VYPR

CVEs

386,593 total · page 6716 of 7,732

AllCriticalHighKEV
  • CVE-2012-3073Jul 12, 2012
    Cisco Systems, Inc.
    Telepresence Manager
    risk 0.00cvss —epss 0.02

    The IP implementation on Cisco TelePresence Multipoint Switch before 1.8.1, Cisco TelePresence Manager before 1.9.0, and Cisco TelePresence Recording Server 1.8 and earlier allows remote attackers to cause a denial of service (networking outage or process crash) via (1)…

  • CVE-2012-2486Jul 12, 2012
    Cisco Systems, Inc.
    Telepresence Manager
    risk 0.00cvss —epss 0.02

    The Cisco Discovery Protocol (CDP) implementation on Cisco TelePresence Multipoint Switch before 1.9.0, Cisco TelePresence Immersive Endpoint Devices before 1.9.1, Cisco TelePresence Manager before 1.9.0, and Cisco TelePresence Recording Server before 1.8.1 allows remote…

  • CVE-2012-3890Jul 11, 2012
    Winamp
    Winamp
    risk 0.00cvss —epss 0.02

    The in_mod plugin in Winamp before 5.63 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a .IT file.

  • CVE-2012-3889Jul 11, 2012
    Winamp
    Winamp
    risk 0.00cvss —epss 0.02

    The in_mod plugin in Winamp before 5.63 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a .IT file.

  • CVE-2011-4309Jul 11, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to bypass intended access restrictions and perform global searches by leveraging the guest role and making a direct request to a URL.

  • CVE-2011-4308Jul 11, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    mod/forum/user.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 allows remote authenticated users to discover the names of other users via unspecified vectors.

  • CVE-2011-4307Jul 11, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in mod/wiki/lang/en/wiki.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the section parameter.

  • CVE-2011-4306Jul 11, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in course/editsection.html in Moodle 1.9.x before 1.9.14 allows remote authenticated users to inject arbitrary web script or HTML via crafted data.

  • CVE-2011-4305Jul 11, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    message/refresh.php in Moodle 1.9.x before 1.9.14 allows remote authenticated users to cause a denial of service (infinite request loop) via a URL that specifies a zero wait time for message refreshing.

  • CVE-2011-4304Jul 11, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    The chat functionality in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to discover the name of any user via a beep operation.

  • CVE-2011-4303Jul 11, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    lib/db/upgrade.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not set the correct registration_hubs.secret value during installation, which allows remote attackers to bypass intended access restrictions by leveraging the hubs feature.

  • CVE-2011-4302Jul 11, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    mnet/xmlrpc/client.php in MNET in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not properly process the return value of the openssl_verify function, which allows remote attackers to bypass validation via a crafted certificate.

  • CVE-2011-4301Jul 11, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the…

  • CVE-2011-4300Jul 11, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    The file_browser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file.

  • CVE-2011-4299Jul 11, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment.

  • CVE-2011-4298Jul 11, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data.

  • CVE-2012-2020Jul 11, 2012
    Microfocus
    Operations Agent
    risk 0.08cvss —epss 0.65

    Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1326.

  • CVE-2012-2019Jul 11, 2012
    Microfocus
    Operations Agent
    risk 0.08cvss —epss 0.64

    Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1325.

  • CVE-2012-1894Jul 10, 2012
    Microsoft
    Office
    risk 0.00cvss —epss 0.02

    Microsoft Office for Mac 2011 uses world-writable permissions for the "Applications/Microsoft Office 2011/" directory and certain other directories, which allows local users to gain privileges by placing a Trojan horse executable file in one of these directories, aka "Office for…

  • CVE-2012-1893Jul 10, 2012
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate callback parameters during creation of a hook procedure, which…

  • CVE-2012-1891CriJul 10, 2012
    Microsoft
    Data Access Components
    risk 0.66cvss 9.8epss 0.29

    Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary code via crafted XML data that triggers access to an uninitialized object in memory, aka "ADO…

  • CVE-2012-1890Jul 10, 2012
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle keyboard-layout files, which allows local users to gain privileges…

  • CVE-2012-1870Jul 10, 2012
    Microsoft
    Windows
    risk 0.01cvss —epss 0.10

    The CBC mode in the TLS protocol, as used in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and other products, allows remote web servers to obtain plaintext data by triggering…

  • CVE-2012-1863Jul 10, 2012
    Microsoft
    Sharepoint Server
    risk 0.02cvss —epss 0.23

    Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a…

  • CVE-2012-1862Jul 10, 2012
    Microsoft
    Sharepoint Server
    risk 0.01cvss —epss 0.11

    Open redirect vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "SharePoint URL Redirection Vulnerability."

  • CVE-2012-1861Jul 10, 2012
    Microsoft
    Sharepoint Server
    risk 0.01cvss —epss 0.15

    Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka…

  • CVE-2012-1860Jul 10, 2012
    Microsoft
    Sharepoint Server
    risk 0.01cvss —epss 0.13

    Microsoft Office SharePoint Server 2007 SP2 and SP3, SharePoint Server 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 do not properly check permissions for search scopes, which allows remote authenticated users to obtain sensitive information or cause a denial of…

  • CVE-2012-1859Jul 10, 2012
    Microsoft
    Sharepoint Server
    risk 0.02cvss —epss 0.23

    Cross-site scripting (XSS) vulnerability in scriptresx.ashx in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript…

  • CVE-2012-1854HigKEVJul 10, 2012
    Microsoft
    Office
    risk 0.64cvss 7.8epss 0.21

    Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse…

  • CVE-2012-1524Jul 10, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.22

    Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Attribute Remove Remote Code Execution Vulnerability."

  • CVE-2012-1522Jul 10, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.21

    Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Cached Object Remote Code Execution Vulnerability."

  • CVE-2012-0175HigJul 10, 2012
    Microsoft
    Windows
    risk 0.59cvss 8.8epss 0.26

    The Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted name for a (1) file or (2) directory, aka "Command…

  • CVE-2012-3812Jul 9, 2012
    Digium
    Asterisk
    risk 0.00cvss —epss 0.03

    Double free vulnerability in apps/app_voicemail.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones allows remote authenticated users…

  • CVE-2012-3238Jul 9, 2012
    Astaro
    Security Gateway
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in Astaro Security Gateway before 8.305 allows remote attackers to inject arbitrary web script or HTML via the "Comment (optional)" field.

  • CVE-2012-2970Jul 9, 2012
    Synel
    SY-780/A
    risk 0.00cvss —epss 0.01

    The Synel SY-780/A Time & Attendance terminal allows remote attackers to cause a denial of service (device hang) via network traffic to port (1) 1641, (2) 3734, or (3) 3735.

  • CVE-2012-2138Jul 9, 2012
    Apache
    Sling Servlets Post
    risk 0.00cvss —epss 0.14

    The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted…

  • CVE-2012-1493Jul 9, 2012
    F5, Inc.
    Big IP
    risk 0.08cvss —epss 0.63

    F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers'…

  • CVE-2012-3859Jul 9, 2012
    Netsweeper
    Netsweeper
    risk 0.03cvss —epss 0.03

    Unspecified vulnerability in the WebAdmin Portal in Netsweeper has unknown impact and attack vectors, a different vulnerability than CVE-2012-2446 and CVE-2012-2447.

  • CVE-2012-2447Jul 9, 2012
    Netsweeper
    Netsweeper
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in accountmgr/adminupdate.php in the WebAdmin Portal in Netsweeper allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via an add action.

  • CVE-2012-2446Jul 9, 2012
    Netsweeper
    Netsweeper
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in tools/local_lookup.php in the WebAdmin Portal in Netsweeper allows remote attackers to inject arbitrary web script or HTML via the group parameter in a lookup action.

  • CVE-2012-3863Jul 9, 2012
    Digium
    Asterisk
    risk 0.00cvss —epss 0.03

    channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not…

  • CVE-2012-3372HigJul 9, 2012
    Cyberoam
    Cyberoamos
    risk 0.48cvss 7.4epss 0.01

    The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the…

  • CVE-2012-3374Jul 7, 2012
    Pidgin (software)
    Pidgin
    risk 0.01cvss —epss 0.06

    Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message.

  • CVE-2012-2644Jul 7, 2012
    Hazama
    Mt4i
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2642.

  • CVE-2012-2643Jul 7, 2012
    Kent Web
    Yy Board
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in KENT-WEB YY-BOARD before 6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted form entry.

  • CVE-2012-2642Jul 7, 2012
    Hazama
    Mt4i
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2644.

  • CVE-2012-2386Jul 7, 2012
    PHP
    PHP
    risk 0.06cvss —epss 0.42

    Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a…

  • CVE-2012-3585Jul 5, 2012
    IrfanView
    Irfanview
    risk 0.04cvss —epss 0.08

    Heap-based buffer overflow in jpeg_ls.dll in the Jpeg_LS (aka JLS) plugin in the formats plugins in IrfanView PlugIns before 4.34 allows remote attackers to execute arbitrary code via a crafted JLS file.

  • CVE-2012-2018Jul 5, 2012
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in HP Network Node Manager i (NNMi) 8.x, 9.0x, and 9.1x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-2641Jul 5, 2012
    Zenphoto
    Zenphoto
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Zenphoto before 1.4.3 allows remote attackers to inject arbitrary web script or HTML by triggering improper interaction with an unspecified library.