VYPR

CVEs

386,791 total · page 6667 of 7,736

AllCriticalHighKEV
  • CVE-2012-4212Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the XPCWrappedNative::Mark function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

  • CVE-2012-4210Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The Style Inspector in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 does not properly restrict the context of HTML markup and Cascading Style Sheets (CSS) token sequences, which allows user-assisted remote attackers to execute arbitrary JavaScript code with…

  • CVE-2012-4209Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 do not prevent use of a "top" frame name-attribute value to access the location property, which makes it easier for remote…

  • CVE-2012-4208Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The XrayWrapper implementation in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 does not consider the compartment during property filtering, which allows remote attackers to bypass intended chrome-only restrictions on reading DOM object…

  • CVE-2012-4207Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The HZ-GB-2312 character-set implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 does not properly handle a ~ (tilde) character in proximity to a chunk delimiter,…

  • CVE-2012-4206Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in the installer in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 on Windows allows local users to gain privileges via a Trojan horse DLL in the default downloads directory.

  • CVE-2012-4205Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks or…

  • CVE-2012-4204Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    The str_unescape function in the JavaScript engine in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.

  • CVE-2012-4203Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The New Tab page in Mozilla Firefox before 17.0 uses a privileged context for execution of JavaScript code by bookmarklets, which allows user-assisted remote attackers to run arbitrary programs by leveraging a javascript: URL in a bookmark.

  • CVE-2012-4202Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.11

    Heap-based buffer overflow in the image::RasterImage::DrawFrameTo function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code…

  • CVE-2012-4201Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href…

  • CVE-2012-5703Nov 20, 2012
    VMware
    Esx
    risk 0.00cvss —epss 0.02

    The vSphere API in VMware ESXi 4.1 and ESX 4.1 allows remote attackers to cause a denial of service (host daemon crash) via an invalid value in a (1) RetrieveProp or (2) RetrievePropEx SOAP request.

  • CVE-2012-5674Nov 20, 2012
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Adobe ColdFusion 10 before Update 5, when Internet Information Services (IIS) is used, allows attackers to cause a denial of service via unknown vectors.

  • CVE-2012-5920Nov 20, 2012
    Google
    Web Toolkit
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Google Web Toolkit (GWT) 2.4 through 2.5 Final, as used in JBoss Operations Network (ON) 3.1.1 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this issue…

  • CVE-2012-5529Nov 20, 2012
    Firebirdsql
    Firebird
    risk 0.00cvss —epss 0.02

    TraceManager in Firebird 2.5.0 and 2.5.1, when trace is enabled, allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) by preparing an empty dynamic SQL query.

  • CVE-2012-5519Nov 20, 2012
    Apple Inc.
    Cups
    risk 0.03cvss —epss 0.02

    CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging…

  • CVE-2012-4566Nov 20, 2012
    Radsecproxy
    Radsecproxy
    risk 0.00cvss —epss 0.01

    The DTLS support in radsecproxy before 1.6.2 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access…

  • CVE-2012-4563Nov 20, 2012
    Google
    Web Toolkit
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Google Web Toolkit (GWT) 2.4 Beta and release candidates before 2.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-4523Nov 20, 2012
    Radsecproxy
    Radsecproxy
    risk 0.00cvss —epss 0.02

    radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof…

  • CVE-2012-4510Nov 20, 2012
    Cups Pk Helper Project
    Cups Pk Helper
    risk 0.00cvss —epss 0.01

    cups-pk-helper before 0.2.3 does not properly wrap the (1) cupsGetFile and (2) cupsPutFile function calls, which allows user-assisted remote attackers to read or overwrite sensitive files using CUPS resources.

  • CVE-2012-4366Nov 20, 2012
    Belkin
    N900
    risk 0.03cvss —epss 0.05

    Belkin wireless routers Surf N150 Model F7D1301v1, N900 Model F9K1104v1, N450 Model F9K1105V2, and N300 Model F7D2301v1 generate a predictable default WPA2-PSK passphrase based on eight digits of the WAN MAC address, which allows remote attackers to access the network by…

  • CVE-2012-3354Nov 20, 2012
    Dokuwiki
    Dokuwiki
    risk 0.00cvss —epss 0.01

    doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers to obtain sensitive information via the prefix parameter, which reveals the installation path in an error message.

  • CVE-2011-4612Nov 20, 2012
    Xiph.Org
    Icecast
    risk 0.00cvss —epss 0.02

    icecast before 2.3.3 allows remote attackers to inject control characters such as newlines into the error loc (error.log) via a crafted URL.

  • CVE-2012-5919Nov 19, 2012
    Havalite
    Havalite
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) find or (2) replace fields to havalite/findReplace.php; (3) username parameter to havalite/hava_login.php, (4) the Edit…

  • CVE-2012-5918Nov 19, 2012
    Razorcms
    Razorcms
    risk 0.03cvss —epss 0.02

    razorCMS 1.2 allows remote authenticated users to access administrator directories and files by creating and deleting a directory.

  • CVE-2012-5854Nov 19, 2012
    Weechat
    Weechat
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in WeeChat 0.3.6 through 0.3.9 allows remote attackers to cause a denial of service (crash or hang) and possibly execute arbitrary code via crafted IRC colors that are not properly decoded.

  • CVE-2012-4541Nov 19, 2012
    Piwik
    Piwik
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-4423Nov 19, 2012
    Libvirt
    Libvirt
    risk 0.00cvss —epss 0.04

    The virNetServerProgramDispatchCall function in libvirt before 0.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and segmentation fault) via an RPC call with (1) an event as the RPC number or (2) an RPC number whose value is in a "gap" in the…

  • CVE-2012-4233Nov 19, 2012
    Libreoffice
    Libreoffice
    risk 0.00cvss —epss 0.03

    LibreOffice 3.5.x before 3.5.7.2 and 3.6.x before 3.6.1, and OpenOffice.org (OOo), allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted (1) odt file to vcllo.dll, (2) ODG (Drawing document) file to svxcorelo.dll, (3) PolyPolygon record in…

  • CVE-2012-4225Nov 19, 2012
    Nvidia
    Unix Graphic Driver
    risk 0.00cvss —epss 0.00

    NVIDIA UNIX graphics driver before 295.71 and before 304.32 allows local users to write to arbitrary physical memory locations and gain privileges by modifying the VGA window using /dev/nvidia0.

  • CVE-2011-5244Nov 19, 2012
    Tetex
    Tetex
    risk 0.00cvss —epss 0.03

    Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code…

  • CVE-2011-2486Nov 19, 2012
    Nspluginwrapper
    Nspluginwrapper
    risk 0.00cvss —epss 0.02

    nspluginwrapper before 1.4.4 does not properly provide access to NPNVprivateModeBool variable settings, which could prevent Firefox plugins from determining if they should run in Private Browsing mode and allow remote attackers to bypass intended access restrictions, as…

  • CVE-2011-0433Nov 19, 2012
    Tetex
    Tetex
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted…

  • CVE-2012-4533Nov 19, 2012
    Viewvc
    Viewvc
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via…

  • CVE-2012-4552Nov 18, 2012
    Steve J Baker
    Plib
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in the error function in ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to execute arbitrary code via a crafted 3d model file that triggers a long error message, as demonstrated by a .ase file.

  • CVE-2012-4520Nov 18, 2012
    Djangoproject
    Django
    risk 0.00cvss —epss 0.04

    The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.

  • CVE-2012-4433Nov 18, 2012
    Gegl
    Gegl
    risk 0.01cvss —epss 0.13

    Multiple integer overflows in operations/external/ppm-load.c in GEGL (Generic Graphics Library) 0.2.0 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a large (1) width or (2) height value in a Portable Pixel Map…

  • CVE-2012-4417Nov 18, 2012
    Gluster
    Glusterfs
    risk 0.00cvss —epss 0.00

    GlusterFS 3.3.0, as used in Red Hat Storage server 2.0, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.

  • CVE-2012-4950Nov 18, 2012
    Patterninsight
    Pattern Insight
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Keyword Search page in the web interface in Pattern Insight 2.3 allows remote attackers to inject arbitrary web script or HTML via crafted characters that are not properly handled during construction of error messages.

  • CVE-2012-4947Nov 18, 2012
    Agilefleet
    Fleetcommander Kiosk
    risk 0.00cvss —epss 0.02

    Agile FleetCommander and FleetCommander Kiosk before 4.08 store database credentials in cleartext, which allows remote attackers to obtain sensitive information via requests to unspecified pages.

  • CVE-2012-4946Nov 18, 2012
    Agilefleet
    Fleetcommander Kiosk
    risk 0.00cvss —epss 0.01

    Agile FleetCommander and FleetCommander Kiosk before 4.08 use an XOR format for password encryption, which makes it easier for context-dependent attackers to obtain sensitive information by reading a key file and the encrypted strings.

  • CVE-2012-4945Nov 18, 2012
    Agilefleet
    Fleetcommander Kiosk
    risk 0.00cvss —epss 0.02

    Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection" issue.

  • CVE-2012-4944Nov 18, 2012
    Agilefleet
    Fleetcommander Kiosk
    risk 0.00cvss —epss 0.04

    Multiple unrestricted file upload vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary code by uploading a file via an unspecified page.

  • CVE-2012-4943Nov 18, 2012
    Agilefleet
    Fleetcommander Kiosk
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to hijack the authentication of arbitrary users for requests that modify (1) passwords, (2) accounts, or (3) permissions.

  • CVE-2012-4942Nov 18, 2012
    Agilefleet
    Fleetcommander Kiosk
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to inject arbitrary web script or HTML via an arbitrary text field.

  • CVE-2012-4941Nov 18, 2012
    Agilefleet
    Fleetcommander Kiosk
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-4938Nov 18, 2012
    Patterninsight
    Pattern Insight
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web interface in Pattern Insight 2.3 allows remote authenticated administrators to inject arbitrary web script or HTML via the banner message.

  • CVE-2012-4937Nov 18, 2012
    Patterninsight
    Pattern Insight
    risk 0.00cvss —epss 0.02

    Session fixation vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack web sessions via a jsession_id cookie.

  • CVE-2012-4936Nov 18, 2012
    Patterninsight
    Pattern Insight
    risk 0.00cvss —epss 0.01

    The web interface in Pattern Insight 2.3 allows remote attackers to conduct clickjacking attacks via a FRAME element.

  • CVE-2012-4935Nov 18, 2012
    Patterninsight
    Pattern Insight
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack the authentication of arbitrary users.