VYPR

CVEs

386,559 total · page 6748 of 7,732

AllCriticalHighKEV
  • CVE-2012-1224Feb 21, 2012
    Contentlion
    Contentlion Alpha
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in system/classes/login.php in ContentLion Alpha 1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  • CVE-2012-1223Feb 21, 2012
    Rabidhamster
    R2\/extreme
    risk 0.00cvss —epss 0.01

    RabidHamster R2/Extreme 1.65 and earlier uses a small search space of values for the PIN number, which allows remote attackers to obtain the PIN number via a brute force attack.

  • CVE-2012-1222Feb 21, 2012
    Rabidhamster
    R2\/extreme
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in RabidHamster R2/Extreme 1.65 and earlier allows remote authenticated users to execute arbitrary code via a long string to TCP port 23.

  • CVE-2012-1221Feb 21, 2012
    Rabidhamster
    R2\/
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in the telnet server in RabidHamster R2/Extreme 1.65 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the File command.

  • CVE-2012-1220Feb 21, 2012
    Gazie
    GAzie
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in modules/config/admin_utente.php in GAzie 5.20 and earlier allows remote attackers to hijack the authentication of administrators for requests that change account information via an update action, as demonstrated by changing the…

  • CVE-2012-1219Feb 21, 2012
    Freelancerkit
    Freelancerkit
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in freelancerKit 2.35 allow remote attackers to inject arbitrary web script or HTML via the (1) ticket parameter to tickets.php, (2) title parameter to notes.php, or (3) task parameter to todo.php. NOTE: some of these details…

  • CVE-2012-1218Feb 21, 2012
    Freelancerkit
    Freelancerkit
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in freelancerKit 2.35 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to the (1) notes and (2) tickets components.

  • CVE-2012-0995Feb 21, 2012
    Zenphoto
    Zenphoto
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter in an external action to zp-core/admin.php, (2) PATH_INTO to an unspecified URL, as demonstrated using /1/, (3) PATH_INFO…

  • CVE-2012-0994Feb 21, 2012
    Zenphoto
    Zenphoto
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Manage Albums feature in zp-core/admin-albumsort.php in ZENphoto 1.4.2 allows remote authenticated users to execute arbitrary SQL commands via the sortableList parameter.

  • CVE-2012-0993Feb 21, 2012
    Zenphoto
    Zenphoto
    risk 0.00cvss —epss 0.02

    Eval injection vulnerability in zp-core/zp-extensions/viewer_size_image.php in ZENphoto 1.4.2, when the viewer_size_image plugin is enabled, allows remote attackers to execute arbitrary PHP code via the viewer_size_image_saved cookie.

  • CVE-2012-0865Feb 21, 2012
    Cubecart
    Cubecart
    risk 0.03cvss —epss 0.03

    Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) r parameter to switch.php or (2) goto parameter to admin/login.php.

  • CVE-2012-0224Feb 21, 2012
    7-Technologies
    AQUIS
    risk 0.00cvss —epss 0.01

    Untrusted search path vulnerability in 7-Technologies (7T) AQUIS 1.5 and earlier allows local users to gain privileges via a Trojan horse DLL in the current working directory, a different vulnerability than CVE-2012-0223.

  • CVE-2011-4187Feb 21, 2012
    Novell
    Iprint
    risk 0.00cvss —epss 0.04

    Buffer overflow in the GetDriverSettings function in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a long realm field, a different vulnerability than CVE-2011-3173.

  • CVE-2011-4186Feb 21, 2012
    Novell
    Iprint
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a crafted client-file-name parameter in a printer-url, a different vulnerability than CVE-2011-1705.

  • CVE-2011-4185Feb 21, 2012
    Novell
    Iprint
    risk 0.00cvss —epss 0.03

    The GetPrinterURLList2 method in the ActiveX control in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2008-2431 and…

  • CVE-2012-1217Feb 21, 2012
    STHS
    STHS v2 Web Portal
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in STHS v2 Web Portal 2.2 allow remote attackers to inject arbitrary web script or HTML via the team parameter to (1) prospects.php, (2) prospect.php, or (3) team.php.

  • CVE-2012-1216Feb 21, 2012
    Pbboard
    Pbboard
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in PBBoard 2.1.4 allow remote attackers to hijack the authentication of administrators for requests that (1) upload a file via an add action or (2) change the contents of a file via a dit action.

  • CVE-2012-1215Feb 21, 2012
    Yoono
    Yoono
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Add friends module in the Yoono extension before 7.7.8 for Firefox allows remote attackers to inject arbitrary web script or HTML via the create field in a "Create a group" action.

  • CVE-2012-1214Feb 21, 2012
    Yoono
    Yoono Desktop
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Add friends module in Yoono Desktop Application before 1.8.21 allows remote attackers to inject arbitrary web script or HTML via the create field in a "Create a group" action.

  • CVE-2012-1200Feb 18, 2012
    Nova
    Nova
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Nova CMS allow remote attackers to execute arbitrary PHP code via a URL in the (1) fileType parameter to optimizer/index.php, (2) id parameter to administrator/modules/moduleslist.php, (3) filename parameter to…

  • CVE-2012-1199Feb 18, 2012
    Secureideas
    Basic Analysis and Security Engine
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Basic Analysis and Security Engine (BASE) 1.4.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) BASE_path parameter to base_ag_main.php, (2) base_db_setup.php, (3) base_graph_common.php, (4)…

  • CVE-2012-1198Feb 18, 2012
    Secureideas
    Basic Analysis and Security Engine
    risk 0.03cvss —epss 0.05

    base_ag_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allows remote attackers to execute arbitrary code by uploading contents of the file with an executable extension via a create action, then accessing it via a view action.

  • CVE-2012-1197Feb 18, 2012
    Acdsee
    Acdsee
    risk 0.00cvss —epss 0.04

    Integer overflow in the IDE_ACDStd.apl module for ACDSee 14.1 Build 137 allows remote attackers to execute arbitrary code via crafted "image dimension values" in a BMP file, which triggers a heap-based buffer overflow.

  • CVE-2012-1196Feb 18, 2012
    Lenovo
    ThinkManagement Console
    risk 0.07cvss —epss 0.52

    Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a .. (dot dot) in the filename parameter in a SetTaskLogByFile SOAP request.

  • CVE-2012-1195Feb 18, 2012
    Lenovo
    ThinkManagement Console
    risk 0.08cvss —epss 0.69

    Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a…

  • CVE-2011-5081Feb 18, 2012
    Backuppc
    Backuppc
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other earlier versions allows remote attackers to inject arbitrary web script or HTML via the share parameter in a RestoreFile action to index.cgi.

  • CVE-2011-4923Feb 18, 2012
    Backuppc
    Backuppc
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in View.pm in BackupPC 3.0.0, 3.1.0, 3.2.0, 3.2.1, and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the num parameter in a view action to index.cgi, related to the log file viewer, a different…

  • CVE-2011-4614Feb 18, 2012
    TYPO3
    Typo3
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x before 4.6.2, and development versions of 4.7 allows remote attackers to execute arbitrary PHP code via a URL in the…

  • CVE-2011-4320Feb 18, 2012
    Process One
    Ejabberd
    risk 0.00cvss —epss 0.02

    The mod_pubsub module (mod_pubsub.erl) in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users to cause a denial of service (infinite loop) via a stanza with a publish tag that lacks a node attribute.

  • CVE-2011-3361Feb 18, 2012
    Backuppc
    Backuppc
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in CGI/Browse.pm in BackupPC 3.2.0 and possibly other versions before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a browse action to index.cgi.

  • CVE-2011-4113Feb 17, 2012
    Drupal
    Views
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the Views module before 6.x-2.13 for Drupal allows remote attackers to execute arbitrary SQL commands via vectors related to "filters/arguments on certain types of views with specific configurations of arguments."

  • CVE-2011-4105Feb 17, 2012
    Light
    Light
    risk 0.00cvss —epss 0.00

    LightDM before 1.0.6 allows local users to change ownership of arbitrary files via a symlink attack on ~/.Xauthority.

  • CVE-2012-1194Feb 17, 2012
    Microsoft
    Windows Server 2008
    risk 0.01cvss —epss 0.10

    The resolver in the DNS Server service in Microsoft Windows Server 2008 before R2 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked…

  • CVE-2012-1193Feb 17, 2012
    PowerDNS
    Recursor
    risk 0.00cvss —epss 0.06

    The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost…

  • CVE-2012-1192Feb 17, 2012
    Unbound
    Unbound
    risk 0.00cvss —epss 0.01

    The resolver in Unbound before 1.4.11 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.

  • CVE-2012-1191Feb 17, 2012
    djbdns
    djbdns
    risk 0.00cvss —epss 0.02

    The resolver in dnscache in Daniel J. Bernstein djbdns 1.05 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost…

  • CVE-2012-0206Feb 17, 2012
    PowerDNS
    Authoritative
    risk 0.00cvss —epss 0.05

    common_startup.cc in PowerDNS (aka pdns) Authoritative Server before 2.9.22.5 and 3.x before 3.0.1 allows remote attackers to cause a denial of service (packet loop) via a crafted UDP DNS response.

  • CVE-2012-0352Feb 16, 2012
    Cisco Systems, Inc.
    Nexus 5000
    risk 0.00cvss —epss 0.01

    Cisco NX-OS 4.2.x before 4.2(1)SV1(5.1) on Nexus 1000v series switches; 4.x and 5.0.x before 5.0(2)N1(1) on Nexus 5000 series switches; and 4.2.x before 4.2.8, 5.0.x before 5.0.5, and 5.1.x before 5.1.1 on Nexus 7000 series switches allows remote attackers to cause a denial of…

  • CVE-2011-3027Feb 16, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 17.0.963.56 does not properly perform a cast of an unspecified variable during handling of columns, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.

  • CVE-2011-3026Feb 16, 2012
    Google
    Chrome
    risk 0.06cvss —epss 0.73

    Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer truncation.

  • CVE-2011-3025Feb 16, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 17.0.963.56 does not properly parse H.264 data, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2011-3024Feb 16, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service (application crash) via an empty X.509 certificate.

  • CVE-2011-3023Feb 16, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to drag-and-drop operations.

  • CVE-2011-3022Feb 16, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    translate/translate_manager.cc in Google Chrome before 17.0.963.56 and 19.x before 19.0.1036.7 uses an HTTP session to exchange data for translation, which allows remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2011-3021Feb 16, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to subframe loading.

  • CVE-2011-3020Feb 16, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Native Client validator implementation in Google Chrome before 17.0.963.56 has unknown impact and remote attack vectors.

  • CVE-2011-3019Feb 16, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Heap-based buffer overflow in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Matroska video (aka MKV) file.

  • CVE-2011-3018Feb 16, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Heap-based buffer overflow in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to path rendering.

  • CVE-2011-3017Feb 16, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to database handling.

  • CVE-2011-3016Feb 16, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving counter nodes, related to a "read-after-free" issue.