VYPR

CVEs

386,521 total · page 6758 of 7,731

AllCriticalHighKEV
  • CVE-2011-4370Jan 10, 2012
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.06

    Adobe Reader and Acrobat before 9.5, and 10.x before 10.1.2, on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-4372 and CVE-2011-4373.

  • CVE-2011-4785Jan 10, 2012
    Microfocus
    LaserJet 2430
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the HP-ChaiSOE/1.0 web server on the HP LaserJet P3015 printer with firmware before 07.080.3, LaserJet 4650 printer with firmware 07.006.0, and LaserJet 2430 printer with firmware 08.113.0_I35128 allows remote attackers to read arbitrary…

  • CVE-2011-4532Jan 8, 2012
    Siemens Foundation
    Automation License Manager
    risk 0.03cvss —epss 0.03

    Absolute path traversal vulnerability in the ALMListView.ALMListCtrl ActiveX control in almaxcx.dll in the graphical user interface in Siemens Automation License Manager (ALM) 2.0 through 5.1+SP1+Upd2 allows remote attackers to overwrite arbitrary files via the Save method.

  • CVE-2011-4531Jan 8, 2012
    Siemens Foundation
    Automation License Manager
    risk 0.04cvss —epss 0.08

    Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted content in a (1) get_target_ocx_param or (2) send_target_ocx_param command.

  • CVE-2011-4530Jan 8, 2012
    Siemens Foundation
    Automation License Manager
    risk 0.03cvss —epss 0.04

    Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 does not properly copy fields obtained from clients, which allows remote attackers to cause a denial of service (exception and daemon crash) via long fields, as demonstrated by fields to the (1)…

  • CVE-2011-4529Jan 8, 2012
    Siemens Foundation
    Automation License Manager
    risk 0.04cvss —epss 0.07

    Multiple buffer overflows in Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 allow remote attackers to execute arbitrary code via a long serialid field in an _licensekey command, as demonstrated by the (1) check_licensekey or (2) read_licensekey command.

  • CVE-2011-5057Jan 8, 2012
    Apache
    Struts
    risk 0.05cvss —epss 0.27

    Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that…

  • CVE-2012-0394Jan 8, 2012
    Apache
    Struts
    risk 0.02cvss —epss 0.73

    The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself.

  • CVE-2012-0393Jan 8, 2012
    Apache
    Struts
    risk 0.00cvss —epss 0.36

    The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.

  • CVE-2012-0392Jan 8, 2012
    Apache
    Struts
    risk 0.04cvss —epss 0.98

    The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

  • CVE-2012-0391CriKEVJan 8, 2012
    Apache
    Struts
    risk 0.78cvss 9.8epss 0.76

    The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

  • CVE-2011-4361Jan 8, 2012
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated…

  • CVE-2011-4360Jan 8, 2012
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter.

  • CVE-2012-0024Jan 8, 2012
    Maradns
    Maradns
    risk 0.00cvss —epss 0.03

    MaraDNS before 1.3.07.12 and 1.4.x before 1.4.08 computes hash values for DNS data without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted queries with the…

  • CVE-2011-5056Jan 8, 2012
    Maradns
    Maradns
    risk 0.00cvss —epss 0.00

    The authoritative server in MaraDNS through 2.0.04 computes hash values for DNS data without restricting the ability to trigger hash collisions predictably, which might allow local users to cause a denial of service (CPU consumption) via crafted records in zone files, a…

  • CVE-2011-5055Jan 8, 2012
    Maradns
    Maradns
    risk 0.00cvss —epss 0.01

    MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS data without properly restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted queries with the Recursion Desired…

  • CVE-2011-4870Jan 8, 2012
    Invensys
    Wonderware Inbatch
    risk 0.00cvss —epss 0.02

    Multiple buffer overflows in the (1) GUIControls, (2) BatchObjSrv, and (3) BatchSecCtrl ActiveX controls in Invensys Wonderware InBatch 9.0 and 9.0 SP1, and InBatch 8.1 SP1, 9.0 SP2, and 9.5 Server and Runtime Clients, allow remote attackers to execute arbitrary code via a long…

  • CVE-2011-4056Jan 8, 2012
    Siemens Foundation
    Tecnomatix Factorylink
    risk 0.00cvss —epss 0.01

    An unspecified ActiveX control in ActBar.ocx in Siemens Tecnomatix FactoryLink 6.6.1 (aka 6.6 SP1), 7.5.217 (aka 7.5 SP2), and 8.0.2.54 allows remote attackers to create or overwrite arbitrary files via the save method.

  • CVE-2011-4055Jan 8, 2012
    Siemens Foundation
    Tecnomatix Factorylink
    risk 0.00cvss —epss 0.05

    Buffer overflow in the WebClient ActiveX control in Siemens Tecnomatix FactoryLink 6.6.1 (aka 6.6 SP1), 7.5.217 (aka 7.5 SP2), and 8.0.2.54 allows remote attackers to execute arbitrary code via a long string in a parameter associated with the location URL.

  • CVE-2011-3206Jan 8, 2012
    Rhq Project
    Rhq
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in RHQ 4.2.0, as used in JBoss Operations Network (aka JON or JBoss ON) before 3.0, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-3922Jan 7, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Stack-based buffer overflow in Google Chrome before 16.0.912.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to glyph handling.

  • CVE-2011-3921Jan 7, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 16.0.912.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving animation frames.

  • CVE-2011-3919Jan 7, 2012
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Heap-based buffer overflow in libxml2, as used in Google Chrome before 16.0.912.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-5054Jan 6, 2012
    KDE
    Kcheckpass
    risk 0.00cvss —epss 0.00

    kcheckpass passes a user-supplied argument to the pam_start function, often within a setuid environment, which allows local users to invoke any configured PAM stack, and possibly trigger unintended side effects, via an arbitrary valid PAM service name, a different vulnerability…

  • CVE-2011-5053Jan 6, 2012
    Wi Fi Alliance
    Wi-Fi Protected Setup (WPS)
    risk 0.03cvss —epss 0.03

    The Wi-Fi Protected Setup (WPS) protocol, when the "external registrar" authentication method is used, does not properly inform clients about failed PIN authentication, which makes it easier for remote attackers to discover the PIN value, and consequently discover the Wi-Fi…

  • CVE-2012-0287Jan 6, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the…

  • CVE-2011-4616Jan 6, 2012
    Perl Foundation
    HTML-Template-Pro
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the HTML-Template-Pro module before 0.9507 for Perl allows remote attackers to inject arbitrary web script or HTML via template parameters, related to improper handling of > (greater than) and < (less than) characters.

  • CVE-2012-0390Jan 6, 2012
    GNU
    Gnutls
    risk 0.00cvss —epss 0.01

    The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel…

  • CVE-2012-0027Jan 6, 2012
    OpenSSL Project
    OpenSSL
    risk 0.00cvss —epss 0.05

    The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.

  • CVE-2011-4619Jan 6, 2012
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.18

    The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.

  • CVE-2011-4577Jan 6, 2012
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.08

    OpenSSL before 0.9.8s and 1.x before 1.0.0f, when RFC 3779 support is enabled, allows remote attackers to cause a denial of service (assertion failure) via an X.509 certificate containing certificate-extension data associated with (1) IP address blocks or (2) Autonomous System…

  • CVE-2011-4576Jan 6, 2012
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.16

    The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

  • CVE-2011-4109Jan 6, 2012
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.17

    Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.

  • CVE-2011-4108Jan 6, 2012
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.16

    The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

  • CVE-2011-4858Jan 5, 2012
    Apache
    Tomcat
    risk 0.09cvss —epss 0.80

    Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many…

  • CVE-2011-5019Jan 5, 2012
    Textpattern
    Textpattern
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in setup/index.php in Textpattern CMS 4.4.1, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the ddb parameter.

  • CVE-2011-4905Jan 5, 2012
    Apache
    Activemq
    risk 0.00cvss —epss 0.08

    Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by sending many openwire failover:tcp:// connection requests.

  • CVE-2011-5052Jan 4, 2012
    Cocsoft
    Stream Down
    risk 0.05cvss —epss 0.30

    Stack-based buffer overflow in CoCSoft Stream Down 6.8.0 allows remote web servers to execute arbitrary code via a long response to a download request.

  • CVE-2011-5051Jan 4, 2012
    WordPress
    Wp Symposium
    risk 0.00cvss —epss 0.04

    Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension using (1) uploadify/upload_admin_avatar.php or (2)…

  • CVE-2011-5050Jan 4, 2012
    Elitecore
    Cyberoam UTM
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in corporate/Controller in Elitecore Technologies Cyberoam UTM before 10.01.2 build 059 allows remote authenticated administrators to execute arbitrary SQL commands via the tableid parameter. NOTE: some of these details are obtained from third party…

  • CVE-2011-5049Jan 4, 2012
    MySQL
    MySQL
    risk 0.03cvss —epss 0.04

    MySQL 5.5.8, when running on Windows, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted packet to TCP port 3306.

  • CVE-2011-4921Jan 4, 2012
    E107
    E107
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in usersettings.php in e107 0.7.26, and possibly other versions before 1.0.0, allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2011-4920Jan 4, 2012
    E107
    E107
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.26, and other versions before 1.0.0, allow remote attackers to inject arbitrary web script or HTML via the URL to (1) e107_images/thumb.php or (2) rate.php, (3) resend_name parameter to e107_admin/users.php, and (4)…

  • CVE-2007-6751Jan 4, 2012
    H Fj
    Mailform Plugin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the MailForm plugin before 1.20 for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-3337Jan 4, 2012
    Eeye
    Retina Network Security Scanner
    risk 0.00cvss —epss 0.00

    eEye Audit ID 2499 in eEye Digital Security Audits 2406 through 2423 for eEye Retina Network Security Scanner on HP-UX, IRIX, and Solaris allows local users to gain privileges via a Trojan horse gauntlet program in an arbitrary directory under /usr/local/.

  • CVE-2011-1386Jan 4, 2012
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.01

    IBM Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.1.1, 6.2.0, and 6.2.1 do not properly handle signature validations based on SAML 1.0, 1.1, and 2.0, which allows remote attackers to bypass intended authentication or…

  • CVE-2011-1384Jan 4, 2012
    IBM
    invscout
    risk 0.00cvss —epss 0.00

    The (1) bin/invscoutClient_VPD_Survey and (2) sbin/invscout_lsvpd programs in invscout.rte before 2.2.0.19 on IBM AIX 7.1, 6.1, 5.3, and earlier allow local users to delete arbitrary files, or trigger inventory scout operations on arbitrary files, via a symlink attack on an…

  • CVE-2011-5048Jan 3, 2012
    IBM
    Web Experience Factory
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in IBM Web Experience Factory (aka WEF, formerly WebSphere Portlet Factory) 7.0 and 7.0.1 allow remote attackers to inject arbitrary web script or HTML via a (1) text INPUT element or (2) TEXTAREA element, related to an…

  • CVE-2011-5047Jan 3, 2012
    Pfsense
    Pfsense
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in status_rrd_graph.php in pfSense before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the style parameter.

  • CVE-2011-4197Jan 3, 2012
    Pfsense
    Pfsense
    risk 0.00cvss —epss 0.02

    etc/inc/certs.inc in the PKI implementation in pfSense before 2.0.1 creates each X.509 certificate with a true value for the CA basic constraint, which allows remote attackers to create sub-certificates for arbitrary subjects by leveraging the private key.