VYPR

CVEs

387,242 total · page 6615 of 7,745

AllCriticalHighKEV
  • CVE-2013-3750Jul 17, 2013
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Oracle Solaris 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Kernel/VM

  • CVE-2013-3749Jul 17, 2013
    Oracle Corporation
    Application Object Library
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote authenticated users to affect confidentiality via unknown vectors related to Logging. NOTE: the previous information is from the…

  • CVE-2013-3748Jul 17, 2013
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Oracle Solaris 11 allows remote attackers to affect availability via vectors related to Driver/IDM (iSCSI Data Mover).

  • CVE-2013-3747Jul 17, 2013
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote authenticated users to affect confidentiality via unknown vectors related to Client System Analyzer.

  • CVE-2013-3746Jul 17, 2013
    Oracle Corporation
    Sun Systems Products Suite
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Solaris Cluster component in Oracle and Sun Systems Products Suite 3.2, 3.3, and 4 prior to 4.1 SRU 3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Zone Cluster Infrastructure.

  • CVE-2013-3745Jul 17, 2013
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Oracle Solaris 8, 9, 10, and 11 allows local users to affect availability via unknown vectors related to Libraries/Libc.

  • CVE-2013-0398Jul 17, 2013
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Oracle Solaris 8, 9, 10, and 11 allows remote attackers to affect confidentiality via unknown vectors related to Utility/Remote Execution Server (in.rexecd).

  • CVE-2013-2135Jul 16, 2013
    Apache
    Struts
    risk 0.00cvss —epss 0.14

    Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

  • CVE-2013-2134Jul 16, 2013
    Apache
    Struts
    risk 0.02cvss —epss 0.70

    Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.

  • CVE-2013-2122Jul 16, 2013
    Drupal
    Edit Limit
    risk 0.00cvss —epss 0.02

    The Edit Limit module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to comments, which allows remote authenticated users with the "edit comments" permission to edit arbitrary comments of other users via unspecified vectors.

  • CVE-2013-1925Jul 16, 2013
    Drupal
    Chaos tool suite (ctools)
    risk 0.00cvss —epss 0.02

    The Chaos Tool Suite (ctools) module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict node access, which allows remote authenticated users with the "access content" permission to read restricted node titles via an autocomplete list.

  • CVE-2013-1908Jul 16, 2013
    Drupal
    Commons Wikis
    risk 0.00cvss —epss 0.03

    The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors.

  • CVE-2013-1907Jul 16, 2013
    Drupal
    Commons Group
    risk 0.00cvss —epss 0.03

    The Commons Group module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors.

  • CVE-2013-0246Jul 16, 2013
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors.

  • CVE-2013-0245Jul 16, 2013
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not properly restrict access to node that are part of a book outline, which allows remote authenticated users with the "access printer-friendly version" permission to…

  • CVE-2013-4117Jul 16, 2013
    WordPress
    Category Grid View Gallery
    risk 0.04cvss —epss 0.13

    Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter.

  • CVE-2013-3491Jul 16, 2013
    WordPress
    Sharebar
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Sharebar plugin 1.2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) modify buttons, or (3) insert cross-site scripting (XSS) sequences.

  • CVE-2013-2188Jul 16, 2013
    Red Hat
    Kernel
    risk 0.00cvss —epss 0.00

    A certain Red Hat patch to the do_filp_open function in fs/namei.c in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle failure to obtain write permissions, which allows local users to cause a denial of service (system…

  • CVE-2013-1943HigJul 16, 2013
    Linux
    Kernel
    risk 0.44cvss 7.8epss 0.00

    The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space, which allows local users to gain privileges or obtain sensitive information from kernel memory…

  • CVE-2013-1935Jul 16, 2013
    Red Hat
    Kernel
    risk 0.00cvss —epss 0.00

    A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux (RHEL) 6 does not properly implement the PV EOI feature, which allows guest OS users to cause a denial of service (host OS crash) by leveraging a time window…

  • CVE-2013-4125Jul 15, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.05

    The fib6_add_rt2node function in net/ipv6/ip6_fib.c in the IPv6 stack in the Linux kernel through 3.10.1 does not properly handle Router Advertisement (RA) messages in certain circumstances involving three routes that initially qualified for membership in an ECMP route set until…

  • CVE-2013-3578Jul 15, 2013
    Wave
    Embassy Remote Administration Server Help Desk
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server (ERAS) allows remote authenticated users to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue parameter (aka the search field), leading to…

  • CVE-2013-3577Jul 15, 2013
    Wave
    Embassy Remote Administration Server Help Desk
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server (ERAS) allows remote attackers to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue parameter (aka the search field).

  • CVE-2013-1087Jul 15, 2013
    Novell
    Groupwise
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the client in Novell GroupWise through 8.0.3 HP3, and 2012 through SP2, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML via the body of an e-mail message.

  • CVE-2013-3428Jul 15, 2013
    Cisco Systems, Inc.
    Secure Access Control System
    risk 0.00cvss —epss 0.01

    The web interface in Cisco Secure Access Control System (ACS) does not properly suppress error-condition details, which allows remote authenticated users to obtain sensitive information via an unspecified request that triggers an error, aka Bug ID CSCue65957.

  • CVE-2013-2765Jul 15, 2013
    Trustwave
    Modsecurity
    risk 0.00cvss —epss 0.14

    The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.

  • CVE-2013-4113Jul 13, 2013
    PHP
    PHP
    risk 0.00cvss —epss 0.05

    ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct…

  • CVE-2013-3692Jul 13, 2013
    Blackberry
    Z10
    risk 0.00cvss —epss 0.00

    BlackBerry 10 OS before 10.0.10.648 on BlackBerry Z10 smartphones uses weak permissions for a BlackBerry Protect object, which allows physically proximate attackers to bypass intended access restrictions by leveraging a user's BlackBerry Protect password-reset request and a…

  • CVE-2013-2351Jul 13, 2013
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.00, 9.1x, and 9.2x allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.

  • CVE-2013-3424Jul 12, 2013
    Cisco Systems, Inc.
    Secure Access Control System
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Administration and View pages in Cisco Secure Access Control System (ACS) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCud75177.

  • CVE-2013-3423Jul 12, 2013
    Cisco Systems, Inc.
    Secure Access Control System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web interface in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified field, aka Bug ID CSCud75174.

  • CVE-2013-3422Jul 12, 2013
    Cisco Systems, Inc.
    Secure Access Control System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Administration pages in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud75165.

  • CVE-2013-3421Jul 12, 2013
    Cisco Systems, Inc.
    Secure Access Control System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Help index page in Cisco Secure Access Control System (ACS) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud75170.

  • CVE-2013-2704Jul 12, 2013
    Metin Saylan
    Dropdown Menu Widget
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Dropdown Menu Widget plugin 1.9.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting (XSS) sequences.

  • CVE-2013-3655Jul 12, 2013
    Sharp
    Aquos Hn Pp150 Firmware
    risk 0.00cvss —epss 0.02

    The Sharp AQUOS PhotoPlayer HN-PP150 with firmware before 1.04.00.04 allows remote attackers to cause a denial of service (networking outage) via crafted packet data.

  • CVE-2013-2688Jul 12, 2013
    Blackberry
    Qnx Software Development Platform
    risk 0.01cvss —epss 0.07

    Buffer overflow in phrelay in BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted packets to TCP port 4868 that leverage…

  • CVE-2013-2687Jul 12, 2013
    Blackberry
    Qnx Momentics Tool Suite
    risk 0.01cvss —epss 0.08

    Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2) QNX Momentics Tool Suite through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial of service (application crash)…

  • CVE-2013-3419Jul 11, 2013
    Cisco Systems, Inc.
    Unified Meetingplace Web Conferencing
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Cisco Unified MeetingPlace Web Conferencing allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuh74981.

  • CVE-2013-3418Jul 11, 2013
    Cisco Systems, Inc.
    Unified Communications Domain Manager
    risk 0.00cvss —epss 0.01

    Cisco Unified Communications Domain Manager does not properly allocate memory for GET and POST requests, which allows remote authenticated users to cause a denial of service (memory consumption and process crash) via crafted requests to the management interface, aka Bug ID…

  • CVE-2013-1777Jul 11, 2013
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.10

    The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using…

  • CVE-2013-1768Jul 11, 2013
    Apache
    Openjpa
    risk 0.00cvss —epss 0.10

    The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute…

  • CVE-2013-4690Jul 11, 2013
    Juniper Networks
    Junos
    risk 0.00cvss —epss 0.02

    Juniper Junos 10.4 before 10.4S13, 11.4 before 11.4R7-S1, 12.1 before 12.1R5-S3, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on the SRX1400, SRX3400, and SRX3600 does not properly initialize memory locations used during padding of Ethernet packets, which allows…

  • CVE-2013-4688Jul 11, 2013
    Juniper Networks
    Junos
    risk 0.00cvss —epss 0.02

    flowd in Juniper Junos 10.4 before 10.4R11 on SRX devices, when the MSRPC Application Layer Gateway (ALG) is enabled, allows remote attackers to cause a denial of service (daemon crash) via crafted MSRPC requests, aka PR 772834.

  • CVE-2013-4687Jul 11, 2013
    Juniper Networks
    Junos
    risk 0.00cvss —epss 0.03

    flowd in Juniper Junos 10.4 before 10.4S14, 11.2 and 11.4 before 11.4R6-S2, and 12.1 before 12.1R6 on SRX devices, when certain Application Layer Gateways (ALGs) are enabled, allows remote attackers to cause a denial of service (daemon crash) via crafted TCP packets, aka PRs…

  • CVE-2013-4686Jul 11, 2013
    Juniper Networks
    Junos
    risk 0.00cvss —epss 0.02

    The kernel in Juniper Junos 10.4 before 10.4R14, 11.4 before 11.4R8, 11.4X27 before 11.4X27.43, 12.1 before 12.1R6, 12.1X44 before 12.1X44-D20, 12.2 before 12.2R4, and 12.3 before 12.3R2, in certain VLAN configurations with unrestricted arp-resp and proxy-arp settings, allows…

  • CVE-2013-4685Jul 11, 2013
    Juniper Networks
    Junos
    risk 0.01cvss —epss 0.08

    Buffer overflow in flowd in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R7, 12.1 before 12.1R6, and 12.1X44 before 12.1X44-D15 on SRX devices, when Captive Portal is enabled with the UAC enforcer role, allows remote attackers to execute arbitrary code via crafted HTTP…

  • CVE-2013-4684Jul 11, 2013
    Juniper Networks
    Junos
    risk 0.00cvss —epss 0.03

    flowd in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R8, 12.1 before 12.1R7, and 12.1X44 before 12.1X44-D15 on SRX devices, when PIM and NAT are enabled, allows remote attackers to cause a denial of service (daemon crash) via crafted PIM packets, aka PR 842253.

  • CVE-2013-2786Jul 10, 2013
    Alstom
    Micom S1 Agile
    risk 0.00cvss —epss 0.00

    Alstom Grid MiCOM S1 Agile before 1.0.3 and Alstom Grid MiCOM S1 Studio use weak permissions for the MiCOM S1 %PROGRAMFILES% directory, which allows local users to gain privileges via a Trojan horse executable file.

  • CVE-2013-2784Jul 10, 2013
    Triangle Research International
    Nano-10 PLC
    risk 0.03cvss —epss 0.04

    Triangle Research International (aka Tri) Nano-10 PLC devices with firmware before r81 use an incorrect algorithm for bounds checking of data in Modbus/TCP packets, which allows remote attackers to cause a denial of service (networking outage) via a crafted packet to TCP port…

  • CVE-2013-2352Jul 10, 2013
    Microfocus
    LeftHand OS
    risk 0.00cvss —epss 0.04

    LeftHand OS (aka SAN iQ) 10.5 and earlier on HP StoreVirtual Storage devices does not provide a mechanism for disabling the HP Support challenge-response root-login feature, which makes it easier for remote attackers to obtain administrative access by leveraging knowledge of an…