VYPR

CVEs

387,986 total · page 6589 of 7,760

AllCriticalHighKEV
  • CVE-2013-4617Nov 27, 2013
    Jahia
    Jahia Xcm
    risk 0.00cvss —epss 0.01

    Jahia xCM before 6.6.2 does not include the HTTPOnly flag in a Set-Cookie header for the JSESSIONID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

  • CVE-2013-3920Nov 27, 2013
    Jahia
    Jahia Xcm
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Jahia xCM before 6.6.2 allows remote authenticated users to inject arbitrary web script or HTML via the "about me" field.

  • CVE-2013-6383Nov 27, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call.

  • CVE-2013-6382Nov 27, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for a (1) XFS_IOC_ATTRLIST_BY_HANDLE or…

  • CVE-2013-6381Nov 27, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Buffer overflow in the qeth_snmp_command function in drivers/s390/net/qeth_core_main.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service or possibly have unspecified other impact via an SNMP ioctl call with a length value that is incompatible…

  • CVE-2013-6380Nov 27, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The aac_send_raw_srb function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 3.12.1 does not properly validate a certain size value, which allows local users to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via…

  • CVE-2013-6378Nov 27, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service (OOPS) by leveraging root privileges for a zero-length write operation.

  • CVE-2013-4036Nov 27, 2013
    IBM
    Infosphere Master Data Management Server For Product Information Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1 FP13, and IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1 FP7 and 11.0 before FP2, allows remote…

  • CVE-2013-3394Nov 27, 2013
    Cisco Systems, Inc.
    Prime Network Registrar
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web interface in Cisco Prime Network Registrar 8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted field, aka Bug ID CSCuh41429.

  • CVE-2013-6875Nov 26, 2013
    Nagios
    XI
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php.

  • CVE-2013-6874Nov 26, 2013
    Vortex
    Light Alloy
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in Vortex Light Alloy before 4.7.4 allows remote attackers to execute arbitrary code via a long URL in a .m3u file.

  • CVE-2013-6873Nov 26, 2013
    Testa
    Online Test Management System
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in Testa Online Test Management System (OTMS) 2.0.0.2 allows remote attackers to execute arbitrary SQL commands via the test_id parameter.

  • CVE-2013-3923Nov 26, 2013
    Savysoda
    WiFi Free Hd
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in SavySoda WiFi HD Free before 7.0 allows remote attackers to read arbitrary files via a ..%2f (encoded dot dot slash) in a GET request.

  • CVE-2013-4525Nov 26, 2013
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in mod/quiz/report/responses/responses_table.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via an answer to a…

  • CVE-2013-4524Nov 26, 2013
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in repository/filesystem/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a path.

  • CVE-2013-4523Nov 26, 2013
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in message/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted message.

  • CVE-2013-4522Nov 26, 2013
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send "Cache-Control: private" HTTP headers, which allows remote attackers to obtain sensitive information by requesting a file that had been previously retrieved by…

  • CVE-2013-6870Nov 25, 2013
    Splunk
    Splunk
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6374Nov 25, 2013
    Jenkins Project
    Build Failure Analyzer
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.5.1 for Jenkins allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6373Nov 25, 2013
    Jenkins Project
    Exclusion Plugin
    risk 0.00cvss —epss 0.01

    The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to list and release resources via unspecified vectors.

  • CVE-2013-4573Nov 25, 2013
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to inject arbitrary web script or HTML via the "to" parameter to index.php.

  • CVE-2013-3922Nov 25, 2013
    Gummybearstudios
    Ftp Drive \+ HTTP Server
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in Gummy Bear Studios FTP Drive + HTTP Server 1.0.4 and earlier allows remote attackers to read arbitrary files via a ..%2f (encoded dot dot slash) in a GET request.

  • CVE-2012-6608Nov 25, 2013
    Elastix
    Elastix
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in xmlservices/E_book.php in Elastix 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the Page parameter.

  • CVE-2013-5458Nov 24, 2013
    IBM
    Java
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6 allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2013-5457Nov 24, 2013
    IBM
    Java
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6, 6.0.1 before SR7, and 6.0.0 before SR15 allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2013-5456Nov 24, 2013
    IBM
    Java
    risk 0.00cvss —epss 0.06

    The com.ibm.rmi.io.SunSerializableFactory class in IBM Java SDK 7.0.0 before SR6 allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code via vectors related to deserialization inside the AccessController doPrivileged block.

  • CVE-2013-5375Nov 24, 2013
    IBM
    Java
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6, 6.0.1 before SR7, 6.0.0 before SR15, and 5.0.0 before SR16 FP4 allows remote attackers to access restricted classes via unspecified vectors related to XML and XSL.

  • CVE-2013-4041Nov 24, 2013
    IBM
    Java
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in IBM Java SDK 5.0.0 before SR16 FP4, 7.0.0 before SR6, 6.0.1 before SR7, and 6.0.0 before SR15 allows remote attackers to access restricted classes via unspecified vectors.

  • CVE-2013-6869Nov 23, 2013
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the SRTT_GET_COUNT_BEFORE_KEY_RFC function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4509Nov 23, 2013
    Ibus Project
    Ibus
    risk 0.00cvss —epss 0.00

    The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the…

  • CVE-2013-4164Nov 23, 2013
    Ruby Lang
    Ruby
    risk 0.06cvss —epss 0.35

    Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string…

  • CVE-2013-6868Nov 23, 2013
    Sybase
    Adaptive Server Enterprise
    risk 0.00cvss —epss 0.01

    SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows local users to obtain sensitive information via unspecified vectors.

  • CVE-2013-6867Nov 23, 2013
    Sybase
    Adaptive Server Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.7 before 15.7 SP50 or 15.7 SP100 allows remote attackers to cause a denial of service via unspecified vectors.

  • CVE-2013-6866Nov 23, 2013
    Sybase
    Adaptive Server Enterprise
    risk 0.00cvss —epss 0.03

    SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka CR736689.

  • CVE-2013-6865Nov 23, 2013
    Sybase
    Adaptive Server Enterprise
    risk 0.00cvss —epss 0.03

    SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka CR732989.

  • CVE-2013-6864Nov 23, 2013
    Sybase
    Adaptive Server Enterprise
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to affect confidentiality, integrity, and availability via…

  • CVE-2013-6863Nov 23, 2013
    Sybase
    Adaptive Server Enterprise
    risk 0.00cvss —epss 0.02

    SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to gain privileges via unspecified vectors.

  • CVE-2013-6862Nov 23, 2013
    Sybase
    Adaptive Server Enterprise
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote attackers to cause a denial of service via unspecified vectors.

  • CVE-2013-6861Nov 23, 2013
    Sybase
    Adaptive Server Enterprise
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows local users to obtain sensitive information via unspecified vectors.

  • CVE-2013-6860Nov 23, 2013
    Sybase
    Adaptive Server Enterprise
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to obtain sensitive information via unspecified vectors.

  • CVE-2013-6859Nov 23, 2013
    Sybase
    Adaptive Server Enterprise
    risk 0.00cvss —epss 0.02

    SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3. 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 does not properly perform authorization, which allows remote authenticated users to gain privileges via unspecified vectors.

  • CVE-2013-6384Nov 23, 2013
    OpenStack
    Telemetry \(ceilometer\)
    risk 0.00cvss —epss 0.00

    (1) impl_db2.py and (2) impl_mongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information (the DB2 or MongoDB password) by reading the log…

  • CVE-2013-4547Nov 23, 2013
    Nginx
    Nginx
    risk 0.08cvss —epss 0.68

    nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.

  • CVE-2013-4459Nov 23, 2013
    Light
    Light
    risk 0.00cvss —epss 0.00

    LightDM 1.7.5 through 1.8.3 and 1.9.x before 1.9.2 does not apply the AppArmor profile to the Guest account, which allows local users to bypass intended restrictions by leveraging the Guest account.

  • CVE-2013-4407Nov 23, 2013
    HTTP Body Project
    HTTP Body
    risk 0.00cvss —epss 0.03

    HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging…

  • CVE-2013-2561Nov 23, 2013
    Openfabrics
    Ibutils
    risk 0.00cvss —epss 0.01

    OpenFabrics ibutils 1.5.7 allows local users to overwrite arbitrary files via a symlink attack on (1) ibdiagnet.db, (2) ibdiagnet.fdbs, (3) ibdiagnet_ibis.log, (4) ibdiagnet.log, (5) ibdiagnet.lst, (6) ibdiagnet.mcfdbs, (7) ibdiagnet.pkey, (8) ibdiagnet.psl, (9) ibdiagnet.slvl,…

  • CVE-2013-1058Nov 23, 2013
    Canonical
    Maas
    risk 0.00cvss —epss 0.02

    maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these files via a man-in-the-middle (MITM) attack.

  • CVE-2013-0869Nov 23, 2013
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.02

    The field_end function in libavcodec/h264.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted H.264 data, related to an SPS and slice mismatch and an out-of-bounds array access.

  • CVE-2013-0868Nov 23, 2013
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.04

    libavcodec/huffyuvdec.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted Huffyuv data, related to an out-of-bounds write and (1) unchecked return codes from the init_vlc function and (2) "len==0 cases."

  • CVE-2013-0867Nov 23, 2013
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.02

    The decode_slice_header function in libavcodec/h264.c in FFmpeg before 1.1.2 does not properly check when the pixel format changes, which allows remote attackers to have unspecified impact via crafted H.264 video data, related to an out-of-bounds array access.