VYPR

CVEs

386,533 total · page 6757 of 7,731

AllCriticalHighKEV
  • CVE-2011-3531Jan 18, 2012
    Oracle Corporation
    Fusion Middleware
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Oracle Web Services Manager component in Oracle Fusion Middleware 11.1.1.3, 11.1.1.4, and 11.1.1.5 allows remote attackers to affect availability via unknown vectors related to Web Services Security.

  • CVE-2011-3524Jan 18, 2012
    Oracle Corporation
    Jd Edwards Enterpriseone
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the EnterpriseOne Tools component in Oracle JD Edwards 8.98 SP 24 allows remote authenticated users to affect confidentiality, related to Enterprise Infrastructure SEC (JDENET), a different vulnerability than CVE-2011-2325, CVE-2011-2326, and…

  • CVE-2011-3514Jan 18, 2012
    Oracle Corporation
    Jd Edwards Enterpriseone
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the EnterpriseOne Tools component in Oracle JD Edwards 8.98 SP 24 allows remote authenticated users to affect integrity, related to Enterprise Infrastructure SEC (JDENET).

  • CVE-2011-3509Jan 18, 2012
    Oracle Corporation
    Jd Edwards Enterpriseone
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the EnterpriseOne Tools component in Oracle JD Edwards 8.98 SP 24 allows remote authenticated users to affect confidentiality, related to Enterprise Infrastructure SEC (JDENET), a different vulnerability than CVE-2011-2325, CVE-2011-2326, and…

  • CVE-2011-2326Jan 18, 2012
    Oracle Corporation
    Jd Edwards Enterpriseone
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the EnterpriseOne Tools component in Oracle JD Edwards 8.98 SP 24 allows remote authenticated users to affect confidentiality, related to Enterprise Infrastructure SEC (JDENET), a different vulnerability than CVE-2011-2325, CVE-2011-3509, and…

  • CVE-2011-2325Jan 18, 2012
    Oracle Corporation
    Jd Edwards Enterpriseone
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the EnterpriseOne Tools component in Oracle JD Edwards 8.98 SP 24 allows remote authenticated users to affect confidentiality, related to Enterprise Infrastructure SEC (JDENET), a different vulnerability than CVE-2011-2326, CVE-2011-3509, and…

  • CVE-2011-2324Jan 18, 2012
    Oracle Corporation
    Jd Edwards Enterpriseone
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the EnterpriseOne Tools component in Oracle JD Edwards 8.98 SP 24 allows remote attackers to affect availability, related to Enterprise Infrastructure SEC (JDENET).

  • CVE-2011-2321Jan 18, 2012
    Oracle Corporation
    Jd Edwards Enterpriseone
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the EnterpriseOne Tools component in Oracle JD Edwards 8.98 SP 24 allows remote authenticated users to affect confidentiality, related to Enterprise Infrastructure SEC (JDNET).

  • CVE-2011-2317Jan 18, 2012
    Oracle Corporation
    Jd Edwards Enterpriseone
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the EnterpriseOne Tools component in Oracle JD Edwards 8.98 SP 24 allows remote authenticated users to affect integrity, related to Enterprise Infrastucture SEC (JDNET).

  • CVE-2011-2271Jan 18, 2012
    Oracle Corporation
    Application Object Library
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote authenticated users to affect integrity via unknown vectors related to Attachments / File Upload.

  • CVE-2011-2262Jan 18, 2012
    MySQL
    MySQL
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote attackers to affect availability via unknown vectors.

  • CVE-2012-0781Jan 18, 2012
    PHP
    PHP
    risk 0.04cvss —epss 0.10

    The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that attempts to perform Tidy::diagnose operations on invalid objects, a different vulnerability…

  • CVE-2012-0190Jan 18, 2012
    IBM
    Spss Data Collection
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Render method in the ExportHTML.ocx ActiveX control in ExportHTML.dll in IBM SPSS Dimensions 5.5 and SPSS Data Collection 5.6, 6.0, and 6.0.1 allows remote attackers to execute arbitrary code via a crafted HTML document.

  • CVE-2012-0189Jan 18, 2012
    IBM
    Spss Samplepower
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in the (1) PrintFile and (2) SaveDoc methods in the VsVIEW6 ActiveX control in VsVIEW6.ocx in IBM SPSS SamplePower 3.0 allow remote attackers to execute arbitrary code via a crafted HTML document.

  • CVE-2012-0188Jan 18, 2012
    IBM
    Spss Data Collection
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the SetLicenseInfoEx method in an ActiveX control in mraboutb.dll in IBM SPSS Dimensions 5.5 and SPSS Data Collection 5.6, 6.0, and 6.0.1 allows remote attackers to execute arbitrary code via a crafted HTML document.

  • CVE-2012-0031Jan 18, 2012
    Apache
    HTTP Server
    risk 0.03cvss —epss 0.03

    scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an…

  • CVE-2011-4153Jan 18, 2012
    PHP
    PHP
    risk 0.04cvss —epss 0.12

    PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that performs strndup operations on untrusted…

  • CVE-2011-3328Jan 17, 2012
    Libpng
    Libpng
    risk 0.00cvss —epss 0.04

    The png_handle_cHRM function in pngrutil.c in libpng 1.5.4, when color-correction support is enabled, allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a malformed PNG image containing a cHRM chunk associated with a certain…

  • CVE-2010-5082Jan 17, 2012
    Microsoft
    Windows Server 2008
    risk 0.01cvss —epss 0.15

    Untrusted search path vulnerability in colorcpl.exe 6.0.6000.16386 in the Color Control Panel in Microsoft Windows Server 2008 SP2, R2, and R2 SP1 allows local users to gain privileges via a Trojan horse sti.dll file in the current working directory, as demonstrated by a…

  • CVE-2012-0267Jan 15, 2012
    Ntrglobal
    Ntr Activex Control
    risk 0.06cvss —epss 0.39

    The StopModule method in the NTR ActiveX control before 2.0.4.8 allows remote attackers to execute arbitrary code via a crafted lModule parameter that triggers use of an arbitrary memory address as a function pointer.

  • CVE-2012-0266Jan 15, 2012
    Ntrglobal
    Ntr Activex Control
    risk 0.06cvss —epss 0.42

    Multiple stack-based buffer overflows in the NTR ActiveX control before 2.0.4.8 allow remote attackers to execute arbitrary code via (1) a long bstrUrl parameter to the StartModule method, (2) a long bstrParams parameter to the Check method, a long bstrUrl parameter to the (3)…

  • CVE-2011-5066Jan 15, 2012
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.00

    The SibRaRecoverableSiXaResource class in the Default Messaging Component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 does not properly handle a Service Integration Bus (SIB) dump operation involving the First Failure Data Capture (FFDC) introspection code,…

  • CVE-2011-5065Jan 15, 2012
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 allows remote attackers to inject arbitrary web script or HTML via vectors related to web messaging.

  • CVE-2011-4868Jan 15, 2012
    Isc
    DHCP
    risk 0.00cvss —epss 0.03

    The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash)…

  • CVE-2011-1377Jan 15, 2012
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    The Web Services Security component in the Web Services Feature Pack before 6.1.0.41 for IBM WebSphere Application Server (WAS) 6.1 does not properly handle the enabling of WS-Security for a JAX-WS application, which has unspecified impact and attack vectors.

  • CVE-2011-1362Jan 15, 2012
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Installation Verification Test (IVT) application in the Install component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 and 7.0 before 7.0.0.19 allows remote attackers to inject arbitrary web script or HTML via…

  • CVE-2011-5064Jan 14, 2012
    Apache
    Tomcat
    risk 0.01cvss —epss 0.06

    DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass…

  • CVE-2011-5063Jan 14, 2012
    Apache
    Tomcat
    risk 0.00cvss —epss 0.06

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a…

  • CVE-2011-5062Jan 14, 2012
    Apache
    Tomcat
    risk 0.00cvss —epss 0.07

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a…

  • CVE-2011-1184Jan 14, 2012
    Apache
    Tomcat
    risk 0.00cvss —epss 0.08

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access…

  • CVE-2012-0039HigJan 14, 2012
    GNOME Foundation
    Glib
    risk 0.49cvss 7.5epss 0.02

    GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application…

  • CVE-2012-0693Jan 14, 2012
    Whmcs
    Whmcompletesolution
    risk 0.00cvss —epss 0.01

    submitticket.php in WHMCompleteSolution (WHMCS) 5.03 allows remote attackers to inject arbitrary code into a subject field via crafted ticket data, a different vulnerability than CVE-2011-5061. NOTE: the vendor disputes this issue, noting that some of the details overlap…

  • CVE-2011-5061Jan 14, 2012
    Whmcs
    Whmcompletesolution
    risk 0.00cvss —epss 0.02

    functions.php in WHMCompleteSolution (WHMCS) 4.0.x through 5.0.x allows remote attackers to trigger arbitrary code execution in the Smarty templating system by submitting a crafted ticket, related to improper handling of characters in the subject field.

  • CVE-2011-5060Jan 13, 2012
    Perl Foundation
    PAR
    risk 0.00cvss —epss 0.00

    The par_mktmpdir function in the PAR module before 1.003 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR packed…

  • CVE-2012-0030Jan 13, 2012
    OpenStack
    Nova
    risk 0.00cvss —epss 0.02

    Nova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to bypass access restrictions for tenants of other users via an OSAPI request with a modified project_id URI parameter.

  • CVE-2011-4114Jan 13, 2012
    PAR::Packer
    PAR::Packer
    risk 0.00cvss —epss 0.00

    The par_mktmpdir function in the PAR::Packer module before 1.012 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR…

  • CVE-2011-4057Jan 13, 2012
    Wibu
    Codemeter Runtime
    risk 0.00cvss —epss 0.05

    Wibu-Systems AG CodeMeter Runtime 4.30c, 4.10b, and possibly other versions before 4.40 allows remote attackers to cause a denial of service (CodeMeter.exe crash) via certain crafted packets to TCP port 22350.

  • CVE-2011-3597Jan 13, 2012
    Libwww Perl
    Digest
    risk 0.04cvss —epss 0.13

    Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.

  • CVE-2011-2939Jan 13, 2012
    Perl Foundation
    Perl
    risk 0.00cvss —epss 0.03

    Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based…

  • CVE-2011-2776Jan 13, 2012
    Robert Luberda
    Super
    risk 0.00cvss —epss 0.00

    Buffer overflow in the Error function in super.c in Super 3.30.0 might allow local users to execute arbitrary code via vectors related to syslog logging. NOTE: some of these details are obtained from third party information.

  • CVE-2012-0697Jan 13, 2012
    Microfocus
    StorageWorks P2000 G3 MSA array systems
    risk 0.01cvss —epss 0.07

    HP StorageWorks P2000 G3 MSA array systems have a default account, which makes it easier for remote attackers to perform administrative tasks via unspecified vectors, a different vulnerability than CVE-2011-4788.

  • CVE-2012-0696Jan 13, 2012
    IBM
    Cognos Tm1
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Executive Viewer (EV) in IBM Cognos TM1 before 9.5 FP1 allow remote attackers to inject arbitrary web script or HTML via unspecified requests to (1) aspnet_client or (2) evserver/createcontrol.js.

  • CVE-2012-0310Jan 13, 2012
    Cogentdatahub
    Cascade Datahub
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in Cogent DataHub 7.1.2 and earlier, Cascade DataHub 6.4.20 and earlier, and OPC DataHub 6.4.20 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

  • CVE-2012-0309Jan 13, 2012
    Cogentdatahub
    Cascade Datahub
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Cogent DataHub 7.1.2 and earlier, Cascade DataHub 6.4.20 and earlier, and OPC DataHub 6.4.20 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-4925Jan 13, 2012
    Clusterresources
    Torque Resource Manager
    risk 0.00cvss —epss 0.01

    Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 2.5.9, when munge authentication is used, allows remote authenticated users to impersonate arbitrary user accounts via unspecified vectors.

  • CVE-2011-4789Jan 13, 2012
    Microfocus
    Diagnostics
    risk 0.08cvss —epss 0.64

    Stack-based buffer overflow in magentservice.exe in the server in HP LoadRunner 11.00 before patch 4 allows remote attackers to execute arbitrary code via a crafted size value in a packet. NOTE: it was originally reported that the affected product is HP Diagnostics Server, but…

  • CVE-2011-4788Jan 13, 2012
    Microfocus
    StorageWorks P2000 G3 MSA
    risk 0.00cvss —epss 0.05

    Absolute path traversal vulnerability in the web interface on HP StorageWorks P2000 G3 MSA array systems allows remote attackers to read arbitrary files via a pathname in the URI.

  • CVE-2011-4787Jan 12, 2012
    Microfocus
    Easy Printer Care Software
    risk 0.00cvss —epss 0.04

    A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-2404 and…

  • CVE-2011-4786Jan 12, 2012
    Microfocus
    Easy Printer Care Software
    risk 0.06cvss —epss 0.39

    A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-2404 and…

  • CVE-2012-0695Jan 12, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Google Chrome before 17.0.963.27 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors.