VYPR

CVEs

386,559 total · page 6752 of 7,732

AllCriticalHighKEV
  • CVE-2012-1022Feb 8, 2012
    4images
    4images
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/categories.php in 4images 1.7.10 remote attackers to execute arbitrary SQL commands via the cat_parent_id parameter in an addcat action.

  • CVE-2012-1021Feb 8, 2012
    4images
    4images
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/categories.php in 4images 1.7.10 allows remote attackers to inject arbitrary web script or HTML via the cat_parent_id parameter in an addcat action.

  • CVE-2012-1020Feb 8, 2012
    NexorONE
    Online Banking
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in login.php in NexorONE Online Banking allow remote attackers to inject arbitrary web script or HTML via the (1) visitor_language parameter to register.php or (2) message parameter.

  • CVE-2012-1019Feb 8, 2012
    Cryptpad
    XWiki Enterprise
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in XWiki Enterprise 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) XWiki.XWikiComments_comment parameter to xwiki/bin/commentadd/Main/WebHome, (2) XWiki.XWikiUsers_0_company parameter when editing…

  • CVE-2012-1018Feb 8, 2012
    D Mack Media
    Currency Converter
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in includes/convert.php in D-Mack Media Currency Converter (mod_currencyconverter) module 1.0.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the from parameter.

  • CVE-2012-1017Feb 8, 2012
    Basic Analysis And Security Engine
    Base
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allow remote attackers to execute arbitrary SQL commands via the (1) ip_addr[0][1], (2) ip_addr[0][2], or (3) ip_addr[0][9] parameters.

  • CVE-2011-5077Feb 8, 2012
    HDWiki
    HDWiki
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in attachement.php in HDWiki 5.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in image directory.

  • CVE-2011-5076Feb 8, 2012
    HDWiki
    HDWiki
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in model/comment.class.php in HDWiki 5.0, 5.1, and possibly other versions allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php. NOTE: some of these details are obtained from third party information.

  • CVE-2012-1011Feb 7, 2012
    WordPress
    Allwebmenus
    risk 0.04cvss —epss 0.09

    actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it…

  • CVE-2012-1010Feb 7, 2012
    WordPress
    Allwebmenus
    risk 0.04cvss —epss 0.09

    Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified…

  • CVE-2012-1005Feb 7, 2012
    Sphinx Soft
    Mobile Web Server
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Sphinx Software Mobile Web Server 3.1.2.47 allow remote attackers to inject arbitrary web script or HTML via the comment parameter to a blog, as demonstrated using (1) Blog/MyFirstBlog.txt or (2) Blog/AboutSomething.txt.

  • CVE-2012-0992Feb 7, 2012
    Openemr
    Openemr
    risk 0.03cvss —epss 0.04

    interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter.

  • CVE-2012-0991Feb 7, 2012
    Openemr
    Openemr
    risk 0.04cvss —epss 0.09

    Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in…

  • CVE-2012-0990Feb 7, 2012
    Dclassifieds
    Dclassifieds
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin/settings/update in DClassifieds 0.1 final allows remote attackers to hijack the authentication of administrators for requests that modify account settings such as the administrator password or email via certain Settings[]…

  • CVE-2012-1007Feb 7, 2012
    Apache
    Struts
    risk 0.06cvss —epss 0.33

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or…

  • CVE-2012-1006Feb 7, 2012
    Apache
    Struts
    risk 0.08cvss —epss 0.57

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to…

  • CVE-2012-1003Feb 7, 2012
    Opera
    Opera
    risk 0.00cvss —epss 0.01

    Multiple integer overflows in Opera 11.60 and earlier allow remote attackers to cause a denial of service (application crash) via a large integer argument to the (1) Int32Array, (2) Float32Array, (3) Float64Array, (4) Uint32Array, (5) Int16Array, or (6) ArrayBuffer function. …

  • CVE-2012-0830Feb 6, 2012
    PHP
    PHP
    risk 0.05cvss —epss 0.30

    The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect…

  • CVE-2012-0396Feb 6, 2012
    EMC Corporation
    Documentum Xplore
    risk 0.00cvss —epss 0.01

    EMC Documentum xPlore 1.0, 1.1 before P07, and 1.2 does not properly enforce the requirement for BROWSE permission, which allows remote authenticated users to determine the existence of an object, or read object metadata, via a search.

  • CVE-2012-0290Feb 6, 2012
    Symantec
    Pcanywhere
    risk 0.00cvss —epss 0.02

    Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), Altiris Client Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), and Altiris Deployment Solution Remote pcAnywhere Solution 7.1…

  • CVE-2012-0194Feb 6, 2012
    IBM
    Aix
    risk 0.00cvss —epss 0.03

    The TCP implementation in IBM AIX 5.3, 6.1, and 7.1, when the Large Send Offload option is enabled, allows remote attackers to cause a denial of service (assertion failure and panic) via an unspecified series of packets.

  • CVE-2011-4041Feb 6, 2012
    Broadwin
    Webaccess
    risk 0.04cvss —epss 0.18

    webvrpcs.exe in Advantech/BroadWin WebAccess allows remote attackers to execute arbitrary code or obtain a security-code value via a long string in an RPC request to TCP port 4592.

  • CVE-2011-4872Feb 5, 2012
    Htc
    Evo 3d
    risk 0.00cvss —epss 0.01

    Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials…

  • CVE-2011-4879Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.04cvss —epss 0.12

    miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime does…

  • CVE-2011-4878Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.04cvss —epss 0.11

    Directory traversal vulnerability in miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime…

  • CVE-2011-4877Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.04cvss —epss 0.07

    HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime, when Transfer Mode is enabled, allows…

  • CVE-2011-4876Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime, when…

  • CVE-2011-4875Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.04cvss —epss 0.14

    Stack-based buffer overflow in HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime, when…

  • CVE-2011-4514Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.03

    The TELNET daemon in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime does not perform authentication, which makes it easier…

  • CVE-2011-4513Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.05

    Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allow user-assisted remote attackers to execute arbitrary code via a…

  • CVE-2011-4512Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC…

  • CVE-2011-4511Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and…

  • CVE-2011-4510Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and…

  • CVE-2011-4509Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.02

    The HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime has an improperly selected default password for the…

  • CVE-2011-4508Feb 3, 2012
    Siemens Foundation
    Wincc
    risk 0.00cvss —epss 0.03

    The HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime generates predictable…

  • CVE-2012-0314Feb 3, 2012
    EAccess
    GP02
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities on the eAccess Pocket WiFi (aka GP02) router before 2.00 with firmware 11.203.11.05.168 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) initialize settings or (2)…

  • CVE-2011-4791Feb 3, 2012
    Microfocus
    Data Protector Media Operations
    risk 0.01cvss —epss 0.08

    DBServer.exe in HP Data Protector Media Operations 6.11 and earlier allows remote attackers to execute arbitrary code via a crafted request containing a large value in a length field.

  • CVE-2012-0448Feb 2, 2012
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Bugzilla 2.x and 3.x before 3.4.14, 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 does not reject non-ASCII characters in e-mail addresses of new user accounts, which makes it easier for remote authenticated users to spoof other…

  • CVE-2012-0440Feb 2, 2012
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in jsonrpc.cgi in Bugzilla 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 allows remote attackers to hijack the authentication of arbitrary users for requests that use the JSON-RPC API.

  • CVE-2011-3463Feb 2, 2012
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    WebDAV Sharing in Apple Mac OS X 10.7.x before 10.7.3 does not properly perform authentication, which allows local users to gain privileges by leveraging access to (1) the server or (2) a bound directory.

  • CVE-2011-3462Feb 2, 2012
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Time Machine in Apple Mac OS X before 10.7.3 does not verify the unique identifier of its remote AFP volume or Time Capsule, which allows remote attackers to obtain sensitive information contained in new backups by spoofing this storage object, a different vulnerability than…

  • CVE-2011-3460Feb 2, 2012
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    Buffer overflow in QuickTime in Apple Mac OS X before 10.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PNG file.

  • CVE-2011-3459Feb 2, 2012
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Off-by-one error in QuickTime in Apple Mac OS X before 10.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted rdrf atom in a movie file that triggers a buffer overflow.

  • CVE-2011-3458Feb 2, 2012
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    QuickTime in Apple Mac OS X before 10.7.3 does not prevent access to uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MP4 file.

  • CVE-2011-3457Feb 2, 2012
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    The OpenGL implementation in Apple Mac OS X before 10.7.3 does not properly perform OpenGL Shading Language (aka GLSL) compilation, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted…

  • CVE-2011-3453Feb 2, 2012
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    Integer overflow in libresolv in Apple Mac OS X before 10.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via crafted DNS data.

  • CVE-2011-3452Feb 2, 2012
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Internet Sharing in Apple Mac OS X before 10.7.3 does not preserve the Wi-Fi configuration across software updates, which allows remote attackers to obtain sensitive information by leveraging the lack of a WEP password for a Wi-Fi network.

  • CVE-2011-3450Feb 2, 2012
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    CoreUI in Apple Mac OS X 10.7.x before 10.7.3 does not properly restrict the allocation of stack memory, which allows remote attackers to execute arbitrary code or cause a denial of service (memory consumption and application crash) via a long URL.

  • CVE-2011-3449Feb 2, 2012
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Use-after-free vulnerability in CoreText in Apple Mac OS X before 10.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted embedded font in a document.

  • CVE-2011-3448Feb 2, 2012
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in CoreMedia in Apple Mac OS X before 10.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.264 encoding.