VYPR

CVEs

387,351 total · page 6610 of 7,748

AllCriticalHighKEV
  • CVE-2013-4806Aug 12, 2013
    Microfocus
    3com Router
    risk 0.00cvss —epss 0.02

    The OSPF implementation on HP JD9##A routers; HP J4###A, J484#B, J8###A, JD3##A, JE###A, and JF55#A switches; HP 3COM routers and switches; and HP H3C routers and switches does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA)…

  • CVE-2013-3457Aug 12, 2013
    Cisco Systems, Inc.
    Finesse
    risk 0.00cvss —epss 0.02

    Absolute path traversal vulnerability in the web interface in Cisco Finesse allows remote attackers to read directory contents via a direct request to a directory URL, aka Bug ID CSCug16772.

  • CVE-2013-3455Aug 12, 2013
    Cisco Systems, Inc.
    Finesse
    risk 0.00cvss —epss 0.02

    Cisco Finesse allows remote attackers to obtain sensitive information by sniffing the network for HTTP query data, aka Bug ID CSCug16732.

  • CVE-2013-4038Aug 9, 2013
    IBM
    Bladecenter
    risk 0.00cvss —epss 0.01

    The Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) on IBM BladeCenter, Flex System, System x iDataPlex, and System x3### servers uses cleartext for password storage, which allows context-dependent attackers to obtain…

  • CVE-2013-4037Aug 9, 2013
    IBM
    Bladecenter
    risk 0.00cvss —epss 0.01

    The RAKP protocol support in the Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) and Integrated Management Module II (IMM2) on IBM BladeCenter, Flex System, System x iDataPlex, and System x3### servers sends a password hash…

  • CVE-2013-4031Aug 9, 2013
    IBM
    Bladecenter
    risk 0.00cvss —epss 0.02

    The Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) and Integrated Management Module II (IMM2) on IBM BladeCenter, Flex System, System x iDataPlex, and System x3### servers has a default password for the IPMI user account,…

  • CVE-2013-2798Aug 9, 2013
    Selinc
    Sel 2241
    risk 0.00cvss —epss 0.00

    Schweitzer Engineering Laboratories (SEL) SEL-2241, SEL-3505, and SEL-3530 RTAC master devices allow physically proximate attackers to cause a denial of service (infinite loop) via crafted input over a serial line.

  • CVE-2013-2796Aug 9, 2013
    Schneider Electric
    Vijeo Citect
    risk 0.00cvss —epss 0.01

    Schneider Electric Vijeo Citect 7.20 and earlier, CitectSCADA 7.20 and earlier, and PowerLogic SCADA 7.20 and earlier allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML…

  • CVE-2013-2792Aug 9, 2013
    Schweitzer Engineering Laboratories, Inc.
    SEL-2241
    risk 0.00cvss —epss 0.02

    Schweitzer Engineering Laboratories (SEL) SEL-2241, SEL-3505, and SEL-3530 RTAC master devices allow remote attackers to cause a denial of service (infinite loop) via a crafted DNP3 TCP packet.

  • CVE-2013-0494Aug 9, 2013
    IBM
    Sterling B2b Integrator
    risk 0.00cvss —epss 0.02

    IBM Sterling B2B Integrator 5.0 and 5.1 allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted HTTP (1) Range or (2) Request-Range header.

  • CVE-2013-0492Aug 9, 2013
    IBM
    Informix Open Admin Tool
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Informix Open Admin Tool (OAT) 2.x and 3.x before 3.11.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2012-3039Aug 9, 2013
    Moxa
    Oncell Gateway G3151
    risk 0.00cvss —epss 0.01

    Moxa OnCell Gateway G3111, G3151, G3211, and G3251 devices with firmware before 1.4 do not use a sufficient source of entropy for SSH and SSL keys, which makes it easier for remote attackers to obtain access by leveraging knowledge of a key from a product installation elsewhere.

  • CVE-2013-5100Aug 9, 2013
    Franz Holzinger
    Static Methods
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Static Methods since 2007 (div2007) extension before 0.10.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the t3lib_div::quoteJSvalue function.

  • CVE-2013-4115Aug 9, 2013
    Squid Cache
    Squid
    risk 0.04cvss —epss 0.44

    Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows remote attackers to cause a denial of service (memory corruption and server termination) via a long name in a DNS lookup request.

  • CVE-2012-6458Aug 9, 2013
    Silverstripe
    Silverstripe
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the SilverStripe e-commerce module 3.0 for SilverStripe CMS allow remote attackers to inject arbitrary web script or HTML via the (1) FirstName, (2) Surname, or (3) Email parameter to code/forms/OrderFormAddress.php; or the…

  • CVE-2013-5099Aug 9, 2013
    Anchorcms
    Anchor CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Name field. NOTE: some sources have reported that comments.php is vulnerable, but certain functions…

  • CVE-2013-5098Aug 9, 2013
    WordPress
    Download Monitor
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262.

  • CVE-2013-4789Aug 9, 2013
    Cotonti
    Cotonti
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote attackers to execute arbitrary SQL commands via the "c" parameter to index.php.

  • CVE-2013-4759Aug 9, 2013
    Magnolia
    Magnolia Form Module
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in the Magnolia Form module 1.x before 1.4.7 and 2.x before 2.0.2 for Magnolia CMS allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) fullname, or (3) email parameter to…

  • CVE-2013-4742Aug 9, 2013
    Netwin
    Surgeftp
    risk 0.00cvss —epss 0.04

    Buffer overflow in NetWin SurgeFTP before 23d2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string within the authentication request.

  • CVE-2013-4625Aug 9, 2013
    WordPress
    Duplicator
    risk 0.04cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter.

  • CVE-2013-4620Aug 9, 2013
    Openemr
    Openemr
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in interface/main/onotes/office_comments_full.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter.

  • CVE-2013-4619Aug 9, 2013
    Openemr
    Openemr
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) start or (2) end parameter to interface/reports/custom_report_range.php, or the (3) form_newid parameter to custom/chart_tracker.php.

  • CVE-2013-4600Aug 9, 2013
    Alkacon
    Opencms
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to system/workplace/views/admin/admin-main.jsp or the (2) requestedResource parameter to…

  • CVE-2013-4147Aug 9, 2013
    Yard Radius Project
    Yard Radius
    risk 0.03cvss —epss 0.04

    Multiple format string vulnerabilities in Yet Another Radius Daemon (YARD RADIUS) 1.1.2 allow context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in a request in the (1) log_msg function in log.c or (2)…

  • CVE-2013-3262Aug 9, 2013
    WordPress
    Download Monitor
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter.

  • CVE-2013-2577Aug 9, 2013
    Xnview
    Xnview
    risk 0.04cvss —epss 0.12

    Buffer overflow in XnView before 2.04 allows remote attackers to execute arbitrary code via a crafted PCT file.

  • CVE-2013-2576Aug 9, 2013
    B E Soft
    Artweaver Free
    risk 0.04cvss —epss 0.10

    Buffer overflow in Artweaver before 3.1.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted AWD file.

  • CVE-2013-3480Aug 9, 2013
    Sagelighteditor
    Sagelight
    risk 0.00cvss —epss 0.04

    Integer overflow in Sagelight 4.4 and earlier allows remote attackers to execute arbitrary code via crafted width and height dimensions in a BMP file, which triggers a heap-based buffer overflow.

  • CVE-2013-3253Aug 9, 2013
    Xhanch
    My Twitter
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter plugin before 2.7.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change unspecified settings.

  • CVE-2013-2117Aug 9, 2013
    Cgit
    cgit
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the cgit_parse_readme function in ui-summary.c in cgit before 0.9.2, when a readme file is set to a filesystem path, allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter.

  • CVE-2013-0150Aug 9, 2013
    F5, Inc.
    Big IP
    risk 0.01cvss —epss 0.06

    Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, FirePass 6.0.0 through 6.1.0 and 7.0.0, and other products "when APM is provisioned," allows remote attackers to…

  • CVE-2013-4943Aug 9, 2013
    Siemens Foundation
    Comos
    risk 0.00cvss —epss 0.00

    The client application in Siemens COMOS before 9.1 Update 458, 9.2 before 9.2.0.6.37, and 10.0 before 10.0.3.0.19 allows local users to gain privileges and bypass intended database-operation restrictions by leveraging COMOS project access.

  • CVE-2013-3990Aug 9, 2013
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the MIME e-mail functionality in iNotes in IBM Domino 9.0 before IF3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN98FLQ2.

  • CVE-2013-3659Aug 9, 2013
    Nttdocomo
    overseas usage application
    risk 0.00cvss —epss 0.01

    The NTT DOCOMO overseas usage application 2.0.0 through 2.0.4 for Android does not properly connect to Wi-Fi access points, which allows remote attackers to obtain sensitive information by leveraging presence in an 802.11 network's coverage area.

  • CVE-2013-3032Aug 9, 2013
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the MIME e-mail functionality in iNotes in IBM Domino 9.0 before IF3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN986NAA.

  • CVE-2013-3027Aug 9, 2013
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.03

    Integer overflow in the DWA9W ActiveX control in iNotes in IBM Domino 9.0 before IF3 allows remote attackers to execute arbitrary code via a crafted web page, aka SPR PTHN97XHFW.

  • CVE-2013-3256Aug 8, 2013
    Shareaholic
    Sexybookmarks
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Shareaholic SexyBookmarks plugin 6.1.4.0 for WordPress allows remote attackers to hijack the authentication of users for requests that "manipulate plugin settings."

  • CVE-2013-3454Aug 8, 2013
    Cisco Systems, Inc.
    Telepresence System Software
    risk 0.00cvss —epss 0.02

    Cisco TelePresence System Software 1.10.1 and earlier on 500, 13X0, 1X00, 30X0, and 3X00 devices, and 6.0.3 and earlier on TX 9X00 devices, has a default password for the pwrecovery account, which makes it easier for remote attackers to modify the configuration or perform…

  • CVE-2013-1717Aug 7, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly restrict local-filesystem access by Java applets, which allows user-assisted remote attackers to read arbitrary…

  • CVE-2013-1715Aug 7, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.00

    Multiple untrusted search path vulnerabilities in the (1) full installer and (2) stub installer in Mozilla Firefox before 23.0 on Windows allow local users to gain privileges via a Trojan horse DLL in the default downloads directory. NOTE: this issue exists because of an…

  • CVE-2013-1714Aug 7, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The Web Workers implementation in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 does not properly restrict XMLHttpRequest calls, which allows remote attackers to bypass the…

  • CVE-2013-1713Aug 7, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 use an incorrect URI within unspecified comparisons during enforcement of the Same Origin Policy, which allows remote attackers…

  • CVE-2013-1712Aug 7, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.00

    Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Updater in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 on Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server…

  • CVE-2013-1711Aug 7, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The XrayWrapper implementation in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 does not properly address the possibility of an XBL scope bypass resulting from non-native arguments in XBL function calls, which makes it easier for remote attackers to conduct cross-site…

  • CVE-2013-1710Aug 7, 2013
    Mozilla Corporation
    Firefox
    risk 0.06cvss —epss 0.40

    The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site…

  • CVE-2013-1709Aug 7, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly handle the interaction between FRAME elements and history, which allows remote attackers to conduct cross-site…

  • CVE-2013-1708Aug 7, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allow remote attackers to cause a denial of service (application crash) via a crafted WAV file that is not properly handled by the nsCString::CharAt function.

  • CVE-2013-1707Aug 7, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in Mozilla Updater in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 allows local users to gain privileges via a long pathname on the command line to the Mozilla…

  • CVE-2013-1706Aug 7, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in maintenanceservice.exe in the Mozilla Maintenance Service in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 allows local users to gain privileges via a long pathname on…