VYPR

CVEs

388,046 total · page 6583 of 7,761

AllCriticalHighKEV
  • CVE-2013-5452Dec 19, 2013
    IBM
    Filenet Business Process Framework
    risk 0.00cvss —epss 0.01

    IBM FileNet Business Process Framework 4.1.0 allows remote authenticated users to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE)…

  • CVE-2013-5426Dec 19, 2013
    IBM
    Infosphere Master Data Management Server For Product Information Management
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1 IF5 and 11.0 before IF1 and InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1 IF11 allows remote authenticated users to…

  • CVE-2013-5422Dec 19, 2013
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.01

    The Web Client in IBM Rational ClearQuest 7.1 through 7.1.2.12, 8.0.0.x before 8.0.0.9, and 8.0.1.x before 8.0.1.2, when a multi-database dataset exists, allows remote attackers to read database names via unspecified vectors.

  • CVE-2013-7086Dec 19, 2013
    Webbynode
    Webbynode
    risk 0.00cvss —epss 0.04

    The message function in lib/webbynode/notify.rb in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message.

  • CVE-2013-7067Dec 19, 2013
    Drupal
    OG Features
    risk 0.00cvss —epss 0.01

    The OG Features module 6.x-1.x before 6.x-1.4 for Drupal does not properly override pages that have an access callback set to false, which allows remote attackers to bypass intended access restrictions via a request.

  • CVE-2013-7005Dec 19, 2013
    Dlink
    Dsr 500 Firmware
    risk 0.00cvss —epss 0.01

    D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 stores account passwords in cleartext, which allows local users to…

  • CVE-2013-7004Dec 19, 2013
    Dlink
    Dsr 500 Firmware
    risk 0.00cvss —epss 0.02

    D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 have a hardcoded account of username gkJ9232xXyruTRmY, which makes…

  • CVE-2013-6837Dec 19, 2013
    PrettyPhoto
    prettyPhoto
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.

  • CVE-2013-6836Dec 19, 2013
    GNOME Foundation
    Gnumeric
    risk 0.00cvss —epss 0.02

    Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value.

  • CVE-2013-6824Dec 19, 2013
    Zabbix
    Zabbix
    risk 0.00cvss —epss 0.03

    Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter.

  • CVE-2013-5946Dec 19, 2013
    Dlink
    Dsr 500 Firmware
    risk 0.01cvss —epss 0.07

    The runShellCmd function in systemCheck.htm in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 allows remote…

  • CVE-2013-4776Dec 19, 2013
    Netgear
    Prosafe Gs724t
    risk 0.04cvss —epss 0.07

    NETGEAR ProSafe GS724Tv3 and GS716Tv2 with firmware 5.4.1.13 and earlier, GS748Tv4 5.4.1.14, and GS510TP 5.0.4.4 allows remote attackers to cause a denial of service (reboot or crash) via a crafted HTTP request to filesystem/.

  • CVE-2013-4775Dec 19, 2013
    Netgear
    Prosafe Gs724t
    risk 0.04cvss —epss 0.15

    NETGEAR ProSafe GS724Tv3 and GS716Tv2 with firmware 5.4.1.13 and earlier; GS748Tv4 with firmware 5.4.1.14; GS510TP with firmware 5.4.0.6; GS752TPS, GS728TPS, GS728TS, and GS725TS with firmware 5.3.0.17; and GS752TXS and GS728TXS with firmware 6.1.0.12 allows remote attackers to…

  • CVE-2013-6701Dec 18, 2013
    Cisco Systems, Inc.
    Ons 15454e Optical Transport Platform
    risk 0.00cvss —epss 0.02

    The tNetTaskLimit process on the Transport Node Controller (TNC) on Cisco ONS 15454 devices with software 9.6 and earlier does not properly prioritize health pings, which allows remote attackers to cause a denial of service (watchdog timeout and TNC reset) via a flood of network…

  • CVE-2013-5466Dec 18, 2013
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    The XSLT library in IBM DB2 and DB2 Connect 9.5 through 10.5, and the DB2 pureScale Feature 9.8 for Enterprise Server Edition, allows remote authenticated users to cause a denial of service via unspecified vectors.

  • CVE-2013-5440Dec 18, 2013
    IBM
    Infosphere Information Server
    risk 0.00cvss —epss 0.00

    IBM InfoSphere Information Server 8.0, 8.1, 8.5, 8.7, and 9.1 allows local users to obtain sensitive information in opportunistic circumstances by leveraging the presence of file content after a failed installation.

  • CVE-2013-5416Dec 18, 2013
    IBM
    Rational Clearcase
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in IBM Rational ClearCase through 7.1.2.12, 8.0.0.x before 8.0.0.9, and 8.0.1.x before 8.0.1.2 allows local users to gain privileges via unknown vectors.

  • CVE-2013-5415Dec 18, 2013
    IBM
    Rational Clearcase
    risk 0.00cvss —epss 0.00

    Buffer overflow in IBM Rational ClearCase through 7.1.2.12, 8.0.0.x before 8.0.0.9, and 8.0.1.x before 8.0.1.2 allows local users to gain privileges via unspecified vectors.

  • CVE-2013-5402Dec 18, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management, Maximo Asset Management Essentials, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities 7.1.x through…

  • CVE-2013-5398Dec 18, 2013
    IBM
    Rational Focal Point
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Webservice Axis Gateway in IBM Rational Focal Point 6.4 before devfix1, 6.4.1.3 before devfix1, 6.5.1 before devfix1, 6.5.2 before devfix4, 6.5.2.3 before devfix9, 6.6 before devfix5, 6.6.0.1 before devfix2, and 6.6.1 allows remote attackers to…

  • CVE-2013-5397Dec 18, 2013
    IBM
    Rational Focal Point
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Webservice Axis Gateway in IBM Rational Focal Point 6.4 before devfix1, 6.4.1.3 before devfix1, 6.5.1 before devfix1, 6.5.2 before devfix4, 6.5.2.3 before devfix9, 6.6 before devfix5, 6.6.0.1 before devfix2, and 6.6.1 allows remote attackers to…

  • CVE-2013-5228Dec 18, 2013
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in…

  • CVE-2013-5227Dec 18, 2013
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Apple Safari before 6.1.1 and 7.x before 7.0.1 allows remote attackers to bypass the Same Origin Policy and discover credentials by triggering autofill of subframe form fields.

  • CVE-2013-5225Dec 18, 2013
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in…

  • CVE-2013-5199Dec 18, 2013
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in…

  • CVE-2013-5198Dec 18, 2013
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in…

  • CVE-2013-5197Dec 18, 2013
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in…

  • CVE-2013-5196Dec 18, 2013
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in…

  • CVE-2013-5195Dec 18, 2013
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in…

  • CVE-2013-7129Dec 17, 2013
    Themebeans
    Blooog Theme
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ThemeBeans Blooog theme 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the jQuery parameter to assets/js/jplayer.swf.

  • CVE-2013-6883Dec 17, 2013
    Cru Inc
    Ditto Forensic Fieldstation
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to hijack the authentication of administrators for requests that modify the disk erase technique settings via unspecified vectors.

  • CVE-2013-6882Dec 17, 2013
    Cru Inc
    Ditto Forensic Fieldstation
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in CRU Ditto Forensic FieldStation with firmware 2013Oct15a and earlier allow (1) remote attackers to inject arbitrary web script or HTML via the username parameter in a login or (2) remote authenticated users to inject…

  • CVE-2013-7128Dec 17, 2013
    Valve Software
    SteamOS Beta
    risk 0.00cvss —epss 0.00

    Valve Bug Reporter in the valve-bugreporter package 2.10+bsos1 in Valve SteamOS Beta stores cleartext credentials in a .valve-bugreporter.cfg file upon a Remember Credentials action, which allows local users to obtain sensitive information by reading this file.

  • CVE-2013-7127Dec 17, 2013
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Apple Safari 6.0.5 on Mac OS X 10.7.5 and 10.8.5 stores cleartext credentials in LastSession.plist, which allows local users to obtain sensitive information by reading this file.

  • CVE-2013-6733Dec 17, 2013
    IBM
    Sametime
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Web Application in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6721Dec 17, 2013
    IBM
    Websphere Service Registry And Repository
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM WebSphere Service Registry and Repository (WSRR) 7.5.x before 7.5.0.4 and 8.x through 8.0.0.2 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving widgets.

  • CVE-2013-6329Dec 17, 2013
    IBM
    Global Security Kit
    risk 0.00cvss —epss 0.03

    IBM Global Security Kit (aka GSKit), as used in Content Manager OnDemand 8.5 and 9.0 and other products, allows remote attackers to cause a denial of service via a crafted handshake during resumption of an SSLv2 session.

  • CVE-2013-6327Dec 17, 2013
    IBM
    Sterling Connect:Enterprise
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the HTTP Option in IBM Sterling Connect:Enterprise 1.3 before 1.3.0.2 iFix 1 and 1.4 before 1.4.0.0 iFix 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "cross-frame scripting"…

  • CVE-2013-6193Dec 17, 2013
    Microfocus
    Color Laserjet Cm1312nfi Multifunction Printer
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability on HP LaserJet M1522n and M2727; LaserJet Pro 100, 300, 400, CM1415fnw, CP1*, M121*, M1536dnf, and P1*; Color LaserJet CM* and CP*; and TopShot LaserJet Pro M275 printers allows remote attackers to cause a denial of service via unknown vectors.

  • CVE-2013-6038Dec 17, 2013
    Trimble
    Sketchup Viewer
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in Trimble SketchUp Viewer 13.0.4124 allows remote attackers to execute arbitrary code via a crafted .SKP file.

  • CVE-2013-2816Dec 17, 2013
    Cooper Power Systems
    SMP
    risk 0.00cvss —epss 0.00

    The DNP3 component in Cooper Power Systems SMP 4, 4/DP, and 16 gateways allows physically proximate attackers to cause a denial of service (reboot or link outage) via crafted input over a serial line.

  • CVE-2013-2814Dec 17, 2013
    Cooperindustries
    Dnp3 Master Opc Server
    risk 0.00cvss —epss 0.01

    Cooper Power Systems Cybectec DNP3 Master OPC Server allows remote attackers to cause a denial of service (unhandled exception and process crash) via unspecified vectors.

  • CVE-2013-2813Dec 17, 2013
    Cooper Power Systems
    SMP
    risk 0.00cvss —epss 0.01

    The DNP3 component in Cooper Power Systems SMP 4, 4/DP, and 16 gateways allows remote attackers to cause a denial of service (reboot or link outage) via a crafted DNP3 TCP packet.

  • CVE-2013-6966Dec 17, 2013
    Cisco Systems, Inc.
    Webex Training Center
    risk 0.00cvss —epss 0.02

    Open redirect vulnerability in Cisco WebEx Training Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCul36031.

  • CVE-2013-6926Dec 17, 2013
    Siemens Foundation
    Ros
    risk 0.00cvss —epss 0.01

    The integrated HTTPS server in Siemens RuggedCom ROS before 3.12.2 allows remote authenticated users to bypass intended restrictions on administrative actions by leveraging access to a (1) guest or (2) operator account.

  • CVE-2013-6925Dec 17, 2013
    Siemens Foundation
    Ros
    risk 0.00cvss —epss 0.02

    The integrated HTTPS server in Siemens RuggedCom ROS before 3.12.2 allows remote attackers to hijack web sessions by predicting a session id value.

  • CVE-2013-6420Dec 17, 2013
    PHP
    PHP
    risk 0.06cvss —epss 0.36

    The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a…

  • CVE-2013-6192Dec 17, 2013
    Microfocus
    Operations Orchestration
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in HP Operations Orchestration before 9 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2013-6191Dec 17, 2013
    Microfocus
    Operations Orchestration
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in HP Operations Orchestration before 9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-3140Dec 16, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.24

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted CMarkup object, aka "Internet Explorer Use After Free Vulnerability."