VYPR

CVEs

388,348 total · page 6575 of 7,767

AllCriticalHighKEV
  • CVE-2013-6724Feb 1, 2014
    IBM
    Spss Samplepower
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the vsflex8l ActiveX control in IBM SPSS SamplePower 3.0.1 before FP1 IF1 allows remote attackers to execute arbitrary code via a crafted ComboList property value.

  • CVE-2013-4043Feb 1, 2014
    IBM
    Spss Collaboration And Deployment Services
    risk 0.00cvss —epss 0.01

    The server in IBM SPSS Collaboration and Deployment Services 4.x before 4.2.1.3 IF3, 5.x before 5.0 FP3, and 6.x before 6.0 IF1 allows remote attackers to read arbitrary files via an unspecified HTTP request.

  • CVE-2014-0001Jan 31, 2014
    MariaDB
    MariaDB
    risk 0.01cvss —epss 0.06

    Buffer overflow in client/mysql.cc in Oracle MySQL and MariaDB before 5.5.35 allows remote database servers to cause a denial of service (crash) and possibly execute arbitrary code via a long server version string.

  • CVE-2013-6143Jan 31, 2014
    Schneider Electric
    Telvent SAGE 3030 RTU
    risk 0.00cvss —epss 0.01

    The Schneider Electric Telvent SAGE 3030 RTU with firmware C3413-500-001D3_P4 and C3413-500-001F0_PB allows remote attackers to cause a denial of service (temporary outage and CPU consumption) via malformed DNP3 traffic.

  • CVE-2014-1204Jan 31, 2014
    Tableausoftware
    Server
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in Tableau Server 8.0.x before 8.0.7 and 8.1.x before 8.1.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be exploited by unauthenticated remote attackers if the guest user is enabled.

  • CVE-2013-6235Jan 31, 2014
    Steve Souza
    Java Application Monitor
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in JAMon (Java Application Monitor) 2.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listenertype or (2) currentlistener parameter to mondetail.jsp or ArraySQL parameter to (3)…

  • CVE-2013-4979Jan 31, 2014
    Ideamk
    Eps Viewer
    risk 0.00cvss —epss 0.05

    Buffer overflow in the gldll32.dll module in EPS Viewer 3.2 and earlier allows remote attackers to execute arbitrary code via a crafted EPS file.

  • CVE-2013-4383Jan 31, 2014
    Drupal
    jQuery Countdown
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the jQuery Countdown module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-0757Jan 31, 2014
    3S Smart Software Solutions
    CoDeSys Runtime Toolkit
    risk 0.00cvss —epss 0.04

    Smart Software Solutions (3S) CoDeSys Runtime Toolkit before 2.4.7.44 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.

  • CVE-2013-6727Jan 31, 2014
    IBM
    Sametime
    risk 0.00cvss —epss 0.02

    The Connect client in IBM Sametime 8.5.2 through 8.5.2.1 and 9.0 before HF1 does not properly restrict unsigned Java plugins, which allows remote attackers to obtain sensitive information via unspecified vectors.

  • CVE-2014-1610Jan 30, 2014
    MediaWiki
    Mediawiki
    risk 0.06cvss —epss 0.43

    MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w…

  • CVE-2013-7303Jan 30, 2014
    Spip
    Spip
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in (1) squelettes-dist/formulaires/inscription.php and (2) prive/forms/editer_auteur.php in SPIP before 2.1.25 and 3.0.x before 3.0.13 allow remote attackers to inject arbitrary web script or HTML via the author name field.

  • CVE-2014-1837Jan 30, 2014
    Stackideas
    Komento
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the StackIdeas Komento (com_komento) component before 1.7.4 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors related to "checking new comments."

  • CVE-2014-1612Jan 30, 2014
    Media5Corp
    Mediatrix 4402
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in login.esp in the Web Management Interface in Media5 Mediatrix 4402 VoIP Gateway with firmware Dgw 1.1.13.186 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.

  • CVE-2014-1611Jan 30, 2014
    Drupal
    Anonymous Posting
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Anonymous Posting module 7.x-1.2 and 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the contact name field.

  • CVE-2014-0793Jan 30, 2014
    Stackideas
    Komento
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website or (2) latitude parameter in a comment to the default URI.

  • CVE-2013-7246Jan 30, 2014
    Daum
    Daumgame Activex Control
    risk 0.04cvss —epss 0.11

    Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allows remote attackers to execute arbitrary code via a long string, as exploited in the wild in January 2014.

  • CVE-2013-3090Jan 30, 2014
    Belkin
    N300
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Belkin N300 router allow remote attackers to inject arbitrary web script or HTML via the Guest Access PSK field to wireless_guest2_print.stm or other unspecified vectors.

  • CVE-2013-3087Jan 30, 2014
    Belkin
    N900
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Belkin N900 router allow remote attackers to inject arbitrary web script or HTML via the (1) ssid2 parameter to wl_channel.html or (2) guest_psk parameter to wl_guest.html.

  • CVE-2013-3084Jan 30, 2014
    Belkin
    F5d8236 4 V2
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Belkin Model F5D8236-4 v2 router allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-1376Jan 30, 2014
    Adobe Inc.
    Acrobat
    risk 0.01cvss —epss 0.07

    Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0606, CVE-2013-0612, CVE-2013-0615, CVE-2013-0617, and…

  • CVE-2013-0177Jan 30, 2014
    Apache
    Ofbiz
    risk 0.00cvss —epss 0.21

    Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1)…

  • CVE-2012-3000Jan 30, 2014
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in sam/admin/reports/php/saveSettings.php in the (1) APM WebGUI in F5 BIG-IP LTM, GTM, ASM, Link Controller, PSM, APM, Edge Gateway, and Analytics and (2) AVR WebGUI in WebAccelerator and WOM 11.2.x before 11.2.0-HF3 and 11.2.x before…

  • CVE-2014-0838Jan 30, 2014
    IBM
    QRadar SIEM
    risk 0.00cvss —epss 0.02

    The AutoUpdate package before 6.4 for IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to execute arbitrary console commands by leveraging control of the server.

  • CVE-2014-0837Jan 30, 2014
    IBM
    QRadar SIEM
    risk 0.00cvss —epss 0.01

    The AutoUpdate process in IBM Security QRadar SIEM 7.2 MR1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

  • CVE-2014-0836Jan 30, 2014
    IBM
    QRadar SIEM
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2014-0835Jan 30, 2014
    IBM
    QRadar SIEM
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify console Auto Update settings.

  • CVE-2014-1683Jan 29, 2014
    Skybluecanvas
    Skybluecanvas
    risk 0.06cvss —epss 0.31

    The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or…

  • CVE-2013-7318Jan 29, 2014
    Manageengine
    Firewallanalyzer
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in BusinessFlow/login in AlgoSec Firewall Analyzer 6.4 allows remote attackers to inject arbitrary web script or HTML via the message parameter.

  • CVE-2013-6141Jan 29, 2014
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in op5 Monitor before 6.1.3 allows attackers to read arbitrary files via unknown vectors related to lack of authorization.

  • CVE-2013-5092Jan 29, 2014
    Manageengine
    Firewallanalyzer
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in afa/php/Login.php in AlgoSec Firewall Analyzer 6.1-b86 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  • CVE-2013-5005Jan 29, 2014
    Tripwire
    Tripwire Enterprise
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ajaxRequest/methodCall.do in Tripwire Enterprise 8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) m_target_class_name, (2) m_target_method_name, or (3) m_request_context_params…

  • CVE-2013-4898Jan 29, 2014
    Socialengine
    Socialengine
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the…

  • CVE-2013-4889Jan 29, 2014
    Xibosignage
    Xibo
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new administrator via the AddUser action or (2) conduct cross-site scripting…

  • CVE-2013-4888Jan 29, 2014
    Xibosignage
    Xibo
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page.

  • CVE-2013-4887Jan 29, 2014
    Xibosignage
    Xibo
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter.

  • CVE-2013-4662Jan 29, 2014
    Civicrm
    Civicrm
    risk 0.00cvss —epss 0.01

    The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.

  • CVE-2013-4661Jan 29, 2014
    Civicrm
    Civicrm
    risk 0.00cvss —epss 0.01

    CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which allows remote authenticated users with the "access CiviCRM" permission to bypass intended access restrictions, as…

  • CVE-2013-2747Jan 29, 2014
    Courion
    Access Risk Management Suite
    risk 0.00cvss —epss 0.01

    The password reset feature in Courion Access Risk Management Suite Version 8 Update 9 allows remote authenticated users to bypass intended Internet Explorer usage restrictions and execute arbitrary commands by using keyboard shortcuts to navigate the file system and open a…

  • CVE-2012-6086Jan 29, 2014
    Zabbix
    Zabbix
    risk 0.00cvss —epss 0.01

    libs/zbxmedia/eztexting.c in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.8rc1, and 2.1.x before 2.1.2 does not properly set the CURLOPT_SSL_VERIFYHOST option for libcurl, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

  • CVE-2014-0682Jan 29, 2014
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.00cvss —epss 0.02

    Cisco WebEx Meetings Server allows remote authenticated users to bypass authorization checks and (1) join arbitrary meetings, or (2) terminate a meeting without having a host role, via a crafted URL, aka Bug ID CSCuj42346.

  • CVE-2014-0681Jan 29, 2014
    Cisco Systems, Inc.
    Identity Services Engine Software
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages,…

  • CVE-2014-0680Jan 29, 2014
    Cisco Systems, Inc.
    Identity Services Engine Software
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038.

  • CVE-2014-1692HigJan 29, 2014
    OpenSSH
    OpenSSH
    risk 0.48cvss 7.3epss 0.05

    The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other…

  • CVE-2014-0810Jan 29, 2014
    Justsystems
    Sanshiro
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in JustSystems Sanshiro 2007 before update 3, 2008 before update 5, 2009 before update 6, and 2010 before update 6, and Sanshiro Viewer before 2.0.2.0, allows remote attackers to execute arbitrary code via a crafted document.

  • CVE-2013-6931Jan 29, 2014
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the API in Cybozu Garoon 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6929.

  • CVE-2013-6930Jan 29, 2014
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the page-navigation implementation in Cybozu Garoon 2.0.0 through 2.0.6, 2.1.0 through 2.1.3, 2.5.0 through 2.5.4, 3.0.0 through 3.0.3, 3.5.0 through 3.5.5, and 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL commands…

  • CVE-2013-6749Jan 29, 2014
    IBM
    Lotus Quickr
    risk 0.00cvss —epss 0.04

    Buffer overflow in the ActiveX control in qp2.cab in IBM Lotus Quickr for Domino 8.5.1 before 8.5.1.42-001b allows remote attackers to execute arbitrary code via a crafted HTML document, a different vulnerability than CVE-2013-6748.

  • CVE-2013-6748Jan 29, 2014
    IBM
    Lotus Quickr
    risk 0.00cvss —epss 0.03

    Buffer overflow in the ActiveX control in qp2.cab in IBM Lotus Quickr for Domino 8.5.1 before 8.5.1.42-001b allows remote attackers to execute arbitrary code via a crafted HTML document, a different vulnerability than CVE-2013-6749.

  • CVE-2013-2974Jan 29, 2014
    IBM
    Tivoli Application Dependency Discovery Manager
    risk 0.00cvss —epss 0.01

    The BIRT viewer in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.1.x before 7.2.1.5 allows remote authenticated users to bypass authorization checks and obtain report-administration privileges, and consequently create or delete reports or conduct SQL injection…