VYPR

CVEs

386,233 total · page 6816 of 7,725

AllCriticalHighKEV
  • CVE-2010-4767Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.02

    Open Ticket Request System (OTRS) before 2.3.6 does not properly handle e-mail messages in which the From line contains UTF-8 characters associated with diacritical marks and an invalid charset, which allows remote attackers to cause a denial of service (duplicate tickets and…

  • CVE-2010-4766Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    The AgentTicketForward feature in Open Ticket Request System (OTRS) before 2.4.7 does not properly remove inline images from HTML e-mail messages, which allows remote attackers to obtain potentially sensitive image information in opportunistic circumstances by reading a…

  • CVE-2010-4765Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Race condition in the Kernel::System::Main::FileWrite method in Open Ticket Request System (OTRS) before 2.4.8 allows remote authenticated users to corrupt the TicketCounter.log data in opportunistic circumstances by creating tickets.

  • CVE-2010-4764Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Open Ticket Request System (OTRS) before 2.4.10, and 3.x before 3.0.3, does not present warnings about incoming encrypted e-mail messages that were based on revoked PGP or GPG keys, which makes it easier for remote attackers to spoof e-mail communication by leveraging a key that…

  • CVE-2010-4763Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.02

    The ACL-customer-status Ticket Type setting in Open Ticket Request System (OTRS) before 3.0.0-beta1 does not restrict the ticket options after an AJAX reload, which allows remote authenticated users to bypass intended ACL restrictions on the (1) Status, (2) Service, and (3)…

  • CVE-2010-4761Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    The customer-interface ticket-print dialog in Open Ticket Request System (OTRS) before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote authenticated users to obtain potentially sensitive information from the (1) responsible, (2) owner, (3)…

  • CVE-2010-4762Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the rich-text-editor component in Open Ticket Request System (OTRS) before 3.0.0-beta2 allows remote authenticated users to inject arbitrary web script or HTML by using the "source code" feature in the customer interface.

  • CVE-2010-4760Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Open Ticket Request System (OTRS) before 3.0.0-beta6 adds email-notification-ext articles to tickets during processing of event-based notifications, which allows remote authenticated users to obtain potentially sensitive information by reading a ticket.

  • CVE-2010-4759Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Open Ticket Request System (OTRS) before 3.0.0-beta7 does not properly restrict the ticket ages that are within the scope of a search, which allows remote authenticated users to cause a denial of service (daemon hang) via a fulltext search.

  • CVE-2010-4758Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.00

    installer.pl in Open Ticket Request System (OTRS) before 3.0.3 has an Inbound Mail Password field that uses the text type, instead of the password type, for its INPUT element, which makes it easier for physically proximate attackers to obtain the password by reading the…

  • CVE-2009-5057Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.02

    The S/MIME feature in Open Ticket Request System (OTRS) before 2.3.4 does not configure the RANDFILE and HOME environment variables for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for…

  • CVE-2009-5056Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Open Ticket Request System (OTRS) before 2.4.0-beta2 does not properly enforce the move_into permission setting for a queue, which allows remote authenticated users to bypass intended access restrictions and read a ticket by watching this ticket, and then selecting the ticket…

  • CVE-2009-5055Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Open Ticket Request System (OTRS) before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as…

  • CVE-2008-7283Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Open Ticket Request System (OTRS) before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions.

  • CVE-2008-7282Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System (OTRS) before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform…

  • CVE-2008-7281Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.02

    Open Ticket Request System (OTRS) before 2.2.7 sends e-mail containing a Bcc header field that lists the Blind Carbon Copy recipients, which allows remote attackers to obtain potentially sensitive e-mail address information by reading this field.

  • CVE-2008-7280Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.02

    Kernel/System/EmailParser.pm in PostmasterPOP3.pl in Open Ticket Request System (OTRS) before 2.2.7 does not properly handle e-mail messages containing malformed UTF-8 characters, which allows remote attackers to cause a denial of service (e-mail retrieval outage) via a crafted…

  • CVE-2008-7279Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    The CustomerInterface component in Open Ticket Request System (OTRS) before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors.

  • CVE-2008-7278Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.02

    The S/MIME feature in Open Ticket Request System (OTRS) before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE environment variable for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended…

  • CVE-2008-7277Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.

  • CVE-2008-7276Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.00

    Kernel/System/Web/Request.pm in Open Ticket Request System (OTRS) before 2.3.2 creates a directory under /tmp/ with 1274 permissions, which might allow local users to bypass intended access restrictions via standard filesystem operations, related to incorrect interpretation of…

  • CVE-2008-7275Mar 18, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) before 2.3.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) AgentTicketMailbox or (2) CustomerTicketOverView.

  • CVE-2011-1148Mar 18, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by using the same variable for multiple arguments.

  • CVE-2011-1432Mar 16, 2011
    SCO Group
    Scoofficeserver
    risk 0.00cvss —epss 0.02

    The STARTTLS implementation in SCO SCOoffice Server does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext…

  • CVE-2011-1431Mar 16, 2011
    netqmail
    qmail-smtpd
    risk 0.00cvss —epss 0.05

    The STARTTLS implementation in qmail-smtpd.c in qmail-smtpd in the netqmail-1.06-tls patch for netqmail 1.06 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is…

  • CVE-2011-1430Mar 16, 2011
    Ipswitch, Inc.
    Imail
    risk 0.00cvss —epss 0.03

    The STARTTLS implementation in the server in Ipswitch IMail 11.03 and earlier does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in…

  • CVE-2011-1429Mar 16, 2011
    Mutt
    Mutt
    risk 0.00cvss —epss 0.01

    Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766.

  • CVE-2011-1428Mar 16, 2011
    Weechat
    Weechat
    risk 0.00cvss —epss 0.01

    Wee Enhanced Environment for Chat (aka WeeChat) 0.3.4 and earlier does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL chat server via an arbitrary certificate,…

  • CVE-2011-1153Mar 16, 2011
    PHP
    PHP
    risk 0.01cvss —epss 0.07

    Multiple format string vulnerabilities in phar_object.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive information from process memory, cause a denial of service (memory corruption), or possibly execute arbitrary code via…

  • CVE-2011-1094Mar 16, 2011
    KDE
    Kdelibs
    risk 0.00cvss —epss 0.01

    kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a…

  • CVE-2011-0889Mar 16, 2011
    Microfocus
    Client Automation Enterprise
    risk 0.01cvss —epss 0.13

    Unspecified vulnerability in HP Client Automation Enterprise (aka HPCA or Radia Notify) 5.11, 7.2, 7.5, 7.8, and 7.9 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2011-0751Mar 16, 2011
    Nostromo
    Nostromo webserver
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in nhttpd (aka Nostromo webserver) before 1.9.4 allows remote attackers to execute arbitrary programs or read arbitrary files via a ..%2f (encoded dot dot slash) in a URI.

  • CVE-2011-0745Mar 16, 2011
    Sugarcrm
    Sugarcrm
    risk 0.04cvss —epss 0.06

    SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover (1) the names of customers via a ShowDuplicates action to the Accounts module, reachable…

  • CVE-2011-0648Mar 16, 2011
    EMC Corporation
    Avamar
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in EMC Avamar before 5.0.4-30 allows remote authenticated users to gain privileges via unknown vectors.

  • CVE-2011-0442Mar 16, 2011
    EMC Corporation
    Avamar
    risk 0.00cvss —epss 0.01

    The service utility in EMC Avamar 5.x before 5.0.4 uses cleartext to transmit event details in (1) service requests and (2) e-mail messages, which might allow remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2011-0411Mar 16, 2011
    Postfix
    Postfix
    risk 0.01cvss —epss 0.16

    The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext…

  • CVE-2011-0322Mar 16, 2011
    Rsa
    Access Manager Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in EMC RSA Access Manager Server 5.5.x, 6.0.x, and 6.1.x allows remote attackers to access resources via unknown vectors.

  • CVE-2011-1427Mar 15, 2011
    Kodak
    Insite
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Kodak InSite 5.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Language parameter to Pages/login.aspx, (2) HeaderWarning parameter to Troubleshooting/DiagnosticReport.asp, or (3) User-Agent…

  • CVE-2011-1147Mar 15, 2011
    Asterisk
    Asterisk Open Source
    risk 0.00cvss —epss 0.04

    Multiple stack-based and heap-based buffer overflows in the (1) decode_open_type and (2) udptl_rx_packet functions in main/udptl.c in Asterisk Open Source 1.4.x before 1.4.39.2, 1.6.1.x before 1.6.1.22, 1.6.2.x before 1.6.2.16.2, and 1.8 before 1.8.2.4; Business Edition C.x.x…

  • CVE-2011-1146Mar 15, 2011
    Libvirt
    Libvirt
    risk 0.00cvss —epss 0.02

    libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset,…

  • CVE-2011-1092Mar 15, 2011
    PHP
    PHP
    risk 0.04cvss —epss 0.18

    Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possibly read sensitive memory via a large third argument to the shmop_read function.

  • CVE-2011-0695Mar 15, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Race condition in the cm_work_handler function in the InfiniBand driver (drivers/infiniband/core/cma.c) in Linux kernel 2.6.x allows remote attackers to cause a denial of service (panic) by sending an InfiniBand request while other request handlers are still running, which…

  • CVE-2011-0609HigKEVMar 15, 2011
    Adobe Inc.
    Acrobat
    risk 0.71cvss 7.8epss 0.64

    Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x…

  • CVE-2011-0457Mar 15, 2011
    E107
    E107
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in e107 0.7.22 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-0438Mar 15, 2011
    Nss Pam Ldapd
    nss-pam-ldapd
    risk 0.00cvss —epss 0.02

    nslcd/pam.c in the nss-pam-ldapd 0.8.0 PAM module returns a success code when a user is not found in LDAP, which allows remote attackers to bypass authentication.

  • CVE-2011-0063Mar 15, 2011
    Majordomo
    Majordomo
    risk 0.10cvss —epss 0.85

    The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ./.../ sequence in the "extra" parameter to the help command, which causes the regular expression to…

  • CVE-2011-0001Mar 15, 2011
    tgt
    tgt
    risk 0.00cvss —epss 0.05

    Double free vulnerability in the iscsi_rx_handler function (usr/iscsi/iscsid.c) in the tgt daemon (tgtd) in Linux SCSI target framework (tgt) before 1.0.14, aka scsi-target-utils, allows remote attackers to cause a denial of service (memory corruption and crash) and possibly…

  • CVE-2010-4757Mar 15, 2011
    E107
    E107
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in submitnews.php in e107 before 0.7.23 allows remote attackers to inject arbitrary web script or HTML via the submitnews_title parameter, a different vector than CVE-2008-6208. NOTE: some of these details are obtained from third party…

  • CVE-2011-1419Mar 14, 2011
    Apache
    Tomcat
    risk 0.00cvss —epss 0.07

    Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an…

  • CVE-2011-1091Mar 14, 2011
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.03

    libymsg.c in the Yahoo! protocol plugin in libpurple in Pidgin 2.6.0 through 2.7.10 allows (1) remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG notification packet, and allows (2) remote Yahoo! servers…