VYPR

CVEs

386,791 total · page 6664 of 7,736

AllCriticalHighKEV
  • CVE-2012-4559Nov 30, 2012
    Libssh
    Libssh
    risk 0.00cvss —epss 0.05

    Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c, (2) channel_request function in channels.c, (3) ssh_userauth_pubkey function in auth.c, (4) sftp_parse_attr_3 function in sftp.c, and (5) try_publickey_from_file function in keyfiles.c in libssh…

  • CVE-2012-4551Nov 30, 2012
    Ps Project Management Team
    Libunity Webapps
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in libunity-webapps before 2.4.1 allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via a crafted web site, related to "certain hash tables."

  • CVE-2012-4479Nov 30, 2012
    Drupal
    Drag & Drop Gallery
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-4478Nov 30, 2012
    Drupal
    Drag & Drop Gallery
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators.

  • CVE-2012-4477Nov 30, 2012
    Drupal
    Drag & Drop Gallery
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to bypass access restrictions via unknown attack vectors.

  • CVE-2012-4476Nov 30, 2012
    Drupal
    Drag & Drop Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-4475Nov 30, 2012
    Drupal
    Security Questions
    risk 0.00cvss —epss 0.01

    The Security Questions module for Drupal 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.1 does not properly restrict access, which allows remote attackers to edit an arbitrary user's questions and answers via unspecified vectors.

  • CVE-2012-4474Nov 30, 2012
    Drupal
    Colorbox Node
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Colorbox Node module 7.x-2.x before 7.x-2.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.

  • CVE-2012-4473Nov 30, 2012
    Christian Johansson
    Restrict Node Page View
    risk 0.00cvss —epss 0.01

    The Restrict node page view module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "view any node page" or "view any node {type} page" permission to access unpublished nodes via a direct request.

  • CVE-2012-4472Nov 30, 2012
    Drupal
    Drag & Drop Gallery
    risk 0.00cvss —epss 0.01

    Unrestricted file upload vulnerability in upload.php in the Drag & Drop Gallery module 6.x-1.5 and earlier for Drupal allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a…

  • CVE-2012-4471Nov 30, 2012
    Dominique Clause
    Search Autocomplete
    risk 0.00cvss —epss 0.01

    The Search Autocomplete module 7.x-2.x before 7.x-2.4 for Drupal does not properly restrict access to the module admin page, which allows remote attackers to disable an autocompletion or change the priority order via unspecified vectors.

  • CVE-2012-4470Nov 30, 2012
    Drupal
    Listhandler
    risk 0.00cvss —epss 0.01

    The Listhandler module 6.x-1.x before 6.x-1.1 for Drupal does not properly check permissions when importing emails, which allows remote comment authors to bypass access restrictions and possibly have other unspecified impact.

  • CVE-2012-4469Nov 30, 2012
    Drupal
    Hashcash
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Hashcash module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.2 for Drupal, when "Log failed hashcash" is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid token, which is not properly handled…

  • CVE-2012-4468Nov 30, 2012
    Drupal
    Privatemsg
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Privatemsg module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a user name in a private message.

  • CVE-2012-5568Nov 30, 2012
    Apache
    Tomcat
    risk 0.01cvss —epss 0.10

    Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.

  • CVE-2012-4834Nov 30, 2012
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in LayerLoader.jsp in the theme component in IBM WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF19 and 8.0 before CF03 allows remote attackers to read arbitrary files via a crafted URI.

  • CVE-2012-4557Nov 30, 2012
    Apache
    HTTP Server
    risk 0.01cvss —epss 0.17

    The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.

  • CVE-2012-5174Nov 30, 2012
    Kyocera
    WX300K
    risk 0.00cvss —epss 0.03

    The KYOCERA AH-K3001V, AH-K3002V, WX300K, WX310K, WX320K, and WX320KR devices allow remote attackers to cause a denial of service (persistent reboot) via an e-mail message in an invalid format.

  • CVE-2012-4222Nov 30, 2012
    Google
    Android
    risk 0.00cvss —epss 0.01

    drivers/gpu/msm/kgsl.c in the Qualcomm Innovation Center (QuIC) Graphics KGSL kernel-mode driver for Android 2.3 through 4.2 allows attackers to cause a denial of service (NULL pointer dereference) via an application that uses crafted arguments in a local kgsl_ioctl call.

  • CVE-2012-4221Nov 30, 2012
    Google
    Android
    risk 0.00cvss —epss 0.02

    Integer overflow in diagchar_core.c in the Qualcomm Innovation Center (QuIC) Diagnostics (aka DIAG) kernel-mode driver for Android 2.3 through 4.2 allows attackers to execute arbitrary code or cause a denial of service via an application that uses crafted arguments in a local…

  • CVE-2012-4220Nov 30, 2012
    Qualcomm
    DIAG
    risk 0.00cvss —epss 0.03

    diagchar_core.c in the Qualcomm Innovation Center (QuIC) Diagnostics (aka DIAG) kernel-mode driver for Android 2.3 through 4.2 allows attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference) via an application that uses crafted arguments…

  • CVE-2012-5530Nov 29, 2012
    Performancecopilot
    Pcp
    risk 0.00cvss —epss 0.00

    The (1) pcmd and (2) pmlogger init scripts in Performance Co-Pilot (PCP) before 3.6.10 allow local users to overwrite arbitrary files via a symlink attack on a /var/tmp/##### temporary file.

  • CVE-2012-4841Nov 29, 2012
    IBM
    Tivoli Endpoint Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Tivoli Endpoint Manager for Remote Control Broker 8.2 before 8.2.1-TIV-TEMRC821-IF0002 allows remote attackers to cause a denial of service (resource consumption) via unknown vectors.

  • CVE-2012-3271Nov 29, 2012
    Microfocus
    Integrated Lights Out 3 Firmware
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability on the HP Integrated Lights-Out 3 (aka iLO3) with firmware before 1.50 and Integrated Lights-Out 4 (aka iLO4) with firmware before 1.13 allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2012-6051Nov 28, 2012
    Google
    Cityhash
    risk 0.00cvss —epss 0.01

    Google CityHash computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as…

  • CVE-2012-5373Nov 28, 2012
    Openjdk
    OpenJDK
    risk 0.00cvss —epss 0.02

    Oracle Java SE 7 and earlier, and OpenJDK 7 and earlier, computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an…

  • CVE-2012-5372Nov 28, 2012
    Rubinius
    Rubinius
    risk 0.00cvss —epss 0.02

    Rubinius computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated…

  • CVE-2012-5371Nov 28, 2012
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.03

    Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an…

  • CVE-2012-5370Nov 28, 2012
    Jruby
    Jruby
    risk 0.00cvss —epss 0.02

    JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by…

  • CVE-2012-2739Nov 28, 2012
    Openjdk
    OpenJDK
    risk 0.00cvss —epss 0.03

    Oracle Java SE before 7 Update 6, and OpenJDK 7 before 7u6 build 12 and 8 before build 39, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via…

  • CVE-2012-5136Nov 28, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 23.0.1271.91 does not properly perform a cast of an unspecified variable during handling of the INPUT element, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted HTML document.

  • CVE-2012-5135Nov 28, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 23.0.1271.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to printing.

  • CVE-2012-5134Nov 28, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.04

    Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted…

  • CVE-2012-5133Nov 28, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 23.0.1271.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG filters.

  • CVE-2012-5132Nov 28, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 23.0.1271.91 allows remote attackers to cause a denial of service (application crash) via a response with chunked transfer coding.

  • CVE-2012-5131Nov 28, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 23.0.1271.91 on Mac OS X does not properly mitigate improper rendering behavior in the Intel GPU driver, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2012-5130Nov 28, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Skia, as used in Google Chrome before 23.0.1271.91, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2012-4964Nov 28, 2012
    Samsung Mobile
    Printer Firmware
    risk 0.01cvss —epss 0.08

    The Samsung printer firmware before 20121031 has a hardcoded read-write SNMP community, which makes it easier for remote attackers to obtain administrative access via an SNMP request.

  • CVE-2012-4615Nov 27, 2012
    EMC Corporation
    Smarts Network Configuration Manager
    risk 0.00cvss —epss 0.00

    EMC Smarts Network Configuration Manager (NCM) before 9.1 uses a hardcoded encryption key for the storage of credentials, which allows local users to obtain sensitive information via unspecified vectors.

  • CVE-2012-4614Nov 27, 2012
    EMC Corporation
    Smarts Network Configuration Manager
    risk 0.00cvss —epss 0.02

    The default configuration of EMC Smarts Network Configuration Manager (NCM) before 9.1 does not require authentication for database access, which allows remote attackers to have an unspecified impact via a network session.

  • CVE-2012-4611Nov 27, 2012
    EMC Corporation
    Rsa Adaptive Authentication On Premise
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Adaptive Authentication On-Premise (AAOP) before 7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-6050Nov 27, 2012
    Mikrotik
    Routeros
    risk 0.04cvss —epss 0.09

    The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consumption), read the router version, and possibly have other impacts via a request to download the router's DLLs or plugins, as demonstrated by roteros.dll.

  • CVE-2012-6049Nov 27, 2012
    Open Solution
    Quick.cart
    risk 0.00cvss —epss 0.01

    Open Solution Quick.Cart 5.0 allows remote attackers to obtain sensitive information via (1) a long string or (2) invalid characters in a cookie, which reveals the installation path in an error message.

  • CVE-2012-6048Nov 27, 2012
    Guitar Pro
    Guitar Pro
    risk 0.03cvss —epss 0.02

    Guitar Pro 6.1.1 r10791 allows remote attackers to cause a denial of service (crash) via a long string in a gpx file.

  • CVE-2012-6047Nov 27, 2012
    X7 Chat
    X7 Chat
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in X7 Chat 2.0.5.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that add a user to an arbitrary group via the users page in an adminpanel action to index.php.

  • CVE-2012-6046Nov 27, 2012
    Phpenter
    PHP Enter
    risk 0.03cvss —epss 0.04

    Static code injection vulnerability in admin/banners.php in PHP Enter allows remote attackers to inject arbitrary PHP code into horad.php via the code parameter.

  • CVE-2012-6045Nov 27, 2012
    Ramui
    Forum
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in gb/user/index.php in Ramui Forum, possibly 1.0 Beta, allows remote attackers to inject arbitrary web script or HTML via the query parameter.

  • CVE-2010-5286Nov 26, 2012
    Joomla
    Jstore
    risk 0.04cvss —epss 0.12

    Directory traversal vulnerability in Jstore (com_jstore) component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-5285Nov 26, 2012
    Collabtive
    Collabtive
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin.php in Collabtive 0.6.5 allows remote attackers to hijack the authentication of administrators for requests that add administrative users via the edituser action.

  • CVE-2010-5284Nov 26, 2012
    Collabtive
    Collabtive
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Collabtive 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) User parameter in the edit user profile feature to manageuser.php, (2) y parameter in a newcal action to manageajax.php, and the (3)…