VYPR

CVEs

346,414 total · page 5975 of 6,929

AllCriticalHighKEV
  • CVE-2011-1897Oct 12, 2011
    Microsoft
    Forefront Unified Access Gateway
    risk 0.01cvss —epss 0.08

    Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Default Reflected XSS Vulnerability."

  • CVE-2011-1896Oct 12, 2011
    Microsoft
    Forefront Unified Access Gateway
    risk 0.01cvss —epss 0.08

    Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "ExcelTable Reflected XSS Vulnerability."

  • CVE-2011-1895Oct 12, 2011
    Microsoft
    Forefront Unified Access Gateway
    risk 0.01cvss —epss 0.11

    CRLF injection vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks and cross-site scripting (XSS) attacks, via unspecified…

  • CVE-2011-1253Oct 12, 2011
    Microsoft
    .net Framework
    risk 0.01cvss —epss 0.13

    Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.0.60831, does not properly restrict inheritance, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET…

  • CVE-2011-1247Oct 12, 2011
    Microsoft
    Windows
    risk 0.01cvss —epss 0.11

    Untrusted search path vulnerability in the Microsoft Active Accessibility component in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a…

  • CVE-2011-4030Oct 10, 2011
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.02

    The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.

  • CVE-2011-3599Oct 10, 2011
    Adam Kennedy
    Crypt Dsa
    risk 0.00cvss —epss 0.02

    The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack.

  • CVE-2011-3587Oct 10, 2011
    Zope
    Zope
    risk 0.02cvss —epss 0.78

    Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.

  • CVE-2011-3327Oct 10, 2011
    Quagga (software)
    Quagga
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in the ecommunity_ecom2str function in bgp_ecommunity.c in bgpd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by sending a crafted BGP UPDATE message over IPv4.

  • CVE-2011-3326Oct 10, 2011
    Quagga (software)
    Quagga
    risk 0.00cvss —epss 0.05

    The ospf_flood function in ospf_flood.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) via an invalid Link State Advertisement (LSA) type in an IPv4 Link State Update message.

  • CVE-2011-3325Oct 10, 2011
    Quagga (software)
    Quagga
    risk 0.00cvss —epss 0.05

    ospf_packet.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) via (1) a 0x0a type field in an IPv4 packet header or (2) a truncated IPv4 Hello packet.

  • CVE-2011-3324Oct 10, 2011
    Quagga (software)
    Quagga
    risk 0.00cvss —epss 0.05

    The ospf6_lsa_is_changed function in ospf6_lsa.c in the OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via trailing zero values in the Link State Advertisement (LSA) header list of…

  • CVE-2011-3323Oct 10, 2011
    Quagga (software)
    Quagga
    risk 0.00cvss —epss 0.05

    The OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of service (out-of-bounds memory access and daemon crash) via a Link State Update message with an invalid IPv6 prefix length.

  • CVE-2011-2675Oct 10, 2011
    Utage.org
    Enkai
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Enkai-kun before 110916 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-2189HigOct 10, 2011
    Linux
    Kernel
    risk 0.53cvss 7.5epss 0.18

    net/core/net_namespace.c in the Linux kernel 2.6.32 and earlier does not properly handle a high rate of creation and cleanup of network namespaces, which makes it easier for remote attackers to cause a denial of service (memory consumption) via requests to a daemon that requires…

  • CVE-2010-4963Oct 9, 2011
    Hulihan
    BXR
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in folder/list in Hulihan BXR 0.6.8 allows remote attackers to execute arbitrary SQL commands via the order_by parameter.

  • CVE-2010-4962Oct 9, 2011
    Dev Team Typoheads
    Webkitpdf
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Webkit PDFs (webkitpdf) extension before 1.1.4 for TYPO3 allows remote attackers to execute arbitrary commands via unknown vectors.

  • CVE-2010-4961Oct 9, 2011
    Dev Team Typoheads
    Webkitpdf
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Webkit PDFs (webkitpdf) extension before 1.1.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-4960Oct 9, 2011
    TYPO3
    mh_branchenbuch
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Branchenbuch (aka Yellow Pages or mh_branchenbuch) extension before 0.9.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-4959Oct 9, 2011
    Preprojects
    Pre Podcast Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the login feature in Pre Projects Pre Podcast Portal allows remote attackers to execute arbitrary SQL commands via the password parameter.

  • CVE-2010-4958Oct 9, 2011
    Pradoportal
    Prado Portal
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Prado Portal 1.2.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2010-4957Oct 9, 2011
    TYPO3
    ke_questionnaire
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Questionnaire (ke_questionnaire) extension before 2.2.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-4956Oct 9, 2011
    TYPO3
    ke_questionnaire
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Questionnaire (ke_questionnaire) extension before 2.2.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-4955Oct 9, 2011
    APBoard Developers
    APBoard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in board/board.php in APBoard Developers APBoard 2.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2006-3078.

  • CVE-2010-4954Oct 9, 2011
    Xt Commerce
    Gambio
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in product_reviews_info.php in xt:Commerce Gambio 2008 allows remote attackers to execute arbitrary SQL commands via the products_id parameter.

  • CVE-2010-4953Oct 9, 2011
    Jw Calendar
    Jw Calendar
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the JW Calendar (jw_calendar) extension 1.3.20 and earlier for TYPO3 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2010-4952Oct 9, 2011
    TYPO3
    festat
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the FE user statistic (festat) extension before 0.2.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-4951Oct 9, 2011
    TYPO3
    xaJax Shoutbox
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the xaJax Shoutbox (vx_xajax_shoutbox) extension before 1.0.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-4950Oct 9, 2011
    TYPO3
    Event
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Event (event) extension before 0.3.7 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-4949Oct 9, 2011
    Joomla
    FreiChat
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the (1) FreiChat component before 2.1.2 for Joomla! and the (2) FreiChatPure component before 1.2.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML by entering it in an unspecified window.

  • CVE-2010-4948Oct 9, 2011
    Phpgalleryscript
    PHP Free Photo Gallery
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in libs/adodb/adodb.inc.php in PHP Free Photo Gallery script allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.

  • CVE-2010-4947Oct 9, 2011
    Allpcscript
    Allpc
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in advanced_search_result.php in ALLPC 2.5 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.

  • CVE-2010-4946Oct 9, 2011
    ALLPC
    ALLPC
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in product_info.php in ALLPC 2.5 allows remote attackers to execute arbitrary SQL commands via the products_id parameter.

  • CVE-2010-4945Oct 9, 2011
    Joomla
    CamelcityDB
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the CamelcityDB (com_camelcitydb2) component 2.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

  • CVE-2010-4944Oct 9, 2011
    Joomla
    Com Elite Experts
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Elite Experts (com_elite_experts) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a showExpertProfileDetailed action to index.php.

  • CVE-2010-4943Oct 9, 2011
    Saurus
    CMS
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to execute arbitrary PHP code via a URL in the class_path parameter to (1) file.php or (2) com_del.php.

  • CVE-2010-4942Oct 9, 2011
    E Xoopport
    Samsara
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in location.php in the eCal module in E-Xoopport Samsara 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the lid parameter.

  • CVE-2010-4941Oct 9, 2011
    Joomla
    Teams
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Teams (com_teams) component 1_1028_100809_1711 for Joomla! allows remote attackers to execute arbitrary SQL commands via the PlayerID parameter in a player save action to index.php.

  • CVE-2010-4940Oct 9, 2011
    Wanewsletter
    Wanewsletter
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in WAnewsletter 2.1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-4939Oct 9, 2011
    MailForm
    MailForm
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in MailForm 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the theme parameter.

  • CVE-2010-4938Oct 9, 2011
    Joomla
    Com Weblinks
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Weblinks (com_weblinks) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a categories action to index.php. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2010-4937Oct 9, 2011
    Joomla
    Amblog
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Amblog (com_amblog) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) articleid or (2) catid parameter to index.php.

  • CVE-2010-4936Oct 9, 2011
    Joomla
    Slide Show
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Slide Show (com_slideshow) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.

  • CVE-2010-4935Oct 9, 2011
    Khader Abbeb
    Entrans
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in poll.php in Entrans 0.3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the sid parameter.

  • CVE-2010-4934Oct 9, 2011
    Get Tube
    Get Tube
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in video.php in Get Tube 4.51 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-4933Oct 9, 2011
    Geeklog
    Geeklog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in filemgmt/singlefile.php in Geeklog 1.3.8 allows remote attackers to execute arbitrary SQL commands via the lid parameter.

  • CVE-2010-4932Oct 9, 2011
    Entrans
    Entrans
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in Entrans before 0.3.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter.

  • CVE-2010-4931Oct 9, 2011
    PHP-Fusion
    Phpfusion
    risk 0.04cvss —epss 0.16

    Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder_level parameter. NOTE: this issue has been disputed by a reliable third party

  • CVE-2010-4930Oct 9, 2011
    Mail
    WebMail
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in index.php in @mail Webmail before 6.2.0 allows remote attackers to inject arbitrary web script or HTML via the MailType parameter in a mail/auth/processlogin action.

  • CVE-2010-4929Oct 9, 2011
    Joomla
    com_ezautos
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Joostina (com_ezautos) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the firstCode parameter in a helpers action to index.php.