VYPR

CVEs

387,005 total · page 6647 of 7,741

AllCriticalHighKEV
  • CVE-2013-0220Feb 24, 2013
    Fedoraproject
    Sssd
    risk 0.00cvss —epss 0.03

    The (1) sss_autofs_cmd_getautomntent and (2) sss_autofs_cmd_getautomntbyname function in responder/autofs/autofssrv_cmd.c and the (3) ssh_cmd_parse_request function in responder/ssh/sshsrv_cmd.c in System Security Services Daemon (SSSD) before 1.9.4 allow remote attackers to…

  • CVE-2013-0219Feb 24, 2013
    SSSD
    Sssd
    risk 0.00cvss —epss 0.00

    System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3) removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files.

  • CVE-2012-6128Feb 24, 2013
    Openconnect
    OpenConnect
    risk 0.00cvss —epss 0.03

    Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow remote VPN gateways to cause a denial of service (application crash) via a long (1) hostname, (2) path, or (3) cookie list in a response.

  • CVE-2012-6093Feb 24, 2013
    Qt
    Qt
    risk 0.00cvss —epss 0.02

    The QSslSocket::sslErrors function in Qt before 4.6.5, 4.7.x before 4.7.6, 4.8.x before 4.8.5, when using certain versions of openSSL, uses an "incompatible structure layout" that can read memory from the wrong location, which causes Qt to report an incorrect error when…

  • CVE-2012-5624Feb 24, 2013
    Qt
    Qt
    risk 0.00cvss —epss 0.02

    The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force the read of arbitrary local files and possibly obtain sensitive information via a file: URL to a QML application.

  • CVE-2013-0786Feb 24, 2013
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    The Bugzilla::Search::build_subselect function in Bugzilla 2.x and 3.x before 3.6.13 and 3.7.x and 4.0.x before 4.0.10 generates different error messages for invalid product queries depending on whether a product exists, which allows remote attackers to discover private product…

  • CVE-2013-0785Feb 24, 2013
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in show_bug.cgi in Bugzilla before 3.6.13, 3.7.x and 4.0.x before 4.0.10, 4.1.x and 4.2.x before 4.2.5, and 4.3.x and 4.4.x before 4.4rc2 allows remote attackers to inject arbitrary web script or HTML via the id parameter in conjunction…

  • CVE-2013-0120Feb 24, 2013
    Dell
    Powerconnect 6248p
    risk 0.00cvss —epss 0.01

    The web interface on Dell PowerConnect 6248P switches allows remote attackers to cause a denial of service (device crash) via a malformed request.

  • CVE-2013-0118Feb 24, 2013
    Office Ocx
    Cs Cart
    risk 0.00cvss —epss 0.02

    CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.

  • CVE-2013-0113Feb 24, 2013
    Nuance
    PDF Reader
    risk 0.00cvss —epss 0.03

    Nuance PDF Reader 7.0 and PDF Viewer Plus 7.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document.

  • CVE-2013-0108Feb 24, 2013
    Honeywell
    Symmetre
    risk 0.05cvss —epss 0.27

    An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R410.2; SymmetrE R310, R410.1, and R410.2; ComfortPoint Open Manager (aka CPO-M) Station R100; and HMIWeb Browser client packages allows remote attackers to…

  • CVE-2012-6275Feb 24, 2013
    Bigantsoft
    Bigant Im Message Server
    risk 0.07cvss —epss 0.47

    Multiple stack-based buffer overflows in AntDS.exe in BigAntSoft BigAnt IM Message Server allow remote attackers to have an unspecified impact via (1) the filename header in an SCH request or (2) the userid component in a DUPF request.

  • CVE-2012-6274Feb 24, 2013
    Bigantsoft
    Bigant Im Message Server
    risk 0.07cvss —epss 0.47

    BigAntSoft BigAnt IM Message Server does not require authentication for file uploading, which allows remote attackers to create arbitrary files under AntServer\DocData\Public via unspecified vectors.

  • CVE-2012-6273Feb 24, 2013
    Bigantsoft
    Bigant Im Message Server
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in BigAntSoft BigAnt IM Message Server allows remote attackers to execute arbitrary SQL commands via an SHU (aka search user) request.

  • CVE-2012-4708Feb 24, 2013
    3S Smart Software Solutions
    CODESYS Gateway Server
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via a crafted packet.

  • CVE-2012-4707Feb 24, 2013
    3S Smart Software Solutions
    CODESYS Gateway Server
    risk 0.00cvss —epss 0.04

    3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors that trigger an out-of-bounds memory access.

  • CVE-2012-4706Feb 24, 2013
    3S Smart Software Solutions
    CODESYS Gateway Server
    risk 0.00cvss —epss 0.02

    Integer signedness error in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to cause a denial of service via a crafted packet that triggers a heap-based buffer overflow.

  • CVE-2012-4705Feb 24, 2013
    3S Smart Software Solutions
    CODESYS Gateway Server
    risk 0.08cvss —epss 0.65

    Directory traversal vulnerability in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors involving a crafted pathname.

  • CVE-2012-4704Feb 24, 2013
    3S Smart Software Solutions
    CODESYS Gateway Server
    risk 0.00cvss —epss 0.04

    Array index error in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via a crafted packet.

  • CVE-2013-0804Feb 24, 2013
    Novell
    Groupwise
    risk 0.04cvss —epss 0.13

    The client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference) via unspecified vectors.

  • CVE-2012-0439Feb 24, 2013
    Novell
    Groupwise
    risk 0.06cvss —epss 0.39

    An ActiveX control in gwcls1.dll in the client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code via (1) a pointer argument to the SetEngine method or (2) an XPItem pointer argument to an unspecified method.

  • CVE-2013-2268Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the MathML implementation in WebKit in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, has unknown impact and remote attack vectors, related to a "high severity security issue."

  • CVE-2013-0900Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Race condition in the International Components for Unicode (ICU) functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via…

  • CVE-2013-0899Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Integer overflow in the padding implementation in the opus_packet_parse_impl function in src/opus_decoder.c in Opus before 1.0.2, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products, allows remote attackers to…

  • CVE-2013-0898Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a URL.

  • CVE-2013-0897Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Off-by-one error in the PDF functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service via a crafted document.

  • CVE-2013-0896Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly manage memory during message handling for plug-ins, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown…

  • CVE-2013-0895Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 25.0.1364.97 on Linux, and before 25.0.1364.99 on Mac OS X, does not properly handle pathnames during copy operations, which might make it easier for remote attackers to execute arbitrary programs via unspecified vectors.

  • CVE-2013-0894Feb 23, 2013
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.02

    Buffer overflow in the vorbis_parse_setup_hdr_floors function in the Vorbis decoder in vorbisdec.c in libavcodec in FFmpeg through 1.1.3, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products, allows remote…

  • CVE-2013-0893Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Race condition in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to media.

  • CVE-2013-0892Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in the IPC layer in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allow remote attackers to cause a denial of service or possibly have other impact via unknown vectors.

  • CVE-2013-0891Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Integer overflow in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a blob.

  • CVE-2013-0890Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in the IPC layer in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allow remote attackers to cause a denial of service (memory corruption) or possibly have other impact via unknown vectors.

  • CVE-2013-0889Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly enforce a user gesture requirement before proceeding with a file download, which might make it easier for remote attackers to execute arbitrary code via a crafted file.

  • CVE-2013-0888Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Skia, as used in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to a "user gesture check for dangerous file downloads."

  • CVE-2013-0887Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The developer-tools process in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly restrict privileges during interaction with a connected server, which has unspecified impact and attack vectors.

  • CVE-2013-0886Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 25.0.1364.99 on Mac OS X does not properly implement signal handling for Native Client (aka NaCl) code, which has unspecified impact and attack vectors.

  • CVE-2013-0885Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly restrict API privileges during interaction with the Chrome Web Store, which has unspecified impact and attack vectors.

  • CVE-2013-0884Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly load Native Client (aka NaCl) code, which has unspecified impact and attack vectors.

  • CVE-2013-0883Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Skia, as used in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.

  • CVE-2013-0882Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (incorrect memory access) or possibly have unspecified other impact via a large number of SVG parameters.

  • CVE-2013-0881Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (incorrect read operation) via crafted data in the Matroska container format.

  • CVE-2013-0880Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to databases.

  • CVE-2013-0879Feb 23, 2013
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly implement web audio nodes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

  • CVE-2013-1659Feb 22, 2013
    VMware
    Esxi
    risk 0.00cvss —epss 0.02

    VMware vCenter Server 4.0 before Update 4b, 5.0 before Update 2, and 5.1 before 5.1.0b; VMware ESXi 3.5 through 5.1; and VMware ESX 3.5 through 4.1 do not properly implement the Network File Copy (NFC) protocol, which allows man-in-the-middle attackers to execute arbitrary code…

  • CVE-2013-0465Feb 22, 2013
    IBM
    Webshere Cast Iron Cloud Integration
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the IBM WebSphere Cast Iron physical and virtual appliance 6.0 and 6.1 before 6.1.0.15 and 6.3 before 6.3.0.1, when LDAP authentication is enabled, allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via…

  • CVE-2012-6326Feb 22, 2013
    VMware
    Vcenter Server
    risk 0.00cvss —epss 0.01

    VMware vCenter Server 4.1 before Update 3 and 5.0 before Update 2, and vCSA 5.0 before Update 2, allows remote attackers to cause a denial of service (disk consumption) via vectors that trigger large log entries.

  • CVE-2013-0730Feb 22, 2013
    Sourcefabric
    Newscoop
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 4.x through 4.1.0 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) language parameter to application/modules/admin/controllers/LanguagesController.php or (2) user parameter…

  • CVE-2013-0706Feb 22, 2013
    NEC
    Universal RAID Utility
    risk 0.00cvss —epss 0.02

    NEC Universal RAID Utility 1.40 Rev 680 and earlier, 2.31 Rev 1492 and earlier, and 2.5 Rev 2244 and earlier does not provide access control, which allows remote attackers to perform arbitrary RAID disk operations via unspecified vectors.

  • CVE-2013-0313Feb 22, 2013
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The evm_update_evmxattr function in security/integrity/evm/evm_crypto.c in the Linux kernel before 3.7.5, when the Extended Verification Module (EVM) is enabled, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have…