VYPR

CVEs

387,332 total · page 6612 of 7,747

AllCriticalHighKEV
  • CVE-2013-2088Jul 31, 2013
    Apache
    Subversion
    risk 0.06cvss —epss 0.31

    contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.

  • CVE-2013-2056Jul 31, 2013
    Red Hat
    Satellite
    risk 0.00cvss —epss 0.02

    The Inter-Satellite Sync (ISS) operation in Red Hat Network (RHN) Satellite 5.3, 5.4, and 5.5 does not properly check client "authenticity," which allows remote attackers to obtain channel content by skipping the initial authentication call.

  • CVE-2013-1968Jul 31, 2013
    Apache
    Subversion
    risk 0.00cvss —epss 0.03

    Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service (FSFS repository corruption) via a newline character in a file name.

  • CVE-2013-0943Jul 31, 2013
    EMC Corporation
    Networker
    risk 0.00cvss —epss 0.00

    EMC NetWorker 7.6.x and 8.x before 8.1 allows local users to obtain sensitive configuration information by leveraging operating-system privileges to perform decryption with nsradmin.

  • CVE-2013-5006Jul 31, 2013
    Westerndigital
    My Net N900c
    risk 0.03cvss —epss 0.05

    main_internet.php on the Western Digital My Net N600 and N750 with firmware 1.03.12 and 1.04.16, and the N900 and N900C with firmware 1.05.12, 1.06.18, and 1.06.28, allows remote attackers to discover the cleartext administrative password by reading the "var pass=" line within…

  • CVE-2013-4697Jul 31, 2013
    Hitachi
    It Operations Director
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Hitachi JP1/IT Desktop Management - Manager 09-50 through 09-50-03, 09-51 through 09-51-05, 10-00 through 10-00-02, and 10-01 through 10-01-02; Hitachi Job Management Partner 1/IT Desktop Management - Manager 09-50 through 09-50-03 and…

  • CVE-2013-3425Jul 31, 2013
    Cisco Systems, Inc.
    Webex
    risk 0.00cvss —epss 0.01

    The Meeting Center component in Cisco WebEx 11 generates different error messages for invalid file-access attempts depending on whether a file exists, which allows remote authenticated users to enumerate files via a series of SPI calls, aka Bug ID CSCuc35965.

  • CVE-2013-2367Jul 31, 2013
    Microfocus
    Sitescope
    risk 0.09cvss —epss 0.69

    Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1678.

  • CVE-2013-1377Jul 31, 2013
    Adobe Inc.
    Digital Editions
    risk 0.00cvss —epss 0.04

    Adobe Digital Editions 2.x before 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2013-2886Jul 31, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Google Chrome before 28.0.1500.95 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

  • CVE-2013-2885Jul 31, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to not properly considering focus during the processing of JavaScript events in the presence of a…

  • CVE-2013-2884Jul 31, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in the DOM implementation in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to improper tracking of which document owns an Attr object.

  • CVE-2013-2883Jul 31, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to deleting the registration of a MutationObserver object.

  • CVE-2013-2882Jul 31, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    Google V8, as used in Google Chrome before 28.0.1500.95, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."

  • CVE-2013-2881Jul 31, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 28.0.1500.95 does not properly handle frames, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

  • CVE-2013-5003Jul 31, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote authenticated users to execute arbitrary SQL commands via (1) the scale parameter to pmd_pdf.php or (2) the pdf_page_number parameter to schema_export.php.

  • CVE-2013-5002Jul 31, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Schema.class.php in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted pageNumber value to schema_export.php.

  • CVE-2013-5001Jul 31, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php in phpMyAdmin 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted object name associated with a…

  • CVE-2013-5000Jul 31, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    phpMyAdmin 3.5.x before 3.5.8.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to config.default.php and other files.

  • CVE-2013-4999Jul 31, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to Error.class.php and Error_Handler.class.php.

  • CVE-2013-4998Jul 31, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to pmd_common.php and other files.

  • CVE-2013-4997Jul 31, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in (1) an anchor identifier to setup/index.php or (2) a chartTitle (aka chart title)…

  • CVE-2013-4996Jul 31, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted database name, (2) a crafted user name, (3) a crafted logo URL in the…

  • CVE-2013-4995Jul 31, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SQL query that is not properly handled during the display of row information.

  • CVE-2013-4936Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The IsDFP_Frame function in plugins/profinet/packet-pn-rt.c in the PROFINET Real-Time dissector in Wireshark 1.10.x before 1.10.1 does not validate MAC addresses, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a…

  • CVE-2013-4935Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_per_length_determinant function in epan/dissectors/packet-per.c in the ASN.1 PER dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize a length field in certain abnormal situations, which allows remote attackers to cause a denial of…

  • CVE-2013-4934Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize certain structure members, which allows remote attackers to cause a denial of service (application crash) via a crafted…

  • CVE-2013-4933Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted packet-trace file.

  • CVE-2013-4932Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Multiple array index errors in epan/dissectors/packet-gsm_a_common.c in the GSM A Common dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allow remote attackers to cause a denial of service (application crash) via a crafted packet.

  • CVE-2013-4931Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    epan/proto.c in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (loop) via a crafted packet that is not properly handled by the GSM RR dissector.

  • CVE-2013-4930Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.04

    The dissect_dvbci_tpdu_hdr function in epan/dissectors/packet-dvbci.c in the DVB-CI dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not validate a certain length value before decrementing it, which allows remote attackers to cause a denial of service…

  • CVE-2013-4929Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.04

    The parseFields function in epan/dissectors/packet-dis-pdus.c in the DIS dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not terminate packet-data processing after finding zero remaining bytes, which allows remote attackers to cause a denial of service…

  • CVE-2013-4928Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Integer signedness error in the dissect_headers function in epan/dissectors/packet-btobex.c in the Bluetooth OBEX dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.

  • CVE-2013-4927Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.04

    Integer signedness error in the get_type_length function in epan/dissectors/packet-btsdp.c in the Bluetooth SDP dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet.

  • CVE-2013-4926Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 does not properly determine whether there is remaining packet data to process, which allows remote attackers to cause a denial of service (application crash) via a…

  • CVE-2013-4925Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Integer signedness error in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted packet.

  • CVE-2013-4924Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 does not properly validate certain index values, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.

  • CVE-2013-4923Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Memory leak in the dissect_dcom_ActivationProperties function in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (memory consumption) via crafted packets.

  • CVE-2013-4922Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Double free vulnerability in the dissect_dcom_ActivationProperties function in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (application crash) via a crafted…

  • CVE-2013-4921Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Off-by-one error in the dissect_radiotap function in epan/dissectors/packet-ieee80211-radiotap.c in the Radiotap dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet.

  • CVE-2013-4920Jul 30, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The P1 dissector in Wireshark 1.10.x before 1.10.1 does not properly initialize a global variable, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.

  • CVE-2013-4954Jul 29, 2013
    WordPress
    Pie Register
    risk 0.00cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the…

  • CVE-2013-4953Jul 29, 2013
    Topgames
    Top Games Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in play.php in Top Games Script 1.2 allows remote attackers to execute arbitrary SQL commands via the gid parameter.

  • CVE-2013-4952Jul 29, 2013
    Elemata
    Elemata CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in functions/global.php in Elemata CMS RC 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2013-4951Jul 29, 2013
    Mintboard
    Mintboard
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Mintboard 0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) pass parameter in views/login.php or (3) name or (4) pass parameter in views/signup.php.

  • CVE-2013-4950Jul 29, 2013
    Machform
    Machform
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in view.php in Machform 2 allows remote attackers to inject arbitrary web script or HTML via the element_2 parameter.

  • CVE-2013-4949Jul 29, 2013
    Machform
    Machform
    risk 0.03cvss —epss 0.05

    Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in the upload form's directory in data/.

  • CVE-2013-4948Jul 29, 2013
    Machform
    Machform
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the element_2 parameter.

  • CVE-2013-4947Jul 29, 2013
    Sawmill
    Sawmill
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the update and build database page in Sawmill before 8.6.3 allows remote attackers to have unknown impact and attack vectors.

  • CVE-2013-4946Jul 29, 2013
    BMC Software
    Service Desk Express
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in BMC Service Desk Express (SDE) 10.2.1.95 allow remote attackers to inject arbitrary web script or HTML via the (1) SelTab parameter to QV_admin.aspx, the (2) CallBack parameter to QV_grid.aspx, or the (3) HelpPage parameter…