VYPR

CVEs

387,103 total · page 6630 of 7,743

AllCriticalHighKEV
  • CVE-2013-0535May 2, 2013
    IBM
    Sametime
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-2944May 2, 2013
    Strongswan
    Strongswan
    risk 0.00cvss —epss 0.02

    strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature.

  • CVE-2013-1884May 2, 2013
    Apache
    Subversion
    risk 0.07cvss —epss 0.51

    The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.

  • CVE-2013-1849May 2, 2013
    Apache
    Subversion
    risk 0.01cvss —epss 0.09

    The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.

  • CVE-2013-1847May 2, 2013
    Apache
    Subversion
    risk 0.07cvss —epss 0.51

    The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.

  • CVE-2013-1846May 2, 2013
    Apache
    Subversion
    risk 0.01cvss —epss 0.07

    The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL.

  • CVE-2013-1845May 2, 2013
    Apache
    Subversion
    risk 0.00cvss —epss 0.06

    The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.

  • CVE-2013-0306May 2, 2013
    Djangoproject
    Django
    risk 0.00cvss —epss 0.03

    The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num…

  • CVE-2013-0305May 2, 2013
    Djangoproject
    Django
    risk 0.00cvss —epss 0.02

    The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.

  • CVE-2012-5657May 2, 2013
    Zend
    Framework
    risk 0.00cvss —epss 0.02

    The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory…

  • CVE-2012-4481May 2, 2013
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.02

    The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to_s method when operating on Ruby objects. NOTE: this issue is due to an incomplete fix for CVE-2011-1005.

  • CVE-2012-0864May 2, 2013
    glibc
    glibc
    risk 0.00cvss —epss 0.03

    Integer overflow in the vfprintf function in stdio-common/vfprintf.c in glibc 2.14 and other versions allows context-dependent attackers to bypass the FORTIFY_SOURCE protection mechanism, conduct format string attacks, and write to arbitrary memory via a large number of…

  • CVE-2011-4609May 2, 2013
    glibc
    glibc
    risk 0.00cvss —epss 0.02

    The svc_run function in the RPC implementation in glibc before 2.15 allows remote attackers to cause a denial of service (CPU consumption) via a large number of RPC connections.

  • CVE-2009-5029May 2, 2013
    glibc
    glibc
    risk 0.04cvss —epss 0.08

    Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezone (TZ) file, as demonstrated using vsftpd.

  • CVE-2013-3266May 2, 2013
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.04

    The nfsrvd_readdir function in sys/fs/nfsserver/nfs_nfsdport.c in the new NFS server in FreeBSD 8.0 through 9.1-RELEASE-p3 does not verify that a READDIR request is for a directory node, which allows remote attackers to cause a denial of service (memory corruption) or possibly…

  • CVE-2009-5135May 2, 2013
    Nextapp
    Echo
    risk 0.04cvss —epss 0.10

    The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

  • CVE-2013-2321May 2, 2013
    Microfocus
    Service Manager Web Tier
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in HP Service Manager Web Tier 9.31 before 9.31.2004 p2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-1338May 2, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.21

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than…

  • CVE-2012-5222May 2, 2013
    Microfocus
    Service Manager Web Tier
    risk 0.00cvss —epss 0.02

    HP Service Manager Web Tier 9.31 before 9.31.2004 p2 allows remote attackers to obtain sensitive information via unspecified vectors.

  • CVE-2013-3107May 1, 2013
    VMware
    Vcenter Server
    risk 0.00cvss —epss 0.02

    VMware vCenter Server 5.1 before Update 1, when anonymous LDAP binding for Active Directory is enabled, allows remote attackers to bypass authentication by providing a valid username in conjunction with an empty password.

  • CVE-2013-3080May 1, 2013
    VMware
    Vcenter Server Appliance
    risk 0.00cvss —epss 0.02

    VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated users to create or overwrite arbitrary files, and consequently execute arbitrary code or cause a denial of service, by leveraging Virtual Appliance Management Interface (VAMI) web-interface…

  • CVE-2013-3079May 1, 2013
    VMware
    Vcenter Server Appliance
    risk 0.00cvss —epss 0.02

    VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated users to execute arbitrary programs with root privileges by leveraging Virtual Appliance Management Interface (VAMI) access.

  • CVE-2013-3063May 1, 2013
    SAP
    Basis Communication Services
    risk 0.00cvss —epss 0.01

    SAP BASIS Communication Services 4.6B through 7.30 allows remote authenticated users to execute arbitrary commands via unspecified vectors.

  • CVE-2013-3062May 1, 2013
    SAP
    Production Planning And Control
    risk 0.00cvss —epss 0.02

    The CP_RC_TRANSACTION_CALL_BY_SET function in the Engineering Workbench component in SAP Production Planning and Control allows remote authenticated users to bypass intended transaction restrictions via unspecified vectors.

  • CVE-2013-3061May 1, 2013
    SAP
    ERP Central Component
    risk 0.00cvss —epss 0.02

    The ISHMED-PATRED_TRANSACT_RFCCALL function in the IS-H Industry-Specific Component Hospital subsystem in SAP Healthcare Industry Solution, and the SAP ERP central component (aka ECC 6), allows remote authenticated users to bypass intended transaction restrictions via…

  • CVE-2013-1230May 1, 2013
    Cisco Systems, Inc.
    Unified Communications Domain Manager
    risk 0.00cvss —epss 0.01

    Cisco Unified Communications Domain Manager allows remote attackers to cause a denial of service (CPU consumption) via a flood of malformed UDP packets, aka Bug ID CSCug47057.

  • CVE-2013-1229May 1, 2013
    Cisco Systems, Inc.
    Telepresence Management Suite
    risk 0.00cvss —epss 0.01

    TMSSNMPService.exe in TelePresence Manager in Cisco TelePresence Management Suite (TMS) on 64-bit platforms allows remote attackers to cause a denial of service (process crash) via SNMP traps, aka Bug ID CSCue00028.

  • CVE-2013-1160May 1, 2013
    Cisco Systems, Inc.
    Prime Central For Hosted Collaboration Solution
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the OpenView web menus in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud56743.

  • CVE-2013-1159May 1, 2013
    Cisco Systems, Inc.
    Prime Central For Hosted Collaboration Solution
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Netcool Impact (NCI) web menus in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud56706.

  • CVE-2013-1158May 1, 2013
    Cisco Systems, Inc.
    Prime Central For Hosted Collaboration Solution
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the IBM Tivoli Monitoring (ITM) help menus in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud54397.

  • CVE-2013-1157May 1, 2013
    Cisco Systems, Inc.
    Prime Central For Hosted Collaboration Solution
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the IBM Tivoli Monitoring (ITM) Java servlet container in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud51068.

  • CVE-2013-1156May 1, 2013
    Cisco Systems, Inc.
    Prime Central For Hosted Collaboration Solution
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to read arbitrary files via a crafted URL, aka Bug ID CSCud51034.

  • CVE-2013-0699May 1, 2013
    Galilmc
    Rio 47100 Plc
    risk 0.03cvss —epss 0.03

    The Galil RIO-47100 Pocket PLC allows remote attackers to cause a denial of service via a session that includes "repeated requests."

  • CVE-2013-0673May 1, 2013
    Matrikonopc
    A&E Historian
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the web interface in the Health Monitor service in MatrikonOPC A&E Historian 1.0.0.0 allows remote attackers to read and delete arbitrary files via a crafted URL.

  • CVE-2013-0666May 1, 2013
    Matrikonopc
    Matrikonopc Security Gateway
    risk 0.00cvss —epss 0.01

    The configuration utility in MatrikonOPC Security Gateway 1.0 allows remote attackers to cause a denial of service (unhandled exception and application crash) via a TCP RST packet.

  • CVE-2013-0538May 1, 2013
    IBM
    Lotus Notes
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 allows remote attackers to inject arbitrary web script or HTML via a SCRIPT element in an HTML e-mail message, aka SPRs JMOY95BLM6 and JMOY95BN49.

  • CVE-2013-0141May 1, 2013
    McAfee
    Epolicy Orchestrator
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to upload arbitrary files via a crafted request over the Agent-Server communication channel, as demonstrated by writing to the Software/ directory.

  • CVE-2013-0140May 1, 2013
    McAfee
    Epolicy Orchestrator
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel.

  • CVE-2013-0127May 1, 2013
    IBM
    Lotus Notes
    risk 0.00cvss —epss 0.04

    IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 does not block APPLET elements in HTML e-mail, which allows remote attackers to bypass intended restrictions on Java code execution and X-Confirm-Reading-To functionality via a crafted message, aka…

  • CVE-2012-4952May 1, 2013
    Dentrix
    G5
    risk 0.00cvss —epss 0.02

    Henry Schein Dentrix G5 before 15.1.294 has a single internal-database password that is shared across different customers' installations, which allows remote attackers to obtain sensitive information about patients by leveraging knowledge of this password from another…

  • CVE-2012-5947Apr 30, 2013
    IBM
    Spss Samplepower
    risk 0.00cvss —epss 0.04

    Buffer overflow in the vsflex7l ActiveX control in IBM SPSS SamplePower 3.0 before FP1 allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2012-5946Apr 30, 2013
    IBM
    Spss Samplepower
    risk 0.06cvss —epss 0.34

    Buffer overflow in the c1sizer ActiveX control in C1sizer.ocx in IBM SPSS SamplePower 3.0 before FP1 allows remote attackers to execute arbitrary code via a long TabCaption string.

  • CVE-2012-5945Apr 30, 2013
    IBM
    Spss Samplepower
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in the Vsflex8l ActiveX control in IBM SPSS SamplePower 3.0 before FP1 allow remote attackers to execute arbitrary code via a long (1) ComboList or (2) ColComboList property value.

  • CVE-2013-1944Apr 29, 2013
    Curl
    Curl
    risk 0.00cvss —epss 0.04

    The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.

  • CVE-2013-1927Apr 29, 2013
    IcedTea
    IcedTea-Web
    risk 0.00cvss —epss 0.04

    The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to execute arbitrary code via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR."

  • CVE-2013-1926Apr 29, 2013
    IcedTea
    IcedTea-Web
    risk 0.00cvss —epss 0.02

    The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.

  • CVE-2013-1914Apr 29, 2013
    GNU
    Glibc
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.17 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of domain…

  • CVE-2013-1196Apr 29, 2013
    Cisco Systems, Inc.
    Application Networking Manager
    risk 0.00cvss —epss 0.00

    The command-line interface in Cisco Secure Access Control System (ACS), Identity Services Engine Software, Context Directory Agent, Application Networking Manager (ANM), Prime Network Control System, Prime LAN Management Solution (LMS), Prime Collaboration, Unified Provisioning…

  • CVE-2012-5221Apr 29, 2013
    Microfocus
    Laserjet Enterprise P3015
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in the PostScript Interpreter, as used on the HP LaserJet 4xxx, 5200, 90xx, M30xx, M4345, M50xx, M90xx, P3005, and P4xxx; LaserJet Enterprise P3015; Color LaserJet 3xxx, 47xx, 5550, 9500, CM60xx, CP35xx, CP4005, and CP6015; Color LaserJet…

  • CVE-2013-3302Apr 29, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Race condition in the smb_send_rqst function in fs/cifs/transport.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via vectors involving a reconnection event.