VYPR

CVEs

386,738 total · page 6691 of 7,735

AllCriticalHighKEV
  • CVE-2012-2784Sep 10, 2012
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the decode_pic function in libavcodec/cavsdec.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to "width/height changing in CAVS," a different vulnerability than…

  • CVE-2012-2783Sep 10, 2012
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in libavcodec/vp56.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.5, has unknown impact and attack vectors, related to "freeing the returned frame."

  • CVE-2012-2782Sep 10, 2012
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the decode_slice_header function in libavcodec/h264.c in FFmpeg before 0.11 has unknown impact and attack vectors, related to a "rejected resolution change."

  • CVE-2012-2779Sep 10, 2012
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the decode_frame function in libavcodec/indeo5.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to an invalid "gop header" and decoding in a "half initialized context."

  • CVE-2012-2777Sep 10, 2012
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the decode_pic function in libavcodec/cavsdec.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to "width/height changing in CAVS," a different vulnerability than…

  • CVE-2012-2776Sep 10, 2012
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the decode_cell_data function in libavcodec/indeo3.c in FFmpeg before 0.11 and Libav 0.8.x before 0.8.4 has unknown impact and attack vectors, related to an "out of picture write."

  • CVE-2012-2775Sep 10, 2012
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the read_var_block_data function in libavcodec/alsdec.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to a large order and an "out of array write in quant_cof."

  • CVE-2012-2774Sep 10, 2012
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.03

    The ff_MPV_frame_start function in libavcodec/mpegvideo.c in FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) via unspecified vectors, related to starting "a frame outside SETUP state."

  • CVE-2012-2772Sep 10, 2012
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the ff_rv34_decode_frame function in libavcodec/rv34.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to "width/height changing with frame threading."

  • CVE-2012-3326Sep 10, 2012
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote attackers…

  • CVE-2012-3313Sep 10, 2012
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows…

  • CVE-2012-2185Sep 10, 2012
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    IBM Maximo Asset Management 6.2 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote authenticated users to obtain sensitive…

  • CVE-2012-2184Sep 10, 2012
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in IBM Maximo Asset Management 7.1 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote…

  • CVE-2012-2183Sep 10, 2012
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.02

    Session fixation vulnerability in IBM Maximo Asset Management 6.2 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote…

  • CVE-2012-0747Sep 10, 2012
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in IBM Maximo Asset Management 6.2 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote…

  • CVE-2012-0746Sep 10, 2012
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote…

  • CVE-2012-0728Sep 10, 2012
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote…

  • CVE-2012-0727Sep 10, 2012
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in IBM Maximo Asset Management 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote authenticated users to…

  • CVE-2012-0714Sep 10, 2012
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IBM Maximo Asset Management 6.2 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB),…

  • CVE-2012-4885Sep 9, 2012
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    The wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to cause a denial of service (infinite loop) via certain input, as demonstrated by the padleft function.

  • CVE-2012-2316Sep 9, 2012
    Openkm
    Openkm
    risk 0.03cvss —epss 0.04

    Cross-site request forgery (CSRF) vulnerability in servlet/admin/AuthServlet.java in OpenKM 5.1.7 and other versions before 5.1.8-2 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary code via the script parameter to…

  • CVE-2012-2315Sep 9, 2012
    Openkm
    Openkm
    risk 0.03cvss —epss 0.06

    admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remote authenticated users to assign administrator privileges to arbitrary users via the userEdit action.

  • CVE-2012-2115Sep 9, 2012
    Openemr
    Openemr
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter.

  • CVE-2012-1912Sep 9, 2012
    PHP Address
    PHP Address
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in preferences.php in PHP Address Book 7.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the from parameter. NOTE: the index.php vector is already covered by CVE-2008-2566.

  • CVE-2012-1911Sep 9, 2012
    PHP Address
    PHP Address
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in PHP Address Book 6.2.12 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) to_group parameter to group.php or (2) id parameter to vcard.php. NOTE: the edit.php vector is already covered by CVE-2008-2565.

  • CVE-2012-1649Sep 9, 2012
    Drupal
    Cool Aid
    risk 0.00cvss —epss 0.01

    Cool Aid module before 6.x-1.9 for Drupal does not enforce access restrictions, which allows remote authenticated users with the administer coolaid permission to modify arbitrary pages via unspecified vectors.

  • CVE-2012-1648Sep 9, 2012
    Danielb
    Cool Aid
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Cool Aid module before 6.x-1.9 for Drupal allows remote authenticated users with the administer coolaid permission to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1582Sep 9, 2012
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to inject arbitrary web script or HTML via a crafted page with "forged strip item markers," as demonstrated using the CharInsert…

  • CVE-2012-1581Sep 9, 2012
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users.

  • CVE-2012-1580Sep 9, 2012
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in Special:Upload in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to hijack the authentication of unspecified victims for requests that upload files.

  • CVE-2012-1579Sep 9, 2012
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 includes private data such as CSRF tokens in a JavaScript file, which allows remote attackers to obtain sensitive information.

  • CVE-2012-1578Sep 9, 2012
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that (1) block a user via a request to the Block module or…

  • CVE-2012-1152Sep 9, 2012
    Ingy
    YAML
    risk 0.00cvss —epss 0.02

    Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and perl-YAML-LibYAML) module 0.38 for Perl allow remote attackers to cause a denial of service (process crash) via format string specifiers in a (1) YAML stream to…

  • CVE-2012-1151Sep 9, 2012
    Perl Foundation
    Perl
    risk 0.00cvss —epss 0.03

    Multiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.19.0 for Perl allow remote PostgreSQL database servers to cause a denial of service (process crash) via format string specifiers in (1) a crafted database warning to the…

  • CVE-2011-5161Sep 9, 2012
    Openemr
    Openemr
    risk 0.03cvss —epss 0.02

    Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the patient…

  • CVE-2011-5160Sep 9, 2012
    Openemr
    Openemr
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web script or HTML via the site parameter.

  • CVE-2011-5159Sep 9, 2012
    Geeklog
    Geeklog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin/configuration.php in Geeklog before 1.7.1sr1 allows remote attackers to inject arbitrary web script or HTML via the sub_group parameter, a different vulnerability than CVE-2011-4942.

  • CVE-2011-4942Sep 9, 2012
    Geeklog
    Geeklog
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in admin/configuration.php in Geeklog before 1.7.1sr1 allow remote attackers to inject arbitrary web script or HTML via the (1) subgroup or (2) conf_group parameters. NOTE: this vulnerability might require a user-assisted…

  • CVE-2012-4012Sep 8, 2012
    Cybozu
    Kunai
    risk 0.00cvss —epss 0.01

    The WebView class in the Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL.

  • CVE-2012-4011Sep 8, 2012
    Cybozu
    Kunai
    risk 0.00cvss —epss 0.03

    The Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site.

  • CVE-2012-3257Sep 8, 2012
    Microfocus
    Business Availability Center
    risk 0.00cvss —epss 0.01

    HP Business Availability Center (BAC) 8.07 allows remote authenticated users to hijack web sessions via unspecified vectors.

  • CVE-2012-3256Sep 8, 2012
    Microfocus
    Business Availability Center
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in HP Business Availability Center (BAC) 8.07 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2012-3255Sep 8, 2012
    Microfocus
    Business Availability Center
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 8.07 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-3004Sep 8, 2012
    Realflex
    Realwin
    risk 0.00cvss —epss 0.00

    Multiple untrusted search path vulnerabilities in RealFlex RealWin before 2.1.13, FlexView before 3.1.86, and RealWinDemo before 2.1.13 allow local users to gain privileges via a Trojan horse (1) realwin.dll or (2) keyhook.dll file in the current working directory.

  • CVE-2012-1666Sep 8, 2012
    VMware
    Workstation
    risk 0.03cvss —epss 0.01

    Untrusted search path vulnerability in VMware Tools in VMware Workstation before 8.0.4, VMware Player before 4.0.4, VMware Fusion before 4.1.2, VMware View before 5.1, and VMware ESX 4.1 before U3 and 5.0 before P03 allows local users to gain privileges via a Trojan horse…

  • CVE-2012-0254Sep 8, 2012
    Honeywell
    Enterprise Building Manager
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the HMIWeb Browser HSCDSPRenderDLL ActiveX control in Honeywell Process Solutions (HPS) Experion R2xx, R30x, R31x, and R400.x; Honeywell Building Solutions (HBS) Enterprise Building Manager R400 and R410.1; and Honeywell Environmental Combustion…

  • CVE-2012-4388Sep 7, 2012
    PHP
    PHP
    risk 0.00cvss —epss 0.04

    The sapi_header_op function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0 does not properly determine a pointer during checks for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted…

  • CVE-2012-4883Sep 7, 2012
    3DVIA
    Composer
    risk 0.00cvss —epss 0.00

    Multiple untrusted search path vulnerabilities in 3DVIA Composer V6R2012 HF1 Build 6.8.1.1652 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2) ibfs32.dll file in the current working directory, as demonstrated by a directory that contains a .smg file.…

  • CVE-2012-4882Sep 7, 2012
    3D XML Player
    3D XML Player
    risk 0.00cvss —epss 0.00

    Multiple untrusted search path vulnerabilities in 3D XML Player 6.212.13.12076 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2) JT0DevPhase.dll file in the current working directory, as demonstrated by a directory that contains a .3dx file. NOTE: the…

  • CVE-2012-4881Sep 7, 2012
    MoviEZ
    HD
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in moviEZ HD 1.0 Build 2554-29894-A allows local users to gain privileges via a Trojan horse avrt.dll file in the current working directory, as demonstrated by a directory that contains a .mvz file. NOTE: the provenance of this information is…