VYPR

CVEs

385,938 total · page 6839 of 7,719

AllCriticalHighKEV
  • CVE-2010-3804Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.09

    The JavaScript implementation in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, uses a weak algorithm for generating values of random numbers, which makes it easier for remote attackers to track a user by…

  • CVE-2010-3803Nov 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.06

    Integer overflow in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string.

  • CVE-2010-3618Nov 22, 2010
    PGP Corporation
    Desktop
    risk 0.00cvss —epss 0.02

    PGP Desktop 10.0.x before 10.0.3 SP2 and 10.1.0 before 10.1.0 SP1 does not properly implement the "Decrypt/Verify File via Right-Click" functionality for multi-packet OpenPGP messages that represent multi-message input, which allows remote attackers to spoof signed data by…

  • CVE-2010-3432Nov 22, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.06

    The sctp_packet_config function in net/sctp/output.c in the Linux kernel before 2.6.35.6 performs extraneous initializations of packet data structures, which allows remote attackers to cause a denial of service (panic) via a certain sequence of SCTP traffic.

  • CVE-2010-4299Nov 22, 2010
    Novell
    Zenworks Handheld Management
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in ZfHIPCND.exe in Novell Zenworks 7 Handheld Management (ZHM) allows remote attackers to execute arbitrary code via a crafted request to TCP port 2400.

  • CVE-2010-4210HigNov 22, 2010
    FreeBSD
    FreeBSD
    risk 0.54cvss 7.8epss 0.01

    The pfs_getextattr function in FreeBSD 7.x before 7.3-RELEASE and 8.x before 8.0-RC1 unlocks a mutex that was not previously locked, which allows local users to cause a denial of service (kernel panic), overwrite arbitrary memory locations, and possibly execute arbitrary code…

  • CVE-2010-3872HigNov 22, 2010
    Apache
    Mod Fcgid
    risk 0.42cvss 7.5epss 0.03

    A flaw was found in the mod_fcgid module of httpd. A malformed FastCGI response may result in a stack-based buffer overflow in the modules/fcgid/fcgid_bucket.c file in the fcgid_header_bucket_read() function, resulting in an application crash.

  • CVE-2010-4168HigNov 17, 2010
    OpenTTD
    Openttd
    risk 0.49cvss 7.5epss 0.04

    Multiple use-after-free vulnerabilities in OpenTTD 1.0.x before 1.0.5 allow (1) remote attackers to cause a denial of service (invalid write and daemon crash) by abruptly disconnecting during transmission of the map from the server, related to network/network_server.cpp; (2)…

  • CVE-2010-4159Nov 17, 2010
    Mono
    Mono
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in metadata/loader.c in Mono 2.8 and earlier allows local users to gain privileges via a Trojan horse shared library in the current working directory.

  • CVE-2010-4107Nov 17, 2010
    Microfocus
    Laserjet 4300
    risk 0.04cvss —epss 0.13

    The default configuration of the PJL Access value in the File System External Access settings on HP LaserJet MFP printers, Color LaserJet MFP printers, and LaserJet 4100, 4200, 4300, 5100, 8150, and 9000 printers enables PJL commands that use the device's filesystem, which…

  • CVE-2010-3978Nov 17, 2010
    Spree
    Spree
    risk 0.00cvss —epss 0.03

    Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json, (2)…

  • CVE-2010-3869Nov 17, 2010
    Dogtag
    Certificate System
    risk 0.00cvss —epss 0.01

    Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.

  • CVE-2010-3868Nov 17, 2010
    Dogtag
    Certificate System
    risk 0.00cvss —epss 0.01

    Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the…

  • CVE-2010-3864Nov 17, 2010
    OpenSSL Project
    OpenSSL
    risk 0.02cvss —epss 0.22

    Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and internal caching are enabled on a TLS server, might allow remote attackers to execute arbitrary code via client data that triggers a heap-based buffer overflow,…

  • CVE-2010-4274Nov 17, 2010
    IBM
    Systems Director
    risk 0.00cvss —epss 0.00

    reset_diragent_keys in the Common agent in IBM Systems Director 6.2.0 has 754 permissions, which allows local users to gain privileges by leveraging system group membership.

  • CVE-2010-4273Nov 17, 2010
    DescargarVista
    ACC IMoveis
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in imoveis.php in DescargarVista ACC IMoveis 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-4272Nov 17, 2010
    Pulse Infotech
    Sponsor Wall
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Pulse Infotech Sponsor Wall (com_sponsorwall) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.

  • CVE-2010-4271Nov 17, 2010
    Impresscms
    Impresscms
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in ImpressCMS before 1.2.3 RC2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-4270Nov 17, 2010
    nBill
    nBill
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the nBill (com_netinvoice) component before 2.0.9 standard edition, 2.0.10 lite edition, and 1.2_10 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in unspecified vectors related to (1)…

  • CVE-2010-4269Nov 17, 2010
    Collabtive
    Collabtive
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in managechat.php in Collabtive 0.65 allows remote attackers to execute arbitrary SQL commands via the chatstart[USERTOID] cookie in a pull action.

  • CVE-2010-4268Nov 17, 2010
    Joomla
    Pulse Infotech Flip Wall
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Pulse Infotech Flip Wall (com_flipwall) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.

  • CVE-2010-4234Nov 17, 2010
    Camtron
    Cmnc 200
    risk 0.03cvss —epss 0.03

    The web server on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to cause a denial of service (device reboot) via a large number of requests in a short time interval.

  • CVE-2010-4233Nov 17, 2010
    Camtron
    Cmnc 200
    risk 0.04cvss —epss 0.09

    The Linux installation on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 has a default password of m for the root account, and a default password of merlin for the mg3500 account, which makes it easier for remote attackers…

  • CVE-2010-4232Nov 17, 2010
    Camtron
    CMNC-200 Full HD IP Camera
    risk 0.03cvss —epss 0.04

    The web-based administration interface on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to bypass authentication via a // (slash slash) at the beginning of a URI, as demonstrated by the…

  • CVE-2010-4231Nov 17, 2010
    Camtron
    CMNC-200 Full HD IP Camera
    risk 0.04cvss —epss 0.16

    Directory traversal vulnerability in the web-based administration interface on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

  • CVE-2010-4230Nov 17, 2010
    Camtron
    CMNC-200 Full HD IP Camera
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in a certain ActiveX control for the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to execute arbitrary code via a long string in the first argument to the connect method.

  • CVE-2010-4215Nov 17, 2010
    Foswiki
    Foswiki
    risk 0.00cvss —epss 0.01

    UI/Manage.pm in Foswiki 1.1.0 and 1.1.1 allows remote authenticated users to gain privileges by modifying the GROUP and ALLOWTOPICCHANGE preferences in the topic preferences for Main.AdminGroup.

  • CVE-2010-4011Nov 17, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Dovecot in Apple Mac OS X 10.6.5 10H574 does not properly manage memory for user names, which allows remote authenticated users to read the private e-mail of other persons in opportunistic circumstances via standard e-mail clients accessing a user's own mailbox, related to a…

  • CVE-2010-4008Nov 17, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service…

  • CVE-2010-4010Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Integer signedness error in Apple Type Services (ATS) in Apple Mac OS X 10.5.8 allows remote attackers to execute arbitrary code via a crafted embedded Compact Font Format (CFF) font in a document.

  • CVE-2010-3798Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in xar in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted xar archive.

  • CVE-2010-3797Nov 16, 2010
    Apple Inc.
    Wiki Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Wiki Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-3796Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Safari RSS in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 does not block Java applets in an RSS feed, which allows remote attackers to obtain sensitive information via a feed: URL containing an applet that performs DOM modifications.

  • CVE-2010-3795Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    QuickTime in Apple Mac OS X 10.6.x before 10.6.5 accesses uninitialized memory locations during processing of GIF image data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted GIF file.

  • CVE-2010-3794Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    QuickTime in Apple Mac OS X 10.6.x before 10.6.5 accesses uninitialized memory locations during processing of FlashPix image data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FlashPix file.

  • CVE-2010-3793Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Sorenson movie file.

  • CVE-2010-3792Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Integer signedness error in QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MPEG movie file.

  • CVE-2010-3791Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Buffer overflow in QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MPEG movie file.

  • CVE-2010-3790Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.05

    QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file that causes an image sample transformation to scale a sprite outside a buffer…

  • CVE-2010-3789Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted AVI file.

  • CVE-2010-3788Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    QuickTime in Apple Mac OS X 10.6.x before 10.6.5 accesses uninitialized memory locations during processing of JP2 image data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JP2 file.

  • CVE-2010-3787Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JP2 image.

  • CVE-2010-3786Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    QuickLook in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Excel file.

  • CVE-2010-3785Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Buffer overflow in QuickLook in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Office document.

  • CVE-2010-3784Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    The PMPageFormatCreateWithDataRepresentation API in Printing in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 does not properly handle XML data, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified API calls.

  • CVE-2010-3783Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Password Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 does not properly perform replication, which allows remote authenticated users to bypass verification of the current password via unspecified vectors.

  • CVE-2010-1847Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    The kernel in Apple Mac OS X 10.6.x before 10.6.5 does not properly perform memory management associated with terminal devices, which allows local users to cause a denial of service (system crash) via unspecified vectors.

  • CVE-2010-1846Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in Image RAW in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted RAW image.

  • CVE-2010-1845Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    ImageIO in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted PSD image.

  • CVE-2010-1844Nov 16, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Image Capture in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to cause a denial of service (memory consumption and system crash) via a crafted image.