VYPR

CVEs

386,593 total · page 6724 of 7,732

AllCriticalHighKEV
  • CVE-2012-1879HigJun 12, 2012
    Microsoft
    Internet Explorer
    risk 0.54cvss 8.1epss 0.20

    Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access an undefined memory location, aka "insertAdjacentText Remote Code Execution Vulnerability."

  • CVE-2012-1878Jun 12, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.22

    Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnBeforeDeactivate Event Remote Code Execution Vulnerability."

  • CVE-2012-1877Jun 12, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.24

    Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Title Element Change Remote Code Execution Vulnerability."

  • CVE-2012-1876Jun 12, 2012
    Microsoft
    Internet Explorer
    risk 0.08cvss —epss 0.65

    Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote…

  • CVE-2012-1875Jun 12, 2012
    Microsoft
    Internet Explorer
    risk 0.08cvss —epss 0.62

    Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Same ID Property Remote Code Execution Vulnerability."

  • CVE-2012-1874Jun 12, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.24

    Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows user-assisted remote attackers to execute arbitrary code by accessing a deleted object, aka "Developer Toolbar Remote Code Execution Vulnerability."

  • CVE-2012-1873Jun 12, 2012
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.18

    Microsoft Internet Explorer 7 through 9 does not properly create and initialize string data, which allows remote attackers to obtain sensitive information from process memory via a crafted HTML document, aka "Null Byte Information Disclosure Vulnerability."

  • CVE-2012-1872MedJun 12, 2012
    Microsoft
    Internet Explorer
    risk 0.40cvss 6.1epss 0.06

    Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to inject arbitrary web script or HTML via crafted character sequences with EUC-JP encoding, aka "EUC-JP Character Encoding Vulnerability."

  • CVE-2012-1868Jun 12, 2012
    Microsoft
    Windows Xp
    risk 0.00cvss —epss 0.01

    Race condition in the thread-creation implementation in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3 allows local users to gain privileges via a crafted application, aka "Win32k.sys Race Condition Vulnerability."

  • CVE-2012-1867HigJun 12, 2012
    Microsoft
    Windows
    risk 0.55cvss 8.4epss 0.01

    Integer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted TrueType font file…

  • CVE-2012-1866Jun 12, 2012
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle user-mode input passed to kernel mode for driver objects, which…

  • CVE-2012-1865Jun 12, 2012
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle user-mode input passed to kernel mode for driver objects, which…

  • CVE-2012-1864Jun 12, 2012
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle user-mode input passed to kernel mode for driver objects, which…

  • CVE-2012-1858Jun 12, 2012
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.22

    The toStaticHTML API (aka the SafeHTML component) in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Attendee does not properly handle event attributes and script, which makes it easier for remote attackers to conduct cross-site scripting (XSS)…

  • CVE-2012-1857Jun 12, 2012
    Microsoft
    Dynamics Ax
    risk 0.01cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in the Enterprise Portal component in Microsoft Dynamics AX 2012 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Dynamics AX Enterprise Portal XSS Vulnerability."

  • CVE-2012-1855Jun 12, 2012
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.20

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly handle function pointers, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka ".NET Framework…

  • CVE-2012-1849Jun 12, 2012
    Microsoft
    Lync
    risk 0.01cvss —epss 0.18

    Untrusted search path vulnerability in Microsoft Lync 2010, 2010 Attendee, and 2010 Attendant allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .ocsmeet file, aka "Lync Insecure Library…

  • CVE-2012-1523Jun 12, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.22

    Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Center Element Remote Code Execution Vulnerability."

  • CVE-2012-0217Jun 12, 2012
    Microsoft
    Windows Server 2008
    risk 0.00cvss —epss 0.40

    The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta…

  • CVE-2012-0173Jun 12, 2012
    Microsoft
    Windows
    risk 0.02cvss —epss 0.21

    The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly process packets in memory, which allows remote attackers to…

  • CVE-2012-0677Jun 12, 2012
    Apple Inc.
    iTunes
    risk 0.04cvss —epss 0.15

    Heap-based buffer overflow in Apple iTunes before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted .m3u playlist.

  • CVE-2012-2959Jun 11, 2012
    BMC Software
    Identity Management Suite
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in password-manager/changePasswords.do in BMC Identity Management Suite 7.5.00.103 allows remote attackers to hijack the authentication of administrators for requests that change passwords.

  • CVE-2012-1825Jun 11, 2012
    Forescout
    Counteract
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the status program on the ForeScout CounterACT appliance with software 6.3.3.2 through 6.3.4.10 allow remote attackers to inject arbitrary web script or HTML via (1) the loginname parameter in a forgotpass action or (2) the…

  • CVE-2012-3343Jun 9, 2012
    Bloxx
    Web Filtering
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Microdasys before 3.5.1-B708, as used in Bloxx Web Filtering before 5.0.14 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that trigger error pages containing XSS…

  • CVE-2012-2566Jun 9, 2012
    Bloxx
    Web Filtering
    risk 0.00cvss —epss 0.02

    Bloxx Web Filtering before 5.0.14 does not properly interpret X-Forwarded-For headers during access-control and logging operations for HTTPS connection attempts, which allows remote attackers to bypass intended IP address and domain restrictions, and trigger misleading log…

  • CVE-2012-2565Jun 9, 2012
    Bloxx
    Web Filtering
    risk 0.00cvss —epss 0.01

    Bloxx Web Filtering before 5.0.14 does not use a salt during calculation of a password hash, which makes it easier for context-dependent attackers to determine cleartext passwords via a rainbow-table approach.

  • CVE-2012-2564Jun 9, 2012
    Bloxx
    Web Filtering
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative interface in Bloxx Web Filtering before 5.0.14 allow remote attackers to hijack the authentication of administrators for requests that perform administrative actions.

  • CVE-2012-2563Jun 9, 2012
    Bloxx
    Web Filtering
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Bloxx Web Filtering before 5.0.14 allow (1) remote attackers to inject arbitrary web script or HTML via web traffic that is examined within the Bloxx Reports component, and allow (2) remote authenticated administrators to…

  • CVE-2012-2040Jun 9, 2012
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.04

    Untrusted search path vulnerability in the installer in Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on…

  • CVE-2012-2039Jun 9, 2012
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.05

    Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows…

  • CVE-2012-2038Jun 9, 2012
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.04

    Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows…

  • CVE-2012-2037Jun 9, 2012
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.04

    Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows…

  • CVE-2012-2036Jun 9, 2012
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.05

    Integer overflow in Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before…

  • CVE-2012-2035Jun 9, 2012
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR…

  • CVE-2012-2034HigKEVJun 9, 2012
    Adobe Inc.
    Air
    risk 0.61cvss 7.5epss 0.08

    Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows…

  • CVE-2012-3003Jun 8, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.02

    Open redirect vulnerability in an unspecified web application in Siemens WinCC 7.0 SP3 before Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a GET request.

  • CVE-2012-2598Jun 8, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.02

    Buffer overflow in the DiagAgent web server in Siemens WinCC 7.0 SP3 through Update 2 allows remote attackers to cause a denial of service (agent outage) via crafted input.

  • CVE-2012-2597Jun 8, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in Siemens WinCC 7.0 SP3 before Update 2 allow remote authenticated users to read arbitrary files via a crafted parameter in a URL.

  • CVE-2012-2596Jun 8, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.01

    The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack.

  • CVE-2012-2595Jun 8, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 allow remote attackers to inject arbitrary web script or HTML via vectors involving special characters in parameters.

  • CVE-2012-1818Jun 8, 2012
    Emerson
    Deltav
    risk 0.00cvss —epss 0.02

    An unspecified ActiveX control in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to overwrite arbitrary files via unknown vectors.

  • CVE-2012-1817Jun 8, 2012
    Emerson
    Deltav
    risk 0.00cvss —epss 0.04

    Buffer overflow in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via an invalid field in a…

  • CVE-2012-1816Jun 8, 2012
    Emerson
    Deltav
    risk 0.00cvss —epss 0.02

    PORTSERV.exe in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to cause a denial of service (daemon crash) via a crafted (1) TCP or (2) UDP packet to port 111.

  • CVE-2012-1815Jun 8, 2012
    Emerson
    Deltav
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-1814Jun 8, 2012
    Emerson
    Deltav
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-2603Jun 8, 2012
    Collabnet
    Scrumworks
    risk 0.00cvss —epss 0.02

    The server in CollabNet ScrumWorks Pro before 6.0 allows remote authenticated users to gain privileges and obtain sensitive information via a modified desktop client.

  • CVE-2012-1826Jun 8, 2012
    Dotcms
    Dotcms
    risk 0.00cvss —epss 0.02

    dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.

  • CVE-2012-0507CriKEVJun 7, 2012
    Sun Corporation
    Jre
    risk 0.93cvss 9.8epss 0.98

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related…

  • CVE-2012-0948Jun 7, 2012
    GNOME Foundation
    Update Manager Core
    risk 0.00cvss —epss 0.00

    DistUpgrade/DistUpgradeMain.py in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uses weak permissions for (1) apt-clone_system_state.tar.gz and (2) system_state.tar.gz, which allows local users to obtain repository credentials.

  • CVE-2012-3292Jun 7, 2012
    Globus
    Toolkit
    risk 0.00cvss —epss 0.03

    The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes…