VYPR

CVEs

388,088 total · page 6581 of 7,762

AllCriticalHighKEV
  • CVE-2013-3667Dec 31, 2013
    Bare Bones Software
    Yojimbo
    risk 0.00cvss —epss 0.02

    The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation, which allows attackers to perform "tampering or corruption" of the updates.

  • CVE-2013-3572MedDec 31, 2013
    UI
    Unifi Controller
    risk 0.40cvss 6.1epss 0.02

    Cross-site scripting (XSS) vulnerability in the administer interface in the UniFi Controller in Ubiquiti Networks UniFi 2.3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted client hostname.

  • CVE-2012-0264Dec 31, 2013
    risk 0.00cvss —epss 0.04

    op5 Monitor and op5 Appliance before 5.5.0 do not properly manage session cookies, which allows remote attackers to have an unspecified impact via unspecified vectors.

  • CVE-2012-0263Dec 31, 2013
    Tenable
    Appliance
    risk 0.00cvss —epss 0.02

    monitor/index.php in op5 Monitor and op5 Appliance before 5.5.1 allows remote authenticated users to obtain sensitive information such as database and user credentials via error messages that are triggered by (1) a malformed hoststatustypes parameter to status/service/all or (2)…

  • CVE-2012-0262Dec 31, 2013
    risk 0.09cvss —epss 0.73

    op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter.

  • CVE-2012-0261Dec 31, 2013
    risk 0.09cvss —epss 0.74

    license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the timestamp parameter for an install action.

  • CVE-2013-6987Dec 31, 2013
    Synology
    Diskstation Manager
    risk 0.04cvss —epss 0.15

    Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before 4.3-3810 Update 3 allow remote attackers to read, write, and delete arbitrary files via a .. (dot dot) in the (1) path parameter to file_delete.cgi or (2)…

  • CVE-2013-6459Dec 31, 2013
    Mislav Marohnic
    Will Paginate
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the will_paginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links.

  • CVE-2013-5573Dec 31, 2013
    Jenkins Project
    Jenkins
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.

  • CVE-2013-7242Dec 31, 2013
    Zenphoto
    Zenphoto
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4 allows remote authenticated administrators to execute arbitrary SQL commands via the tableprefix parameter.

  • CVE-2013-7241Dec 31, 2013
    Zenphoto
    Zenphoto
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the export function in zp-core/zp-extensions/mergedRSS.php in Zenphoto before 1.4.5.4 allows remote attackers to inject arbitrary web script or HTML via the URI.

  • CVE-2013-6983Dec 31, 2013
    Cisco Systems, Inc.
    Unified Presence Server
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the web interface in Cisco Unified Presence Server allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuh35615.

  • CVE-2013-7209Dec 30, 2013
    Jforum
    Jforum
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in admBase/login.page in the Admin module in JForum allows remote attackers to hijack the authentication of administrators for requests that change the user group permissions of arbitrary users via a groupsSave action.

  • CVE-2013-7233Dec 30, 2013
    WordPress
    WordPress
    risk 0.03cvss —epss 0.04

    Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list.

  • CVE-2013-7232Dec 30, 2013
    Esri
    Arcgis Server
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service.

  • CVE-2013-7231Dec 30, 2013
    Esri
    Arcgis Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-5222.

  • CVE-2013-5222Dec 30, 2013
    Esri
    Arcgis Server
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5220Dec 30, 2013
    Hot
    Hotbox Router
    risk 0.03cvss —epss 0.05

    goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a denial of service (device crash) via crafted HTTP POST data.

  • CVE-2013-5219Dec 30, 2013
    Hot
    Hotbox Router
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to read arbitrary files via a .. (dot dot) in a URI, as demonstrated by a request for /etc/passwd.

  • CVE-2013-5218Dec 30, 2013
    Hot
    Hotbox Router
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to inject arbitrary web script or HTML via a crafted DHCP Host Name option, which is not properly handled during rendering of the DHCP table in wlanAccess.asp.

  • CVE-2013-5210Dec 30, 2013
    Adtran
    Aos
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the GUI login page in ADTRAN AOS before R10.8.1 on the NetVanta 7100 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5039Dec 30, 2013
    Hot
    Hotbox Router
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in goform/wlanBasicSecurity on the HOT HOTBOX router with software 2.1.11 allows remote attackers to hijack the authentication of administrators for requests that change the WiFi Security field to Deactivated via the WifiSecurity…

  • CVE-2013-5038Dec 30, 2013
    Hot
    Hotbox Router
    risk 0.03cvss —epss 0.03

    The HOT HOTBOX router with software 2.1.11 allows remote attackers to bypass authentication by configuring a source IP address that had previously been used for an authenticated session.

  • CVE-2013-5037Dec 30, 2013
    Hot
    Hotbox Router
    risk 0.03cvss —epss 0.03

    The HOT HOTBOX router with software 2.1.11 has a default WPS PIN of 12345670, which makes it easier for remote attackers to obtain the WPA or WPA2 pre-shared key via EAP messages.

  • CVE-2013-4858Dec 30, 2013
    Microsoft
    Windows Movie Maker
    risk 0.04cvss —epss 0.13

    Microsoft Windows Movie Maker 2.1.4026.0 on Windows XP SP3 allows remote attackers to cause a denial of service (application crash) via a crafted .wav file, as demonstrated by movieMaker.wav.

  • CVE-2013-6198Dec 29, 2013
    Microfocus
    Service Manager
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in HP Service Manager WebTier and Windows Client 9.20 and 9.21 before 9.21.661 p8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6197Dec 29, 2013
    Microfocus
    Service Manager
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in HP Service Manager WebTier and Windows Client 9.20 and 9.21 before 9.21.661 p8 allows remote authenticated users to execute arbitrary code via unknown vectors.

  • CVE-2013-6189Dec 29, 2013
    Microfocus
    Application Information Optimizer
    risk 0.01cvss —epss 0.17

    Unspecified vulnerability in the Archive Query Server in HP Application Information Optimizer (formerly HP Database Archiving) 6.2, 6.3, 6.4, and 7.0 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1666.

  • CVE-2013-5583Dec 29, 2013
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in libraries/idna_convert/example.php in Joomla! 3.1.5 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

  • CVE-2013-3846Dec 29, 2013
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.22

    Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted CSpliceTreeEngine::InsertSplice object in an HTML document, aka "Internet Explorer Memory…

  • CVE-2013-2504Dec 29, 2013
    Matrix42
    Service Store
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in SPS/Portal/default.aspx in Service Desk in Matrix42 Service Store 5.3 SP3 (aka 5.33.946.0) allows remote attackers to inject arbitrary web script or HTML via the query string.

  • CVE-2013-7149Dec 28, 2013
    Openx
    Openx
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery invocation script) in Revive Adserver before 3.0.2, and OpenX Source 2.8.11 and earlier, allows remote attackers to execute arbitrary SQL commands via the what parameter to an XML-RPC method.

  • CVE-2013-6981Dec 28, 2013
    Cisco Systems, Inc.
    iOS Xe
    risk 0.00cvss —epss 0.03

    Cisco IOS XE 3.7S(.1) and earlier allows remote attackers to cause a denial of service (Packet Processor crash) via fragmented MPLS IP packets, aka Bug ID CSCul00709.

  • CVE-2013-6932Dec 28, 2013
    IrfanView
    Irfanview
    risk 0.00cvss —epss 0.06

    Buffer overflow in IrfanView before 4.37, when a multibyte-character directory name is used, allows user-assisted remote attackers to execute arbitrary code via a crafted file that is incorrectly handled by the Thumbnail tooltips feature in the Thumbnails window.

  • CVE-2013-6929Dec 28, 2013
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted API input.

  • CVE-2013-6886Dec 28, 2013
    Realvnc
    Realvnc
    risk 0.00cvss —epss 0.00

    RealVNC VNC 5.0.6 on Mac OS X, Linux, and UNIX allows local users to gain privileges via a crafted argument to the (1) vncserver, (2) vncserver-x11, or (3) Xvnc helper.

  • CVE-2013-6812Dec 28, 2013
    Nextdc
    Onedc
    risk 0.00cvss —epss 0.01

    The ONEDC app before 1.7 for iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2013-6808Dec 28, 2013
    Zend
    Zendto
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in lib/NSSDropoff.php in ZendTo before 4.11-13 allows remote attackers to inject arbitrary web script or HTML via a modified emailAddr field to pickup.php.

  • CVE-2013-6182Dec 28, 2013
    EMC Corporation
    Replication Manager
    risk 0.00cvss —epss 0.00

    Unquoted Windows search path vulnerability in EMC Replication Manager before 5.5 allows local users to gain privileges via a crafted application in a parent directory of an intended directory.

  • CVE-2013-6181Dec 28, 2013
    EMC Corporation
    Watch4net
    risk 0.00cvss —epss 0.01

    EMC Watch4Net before 6.3 stores cleartext polled-device passwords in the installation repository, which allows local users to obtain sensitive information by leveraging repository privileges.

  • CVE-2013-6006Dec 28, 2013
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.02

    Cybozu Garoon 3.5 through 3.7 SP2 allows remote attackers to bypass Keitai authentication via a modified user ID in a request.

  • CVE-2013-1096Dec 28, 2013
    Novell
    Identity Manager
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Roles Based Provisioning Module 4.0.2 before Field Patch D for Novell Identity Manager (aka IDM) allows remote attackers to inject arbitrary web script or HTML via a taskDetail taskId.

  • CVE-2013-2179Dec 27, 2013
    Xorg
    Xdm
    risk 0.00cvss —epss 0.02

    X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using certain implementations of the crypt API function that can return NULL, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by attempting to log into…

  • CVE-2013-2030Dec 27, 2013
    OpenStack
    Folsom
    risk 0.00cvss —epss 0.00

    keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using…

  • CVE-2011-2519Dec 27, 2013
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    Xen in the Linux kernel, when running a guest on a host without hardware assisted paging (HAP), allows guest users to cause a denial of service (invalid pointer dereference and hypervisor crash) via the SAHF instruction.

  • CVE-2010-1819Dec 27, 2013
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Untrusted search path vulnerability in the Picture Viewer in Apple QuickTime before 7.6.8 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) CoreVideo.dll, (2) CoreGraphics.dll, or (3)…

  • CVE-2010-0430Dec 27, 2013
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.01

    libspice, as used in QEMU-KVM in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H or rhev-hypervisor) before 5.5-2.2 and possibly other products, allows guest OS users to read from or write to arbitrary QEMU memory by modifying the address that is used by Cairo for…

  • CVE-2013-7217Dec 26, 2013
    Zimbra
    Collaboration Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Zimbra Collaboration Server 7.2.5 and earlier, and 8.0.x through 8.0.5, has "critical" impact and unspecified vectors, a different vulnerability than CVE-2013-7091.

  • CVE-2013-7216Dec 24, 2013
    Classifieds Creator
    Classifieds Creator
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Classifieds Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to demo/classifieds/product.asp, or (2) UserID or (3) Password field to demo/classifieds/admin.asp.

  • CVE-2013-6388Dec 24, 2013
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Color module in Drupal 7.x before 7.24 allows remote attackers to inject arbitrary web script or HTML via vectors related to CSS.