VYPR

CVEs

387,212 total · page 6626 of 7,745

AllCriticalHighKEV
  • CVE-2013-2315May 29, 2013
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.01

    data/class/pages/forgot/LC_Page_Forgot.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 does not properly validate the input to the password reminder function, which allows remote attackers to obtain sensitive information via a crafted request.

  • CVE-2013-2314May 29, 2013
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the adminAuthorization function in data/class/helper/SC_Helper_Session.php in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL associated with the management…

  • CVE-2013-2313May 29, 2013
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.02

    Session fixation vulnerability in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to hijack web sessions via unspecified vectors.

  • CVE-2013-2312May 29, 2013
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the shopping-cart screen in LOCKON EC-CUBE 2.11.0 through 2.12.3enP2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2013-1213May 29, 2013
    Cisco Systems, Inc.
    Nexus 1000v
    risk 0.00cvss —epss 0.02

    Cisco NX-OS on the Nexus 1000V does not assign the proper priority to heartbeat messages from a Virtual Ethernet Module (VEM) to a Virtual Supervisor Module (VSM), which allows remote attackers to cause a denial of service (false VEM unavailability report) via a flood of UDP…

  • CVE-2013-1212May 29, 2013
    Cisco Systems, Inc.
    Nexus 1000v
    risk 0.00cvss —epss 0.01

    The SSL functionality in Cisco NX-OS on the Nexus 1000V does not properly verify X.509 certificates, which allows man-in-the-middle attackers to spoof servers, and intercept or modify Virtual Supervisor Module (VSM) to VMware vCenter communication, via a crafted certificate, aka…

  • CVE-2013-1211May 29, 2013
    Cisco Systems, Inc.
    Nx OS
    risk 0.00cvss —epss 0.02

    Cisco NX-OS on the Nexus 1000V does not properly handle authentication for Virtual Ethernet Module (VEM) to Virtual Supervisor Module (VSM) communication, which allows remote attackers to obtain VEM access via (1) spoofed STUN packets or (2) a crafted VMware ESXi instance, aka…

  • CVE-2013-1210May 29, 2013
    Cisco Systems, Inc.
    Nx OS
    risk 0.00cvss —epss 0.02

    Array index error in the Virtual Ethernet Module (VEM) kernel driver for VMware ESXi in Cisco NX-OS on the Nexus 1000V, when STUN debugging is enabled, allows remote attackers to cause a denial of service (ESXi crash and purple screen of death) by sending crafted STUN packets to…

  • CVE-2013-1209May 29, 2013
    Cisco Systems, Inc.
    Nexus 1000v
    risk 0.00cvss —epss 0.01

    The encryption functionality in the Virtual Supervisor Module (VSM) to Virtual Ethernet Module (VEM) communication component in Cisco NX-OS on the Nexus 1000V does not properly authenticate VSM/VEM packets, which allows remote attackers to disable packet-level encryption and…

  • CVE-2013-1208May 29, 2013
    Cisco Systems, Inc.
    Nexus 1000v
    risk 0.00cvss —epss 0.01

    The encryption functionality in Cisco NX-OS on the Nexus 1000V does not properly handle Virtual Supervisor Module (VSM) to Virtual Ethernet Module (VEM) communication, which allows remote attackers to intercept or modify network traffic by leveraging certain Layer 2 or Layer 3…

  • CVE-2013-3666May 29, 2013
    LG
    Optimus G E973
    risk 0.00cvss —epss 0.00

    The LG Hidden Menu component for Android on the LG Optimus G E973 allows physically proximate attackers to execute arbitrary commands by entering USB Debugging mode, using Android Debug Bridge (adb) to establish a USB connection, dialing 3845#*973#, modifying the WLAN Test Wi-Fi…

  • CVE-2013-0482May 29, 2013
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 through 8.5.0.2 and WebSphere Message Broker 6.1, 7.0 through 7.0.0.5, and 8.0 through 8.0.0.2, when WS-Security is used, allows remote attackers to spoof the signatures of messages via a…

  • CVE-2002-2443May 29, 2013
    Mit
    Kerberos 5
    risk 0.00cvss —epss 0.06

    schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a…

  • CVE-2013-2069May 29, 2013
    Red Hat
    Livecd Tools
    risk 0.00cvss —epss 0.00

    Red Hat livecd-tools before 13.4.4, 17.x before 17.17, 18.x before 18.16, and 19.x before 19.3, when a rootpw directive is not set in a Kickstart file, sets the root user password to empty, which allows local users to gain privileges.

  • CVE-2013-1962May 29, 2013
    Libvirt
    Libvirt
    risk 0.00cvss —epss 0.04

    The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1.0.5 allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of requests "to list all volumes for the particular pool."

  • CVE-2013-2989May 28, 2013
    IBM
    Sterling Connect\
    risk 0.00cvss —epss 0.00

    The file-copying functionality in IBM Sterling Connect:Direct 3.8.00, 4.0.00, and 4.1.0 for UNIX on AIX 6.1 through 7.1 uses incorrect privileges, which allows local users to bypass filesystem read permissions and write permissions by leveraging authentication to the…

  • CVE-2013-0599May 28, 2013
    IBM
    Rational Directory Server
    risk 0.00cvss —epss 0.02

    IBM Eclipse Help System (IEHS), as used in IBM Rational Directory Server 5.1.1 through 5.1.1.2 and 5.2 through 5.2.1 and other products, allows remote attackers to obtain sensitive information by providing a crafted parameter path and then reading the debug information…

  • CVE-2013-0499May 28, 2013
    IBM
    Websphere Datapower Soa Appliance
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall,…

  • CVE-2013-0576May 28, 2013
    IBM
    Tivoli Monitoring
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Tivoli Enterprise Portal browser client in IBM Tivoli Monitoring 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, and 6.2.3 through FP02 allows remote attackers to inject arbitrary web script or HTML via unspecified…

  • CVE-2013-2959May 27, 2013
    IBM
    Infosphere Optim Data Growth For Oracle E Business Suite
    risk 0.00cvss —epss 0.01

    The Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 does not provide an encrypted session for transmitting login credentials, which allows remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2013-2957May 27, 2013
    IBM
    Infosphere Optim Data Growth For Oracle E Business Suite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2013-2956May 27, 2013
    IBM
    Infosphere Optim Data Growth For Oracle E Business Suite
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2013-2955May 27, 2013
    IBM
    Infosphere Optim Data Growth For Oracle E Business Suite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, related to a stored XSS issue.

  • CVE-2013-2954May 27, 2013
    IBM
    Infosphere Optim Data Growth For Oracle E Business Suite
    risk 0.00cvss —epss 0.01

    The login page in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 does not limit the number of incorrect authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.

  • CVE-2013-2953May 27, 2013
    IBM
    Infosphere Optim Data Growth For Oracle E Business Suite
    risk 0.00cvss —epss 0.00

    IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 relies on the MD5 algorithm for signatures in X.509 certificates, which makes it easier for man-in-the-middle attackers to spoof SSL servers via a crafted certificate.

  • CVE-2012-6399May 27, 2013
    Cisco Systems, Inc.
    Webex
    risk 0.00cvss —epss 0.01

    Cisco WebEx 4.1 on iOS does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, aka Bug ID…

  • CVE-2013-3562May 25, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Multiple integer signedness errors in the tvb_unmasked function in epan/dissectors/packet-websocket.c in the Websocket dissector in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (application crash) via a malformed packet.

  • CVE-2013-3561May 25, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    Multiple integer overflows in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (loop or application crash) via a malformed packet, related to a crash of the Websocket dissector, an infinite loop in the MySQL dissector, and a large loop in the ETCH…

  • CVE-2013-3560May 25, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The dissect_dsmcc_un_download function in epan/dissectors/packet-mpeg-dsmcc.c in the MPEG DSM-CC dissector in Wireshark 1.8.x before 1.8.7 uses an incorrect format string, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.

  • CVE-2013-3559May 25, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.8.x before 1.8.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (integer overflow, and heap memory corruption or NULL pointer dereference, and application…

  • CVE-2013-3558May 25, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The dissect_ccp_bsdcomp_opt function in epan/dissectors/packet-ppp.c in the PPP CCP dissector in Wireshark 1.8.x before 1.8.7 does not terminate a bit-field list, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.

  • CVE-2013-3557May 25, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_ber_choice function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.6.x before 1.6.15 and 1.8.x before 1.8.7 does not properly initialize a certain variable, which allows remote attackers to cause a denial of service (application crash) via…

  • CVE-2013-3556May 25, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The fragment_add_seq_common function in epan/reassemble.c in the ASN.1 BER dissector in Wireshark before r48943 has an incorrect pointer dereference during a comparison, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.

  • CVE-2013-3555May 25, 2013
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    epan/dissectors/packet-gtpv2.c in the GTPv2 dissector in Wireshark 1.8.x before 1.8.7 calls incorrect functions in certain contexts related to ciphers, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.

  • CVE-2013-2083May 25, 2013
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    The MoodleQuickForm class in lib/formslib.php in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted…

  • CVE-2013-2082May 25, 2013
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.

  • CVE-2013-2081May 25, 2013
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.

  • CVE-2013-2080May 25, 2013
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the…

  • CVE-2013-2079May 25, 2013
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP assignment-archive download (aka downloadall) requests, which allows remote authenticated users to read…

  • CVE-2013-3661May 24, 2013
    Microsoft
    Windows
    risk 0.03cvss —epss 0.04

    The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not check whether linked-list traversal is…

  • CVE-2013-3660HigKEVMay 24, 2013
    Microsoft
    Windows
    risk 0.69cvss 7.8epss 0.39

    The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a…

  • CVE-2013-3634May 24, 2013
    Siemens Foundation
    SCALANCE X-200IRT
    risk 0.00cvss —epss 0.01

    A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (Versions < V5.0.0 for CVE-2013-3633 and versions < V4.5.0 for CVE-2013-3634), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.1.0). The implementation…

  • CVE-2013-3633May 24, 2013
    Siemens Foundation
    SCALANCE X-200IRT
    risk 0.00cvss —epss 0.01

    A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (Versions < V5.0.0 for CVE-2013-3633 and versions < V4.5.0 for CVE-2013-3634), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.1.0). The user privileges…

  • CVE-2013-1022May 24, 2013
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted mvhd atoms in a movie file.

  • CVE-2013-1021May 24, 2013
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.04

    Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JPEG data in a movie file.

  • CVE-2013-1020May 24, 2013
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.03

    Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JPEG data in a movie file.

  • CVE-2013-1019May 24, 2013
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.06

    Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with Sorenson encoding.

  • CVE-2013-1018May 24, 2013
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.264 encoding.

  • CVE-2013-1017May 24, 2013
    Apple Inc.
    Quicktime
    risk 0.06cvss —epss 0.33

    Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted dref atoms in a movie file.

  • CVE-2013-1016May 24, 2013
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.263 encoding.