VYPR

CVEs

386,781 total · page 6672 of 7,736

AllCriticalHighKEV
  • CVE-2012-3446MedNov 4, 2012
    Apache
    Libcloud
    risk 0.31cvss 5.9epss 0.01

    Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL…

  • CVE-2012-5170Nov 4, 2012
    Simon Brown
    Pebble
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in Pebble before 2.6.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2012-4987Nov 4, 2012
    RealNetworks
    Realplayer
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in RealNetworks RealPlayer 15.0.5.109 allows user-assisted remote attackers to execute arbitrary code via a crafted ZIP file that triggers incorrect processing of long pathnames by the Watch Folders feature.

  • CVE-2012-3750Nov 3, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    The Passcode Lock implementation in Apple iOS before 6.0.1 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement and access Passbook passes via unspecified vectors.

  • CVE-2012-3749Nov 3, 2012
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    The extensions APIs in the kernel in Apple iOS before 6.0.1 provide kernel addresses in responses that contain an OSBundleMachOHeaders key, which makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted app.

  • CVE-2012-3748Nov 3, 2012
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.17

    Race condition in WebKit in Apple iOS before 6.0.1 and Safari before 6.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript arrays.

  • CVE-2012-0025Nov 2, 2012
    IrfanView
    Flashpix Plugin
    risk 0.04cvss —epss 0.06

    Double free vulnerability in the Free_All_Memory function in jpeg/dectile.c in libfpx before 1.3.1-1, as used in the FlashPix PlugIn 4.2.2.0 for IrfanView, allows remote attackers to cause a denial of service (crash) via a crafted FPX image.

  • CVE-2012-4498Nov 2, 2012
    Drupal
    Activism
    risk 0.00cvss —epss 0.02

    The Activism module 6.x-2.x before 6.x-2.1 for Drupal does not properly restrict access to the "Campaign" content type, which might allow remote attackers to bypass access restrictions and possibly have other unspecified impact.

  • CVE-2012-4497Nov 2, 2012
    Drupal
    Elegant Theme
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the "3 slide gallery" in the Elegant Theme module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via a slide URL.

  • CVE-2012-4493Nov 2, 2012
    Drupal
    Better Revisions
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the administrative interface in the Better Revisions module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer better revisions" permission to inject arbitrary web script or HTML via unspecified…

  • CVE-2012-4487Nov 2, 2012
    Drupal
    Subuser
    risk 0.00cvss —epss 0.01

    The Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions, which allows remote authenticated parent users to change their role by switching to a subuser they created.

  • CVE-2012-4486Nov 2, 2012
    Drupal
    Subuser
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Subuser module before 6.x-1.8 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that switch the user to a subuser via unspecified vectors.

  • CVE-2012-5417Nov 2, 2012
    Cisco Systems, Inc.
    Prime Data Center Network Manager
    risk 0.00cvss —epss 0.03

    Cisco Prime Data Center Network Manager (DCNM) before 6.1(1) does not properly restrict access to certain JBoss MainDeployer functionality, which allows remote attackers to execute arbitrary commands via JBoss Application Server Remote Method Invocation (RMI) services, aka Bug…

  • CVE-2012-5416Nov 2, 2012
    Cisco Systems, Inc.
    Unified Meetingplace
    risk 0.00cvss —epss 0.02

    Buffer overflow in Cisco Unified MeetingPlace Web Conferencing before 7.1MR1 Patch 1, 8.0 before 8.0MR1 Patch 1, and 8.5 before 8.5MR3 allows remote attackers to cause a denial of service (daemon hang) via unspecified parameters in a POST request, aka Bug ID CSCua66341.

  • CVE-2012-5705Nov 1, 2012
    Justin Dodge
    Hotblocks
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the settings page (admin/settings/hotblocks) in the Hotblocks module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with the "administer hotblocks" permission to inject arbitrary web script or HTML via the "block…

  • CVE-2012-5704Nov 1, 2012
    Justin Dodge
    Hotblocks
    risk 0.00cvss —epss 0.01

    The Hotblocks module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with the "administer hotblocks" permission to cause a denial of service (infinite loop and time out) via a block that references itself.

  • CVE-2012-5687Nov 1, 2012
    TP-Link
    Tl Wr841n
    risk 0.08cvss —epss 0.69

    Directory traversal vulnerability in the web-based management feature on the TP-LINK TL-WR841N router with firmware 3.13.9 build 120201 Rel.54965n and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to the help/ URI.

  • CVE-2012-5409Nov 1, 2012
    Siemens Foundation
    Sipass Integrated
    risk 0.04cvss —epss 0.16

    AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network, which allows remote attackers to write data to any memory location and consequently execute arbitrary code via crafted…

  • CVE-2012-3026Nov 1, 2012
    GE Intelligent Platforms
    Proficy Real-Time Information Portal
    risk 0.00cvss —epss 0.05

    rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory corruption and service crash) or possibly execute arbitrary code via long input data, a…

  • CVE-2012-3021Nov 1, 2012
    GE Intelligent Platforms
    Proficy Real-Time Information Portal
    risk 0.00cvss —epss 0.05

    rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory corruption and service crash) or possibly execute arbitrary code via long input data, a…

  • CVE-2012-3010Nov 1, 2012
    GE Intelligent Platforms
    Proficy Real-Time Information Portal
    risk 0.00cvss —epss 0.05

    rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory corruption and service crash) or possibly execute arbitrary code via long input data, a…

  • CVE-2012-4940Oct 31, 2012
    Gecad Technologies
    Mail Server
    risk 0.10cvss —epss 0.85

    Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbitrary files via a .. (dot dot) in (1) the fileName parameter in a download action to source/loggin/page_log_dwn_file.hsp, or the…

  • CVE-2012-4939Oct 31, 2012
    SolarWinds
    Orion Network Performance Monitor
    risk 0.04cvss —epss 0.07

    Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the "Search for an IP address" field.

  • CVE-2012-5671Oct 31, 2012
    Exim
    Exim
    risk 0.00cvss —epss 0.08

    Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn control = dkim_disable_verify," allows remote attackers to execute arbitrary code via…

  • CVE-2012-4544Oct 31, 2012
    Xen
    Xen
    risk 0.00cvss —epss 0.00

    The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.

  • CVE-2012-4532Oct 31, 2012
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in modules/mod_languages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php. NOTE: some of these details are…

  • CVE-2012-4531Oct 31, 2012
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-4500Oct 31, 2012
    Drupal
    Announcements
    risk 0.00cvss —epss 0.01

    The Announcements module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the "access announcements" permission to bypass node access restrictions and possibly have other unspecified impact.

  • CVE-2012-4499Oct 31, 2012
    Drupal
    Email Field
    risk 0.00cvss —epss 0.01

    The contact formatter page in the Email Field module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to email the stored address in the entity via unspecified vectors.

  • CVE-2012-4496Oct 31, 2012
    Drupal
    Custom Publishing Options
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Custom Publishing Options module 6.x-1.x before 6.x-1.4 for Drupal allows remote authenticated users with the "administer nodes" permission to inject arbitrary web script or HTML via the status labels parameter.

  • CVE-2012-4495Oct 31, 2012
    Drupal
    Mime Mail
    risk 0.00cvss —epss 0.01

    The Mime Mail module 6.x-1.x before 6.x-1.1 for Drupal does not properly restrict access to files outside Drupal's publish files directory, which allows remote authenticated users to send arbitrary files as attachments.

  • CVE-2012-4494Oct 31, 2012
    Drupal
    Shibboleth authentication module
    risk 0.00cvss —epss 0.01

    The Shibboleth authentication module 7.x-4.0 for Drupal does not properly check the active status of users, which allows remote blocked users to access bypass intended access restrictions and possibly have other impacts by logging in.

  • CVE-2012-4492Oct 31, 2012
    Drupal
    Shorten URLs
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Shorten URLs module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors to the (1) report…

  • CVE-2012-4491Oct 31, 2012
    Drupal
    Monthly Archive by Node Type
    risk 0.00cvss —epss 0.01

    The Monthly Archive by Node Type module 6.x for Drupal does not properly check permissions defined by node_access modules, which allows remote attackers to access restricted nodes via unspecified vectors.

  • CVE-2012-4490Oct 31, 2012
    Ricky Morse
    Excluded Users
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Excluded Users module 6.x-1.x before 6.x-1.1 for Drupal allow remote attackers to inject arbitrary web script or HTML via a (1) user name or (2) email address.

  • CVE-2012-4489Oct 31, 2012
    Drupal
    Secure Login
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in the securelogin_secure_redirect function in the Secure Login module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter.

  • CVE-2012-4488Oct 31, 2012
    Drupal
    Location
    risk 0.00cvss —epss 0.01

    The Location module 6.x before 6.x-3.2 and 7.x before 7.x-3.0-alpha1 for Drupal does not properly check user or node access permissions, which allows remote attackers to read node or user results via the location search page.

  • CVE-2012-4485Oct 31, 2012
    Drupal
    Gallery formatter
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the galleryformatter_field_formatter_view functiuon in galleryformatter.tpl.php the Gallery formatter module before 7.x-1.2 for Drupal allow remote authenticated users with permissions to create a node or entity to inject…

  • CVE-2012-4484Oct 31, 2012
    Drupal
    Campaign Monitor
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the administrative interface in the Campaign Monitor module before 6.x-2.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this refers to an issue in an independently developed…

  • CVE-2012-4483Oct 31, 2012
    Drupal
    Commons
    risk 0.00cvss —epss 0.01

    The commons_discussion_views_default_views function in modules/features/commons_discussion/commons_discussion.views_default.inc in the Drupal Commons module 6.x-2.x before 6.x-2.8 for Drupal does not properly enforce intended node access restrictions, which might allow remote…

  • CVE-2012-4482Oct 31, 2012
    Drupal
    Ubercart SecureTrading Payment Method
    risk 0.00cvss —epss 0.01

    The Ubercart SecureTrading Payment Method module 6.x for Drupal does not properly verify payment notification information, which allows remote attackers to purchase an item without paying via unspecified vectors.

  • CVE-2012-2625Oct 31, 2012
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    The PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, 4.2.x, and 4.1.x allows local para-virtualized guest users to cause a denial of service (memory consumption) via a large (1) bzip2 or (2) lzma compressed kernel image.

  • CVE-2012-5692Oct 31, 2012
    Invision Power Services
    Power Board
    risk 0.05cvss —epss 0.26

    Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors.

  • CVE-2012-4934Oct 31, 2012
    Tomatocart
    Tomatocart
    risk 0.00cvss —epss 0.01

    TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL.

  • CVE-2012-4610Oct 31, 2012
    EMC Corporation
    Avamar
    risk 0.00cvss —epss 0.01

    EMC Avamar Client for VMware 6.1 stores the cleartext server root password on the proxy client, which might allow remote attackers to obtain sensitive information by leveraging "network access" to the proxy client.

  • CVE-2012-4547Oct 31, 2012
    AWStats
    Awstats
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in awredir.pl in AWStats before 7.1 has unknown impact and attack vectors.

  • CVE-2012-0023Oct 30, 2012
    VideoLAN
    VLC media player
    risk 0.00cvss —epss 0.05

    Double free vulnerability in the get_chunk_header function in modules/demux/ty.c in VideoLAN VLC media player 0.9.0 through 1.1.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TiVo (TY) file.

  • CVE-2012-4663Oct 29, 2012
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    The DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.3 before 8.3(2.25), 8.4 before 8.4(2.5), and 8.5 before 8.5(1.13) and the Firewall Services…

  • CVE-2012-4662Oct 29, 2012
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    The DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.3 before 8.3(2.25), 8.4 before 8.4(2.5), and 8.5 before 8.5(1.13) and the Firewall Services…

  • CVE-2012-4661Oct 29, 2012
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.3 before 8.3(2.34), 8.4 before 8.4(4.4), 8.5 before 8.5(1.13),…