VYPR

CVEs

387,704 total · page 6599 of 7,755

AllCriticalHighKEV
  • CVE-2013-5325Oct 9, 2013
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.04

    Adobe Reader and Acrobat 11.x before 11.0.05 on Windows allow remote attackers to execute arbitrary JavaScript code in a javascript: URL via a crafted PDF document.

  • CVE-2013-4385Oct 9, 2013
    CHICKEN
    CHICKEN
    risk 0.00cvss —epss 0.03

    Buffer overflow in the "read-string!" procedure in the "extras" unit in CHICKEN stable before 4.8.0.5 and development snapshots before 4.8.3 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via a…

  • CVE-2013-4384Oct 9, 2013
    Drupal
    Google Site Search
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Google Site Search module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.10 for Drupal allows remote attackers to inject arbitrary web script or HTML by causing crafted data to be returned by the Google API.

  • CVE-2013-4284Oct 9, 2013
    Red Hat
    Enterprise Mrg
    risk 0.00cvss —epss 0.02

    Cumin, as used in Red Hat Enterprise MRG 2.4, allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted Ajax update request.

  • CVE-2013-4258Oct 9, 2013
    Network Audio System
    NAS
    risk 0.00cvss —epss 0.04

    Format string vulnerability in the osLogMsg function in server/os/aulog.c in Network Audio System (NAS) 1.9.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in unspecified vectors, related to syslog.

  • CVE-2013-4256Oct 9, 2013
    Radscan
    Network Audio System
    risk 0.00cvss —epss 0.01

    Multiple stack-based and heap-based buffer overflows in Network Audio System (NAS) 1.9.3 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via the (1) display command argument to the ProcessCommandLine function in server/os/utils.c; (2)…

  • CVE-2013-3897HigKEVOct 9, 2013
    Microsoft
    Internet Explorer
    risk 0.78cvss 8.8epss 0.77

    Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event…

  • CVE-2013-3896MedKEVOct 9, 2013
    Microsoft
    Silverlight
    risk 0.56cvss 5.5epss 0.68

    Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka "Silverlight Vulnerability."

  • CVE-2013-3895Oct 9, 2013
    Microsoft
    Sharepoint Server
    risk 0.02cvss —epss 0.30

    Microsoft SharePoint Server 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to conduct clickjacking attacks via a crafted web page, aka "Parameter Injection Vulnerability."

  • CVE-2013-3894HigOct 9, 2013
    Microsoft
    Windows
    risk 0.56cvss 8.1epss 0.43

    The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allow remote attackers to execute arbitrary code via a crafted CMAP table in…

  • CVE-2013-3892Oct 9, 2013
    Microsoft
    Word
    risk 0.02cvss —epss 0.20

    Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Memory Corruption Vulnerability."

  • CVE-2013-3891Oct 9, 2013
    Microsoft
    Word
    risk 0.01cvss —epss 0.19

    Microsoft Word 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Memory Corruption Vulnerability."

  • CVE-2013-3890Oct 9, 2013
    Microsoft
    Excel
    risk 0.02cvss —epss 0.20

    Microsoft Excel 2007 SP3, Excel Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Excel Memory Corruption Vulnerability."

  • CVE-2013-3889Oct 9, 2013
    Microsoft
    Office
    risk 0.02cvss —epss 0.27

    Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; Office Compatibility Pack SP3; and Excel Services and Word Automation Services in SharePoint Server 2013 allow remote attackers…

  • CVE-2013-3888HigOct 9, 2013
    Microsoft
    Windows
    risk 0.55cvss 8.4epss 0.01

    dxgkrnl.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "DirectX Graphics Kernel Subsystem Double Fetch Vulnerability."

  • CVE-2013-3886Oct 9, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2013-3885Oct 9, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3872, CVE-2013-3873, and…

  • CVE-2013-3882Oct 9, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3872, CVE-2013-3873, and…

  • CVE-2013-3881Oct 9, 2013
    Microsoft
    Windows 7
    risk 0.04cvss —epss 0.15

    win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a crafted application, aka "Win32k NULL Page Vulnerability."

  • CVE-2013-3880Oct 9, 2013
    Microsoft
    Windows 8
    risk 0.01cvss —epss 0.13

    The App Container feature in the kernel-mode drivers in Microsoft Windows 8, Windows Server 2012, and Windows RT allows remote attackers to bypass intended access restrictions and obtain sensitive information from a different container via a Trojan horse application, aka "App…

  • CVE-2013-3879Oct 9, 2013
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain…

  • CVE-2013-3875Oct 9, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2013-3874Oct 9, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2013-3873Oct 9, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3872, CVE-2013-3882, and…

  • CVE-2013-3872Oct 9, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.21

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3873, CVE-2013-3882, and…

  • CVE-2013-3871Oct 9, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.21

    Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2013-3861Oct 9, 2013
    Microsoft
    .net Framework
    risk 0.07cvss —epss 0.82

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 allows remote attackers to cause a denial of service (application crash or hang) via crafted character sequences in JSON data, aka "JSON Parsing Vulnerability."

  • CVE-2013-3860Oct 9, 2013
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.31

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly parse a DTD during XML digital-signature validation, which allows remote attackers to cause a denial of service (application crash or hang) via a crafted signed XML document, aka "Entity…

  • CVE-2013-3200Oct 9, 2013
    Microsoft
    Windows
    risk 0.00cvss —epss 0.05

    The USB drivers in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allow physically proximate attackers to execute arbitrary…

  • CVE-2013-3195Oct 9, 2013
    Microsoft
    Windows
    risk 0.03cvss —epss 0.38

    The DSA_InsertItem function in Comctl32.dll in the Windows common control library in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly allocate…

  • CVE-2013-3128Oct 9, 2013
    Microsoft
    Windows
    risk 0.04cvss —epss 0.50

    The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5, allow remote attackers…

  • CVE-2013-2099Oct 9, 2013
    Python (programming language)
    Python
    risk 0.00cvss —epss 0.05

    Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_match_hostname as used for older Python versions, allows remote attackers to cause a denial of service (CPU consumption)…

  • CVE-2013-3627Oct 5, 2013
    McAfee
    Agent
    risk 0.00cvss —epss 0.02

    FrameworkService.exe in McAfee Framework Service in McAfee Managed Agent (MA) before 4.5.0.1927 and 4.6 before 4.6.0.3258 allows remote attackers to cause a denial of service (service crash) via a malformed HTTP request.

  • CVE-2013-3610Oct 5, 2013
    Asus
    Rt N10e Firmware
    risk 0.00cvss —epss 0.01

    qis/QIS_finish.htm on the ASUS RT-N10E router with firmware before 2.0.0.25 does not require authentication, which allows remote attackers to discover the administrator password via a direct request.

  • CVE-2013-2808Oct 5, 2013
    Philips
    Xper Information Management Physiomonitoring 5
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in Xper in Philips Xper Information Management Physiomonitoring 5 components, Xper Information Management Vascular Monitoring 5 components, and Xper Information Management servers and workstations for Flex Cardio products before XperConnect 1.5.4.053…

  • CVE-2012-4141Oct 5, 2013
    Cisco Systems, Inc.
    Nx OS
    risk 0.00cvss —epss 0.00

    Directory traversal vulnerability in the CLI parser in Cisco NX-OS allows local users to create arbitrary script files via a relative pathname in the "file name" parameter, aka Bug IDs CSCua71557 and CSCua71551.

  • CVE-2012-4122Oct 5, 2013
    Cisco Systems, Inc.
    Nx OS
    risk 0.00cvss —epss 0.00

    The CLI parser in Cisco NX-OS allows local users to bypass intended access restrictions, and overwrite or create arbitrary files, via shell output redirection, aka Bug IDs CSCts56672 and CSCts56669.

  • CVE-2012-4098Oct 5, 2013
    Cisco Systems, Inc.
    Nx OS
    risk 0.00cvss —epss 0.02

    The BGP implementation in Cisco NX-OS does not properly filter AS paths, which allows remote attackers to cause a denial of service (BGP service reset and resync) via a malformed UPDATE message, aka Bug ID CSCtn13055.

  • CVE-2012-4091Oct 5, 2013
    Cisco Systems, Inc.
    Nx OS
    risk 0.00cvss —epss 0.03

    The RIP service engine in Cisco NX-OS allows remote attackers to cause a denial of service (engine restart) via a malformed (1) RIPv4 or (2) RIPv6 message, aka Bug ID CSCtj73415.

  • CVE-2012-4090Oct 5, 2013
    Cisco Systems, Inc.
    Nexus 7000
    risk 0.00cvss —epss 0.02

    The management interface in Cisco NX-OS on Nexus 7000 devices allows remote authenticated users to obtain sensitive configuration-file information by leveraging the network-operator role, aka Bug ID CSCti09089.

  • CVE-2012-4084Oct 5, 2013
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the web-management interface in the fabric interconnect (FI) component in Cisco Unified Computing System (UCS) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCtg20755.

  • CVE-2012-4075Oct 5, 2013
    Cisco Systems, Inc.
    Nx OS
    risk 0.00cvss —epss 0.00

    Cisco NX-OS allows local users to gain privileges and execute arbitrary commands via shell metacharacters in unspecified command parameters, aka Bug IDs CSCtf19827 and CSCtf27788.

  • CVE-2013-3689Oct 4, 2013
    Brickcom
    100ap Device Firmware
    risk 0.00cvss —epss 0.01

    Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera models with firmware 3.0.6.16C1 and earlier, do not properly restrict access to configfile.dump, which allow remote attackers to obtain sensitive information (user names, passwords,…

  • CVE-2013-3543Oct 4, 2013
    Axis
    Media Control Activex Control
    risk 0.03cvss —epss 0.04

    The AXIS Media Control (AMC) ActiveX control (AxisMediaControlEmb.dll) 6.2.10.11 for AXIS network cameras allows remote attackers to create or overwrite arbitrary files via a file path to the (1) StartRecord, (2) SaveCurrentImage, or (3) StartRecordMedia methods.

  • CVE-2013-3541Oct 4, 2013
    Airlive
    WL2600CAM
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in cgi-bin/admin/fileread in AirLive WL2600CAM and possibly other camera models allows remote attackers to read arbitrary files via a .. (dot dot) in the READ.filePath parameter.

  • CVE-2013-3540Oct 4, 2013
    Airlive
    POE2600HD
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in cgi-bin/admin/usrgrp.cgi in AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD, and possibly other camera models allows remote attackers to hijack the authentication of administrators for requests…

  • CVE-2013-5091Oct 4, 2013
    Vtiger
    vTiger
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated users to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. NOTE: this issue might be a duplicate of CVE-2011-4559.

  • CVE-2013-4986Oct 4, 2013
    Iconcool
    Pdfcool Studio
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in PDFAX0722_IconCool.dll 7.22.1125.2121 in IconCool PDFCool Studio 3.32 Build 130330 and earlier allows remote attackers to execute arbitrary code via a crafted PDF file.

  • CVE-2013-6044Oct 4, 2013
    Djangoproject
    Django
    risk 0.00cvss —epss 0.02

    The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications…

  • CVE-2013-6011Oct 4, 2013
    Citrix Systems
    Netscaler Application Delivery Controller
    risk 0.00cvss —epss 0.01

    Citrix NetScaler Application Delivery Controller (ADC) 10.0 before 10.0-76.7 allows remote attackers to cause a denial of service (nsconfigd crash and appliance reboot) via a crafted request.