VYPR

CVEs

386,605 total · page 6710 of 7,733

AllCriticalHighKEV
  • CVE-2012-3590Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.

  • CVE-2012-3589Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.

  • CVE-2012-1520Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.

  • CVE-2012-0683Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.

  • CVE-2012-0682Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.

  • CVE-2012-4053Jul 25, 2012
    Ez
    Ez Publish
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in eZOE flash player in eZ Publish 4.1 through 4.6 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2012-3697Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit in Apple Safari before 6.0 does not properly handle file: URLs, which allows remote attackers to bypass intended sandbox restrictions and read arbitrary files by leveraging a WebProcess compromise.

  • CVE-2012-3696Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in WebKit in Apple Safari before 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP request splitting attacks via a crafted web site that leverages improper WebSockets URI handling.

  • CVE-2012-3695Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML by leveraging improper URL canonicalization during the handling of the location.href property.

  • CVE-2012-3694Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to obtain sensitive information about full pathnames via a crafted web site.

  • CVE-2012-3693Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Incomplete blacklist vulnerability in WebKit in Apple Safari before 6.0 allows remote attackers to spoof domain names in URLs, and possibly conduct phishing attacks, by leveraging the availability of IDN support and Unicode fonts to construct unspecified homoglyphs.

  • CVE-2012-3691Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    WebKit in Apple Safari before 6.0 does not properly handle Cascading Style Sheets (CSS) property values, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

  • CVE-2012-3690Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to read arbitrary files via a crafted web site.

  • CVE-2012-3689Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to bypass the Same Origin Policy via a crafted web site.

  • CVE-2012-3650Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    WebKit in Apple Safari before 6.0 accesses uninitialized memory locations during the rendering of SVG images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.

  • CVE-2012-2760Jul 25, 2012
    Findingscience
    Mod Auth Openid
    risk 0.00cvss —epss 0.01

    mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local users to obtain session ids.

  • CVE-2012-2677Jul 25, 2012
    Boost
    Pool
    risk 0.00cvss —epss 0.04

    Integer overflow in the ordered_malloc function in boost/pool/pool.hpp in Boost Pool before 3.9 makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large memory chunk size value, which causes less memory to be…

  • CVE-2012-2676Jul 25, 2012
    Emery Berger
    Hoard
    risk 0.00cvss —epss 0.01

    Multiple integer overflows in the (1) malloc and (2) calloc functions in Hoard before 3.9 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows on implementing code via a large size value, which causes less memory to be…

  • CVE-2012-2675Jul 25, 2012
    Nedprod
    Nedmalloc
    risk 0.00cvss —epss 0.01

    Multiple integer overflows in the (1) CallMalloc (malloc) and (2) nedpcalloc (calloc) functions in nedmalloc (nedmalloc.c) before 1.10 beta2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which…

  • CVE-2012-2674Jul 25, 2012
    Google
    Bionic
    risk 0.00cvss —epss 0.01

    Multiple integer overflows in the (1) chk_malloc, (2) leak_malloc, and (3) leak_memalign functions in libc/bionic/malloc_debug_leak.c in Bionic (libc) for Android, when libc.debug.malloc is set, make it easier for context-dependent attackers to perform memory-related attacks…

  • CVE-2012-2673Jul 25, 2012
    Boehm-Demers-Weiser GC
    libgc
    risk 0.00cvss —epss 0.03

    Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related…

  • CVE-2012-0680Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Apple Safari before 6.0 does not properly handle the autocomplete attribute of a password input element, which allows remote attackers to bypass authentication by leveraging an unattended workstation.

  • CVE-2012-0679Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Apple Safari before 6.0 allows remote attackers to read arbitrary files via a feed:// URL.

  • CVE-2012-0678Jul 25, 2012
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML via a feed:// URL.

  • CVE-2007-6754Jul 25, 2012
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.01

    The ipalloc function in libc/stdlib/malloc.c in jemalloc in libc for FreeBSD 6.4 and NetBSD does not properly allocate memory, which makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, related to…

  • CVE-2006-7252Jul 25, 2012
    Jemalloc
    jemalloc
    risk 0.00cvss —epss 0.01

    Integer overflow in the calloc function in libc/stdlib/malloc.c in jemalloc in libc for FreeBSD 6.4 and NetBSD makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which triggers a memory allocation of…

  • CVE-2005-4895Jul 25, 2012
    Gperftools
    Gperftools
    risk 0.00cvss —epss 0.01

    Multiple integer overflows in TCMalloc (tcmalloc.cc) in gperftools before 0.4 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.

  • CVE-2012-3954Jul 25, 2012
    Isc
    DHCP
    risk 0.00cvss —epss 0.04

    Multiple memory leaks in ISC DHCP 4.1.x and 4.2.x before 4.2.4-P1 and 4.1-ESV before 4.1-ESV-R6 allow remote attackers to cause a denial of service (memory consumption) by sending many requests.

  • CVE-2012-3868Jul 25, 2012
    Isc
    Bind
    risk 0.00cvss —epss 0.03

    Race condition in the ns_client structure management in ISC BIND 9.9.x before 9.9.1-P2 allows remote attackers to cause a denial of service (memory consumption or process exit) via a large volume of TCP queries.

  • CVE-2012-3817Jul 25, 2012
    Isc
    Bind
    risk 0.02cvss —epss 0.24

    ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation is enabled, does not properly initialize the failing-query cache, which allows remote attackers to cause a denial of…

  • CVE-2012-3571Jul 25, 2012
    Isc
    DHCP
    risk 0.04cvss —epss 0.13

    ISC DHCP 4.1.2 through 4.2.4 and 4.1-ESV before 4.1-ESV-R6 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed client identifier.

  • CVE-2012-3570Jul 25, 2012
    Isc
    DHCP
    risk 0.00cvss —epss 0.03

    Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, allows remote attackers to cause a denial of service (segmentation fault and daemon exit) via a crafted client identifier parameter.

  • CVE-2012-2646Jul 25, 2012
    Fenrir Inc
    Sleipnir Mobile
    risk 0.00cvss —epss 0.02

    The Sleipnir Mobile application before 2.1.0 and Sleipnir Mobile Black Edition application before 2.1.0 for Android do not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.

  • CVE-2012-2197Jul 25, 2012
    IBM
    Db2
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote authenticated users to execute arbitrary code by leveraging certain CONNECT and EXECUTE privileges.

  • CVE-2012-2196Jul 25, 2012
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote attackers to read arbitrary XML files via the (1) GET_WRAP_CFG_C or (2) GET_WRAP_CFG_C2 stored procedure.

  • CVE-2012-2194Jul 25, 2012
    IBM
    Db2
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the SQLJ.DB2_INSTALL_JAR stored procedure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote attackers to replace JAR files via unspecified vectors.

  • CVE-2012-4050Jul 24, 2012
    Google
    ChromeOS
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Google Chrome OS before 21.0.1180.50 on the Cr-48 and Samsung Series 5 and 5 550 Chromebook platforms, and the Samsung Chromebox Series 3, have unknown impact and attack vectors.

  • CVE-2012-4049Jul 24, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet.

  • CVE-2012-4048Jul 24, 2012
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.01

    The PPP dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted packet, as demonstrated by a usbmon dump.

  • CVE-2012-3398Jul 23, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Algorithmic complexity vulnerability in Moodle 1.9.x before 1.9.19, 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to cause a denial of service (CPU consumption) by using the advanced-search feature on a database activity that…

  • CVE-2012-3397Jul 23, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    lib/modinfolib.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 does not check for a group-membership requirement when determining whether an activity is unavailable or hidden, which allows remote authenticated users to bypass…

  • CVE-2012-3396Jul 23, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cohort/edit_form.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the idnumber field. NOTE: this…

  • CVE-2012-3395Jul 23, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in mod/feedback/complete.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to execute arbitrary SQL commands via crafted form data.

  • CVE-2012-3394Jul 23, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    auth/ldap/ntlmsso_attempt.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 redirects users from an https LDAP login URL to an http URL, which allows remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2012-3393Jul 23, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in repository/lib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 allows remote authenticated administrators to inject arbitrary web script or HTML by renaming a repository.

  • CVE-2012-3392Jul 23, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    mod/forum/unsubscribeall.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not consider whether a forum is optional, which allows remote authenticated users to bypass forum-subscription requirements by leveraging the student role and unsubscribing from all forums.

  • CVE-2012-3391Jul 23, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    mod/forum/rsslib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly implement the requirement for posting before reading a Q&A forum, which allows remote authenticated users to bypass intended access restrictions by leveraging the student role and reading…

  • CVE-2012-3390Jul 23, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    lib/filelib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly restrict file access after a block has been hidden, which allows remote authenticated users to obtain sensitive information by reading a file that is embedded in a block.

  • CVE-2012-3389Jul 23, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in mod/lti/typessettings.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) lti_typename or (2) lti_toolurl parameter.

  • CVE-2012-3388Jul 23, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    The is_enrolled function in lib/accesslib.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 does not properly interact with the caching feature, which might allow remote authenticated users to bypass an intended capability check via unspecified vectors that trigger caching…