VYPR

CVEs

347,108 total · page 5886 of 6,943

AllCriticalHighKEV
  • CVE-2012-5330Oct 8, 2012
    AsaanCart
    asaanCart
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in asaanCart 0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to calc.php, (2) chat.php, (3) register.php, or (4) index.php in libs/smarty_ajax/; or the (5) page parameter to…

  • CVE-2012-5329Oct 8, 2012
    Typsoft
    Typsoft FTP Server
    risk 0.04cvss —epss 0.09

    Buffer overflow in TYPSoft FTP Server 1.1 allows remote authenticated users to cause a denial of service (application crash) via a long string in an APPE command.

  • CVE-2012-1671Oct 8, 2012
    Nicolas Tormo
    Phppaleo
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in phpPaleo 4.8b155 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.

  • CVE-2012-5328Oct 8, 2012
    WordPress
    Mingle Forum
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress might allow remote authenticated users to execute arbitrary SQL commands via the (1) memberid or (2) groupid parameters in a removemember action or (3) id…

  • CVE-2012-5327Oct 8, 2012
    WordPress
    Mingle Forum
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) delete_usrgrp[] parameter in a delete_usergroups…

  • CVE-2012-5326Oct 8, 2012
    Idevspot
    Isupport
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin/function.php in IDevSpot iSupport 1.x allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via an administrators action.

  • CVE-2012-5325Oct 8, 2012
    WordPress
    Shortcode Redirect
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the scr_do_redirect function in scr.php in the Shortcode Redirect plugin 1.0.01 and earlier for WordPress allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (1) url or…

  • CVE-2012-5324Oct 8, 2012
    Tracker Software
    PDF Xchange
    risk 0.04cvss —epss 0.06

    Multiple buffer overflows in the Pdf Printer Preferences ActiveX Control in pdfxctrl.dll in Tracker Software PDF-XChange 3.60.0128 allow remote attackers to execute arbitrary code via a long string in the (1) sub_path parameter to the StoreInRegistry function or (2) sub_key…

  • CVE-2012-0846Oct 8, 2012
    Webcalendar
    Webcalendar
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the Location variable.

  • CVE-2012-5323Oct 8, 2012
    Xavi
    X7968
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in webconfig/admin_passwd/passwd.html/admin_passwd in Xavi X7968 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysUserName, sysPassword, and…

  • CVE-2012-5322Oct 8, 2012
    Xavi
    X7968
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Xavi X7968 allow remote attackers to inject arbitrary web script or HTML via the (1) pvcName parameter to webconfig/wan/confirm.html/confirm or (2) host_name_txtbox parameter to webconfig/lan/lan_config.html/local_lan_config.

  • CVE-2012-5321Oct 8, 2012
    Tiki
    Tikiwiki CMS\/groupware
    risk 0.04cvss —epss 0.14

    tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka "frame injection."

  • CVE-2012-5320Oct 8, 2012
    Sagem
    F\@st 2604
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in password.cgi in Sagem F@ST 2604 253180972B allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysPassword parameter.

  • CVE-2012-5319Oct 8, 2012
    Dlink
    Dcs 2000
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in setup/security.cgi in D-Link DCS-900, DCS-2000, and DCS-5300 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the rootpass parameter.

  • CVE-2012-1416Oct 8, 2012
    Socialcms
    Socialcms
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in SocialCMS 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrator accounts via a member_new action to my_admin/admin1_members.php or (2) modify the default…

  • CVE-2012-1308Oct 8, 2012
    Dlink
    Dsl 2640b
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in redpass.cgi in D-Link DSL-2640B Firmware EU_4.00 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysPassword parameter.

  • CVE-2012-1189Oct 8, 2012
    Speed Dreams
    Speed Dreams
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in modules/graphic/ssgraph/grsound.cpp in The Open Racing Car Simulator (TORCS) before 1.3.3 and Speed Dreams allows user-assisted remote attackers to execute arbitrary code via a long file name in an engine sample attribute in an xml configuration…

  • CVE-2011-5208Oct 8, 2012
    Backwpup
    Backwpup
    risk 0.00cvss —epss 0.03

    Multiple directory traversal vulnerabilities in the BackWPup plugin before 1.4.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the wpabs parameter to (1) app/options-view_log-iframe.php or (2) app/options-runnow-iframe.php.

  • CVE-2011-4929Oct 8, 2012
    Redmine
    Redmine
    risk 0.07cvss —epss 0.46

    Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitrary commands via unknown vectors.

  • CVE-2011-4928Oct 8, 2012
    Redmine
    Redmine
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the textile formatter in Redmine before 1.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-4927Oct 8, 2012
    Redmine
    Redmine
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the bazaar repository adapter in Redmine 1.0.x before 1.0.5 allows remote authenticated users to obtain sensitive information via unknown vectors.

  • CVE-2011-4342Oct 8, 2012
    Backwpup
    Backwpup
    risk 0.04cvss —epss 0.10

    PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the wpabs parameter.

  • CVE-2012-5318Oct 8, 2012
    WordPress
    Kish Guest Posting
    risk 0.04cvss —epss 0.07

    Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the…

  • CVE-2012-5317Oct 8, 2012
    Bigware
    Shop
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in main_bigware_43.php in Bigware Shop before 2.1.5 allows remote attackers to execute arbitrary SQL commands via the lastname parameter in a process action.

  • CVE-2012-5316Oct 8, 2012
    Barracuda Networks
    Spam \& Virus Firewall 600
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Barracuda Spam & Virus Firewall 600 Firmware 4.0.1.009 and earlier allow remote authenticated users to inject arbitrary web script or HTML via (1) Troubleshooting in the Trace route Device module or (2) LDAP Username in the…

  • CVE-2012-5315Oct 8, 2012
    PHP Ireport Project
    PHP Ireport
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in php ireport 1.0 allow remote attackers to inject arbitrary web script or HTML via the message parameter to (1) messages_viewer.php, (2) home.php, or (3) history.php.

  • CVE-2012-5314Oct 8, 2012
    ViewGit
    ViewGit
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in ViewGit 0.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the f parameter.

  • CVE-2012-5313Oct 8, 2012
    Snitz Communications
    Forums 2000
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in forum.asp in Snitz Forums 2000 allows remote attackers to execute arbitrary SQL commands via the TOPIC_ID parameter.

  • CVE-2012-5312Oct 8, 2012
    Tribiq
    CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Tribiq CMS allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

  • CVE-2012-5310Oct 8, 2012
    WordPress
    Wp Ecommerce
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-1125Oct 8, 2012
    WordPress
    Kish Guest Posting
    risk 0.00cvss —epss 0.12

    Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a PHP extension, then accessing it via a direct request to the file in…

  • CVE-2012-5309Oct 8, 2012
    IBM
    Lotus Notes Traveler
    risk 0.00cvss —epss 0.01

    servlet/traveler in IBM Lotus Notes Traveler through 8.5.3.3 Interim Fix 1 does not properly restrict invalid authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.

  • CVE-2012-5308Oct 8, 2012
    IBM
    Lotus Notes Traveler
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in servlet/traveler in IBM Lotus Notes Traveler through 8.5.3.3 Interim Fix 1 allows remote attackers to hijack the authentication of arbitrary users for requests that create problem reports via a getReportProblem upload action.

  • CVE-2012-5307Oct 8, 2012
    IBM
    Lotus Notes Traveler
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in servlet/traveler in IBM Lotus Notes Traveler before 8.5.3.3 Interim Fix 1, when Firefox is used, allows remote attackers to inject arbitrary web script or HTML via the redirectURL parameter, a different vulnerability than CVE-2012-4824…

  • CVE-2012-4825Oct 8, 2012
    IBM
    Lotus Notes Traveler
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in servlet/traveler/ILNT.mobileconfig in IBM Lotus Notes Traveler before 8.5.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) userId or (2) address parameter in a getClientConfigFile action.

  • CVE-2012-4824Oct 8, 2012
    IBM
    Lotus Notes Traveler
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in servlet/traveler in IBM Lotus Notes Traveler 8.5.3 before 8.5.3.3 Interim Fix 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirectURL parameter.

  • CVE-2011-4640Oct 8, 2012
    Spamtitan
    Webtitan
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in logs-x.php in SpamTitan WebTitan before 3.60 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the fname parameter in a view action.

  • CVE-2011-4639Oct 8, 2012
    Spamtitan
    Webtitan
    risk 0.00cvss —epss 0.01

    The (1) Traceroute and (2) Ping implementations in tools.php in SpamTitan WebTitan before 3.60 allow remote authenticated users to execute arbitrary commands via shell metacharacters in an argument, as demonstrated by an && (ampersand ampersand) sequence.

  • CVE-2011-4638Oct 8, 2012
    Spamtitan
    Webtitan
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in SpamTitan WebTitan before 3.60 allow remote attackers to execute arbitrary SQL commands via (1) the username parameter to login-x.php, and allow remote authenticated users to execute arbitrary SQL commands via the (2) bldomain, (3)…

  • CVE-2010-5279Oct 8, 2012
    Vwar
    Virtual War
    risk 0.00cvss —epss 0.01

    article.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to cause a denial of service (memory consumption) via a large integer in the ratearticleselect parameter.

  • CVE-2010-5067Oct 8, 2012
    Vwar
    Virtual War
    risk 0.00cvss —epss 0.01

    Virtual War (aka VWar) 1.6.1 R2 uses static session cookies that depend only on a user's password, which makes it easier for remote attackers to bypass timeout and logout actions, and retain access for a long period of time, by leveraging knowledge of a session cookie.

  • CVE-2010-5066Oct 8, 2012
    Vwar
    Virtual War
    risk 0.00cvss —epss 0.01

    The createRandomPassword function in includes/functions_common.php in Virtual War (aka VWar) 1.6.1 R2 uses a small range of values to select the seed argument for the PHP mt_srand function, which makes it easier for remote attackers to determine randomly generated passwords via…

  • CVE-2010-5065Oct 8, 2012
    Vwar
    Virtual War
    risk 0.00cvss —epss 0.01

    popup.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to bypass intended member restrictions and read news posts via a modified newsid parameter in a printnews action.

  • CVE-2010-5064Oct 8, 2012
    Vwar
    Virtual War
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Virtual War (aka VWar) 1.6.1 R2 allow remote attackers to inject arbitrary web script or HTML via (1) the Additional Information field to challenge.php, the (2) Additional Information or (3) Contact information field to…

  • CVE-2010-5063Oct 8, 2012
    Vwar
    Virtual War
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in article.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to execute arbitrary SQL commands via the ratearticleselect parameter.

  • CVE-2012-1414Oct 7, 2012
    Plume CMS
    CMS
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in manager/news.php in Plume CMS 1.2.4 and earlier allows remote attackers to hijack the authentication of administrators for requests that create News pages via a publish action.

  • CVE-2011-4911Oct 7, 2012
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.02

    Joomla! before 1.5.12 does not perform a JEXEC check in unspecified files, which allows remote attackers to obtain the installation path via unspecified vectors.

  • CVE-2011-4910Oct 7, 2012
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Joomla! before 1.5.12 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  • CVE-2011-4909Oct 7, 2012
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.5.12 allow remote attackers to inject arbitrary web script or HTML via the HTTP_REFERER header to (1) components/com_content/views/article/tmpl/form.php, (2) components/com_user/controller.php, (3)…

  • CVE-2011-4363Oct 7, 2012
    Proc::ProcessTable
    Proc::ProcessTable
    risk 0.00cvss —epss 0.00

    ProcessTable.pm in the Proc::ProcessTable module 0.45 for Perl, when TTY information caching is enabled, allows local users to overwrite arbitrary files via a symlink attack on /tmp/TTYDEVS.