VYPR

CVEs

387,989 total · page 6588 of 7,760

AllCriticalHighKEV
  • CVE-2013-6902Dec 5, 2013
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6901Dec 5, 2013
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0, when Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6900Dec 5, 2013
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6004Dec 5, 2013
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in Cybozu Garoon before 3.7.2 allows remote attackers to hijack web sessions via unspecified vectors.

  • CVE-2013-6003Dec 5, 2013
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in Cybozu Garoon 3.1 through 3.5 SP5, when Phone Messages forwarding is enabled, allows remote authenticated users to inject arbitrary e-mail headers via unspecified vectors.

  • CVE-2013-6002Dec 5, 2013
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.02

    The server in Cybozu Garoon before 3.7 SP1 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.

  • CVE-2013-6001Dec 5, 2013
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Space function in Cybozu Garoon before 3.7 SP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-6000Dec 5, 2013
    Tattyan
    HP TOWN
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Tattyan HP TOWN before 5_10_1 allows remote attackers to read arbitrary files via a .. (dot dot) in a request.

  • CVE-2013-6945Dec 4, 2013
    Osehra
    Vista
    risk 0.00cvss —epss 0.01

    The M2M Broker in OSEHRA VistA, as distributed before September 30, 2013, allows attackers to bypass authentication and authorization to perform doctor-only actions and read or modify patient records via unspecified vectors related to a "logic flaw."

  • CVE-2013-2825Dec 4, 2013
    Elecsys
    Director Gateway
    risk 0.00cvss —epss 0.01

    The DNP3 service in the Outstation component on Elecsys Director Gateway devices with kernel 2.6.32.11ael1 and earlier allows remote attackers to cause a denial of service (CPU consumption and communication outage) via crafted input.

  • CVE-2013-6936Dec 4, 2013
    MyBB
    Ajax Forum Stat
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletinBoard) allow remote attackers to execute arbitrary SQL commands via the (1) tooltip or (2) usertooltip parameter.

  • CVE-2013-6935Dec 4, 2013
    Videocharge
    Watermark Master
    risk 0.06cvss —epss 0.32

    Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the SourcePath value in a .wcf file.

  • CVE-2013-6702Dec 4, 2013
    Cisco Systems, Inc.
    Ons 15454 Firmware
    risk 0.00cvss —epss 0.02

    The management implementation on Cisco ONS 15454 controller cards with software 9.8 and earlier allows remote attackers to cause a denial of service (card reset) via crafted packets, aka Bug ID CSCtz50902.

  • CVE-2013-3519Dec 4, 2013
    VMware
    Workstation
    risk 0.00cvss —epss 0.01

    lgtosync.sys in VMware Workstation 9.x before 9.0.3, VMware Player 5.x before 5.0.3, VMware Fusion 5.x before 5.0.4, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1, when a 32-bit Windows guest OS is used, allows guest OS users to gain guest OS privileges via an…

  • CVE-2013-6029Dec 4, 2013
    Att
    Connect Participant Application
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in the AT&T Connect Participant Application before 9.5.51 on Windows allows remote attackers to execute arbitrary code via a malformed .SVT file.

  • CVE-2013-5449Dec 4, 2013
    IBM
    Filenet Content Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in workingSet.jsp in IBM Eclipse Help System (IEHS), as used in the installable InfoCenter component in IBM FileNet Content Manager 4.5.1, 5.0.0, 5.1.0, and 5.2.0, allows remote attackers to inject arbitrary web script or HTML via…

  • CVE-2013-6937Dec 4, 2013
    Videocharge
    Watermark Master
    risk 0.03cvss —epss 0.03

    Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the name attribute of the cols element in a .wstyle file.

  • CVE-2013-6705Dec 3, 2013
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    The IP Device Tracking (IPDT) feature in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (IPDT AVL corruption and device reload) via a crafted sequence of ARP packets, aka Bug ID CSCuh38133.

  • CVE-2013-6704Dec 3, 2013
    Cisco Systems, Inc.
    iOS Xe
    risk 0.00cvss —epss 0.01

    Cisco IOS XE does not properly manage memory for TFTP UDP flows, which allows remote attackers to cause a denial of service (memory consumption) via TFTP (1) client or (2) server traffic, aka Bug IDs CSCuh09324 and CSCty42686.

  • CVE-2013-6703Dec 3, 2013
    Cisco Systems, Inc.
    ONS15454
    risk 0.00cvss —epss 0.01

    The TLS/SSLv3 module on Cisco ONS 15454 controller cards allows remote attackers to cause a denial of service (card reset) via crafted (1) TLS or (2) SSLv3 packets, aka Bug ID CSCuh34787.

  • CVE-2013-6690Dec 3, 2013
    Cisco Systems, Inc.
    Prime Collaboration
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the web interface in the Assurance component in Cisco Prime Collaboration allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs CSCui92643, CSCui94038, and CSCui94161.

  • CVE-2012-6150Dec 3, 2013
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.04

    The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in…

  • CVE-2013-6696Dec 2, 2013
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    Cisco Adaptive Security Appliance (ASA) Software does not properly handle errors during the processing of DNS responses, which allows remote attackers to cause a denial of service (device reload) via a malformed response, aka Bug ID CSCuj28861.

  • CVE-2013-6695Dec 2, 2013
    Cisco Systems, Inc.
    Secure Access Control System
    risk 0.00cvss —epss 0.01

    The RBAC implementation in Cisco Secure Access Control System (ACS) does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the…

  • CVE-2012-6535Dec 2, 2013
    Djvulibre Project
    Djvulibre
    risk 0.00cvss —epss 0.05

    DjVuLibre before 3.5.25.3, as used in Evince, Sumatra PDF Reader, VuDroid, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted DjVu (aka .djv) file.

  • CVE-2012-0434Dec 2, 2013
    Dell
    Crowbar
    risk 0.00cvss —epss 0.02

    The server in Crowbar, as used in SUSE Cloud 1.0, uses weak permissions for the production.log file, which has unspecified impact and attack vectors.

  • CVE-2012-0427Dec 2, 2013
    SUSE S.A.
    yast2-add-on-creator
    risk 0.00cvss —epss 0.00

    yast2-add-on-creator in SUSE inst-source-utils 2008.11.26 before 2008.11.26-0.9.1 and 2012.9.13 before 2012.9.13-0.8.1 allows local users to gain privileges via a crafted (1) file name or (2) directory name.

  • CVE-2012-0426Dec 2, 2013
    Novell
    Suse Linux Enterprise For Sap Applications
    risk 0.00cvss —epss 0.00

    Race condition in sap_suse_cluster_connector before 1.0.0-0.8.1 in SUSE Linux Enterprise for SAP Applications 11 SP2 allows local users to have an unspecified impact via vectors related to a tmp/ directory.

  • CVE-2012-0425Dec 2, 2013
    SUSE S.A.
    yast2-network
    risk 0.00cvss —epss 0.01

    LanItems.ycp in save_y2logs in yast2-network before 2.24.4 in SUSE YaST writes cleartext Wi-Fi credentials to the y2log log file, which allows context-dependent attackers to obtain sensitive information by reading the (1) WIRELESS_WPA_PASSWORD or (2) WIRELESS_CLIENT_KEY_PASSWORD…

  • CVE-2012-0420Dec 2, 2013
    OpenSUSE
    Zypper
    risk 0.00cvss —epss 0.00

    zypp-refresh-wrapper in SUSE Zypper before 1.3.20 and 1.6.x before 1.6.166 allows local users to create files in arbitrary directories, or possibly have unspecified other impact, via a pathname in the ZYPP_LOCKFILE_ROOT environment variable.

  • CVE-2012-0414Dec 2, 2013
    Novell
    Suse Manager
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Spacewalk service in SUSE Manager 1.2 for SUSE Linux Enterprise (SLE) 11 SP1 allows remote attackers to inject arbitrary web script or HTML via an image name.

  • CVE-2013-3707Dec 1, 2013
    Novell
    Open Enterprise Server
    risk 0.00cvss —epss 0.02

    The HTTPSTK service in the novell-nrm package before 2.0.2-297.305.302.3 in Novell Open Enterprise Server 2 (OES 2) Linux, and OES 11 Linux Gold and SP1, does not make the intended SSL_free and SSL_shutdown calls for the close of a TCP connection, which allows remote attackers…

  • CVE-2013-2818Dec 1, 2013
    Alstom
    E Terracontrol
    risk 0.00cvss —epss 0.00

    The DNP Master Driver in Alstom e-terracontrol 3.5, 3.6, and 3.7 allows physically proximate attackers to cause a denial of service (infinite loop and DNP3 service disruption) via crafted input over a serial line.

  • CVE-2013-6718Dec 1, 2013
    IBM
    Advanced Management Module
    risk 0.00cvss —epss 0.01

    The Advanced Management Module (AMM) with firmware 3.64B, 3.64C, and 3.64G for IBM BladeCenter systems allows remote attackers to discover account names and passwords via use of an unspecified interface.

  • CVE-2013-3708Dec 1, 2013
    Novell
    Iprint
    risk 0.00cvss —epss 0.01

    The id1.GetPrinterURLList function in Novell iPrint Client before 5.93 allows remote attackers to cause a denial of service via unspecified vectors.

  • CVE-2013-6918Nov 30, 2013
    Satechi
    Smart Travel Router
    risk 0.00cvss —epss 0.01

    The web interface on the Satechi travel router 1.5, when Wi-Fi is used for WAN access, exposes the console without authentication on the WAN IP address regardless of the "Web Management via WAN" setting, which allows remote attackers to bypass intended access restrictions via…

  • CVE-2013-5636Nov 30, 2013
    Checkpoint
    Endpoint Security
    risk 0.00cvss —epss 0.00

    Unlock.exe in Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not associate password failures with a device ID, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by overwriting DVREM.EPM…

  • CVE-2013-5635Nov 30, 2013
    Checkpoint
    Endpoint Security
    risk 0.00cvss —epss 0.00

    Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not properly maintain the state of password failures, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by entering password guesses within…

  • CVE-2013-6392Nov 30, 2013
    Codeaurora
    Android Msm
    risk 0.00cvss —epss 0.00

    The genlock_dev_ioctl function in genlock.c in the Genlock driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly initialize a certain data structure, which allows local users to…

  • CVE-2013-6791Nov 29, 2013
    Microsoft
    Enhanced Mitigation Experience Toolkit
    risk 0.00cvss —epss 0.05

    Microsoft Enhanced Mitigation Experience Toolkit (EMET) before 4.0 uses predictable addresses for hooked functions, which makes it easier for context-dependent attackers to defeat the ASLR protection mechanism via a return-oriented programming (ROP) attack.

  • CVE-2013-6307Nov 29, 2013
    IBM
    QRadar SIEM
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5463Nov 29, 2013
    IBM
    QRadar SIEM
    risk 0.00cvss —epss 0.01

    The WinCollect agent in IBM Security QRadar SIEM before 7.1.1.569824 allows remote attackers to bypass intended access restrictions by injecting a (1) DLL or (2) configuration file.

  • CVE-2013-5448Nov 29, 2013
    IBM
    QRadar SIEM
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Right Click Plugin context menus in IBM Security QRadar SIEM 7.1 and 7.2 before 7.2 MR1 Patch 1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6885Nov 29, 2013
    AMD
    16h 00h through 0Fh processors
    risk 0.00cvss —epss 0.01

    The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue.

  • CVE-2013-6706Nov 29, 2013
    Cisco Systems, Inc.
    iOS Xe
    risk 0.00cvss —epss 0.02

    The Cisco Express Forwarding processing module in Cisco IOS XE allows remote attackers to cause a denial of service (device reload) via crafted MPLS packets that are not properly handled during IP header validation, aka Bug ID CSCuj23992.

  • CVE-2013-6700Nov 29, 2013
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.01

    The SNMP module in Cisco IOS XR allows remote attackers to cause a denial of service (process reload) via a request for an unspecified MIB, aka Bug ID CSCuh43144.

  • CVE-2013-4844Nov 29, 2013
    Microfocus
    Service Manager
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in HP Service Manager 7.11, 9.21, 9.30, 9.31, and 9.32, and ServiceCenter 6.2.8, allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2013-6712Nov 28, 2013
    PHP
    PHP
    risk 0.00cvss —epss 0.05

    The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.

  • CVE-2013-6322Nov 28, 2013
    IBM
    Sterling Selling and Fulfillment Suite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 8.0 before HF128 and 8.5 before HF93 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5912Nov 28, 2013
    Thomson Reuters
    Velocity Analytics Vhayu Analytic Server
    risk 0.06cvss —epss 0.30

    VhttpdMgr in Thomson Reuters Velocity Analytics Vhayu Analytic Server 6.94 build 2995 allows remote attackers to execute arbitrary code via a URL in the fileName parameter during an importFile action.