VYPR

CVEs

384,390 total · page 7003 of 7,688

AllCriticalHighKEV
  • CVE-2008-3821Jan 16, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 11.0 through 12.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the ping program or (2) unspecified other aspects of the URI.

  • CVE-2008-3818Jan 16, 2009
    Cisco Systems, Inc.
    Ons
    risk 0.00cvss —epss 0.02

    Cisco ONS 15310-CL, 15310-MA, 15327, 15454, 15454 SDH, and 15600 with software 7.0.2 through 7.0.6, 7.2.2, 8.0.x, 8.5.1, and 8.5.2 allows remote attackers to cause a denial of service (control-card reset) via a crafted TCP session.

  • CVE-2009-0136Jan 16, 2009
    Amarok
    Amarok
    risk 0.01cvss —epss 0.07

    Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio (.aa) file with a crafted…

  • CVE-2009-0135Jan 16, 2009
    Amarok
    Amarok
    risk 0.01cvss —epss 0.07

    Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag value, each of which triggers…

  • CVE-2009-0134Jan 16, 2009
    AAA
    EasyGrid ActiveX
    risk 0.04cvss —epss 0.09

    Insecure method vulnerability in the EasyGrid.SGCtrl.32 ActiveX control in EasyGrid.ocx 1.0.0.1 in AAA EasyGrid ActiveX 3.51 allows remote attackers to create and overwrite arbitrary files via the (1) DoSaveFile or (2) DoSaveHtmlFile method. NOTE: vector 1 could be leveraged…

  • CVE-2009-0133Jan 15, 2009
    Microsoft
    HTML Help Workshop
    risk 0.08cvss —epss 0.67

    Buffer overflow in Microsoft HTML Help Workshop 4.74 and earlier allows context-dependent attackers to execute arbitrary code via a .hhp file with a long "Index file" field, possibly a related issue to CVE-2006-0564.

  • CVE-2009-0132Jan 15, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Integer overflow in the aio_suspend function in Sun Solaris 8 through 10 and OpenSolaris, when 32-bit mode is enabled, allows local users to cause a denial of service (panic) via a large integer value in the second argument (aka nent argument).

  • CVE-2009-0131Jan 15, 2009
    Sun Corporation
    Opensolaris
    risk 0.00cvss —epss 0.00

    The UFS implementation in the kernel in Sun OpenSolaris snv_29 through snv_90 allows local users to cause a denial of service (panic) via the single posix_fallocate test in the SUSv3 POSIX test suite, related to an F_ALLOCSP fcntl call.

  • CVE-2009-0130HigJan 15, 2009
    Erlang
    Erlang\/otp
    risk 0.49cvss 7.5epss 0.01

    lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value from the OpenSSL DSA_do_verify function, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.…

  • CVE-2009-0129Jan 15, 2009
    Perl OpenSSL
    Libcrypt Openssl Dsa Perl
    risk 0.00cvss —epss 0.01

    libcrypt-openssl-dsa-perl does not properly check the return value from the OpenSSL DSA_verify and DSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to…

  • CVE-2009-0128Jan 15, 2009
    Llnl
    Slurm
    risk 0.00cvss —epss 0.01

    plugins/crypto/openssl/crypto_openssl.c in Simple Linux Utility for Resource Management (aka SLURM or slurm-llnl) does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a…

  • CVE-2009-0127Jan 15, 2009
    Heikkitoivonen
    M2crypto
    risk 0.00cvss —epss 0.01

    M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a…

  • CVE-2009-0126Jan 15, 2009
    Berkeley Open Infrastructure For Network Computing
    BOINC
    risk 0.00cvss —epss 0.02

    The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSA_public_decrypt function, which allows remote attackers to bypass validation of the…

  • CVE-2009-0125Jan 15, 2009
    Nessus Attack Scripting Language Library
    libnasl
    risk 0.00cvss —epss 0.01

    NOTE: this issue has been disputed by the upstream vendor. nasl/nasl_crypto2.c in the Nessus Attack Scripting Language library (aka libnasl) 2.2.11 does not properly check the return value from the OpenSSL DSA_do_verify function, which allows remote attackers to bypass…

  • CVE-2009-0124Jan 15, 2009
    American Radio Relay League (ARRL)
    tqsllib
    risk 0.00cvss —epss 0.01

    The tqsl_verifyDataBlock function in openssl_cert.cpp in American Radio Relay League (ARRL) tqsllib 2.0 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed…

  • CVE-2009-0123Jan 15, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Apple Safari on Mac OS X 10.5 and Windows allows remote attackers to read arbitrary files on a client machine via vectors related to the association of Safari with the (1) feed, (2) feeds, and (3) feedsearch URL types for RSS feeds. NOTE: as of…

  • CVE-2009-0122Jan 15, 2009
    Microfocus
    Hplip
    risk 0.00cvss —epss 0.01

    hplip.postinst in HP Linux Imaging and Printing (HPLIP) 2.7.7 and 2.8.2 on Ubuntu allows local users to change the ownership of arbitrary files via unspecified manipulations in advance of an HPLIP installation or upgrade by an administrator, related to the product's attempt to…

  • CVE-2009-0029Jan 15, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was properly sign extended when sent from a user-mode application, but cannot verify this, which allows local users to cause a…

  • CVE-2008-5907Jan 15, 2009
    Libpng
    Libpng
    risk 0.00cvss —epss 0.03

    The png_check_keyword function in pngwutil.c in libpng before 1.0.42, and 1.2.x before 1.2.34, might allow context-dependent attackers to set the value of an arbitrary memory location to zero via vectors involving creation of crafted PNG files with keywords, related to an…

  • CVE-2008-5906Jan 15, 2009
    Ktorrent
    Ktorrent
    risk 0.00cvss —epss 0.02

    Eval injection vulnerability in the web interface plugin in KTorrent before 3.1.4 allows remote attackers to execute arbitrary PHP code via unspecified parameters to this interface's PHP scripts.

  • CVE-2008-5905Jan 15, 2009
    Ktorrent
    Ktorrent
    risk 0.00cvss —epss 0.02

    The web interface plugin in KTorrent before 3.1.4 allows remote attackers to bypass intended access restrictions and upload arbitrary torrent files, and trigger the start of downloads and seeding, via a crafted HTTP POST request.

  • CVE-2008-5904Jan 15, 2009
    Xrdp
    Xrdp
    risk 0.04cvss —epss 0.07

    The rdp_rdp_process_color_pointer_pdu function in rdp/rdp_rdp.c in xrdp 0.4.1 and earlier allows remote RDP servers to have an unknown impact via input data that sets crafted values for certain length variables, leading to a buffer overflow.

  • CVE-2008-5903Jan 15, 2009
    Xrdp
    Xrdp
    risk 0.00cvss —epss 0.03

    Array index error in the xrdp_bitmap_def_proc function in xrdp/funcs.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via vectors that manipulate the value of the edit_pos structure member.

  • CVE-2008-5902Jan 15, 2009
    Xrdp
    Xrdp
    risk 0.00cvss —epss 0.03

    Buffer overflow in the xrdp_bitmap_invalidate function in xrdp/xrdp_bitmap.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via a crafted request.

  • CVE-1999-1593Jan 15, 2009
    Microsoft
    Windows
    risk 0.01cvss —epss 0.18

    Windows Internet Naming Service (WINS) allows remote attackers to cause a denial of service (connectivity loss) or steal credentials via a 1Ch registration that causes WINS to change the domain controller to point to a malicious server. NOTE: this problem may be limited when…

  • CVE-2009-0121Jan 15, 2009
    Goople CMS
    Goople CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in frontpage.php in Goople CMS 1.8.2 allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2009-0120Jan 15, 2009
    IBM
    Websphere Datapower XML Security Gateway Xs40
    risk 0.03cvss —epss 0.04

    The IBM WebSphere DataPower XML Security Gateway XS40 with firmware 3.6.1.5 allows remote attackers to cause a denial of service (device reboot) by sending data over an established SSL connection, as demonstrated by the abc\r\n\r\n string data.

  • CVE-2003-1567HigJan 15, 2009
    Microsoft
    Internet Information Server
    risk 0.51cvss 7.5epss 0.25

    The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body of the response, which makes it easier for remote attackers to steal cookies and authentication credentials, or bypass the HttpOnly…

  • CVE-2003-1566Jan 15, 2009
    Microsoft
    Internet Information Server
    risk 0.05cvss —epss 0.28

    Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain sensitive information without detection.

  • CVE-2009-0119Jan 14, 2009
    Microsoft
    Windows Xp
    risk 0.06cvss —epss 0.37

    Buffer overflow in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .chm file.

  • CVE-2009-0041Jan 14, 2009
    Asterisk
    Business Edition
    risk 0.00cvss —epss 0.03

    IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and C.2.x.x before C.2.1.2.1; and s800i 1.2.x before 1.3.0 responds differently to a failed login…

  • CVE-2008-4835CriJan 14, 2009
    Microsoft
    Windows 2000
    risk 0.67cvss 9.8epss 0.45

    SMB in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to execute arbitrary code via malformed values of unspecified "fields inside the SMB packets" in an NT Trans2 request,…

  • CVE-2008-4834Jan 14, 2009
    Microsoft
    Windows 2000
    risk 0.04cvss —epss 0.46

    Buffer overflow in SMB in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via malformed values of unspecified "fields inside the SMB packets" in an NT Trans request, aka "SMB Buffer…

  • CVE-2008-5463Jan 14, 2009
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the PeopleSoft Enterprise Campus Solutions component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9.18 and 9.0.8 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

  • CVE-2008-5462Jan 14, 2009
    Bea
    WebLogic Portal
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the WebLogic Portal component in BEA Product Suite 10.3, 10.2, 10.0 MP1, 9.2 MP3, and 8.1 SP6 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

  • CVE-2008-5461Jan 14, 2009
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0, and SP7 allows remote attackers to affect confidentiality, integrity, and availability, related to WLS. NOTE: the previous information was obtained…

  • CVE-2008-5460Jan 14, 2009
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, and 9.0 allows remote attackers to affect confidentiality via unknown vectors.

  • CVE-2008-5459Jan 14, 2009
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3 allows remote attackers to affect confidentiality via unknown vectors.

  • CVE-2008-5458Jan 14, 2009
    Oracle Corporation
    Application Object Library
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10 and CU2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

  • CVE-2008-5457Jan 14, 2009
    Bea
    BEA Product Suite
    risk 0.08cvss —epss 0.61

    Unspecified vulnerability in the Oracle BEA WebLogic Server Plugins for Apache, Sun and IIS web servers component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote attackers to affect confidentiality, integrity, and availability via…

  • CVE-2008-5456Jan 14, 2009
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9.18 and 9.0.8 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

  • CVE-2008-5455Jan 14, 2009
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the PeopleSoft Enterprise HRMS - ePerformance component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9.18 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

  • CVE-2008-5454Jan 14, 2009
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the iProcurement component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

  • CVE-2008-5452Jan 14, 2009
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9.18 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

  • CVE-2008-5451Jan 14, 2009
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the JD Edwards Tools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.97.2.5 allows remote authenticated users to affect confidentiality via unknown vectors.

  • CVE-2008-5450Jan 14, 2009
    Oracle Corporation
    Applications Platform Engineering
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Oracle Applications Platform Engineering component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows local users to affect confidentiality via unknown vectors.

  • CVE-2008-5447Jan 14, 2009
    Oracle Corporation
    Enterprise Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Enterprise Manager component in Oracle Enterprise Manager 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

  • CVE-2008-5446Jan 14, 2009
    Oracle Corporation
    Applications Framework
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows remote authenticated users to affect confidentiality via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. …

  • CVE-2008-5445Jan 14, 2009
    Oracle Corporation
    Secure Backup
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect availability via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable…

  • CVE-2008-5443Jan 14, 2009
    Oracle Corporation
    Secure Backup
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect availability via unknown vectors, a different vulnerability than CVE-2008-5441 and CVE-2008-5442.