VYPR

CVEs

386,605 total · page 6705 of 7,733

AllCriticalHighKEV
  • CVE-2012-3471Aug 12, 2012
    Ushahidi
    Ushahidi Platform
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the edit functions in (1) application/controllers/admin/reports.php and (2) application/controllers/members/reports.php in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via an incident id.

  • CVE-2012-3470Aug 12, 2012
    Ushahidi
    Ushahidi Platform
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in application/libraries/api/MY_Countries_Api_Object.php in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to _get_countries functions.

  • CVE-2012-3469Aug 12, 2012
    Ushahidi
    Ushahidi Platform
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the messages admin functionality in application/controllers/admin/messages.php, (2)…

  • CVE-2012-3468Aug 12, 2012
    Ushahidi
    Ushahidi Platform
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the verify function in application/controllers/alerts.php, (2) the save_all function in application/models/settings.php,…

  • CVE-2012-2590Aug 12, 2012
    Escon
    SupportPortal Professional Edition
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ESCON SupportPortal Professional Edition 3.0 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted SRC attribute of an IFRAME element, (3) a crafted…

  • CVE-2012-2587Aug 12, 2012
    Afterlogic
    Mailsuite Pro
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with a crafted SRC attribute of (1) an IFRAME element or (2) a SCRIPT element.

  • CVE-2012-2585Aug 12, 2012
    Manageengine
    Servicedesk Plus
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted Cascading Style Sheets (CSS) expression property, (3) a CSS…

  • CVE-2012-2573Aug 12, 2012
    T Dah
    WebMail
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in T-dah WebMail 3.2.0-2.3 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted Cascading Style Sheets (CSS) expression property, (3) a CSS expression…

  • CVE-2012-2571Aug 12, 2012
    Winwebmail
    Winwebmail Server
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in WinWebMail Server 3.8.1.6 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted Cascading Style Sheets (CSS) expression property, (3) a CSS…

  • CVE-2012-4249Aug 12, 2012
    Amazon
    Kindle Touch
    risk 0.00cvss —epss 0.04

    The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, as demonstrated by using lipc-set-prop to set an LIPC property, a different…

  • CVE-2012-4248Aug 12, 2012
    Amazon
    Kindle Touch
    risk 0.00cvss —epss 0.03

    The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface, which might allow remote attackers to have an unspecified impact via vectors involving the (1) dev.log, (2) lipc.set, (3) lipc.get, or (4) todo.scheduleItems…

  • CVE-2012-4070Aug 12, 2012
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in system/src/dispatcher.php in Dir2web 3.0 allows remote attackers to execute arbitrary SQL commands via the oid parameter in a homepage action to index.php.

  • CVE-2012-4069Aug 12, 2012
    risk 0.00cvss —epss 0.01

    Dir2web 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database via a direct request for system/db/website.db.

  • CVE-2012-2584Aug 12, 2012
    Alt N
    Mdaemon
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) the Cascading Style Sheets (CSS) expression property in conjunction with a CSS comment within the…

  • CVE-2012-2969Aug 12, 2012
    Caucho Technology
    Resin
    risk 0.00cvss —epss 0.04

    Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to bypass intended restrictions on filename extensions for created files via a %00 sequence in a pathname within an HTTP request.

  • CVE-2012-2968Aug 12, 2012
    Caucho Technology
    Resin
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to create files in arbitrary directories via a .. (dot dot) in a pathname within an HTTP request.

  • CVE-2012-2967Aug 12, 2012
    Caucho Technology
    Resin
    risk 0.00cvss —epss 0.02

    Caucho Quercus, as distributed in Resin before 4.0.29, does not properly implement the == (equals sign equals sign) operator for comparisons, which has unspecified impact and context-dependent attack vectors.

  • CVE-2012-2966Aug 12, 2012
    Caucho Technology
    Resin
    risk 0.00cvss —epss 0.02

    Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters, which has unspecified impact and remote attack vectors.

  • CVE-2012-2965Aug 12, 2012
    Caucho Technology
    Resin
    risk 0.00cvss —epss 0.02

    Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has unknown impact and remote attack vectors, related to an "HTTP Parameter Contamination" issue.

  • CVE-2012-2964Aug 12, 2012
    BreakingPoint
    Storm appliance
    risk 0.00cvss —epss 0.02

    The BreakingPoint Storm appliance before 3.0 requires cleartext credentials for establishing a session from a GUI administrative client, which allows remote attackers to obtain sensitive information by sniffing the network for XML documents.

  • CVE-2012-2963Aug 12, 2012
    BreakingPoint
    Storm appliance
    risk 0.00cvss —epss 0.02

    The administrative interface in the embedded web server on the BreakingPoint Storm appliance before 3.0 does not require authentication for the gwt/BugReport script, which allows remote attackers to obtain sensitive information by downloading a .tgz file.

  • CVE-2012-2602Aug 12, 2012
    SolarWinds
    Orion Network Performance Monitor
    risk 0.03cvss —epss 0.06

    Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts via CreateUserStepContainer actions to…

  • CVE-2012-2577Aug 12, 2012
    SolarWinds
    Orion Network Performance Monitor
    risk 0.04cvss —epss 0.10

    Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName field of an snmpd.conf file.

  • CVE-2012-4247Aug 12, 2012
    Phplist
    Phplist
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user, (2) remote_database, (3) remote_userprefix, (4) remote_password, or (5) remote_prefix…

  • CVE-2012-4246Aug 12, 2012
    Phplist
    Phplist
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page.

  • CVE-2012-4035Aug 12, 2012
    Pbboard
    Pbboard
    risk 0.03cvss —epss 0.03

    The new_password page in PBBoard 2.1.4 allows remote attackers to change the password of arbitrary user accounts via the member_id and new_password parameters to index.php.

  • CVE-2012-4034Aug 12, 2012
    Pbboard
    Pbboard
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via the (1) username parameter to the send page, (2) email parameter to the forget page, (3) password parameter to the forum_archive page, (4) section parameter to…

  • CVE-2012-3953Aug 12, 2012
    Phplist
    Phplist
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page.

  • CVE-2012-3952Aug 12, 2012
    Phplist
    Phplist
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.

  • CVE-2012-3457Aug 12, 2012
    Lingej
    Pnp4nagios
    risk 0.00cvss —epss 0.00

    PNP4Nagios 0.6 through 0.6.16 uses world-readable permissions for process_perfdata.cfg, which allows local users to obtain the Gearman shared secret by reading the file.

  • CVE-2012-3132Aug 10, 2012
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to execute arbitrary SQL commands via vectors involving CREATE INDEX with a CTXSYS.CONTEXT INDEXTYPE and…

  • CVE-2012-4235Aug 10, 2012
    Joomla
    RSGallery2
    risk 0.00cvss —epss 0.01

    The RSGallery2 (com_rsgallery2) component before 3.2.0 for Joomla! 2.5.x does not place index.html files in image directories, which allows remote attackers to list image filenames via a request for a directory URI.

  • CVE-2012-4071Aug 10, 2012
    Rsgallery2
    Com Rsgallery2
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the comments module in the RSGallery2 (com_rsgallery2) component before 2.3.0 for Joomla! 1.5.x, and before 3.2.0 for Joomla! 2.5.x, allows remote attackers to inject arbitrary web script or HTML via crafted BBCode markup in a comment.

  • CVE-2012-3554Aug 10, 2012
    Joomla
    RSGallery2
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the RSGallery2 (com_rsgallery2) component before 2.3.0 for Joomla! 1.5.x, and before 3.2.0 for Joomla! 2.5.x, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-3465Aug 10, 2012
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML…

  • CVE-2012-3464Aug 10, 2012
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a '…

  • CVE-2012-3463Aug 10, 2012
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag…

  • CVE-2012-2863Aug 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The PDF functionality in Google Chrome before 21.0.1180.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.

  • CVE-2012-2862Aug 9, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in the PDF functionality in Google Chrome before 21.0.1180.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.

  • CVE-2012-2745Aug 9, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.

  • CVE-2012-2744Aug 9, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6 module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets.

  • CVE-2012-2373Aug 9, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The Linux kernel before 3.4.5 on the x86 platform, when Physical Address Extension (PAE) is enabled, does not properly use the Page Middle Directory (PMD), which allows local users to cause a denial of service (panic) via a crafted application that triggers a race condition.

  • CVE-2012-2136Aug 9, 2012
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel before 3.4.5 does not properly validate a certain length value, which allows local users to cause a denial of service (heap-based buffer overflow and system crash) or possibly gain privileges by leveraging…

  • CVE-2012-4004Aug 8, 2012
    Fenrir Inc
    Sleipnir Mobile
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Sleipnir Mobile application 2.2.0 and earlier and Sleipnir Mobile Black Edition application 2.2.0 and earlier for Android allows remote attackers to inject arbitrary web script or HTML via a crafted application that interacts with…

  • CVE-2012-2649Aug 8, 2012
    Fenrir Inc
    Sleipnir Mobile
    risk 0.00cvss —epss 0.02

    The Sleipnir Mobile application 2.2.0 and earlier and Sleipnir Mobile Black Edition application 2.2.0 and earlier for Android allow remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site.

  • CVE-2012-3440Aug 8, 2012
    Todd Miller
    Sudo
    risk 0.00cvss —epss 0.00

    A certain Red Hat script for sudo 1.7.2 on Red Hat Enterprise Linux (RHEL) 5 allows local users to overwrite arbitrary files via a symlink attack on the /var/tmp/nsswitch.conf.bak temporary file.

  • CVE-2012-3424Aug 8, 2012
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.02

    The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of…

  • CVE-2012-2960Aug 8, 2012
    Microfocus
    ArcSight Connector Appliance
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the import functionality in HP ArcSight Connector appliance 6.2.0.6244.0 and ArcSight Logger appliance 5.2.0.6288.0 allows remote attackers to inject arbitrary web script or HTML via a crafted file.

  • CVE-2012-2203Aug 8, 2012
    IBM
    Tivoli Directory Server
    risk 0.00cvss —epss 0.02

    IBM Global Security Kit (aka GSKit) before 8.0.14.22, as used in IBM Rational Directory Server, IBM Tivoli Directory Server, and other products, uses the PKCS #12 file format for certificate objects without enforcing file integrity, which makes it easier for remote attackers to…

  • CVE-2012-2191Aug 8, 2012
    IBM
    Tivoli Directory Server
    risk 0.00cvss —epss 0.04

    IBM Global Security Kit (aka GSKit) before 8.0.14.22, as used in IBM Rational Directory Server, IBM Tivoli Directory Server, and other products, does not properly validate data during execution of a protection mechanism against the Vaudenay SSL CBC timing attack, which allows…