VYPR

CVEs

387,684 total · page 6600 of 7,754

AllCriticalHighKEV
  • CVE-2013-4324Oct 3, 2013
    Spice Gtk
    spice-gtk
    risk 0.00cvss —epss 0.00

    spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkit_unix_process_new API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid…

  • CVE-2013-4311Oct 3, 2013
    Libvirt
    Libvirt
    risk 0.00cvss —epss 0.00

    libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related…

  • CVE-2013-4288Oct 3, 2013
    Polkit Project
    Polkit
    risk 0.00cvss —epss 0.00

    Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus…

  • CVE-2013-1066Oct 3, 2013
    Language Selector
    language-selector
    risk 0.00cvss —epss 0.00

    language-selector 0.110.x before 0.110.1, 0.90.x before 0.90.1, and 0.79.x before 0.79.4 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race…

  • CVE-2013-1065Oct 3, 2013
    Martin Pitt
    Jockey
    risk 0.00cvss —epss 0.00

    backend.py in Jockey before 0.9.7-0ubuntu7.11 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2)…

  • CVE-2013-1064Oct 3, 2013
    Apt Xapian Index
    apt-xapian-index
    risk 0.00cvss —epss 0.00

    apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1)…

  • CVE-2013-1063Oct 3, 2013
    Evan Dandrea
    USB Creator
    risk 0.00cvss —epss 0.00

    usb-creator 0.2.47 before 0.2.47.1, 0.2.40 before 0.2.40ubuntu2, and 0.2.38 before 0.2.38.2 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race…

  • CVE-2013-1062Oct 3, 2013
    Michael Vogt
    Ubuntu System Service
    risk 0.00cvss —epss 0.00

    ubuntu-system-service 0.2.4 before 0.2.4.1. 0.2.3 before 0.2.3.1, and 0.2.2 before 0.2.2.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race…

  • CVE-2013-1061Oct 3, 2013
    Software Properties
    Software Properties
    risk 0.00cvss —epss 0.00

    dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging…

  • CVE-2013-6010Oct 3, 2013
    WordPress
    Comment Attachment
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Comment Attachment plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "Attachment field title."

  • CVE-2013-5701Oct 3, 2013
    WatchGuard
    Server Center
    risk 0.03cvss —epss 0.01

    Multiple untrusted search path vulnerabilities in (1) Watchguard Log Collector (wlcollector.exe) and (2) Watchguard WebBlocker Server (wbserver.exe) in WatchGuard Server Center 11.7.4, 11.7.3, and possibly earlier allow local users to gain privileges via a Trojan horse wgpr.dll…

  • CVE-2013-6009Oct 3, 2013
    Open-Xchange
    Appsuite
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in Open-Xchange AppSuite before 7.2.2, when using AJP in certain conditions, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the ajax/defer servlet.

  • CVE-2013-5690Oct 3, 2013
    Open-Xchange
    Appsuite
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange AppSuite before 7.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) content with the text/xml MIME type or (2) the Status comment field of an appointment.

  • CVE-2013-5944Oct 3, 2013
    Siemens Foundation
    X-200IRT
    risk 0.00cvss —epss 0.03

    The integrated web server on Siemens SCALANCE X-200 switches with firmware before 4.5.0 and X-200IRT switches with firmware before 5.1.0 does not properly enforce authentication requirements, which allows remote attackers to perform administrative actions via requests to the…

  • CVE-2013-5519Oct 3, 2013
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the management interface on Cisco Wireless LAN Controller (WLC) devices allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuf77810.

  • CVE-2013-3625Oct 3, 2013
    Baramundi
    Management Suite
    risk 0.00cvss —epss 0.01

    An unspecified DLL file in Baramundi Management Suite 7.5 through 8.9 uses a hardcoded encryption key, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from a product installation elsewhere.

  • CVE-2013-3624Oct 3, 2013
    Baramundi
    Management Suite
    risk 0.00cvss —epss 0.02

    The OS deployment feature in Baramundi Management Suite 7.5 through 8.9 stores credentials in cleartext on deployed machines, which allows remote attackers to obtain sensitive information by reading a file. NOTE: this ID was also incorrectly mapped to a separate issue in Oracle…

  • CVE-2013-3593Oct 3, 2013
    Baramundi
    Management Suite
    risk 0.00cvss —epss 0.02

    Baramundi Management Suite 7.5 through 8.9 uses cleartext for (1) client-server communication and (2) data storage, which allows remote attackers to obtain sensitive information by sniffing the network, and allows context-dependent attackers to obtain sensitive information by…

  • CVE-2013-0694Oct 3, 2013
    Emerson
    ROC800 RTU
    risk 0.00cvss —epss 0.03

    The Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier have hardcoded credentials in a ROM, which makes it easier for remote attackers to obtain shell access to the…

  • CVE-2013-0693Oct 3, 2013
    Enea
    Ose
    risk 0.00cvss —epss 0.03

    The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier performs network-beacon broadcasts, which allows remote attackers to obtain potentially…

  • CVE-2013-0692Oct 3, 2013
    Enea
    Ose
    risk 0.00cvss —epss 0.05

    The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to execute arbitrary code by connecting to the debug service.

  • CVE-2013-0689Oct 3, 2013
    Emerson
    ROC800 RTU
    risk 0.00cvss —epss 0.05

    The TFTP server on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to upload files and consequently execute arbitrary code via unspecified…

  • CVE-2012-4136Oct 3, 2013
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.01

    The high-availability service in the Fabric Interconnect component in Cisco Unified Computing System (UCS) does not properly bind the cluster service to the management interface, which allows remote attackers to obtain sensitive information or cause a denial of service…

  • CVE-2013-5979Oct 2, 2013
    Spring Signage
    Xibo
    risk 0.04cvss —epss 0.18

    Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter to index.php.

  • CVE-2013-5517Oct 2, 2013
    Cisco Systems, Inc.
    Unified Communications Domain Manager
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the web framework in Cisco Unified Communications Domain Manager allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuh96567.

  • CVE-2013-5503Oct 2, 2013
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.01

    The UDP process in Cisco IOS XR 4.3.1 does not free packet memory upon detecting full packet queues, which allows remote attackers to cause a denial of service (memory consumption) via UDP packets to listening ports, aka Bug ID CSCue69413.

  • CVE-2013-4067Oct 2, 2013
    IBM
    Infosphere Information Server
    risk 0.00cvss —epss 0.01

    IBM InfoSphere Information Server 8.0, 8.1, 8.5 through FP3, 8.7, and 9.1 allows remote attackers to hijack sessions and read cookie values, or conduct phishing attacks to capture credentials, via unspecified vectors.

  • CVE-2013-4066Oct 2, 2013
    IBM
    Infosphere Information Server
    risk 0.00cvss —epss 0.01

    IBM InfoSphere Information Server 8.0, 8.1, 8.5 through FP3, 8.7, and 9.1 allows remote attackers to conduct clickjacking attacks by creating an overlay interface on top of the Web Console interface.

  • CVE-2012-4111Oct 2, 2013
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.00

    The create certreq command in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86563.

  • CVE-2012-4110Oct 2, 2013
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.00

    run-script in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86560.

  • CVE-2012-4109Oct 2, 2013
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.00

    The clear sshkey command in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq86559.

  • CVE-2012-4104Oct 2, 2013
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.00

    Absolute path traversal vulnerability in the image-download process in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to overwrite or delete arbitrary files via a full pathname in an image header, aka Bug ID CSCtq02706.

  • CVE-2012-4103Oct 2, 2013
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.00

    ethanalyzer in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq02686.

  • CVE-2012-4102Oct 2, 2013
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.00

    The activate firmware command in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges by embedding commands in an unspecified parameter, aka Bug ID CSCtq02600.

  • CVE-2012-4095Oct 2, 2013
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.00

    The local file editor in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to gain privileges, and read or modify arbitrary files, via unspecified key bindings, aka Bug ID CSCtn04521.

  • CVE-2013-4032Oct 2, 2013
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    The Fast Communications Manager (FCM) in IBM DB2 Enterprise Server Edition and Advanced Enterprise Server Edition 10.1 before FP3 and 10.5, when a multi-node configuration is used, allows remote attackers to cause a denial of service via vectors involving arbitrary data.

  • CVE-2013-2924Oct 2, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    Use-after-free vulnerability in International Components for Unicode (ICU), as used in Google Chrome before 30.0.1599.66 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2013-2923Oct 2, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Google Chrome before 30.0.1599.66 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

  • CVE-2013-2922Oct 2, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in core/html/HTMLTemplateElement.cpp in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that operates on a TEMPLATE…

  • CVE-2013-2921Oct 2, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Double free vulnerability in the ResourceFetcher::didLoadResource function in core/fetch/ResourceFetcher.cpp in the resource loader in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other…

  • CVE-2013-2920Oct 2, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The DoResolveRelativeHost function in url/url_canon_relative.cc in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service (out-of-bounds read) via a relative URL containing a hostname, as demonstrated by a protocol-relative URL beginning with a…

  • CVE-2013-2919Oct 2, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google V8, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

  • CVE-2013-2918Oct 2, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in the RenderBlock::collapseAnonymousBlockChild function in core/rendering/RenderBlock.cpp in the DOM implementation in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have…

  • CVE-2013-2917Oct 2, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The ReverbConvolverStage::ReverbConvolverStage function in core/platform/audio/ReverbConvolverStage.cpp in the Web Audio implementation in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service (out-of-bounds read) via vectors…

  • CVE-2013-2916Oct 2, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to spoof the address bar via vectors involving a response with a 204 (aka No Content) status code, in conjunction with a delay in notifying the user of an attempted spoof.

  • CVE-2013-2915Oct 2, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 30.0.1599.66 preserves pending NavigationEntry objects in certain invalid circumstances, which allows remote attackers to spoof the address bar via a URL with a malformed scheme, as demonstrated by a nonexistent:12121 URL.

  • CVE-2013-2914Oct 2, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in the color-chooser dialog in Google Chrome before 30.0.1599.66 on Windows allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to color_chooser_dialog.cc and color_chooser_win.cc in…

  • CVE-2013-2913Oct 2, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in the XMLDocumentParser::append function in core/xml/parser/XMLDocumentParser.cpp in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors…

  • CVE-2013-2912Oct 2, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in the PepperInProcessRouter::SendToHost function in content/renderer/pepper/pepper_in_process_router.cc in the Pepper Plug-in API (PPAPI) in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service or possibly have…

  • CVE-2013-2911Oct 2, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in the XSLStyleSheet::compileStyleSheet function in core/xml/XSLStyleSheetLibxslt.cpp in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging…