VYPR

CVEs

386,588 total · page 6734 of 7,732

AllCriticalHighKEV
  • CVE-2012-2003May 2, 2012
    Microfocus
    Insight Management Agents
    risk 0.00cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in HP Insight Management Agents before 9.0.0.0 on Windows Server 2003 and 2008 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2012-2002May 2, 2012
    Microfocus
    SNMP Agents For Linux
    risk 0.00cvss —epss 0.04

    Open redirect vulnerability in HP SNMP Agents for Linux before 9.0.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2012-2001May 2, 2012
    Microfocus
    SNMP Agents For Linux
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in HP SNMP Agents for Linux before 9.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1819May 2, 2012
    Wellintech
    Kingview
    risk 0.00cvss —epss 0.02

    Untrusted search path vulnerability in WellinTech KingView 6.53 allows local users to gain privileges via a Trojan horse DLL in the current working directory.

  • CVE-2012-2000May 2, 2012
    Microfocus
    System Health Application and Command Line Utilities
    risk 0.01cvss —epss 0.08

    Multiple unspecified vulnerabilities in HP System Health Application and Command Line Utilities before 9.0.0 allow remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2012-0362May 2, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    The extended ACL functionality in Cisco IOS 12.2(58)SE2 and 15.0(1)SE discards all lines that end with a log or time keyword, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by sending network traffic, aka Bug ID CSCts01106.

  • CVE-2012-0361May 2, 2012
    Cisco Systems, Inc.
    IP Communicator
    risk 0.00cvss —epss 0.01

    The sccp-protocol component in Cisco IP Communicator (CIPC) 7.0 through 8.6 does not limit the rate of SCCP messages to Cisco Unified Communications Manager (CUCM), which allows remote attackers to cause a denial of service via vectors that trigger (1) on hook and (2) off hook…

  • CVE-2012-0339May 2, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Cisco IOS 12.2 through 12.4 and 15.0 does not recognize the vrf-also keyword during enforcement of access-class commands, which allows remote attackers to establish TELNET connections from arbitrary source IP addresses via a standard TELNET client, aka Bug ID CSCsi77774.

  • CVE-2012-0338May 2, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Cisco IOS 12.2 through 12.4 and 15.0 does not recognize the vrf-also keyword during enforcement of access-class commands, which allows remote attackers to establish SSH connections from arbitrary source IP addresses via a standard SSH client, aka Bug ID CSCsv86113.

  • CVE-2012-0337May 2, 2012
    Cisco Systems, Inc.
    Unified Meetingplace
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the web component in Cisco Unified MeetingPlace 7.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtx08939.

  • CVE-2012-0335May 2, 2012
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.2 through 8.4 do not properly perform proxy authentication during attempts to cut through a firewall, which allows remote attackers to obtain sensitive information via a connection attempt, aka Bug ID…

  • CVE-2012-0333May 2, 2012
    Cisco Systems, Inc.
    Small Business IP Phone
    risk 0.00cvss —epss 0.01

    Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSCts08768.

  • CVE-2011-4016May 2, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    The PPP implementation in Cisco IOS 12.2 and 15.0 through 15.2, when Point-to-Point Termination and Aggregation (PTA) and L2TP are used, allows remote attackers to cause a denial of service (device crash) via crafted network traffic, aka Bug ID CSCtf71673.

  • CVE-2011-4015May 2, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Cisco IOS 15.2S allows remote attackers to cause a denial of service (interface queue wedge) via malformed UDP traffic on port 465, aka Bug ID CSCts48300.

  • CVE-2011-4014May 2, 2012
    Cisco Systems, Inc.
    Wireless Control System
    risk 0.00cvss —epss 0.01

    The TAC Case Attachment tool in Cisco Wireless Control System (WCS) 7.0 allows remote authenticated users to read arbitrary files under webnms/Temp/ via unspecified vectors, aka Bug ID CSCtq86807.

  • CVE-2011-4012May 2, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Cisco IOS 12.0, 15.0, and 15.1, when a Policy Feature Card 3C (PFC3C) is used, does not create a fragment entry during processing of an ICMPv6 ACL, which has unspecified impact and remote attack vectors, aka Bug ID CSCtj90091.

  • CVE-2011-4007May 2, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Cisco IOS 15.0 and 15.1 and IOS XE 3.x do not properly handle the "set mpls experimental imposition" command, which allows remote attackers to cause a denial of service (device crash) via network traffic that triggers (1) fragmentation or (2) reassembly, aka Bug ID CSCtr56576.

  • CVE-2011-4006May 2, 2012
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.01

    The ESMTP inspection feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2 through 8.5 allows remote attackers to cause a denial of service (CPU consumption) via an unspecified closing sequence, aka Bug ID CSCtt32565.

  • CVE-2011-3317May 2, 2012
    Cisco Systems, Inc.
    Secure Access Control Server
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCtr78192.

  • CVE-2011-3309May 2, 2012
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.01

    Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2 through 8.4 process IKE requests despite a vpnclient mode configuration, which allows remote attackers to obtain potentially sensitive information by reading IKE responder traffic, aka Bug ID…

  • CVE-2011-3295May 2, 2012
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.02

    The NETIO and IPV4_IO processes in Cisco IOS XR 3.8 through 4.1, as used in Cisco Carrier Routing System and other products, allow remote attackers to cause a denial of service (CPU consumption) via crafted network traffic, aka Bug ID CSCti59888.

  • CVE-2011-3293May 2, 2012
    Cisco Systems, Inc.
    Secure Access Control Server
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.2 allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences, aka Bug ID…

  • CVE-2011-3289May 2, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.00

    Cisco IOS 12.4 and 15.0 through 15.2 allows physically proximate attackers to bypass the No Service Password-Recovery feature and read the start-up configuration via unspecified vectors, aka Bug ID CSCtr97640.

  • CVE-2011-3285May 2, 2012
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in /+CSCOE+/logon.html on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.0 through 8.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors, aka Bug…

  • CVE-2011-3283May 2, 2012
    Cisco Systems, Inc.
    Carrier Routing System
    risk 0.00cvss —epss 0.02

    Cisco Carrier Routing System 3.9.1 allows remote attackers to cause a denial of service (Metro subsystem crash) via a fragmented GRE packet, aka Bug ID CSCts14887.

  • CVE-2011-2586May 2, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    The HTTP client in Cisco IOS 12.4 and 15.0 allows user-assisted remote attackers to cause a denial of service (device crash) via a malformed HTTP response to a request for service installation, aka Bug ID CSCts12249.

  • CVE-2011-2583May 2, 2012
    Cisco Systems, Inc.
    Unified Contact Center Express
    risk 0.00cvss —epss 0.02

    Cisco Unified Contact Center Express (aka CCX) 8.0 and 8.5 allows remote attackers to cause a denial of service via network traffic, as demonstrated by an SEC-BE-STABLE test case, aka Bug ID CSCth33834.

  • CVE-2011-2578May 2, 2012
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Memory leak in Cisco IOS 15.1 and 15.2 allows remote attackers to cause a denial of service (memory consumption) via malformed SIP packets on a NAT interface, aka Bug ID CSCts12366.

  • CVE-2012-0279May 1, 2012
    Quest
    Toad For Data Analysts
    risk 0.00cvss —epss 0.00

    Quest Toad for Data Analysts 3.0.1 uses weak permissions (Everyone: Full Control) for the %COMMONPROGRAMFILES%\Quest Shared directory, which allows local users to gain privileges via a Trojan horse file.

  • CVE-2012-2162May 1, 2012
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    The Web Server Plug-in in IBM WebSphere Application Server (WAS) 8.0 and earlier uses unencrypted HTTP communication after expiration of the plugin-key.kdb password, which allows remote attackers to obtain sensitive information by sniffing the network, or spoof arbitrary servers…

  • CVE-2012-0878May 1, 2012
    Pythonpaste
    Paste
    risk 0.00cvss —epss 0.04

    Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.

  • CVE-2012-2217May 1, 2012
    Htc
    Evo 3d
    risk 0.00cvss —epss 0.02

    The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before 3.26.502.56, and Hero does not restrict localhost access to TCP port 2479,…

  • CVE-2012-1521May 1, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the XML parser in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-3081May 1, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    Use-after-free vulnerability in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the floating of elements, a different vulnerability than CVE-2011-3078.

  • CVE-2011-3080May 1, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Race condition in the Inter-process Communication (IPC) implementation in Google Chrome before 18.0.1025.168 allows attackers to bypass intended sandbox restrictions via unspecified vectors.

  • CVE-2011-3079May 1, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The Inter-process Communication (IPC) implementation in Google Chrome before 18.0.1025.168, as used in Mozilla Firefox before 38.0 and other products, does not properly validate messages, which has unspecified impact and attack vectors.

  • CVE-2011-3078May 1, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the floating of elements, a different vulnerability than CVE-2011-3081.

  • CVE-2012-2416Apr 30, 2012
    Asterisk
    Business Edition
    risk 0.00cvss —epss 0.02

    chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.11.1 and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4, when the trustrpid option is enabled, allows remote authenticated users to cause a denial of service (daemon crash) by…

  • CVE-2012-2415Apr 30, 2012
    Asterisk
    Opensource
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 allows remote authenticated users to cause a denial of service or possibly have unspecified other impact via a…

  • CVE-2012-2414Apr 30, 2012
    Asterisk
    Business Edition
    risk 0.00cvss —epss 0.03

    main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements, which allows remote…

  • CVE-2012-2111Apr 30, 2012
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.05

    The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote…

  • CVE-2012-0863Apr 30, 2012
    Mumble
    Mumble
    risk 0.00cvss —epss 0.00

    Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file.

  • CVE-2012-2213Apr 28, 2012
    Squid Cache
    Squid
    risk 0.01cvss —epss 0.12

    Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a…

  • CVE-2012-2212Apr 28, 2012
    McAfee
    Web Gateway
    risk 0.00cvss —epss 0.01

    McAfee Web Gateway 7.0 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher did not provide configuration details…

  • CVE-2012-2441Apr 28, 2012
    Siemens Foundation
    Rugged Operating System
    risk 0.04cvss —epss 0.09

    RuggedCom Rugged Operating System (ROS) before 3.3 has a factory account with a password derived from the MAC Address field in a banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing a (1) SSH…

  • CVE-2012-2440Apr 28, 2012
    TP-Link
    8840t
    risk 0.00cvss —epss 0.01

    The default configuration of the TP-Link 8840T router enables web-based administration on the WAN interface, which allows remote attackers to establish an HTTP connection and possibly have unspecified other impact via unknown vectors.

  • CVE-2012-2439Apr 28, 2012
    Netgear
    Prosafe Fvs318n
    risk 0.00cvss —epss 0.02

    The default configuration of the NETGEAR ProSafe FVS318N firewall enables web-based administration on the WAN interface, which allows remote attackers to establish an HTTP connection and possibly have unspecified other impact via unknown vectors.

  • CVE-2012-1803Apr 28, 2012
    Siemens Foundation
    Rugged Operating System
    risk 0.07cvss —epss 0.49

    RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Address field in the banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing…

  • CVE-2012-0466Apr 27, 2012
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    template/en/default/list/list.js.tmpl in Bugzilla 2.x and 3.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1 does not properly handle multiple logins, which allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive…

  • CVE-2012-0465Apr 27, 2012
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when the inbound_proxies option is enabled, does not properly validate the X-Forwarded-For HTTP header, which allows remote attackers to bypass the lockout policy via a series…