VYPR

CVEs

387,945 total · page 6593 of 7,759

AllCriticalHighKEV
  • CVE-2013-6789Nov 13, 2013
    Silverstripe
    Silverstripe
    risk 0.00cvss —epss 0.01

    security/MemberLoginForm.php in SilverStripe 3.0.3 supports credentials in a GET request, which allows remote or local attackers to obtain sensitive information by reading web-server access logs, web-server Referer logs, or the browser history, a similar vulnerability to…

  • CVE-2013-3940Nov 13, 2013
    Microsoft
    Windows
    risk 0.03cvss —epss 0.34

    Integer overflow in the Graphics Device Interface (GDI) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows…

  • CVE-2013-3917Nov 13, 2013
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.18

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3915.

  • CVE-2013-3916Nov 13, 2013
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.18

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3912.

  • CVE-2013-3915Nov 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.19

    Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3917.

  • CVE-2013-3914Nov 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.19

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2013-3912Nov 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.19

    Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3916.

  • CVE-2013-3911Nov 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.19

    Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2013-3910Nov 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.19

    Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2013-3909Nov 13, 2013
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.15

    Microsoft Internet Explorer 6 through 8 allows remote attackers to read content from a different (1) domain or (2) zone via crafted characters in Cascading Style Sheets (CSS) token sequences, aka "Internet Explorer Information Disclosure Vulnerability."

  • CVE-2013-3908Nov 13, 2013
    Microsoft
    Internet Explorer
    risk 0.03cvss —epss 0.34

    Microsoft Internet Explorer 6 through 10 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information from any visited document via a crafted web page that is not properly handled during a print-preview action, aka "Internet Explorer…

  • CVE-2013-3905Nov 13, 2013
    Microsoft
    Outlook
    risk 0.01cvss —epss 0.11

    Microsoft Outlook 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT does not properly expand metadata contained in S/MIME certificates, which allows remote attackers to obtain sensitive network configuration and state information via a crafted certificate in an e-mail message, aka…

  • CVE-2013-3898Nov 13, 2013
    Microsoft
    Windows 8
    risk 0.00cvss —epss 0.02

    Microsoft Windows 8 and Windows Server 2012, when Hyper-V is used, does not ensure memory-address validity, which allows guest OS users to execute arbitrary code in all guest OS instances, and allows guest OS users to cause a denial of service (host OS crash), via a…

  • CVE-2013-3887Nov 13, 2013
    Microsoft
    Windows
    risk 0.00cvss —epss 0.03

    The Ancillary Function Driver (AFD) in afd.sys in the kernel-mode drivers in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 allows local users to obtain sensitive…

  • CVE-2013-3869Nov 13, 2013
    Microsoft
    Windows
    risk 0.01cvss —epss 0.17

    Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to cause a denial of service (daemon hang)…

  • CVE-2013-2653Nov 13, 2013
    Silverstripe
    Silverstripe
    risk 0.00cvss —epss 0.04

    security/MemberLoginForm.php in SilverStripe 3.0.3 supports login using a GET request, which makes it easier for remote attackers to conduct phishing attacks without detection by the victim.

  • CVE-2013-1325Nov 13, 2013
    Microsoft
    Office
    risk 0.03cvss —epss 0.31

    Heap-based buffer overflow in Microsoft Office 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka "Word Heap Overwrite Vulnerability."

  • CVE-2013-1324Nov 13, 2013
    Microsoft
    Office
    risk 0.03cvss —epss 0.31

    Stack-based buffer overflow in Microsoft Office 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka "Word Stack Buffer Overwrite Vulnerability."

  • CVE-2013-0082Nov 13, 2013
    Microsoft
    Office
    risk 0.01cvss —epss 0.19

    Microsoft Office 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka "WPD File Format Memory Corruption Vulnerability."

  • CVE-2013-5726Nov 12, 2013
    Tapbots
    Tweetbot
    risk 0.00cvss —epss 0.01

    Tweetbot 1.3.3 for Mac, and 2.8.5 for iPad and iPhone, does not require confirmation of (1) follow or (2) favorite actions, which allows remote attackers to automatically force the user to perform undesired actions, as demonstrated via the tweetbot:///follow/ URL.

  • CVE-2013-6763Nov 12, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The uio_mmap_physical function in drivers/uio/uio.c in the Linux kernel before 3.12 does not validate the size of a memory block, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via crafted mmap operations, a different…

  • CVE-2013-6122Nov 12, 2013
    Qualcomm
    Goodix gt915 touchscreen driver
    risk 0.00cvss —epss 0.00

    goodix_tool.c in the Goodix gt915 touchscreen driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly synchronize updates to a global variable, which allows local users to bypass…

  • CVE-2013-4740Nov 12, 2013
    Qualcomm
    Quic Mobile Station Modem Kernel
    risk 0.00cvss —epss 0.00

    goodix_tool.c in the Goodix gt915 touchscreen driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, relies on user-space length values for kernel-memory copies of procfs file content, which allows…

  • CVE-2013-4516Nov 12, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The mp_get_count function in drivers/staging/sb105x/sb_pci_mp.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.

  • CVE-2013-4515Nov 12, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl call.

  • CVE-2013-4514Nov 12, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a denial of service or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability and providing a long station-name string, related…

  • CVE-2013-4513Nov 12, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Buffer overflow in the oz_cdev_write function in drivers/staging/ozwpan/ozcdev.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact via a crafted write operation.

  • CVE-2013-4512Nov 12, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging root privileges for a write operation.

  • CVE-2013-4511Nov 12, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted mmap operations, related to the (1)…

  • CVE-2013-3918HigKEVNov 12, 2013
    Microsoft
    Windows
    risk 0.78cvss 8.8epss 0.74

    The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold…

  • CVE-2013-2239Nov 12, 2013
    Openvz
    Vzkernel
    risk 0.00cvss —epss 0.00

    vzkernel before 042stab080.2 in the OpenVZ modification for the Linux kernel 2.6.32 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via (1) a crafted ploop driver ioctl call, related to the…

  • CVE-2013-3985Nov 9, 2013
    IBM
    Sametime
    risk 0.00cvss —epss 0.01

    The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 does not properly restrict application cookies, which allows remote attackers to read session variables by leveraging a weak setting of the Domain variable.

  • CVE-2013-3045Nov 9, 2013
    IBM
    Sametime
    risk 0.00cvss —epss 0.01

    The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to share crafted links via the Library function.

  • CVE-2013-3044Nov 9, 2013
    IBM
    Sametime
    risk 0.00cvss —epss 0.01

    The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to spoof the origin of chat messages, or compose anonymous chat messages, by leveraging meeting-attendance privileges.

  • CVE-2013-0537Nov 9, 2013
    IBM
    Sametime
    risk 0.00cvss —epss 0.01

    The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to spoof the origin of shared links by leveraging meeting-attendance privileges.

  • CVE-2013-4548Nov 8, 2013
    OpenSSL Project
    OpenSSL
    risk 0.00cvss —epss 0.03

    The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell…

  • CVE-2013-3986Nov 8, 2013
    IBM
    Sametime
    risk 0.04cvss —epss 0.09

    IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote attackers to cause a denial of service (WebPlayer Firefox extension crash) via a crafted Audio Visual (AV) session.

  • CVE-2013-6230Nov 8, 2013
    Isc
    Bind
    risk 0.00cvss —epss 0.06

    The Winsock WSAIoctl API in Microsoft Windows Server 2008, as used in ISC BIND 9.6-ESV before 9.6-ESV-R10-P1, 9.8 before 9.8.6-P1, 9.9 before 9.9.4-P1, 9.9.3-S1, 9.9.4-S1, and other products, does not properly support the SIO_GET_INTERFACE_LIST command for netmask…

  • CVE-2013-5566Nov 8, 2013
    Cisco Systems, Inc.
    Nx OS
    risk 0.00cvss —epss 0.02

    Cisco NX-OS 5.0 and earlier on MDS 9000 devices allows remote attackers to cause a denial of service (supervisor CPU consumption) via Authentication Header (AH) authentication in a Virtual Router Redundancy Protocol (VRRP) frame, aka Bug ID CSCte27874.

  • CVE-2013-5565Nov 8, 2013
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.01

    The OSPFv3 functionality in Cisco IOS XR 5.1 allows remote attackers to cause a denial of service (process crash) via a malformed LSA Type-1 packet, aka Bug ID CSCuj82176.

  • CVE-2013-5558Nov 8, 2013
    Cisco Systems, Inc.
    Telepresence Vx Clinical Assistant
    risk 0.00cvss —epss 0.02

    The WIL-A module in Cisco TelePresence VX Clinical Assistant 1.2 before 1.21 changes the admin password to an empty password upon a reboot, which makes it easier for remote attackers to obtain access via the administrative interface, aka Bug ID CSCuj17238.

  • CVE-2013-5554Nov 8, 2013
    Cisco Systems, Inc.
    Wide Area Application Services Mobile
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the web-management interface in the server in Cisco Wide Area Application Services (WAAS) Mobile before 3.5.5 allows remote attackers to upload and execute arbitrary files via a crafted POST request, aka Bug ID CSCuh69773.

  • CVE-2013-5553Nov 8, 2013
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Multiple memory leaks in Cisco IOS 15.1 before 15.1(4)M7 allow remote attackers to cause a denial of service (memory consumption or device reload) by sending a crafted SIP message over (1) IPv4 or (2) IPv6, aka Bug IDs CSCuc42558 and CSCug25383.

  • CVE-2013-4987Nov 8, 2013
    Pineapp
    Mail Secure
    risk 0.03cvss —epss 0.03

    PineApp Mail-SeCure before 3.70 allows remote authenticated users to gain privileges by leveraging console access and providing shell metacharacters in a "system ping" command.

  • CVE-2013-4716Nov 8, 2013
    Tattyan
    HP TOWN
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Tattyan HP TOWN 5_9_3 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string.

  • CVE-2013-4508HigNov 8, 2013
    Lighttpd
    Lighttpd
    risk 0.49cvss 7.5epss 0.03

    lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.

  • CVE-2013-4055Nov 8, 2013
    IBM
    Domino Web Administrator
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in webadmin.nsf in Domino Web Administrator in IBM Domino 8.5 and 9.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-4051.

  • CVE-2013-4051Nov 8, 2013
    IBM
    Domino Web Administrator
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in webadmin.nsf in Domino Web Administrator in IBM Domino 8.5 and 9.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-4055.

  • CVE-2013-4050Nov 8, 2013
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in webadmin.nsf in Domino Web Administrator in IBM Domino 8.5 and 9.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2013-5563Nov 6, 2013
    Cisco Systems, Inc.
    Security Monitoring Analysis And Response System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Query/NewQueryResult.jsp in Cisco Security Monitoring, Analysis and Response System (CS-MARS) allows remote attackers to inject arbitrary web script or HTML via the isnowLatency parameter, aka Bug ID CSCul16173.