VYPR

CVEs

386,746 total · page 6682 of 7,735

AllCriticalHighKEV
  • CVE-2011-4945Oct 1, 2012
    Michael Biebl
    Policykit
    risk 0.00cvss —epss 0.00

    PolicyKit 0.103 sets the AdminIdentities to "wheel" by default, which allows local users in the wheel group to gain root privileges without authentication.

  • CVE-2012-5233Oct 1, 2012
    Luke Herrington
    Stickynote
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the stickynote module before 7.x-1.1 for Drupal allows remote authenticated users with edit stickynotes privileges to inject arbitrary web script or HTML via unspecified vecotrs.

  • CVE-2012-1636Oct 1, 2012
    Drupal
    stickynote
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the stickynote module before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of users for requests that delete stickynotes via unspecified vectors.

  • CVE-2012-0989Oct 1, 2012
    Oneorzero
    Aims
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in OneOrZero AIMS 2.8.0 Trial Edition build231211 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.

  • CVE-2012-5232Oct 1, 2012
    Mediafire
    Mod Quick Form
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Quickl Form component for Joomla! allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-5231Oct 1, 2012
    Minicms
    Minicms
    risk 0.03cvss —epss 0.03

    miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted (1) pagename or (2) area variable containing an executable extension, which is not properly handled by (a) update.php when writing files to content/, or (b) updatenews.php when writing files…

  • CVE-2012-5230Oct 1, 2012
    Jextensions
    JE Story Submit
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the JE Story Submit (com_jesubmit) component before 1.9 for Joomla! has unknown impact and attack vectors.

  • CVE-2012-5229Oct 1, 2012
    WordPress
    Slideshow Gallery2
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in css/gallery-css.php in the Slideshow Gallery2 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the border parameter.

  • CVE-2012-5228Oct 1, 2012
    Phplist
    Phplist
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. NOTE: some of these details are obtained from third…

  • CVE-2012-5227Oct 1, 2012
    Peel
    Peel Shopping
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in administrer/tva.php in Peel SHOPPING 2.8 and 2.9 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2012-5226Oct 1, 2012
    Peel
    Peel Shopping
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Peel SHOPPING 2.8 and 2.9 allow remote attackers to inject arbitrary web script or HTML via the (1) motclef parameter to achat/recherche.php or (2) PATH_INFO to index.php.

  • CVE-2012-5225Oct 1, 2012
    Eliteweaver
    Xclick Cart
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in webscr.php in xClick Cart 1.0.1 and 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the shopping_url parameter.

  • CVE-2012-5224Oct 1, 2012
    Vbadvanced
    Vbadvanced Cmps
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in vb/includes/vba_cmps_include_bottom.php in vBadvanced CMPS 3.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pages[template] parameter.

  • CVE-2012-5223Oct 1, 2012
    Vbseo
    Vbseo
    risk 0.06cvss —epss 0.41

    The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" in the char_repl parameter, which is inserted into a regular expression…

  • CVE-2012-1898Oct 1, 2012
    Wolfcms
    WolfCMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in wolfcms/admin/user/add in Wolf CMS 0.75 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user[name], (2) user[email], or (3) user[username] parameters.

  • CVE-2012-1897Oct 1, 2012
    Wolf CMS
    Wolf CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Wolf CMS 0.75 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) delete users via the user id number to admin/user/delete; (2) delete pages via the page id number…

  • CVE-2012-1639Oct 1, 2012
    Drupal
    Commerce
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in product/commerce_product.module in the Drupal Commerce module for Drupal before 7.x-1.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) sku or (2) title parameters.

  • CVE-2012-1576Oct 1, 2012
    Atheme
    Atheme
    risk 0.00cvss —epss 0.02

    The myuser_delete function in libathemecore/account.c in Atheme 5.x before 5.2.7, 6.x before 6.0.10, and 7.x before 7.0.0-beta2 does not properly clean up CertFP entries when a user is deleted, which allows remote attackers to access a different user account or cause a denial of…

  • CVE-2011-5202Oct 1, 2012
    Sysprogs
    Wincdemu
    risk 0.00cvss —epss 0.00

    BazisVirtualCDBus.sys in WinCDEmu 3.6 allows local users to cause a denial of service (system crash) via the unmount command to batchmnt.exe.

  • CVE-2012-4833Oct 1, 2012
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    fuser in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly restrict the -k option, which allows local users to kill arbitrary processes via a crafted command line.

  • CVE-2012-4830Oct 1, 2012
    IBM
    Websphere Commerce
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11 and 7.0 through 7.0.0.6 allows remote attackers to obtain users' personal data via unknown vectors.

  • CVE-2012-3319Oct 1, 2012
    IBM
    Rational Business Developer
    risk 0.00cvss —epss 0.01

    IBM Rational Business Developer 8.x before 8.0.1.4 allows remote attackers to obtain potentially sensitive information via a connection to a web service created with the Rational Business Developer product.

  • CVE-2012-3035Oct 1, 2012
    Emerson
    Deltav
    risk 0.00cvss —epss 0.02

    Buffer overflow in Emerson DeltaV 9.3.1 and 10.3 through 11.3.1 allows remote attackers to cause a denial of service (daemon crash) via a long string to an unspecified port.

  • CVE-2012-0748Oct 1, 2012
    IBM
    Rational Team Concert
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in unspecified services in IBM Rational Team Concert (RTC) 4.x before 4.0.0.1 allow remote attackers to hijack the authentication of arbitrary users for requests that modify work items.

  • CVE-2012-4450Oct 1, 2012
    Fedoraproject
    389 Directory Server
    risk 0.00cvss —epss 0.02

    389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn operation, which allows remote authenticated users with certain permissions to bypass ACL restrictions and access the DN entry.

  • CVE-2012-4437Oct 1, 2012
    Smarty
    Smarty
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception.

  • CVE-2012-4432Oct 1, 2012
    Optipng Project
    Optipng
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in opngreduc.c in OptiPNG Hg and 0.7.x before 0.7.3 might allow remote attackers to execute arbitrary code via unspecified vectors related to "palette reduction."

  • CVE-2012-4427Oct 1, 2012
    GNOME Foundation
    Gnome Shell
    risk 0.00cvss —epss 0.01

    The gnome-shell plugin 3.4.1 in GNOME allows remote attackers to force the download and installation of arbitrary extensions from extensions.gnome.org via a crafted web page.

  • CVE-2012-4415Oct 1, 2012
    Guacamole
    Guacamole
    risk 0.04cvss —epss 0.14

    Stack-based buffer overflow in the guac_client_plugin_open function in libguac in Guacamole before 0.6.3 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long protocol name.

  • CVE-2012-4429Oct 1, 2012
    Vino
    Vino
    risk 0.00cvss —epss 0.02

    Vino 2.28, 2.32, 3.4.2, and earlier allows remote attackers to read clipboard activity by listening on TCP port 5900.

  • CVE-2012-3500Oct 1, 2012
    Devscripts Devel Team
    Devscripts
    risk 0.00cvss —epss 0.00

    scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.

  • CVE-2012-2242Oct 1, 2012
    Devscripts Devel Team
    Devscripts
    risk 0.00cvss —epss 0.02

    scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes file, related to "arguments to external commands" that are not properly escaped, a different vulnerability than CVE-2012-2240.

  • CVE-2012-2241Oct 1, 2012
    Devscripts Devel Team
    Devscripts
    risk 0.00cvss —epss 0.02

    scripts/dget.pl in devscripts before 2.12.3 allows remote attackers to delete arbitrary files via a crafted (1) .dsc or (2) .changes file, probably related to a NULL byte in a filename.

  • CVE-2012-2240Oct 1, 2012
    Devscripts Devel Team
    Devscripts
    risk 0.00cvss —epss 0.03

    scripts/dscverify.pl in devscripts before 2.12.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to "arguments to external commands."

  • CVE-2012-2153Oct 1, 2012
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content…

  • CVE-2012-1591Oct 1, 2012
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.

  • CVE-2012-1590Oct 1, 2012
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page.

  • CVE-2012-1588Oct 1, 2012
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Algorithmic complexity vulnerability in the _filter_url function in the text filtering system (modules/filter/filter.module) in Drupal 7.x before 7.14 allows remote authenticated users with certain roles to cause a denial of service (CPU consumption) via a long email address.

  • CVE-2011-4551Oct 1, 2012
    Tiki
    Tikiwiki CMS\/groupware
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in tiki-cookie-jar.php in TikiWiki CMS/Groupware before 8.2 and LTS before 6.5 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters.

  • CVE-2012-4448Sep 28, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard_incoming_links edit action.

  • CVE-2012-1833Sep 28, 2012
    VMware
    SpringSource Grails
    risk 0.00cvss —epss 0.01

    VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.

  • CVE-2012-5197Sep 28, 2012
    Condor Project
    Condor
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 have unknown impact and attack vectors related to "error checking of system calls."

  • CVE-2012-5196Sep 28, 2012
    Condor Project
    Condor
    risk 0.00cvss —epss 0.02

    Multiple buffer overflows in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 have unknown impact and attack vectors.

  • CVE-2012-3493Sep 28, 2012
    Condor Project
    Condor
    risk 0.00cvss —epss 0.02

    The command_give_request_ad function in condor_startd.V6/command.cpp Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 allows remote attackers to obtain sensitive information, and possibly control or start arbitrary jobs, via a ClassAd request to the condor_startd port, which…

  • CVE-2012-3492Sep 28, 2012
    Condor Project
    Condor
    risk 0.00cvss —epss 0.03

    The filesystem authentication (condor_io/condor_auth_fs.cpp) in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 uses authentication directories even when they have weak permissions, which allows remote attackers to impersonate users by renaming a user's authentication…

  • CVE-2012-3491Sep 28, 2012
    Condor Project
    Condor
    risk 0.00cvss —epss 0.02

    src/condor_schedd.V6/schedd.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the permissions of jobs, which allows remote authenticated users to remove arbitrary idle jobs via unspecified vectors.

  • CVE-2012-3459Sep 28, 2012
    Trevor Mckay
    Cumin
    risk 0.00cvss —epss 0.02

    Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to modify Condor attributes and possibly gain privileges via crafted additional parameters in an HTTP POST request, which triggers a job attribute…

  • CVE-2012-2735Sep 28, 2012
    Trevor Mckay
    Cumin
    risk 0.00cvss —epss 0.02

    Session fixation vulnerability in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote attackers to hijack web sessions via a crafted session cookie.

  • CVE-2012-2734Sep 28, 2012
    Trevor Mckay
    Cumin
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to hijack the authentication of arbitrary users for requests that execute commands via unspecified…

  • CVE-2012-2685Sep 28, 2012
    Trevor Mckay
    Cumin
    risk 0.00cvss —epss 0.02

    Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to cause a denial of service (memory consumption) via a large size in an image request.