VYPR

CVEs

386,738 total · page 6688 of 7,735

AllCriticalHighKEV
  • CVE-2012-3901Sep 16, 2012
    Cisco Systems, Inc.
    IPS 4200 series sensors
    risk 0.00cvss —epss 0.01

    The updateTime function in sensorApp on Cisco IPS 4200 series sensors 7.0 and 7.1 allows remote attackers to cause a denial of service (process crash and traffic-inspection outage) via network traffic, aka Bug ID CSCta96144.

  • CVE-2012-3899Sep 16, 2012
    Cisco Systems, Inc.
    IPS 4200 series
    risk 0.00cvss —epss 0.01

    sensorApp on Cisco IPS 4200 series sensors 6.0, 6.2, and 7.0 does not properly allocate memory, which allows remote attackers to cause a denial of service (memory corruption and process crash, and traffic-inspection outage) via network traffic, aka Bug ID CSCtn23051.

  • CVE-2012-3895Sep 16, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Cisco IOS 15.0 through 15.3 allows remote authenticated users to cause a denial of service (device crash) via an MVPNv6 update, aka Bug ID CSCty89224.

  • CVE-2012-3893Sep 16, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    The FlexVPN implementation in Cisco IOS 15.2 and 15.3 allows remote authenticated users to cause a denial of service (spoke crash) via spoke-to-spoke traffic, aka Bug ID CSCtz02622.

  • CVE-2012-3096Sep 16, 2012
    Cisco Systems, Inc.
    Unity Connection
    risk 0.00cvss —epss 0.01

    Cisco Unity Connection (UC) 7.1, 8.0, and 8.5 allows remote authenticated users to cause a denial of service (resource consumption and administration outage) via extended use of the product, aka Bug ID CSCtd79132.

  • CVE-2012-3094Sep 16, 2012
    Cisco Systems, Inc.
    Anyconnect Secure Mobility Client
    risk 0.00cvss —epss 0.01

    The VPN downloader in the download_install component in Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495 on Linux accepts arbitrary X.509 server certificates without user interaction, which allows remote attackers to obtain sensitive information via vectors…

  • CVE-2012-3088Sep 16, 2012
    Cisco Systems, Inc.
    Anyconnect Secure Mobility Client
    risk 0.00cvss —epss 0.02

    Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495, and 3.2.x, does not check whether an HTTP request originally contains ScanSafe headers, which allows remote attackers to have an unspecified impact via a crafted request, aka Bug ID CSCua13166.

  • CVE-2012-3079Sep 16, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.2 allows remote attackers to cause a denial of service (CPU consumption) by establishing many IPv6 neighbors, aka Bug ID CSCtn78957.

  • CVE-2012-3060Sep 16, 2012
    Cisco Systems, Inc.
    Unity Connection
    risk 0.00cvss —epss 0.01

    Cisco Unity Connection (UC) 8.6, 9.0, and 9.5 allows remote attackers to cause a denial of service (CPU consumption) via malformed UDP packets, aka Bug ID CSCtz76269.

  • CVE-2012-3052Sep 16, 2012
    Cisco Systems, Inc.
    VPN Client
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in Cisco VPN Client 5.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka Bug ID CSCua28747.

  • CVE-2012-3051Sep 16, 2012
    Cisco Systems, Inc.
    Nexus 7000
    risk 0.00cvss —epss 0.01

    Cisco NX-OS 5.2 and 6.1 on Nexus 7000 series switches allows remote attackers to cause a denial of service (process crash or packet loss) via a large number of ARP packets, aka Bug ID CSCtr44822.

  • CVE-2012-4930Sep 15, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP…

  • CVE-2012-4929Sep 15, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.04

    The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by…

  • CVE-2012-4928Sep 15, 2012
    Oxwall
    Oxwall
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ow_updates/index.php in Oxwall 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the plugin parameter.

  • CVE-2012-4927Sep 15, 2012
    Limesurvey
    Limesurvey
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attackers to execute arbitrary SQL commands via the fieldnames parameter to index.php.

  • CVE-2012-4926Sep 15, 2012
    Imgpals
    Img Pals Photo Host
    risk 0.03cvss —epss 0.02

    approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activation of administrators via the u parameter in an (1) app0 (disable) or (2) app1 (enable) action.

  • CVE-2012-4925Sep 15, 2012
    Imgpals
    Img Pals Photo Host
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in approve.php in Img Pals Photo Host 1.0 allow remote attackers to execute arbitrary SQL commands via the u parameter in a (1) app0 or (2) app1 action. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2012-4924Sep 15, 2012
    Asus
    Net4switch
    risk 0.06cvss —epss 0.36

    Buffer overflow in the CxDbgPrint function in the ipswcom.dll ActiveX component 1.0.0.1 for ASUS Net4Switch 1.0.0020 allows remote attackers to execute arbitrary code via a long parameter to the Alert method.

  • CVE-2012-4923Sep 15, 2012
    Endian
    Firewall
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Endian Firewall 2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) createrule parameter to dnat.cgi, (2) addrule parameter to dansguardian.cgi, or (3) PATH_INFO to openvpn_users.cgi.

  • CVE-2012-4336Sep 15, 2012
    Flogr
    Flogr
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Flogr 2.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO or (2) an arbitrary parameter.

  • CVE-2012-3458Sep 15, 2012
    Python (programming language)
    Beaker
    risk 0.00cvss —epss 0.02

    Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.

  • CVE-2012-3233Sep 15, 2012
    Kayako
    Fusion
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in __swift/thirdparty/PHPExcel/PHPExcel/Shared/JAMA/docs/download.php in Kayako Fusion 4.40.1148, and possibly before 4.50.1581, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  • CVE-2012-2275Sep 15, 2012
    Testlink
    Testlink
    risk 0.00cvss —epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijack the authentication of users for requests that add, delete, or modify sensitive information, as demonstrated by changing the administrator's email via an…

  • CVE-2011-5176Sep 15, 2012
    Bananadance
    Banana Dance
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in search.php in Banana Dance, possibly B.1.5 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) q or (2) category parameter.

  • CVE-2011-5175Sep 15, 2012
    Bananadance
    Banana Dance
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in search.php in Banana Dance, possibly B.1.5 and earlier, allows remote attackers to execute arbitrary SQL commands via the category parameter.

  • CVE-2011-5174Sep 15, 2012
    Intel
    C206 Chipset
    risk 0.00cvss —epss 0.00

    Buffer overflow in Intel Trusted Execution Technology (TXT) SINIT Authenticated Code Modules (ACM) in Intel Q67 Express, C202, C204, C206 Chipsets, and Mobile Intel QM67, and QS67 Chipset before 2nd_gen_i5_i7_SINIT_51.BIN Express; Intel Q57, 3450 Chipsets and Mobile Intel QM57…

  • CVE-2011-5173Sep 15, 2012
    Bugbear Entertainment
    Flatout
    risk 0.03cvss —epss 0.03

    Buffer overflow in Bugbear Entertainment FlatOut 2005 allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the title field in a bed file.

  • CVE-2011-5172Sep 15, 2012
    StoryBoard Quick
    StoryBoard Quick
    risk 0.04cvss —epss 0.06

    Stack-based buffer overflow in StoryBoard Quick 6 Build 3786, and possibly StoryBoard Artist and StoryBoard Studio, allows remote attackers to execute arbitrary code via a long string in the string element field in a frame xml file.

  • CVE-2011-5171Sep 15, 2012
    Cyberlink
    Power2go
    risk 0.07cvss —epss 0.46

    Multiple stack-based buffer overflows in CyberLink Power2Go 7 (build 196) and 8 (build 1031) allow remote attackers to execute arbitrary code via the (1) src and (2) name parameters in a p2g project file.

  • CVE-2011-5170Sep 15, 2012
    Castillo Bueno Systems
    CCMPlayer
    risk 0.06cvss —epss 0.32

    Stack-based buffer overflow in Castillo Bueno Systems CCMPlayer 1.5 allows remote attackers to execute arbitrary code via a long track name in an m3u playlist.

  • CVE-2011-5169Sep 15, 2012
    SonicWall
    ViewPoint
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in sgms/reports/scheduledreports/configure/scheduleProps.jsp in SonicWall ViewPoint 6.0 SP2 allows remote attackers to execute arbitrary SQL commands via the scheduleID parameter.

  • CVE-2011-5168Sep 15, 2012
    Bananadance
    Banana Dance
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in user.php in Banana Dance before B.1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2011-5167Sep 15, 2012
    Tidestone
    Formula One Activex Control
    risk 0.04cvss —epss 0.10

    Heap-based buffer overflow in the SetDevNames method of the Tidestone Formula One ActiveX control (TTF16.ocx) 6.3.5 Build 1 in Oracle Hyperion Strategic Finance 12.x and possibly earlier allows remote attackers to execute arbitrary code via a long string to the DriverName…

  • CVE-2011-5166Sep 15, 2012
    KnFTP
    KnFTP
    risk 0.04cvss —epss 0.06

    Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary code via a long string to the (1) USER, (2) PASS, (3) REIN, (4) QUIT, (5) PORT, (6) PASV, (7) TYPE, (8) STRU, (9) MODE, (10) RETR, (11) STOR, (12) APPE, (13) ALLO, (14) REST, (15)…

  • CVE-2011-5165Sep 15, 2012
    Cleanersoft
    Free Mp3 Cd Ripper
    risk 0.06cvss —epss 0.37

    Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted .wav file.

  • CVE-2011-5164Sep 15, 2012
    VanDyke Software
    Absoluteftp
    risk 0.05cvss —epss 0.29

    Stack-based buffer overflow in VanDyke Software AbsoluteFTP 1.9.6 through 2.2.10 allows remote FTP servers to execute arbitrary code via a crafted file name in a LIST command response.

  • CVE-2011-5163Sep 15, 2012
    Schneider Electric
    Citectscada
    risk 0.00cvss —epss 0.00

    Buffer overflow in an unspecified third-party component in the Batch module for Schneider Electric CitectSCADA before 7.20 and Mitsubishi MX4 SCADA before 7.20 allows local users to execute arbitrary code via a long string in a login sequence.

  • CVE-2011-5162Sep 15, 2012
    Gomlab
    GOM Player
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in GOM Player 2.1.33.5071 allows user-assisted remote attackers to execute arbitrary code via a .ASX file with a long URI in the "ref href" tag. NOTE: this issue exists because of a CVE-2007-0707 regression.

  • CVE-2012-4360Sep 15, 2012
    Google
    Mod Pagespeed
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the mod_pagespeed module 0.10.19.1 through 0.10.22.4 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-4001Sep 15, 2012
    Google
    Mod Pagespeed
    risk 0.00cvss —epss 0.01

    The mod_pagespeed module before 0.10.22.6 for the Apache HTTP Server does not properly verify its host name, which allows remote attackers to trigger HTTP requests to arbitrary hosts via unspecified vectors, as demonstrated by requests to intranet servers.

  • CVE-2012-4817Sep 14, 2012
    IBM
    Aix
    risk 0.01cvss —epss 0.08

    The NFSv4 client implementation in IBM AIX 5.3, 6.1, and 7.1, and VIOS before 2.2.1.4-FP-25 SP-02, does not properly handle GID values, which allows remote attackers to cause a denial of service via unspecified vectors.

  • CVE-2012-4683Sep 14, 2012
    Bitcoin Foundation
    Bitcoind
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in bitcoind and Bitcoin-Qt allows attackers to cause a denial of service via unknown vectors, a different vulnerability than CVE-2012-4682.

  • CVE-2012-4682Sep 14, 2012
    Bitcoin Foundation
    Bitcoind
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in bitcoind and Bitcoin-Qt allows attackers to cause a denial of service via unknown vectors, a different vulnerability than CVE-2012-4683.

  • CVE-2012-4013Sep 14, 2012
    Cybozu
    Kunai Browser For Remote Service
    risk 0.00cvss —epss 0.01

    The WebView class in the Cybozu KUNAI Browser for Remote Service application beta for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file:…

  • CVE-2012-4422Sep 14, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin…

  • CVE-2012-4421Sep 14, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticated users to bypass intended access restrictions and publish new posts by leveraging the Contributor role and using the…

  • CVE-2010-5106Sep 14, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended access restrictions, and publish, edit, or delete posts, by leveraging the Author or Contributor role.

  • CVE-2012-4922Sep 14, 2012
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    The tor_timegm function in common/util.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.22-rc, does not properly validate time values, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed directory object, a different…

  • CVE-2012-4419Sep 14, 2012
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    The compare_tor_addr_to_addr_policy function in or/policies.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.21-rc, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a zero-valued port field that is not properly handled during policy…

  • CVE-2012-4244Sep 14, 2012
    Isc
    Bind
    risk 0.03cvss —epss 0.37

    ISC BIND 9.x before 9.7.6-P3, 9.8.x before 9.8.3-P3, 9.9.x before 9.9.1-P3, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P3 allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a long resource record.