VYPR

CVEs

386,791 total · page 6662 of 7,736

AllCriticalHighKEV
  • CVE-2012-4787CriDec 12, 2012
    Microsoft
    Internet Explorer
    risk 0.60cvss 9.0epss 0.18

    Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly initialized or (2) is deleted, aka "Improper Ref Counting Use After Free…

  • CVE-2012-4786Dec 12, 2012
    Microsoft
    Windows
    risk 0.02cvss —epss 0.24

    The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allow remote attackers to execute arbitrary code via a crafted…

  • CVE-2012-4782Dec 12, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.26

    Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "CMarkup Use After Free Vulnerability."

  • CVE-2012-4781Dec 12, 2012
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.18

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "InjectHTMLStream Use After Free Vulnerability."

  • CVE-2012-4774Dec 12, 2012
    Microsoft
    Windows
    risk 0.02cvss —epss 0.21

    Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted (1) file name or (2) subfolder name that triggers use of unallocated…

  • CVE-2012-2556Dec 12, 2012
    Microsoft
    Windows
    risk 0.02cvss —epss 0.21

    The OpenType Font (OTF) driver in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows remote attackers to…

  • CVE-2012-2549Dec 12, 2012
    Microsoft
    Windows Server 2008
    risk 0.01cvss —epss 0.10

    The IP-HTTPS server in Windows Server 2008 R2 and R2 SP1 and Server 2012 does not properly validate certificates, which allows remote attackers to bypass intended access restrictions via a revoked certificate, aka "Revoked Certificate Bypass Vulnerability."

  • CVE-2012-2539HigKEVDec 12, 2012
    Microsoft
    Word
    risk 0.67cvss 7.8epss 0.53

    Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "Word RTF…

  • CVE-2012-1537Dec 12, 2012
    Microsoft
    Directx
    risk 0.02cvss —epss 0.23

    Heap-based buffer overflow in DirectPlay in DirectX 9.0 through 11.1 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 allows remote attackers to…

  • CVE-2012-6313Dec 11, 2012
    WordPress
    Simple Gmail Login
    risk 0.04cvss —epss 0.08

    simple-gmail-login.php in the Simple Gmail Login plugin before 1.1.4 for WordPress allows remote attackers to obtain sensitive information via a request that lacks a timezone, leading to disclosure of the installation path in a stack trace.

  • CVE-2012-6312Dec 11, 2012
    WordPress
    Video Lead Form
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php.

  • CVE-2012-5956Dec 11, 2012
    Manageengine
    Assetexplorer
    risk 0.00cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine AssetExplorer 5.6 before service pack 5614 allow remote attackers to inject arbitrary web script or HTML via fields in XML asset data to discoveryServlet/WsDiscoveryServlet, as demonstrated by the…

  • CVE-2012-4349Dec 11, 2012
    Symantec
    Network Access Control
    risk 0.00cvss —epss 0.00

    Unquoted Windows search path vulnerability in Symantec Network Access Control (SNAC) 12.1 before RU2 allows local users to gain privileges via unspecified vectors.

  • CVE-2012-6301Dec 10, 2012
    Google
    Android
    risk 0.04cvss —epss 0.06

    The Browser application in Android 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted market: URI in the SRC attribute of an IFRAME element.

  • CVE-2012-5973Dec 10, 2012
    Ca
    Xcom Data Transport
    risk 0.00cvss —epss 0.04

    CA XCOM Data Transport r11.0 and r11.5 on UNIX and Linux allows remote attackers to execute arbitrary commands via a crafted request.

  • CVE-2012-4857Dec 8, 2012
    IBM
    Informix
    risk 0.00cvss —epss 0.05

    Buffer overflow in IBM Informix 11.50 through 11.50.xC9W2 and 11.70 before 11.70.xC7 allows remote authenticated users to execute arbitrary code via a crafted SQL statement.

  • CVE-2012-4838Dec 8, 2012
    IBM
    Flex System Chassis Management Module
    risk 0.00cvss —epss 0.00

    IBM Flex System Chassis Management Module (CMM) and Integrated Management Module 2 (IMM2) allow local users to obtain sensitive information about (1) local accounts, (2) SSH private keys, (3) SSL/TLS private keys, (4) SNMPv3 communities, and (5) LDAP credentials by leveraging…

  • CVE-2012-4690Dec 8, 2012
    Rockwellautomation
    Slc 500 Controller
    risk 0.00cvss —epss 0.04

    Rockwell Automation Allen-Bradley MicroLogix controller 1100, 1200, 1400, and 1500; SLC 500 controller platform; and PLC-5 controller platform, when Static status is not enabled, allow remote attackers to cause a denial of service via messages that trigger modification of status…

  • CVE-2012-4687Dec 8, 2012
    Postoaktraffic
    Awam Bluetooth Reader
    risk 0.00cvss —epss 0.02

    Post Oak AWAM Bluetooth Reader Traffic System does not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attackers to spoof a device by predicting a key value.

  • CVE-2012-3297Dec 8, 2012
    IBM
    Tivoli Monitoring
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the embedded HTTP server in the Service Console in IBM Tivoli Monitoring 6.2.2 before 6.2.2-TIV-ITM-FP0009 and 6.3.2 before 6.2.3-TIV-ITM-FP0001 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.

  • CVE-2012-5688Dec 6, 2012
    Isc
    Bind
    risk 0.01cvss —epss 0.11

    ISC BIND 9.8.x before 9.8.4-P1 and 9.9.x before 9.9.2-P1, when DNS64 is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.

  • CVE-2012-5176Dec 6, 2012
    Kent Web
    Access Report
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in KENT-WEB ACCESS REPORT 5.02 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to tag embedding.

  • CVE-2012-5175Dec 6, 2012
    Kent Web
    Access Report
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in KENT-WEB ACCESS REPORT 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to access-log data.

  • CVE-2012-3275Dec 6, 2012
    Microfocus
    OpenView Network Node Manager
    risk 0.01cvss —epss 0.10

    Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.1x and 9.20 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2012-3274Dec 6, 2012
    Microfocus
    Intelligent Management Center
    risk 0.08cvss —epss 0.64

    Stack-based buffer overflow in uam.exe in the User Access Manager (UAM) component in HP Intelligent Management Center (IMC) before 5.1 E0101P01 allows remote attackers to execute arbitrary code via vectors related to log data.

  • CVE-2012-3273Dec 6, 2012
    Microfocus
    LaserJet 400 M401
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities on the HP LaserJet Pro 400 MFP M425 with firmware 20120625 and LaserJet 400 M401 with firmware 20120621 allow remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2012-3272Dec 6, 2012
    Microfocus
    Color Laserjet Cp6015
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability on the HP Color LaserJet CM3530 with firmware before 53.190.9, Color LaserJet CM60xx with firmware before 52.210.9, Color LaserJet CP3525 with firmware before 06.140.3 18, Color LaserJet CP4xxx with firmware before 07.120.6, Color…

  • CVE-2012-5055Dec 5, 2012
    VMware
    Spring Security
    risk 0.00cvss —epss 0.02

    DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames…

  • CVE-2011-2732Dec 5, 2012
    VMware
    Spring Security
    risk 0.03cvss —epss 0.05

    CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.

  • CVE-2011-2731Dec 5, 2012
    VMware
    Spring Security
    risk 0.00cvss —epss 0.01

    Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.

  • CVE-2011-2730Dec 5, 2012
    Gopivotal
    Spring Framework
    risk 0.00cvss —epss 0.12

    VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a)…

  • CVE-2009-2899Dec 5, 2012
    VMware
    Hyperic Hq
    risk 0.00cvss —epss 0.00

    The monitor perl script in the Sybase database plug-in in SpringSource Hyperic HQ before 4.3 allows local users to obtain the database password by listing the process and its arguments.

  • CVE-2012-6062Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_rtcp_app function in epan/dissectors/packet-rtcp.c in the RTCP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.

  • CVE-2012-6061Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_wtp_common function in epan/dissectors/packet-wtp.c in the WTP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data type for a certain length field, which allows remote attackers to cause a denial of service (integer overflow and…

  • CVE-2012-6060Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Integer overflow in the dissect_iscsi_pdu function in epan/dissectors/packet-iscsi.c in the iSCSI dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.

  • CVE-2012-6059Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_isakmp function in epan/dissectors/packet-isakmp.c in the ISAKMP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data structure to determine IKEv2 decryption parameters, which allows remote attackers to cause a denial of service…

  • CVE-2012-6058Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Integer overflow in the dissect_icmpv6 function in epan/dissectors/packet-icmpv6.c in the ICMPv6 dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted Number of Sources value.

  • CVE-2012-6057Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_eigrp_metric_comm function in epan/dissectors/packet-eigrp.c in the EIGRP dissector in Wireshark 1.8.x before 1.8.4 uses the wrong data type for a certain offset value, which allows remote attackers to cause a denial of service (integer overflow and infinite loop)…

  • CVE-2012-6056Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Integer overflow in the dissect_sack_chunk function in epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted Duplicate TSN count.

  • CVE-2012-6055Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    epan/dissectors/packet-3g-a11.c in the 3GPP2 A11 dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a zero value in a sub-type length field.

  • CVE-2012-6054Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_sflow_245_address_type function in epan/dissectors/packet-sflow.c in the sFlow dissector in Wireshark 1.8.x before 1.8.4 does not properly handle length calculations for an invalid IP address type, which allows remote attackers to cause a denial of service (infinite…

  • CVE-2012-6053Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    epan/dissectors/packet-usb.c in the USB dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 relies on a length field to calculate an offset value, which allows remote attackers to cause a denial of service (infinite loop) via a zero value for this field.

  • CVE-2012-6052Dec 5, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    Wireshark 1.8.x before 1.8.4 allows remote attackers to obtain sensitive hostname information by reading pcap-ng files.

  • CVE-2012-4985Dec 5, 2012
    Forescout
    Counteract
    risk 0.00cvss —epss 0.02

    The Forescout CounterACT NAC device 6.3.4.1 does not block ARP and ICMP traffic from unrecognized clients, which allows remote attackers to conduct ARP poisoning attacks via crafted packets.

  • CVE-2012-4983Dec 5, 2012
    Forescout
    Counteract
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities on the Forescout CounterACT NAC device before 7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the a parameter to assets/login or (2) the query parameter to assets/rangesearch.

  • CVE-2012-4982Dec 5, 2012
    Forescout
    Counteract
    risk 0.04cvss —epss 0.09

    Open redirect vulnerability in assets/login on the Forescout CounterACT NAC device before 7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the a parameter.

  • CVE-2012-4862Dec 5, 2012
    IBM
    Rational Developer For System Z
    risk 0.00cvss —epss 0.00

    The Host Connect emulator in IBM Rational Developer for System z 7.1 through 8.5.1 does not properly store the SSL certificate password, which allows local users to obtain sensitive information via unspecified vectors.

  • CVE-2012-4609Dec 5, 2012
    EMC Corporation
    Rsa Netwitness Informer
    risk 0.00cvss —epss 0.01

    The web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

  • CVE-2012-4608Dec 5, 2012
    EMC Corporation
    Rsa Netwitness Informer
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2012-4347Dec 5, 2012
    Symantec
    Messaging Gateway
    risk 0.08cvss —epss 0.59

    Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway (SMG) 9.5.x allow remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) logFile parameter in a logs action to brightmail/export or (2)…