VYPR

CVEs

386,462 total · page 6767 of 7,730

AllCriticalHighKEV
  • CVE-2011-4157Nov 16, 2011
    Microfocus
    StorageWorks P4000 Virtual SAN Appliance
    risk 0.01cvss —epss 0.13

    Stack-based buffer overflow in hydra.exe in HP SAN/iQ before 9.5 on the HP StorageWorks P4000 Virtual SAN Appliance allows remote attackers to execute arbitrary code via a crafted login request.

  • CVE-2011-1516Nov 15, 2011
    Apple Inc.
    Mac OS X
    risk 0.03cvss —epss 0.03

    The kSBXProfileNoNetwork and kSBXProfileNoInternet sandbox profiles in Apple Mac OS X 10.5.x through 10.7.x do not propagate restrictions to all created processes, which allows remote attackers to access network resources via a crafted application, as demonstrated by use of…

  • CVE-2008-7303Nov 15, 2011
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    The nonet and nointernet sandbox profiles in Apple Mac OS X 10.5.x do not propagate restrictions to all created processes, which allows remote attackers to access network resources via a crafted application, as demonstrated by use of launchctl to trigger the launchd daemon's…

  • CVE-2011-4118Nov 15, 2011
    Mahara (software)
    Mahara
    risk 0.00cvss —epss 0.02

    Mahara before 1.4.1, when MNet (aka the Moodle network feature) is used, allows remote authenticated users to gain privileges via a jump to an XMLRPC target.

  • CVE-2011-2774Nov 15, 2011
    Mahara (software)
    Mahara
    risk 0.00cvss —epss 0.01

    The "Reply to message" feature in Mahara 1.3.x and 1.4.x before 1.4.1 allows remote authenticated users to read the messages of a different user via a modified replyto parameter.

  • CVE-2011-2773Nov 15, 2011
    Mahara (software)
    Mahara
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Mahara before 1.4.1 allows remote attackers to hijack the authentication of administrators for requests that add a user to an institution.

  • CVE-2011-2772Nov 15, 2011
    Mahara (software)
    Mahara
    risk 0.00cvss —epss 0.02

    The get_dataroot_image_path function in lib/file.php in Mahara before 1.4.1 does not properly validate uploaded image files, which allows remote attackers to cause a denial of service (memory consumption) via a (1) large or (2) invalid image.

  • CVE-2011-2771Nov 15, 2011
    Mahara (software)
    Mahara
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Mahara before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) URI attributes and (2) the External Feed component, as demonstrated by the guid element in an RSS feed.

  • CVE-2011-4436Nov 12, 2011
    Dell
    Kace K2000 Systems Deployment Appliance
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface on the Dell KACE K2000 System Deployment Appliance allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-4048Nov 12, 2011
    Dell
    Kace K2000 Systems Deployment Appliance
    risk 0.00cvss —epss 0.01

    The Dell KACE K2000 System Deployment Appliance has a default username and password for the read-only reporting account, which makes it easier for remote attackers to obtain sensitive information from the database by leveraging the default credentials.

  • CVE-2011-4047Nov 12, 2011
    Dell
    Kace K2000 Systems Deployment Appliance
    risk 0.00cvss —epss 0.03

    The Dell KACE K2000 System Deployment Appliance allows remote attackers to execute arbitrary commands by leveraging database write access.

  • CVE-2011-4046Nov 12, 2011
    Dell
    Kace K2000 Systems Deployment Appliance
    risk 0.00cvss —epss 0.01

    The Dell KACE K2000 System Deployment Appliance stores the recovery account password in cleartext within a PHP script, which allows context-dependent attackers to obtain sensitive information by examining script source code.

  • CVE-2011-4435Nov 11, 2011
    IBM
    DB2 Tools
    risk 0.00cvss —epss 0.01

    The web-server component in the Consolidation and Analysis Engine (CAE) Server in DB2 Query Monitor in IBM DB2 Tools 2.3.0 for z/OS does not prevent directory browsing, which allows remote attackers to obtain sensitive information via HTTP requests.

  • CVE-2011-4434Nov 11, 2011
    Microsoft
    Windows Server 2008
    risk 0.00cvss —epss 0.02

    Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 do not properly enforce AppLocker rules, which allows local users to bypass intended access restrictions via a (1) macro or (2) scripting feature in an application, as demonstrated by Microsoft Office…

  • CVE-2011-3376Nov 11, 2011
    Apache
    Tomcat
    risk 0.00cvss —epss 0.01

    org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's…

  • CVE-2011-1375Nov 11, 2011
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    IBM AIX 6.1 and 7.1 does not restrict the wpar_limits_config and wpar_limits_modify system calls, which allows local users to cause a denial of service (system crash) via a crafted call.

  • CVE-2011-3442Nov 11, 2011
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    The kernel in Apple iOS before 5.0.1 does not ensure the validity of flag combinations for an mmap system call, which allows local users to execute arbitrary unsigned code via a crafted app.

  • CVE-2011-3441Nov 11, 2011
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    libinfo in Apple iOS before 5.0.1 does not properly formulate domain-name queries, which allows remote attackers to obtain sensitive information via a crafted DNS hostname.

  • CVE-2011-3440Nov 11, 2011
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    The Passcode Lock feature in Apple iOS before 5.0.1 on the iPad 2 does not properly implement the locked state, which allows physically proximate attackers to access data by opening a Smart Cover during power-off confirmation.

  • CVE-2011-3439Nov 11, 2011
    Apple Inc.
    Coregraphics
    risk 0.00cvss —epss 0.05

    FreeType in CoreGraphics in Apple iOS before 5.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font in a document.

  • CVE-2011-2460Nov 11, 2011
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2011-2459Nov 11, 2011
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2011-2458Nov 11, 2011
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.04

    Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, when Internet Explorer is used, allows remote attackers to bypass the cross-domain policy via a crafted…

  • CVE-2011-2457Nov 11, 2011
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.09

    Stack-based buffer overflow in Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code via unspecified vectors.

  • CVE-2011-2456Nov 11, 2011
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.09

    Buffer overflow in Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code via unspecified vectors.

  • CVE-2011-2455Nov 11, 2011
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2011-2454Nov 11, 2011
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2011-2453Nov 11, 2011
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2011-2452Nov 11, 2011
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2011-2451Nov 11, 2011
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2011-2450Nov 11, 2011
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via…

  • CVE-2011-2445Nov 11, 2011
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.06

    Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2011-3898Nov 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 15.0.874.120, when Java Runtime Environment (JRE) 7 is used, does not request user confirmation before applet execution begins, which allows remote attackers to have an unspecified impact via a crafted applet.

  • CVE-2011-3897Nov 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 15.0.874.120 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to editing.

  • CVE-2011-3896Nov 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Buffer overflow in Google Chrome before 15.0.874.120 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to shader variable mapping.

  • CVE-2011-3895Nov 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Heap-based buffer overflow in the Vorbis decoder in Google Chrome before 15.0.874.120 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted stream.

  • CVE-2011-3894Nov 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 15.0.874.120 does not properly perform VP8 decoding, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted stream.

  • CVE-2011-3893Nov 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 15.0.874.120 does not properly implement the MKV and Vorbis media handlers, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2011-3892Nov 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Double free vulnerability in the Theora decoder in Google Chrome before 15.0.874.120 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted stream.

  • CVE-2011-4432Nov 10, 2011
    Centreon
    Centreon
    risk 0.00cvss —epss 0.01

    www/include/configuration/nconfigObject/contact/DB-Func.php in Merethis Centreon before 2.3.2 does not use a salt during calculation of a password hash, which makes it easier for context-dependent attackers to determine cleartext passwords via a rainbow-table approach.

  • CVE-2011-4431Nov 10, 2011
    Centreon
    Centreon
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in main.php in Merethis Centreon before 2.3.2 allows remote authenticated users to execute arbitrary commands via a .. (dot dot) in the command_name parameter.

  • CVE-2011-3985Nov 9, 2011
    Plume CMS
    CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Plume before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2740Nov 9, 2011
    EMC Corporation
    RSA Key Manager
    risk 0.00cvss —epss 0.03

    EMC RSA Key Manager (RKM) Appliance 2.7 SP1 before 2.7.1.6, when Firefox 4.x or 5.0 is used, does not properly terminate a user session upon a logout action, which makes it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation.

  • CVE-2011-2739Nov 9, 2011
    EMC Corporation
    Documentum Eroom
    risk 0.00cvss —epss 0.03

    The file-blocking feature in EMC Documentum eRoom 7.3.x and 7.4.x before 7.4.3.g does not properly restrict the uploading and opening of files with dangerous file types, which allows remote authenticated users to execute arbitrary code via an uploaded file.

  • CVE-2011-1373Nov 9, 2011
    IBM
    Db2
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in IBM DB2 9.7 before FP5 on UNIX, when the Self Tuning Memory Manager (STMM) feature and the AUTOMATIC DATABASE_MEMORY setting are configured, allows local users to cause a denial of service (daemon crash) via unknown vectors.

  • CVE-2011-3999Nov 9, 2011
    Ibc.co.jp
    Iwate Portal Bar
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the RSS/Atom feed-reader implementation in Iwate Portal Bar allows remote attackers to inject arbitrary web script or HTML via a crafted feed.

  • CVE-2011-3998Nov 9, 2011
    Apple Inc.
    Webobjects
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Apple WebObjects 5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-3997Nov 9, 2011
    Opengear
    Opengear Console Server Firmware
    risk 0.00cvss —epss 0.01

    Opengear console servers with firmware before 2.2.1 allow remote attackers to bypass authentication, and modify settings or access connected equipment, via unspecified vectors.

  • CVE-2011-3655Nov 9, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 4.x through 7.0 and Thunderbird 5.0 through 7.0 perform access control without checking for use of the NoWaiverWrapper wrapper, which allows remote attackers to gain privileges via a crafted web site.

  • CVE-2011-3654Nov 9, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 does not properly handle links from SVG mpath elements to non-SVG elements, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute…