VYPR

CVEs

387,664 total · page 6601 of 7,754

AllCriticalHighKEV
  • CVE-2013-4355Oct 1, 2013
    Xen
    Xen
    risk 0.00cvss —epss 0.00

    Xen 4.3.x and earlier does not properly handle certain errors, which allows local HVM guests to obtain hypervisor stack memory via a (1) port or (2) memory mapped I/O write or (3) other unspecified operations related to addresses without associated memory.

  • CVE-2013-4210Oct 1, 2013
    Red Hat
    Jboss Remoting
    risk 0.00cvss —epss 0.03

    The org.jboss.remoting.transport.socket.ServerThread class in Red Hat JBoss Remoting for Red Hat JBoss SOA Platform 5.3.1 GA, Web Platform 5.2.0, Enterprise Application Platform 5.2.0, and other products allows remote attackers to cause a denial of service (file descriptor…

  • CVE-2013-2269Oct 1, 2013
    Arubanetworks
    Clearpass
    risk 0.00cvss —epss 0.01

    The Sponsorship Confirmation functionality in Aruba Networks ClearPass 5.x, 6.0.1, and 6.0.2, and Amigopod/ClearPass Guest 3.0 through 3.9.7, allows remote attackers to bypass intended access restrictions and approve a request by sending a guest request, then using "parameter…

  • CVE-2013-2231Oct 1, 2013
    Red Hat
    QEMU Guest Agent
    risk 0.00cvss —epss 0.00

    Unquoted Windows search path vulnerability in the QEMU Guest Agent service for Red Hat Enterprise Linux Desktop 6, HPC Node 6, Server 6, Workstation 6, Desktop Supplementary 6, Server Supplementary 6, Supplementary AUS 6.4, Supplementary EUS 6.4.z, and Workstation Supplementary…

  • CVE-2012-5627Oct 1, 2013
    MariaDB
    MariaDB
    risk 0.04cvss —epss 0.11

    Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force…

  • CVE-2012-2126Oct 1, 2013
    RubyGems
    Rubygems
    risk 0.00cvss —epss 0.01

    RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.

  • CVE-2012-2125Oct 1, 2013
    RubyGems
    Rubygems
    risk 0.00cvss —epss 0.02

    RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.

  • CVE-2011-2901Oct 1, 2013
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    Off-by-one error in the __addr_ok macro in Xen 3.3 and earlier allows local 64 bit PV guest administrators to cause a denial of service (host crash) via unspecified hypercalls that ignore virtual-address bits.

  • CVE-2013-5395Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.02

    IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote attackers to bypass intended access restrictions via unspecified vectors.

  • CVE-2013-5383Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to gain privileges via unspecified vectors, a different vulnerability than CVE-2013-5382.

  • CVE-2013-5382Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to gain privileges via unspecified vectors, a different vulnerability than CVE-2013-5383.

  • CVE-2013-5381Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.3 allows remote authenticated users to gain privileges via unspecified vectors.

  • CVE-2013-5380Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.00

    IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows local users to obtain sensitive information via unspecified vectors.

  • CVE-2013-4027Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to bypass intended access restrictions via unspecified vectors.

  • CVE-2013-4021Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to conduct unspecified file-inclusion attacks via unknown vectors.

  • CVE-2013-4020Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.3 allows remote authenticated users to bypass intended access restrictions via unspecified vectors.

  • CVE-2013-4019Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 7.1 before 7.1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-4018Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to obtain sensitive information via unspecified vectors.

  • CVE-2013-4017Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in IBM Maximo Asset Management 7.1 before 7.1.1.12 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4014Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-4013Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.2 allows remote attackers to obtain sensitive information via unspecified vectors.

  • CVE-2013-3973Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in IBM Maximo Asset Management 7.1 before 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-3972Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    IBM Maximo Asset Management 7.1 before 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to obtain sensitive information via unspecified vectors.

  • CVE-2013-3971Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    IBM Maximo Asset Management 7.1 through 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2013-3049.

  • CVE-2013-3049Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    IBM Maximo Asset Management 7.1 through 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2013-3971.

  • CVE-2013-3048Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 through 7.1.1.12, and 7.5 before 7.5.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-3047Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    IBM Maximo Asset Management 7.1 before 7.1.1.12 and 7.5 before 7.5.0.5 allows remote authenticated users to gain privileges via unspecified vectors.

  • CVE-2013-0451Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 7.1 through 7.1.1.12 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-3323Oct 1, 2013
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    IBM Maximo Asset Management 6.2 before 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.3 allows remote attackers to gain privileges via unspecified vectors.

  • CVE-2013-5572Oct 1, 2013
    Zabbix
    Zabbix
    risk 0.03cvss —epss 0.04

    Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.

  • CVE-2013-5370Oct 1, 2013
    IBM
    Spss Collaboration And Deployment Services
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in IBM SPSS Collaboration and Deployment Services 4.2.1 and 5.0 through FP2 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2013-4042.

  • CVE-2013-4042Oct 1, 2013
    IBM
    Spss Collaboration And Deployment Services
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in IBM SPSS Collaboration and Deployment Services 4.2.1 and 5.0 through FP2 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2013-5370.

  • CVE-2013-3278Oct 1, 2013
    EMC Corporation
    VPlex GeoSynchrony
    risk 0.00cvss —epss 0.00

    EMC VPLEX before VPLEX GeoSynchrony 5.2 SP1 uses cleartext for storage of the LDAP/AD bind password, which allows local users to obtain sensitive information by reading the management-server configuration file.

  • CVE-2013-5725Oct 1, 2013
    Metaclassy
    Byword
    risk 0.00cvss —epss 0.01

    The Metaclassy Byword app 2.x before 2.1 for iOS does not require confirmation of Replace file actions, which allows remote attackers to overwrite arbitrary files via the name and text parameters in a byword://replace URL.

  • CVE-2013-5516Oct 1, 2013
    Cisco Systems, Inc.
    Telepresence Multipoint Switch
    risk 0.00cvss —epss 0.02

    The Media Snapshot implementation on Cisco TelePresence Multipoint Switch (CTMS) devices allows remote authenticated users to cause a denial of service (device reload) by sending many Media Snapshot requests at the time of a meeting termination, aka Bug ID CSCuh44796.

  • CVE-2013-3041Oct 1, 2013
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.01

    The Web Client in IBM Rational ClearQuest 7.1 before 7.1.2.12, 8.0 before 8.0.0.8, and 8.0.1 before 8.0.1.1 allows remote attackers to obtain sensitive information from the client-server data stream via unspecified vectors associated with a "JSON hijacking attack."

  • CVE-2012-4096Oct 1, 2013
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.00

    The local file editor in the Baseboard Management Controller (BMC) in Cisco Unified Computing System (UCS) allows local users to gain privileges and modify arbitrary fabric-interconnect files, in the context of a vi process, via unspecified commands, aka Bug ID CSCtn06574.

  • CVE-2013-5693Sep 30, 2013
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in X2Engine X2CRM before 3.5 allows remote attackers to inject arbitrary web script or HTML via the model parameter to index.php/admin/editor.

  • CVE-2013-5692Sep 30, 2013
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the file parameter to index.php/admin/translationManager.

  • CVE-2013-4623Sep 30, 2013
    Polarssl
    Polarssl
    risk 0.00cvss —epss 0.02

    The x509parse_crt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certificate…

  • CVE-2013-4362Sep 30, 2013
    Davfs2
    Davfs2
    risk 0.03cvss —epss 0.01

    WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (1) kernel_interface.c and (2) mount_davfs.c, related to the "system" function.

  • CVE-2013-4222Sep 30, 2013
    OpenStack
    Keystone
    risk 0.00cvss —epss 0.02

    OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.

  • CVE-2013-2238Sep 30, 2013
    Signalwire
    Freeswitch
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in the switch_perform_substitution function in switch_regex.c in FreeSWITCH 1.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to the index and substituted variables.

  • CVE-2013-1839Sep 30, 2013
    Squid Cache
    Squid
    risk 0.01cvss —epss 0.18

    The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a "," character in an Accept-Language header.

  • CVE-2013-1444Sep 30, 2013
    Marc Vertes
    Txt2man
    risk 0.00cvss —epss 0.00

    A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222.

  • CVE-2013-0211Sep 30, 2013
    Libarchive
    Libarchive
    risk 0.00cvss —epss 0.04

    Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an…

  • CVE-2013-5963Sep 30, 2013
    WordPress
    Simple Dropbox Upload
    risk 0.00cvss —epss 0.04

    Unrestricted file upload vulnerability in multi.php in Simple Dropbox Upload plugin before 1.8.8.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in…

  • CVE-2013-5962Sep 30, 2013
    WordPress
    Complete Gallery Manager
    risk 0.04cvss —epss 0.15

    Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct…

  • CVE-2013-5961Sep 30, 2013
    WordPress
    Lazy SEO
    risk 0.03cvss —epss 0.05

    Unrestricted file upload vulnerability in lazyseo.php in the Lazy SEO plugin 1.1.9 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in lazy-seo/.

  • CVE-2013-4378Sep 30, 2013
    Javamelody
    Javamelody
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.