VYPR

CVEs

386,233 total · page 6817 of 7,725

AllCriticalHighKEV
  • CVE-2011-1088Mar 14, 2011
    Apache
    Tomcat
    risk 0.00cvss —epss 0.06

    Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.

  • CVE-2011-0701Mar 14, 2011
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter.

  • CVE-2011-0700Mar 14, 2011
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title), (2) post_status, (3) comment_status, (4)…

  • CVE-2011-0432Mar 14, 2011
    Simon Pamies
    Pywebdav
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are…

  • CVE-2011-0280Mar 14, 2011
    Microfocus
    Power Manager
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in HP Power Manager (HPPM) 4.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the logType parameter to Contents/exportlogs.asp, (2) the Id parameter to Contents/pagehelp.asp, or the (3)…

  • CVE-2011-1418Mar 11, 2011
    Apple Inc.
    TV
    risk 0.00cvss —epss 0.01

    The stateless address autoconfiguration (aka SLAAC) functionality in the IPv6 networking implementation in Apple iOS before 4.3 and Apple TV before 4.2 places the MAC address into the IPv6 address, which makes it easier for remote IPv6 servers to track users by logging source…

  • CVE-2011-0715Mar 11, 2011
    Apache
    Subversion
    risk 0.01cvss —epss 0.06

    The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.

  • CVE-2011-0169Mar 11, 2011
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    WebKit in Apple Safari before 5.0.4, when the Web Inspector is used, does not properly handle the window.console._inspectorCommandLineAPI property, which allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a…

  • CVE-2011-0167Mar 11, 2011
    Apple Inc.
    Safari
    risk 0.03cvss —epss 0.03

    The windows functionality in WebKit in Apple Safari before 5.0.4 allows remote attackers to bypass the Same Origin Policy, and force the upload of arbitrary local files from a client computer, via a crafted web site.

  • CVE-2011-0166Mar 11, 2011
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    The HTML5 drag and drop functionality in WebKit in Apple Safari before 5.0.4 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via vectors related to the dragging of content. NOTE: this might overlap CVE-2011-0778.

  • CVE-2011-0163Mar 11, 2011
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle unspecified "cached resources," which allows remote attackers to cause a denial of service (resource unavailability) via a crafted web site that conducts a cache-poisoning attack.

  • CVE-2011-0162Mar 11, 2011
    Apple Inc.
    TV
    risk 0.00cvss —epss 0.03

    Wi-Fi in Apple iOS before 4.3 and Apple TV before 4.2 does not properly perform bounds checking for Wi-Fi frames, which allows remote attackers to cause a denial of service (device reset) via unspecified traffic on the local wireless network.

  • CVE-2011-0161Mar 11, 2011
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle the Attr.style accessor, which allows remote attackers to bypass the Same Origin Policy and inject Cascading Style Sheets (CSS) token sequences via a crafted web site.

  • CVE-2011-0160Mar 11, 2011
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle redirects in conjunction with HTTP Basic Authentication, which might allow remote web servers to capture credentials by logging the Authorization HTTP header.

  • CVE-2011-0159Mar 11, 2011
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    The Safari Settings feature in Safari in Apple iOS 4.x before 4.3 does not properly implement the clearing of cookies during execution of the Safari application, which might make it easier for remote web servers to track users by setting a cookie.

  • CVE-2011-0158Mar 11, 2011
    Apple Inc.
    MobileSafari
    risk 0.00cvss —epss 0.01

    MobileSafari in Apple iOS before 4.3 does not properly implement application launching through URL handlers, which allows remote attackers to cause a denial of service (persistent application crash) via crafted JavaScript code.

  • CVE-2011-0157Mar 11, 2011
    Apple Inc.
    Webkit
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple iOS before 4.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-09-1.

  • CVE-2010-4651Mar 11, 2011
    GNU
    Patch
    risk 0.00cvss —epss 0.05

    Directory traversal vulnerability in util.c in GNU patch 2.6.1 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a filename that is specified with a .. (dot dot) or full pathname, a related issue to CVE-2010-1679.

  • CVE-2011-1290Mar 11, 2011
    Rim
    Blackberry Torch 9800
    risk 0.01cvss —epss 0.10

    Integer overflow in WebKit, as used on the Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246, in Google Chrome before 10.0.648.133, and in Apple Safari before 5.0.5, allows remote attackers to execute arbitrary code via unknown vectors related to CSS "style…

  • CVE-2011-1417Mar 11, 2011
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.05

    Integer overflow in QuickLook, as used in Apple Mac OS X before 10.6.7 and MobileSafari in Apple iOS before 4.2.7 and 4.3.x before 4.3.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a Microsoft…

  • CVE-2011-1416Mar 11, 2011
    Rim
    Blackberry Torch 9800
    risk 0.00cvss —epss 0.01

    The Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246 allows attackers to read the contents of memory locations via unknown vectors, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest…

  • CVE-2011-1137Mar 11, 2011
    Proftpd
    Proftpd
    risk 0.05cvss —epss 0.28

    Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumption leading to OOM kill) via a malformed SSH message.

  • CVE-2011-0456Mar 11, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.03

    webscript.pl in Open Ticket Request System (OTRS) 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."

  • CVE-2010-3609Mar 11, 2011
    Openslp
    Openslp
    risk 0.04cvss —epss 0.17

    The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a…

  • CVE-2011-1413Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 on Linux does not properly mitigate an unspecified flaw in an X server, which allows remote attackers to cause a denial of service (application crash) via vectors involving long messages.

  • CVE-2011-1286Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google V8, as used in Google Chrome before 10.0.648.127, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger incorrect access to memory.

  • CVE-2011-1285Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The regular-expression functionality in Google Chrome before 10.0.648.127 does not properly implement reentrancy, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-1204Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 does not properly handle attributes, which allows remote attackers to cause a denial of service (DOM tree corruption) or possibly have unspecified other impact via a crafted document.

  • CVE-2011-1203Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 does not properly handle SVG cursors, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

  • CVE-2011-1202Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a…

  • CVE-2011-1201Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The context implementation in WebKit, as used in Google Chrome before 10.0.648.127, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

  • CVE-2011-1200Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 10.0.648.127 does not properly perform a cast of an unspecified variable during text rendering, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.

  • CVE-2011-1199Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 does not properly handle DataView objects, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-1198Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The video functionality in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger use of a malformed "out-of-bounds structure."

  • CVE-2011-1197Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 does not properly perform table painting, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

  • CVE-2011-1196Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The OGG container implementation in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.

  • CVE-2011-1195Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to "document script lifetime handling."

  • CVE-2011-1194Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Google Chrome before 10.0.648.127 allow remote attackers to bypass the pop-up blocker via unknown vectors.

  • CVE-2011-1193Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google V8, as used in Google Chrome before 10.0.648.127, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

  • CVE-2011-1192Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 on Linux does not properly handle Unicode ranges, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2011-1191Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of DOM URLs.

  • CVE-2011-1190Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The Web Workers implementation in Google Chrome before 10.0.648.127 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, related to an "error message leak."

  • CVE-2011-1189Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 does not properly perform box layout, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale node."

  • CVE-2011-1188Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 does not properly handle counter nodes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-1187Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 10.0.648.127 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, related to an "error message leak."

  • CVE-2011-1186Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    Google Chrome before 10.0.648.127 on Linux does not properly handle parallel execution of calls to the print method, which might allow remote attackers to cause a denial of service (application crash) via crafted JavaScript code.

  • CVE-2011-1185Mar 11, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 10.0.648.127 does not prevent (1) navigation and (2) close operations on the top location of a sandboxed frame, which has unspecified impact and remote attack vectors.

  • CVE-2011-1347Mar 10, 2011
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.28

    Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to bypass Protected Mode and create arbitrary files by leveraging access to a Low integrity process, as demonstrated by Stephen Fewer as the third of three chained vulnerabilities…

  • CVE-2011-1346Mar 10, 2011
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.26

    Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by Stephen Fewer as the second of three chained vulnerabilities during a Pwn2Own competition at CanSecWest 2011.

  • CVE-2011-1345Mar 10, 2011
    Microsoft
    Internet Explorer
    risk 0.03cvss —epss 0.41

    Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, as demonstrated by Stephen Fewer as the first of three…