VYPR

CVEs

387,980 total · page 6591 of 7,760

AllCriticalHighKEV
  • CVE-2013-6176Nov 21, 2013
    EMC Corporation
    Document Sciences Xpression
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote authenticated…

  • CVE-2013-6175Nov 21, 2013
    EMC Corporation
    Document Sciences Xpression
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote…

  • CVE-2013-6174Nov 21, 2013
    EMC Corporation
    Document Sciences Xpression
    risk 0.00cvss —epss 0.02

    Multiple open redirect vulnerabilities in xAdmin in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote…

  • CVE-2013-6173Nov 21, 2013
    EMC Corporation
    Document Sciences Xpression
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow…

  • CVE-2013-5996Nov 21, 2013
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in shopping/payment.tpl components in LOCKON EC-CUBE 2.11.0 through 2.13.0 allow remote attackers to inject arbitrary web script or HTML via crafted values.

  • CVE-2013-5995Nov 21, 2013
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.01

    data/class/helper/SC_Helper_Address.php in the front-features implementation in LOCKON EC-CUBE 2.12.3 through 2.13.0 allows remote authenticated users to obtain sensitive information via unspecified vectors related to addresses.

  • CVE-2013-5994Nov 21, 2013
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.01

    data/class/pages/mypage/LC_Page_Mypage_DeliveryAddr.php in LOCKON EC-CUBE 2.11.2 through 2.13.0 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.

  • CVE-2013-5993Nov 21, 2013
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.0 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors related to refusals.

  • CVE-2013-5992Nov 21, 2013
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the displaySystemError function in html/handle_error.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to inject arbitrary web script or HTML by leveraging incorrect handling of error-message output.

  • CVE-2013-5991Nov 21, 2013
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.01

    The displaySystemError function in html/handle_error.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to obtain sensitive information by leveraging incorrect handling of error-log output.

  • CVE-2013-6831Nov 20, 2013
    Pineapp
    Mail Secure
    risk 0.03cvss —epss 0.01

    PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms has a sudoers file that does not properly restrict user specifications, which allows local users to gain privileges via a sudo command that leverages access to the qmailq account.

  • CVE-2013-6830Nov 20, 2013
    Pineapp
    Mail Secure
    risk 0.04cvss —epss 0.09

    admin/confnetworking.html in PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms allows remote attackers to execute arbitrary commands via shell metacharacters in the nsserver parameter during an nslookup operation.

  • CVE-2013-6829Nov 20, 2013
    Pineapp
    Mail Secure
    risk 0.09cvss —epss 0.80

    admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pinghost parameter during a ping operation.

  • CVE-2013-6828Nov 20, 2013
    Pineapp
    Mail Secure
    risk 0.00cvss —epss 0.01

    admin/management.html in PineApp Mail-SeCure allows remote attackers to bypass authentication and perform a sys_usermng operation via the it parameter.

  • CVE-2013-6827Nov 20, 2013
    Pineapp
    Mail Secure
    risk 0.00cvss —epss 0.01

    Absolute path traversal vulnerability in admin/viewmsg.php in PineApp Mail-SeCure allows remote attackers to read arbitrary files via a full pathname in the msg parameter.

  • CVE-2013-5607Nov 20, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Integer overflow in the PL_ArenaAllocate function in Mozilla Netscape Portable Runtime (NSPR) before 4.10.2, as used in Firefox before 25.0.1, Firefox ESR 17.x before 17.0.11 and 24.x before 24.1.1, and SeaMonkey before 2.22.1, allows remote attackers to cause a denial of…

  • CVE-2013-1417Nov 20, 2013
    Mit
    Kerberos 5
    risk 0.00cvss —epss 0.02

    do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted…

  • CVE-2013-6826Nov 20, 2013
    Fortinet
    Fortianalyzer
    risk 0.03cvss —epss 0.02

    cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks.

  • CVE-2013-6823Nov 20, 2013
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    GRMGApp in SAP NetWeaver allows remote attackers to bypass intended access restrictions via unspecified vectors.

  • CVE-2013-6822Nov 20, 2013
    SAP
    Netweaver
    risk 0.00cvss —epss 0.02

    GRMGApp in SAP NetWeaver allows remote attackers to have unspecified impact and attack vectors, related to an XML External Entity (XXE) issue.

  • CVE-2013-6821Nov 20, 2013
    SAP
    Netweaver
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the Exportability Check Service in SAP NetWeaver allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2013-6819Nov 20, 2013
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Performance Provider in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6820Nov 20, 2013
    SAP
    Netweaver Development Infrastructure
    risk 0.00cvss —epss 0.04

    Unrestricted file upload vulnerability in the SAP NetWeaver Development Infrastructure (NWDI) allows remote attackers to execute arbitrary code by uploading a file with an executable extension via unspecified vectors.

  • CVE-2013-6818Nov 20, 2013
    SAP
    Netweaver Logviewer
    risk 0.00cvss —epss 0.01

    SAP NetWeaver Logviewer 6.30, when running on Windows, allows remote attackers to bypass intended access restrictions via unspecified vectors.

  • CVE-2013-6817Nov 20, 2013
    SAP
    Network Interface Router
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in SAP Network Interface Router (SAProuter) 7.30 allows remote attackers to cause a denial of service and execute arbitrary code via crafted NI Route messages.

  • CVE-2013-6816Nov 20, 2013
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the (1) JavaDumpService and (2) DataCollector servlets in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6814Nov 20, 2013
    SAP
    Netweaver
    risk 0.00cvss —epss 0.02

    The J2EE Engine in SAP NetWeaver 6.40, 7.02, and earlier allows remote attackers to redirect users to arbitrary web sites, conduct phishing attacks, and obtain sensitive information (cookies and SAPPASSPORT) via unspecified vectors.

  • CVE-2013-6815Nov 20, 2013
    SAP
    Netweaver
    risk 0.00cvss —epss 0.02

    The SHSTI_UPLOAD_XML function in the Application Server for ABAP (AS ABAP) in SAP NetWeaver 7.31 and earlier allows remote attackers to cause a denial of service via unspecified vectors, related to an XML External Entity (XXE) issue.

  • CVE-2013-4559Nov 20, 2013
    Lighttpd
    Lighttpd
    risk 0.01cvss —epss 0.11

    lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function…

  • CVE-2013-4560Nov 20, 2013
    Lighttpd
    Lighttpd
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.

  • CVE-2013-4495Nov 20, 2013
    Adaptivecomputing
    Torque Resource Manager
    risk 0.00cvss —epss 0.03

    The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.

  • CVE-2013-4487Nov 20, 2013
    GNU
    Gnutls
    risk 0.00cvss —epss 0.02

    Off-by-one error in the dane_raw_tlsa in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.16 and 3.2.x before 3.2.6 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries. NOTE: this issue is due to an…

  • CVE-2013-4466Nov 20, 2013
    GNU
    Gnutls
    risk 0.00cvss —epss 0.02

    Buffer overflow in the dane_query_tlsa function in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.15 and 3.2.x before 3.2.5 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries.

  • CVE-2013-4386Nov 20, 2013
    Theforeman
    Foreman
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) fqdn or (2) hostgroup parameter.

  • CVE-2013-6282HigKEVNov 20, 2013
    Linux
    Kernel
    risk 0.68cvss 8.8epss 0.40

    The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited…

  • CVE-2013-6074Nov 20, 2013
    Open-Xchange
    Appsuite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote attackers to inject arbitrary web script or HTML via an attached SVG file.

  • CVE-2013-5966Nov 20, 2013
    Zkoss
    Zk Framework
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in ZK Framework before 5.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5730Nov 20, 2013
    Dlink
    DSL-2740B Gateway
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DSL-2740B Gateway with firmware EU_1.00 allow remote attackers to hijack the authentication of administrators for requests that (1) enable or disable Wireless MAC Address Filters via a wlFltMode action to…

  • CVE-2013-5215Nov 20, 2013
    Foscam
    Wireless IP Camera
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the web interface "WiFi scan" option in FOSCAM Wireless IP Cameras allows remote attackers to inject arbitrary web script or HTML via the SSID.

  • CVE-2013-4592Nov 20, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Memory leak in the __kvm_set_memory_region function in virt/kvm/kvm_main.c in the Linux kernel before 3.9 allows local users to cause a denial of service (memory consumption) by leveraging certain device access to trigger movement of memory slots.

  • CVE-2013-4591Nov 20, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Buffer overflow in the __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a getxattr system call for the…

  • CVE-2013-4588HigNov 20, 2013
    Linux
    Kernel
    risk 0.39cvss 7.0epss 0.00

    Multiple stack-based buffer overflows in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 2.6.33, when CONFIG_IP_VS is used, allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability for (1) a getsockopt system call, related to the do_ip_vs_get_ctl…

  • CVE-2013-4579Nov 20, 2013
    Linux
    Kernel
    risk 0.04cvss —epss 0.10

    The ath9k_htc_set_bssid_mask function in drivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through 3.12 uses a BSSID masking approach to determine the set of MAC addresses on which a Wi-Fi device is listening, which allows remote attackers to discover the…

  • CVE-2013-4563Nov 20, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    The udp6_ufo_fragment function in net/ipv6/udp_offload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of…

  • CVE-2013-4507Nov 20, 2013
    Collectiveaccess
    Pawtucket
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in CollectiveAccess Providence and Pawtucket before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-3095Nov 20, 2013
    Dlink
    Dir865l
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR865L router (Rev. A1) with firmware before 1.05b07 allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password or (2) enable remote…

  • CVE-2013-6797Nov 19, 2013
    Sunil Nanda
    Blue Wrench Video Widget
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bw_url parameter…

  • CVE-2013-6631Nov 19, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the Channel::SendRTCPPacket function in voice_engine/channel.cc in libjingle in WebRTC, as used in Google Chrome before 31.0.1650.48 and other products, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have…

  • CVE-2013-6630Nov 19, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The get_dht function in jdmarker.c in libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48 and other products, does not set all elements of a certain Huffman value array during the reading of segments that follow Define Huffman Table (DHT) JPEG markers,…

  • CVE-2013-6629Nov 19, 2013
    Google
    Chrome
    risk 0.01cvss —epss 0.10

    The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of…