VYPR

CVEs

386,696 total · page 6694 of 7,734

AllCriticalHighKEV
  • CVE-2012-4390Sep 5, 2012
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.02

    (1) apps/calendar/appinfo/remote.php and (2) apps/contacts/appinfo/remote.php in ownCloud before 4.0.7 allows remote authenticated users to enumerate the registered users via unspecified vectors.

  • CVE-2012-4389Sep 5, 2012
    OwnCloud
    Owncloud
    risk 0.00cvss —epss 0.03

    Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.7 allows remote attackers to execute arbitrary code by uploading a crafted .htaccess file in an import.zip file and accessing an uploaded PHP file.

  • CVE-2012-4387Sep 5, 2012
    Apache
    Struts
    risk 0.00cvss —epss 0.08

    Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.

  • CVE-2012-4386Sep 5, 2012
    Apache
    Struts
    risk 0.00cvss —epss 0.03

    The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session…

  • CVE-2012-3551Sep 5, 2012
    Dell
    Crowbar
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in crowbar_framework/app/views/support/index.html.haml in the Crowbar barclamp in Crowbar, possibly 1.4 and earlier, allows remote attackers to inject arbitrary web script or HTML via the file parameter to /utils.

  • CVE-2012-3542Sep 5, 2012
    OpenStack
    Essex
    risk 0.00cvss —epss 0.03

    OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was…

  • CVE-2012-3540Sep 5, 2012
    OpenStack
    Horizon
    risk 0.00cvss —epss 0.03

    Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/. NOTE: this issue was originally…

  • CVE-2012-3537Sep 5, 2012
    Dell
    Crowbar
    risk 0.00cvss —epss 0.01

    The Crowbar Ohai plugin (chef/cookbooks/ohai/files/default/plugins/crowbar.rb) in the Deployer Barclamp in Crowbar, possibly 1.4 and earlier, allows local users to execute arbitrary shell commands via vectors related to "insecure handling of tmp files" and predictable file names.

  • CVE-2012-3535Sep 5, 2012
    Uclouvain
    Openjpeg
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in OpenJPEG 1.5.0 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted JPEG2000 file.

  • CVE-2012-3531Sep 5, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-3530Sep 5, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.

  • CVE-2012-3529Sep 5, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.

  • CVE-2012-3528Sep 5, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-3527Sep 5, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a…

  • CVE-2012-3526Sep 5, 2012
    Thomas Eibner
    Mod Rpaf
    risk 0.01cvss —epss 0.07

    The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service (server or application crash) via multiple X-Forwarded-For headers in a request.

  • CVE-2012-3509Sep 5, 2012
    GNU
    Binutils
    risk 0.00cvss —epss 0.04

    Multiple integer overflows in the (1) _objalloc_alloc function in objalloc.c and (2) objalloc_alloc macro in include/objalloc.h in GNU libiberty, as used by binutils 2.22, allow remote attackers to cause a denial of service (crash) via vectors related to the "addition of…

  • CVE-2011-3146Sep 5, 2012
    GNOME Foundation
    Librsvg
    risk 0.00cvss —epss 0.04

    librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference) and possibly execute arbitrary code via a SVG file with a node with the element name starting with "fe," which…

  • CVE-2010-4819Sep 5, 2012
    Xorg
    Xserver
    risk 0.00cvss —epss 0.00

    The ProcRenderAddGlyphs function in the Render extension (render/render.c) in X.Org xserver 1.7.7 and earlier allows local users to read arbitrary memory and possibly cause a denial of service (server crash) via unspecified vectors related to an "input sanitization flaw."

  • CVE-2010-4818Sep 5, 2012
    Xorg
    Xserver
    risk 0.00cvss —epss 0.05

    The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via (1) a crafted request that triggers a client swap in glx/glxcmdsswap.c; or (2) a crafted length or (3) a negative value…

  • CVE-2012-3012Sep 5, 2012
    Arbiter
    Power Sentinel
    risk 0.00cvss —epss 0.01

    The Arbiter Power Sentinel 1133A device with firmware before 11Jun2012 Rev 421 allows remote attackers to cause a denial of service (Ethernet outage) via unspecified Ethernet traffic that fills a buffer, as demonstrated by a port scan.

  • CVE-2011-4452Sep 5, 2012
    Wikkawiki
    Wikkawiki
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in the AdminUsers component in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to hijack the authentication of administrators for requests that remove arbitrary user accounts via a delete operation, as demonstrated by an…

  • CVE-2011-4451Sep 5, 2012
    Wikkawiki
    Wikkawiki
    risk 0.04cvss —epss 0.14

    libs/Wakka.class.php in WikkaWiki 1.3.1 and 1.3.2, when the spam_logging option is enabled, allows remote attackers to write arbitrary PHP code to the spamlog_path file via the User-Agent HTTP header in an addcomment request. NOTE: the vendor disputes this issue because the…

  • CVE-2011-4450Sep 5, 2012
    Wikkawiki
    Wikkawiki
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in handlers/files.xml/files.xml.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to read or delete arbitrary files via a non-initial .. (dot dot) in the file parameter, as demonstrated by the /../../wikka.config.php pathname in a…

  • CVE-2011-4449Sep 5, 2012
    Wikkawiki
    Wikkawiki
    risk 0.03cvss —epss 0.04

    actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET_MODE is enabled, supports file uploads for file extensions that are typically absent from an Apache HTTP Server TypesConfig file, which makes it easier for remote attackers to execute arbitrary PHP code by…

  • CVE-2011-4448Sep 5, 2012
    Wikkawiki
    Wikkawiki
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in actions/usersettings/usersettings.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to execute arbitrary SQL commands via the default_comment_display parameter in an update action.

  • CVE-2012-2068Sep 5, 2012
    Drupal
    Fancy Slide
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in fancy_slide.module in the Fancy Slide module before 6.x-2.7 for Drupal allow remote authenticated users with the administer fancy_slide permission to inject arbitrary web script or HTML via the (1) node_title or (2)…

  • CVE-2012-2067Sep 5, 2012
    Drupal
    CKEditor
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the CKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal, when the core PHP module is enabled, allows remote authenticated users or remote attackers to execute arbitrary PHP code…

  • CVE-2012-2066Sep 5, 2012
    Fckeditor
    Fckeditor
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal allows remote authenticated users or remote attackers to inject arbitrary web script or HTML via…

  • CVE-2012-2065Sep 5, 2012
    Drupal
    Language Icons
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Language Icons module 6.x-2.x before 6.x-2.1 and 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with administer languages permissions to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-2064Sep 5, 2012
    Drupal
    Views Language Switcher
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in theme/views_lang_switch.theme.inc in the Views Language Switcher module before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter.

  • CVE-2012-2063Sep 5, 2012
    Drupal
    Slidebox
    risk 0.00cvss —epss 0.02

    The Slidebox module before 7.x-1.4 for Drupal does not properly check permissions, which allows remote attackers to obtain sensitive information via unspecified vectors.

  • CVE-2012-2109Sep 4, 2012
    Buddypress
    Buddypress
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands via the page parameter in an activity_widget_filter action.

  • CVE-2012-1614Sep 4, 2012
    Coppermine
    Coppermine Photo Gallery
    risk 0.04cvss —epss 0.09

    Coppermine Photo Gallery before 1.5.20 allows remote attackers to obtain sensitive information via (1) a direct request to plugins/visiblehookpoints/index.php, an invalid (2) page or (3) cat parameter to thumbnails.php, an invalid (4) page parameter to usermgr.php, or an invalid…

  • CVE-2012-1613Sep 4, 2012
    Coppermine
    Coppermine Photo Gallery
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in edit_one_pic.php in Coppermine Photo Gallery before 1.5.20 allows remote authenticated users with certain privileges to inject arbitrary web script or HTML via the keywords parameter.

  • CVE-2012-1608Sep 4, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.

  • CVE-2012-1607Sep 4, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.03

    The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.

  • CVE-2012-1606Sep 4, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1605Sep 4, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."

  • CVE-2012-4747Sep 4, 2012
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Bugzilla 2.x and 3.x through 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 stores potentially sensitive information under the web root with insufficient access control, which allows remote attackers to read (1) template (aka .tmpl)…

  • CVE-2012-3981Sep 4, 2012
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 does not restrict the characters in a username, which might allow remote attackers to inject data into an LDAP directory via a crafted…

  • CVE-2012-3582Sep 4, 2012
    Symantec
    Pgp Universal Server
    risk 0.00cvss —epss 0.01

    Symantec PGP Universal Server 3.2.x before 3.2.1 MP2 does not properly manage sessions that include key search requests, which might allow remote attackers to read a private key in opportunistic circumstances by making a request near the end of a user's session.

  • CVE-2012-3014Sep 4, 2012
    Garrettcom
    Magnum Managed Networks Software 6k
    risk 0.00cvss —epss 0.00

    The Management Software application in GarrettCom Magnum MNS-6K before 4.4.0, and 14.x before 14.4.0, has a hardcoded password for an administrative account, which allows local users to gain privileges via unspecified vectors.

  • CVE-2012-2288Sep 4, 2012
    EMC Corporation
    Networker
    risk 0.06cvss —epss 0.33

    Format string vulnerability in the nsrd RPC service in EMC NetWorker 7.6.3 and 7.6.4 before 7.6.4.1, and 8.0 before 8.0.0.1, allows remote attackers to execute arbitrary code via format string specifiers in a message.

  • CVE-2012-0275Sep 4, 2012
    Adobe Inc.
    Photoshop
    risk 0.01cvss —epss 0.09

    Heap-based buffer overflow in Photoshop.exe in Adobe Photoshop CS5 12.x before 12.0.5, CS5.1 12.1.x before 12.1.1, and CS6 13.x before 13.0.1 allows remote attackers to execute arbitrary code via a crafted TIFF image with SGI24LogLum compression.

  • CVE-2012-4746Aug 31, 2012
    Zte
    Zxdsl
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in accessaccount.cgi in ZTE ZXDSL 831IIV7.5.0a_Z29_OV allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysPassword parameter.

  • CVE-2012-4745Aug 31, 2012
    Acuity CMS
    Acuity CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/login.asp in Acuity CMS 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the UserName parameter.

  • CVE-2012-4744Aug 31, 2012
    Zeroboard
    Zeroboard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in ssearch.php in the Siche search module 0.5 for Zeroboard allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2012-4743Aug 31, 2012
    Eos.pe
    Siche Search Module
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ssearch.php in Siche search module 0.5 for Zeroboard allow remote attackers to execute arbitrary SQL commands via the (1) ss, (2) sm, (3) align, or (4) category parameters.

  • CVE-2012-4742Aug 31, 2012
    Packetfence
    Packetfence
    risk 0.00cvss —epss 0.03

    The web_node_register function in web.pm in PacketFence before 3.0.2 might allow remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2012-4741Aug 31, 2012
    Packetfence
    Packetfence
    risk 0.00cvss —epss 0.01

    The RADIUS extension in PacketFence before 3.3.0 uses a different user name than is used for authentication for users with custom VLAN assignment extensions, which allows remote attackers to spoof user identities via the User-Name RADIUS attribute.