VYPR

CVEs

346,511 total · page 5946 of 6,931

AllCriticalHighKEV
  • CVE-2012-0242Feb 21, 2012
    Advantech
    Webaccess
    risk 0.04cvss —epss 0.07

    Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string.

  • CVE-2012-0241Feb 21, 2012
    Advantech
    Webaccess
    risk 0.03cvss —epss 0.05

    Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service (memory corruption) via a modified stream identifier to a function.

  • CVE-2012-0240Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.04

    GbScriptAddUp.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2012-0239Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative password via a password-change request.

  • CVE-2012-0238Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in opcImg.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2012-0237Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    Advantech/BroadWin WebAccess before 7.0 allows remote attackers to (1) enable date and time syncing or (2) disable date and time syncing via a crafted URL.

  • CVE-2012-0236Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL. NOTE: the vendor reportedly "does not consider it to be a security risk."

  • CVE-2012-0235Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2012-0234Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via a malformed URL.

  • CVE-2012-0233Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via a malformed URL.

  • CVE-2012-0200Feb 21, 2012
    IBM
    Soliddb
    risk 0.03cvss —epss 0.06

    The server in IBM solidDB 6.5 before Interim Fix 6 does not properly initialize data structures, which allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a redundant WHERE condition.

  • CVE-2011-4890Feb 21, 2012
    IBM
    Soliddb
    risk 0.00cvss —epss 0.02

    The server in IBM solidDB 6.5 before FP9 and 7.0 before FP1 allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a ROWNUM condition involving a subquery.

  • CVE-2011-4526Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.04

    Buffer overflow in an ActiveX control in Advantech/BroadWin WebAccess before 7.0 might allow remote attackers to execute arbitrary code via a long string value in unspecified parameters.

  • CVE-2011-4525Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.02

    Advantech/BroadWin WebAccess before 7.0 allows remote attackers to trigger the extraction of arbitrary web content into a batch file on a client system, and execute this batch file, via unspecified vectors.

  • CVE-2011-4524Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.04

    Buffer overflow in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via a long string value in unspecified parameters.

  • CVE-2011-4523Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in bwview.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

  • CVE-2011-4522Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in bwerrdn.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

  • CVE-2011-4521Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via crafted string input.

  • CVE-2011-1914Feb 21, 2012
    Advantech
    Adam Opc Server
    risk 0.00cvss —epss 0.04

    Buffer overflow in the Advantech ADAM OLE for Process Control (OPC) Server ActiveX control in ADAM OPC Server before 3.01.012, Modbus RTU OPC Server before 3.01.010, and Modbus TCP OPC Server before 3.01.010 allows remote attackers to execute arbitrary code via unspecified…

  • CVE-2012-1227Feb 21, 2012
    Pluck
    Pluck
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in pluck 4.7 allow remote attackers to hijack the authentication of admins for requests that (1) modify the admin email address or (2) modify the blog title via a settings action; (3) add a page via an…

  • CVE-2012-1226Feb 21, 2012
    Dolibarr
    Dolibarr
    risk 0.00cvss —epss 0.25

    Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the (1) file parameter to document.php or (2) backtopage parameter in a create action to…

  • CVE-2012-1225Feb 21, 2012
    Dolibarr
    Dolibarr
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in Dolibarr CMS 3.2.0 Alpha and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) memberslist parameter (aka Member List) in list.php or (2) rowid parameter to adherents/fiche.php.

  • CVE-2012-1224Feb 21, 2012
    Contentlion
    Contentlion Alpha
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in system/classes/login.php in ContentLion Alpha 1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  • CVE-2012-1223Feb 21, 2012
    Rabidhamster
    R2\/extreme
    risk 0.00cvss —epss 0.01

    RabidHamster R2/Extreme 1.65 and earlier uses a small search space of values for the PIN number, which allows remote attackers to obtain the PIN number via a brute force attack.

  • CVE-2012-1222Feb 21, 2012
    Rabidhamster
    R2\/extreme
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in RabidHamster R2/Extreme 1.65 and earlier allows remote authenticated users to execute arbitrary code via a long string to TCP port 23.

  • CVE-2012-1221Feb 21, 2012
    Rabidhamster
    R2\/
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in the telnet server in RabidHamster R2/Extreme 1.65 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the File command.

  • CVE-2012-1220Feb 21, 2012
    Gazie
    GAzie
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in modules/config/admin_utente.php in GAzie 5.20 and earlier allows remote attackers to hijack the authentication of administrators for requests that change account information via an update action, as demonstrated by changing the…

  • CVE-2012-1219Feb 21, 2012
    Freelancerkit
    Freelancerkit
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in freelancerKit 2.35 allow remote attackers to inject arbitrary web script or HTML via the (1) ticket parameter to tickets.php, (2) title parameter to notes.php, or (3) task parameter to todo.php. NOTE: some of these details…

  • CVE-2012-1218Feb 21, 2012
    Freelancerkit
    Freelancerkit
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in freelancerKit 2.35 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to the (1) notes and (2) tickets components.

  • CVE-2012-0995Feb 21, 2012
    Zenphoto
    Zenphoto
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter in an external action to zp-core/admin.php, (2) PATH_INTO to an unspecified URL, as demonstrated using /1/, (3) PATH_INFO…

  • CVE-2012-0994Feb 21, 2012
    Zenphoto
    Zenphoto
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Manage Albums feature in zp-core/admin-albumsort.php in ZENphoto 1.4.2 allows remote authenticated users to execute arbitrary SQL commands via the sortableList parameter.

  • CVE-2012-0993Feb 21, 2012
    Zenphoto
    Zenphoto
    risk 0.00cvss —epss 0.03

    Eval injection vulnerability in zp-core/zp-extensions/viewer_size_image.php in ZENphoto 1.4.2, when the viewer_size_image plugin is enabled, allows remote attackers to execute arbitrary PHP code via the viewer_size_image_saved cookie.

  • CVE-2012-0865Feb 21, 2012
    Cubecart
    Cubecart
    risk 0.03cvss —epss 0.03

    Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) r parameter to switch.php or (2) goto parameter to admin/login.php.

  • CVE-2012-0224Feb 21, 2012
    7-Technologies
    AQUIS
    risk 0.00cvss —epss 0.02

    Untrusted search path vulnerability in 7-Technologies (7T) AQUIS 1.5 and earlier allows local users to gain privileges via a Trojan horse DLL in the current working directory, a different vulnerability than CVE-2012-0223.

  • CVE-2011-4187Feb 21, 2012
    Novell
    Iprint
    risk 0.00cvss —epss 0.04

    Buffer overflow in the GetDriverSettings function in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a long realm field, a different vulnerability than CVE-2011-3173.

  • CVE-2011-4186Feb 21, 2012
    Novell
    Iprint
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a crafted client-file-name parameter in a printer-url, a different vulnerability than CVE-2011-1705.

  • CVE-2011-4185Feb 21, 2012
    Novell
    Iprint
    risk 0.00cvss —epss 0.03

    The GetPrinterURLList2 method in the ActiveX control in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2008-2431 and…

  • CVE-2012-1217Feb 21, 2012
    STHS
    STHS v2 Web Portal
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in STHS v2 Web Portal 2.2 allow remote attackers to inject arbitrary web script or HTML via the team parameter to (1) prospects.php, (2) prospect.php, or (3) team.php.

  • CVE-2012-1216Feb 21, 2012
    Pbboard
    Pbboard
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in PBBoard 2.1.4 allow remote attackers to hijack the authentication of administrators for requests that (1) upload a file via an add action or (2) change the contents of a file via a dit action.

  • CVE-2012-1215Feb 21, 2012
    Yoono
    Yoono
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Add friends module in the Yoono extension before 7.7.8 for Firefox allows remote attackers to inject arbitrary web script or HTML via the create field in a "Create a group" action.

  • CVE-2012-1214Feb 21, 2012
    Yoono
    Yoono Desktop
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Add friends module in Yoono Desktop Application before 1.8.21 allows remote attackers to inject arbitrary web script or HTML via the create field in a "Create a group" action.

  • CVE-2012-1200Feb 18, 2012
    Nova
    Nova
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Nova CMS allow remote attackers to execute arbitrary PHP code via a URL in the (1) fileType parameter to optimizer/index.php, (2) id parameter to administrator/modules/moduleslist.php, (3) filename parameter to…

  • CVE-2012-1199Feb 18, 2012
    Secureideas
    Basic Analysis and Security Engine
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Basic Analysis and Security Engine (BASE) 1.4.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) BASE_path parameter to base_ag_main.php, (2) base_db_setup.php, (3) base_graph_common.php, (4)…

  • CVE-2012-1198Feb 18, 2012
    Secureideas
    Basic Analysis and Security Engine
    risk 0.03cvss —epss 0.05

    base_ag_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allows remote attackers to execute arbitrary code by uploading contents of the file with an executable extension via a create action, then accessing it via a view action.

  • CVE-2012-1197Feb 18, 2012
    Acdsee
    Acdsee
    risk 0.00cvss —epss 0.04

    Integer overflow in the IDE_ACDStd.apl module for ACDSee 14.1 Build 137 allows remote attackers to execute arbitrary code via crafted "image dimension values" in a BMP file, which triggers a heap-based buffer overflow.

  • CVE-2012-1196Feb 18, 2012
    Lenovo
    ThinkManagement Console
    risk 0.07cvss —epss 0.56

    Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a .. (dot dot) in the filename parameter in a SetTaskLogByFile SOAP request.

  • CVE-2012-1195Feb 18, 2012
    Lenovo
    ThinkManagement Console
    risk 0.08cvss —epss 0.68

    Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a…

  • CVE-2011-5081Feb 18, 2012
    Backuppc
    Backuppc
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other earlier versions allows remote attackers to inject arbitrary web script or HTML via the share parameter in a RestoreFile action to index.cgi.

  • CVE-2011-4923Feb 18, 2012
    Backuppc
    Backuppc
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in View.pm in BackupPC 3.0.0, 3.1.0, 3.2.0, 3.2.1, and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the num parameter in a view action to index.cgi, related to the log file viewer, a different…

  • CVE-2011-4614Feb 18, 2012
    TYPO3
    Typo3
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x before 4.6.2, and development versions of 4.7 allows remote attackers to execute arbitrary PHP code via a URL in the…