VYPR

CVEs

386,593 total · page 6726 of 7,732

AllCriticalHighKEV
  • CVE-2011-4458Jun 4, 2012
    Bestpractical
    Rt
    risk 0.00cvss —epss 0.03

    Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-5092 and…

  • CVE-2011-2085Jun 4, 2012
    Bestpractical
    Rt
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Best Practical Solutions RT before 3.8.12 and 4.x before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users.

  • CVE-2011-2084Jun 4, 2012
    Bestpractical
    Rt
    risk 0.00cvss —epss 0.02

    Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to read (1) hashes of former passwords and (2) ticket correspondence history by leveraging access to a privileged account.

  • CVE-2011-2083Jun 4, 2012
    Bestpractical
    Rt
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2082Jun 4, 2012
    Bestpractical
    Rt
    risk 0.00cvss —epss 0.01

    The vulnerable-passwords script in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not update the password-hash algorithm for disabled user accounts, which makes it easier for context-dependent attackers to determine cleartext passwords, and possibly use…

  • CVE-2012-1255Jun 4, 2012
    Segue Project
    Segue
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Segue 2.2.10.2 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-1254Jun 4, 2012
    Segue Project
    Segue
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Segue 2.2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1251Jun 4, 2012
    Opera
    Opera
    risk 0.00cvss —epss 0.01

    Opera before 9.63 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2012-1250Jun 4, 2012
    LOGITEC CORPORATION
    LAN-W300N/R
    risk 0.00cvss —epss 0.06

    Logitec LAN-W300N/R routers with firmware before 2.27 do not properly restrict login access, which allows remote attackers to obtain administrative privileges and modify settings via vectors related to PPPoE authentication.

  • CVE-2012-2630Jun 4, 2012
    Bandainamcogames
    Madomagi IP Android
    risk 0.00cvss —epss 0.01

    The Puella Magi Madoka Magica iP application 1.05 and earlier for Android places cleartext Twitter credentials in a log file, which allows remote attackers to obtain sensitive information via a crafted application.

  • CVE-2012-1253Jun 4, 2012
    Roundcube
    Webmail
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment.

  • CVE-2012-1252Jun 4, 2012
    Rssowl
    Rssowl
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in RSSOwl before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via a feed, a different vulnerability than CVE-2006-4760.

  • CVE-2012-2948Jun 2, 2012
    Asterisk
    Certified Asterisk
    risk 0.00cvss —epss 0.02

    chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon…

  • CVE-2012-2947Jun 2, 2012
    Asterisk
    Certified Asterisk
    risk 0.00cvss —epss 0.02

    chan_iax2.c in the IAX2 channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1, when a certain mohinterpret setting is enabled, allows remote attackers to cause a denial of service (daemon crash)…

  • CVE-2012-2944Jun 1, 2012
    Networkupstools
    Nut
    risk 0.00cvss —epss 0.06

    Buffer overflow in the addchar function in common/parseconf.c in upsd in Network UPS Tools (NUT) before 2.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (electric-power outage) via a long string containing non-printable characters.

  • CVE-2012-2752Jun 1, 2012
    VMware
    Vma
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in VMware vMA 4.x and 5.x before 5.0.0.2 allows local users to gain privileges via a Trojan horse DLL in the current working directory.

  • CVE-2012-0409Jun 1, 2012
    EMC Corporation
    Autostart
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in EMC AutoStart 5.3.x and 5.4.x before 5.4.3 allow remote attackers to cause a denial of service (agent crash) or possibly execute arbitrary code via crafted packets.

  • CVE-2012-2352May 31, 2012
    Sympa
    Sympa
    risk 0.00cvss —epss 0.03

    The archive management (arc_manage) page in wwsympa/wwsympa.fcgi.in in Sympa before 6.1.11 does not check permissions, which allows remote attackers to list, read, and delete arbitrary list archives via vectors related to the (1) do_arc_manage, (2) do_arc_download, or (3)…

  • CVE-2012-0949May 31, 2012
    Ubuntu
    Update Manager
    risk 0.00cvss —epss 0.02

    The Apport hook in Update Manager as used by Ubuntu 12.04 LTS, 11.10, and 11.04 uploads certain system state archive files when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report.

  • CVE-2012-2488May 31, 2012
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.02

    Cisco IOS XR before 4.2.1 on ASR 9000 series devices and CRS series devices allows remote attackers to cause a denial of service (packet transmission outage) via a crafted packet, aka Bug IDs CSCty94537 and CSCtz62593.

  • CVE-2010-5099May 30, 2012
    TYPO3
    Typo3
    risk 0.03cvss —epss 0.03

    The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP…

  • CVE-2012-2952May 29, 2012
    Jaow
    Jaow
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in add_ons.php in Jaow 2.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the add_ons parameter.

  • CVE-2012-1988May 29, 2012
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.03

    Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating…

  • CVE-2012-1987May 29, 2012
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST…

  • CVE-2012-1986May 29, 2012
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.01

    Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink…

  • CVE-2012-1906May 29, 2012
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.00

    Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or…

  • CVE-2012-1054May 29, 2012
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.00

    Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.

  • CVE-2012-1053May 29, 2012
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.00

    The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain…

  • CVE-2012-0804May 29, 2012
    Nongnu
    Cvs
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response.

  • CVE-2012-0220May 29, 2012
    Ikiwiki
    Ikiwiki
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the meta plugin (Plugin/meta.pm) in ikiwiki before 3.20120516 allow remote attackers to inject arbitrary web script or HTML via the (1) author or (2) authorurl meta tags.

  • CVE-2011-3048May 29, 2012
    Libpng
    Libpng
    risk 0.00cvss —epss 0.07

    The png_set_text_2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before 1.4.11, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted text chunk in a PNG image file, which…

  • CVE-2012-2949May 29, 2012
    Zte
    Score M
    risk 0.00cvss —epss 0.04

    The ZTE sync_agent program for Android 2.3.4 on the Score M device uses a hardcoded ztex1609523 password to control access to commands, which allows remote attackers to gain privileges via a crafted application.

  • CVE-2012-2943May 27, 2012
    Cryptographp
    Cryptographp
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in cryptographp.inc.php in Cryptographp allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the cfg parameter.

  • CVE-2012-2942May 27, 2012
    Haproxy
    Haproxy
    risk 0.00cvss —epss 0.05

    Buffer overflow in the trash buffer in the header capture functionality in HAProxy before 1.4.21, when global.tune.bufsize is set to a value greater than the default and header rewriting is enabled, allows remote attackers to cause a denial of service and possibly execute…

  • CVE-2012-2941May 27, 2012
    Yandex
    Yandex.server 2010
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search/ in Yandex.Server 2010 9.0 Enterprise allows remote attackers to inject arbitrary web script or HTML via the text parameter.

  • CVE-2012-2940May 27, 2012
    Mediachance
    Real Draw Pro
    risk 0.03cvss —epss 0.02

    MediaChance Real-DRAW PRO 5.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted (1) PNG, (2) WMF, (3) PSD, (4) TGA, (5) TTF, (6) BMP, (7) TIFF, or (8) PCX file.

  • CVE-2012-2939May 27, 2012
    Travelon
    Express
    risk 0.03cvss —epss 0.04

    Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hotel-image-add.php, or (3) hotel-add.php.

  • CVE-2012-2938May 27, 2012
    Itechscripts
    Travelon Express
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Travelon Express 6.2.2 allow remote attackers to inject arbitrary web script or HTML via the holiday name field to (1) holiday_add.php or (2) holiday_view.php.

  • CVE-2012-2937May 27, 2012
    Pligg
    CMS
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to execute arbitrary SQL commands via the (1) list parameter in a move action to admin/admin_index.php, (2) display parameter in a minimize action to admin/admin_index.php, (3) enabled[]…

  • CVE-2012-2936May 27, 2012
    Pligg
    CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) user or (2) page parameter to (a) admin/admin_comments.php or (b) admin/admin_links.php; or list parameter in a (3) move or (4)…

  • CVE-2012-2436May 27, 2012
    Pligg
    CMS
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter in a move or (2) minimize action to admin/admin_index.php; (3) the karma_username parameter to module.php in…

  • CVE-2012-2435May 27, 2012
    Pligg
    CMS
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the captcha module in Pligg CMS before 1.2.2 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the captcha parameter to module.php, as demonstrated by cross-site request forgery (CSRF)…

  • CVE-2012-2935May 27, 2012
    OsCommerce
    Online Merchant
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Checkout/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the value_title parameter, a different vulnerability than…

  • CVE-2012-2235May 27, 2012
    Support Incident Tracker
    SiT!
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Support Incident Tracker (SiT!) 3.65 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to index.php, which is not properly handled in an error message.

  • CVE-2012-1792May 27, 2012
    OsCommerce
    Online Merchant
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to…

  • CVE-2012-1413May 27, 2012
    Zen Cart
    ZenCart
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in zc_install/includes/modules/pages/database_setup/header_php.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the db_username parameter to…

  • CVE-2012-2568May 25, 2012
    Seagate
    BlackArmor
    risk 0.00cvss —epss 0.04

    d41d8cd98f00b204e9800998ecf8427e.php in the management web server on the Seagate BlackArmor device allows remote attackers to change the administrator password via unspecified vectors.

  • CVE-2012-2176May 25, 2012
    IBM
    Lotus Quickr
    risk 0.06cvss —epss 0.32

    Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for Domino allow remote attackers to execute arbitrary code via a long argument to the (1) Attachment_Times or (2) Import_Times method.

  • CVE-2011-2722May 25, 2012
    Hewlett-Packard
    hplip
    risk 0.00cvss —epss 0.00

    The send_data_to_stdout function in prnt/hpijs/hpcupsfax.cpp in HP Linux Imaging and Printing (HPLIP) 3.x before 3.11.10 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hpcupsfax.out temporary file.

  • CVE-2012-2429May 25, 2012
    Xarrow
    Xarrow
    risk 0.00cvss —epss 0.04

    The server in xArrow before 3.4.1 performs an invalid read operation, which allows remote attackers to execute arbitrary code via unspecified vectors.