VYPR

CVEs

387,214 total · page 6625 of 7,745

AllCriticalHighKEV
  • CVE-2013-3955Jun 5, 2013
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    The get_xattrinfo function in the XNU kernel in Apple iOS 5.x and 6.x through 6.1.3 on iPad devices does not properly validate the header of an AppleDouble file, which might allow local users to cause a denial of service (memory corruption) or have unspecified other impact via…

  • CVE-2013-3954Jun 5, 2013
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    The posix_spawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not properly validate the data for file actions and port actions, which allows local users to (1) cause a denial of service (panic) via a size value that is inconsistent with a header count field, or (2)…

  • CVE-2013-3953Jun 5, 2013
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    The mach_port_space_info function in osfmk/ipc/mach_debug.c in the XNU kernel in Apple Mac OS X 10.8.x does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted call.

  • CVE-2013-3952Jun 5, 2013
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    The fill_pipeinfo function in bsd/kern/sys_pipe.c in the XNU kernel in Apple Mac OS X 10.8.x allows local users to defeat the KASLR protection mechanism via the PROC_PIDFDPIPEINFO option to the proc_info system call for a kernel pipe handle.

  • CVE-2013-3951Jun 5, 2013
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    sys/openbsd/stack_protector.c in libc in Apple iOS 6.1.3 and Mac OS X 10.8.x does not properly parse the Apple strings employed in the user-space stack-cookie implementation, which allows local users to bypass cookie randomization by executing a program with a call-path…

  • CVE-2013-3950Jun 5, 2013
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    Stack-based buffer overflow in the openSharedCacheFile function in dyld.cpp in dyld in Apple iOS 5.1.x and 6.x through 6.1.3 makes it easier for attackers to conduct untethering attacks via a long string in the DYLD_SHARED_CACHE_DIR environment variable.

  • CVE-2013-3949Jun 5, 2013
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    The posix_spawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not prevent use of the _POSIX_SPAWN_DISABLE_ASLR and _POSIX_SPAWN_ALLOW_DATA_EXEC flags for setuid and setgid programs, which allows local users to bypass intended access restrictions via a wrapper…

  • CVE-2013-3948Jun 5, 2013
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    Apple iOS 6.1.3 does not follow redirects during determination of the hostname to display in an iOS Enterprise Deployment installation dialog, which makes it easier for remote attackers to trigger installation of arbitrary applications via a download-manifest itms-services://…

  • CVE-2013-1024Jun 5, 2013
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    CoreMedia Playback in Apple Mac OS X before 10.8.4 does not properly initialize memory during the processing of text tracks, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.

  • CVE-2013-1023Jun 5, 2013
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple Safari before 6.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2013-1009.

  • CVE-2013-1013Jun 5, 2013
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    XSS Auditor in WebKit in Apple Safari before 6.0.5 does not properly rewrite URLs, which allows remote attackers to trigger unintended form submissions via unspecified vectors.

  • CVE-2013-1012Jun 5, 2013
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 6.0.5 allows remote attackers to inject arbitrary web script or HTML via vectors involving IFRAME elements.

  • CVE-2013-1009Jun 5, 2013
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple Safari before 6.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2013-1023.

  • CVE-2013-0990Jun 5, 2013
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    SMB in Apple Mac OS X before 10.8.4, when file sharing is enabled, allows remote authenticated users to create or modify files outside of a shared directory via unspecified vectors.

  • CVE-2013-0985Jun 5, 2013
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Disk Management in Apple Mac OS X before 10.8.4 does not properly authenticate attempts to disable FileVault, which allows local users to cause a denial of service (loss of encryption functionality) via an unspecified command line.

  • CVE-2013-0984Jun 5, 2013
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.14

    Directory Service in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted message.

  • CVE-2013-0983Jun 5, 2013
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Stack consumption vulnerability in CoreAnimation in Apple Mac OS X before 10.8.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted text glyph in a URL encountered by Safari.

  • CVE-2013-0982Jun 5, 2013
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    The Private Browsing feature in CFNetwork in Apple Mac OS X before 10.8.4 does not prevent storage of permanent cookies upon exit from Safari, which might allow physically proximate attackers to bypass cookie-based authentication by leveraging an unattended workstation.

  • CVE-2013-0975Jun 5, 2013
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Buffer overflow in QuickDraw Manager in Apple Mac OS X before 10.8.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image.

  • CVE-2013-3475Jun 5, 2013
    IBM
    Db2
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in db2aud in the Audit Facility in IBM DB2 and DB2 Connect 9.1, 9.5, 9.7, 9.8, and 10.1, as used in Smart Analytics System 7600 and other products, allows local users to gain privileges via unspecified vectors.

  • CVE-2013-0509Jun 5, 2013
    IBM
    Tivoli Netcool System Service Monitors
    risk 0.01cvss —epss 0.07

    Buffer overflow in the Transaction MIB agent in IBM Tivoli Netcool System Service Monitors (SSM) and Application Service Monitors (ASM) 4.0.0 before FP14 allows remote attackers to execute arbitrary code via a SQL transaction with a long table name that is not properly handled…

  • CVE-2013-0508Jun 5, 2013
    IBM
    Tivoli Netcool System Service Monitors
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in IBM Tivoli Netcool System Service Monitors (SSM) and Application Service Monitors (ASM) 4.0.0 before FP14 and 4.0.1 before FP1 allow context-dependent attackers to execute arbitrary code or cause a denial of service via a long line in (1)…

  • CVE-2013-2865Jun 5, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Google Chrome before 27.0.1453.110 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

  • CVE-2013-2864Jun 5, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The PDF functionality in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via unknown vectors.

  • CVE-2013-2863Jun 5, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.04

    Google Chrome before 27.0.1453.110 does not properly handle SSL sockets, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2013-2862Jun 5, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Skia, as used in Google Chrome before 27.0.1453.110, does not properly handle GPU acceleration, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

  • CVE-2013-2861Jun 5, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in the SVG implementation in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2013-2860Jun 5, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving access to a database API by a worker process.

  • CVE-2013-2859Jun 5, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 27.0.1453.110 allows remote attackers to bypass the Same Origin Policy and trigger namespace pollution via unspecified vectors.

  • CVE-2013-2858Jun 5, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in the HTML5 Audio implementation in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2013-2857Jun 5, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of images.

  • CVE-2013-2856Jun 5, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of input.

  • CVE-2013-2855Jun 5, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The Developer Tools API in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

  • CVE-2013-2854Jun 5, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 27.0.1453.110 on Windows provides an incorrect handle to a renderer process in unspecified circumstances, which allows remote attackers to cause a denial of service or possibly have other impact via unknown vectors.

  • CVE-2013-2970Jun 3, 2013
    IBM
    Qradar Security Information And Event Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in IBM QRadar Security Information and Event Manager (SIEM) 7.x before 7.1 MR2 Patch 1 allows remote authenticated users to execute operating-system commands via unknown vectors.

  • CVE-2013-2317Jun 3, 2013
    Fenrir Inc
    Sleipnir Mobile
    risk 0.00cvss —epss 0.02

    The Sleipnir Mobile application 2.9.1 and earlier and Sleipnir Mobile Black Edition application 2.9.1 and earlier for Android allow remote attackers to spoof the address bar via vectors involving the opening of a new window.

  • CVE-2013-2316Jun 3, 2013
    Yahoo
    Yahoo\! Browser
    risk 0.00cvss —epss 0.02

    The Yahoo! Browser application 1.4.4 and earlier for Android allows remote attackers to spoof the address bar via vectors related to URL display, a different vulnerability than CVE-2013-2307.

  • CVE-2013-0464Jun 3, 2013
    IBM
    Spss Data Collection
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in IBM Eclipse Help System (IEHS) 3.4.3 and 3.6.2, as used in IBM SPSS Data Collection 6.0, 6.0.1, and 7.0, allow remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2013-2950Jun 3, 2013
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in IBM WebSphere Portal 6.1.0.x before 6.1.0.3 CF26, 6.1.5.x before 6.1.5 CF26, 7.0.0.x before 7.0.0.2 CF21, and 8.0.0.x through 8.0.0.1 CF5, when home substitution (aka uri.home.substitution) is enabled, allows remote authenticated users to inject…

  • CVE-2013-0549Jun 3, 2013
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Web Content Manager - Web Content Viewer Portlet in the server in IBM WebSphere Portal 7.0.0.x through 7.0.0.2 CF22 and 8.0.0.x through 8.0.0.1 CF5, when the IBM Portlet API is used, allows remote attackers to inject arbitrary web…

  • CVE-2013-3261Jun 1, 2013
    Codeasily
    Grand Flagallery
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in a flag-manage-gallery action.

  • CVE-2013-2071Jun 1, 2013
    Apache
    Tomcat
    risk 0.01cvss —epss 0.07

    java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for…

  • CVE-2013-2067Jun 1, 2013
    Apache
    Tomcat
    risk 0.01cvss —epss 0.07

    java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote…

  • CVE-2013-0136Jun 1, 2013
    Mutiny
    Mutiny
    risk 0.06cvss —epss 0.40

    Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1)…

  • CVE-2012-3544Jun 1, 2013
    Apache
    Tomcat
    risk 0.01cvss —epss 0.11

    Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.

  • CVE-2013-3735HigMay 31, 2013
    PHP
    PHP
    risk 0.42cvss 7.5epss 0.03

    The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted function definition, as…

  • CVE-2013-3315May 31, 2013
    TIBCO Software
    Silver Mobile
    risk 0.00cvss —epss 0.01

    The server in TIBCO Silver Mobile 1.1.0 does not properly verify access to the administrator role before executing a command, which allows authenticated users to gain privileges via unspecified vectors.

  • CVE-2013-1247May 31, 2013
    Cisco Systems, Inc.
    Prime Infrastructure
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the wireless configuration module in Cisco Prime Infrastructure allows remote attackers to inject arbitrary web script or HTML via an SSID that is not properly handled during display of the XML windowing table, aka Bug ID CSCuf04356.

  • CVE-2013-1246May 31, 2013
    Cisco Systems, Inc.
    Telepresence System Software
    risk 0.00cvss —epss 0.02

    Cisco TelePresence System Software does not properly handle inactive t-shell sessions, which allows remote authenticated users to cause a denial of service (memory consumption and service outage) by establishing multiple SSH connections, aka Bug ID CSCug77610.

  • CVE-2013-3721May 31, 2013
    Psychostats
    Psychostats
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in awards.php in PsychoStats 3.2.2b allows remote attackers to execute arbitrary SQL commands via the d parameter.