VYPR

CVEs

387,907 total · page 6595 of 7,759

AllCriticalHighKEV
  • CVE-2013-5543Oct 31, 2013
    Cisco Systems, Inc.
    iOS Xe
    risk 0.00cvss —epss 0.02

    Cisco IOS XE 3.4 before 3.4.2S and 3.5 before 3.5.1S on 1000 ASR devices allows remote attackers to cause a denial of service (device reload) via malformed ICMP error packets associated with a (1) TCP or (2) UDP session that is under inspection by the Zone-Based Firewall (ZBFW)…

  • CVE-2013-5604Oct 30, 2013
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.06

    The txXPathNodeUtils::getBaseURI function in the XSLT processor in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly initialize data, which…

  • CVE-2013-5603Oct 30, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the nsContentUtils::ContentIsHostIncludingDescendantOf function in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of…

  • CVE-2013-5602Oct 30, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    The Worker::SetEventListener function in the Web workers implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to…

  • CVE-2013-5601Oct 30, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the nsEventListenerManager::SetEventHandler function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote…

  • CVE-2013-5600Oct 30, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the nsIOService::NewChannelFromURIWithProxyFlags function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote…

  • CVE-2013-5599Oct 30, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka presentation shell) implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10,…

  • CVE-2013-5598Oct 30, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an…

  • CVE-2013-5597Oct 30, 2013
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.06

    Use-after-free vulnerability in the nsDocLoader::doStopDocumentLoad function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to…

  • CVE-2013-5596Oct 30, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The cycle collection (CC) implementation in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 does not properly determine the thread for release of an image object, which allows remote attackers to execute arbitrary…

  • CVE-2013-5595Oct 30, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The JavaScript engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly allocate memory for unspecified functions, which allows remote…

  • CVE-2013-5593Oct 30, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The SELECT element implementation in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 does not properly restrict the nature or placement of HTML within a dropdown menu, which allows remote attackers to spoof the…

  • CVE-2013-5592Oct 30, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 25.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

  • CVE-2013-5591Oct 30, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the browser engine in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute…

  • CVE-2013-5590Oct 30, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allow remote attackers to cause a denial of…

  • CVE-2013-4261Oct 29, 2013
    OpenStack
    Folsom
    risk 0.00cvss —epss 0.02

    OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service (connection pool consumption), as demonstrated using…

  • CVE-2013-4185Oct 29, 2013
    OpenStack
    Compute
    risk 0.00cvss —epss 0.02

    Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle network source security group policy updates, which allows remote authenticated users to cause a denial of service (nova-network consumption) via…

  • CVE-2013-5968Oct 29, 2013
    Ca
    Web Agents
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in CA SiteMinder 12.0 through 12.51, and SiteMinder 6 Web Agents, allows remote attackers to inject arbitrary web script or HTML via vectors involving a " (double quote) character.

  • CVE-2013-5741Oct 29, 2013
    Triangle Research International
    Nano-10 PLC
    risk 0.00cvss —epss 0.02

    Triangle Research International (aka Tri) Nano-10 PLC devices with firmware r81 and earlier do not properly handle large length values in MODBUS data, which allows remote attackers to cause a denial of service (transition to the interrupt state) via a crafted packet to TCP port…

  • CVE-2013-6289Oct 28, 2013
    Ingo Renner
    Apache Solr
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-6288Oct 28, 2013
    Ingo Renner
    Apache Solr
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 has unknown impact and remote attack vectors, related to "Insecure Unserialize."

  • CVE-2013-6014CriOct 28, 2013
    Juniper Networks
    Junos
    risk 0.61cvss 9.3epss 0.01

    Juniper Junos 10.4 before 10.4S15, 11.4 before 11.4R9, 11.4X27 before 11.4X27.44, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D15, 12.2 before 12.2R6, 12.3 before 12.3R3, 13.1 before 13.1R3, and 13.2 before 13.2R1, when Proxy ARP is enabled on an…

  • CVE-2013-6012Oct 28, 2013
    Juniper Networks
    Junos
    risk 0.00cvss —epss 0.02

    Juniper Junos 12.1X44 before 12.1.X44-D20 and 12.1X45 before 12.1X45-D15, when the no-validate option is enabled, does not properly handle configuration validation errors during the config commit phase of the boot-up sequence, which allows remote attackers to bypass…

  • CVE-2013-5744Oct 28, 2013
    Fengoffice
    Fengoffice
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows remote attackers to inject arbitrary web script or HTML via an arbitrary ref_XXX parameter.

  • CVE-2013-4402Oct 28, 2013
    Gnupg
    Gnupg
    risk 0.00cvss —epss 0.05

    The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.

  • CVE-2013-4394Oct 28, 2013
    Systemd Project
    Systemd
    risk 0.00cvss —epss 0.00

    The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Extension (XKB) layouts description, allows local users in the group to modify the Xorg X11 Server configuration file and possibly gain…

  • CVE-2013-4393Oct 28, 2013
    Systemd Project
    Systemd
    risk 0.00cvss —epss 0.00

    journald in systemd, when the origin of native messages is set to file, allows local users to cause a denial of service (logging service blocking) via a crafted file descriptor.

  • CVE-2013-4392MedOct 28, 2013
    Systemd Project
    Systemd
    risk 0.33cvss 5.0epss 0.00

    systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.

  • CVE-2013-4391Oct 28, 2013
    Systemd Project
    Systemd
    risk 0.00cvss —epss 0.05

    Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large journal data field, which triggers a heap-based buffer overflow.

  • CVE-2013-3704Oct 28, 2013
    Novell
    Libzypp
    risk 0.00cvss —epss 0.02

    The RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different key fingerprint than the one used to sign a repository when multiple key blobs are used, which might allow remote attackers to trick users into believing that the repository was signed…

  • CVE-2013-3243Oct 28, 2013
    Opentext
    IXOS ECM
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in OpenText/IXOS ECM for SAP NetWeaver allows remote attackers to execute arbitrary ABAP code via unknown vectors.

  • CVE-2013-2208Oct 28, 2013
    Andreas Krennmair
    Tpp
    risk 0.00cvss —epss 0.03

    tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file.

  • CVE-2012-6303Oct 28, 2013
    Snack
    Sound Toolkit
    risk 0.04cvss —epss 0.10

    Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large chunk size in a WAV file.

  • CVE-2012-0827Oct 28, 2013
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    The File module in Drupal 7.x before 7.11, when using unspecified field access modules, allows remote authenticated users to read arbitrary private files that are associated with restricted fields via unspecified vectors.

  • CVE-2012-0826Oct 28, 2013
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to hijack the authentication of unspecified victims for requests that update feeds and possibly cause a denial of service (loss of…

  • CVE-2012-0825Oct 28, 2013
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.

  • CVE-2010-1159Oct 28, 2013
    File Project
    Linux
    risk 0.04cvss —epss 0.07

    Multiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) large length value in an EAPOL packet or (2) long EAPOL packet.

  • CVE-2013-2186Oct 28, 2013
    Red Hat
    Jboss Enterprise Portal Platform
    risk 0.00cvss —epss 0.13

    The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.

  • CVE-2013-2102Oct 28, 2013
    Red Hat
    Jboss Portal
    risk 0.00cvss —epss 0.01

    The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups channel is started, which allows remote attackers to obtain sensitive information (diagnostics) by accessing the service.

  • CVE-2013-1056Oct 28, 2013
    Canonical
    Ubuntu Linux
    risk 0.00cvss —epss 0.00

    X.org X server 1.13.3 and earlier, when not run as root, allows local users to cause a denial of service (crash) or possibly gain privileges via vectors involving cached xkb files.

  • CVE-2012-4572Oct 28, 2013
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.00cvss —epss 0.00

    Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local…

  • CVE-2012-4529Oct 28, 2013
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.00cvss —epss 0.02

    The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a…

  • CVE-2013-6285Oct 28, 2013
    Tylertech
    Taxweb
    risk 0.00cvss —epss 0.01

    The search component in the Treasurer application in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to obtain sensitive query-structure information via an invalid search request, a different vulnerability than CVE-2013-6020.

  • CVE-2013-6020Oct 28, 2013
    Tyler Technologies
    TaxWeb
    risk 0.00cvss —epss 0.01

    passwordRequestPOST.jsp in Tyler Technologies TaxWeb 3.13.3.1 sends different HTTP status codes for invalid password-recovery requests depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of requests to the (1)…

  • CVE-2013-6019Oct 28, 2013
    Tyler Technologies
    TaxWeb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to inject arbitrary web script or HTML via the accountNum parameter to an unspecified component.

  • CVE-2013-6018Oct 28, 2013
    Tyler Technologies
    TaxWeb
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in login.jsp in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to hijack the authentication of arbitrary users for requests that change a password.

  • CVE-2013-5430Oct 28, 2013
    IBM
    Security Appscan
    risk 0.00cvss —epss 0.01

    The Jazz Team Server component in IBM Security AppScan Enterprise 8.x before 8.8 has a default username and password, which makes it easier for remote authenticated users to obtain unspecified access to this component by leveraging this credential information in an environment…

  • CVE-2013-4428Oct 27, 2013
    OpenStack
    Glance
    risk 0.00cvss —epss 0.03

    OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image policy is configured, does not properly restrict access to cached images, which allows remote authenticated users to read otherwise…

  • CVE-2013-4302Oct 27, 2013
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    (1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to…

  • CVE-2013-4301Oct 27, 2013
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals…