VYPR

CVEs

386,273 total · page 6815 of 7,726

AllCriticalHighKEV
  • CVE-2011-1472Mar 29, 2011
    Nokia
    E75
    risk 0.00cvss —epss 0.00

    The Nokia E75 phone with firmware before 211.12.01 allows physically proximate attackers to bypass the Device Lock code by entering an unspecified button sequence at boot time.

  • CVE-2011-1205Mar 29, 2011
    IBM
    Rational Clearcase
    risk 0.00cvss —epss 0.00

    Multiple buffer overflows in unspecified COM objects in Rational Common Licensing 7.0 through 7.1.1.4 in IBM Rational ClearCase 7.0.0.4 through 7.1.1.4, ClearQuest 7.0.0.4 through 7.1.1.4, and other products allow local users to gain privileges via a Trojan horse HTML document…

  • CVE-2011-1176Mar 29, 2011
    Mpm Itk Project
    Mpm Itk
    risk 0.00cvss —epss 0.03

    The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote…

  • CVE-2011-0892Mar 29, 2011
    Microfocus
    Diagnostics
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in HP Diagnostics 7.5x and 8.0x before 8.05.54.225 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2011-0728Mar 29, 2011
    Michael Hudson Doyle
    Loggerhead
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.

  • CVE-2011-0441Mar 29, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.00

    The Debian GNU/Linux /etc/cron.d/php5 cron job for PHP 5.3.5 allows local users to delete arbitrary files via a symlink attack on a directory under /var/lib/php5/.

  • CVE-2010-1675Mar 29, 2011
    Quagga (software)
    Quagga
    risk 0.00cvss —epss 0.03

    bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service (session reset) via a malformed AS_PATHLIMIT path attribute.

  • CVE-2010-1674Mar 29, 2011
    Quagga (software)
    Quagga
    risk 0.01cvss —epss 0.13

    The extended-community parser in bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed Extended Communities attribute.

  • CVE-2011-1524Mar 28, 2011
    Symantec
    Liveupdate Administrator
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event…

  • CVE-2011-1420Mar 28, 2011
    EMC Corporation
    Data Protection Advisor
    risk 0.00cvss —epss 0.00

    EMC Data Protection Advisor Collector 5.7 and 5.7.1 on Solaris SPARC platforms uses weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors.

  • CVE-2011-1167Mar 28, 2011
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in the thunder (aka ThunderScan) decoder in tif_thunder.c in LibTIFF 3.9.4 and earlier allows remote attackers to execute arbitrary code via crafted THUNDER_2BITDELTAS data in a .tiff file that has an unexpected BitsPerSample value.

  • CVE-2011-0760Mar 28, 2011
    WordPress
    WP Related Posts
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration screen in wp-relatedposts.php in the WP Related Posts plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting…

  • CVE-2011-0545Mar 28, 2011
    Symantec
    Liveupdate Administrator
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in adduser.do in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other…

  • CVE-2011-0458Mar 28, 2011
    Google
    Picasa
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in the Locate on Disk feature in Google Picasa before 3.8 allows local users to gain privileges via a Trojan horse executable file in the current working directory.

  • CVE-2011-0440Mar 28, 2011
    Mahara (software)
    Mahara
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to hijack the authentication of arbitrary users for requests that delete blogs.

  • CVE-2011-0439Mar 28, 2011
    Mahara (software)
    Mahara
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the Pieforms select box.

  • CVE-2011-0024Mar 28, 2011
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in wiretap/pcapng.c in Wireshark before 1.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted capture file.

  • CVE-2010-3276Mar 28, 2011
    VideoLAN
    VLC media player
    risk 0.01cvss —epss 0.07

    libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an NSV file.

  • CVE-2010-3275Mar 28, 2011
    VideoLAN
    VLC media player
    risk 0.09cvss —epss 0.76

    libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an AMV file, related to a "dangling pointer vulnerability."

  • CVE-2011-1520Mar 25, 2011
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.00

    The default configuration of the server console in IBM Lotus Domino does not require a password (aka Server_Console_Password), which allows physically proximate attackers to perform administrative changes or obtain sensitive information via a (1) Load, (2) Tell, or (3) Set…

  • CVE-2011-1519Mar 25, 2011
    IBM
    Lotus Domino
    risk 0.04cvss —epss 0.09

    The remote console in the Server Controller in IBM Lotus Domino 7.x and 8.x verifies credentials against a file located at a UNC share pathname specified by the client, which allows remote attackers to bypass authentication, and consequently execute arbitrary code, by placing…

  • CVE-2011-1400Mar 25, 2011
    Debian
    linux
    risk 0.00cvss —epss 0.04

    The default configuration of the shell_escape_commands directive in conf/texmf.d/95NonPath.cnf in the tex-common package before 2.08.1 in Debian GNU/Linux squeeze, Ubuntu 10.10 and 10.04 LTS, and possibly other operating systems lists certain programs, which might allow remote…

  • CVE-2011-1296Mar 25, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.204 does not properly handle SVG text, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

  • CVE-2011-1295Mar 25, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    WebKit, as used in Google Chrome before 10.0.648.204 and Apple Safari before 5.0.6, does not properly handle node parentage, which allows remote attackers to cause a denial of service (DOM tree corruption), conduct cross-site scripting (XSS) attacks, or possibly have unspecified…

  • CVE-2011-1294Mar 25, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.204 does not properly handle Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

  • CVE-2011-1293Mar 25, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the HTMLCollection implementation in Google Chrome before 10.0.648.204 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-1292Mar 25, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the frame-loader implementation in Google Chrome before 10.0.648.204 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-1291Mar 25, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.204 does not properly handle base strings, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors, related to a "buffer error."

  • CVE-2011-0890Mar 25, 2011
    Microfocus
    Discovery\&dependency Mapping Inventory
    risk 0.00cvss —epss 0.03

    HP Discovery & Dependency Mapping Inventory (DDMI) 7.50, 7.51, 7.60, 7.61, 7.70, and 9.30 launches the Windows SNMP service with its default configuration, which allows remote attackers to obtain potentially sensitive information or have unspecified other impact by leveraging…

  • CVE-2010-4776Mar 23, 2011
    Preprojects
    Pre Online Tests Generator
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in takefreestart.php in PreProjects Pre Online Tests Generator Pro allows remote attackers to execute arbitrary SQL commands via the tid2 parameter.

  • CVE-2010-4775Mar 23, 2011
    Drupal
    Relevant Content
    risk 0.00cvss —epss 0.01

    The Relevant Content module 5.x before 5.x-1.4 and 6.x before 6.x-1.5 for Drupal does not properly implement node access logic, which allows remote attackers to discover restricted node titles and relationships.

  • CVE-2010-4774Mar 23, 2011
    Auracms
    Auracms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pdf.php in AuraCMS 1.62 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2007-4804 and CVE-2007-4171.

  • CVE-2010-4773Mar 23, 2011
    Hitachi
    Eur Form Client
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Hitachi EUR Form Client before 05-10 -/D 2010.11.15 and 05-10-CA (* 2) 2010.11.15; Hitachi EUR Form Service before 05-10 -/D 2010.11.15; and uCosminexus EUR Form Service before 07-60 -/D 2010.11.15 on Windows, before 05-10 -/D 2010.11.15 and 07-50…

  • CVE-2010-4772Mar 23, 2011
    Matteoiammarrone
    S CMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in blocks/lang.php in S-CMS 2.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter to viewforum.php.

  • CVE-2010-4771Mar 23, 2011
    Matteoiammarrone
    S CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability to viewforum.php in S-CMS 2.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-4770Mar 23, 2011
    Commodityrentals
    Dvd Rentals Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in CommodityRentals DVD Rentals Script allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a catalog action.

  • CVE-2010-4769Mar 23, 2011
    Joomla
    Jimtawl
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in the Jimtawl (com_jimtawl) component 1.0.2 Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the task parameter to index.php.

  • CVE-2011-0194Mar 23, 2011
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Integer overflow in ImageIO in Apple Mac OS X 10.6 before 10.6.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image with JPEG encoding.

  • CVE-2011-0193Mar 23, 2011
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in Image RAW in Apple Mac OS X before 10.6.7 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Canon RAW image.

  • CVE-2011-0190Mar 23, 2011
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Install Helper in Installer in Apple Mac OS X before 10.6.7 does not properly process an unspecified URL, which might allow remote attackers to track user logins by logging network traffic from an agent that was intended to send network traffic to an Apple server.

  • CVE-2011-0189Mar 23, 2011
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    The default configuration of Terminal in Apple Mac OS X 10.6 before 10.6.7 uses SSH protocol version 1 within the New Remote Connection dialog, which might make it easier for man-in-the-middle attackers to spoof SSH servers by leveraging protocol vulnerabilities.

  • CVE-2011-0188Mar 23, 2011
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.03

    The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of…

  • CVE-2011-0187Mar 23, 2011
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    The plug-in in QuickTime in Apple Mac OS X before 10.6.7 allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive video data via vectors involving a cross-site redirect.

  • CVE-2011-0186Mar 23, 2011
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    QuickTime in Apple Mac OS X before 10.6.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted JPEG2000 image.

  • CVE-2011-0184Mar 23, 2011
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    QuickLook in Apple Mac OS X 10.6 before 10.6.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via an Excel spreadsheet with a crafted formula that uses unspecified opcodes.

  • CVE-2011-0183Mar 23, 2011
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Libinfo in Apple Mac OS X before 10.6.7 does not properly handle an unspecified integer field in an NFS RPC packet, which allows remote attackers to cause a denial of service (lockd, statd, mountd, or portmap outage) via a crafted packet, related to an "integer truncation issue."

  • CVE-2011-0182Mar 23, 2011
    Apple Inc.
    Mac OS X
    risk 0.03cvss —epss 0.02

    The i386_set_ldt system call in the kernel in Apple Mac OS X before 10.6.7 does not properly handle call gates, which allows local users to gain privileges via vectors involving the creation of a call gate entry.

  • CVE-2011-0181Mar 23, 2011
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Integer overflow in ImageIO in Apple Mac OS X before 10.6.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted XBM image.

  • CVE-2011-0180Mar 23, 2011
    Apple Inc.
    Mac OS X
    risk 0.03cvss —epss 0.01

    Integer overflow in HFS in Apple Mac OS X before 10.6.7 allows local users to read arbitrary (1) HFS, (2) HFS+, or (3) HFS+J files via a crafted F_READBOOTSTRAP ioctl call.

  • CVE-2011-0179Mar 23, 2011
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    CoreText in Apple Mac OS X before 10.6.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a document that contains a crafted embedded font.