VYPR

CVEs

346,473 total · page 5961 of 6,930

AllCriticalHighKEV
  • CVE-2011-4735Dec 16, 2011
    Parallels
    Parallels Plesk Panel
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/user/create and certain other files.

  • CVE-2011-4734Dec 16, 2011
    Parallels
    Parallels Plesk Panel
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by file-manager/ and certain other files.

  • CVE-2011-4733Dec 16, 2011
    Parallels
    Parallels Plesk Panel
    risk 0.00cvss —epss 0.02

    The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving…

  • CVE-2011-4732Dec 16, 2011
    Parallels
    Parallels Plesk Panel
    risk 0.00cvss —epss 0.02

    The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving…

  • CVE-2011-4731Dec 16, 2011
    Parallels
    Parallels Plesk Panel
    risk 0.00cvss —epss 0.01

    The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by admin/home/admin and certain…

  • CVE-2011-4730Dec 16, 2011
    Parallels
    Parallels Plesk Panel
    risk 0.00cvss —epss 0.02

    The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as…

  • CVE-2011-4729Dec 16, 2011
    Parallels
    Parallels Plesk Panel
    risk 0.00cvss —epss 0.01

    The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as…

  • CVE-2011-4728Dec 16, 2011
    Parallels
    Parallels Plesk Panel
    risk 0.00cvss —epss 0.01

    The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as…

  • CVE-2011-4727Dec 16, 2011
    Parallels
    Parallels Plesk Panel
    risk 0.00cvss —epss 0.02

    The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error) or possibly have unspecified…

  • CVE-2011-4726Dec 16, 2011
    Parallels
    Parallels Plesk Panel
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/health/ and certain…

  • CVE-2011-4725Dec 16, 2011
    Parallels
    Parallels Plesk Panel
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by login_up.php3 and certain other files.

  • CVE-2011-4837Dec 15, 2011
    Homeseer
    Homeseer Hs2
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in /ctrl in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to hijack the authentication of admins for requests that execute arbitrary programs.

  • CVE-2011-4836Dec 15, 2011
    Homeseer
    Homeseer Hs2
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to inject arbitrary web script or HTML via a request for a crafted URI.

  • CVE-2011-4835Dec 15, 2011
    Homeseer
    Homeseer Hs2
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to access arbitrary files via unspecified vectors.

  • CVE-2011-4834Dec 15, 2011
    Microfocus
    Application LifeCycle Management
    risk 0.03cvss —epss 0.01

    The GetInstalledPackages function in the configuration tool in HP Application Lifestyle Management (ALM) 11 on AIX, HP-UX, and Solaris allows local users to gain privileges via (1) a Trojan horse /tmp/tmp.txt FIFO or (2) a symlink attack on /tmp/tmp.txt.

  • CVE-2011-4833Dec 15, 2011
    Sugarcrm
    Sugarcrm
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the (1) where and (2) order parameters in a get_full_list action…

  • CVE-2011-4832Dec 15, 2011
    Caupo
    Cauposhop Classic
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in CaupoShop Pro 2.x, CaupoShop Classic 3.01, and CaupoShop Pro 3.70 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter in a template action.

  • CVE-2011-4831Dec 15, 2011
    Web File Browser
    Web File Browser
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in webFileBrowser.php in Web File Browser 0.4b14 allows remote authenticated users to read arbitrary files via a ..%2f (encoded dot dot) in the file parameter in a download action.

  • CVE-2011-4830Dec 15, 2011
    Barter Sites
    Com Listing
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the com_listing component in Barter Sites component 1.3 for Joomla! allow remote authenticated users to inject arbitrary web script or HTML via the (1) listing_title, (2) description, (3) homeurl (aka Website Address), (4)…

  • CVE-2011-4829Dec 15, 2011
    Barter Sites
    Barter Sites component
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the com_listing component in Barter Sites component 1.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the category_id parameter to index.php.

  • CVE-2011-4828Dec 15, 2011
    Autosectools
    V CMS
    risk 0.08cvss —epss 0.65

    Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in temp/.

  • CVE-2011-4827Dec 15, 2011
    Autosectools
    V CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in AutoSec Tools V-CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) p parameter to redirect.php and (2) box parameter to includes/TrueColorPicker/index.php, which is not properly handled in…

  • CVE-2011-4826Dec 15, 2011
    Autosectools
    V CMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in session.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to process.php. NOTE: some of these details are obtained from third party information.

  • CVE-2011-4825Dec 15, 2011
    Tinymce
    Tinymce
    risk 0.06cvss —epss 0.41

    Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into…

  • CVE-2011-4824Dec 15, 2011
    Cacti (software)
    Cacti
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the login_username parameter.

  • CVE-2011-4823Dec 15, 2011
    Joomla
    Vik Real Estate
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Vik Real Estate (com_vikrealestate) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) contract parameter in a results action and (2) imm parameter in a show action to index.php.

  • CVE-2011-4822Dec 15, 2011
    Atlassian
    Fisheye
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) snippets in a user comment, which is not properly handled in a Confluence page, or (2) the user…

  • CVE-2011-4606Dec 15, 2011
    Artsoft Entertainment
    Rocks'n'Diamonds
    risk 0.00cvss —epss 0.00

    Artsoft Entertainment Rocks'n'Diamonds (aka rocksndiamonds) 3.3.0.1 allows local users to overwrite arbitrary files via a symlink attack on .rocksndiamonds/cache/artworkinfo.cache under a user's home directory.

  • CVE-2011-4598Dec 15, 2011
    Asterisk
    Asterisk
    risk 0.00cvss —epss 0.02

    The handle_request_info function in channels/chan_sip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted sequence of…

  • CVE-2011-4597Dec 15, 2011
    Asterisk
    Asterisk
    risk 0.00cvss —epss 0.03

    The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate…

  • CVE-2011-4517Dec 15, 2011
    Jasper
    JasPer
    risk 0.01cvss —epss 0.11

    The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory…

  • CVE-2011-4516Dec 15, 2011
    Jasper
    JasPer
    risk 0.01cvss —epss 0.11

    Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted numrlvls value in a coding style default (COD) marker…

  • CVE-2011-4339Dec 15, 2011
    Ipmitool
    Ipmitool
    risk 0.00cvss —epss 0.00

    ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux (RHEL) 6, Debian GNU/Linux, Fedora 16, and other products uses 0666 permissions for its ipmievd.pid PID file, which allows local users to kill arbitrary processes…

  • CVE-2011-4368Dec 14, 2011
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Remote Development Services (RDS) in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2742Dec 14, 2011
    EMC Corporation
    Rsa Adaptive Authentication On Premise
    risk 0.00cvss —epss 0.01

    EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly perform forensic evaluation upon receipt of device tokens from mobile apps, which might allow remote attackers to bypass intended application…

  • CVE-2011-2741Dec 14, 2011
    EMC Corporation
    Rsa Adaptive Authentication On Premise
    risk 0.00cvss —epss 0.01

    EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly implement Device Recovery and Device Identification, which might allow remote attackers to bypass intended security restrictions on a (1) previously…

  • CVE-2011-2463Dec 14, 2011
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving the cfform tag.

  • CVE-2011-4814Dec 14, 2011
    Dolibarr
    Dolibarr
    risk 0.00cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) admin/boxes.php, (3) comm/clients.php, (4) commande/index.php; and the optioncss…

  • CVE-2011-4813Dec 14, 2011
    Whmcs
    Whmcompletesolution
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in clientarea.php in WHMCompleteSolution (WHMCS) 3.x.x allows remote attackers to read arbitrary files via an invalid action and a ../ (dot dot slash) in the templatefile parameter.

  • CVE-2011-4812Dec 14, 2011
    BestShopPro
    BestShopPro
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in nowosci.php in BestShopPro allows remote attackers to inject arbitrary web script or HTML via the str parameter.

  • CVE-2011-4811Dec 14, 2011
    BestShopPro
    BestShopPro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pokaz_podkat.php in BestShopPro allows remote attackers to execute arbitrary SQL commands via the str parameter.

  • CVE-2011-4810Dec 14, 2011
    Whmcs
    Whmcompletesolution
    risk 0.04cvss —epss 0.07

    Multiple directory traversal vulnerabilities in WHMCompleteSolution (WHMCS) 3.x and 4.x allow remote attackers to read arbitrary files via the templatefile parameter to (1) submitticket.php and (2) downloads.php, and (3) the report parameter to admin/reports.php.

  • CVE-2011-4809Dec 14, 2011
    Joomlaextensions
    Com Hmcommunity
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the HM Community (com_hmcommunity) component before 1.01 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) language[], (2) university[], (3) persent[], (4) company_name[], (5)…

  • CVE-2011-4808Dec 14, 2011
    Joomla
    HM Community
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the HM Community (com_hmcommunity) component before 1.01 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a fnd_home action to index.php.

  • CVE-2011-4807Dec 14, 2011
    Phpalbum
    Phpalbum
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in main.php in phpAlbum 0.4.1.16 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the var1 parameter.

  • CVE-2011-4806Dec 14, 2011
    Phpalbum
    Phpalbum
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in main.php in phpAlbum 0.4.1.16 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) var1 and (2) keyword parameters.

  • CVE-2011-4805Dec 14, 2011
    SAP
    Crystal Reports Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in pubDBLogon.jsp in SAP Crystal Report Server 2008 allows remote attackers to inject arbitrary web script or HTML via the service parameter.

  • CVE-2011-4804Dec 14, 2011
    Joomla
    obSuggest
    risk 0.05cvss —epss 0.24

    Directory traversal vulnerability in the obSuggest (com_obsuggest) component before 1.8 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2011-4803Dec 14, 2011
    WordPress
    Wptouch
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in wptouch/ajax.php in the WPTouch plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2011-4802Dec 14, 2011
    Dolibarr
    Dolibarr
    risk 0.00cvss —epss 0.06

    Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2) sortorder, and (3) sall parameters to user/index.php and (b) user/group/index.php; the id parameter to…