VYPR

CVEs

385,938 total · page 6838 of 7,719

AllCriticalHighKEV
  • CVE-2010-4312Nov 26, 2010
    Apache
    Tomcat
    risk 0.00cvss —epss 0.02

    The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.

  • CVE-2010-4311Nov 26, 2010
    Dustincowell
    Free Simple Software
    risk 0.00cvss —epss 0.01

    Free Simple Software 1.0 stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information.

  • CVE-2010-4298Nov 26, 2010
    Free Simple Software
    download module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the download module in Free Simple Software 1.0 allows remote attackers to execute arbitrary SQL commands via the downloads_id parameter in a download_now action to index.php.

  • CVE-2010-4172Nov 26, 2010
    Apache
    Tomcat
    risk 0.00cvss —epss 0.42

    Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or…

  • CVE-2010-3911Nov 26, 2010
    Vtiger
    vTiger
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via (1) the username (aka default_user_name) field or (2) the password field in a Users Login action to index.php, or (3) the label…

  • CVE-2010-3910Nov 26, 2010
    Vtiger
    CRM
    risk 0.01cvss —epss 0.07

    Multiple directory traversal vulnerabilities in the return_application_language function in include/utils/utils.php in vtiger CRM before 5.2.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the lang_crm parameter to phprint.php or…

  • CVE-2010-3909Nov 26, 2010
    Vtiger
    vTiger
    risk 0.00cvss —epss 0.02

    Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file…

  • CVE-2010-3855Nov 26, 2010
    FreeType
    Freetype
    risk 0.00cvss —epss 0.05

    Buffer overflow in the ft_var_readpackedpoints function in truetype/ttgxvar.c in FreeType 2.4.3 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TrueType GX font.

  • CVE-2010-3832Nov 26, 2010
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in the GSM mobility management implementation in Telephony in Apple iOS before 4.2 on the iPhone and iPad allows remote attackers to execute arbitrary code on the baseband processor via a crafted Temporary Mobile Subscriber Identity (TMSI) field.

  • CVE-2010-3831Nov 26, 2010
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.01

    Photos in Apple iOS before 4.2 enables support for HTTP Basic Authentication over an unencrypted connection, which allows man-in-the-middle attackers to read MobileMe account passwords by spoofing a MobileMe Gallery server during a "Send to MobileMe" action.

  • CVE-2010-3830Nov 26, 2010
    Apple Inc.
    iOS
    risk 0.03cvss —epss 0.01

    Networking in Apple iOS before 4.2 accesses an invalid pointer during the processing of packet filter rules, which allows local users to gain privileges via unspecified vectors.

  • CVE-2010-3829Nov 26, 2010
    Apple Inc.
    Webkit
    risk 0.00cvss —epss 0.02

    WebKit in Apple iOS before 4.2 allows remote attackers to bypass the remote image loading setting in Mail via an HTML LINK element with a DNS prefetching property, as demonstrated by an HTML e-mail message that uses a LINK element for X-Confirm-Reading-To functionality, a…

  • CVE-2010-3828Nov 26, 2010
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.01

    iAd Content Display in Apple iOS before 4.2 allows man-in-the-middle attackers to make calls via a crafted URL in an ad.

  • CVE-2010-3827Nov 26, 2010
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.01

    Apple iOS before 4.2 does not properly validate signatures before displaying a configuration profile in the configuration installation utility, which allows remote attackers to spoof profiles via unspecified vectors.

  • CVE-2010-3814Nov 26, 2010
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in the Ins_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SHZ bytecode instruction, related to TrueType opcodes, as demonstrated…

  • CVE-2010-3705Nov 26, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.02

    The sctp_auth_asoc_get_hmac function in net/sctp/auth.c in the Linux kernel before 2.6.36 does not properly validate the hmac_ids array of an SCTP peer, which allows remote attackers to cause a denial of service (memory corruption and panic) via a crafted value in the last…

  • CVE-2008-7266Nov 26, 2010
    Rsa
    Adaptive Authentication \(on Premise\)
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in an unspecified Shockwave Flash file in RSA Adaptive Authentication 2.x and 5.7.x allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2010-4301Nov 26, 2010
    Wireshark
    Wireshark
    risk 0.04cvss —epss 0.09

    epan/dissectors/packet-zbee-zcl.c in the ZigBee ZCL dissector in Wireshark 1.4.0 through 1.4.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted ZCL packet, related to Discover Attributes.

  • CVE-2010-4300Nov 26, 2010
    Wireshark
    Wireshark
    risk 0.04cvss —epss 0.14

    Heap-based buffer overflow in the dissect_ldss_transfer function (epan/dissectors/packet-ldss.c) in the LDSS dissector in Wireshark 1.2.0 through 1.2.12 and 1.4.0 through 1.4.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via…

  • CVE-2010-3698Nov 26, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The KVM implementation in the Linux kernel before 2.6.36 does not properly reload the FS and GS segment registers, which allows host OS users to cause a denial of service (host OS crash) via a KVM_RUN ioctl call in conjunction with a modified Local Descriptor Table (LDT).

  • CVE-2010-3445Nov 26, 2010
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.04

    Stack consumption vulnerability in the dissect_ber_unknown function in epan/dissectors/packet-ber.c in the BER dissector in Wireshark 1.4.x before 1.4.1 and 1.2.x before 1.2.12 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a long…

  • CVE-2010-2963Nov 26, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    drivers/media/video/v4l2-compat-ioctl32.c in the Video4Linux (V4L) implementation in the Linux kernel before 2.6.36 on 64-bit platforms does not validate the destination of a memory copy operation, which allows local users to write to arbitrary kernel memory locations, and…

  • CVE-2010-2962Nov 26, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    drivers/gpu/drm/i915/i915_gem.c in the Graphics Execution Manager (GEM) in the Intel i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.36 does not properly validate pointers to blocks of memory, which allows local users to write to…

  • CVE-2010-4305Nov 22, 2010
    Cisco Systems, Inc.
    Unified Videoconferencing System 3515 Multipoint Control Unit Firmware
    risk 0.00cvss —epss 0.01

    Cisco Unified Videoconferencing (UVC) System 3545, 5110, 5115, and 5230; Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gateway; Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gateway; and Unified Videoconferencing 3515 Multipoint Control Unit (MCU)…

  • CVE-2010-4304Nov 22, 2010
    Cisco Systems, Inc.
    Unified Videoconferencing System 3515 Multipoint Control Unit Firmware
    risk 0.00cvss —epss 0.01

    The web interface in Cisco Unified Videoconferencing (UVC) System 3545, 5110, 5115, and 5230; Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gateway; Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gateway; and Unified Videoconferencing 3515 Multipoint…

  • CVE-2010-4303Nov 22, 2010
    Cisco Systems, Inc.
    Unified Videoconferencing System 5110
    risk 0.00cvss —epss 0.00

    Cisco Unified Videoconferencing (UVC) System 5110 and 5115, when the Linux operating system is used, uses world-readable permissions for the /etc/shadow file, which allows local users to discover encrypted passwords by reading this file, aka Bug ID CSCti54043.

  • CVE-2010-4302Nov 22, 2010
    Cisco Systems, Inc.
    Unified Videoconferencing System 5110
    risk 0.00cvss —epss 0.00

    /opt/rv/Versions/CurrentVersion/Mcu/Config/Mcu.val in Cisco Unified Videoconferencing (UVC) System 5110 and 5115, when the Linux operating system is used, uses a weak hashing algorithm for the (1) administrator and (2) operator passwords, which makes it easier for local users to…

  • CVE-2010-4173Nov 22, 2010
    Openfabrics
    Libsdp
    risk 0.00cvss —epss 0.00

    The default configuration of libsdp.conf in libsdp 1.1.104 and earlier creates log files in /tmp, which allows local users to overwrite arbitrary files via a (1) symlink or (2) hard link attack on the libsdp.log.##### temporary file.

  • CVE-2010-4167Nov 22, 2010
    ImageMagick
    Imagemagick
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in configure.c in ImageMagick before 6.6.5-5, when MAGICKCORE_INSTALLED_SUPPORT is defined, allows local users to gain privileges via a Trojan horse configuration file in the current working directory.

  • CVE-2010-3038Nov 22, 2010
    Cisco Systems, Inc.
    Unified Videoconferencing System 5110
    risk 0.00cvss —epss 0.03

    Cisco Unified Videoconferencing (UVC) System 5110 and 5115, when the Linux operating system is used, has a default password for the (1) root, (2) cs, and (3) develop accounts, which makes it easier for remote attackers to obtain access via the (a) FTP or (b) SSH daemon, aka Bug…

  • CVE-2010-3037Nov 22, 2010
    Cisco Systems, Inc.
    Unified Videoconferencing System 3515 Multipoint Control Unit Firmware
    risk 0.00cvss —epss 0.03

    goform/websXMLAdminRequestCgi.cgi in Cisco Unified Videoconferencing (UVC) System 5110 and 5115, and possibly Unified Videoconferencing System 3545 and 5230, Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gateway, Unified Videoconferencing 3522 Basic Rate Interfaces…

  • CVE-2010-4169Nov 22, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Use-after-free vulnerability in mm/mprotect.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors involving an mprotect system call.

  • CVE-2010-4165Nov 22, 2010
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a…

  • CVE-2010-3826Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly perform a cast of an unspecified variable during processing of colors in an SVG document, which allows remote attackers to execute arbitrary code…

  • CVE-2010-3824Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving SVG use…

  • CVE-2010-3823Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving Geolocation…

  • CVE-2010-3822Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, accesses an uninitialized pointer during processing of Cascading Style Sheets (CSS) counter styles, which allows remote attackers to execute arbitrary code or cause…

  • CVE-2010-3821Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly handle the :first-letter pseudo-element in a Cascading Style Sheets (CSS) token sequence, which allows remote attackers to execute arbitrary code…

  • CVE-2010-3820Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, accesses uninitialized memory during processing of editable elements, which allows remote attackers to execute arbitrary code or cause a denial of service…

  • CVE-2010-3819Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly perform a cast of an unspecified variable during processing of Cascading Style Sheets (CSS) boxes, which allows remote attackers to execute…

  • CVE-2010-3818Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving inline text…

  • CVE-2010-3817Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly perform a cast of an unspecified variable during processing of Cascading Style Sheets (CSS) 3D transforms, which allows remote attackers to execute…

  • CVE-2010-3816Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving scrollbars.

  • CVE-2010-3813Nov 22, 2010
    Webkitgtk
    Webkitgtk
    risk 0.00cvss —epss 0.02

    The WebCore::HTMLLinkElement::process function in WebCore/html/HTMLLinkElement.cpp in WebKit, as used in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4; webkitgtk before 1.2.6; and possibly other products does not verify…

  • CVE-2010-3812Nov 22, 2010
    Webkitgtk
    Webkitgtk
    risk 0.01cvss —epss 0.07

    Integer overflow in the Text::wholeText method in dom/Text.cpp in WebKit, as used in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4; webkitgtk before 1.2.6; and possibly other products allows remote attackers to execute…

  • CVE-2010-3811Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving element…

  • CVE-2010-3810Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly handle the History object, which allows remote attackers to spoof the location bar's URL or add URLs to the history via a cross-origin attack.

  • CVE-2010-3809Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly perform a cast of an unspecified variable during processing of inline styling, which allows remote attackers to execute arbitrary code or cause a…

  • CVE-2010-3808Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly perform a cast of an unspecified variable during processing of editing commands, which allows remote attackers to execute arbitrary code or cause a…

  • CVE-2010-3805Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.06

    Integer underflow in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving WebSockets. NOTE: this…