VYPR

CVEs

385,564 total · page 6928 of 7,712

AllCriticalHighKEV
  • CVE-2009-3932Nov 12, 2009
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    The Gears plugin in Google Chrome before 3.0.195.32 allows user-assisted remote attackers to cause a denial of service (memory corruption and plugin crash) or possibly execute arbitrary code via unspecified use of the Gears SQL API, related to putting "SQL metadata into a bad…

  • CVE-2009-3931Nov 12, 2009
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Incomplete blacklist vulnerability in browser/download/download_exe.cc in Google Chrome before 3.0.195.32 allows remote attackers to force the download of certain dangerous files via a "Content-Disposition: attachment" designation, as demonstrated by (1) .mht and (2) .mhtml…

  • CVE-2009-3134Nov 11, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.26

    Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats…

  • CVE-2009-3133Nov 11, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.25

    Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a spreadsheet containing a malformed object that triggers memory corruption, related to "loading Excel records," aka…

  • CVE-2009-3132Nov 11, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.26

    Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats…

  • CVE-2009-3131Nov 11, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.25

    Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats…

  • CVE-2009-3130Nov 11, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.29

    Heap-based buffer overflow in Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via a spreadsheet containing a malformed Binary File Format (aka BIFF) record that triggers…

  • CVE-2009-3135Nov 11, 2009
    Microsoft
    Office
    risk 0.03cvss —epss 0.36

    Stack-based buffer overflow in Microsoft Office Word 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, Open XML File Format Converter for Mac, Office Word Viewer 2003 SP3, and Office Word Viewer allow remote attackers to execute arbitrary code via a Word document with a…

  • CVE-2009-3129HigKEVNov 11, 2009
    Microsoft
    Office
    risk 0.72cvss 7.8epss 0.84

    Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats…

  • CVE-2009-3128Nov 11, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.25

    Microsoft Office Excel 2002 SP3 and 2003 SP3, and Office Excel Viewer 2003 SP3, does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a spreadsheet with a malformed record object, aka "Excel SxView Memory Corruption…

  • CVE-2009-3127Nov 11, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.25

    Microsoft Office Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, Open XML File Format Converter for Mac, and Office Excel Viewer 2003 SP3 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet,…

  • CVE-2009-2523Nov 11, 2009
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.26

    The License Logging Server (llssrv.exe) in Microsoft Windows 2000 SP4 allows remote attackers to execute arbitrary code via an RPC message containing a string without a null terminator, which triggers a heap-based buffer overflow in the LlsrLicenseRequestW method, aka "License…

  • CVE-2009-2514Nov 11, 2009
    Microsoft
    Windows 2000
    risk 0.07cvss —epss 0.47

    win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not correctly parse font code during construction of a directory-entry table, which allows remote attackers to execute arbitrary code via a crafted Embedded OpenType (EOT) font, aka…

  • CVE-2009-2513Nov 11, 2009
    Microsoft
    Windows 2000
    risk 0.00cvss —epss 0.02

    The Graphics Device Interface (GDI) in win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 does not properly validate user-mode input, which allows local users to gain privileges via a…

  • CVE-2009-2512CriNov 11, 2009
    Microsoft
    Windows
    risk 0.66cvss 9.8epss 0.31

    The Web Services on Devices API (WSDAPI) in Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 does not properly process the headers of WSD messages, which allows remote attackers to execute arbitrary code via a crafted (1) message or (2) response, aka "Web Services…

  • CVE-2009-1928Nov 11, 2009
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.30

    Stack consumption vulnerability in the LDAP service in Active Directory on Microsoft Windows 2000 SP4, Server 2003 SP2, and Server 2008 Gold and SP2; Active Directory Application Mode (ADAM) on Windows XP SP2 and SP3 and Server 2003 SP2; and Active Directory Lightweight…

  • CVE-2009-1127Nov 11, 2009
    Microsoft
    Windows 2000
    risk 0.00cvss —epss 0.02

    win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 does not correctly validate an argument to an unspecified system call, which allows local users to gain privileges via a crafted…

  • CVE-2009-3930Nov 10, 2009
    File Project
    File
    risk 0.00cvss —epss 0.02

    Multiple integer overflows in Christos Zoulas file before 5.02 allow user-assisted remote attackers to have an unspecified impact via a malformed compound document (aka cdf) file that triggers a buffer overflow.

  • CVE-2009-2840Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Spotlight in Apple Mac OS X 10.5.8 does not properly handle temporary files, which allows local users to overwrite arbitrary files in the context of a different user's privileges via unspecified vectors.

  • CVE-2009-2839Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Screen Sharing in Apple Mac OS X 10.5.8 allows remote VNC servers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.

  • CVE-2009-2838Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Integer overflow in QuickLook in Apple Mac OS X 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Office document that triggers a buffer overflow.

  • CVE-2009-2837Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in QuickDraw Manager in Apple Mac OS X before 10.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image.

  • CVE-2009-2836Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Race condition in Login Window in Apple Mac OS X 10.6.x before 10.6.2, when at least one account has a blank password, allows attackers to bypass password authentication and obtain login access to an arbitrary account via unspecified vectors.

  • CVE-2009-2835Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    The kernel in Apple Mac OS X before 10.6.2 does not properly handle task state segments, which allows local users to gain privileges, cause a denial of service (system crash), or obtain sensitive information via unspecified vectors.

  • CVE-2009-2834Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    IOKit in Apple Mac OS X before 10.6.2 allows local users to modify the firmware of a (1) USB or (2) Bluetooth keyboard via unspecified vectors.

  • CVE-2009-2833Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Buffer overflow in the UCCompareTextDefault API in International Components for Unicode in Apple Mac OS X 10.5.8 allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.

  • CVE-2009-2832Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Buffer overflow in FTP Server in Apple Mac OS X before 10.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a CWD command specifying a pathname in a deeply nested hierarchy of directories, related to a "CWD command line tool."

  • CVE-2009-2831Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Dictionary in Apple Mac OS X 10.5.8 allows remote attackers to create arbitrary files with any contents, and thereby execute arbitrary code, via crafted JavaScript, related to a "design issue."

  • CVE-2009-2830Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in Christos Zoulas file before 5.03 in Apple Mac OS X 10.6.x before 10.6.2 allow user-assisted remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Common Document Format (CDF) file. NOTE: this might…

  • CVE-2009-2829Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Event Monitor in Apple Mac OS X 10.5.8 does not properly handle crafted authentication data sent to an SSH daemon, which allows remote attackers to cause a denial of service via vectors involving processing of XML log documents by other services, related to a "log injection"…

  • CVE-2009-2828Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    The server in DirectoryService in Apple Mac OS X 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.

  • CVE-2009-2827Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in Disk Images in Apple Mac OS X 10.5.8 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FAT filesystem on a disk image.

  • CVE-2009-2826Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Multiple integer overflows in CoreGraphics in Apple Mac OS X 10.5.8 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document that triggers a heap-based buffer overflow.

  • CVE-2009-2825Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Certificate Assistant in Apple Mac OS X before 10.6.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted…

  • CVE-2009-2824Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in Apple Type Services (ATS) in Apple Mac OS X 10.5.8 allow remote attackers to execute arbitrary code via a crafted embedded font in a document.

  • CVE-2009-2823Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    The Apache HTTP Server in Apple Mac OS X before 10.6.2 enables the HTTP TRACE method, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified web client software.

  • CVE-2009-2820Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.03cvss —epss 0.06

    The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks…

  • CVE-2009-2819Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    AFP Client in Apple Mac OS X 10.5.8 allows remote AFP servers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via unspecified vectors.

  • CVE-2009-2818Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Adaptive Firewall in Apple Mac OS X before 10.6.2 does not properly handle invalid usernames in SSH login attempts, which makes it easier for remote attackers to obtain login access via a brute-force attack (aka dictionary attack).

  • CVE-2009-2810Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Launch Services in Apple Mac OS X 10.6.x before 10.6.2 recursively clears quarantine information upon opening a quarantined folder, which allows user-assisted remote attackers to execute arbitrary code via a quarantined application that does not trigger a "potentially unsafe"…

  • CVE-2009-2808Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Help Viewer in Apple Mac OS X before 10.6.2 does not use an HTTPS connection to retrieve Apple Help content from a web site, which allows man-in-the-middle attackers to send a crafted help:runscript link, and thereby execute arbitrary code, via a spoofed response.

  • CVE-2009-3727Nov 10, 2009
    Asterisk
    Asterisknow
    risk 0.00cvss —epss 0.04

    Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, 1.6.0.x before 1.6.0.17, and 1.6.1.x before 1.6.1.9; Business Edition A.x.x, B.x.x before B.2.5.12, C.2.x.x before C.2.4.5, and C.3.x.x before C.3.2.2; AsteriskNOW 1.5; and s800i 1.3.x before 1.3.0.5 generate…

  • CVE-2009-3924Nov 10, 2009
    Punkbuster
    Punkbuster
    risk 0.00cvss —epss 0.04

    Buffer overflow in pbsv.dll, as used in Soldier of Fortune II and possibly other applications when Even Balance PunkBuster 1.728 or earlier is enabled, allows remote attackers to cause a denial of service (application server crash) and possibly execute arbitrary code via a long…

  • CVE-2009-3619Nov 10, 2009
    Viewvc
    Viewvc
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 has unknown impact and remote attack vectors related to "printing illegal parameter names and values."

  • CVE-2009-3618Nov 10, 2009
    Viewvc
    Viewvc
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in viewvc.py in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the view parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-3923Nov 10, 2009
    Sun Corporation
    Virtualbox
    risk 0.00cvss —epss 0.02

    The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure (VDI) 3.0 does not require authentication, which allows remote attackers to obtain unspecified access via vectors involving requests to an Apache HTTP Server.

  • CVE-2009-3886Nov 9, 2009
    Sun Corporation
    Java SE 6
    risk 0.00cvss —epss 0.02

    The Java Web Start implementation in Sun Java SE 6 before Update 17 does not properly handle the interaction between a signed JAR file and a JNLP (1) application or (2) applet, which has unspecified impact and attack vectors, related to a "regression," aka Bug Id 6870531.

  • CVE-2009-3885Nov 9, 2009
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.02

    Sun Java SE 5.0 before Update 22 and 6 before Update 17 on Windows allows remote attackers to cause a denial of service via a BMP file containing a link to a UNC share pathname for an International Color Consortium (ICC) profile file, probably a related issue to CVE-2007-2789,…

  • CVE-2009-3884Nov 9, 2009
    Openjdk
    OpenJDK
    risk 0.00cvss —epss 0.03

    The TimeZone.getTimeZone method in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local files via vectors related to handling of zoneinfo (aka tz) files, aka Bug Id 6824265.

  • CVE-2009-3883Nov 9, 2009
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in the Windows Pluggable Look and Feel (PL&F) feature in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and remote attack vectors, related to "information leaks in mutable…