VYPR

CVEs

386,336 total · page 6788 of 7,727

AllCriticalHighKEV
  • CVE-2011-2983Aug 18, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x, and possibly other products does not properly handle the RegExp.input property, which allows remote attackers to bypass the Same Origin Policy and read data from a different domain via a…

  • CVE-2011-2982Aug 18, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x, and possibly other products allow remote attackers to cause a denial of service (memory corruption and application crash) or…

  • CVE-2011-2981Aug 18, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The event-management implementation in Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly select the context for script to run in, which allows remote attackers to bypass the Same Origin Policy or execute…

  • CVE-2011-2980Aug 18, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in the ThinkPadSensor::Startup function in Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, allows local users to gain privileges by leveraging write access in an unspecified directory to place a Trojan horse DLL that is loaded…

  • CVE-2011-2378Aug 18, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    The appendChild function in Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, SeaMonkey 2.x, and possibly other products does not properly handle DOM objects, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to dereferencing…

  • CVE-2011-1625Aug 18, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Cisco IOS 12.2, 12.3, 12.4, 15.0, and 15.1, when the data-link switching (DLSw) feature is configured, allows remote attackers to cause a denial of service (device crash) by sending a sequence of malformed packets and leveraging a "narrow timing window," aka Bug ID CSCtf74999, a…

  • CVE-2011-1624Aug 18, 2011
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Cisco IOS 12.2(58)SE, when a login banner is configured, allows remote attackers to cause a denial of service (device reload) by establishing two SSH2 sessions, aka Bug ID CSCto62631.

  • CVE-2011-0084Aug 18, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    The SVGTextElement.getCharNumAtPosition function in Mozilla Firefox before 3.6.20, and 4.x through 5; Thunderbird 3.x before 3.1.12 and other versions before 6; SeaMonkey 2.x before 2.3; and possibly other products does not properly handle SVG text, which allows remote attackers…

  • CVE-2011-3144Aug 16, 2011
    Control Microsystems
    ClearSCADA
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Control Microsystems ClearSCADA 2005, 2007, and 2009 before R2.3 and R1.4, as used in SCX before 67 R4.5 and 68 R3.9, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-3143Aug 16, 2011
    Control Microsystems
    ClearSCADA
    risk 0.01cvss —epss 0.08

    Use-after-free vulnerability in Control Microsystems ClearSCADA 2005, 2007, and 2009 before R2.3 and R1.4, as used in SCX before 67 R4.5 and 68 R3.9, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified long strings…

  • CVE-2011-3142Aug 16, 2011
    Wellintech
    Kingview
    risk 0.06cvss —epss 0.38

    Stack-based buffer overflow in an ActiveX control in KVWebSvr.dll in WellinTech KingView 6.52 and 6.53 allows remote attackers to execute arbitrary code via a long second argument to the ValidateUser method.

  • CVE-2011-3141Aug 16, 2011
    Invensys
    Wonderware Inbatch
    risk 0.00cvss —epss 0.04

    Buffer overflow in the InBatch BatchField ActiveX control for Invensys Wonderware InBatch 8.1 SP1, 9.0, and 9.0 SP1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

  • CVE-2011-3140Aug 15, 2011
    IBM
    Web Application Firewall
    risk 0.00cvss —epss 0.02

    IBM Web Application Firewall, as used on the G400 IPS-G400-IB-1 and GX4004 IPS-GX4004-IB-2 appliances with update 31.030, does not properly handle query strings with multiple instances of the same parameter, which allows remote attackers to bypass intended intrusion prevention…

  • CVE-2011-2749Aug 15, 2011
    Isc
    DHCP
    risk 0.03cvss —epss 0.39

    The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

  • CVE-2011-2748Aug 15, 2011
    Isc
    DHCP
    risk 0.03cvss —epss 0.39

    The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.

  • CVE-2011-2729Aug 15, 2011
    Apache
    Tomcat
    risk 0.01cvss —epss 0.07

    native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read…

  • CVE-2011-2481Aug 15, 2011
    Apache
    Tomcat
    risk 0.00cvss —epss 0.01

    Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is…

  • CVE-2011-2424Aug 15, 2011
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.07

    Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows remote attackers to execute arbitrary code or cause a denial of service…

  • CVE-2011-0257Aug 15, 2011
    Apple Inc.
    Quicktime
    risk 0.08cvss —epss 0.60

    Integer signedness error in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PnSize opcode in a PICT file that triggers a stack-based buffer overflow.

  • CVE-2011-0256Aug 15, 2011
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.04

    Integer overflow in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted track run atoms in a QuickTime movie file.

  • CVE-2011-3011Aug 15, 2011
    Ca
    Arcserve D2d
    risk 0.09cvss —epss 0.72

    BaseServiceImpl.class in CA ARCserve D2D r15 does not properly handle sessions, which allows remote attackers to obtain credentials, and consequently execute arbitrary commands, via unspecified vectors.

  • CVE-2011-2907Aug 15, 2011
    Terascale
    TORQUE Resource Manager
    risk 0.00cvss —epss 0.03

    Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 3.0.1 and earlier allows remote attackers to bypass host-based authentication and submit arbitrary jobs via a modified PBS_O_HOST variable to the qsub program.

  • CVE-2011-0551Aug 15, 2011
    Symantec
    Endpoint Protection
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Web Interface in the Endpoint Protection Manager in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.6300 allows remote attackers to hijack the authentication of administrators for requests that create…

  • CVE-2011-0550Aug 15, 2011
    Symantec
    Endpoint Protection
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Web Interface in the Endpoint Protection Manager in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.6300 allow remote attackers to inject arbitrary web script or HTML via (1) the token parameter to…

  • CVE-2011-0527Aug 15, 2011
    VMware
    Tc Server
    risk 0.00cvss —epss 0.02

    VMware vFabric tc Server (aka SpringSource tc Server) 2.0.x before 2.0.6.RELEASE and 2.1.x before 2.1.2.RELEASE accepts obfuscated passwords during JMX authentication, which makes it easier for context-dependent attackers to obtain access by leveraging an ability to read stored…

  • CVE-2011-2357Aug 12, 2011
    Google
    Android
    risk 0.03cvss —epss 0.05

    Cross-application scripting vulnerability in the Browser URL loading functionality in Android 2.3.4 and 3.1 allows local applications to bypass the sandbox and execute arbitrary Javascript in arbitrary domains by (1) causing the MAX_TAB number of tabs to be opened, then loading…

  • CVE-2011-1898Aug 12, 2011
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping, allows guest OS users to gain host OS privileges by "using DMA to generate MSI interrupts by writing to the interrupt injection registers."

  • CVE-2011-1583Aug 12, 2011
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code via a crafted paravirtualised guest kernel image that triggers (1) a buffer overflow during a…

  • CVE-2011-3138Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.02

    The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit (JDK) class, which might…

  • CVE-2011-3137Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Management Console in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 has unknown impact and attack vectors, aka APAR IV03050.

  • CVE-2011-3136Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Management Console in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 has unknown impact and attack vectors, aka APAR IV03048.

  • CVE-2011-3135Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Runtime in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 has unknown impact and attack vectors.

  • CVE-2009-5085Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.01

    IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when configured as an OpenID provider, does not delete the site information cookie in response to a user's deletion of a relying-party trust entry, which allows user-assisted remote attackers to bypass intended…

  • CVE-2009-5084Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.00

    IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when com.tivoli.am.fim.infocard.delegates.InfoCardSTSDelegate tracing is enabled, creates a cleartext log entry containing a password, which might allow local users to obtain sensitive information by reading the…

  • CVE-2009-5083Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.01

    IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when configured as an OpenID relying party, does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, which allows remote attackers to bypass authentication via…

  • CVE-2008-7299Aug 12, 2011
    IBM
    Tivoli Federated Identity Manager
    risk 0.00cvss —epss 0.01

    IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2 uses an incomplete SAML 1.x browser-artifact, which allows remote OpenID providers to spoof assertions via vectors related to the Issuer field.

  • CVE-2011-2423Aug 11, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.01cvss —epss 0.06

    msvcr90.dll in Adobe Shockwave Player before 11.6.1.629 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2011-2422Aug 11, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.05

    Textra.x32 in Adobe Shockwave Player before 11.6.1.629 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2011-2421Aug 11, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.04

    Dirapi.dll in Adobe Shockwave Player before 11.6.1.629 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir media file.

  • CVE-2011-2420Aug 11, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.05

    Adobe Shockwave Player before 11.6.1.629 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2011-2419Aug 11, 2011
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.05

    IML32.dll in Adobe Shockwave Player before 11.6.1.629 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2011-2409Aug 11, 2011
    Microfocus
    Palm webOS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Calendar application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2408Aug 11, 2011
    Microfocus
    Palm webOS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Contacts application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2407Aug 11, 2011
    Microfocus
    Performance Insight
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in HP OpenView Performance Insight 5.3, 5.31, 5.4, 5.41, 5.41.001, and 5.41.002 allows remote attackers to obtain access via unknown vectors.

  • CVE-2011-2406Aug 11, 2011
    Microfocus
    Performance Insight
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in HP OpenView Performance Insight 5.3, 5.31, 5.4, 5.41, 5.41.001, and 5.41.002 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2405Aug 11, 2011
    Microfocus
    ProLiant SL Advanced Power Manager
    risk 0.00cvss —epss 0.02

    The HP ProLiant SL Advanced Power Manager (SL-APM) with firmware before 1.20 does not properly validate users, which allows remote attackers to cause a denial of service via unspecified vectors.

  • CVE-2011-2404Aug 11, 2011
    Microfocus
    Easy Printer Care Software
    risk 0.09cvss —epss 0.74

    A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-4786 and…

  • CVE-2011-2133Aug 11, 2011
    Adobe Inc.
    Robohelp
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Adobe RoboHelp 8 and 9 before 9.0.1.262, and RoboHelp Server 8 and 9, allows remote attackers to inject arbitrary web script or HTML via the URI, related to template_stock/whutils.js.

  • CVE-2011-2132Aug 11, 2011
    Adobe Inc.
    Flash Media Server
    risk 0.04cvss —epss 0.08

    Adobe Flash Media Server (FMS) before 3.5.7, and 4.x before 4.0.3, allows attackers to cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2011-2131Aug 11, 2011
    Adobe Inc.
    Creative Suite
    risk 0.05cvss —epss 0.22

    Adobe Photoshop 12.0 in Creative Suite 5 (CS5) and 12.1 in Creative Suite 5.1 (CS5.1) allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted GIF file.