VYPR

CVEs

386,118 total · page 6830 of 7,723

AllCriticalHighKEV
  • CVE-2010-2632Jan 19, 2011
    Sun Corporation
    Sunos
    risk 0.06cvss —epss 0.35

    Unspecified vulnerability in the FTP Server in Oracle Solaris 8, 9, 10, and 11 Express allows remote attackers to affect availability. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable researcher that this…

  • CVE-2011-0494Jan 19, 2011
    IBM
    Tivoli Access Manager For E Business
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in WebSEAL in IBM Tivoli Access Manager for e-business 5.1 before 5.1.0.39-TIV-AWS-IF0040, 6.0 before 6.0.0.25-TIV-AWS-IF0026, 6.1.0 before 6.1.0.5-TIV-AWS-IF0006, and 6.1.1 before 6.1.1-TIV-AWS-FP0001 has unspecified impact and attack vectors. …

  • CVE-2011-0493Jan 19, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.03

    Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha might allow remote attackers to cause a denial of service (assertion failure and daemon exit) via vectors related to malformed router caches and improper handling of integer values.

  • CVE-2011-0492Jan 19, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.03

    Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha allows remote attackers to cause a denial of service (assertion failure and daemon exit) via blobs that trigger a certain file size, as demonstrated by the cached-descriptors.new file.

  • CVE-2011-0491Jan 19, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.03

    The tor_realloc function in Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha does not validate a certain size value during memory allocation, which might allow remote attackers to cause a denial of service (daemon crash) via unspecified vectors, related to "underflow…

  • CVE-2011-0490Jan 19, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.03

    Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha makes calls to Libevent within Libevent log handlers, which might allow remote attackers to cause a denial of service (daemon crash) via vectors that trigger certain log messages.

  • CVE-2011-0427Jan 19, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.

  • CVE-2011-0016Jan 19, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.00

    Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha does not properly manage key data in memory, which might allow local users to obtain sensitive information by leveraging the ability to read memory that was previously used by a different process.

  • CVE-2011-0015Jan 19, 2011
    Tor
    Tor
    risk 0.00cvss —epss 0.03

    Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha does not properly check the amount of compression in zlib-compressed data, which allows remote attackers to cause a denial of service via a large compression factor.

  • CVE-2010-4700Jan 18, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The set_magic_quotes_runtime function in PHP 5.3.2 and 5.3.3, when the MySQLi extension is used, does not properly interact with use of the mysqli_fetch_assoc function, which might make it easier for context-dependent attackers to conduct SQL injection attacks via crafted input…

  • CVE-2010-4699Jan 18, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The iconv_mime_decode_headers function in the Iconv extension in PHP before 5.3.4 does not properly handle encodings that are unrecognized by the iconv and mbstring (aka Multibyte String) implementations, which allows remote attackers to trigger an incomplete output array, and…

  • CVE-2010-4698Jan 18, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the GD extension in PHP before 5.2.15 and 5.3.x before 5.3.4 allows context-dependent attackers to cause a denial of service (application crash) via a large number of anti-aliasing steps in an argument to the imagepstext function.

  • CVE-2010-4697Jan 18, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the Zend engine in PHP before 5.2.15 and 5.3.x before 5.3.4 might allow context-dependent attackers to cause a denial of service (heap memory corruption) or have unspecified other impact via vectors related to use of __set, __get, __isset, and…

  • CVE-2006-7243Jan 18, 2011
    PHP
    PHP
    risk 0.00cvss —epss 0.05

    PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists…

  • CVE-2011-0489Jan 18, 2011
    Objectivity
    Objectivity\/db
    risk 0.04cvss —epss 0.13

    The server components in Objectivity/DB 10.0 do not require authentication for administrative commands, which allows remote attackers to modify data, obtain sensitive information, or cause a denial of service by sending requests over TCP to (1) the Lock Server or (2) the…

  • CVE-2011-0488Jan 18, 2011
    Indusoft
    Web Studio
    risk 0.01cvss —epss 0.09

    Stack-based buffer overflow in NTWebServer.exe in the test web service in InduSoft NTWebServer, as distributed in Advantech Studio 6.1 and InduSoft Web Studio 7.0, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long…

  • CVE-2011-0487Jan 18, 2011
    Icq
    Icq
    risk 0.00cvss —epss 0.03

    ICQ 7 does not verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a crafted file that is fetched through an automatic-update mechanism.

  • CVE-2011-0486Jan 18, 2011
    IBM
    Cognos 8 Business Intelligence
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cognos.cgi in IBM Cognos 8 Business Intelligence (BI) 8.4.1 before FP1 allows remote attackers to inject arbitrary web script or HTML via the pathinfo parameter.

  • CVE-2011-0408Jan 18, 2011
    Libpng
    Libpng
    risk 0.00cvss —epss 0.06

    pngrtran.c in libpng 1.5.x before 1.5.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted palette-based PNG image that triggers a buffer overflow, related to the png_do_expand_palette function, the…

  • CVE-2011-0272Jan 18, 2011
    Microfocus
    Loadrunner
    risk 0.01cvss —epss 0.13

    Unspecified vulnerability in HP LoadRunner 9.52 allows remote attackers to execute arbitrary code via network traffic to TCP port 5001 or 5002, related to the HttpTunnel feature.

  • CVE-2011-0010Jan 18, 2011
    Todd Miller
    Sudo
    risk 0.00cvss —epss 0.01

    check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.

  • CVE-2010-4696Jan 18, 2011
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Joomla! 1.5.x before 1.5.22 allow remote attackers to execute arbitrary SQL commands via the (1) filter_order or (2) filter_order_Dir parameter in a com_contact action to index.php, a different vulnerability than CVE-2010-4166. NOTE:…

  • CVE-2010-4646Jan 18, 2011
    Hastymail
    Hastymail2
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Hastymail2 before 1.01 allows remote attackers to inject arbitrary web script or HTML via a crafted background attribute within a cell in a TABLE element, related to improper use of the htmLawed filter.

  • CVE-2010-4531Jan 18, 2011
    PCSC-Lite
    PCSC-Lite
    risk 0.00cvss —epss 0.01

    Stack-based buffer overflow in the ATRDecodeAtr function in the Answer-to-Reset (ATR) Handler (atrhandler.c) for pcscd in PCSC-Lite 1.5.3, and possibly other 1.5.x and 1.6.x versions, allows physically proximate attackers to cause a denial of service (crash) and possibly execute…

  • CVE-2010-4530Jan 18, 2011
    PCSC-Lite
    PCSC-Lite
    risk 0.00cvss —epss 0.01

    Signedness error in ccid_serial.c in libccid in the USB Chip/Smart Card Interface Devices (CCID) driver, as used in pcscd in PCSC-Lite 1.5.3 and possibly other products, allows physically proximate attackers to execute arbitrary code via a smart card with a crafted serial number…

  • CVE-2010-4263Jan 18, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    The igb_receive_skb function in drivers/net/igb/igb_main.c in the Intel Gigabit Ethernet (aka igb) subsystem in the Linux kernel before 2.6.34, when Single Root I/O Virtualization (SR-IOV) and promiscuous mode are enabled but no VLANs are registered, allows remote attackers to…

  • CVE-2010-4166Jan 18, 2011
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Joomla! 1.5.x before 1.5.22 allow remote attackers to execute arbitrary SQL commands via (1) the filter_order parameter in a com_weblinks category action to index.php, (2) the filter_order_Dir parameter in a com_weblinks category action…

  • CVE-2009-5051Jan 18, 2011
    Hastymail
    Hastymail2
    risk 0.00cvss —epss 0.01

    Hastymail2 before RC 8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

  • CVE-2010-4566Jan 14, 2011
    Citrix Systems
    Access Gateway
    risk 0.05cvss —epss 0.28

    The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and earlier, and the NTLM authentication component in Access Gateway Standard and Advanced Editions before Access Gateway 5.0, allows attackers to execute…

  • CVE-2010-4339Jan 14, 2011
    Hypermail
    Hypermail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Hypermail 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted From address, which is not properly handled when indexing messages.

  • CVE-2010-4337Jan 14, 2011
    Gnash
    gnash
    risk 0.00cvss —epss 0.00

    The configure script in gnash 0.8.8 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/gnash-configure-errors.$$, (2) /tmp/gnash-configure-warnings.$$, or (3) /tmp/gnash-configure-recommended.$$ files.

  • CVE-2010-4335Jan 14, 2011
    Cakephp
    Cakephp
    risk 0.00cvss —epss 0.55

    The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize…

  • CVE-2010-3086Jan 14, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    include/asm-x86/futex.h in the Linux kernel before 2.6.25 does not properly implement exception fixup, which allows local users to cause a denial of service (panic) via an invalid application that triggers a page fault.

  • CVE-2010-0115Jan 14, 2011
    Symantec
    Web Gateway
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter.

  • CVE-2010-3840Jan 14, 2011
    MySQL
    MySQL
    risk 0.00cvss —epss 0.03

    The Gis_line_string::init_from_wkb function in sql/spatial.cc in MySQL 5.1 before 5.1.51 allows remote authenticated users to cause a denial of service (server crash) by calling the PolyFromWKB function with Well-Known Binary (WKB) data containing a crafted number of (1) line…

  • CVE-2010-3839Jan 14, 2011
    MySQL
    MySQL
    risk 0.00cvss —epss 0.03

    MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (infinite loop) via multiple invocations of a (1) prepared statement or (2) stored procedure that creates a query with nested JOIN statements.

  • CVE-2010-3838Jan 14, 2011
    MySQL
    MySQL
    risk 0.00cvss —epss 0.03

    MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via a query that uses the (1) GREATEST or (2) LEAST function with a mixed list of numeric and LONGBLOB arguments, which is not properly…

  • CVE-2010-3837Jan 14, 2011
    MySQL
    MySQL
    risk 0.00cvss —epss 0.03

    MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via a prepared statement that uses GROUP_CONCAT with the WITH ROLLUP modifier, probably triggering a use-after-free error when a copied…

  • CVE-2010-3836Jan 14, 2011
    MySQL
    MySQL
    risk 0.00cvss —epss 0.02

    MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (assertion failure and server crash) via vectors related to view preparation, pre-evaluation of LIKE predicates, and IN Optimizers.

  • CVE-2010-3835Jan 14, 2011
    MySQL
    MySQL
    risk 0.00cvss —epss 0.03

    MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (mysqld server crash) by performing a user-variable assignment in a logical expression that is calculated and stored in a temporary table for GROUP BY, then causing the…

  • CVE-2010-3834Jan 14, 2011
    MySQL
    MySQL
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via vectors related to "materializing a derived table that required a temporary table for grouping" and…

  • CVE-2010-3833Jan 14, 2011
    MySQL
    MySQL
    risk 0.00cvss —epss 0.03

    MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 does not properly propagate type errors, which allows remote attackers to cause a denial of service (server crash) via crafted arguments to extreme-value functions such as (1) LEAST and (2) GREATEST, related to…

  • CVE-2010-4695Jan 14, 2011
    Catb
    Gif2png
    risk 0.00cvss —epss 0.02

    A certain Fedora patch for gif2png.c in gif2png 2.5.1 and 2.5.2, as distributed in gif2png-2.5.1-1200.fc12 on Fedora 12 and gif2png_2.5.2-1 on Debian GNU/Linux, truncates a GIF pathname specified on the command line, which might allow remote attackers to create PNG files in…

  • CVE-2010-4694Jan 14, 2011
    Catb
    Gif2png
    risk 0.00cvss —epss 0.02

    Buffer overflow in gif2png.c in gif2png 2.5.3 and earlier might allow context-dependent attackers to cause a denial of service (application crash) or have unspecified other impact via a GIF file that contains many images, leading to long extensions such as .p100 for PNG output…

  • CVE-2011-0485Jan 14, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle speech data, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to a "stale pointer."

  • CVE-2011-0484Jan 14, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly perform DOM node removal, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale rendering node."

  • CVE-2011-0483Jan 14, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly perform a cast of an unspecified variable during handling of video, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2011-0482Jan 14, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly perform a cast of an unspecified variable during handling of anchors, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML…

  • CVE-2011-0481Jan 14, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Buffer overflow in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to PDF shading.

  • CVE-2011-0480Jan 14, 2011
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in vorbis_dec.c in the Vorbis decoder in FFmpeg, as used in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified…