Lucene search
+L
CertMost viewed

3716 matches found

CERT
CERT
added 2013/04/03 12:0 a.m.37 views

C2 WebResource web interface XSS vulnerability

Overview The C2 WebResource web interface contains a XSS vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'The C2 WebResource web interface is vulnerable to XSS on the following URL and parameter:...

4.3CVSS5.8AI score0.01682EPSS
SaveExploits2References3
CERT
CERT
added 2012/10/30 12:0 a.m.37 views

CA ARCserve Backup opcode 0x7a RWSList remote code execution vulnerability

Overview The CA ARCserve Backup authentication service, caauthd.exe, is susceptible to a pre-authentication remote code execution vulnerability. Arbitrary code will run with NT AUTHORITY\SYSTEM privileges. CA ARCserve Backup r16 SP1 was reported to be vulnerable. Description The Offensive Securit...

7.5CVSS7.5AI score0.04053EPSS
SaveExploits4References2
CERT
CERT
added 2012/08/16 12:0 a.m.37 views

CuteSoft Cute Editor 6.4 reflected cross site scripting

Overview CuteSoft Cute Editor 6.4, and possibly other verions, contains a reflected cross-site scripting XSS CWE-79 vulnerability. Description CuteSoft Cute Editor 6.4 has been reported to contain a reflected cross-site scripting XSS CWE-79 vulnerability. The GET request parameter called UploadID...

3.5CVSS6AI score0.00825EPSS
SaveExploits0References2
CERT
CERT
added 2012/06/08 12:0 a.m.37 views

ForeScout CounterACT reflected XSS vulnerability

Overview The ForeScout CounterACT appliance contains reflected cross-site scripting XSS vulnerabilities. Description The web interface of the ForeScout CounterACT appliance contains reflected XSS vulnerabilities CWE-79. The following are a couple...

4.3CVSS5.8AI score0.00987EPSS
SaveExploits0References2
CERT
CERT
added 2012/05/16 12:0 a.m.37 views

HP Business Service Management 9.12 remote code execution vulnerability

Overview The HP Business Service Management HPBSM application contains a remote code execution vulnerability. Version 9.12 has been reported to be affected but other versions may also be affected. Description HPBSM uses the JBOSS application server. In the default configuration, HPBSM contains op...

10CVSS7.1AI score0.08659EPSS
SaveExploits0References1
CERT
CERT
added 2011/12/08 12:0 a.m.37 views

Hewlett-Packard printers and scanner devices allow remote unautheticated firmware updates

Overview A vulnerability in certain Hewlett-Packard devices could allow a remote attacker to install unauthorized firmware on an affected system. Description Certain Hewlett-Packard Printers and Hewlett-Packard Digital Senders products allow the device's firmware to be updated over the network. T...

10CVSS7.2AI score0.13892EPSS
SaveExploits0References4
CERT
CERT
added 2011/11/08 12:0 a.m.37 views

Dell KACE K2000 Appliance read-only database account allows account information disclosure

Overview A vulnerability in the database component of the Dell KACE K2000 Deployment Appliance may allow a remote attacker to read account information from an affected device. Description The Dell KACE K2000 Deployment Appliance is an integrated systems provisioning product for large-scale...

4.3CVSS6.2AI score0.01059EPSS
SaveExploits0References1
CERT
CERT
added 2011/10/13 12:0 a.m.37 views

OneOrZero AIMS authentication bypass and SQLi vulnerabilities

Overview OneOrZero Action & Information Management System AIMS is vulnerable to an authentication bypass and SQL injection. Description According to the vendor's website:"OneOrZero AIMS is a powerful enterprise ready suite that includes a help desk, knowledge base, time manager and reporting syst...

8.2AI score
SaveExploits0References3
CERT
CERT
added 2011/07/29 12:0 a.m.37 views

Avaya Secure Access Link (SAL) Gateway information disclosure vulnerability

Overview Avaya Secure Access Link SAL gateway releases 1.5, 1.8, and 2.0 have an information disclosure vulnerability in the default install. Description According to Avaya's Product Support Notice PSN003314u PDF:"On installation of SAL Gateway with the default properties provided along with the...

6.9AI score
SaveExploits0References1
CERT
CERT
added 2010/12/01 12:0 a.m.37 views

ISC BIND cache vulnerability

Overview The ISC BIND nameserver contains a vulnerability that could allow a remote attacker to cause a denial of service. Description According to ISC:Adding certain types of signed negative responses to cache doesn't clear any matching RRSIG records already in cache. A subsequent lookup of the...

4CVSS8.4AI score0.091EPSS
SaveExploits0References2
CERT
CERT
added 2009/04/06 12:0 a.m.37 views

Particle Software IntraLaunch Application Launcher ActiveX control fails to restrict access to dangerous methods

Overview The Particle Software IntraLaunch Application Launcher ActiveX control allows arbitrary code execution. Description Particle Software IntraLaunch is an ActiveX control that "... allows web page links to execute anything from applications to associations such as Word or Acrobat PDF...

9.3CVSS6.3AI score0.04148EPSS
SaveExploits1References3
CERT
CERT
added 2009/03/19 12:0 a.m.37 views

Autonomy KeyView SDK buffer overflow vulnerability

Overview Autonomy KeyView SDK contains a buffer overflow vulnerability that may allow an attacker to execute arbitrary code. Description Autonomy KeyView SDK is a commercial software development kit SDK that includes file filtering libraries. A vulnerability exists in the way the SDK libraries...

9.3CVSS7.4AI score0.06757EPSS
SaveExploits2References6
CERT
CERT
added 2008/10/02 12:0 a.m.37 views

libpng off-by-one vulnerability

Overview A vulnerability exists in libpng that may allow a remote attacker to cause a denial of service. Description A vulnerability in the way libpng handles files that contain multiple zTXt chunks may cause a denial of service. This vulnerability is due to an off-by-one error introduced in the...

4.3CVSS9AI score0.03343EPSS
SaveExploits1References2
CERT
CERT
added 2008/05/30 12:0 a.m.37 views

OpenSSL Server Name extension Denial of Service

Overview A vulnerability exists in OpenSSL that may allow a remote attacker to cause a denial of service. Description OpenSSL contains a vulnerability in the way server name extension data is handled that may result in a denial of service. According to OpenSSL Security Advisory 28-Mar-2008:If...

4.3CVSS8.1AI score0.04559EPSS
SaveExploits1References4
CERT
CERT
added 2008/05/27 12:0 a.m.37 views

Foxit Reader buffer overflow vulnerability

Overview Foxit Reader contains a buffer overflow vulnerability that may allow an attacker to execute arbitrary code. Description Foxit Reader is a PDF reader that is available on multiple operating systems.From the Secuia Research advisory Foxit Reader "util.printf" Buffer Overflow: S ecunia...

9.3CVSS7.7AI score0.22693EPSS
SaveExploits3References3
CERT
CERT
added 2008/04/11 12:0 a.m.37 views

Microsoft GDI buffer overflow vulnerability

Overview The Microsoft GDI contains a buffer overflow vulnerability that may allow an attacker to execute arbitrary code. Description The Graphics Device Interface GDI is component of the Microsoft Windows user interface. Windows Metafile WMF and Enhanced Metafile EMF are image file formats...

9.3CVSS7.6AI score0.57102EPSS
SaveExploits4References5
CERT
CERT
added 2008/02/05 12:0 a.m.37 views

Yahoo! Music Jukebox YMP Datagrid ActiveX control stack buffer overflows

Overview The Yahoo! Music Jukebox YMP Datagrid ActiveX control contains multiple stack buffer overflows, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Yahoo! Music Jukebox is a music player for Microsoft Windows, which includes...

6.8AI score
SaveExploits0References3
CERT
CERT
added 2008/02/04 12:0 a.m.37 views

Aurigma ImageUploader ActiveX control stack buffer overflows

Overview The Aurigma ImageUploader ActiveX control contains multiple stack buffer overflow vulnerabilities, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description Aurigma ImageUploader is an ActiveX control that provides the ability to upload pictures usin...

7.1AI score
SaveExploits0References10
CERT
CERT
added 2007/12/14 12:0 a.m.37 views

Microsoft DirectX remote code execution

Overview Microsoft DirectX is vulnerable to a remote code execution vulnerability which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft DirectX is a feature of the Microsoft Windows operating system used for streaming multimedia...

9.3CVSS7.7AI score0.36234EPSS
SaveExploits1References1
CERT
CERT
added 2007/12/12 12:0 a.m.37 views

Microsoft SMBv2 signing vulnerability

Overview A vulnerability in the way Microsoft Server Message Block Version 2 SMBv2 implements digital signing of packets may allow a remote, unauthenticated attacker to gain local user privileges and execute arbitrary code. Description Microsoft Server Message Block SMB Protocol is a network file...

10CVSS6.9AI score0.41243EPSS
SaveExploits1References2
CERT
CERT
added 2007/12/04 12:0 a.m.37 views

Mortbay Jetty vulnerable to HTTP response splitting

Overview Mortbay Jetty is vulnerable to HTTP response splitting, which may allow a remote, unauthenticated attacker to inject various HTTP headers Description Mortbay Jetty is a web server that is written in Java. Jetty fails to properly handle HTTP headers with CRLF sequences, which can allow an...

5CVSS7.5AI score0.03597EPSS
SaveExploits0References2
CERT
CERT
added 2007/11/01 12:0 a.m.37 views

CUPS buffer overflow vulnerability

Overview The Common Unix Printing System contains a buffer overflow vulnerability. This vulnerability may allow a remote attacker to execute arbitrary code. Description The Common Unix Printing System CUPS is a printing service used by many Linux and Unix operating systems. CUPS uses a print...

10CVSS9.3AI score0.07377EPSS
SaveExploits1References9
CERT
CERT
added 2007/09/04 12:0 a.m.37 views

MIT Kerberos 5 kadmind buffer overflow vulnerability

Overview An unspecified vulnerability in MIT Kerberos kadmind server may allow an attacker to execute arbitrary code. Description Kerberos is a network authentication system that uses a trusted third party to authenticate clients and servers to each other. It is designed to provide strong...

10CVSS9.7AI score0.10997EPSS
SaveExploits4References3
CERT
CERT
added 2007/06/20 12:0 a.m.37 views

Cerulean Studios Trillian Instant Messenger fails to properly handle "UTF-8" sequences

Overview A vulnerability in Cerulean Studios Trillian Instant Messenger client may lead to execution of arbitrary code. Description Cerulean Studios Trillian Instant Messenger client fails to properly handle specially crafted UTF-8 text. A heap overflow may occur when Trillian receives a messages...

9.3CVSS6.2AI score0.06228EPSS
SaveExploits0References3
CERT
CERT
added 2007/06/01 12:0 a.m.37 views

IPv6 Type 0 Route Headers allow sender to control routing

Overview IPv6 Type 0 Route Headers allow the sender to control packet routing. This vulnerability may allow an attacker to cause a denial-of-service condition. Description Routing header options provided by IPv6 allow packet senders to indicate specific nodes through which the packet should trave...

7.8CVSS5.7AI score0.05035EPSS
SaveExploits0References9
CERT
CERT
added 2007/05/10 12:0 a.m.37 views

Microsoft Windows Media Services NMSA Session Description Object ActiveX control contains dangerous methods

Overview The Microsoft Windows Media Services NMSA Session Description Object ActiveX control fails to restrict access to dangerous methods. This vulnerability could allow a remote attacker to execute arbitrary code on an affected system. Description Microsoft Windows Media Services is a software...

9.3CVSS6.6AI score0.34869EPSS
SaveExploits1References3
CERT
CERT
added 2007/05/09 12:0 a.m.37 views

Microsoft Word fails to properly parse crafted rich text content

Overview Microsoft Word fails to properly parse rich text content and may allow a remote, unauthenticated attacker to execute arbitrary code. Description Microsoft Word does not properly validate rich text within the contents of a file. When Word opens and parses a specially crafted file, memory...

6.8CVSS7AI score0.29479EPSS
SaveExploits0References2
CERT
CERT
added 2007/04/26 12:0 a.m.37 views

Cisco NetFlow Collection Engine contains known default passwords

Overview A vulnerability in the Cisco NetFlow Collection Engine could allow a remote attacker to gain access to a vulnerable system. Description The Cisco Network Services CNS NetFlow Collection Engine NFC is a software package for supported UNIX platforms and is used to collect and monitor NetFl...

10CVSS6.9AI score0.04733EPSS
SaveExploits0References1
CERT
CERT
added 2007/04/03 12:0 a.m.37 views

SolidWorks sldimdownload ActiveX control fails to restrict access to methods

Overview The SolidWorks sldimdownload ActiveX control contains methods that can allow a remote, unauthenticated attacker to run arbitrary code on a vulnerable system. Description SolidWorks provides 3D CAD software solutions. The SolidWorks sldimdownload ActiveX control is provided by the file...

9.3CVSS7.1AI score0.04662EPSS
SaveExploits0References5
CERT
CERT
added 2007/03/20 12:0 a.m.37 views

NETxAutomation NETxEIB OPC Server fails to properly validate OPC server handles

Overview The NETxAutomation NETxEIB OPC Server contains a vulnerability that may allow a remote attacker to execute arbitary code or cause a denial-of-service. Description OLE for Process Control OPC is a specification for a standard set of OLE COM objects for use in the process control and...

7.5CVSS7.1AI score0.04442EPSS
SaveExploits0References4
CERT
CERT
added 2007/03/19 12:0 a.m.37 views

Takebishi Electric DeviceXPlorer OPC Server fails to properly validate OPC server handles

Overview The Takebishi Electric DeviceXPlorer OPC server contains a vulnerability that may allow a remote attacker to execute arbitary code or cause a denial-of-service. Description OLE for Process Control OPC is a specification for a standard set of OLE COM objects for use in the process control...

10CVSS7.1AI score0.09055EPSS
SaveExploits0References4
CERT
CERT
added 2007/02/26 12:0 a.m.37 views

Apple iChat fails to properly handle crafted TXT key hashes

Overview A vulnerability in the way Apple iChat handles specially crafted TXT key hashes could lead to denial of service. Description Apple iChat is an instant message client for Apple Mac OS X. Apple iChat Agent is a back-end process that manages iChat sessions and available contacts. Apple...

2.1CVSS6.2AI score0.03264EPSS
SaveExploits2References8
CERT
CERT
added 2007/02/20 12:0 a.m.37 views

Microsoft Internet Explorer fails to properly interpret certain responses from FTP servers

Overview A vulnerability in the way Microsoft Internet Explorer handles responses from FTP servers may lead to execution of arbitrary code. Description Microsoft Internet Explorer contains an unspecified vulnerability that could be exploited when it attempts to interpret responses from FTP server...

10CVSS6.2AI score0.58121EPSS
SaveExploits1References5
CERT
CERT
added 2007/01/09 12:0 a.m.37 views

Microsoft Excel fails to properly handle malformed IMDATA records

Overview A vulnerability in the way that Microsoft Excel handles malformed image records could allow an attacker to execute arbitrary code on a vulnerable system. Description Microsoft Excel fails to properly validate the size of IMDATA records. When a file containing a malformed IMDATA record is...

9.3CVSS7AI score0.3117EPSS
SaveExploits0References4
CERT
CERT
added 2006/12/14 12:0 a.m.37 views

Microsoft Word malformed pointer vulnerability

Overview A vulnerability in Microsoft Word could allow an attacker to compromise a vulnerable system. Description Data used by Microsoft Word to construct a destination address for a memory copy routine is embedded within a Word document itself. If an attacker constructs a Word document with a...

9.3CVSS6.4AI score0.40431EPSS
SaveExploits2References3
CERT
CERT
added 2006/12/01 12:0 a.m.37 views

Autonomy Ultraseek default configuration does not adequately restrict in-document highlighting

Overview A vulnerability exists in the Ultraseek /highlight/index.html script. Successful exploitation of this vulnerability may allow an attacker to enumerate and access content from non-public servers or execute cross-site scripting attacks. Description Ultraseek is a search engine used on...

10CVSS5.9AI score0.06339EPSS
SaveExploits0References3
CERT
CERT
added 2006/10/11 12:0 a.m.37 views

Microsoft Office fails to properly parse malformed strings

Overview A vulnerability in the way Microsoft Office parses files with malformed strings may lead to execution of arbitrary code. Description Microsoft Office contains a vulnerability that could be exploited when parsing specially crafted strings. According to Microsoft Security Bulletin...

9.3CVSS6.9AI score0.29568EPSS
SaveExploits0References1
CERT
CERT
added 2006/10/10 12:0 a.m.37 views

Microsoft PowerPoint fails to properly handle malformed data records

Overview Microsoft PowerPoint contains a vulnerability in the handling of malformed data records, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft PowerPoint contains a vulnerability that could be exploited when PowerPoint...

9.3CVSS6.8AI score0.11423EPSS
SaveExploits4References2
CERT
CERT
added 2006/09/27 12:0 a.m.37 views

Cisco IOS contains buffer overflow in VTP VLAN name handling

Overview Cisco IOS fails to properly handle specially crafted VTP summary advertisement with overly long VLAN name. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition. Description Cisco's VLAN Trunking Protocol VTP...

7.5CVSS7.6AI score0.07365EPSS
SaveExploits0References4
CERT
CERT
added 2006/09/13 12:0 a.m.37 views

Apple QuickTime fails to properly handle SGI images

Overview Apple QuickTime fails to properly handle SGI images. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition. Description Apple QuickTime is multimedia software that allows users to view local and remote audio, vide...

5.1CVSS7.5AI score0.06268EPSS
SaveExploits0References4
CERT
CERT
added 2006/07/27 12:0 a.m.37 views

Mozilla fails to properly handle garbage collection

Overview The Mozilla JavaScript engine fails to properly perform garbage collection, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description Garbage collection According to Mozilla: Garbage collection is generally used to refer to algorithms that 1 determin...

7.5CVSS7AI score0.06476EPSS
SaveExploits0References14
CERT
CERT
added 2006/07/27 12:0 a.m.37 views

Mozilla fails to properly handle simultaneous XPCOM events

Overview Mozilla products are vulnerable to memory corruption via simultaneous XPCOM events. This may allow a remote attacker to execute arbitrary code on a vulnerable system. Description XPCOMXPCOM is a cross-platform component object model similar to Microsoft COM or CORBA. XPCOM provides the...

7.5CVSS6.9AI score0.06305EPSS
SaveExploits0References8
CERT
CERT
added 2006/07/13 12:0 a.m.37 views

Adobe Flash Player fails to properly handle malformed SWF files

Overview Adobe Flash Player fails to properly handle malformed SWF files resulting in a memory corruption vulnerability. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code. Description Adobe Flash Player is a player for the Flash media format and enables...

5.1CVSS7.2AI score0.082EPSS
SaveExploits0References6
CERT
CERT
added 2006/06/29 12:0 a.m.37 views

Microsoft Internet Explorer fails to properly handle CLSID extensions

Overview Microsoft Internet Explorer fails to properly handle directories with CLSID extensions. This may allow an attacker to bypass the warning dialog that Internet Explorer should display before executing downloaded code. Description CLSID According to Microsoft MSDN, A CLSID is a "globally...

5.1CVSS6.4AI score0.48215EPSS
SaveExploits2References5
CERT
CERT
added 2006/05/02 12:0 a.m.37 views

Mozilla Firefox designMode deleted object reference

Overview Mozilla Firefox contains a deleted object reference vulnerability. This may allow a remote attacker to execute arbitrary code. Description Mozilla Firefox contains a vulnerability that causes a deleted object to be referenced when designMode is set to "on." When Firefox attempts to use...

5.1CVSS7AI score0.54003EPSS
SaveExploits2References6
CERT
CERT
added 2006/04/17 12:0 a.m.37 views

Mozilla products border-rendering code vulnerability using CSS

Overview A vulnerability in the way Mozilla products and derivative programs handle certain CSS methods could allow a remote attacker to crash the application or execute arbitrary code on a vulnerable system. Description The Mozilla browser and derived products include support for Content Style...

9.3CVSS7AI score0.08251EPSS
SaveExploits0References1
CERT
CERT
added 2006/03/29 12:0 a.m.37 views

Symantec VERITAS NetBackup Volume Manager daemon buffer overflow

Overview The Symantec VERITAS NetBackup Volume Manager daemon contains a buffer overflow vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code. Description Symantec VERITAS NetBackup Symantec VERITAS NetBackup is a client/server based backup software solution...

9CVSS7.4AI score0.07927EPSS
SaveExploits4References3
CERT
CERT
added 2006/03/14 12:0 a.m.37 views

Microsoft Excel fails to properly perform range validation when parsing document files

Overview Microsoft Excel contains an error in range validation, which may allow a remote unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft Excel fails to properly validate ranges in data files. When a file with a malformed range is opened in Excel,...

6.8CVSS7AI score0.31108EPSS
SaveExploits1References5
CERT
CERT
added 2006/01/25 12:0 a.m.37 views

Oracle Database Data Pump Metadata API SQL injection vulnerability

Overview Oracle Database Data Pump Metadata API is vulnerable to SQL injection, which could allow a remote attacker to execute arbitrary SQL commands on a vulnerable Oracle installation. Description The Oracle Database Data Pump Metadata API fails to properly filter user-supplied input. This may...

10CVSS6.8AI score0.04171EPSS
SaveExploits0References3
CERT
CERT
added 2006/01/19 12:0 a.m.37 views

Oracle Transparent Data Encryption master encryption key stored as plaintext

Overview Oracle Transparent Data Encryption master encryption key is stored as plaintext, which could allow an attacker to decrypt and read sensitive information within the database. Description Transparent Data Encryption TDE According to Oracle, Transparent Data Encryption "allows customers to...

10CVSS5.5AI score0.04863EPSS
SaveExploits0References3
Total number of security vulnerabilities3716