VYPR

CVEs

347,058 total · page 5913 of 6,942

AllCriticalHighKEV
  • CVE-2009-5066Aug 13, 2012
    Red Hat
    JBoss AS
    risk 0.00cvss —epss 0.00

    twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments.

  • CVE-2012-4262Aug 13, 2012
    Hccgmbh
    Mycare2x
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in myCare2x allow remote attackers to inject arbitrary web script or HTML via the (1) name_last, (2) name_first, (3) name_middle, or (4) name_maiden parameter to modules/patient/mycare_pid.php; (5) favorites or (6) lang…

  • CVE-2012-4261Aug 13, 2012
    MyCare2x
    myCare2x
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in modules/patient/mycare2x_pat_info.php in myCare2x allows remote attackers to execute arbitrary SQL commands via the lang parameter.

  • CVE-2012-4260Aug 13, 2012
    MyCare2x
    myCare2x
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in myCare2x allow remote attackers to execute arbitrary SQL commands via the (1) aktion or (2) callurl parameter to modules/patient/mycare2x_pat_info.php; (3) dept_nr or (4) pid parameter to modules/importer/mycare2x_importer.php; (5)…

  • CVE-2012-4259Aug 13, 2012
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the contacts in (1) XPhone UC Web and the (2) web frontend for XPhone Virtual Directory in C4B XPhone Unified Communications (UC) 2011 Web 4.1.890S R1 allows remote attackers to inject arbitrary web script or HTML via the company name.…

  • CVE-2012-4258Aug 13, 2012
    Myrephp
    Real Estate Software
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MYRE Real Estate Software (2012 Q2) allow remote attackers to execute arbitrary SQL commands via the (1) link_idd parameter to 1_mobile/listings.php or (2) userid parameter to 1_mobile/agentprofile.php.

  • CVE-2012-4257Aug 13, 2012
    George Karpouzas
    Yet Another Question \& Answer System
    risk 0.00cvss —epss 0.01

    Yaqas (Yet Another Question & Answer System) 1.0 Alpha 1 allows remote attackers to obtain sensitive information via an invalid character in the PHPSESSID, which reveals the installation path in an error message.

  • CVE-2012-4256Aug 13, 2012
    WordPress
    Jnews
    risk 0.00cvss —epss 0.01

    The jNews (com_jnews) component 7.5.1 for Joomla! allows remote attackers to obtain sensitive information via the emailsearch parameter, which reveals the installation path in an error message.

  • CVE-2012-4255Aug 13, 2012
    Mysqldumper
    Mysqldumper
    risk 0.00cvss —epss 0.01

    MySQLDumper 1.24.4 allows remote attackers to obtain sensitive information via a direct request to learn/cubemail/refresh_dblist.php, which reveals the installation path in an error message.

  • CVE-2012-4254Aug 13, 2012
    Mysqldumper
    Mysqldumper
    risk 0.03cvss —epss 0.02

    MySQLDumper 1.24.4 allows remote attackers to obtain sensitive information (Notices) via a direct request to (1) learn/cubemail/restore.php or (2) learn/cubemail/dump.php.

  • CVE-2012-4253Aug 13, 2012
    Mysqldumper
    Mysqldumper
    risk 0.04cvss —epss 0.08

    Multiple directory traversal vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) language parameter to learn/cubemail/install.php or (2) f parameter learn/cubemail/filemanagement.php, or execute arbitrary local files…

  • CVE-2012-4252Aug 13, 2012
    Mysqldumper
    Mysqldumper
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to hijack the authentication of administrators for requests that (1) remove file access restriction via a deletehtaccess action, (2) drop a database via a kill value in a db…

  • CVE-2012-4251Aug 13, 2012
    Mysqldumper
    Mysqldumper
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter to index.php, (2) phase parameter to install.php, (3) tablename or (4) dbid parameter to sql.php, or (5) filename…

  • CVE-2012-4250Aug 13, 2012
    Samsung Mobile
    Net I Viewer
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in the RequestScreenOptimization function in the XProcessControl.ocx ActiveX control in msls31.dll in Samsung NET-i viewer 1.37 allows remote attackers to execute arbitrary code via a long string in the first argument.

  • CVE-2012-2327Aug 13, 2012
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    MyBB (aka MyBulletinBoard) before 1.6.7 allows remote attackers to obtain sensitive information via a malformed forumread cookie, which reveals the installation path in an error message.

  • CVE-2012-2326Aug 13, 2012
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Admin Control Panel (ACP) in MyBB (aka MyBulletinBoard) before 1.6.7 allows remote administrators to inject arbitrary web script or HTML via a malformed file name in an orphaned attachment.

  • CVE-2012-2325Aug 13, 2012
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the User Inline Moderation feature in the Admin Control Panel (ACP) in MyBB (aka MyBulletinBoard) before 1.6.7 allows remote administrators to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-2324Aug 13, 2012
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.7 allow remote administrators to execute arbitrary SQL commands via unspecified vectors in the (1) user search or (2) Mail Log in the Admin Control Panel (ACP).

  • CVE-2012-3476Aug 12, 2012
    Ushahidi
    Ushahidi Platform
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in (1) application/views/admin/layout.php and (2) themes/default/views/header.php in the Ushahidi Platform before 2.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to a site name.

  • CVE-2012-3475Aug 12, 2012
    Ushahidi
    Ushahidi Platform
    risk 0.00cvss —epss 0.02

    The installer in the Ushahidi Platform before 2.5 omits certain calls to the exit function, which allows remote attackers to obtain administrative privileges via unspecified vectors.

  • CVE-2012-3474Aug 12, 2012
    Ushahidi
    Ushahidi Platform
    risk 0.00cvss —epss 0.02

    The comments API in application/libraries/api/MY_Comments_Api_Object.php in the Ushahidi Platform before 2.5 allows remote attackers to obtain sensitive information about the e-mail address, IP address, and other attributes of the author of a comment via an API function call.

  • CVE-2012-3473Aug 12, 2012
    Ushahidi
    Ushahidi Platform
    risk 0.00cvss —epss 0.02

    The (1) reports API and (2) administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, which allows remote attackers to generate reports and organize comments via API functions.

  • CVE-2012-3472Aug 12, 2012
    Ushahidi
    Ushahidi Platform
    risk 0.00cvss —epss 0.01

    The email API in application/libraries/api/MY_Email_Api_Object.php in the Ushahidi Platform before 2.5 does not require authentication, which allows remote attackers to list, delete, or organize messages via a GET request.

  • CVE-2012-3471Aug 12, 2012
    Ushahidi
    Ushahidi Platform
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the edit functions in (1) application/controllers/admin/reports.php and (2) application/controllers/members/reports.php in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via an incident id.

  • CVE-2012-3470Aug 12, 2012
    Ushahidi
    Ushahidi Platform
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in application/libraries/api/MY_Countries_Api_Object.php in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to _get_countries functions.

  • CVE-2012-3469Aug 12, 2012
    Ushahidi
    Ushahidi Platform
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the messages admin functionality in application/controllers/admin/messages.php, (2)…

  • CVE-2012-3468Aug 12, 2012
    Ushahidi
    Ushahidi Platform
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the verify function in application/controllers/alerts.php, (2) the save_all function in application/models/settings.php,…

  • CVE-2012-2590Aug 12, 2012
    Escon
    SupportPortal Professional Edition
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ESCON SupportPortal Professional Edition 3.0 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted SRC attribute of an IFRAME element, (3) a crafted…

  • CVE-2012-2587Aug 12, 2012
    Afterlogic
    Mailsuite Pro
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with a crafted SRC attribute of (1) an IFRAME element or (2) a SCRIPT element.

  • CVE-2012-2585Aug 12, 2012
    Manageengine
    Servicedesk Plus
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted Cascading Style Sheets (CSS) expression property, (3) a CSS…

  • CVE-2012-2573Aug 12, 2012
    T Dah
    WebMail
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in T-dah WebMail 3.2.0-2.3 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted Cascading Style Sheets (CSS) expression property, (3) a CSS expression…

  • CVE-2012-2571Aug 12, 2012
    Winwebmail
    Winwebmail Server
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in WinWebMail Server 3.8.1.6 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted Cascading Style Sheets (CSS) expression property, (3) a CSS…

  • CVE-2012-4249Aug 12, 2012
    Amazon
    Kindle Touch
    risk 0.00cvss —epss 0.04

    The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, as demonstrated by using lipc-set-prop to set an LIPC property, a different…

  • CVE-2012-4248Aug 12, 2012
    Amazon
    Kindle Touch
    risk 0.00cvss —epss 0.03

    The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface, which might allow remote attackers to have an unspecified impact via vectors involving the (1) dev.log, (2) lipc.set, (3) lipc.get, or (4) todo.scheduleItems…

  • CVE-2012-4070Aug 12, 2012
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in system/src/dispatcher.php in Dir2web 3.0 allows remote attackers to execute arbitrary SQL commands via the oid parameter in a homepage action to index.php.

  • CVE-2012-4069Aug 12, 2012
    risk 0.00cvss —epss 0.01

    Dir2web 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database via a direct request for system/db/website.db.

  • CVE-2012-2584Aug 12, 2012
    Alt N
    Mdaemon
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) the Cascading Style Sheets (CSS) expression property in conjunction with a CSS comment within the…

  • CVE-2012-2969Aug 12, 2012
    Caucho Technology
    Resin
    risk 0.00cvss —epss 0.04

    Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to bypass intended restrictions on filename extensions for created files via a %00 sequence in a pathname within an HTTP request.

  • CVE-2012-2968Aug 12, 2012
    Caucho Technology
    Resin
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to create files in arbitrary directories via a .. (dot dot) in a pathname within an HTTP request.

  • CVE-2012-2967Aug 12, 2012
    Caucho Technology
    Resin
    risk 0.00cvss —epss 0.02

    Caucho Quercus, as distributed in Resin before 4.0.29, does not properly implement the == (equals sign equals sign) operator for comparisons, which has unspecified impact and context-dependent attack vectors.

  • CVE-2012-2966Aug 12, 2012
    Caucho Technology
    Resin
    risk 0.00cvss —epss 0.02

    Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters, which has unspecified impact and remote attack vectors.

  • CVE-2012-2965Aug 12, 2012
    Caucho Technology
    Resin
    risk 0.00cvss —epss 0.02

    Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has unknown impact and remote attack vectors, related to an "HTTP Parameter Contamination" issue.

  • CVE-2012-2964Aug 12, 2012
    BreakingPoint
    Storm appliance
    risk 0.00cvss —epss 0.02

    The BreakingPoint Storm appliance before 3.0 requires cleartext credentials for establishing a session from a GUI administrative client, which allows remote attackers to obtain sensitive information by sniffing the network for XML documents.

  • CVE-2012-2963Aug 12, 2012
    BreakingPoint
    Storm appliance
    risk 0.00cvss —epss 0.02

    The administrative interface in the embedded web server on the BreakingPoint Storm appliance before 3.0 does not require authentication for the gwt/BugReport script, which allows remote attackers to obtain sensitive information by downloading a .tgz file.

  • CVE-2012-2602Aug 12, 2012
    SolarWinds
    Orion Network Performance Monitor
    risk 0.03cvss —epss 0.06

    Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts via CreateUserStepContainer actions to…

  • CVE-2012-2577Aug 12, 2012
    SolarWinds
    Orion Network Performance Monitor
    risk 0.04cvss —epss 0.10

    Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName field of an snmpd.conf file.

  • CVE-2012-4247Aug 12, 2012
    Phplist
    Phplist
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user, (2) remote_database, (3) remote_userprefix, (4) remote_password, or (5) remote_prefix…

  • CVE-2012-4246Aug 12, 2012
    Phplist
    Phplist
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page.

  • CVE-2012-4035Aug 12, 2012
    Pbboard
    Pbboard
    risk 0.03cvss —epss 0.03

    The new_password page in PBBoard 2.1.4 allows remote attackers to change the password of arbitrary user accounts via the member_id and new_password parameters to index.php.

  • CVE-2012-4034Aug 12, 2012
    Pbboard
    Pbboard
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via the (1) username parameter to the send page, (2) email parameter to the forget page, (3) password parameter to the forum_archive page, (4) section parameter to…