VYPR

CVEs

387,232 total · page 6619 of 7,745

AllCriticalHighKEV
  • CVE-2012-6147Jul 1, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-6145Jul 1, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-6144Jul 1, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-3653Jun 30, 2013
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the RecommendSearch feature in the management screen in LOCKON EC-CUBE before 2.12.5 allow remote attackers to inject arbitrary web script or HTML via vectors involving the rank parameter, a different vulnerability than…

  • CVE-2013-3652Jun 30, 2013
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in data/class/pages/products/LC_Page_Products_List.php in LOCKON EC-CUBE 2.11.0 through 2.12.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving the classcategory_id2 field, a different vulnerability…

  • CVE-2013-4735Jun 30, 2013
    Digital Alert Systems
    Dasdec Eas
    risk 0.00cvss —epss 0.05

    The Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 have a default password for an administrative account, which makes it easier for remote attackers to obtain access via an IP network.

  • CVE-2013-4734HigJun 30, 2013
    Digital Alert Systems
    Dasdec Eas
    risk 0.48cvss 7.3epss 0.01

    dasdec_mkuser on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 generates predictable passwords, which might make it easier for attackers to obtain non-administrative access via unspecified vectors.

  • CVE-2013-4733HigJun 30, 2013
    Digital Alert Systems
    Dasdec Eas
    risk 0.49cvss 7.5epss 0.02

    The web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 allows remote attackers to obtain sensitive configuration and status information by reading log files.

  • CVE-2013-4732Jun 30, 2013
    Digital Alert Systems
    Dasdec Eas
    risk 0.00cvss —epss 0.03

    The administrative web server on the Digital Alert Systems DASDEC EAS device through 2.0-2 and the Monroe Electronics R189 One-Net EAS device through 2.0-2 uses predictable session ID values, which makes it easier for remote attackers to hijack sessions by sniffing the network. …

  • CVE-2013-4731Jun 30, 2013
    Choice Wireless
    Wixfmr 111
    risk 0.00cvss —epss 0.03

    ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to execute arbitrary commands via shell metacharacters in the pip parameter in an Ajax tag_ipPing request, a different vulnerability than CVE-2013-3581.

  • CVE-2013-0137Jun 30, 2013
    Digital Alert Systems
    Dasdec Eas
    risk 0.01cvss —epss 0.13

    The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 contains a known SSH private key, which makes it easier for remote attackers to obtain root access, and spoof alerts, via an SSH…

  • CVE-2013-3654Jun 30, 2013
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in LOCKON EC-CUBE 2.12.0 through 2.12.4 allows remote attackers to read arbitrary image files via vectors related to data/class/SC_CheckError.php and data/class/SC_FormParam.php, a different vulnerability than CVE-2013-3650.

  • CVE-2013-3651Jun 30, 2013
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.04

    LOCKON EC-CUBE 2.11.2 through 2.12.4 allows remote attackers to conduct unspecified PHP code-injection attacks via a crafted string, related to data/class/SC_CheckError.php and data/class/SC_FormParam.php.

  • CVE-2013-3650Jun 30, 2013
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the lfCheckFileName function in data/class/pages/LC_Page_ResizeImage.php in LOCKON EC-CUBE before 2.12.5 allows remote attackers to read arbitrary image files via vectors involving the image parameter to resize_image.php, a different…

  • CVE-2013-2342Jun 30, 2013
    Microfocus
    StoreOnce D2D
    risk 0.00cvss —epss 0.01

    The HP StoreOnce D2D backup system with software before 3.0.0 has a default password of badg3r5 for the HPSupport account, which allows remote attackers to obtain administrative access and delete data via an SSH session.

  • CVE-2013-2339Jun 30, 2013
    Microfocus
    Smart Zero Core
    risk 0.00cvss —epss 0.01

    HP Smart Zero Core 4.3 and 4.3.1 on the t410 All-in-One Smart Zero Client, t410 Smart Zero Client, t510 Flexible Thin Client, t5565z Smart Client, t610 Flexible Thin Client, and t610 PLUS Flexible Thin Client allows local users to obtain sensitive information, modify data, or…

  • CVE-2013-4098Jun 28, 2013
    risk 0.03cvss —epss 0.04

    ServerAdmin/ErrorViewer.jsp in DS3 Authentication Server allow remote attackers to inject arbitrary error-page text via the message parameter.

  • CVE-2013-4097Jun 28, 2013
    risk 0.04cvss —epss 0.07

    ServerAdmin/TestDRConnection.jsp in DS3 Authentication Server allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in a -REG-E-OPEN error message.

  • CVE-2013-4096Jun 28, 2013
    risk 0.04cvss —epss 0.09

    ServerAdmin/TestTelnetConnection.jsp in DS3 Authentication Server allows remote authenticated users to execute arbitrary commands via shell metacharacters in the HOST_NAME field.

  • CVE-2013-4095Jun 28, 2013
    Imperva
    Securesphere
    risk 0.03cvss —epss 0.06

    plain/actionsets.html in the SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows remote authenticated users to execute arbitrary commands via a task with a [command].value field in conjunction with an [arguments].value field.

  • CVE-2013-4094Jun 28, 2013
    Imperva
    Securesphere
    risk 0.03cvss —epss 0.06

    The Key Management feature in the SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows remote authenticated users to upload executable files via the (1) private_key or (2) public_key parameter in a T/keyManagement request to…

  • CVE-2013-4093Jun 28, 2013
    Imperva
    Securesphere
    risk 0.04cvss —epss 0.07

    The SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows remote attackers to obtain sensitive information via (1) a direct request to dwr/call/plaincall/AsyncOperationsContainer.getOperationState.dwr, which reveals the installation path…

  • CVE-2013-4092Jun 28, 2013
    Imperva
    Securesphere
    risk 0.03cvss —epss 0.05

    The SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows context-dependent attackers to obtain sensitive information by leveraging the presence of (1) a session ID in the jsessionid field to secsphLogin.jsp or (2) credentials in the…

  • CVE-2013-4091Jun 28, 2013
    Imperva
    Securesphere
    risk 0.03cvss —epss 0.06

    The SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 does not have an off autocomplete attribute for the password (aka j_password) field on the secsphLogin.jsp login page, which makes it easier for remote attackers to obtain access by…

  • CVE-2013-3649Jun 28, 2013
    Kent Web
    Clip Mail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in KENT-WEB CLIP-MAIL before 3.4, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an unspecified form field.

  • CVE-2013-3648Jun 28, 2013
    Kent Web
    Post Mail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in KENT-WEB POST-MAIL before 6.7, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an unspecified form field.

  • CVE-2010-5288Jun 28, 2013
    EDItran
    Communications Platform
    risk 0.00cvss —epss 0.03

    Buffer overflow in the lsConnectionCached function in editcp in EDItran Communications Platform 4.1 R7 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted packet to TCP port 7777.

  • CVE-2013-4660Jun 28, 2013
    Nodeca
    Js YAML
    risk 0.04cvss —epss 0.17

    The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.

  • CVE-2013-2323Jun 28, 2013
    Microfocus
    SQL/MX
    risk 0.00cvss —epss 0.01

    HP SQL/MX 3.0 through 3.2 on NonStop servers, when SQL/MP Objects are used, allows remote authenticated users to bypass intended access restrictions and modify data via unspecified vectors, aka the "SQL/MP tables" issue.

  • CVE-2013-2322Jun 28, 2013
    Microfocus
    SQL/MX
    risk 0.00cvss —epss 0.01

    HP SQL/MX 3.2 and earlier on NonStop servers, when SQL/MP Objects are used, allows remote authenticated users to obtain sensitive information via unspecified vectors, aka the "SQL/MP index" issue.

  • CVE-2013-3386Jun 27, 2013
    Cisco Systems, Inc.
    Ironport Asyncos
    risk 0.00cvss —epss 0.02

    The IronPort Spam Quarantine (ISQ) component in the web framework in IronPort AsyncOS on Cisco Email Security Appliance devices before 7.1.5-106 and 7.3, 7.5, and 7.6 before 7.6.3-019 and Content Security Management Appliance devices before 7.9.1-102 and 8.0 before 8.0.0-404…

  • CVE-2013-3385Jun 27, 2013
    Cisco Systems, Inc.
    Ironport Asyncos
    risk 0.00cvss —epss 0.03

    The management GUI in the web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-602; Email Security Appliance devices before 7.1.5-106 and 7.3, 7.5, and 7.6 before 7.6.3-019; and Content Security…

  • CVE-2013-3384Jun 27, 2013
    Cisco Systems, Inc.
    Ironport Asyncos
    risk 0.00cvss —epss 0.04

    The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550; Email Security Appliance devices before 7.1.5-104, 7.3 before 7.3.2-026, 7.5 before 7.5.2-203, and 7.6 before 7.6.3-019; and Content…

  • CVE-2013-3383Jun 27, 2013
    Cisco Systems, Inc.
    Ironport Asyncos
    risk 0.00cvss —epss 0.03

    The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550 allows remote authenticated users to execute arbitrary commands via crafted command-line input in a URL sent over IPv4, aka Bug ID…

  • CVE-2013-4721Jun 27, 2013
    TYPO3
    RSS feed from records
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the RSS feed from records extension 1.0.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4720Jun 27, 2013
    TYPO3
    Wec Discussion Forum
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the WEC Discussion Forum extension before 2.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4719Jun 27, 2013
    TYPO3
    lonewsseo
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the SEO Pack for tt_news extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-6577Jun 27, 2013
    TYPO3
    Formhandler
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Formhandler extension before 1.4.1 for TYPO3 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-6576Jun 27, 2013
    Drupal
    PRH Search
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the PRH Search module 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers from certain sources to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-6575Jun 27, 2013
    Drupal
    Exposed Filter Data
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Exposed Filter Data module 6.x-1.x before 6.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-6574Jun 27, 2013
    Drupal
    Fonecta verify
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Fonecta verify module 7.x-1.x before 7.x-1.6 for Drupal allows remote attackers from certain sources to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-3398Jun 26, 2013
    Cisco Systems, Inc.
    Prime Central For Hosted Collaboration Solution
    risk 0.00cvss —epss 0.01

    The web framework in Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance provides different responses to requests for arbitrary pathnames depending on whether the pathname exists, which allows remote attackers to enumerate directories and files via a series of…

  • CVE-2013-3397Jun 26, 2013
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Unified Serviceability component in Cisco Unified Communications Manager (CUCM) allows remote attackers to hijack the authentication of arbitrary users for requests that perform Unified Serviceability actions, aka Bug ID…

  • CVE-2013-3396Jun 26, 2013
    Cisco Systems, Inc.
    Content Security Management Appliance
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web framework in Cisco Content Security Management on Security Management Appliance (SMA) devices allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuh24749.

  • CVE-2013-3393Jun 26, 2013
    Cisco Systems, Inc.
    Jabber
    risk 0.00cvss —epss 0.01

    The Precision Video Engine component in Cisco Jabber for Windows and Cisco Virtualization Experience Media Engine allows remote attackers to cause a denial of service (process crash and call disconnection) via crafted RTP packets, aka Bug IDs CSCuh60706 and CSCue21117.

  • CVE-2013-3382Jun 26, 2013
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    The Next-Generation Firewall (aka NGFW, formerly CX Context-Aware Security) module 9.x before 9.1.1.9 and 9.1.2.x before 9.1.2.12 for Cisco Adaptive Security Appliances (ASA) devices allows remote attackers to cause a denial of service (device reload or traffic-processing…

  • CVE-2013-1700Jun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.00

    The Mozilla Maintenance Service in Mozilla Firefox before 22.0 on Windows does not properly handle inability to launch the Mozilla Updater executable file, which allows local users to gain privileges via vectors involving placement of a Trojan horse executable file at an…

  • CVE-2013-1699Jun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The Internationalized Domain Name (IDN) display algorithm in Mozilla Firefox before 22.0 does not properly handle the .com, .name, and .net top-level domains, which allows remote attackers to spoof the address bar via unspecified homograph characters.

  • CVE-2013-1698Jun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    The getUserMedia permission implementation in Mozilla Firefox before 22.0 references the URL of a top-level document instead of the URL of a specific page, which makes it easier for remote attackers to trick users into permitting camera or microphone access via a crafted web…

  • CVE-2013-1697Jun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary…