VYPR

CVEs

387,346 total · page 6611 of 7,747

AllCriticalHighKEV
  • CVE-2013-5025Aug 6, 2013
    Ni
    LabWindows/CVI
    risk 0.00cvss —epss 0.01

    An ActiveX control in exlauncher.dll in the Help subsystem in National Instruments LabWindows/CVI before 2013 allows remote attackers to cause a denial of service by triggering the display of local example files.

  • CVE-2013-5024Aug 6, 2013
    Ni
    NI .NET Class Library Help
    risk 0.00cvss —epss 0.01

    An ActiveX control in NationalInstruments.Help2.dll in National Instruments NI .NET Class Library Help, as used in Measurement Studio 2013 and earlier and other products, allows remote attackers to obtain sensitive information about the existence of registry keys via crafted (1)…

  • CVE-2013-5023Aug 6, 2013
    Ni
    Labview
    risk 0.00cvss —epss 0.01

    The ActiveX controls in the HelpAsst component in NI Help Links in National Instruments LabWindows/CVI 2012 SP1 and earlier, LabVIEW 2012 SP1 and earlier, and other products allow remote attackers to cause a denial of service by triggering the display of local .chm files.

  • CVE-2013-5022Aug 6, 2013
    Ni
    Labview
    risk 0.00cvss —epss 0.03

    Absolute path traversal vulnerability in the 3D Graph ActiveX control in cw3dgrph.ocx in National Instruments LabWindows/CVI 2012 SP1 and earlier, LabVIEW 2012 SP1 and earlier, and other products allows remote attackers to create and execute arbitrary files via a full pathname…

  • CVE-2013-5021Aug 6, 2013
    Abb
    Datamanager
    risk 0.00cvss —epss 0.02

    Multiple absolute path traversal vulnerabilities in National Instruments cwui.ocx, as used in National Instruments LabWindows/CVI 2012 SP1 and earlier, National Instruments LabVIEW 2012 SP1 and earlier, the Data Analysis component in ABB DataManager 1 through 6.3.6, and other…

  • CVE-2013-3996Aug 6, 2013
    IBM
    Infosphere Biginsights
    risk 0.00cvss —epss 0.01

    IBM InfoSphere BigInsights 1.1 through 2.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct phishing attacks via a crafted web site.

  • CVE-2013-3995Aug 6, 2013
    IBM
    Infosphere Biginsights
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM InfoSphere BigInsights 1.1 through 2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-3992Aug 6, 2013
    IBM
    Infosphere Biginsights
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IBM InfoSphere BigInsights 2.0 through 2.1 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2013-4124Aug 6, 2013
    Samba (software)
    Samba
    risk 0.09cvss —epss 0.69

    Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet.

  • CVE-2013-1633Aug 6, 2013
    Python (programming language)
    Setuptools
    risk 0.00cvss —epss 0.02

    easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.

  • CVE-2013-1630Aug 6, 2013
    Guillaume Gauvrit
    Pyshop
    risk 0.00cvss —epss 0.02

    pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.

  • CVE-2013-1629Aug 6, 2013
    Pypa
    Pip
    risk 0.00cvss —epss 0.06

    pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.

  • CVE-2013-4679Aug 5, 2013
    Symantec
    Workspace Virtualization
    risk 0.03cvss —epss 0.01

    Symantec Workspace Virtualization before 6.x before 6.4.1953.0, when a virtual application layer is configured, allows local users to gain privileges via an application that performs crafted interaction with the operating system.

  • CVE-2013-4807Aug 5, 2013
    Microfocus
    Hotspot Laserjet Pro M1218nfs Mfp Firmware
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability on the HP LaserJet Pro P1102w, P1606dn, M1212nf MFP, M1213nf MFP, M1214nfh MFP, M1216nfh MFP, M1217nfw MFP, M1218nfs MFP, and CP1025nw with firmware before 2013-07-26 20130703 allows remote attackers to modify data via unknown vectors.

  • CVE-2013-4677Aug 5, 2013
    Symantec
    Backup Exec
    risk 0.00cvss —epss 0.00

    Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 uses weak permissions (Everyone: Read and Everyone: Change) for backup data files, which allows local users to obtain sensitive information or modify the outcome of a restore via direct access to these files.

  • CVE-2013-4678Aug 5, 2013
    Symantec
    Backup Exec
    risk 0.00cvss —epss 0.01

    The NDMP protocol implementation in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allows remote authenticated users to obtain sensitive host-version information via unspecified vectors.

  • CVE-2013-4676Aug 5, 2013
    Symantec
    Backup Exec
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a (1) custom-reports generation page, (2) Storage Devices creation page,…

  • CVE-2013-1610Aug 5, 2013
    Symantec
    Encryption Desktop
    risk 0.00cvss —epss 0.00

    Unquoted Windows search path vulnerability in RDDService in Symantec PGP Desktop 10.0.x through 10.2.x and Symantec Encryption Desktop 10.3.0 before MP3 allows local users to gain privileges via a Trojan horse application in the %SYSTEMDRIVE% top-level directory.

  • CVE-2013-4575Aug 5, 2013
    Symantec
    Backup Exec
    risk 0.00cvss —epss 0.01

    Heap-based buffer overflow in the utility program in the Linux agent in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allows remote attackers to cause a denial of service (agent crash) or possibly execute arbitrary code via unspecified vectors.

  • CVE-2013-4805Aug 5, 2013
    Microfocus
    Integrated Lights Out Firmware
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in HP Integrated Lights-Out 3 (aka iLO3) firmware before 1.60 and 4 (aka iLO4) firmware before 1.30 allows remote attackers to bypass authentication via unknown vectors.

  • CVE-2013-3450Aug 5, 2013
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the User WebDialer page in Cisco Unified Communications Manager (Unified CM) allows remote attackers to hijack the authentication of arbitrary users for requests that dial calls, aka Bug ID CSCui13028.

  • CVE-2013-3451Aug 5, 2013
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Unified Communications Manager (Unified CM) allow remote attackers to hijack the authentication of arbitrary users for requests that perform arbitrary Unified CM operations, aka Bug ID CSCui13033.

  • CVE-2013-3442Aug 5, 2013
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    The web portal in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to obtain sensitive stack-trace information via unspecified vectors that trigger a stack exception, aka Bug ID CSCug34854.

  • CVE-2013-0149Aug 5, 2013
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    The OSPF implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.3, IOS-XE 2.x through 3.9.xS, ASA and PIX 7.x through 9.1, FWSM, NX-OS, and StarOS before 14.0.50488 does not properly validate Link State Advertisement (LSA) type 1 packets before performing operations…

  • CVE-2013-4627Aug 2, 2013
    Bitcoin Foundation
    Bitcoin Core
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in bitcoind and Bitcoin-Qt 0.8.x allows remote attackers to cause a denial of service (memory consumption) via a large amount of tx message data.

  • CVE-2013-4165Aug 2, 2013
    Bitcoin Foundation
    Bitcoind
    risk 0.00cvss —epss 0.02

    The HTTPAuthorized function in bitcoinrpc.cpp in bitcoind 0.8.1 provides information about authentication failure upon detecting the first incorrect byte of a password, which makes it easier for remote attackers to determine passwords via a timing side-channel attack.

  • CVE-2013-3448Aug 2, 2013
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.00cvss —epss 0.01

    Cisco WebEx Meetings Server does not check whether a user account is active, which allows remote authenticated users to bypass intended access restrictions by performing meeting operations after account deactivation, aka Bug ID CSCuh33315.

  • CVE-2013-3220Aug 2, 2013
    Bitcoin Foundation
    Bitcoind
    risk 0.00cvss —epss 0.02

    bitcoind and Bitcoin-Qt before 0.4.9rc2, 0.5.x before 0.5.8rc2, 0.6.x before 0.6.5rc2, and 0.7.x before 0.7.3rc2, and wxBitcoin, do not properly consider whether a block's size could require an excessive number of database locks, which allows remote attackers to cause a denial…

  • CVE-2013-3219Aug 2, 2013
    Bitcoin Foundation
    Bitcoind
    risk 0.00cvss —epss 0.02

    bitcoind and Bitcoin-Qt 0.8.x before 0.8.1 do not enforce a certain block protocol rule, which allows remote attackers to bypass intended access restrictions and conduct double-spending attacks via a large block that triggers incorrect Berkeley DB locking in older product…

  • CVE-2013-1190Aug 2, 2013
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.01

    The C-Series Rack Server component 1.4 in Cisco Unified Computing System (UCS) does not properly restrict inbound access to ports, which allows remote attackers to cause a denial of service (Integrated Management Controller reboot or hang) via crafted packets, as demonstrated by…

  • CVE-2013-3724Aug 1, 2013
    Mw Wp Form Project
    Monkey
    risk 0.04cvss —epss 0.14

    The mk_request_header_process function in mk_request.c in Monkey 1.1.1 allows remote attackers to cause a denial of service (thread crash and service outage) via a '\0' character in an HTTP request.

  • CVE-2012-5460Aug 1, 2013
    Juniper Networks
    Ive OS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the help page in Juniper Secure Access (SA) with IVE OS before 7.1r13, 7.2.x before 7.2r7, and 7.3.x before 7.3r2 allows remote attackers to inject arbitrary web script or HTML via the WWHSearchWordsText parameter.

  • CVE-2013-3444Aug 1, 2013
    Cisco Systems, Inc.
    WAAS Software
    risk 0.00cvss —epss 0.04

    The web framework in Cisco WAAS Software before 4.x and 5.x before 5.0.3e, 5.1.x before 5.1.1c, and 5.2.x before 5.2.1; Cisco ACNS Software 4.x and 5.x before 5.5.29.2; Cisco ECDS Software 2.x before 2.5.6; Cisco CDS-IS Software 2.x before 2.6.3.b50 and 3.1.x before 3.1.2b54;…

  • CVE-2013-3443Aug 1, 2013
    Cisco Systems, Inc.
    WAAS Software
    risk 0.00cvss —epss 0.06

    The web service framework in Cisco WAAS Software 4.x and 5.x before 5.0.3e, 5.1.x before 5.1.1c, and 5.2.x before 5.2.1 in a Central Manager (CM) configuration allows remote attackers to execute arbitrary code via a crafted POST request, aka Bug ID CSCuh26626.

  • CVE-2012-3913Aug 1, 2013
    Cisco Systems, Inc.
    VC220
    risk 0.00cvss —epss 0.01

    The Cisco VC220 and VC240 cameras allow remote attackers to cause a denial of service (WebUI outage) via crafted packets, aka Bug IDs CSCtf73188, CSCtf88059, CSCtf87951, CSCtf87908, and CSCtf88019.

  • CVE-2013-4912Aug 1, 2013
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.02

    Open redirect vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks by leveraging improper configuration of SIMATIC HMI panels by the WinCC product.

  • CVE-2013-4911Aug 1, 2013
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to hijack the authentication of unspecified victims by leveraging improper configuration of SIMATIC HMI panels by the WinCC product.

  • CVE-2013-4652Aug 1, 2013
    Siemens Foundation
    Scalance W700 Ieee 802.11n Firmware
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in the command-line management interface on Siemens Scalance W7xx devices with firmware before 4.5.4 allows remote attackers to bypass authentication and execute arbitrary code via a (1) SSH or (2) TELNET connection.

  • CVE-2013-4651Aug 1, 2013
    Siemens Foundation
    Scalance W700 Ieee 802.11n Firmware
    risk 0.00cvss —epss 0.01

    Siemens Scalance W7xx devices with firmware before 4.5.4 use the same hardcoded X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust…

  • CVE-2013-2994Aug 1, 2013
    IBM
    Websphere Commerce
    risk 0.00cvss —epss 0.01

    IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 incorrectly maintains a valid session after unspecified interaction with REST services, which allows remote attackers to issue REST requests in the context of an arbitrary user's active session via unknown vectors.

  • CVE-2013-4673Aug 1, 2013
    Symantec
    Web Gateway
    risk 0.00cvss —epss 0.01

    The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 does not properly implement RADIUS authentication, which allows remote attackers to execute arbitrary code by leveraging access to the login prompt.

  • CVE-2013-4672Aug 1, 2013
    Symantec
    Web Gateway
    risk 0.00cvss —epss 0.01

    The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 has an incorrect sudoers file, which allows local users to bypass intended access restrictions via a command.

  • CVE-2013-4671Aug 1, 2013
    Symantec
    Web Gateway
    risk 0.00cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2013-4670Aug 1, 2013
    Symantec
    Web Gateway
    risk 0.00cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-1617Aug 1, 2013
    Symantec
    Web Gateway
    risk 0.00cvss —epss 0.06

    Multiple SQL injection vulnerabilities in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allow remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-1616Aug 1, 2013
    Symantec
    Web Gateway
    risk 0.04cvss —epss 0.11

    The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a command into an application script.

  • CVE-2013-2993Aug 1, 2013
    IBM
    Websphere Commerce
    risk 0.00cvss —epss 0.01

    IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.7 does not properly perform authentication for unspecified web services, which allows remote attackers to issue requests in the context of an arbitrary user's active session via unknown vectors.

  • CVE-2013-5020Jul 31, 2013
    Minibb
    Minibb
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in bb_admin.php in MiniBB before 3.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) forum_name, (2) forum_group, (3) forum_icon, or (4) forum_desc parameter. NOTE: the whatus vector is already…

  • CVE-2013-5019Jul 31, 2013
    Vector
    Ultra Mini Httpd
    risk 0.08cvss —epss 0.64

    Stack-based buffer overflow in Ultra Mini HTTPD 1.21 allows remote attackers to execute arbitrary code via a long resource name in an HTTP request.

  • CVE-2013-4674Jul 31, 2013
    Symantec
    Pgp Universal Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Web Email Protection component in Symantec Encryption Management Server (formerly Symantec PGP Universal Server) before 3.3.0 MP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted encrypted…