VYPR

CVEs

346,462 total · page 5964 of 6,930

AllCriticalHighKEV
  • CVE-2011-4671Dec 2, 2011
    WordPress
    Adrotate
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8, for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter (aka redirect URL).

  • CVE-2011-4670Dec 2, 2011
    Vtiger
    vTiger
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) viewname parameter in a CalendarAjax action, (2) activity_mode parameter in a DetailView action, (3) contact_id and (4)…

  • CVE-2011-4669Dec 2, 2011
    WordPress
    Wordpress Users
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in wp-users.php in WordPress Users plugin 1.3 and possibly earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the uid parameter to index.php.

  • CVE-2011-4668Dec 2, 2011
    IBM
    Tivoli Netcool\/reporter
    risk 0.00cvss —epss 0.03

    IBM Tivoli Netcool/Reporter 2.2 before 2.2.0.8 allows remote attackers to execute arbitrary code via vectors related to an unspecified CGI program used with the Apache HTTP Server.

  • CVE-2011-4545Dec 2, 2011
    Prestashop
    Prestashop
    risk 0.03cvss —epss 0.04

    CRLF injection vulnerability in admin/displayImage.php in Prestashop 1.4.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the name parameter.

  • CVE-2011-4036Dec 2, 2011
    Schneider Electric
    Vijeo Historian
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2011-4035Dec 2, 2011
    Schneider Electric
    Vijeo Historian
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-4034Dec 2, 2011
    Schneider Electric
    Vijeo Historian
    risk 0.04cvss —epss 0.13

    Buffer overflow in the Steema TeeChart ActiveX control, as used in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service via…

  • CVE-2011-4033Dec 2, 2011
    Schneider Electric
    Vijeo Historian
    risk 0.00cvss —epss 0.02

    Buffer overflow in the Steema TeeChart ActiveX control, as used in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier, allows remote attackers to cause a denial of service via unspecified vectors.

  • CVE-2011-4544Dec 1, 2011
    Prestashop
    Prestashop
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Prestashop before 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) address or (2) relativ_base_dir parameter to modules/mondialrelay/googlemap.php; the (3) relativ_base_dir, (4) Pays, (5) Ville,…

  • CVE-2011-4540Dec 1, 2011
    Atmail
    Atmail
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in AtMail Open (aka AtMail Open-Source edition) 1.04 allow remote attackers to inject arbitrary web script or HTML via the func parameter to (1) ldap.php or (2) search.php.

  • CVE-2011-4161Dec 1, 2011
    Microfocus
    CM8060 Color MFP with Edgeline
    risk 0.01cvss —epss 0.14

    The default configuration of the HP CM8060 Color MFP with Edgeline; Color LaserJet 3xxx, 4xxx, 5550, 9500, CMxxxx, CPxxxx, and Enterprise CPxxxx; Digital Sender 9200c and 9250c; LaserJet 4xxx, 5200, 90xx, Mxxxx, and Pxxxx; and LaserJet Enterprise 500 color M551, 600, M4555 MFP,…

  • CVE-2011-4344Dec 1, 2011
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.

  • CVE-2011-4001Dec 1, 2011
    Mawashimono
    Nikki
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in HP no Mawashimono Nikki 6.6 and earlier allows remote attackers to read and modify arbitrary files via unspecified vectors.

  • CVE-2011-2461Dec 1, 2011
    Adobe Inc.
    Flex
    risk 0.01cvss —epss 0.08

    Cross-site scripting (XSS) vulnerability in the Adobe Flex SDK 3.x and 4.x before 4.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to the loading of modules from different domains.

  • CVE-2011-4647Nov 30, 2011
    Geeklog
    Geeklog
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the story creation feature in Geeklog 1.8.0 allow remote attackers to inject arbitrary web script or HTML via the (1) code or (2) raw BBcode tags.

  • CVE-2011-4646Nov 30, 2011
    Lesterchan
    Wp Postratings (wordpress Plugin)
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote authenticated users with the Author role to execute arbitrary SQL commands via the id attribute of the ratings shortcode…

  • CVE-2011-4542Nov 30, 2011
    Hastymail
    Hastymail2
    risk 0.05cvss —epss 0.24

    Hastymail2 2.1.1 before RC2 allows remote attackers to execute arbitrary commands via the (1) rs or (2) rsargs[] parameter in a mailbox Drafts action to the default URI.

  • CVE-2011-4345Nov 30, 2011
    Namazu
    Namazu
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Namazu before 2.0.21, when Internet Explorer 6 or 7 is used, allows remote attackers to inject arbitrary web script or HTML via a cookie.

  • CVE-2011-4317Nov 30, 2011
    Apache
    HTTP Server
    risk 0.08cvss —epss 0.60

    The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a…

  • CVE-2011-4191Nov 30, 2011
    Novell
    Netware
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in the xdrDecodeString function in XNFS.NLM in Novell NetWare 6.5 SP8 allows remote attackers to execute arbitrary code or cause a denial of service (abend or NFS outage) via long packets.

  • CVE-2011-4002Nov 30, 2011
    Mawashimono
    Nikki
    risk 0.00cvss —epss 0.02

    HP no Mawashimono Nikki 6.6 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."

  • CVE-2011-3639Nov 30, 2011
    Apache
    HTTP Server
    risk 0.07cvss —epss 0.51

    The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which…

  • CVE-2011-3173Nov 30, 2011
    Novell
    Open Enterprise Server
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in the GetDriverSettings function in nipplib.dll in the iPrint client in Novell Open Enterprise Server 2 (aka OES2) SP3 allows remote attackers to execute arbitrary code via a long (1) hostname or (2) port field.

  • CVE-2009-5028Nov 30, 2011
    Namazu
    Namazu
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in Namazu before 2.0.20 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted request containing an empty uri field.

  • CVE-2011-4405Nov 29, 2011
    Ubuntu
    system-config-printer
    risk 0.00cvss —epss 0.03

    The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10, as used by the automatic printer driver download service, uses an "insecure connection" for queries to the OpenPrinting database, which allows remote attackers to execute arbitrary code via a…

  • CVE-2011-4313Nov 29, 2011
    Isc
    Bind
    risk 0.01cvss —epss 0.16

    query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors…

  • CVE-2011-3367Nov 29, 2011
    Arora Browser
    Arora
    risk 0.00cvss —epss 0.01

    Arora, possibly 0.11 and other versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.

  • CVE-2011-3366Nov 29, 2011
    Adjam
    Rekonq
    risk 0.00cvss —epss 0.01

    Rekonq 0.7.0 and earlier does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.

  • CVE-2011-3365Nov 29, 2011
    KDE
    Kde
    risk 0.00cvss —epss 0.01

    The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.

  • CVE-2011-3150Nov 29, 2011
    Ubuntu
    Software Center
    risk 0.00cvss —epss 0.02

    Software Center in Ubuntu 11.10, 11.04 10.10 does not properly validate server certificates, which allows remote attackers to execute arbitrary code or obtain sensitive information via a man-in-the-middle (MITM) attack.

  • CVE-2011-4572Nov 29, 2011
    Codefuture
    Cf Image Hosting Script
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in inc/tesmodrewite.php in CF Image Hosting Script 1.3.82, 1.4.1, and probably other versions before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this was originally reported as a file…

  • CVE-2011-4571Nov 29, 2011
    Joomla
    Estate Agent
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Estate Agent (com_estateagent) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a showEO action to index.php.

  • CVE-2011-4570Nov 29, 2011
    Joomla
    Time Returns
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Time Returns (com_timereturns) component 2.0 and possibly earlier versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a timereturns action to index.php.

  • CVE-2011-4569Nov 29, 2011
    MyBB
    Userbar
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in userbarsettings.php in the Userbar plugin 2.2 for MyBB Forum allows remote attackers to execute arbitrary SQL commands via the image2 parameter.

  • CVE-2011-4568Nov 29, 2011
    WordPress
    Flowplayer
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI.

  • CVE-2011-4567Nov 29, 2011
    Zen Cart
    ZenCart
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in includes/templates/template_default/templates/tpl_gv_send_default.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gv_send action to index.php, a different…

  • CVE-2011-4566Nov 29, 2011
    PHP
    PHP
    risk 0.01cvss —epss 0.07

    Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in…

  • CVE-2011-4547Nov 29, 2011
    Zen Cart
    ZenCart
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in includes/templates/template_default/common/tpl_header_test_info.php in Zen Cart 1.3.9h, when debugging is enabled, might allow remote attackers to inject arbitrary web script or HTML via the (1) main_page parameter or (2)…

  • CVE-2011-4541Nov 29, 2011
    Hastymail
    Hastymail2
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Hastymail2 2.1.1 before RC2 allows remote attackers to inject arbitrary web script or HTML via the rs parameter in a mailbox Drafts action.

  • CVE-2011-4565Nov 28, 2011
    XOOPS
    Xoops
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.5.1.a, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to include/formdhtmltextarea_preview.php or (2) img BBCODE tag within the message…

  • CVE-2011-4564Nov 28, 2011
    Activedev
    Active CMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the admin script in Active CMS 1.2 allows remote attackers to inject arbitrary web script or HTML via the mod parameter in a module action.

  • CVE-2011-4563Nov 28, 2011
    Jakcms
    Jakcms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in JAKCMS 2.0.4.1, and possibly other versions before 2.2.6 2011-09-23, allows remote attackers to inject arbitrary web script or HTML via the userpost parameter in a PM request, related to tinymce. NOTE: some of these…

  • CVE-2011-4562Nov 28, 2011
    WordPress
    Redirection
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header in a request to a…

  • CVE-2011-4561Nov 28, 2011
    Phorum
    Phorum
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin.php in Phorum 5.2.18 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/index.php. NOTE: some of these details are obtained from third party information.

  • CVE-2011-4560Nov 28, 2011
    Drupal
    Petition Node
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Petition Node module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to signing a petition.

  • CVE-2011-4559Nov 28, 2011
    Vtiger
    CRM
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php.

  • CVE-2011-4335Nov 28, 2011
    Contao
    CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php in a (1) teachers.html or (2) teachers/ action.

  • CVE-2011-4329Nov 28, 2011
    Dolibarr
    Dolibarr
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter in a setup action to admin/company.php, or the PATH_INFO to (2) admin/security_other.php, (3) admin/events.php, or…

  • CVE-2011-4319Nov 28, 2011
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a…