VYPR

CVEs

388,310 total · page 6577 of 7,767

AllCriticalHighKEV
  • CVE-2012-6447Jan 23, 2014
    Splunk
    Splunk
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 5.0.0 through 5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-0675Jan 23, 2014
    Cisco Systems, Inc.
    Telepresence Video Communication Server
    risk 0.00cvss —epss 0.02

    The Expressway component in Cisco TelePresence Video Communication Server (VCS) uses the same default X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging…

  • CVE-2014-0979Jan 23, 2014
    Lightdm Gtk\+ Greeter Project
    Lightdm Gtk\+ Greeter
    risk 0.00cvss —epss 0.00

    The start_authentication function in lightdm-gtk-greeter.c in LightDM GTK+ Greeter before 1.7.1 does not properly handle the return value from the lightdm_greeter_get_authentication_user function, which allows local users to cause a denial of service (NULL pointer dereference)…

  • CVE-2014-0006Jan 23, 2014
    OpenStack
    Swift
    risk 0.00cvss —epss 0.02

    The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

  • CVE-2013-6443Jan 23, 2014
    Red Hat
    Cloudforms
    risk 0.00cvss —epss 0.01

    CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request.

  • CVE-2013-6448Jan 23, 2014
    JBoss
    seam2
    risk 0.00cvss —epss 0.01

    The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allows remote attackers to bypass the WebRemote annotation restriction and obtain information about arbitrary classes and methods on the server…

  • CVE-2013-6447Jan 23, 2014
    Red Hat
    Jboss Seam 2 Framework
    risk 0.00cvss —epss 0.03

    Multiple XML External Entity (XXE) vulnerabilities in the (1) ExecutionHandler, (2) PollHandler, and (3) SubscriptionHandler classes in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allow remote attackers to read arbitrary…

  • CVE-2013-6412Jan 23, 2014
    Augeas
    Augeas
    risk 0.00cvss —epss 0.00

    The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask contains a "7," which causes world-writable permissions to be used for new files and allows local users to modify the files via unspecified…

  • CVE-2014-0808CriJan 22, 2014
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.59cvss 9.1epss 0.02

    Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a…

  • CVE-2014-0807Jan 22, 2014
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.02

    data/class/pages/shopping/LC_Page_Shopping_Deliv.php in LOCKON EC-CUBE 2.4.4 and earlier, and 2.11.0 through 2.12.2, allows remote attackers to modify data via unspecified vectors.

  • CVE-2014-0806Jan 22, 2014
    Sleipnir
    Sleipnir Mobile
    risk 0.00cvss —epss 0.01

    The Sleipnir Mobile application 2.12.1 and earlier and Sleipnir Mobile Black Edition application 2.12.1 and earlier for Android provide Geolocation API data without verifying user consent, which allows remote attackers to obtain sensitive location information via a web site that…

  • CVE-2014-0677Jan 22, 2014
    Cisco Systems, Inc.
    Nx OS
    risk 0.00cvss —epss 0.02

    The Label Distribution Protocol (LDP) functionality in Cisco NX-OS allows remote attackers to cause a denial of service (temporary LDP session outage) via LDP discovery traffic containing malformed Hello messages, aka Bug ID CSCul88851.

  • CVE-2014-0676Jan 22, 2014
    Cisco Systems, Inc.
    Nx OS
    risk 0.00cvss —epss 0.00

    Cisco NX-OS allows local users to bypass intended TACACS+ command restrictions via a series of multiple commands, aka Bug ID CSCum47367.

  • CVE-2014-0662Jan 22, 2014
    Cisco Systems, Inc.
    Telepresence Video Communication Server
    risk 0.00cvss —epss 0.02

    The SIP module in Cisco TelePresence Video Communication Server (VCS) before 8.1 allows remote attackers to cause a denial of service (process failure) via a crafted SDP message, aka Bug ID CSCue97632.

  • CVE-2014-0661Jan 22, 2014
    Cisco Systems, Inc.
    Telepresence System Software
    risk 0.00cvss —epss 0.02

    The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-47, TX1310 65, and TX9xxx before 6.0.4(11), allows remote attackers to execute arbitrary commands or cause a denial of service (stack…

  • CVE-2014-0660Jan 22, 2014
    Cisco Systems, Inc.
    Telepresence Isdn Gateway Software
    risk 0.00cvss —epss 0.02

    Cisco TelePresence ISDN Gateway with software before 2.2(1.92) allows remote attackers to cause a denial of service (D-channel call outage) via a crafted Q.931 STATUS message, aka Bug ID CSCui50360.

  • CVE-2014-1637Jan 22, 2014
    Command School
    Student Management System
    risk 0.04cvss —epss 0.07

    Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backup_ray2.php, which allows remote attackers to download a database backup via a direct request.

  • CVE-2014-1636Jan 22, 2014
    Command School
    Student Management System
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4)…

  • CVE-2013-7305Jan 22, 2014
    E107
    E107
    risk 0.00cvss —epss 0.01

    fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access to the e-mail account of a banned user.

  • CVE-2013-7304Jan 22, 2014
    Checkpoint
    Endpoint Security Mi Server R73
    risk 0.00cvss —epss 0.01

    Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509 certificate validation for client devices, which allows man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary certificate during a session established by a client.

  • CVE-2013-2750Jan 22, 2014
    E107
    E107
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in e107_plugins/content/handlers/content_preset.php in e107 before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the query string.

  • CVE-2014-0672Jan 22, 2014
    Cisco Systems, Inc.
    Mediasense
    risk 0.00cvss —epss 0.02

    The Search and Play interface in Cisco MediaSense does not properly enforce authorization requirements, which allows remote authenticated users to download arbitrary recordings via a request to this interface.

  • CVE-2014-0671Jan 22, 2014
    Cisco Systems, Inc.
    Mediasense
    risk 0.00cvss —epss 0.02

    Open redirect vulnerability in Cisco MediaSense allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, aka Bug ID CSCum16749.

  • CVE-2014-0670Jan 22, 2014
    Cisco Systems, Inc.
    Mediasense
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Search and Play interface in Cisco MediaSense allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCum16686.

  • CVE-2014-0669Jan 22, 2014
    Cisco Systems, Inc.
    Asr 5000
    risk 0.00cvss —epss 0.02

    The Wireless Session Protocol (WSP) feature in the Gateway GPRS Support Node (GGSN) component on Cisco ASR 5000 series devices allows remote attackers to bypass intended Top-Up payment restrictions via unspecified WSP packets, aka Bug ID CSCuh28371.

  • CVE-2013-6746Jan 22, 2014
    IBM
    Filenet Content Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in FileNet P8 Platform Documentation Installable Info Center 4.5.1 through 5.2.0 in IBM FileNet Business Process Manager 4.5.1 through 5.1.0, FileNet Content Manager 4.5.1 through 5.2.0, and Case Foundation 5.2.0 allows remote attackers…

  • CVE-2013-6343Jan 22, 2014
    Asus
    Rt N56u Firmware
    risk 0.04cvss —epss 0.08

    Multiple buffer overflows in web.c in httpd on the ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374_979 allow remote attackers to execute arbitrary code via the (1) apps_name or (2) apps_flag parameter to APP_Installation.asp.

  • CVE-2013-5987Jan 21, 2014
    Nvidia
    Graphics Driver
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in NVIDIA graphics driver Release 331, 325, 319, 310, and 304 allows local users to bypass intended access restrictions for the GPU and gain privileges via unknown vectors.

  • CVE-2013-5986Jan 21, 2014
    Nvidia
    Graphics Driver
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in NVIDIA graphics driver Release 331, 325, 319, 310, and 304 has unknown impact and attack vectors, a different vulnerability than CVE-2013-5987.

  • CVE-2013-4884Jan 21, 2014
    McAfee
    Superscan
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in McAfee SuperScan 4.0 allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded sequences in a server response, which is not properly handled in the SuperScan HTML report.

  • CVE-2013-4160Jan 21, 2014
    Openjdk
    OpenJDK
    risk 0.00cvss —epss 0.03

    Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to (1) cmsStageAllocLabV2ToV4curves, (2) cmsPipelineDup, (3)…

  • CVE-2013-2152Jan 21, 2014
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.00

    Unquoted Windows search path vulnerability in the SPICE service, as used in Red Hat Enterprise Virtualization (RHEV) 3.2, allows local users to gain privileges via a crafted application in an unspecified folder.

  • CVE-2013-2151Jan 21, 2014
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.00

    Unquoted Windows search path vulnerability in Red Hat Enterprise Virtualization (RHEV) 3 and 3.2 allows local users to gain privileges via a crafted application in an unspecified folder.

  • CVE-2013-2104Jan 21, 2014
    OpenStack
    Python Keystoneclient
    risk 0.00cvss —epss 0.02

    python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2) use a revoked token once it expires.

  • CVE-2013-1923Jan 21, 2014
    NFS Utils
    nfs-utils
    risk 0.00cvss —epss 0.01

    rpc-gssd in nfs-utils before 1.2.8 performs reverse DNS resolution for server names during GSSAPI authentication, which might allow remote attackers to read otherwise-restricted files via DNS spoofing attacks.

  • CVE-2013-1769Jan 21, 2014
    Telepathy
    Gabble
    risk 0.00cvss —epss 0.02

    A certain hashing algorithm in Telepathy Gabble 0.16.x before 0.16.5 and 0.17.x before 0.17.3 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted message.

  • CVE-2013-1361Jan 21, 2014
    Lenovo
    Thinkpad Bluetooth With Enhanced Data Rate Software
    risk 0.01cvss —epss 0.06

    Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate Software 6.4.0.2900 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is located in the…

  • CVE-2013-0485Jan 21, 2014
    IBM
    Java
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in IBM Java SDK 7 before SR4-FP1, 6 before SR13-FP1, 5.0 before SR16-FP1, and 1.4.2 before SR13-FP16 has unknown impact and attack vectors related to Class Libraries.

  • CVE-2013-0340Jan 21, 2014
    Apple Inc.
    macOS
    risk 0.00cvss —epss 0.19

    expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read…

  • CVE-2013-0339Jan 21, 2014
    Xmlsoft
    Libxml2
    risk 0.00cvss —epss 0.04

    libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests…

  • CVE-2013-0157Jan 21, 2014
    util-linux
    util-linux
    risk 0.00cvss —epss 0.00

    (a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the existence of restricted directories by (1) using the --guess-fstype command-line option or (2) attempting to mount a non-existent device, which generates…

  • CVE-2012-2997Jan 21, 2014
    F5, Inc.
    Big IP
    risk 0.04cvss —epss 0.06

    XML External Entity (XXE) vulnerability in sam/admin/vpe2/public/php/server.php in F5 BIG-IP 10.0.0 through 10.2.4 and 11.0.0 through 11.2.1 allows remote authenticated users to read arbitrary files via a crafted XML file.

  • CVE-2013-7219Jan 21, 2014
    2glux
    Sexy Polling
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in vote.php in the 2Glux Sexy Polling (com_sexypolling) component before 1.0.9 for Joomla! allows remote attackers to execute arbitrary SQL commands via the answer_id[] parameter.

  • CVE-2013-6922Jan 21, 2014
    Seagate
    Blackarmor Nas 220 Firmware
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331 allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts via a crafted request to…

  • CVE-2013-4200Jan 21, 2014
    Plone (software)
    Plone
    risk 0.03cvss —epss 0.02

    The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property, …

  • CVE-2013-2594Jan 21, 2014
    Hornbill
    Supportworks Itsm
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in reports/calldiary.php in Hornbill Supportworks ITSM 1.0.0 through 3.4.14 allows remote attackers to execute arbitrary SQL commands via the callref parameter.

  • CVE-2014-1620Jan 21, 2014
    Hiox India
    Guestbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in add.php in HIOX Guest Book (HGB) 5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name1, (2) email, or (3) cmt parameter.

  • CVE-2014-1619Jan 21, 2014
    Cubicfactory
    Cubic CMS
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Cubic CMS 5.1.1, 5.1.2, and 5.2 allow remote attackers to execute arbitrary SQL commands via the (1) resource_id or (2) version_id parameter to recursos/agent.php or (3) login or (4) pass parameter to login.usuario.

  • CVE-2014-1618Jan 21, 2014
    Uaepd
    Shopping Cart Script
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the (1) cat_id or (2) p_id parameter to products.php or id parameter to (3) page.php or (4) news.php.

  • CVE-2014-1452Jan 21, 2014
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.02

    Stack-based buffer overflow in lib/snmpagent.c in bsnmpd, as used in FreeBSD 8.3 through 10.0, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted GETBULK PDU request.