VYPR

CVEs

387,240 total · page 6616 of 7,745

AllCriticalHighKEV
  • CVE-2013-3408Jul 10, 2013
    Cisco Systems, Inc.
    Virtualization Experience Client 6000 Series Firmware
    risk 0.00cvss —epss 0.00

    The firmware on Cisco Virtualization Experience Client 6000 devices sets incorrect operating-system permissions, which allows local users to gain privileges via an unspecified sequence of commands, aka Bug ID CSCuc31764.

  • CVE-2013-1132Jul 10, 2013
    Cisco Systems, Inc.
    Unified Communications Domain Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Communications Domain Manager allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) IptAccountMgmt, (2) IptFeatureConfigTemplateMgmt, (3) IptFeatureDisplayPolicyMgmt, or…

  • CVE-2013-3405Jul 10, 2013
    Cisco Systems, Inc.
    Telepresence Tc Software
    risk 0.00cvss —epss 0.01

    The web portal in TC software on Cisco TelePresence endpoints does not require an exact password match during a login attempt by a user who has not configured a password, which allows remote attackers to bypass authentication by sending an arbitrary password, aka Bug ID…

  • CVE-2013-3400Jul 10, 2013
    Cisco Systems, Inc.
    Nexus 1000v
    risk 0.00cvss —epss 0.00

    The license-installation module in Cisco NX-OS on Nexus 1000V devices allows local users to execute arbitrary commands via crafted "install license" arguments, aka Bug ID CSCuh30824.

  • CVE-2013-1896Jul 10, 2013
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.29

    mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn…

  • CVE-2013-3245MedJul 10, 2013
    VideoLAN
    VLC media player
    risk 0.41cvss 6.3epss 0.03

    plugins/demux/libmkv_plugin.dll in VideoLAN VLC Media Player 2.0.7, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MKV file, possibly involving an integer overflow and out-of-bounds read…

  • CVE-2013-2115HigJul 10, 2013
    Apache
    Struts
    risk 0.55cvss 8.1epss 0.75

    Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.

  • CVE-2013-1966Jul 10, 2013
    Apache
    Struts
    risk 0.02cvss —epss 0.74

    Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.

  • CVE-2013-1965Jul 10, 2013
    Apache
    Struts
    risk 0.00cvss —epss 0.94

    Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

  • CVE-2013-1954Jul 10, 2013
    VideoLAN
    VLC media player
    risk 0.00cvss —epss 0.06

    The ASF Demuxer (modules/demux/asf/asf.c) in VideoLAN VLC media player 2.0.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ASF movie that triggers an out-of-bounds read.

  • CVE-2013-1868Jul 10, 2013
    VideoLAN
    VLC media player
    risk 0.04cvss —epss 0.11

    Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via vectors related to the (1) freetype renderer and (2) HTML subtitle parser.

  • CVE-2012-5855Jul 10, 2013
    VideoLAN
    VLC media player
    risk 0.00cvss —epss 0.01

    The SHAddToRecentDocs function in VideoLAN VLC media player 2.0.4 and earlier might allow user-assisted attackers to cause a denial of service (crash) via a crafted file name that triggers an incorrect string-length calculation when the file is added to VLC. NOTE: it is not…

  • CVE-2013-3350Jul 10, 2013
    Adobe Inc.
    Coldfusion
    risk 0.01cvss —epss 0.09

    Adobe ColdFusion 10 before Update 11 allows remote attackers to call ColdFusion Components (CFC) public methods via WebSockets.

  • CVE-2013-3349Jul 10, 2013
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Adobe ColdFusion 9.0 through 9.0.2, when the JRun application server is used, allows remote attackers to cause a denial of service via unknown vectors.

  • CVE-2013-3348Jul 10, 2013
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.04

    Adobe Shockwave Player before 12.0.3.133 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2013-3347Jul 10, 2013
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.05

    Integer overflow in Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X, before 11.2.202.297 on Linux, before 11.1.111.64 on Android 2.x and 3.x, and before 11.1.115.69 on Android 4.x allows attackers to execute arbitrary code via PCM…

  • CVE-2013-3345Jul 10, 2013
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.04

    Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X, before 11.2.202.297 on Linux, before 11.1.111.64 on Android 2.x and 3.x, and before 11.1.115.69 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service…

  • CVE-2013-3344Jul 10, 2013
    Adobe Inc.
    Flashplayer
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X, before 11.2.202.297 on Linux, before 11.1.111.64 on Android 2.x and 3.x, and before 11.1.115.69 on Android 4.x allows attackers to execute arbitrary code…

  • CVE-2013-2880Jul 10, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Google Chrome before 28.0.1500.71 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

  • CVE-2013-2879Jul 10, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 28.0.1500.71 does not properly determine the circumstances in which a renderer process can be considered a trusted process for sign-in and subsequent sync operations, which makes it easier for remote attackers to conduct phishing attacks via a crafted web…

  • CVE-2013-2878Jul 10, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the handling of text.

  • CVE-2013-2877Jul 10, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.05

    parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.

  • CVE-2013-2876Jul 10, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    browser/extensions/api/tabs/tabs_api.cc in Google Chrome before 28.0.1500.71 does not properly enforce restrictions on the capture of screenshots by extensions, which allows remote attackers to obtain sensitive information about the content of a previous page via vectors…

  • CVE-2013-2875Jul 10, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    core/rendering/svg/SVGInlineTextBox.cpp in the SVG implementation in Blink, as used in Google Chrome before 28.0.1500.71, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2013-2874Jul 10, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 28.0.1500.71 on Windows, when an Nvidia GPU is used, allows remote attackers to bypass intended restrictions on access to screen data via vectors involving IPC transmission of GL textures.

  • CVE-2013-2873Jul 10, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a 404 HTTP status code during the loading of resources.

  • CVE-2013-2872Jul 10, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 28.0.1500.71 on Mac OS X does not ensure a sufficient source of entropy for renderer processes, which might make it easier for remote attackers to defeat cryptographic protection mechanisms in third-party components via unspecified vectors.

  • CVE-2013-2871Jul 10, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of input.

  • CVE-2013-2870Jul 10, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote servers to execute arbitrary code via crafted response traffic after a URL request.

  • CVE-2013-2869Jul 10, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted JPEG2000 image.

  • CVE-2013-2868Jul 10, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    common/extensions/sync_helper.cc in Google Chrome before 28.0.1500.71 proceeds with sync operations for NPAPI extensions without checking for a certain plugin permission setting, which might allow remote attackers to trigger unwanted extension changes via unspecified vectors.

  • CVE-2013-2867Jul 10, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 28.0.1500.71 does not properly prevent pop-under windows, which allows remote attackers to have an unspecified impact via a crafted web site.

  • CVE-2013-2853Jul 10, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The HTTPS implementation in Google Chrome before 28.0.1500.71 does not ensure that headers are terminated by \r\n\r\n (carriage return, newline, carriage return, newline), which allows man-in-the-middle attackers to have an unspecified impact via vectors that trigger header…

  • CVE-2013-3178Jul 10, 2013
    Microsoft
    Silverlight
    risk 0.03cvss —epss 0.32

    Microsoft Silverlight 5 before 5.1.20513.0 does not properly initialize arrays, which allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via a crafted Silverlight application, aka "Null Pointer Vulnerability."

  • CVE-2013-3174Jul 10, 2013
    Microsoft
    Windows
    risk 0.06cvss —epss 0.32

    DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a crafted GIF file, aka "DirectShow Arbitrary…

  • CVE-2013-3173Jul 10, 2013
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a…

  • CVE-2013-3172Jul 10, 2013
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to cause a denial of service (system hang) via a crafted application…

  • CVE-2013-3171Jul 10, 2013
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.21

    The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions of delegate objects, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a…

  • CVE-2013-3167Jul 10, 2013
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 does not properly handle objects in memory, which allows local users to gain privileges via a crafted…

  • CVE-2013-3166Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.04cvss —epss 0.16

    Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to inject arbitrary web script or HTML via vectors involving incorrect auto-selection of the Shift JIS encoding, leading to cross-domain scrolling events, aka "Shift JIS…

  • CVE-2013-3164Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.24

    Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2013-3163HigKEVJul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.78cvss 8.8epss 0.71

    Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3144 and…

  • CVE-2013-3162Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.25

    Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3115.

  • CVE-2013-3161Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.25

    Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3143.

  • CVE-2013-3154Jul 10, 2013
    Microsoft
    Windows Defender
    risk 0.00cvss —epss 0.02

    The signature-update functionality in Windows Defender on Microsoft Windows 7 and Windows Server 2008 R2 relies on an incorrect pathname, which allows local users to gain privileges via a Trojan horse application in the %SYSTEMDRIVE% top-level directory, aka "Microsoft Windows 7…

  • CVE-2013-3153Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.25

    Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3148.

  • CVE-2013-3152Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.24

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3146.

  • CVE-2013-3151Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.23

    Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3144 and…

  • CVE-2013-3150Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.25

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3145.

  • CVE-2013-3149Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.25

    Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."