VYPR

CVEs

388,264 total · page 6578 of 7,766

AllCriticalHighKEV
  • CVE-2012-6632Jan 16, 2014
    Vessio
    Netbill
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Vessio NetBill 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) file title to accounts/admin/index.php or (3) comment parameter in the support page to accounts/index2.php.

  • CVE-2012-6631Jan 16, 2014
    Vessio
    Netbill
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in accounts/admin/index.php in Vessio NetBill 1.2 allows remote attackers to hijack the authentication of administrators for requests that add accounts via a new-client action.

  • CVE-2012-6630Jan 16, 2014
    WordPress
    Media Library Categories
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) bulk parameter to media-library-categories/add.php or (2) q parameter to…

  • CVE-2012-6629Jan 16, 2014
    WordPress
    Newsletter Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change an email address or (2) conduct script insertion…

  • CVE-2012-6628Jan 16, 2014
    WordPress
    Newsletter Manager
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) xyz_em_campName to admin/create_campaign.php or (2) admin/edit_campaign.php, (3) xyz_em_email…

  • CVE-2012-6627Jan 16, 2014
    WordPress
    Newsletter Manager
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2012-6626Jan 16, 2014
    Brian Cabunac
    Browser To Email Phone Message System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in verify-user.php in b2ePMS 1.0 allows remote attackers to execute arbitrary SQL commands via the username field.

  • CVE-2012-6625Jan 16, 2014
    WordPress
    ForumPress WP Forum Server
    risk 0.00cvss —epss 0.05

    SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the groupid parameter in an editgroup action.

  • CVE-2012-6624Jan 16, 2014
    WordPress
    Soundcloud Is Gold
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter in a soundcloud_is_gold_player_preview action to wp-admin/admin-ajax.php.

  • CVE-2012-6623Jan 16, 2014
    WordPress
    Forum Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php.

  • CVE-2012-6622Jan 16, 2014
    WordPress
    Forum Server
    risk 0.00cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) groupid parameter in an editgroup action or (2) usergroup_id…

  • CVE-2012-6621Jan 16, 2014
    Get Simple.
    Getsimplecms
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1, 3.1.2, 3.2.3, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Email Address or (2) Custom Permalink Structure fields in admin/settings.php; (3) path parameter to…

  • CVE-2012-6620Jan 16, 2014
    Horde (software)
    Kronolith H4
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the (1) tasks and (2) search views in Horde Kronolith H4 before 3.0.17 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6725Jan 16, 2014
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server 7.x before 7.0.0.31, 8.0.x before 8.0.0.8, and 8.5.x before 8.5.5.2 allows remote authenticated administrators to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2013-6330Jan 16, 2014
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    IBM WebSphere Application Server 7.x before 7.0.0.31, when simpleFileServlet static file caching is enabled, allows remote authenticated users to obtain sensitive information via unspecified vectors.

  • CVE-2013-6325Jan 16, 2014
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    IBM WebSphere Application Server 7.x before 7.0.0.31, 8.0.x before 8.0.0.8, and 8.5.x before 8.5.5.2 allows remote attackers to cause a denial of service (resource consumption) via a crafted request to a web services endpoint.

  • CVE-2014-0667Jan 16, 2014
    Cisco Systems, Inc.
    Secure Access Control System
    risk 0.00cvss —epss 0.01

    The RMI interface in Cisco Secure Access Control System (ACS) does not properly enforce authorization requirements, which allows remote authenticated users to read arbitrary files via a request to this interface, aka Bug ID CSCud75169.

  • CVE-2014-0666Jan 16, 2014
    Cisco Systems, Inc.
    Jabber
    risk 0.00cvss —epss 0.06

    Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote attackers to upload arbitrary types of files, and consequently execute arbitrary code, via modified packets, aka Bug ID CSCug48056.

  • CVE-2014-0650Jan 16, 2014
    Cisco Systems, Inc.
    Secure Access Control System
    risk 0.00cvss —epss 0.03

    The web interface in Cisco Secure Access Control System (ACS) 5.x before 5.4 Patch 3 allows remote attackers to execute arbitrary operating-system commands via a request to this interface, aka Bug ID CSCue65962.

  • CVE-2014-0649Jan 16, 2014
    Cisco Systems, Inc.
    Secure Access Control System
    risk 0.00cvss —epss 0.03

    The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authorization requirements, which allows remote authenticated users to obtain superadmin access via a request to this interface, aka Bug ID CSCud75180.

  • CVE-2014-0648Jan 16, 2014
    Cisco Systems, Inc.
    Secure Access Control System
    risk 0.00cvss —epss 0.06

    The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187.

  • CVE-2013-6786Jan 16, 2014
    Huawei
    Mt882
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the "forbidden author header" protection mechanism is bypassed, allows remote…

  • CVE-2013-6687Jan 16, 2014
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.00cvss —epss 0.01

    The web portal in the Enterprise License Manager component in Cisco WebEx Meetings Server allows remote authenticated users to discover the cleartext administrative password by reading HTML source code, aka Bug ID CSCul33876.

  • CVE-2013-6646Jan 16, 2014
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the Web Workers implementation in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the…

  • CVE-2013-6645Jan 16, 2014
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in the OnWindowRemovingFromRootWindow function in content/browser/web_contents/web_contents_view_aura.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows user-assisted remote attackers to cause a…

  • CVE-2013-6644Jan 16, 2014
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

  • CVE-2013-6643Jan 16, 2014
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The OneClickSigninBubbleView::WindowClosing function in browser/ui/views/sync/one_click_signin_bubble_view.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows attackers to trigger a sync with an arbitrary Google account by…

  • CVE-2013-6642Jan 16, 2014
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome through 32.0.1700.23 on Android allows remote attackers to spoof the address bar via unspecified vectors.

  • CVE-2013-6641Jan 16, 2014
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in the FormAssociatedElement::formRemovedFromTree function in core/html/FormAssociatedElement.cpp in Blink, as used in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux, allows remote attackers to cause a…

  • CVE-2014-1473Jan 16, 2014
    McAfee
    Vulnerability Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.5 and earlier allow remote attackers to hijack the authentication of users for requests that modify HTML via unspecified vectors related to the…

  • CVE-2014-1472Jan 16, 2014
    McAfee
    Vulnerability Manager
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-7294Jan 16, 2014
    Libreswan
    Libreswan
    risk 0.00cvss —epss 0.03

    The ikev2parent_inI1outR1 function in pluto/ikev2_parent.c in libreswan before 3.7 allows remote attackers to cause a denial of service (restart) via an IKEv2 I1 notification without a KE payload.

  • CVE-2013-2139Jan 16, 2014
    Srtp
    libsrtp
    risk 0.00cvss —epss 0.03

    Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions.

  • CVE-2014-0496HigKEVJan 15, 2014
    Adobe Inc.
    Acrobat
    risk 0.72cvss 8.8epss 0.40

    Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors.

  • CVE-2014-0495Jan 15, 2014
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.04

    Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0493.

  • CVE-2014-0493Jan 15, 2014
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.05

    Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0495.

  • CVE-2014-0492Jan 15, 2014
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK & Compiler before 4.0.0.1390 allow attackers to defeat the ASLR…

  • CVE-2014-0491Jan 15, 2014
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.07

    Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK & Compiler before 4.0.0.1390 allow attackers to bypass…

  • CVE-2014-0262Jan 15, 2014
    Microsoft
    Windows 7
    risk 0.00cvss —epss 0.02

    win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Server 2008 R2 SP1 does not properly consider thread-owned objects during the processing of window handles, which allows local users to gain privileges via a crafted application, aka "Win32k Window Handle…

  • CVE-2014-0261Jan 15, 2014
    Microsoft
    Dynamics Ax
    risk 0.01cvss —epss 0.10

    Microsoft Dynamics AX 4.0 SP2, 2009 SP1, 2012, and 2012 R2 allows remote authenticated users to cause a denial of service (instance outage) via crafted data to an Application Object Server (AOS) instance, aka "Query Filter DoS Vulnerability."

  • CVE-2014-0260Jan 15, 2014
    Microsoft
    Word
    risk 0.01cvss —epss 0.18

    Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or…

  • CVE-2014-0259Jan 15, 2014
    Microsoft
    Word
    risk 0.01cvss —epss 0.16

    Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."

  • CVE-2014-0258Jan 15, 2014
    Microsoft
    Word
    risk 0.01cvss —epss 0.16

    Microsoft Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability."

  • CVE-2013-7293Jan 15, 2014
    Asus
    Wl 330nul
    risk 0.00cvss —epss 0.01

    The ASUS WL-330NUL router has a configuration process that relies on accessing the 192.168.1.1 IP address, but the documentation advises users to instead access a DNS hostname that does not always resolve to 192.168.1.1, which makes it easier for remote attackers to hijack the…

  • CVE-2014-0665Jan 15, 2014
    Cisco Systems, Inc.
    Identity Services Engine Software
    risk 0.00cvss —epss 0.01

    The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to…

  • CVE-2013-6142Jan 15, 2014
    Schneider Electric
    SCADA Expert Clearscada
    risk 0.00cvss —epss 0.01

    DNP3Driver.exe in the DNP3 driver in Schneider Electric ClearSCADA 2010 R2 through 2010 R3.1 and SCADA Expert ClearSCADA 2013 R1 through 2013 R1.2 allows remote attackers to cause a denial of service (resource consumption) via IP packets containing errors that trigger…

  • CVE-2013-5890Jan 15, 2014
    Oracle Corporation
    Payroll
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Payroll component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, 12.1.3, and 12.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Exception Reporting.

  • CVE-2013-5889Jan 15, 2014
    Oracle Corporation
    Java Se
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, CVE-2014-0418, and…

  • CVE-2013-5888Jan 15, 2014
    Oracle Corporation
    Java Se
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, when running with GNOME, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

  • CVE-2013-5887Jan 15, 2014
    Oracle Corporation
    Java Se
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect availability via unknown vectors related to Deployment.