VYPR

CVEs

386,518 total · page 6760 of 7,731

AllCriticalHighKEV
  • CVE-2011-4783Dec 27, 2011
    Idapython
    IDAPython
    risk 0.00cvss —epss 0.04

    The IDAPython plugin before 1.5.2.3 in IDA Pro allows user-assisted remote attackers to execute arbitrary code via a crafted IDB file, related to improper handling of certain swig_runtime_data files in the current working directory.

  • CVE-2011-3841Dec 27, 2011
    WordPress
    Wp Symposium
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers to inject arbitrary web script or HTML via the uid parameter.

  • CVE-2011-1393Dec 27, 2011
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the authentication functionality in the server in IBM Lotus Domino 8.x before 8.5.2 FP4 allows remote attackers to cause a denial of service (daemon crash) via a crafted Notes RPC packet.

  • CVE-2011-4784Dec 27, 2011
    Nvidia
    Stereoscopic 3d Driver
    risk 0.00cvss —epss 0.00

    The NVIDIA Stereoscopic 3D driver before 7.17.12.7565 does not properly handle commands sent to a named pipe, which allows local users to gain privileges via a crafted application.

  • CVE-2011-4537Dec 27, 2011
    7-Technologies
    Interactive Graphical SCADA System (IGSS)
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in 7-Technologies (7T) Interactive Graphical SCADA System (IGSS) 9.0.0.11355 and earlier allow remote attackers to execute arbitrary code or cause a denial of service via a crafted packet to TCP port (1) 12397 or (2) 12399.

  • CVE-2011-4536Dec 27, 2011
    Wellintech
    Kingview
    risk 0.01cvss —epss 0.09

    Heap-based buffer overflow in nettransdll.dll in HistorySvr.exe (aka HistoryServer.exe) in WellinTech KingView 6.53 and 65.30.2010.18018 allows remote attackers to execute arbitrary code via a crafted op-code 3 packet.

  • CVE-2011-4169Dec 27, 2011
    Microfocus
    Managed Printing Administration
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP Managed Printing Administration before 2.6.4 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.

  • CVE-2011-4168Dec 27, 2011
    Microfocus
    Managed Printing Administration
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in hpmpa/jobDelivery/Default.asp in HP Managed Printing Administration before 2.6.4 allows remote attackers to create arbitrary files via crafted form data.

  • CVE-2011-4167Dec 27, 2011
    Microfocus
    Managed Printing Administration
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in MPAUploader.dll in HP Managed Printing Administration before 2.6.4 allows remote attackers to execute arbitrary code via a long filename parameter in an uploadfile action to Default.asp.

  • CVE-2011-4166Dec 27, 2011
    Microfocus
    Managed Printing Administration
    risk 0.08cvss —epss 0.58

    Directory traversal vulnerability in the MPAUploader.Uploader.1.UploadFiles method in HP Managed Printing Administration before 2.6.4 allows remote attackers to create arbitrary files via crafted form data.

  • CVE-2011-4050Dec 27, 2011
    7-Technologies
    IGSS
    risk 0.05cvss —epss 0.20

    Buffer overflow in 7-Technologies (7T) Interactive Graphical SCADA System (IGSS) 9.0.0.11200 allows remote attackers to cause a denial of service via a crafted packet to TCP port 12401.

  • CVE-2011-5012Dec 25, 2011
    Attachmate
    Reflection FTP Client
    risk 0.04cvss —epss 0.08

    Heap-based buffer overflow in the Reflection FTP Client (rftpcom.dll 7.2.0.106 and possibly other versions), as used in Attachmate Reflection 2008, Reflection 2011 R1 before 15.3.2.569 and R1 SP1 before, Reflection 2011 R2 before 15.4.1.327, Reflection Windows Client 7.2 SP1…

  • CVE-2011-5011Dec 25, 2011
    Xt Commerce
    Xt Commerce
    risk 0.00cvss —epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in xt:Commerce 3.0.4 SP2.1 and possibly earlier allow remote attackers to hijack the authentication of Admins for requests that (1) set a New user to Admin via the cID parameter to a statusconfirm action in…

  • CVE-2011-5010Dec 25, 2011
    Ctekproducts
    Skyrouter
    risk 0.08cvss —epss 0.66

    apps/a3/cfg_ethping.cgi in the Ctek SkyRouter 4200 and 4300 allows remote attackers to execute arbitrary commands via shell metacharacters in the PINGADDRESS parameter for a "u" action.

  • CVE-2011-5009Dec 25, 2011
    3ssoftware
    Codesys
    risk 0.04cvss —epss 0.10

    The CmpWebServer.dll module in the Control service in 3S CoDeSys 3.4 SP4 Patch 2 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a crafted Content-Length in an HTTP POST or (2) an invalid HTTP request method.

  • CVE-2011-5008Dec 25, 2011
    3ssoftware
    Codesys
    risk 0.00cvss —epss 0.05

    Integer overflow in the GatewayService component in 3S CoDeSys 3.4 SP4 Patch 2 allows remote attackers to execute arbitrary code via a large size value in the packet header, which triggers a heap-based buffer overflow.

  • CVE-2011-5007Dec 25, 2011
    3ssoftware
    Codesys
    risk 0.09cvss —epss 0.73

    Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other products, allows remote attackers to execute arbitrary code via a long URI to TCP port 8080.

  • CVE-2011-5006Dec 25, 2011
    Qqplayer
    Qqplayer
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in QQPlayer 3.2.845 allows remote attackers to execute arbitrary code via a crafted PnSize value in a MOV file.

  • CVE-2011-5005Dec 25, 2011
    Quixplorer
    Quixplorer
    risk 0.03cvss —epss 0.04

    Unrestricted file upload vulnerability in QuiXplorer 2.3 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension using the upload action to index.php, then accessing it via a direct request to the file in an unspecified…

  • CVE-2011-5004Dec 25, 2011
    Fabrikar
    Fabrik
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in models/importcsv.php in the Fabrik (com_fabrik) component before 2.1.1 for Joomla! allows remote authenticated users with Manager privileges to execute arbitrary code by uploading a file with an executable extension, then accessing it…

  • CVE-2011-5003Dec 25, 2011
    Avid
    Media Composer
    risk 0.08cvss —epss 0.62

    Stack-based buffer overflow in the Phonetic Indexer (AvidPhoneticIndexer.exe) in Avid Media Composer 5.5.3 and earlier allows remote attackers to execute arbitrary code via a long request to TCP port 4659.

  • CVE-2011-5002Dec 25, 2011
    Finaldraft
    Finaldraft
    risk 0.04cvss —epss 0.08

    Multiple stack-based buffer overflows in Final Draft 8 before 8.02 allow remote attackers to execute arbitrary code via a .fdx or .fdxt file with long (1) Word, (2) Transition, (3) Location, (4) Extension, (5) SceneIntro, (6) TimeOfDay, and (7) Character elements.

  • CVE-2011-5001Dec 25, 2011
    Trend Micro
    Control Manager
    risk 0.08cvss —epss 0.64

    Stack-based buffer overflow in the CGenericScheduler::AddTask function in cmdHandlerRedAlertController.dll in CmdProcessor.exe in Trend Micro Control Manager 5.5 before Build 1613 allows remote attackers to execute arbitrary code via a crafted IPC packet to TCP port 20101.

  • CVE-2011-4862Dec 25, 2011
    Heimdal
    Heimdal
    risk 0.04cvss —epss 0.95

    Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long…

  • CVE-2011-4601Dec 25, 2011
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.05

    family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated…

  • CVE-2010-5081Dec 25, 2011
    Mini Stream
    Rm Mp3 Converter
    risk 0.05cvss —epss 0.31

    Stack-based buffer overflow in Mini-Stream RM-MP3 Converter 3.1.2.1 allows remote attackers to execute arbitrary code via a long URL in a .pls file.

  • CVE-2009-5109Dec 25, 2011
    Mini Stream
    Ripper
    risk 0.06cvss —epss 0.32

    Stack-based buffer overflow in Mini-Stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long entry in a .pls file.

  • CVE-2011-4362Dec 24, 2011
    Lighttpd
    Lighttpd
    risk 0.05cvss —epss 0.21

    Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that…

  • CVE-2011-3839Dec 24, 2011
    Wuzly
    Wuzly
    risk 0.00cvss —epss 0.01

    The administration functionality in Wuzly 2.0 allows remote attackers to bypass authentication by setting the dXNlcm5hbWU cookie.

  • CVE-2011-3838Dec 24, 2011
    Wuzly
    Wuzly
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Wuzly 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) u parameter to fp.php, (2) epage parameter to newpage.php, (3) epost parameter to newpost.php, and (4) username parameter to login.php in admin/; or the (5)…

  • CVE-2011-3837Dec 24, 2011
    Wuzly
    Wuzly
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in blog_system/data_functions.php in Wuzly 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the preview parameter to index.php.

  • CVE-2011-3836Dec 24, 2011
    Wuzly
    Wuzly
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Wuzly 2.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator, (2) perform cross-site scripting (XSS), (3) perform SQL injection, or have other unspecified…

  • CVE-2011-3835Dec 24, 2011
    Wuzly
    Wuzly
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to (1) admin/login.php and (2) admin/404.php; the (3) q parameter to search.php; the (4) theme_name parameter to…

  • CVE-2011-3378Dec 24, 2011
    Rpm
    Rpm
    risk 0.00cvss —epss 0.06

    RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or…

  • CVE-2011-3372Dec 24, 2011
    Cyrus
    IMAP
    risk 0.00cvss —epss 0.03

    imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12 allows remote attackers to bypass authentication by sending an AUTHINFO USER command without sending an additional AUTHINFO PASS command.

  • CVE-2011-4596Dec 23, 2011
    OpenStack
    Nova
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted (1) tarball or (2) manifest.

  • CVE-2011-1392Dec 23, 2011
    IBM
    Rational Rhapsody
    risk 0.00cvss —epss 0.03

    The Blueberry FlashBack ActiveX control in BB FlashBack Recorder.dll in Blueberry BB FlashBack, as used in IBM Rational Rhapsody before 7.6.1 and other products, does not properly implement the (1) Start, (2) PauseAndSave, (3) InsertMarker, and (4) InsertSoundToFBRAtMarker…

  • CVE-2011-1391Dec 23, 2011
    IBM
    Rational Rhapsody
    risk 0.00cvss —epss 0.03

    The Blueberry FlashBack ActiveX control in BB FlashBack Recorder.dll in Blueberry BB FlashBack, as used in IBM Rational Rhapsody before 7.6.1 and other products, does not properly implement the InsertMarker method, which allows remote attackers to execute arbitrary code via…

  • CVE-2011-1388Dec 23, 2011
    IBM
    Rational Rhapsody
    risk 0.00cvss —epss 0.03

    The Blueberry FlashBack ActiveX control in BB FlashBack Recorder.dll in Blueberry BB FlashBack, as used in IBM Rational Rhapsody before 7.6.1 and other products, does not properly implement the TestCompatibilityRecordMode method, which allows remote attackers to execute…

  • CVE-2011-4897Dec 23, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Tor before 0.2.2.25-alpha, when configured as a relay without the Nickname configuration option, uses the local hostname as the Nickname value, which allows remote attackers to obtain potentially sensitive information by reading this value.

  • CVE-2011-4896Dec 23, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.01

    Tor before 0.2.2.24-alpha continues to use a reachable bridge that was previously configured but is not currently configured, which might allow remote attackers to obtain sensitive information about clients in opportunistic circumstances by monitoring network traffic to the…

  • CVE-2011-4895Dec 23, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Tor before 0.2.2.34, when configured as a bridge, sets up circuits through a process different from the process used by a client, which makes it easier for remote attackers to enumerate bridges by observing circuit building.

  • CVE-2011-4894Dec 23, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Tor before 0.2.2.34, when configured as a bridge, uses direct DirPort access instead of a Tor TLS connection for a directory fetch, which makes it easier for remote attackers to enumerate bridges by observing DirPort connections.

  • CVE-2011-2778Dec 23, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.04

    Multiple heap-based buffer overflows in Tor before 0.2.2.35 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code by (1) establishing a SOCKS connection to SocksPort or (2) leveraging a SOCKS proxy configuration.

  • CVE-2011-2769Dec 23, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.01

    Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values.

  • CVE-2011-2768Dec 23, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.01

    Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client…

  • CVE-2011-4782Dec 22, 2011
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter.

  • CVE-2011-4780Dec 22, 2011
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in libraries/display_export.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters, related to the export panels in the (1) server, (2) database, and…

  • CVE-2011-4634Dec 22, 2011
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted database name, related to the Database Synchronize panel; (2) a crafted database name, related to the Database…

  • CVE-2011-3990Dec 22, 2011
    Pukiwiki
    Plus!
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in plugin/comment.inc.php in PukiWiki Plus! 1.4.7plus-u2-i18n and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.