VYPR

CVEs

387,240 total · page 6617 of 7,745

AllCriticalHighKEV
  • CVE-2013-3148Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.25

    Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3153.

  • CVE-2013-3147Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.25

    Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2013-3146Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.24

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3152.

  • CVE-2013-3145Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.25

    Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3150.

  • CVE-2013-3144Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.23

    Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3151 and…

  • CVE-2013-3143Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.06cvss —epss 0.33

    Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3161.

  • CVE-2013-3134Jul 10, 2013
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.21

    The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 on 64-bit platforms does not properly allocate arrays of structures, which allows remote attackers to execute arbitrary code via a crafted .NET Framework application that changes array…

  • CVE-2013-3133Jul 10, 2013
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.21

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application,…

  • CVE-2013-3132Jul 10, 2013
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.22

    Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET…

  • CVE-2013-3131Jul 10, 2013
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.22

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5, and Silverlight 5 before 5.1.20513.0, does not properly prevent changes to data in multidimensional arrays of structures, which allows remote attackers to execute arbitrary code via (1) a crafted .NET Framework…

  • CVE-2013-3129HigJul 10, 2013
    Microsoft
    Office
    risk 0.53cvss 7.8epss 0.32

    Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+, DirectWrite, and Journal, in Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,…

  • CVE-2013-3127Jul 10, 2013
    Microsoft
    Windows Media Player
    risk 0.02cvss —epss 0.22

    The Microsoft WMV video codec in wmv9vcm.dll, wmvdmod.dll in Windows Media Format Runtime 9 and 9.5, and wmvdecod.dll in Windows Media Format Runtime 11 and Windows Media Player 11 and 12 allows remote attackers to execute arbitrary code via a crafted media file, aka "WMV Video…

  • CVE-2013-3115Jul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.25

    Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3162.

  • CVE-2013-1345Jul 10, 2013
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local…

  • CVE-2013-1340HigJul 10, 2013
    Microsoft
    Windows
    risk 0.55cvss 8.4epss 0.02

    win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local…

  • CVE-2013-1300Jul 10, 2013
    Microsoft
    Windows
    risk 0.04cvss —epss 0.12

    win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local…

  • CVE-2013-4787Jul 9, 2013
    Google
    Android
    risk 0.04cvss —epss 0.13

    Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature,…

  • CVE-2013-2118Jul 9, 2013
    Spip
    Spip
    risk 0.04cvss —epss 0.09

    SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "take editorial control" via vectors related to ecrire/inc/filtres.php.

  • CVE-2013-2096Jul 9, 2013
    OpenStack
    Folsom
    risk 0.00cvss —epss 0.00

    OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by creating an image with a large virtual size that does not contain a large amount…

  • CVE-2013-2054Jul 9, 2013
    Strongswan
    Strongswan
    risk 0.00cvss —epss 0.02

    Buffer overflow in the atodn function in strongSwan 2.0.0 through 4.3.4, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT…

  • CVE-2013-2053Jul 9, 2013
    Xelerance
    Openswan
    risk 0.00cvss —epss 0.02

    Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records. …

  • CVE-2013-2052Jul 9, 2013
    Libreswan
    Libreswan
    risk 0.00cvss —epss 0.02

    Buffer overflow in the atodn function in libreswan 3.0 and 3.1, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records. …

  • CVE-2013-2051Jul 9, 2013
    Red Hat
    Enterprise Linux Server
    risk 0.00cvss —epss 0.02

    The Tomcat 6 DIGEST authentication functionality as used in Red Hat Enterprise Linux 6 allows remote attackers to bypass intended access restrictions by performing a replay attack after a nonce becomes stale. NOTE: this issue is due to an incomplete fix for CVE-2012-5887.

  • CVE-2013-1976Jul 9, 2013
    Red Hat
    Jboss Enterprise Web Server
    risk 0.00cvss —epss 0.00

    The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux 5 and 6, allow local users to change the ownership of arbitrary files via a symlink attack on (a)…

  • CVE-2013-1950Jul 9, 2013
    Libtirpc Project
    Libtirpc
    risk 0.04cvss —epss 0.06

    The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remote attackers to cause a denial of service (rpcbind crash) via a Sun RPC request with crafted arguments that trigger a free of an invalid pointer.

  • CVE-2013-1362Jul 9, 2013
    Nagios
    NRPE
    risk 0.08cvss —epss 0.66

    Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters, which are processed by bash.

  • CVE-2013-4786HigJul 8, 2013
    IPMI
    IPMI 2.0
    risk 0.58cvss 7.5epss 0.79

    The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.

  • CVE-2013-4785Jul 8, 2013
    Dell
    iDRAC6
    risk 0.00cvss —epss 0.04

    The web interface on the Dell iDRAC6 with firmware before 1.95 allows remote attackers to modify the CLP interface for arbitrary users and possibly have other impact via a request to an unspecified form that is accessible from testurls.html. NOTE: the vendor disputes the…

  • CVE-2013-4784Jul 8, 2013
    Microfocus
    Integrated Lights Out 4 Firmware
    risk 0.04cvss —epss 0.50

    The HP Integrated Lights-Out (iLO) BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.

  • CVE-2013-4783Jul 8, 2013
    Dell
    iDRAC6
    risk 0.00cvss —epss 0.03

    The Dell iDRAC6 with firmware 1.x before 1.92 and 2.x and 3.x before 3.42, and iDRAC7 with firmware before 1.23.23, allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password. NOTE:…

  • CVE-2013-4782Jul 8, 2013
    Supermicro
    Bmc
    risk 0.05cvss —epss 0.26

    The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.

  • CVE-2013-3273Jul 8, 2013
    Rsa
    Authentication Manager
    risk 0.00cvss —epss 0.00

    EMC RSA Authentication Manager 8.0 before P2 and 7.1 before SP4 P26, as used in Appliance 3.0, does not omit the cleartext administrative password from trace logging in custom SDK applications, which allows local users to obtain sensitive information by reading the trace log…

  • CVE-2013-3272Jul 8, 2013
    EMC Corporation
    Replication Manager
    risk 0.00cvss —epss 0.00

    EMC Replication Manager (RM) before 5.4.4 places encoded passwords in application log files, which makes it easier for local users to obtain sensitive information by reading a file and conducting an unspecified decoding attack.

  • CVE-2013-2205Jul 8, 2013
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site.

  • CVE-2013-2204Jul 8, 2013
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRING, which allows remote attackers to pass arbitrary…

  • CVE-2013-2203Jul 8, 2013
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message.

  • CVE-2013-2202Jul 8, 2013
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

  • CVE-2013-2201Jul 8, 2013
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files, (2) editing of media files, (3) installation of plugins, (4) updates to plugins, (5)…

  • CVE-2013-2200Jul 8, 2013
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing and authorship reassignment via unspecified vectors.

  • CVE-2013-2199Jul 8, 2013
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery (SSRF) issue, a similar vulnerability to CVE-2013-0235.

  • CVE-2013-0237Jul 8, 2013
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2013-0236Jul 8, 2013
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery shortcodes or (2) the content of a post.

  • CVE-2013-0235Jul 8, 2013
    WordPress
    WordPress
    risk 0.00cvss —epss 0.30

    The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.

  • CVE-2013-1615Jul 8, 2013
    Symantec
    Security Information Manager
    risk 0.00cvss —epss 0.01

    The management console (aka Java console) on the Symantec Security Information Manager (SSIM) appliance 4.7.x and 4.8.x before 4.8.1 allows remote attackers to obtain sensitive information via unspecified web-GUI API calls.

  • CVE-2013-1614Jul 8, 2013
    Symantec
    Security Information Manager
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the management console (aka Java console) on the Symantec Security Information Manager (SSIM) appliance 4.7.x and 4.8.x before 4.8.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-1613Jul 8, 2013
    Symantec
    Security Information Manager
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the management console (aka Java console) on the Symantec Security Information Manager (SSIM) appliance 4.7.x and 4.8.x before 4.8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-1414Jul 8, 2013
    Fortinet
    Fortios
    risk 0.03cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in Fortinet FortiOS on FortiGate firewall devices before 4.3.13 and 5.x before 5.0.2 allow remote attackers to hijack the authentication of administrators for requests that modify (1) settings or (2) policies, or (3)…

  • CVE-2013-1059Jul 8, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.05

    net/ceph/auth_none.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an auth_reply message that triggers an attempted build_request operation.

  • CVE-2013-3299Jul 6, 2013
    RealNetworks
    Realplayer
    risk 0.03cvss —epss 0.02

    RealNetworks RealPlayer 16.0.2.32 and earlier allows remote attackers to cause a denial of service (resource consumption or application crash) via an HTML document containing JavaScript code that constructs a long string.

  • CVE-2013-3005Jul 6, 2013
    IBM
    Aix
    risk 0.00cvss —epss 0.03

    The TFTP client in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, when RBAC is enabled, allows remote authenticated users to bypass intended file-ownership restrictions, and read or overwrite arbitrary files, via unspecified vectors.