute arbitrary code or cause a…

  • CVE-2014-0535Jun 11, 2014
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.10

    Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allow attackers to bypass intended access…

  • CVE-2014-0534Jun 11, 2014
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allow attackers to bypass intended access…

  • CVE-2014-0533Jun 11, 2014
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allows…

  • CVE-2014-0532Jun 11, 2014
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allows…

  • CVE-2014-0531Jun 11, 2014
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allows…

  • CVE-2014-2778Jun 11, 2014
    Microsoft
    Word
    risk 0.02cvss —epss 0.20

    Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted embedded font in a (1) .doc or (2) .docx document, aka "Embedded Font Vulnerability."

  • CVE-2014-2777Jun 11, 2014
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.23

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary web script with increased privileges via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2014-1778.

  • CVE-2014-2776Jun 11, 2014
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.22

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782,…

  • CVE-2014-2775Jun 11, 2014
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.20

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1773,…

  • CVE-2014-2773Jun 11, 2014
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.20

    Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2768.

  • CVE-2014-2772Jun 11, 2014
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.20

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782,…