VYPR

CVEs

387,362 total · page 6609 of 7,748

AllCriticalHighKEV
  • CVE-2013-4073Aug 18, 2013
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.03

    The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate,…

  • CVE-2013-2022Aug 17, 2013
    Happyworm
    Jplayer
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.23 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than…

  • CVE-2013-1888Aug 17, 2013
    Pypa
    Pip
    risk 0.00cvss —epss 0.00

    pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.

  • CVE-2013-5310Aug 16, 2013
    TYPO3
    wfqbe
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the DB Integration (wfqbe) extension before 2.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-5309Aug 16, 2013
    Fudforum
    Fudforum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in install/forum_data/src/custom_fields.inc.t in FUDforum 3.0.4.1 and earlier, when registering a new user, allows remote attackers to inject arbitrary web script or HTML via a custom profile field to index.php. NOTE: some of these…

  • CVE-2013-5308Aug 16, 2013
    TYPO3
    RealURL Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the RealURL Management (realurlmanagement) extension 0.3.4 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5307Aug 16, 2013
    TYPO3
    ke_search
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Faceted Search (ke_search) extension before 1.4.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5306Aug 16, 2013
    TYPO3
    browser
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Browser - TYPO3 without PHP (browser) extension before 4.5.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-5305Aug 16, 2013
    TYPO3
    Store Locator
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-5304Aug 16, 2013
    TYPO3
    Store Locator
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-5303Aug 16, 2013
    TYPO3
    Store Locator
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 has unknown impact and remote attack vectors, related to "Insecure Unserialize."

  • CVE-2013-5302Aug 16, 2013
    TYPO3
    ke_search
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Faceted Search (ke_search) extension before 1.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-5301Aug 16, 2013
    Trustport
    Webfilter
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in help.php in Trustport Webfilter 5.5.0.2232 allows remote attackers to read arbitrary files via a .. (dot dot) in the hf parameter.

  • CVE-2013-4114Aug 16, 2013
    Henri Wahl
    Nagstamon
    risk 0.00cvss —epss 0.02

    The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for transmission of a username and password, which allows remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2013-3319Aug 16, 2013
    SAP
    Netweaver
    risk 0.05cvss —epss 0.21

    The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128.

  • CVE-2013-4213Aug 16, 2013
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.00cvss —epss 0.03

    Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client.

  • CVE-2013-4128Aug 16, 2013
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.00cvss —epss 0.02

    Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client.

  • CVE-2013-5097Aug 16, 2013
    Juniper Networks
    Junos Space
    risk 0.00cvss —epss 0.01

    Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly restrict access to the list of user accounts and their MD5 password hashes, which makes it easier for remote authenticated users to obtain sensitive information via a…

  • CVE-2013-5096Aug 16, 2013
    Juniper Networks
    Junos Space
    risk 0.00cvss —epss 0.01

    Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, does not properly implement role-based access control, which allows remote authenticated users to modify the configuration by leveraging the read-only privilege, aka PR 863804.

  • CVE-2013-5095Aug 16, 2013
    Juniper Networks
    Junos Space
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web-based interface in Juniper Junos Space before 13.1R1.6, as used on the JA1500 appliance and in other contexts, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka PR 884469.

  • CVE-2013-4698Aug 16, 2013
    Cybozu
    Mailwise
    risk 0.00cvss —epss 0.01

    Cybozu Mailwise 5.0.4 and 5.0.5 allows remote authenticated users to obtain sensitive e-mail content intended for different persons in opportunistic circumstances by reading Subject header lines within the user's own mailbox.

  • CVE-2013-4007Aug 16, 2013
    IBM
    Advanced Management Module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in adv_sw.php in the Advanced Management Module (AMM) with firmware BBET before BBET64G and BPET before BPET64G for IBM BladeCenter systems allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-3040Aug 16, 2013
    IBM
    Infosphere Information Server
    risk 0.00cvss —epss 0.01

    IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 produces login-failure messages indicating whether the username or password is incorrect, which allows remote attackers to enumerate user accounts via a brute-force attack.

  • CVE-2013-3034Aug 16, 2013
    IBM
    Infosphere Information Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the web console.

  • CVE-2013-0587Aug 16, 2013
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Portal before 8.0.0.1 CF07 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) Portal, (2) Portal 7.0.0.2, (3) Portal 8.0, or (4) PortalWeb2 theme.

  • CVE-2013-0585Aug 16, 2013
    IBM
    Infosphere Information Server
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to the (1) web console and (2) repository management…

  • CVE-2013-5300Aug 15, 2013
    Alienvault
    Open Source Security Information Management
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) before 4.3.0 allow remote attackers to inject arbitrary web script or HTML via the withoutmenu parameter to (1) vulnmeter/index.php or (2) vulnmeter/sched.php;…

  • CVE-2013-2132Aug 15, 2013
    MongoDB
    MongoDB
    risk 0.00cvss —epss 0.03

    bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."

  • CVE-2013-2023Aug 15, 2013
    JPlayer
    jPlayer
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different…

  • CVE-2013-1942Aug 15, 2013
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before 5.0.4 and other products, allow remote attackers to inject arbitrary web script or HTML via the (1)…

  • CVE-2013-2250Aug 15, 2013
    Apache
    Ofbiz
    risk 0.00cvss —epss 0.12

    Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language (UEL) functions via JUEL metacharacters in unspecified parameters, related to nested…

  • CVE-2013-2137Aug 15, 2013
    Apache
    Ofbiz
    risk 0.00cvss —epss 0.08

    Cross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to inject arbitrary web script or HTML via…

  • CVE-2013-5121Aug 14, 2013
    Phpfox
    Phpfox
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in PHPFox before 3.6.0 (build6) allows remote attackers to execute arbitrary SQL commands via the search[sort_by] parameter to user/browse/view_/.

  • CVE-2013-5120Aug 14, 2013
    Phpfox
    Phpfox
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in PHPFox before 3.6.0 (build4) allows remote attackers to execute arbitrary SQL commands via the search[gender] parameter to user/browse/view_/.

  • CVE-2013-2127Aug 14, 2013
    Libraw
    Libraw
    risk 0.00cvss —epss 0.03

    Buffer overflow in the exposure correction code in LibRaw before 0.15.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

  • CVE-2013-2126Aug 14, 2013
    Libraw
    Libraw
    risk 0.00cvss —epss 0.04

    Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW…

  • CVE-2013-2078Aug 14, 2013
    Xen
    Xen
    risk 0.00cvss —epss 0.00

    Xen 4.0.2 through 4.0.4, 4.1.x, and 4.2.x allows local PV guest users to cause a denial of service (hypervisor crash) via certain bit combinations to the XSETBV instruction.

  • CVE-2013-4880Aug 14, 2013
    Bigtreecms
    Bigtree CMS
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter.

  • CVE-2013-4879Aug 14, 2013
    Bigtreecms
    Bigtree CMS
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php.

  • CVE-2013-3199Aug 14, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.19

    Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2013-3198Aug 14, 2013
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    The NT Virtual DOS Machine (NTVDM) subsystem in the kernel in Microsoft Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 on 32-bit platforms does not properly validate kernel-memory addresses, which allows local…

  • CVE-2013-3197Aug 14, 2013
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    The NT Virtual DOS Machine (NTVDM) subsystem in the kernel in Microsoft Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 on 32-bit platforms does not properly validate kernel-memory addresses, which allows local…

  • CVE-2013-3196Aug 14, 2013
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    The NT Virtual DOS Machine (NTVDM) subsystem in the kernel in Microsoft Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 on 32-bit platforms does not properly validate kernel-memory addresses, which allows local…

  • CVE-2013-3194Aug 14, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.19

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2013-3193Aug 14, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.19

    Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3187 and CVE-2013-3191.

  • CVE-2013-3192Aug 14, 2013
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to inject arbitrary web script or HTML via crafted character sequences with EUC-JP encoding, aka "EUC-JP Character Encoding Vulnerability."

  • CVE-2013-3191Aug 14, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.19

    Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3187 and CVE-2013-3193.

  • CVE-2013-3190Aug 14, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.19

    Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2013-3189Aug 14, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3188.

  • CVE-2013-3188Aug 14, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.27

    Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3189.