VYPR

CVEs

386,417 total · page 6779 of 7,729

AllCriticalHighKEV
  • CVE-2011-3980Oct 4, 2011
    Jerome Schneider
    Ameos Dragndropupload
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Drag Drop Mass Upload (ameos_dragndropupload) extension 2.0.2 and earlier for TYPO3 allows remote attackers to upload arbitrary files via unknown vectors.

  • CVE-2011-3979Oct 4, 2011
    Zikula
    Zikula Application Framework
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in ztemp/view_compiled/Theme/theme_admin_setasdefault.php in the theme module in Zikula Application Framework 1.3.0 build 3168, 1.2.7, and probably other versions allows remote attackers to inject arbitrary web script or HTML via the…

  • CVE-2011-3978Oct 4, 2011
    Lightneasy
    Lightneasy
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy.php in LightNEasy 3.2.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) commentemail, (2) commentmessage, or (3) commentname parameter in a sendcomment action for the news page.

  • CVE-2011-3977Oct 4, 2011
    Nomachine
    Nx Server
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in nxconfigure.sh in NoMachine NX Node 3.x before 3.5.0-4 and NX Server 3.x before 3.5.0-5 allows local users to read arbitrary files via unknown vectors.

  • CVE-2011-3976Oct 4, 2011
    Ammsoft
    Scriptftp
    risk 0.05cvss —epss 0.31

    Stack-based buffer overflow in AmmSoft ScriptFTP 3.3 allows remote FTP servers to execute arbitrary code via a long filename in a response to a LIST command, as demonstrated using (1) GETLIST or (2) GETFILE in a ScriptFTP script.

  • CVE-2011-3354Oct 4, 2011
    Quassel Irc
    Quassel
    risk 0.00cvss —epss 0.02

    The CtcpParser::packedReply method in core/ctcpparser.cpp in Quassel before 0.7.3 allows remote attackers to cause a denial of service (crash) via a crafted Client-To-Client Protocol (CTCP) request, as demonstrated in the wild in September 2011.

  • CVE-2011-2894Oct 4, 2011
    VMware
    Spring Framework
    risk 0.00cvss —epss 0.09

    Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1)…

  • CVE-2011-1572Oct 4, 2011
    Gitolite
    Gitolite
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 allows remote attackers to execute arbitrary commands via .. (dot dot) sequences in admin-defined commands.

  • CVE-2011-3282Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Cisco IOS 12.2SRE before 12.2(33)SRE4, 15.0, and 15.1, and IOS XE 2.1.x through 3.3.x, when an MPLS domain is configured, allows remote attackers to cause a denial of service (device reload) via an ICMPv6 packet, related to an expired MPLS TTL, aka…

  • CVE-2011-3281Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Cisco IOS 15.0 through 15.1, in certain HTTP Layer 7 Application Control and Inspection configurations, allows remote attackers to cause a denial of service (device reload or hang) via a crafted HTTP packet, aka Bug ID CSCto68554.

  • CVE-2011-3280HigOct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.02

    Memory leak in the NAT implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xSG, allows remote attackers to cause a denial of service (memory consumption or device reload) by sending crafted SIP packets to UDP port 5060, aka Bug ID CSCtj04672.

  • CVE-2011-3279Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    The provider-edge MPLS NAT implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xSG, allows remote attackers to cause a denial of service (device reload) via a malformed SIP packet to UDP port 5060, aka Bug ID CSCti98219.

  • CVE-2011-3278Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the NAT implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xSG, allows remote attackers to cause a denial of service (device reload) by sending crafted SIP packets to UDP port 5060, aka Bug ID CSCti48483.

  • CVE-2011-3277Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the NAT implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xSG, allows remote attackers to cause a denial of service (device reload) by sending crafted H.323 packets to TCP port 1720, aka Bug ID CSCth11006.

  • CVE-2011-3276Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the NAT implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xSG, allows remote attackers to cause a denial of service (device reload or hang) by sending crafted SIP packets to TCP port 5060, aka Bug ID CSCso02147.

  • CVE-2011-3275Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Memory leak in Cisco IOS 12.4, 15.0, and 15.1, and IOS XE 2.5.x through 3.2.x, allows remote attackers to cause a denial of service (memory consumption) via a crafted SIP message, aka Bug ID CSCti48504.

  • CVE-2011-3274Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Cisco IOS 12.2SRE before 12.2(33)SRE4, 15.0, and 15.1, and IOS XE 2.1.x through 3.3.x, when an MPLS domain is configured, allows remote attackers to cause a denial of service (device crash) via a crafted IPv6 packet, related to an expired MPLS TTL,…

  • CVE-2011-3273Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Memory leak in Cisco IOS 15.0 through 15.1, when IPS or Zone-Based Firewall (aka ZBFW) is configured, allows remote attackers to cause a denial of service (memory consumption or device crash) via vectors that trigger many session creation flows, aka Bug ID CSCti79848.

  • CVE-2011-3272Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    The IP Service Level Agreement (IP SLA) functionality in Cisco IOS 15.1, and IOS XE 2.1.x through 3.3.x, allows remote attackers to cause a denial of service (memory corruption and device reload) via malformed IP SLA packets, aka Bug ID CSCtk67073.

  • CVE-2011-3271Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.01cvss —epss 0.11

    Unspecified vulnerability in the Smart Install functionality in Cisco IOS 12.2 and 15.1 allows remote attackers to execute arbitrary code or cause a denial of service (device crash) via crafted TCP packets to port 4786, aka Bug ID CSCto10165.

  • CVE-2011-3270Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Cisco IOS 12.2SB before 12.2(33)SB10 and 15.0S before 15.0(1)S3a on Cisco 10000 series routers allows remote attackers to cause a denial of service (device reload) via a sequence of crafted ICMP packets, aka Bug ID CSCtk62453.

  • CVE-2011-2072Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Memory leak in Cisco IOS 12.4, 15.0, and 15.1, Cisco IOS XE 2.5.x through 3.2.x, and Cisco Unified Communications Manager (CUCM) 6.x and 7.x before 7.1(5b)su4, 8.x before 8.5(1)su2, and 8.6 before 8.6(1) allows remote attackers to cause a denial of service (memory consumption…

  • CVE-2011-0946Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    The NAT implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xSG, allows remote attackers to cause a denial of service (device reload or hang) via malformed NetMeeting Directory (aka Internet Locator Service or ILS) LDAP traffic, aka Bug ID…

  • CVE-2011-0945Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Memory leak in the Data-link switching (aka DLSw) feature in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xS before 3.1.3S and 3.2.xS before 3.2.1S, when implemented over Fast Sequence Transport (FST), allows remote attackers to cause a denial of service…

  • CVE-2011-0944Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.4, 15.0, and 15.1 allows remote attackers to cause a denial of service (device reload) via malformed IPv6 packets, aka Bug ID CSCtj41194.

  • CVE-2011-0939Oct 3, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Cisco IOS 12.4, 15.0, and 15.1, and IOS XE 2.5.x through 3.2.x, allows remote attackers to cause a denial of service (device reload) via a crafted SIP message, aka Bug ID CSCth03022.

  • CVE-2011-3975Oct 3, 2011
    Htc
    Evo 3d
    risk 0.00cvss —epss 0.01

    A certain HTC update for Android 2.3.4 build GRJ22, when the Sense interface is used on the HTC EVO 3D, EVO 4G, ThunderBolt, and unspecified other devices, provides the HtcLoggers.apk application, which allows user-assisted remote attackers to obtain a list of telephone numbers…

  • CVE-2011-3974Oct 2, 2011
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.03

    Integer signedness error in the decode_residual_inter function in cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese…

  • CVE-2011-3973Oct 2, 2011
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.03

    cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, related to the decode_residual_block,…

  • CVE-2011-3371Oct 2, 2011
    Punbb
    Punbb
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) form_sent, (3) csrf_token, (4) req_confirm, or (5) delete parameter to delete.php, the (6) id, (7)…

  • CVE-2011-3362Oct 2, 2011
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.03

    Integer signedness error in the decode_residual_block function in cavsdec.c in libavcodec in FFmpeg before 0.7.3 and 0.8.x before 0.8.2, and libav through 0.7.1, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute…

  • CVE-2011-2411Oct 2, 2011
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors.

  • CVE-2011-2674Oct 2, 2011
    Basercms
    Basercms
    risk 0.00cvss —epss 0.01

    BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors.

  • CVE-2011-2673Oct 2, 2011
    Basercms
    Basercms
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in BaserCMS before 1.6.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-0554Oct 2, 2011
    Symantec
    Im Manager
    risk 0.00cvss —epss 0.04

    The management console in Symantec IM Manager before 8.4.18 allows remote attackers to execute arbitrary code via unspecified vectors, related to a "code injection issue."

  • CVE-2011-0553Oct 2, 2011
    Symantec
    Im Manager
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the management console in Symantec IM Manager before 8.4.18 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2011-0552Oct 2, 2011
    Symantec
    Im Manager
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in the management console in Symantec IM Manager before 8.4.18 allow remote attackers to inject arbitrary web script or HTML via the (1) refreshRateSetting parameter to IMManager/Admin/IMAdminSystemDashboard.asp, the (2) nav or…

  • CVE-2011-3580Sep 30, 2011
    IceWarp
    Server
    risk 0.00cvss —epss 0.02

    IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to obtain configuration information via a direct request to the /server URI, which triggers a call to the phpinfo function.

  • CVE-2011-3579Sep 30, 2011
    IceWarp
    Server
    risk 0.03cvss —epss 0.05

    server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in…

  • CVE-2011-3369Sep 30, 2011
    EtherApe
    EtherApe
    risk 0.00cvss —epss 0.02

    The add_conversation function in conversations.c in EtherApe before 0.9.12 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RPC packet, related to the get_rpc function in decode_proto.c.

  • CVE-2011-3010Sep 30, 2011
    TWiki
    Twiki
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in TWiki before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the newtopic parameter in a WebCreateNewTopic action, related to the TWiki.WebCreateNewTopicTemplate topic; or (2) the query string to…

  • CVE-2011-2998Sep 30, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expression.

  • CVE-2011-3866Sep 29, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla Firefox before 7.0 and SeaMonkey before 2.4 do not properly restrict availability of motion data events, which makes it easier for remote attackers to read keystrokes by leveraging JavaScript code running in a background tab.

  • CVE-2011-3504Sep 29, 2011
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.06

    The Matroska format decoder in FFmpeg before 0.8.3 does not properly allocate memory, which allows remote attackers to execute arbitrary code via a crafted file.

  • CVE-2011-3232Sep 29, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    YARR, as used in Mozilla Firefox before 7.0, Thunderbird before 7.0, and SeaMonkey before 2.4, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted JavaScript.

  • CVE-2011-3005Sep 29, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Use-after-free vulnerability in Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OGG headers in a .ogg file.

  • CVE-2011-3004Sep 29, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    The JSSubScriptLoader in Mozilla Firefox 4.x through 6 and SeaMonkey before 2.4 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages…

  • CVE-2011-3003Sep 29, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Mozilla Firefox before 7.0 and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unspecified WebGL test case that triggers a memory-allocation error and a resulting out-of-bounds write operation.

  • CVE-2011-3002Sep 29, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Almost Native Graphics Layer Engine (ANGLE), as used in Mozilla Firefox before 7.0 and SeaMonkey before 2.4, does not validate the return value of a GrowAtomTable function call, which allows remote attackers to cause a denial of service (application crash) or possibly execute…

  • CVE-2011-3001Sep 29, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent manual add-on installation in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that…