VYPR

CVEs

388,310 total · page 6576 of 7,767

AllCriticalHighKEV
  • CVE-2013-7137CriJan 26, 2014
    Burden Project
    Burden
    risk 0.61cvss 9.8epss 0.16

    The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and gain privileges by setting the burden_user_rememberme cookie to 1.

  • CVE-2013-6891Jan 26, 2014
    Apple Inc.
    Cups
    risk 0.00cvss —epss 0.00

    lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf.

  • CVE-2013-6853Jan 26, 2014
    Yahoo
    Toolbar
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in clickstream.js in Y! Toolbar plugin for FireFox 3.1.0.20130813024103 for Mac, and 2.5.9.2013418100420 for Windows, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that is stored by the victim.

  • CVE-2013-5364Jan 26, 2014
    Secunia
    Csi Agent
    risk 0.00cvss —epss 0.00

    Secunia CSI Agent 6.0.0.15017 and earlier, 6.0.1.1007 and earlier, and 7.0.0.21 and earlier, when running on Red Hat Linux, uses world-readable and world-writable permissions for /etc/csia_config.xml, which allows local users to change CSI Agent configuration by modifying this…

  • CVE-2014-0751Jan 25, 2014
    Ge
    Cimplicity
    risk 0.00cvss —epss 0.03

    The CIMPLICITY Web-based access component, CimWebServer, does not check the location of shell files being loaded into the system. By modifying the source location, an attacker could send shell code to the CimWebServer which would deploy the nefarious files as part of any…

  • CVE-2014-0750Jan 25, 2014
    GE Intelligent Platforms
    Proficy Process Systems with CIMPLICITY
    risk 0.09cvss —epss 0.70

    Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP…

  • CVE-2014-0678Jan 25, 2014
    Cisco Systems, Inc.
    Secure Access Control System
    risk 0.00cvss —epss 0.01

    The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951.

  • CVE-2014-0673Jan 25, 2014
    Cisco Systems, Inc.
    Video Surveillance 5000 HD IP Dome cameras
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Cisco Video Surveillance 5000 HD IP Dome cameras allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCud10943 and CSCud10950.

  • CVE-2014-1670Jan 25, 2014
    Microsoft
    Bing
    risk 0.01cvss —epss 0.14

    The Microsoft Bing application before 4.2.1 for Android allows remote attackers to install arbitrary APK files via vectors involving a crafted DNS response.

  • CVE-2014-1202Jan 25, 2014
    Eviware
    Soapui
    risk 0.00cvss —epss 0.08

    The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.

  • CVE-2014-1476Jan 24, 2014
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page.

  • CVE-2014-1475Jan 24, 2014
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.

  • CVE-2014-1447Jan 24, 2014
    Libvirt
    Libvirt
    risk 0.00cvss —epss 0.02

    Race condition in the virNetServerClientStartKeepAlive function in libvirt before 1.2.1 allows remote attackers to cause a denial of service (libvirtd crash) by closing a connection before a keepalive response is sent.

  • CVE-2014-0028Jan 24, 2014
    Libvirt
    Libvirt
    risk 0.00cvss —epss 0.01

    libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:search_domains restrictions in ACLs and obtain sensitive domain object information via a request to the (1) virConnectDomainEventRegister and (2)…

  • CVE-2013-6458Jan 24, 2014
    Libvirt
    Libvirt
    risk 0.00cvss —epss 0.01

    Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a…

  • CVE-2013-6457Jan 24, 2014
    Libvirt
    Libvirt
    risk 0.00cvss —epss 0.01

    The libxlDomainGetNumaParameters function in the libxl driver (libxl/libxl_driver.c) in libvirt before 1.2.1 does not properly initialize the nodemap, which allows local users to cause a denial of service (invalid free operation and crash) or possibly execute arbitrary code via…

  • CVE-2013-6434Jan 24, 2014
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.01

    The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a native SPICE client invocation method, initially makes insecure connections to the SPICE server, which allows man-in-the-middle attackers to spoof the SPICE server.

  • CVE-2013-2192Jan 24, 2014
    Apache
    Hadoop
    risk 0.00cvss —epss 0.01

    The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by…

  • CVE-2013-1853Jan 24, 2014
    Almanah Project
    Almanah
    risk 0.00cvss —epss 0.00

    Almanah Diary 0.9.0 and 0.10.0 does not encrypt the database when closed, which allows local users to obtain sensitive information by reading the database.

  • CVE-2013-1886Jan 24, 2014
    Red Hat
    Certificate System
    risk 0.00cvss —epss 0.02

    Format string vulnerability in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via format…

  • CVE-2013-1885Jan 24, 2014
    Dogtag
    Certificate System
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) tus/ or…

  • CVE-2014-1252Jan 24, 2014
    Apple Inc.
    Pages
    risk 0.00cvss —epss 0.04

    Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word file.

  • CVE-2014-0809Jan 24, 2014
    Gapless Player
    Simzip
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the Gapless Player SimZip (aka Simple Zip Viewer) application before 1.2.1 for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.

  • CVE-2013-7317Jan 24, 2014
    Office Ocx
    Cs Cart
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) settings_file or (2) data_file parameter to (a) ampie.swf, (b) amline.swf, or (c) amcolumn.swf.

  • CVE-2013-7316Jan 24, 2014
    GitLab Inc.
    GitLab
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML file, as demonstrated by README.html.

  • CVE-2013-7184Jan 24, 2014
    Gretech
    GOM Player
    risk 0.03cvss —epss 0.02

    Gretech GOM Media Player 2.2.56.5158 and earlier allows remote attackers to cause a denial of service (memory corruption) via a crafted AVI file.

  • CVE-2013-5350Jan 24, 2014
    OpenPNE
    OpenPNE
    risk 0.00cvss —epss 0.02

    The "Remember me" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php in OpenPNE 3.6.13 before 3.6.13.1 and 3.8.9 before 3.8.9.1 does not properly validate login data in HTTP Cookie headers, which allows remote attackers to conduct…

  • CVE-2014-0674Jan 24, 2014
    Cisco Systems, Inc.
    Video Surveillance Operations Manager
    risk 0.00cvss —epss 0.02

    Cisco Video Surveillance Operations Manager (VSOM) does not require authentication for MySQL database connections, which allows remote attackers to obtain sensitive information, modify data, or cause a denial of service by leveraging network connectivity from a client system…

  • CVE-2013-7175Jan 24, 2014
    Avanset
    Visual Certexam Manager
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Avanset Visual CertExam Manager 3.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) Title, (2) File name, or (3) Candidate Name field.

  • CVE-2013-6030Jan 24, 2014
    Emerson Network Power
    Avocent MergePoint Unity 2016
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability on the Emerson Network Power Avocent MergePoint Unity 2016 (aka MPU2016) KVM switch with firmware 1.9.16473 allows remote attackers to read arbitrary files via unspecified vectors, as demonstrated by reading the /etc/passwd file.

  • CVE-2013-5669Jan 24, 2014
    Thecus
    N8800
    risk 0.00cvss —epss 0.02

    The Thecus NAS server N8800 with firmware 5.03.01 uses cleartext credentials for administrative authentication, which allows remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2013-5668Jan 24, 2014
    Thecus
    N8800
    risk 0.00cvss —epss 0.02

    The ADS/NT Support page on the Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to discover the administrator credentials by reading this page's cleartext content.

  • CVE-2013-5667Jan 24, 2014
    Thecus
    N8800
    risk 0.00cvss —epss 0.04

    The Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to execute arbitrary commands via a get_userid action with shell metacharacters in the username parameter.

  • CVE-2013-7315Jan 23, 2014
    Gopivotal
    Spring Framework
    risk 0.00cvss —epss 0.05

    The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via…

  • CVE-2013-7048Jan 23, 2014
    OpenStack
    Nova
    risk 0.00cvss —epss 0.00

    OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots.

  • CVE-2013-6934Jan 23, 2014
    VideoLAN
    VLC media player
    risk 0.02cvss —epss 0.28

    The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a space character at the beginning of an RTSP…

  • CVE-2013-6933Jan 23, 2014
    Live555
    Streaming Media
    risk 0.01cvss —epss 0.17

    The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character…

  • CVE-2013-4152Jan 23, 2014
    Gopivotal
    Spring Framework
    risk 0.00cvss —epss 0.26

    The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external…

  • CVE-2014-1242Jan 23, 2014
    Apple Inc.
    iTunes
    risk 0.00cvss —epss 0.01

    Apple iTunes before 11.1.4 uses HTTP for the iTunes Tutorials window, which allows man-in-the-middle attackers to spoof content by gaining control over the client-server data stream.

  • CVE-2014-0494Jan 23, 2014
    Adobe Inc.
    Digital Editions
    risk 0.00cvss —epss 0.05

    Adobe Digital Editions 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.

  • CVE-2013-5371Jan 23, 2014
    IBM
    Tivoli Storage Manager
    risk 0.00cvss —epss 0.00

    The client in IBM Tivoli Storage Manager (TSM) 6.3.1 and 6.4.0 on Windows does not preserve permissions of Resilient File System (ReFS) files across backup and restore operations, which allows local users to bypass intended access restrictions via standard filesystem operations.

  • CVE-2013-7314Jan 23, 2014
    NEC
    IX1000
    risk 0.00cvss —epss 0.02

    The OSPF implementation on NEC IP38X, IX1000, IX2000, and IX3000 routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a…

  • CVE-2013-7313Jan 23, 2014
    Juniper Networks
    Junos
    risk 0.00cvss —epss 0.01

    The OSPF implementation in Juniper Junos through 13.x, JunosE, and ScreenOS through 6.3.x does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers…

  • CVE-2013-7312Jan 23, 2014
    Enterasys
    C5
    risk 0.00cvss —epss 0.01

    The OSPF implementation on Enterasys switches and routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service…

  • CVE-2013-7311Jan 23, 2014
    Checkpoint
    Gaia OS
    risk 0.00cvss —epss 0.01

    The OSPF implementation in Check Point Gaia OS R75.X and R76 and IPSO OS 6.2 R75.X and R76 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote…

  • CVE-2013-7310Jan 23, 2014
    Yamaha
    Rt250i
    risk 0.00cvss —epss 0.01

    The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing…

  • CVE-2013-7309Jan 23, 2014
    Extremenetworks
    Exos
    risk 0.00cvss —epss 0.01

    The OSPF implementation in Extreme Networks EXOS does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing…

  • CVE-2013-7308Jan 23, 2014
    Dlink
    Des 3810 28
    risk 0.00cvss —epss 0.01

    The OSPF implementation on the D-Link DES-3810-28 switch with firmware R2.20.B017 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to…

  • CVE-2013-7307Jan 23, 2014
    Brocade
    Vyatta Vrouter
    risk 0.00cvss —epss 0.01

    The OSPF implementation on the Brocade Vyatta vRouter with software before 6.6R1 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause…

  • CVE-2013-7306Jan 23, 2014
    Brocade
    Brocade Router
    risk 0.00cvss —epss 0.01

    The OSPF implementation on Brocade routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing…