VYPR

CVEs

388,017 total · page 6584 of 7,761

AllCriticalHighKEV
  • CVE-2013-4587Dec 14, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Array index error in the kvm_vm_ioctl_create_vcpu function in virt/kvm/kvm_main.c in the KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges via a large id value.

  • CVE-2013-7104Dec 14, 2013
    McAfee
    Email Gateway
    risk 0.00cvss —epss 0.04

    McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands by specifying them in the value attribute in a (1) Command or (2) Script XML element. NOTE: this issue can be combined with CVE-2013-7092 to allow remote attackers to execute…

  • CVE-2013-7103Dec 14, 2013
    McAfee
    Email Gateway
    risk 0.00cvss —epss 0.04

    McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the value attribute in a (1) TestFile XML element or the (2) hostname. NOTE: this issue can be combined with CVE-2013-7092 to allow remote attackers to…

  • CVE-2013-7085Dec 14, 2013
    Devscripts Devel Team
    Devscripts
    risk 0.00cvss —epss 0.02

    Uscan in devscripts 2.13.5, when USCAN_EXCLUSION is enabled, allows remote attackers to delete arbitrary files via a whitespace character in a filename.

  • CVE-2013-7069Dec 14, 2013
    Beyondgrep
    Ack
    risk 0.00cvss —epss 0.03

    ack 2.00 through 2.11_02 allows remote attackers to execute arbitrary code via a (1) --pager, (2) --regex, or (3) --output option in a .ackrc file in a directory to be searched.

  • CVE-2013-6428Dec 14, 2013
    OpenStack
    Heat
    risk 0.00cvss —epss 0.02

    The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.

  • CVE-2013-6426Dec 14, 2013
    OpenStack
    Heat
    risk 0.00cvss —epss 0.01

    The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and (1) create a stack via the…

  • CVE-2013-6411Dec 14, 2013
    OpenTTD
    Openttd
    risk 0.00cvss —epss 0.03

    The HandleCrashedAircraft function in aircraft_cmd.cpp in OpenTTD 0.3.6 through 1.3.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) by crashing an aircraft outside of the map.

  • CVE-2013-6391Dec 14, 2013
    OpenStack
    Keystone
    risk 0.00cvss —epss 0.02

    The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and…

  • CVE-2013-6051Dec 14, 2013
    Quagga (software)
    Quagga
    risk 0.00cvss —epss 0.02

    The bgp_attr_unknown function in bgp_attr.c in Quagga 0.99.21 does not properly initialize the total variable, which allows remote attackers to cause a denial of service (bgpd crash) via a crafted BGP update.

  • CVE-2013-5107Dec 14, 2013
    Rockmongo
    Rockmongo
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in RockMongo 1.1.5 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the ROCK_LANG cookie, as demonstrated in a login.index action to index.php.

  • CVE-2013-1364Dec 14, 2013
    Zabbix
    Zabbix
    risk 0.00cvss —epss 0.02

    The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter.

  • CVE-2013-7096Dec 13, 2013
    SAP
    Emr Unwired
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in SAP EMR Unwired allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-7095Dec 13, 2013
    SAP
    Customer Relationship Management
    risk 0.00cvss —epss 0.02

    The XML parser (crm_flex_data) in SAP Customer Relationship Management (CRM) 7.02 EHP 2 has unknown impact and attack vectors related to an XML External Entity (XXE) issue.

  • CVE-2013-7094Dec 13, 2013
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the RSDDCVER_COUNT_TAB_COLS function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-7093Dec 13, 2013
    SAP
    Network Interface Router
    risk 0.00cvss —epss 0.03

    SAP Network Interface Router (SAProuter) 39.3 SP4 allows remote attackers to bypass authentication and modify the configuration via unspecified vectors.

  • CVE-2013-7039Dec 13, 2013
    Libmicrohttpd
    libmicrohttpd
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd before 0.9.32, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long URI in an…

  • CVE-2013-7038Dec 13, 2013
    GNU
    Libmicrohttpd
    risk 0.00cvss —epss 0.02

    The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.

  • CVE-2013-6809Dec 13, 2013
    Tftpd32
    Tftpd32
    risk 0.00cvss —epss 0.03

    Format string vulnerability in the client in Tftpd32 before 4.50 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in the Remote File field.

  • CVE-2013-6400Dec 13, 2013
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    Xen 4.2.x and 4.3.x, when using Intel VT-d and a PCI device has been assigned, does not clear the flag that suppresses IOMMU TLB flushes when unspecified errors occur, which causes the TLB entries to not be flushed and allows local guest administrators to cause a denial of…

  • CVE-2013-6359Dec 13, 2013
    Munin Monitoring
    Munin
    risk 0.00cvss —epss 0.02

    Munin::Master::Node in Munin before 2.0.18 allows remote attackers to cause a denial of service (abort data collection for node) via a plugin that uses "multigraph" as a multigraph service name.

  • CVE-2013-6048Dec 13, 2013
    Munin Monitoring
    Munin
    risk 0.00cvss —epss 0.03

    The get_group_tree function in lib/Munin/Master/HTMLConfig.pm in Munin before 2.0.18 allows remote nodes to cause a denial of service (infinite loop and memory consumption in the munin-html process) via crafted multigraph data.

  • CVE-2013-5676Dec 13, 2013
    Sonarsource
    Jenkins Plugin
    risk 0.03cvss —epss 0.05

    The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.

  • CVE-2012-6151Dec 13, 2013
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.09

    Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote attackers to cause a denial of service (crash or infinite loop, CPU consumption, and hang) by causing the AgentX subagent to timeout.

  • CVE-2013-7092Dec 13, 2013
    McAfee
    Email Gateway
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in /admin/cgi-bin/rpc/doReport/18 in McAfee Email Gateway 7.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) events_col, (2) event_id, (3) reason, (4) events_order, (5) emailstatus_order, or (6)…

  • CVE-2013-7091Dec 13, 2013
    Zimbra
    Zimbra
    risk 0.10cvss —epss 0.86

    Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the skin parameter. NOTE: this can be leveraged to execute…

  • CVE-2013-7050Dec 13, 2013
    Devscripts Devel Team
    Devscripts
    risk 0.00cvss —epss 0.02

    The get_main_source_dir function in scripts/uscan.pl in devscripts before 2.13.8, when using USCAN_EXCLUSION, allows remote attackers to execute arbitrary commands via shell metacharacters in a directory name.

  • CVE-2013-6958Dec 13, 2013
    Juniper Networks
    Screenos
    risk 0.00cvss —epss 0.02

    Juniper NetScreen Firewall running ScreenOS 5.4, 6.2, or 6.3, when the Ping of Death screen is disabled, allows remote attackers to cause a denial of service via a crafted packet.

  • CVE-2013-6957Dec 13, 2013
    Juniper Networks
    IDP
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the web administrative component in Juniper IDP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the ACM web server.

  • CVE-2013-6956Dec 13, 2013
    Juniper Networks
    Ive OS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Secure Access Service Web rewriting feature in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r17, 7.3 before 7.3r8, 7.4 before 7.4r6, and 8.0 before 8.0r1, when web rewrite is enabled, allows remote…

  • CVE-2013-6394Dec 13, 2013
    Percona
    Xtrabackup
    risk 0.00cvss —epss 0.00

    Percona XtraBackup before 2.1.6 uses a constant string for the initialization vector (IV), which makes it easier for local users to defeat cryptographic protection mechanisms and conduct plaintext attacks.

  • CVE-2013-4569Dec 13, 2013
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    The CleanChanges extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3, when "Group changes by page in recent changes and watchlist" is enabled, allows remote attackers to obtain sensitive information (revision-deleted IPs) via the Recent Changes…

  • CVE-2013-4568Dec 13, 2013
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of…

  • CVE-2013-4567Dec 13, 2013
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.01

    Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a \b (backspace) character in CSS.

  • CVE-2013-0348Dec 13, 2013
    Acme
    Thttpd
    risk 0.00cvss —epss 0.01

    thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to obtain sensitive information by reading the file.

  • CVE-2012-5394Dec 13, 2013
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the CentralAuth extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to hijack the authentication of users for requests that login via vectors involving image loading.

  • CVE-2013-6839Dec 13, 2013
    Instantsoft
    Instantcms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary SQL commands via the orderby parameter to catalog/[id].

  • CVE-2013-6005Dec 13, 2013
    Cybozu
    Dezie
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Cybozu Dezie before 8.1.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to the Cancel button.

  • CVE-2013-4988Dec 13, 2013
    Icofx
    Icofx
    risk 0.08cvss —epss 0.67

    Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCount value in an ICONDIR structure in an ICO file. NOTE: some of these details are obtained from third party information.

  • CVE-2013-5763Dec 12, 2013
    Oracle Corporation
    Fusion Middleware
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.0 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Maintenance. NOTE: the original disclosure of this issue erroneously…

  • CVE-2013-6421Dec 12, 2013
    Projectsprouts
    Sprout
    risk 0.00cvss —epss 0.02

    The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.

  • CVE-2013-6054Dec 12, 2013
    Uclouvain
    Openjpeg
    risk 0.00cvss —epss 0.02

    Heap-based buffer overflow in OpenJPEG 1.3 has unspecified impact and remote vectors, a different vulnerability than CVE-2013-6045.

  • CVE-2013-6052Dec 12, 2013
    Uclouvain
    Openjpeg
    risk 0.00cvss —epss 0.02

    OpenJPEG 1.3 and earlier allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based out-of-bounds read.

  • CVE-2013-6045Dec 12, 2013
    Uclouvain
    Openjpeg
    risk 0.00cvss —epss 0.06

    Multiple heap-based buffer overflows in OpenJPEG 1.3 and earlier might allow remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2013-4566Dec 12, 2013
    Mod Nss Project
    Mod Nss
    risk 0.00cvss —epss 0.02

    mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions.

  • CVE-2013-4458Dec 12, 2013
    GNU
    Glibc
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of…

  • CVE-2013-2752Dec 12, 2013
    Netgear
    Raidiator
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in frontview/lib/np_handler.pl in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to hijack the authentication of users.

  • CVE-2013-2751Dec 12, 2013
    Netgear
    Raidiator
    risk 0.09cvss —epss 0.72

    Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to execute arbitrary Perl code via a crafted request, related to the "forgot password workflow."

  • CVE-2013-1978Dec 12, 2013
    GIMP
    Gimp
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in the read_xwd_cols function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an X Window System (XWD) image dump with more…

  • CVE-2013-1913Dec 12, 2013
    GIMP
    Gimp
    risk 0.00cvss —epss 0.04

    Integer overflow in the load_image function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier, when used with glib before 2.24, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large color entries…