VYPR

CVEs

387,023 total · page 6641 of 7,741

AllCriticalHighKEV
  • CVE-2013-0716Mar 20, 2013
    Windriver
    Vxworks
    risk 0.00cvss —epss 0.02

    The web server in Wind River VxWorks 5.5 through 6.9 allows remote attackers to cause a denial of service (daemon crash) via a crafted URI.

  • CVE-2013-0715Mar 20, 2013
    Windriver
    Vxworks
    risk 0.00cvss —epss 0.02

    The WebCLI component in Wind River VxWorks 5.5 through 6.9 allows remote authenticated users to cause a denial of service (CLI session crash) via a crafted command string.

  • CVE-2013-0714Mar 20, 2013
    Windriver
    Vxworks
    risk 0.01cvss —epss 0.06

    IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to execute arbitrary code or cause a denial of service (daemon hang) via a crafted public-key authentication request.

  • CVE-2013-0713Mar 20, 2013
    Windriver
    Vxworks
    risk 0.00cvss —epss 0.02

    IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted pty request.

  • CVE-2013-0712Mar 20, 2013
    Windriver
    Vxworks
    risk 0.00cvss —epss 0.03

    IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted packet.

  • CVE-2013-0711Mar 20, 2013
    Windriver
    Vxworks
    risk 0.00cvss —epss 0.03

    IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to cause a denial of service (daemon outage) via a crafted authentication request.

  • CVE-2013-2275Mar 20, 2013
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.03

    The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified…

  • CVE-2013-2274Mar 20, 2013
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.03

    Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.

  • CVE-2013-1655Mar 20, 2013
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.05

    Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."

  • CVE-2013-1654Mar 20, 2013
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.03

    Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors.

  • CVE-2013-1653Mar 20, 2013
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.05

    Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to…

  • CVE-2013-1652Mar 20, 2013
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.02

    Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.

  • CVE-2013-1640Mar 20, 2013
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.05

    The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted…

  • CVE-2013-1843Mar 20, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2013-1842Mar 20, 2013
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation…

  • CVE-2013-1766Mar 20, 2013
    Libvirt
    Libvirt
    risk 0.00cvss —epss 0.00

    libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors.

  • CVE-2013-0332Mar 20, 2013
    Zoneminder
    Zoneminder
    risk 0.04cvss —epss 0.10

    Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) view, (2) request, or (3) action parameter.

  • CVE-2013-0232Mar 20, 2013
    Zoneminder
    Zoneminder
    risk 0.07cvss —epss 0.48

    includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the…

  • CVE-2013-0981Mar 20, 2013
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    The IOUSBDeviceFamily driver in the USB implementation in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 accesses pipe object pointers that originated in userspace, which allows local users to gain privileges via crafted code.

  • CVE-2013-0980Mar 20, 2013
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    The Passcode Lock implementation in Apple iOS before 6.1.3 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement by leveraging an error in the emergency-call feature.

  • CVE-2013-0979Mar 20, 2013
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    lockdownd in Lockdown in Apple iOS before 6.1.3 does not properly consider file types during the permission-setting step of a backup restoration, which allows local users to change the permissions of arbitrary files via a backup that contains a pathname with a symlink.

  • CVE-2013-0978Mar 20, 2013
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not ensure that it has been invoked in an abort context, which makes it easier for local users to bypass the ASLR protection mechanism via crafted code.

  • CVE-2013-0977Mar 20, 2013
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    dyld in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not properly manage the state of file loading for Mach-O executable files, which allows local users to bypass intended code-signing requirements via a file that contains overlapping segments.

  • CVE-2012-5938Mar 20, 2013
    IBM
    Infosphere Information Server
    risk 0.00cvss —epss 0.00

    The installation process in IBM InfoSphere Information Server 8.1, 8.5, 8.7, and 9.1 on UNIX and Linux sets incorrect permissions and ownerships for unspecified files, which allows local users to bypass intended access restrictions via standard filesystem operations.

  • CVE-2013-1857Mar 19, 2013
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.02

    The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it…

  • CVE-2013-1856Mar 19, 2013
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.02

    The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows…

  • CVE-2013-1855Mar 19, 2013
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.03

    The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for…

  • CVE-2013-1854Mar 19, 2013
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.04

    The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.

  • CVE-2013-0717Mar 19, 2013
    NEC
    Atermwm3450rn
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility on the NEC AtermWR9500N, AtermWR8600N, AtermWR8370N, AtermWR8160N, AtermWM3600R, and AtermWM3450RN routers allow remote attackers to hijack the authentication of administrators for…

  • CVE-2013-0506Mar 19, 2013
    IBM
    Sterling Order Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-0505Mar 19, 2013
    IBM
    Sterling Order Management
    risk 0.00cvss —epss 0.01

    IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to conduct XPath injection attacks, and read arbitrary XML files, via unspecified vectors.

  • CVE-2013-1863Mar 19, 2013
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.02

    Samba 4.x before 4.0.4, when configured as an Active Directory domain controller, uses world-writable permissions on non-default CIFS shares, which allows remote authenticated users to read, modify, create, or delete arbitrary files via standard filesystem operations.

  • CVE-2013-2263Mar 19, 2013
    Citrix Systems
    Access Gateway
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524 allows remote attackers to access network resources via unknown attack vectors.

  • CVE-2013-0331Mar 19, 2013
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.02

    Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.

  • CVE-2013-0330Mar 19, 2013
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors.

  • CVE-2013-0329Mar 19, 2013
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors.

  • CVE-2013-0328Mar 19, 2013
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-0327Mar 19, 2013
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.

  • CVE-2013-0251Mar 19, 2013
    Latd
    latd
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in llogincircuit.cc in latd 1.25 through 1.30 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the llogin version.

  • CVE-2013-0227Mar 19, 2013
    Drupal
    Search API Sorts
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Search API Sorts module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified field labels.

  • CVE-2013-0226Mar 19, 2013
    Drupal
    Keyboard Shortcut Utility
    risk 0.00cvss —epss 0.01

    The Keyboard Shortcut Utility module 7.x-1.x before 7.x-1.1 for Drupal does not properly check node restrictions, which allows (1) remote authenticated users with the "view shortcuts" permission to read nodes or (2) remote authenticated users with the "admin shortcuts"…

  • CVE-2013-0225Mar 19, 2013
    Drupal
    User Relationships
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the User Relationships module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-alpha5 for Drupal allows remote authenticated users with the "administer user relationships" permission to inject arbitrary web script or HTML via a…

  • CVE-2013-0224Mar 19, 2013
    Drupal
    Video
    risk 0.00cvss —epss 0.00

    The Video module 7.x-2.x before 7.x-2.9 for Drupal, when using the FFmpeg transcoder, allows local users to execute arbitrary PHP code by modifying a temporary PHP file.

  • CVE-2013-0207Mar 19, 2013
    Drupal
    Mark Complete
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Mark Complete module 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2013-0206Mar 19, 2013
    Drupal
    Live CSS
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in the Live CSS module 6.x-2.x before 6.x-2.1 and 7.x-2.x before 7.x-2.7 for Drupal allows remote authenticated users with the "administer CSS" permissions to execute arbitrary code by uploading a file with an executable extension, then…

  • CVE-2013-0205Mar 19, 2013
    Drupal
    restws
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the RESTful Web Services (restws) module 7.x-1.x before 7.x-1.2 and 7.x-2.x before 7.x-2.0-alpha4 for Drupal allows remote attackers to hijack the authentication of arbitrary users via unknown vectors.

  • CVE-2013-1495Mar 18, 2013
    Oracle Corporation
    Support Tools
    risk 0.00cvss —epss 0.00

    asr in Oracle Auto Service Request in Oracle Support Tools before 4.3.2 allows local users to modify arbitrary files via a symlink attack on a predictable filename in /tmp.

  • CVE-2013-0915Mar 18, 2013
    Google
    ChromeOS
    risk 0.00cvss —epss 0.01

    The GPU process in Google Chrome OS before 25.0.1364.173 allows attackers to cause a denial of service or possibly have unspecified other impact via vectors related to an "overflow."

  • CVE-2013-0913Mar 18, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Integer overflow in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel through 3.8.3, as used in Google Chrome OS before 25.0.1364.173 and other products, allows local users to cause a denial of…

  • CVE-2013-2492Mar 15, 2013
    Firebirdsql
    Firebird
    risk 0.06cvss —epss 0.42

    Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514, and 2.5.1 through 2.5.3 before 26623, on Windows allows remote attackers to execute arbitrary code via a crafted packet to TCP port 3050, related to a missing size check during extraction of a group number…