VYPR

CVEs

386,273 total · page 6813 of 7,726

AllCriticalHighKEV
  • CVE-2011-1156Apr 11, 2011
    Mark Pilgrim
    Feedparser
    risk 0.00cvss —epss 0.03

    feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0.1 allows remote attackers to cause a denial of service (application crash) via a malformed DOCTYPE declaration.

  • CVE-2009-5065Apr 11, 2011
    Mark Pilgrim
    Feedparser
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0 allows remote attackers to inject arbitrary web script or HTML via vectors involving nested CDATA stanzas.

  • CVE-2011-1681Apr 10, 2011
    VMware
    Open Virtual Machine Tools
    risk 0.00cvss —epss 0.00

    vmware-hgfsmounter in VMware Open Virtual Machine Tools (aka open-vm-tools) 8.4.2-261024 and earlier attempts to append to the /etc/mtab file without first checking whether resource limits would interfere, which allows local users to trigger corruption of this file via a process…

  • CVE-2011-1680Apr 10, 2011
    Ncpfs
    Ncpfs
    risk 0.00cvss —epss 0.00

    ncpmount in ncpfs 2.2.6 and earlier does not remove the /etc/mtab~ lock file after a failed attempt to add a mount entry, which has unspecified impact and local attack vectors.

  • CVE-2011-1679Apr 10, 2011
    Ncpfs
    Ncpfs
    risk 0.00cvss —epss 0.00

    ncpfs 2.2.6 and earlier attempts to use (1) ncpmount to append to the /etc/mtab file and (2) ncpumount to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab file via a…

  • CVE-2011-1678Apr 10, 2011
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.01

    smbfs in Samba 3.5.8 and earlier attempts to use (1) mount.cifs to append to the /etc/mtab file and (2) umount.cifs to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab…

  • CVE-2011-1677Apr 10, 2011
    util-linux
    util-linux
    risk 0.00cvss —epss 0.00

    mount in util-linux 2.19 and earlier does not remove the /etc/mtab~ lock file after a failed attempt to add a mount entry, which has unspecified impact and local attack vectors.

  • CVE-2011-1676Apr 10, 2011
    util-linux
    mount
    risk 0.00cvss —epss 0.00

    mount in util-linux 2.19 and earlier does not remove the /etc/mtab.tmp file after a failed attempt to add a mount entry, which allows local users to trigger corruption of the /etc/mtab file via multiple invocations.

  • CVE-2011-1675Apr 10, 2011
    util-linux
    util-linux
    risk 0.00cvss —epss 0.00

    mount in util-linux 2.19 and earlier attempts to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab file via a process with a small RLIMIT_FSIZE value, a related issue…

  • CVE-2011-1674Apr 10, 2011
    Netgear
    Prosafe Wnap210
    risk 0.00cvss —epss 0.03

    The NetGear ProSafe WNAP210 with firmware 2.0.12 allows remote attackers to bypass authentication and obtain access to the configuration page by visiting recreate.php and then visiting index.php.

  • CVE-2011-1673Apr 10, 2011
    Netgear
    Prosafe Wnap210
    risk 0.00cvss —epss 0.02

    BackupConfig.php on the NetGear ProSafe WNAP210 allows remote attackers to obtain the administrator password by reading the configuration file.

  • CVE-2011-1672Apr 10, 2011
    Dell
    Kace K2000 Systems Deployment Appliance
    risk 0.00cvss —epss 0.03

    The Dell KACE K2000 Systems Deployment Appliance 3.3.36822 and earlier contains a peinst CIFS share, which allows remote attackers to obtain sensitive information by reading the (1) unattend.xml or (2) sysprep.inf file, as demonstrated by reading a password.

  • CVE-2011-1095Apr 10, 2011
    GNU
    Glibc
    risk 0.00cvss —epss 0.01

    locale/programs/locale.c in locale in the GNU C Library (aka glibc or libc6) before 2.13 does not quote its output, which might allow local users to gain privileges via a crafted localization environment variable, in conjunction with a program that executes a script that uses…

  • CVE-2011-1089Apr 10, 2011
    GNU
    Glibc
    risk 0.00cvss —epss 0.00

    The addmntent function in the GNU C Library (aka glibc or libc6) 2.13 and earlier does not report an error status for failed attempts to write to the /etc/mtab file, which makes it easier for local users to trigger corruption of this file, as demonstrated by writes from a…

  • CVE-2011-0994Apr 10, 2011
    Novell
    File Reporter
    risk 0.01cvss —epss 0.18

    Stack-based buffer overflow in NFRAgent.exe in Novell File Reporter (NFR) before 1.0.2 allows remote attackers to execute arbitrary code via unspecified XML data.

  • CVE-2011-0765Apr 10, 2011
    Pwhois
    Layer Four Traceroute
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in lft in pWhois Layer Four Traceroute (LFT) 3.x before 3.3 allows local users to gain privileges via a crafted command line.

  • CVE-2011-1671Apr 10, 2011
    Getontracks
    Tracks
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in app/controllers/todos_controller.rb in Tracks 1.7.2, 2.0RC2, and 2.0devel allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to todos/tag/. NOTE: some of these details are obtained from third party…

  • CVE-2011-1670Apr 10, 2011
    InTerra
    Blog Machine
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in actions/add.php in InTerra Blog Machine 1.84, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the subject parameter to post_url/edit.

  • CVE-2011-1669Apr 10, 2011
    WordPress
    WP Custom Pages
    risk 0.05cvss —epss 0.22

    Directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbitrary files via ..%2F (encoded dot dot) sequences in the url parameter.

  • CVE-2011-1668Apr 10, 2011
    Awcm CMS
    AR Web Content Manager
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search.php in AR Web Content Manager (AWCM) 2.1, 2.2, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2011-1667Apr 10, 2011
    Anzeigenmarkt
    Anzeigenmarkt 2011
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Anzeigenmarkt 2011 allows remote attackers to execute arbitrary SQL commands via the q parameter in a list action.

  • CVE-2011-1666Apr 10, 2011
    Metaways
    Tine
    risk 0.00cvss —epss 0.01

    Metaways Tine 2.0 allows remote attackers to obtain sensitive information via unknown vectors in (1) Crm/Controller.php, (2) Crm/Export/Csv.php, or (3) Calendar/Model/Attender.php, which reveal the full installation path.

  • CVE-2011-1665Apr 10, 2011
    Phpboost
    Phpboost
    risk 0.03cvss —epss 0.03

    PHPBoost 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain backup SQL files via a direct request for predictable filenames in cache/backup/.

  • CVE-2011-1664Apr 10, 2011
    Drupal
    Translation Management
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Translation Management module 6.x before 6.x-1.21 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2011-1663Apr 10, 2011
    Drupal
    Translation Management
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Translation Management module 6.x before 6.x-1.21 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2011-1662Apr 10, 2011
    Drupal
    Translation Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Translation Management module 6.x before 6.x-1.21 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-1661Apr 10, 2011
    Drupal
    Node Quick Find
    risk 0.00cvss —epss 0.01

    The Node Quick Find module 6.x-1.1 for Drupal does not use db_rewrite_sql when presenting node titles, which allows remote attackers to bypass intended access restrictions and read potentially sensitive node titles via the autocomplete feature.

  • CVE-2011-1660Apr 10, 2011
    Grapecity
    Data Dynamics Reports
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the DataDynamics.Reports.Web class library in GrapeCity Data Dynamics Reports before 1.6.2084.14 allow remote attackers to inject arbitrary web script or HTML via (1) the reportName or (2) uniqueId parameter to…

  • CVE-2011-1163Apr 10, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly handle an invalid number of partitions, which might allow local users to obtain potentially sensitive information from kernel heap memory via vectors related to partition-table…

  • CVE-2011-0466Apr 10, 2011
    Novell
    Opensuse Build Service
    risk 0.00cvss —epss 0.01

    The API in SUSE openSUSE Build Service (OBS) 2.0.x before 2.0.8 and 2.1.x before 2.1.6 allows attackers to bypass intended write-access restrictions and modify a (1) package or (2) project via unspecified vectors.

  • CVE-2011-0463Apr 10, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The ocfs2_prepare_page_for_write function in fs/ocfs2/aops.c in the Oracle Cluster File System 2 (OCFS2) subsystem in the Linux kernel before 2.6.39-rc1 does not properly handle holes that cross page boundaries, which allows local users to obtain potentially sensitive…

  • CVE-2011-0462Apr 10, 2011
    Novell
    Opensuse Build Service
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the login page in the webui component in SUSE openSUSE Build Service (OBS) before 2.1.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-1659Apr 8, 2011
    GNU
    Glibc
    risk 0.00cvss —epss 0.03

    Integer overflow in posix/fnmatch.c in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long UTF8 string that is used in an fnmatch call with a crafted pattern argument, a different…

  • CVE-2011-1658Apr 8, 2011
    GNU
    Glibc
    risk 0.00cvss —epss 0.00

    ld.so in the GNU C Library (aka glibc or libc6) 2.13 and earlier expands the $ORIGIN dynamic string token when RPATH is composed entirely of this token, which might allow local users to gain privileges by creating a hard link in an arbitrary directory to a (1) setuid or (2)…

  • CVE-2011-1492Apr 8, 2011
    Roundcube
    Webmail
    risk 0.00cvss —epss 0.02

    steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server,…

  • CVE-2011-1491Apr 8, 2011
    Roundcube
    Webmail
    risk 0.00cvss —epss 0.02

    The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and…

  • CVE-2011-1475Apr 8, 2011
    Apache
    Tomcat
    risk 0.00cvss —epss 0.09

    The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up…

  • CVE-2011-1183Apr 8, 2011
    Apache
    Tomcat
    risk 0.00cvss —epss 0.06

    Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an…

  • CVE-2011-1071Apr 8, 2011
    GNU
    Glibc
    risk 0.04cvss —epss 0.14

    The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a "stack extension attack,"…

  • CVE-2011-0997Apr 8, 2011
    Isc
    DHCP
    risk 0.07cvss —epss 0.85

    dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is…

  • CVE-2011-0536Apr 8, 2011
    GNU
    Glibc
    risk 0.03cvss —epss 0.01

    Multiple untrusted search path vulnerabilities in elf/dl-object.c in certain modified versions of the GNU C Library (aka glibc or libc6), including glibc-2.5-49.el5_5.6 and glibc-2.12-1.7.el6_0.3 in Red Hat Enterprise Linux, allow local users to gain privileges via a crafted…

  • CVE-2011-0465Apr 8, 2011
    Matthias Hopf
    Xrdb
    risk 0.00cvss —epss 0.06

    xrdb.c in xrdb before 1.0.9 in X.Org X11R7.6 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a (1) DHCP or (2) XDMCP message.

  • CVE-2010-4784Apr 7, 2011
    PHP Web Scripts
    Easy Banner Free
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in member.php in PHP Web Scripts Easy Banner Free 2009.05.18, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

  • CVE-2010-4783Apr 7, 2011
    PHP Web Scripts
    Easy Banner Free
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in PHP Web Scripts Easy Banner Free 2009.05.18, when magic_quotes_gpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the (1) siteurl and (2) urlbanner parameters.

  • CVE-2010-4782Apr 7, 2011
    Softwebs Nepal
    Ananda Real Estate
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) city, (2) state, (3) country, (4) minprice, (5) maxprice, (6) bed, and (7) bath parameters,…

  • CVE-2010-4781Apr 7, 2011
    Enanocms
    Enanocms
    risk 0.03cvss —epss 0.03

    index.php in Enano CMS 1.1.7pl1, and possibly other versions before 1.1.8, 1.0.6pl3, and 1.1.7pl2, allows remote attackers to obtain sensitive information via a crafted title parameter, which reveals the installation path in an error message.

  • CVE-2010-4780Apr 7, 2011
    Enanocms
    Enanocms
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the check_banlist function in includes/sessions.php in Enano CMS 1.1.7pl1; 1.0.6pl2; and possibly other versions before 1.1.8, 1.0.6pl3, and 1.1.7pl2 allows remote attackers to execute arbitrary SQL commands via the email parameter to index.php. …

  • CVE-2010-4779Apr 7, 2011
    WordPress
    Wptouch
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wptouch_settings parameter to include/adsense-new.php. NOTE: some of these…

  • CVE-2011-1652Apr 6, 2011
    Microsoft
    Windows 7
    risk 0.01cvss —epss 0.12

    The default configuration of Microsoft Windows 7 immediately prefers a new IPv6 and DHCPv6 service over a currently used IPv4 and DHCPv4 service upon receipt of an IPv6 Router Advertisement (RA), and does not provide an option to ignore an unexpected RA, which allows remote…

  • CVE-2011-0895Apr 6, 2011
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x and 8.1x allows remote authenticated users to obtain sensitive information via unknown vectors.