VYPR

CVEs

389,914 total · page 6571 of 7,799

AllCriticalHighKEV
  • CVE-2013-4544May 8, 2014
    QEMU
    Qemu
    risk 0.00cvss —epss 0.01

    hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices. NOTE: some of these details are obtained from third…

  • CVE-2013-3571May 8, 2014
    Socat
    Socat
    risk 0.00cvss —epss 0.02

    socat 1.2.0.0 before 1.7.2.2 and 2.0.0-b1 before 2.0.0-b6, when used for a listen type address and the fork option is enabled, allows remote attackers to cause a denial of service (file descriptor consumption) via multiple request that are refused based on the (1) sourceport,…

  • CVE-2013-0345May 8, 2014
    Varnish.projects.linpro
    Varnish Cache
    risk 0.00cvss —epss 0.00

    varnish 3.0.3 uses world-readable permissions for the /var/log/varnish/ directory and the log files in the directory, which allows local users to obtain sensitive information by reading the files. NOTE: some of these details are obtained from third party information.

  • CVE-2013-0210May 8, 2014
    Theforeman
    Foreman
    risk 0.00cvss —epss 0.02

    The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands.

  • CVE-2013-0187May 8, 2014
    Theforeman
    Foreman
    risk 0.00cvss —epss 0.01

    Foreman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest or (2) AJAX request.

  • CVE-2013-0174May 8, 2014
    Theforeman
    Foreman
    risk 0.00cvss —epss 0.02

    The external node classifier (ENC) API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request.

  • CVE-2013-0173May 8, 2014
    Theforeman
    Foreman
    risk 0.00cvss —epss 0.01

    Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attackers to guess the password via a brute force attack.

  • CVE-2013-0171May 8, 2014
    Theforeman
    Foreman
    risk 0.00cvss —epss 0.03

    Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.

  • CVE-2012-5477May 8, 2014
    Theforeman
    Foreman
    risk 0.00cvss —epss 0.00

    The smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify files created by the daemon via unspecified vectors.

  • CVE-2014-3426May 8, 2014
    Ncsa
    Ncsa Mosaic
    risk 0.00cvss —epss 0.00

    NCSA Mosaic 2.1 through 2.7b5 allows local users to cause a denial of service ("remote control" outage) by creating a /tmp/Mosaic.pid file for every possible PID.

  • CVE-2014-3425May 8, 2014
    Ncsa
    Ncsa Mosaic
    risk 0.00cvss —epss 0.00

    NCSA Mosaic 2.0 and earlier allows local users to cause a denial of service ("remote control" outage) by creating a /tmp/xmosaic.pid file for every possible PID.

  • CVE-2014-3424May 8, 2014
    GNU
    Emacs
    risk 0.00cvss —epss 0.00

    lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/tramp.##### temporary file.

  • CVE-2014-3423May 8, 2014
    GNU
    Emacs
    risk 0.00cvss —epss 0.00

    lisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/Mosaic.##### temporary file.

  • CVE-2014-3422May 8, 2014
    GNU
    Emacs
    risk 0.00cvss —epss 0.00

    lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file under /tmp/esrc/.

  • CVE-2014-3421May 8, 2014
    GNU
    Emacs
    risk 0.00cvss —epss 0.00

    lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on the /tmp/gnus.face.ppm temporary file.

  • CVE-2014-3215May 8, 2014
    policycoreutils
    seunshare
    risk 0.00cvss —epss 0.00

    seunshare in policycoreutils 2.2.5 is owned by root with 4755 permissions, and executes programs in a way that changes the relationship between the setuid system call and the getresuid saved set-user-ID value, which makes it easier for local users to gain privileges by…

  • CVE-2014-2936May 8, 2014
    Caldera
    Caldera
    risk 0.00cvss —epss 0.02

    The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via (1) the maindir_hotfolder parameter to dirmng/index.php, or an unspecified parameter to (2) PPD/index.php, (3) dirmng/docmd.php, or (4) dirmng/param.php.

  • CVE-2014-2935May 8, 2014
    Caldera
    Caldera
    risk 0.00cvss —epss 0.04

    costview3/xmlrpc_server/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request.

  • CVE-2014-2934May 8, 2014
    Caldera
    Caldera
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the tr parameter to (1) costview2/jobs.php or (2) costview2/printers.php.

  • CVE-2014-2933May 8, 2014
    Caldera
    Caldera
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in dirmng/index.php in Caldera 9.20 allows remote attackers to access arbitrary directories via a crafted pathname.

  • CVE-2014-2602May 8, 2014
    Microfocus
    Oneview
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP OneView 1.0 and 1.01 allows remote authenticated users to gain privileges via unknown vectors.

  • CVE-2014-2136May 8, 2014
    Cisco Systems, Inc.
    Webex Recording Format Player
    risk 0.00cvss —epss 0.04

    Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .arf file, aka…

  • CVE-2014-2135May 8, 2014
    Cisco Systems, Inc.
    Webex Recording Format Player
    risk 0.00cvss —epss 0.04

    Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .arf file, aka…

  • CVE-2014-2134May 8, 2014
    Cisco Systems, Inc.
    Webex Recording Format Player
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted audio…

  • CVE-2014-2133May 8, 2014
    Cisco Systems, Inc.
    Webex Recording Format Player
    risk 0.00cvss —epss 0.03

    Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .arf file that…

  • CVE-2014-2132May 8, 2014
    Cisco Systems, Inc.
    Webex Recording Format Player
    risk 0.00cvss —epss 0.02

    Cisco WebEx Recording Format (WRF) player and Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allow remote attackers to cause a denial of service (application crash) via a crafted (1) .wrf or (2) .arf file that triggers a…

  • CVE-2014-0963May 8, 2014
    IBM
    Global Security Kit
    risk 0.00cvss —epss 0.03

    The Reverse Proxy feature in IBM Global Security Kit (aka GSKit) in IBM Security Access Manager (ISAM) for Web 7.0 before 7.0.0-ISS-SAM-IF0006 and 8.0 before 8.0.0.3-ISS-WGA-IF0002 allows remote attackers to cause a denial of service (infinite loop) via crafted SSL messages.

  • CVE-2014-0930May 8, 2014
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    The ptrace system call in IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.2.x, allows local users to cause a denial of service (system crash) or obtain sensitive information from kernel memory via a crafted PT_LDINFO operation.

  • CVE-2014-0595May 8, 2014
    Novell
    Open Enterprise Server
    risk 0.00cvss —epss 0.00

    /opt/novell/ncl/bin/nwrights in Novell Client for Linux in Novell Open Enterprise Server (OES) 11 Linux SP2 does not properly manage a certain array, which allows local users to obtain the S permission in opportunistic circumstances by leveraging the granting of the F permission…

  • CVE-2014-0362May 8, 2014
    Google
    Search Appliance
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability on Google Search Appliance (GSA) devices before 7.0.14.G.216 and 7.2 before 7.2.0.G.114, when dynamic navigation is configured, allows remote attackers to inject arbitrary web script or HTML via input included in a SCRIPT element.

  • CVE-2014-0116May 8, 2014
    Apache
    Struts
    risk 0.00cvss —epss 0.07

    CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this…

  • CVE-2013-5016May 8, 2014
    Symantec
    Critical System Protection (SCSP)
    risk 0.00cvss —epss 0.02

    Symantec Critical System Protection (SCSP) before 5.2.9, when installed on an unpatched Windows Server 2003 R2 platform, allows remote attackers to bypass policy settings via unspecified vectors.

  • CVE-2014-3124May 7, 2014
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    The HVMOP_set_mem_type control in Xen 4.1 through 4.4.x allows local guest HVM administrators to cause a denial of service (hypervisor crash) or possibly execute arbitrary code by leveraging a separate qemu-dm vulnerability to trigger invalid page table translations for…

  • CVE-2014-2913May 7, 2014
    Nagios
    Remote Plugin Executor
    risk 0.04cvss —epss 0.15

    Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has…

  • CVE-2014-2891May 7, 2014
    Strongswan
    Strongswan
    risk 0.00cvss —epss 0.03

    strongSwan before 5.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a crafted ID_DER_ASN1_DN ID payload.

  • CVE-2014-2191May 7, 2014
    Cisco Systems, Inc.
    Broadcast Access Center for Telco and Wireless
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless (aka BAC-TW) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun91113.

  • CVE-2014-2190May 7, 2014
    Cisco Systems, Inc.
    Broadcast Access Center for Telco and Wireless
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless (aka BAC-TW) allows remote attackers to hijack the authentication of arbitrary users for requests that make BAC-TW changes, aka Bug IDs CSCuo23804 and…

  • CVE-2014-2181May 7, 2014
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    Cisco Adaptive Security Appliance (ASA) Software allows remote authenticated users to read files by sending a crafted URL to the HTTP server, as demonstrated by reading the running configuration, aka Bug ID CSCun78551.

  • CVE-2014-0911May 7, 2014
    IBM
    Websphere Mq
    risk 0.00cvss —epss 0.01

    inetd in IBM WebSphere MQ 7.1.x before 7.1.0.5 and 7.5.x before 7.5.0.4 allows remote attackers to cause a denial of service (disk or CPU consumption) via unspecified vectors.

  • CVE-2014-0685May 7, 2014
    Cisco Systems, Inc.
    Cisco Nexus 1000v Intercloud
    risk 0.00cvss —epss 0.01

    Cisco Nexus 1000V InterCloud 5.2(1)IC1(1.2) and earlier for VMware allows remote attackers to bypass ACL deny statements via crafted (1) IGMPv2 or (2) IGMPv3 packets, aka Bug ID CSCug61691.

  • CVE-2014-0684May 7, 2014
    Cisco Systems, Inc.
    Nexus 7000
    risk 0.00cvss —epss 0.00

    Cisco NX-OS 6.2(2) on Nexus 7000 switches allows local users to cause a denial of service via crafted sed input, aka Bug ID CSCui56136.

  • CVE-2014-0196MedKEVMay 7, 2014
    Linux
    Kernel
    risk 0.46cvss 5.5epss 0.22

    The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering…

  • CVE-2014-0130HigKEVMay 7, 2014
    Rubyonrails
    Rails
    risk 0.65cvss 7.5epss 0.54

    Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to…

  • CVE-2013-7336May 7, 2014
    Libvirt
    Libvirt
    risk 0.00cvss —epss 0.00

    The qemuMigrationWaitForSpice function in qemu/qemu_migration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) by causing…

  • CVE-2013-6726May 7, 2014
    IBM
    Tririga Application Platform
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in WebProcess.srv in IBM TRIRIGA Application Platform 3.2.x and 3.3.x before 3.3.1.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-3204May 6, 2014
    Ayatana Project
    Unity
    risk 0.00cvss —epss 0.00

    Unity before 7.2.1, as used in Ubuntu 14.04, does not properly handle keyboard shortcuts, which allows physically proximate attackers to bypass the lock screen and execute arbitrary commands, as demonstrated by right-clicking on the indicator bar and then pressing the ALT and F2…

  • CVE-2014-3203May 6, 2014
    Ayatana Project
    Unity
    risk 0.00cvss —epss 0.01

    Unity before 7.2.1, as used in Ubuntu 14.04, does not properly restrict access to the Dash when the lock screen is active, which allows physically proximate attackers to bypass the lock screen and execute arbitrary commands, as demonstrated by pressing the SUPER key before the…

  • CVE-2014-3202May 6, 2014
    Ayatana Project
    Unity
    risk 0.00cvss —epss 0.00

    Unity before 7.2.1 does not properly handle entry activation, which allows physically proximate attackers to bypass the lock screen by holding the ENTER key, which triggers the process to crash.

  • CVE-2014-2558May 6, 2014
    WordPress
    File Gallery
    risk 0.00cvss —epss 0.02

    The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function.

  • CVE-2014-0193May 6, 2014
    Netty
    Netty
    risk 0.00cvss —epss 0.04

    WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of…