VYPR

CVEs

387,099 total · page 6631 of 7,742

AllCriticalHighKEV
  • CVE-2013-1226Apr 29, 2013
    Cisco Systems, Inc.
    Nexus 7000
    risk 0.00cvss —epss 0.01

    The Ethernet frame-forwarding implementation in Cisco NX-OS on Nexus 7000 devices allows remote attackers to cause a denial of service (forwarding loop and service outage) via a crafted frame, aka Bug ID CSCug47098.

  • CVE-2013-1219Apr 29, 2013
    Cisco Systems, Inc.
    Intrusion Prevention System
    risk 0.00cvss —epss 0.00

    SensorApp in Cisco Intrusion Prevention System (IPS) allows local users to cause a denial of service (Regex hardware job failure and application hang) via a (1) initiate signature upgrade, (2) initiate global correlation, (3) show statistics anomaly-detection, or (4) clear…

  • CVE-2013-1216Apr 29, 2013
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.01

    Memory leak in the SNMP module in Cisco IOS XR allows remote authenticated users to cause a denial of service (memory consumption and process restart) via crafted SNMP packets, aka Bug ID CSCue31546.

  • CVE-2013-1198Apr 29, 2013
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in a Flash component in Cisco Unified Computing System (UCS) Central allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCud15430.

  • CVE-2013-0553Apr 28, 2013
    IBM
    Sametime
    risk 0.00cvss —epss 0.01

    The client implementation in IBM Sametime 8.5.1 through 8.5.2.1, as used in Sametime Connect client, Sametime Advanced Connect client, Sametime Advanced Web client, and other products, allows remote authenticated users to send commands to individual chat users, or to all…

  • CVE-2013-0533Apr 28, 2013
    IBM
    Sametime
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Sametime Links server in IBM Sametime 8.0.2 through 8.5.2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-5219Apr 28, 2013
    Microfocus
    Managed Printing Administration
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in HP Managed Printing Administration (MPA) before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-0593Apr 27, 2013
    IBM
    Spss Samplepower
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the olch2x32 ActiveX control in IBM SPSS SamplePower 3.0 before 3.0-IM-S3SAMPC-WIN32-FP001 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2013-0572Apr 27, 2013
    IBM
    Application Support Facility
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Document Connect for Application Support Facility (aka DC4ASF) before 1.0.0.1218 in Application Support Facility (ASF) 3.4 for z/OS on Windows, Linux, and AIX allows remote authenticated users to inject content, and conduct…

  • CVE-2013-0571Apr 27, 2013
    IBM
    Application Support Facility
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Document Connect for Application Support Facility (aka DC4ASF) before 1.0.0.1218 in Application Support Facility (ASF) 3.4 for z/OS on Windows, Linux, and AIX allows remote attackers to inject arbitrary web script or HTML via a…

  • CVE-2013-0569Apr 27, 2013
    IBM
    Connections
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Communities component in IBM Connections 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-1428Apr 26, 2013
    Tinc
    Tinc
    risk 0.01cvss —epss 0.61

    Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or possibly execute arbitrary code via a large TCP packet.

  • CVE-2013-2709Apr 26, 2013
    Crunchify
    Foursquare Checkins
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the FourSquare Checkins plugin before 1.3 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

  • CVE-2013-2307Apr 26, 2013
    Yahoo
    Yahoo\! Browser
    risk 0.00cvss —epss 0.01

    The Yahoo! Browser application before 1.4.3 for Android allows remote attackers to spoof the address bar via a crafted web site.

  • CVE-2013-2306Apr 26, 2013
    Jig
    Jigbrowser\+
    risk 0.00cvss —epss 0.01

    The jigbrowser+ application before 1.6.4 for Android does not properly open windows, which allows remote attackers to spoof the address bar via a crafted web site.

  • CVE-2013-0727Apr 26, 2013
    Global Mapper
    Global Mapper
    risk 0.00cvss —epss 0.00

    Multiple untrusted search path vulnerabilities in Global Mapper 14.1.0 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2) ibfs32.dll file in the current working directory, as demonstrated by a directory that contains a .gmc, .gmg, .gmp, .gms, .gmw, or…

  • CVE-2012-5220Apr 26, 2013
    Microfocus
    Storage Data Protector
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows local users to gain privileges via unknown vectors.

  • CVE-2013-3241Apr 26, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.03cvss —epss 0.04

    export.php (aka the export script) in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the contents of the POST superglobal array, which allows remote authenticated users to inject values via a crafted request.

  • CVE-2013-3240Apr 26, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.03cvss —epss 0.05

    Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a parameter that specifies a crafted export type.

  • CVE-2013-3239Apr 26, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.09

    phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file…

  • CVE-2013-3238Apr 26, 2013
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.29

    phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a preg_replace function call within the "Replace table prefix" feature.

  • CVE-2013-1969Apr 25, 2013
    Xmlsoft
    Libxml2
    risk 0.00cvss —epss 0.04

    Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to the (1) htmlParseChunk and (2) xmldecl_done functions, as…

  • CVE-2013-1949Apr 25, 2013
    WordPress
    Social Media Widget
    risk 0.00cvss —epss 0.02

    Social Media Widget (social-media-widget) plugin 4.0 for WordPress contains an externally introduced modification (Trojan Horse), which allows remote attackers to force the upload of arbitrary files.

  • CVE-2013-1948Apr 25, 2013
    Rob Westgeest
    Md2pdf
    risk 0.00cvss —epss 0.02

    converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.

  • CVE-2013-1947Apr 25, 2013
    Kelly D. Redding
    Kelredd Pruview
    risk 0.00cvss —epss 0.02

    kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.

  • CVE-2013-1933Apr 25, 2013
    Documentcloud
    Karteek Docsplit
    risk 0.00cvss —epss 0.02

    The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.

  • CVE-2013-1915Apr 25, 2013
    Trustwave
    Modsecurity
    risk 0.00cvss —epss 0.04

    ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity…

  • CVE-2013-0338Apr 25, 2013
    Xmlsoft
    Libxml2
    risk 0.00cvss —epss 0.03

    libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear…

  • CVE-2013-0233Apr 25, 2013
    Heartcombo
    Devise
    risk 0.04cvss —epss 0.14

    Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be…

  • CVE-2013-0175Apr 25, 2013
    Grape Project
    Grape
    risk 0.00cvss —epss 0.04

    multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU…

  • CVE-2012-4466Apr 25, 2013
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.03

    Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a…

  • CVE-2012-4464Apr 25, 2013
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.02

    Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the (1) exc_to_s or (2) name_err_to_s API function, which marks the string as tainted, a different vulnerability…

  • CVE-2013-2767Apr 25, 2013
    Citrix Systems
    Access Gateway
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Citrix NetScaler Access Gateway Enterprise Edition (AGEE) before 9.3.62.4 and 10.x through 10.0.74.4, and NetScaler AGEE Common Criteria build before 9.3.53.6, allows remote attackers to bypass intended intranet access restrictions via unknown…

  • CVE-2013-2696Apr 25, 2013
    WordPress
    All in One Webmaster
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the All in One Webmaster plugin before 8.2.4 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

  • CVE-2013-1215Apr 25, 2013
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.00

    The vpnclient program in the Easy VPN component on Cisco Adaptive Security Appliances (ASA) 5505 devices allows local users to gain privileges via unspecified vectors, aka Bug ID CSCuf85295.

  • CVE-2013-3269Apr 25, 2013
    Cybozu
    Office
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0 allows remote attackers to hijack the authentication of arbitrary users for requests that change mobile passwords, a different vulnerability than CVE-2013-2305.

  • CVE-2013-2305Apr 25, 2013
    Cybozu
    Mailwise
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0, Cybozu Dezie before 8.0.7, and Cybozu Mailwise before 5.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords.

  • CVE-2013-1192Apr 25, 2013
    Cisco Systems, Inc.
    Mds 9000
    risk 0.00cvss —epss 0.02

    The JAR files on Cisco Device Manager for Cisco MDS 9000 devices before 5.2.8, and Cisco Device Manager for Cisco Nexus 5000 devices, allow remote attackers to execute arbitrary commands on Windows client machines via a crafted element-manager.jnlp file, aka Bug IDs CSCty17417…

  • CVE-2013-1186Apr 25, 2013
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.02

    Cisco Unified Computing System (UCS) 1.x before 1.4(4) and 2.x before 2.0(2m) allows remote attackers to bypass KVM authentication via a crafted authentication request to a Cisco Integrated Management Controller (IMC), aka Bug ID CSCts53746.

  • CVE-2013-1185Apr 25, 2013
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.02

    The web interface in the Manager component in Cisco Unified Computing System (UCS) 1.x and 2.x before 2.0(2m) allows remote attackers to obtain sensitive information by reading a (1) technical-support bundle file or (2) on-device configuration backup, aka Bug ID CSCtq86543.

  • CVE-2013-1184Apr 25, 2013
    Cisco Systems, Inc.
    Unified Computing System Infrastructure And Unified Computing System Software
    risk 0.00cvss —epss 0.01

    The management API in the XML API management service in the Manager component in Cisco Unified Computing System (UCS) 1.x before 1.2(1b) allows remote attackers to cause a denial of service (service outage) via a malformed request, aka Bug ID CSCtg48206.

  • CVE-2013-1183Apr 25, 2013
    Cisco Systems, Inc.
    Unified Computing System Infrastructure And Unified Computing System Software
    risk 0.00cvss —epss 0.04

    Buffer overflow in the Intelligent Platform Management Interface (IPMI) functionality in the Manager component in Cisco Unified Computing System (UCS) 1.0 and 1.1 before 1.1(1j) and 1.2 before 1.2(1b) allows remote attackers to execute arbitrary code via malformed data in a UDP…

  • CVE-2013-1182Apr 25, 2013
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.04

    The login page in the Web Console in the Manager component in Cisco Unified Computing System (UCS) before 1.0(2h), 1.1 before 1.1(1j), and 1.3(x) allows remote attackers to bypass LDAP authentication via a malformed request, aka Bug ID CSCtc91207.

  • CVE-2013-1181Apr 25, 2013
    Cisco Systems, Inc.
    Nx OS
    risk 0.00cvss —epss 0.02

    Cisco NX-OS on Nexus 5500 devices 4.x and 5.x before 5.0(3)N2(2), Nexus 3000 devices 5.x before 5.0(3)U3(2), and Unified Computing System (UCS) 6200 devices before 2.0(1w) allows remote attackers to cause a denial of service (device reload) by sending a jumbo packet to the…

  • CVE-2013-1180Apr 25, 2013
    Cisco Systems, Inc.
    Mds 9000
    risk 0.00cvss —epss 0.03

    Buffer overflow in the SNMP implementation in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(5) and 6.x before 6.1(1) and MDS 9000 devices 4.x and 5.x before 5.2(5) allows remote authenticated users to execute arbitrary code via a crafted SNMP request, aka Bug ID…

  • CVE-2013-1179Apr 25, 2013
    Cisco Systems, Inc.
    Mds 9000
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in the (1) SNMP and (2) License Manager implementations in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(5) and 6.x before 6.1(1) and MDS 9000 devices 4.x and 5.x before 5.2(5) allow remote authenticated users to execute arbitrary code via a…

  • CVE-2013-1178Apr 25, 2013
    Cisco Systems, Inc.
    Mds 9000
    risk 0.00cvss —epss 0.01

    Multiple buffer overflows in the Cisco Discovery Protocol (CDP) implementation in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(4) and 6.x before 6.1(1), Nexus 5000 and 5500 devices 4.x and 5.x before 5.1(3)N1(1), Nexus 4000 devices before 4.1(2)E1(1h), Nexus 3000…

  • CVE-2013-3055Apr 25, 2013
    Lexmark
    Markvision
    risk 0.00cvss —epss 0.04

    Lexmark Markvision Enterprise before 1.8 provides a diagnostic interface on TCP port 9789, which allows remote attackers to execute arbitrary code, change the configuration, or obtain sensitive fleet-management information via unspecified vectors.

  • CVE-2013-0728Apr 25, 2013
    ERDAS APOLLO
    ECWP plugin
    risk 0.00cvss —epss 0.04

    Multiple stack-based buffer overflows in NCSAddOn.dll in the ERDAS APOLLO ECWP plugin before 13.00.0001 for Internet Explorer, Firefox, and Chrome allow remote attackers to execute arbitrary code via a long property value.

  • CVE-2013-1958Apr 24, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The scm_check_creds function in net/core/scm.c in the Linux kernel before 3.8.6 does not properly enforce capability requirements for controlling the PID value associated with a UNIX domain socket, which allows local users to bypass intended access restrictions by leveraging the…