VYPR

CVEs

387,005 total · page 6646 of 7,741

AllCriticalHighKEV
  • CVE-2013-0707Mar 1, 2013
    Justsystems
    Ichitaro
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in JustSystems Ichitaro 2006 and 2007, Ichitaro Government 2006 and 2007, Ichitaro Portable with oreplug, Hanako 2006 through 2013, Hanako Police, Hanako Police 3, and Hanako Police 2010 allows remote attackers to execute arbitrary code via a crafted…

  • CVE-2013-0256Mar 1, 2013
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.03

    darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

  • CVE-2013-0184Mar 1, 2013
    Rack
    Rack
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."

  • CVE-2013-0183Mar 1, 2013
    Rack
    Rack
    risk 0.00cvss —epss 0.04

    multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.

  • CVE-2013-0162Mar 1, 2013
    Ryan Davis
    Ruby Parser
    risk 0.00cvss —epss 0.00

    The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.

  • CVE-2012-6116Mar 1, 2013
    Theforeman
    Katello
    risk 0.00cvss —epss 0.00

    modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.

  • CVE-2012-6109Mar 1, 2013
    Rack
    Rack
    risk 0.00cvss —epss 0.03

    lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.

  • CVE-2012-5604Mar 1, 2013
    Red Hat
    Cloudforms
    risk 0.00cvss —epss 0.02

    The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when using Active Directory for authentication, allows remote attackers to bypass authentication via unspecified vectors.

  • CVE-2012-5561Mar 1, 2013
    Theforeman
    Katello
    risk 0.00cvss —epss 0.00

    script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local users to obtain the passphrase by reading the file.

  • CVE-2012-1568Mar 1, 2013
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.00

    The ExecShield feature in a certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 5 and 6 and Fedora 15 and 16 does not properly handle use of many shared libraries by a 32-bit executable file, which makes it easier for context-dependent attackers to…

  • CVE-2013-1141Feb 28, 2013
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.00cvss —epss 0.01

    The mDNS snooping functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.4.1.54 and earlier does not properly manage buffers, which allows remote authenticated users to cause a denial of service (device reload) via crafted mDNS packets, aka Bug ID…

  • CVE-2013-1124Feb 28, 2013
    Cisco Systems, Inc.
    Network Admission Control
    risk 0.00cvss —epss 0.01

    The Cisco Network Admission Control (NAC) agent on Mac OS X does not verify the X.509 certificate of an Identity Services Engine (ISE) server during an SSL session, which allows man-in-the-middle attackers to spoof ISE servers via an arbitrary certificate, aka Bug ID CSCub24309.

  • CVE-2013-1774Feb 28, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The chase_port function in drivers/usb/serial/io_ti.c in the Linux kernel before 3.7.4 allows local users to cause a denial of service (NULL pointer dereference and system crash) via an attempted /dev/ttyUSB read or write operation on a disconnected Edgeport USB serial converter.

  • CVE-2013-1773Feb 28, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service (system crash) via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during…

  • CVE-2013-1772Feb 28, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and…

  • CVE-2013-1767Feb 28, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in the shmem_remount_fs function in mm/shmem.c in the Linux kernel before 3.7.10 allows local users to gain privileges or cause a denial of service (system crash) by remounting a tmpfs filesystem without specifying a required mpol (aka mempolicy)…

  • CVE-2013-1763Feb 28, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    Array index error in the __sock_diag_rcv_msg function in net/core/sock_diag.c in the Linux kernel before 3.7.10 allows local users to gain privileges via a large family value in a Netlink message.

  • CVE-2013-0349Feb 28, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The hidp_setup_hid function in net/bluetooth/hidp/core.c in the Linux kernel before 3.7.6 does not properly copy a certain name field, which allows local users to obtain sensitive information from kernel memory by setting a long name and making an HIDPCONNADD ioctl call.

  • CVE-2013-0343Feb 28, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.02

    The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a denial of service (excessive retries and address-generation…

  • CVE-2012-4542Feb 28, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SG_IO ioctl call that leverages overlapping opcodes.

  • CVE-2013-1137Feb 27, 2013
    Cisco Systems, Inc.
    Unified Presence Server
    risk 0.00cvss —epss 0.02

    Cisco Unified Presence Server (CUPS) 8.6, 9.0, and 9.1 before 9.1.1 allows remote attackers to cause a denial of service (CPU consumption) via crafted packets to the SIP TCP port, aka Bug ID CSCua89930.

  • CVE-2013-1135Feb 27, 2013
    Cisco Systems, Inc.
    Prime Central For Hosted Collaboration Solution Assurance
    risk 0.00cvss —epss 0.01

    Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance 8.6 and 9.0 allows remote attackers to cause a denial of service (CPU consumption and monitoring outage) via malformed TLS messages to TCP port (1) 9043 or (2) 9443, aka Bug ID CSCuc07155.

  • CVE-2013-1134Feb 27, 2013
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    The Location Bandwidth Manager (LBM) Intracluster-communication feature in Cisco Unified Communications Manager (CUCM) 9.x before 9.1(1) does not require authentication from the remote LBM Hub node, which allows remote attackers to conduct cache-poisoning attacks against…

  • CVE-2013-1133Feb 27, 2013
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    Cisco Unified Communications Manager (CUCM) 8.6 before 8.6(2a)su2, 8.6 BE3k before 8.6(4) BE3k, and 9.x before 9.0(1) allows remote attackers to cause a denial of service (CPU consumption and GUI and voice outages) via malformed packets to unused UDP ports, aka Bug ID CSCtx43337.

  • CVE-2013-0490Feb 27, 2013
    IBM
    Infosphere Guardium
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in IBM InfoSphere Guardium S-TAP 8.1 for DB2 on z/OS allows local users to gain privileges via unknown vectors.

  • CVE-2012-4844Feb 27, 2013
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web server in IBM Lotus Domino 8.5.x through 8.5.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-4842Feb 27, 2013
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in the web server in IBM Lotus Domino 8.5.x through 8.5.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2013-2277Feb 27, 2013
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.02

    The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 1.1.3 does not validate the relationship between luma depth and chroma depth, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash)…

  • CVE-2013-2276Feb 27, 2013
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.01

    The avcodec_decode_audio4 function in utils.c in libavcodec in FFmpeg before 1.1.3 does not verify the decoding state before proceeding with certain skip operations, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or…

  • CVE-2012-5767Feb 27, 2013
    IBM
    Ts3500 Tape Library
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the web interface on the IBM TS3500 Tape Library with firmware before C260 allows remote authenticated users to gain privileges via unspecified vectors.

  • CVE-2013-1139Feb 27, 2013
    Cisco Systems, Inc.
    Cloud Portal
    risk 0.00cvss —epss 0.01

    The nsAPI interface in Cisco Cloud Portal 9.1 SP1 and SP2, and 9.3 through 9.3.2, does not properly check privileges, which allows remote authenticated users to obtain sensitive information via a crafted URL, aka Bug ID CSCud81134.

  • CVE-2013-0648HigKEVFeb 27, 2013
    Adobe Inc.
    Flashplayer
    risk 0.70cvss 8.8epss 0.11

    Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary…

  • CVE-2013-0643HigKEVFeb 27, 2013
    Adobe Inc.
    Flashplayer
    risk 0.70cvss 8.8epss 0.11

    The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary…

  • CVE-2013-0504Feb 27, 2013
    Adobe Inc.
    Flashplayer
    risk 0.01cvss —epss 0.10

    Buffer overflow in the broker service in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows attackers to execute arbitrary code via unspecified vectors.

  • CVE-2012-4558Feb 26, 2013
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.23

    Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject…

  • CVE-2012-3499Feb 26, 2013
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.23

    Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3)…

  • CVE-2013-1138Feb 25, 2013
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.01

    The NAT process on Cisco Adaptive Security Appliances (ASA) devices allows remote attackers to cause a denial of service (connections-table memory consumption) via crafted packets, aka Bug ID CSCue46386.

  • CVE-2013-0164Feb 24, 2013
    Red Hat
    Openshift
    risk 0.00cvss —epss 0.00

    The lockwrap function in port-proxy/bin/openshift-port-proxy-cfg in Red Hat OpenShift Origin before 1.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.

  • CVE-2013-0158Feb 24, 2013
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic…

  • CVE-2012-6074Feb 24, 2013
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web…

  • CVE-2012-6073Feb 24, 2013
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.02

    Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing…

  • CVE-2012-6072Feb 24, 2013
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response…

  • CVE-2012-5658Feb 24, 2013
    Red Hat
    Openshift
    risk 0.00cvss —epss 0.00

    rhc-chk.rb in Red Hat OpenShift Origin before 1.1, when -d (debug mode) is used, outputs the password and other sensitive information in cleartext, which allows context-dependent attackers to obtain sensitive information, as demonstrated by including log files or Bugzilla…

  • CVE-2013-0212Feb 24, 2013
    OpenStack
    Image Registry And Delivery Service \(glance\)
    risk 0.00cvss —epss 0.03

    store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to…

  • CVE-2012-6121Feb 24, 2013
    Roundcube
    Webmail
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link.

  • CVE-2012-5647Feb 24, 2013
    Red Hat
    Openshift
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in node-util/www/html/restorer.php in Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the PATH_INFO.

  • CVE-2012-5646Feb 24, 2013
    Red Hat
    Openshift
    risk 0.00cvss —epss 0.02

    node-util/www/html/restorer.php in the Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to execute arbitrary commands via a crafted uuid in the PATH_INFO.

  • CVE-2012-2697Feb 24, 2013
    Red Hat
    Enterprise Linux Server
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in autofs, as used in Red Hat Enterprise Linux (RHEL) 5, allows local users to cause a denial of service (autofs crash and delayed mounts) or prevent "mount expiration" via unspecified vectors related to "using an LDAP-based automount map."

  • CVE-2012-5337Feb 24, 2013
    Jforum
    Jforum
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in jforum.page in JForum 2.1.9 allow remote attackers to inject arbitrary web script or HTML via the (1) action, (2) match_type, (3) sort_by, or (4) start parameters.

  • CVE-2013-0247Feb 24, 2013
    OpenStack
    Keystone
    risk 0.00cvss —epss 0.03

    OpenStack Keystone Essex 2012.1.3 and earlier, Folsom 2012.2.3 and earlier, and Grizzly grizzly-2 and earlier allows remote attackers to cause a denial of service (disk consumption) via many invalid token requests that trigger excessive generation of log entries.