VYPR

CVEs

387,999 total · page 6587 of 7,760

AllCriticalHighKEV
  • CVE-2013-0848Dec 7, 2013
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.02

    The decode_init function in libavcodec/huffyuv.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted width in huffyuv data with the predictor set to median and the colorspace set to YUV422P, which triggers an out-of-bounds array access.

  • CVE-2013-0847Dec 7, 2013
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.02

    The ff_id3v2_parse function in libavformat/id3v2.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via ID3v2 header data, which triggers an out-of-bounds array access.

  • CVE-2013-0846Dec 7, 2013
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.03

    Array index error in the qdm2_decode_super_block function in libavcodec/qdm2.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted QDM2 data, which triggers an out-of-bounds array access.

  • CVE-2013-0845Dec 7, 2013
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.04

    libavcodec/alsdec.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via a crafted block length, which triggers an out-of-bounds write.

  • CVE-2013-0844Dec 7, 2013
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.02

    Off-by-one error in the adpcm_decode_frame function in libavcodec/adpcm.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via crafted DK4 data, which triggers an out-of-bounds array access.

  • CVE-2012-6612Dec 7, 2013
    Apache
    Solr
    risk 0.00cvss —epss 0.10

    The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity…

  • CVE-2013-6410Dec 7, 2013
    Nbd
    nbd
    risk 0.00cvss —epss 0.03

    nbd-server in Network Block Device (nbd) before 3.5 does not properly check IP addresses, which might allow remote attackers to bypass intended access restrictions via an IP address that has a partial match in the authfile configuration file.

  • CVE-2013-6409Dec 7, 2013
    Debian
    Adequate
    risk 0.00cvss —epss 0.00

    Debian adequate before 0.8.1, when run by root with the --user option, allows local users to hijack the tty and possibly gain privileges via the TIOCSTI ioctl.

  • CVE-2013-6408Dec 7, 2013
    Apache
    Solr
    risk 0.00cvss —epss 0.11

    The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an…

  • CVE-2013-6407Dec 7, 2013
    Apache
    Solr
    risk 0.00cvss —epss 0.11

    The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

  • CVE-2013-6397Dec 7, 2013
    Apache
    Solr
    risk 0.00cvss —epss 0.56

    Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be…

  • CVE-2013-6050Dec 7, 2013
    Twibright
    Links
    risk 0.00cvss —epss 0.01

    Integer overflow in Links before 2.8 allows remote attackers to cause a denial of service (crash) via crafted HTML tables.

  • CVE-2013-4558Dec 7, 2013
    Apache
    Subversion
    risk 0.00cvss —epss 0.06

    The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion…

  • CVE-2013-4505Dec 7, 2013
    Apache
    Subversion
    risk 0.01cvss —epss 0.08

    The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.

  • CVE-2013-4479Dec 7, 2013
    Supmua
    Sup
    risk 0.00cvss —epss 0.03

    lib/sup/message_chunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the content_type of an email attachment.

  • CVE-2013-4478Dec 7, 2013
    Supmua
    Sup
    risk 0.00cvss —epss 0.02

    Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.

  • CVE-2013-4446Dec 7, 2013
    Drupal
    Context
    risk 0.00cvss —epss 0.02

    The _json_decode function in plugins/context_reaction_block.inc in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal, when using a version of PHP that does not support the json_decode function, allows remote attackers to execute arbitrary PHP code…

  • CVE-2013-4445Dec 7, 2013
    Drupal
    Context
    risk 0.00cvss —epss 0.02

    The json rendering functionality in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal uses Drupal's token scheme to restrict access to blocks, which makes it easier for remote authenticated users to guess the access token for a block by leveraging…

  • CVE-2013-4212Dec 7, 2013
    Apache
    Roller
    risk 0.09cvss —epss 0.81

    Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol,…

  • CVE-2013-4171Dec 7, 2013
    Apache
    Roller
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the (1) RSS and (2) Atom feed templates.

  • CVE-2013-6707Dec 7, 2013
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.03

    Memory leak in the connection-manager implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to cause a denial of service (multi-protocol management outage) by making multiple management session requests, aka Bug ID…

  • CVE-2013-5455Dec 7, 2013
    IBM
    Smartcloud Provisioning
    risk 0.00cvss —epss 0.01

    IBM SmartCloud Provisioning 2.1 before FP3 IF0001 allows remote authenticated users to modify virtual-system deployment via deployer.virtualsystems CLI commands, as demonstrated by a deletion using a deployer.virtualsystems[#].delete command.

  • CVE-2013-6999Dec 7, 2013
    Microsoft
    Windows Server 2008
    risk 0.00cvss —epss 0.02

    The IsHandleEntrySecure function in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 SP2 does not properly validate the tagPROCESSINFO pW32Job field, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a…

  • CVE-2013-6920Dec 7, 2013
    Siemens Foundation
    SINAMICS S/G controllers
    risk 0.00cvss —epss 0.03

    Siemens SINAMICS S/G controllers with firmware before 4.6.11 do not require authentication for FTP and TELNET sessions, which allows remote attackers to bypass intended access restrictions via TCP traffic to port (1) 21 or (2) 23.

  • CVE-2013-6640Dec 7, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds read) via JavaScript code that sets a variable to the value of…

  • CVE-2013-6639Dec 7, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via…

  • CVE-2013-6638Dec 7, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Multiple buffer overflows in runtime.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a large typed array, related to the (1)…

  • CVE-2013-6637Dec 7, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Google Chrome before 31.0.1650.63 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

  • CVE-2013-6636Dec 7, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The FrameLoader::notifyIfInitialDocumentAccessed function in core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 31.0.1650.63, makes an incorrect check for an empty document during presentation of a modal dialog, which allows remote attackers to spoof the…

  • CVE-2013-6635Dec 7, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the editing implementation in Blink, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via JavaScript code that triggers removal of a node during processing…

  • CVE-2013-6634Dec 7, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/one_click_signin_helper.cc in Google Chrome before 31.0.1650.63 uses an incorrect URL during realm validation, which allows remote attackers to conduct session fixation attacks and hijack web sessions by…

  • CVE-2013-6417Dec 7, 2013
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.02

    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended…

  • CVE-2013-6416Dec 7, 2013
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.

  • CVE-2013-6415Dec 7, 2013
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.

  • CVE-2013-6414Dec 7, 2013
    Rubyonrails
    Rails
    risk 0.05cvss —epss 0.21

    actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.

  • CVE-2013-4492Dec 7, 2013
    I18n Project
    I18n
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call.

  • CVE-2013-4491Dec 7, 2013
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string…

  • CVE-2013-2133Dec 6, 2013
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.00cvss —epss 0.02

    The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise…

  • CVE-2013-1090Dec 6, 2013
    SUSE S.A.
    horde5
    risk 0.00cvss —epss 0.00

    The SUSE horde5 package before 5.0.2-2.4.1 sets incorrect ownership for certain configuration files and directories including /etc/apache2/vhosts.d, which allows local wwwrun users to gain privileges via unspecified vectors.

  • CVE-2013-6804Dec 5, 2013
    Jamroom
    Search Module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Search module before 1.1.1 for Jamroom allows remote attackers to inject arbitrary web script or HTML via the search_string parameter to search/results/all/1/4.

  • CVE-2013-6787Dec 5, 2013
    Chamilo
    Lms
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in the check_user_password function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the non-encrypted passwords mode set at installation, allows remote authenticated users to execute arbitrary SQL commands via the "password0"…

  • CVE-2013-6395Dec 5, 2013
    Ganglia
    Web
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in header.php in Ganglia Web 3.5.8 and 3.5.10 allows remote attackers to inject arbitrary web script or HTML via the host_regex parameter to the default URI, which is processed by get_context.php.

  • CVE-2013-6341Dec 5, 2013
    Dokeos
    Dokeos
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in Dokeos 2.2 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the language parameter to index.php.

  • CVE-2013-6267Dec 5, 2013
    Claroline
    Claroline
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.11.9 allow remote attackers to inject arbitrary web script or HTML via the (1) box parameter to messaging/messagebox.php, cidToEdit parameter to (2) adminregisteruser.php or (3)…

  • CVE-2013-5108Dec 5, 2013
    Rockmongo
    Rockmongo
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the xn function in RockMongo 1.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) db parameter on the login page or (2) username parameter in a login.index action to index.php and other…

  • CVE-2013-3921Dec 5, 2013
    Easytimestudio
    Easy File Manager
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Easytime Studio Easy File Manager 1.1 for iOS allows remote attackers to read arbitrary files via a ..%2f (encoded dot dot slash) to the default URI.

  • CVE-2013-6916Dec 5, 2013
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Yahoo! User Interface Library in Cybozu Garoon before 3.7.2, when Internet Explorer 9 or 10 or Chrome is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6915Dec 5, 2013
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6914Dec 5, 2013
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6913Dec 5, 2013
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in a search component in Cybozu Garoon before 3.7.2, when Internet Explorer is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.