VYPR

CVEs

386,273 total · page 6802 of 7,726

AllCriticalHighKEV
  • CVE-2011-1783Jun 6, 2011
    Apache
    Subversion
    risk 0.01cvss —epss 0.07

    The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is enabled, allows remote attackers to cause a denial of service (infinite loop and memory consumption) in…

  • CVE-2011-1752Jun 6, 2011
    Apache
    Subversion
    risk 0.01cvss —epss 0.08

    The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May…

  • CVE-2011-1178Jun 6, 2011
    GIMP
    Gimp
    risk 0.00cvss —epss 0.05

    Multiple integer overflows in the load_image function in file-pcx.c in the Personal Computer Exchange (PCX) plugin in GIMP 2.6.x and earlier allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PCX image that…

  • CVE-2011-0767Jun 6, 2011
    Imperva
    Securesphere Web Application Firewall
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the management GUI in the MX Management Server in Imperva SecureSphere Web Application Firewall 6.2, 7.x, and 8.x allows remote attackers to inject arbitrary web script or HTML via an HTTP request to a firewalled server, aka Bug ID…

  • CVE-2011-0082Jun 6, 2011
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    The X.509 certificate validation functionality in Mozilla Firefox 4.0.x through 4.0.1 does not properly implement single-session security exceptions, which might make it easier for user-assisted remote attackers to spoof an SSL server via an untrusted certificate that triggers…

  • CVE-2011-2383Jun 3, 2011
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.21

    Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing an http: URL that redirects to a file:…

  • CVE-2011-2382Jun 3, 2011
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.19

    Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing a file:…

  • CVE-2011-2331Jun 2, 2011
    Microfocus
    Intelligent Management Center
    risk 0.01cvss —epss 0.13

    Integer overflow in img.exe in HP Intelligent Management Center (IMC) allows remote attackers to execute arbitrary code via a crafted length value in an a packet that triggers a heap-based buffer overflow, possibly related to an "recv" field.

  • CVE-2011-2330Jun 2, 2011
    IBM
    Tivoli Management Framework
    risk 0.00cvss —epss 0.02

    Tivoli Endpoint in IBM Tivoli Management Framework 3.7.1, 4.1, 4.1.1, and 4.3.1 has an unspecified "built-in account" that is "trivially" accessed, which makes it easier for remote attackers to send requests to restricted pages via a session on TCP port 9495, a different…

  • CVE-2011-2329Jun 2, 2011
    Apache
    Rampart\/c
    risk 0.00cvss —epss 0.02

    The rampart_timestamp_token_validate function in util/rampart_timestamp_token.c in Apache Rampart/C 1.3.0 does not properly calculate the expiration of timestamp tokens, which allows remote attackers to bypass intended access restrictions by leveraging an expired token, a…

  • CVE-2011-2328Jun 2, 2011
    Microfocus
    Loadrunner
    risk 0.00cvss —epss 0.06

    Buffer overflow in HP LoadRunner allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a .usr (aka Virtual User script) file with long directives.

  • CVE-2011-2041Jun 2, 2011
    Cisco Systems, Inc.
    Anyconnect Secure Mobility Client
    risk 0.00cvss —epss 0.00

    The Start Before Logon (SBL) functionality in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.254 on Windows, and on Windows Mobile, allows local users to gain privileges via unspecified user-interface interaction, aka Bug ID CSCta40556.

  • CVE-2011-2024Jun 2, 2011
    Cisco Systems, Inc.
    Cns Network Registrar
    risk 0.00cvss —epss 0.03

    Cisco Network Registrar before 7.2 has a default administrative password, which makes it easier for remote attackers to obtain access via a TCP session, aka Bug ID CSCsm50627.

  • CVE-2011-1637Jun 2, 2011
    Cisco Systems, Inc.
    Skinny Client Control Protocol Software
    risk 0.00cvss —epss 0.00

    Cisco Unified IP Phones 7900 devices (aka TNP phones) with software before 9.2.1 do not properly verify signatures for software images, which allows local users to gain privileges via a crafted image, aka Bug ID CSCtn65962.

  • CVE-2011-1623Jun 2, 2011
    Cisco Systems, Inc.
    Media Processing Software
    risk 0.00cvss —epss 0.02

    Cisco Media Processing Software before 1.2 on Media Experience Engine (MXE) 5600 devices has a default root password, which makes it easier for context-dependent attackers to obtain access via (1) the local console, (2) an SSH session, or (3) a TELNET session, aka Bug ID…

  • CVE-2011-1603Jun 2, 2011
    Cisco Systems, Inc.
    Skinny Client Control Protocol Software
    risk 0.00cvss —epss 0.00

    Cisco Unified IP Phones 7900 devices (aka TNP phones) with software before 9.2.1 allow local users to gain privileges via unspecified vectors, aka Bug ID CSCtn65815.

  • CVE-2011-1602Jun 2, 2011
    Cisco Systems, Inc.
    Skinny Client Control Protocol Software
    risk 0.00cvss —epss 0.00

    The su utility on Cisco Unified IP Phones 7900 devices (aka TNP phones) with software before 9.0.3 allows local users to gain privileges via unspecified vectors, aka Bug ID CSCtf07426.

  • CVE-2011-1220Jun 2, 2011
    IBM
    Tivoli Management Framework
    risk 0.08cvss —epss 0.63

    Stack-based buffer overflow in lcfd.exe in Tivoli Endpoint in IBM Tivoli Management Framework 3.7.1, 4.1, 4.1.1, and 4.3.1 allows remote authenticated users to execute arbitrary code via a long opts field.

  • CVE-2011-1077Jun 2, 2011
    Apache
    Archiva
    risk 0.01cvss —epss 0.07

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-1026Jun 2, 2011
    Apache
    Archiva
    risk 0.00cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to hijack the authentication of administrators.

  • CVE-2009-4008Jun 2, 2011
    Nlnetlabs
    Unbound
    risk 0.00cvss —epss 0.03

    Unbound before 1.4.4 does not send responses for signed zones after mishandling an unspecified query, which allows remote attackers to cause a denial of service (DNSSEC outage) via a crafted query.

  • CVE-2011-2040Jun 2, 2011
    Cisco Systems, Inc.
    Anyconnect Secure Mobility Client
    risk 0.01cvss —epss 0.11

    The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.5.3041, and 3.0.x before 3.0.629, on Linux and Mac OS X downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote…

  • CVE-2011-2039Jun 2, 2011
    Cisco Systems, Inc.
    Anyconnect Secure Mobility Client
    risk 0.09cvss —epss 0.70

    The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to…

  • CVE-2011-1947Jun 2, 2011
    Fetchmail
    Fetchmail
    risk 0.00cvss —epss 0.03

    fetchmail 5.9.9 through 6.3.19 does not properly limit the wait time after issuing a (1) STARTTLS or (2) STLS request, which allows remote servers to cause a denial of service (application hang) by acknowledging the request but not sending additional packets.

  • CVE-2011-0730Jun 2, 2011
    Eucalyptus
    Eucalyptus
    risk 0.00cvss —epss 0.02

    Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2, as used in Ubuntu Enterprise Cloud (UEC) and other products, do not properly interpret signed elements in SOAP requests, which allows man-in-the-middle attackers to execute arbitrary commands by modifying a request, related…

  • CVE-2011-2215May 31, 2011
    Walrus Digit
    Walrack
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in WalRack 1.x before 1.1.8 and 2.x before 2.0.6 has unknown impact and attack vectors, possibly related to file deletion and an encoded URL, a different vulnerability than CVE-2011-1329.

  • CVE-2011-2214May 31, 2011
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the Open Database Connectivity (ODBC) component in 7T Interactive Graphical SCADA System (IGSS) before 9.0.0.11143 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 20222, which triggers memory corruption related to…

  • CVE-2011-1945May 31, 2011
    OpenSSL Project
    OpenSSL
    risk 0.00cvss —epss 0.03

    The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent…

  • CVE-2011-1938May 31, 2011
    PHP
    PHP
    risk 0.05cvss —epss 0.23

    Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execute arbitrary code via a long pathname for a UNIX socket.

  • CVE-2011-1937May 31, 2011
    Webmin
    Webmin
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes the real (aka Full Name) field, related to useradmin/index.cgi and useradmin/user-lib.pl.

  • CVE-2011-1925May 31, 2011
    Nbd
    nbd
    risk 0.00cvss —epss 0.03

    nbd-server.c in Network Block Device (nbd-server) 2.9.21 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by causing a negotiation failure, as demonstrated by specifying a name for a non-existent export.

  • CVE-2011-1922May 31, 2011
    Unbound
    Unbound
    risk 0.01cvss —epss 0.07

    daemon/worker.c in Unbound 1.x before 1.4.10, when debugging functionality and the interface-automatic option are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted DNS request that triggers improper error handling.

  • CVE-2011-1910May 31, 2011
    Isc
    Bind
    risk 0.02cvss —epss 0.25

    Off-by-one error in named in ISC BIND 9.x before 9.7.3-P1, 9.8.x before 9.8.0-P2, 9.4-ESV before 9.4-ESV-R4-P1, and 9.6-ESV before 9.6-ESV-R4-P1 allows remote DNS servers to cause a denial of service (assertion failure and daemon exit) via a negative response containing large…

  • CVE-2011-1651May 31, 2011
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.01

    Cisco IOS XR 3.9.x and 4.0.x before 4.0.3 and 4.1.x before 4.1.1, when an SPA interface processor is installed, allows remote attackers to cause a denial of service (device reload) via a crafted IPv4 packet, aka Bug ID CSCto45095.

  • CVE-2011-1649May 31, 2011
    Cisco Systems, Inc.
    Content Delivery System
    risk 0.00cvss —epss 0.01

    The Internet Streamer application in Cisco Content Delivery System (CDS) with software 2.5.7, 2.5.8, and 2.5.9 before build 126 allows remote attackers to cause a denial of service (Web Engine crash) via a crafted URL, aka Bug IDs CSCtg67333 and CSCth25341.

  • CVE-2011-1647May 31, 2011
    Cisco Systems, Inc.
    Rvs4000
    risk 0.00cvss —epss 0.01

    The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote attackers to read the private key for the admin SSL…

  • CVE-2011-1646May 31, 2011
    Cisco Systems, Inc.
    Rvs4000
    risk 0.00cvss —epss 0.02

    The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote authenticated users to execute arbitrary commands via the (1)…

  • CVE-2011-1645May 31, 2011
    Cisco Systems, Inc.
    Rvs4000
    risk 0.00cvss —epss 0.03

    The web management interface on the Cisco RVS4000 Gigabit Security Router with software 1.x before 1.3.3.4 and 2.x before 2.0.2.7, and the WRVS4400N Gigabit Security Router with software before 2.0.2.1, allows remote attackers to read the backup configuration file, and…

  • CVE-2011-1512May 31, 2011
    IBM
    Lotus Notes
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in xlssr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a malformed BIFF record in a .xls Excel spreadsheet attachment, aka SPR PRAD8E3HKR.

  • CVE-2011-1486May 31, 2011
    Libvirt
    Libvirt
    risk 0.00cvss —epss 0.01

    libvirtd in libvirt before 0.9.0 does not use thread-safe error reporting, which allows remote attackers to cause a denial of service (crash) by causing multiple threads to report errors at the same time.

  • CVE-2011-1485May 31, 2011
    PolicyKit
    polkit
    risk 0.03cvss —epss 0.05

    Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.

  • CVE-2011-1329May 31, 2011
    Walrus Digit
    Walrack
    risk 0.00cvss —epss 0.01

    WalRack 1.x before 1.1.9 and 2.x before 2.0.7 does not properly restrict file uploads, which allows remote attackers to execute arbitrary PHP code via vectors involving a double extension, as demonstrated by a .php.zzz file.

  • CVE-2011-1218May 31, 2011
    IBM
    Lotus Notes
    risk 0.00cvss —epss 0.05

    Buffer overflow in kvarcve.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted .zip attachment, aka SPR PRAD8E3NSP. NOTE: some of these details are obtained from third party information.

  • CVE-2011-1217May 31, 2011
    IBM
    Lotus Notes
    risk 0.00cvss —epss 0.05

    Buffer overflow in kpprzrdr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted .prz attachment. NOTE: some of these details are obtained from third party information.

  • CVE-2011-1216May 31, 2011
    IBM
    Lotus Notes
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in assr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via crafted tag data in an Applix spreadsheet attachment, aka SPR PRAD8823A7.

  • CVE-2011-1215May 31, 2011
    IBM
    Lotus Notes
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in mw8sr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted link in a Microsoft Office document attachment, aka SPR PRAD8823ND.

  • CVE-2011-1214May 31, 2011
    IBM
    Lotus Notes
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in rtfsr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted link in a .rtf attachment, aka SPR PRAD8823JQ.

  • CVE-2011-1213May 31, 2011
    IBM
    Lotus Notes
    risk 0.06cvss —epss 0.33

    Integer underflow in lzhsr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted header in a .lzh attachment that triggers a stack-based buffer overflow, aka SPR PRAD88MJ2W.

  • CVE-2011-0949May 31, 2011
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.01

    Cisco IOS XR 3.6.x, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 does not properly remove sshd_lock files from /tmp/, which allows remote attackers to cause a denial of service (disk consumption) by making many SSHv1 connections, aka Bug ID CSCtd64417.

  • CVE-2011-0943May 31, 2011
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.01

    Cisco IOS XR 3.8.3, 3.8.4, and 3.9.1 allows remote attackers to cause a denial of service (NetIO process restart or device reload) via a crafted IPv4 packet, aka Bug ID CSCth44147.