VYPR

CVEs

386,596 total · page 6712 of 7,732

AllCriticalHighKEV
  • CVE-2012-4024Jul 19, 2012
    Squashfs Project
    Squashfs
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is…

  • CVE-2012-2974Jul 19, 2012
    Smc
    Smc8024l2 Switch
    risk 0.00cvss —epss 0.03

    The web interface on the SMC SMC8024L2 switch allows remote attackers to bypass authentication and obtain administrative access via a direct request to a .html file under (1) status/, (2) system/, (3) ports/, (4) trunks/, (5) vlans/, (6) qos/, (7) rstp/, (8) dot1x/, (9)…

  • CVE-2012-0284Jul 19, 2012
    Cisco Systems, Inc.
    Linksys Playerpt Activex Control
    risk 0.06cvss —epss 0.36

    Stack-based buffer overflow in the SetSource method in the Cisco Linksys PlayerPT ActiveX control 1.0.0.15 in PlayerPT.ocx on the Cisco WVC200 Wireless-G PTZ Internet video camera allows remote attackers to execute arbitrary code via a long URL in the first argument (aka the…

  • CVE-2012-3358Jul 18, 2012
    Uclouvain
    Openjpeg
    risk 0.01cvss —epss 0.08

    Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted (1) tile number or (2) tile length in a JPEG 2000 image file.

  • CVE-2012-2655Jul 18, 2012
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.03

    PostgreSQL 8.3.x before 8.3.19, 8.4.x before 8.4.12, 9.0.x before 9.0.8, and 9.1.x before 9.1.4 allows remote authenticated users to cause a denial of service (server crash) by adding the (1) SECURITY DEFINER or (2) SET attributes to a procedural language's call handler.

  • CVE-2012-0868Jul 18, 2012
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.03

    CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are…

  • CVE-2012-0867Jul 18, 2012
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.02

    PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.

  • CVE-2012-0866Jul 18, 2012
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.04

    CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER, which allows remote authenticated users to execute otherwise restricted…

  • CVE-2009-5030Jul 18, 2012
    Uclouvain
    Openjpeg
    risk 0.00cvss —epss 0.04

    The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated…

  • CVE-2012-4033Jul 18, 2012
    Zingiri
    Zingiri Web Shop
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin before 2.4.0 for WordPress have unknown impact and attack vectors.

  • CVE-2012-2303Jul 18, 2012
    Drupal
    Spaces
    risk 0.00cvss —epss 0.02

    The Spaces module 6.x-3.x before 6.x-3.4 for Drupal does not enforce permissions on non-object pages, which allows remote attackers to obtain sensitive information and possibly have other impacts via unspecified vectors to the (1) Spaces or (2) Spaces OG module.

  • CVE-2012-2140Jul 18, 2012
    RubyGems
    Mail Gem
    risk 0.00cvss —epss 0.04

    The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.

  • CVE-2012-2139Jul 18, 2012
    RubyGems
    Mail Gem
    risk 0.00cvss —epss 0.05

    Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter.

  • CVE-2012-1967Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript…

  • CVE-2012-1966Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not have the same context-menu restrictions for data: URLs as for javascript: URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

  • CVE-2012-1965Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting (XSS) protection mechanisms via a feed:javascript: URL.

  • CVE-2012-1964Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    The certificate-warning functionality in browser/components/certerror/content/aboutCertError.xhtml in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.10 does not properly…

  • CVE-2012-1963Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The Content Security Policy (CSP) functionality in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly restrict the strings placed into the blocked-uri…

  • CVE-2012-1962Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the JSDependentString::undepend function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of…

  • CVE-2012-1961Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly handle duplicate values in X-Frame-Options headers, which makes it easier for remote attackers to conduct…

  • CVE-2012-1960Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The qcms_transform_data_rgb_out_lut_sse2 function in the QCMS implementation in Mozilla Firefox 4.x through 13.0, Thunderbird 5.0 through 13.0, and SeaMonkey before 2.11 might allow remote attackers to obtain sensitive information from process memory via a crafted color profile…

  • CVE-2012-1959Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not consider the presence of same-compartment security wrappers (SCSW) during the cross-compartment wrapping of…

  • CVE-2012-1958Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the nsGlobalWindow::PageHidden function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 might allow remote attackers to execute…

  • CVE-2012-1957Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    An unspecified parser-utility class in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly handle EMBED elements within description elements in RSS feeds,…

  • CVE-2012-1955Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allow remote attackers to spoof the address bar via vectors involving history.forward and history.back calls.

  • CVE-2012-1954Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Use-after-free vulnerability in the nsDocument::AdoptNode function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of…

  • CVE-2012-1953Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The ElementAnimations::EnsureStyleRuleFor function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (buffer…

  • CVE-2012-1952Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The nsTableFrame::InsertFrames function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly perform a cast of a frame variable during processing of…

  • CVE-2012-1951Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the nsSMILTimeValueSpec::IsEventBased function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a…

  • CVE-2012-1950Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The drag-and-drop implementation in Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 allows remote attackers to spoof the address bar by canceling a page load.

  • CVE-2012-1949Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 13.0, Thunderbird 5.0 through 13.0, and SeaMonkey before 2.11 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary…

  • CVE-2012-1948Jul 18, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allow remote attackers to cause a denial of service (memory…

  • CVE-2012-3135Jul 17, 2012
    Oracle Corporation
    Fusion Middleware
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the Oracle JRockit component in Oracle Fusion Middleware 28.2.3 and before, and 27.7.2 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

  • CVE-2012-3134Jul 17, 2012
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to affect availability via unknown vectors.

  • CVE-2012-3131Jul 17, 2012
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Oracle Sun Solaris 9, 10, and 11 allows remote attackers to affect confidentiality, related to Network/NFS.

  • CVE-2012-3130Jul 17, 2012
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Oracle Sun Solaris 11 allows remote attackers to affect integrity via unknown vectors related to pkg.depotd.

  • CVE-2012-3129Jul 17, 2012
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect confidentiality, integrity, and availability, related to Gnome PDF viewer.

  • CVE-2012-3128Jul 17, 2012
    Oracle Corporation
    SPARC T-Series Servers
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Oracle SPARC T-Series Servers running System Firmware 8.2.0 and 8.1.4.e or earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Integrated Lights Out Manager.

  • CVE-2012-3127Jul 17, 2012
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect availability, related to SCTP.

  • CVE-2012-3126Jul 17, 2012
    Oracle Corporation
    Sun Products Suite
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Products Suite 3.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Apache Tomcat Agent.

  • CVE-2012-3125Jul 17, 2012
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Oracle Sun Solaris 8, 9, and 10 allows remote attackers to affect availability, related to TCP/IP.

  • CVE-2012-3124Jul 17, 2012
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect availability, related to Kernel/KSSL.

  • CVE-2012-3123Jul 17, 2012
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect confidentiality, related to Apache HTTP Server.

  • CVE-2012-3122Jul 17, 2012
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Oracle Sun Solaris 8 and 9 allows local users to affect confidentiality and integrity via unknown vectors related to sort.

  • CVE-2012-3121Jul 17, 2012
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Oracle Sun Solaris 9 and 10 allows remote attackers to affect availability via unknown vectors related to in.tnamed and NameServer.

  • CVE-2012-3120Jul 17, 2012
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Oracle Sun Solaris 8 allows remote attackers to affect availability, related to TCP/IP.

  • CVE-2012-3119Jul 17, 2012
    Oracle Corporation
    Peoplesoft Products
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Products 9.0.20 allows remote authenticated users to affect confidentiality via unknown vectors related to Candidate Gateway.

  • CVE-2012-3118Jul 17, 2012
    Oracle Corporation
    Peoplesoft Products
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote authenticated users to affect confidentiality, related to PANPROC.

  • CVE-2012-3117Jul 17, 2012
    Oracle Corporation
    Supply Chain Products Suite
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 5.5.06, 6.0, 6.1, and 6.2 allows remote authenticated users to affect confidentiality via unknown vectors related to HTTP.

  • CVE-2012-3116Jul 17, 2012
    Oracle Corporation
    Supply Chain Products Suite
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 5.5.06, 6.0, 6.1, and 6.2 allows local users to affect confidentiality via unknown vectors.