VYPR

CVEs

387,230 total · page 6620 of 7,745

AllCriticalHighKEV
  • CVE-2013-1694Jun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    The PreserveWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly handle the lack of a wrapper, which allows remote attackers to cause a denial of service…

  • CVE-2013-1693Jun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The SVG filter implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to read pixel values, and possibly bypass the Same Origin Policy and read text from a different…

  • CVE-2013-1692Jun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not prevent the inclusion of body data in an XMLHttpRequest HEAD request, which makes it easier for remote attackers to conduct cross-site request…

  • CVE-2013-1690HigKEVJun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.78cvss 8.8epss 0.69

    Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service…

  • CVE-2013-1688Jun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The Profiler implementation in Mozilla Firefox before 22.0 parses untrusted data during UI rendering, which allows user-assisted remote attackers to execute arbitrary JavaScript code via a crafted web site.

  • CVE-2013-1687Jun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows…

  • CVE-2013-1686Jun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the mozilla::ResetDir function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap…

  • CVE-2013-1685Jun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Use-after-free vulnerability in the nsIDocument::GetRootElement function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of…

  • CVE-2013-1684Jun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Use-after-free vulnerability in the mozilla::dom::HTMLMediaElement::LookupMediaElementURITable function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary…

  • CVE-2013-1683Jun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

  • CVE-2013-1682Jun 26, 2013
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allow remote attackers to cause a denial of service (memory corruption and application…

  • CVE-2013-4683Jun 25, 2013
    Christophe Balisky
    Meta Feedit
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the meta_feedit extension 0.1.10 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4682Jun 25, 2013
    Bas Van Beek
    Multishop
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Multishop extension before 2.0.39 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4681Jun 25, 2013
    TYPO3
    sofortueberweisung2commerce
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the sofortueberweisung2commerce extension before 2.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-4680Jun 25, 2013
    TYPO3
    Maag Form Captcha
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in Maag Form Captcha extension 2.0.0 and earlier for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2013-2177Jun 25, 2013
    Display Suite Project
    Display Suite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-1.x before 7.x-1.7 and 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via an entity bundle label.

  • CVE-2013-1971Jun 25, 2013
    Drupal
    MP3 Player
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the MP3 Player module for Drupal 6.x allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the file name of a MP3 file.

  • CVE-2012-6573Jun 25, 2013
    Drupal
    Apache Solr Autocomplete
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Apache Solr Autocomplete module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving autocomplete results.

  • CVE-2013-4669Jun 25, 2013
    Fortinet
    Forticlient
    risk 0.00cvss —epss 0.01

    FortiClient before 4.3.5.472 on Windows, before 4.0.3.134 on Mac OS X, and before 4.0 on Android; FortiClient Lite before 4.3.4.461 on Windows; FortiClient Lite 2.0 through 2.0.0223 on Android; and FortiClient SSL VPN before 4.0.2258 on Linux proceed with an SSL session after…

  • CVE-2013-4604Jun 25, 2013
    Fortinet
    Fortios
    risk 0.00cvss —epss 0.01

    Fortinet FortiOS before 5.0.3 on FortiGate devices does not properly restrict Guest capabilities, which allows remote authenticated users to read, modify, or delete the records of arbitrary users by leveraging the Guest role.

  • CVE-2013-2129Jun 24, 2013
    Drupal
    webform
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the "edit own webform content" or "edit all webform content" permissions to inject arbitrary web script or HTML via a component label.

  • CVE-2013-2036Jun 24, 2013
    Filebrowser
    Filebrowser
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Filebrowser module 6.x-2.x before 6.x-2.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "lists of files."

  • CVE-2013-1972Jun 24, 2013
    Drupal
    elFinder
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the elFinder file manager module 6.x-0.x before 6.x-0.8 and 7.x-0.x before 7.x-0.8 for Drupal allows remote attackers to hijack the authentication of unspecified victims to create, modify, or delete files via unknown vectors.

  • CVE-2013-1906Jun 24, 2013
    Drupal
    Rules
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Rules module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "administer rules" permission to inject arbitrary web script or HTML via a rule tag.

  • CVE-2013-4636Jun 21, 2013
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via an MP3 file that triggers incorrect MIME type detection during access to an…

  • CVE-2013-4635Jun 21, 2013
    PHP
    PHP
    risk 0.00cvss —epss 0.04

    Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.

  • CVE-2013-4615Jun 21, 2013
    Canon
    Mx922 Printer
    risk 0.04cvss —epss 0.16

    The Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers allow remote attackers to cause a denial of service (device hang) via a crafted LAN_TXT24 parameter to English/pages_MacUS/cgi_lan.cgi followed by a direct request to…

  • CVE-2013-4614Jun 21, 2013
    Canon
    Mx922 Printer
    risk 0.03cvss —epss 0.03

    English/pages_MacUS/wls_set_content.html on the Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers shows the Wi-Fi PSK passphrase in cleartext, which allows physically proximate attackers to obtain sensitive information by reading the screen of…

  • CVE-2013-4613Jun 21, 2013
    Canon
    Mx922 Printer
    risk 0.00cvss —epss 0.02

    The default configuration of the administrative interface on the Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers does not require authentication, which allows remote attackers to modify the configuration by visiting the Advanced page. NOTE:…

  • CVE-2013-3392Jun 21, 2013
    Cisco Systems, Inc.
    Webex Social
    risk 0.00cvss —epss 0.00

    Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco WebEx Social allow remote attackers to hijack the authentication of arbitrary users via unspecified vectors, aka Bug IDs CSCuh10405 and CSCuh10355.

  • CVE-2013-3250Jun 21, 2013
    WordPress
    Wp Maintenance Mode
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.

  • CVE-2013-2110Jun 21, 2013
    PHP
    PHP
    risk 0.00cvss —epss 0.07

    Heap-based buffer overflow in the php_quot_print_encode function in ext/standard/quot_print.c in PHP before 5.3.26 and 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted argument to…

  • CVE-2013-0523Jun 21, 2013
    IBM
    Websphere Commerce
    risk 0.00cvss —epss 0.01

    IBM WebSphere Commerce Enterprise 5.6.x through 5.6.1.5, 6.0.x through 6.0.0.11, and 7.0.x through 7.0.0.7 does not use a suitable encryption algorithm for storefront web requests, which allows remote attackers to obtain sensitive information via a padding oracle attack that…

  • CVE-2012-6572Jun 21, 2013
    Drupal
    Inf08
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the phptemplate_preprocess_node function in template.php in the Inf08 theme 6.x-1.x before 6.x-1.10 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a…

  • CVE-2013-2961Jun 21, 2013
    IBM
    Tivoli Monitoring
    risk 0.00cvss —epss 0.02

    The internal web server in the Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3, 6.2.1 through FP4, 6.2.2 through FP9, and 6.2.3 before FP3, as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations Application Manager) 1.2.1…

  • CVE-2013-2960Jun 21, 2013
    IBM
    Tivoli Monitoring
    risk 0.00cvss —epss 0.03

    Buffer overflow in KDSMAIN in the Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3, 6.2.1 through FP4, 6.2.2 through FP9, and 6.2.3 before FP3, as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations Application Manager) 1.2.1…

  • CVE-2013-0551Jun 21, 2013
    IBM
    Tivoli Monitoring
    risk 0.00cvss —epss 0.02

    The Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3, 6.2.1 through FP4, 6.2.2 through FP9, and 6.2.3 before FP3, as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations Application Manager) 1.2.1 before…

  • CVE-2013-0548Jun 21, 2013
    IBM
    Tivoli Monitoring
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3, 6.2.1 through FP4, 6.2.2 through FP9, and 6.2.3 before FP3, as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations…

  • CVE-2013-0536Jun 21, 2013
    IBM
    Notes
    risk 0.00cvss —epss 0.00

    ntmulti.exe in the Multi User Profile Cleanup service in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3 before FP5, and 9.0 before IF2 allows local users to gain privileges via vectors that arrange for code to be executed during the next login session of a different user,…

  • CVE-2013-3035Jun 21, 2013
    IBM
    Aix
    risk 0.00cvss —epss 0.04

    The IPv6 implementation in the inet subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allows remote attackers to cause a denial of service (system hang) via a crafted packet to an IPv6 interface.

  • CVE-2013-0534Jun 21, 2013
    IBM
    Sametime
    risk 0.00cvss —epss 0.00

    The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, and 8.5.2.1, as used in the Lotus Notes client and separately, might allow local users to obtain sensitive information by leveraging the persistence of cleartext password strings within process memory.

  • CVE-2013-0529Jun 21, 2013
    IBM
    Sterling Connect Direct User Interface
    risk 0.00cvss —epss 0.01

    The Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http…

  • CVE-2013-0527Jun 21, 2013
    IBM
    Sterling Connect Direct User Interface
    risk 0.00cvss —epss 0.00

    The Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not close pages upon the timeout of a session, which allows physically proximate attackers to obtain sensitive administrative-console information by reading the screen of an unattended…

  • CVE-2013-3379Jun 21, 2013
    Cisco Systems, Inc.
    Telepresence Tc Software
    risk 0.00cvss —epss 0.01

    The firewall subsystem in Cisco TelePresence TC Software before 4.2 does not properly implement rules that grant access to hosts, which allows remote attackers to obtain shell access with root privileges by leveraging connectivity to the management network, aka Bug ID CSCts37781.

  • CVE-2013-3378Jun 21, 2013
    Cisco Systems, Inc.
    Telepresence Tc Software
    risk 0.00cvss —epss 0.02

    Cisco TelePresence TC Software before 6.1 and TE Software before 4.1.3 allow remote attackers to cause a denial of service (temporary device hang) via crafted SIP packets, aka Bug ID CSCuf89557.

  • CVE-2013-3377Jun 21, 2013
    Cisco Systems, Inc.
    Telepresence Tc Software
    risk 0.00cvss —epss 0.02

    Cisco TelePresence TC Software before 5.1.7 and TE Software before 4.1.3 allow remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCue01743.

  • CVE-2013-2173Jun 21, 2013
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attackers to cause a denial of service (CPU consumption) via a crafted value of a certain wp-postpass cookie.

  • CVE-2013-4634Jun 20, 2013
    TYPO3
    rzautocomplete
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the jQuery autocomplete for indexed_search (rzautocomplete) extension before 0.0.9 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-1905Jun 20, 2013
    Drupal
    Zero Point
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Zero Point theme 7.x-1.x before 7.x-1.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-1393Jun 20, 2013
    Curvycorners
    Curvycorners
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the CurvyCorners module 6.x-1.x and 7.x-1.x for Drupal allows remote authenticated users with the "administer curvycorners" permission to inject arbitrary web script or HTML via unspecified vectors.