VYPR

CVEs

346,414 total · page 5977 of 6,929

AllCriticalHighKEV
  • CVE-2010-4889Oct 7, 2011
    TYPO3
    Tiny Market
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Tiny Market (hm_tinymarket) extension 0.5.4 and earlier for TYPO3 allows attackers to execute arbitrary code via unknown vectors.

  • CVE-2010-4888Oct 7, 2011
    TYPO3
    Tiny Market
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Tiny Market (hm_tinymarket) extension 0.5.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-4887Oct 7, 2011
    TYPO3
    commentsbe
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Commenting system Backend Module (commentsbe) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-4886Oct 7, 2011
    Peter Proell
    Tweetbutton
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the "official twitter tweet button for your page" (tweetbutton) extension before 1.0.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-4885Oct 7, 2011
    TYPO3
    XING Button
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the XING Button (xing) extension before 1.0.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-4884Oct 7, 2011
    Gaestebuch
    Gaestebuch
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in guestbook/gbook.php in Gaestebuch 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the script_pfad parameter.

  • CVE-2010-4883Oct 7, 2011
    Modx
    Revolution
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter.

  • CVE-2010-4882Oct 7, 2011
    Ventics
    Auto CMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in autocms.php in Auto CMS 1.6 allows remote attackers to inject arbitrary web script or HTML via the sitetitle parameter.

  • CVE-2010-4881Oct 7, 2011
    Apphp
    Apphp Calendar
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in calendar.class.php in ApPHP Calendar (ApPHP CAL) allow remote attackers to hijack the authentication of unspecified victims for requests that use the (1) category_name, (2) category_description, (3) event_name, or (4)…

  • CVE-2010-4880Oct 7, 2011
    Apphp
    Apphp Calendar
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in calendar.class.php in ApPHP Calendar (ApPHP CAL) allow remote attackers to inject arbitrary web script or HTML via the (1) category_name, (2) category_description, (3) event_name, or (4) event_description parameter.

  • CVE-2010-4879Oct 7, 2011
    Dompdf
    Dompdf
    risk 0.00cvss —epss 0.05

    PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the input_file parameter.

  • CVE-2010-4878Oct 7, 2011
    Hinnendahl
    Kontakt Formular
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in formmailer.php in Kontakt Formular 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the script_pfad parameter.

  • CVE-2010-4877Oct 7, 2011
    OneCMS
    OneCMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in OneCMS 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the view parameter.

  • CVE-2010-4876Oct 7, 2011
    Mblogger Project
    Mblogger
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in viewpost.php in mBlogger 1.0.04 allows remote attackers to execute arbitrary SQL commands via the postID parameter.

  • CVE-2010-4875Oct 7, 2011
    WordPress
    Vodpod Video Gallery
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gid parameter.

  • CVE-2010-4874Oct 7, 2011
    Ninkobb
    Ninkobb
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in users.php in NinkoBB 1.3 RC5 allow remote attackers to inject arbitrary web script or HTML via the (1) first_name, (2) last_name, (3) msn, or (4) aim parameter.

  • CVE-2010-4873Oct 7, 2011
    Webidsupport
    Webid
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in confirm.php in WeBid 0.8.5 P1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2010-4872Oct 7, 2011
    ASPilot
    Pilot Cart
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in newsroom.asp in ASPilot Pilot Cart 7.3 allows remote attackers to execute arbitrary SQL commands via the specific parameter.

  • CVE-2010-4871Oct 7, 2011
    Smartftp
    Smartftp
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in SmartFTP before 4.0 Build 1142 allows attackers to have an unknown impact via a long filename.

  • CVE-2010-4870Oct 7, 2011
    Bloofoxcms
    Bloofoxcms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands via the gender parameter.

  • CVE-2011-2191Oct 7, 2011
    Cherokee
    Cherokee Httpd
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee before 1.2.99 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences, as demonstrated by a crafted nickname field to…

  • CVE-2011-2190Oct 7, 2011
    Cherokee
    Cherokee Httpd
    risk 0.00cvss —epss 0.00

    The generate_admin_password function in Cherokee before 1.2.99 uses time and PID values for seeding of a random number generator, which makes it easier for local users to determine admin passwords via a brute-force attack.

  • CVE-2011-3332Oct 6, 2011
    Iceni
    Argus
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in Iceni Argus 6.20 and earlier and Infix 5.04 allows remote attackers to execute arbitrary code via a crafted PDF document that uses flate compression.

  • CVE-2011-3305Oct 6, 2011
    Cisco Systems, Inc.
    Nac Manager
    risk 0.05cvss —epss 0.22

    Directory traversal vulnerability in Cisco Network Admission Control (NAC) Manager 4.8.x allows remote attackers to read arbitrary files via crafted traffic to TCP port 443, aka Bug ID CSCtq10755.

  • CVE-2011-3304Oct 6, 2011
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.03

    Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services module in Cisco Catalyst 6500 series devices, with software 7.2 before 7.2(5.3), 8.0 before 8.0(5.25), 8.1 before 8.1(2.50), 8.2 before 8.2(5.11), 8.3 before 8.3(2.23), 8.4 before 8.4(2), and 8.5…

  • CVE-2011-3303Oct 6, 2011
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services module in Cisco Catalyst 6500 series devices, with software 7.0 before 7.0(8.13), 7.1 and 7.2 before 7.2(5.4), 8.0 before 8.0(5.25), 8.1 before 8.1(2.50), 8.2 before 8.2(5.6), 8.3 before…

  • CVE-2011-3302Oct 6, 2011
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services module in Cisco Catalyst 6500 series devices, with software 7.0 before 7.0(8.13), 7.1 and 7.2 before 7.2(5.4), 8.0 before 8.0(5.25), 8.1 and 8.2 before 8.2(5.11), 8.3 before 8.3(2.23), 8.4 before…

  • CVE-2011-3301Oct 6, 2011
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services module in Cisco Catalyst 6500 series devices, with software 7.0 before 7.0(8.13), 7.1 and 7.2 before 7.2(5.4), 8.0 before 8.0(5.25), 8.1 and 8.2 before 8.2(5.11), 8.3 before 8.3(2.23), 8.4 before…

  • CVE-2011-3300Oct 6, 2011
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services module in Cisco Catalyst 6500 series devices, with software 7.0 before 7.0(8.13), 7.1 and 7.2 before 7.2(5.4), 8.0 before 8.0(5.25), 8.1 and 8.2 before 8.2(5.11), 8.3 before 8.3(2.23), 8.4 before…

  • CVE-2011-3299Oct 6, 2011
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services module in Cisco Catalyst 6500 series devices, with software 7.0 before 7.0(8.13), 7.1 and 7.2 before 7.2(5.4), 8.0 before 8.0(5.25), 8.1 and 8.2 before 8.2(5.11), 8.3 before 8.3(2.23), 8.4 before…

  • CVE-2011-3298Oct 6, 2011
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.01

    Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services module in Cisco Catalyst 6500 series devices, with software 7.0 before 7.0(8.13), 7.1 and 7.2 before 7.2(5.3), 8.0 before 8.0(5.24), 8.1 before 8.1(2.50), 8.2 before 8.2(5), 8.3 before 8.3(2.18),…

  • CVE-2011-3297Oct 6, 2011
    Cisco Systems, Inc.
    Firewall Services Module
    risk 0.00cvss —epss 0.01

    Cisco Firewall Services Module (aka FWSM) 3.1 before 3.1(21), 3.2 before 3.2(22), 4.0 before 4.0(16), and 4.1 before 4.1(7), when certain authentication configurations are used, allows remote attackers to cause a denial of service (module crash) by making many authentication…

  • CVE-2011-3296Oct 6, 2011
    Cisco Systems, Inc.
    Firewall Services Module
    risk 0.00cvss —epss 0.02

    Cisco Firewall Services Module (aka FWSM) 3.1 before 3.1(21), 3.2 before 3.2(22), 4.0 before 4.0(16), and 4.1 before 4.1(7), when IPv6 is used, allows remote attackers to cause a denial of service (memory corruption and module crash or hang) via vectors that trigger syslog…

  • CVE-2011-3288HigOct 6, 2011
    Cisco Systems, Inc.
    Unified Presence Server
    risk 0.49cvss 7.5epss 0.02

    Cisco Unified Presence before 8.5(4) does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and process crash) via a crafted XML document containing a large number of nested entity…

  • CVE-2011-3287Oct 6, 2011
    Cisco Systems, Inc.
    Jabber Extensible Communications Platform
    risk 0.00cvss —epss 0.01

    Cisco Jabber Extensible Communications Platform (aka Jabber XCP) 2.x through 5.4.x before 5.4.0.27581 and 5.8.x before 5.8.1.27561 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption,…

  • CVE-2011-3368Oct 5, 2011
    Apache
    HTTP Server
    risk 0.10cvss —epss 0.91

    The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers…

  • CVE-2010-4869Oct 5, 2011
    DBHcms
    DBHcms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in DBHcms 1.1.4 allows remote attackers to execute arbitrary SQL commands via the editmenu parameter.

  • CVE-2010-4868Oct 5, 2011
    W Agora
    W Agora
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php3 (aka search.php) in W-Agora 4.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the bn parameter.

  • CVE-2010-4867Oct 5, 2011
    W Agora
    W Agora
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in search.php3 (aka search.php) in W-Agora 4.2.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the bn parameter.

  • CVE-2010-4866Oct 5, 2011
    Chipmunk Scripts
    Chipmunk Board
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Chipmunk Board 1.3 allows remote attackers to execute arbitrary SQL commands via the forumID parameter.

  • CVE-2010-4865Oct 5, 2011
    Shiromuku
    Guestbook
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the JE Guestbook (com_jeguestbook) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the d_itemid parameter in an item_detail action to index.php.

  • CVE-2010-4864Oct 5, 2011
    Joomla
    Club Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Club Manager (com_clubmanager) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cm_id parameter in an equip presenta action to index.php.

  • CVE-2010-4863Oct 5, 2011
    Get Simple
    CMS
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in admin/changedata.php in GetSimple CMS 2.01 allows remote attackers to inject arbitrary web script or HTML via the post-title parameter.

  • CVE-2010-4862Oct 5, 2011
    Jextensions
    JE Directory
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JExtensions JE Directory (com_jedirectory) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in an item action to index.php.

  • CVE-2010-4861Oct 5, 2011
    Webspell
    Webspell
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in asearch.php in webSPELL 4.2.1 allows remote attackers to execute arbitrary SQL commands via the search parameter.

  • CVE-2010-4860Oct 5, 2011
    Phpauction
    Phpauction
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in product_desc.php in MyPhpAuction 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-4859Oct 5, 2011
    Shop Script
    Shop Script
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in WebAsyst Shop-Script allows remote attackers to execute arbitrary SQL commands via the blog_id parameter in a news action.

  • CVE-2010-4858Oct 5, 2011
    DNET
    Live-Stats
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in team.rc5-72.php in DNET Live-Stats 0.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the showlang parameter.

  • CVE-2010-4857Oct 5, 2011
    CAG
    CAG CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in click.php in CAG CMS 0.2 Beta allows remote attackers to execute arbitrary SQL commands via the itemid parameter.

  • CVE-2010-4856Oct 5, 2011
    XWeblog
    xWeblog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in arsiv.asp in xWeblog 2.2 allows remote attackers to execute arbitrary SQL commands via the tarih parameter.