VYPR

CVEs

386,336 total · page 6790 of 7,727

AllCriticalHighKEV
  • CVE-2011-3014Aug 9, 2011
    Novell
    Data Synchronizer
    risk 0.00cvss —epss 0.01

    The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not properly restrict caching of HTTPS responses, which makes it easier for remote attackers to obtain sensitive information by leveraging an unattended workstation.

  • CVE-2011-3013Aug 9, 2011
    Novell
    Data Synchronizer
    risk 0.00cvss —epss 0.01

    WebAdmin in the Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 supports weak SSL ciphers, which makes it easier for remote attackers to obtain access via a brute-force attack.

  • CVE-2011-2590Aug 9, 2011
    Uusee
    Uusee
    risk 0.00cvss —epss 0.02

    The Play method in the UUPlayer ActiveX control 6.0.0.1 in UUSee 2010 6.11.0609.2 allows remote attackers to execute arbitrary programs via a UNC share pathname in the MPlayerPath parameter.

  • CVE-2011-2589Aug 9, 2011
    Uusee
    Uusee
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in the SendLogAction method in the UUPlayer ActiveX control 6.0.0.1 in UUSee 2010 6.11.0609.2 might allow remote attackers to execute arbitrary code via a long argument.

  • CVE-2011-2224Aug 9, 2011
    Novell
    Data Synchronizer
    risk 0.00cvss —epss 0.01

    The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

  • CVE-2011-2223Aug 9, 2011
    Novell
    Data Synchronizer
    risk 0.00cvss —epss 0.01

    The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 sends the Admin LDAP password in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2011-2222Aug 9, 2011
    Novell
    Data Synchronizer
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in WebAdmin in the Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 allows remote attackers to hijack web sessions via unspecified vectors.

  • CVE-2011-2221Aug 9, 2011
    Novell
    Data Synchronizer
    risk 0.00cvss —epss 0.01

    The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 allows remote attackers to bypass WebAdmin authentication and obtain sensitive GroupWise information via unspecified vectors.

  • CVE-2011-3012Aug 9, 2011
    Ioquake3
    Ioquake3 Engine
    risk 0.01cvss —epss 0.08

    The ioQuake3 engine, as used in World of Padman 1.2 and earlier, Tremulous 1.1.0, and ioUrbanTerror 2007-12-20, does not check for dangerous file extensions before writing to the quake3 directory, which allows remote attackers to execute arbitrary code via a crafted third-party…

  • CVE-2011-2979Aug 9, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Bugzilla 4.1.x before 4.1.3 generates different responses for certain assignee queries depending on whether the group name is valid, which allows remote attackers to determine the existence of private group names via a custom search. NOTE: this vulnerability exists because of a…

  • CVE-2011-2978Aug 9, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 does not prevent changes to the confirmation e-mail address (aka old_email field) for e-mail change notifications, which makes…

  • CVE-2011-2977Aug 9, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.00

    Bugzilla 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 on Windows does not delete the temporary files associated with uploaded attachments, which allows local users to obtain sensitive information by reading these files. NOTE: this issue exists because…

  • CVE-2011-2976Aug 9, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, and 3.4.x before 3.4.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving a BUGLIST cookie.

  • CVE-2011-2381Aug 9, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in Bugzilla 2.17.1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to inject arbitrary e-mail headers via an attachment description in a…

  • CVE-2011-2380Aug 9, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Bugzilla 2.23.3 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to determine the existence of private group names via a crafted parameter during (1) bug creation or (2)…

  • CVE-2011-2379Aug 9, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Bugzilla 2.4 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3, when Internet Explorer before 9 or Safari before 5.0.6 is used for Raw Unified mode,…

  • CVE-2008-7298Aug 9, 2011
    Google
    Android
    risk 0.00cvss —epss 0.01

    The Android browser in Android cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict…

  • CVE-2008-7297Aug 9, 2011
    Opera
    Opera
    risk 0.00cvss —epss 0.01

    Opera cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS)…

  • CVE-2008-7296Aug 9, 2011
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Apple Safari cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security…

  • CVE-2008-7295Aug 9, 2011
    Microsoft
    Internet Explorer
    risk 0.00cvss —epss 0.05

    Microsoft Internet Explorer cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict…

  • CVE-2008-7294Aug 9, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 4.0.211.0 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict…

  • CVE-2008-7293Aug 9, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport…

  • CVE-2008-7292Aug 9, 2011
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.00

    Bugzilla 2.20.x before 2.20.5, 2.22.x before 2.22.3, and 3.0.x before 3.0.3 on Windows does not delete the temporary files associated with uploaded attachments, which allows local users to obtain sensitive information by reading these files, a different vulnerability than…

  • CVE-2011-3009Aug 5, 2011
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.02

    Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to…

  • CVE-2011-3008Aug 5, 2011
    Avaya
    Secure Access Link Gateway
    risk 0.00cvss —epss 0.02

    The default configuration of Avaya Secure Access Link (SAL) Gateway 1.5, 1.8, and 2.0 contains certain domain names in the Secondary Core Server URL and Secondary Remote Server URL fields, which allows remote attackers to obtain sensitive information by leveraging administrative…

  • CVE-2011-2900Aug 5, 2011
    Shttpd
    Shttpd
    risk 0.04cvss —epss 0.13

    Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0, (2) put_dir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWS) 0.2, and (3) _shttpd_put_dir function in io_dir.c in Simple HTTPD (shttpd) 1.42 allows remote attackers to execute…

  • CVE-2011-2721Aug 5, 2011
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.03

    Off-by-one error in the cli_hm_scan function in matcher-hash.c in libclamav in ClamAV before 0.97.2 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message that is not properly handled during certain hash calculations.

  • CVE-2011-2720Aug 5, 2011
    Glpi Project
    Glpi
    risk 0.00cvss —epss 0.03

    The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obtain sensitive information via a crafted POST request.

  • CVE-2011-2705Aug 5, 2011
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.02

    The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random…

  • CVE-2011-2686Aug 5, 2011
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.03

    Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to…

  • CVE-2011-2591Aug 5, 2011
    Provideo
    GMAXPlayer
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in the Provideo ActiveX controls allow remote attackers to execute arbitrary code via crafted input fields, as demonstrated by (1) a long strIp argument to the voice method in 2way.dll in the alarm 1.0.3.1 ActiveX control, (2) a network response to…

  • CVE-2011-1340Aug 5, 2011
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the type_name parameter to Members/ipa/createObject.

  • CVE-2011-2764Aug 4, 2011
    Ioquake3
    Ioquake3 Engine
    risk 0.01cvss —epss 0.09

    The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier, as used in World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror, does not properly determine dangerous file extensions, which allows remote attackers to…

  • CVE-2011-2701Aug 4, 2011
    FreeRADIUS
    Freeradius
    risk 0.00cvss —epss 0.02

    The ocsp_check function in rlm_eap_tls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate.

  • CVE-2011-1412Aug 4, 2011
    Ioquake3
    Ioquake3 Engine
    risk 0.00cvss —epss 0.04

    sys/sys_unix.c in the ioQuake3 engine on Unix and Linux, as used in World of Padman 1.5.x before 1.5.1.1 and OpenArena 0.8.x-15 and 0.8.x-16, allows remote game servers to execute arbitrary commands via shell metacharacters in a long fs_game variable.

  • CVE-2011-0252Aug 4, 2011
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted STTS atoms in a QuickTime movie file.

  • CVE-2011-0251Aug 4, 2011
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted STSZ atoms in a QuickTime movie file.

  • CVE-2011-0250Aug 4, 2011
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted STSS atoms in a QuickTime movie file.

  • CVE-2011-0249Aug 4, 2011
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted STSC atoms in a QuickTime movie file.

  • CVE-2011-0248Aug 4, 2011
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in the QuickTime ActiveX control in Apple QuickTime before 7.7 on Windows, when Internet Explorer is used, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted QTL file.

  • CVE-2011-0247Aug 4, 2011
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Multiple stack-based buffer overflows in Apple QuickTime before 7.7 on Windows allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted H.264 movie.

  • CVE-2011-0246Aug 4, 2011
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in Apple QuickTime before 7.7 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted GIF file.

  • CVE-2011-0245Aug 4, 2011
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.04

    Buffer overflow in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted pict file.

  • CVE-2011-2819Aug 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 13.0.782.107 allows remote attackers to bypass the Same Origin Policy via vectors related to handling of the base URI.

  • CVE-2011-2818Aug 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to display box rendering.

  • CVE-2011-2805Aug 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 13.0.782.107 allows remote attackers to bypass the Same Origin Policy and conduct script injection attacks via unspecified vectors.

  • CVE-2011-2804Aug 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 13.0.782.107 does not properly handle nested functions in PDF documents, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted document.

  • CVE-2011-2803Aug 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 13.0.782.107 does not properly handle Skia paths, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2011-2802Aug 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google V8, as used in Google Chrome before 13.0.782.107, does not properly perform const lookups, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted web site.

  • CVE-2011-2801Aug 3, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the frame loader.