VYPR

CVEs

346,117 total · page 6034 of 6,923

AllCriticalHighKEV
  • CVE-2010-4265Dec 30, 2010
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.00cvss —epss 0.02

    The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09 allows…

  • CVE-2010-3923Dec 30, 2010
    Hibara
    Attachecase
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in AttacheCase before 2.70 allows local users to gain privileges via a Trojan horse executable file in the current working directory.

  • CVE-2010-3878Dec 30, 2010
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the JMX Console in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 allows remote attackers to hijack the authentication of administrators for requests that deploy WAR files.

  • CVE-2010-3862Dec 30, 2010
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.00cvss —epss 0.03

    The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09, and 5.1.0;…

  • CVE-2010-3708Dec 30, 2010
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.00cvss —epss 0.03

    The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute…

  • CVE-2010-4623Dec 30, 2010
    IBM
    Tivoli Access Manager For E Business
    risk 0.00cvss —epss 0.01

    WebSEAL in IBM Tivoli Access Manager for e-business 6.1.1 before 6.1.1-TIV-AWS-FP0001 allows remote authenticated users to cause a denial of service (worker thread consumption) via shift-reload actions.

  • CVE-2010-4622Dec 30, 2010
    IBM
    Tivoli Access Manager For E Business
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in WebSEAL in IBM Tivoli Access Manager for e-business 6.1.1 before 6.1.1-TIV-AWS-FP0001 on AIX allows remote attackers to read arbitrary files via a %uff0e%uff0e (encoded dot dot) in a URI.

  • CVE-2010-4507Dec 30, 2010
    Clear
    Ispot
    risk 0.03cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities on the iSpot 2.0.0.0 R1679, and the ClearSpot 2.0.0.0 R1512 and R1786, with firmware 1.9.9.4 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary commands via the…

  • CVE-2010-4352Dec 30, 2010
    D Bus Project
    dbus
    risk 0.00cvss —epss 0.01

    Stack consumption vulnerability in D-Bus (aka DBus) before 1.4.1 allows local users to cause a denial of service (daemon crash) via a message containing many nested variants.

  • CVE-2010-4342Dec 30, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    The aun_incoming function in net/econet/af_econet.c in the Linux kernel before 2.6.37-rc6, when Econet is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending an Acorn Universal Networking (AUN) packet over UDP.

  • CVE-2010-4321Dec 30, 2010
    Novell
    Iprint
    risk 0.06cvss —epss 0.33

    Stack-based buffer overflow in an ActiveX control in ienipp.ocx in Novell iPrint Client 5.52 allows remote attackers to execute arbitrary code via a long argument to (1) the GetDriverSettings2 method, as reachable by (2) the GetDriverSettings method.

  • CVE-2010-4276Dec 30, 2010
    Livezilla
    Livezilla
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the lz_tracking_set_sessid function in templates/jscript/jstrack.tpl in LiveZilla 3.2.0.2 allows remote attackers to inject arbitrary web script or HTML via the livezilla parameter in a track action to server.php.

  • CVE-2010-4258Dec 30, 2010
    Linux
    Kernel
    risk 0.03cvss —epss 0.03

    The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1)…

  • CVE-2010-4161Dec 30, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The udp_queue_rcv_skb function in net/ipv4/udp.c in a certain Red Hat build of the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows attackers to cause a denial of service (deadlock and system hang) by sending UDP traffic to a socket that has a crafted socket…

  • CVE-2010-4158Dec 30, 2010
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    The sk_run_filter function in net/core/filter.c in the Linux kernel before 2.6.36.2 does not check whether a certain memory location has been initialized before executing a (1) BPF_S_LD_MEM or (2) BPF_S_LDX_MEM instruction, which allows local users to obtain potentially…

  • CVE-2010-3850Dec 30, 2010
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2 does not require the CAP_NET_ADMIN capability, which allows local users to bypass intended access restrictions and configure econet addresses via an SIOCSIFADDR ioctl call.

  • CVE-2010-3849Dec 30, 2010
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an econet address is configured, allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a sendmsg call that specifies a NULL value for the remote…

  • CVE-2010-3848Dec 30, 2010
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    Stack-based buffer overflow in the econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an econet address is configured, allows local users to gain privileges by providing a large number of iovec structures.

  • CVE-2010-4619Dec 29, 2010
    Webscripti
    Mafya Oyun Scrpti
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in profil.php in Mafya Oyun Scrpti (aka Mafia Game Script) allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-4618Dec 29, 2010
    Algisinfo
    Aicontactsafe
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Algis Info aiContactSafe component before 2.0.14 for Joomla! allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-4617Dec 29, 2010
    Joomla
    JotLoader
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in the JotLoader (com_jotloader) component 2.2.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php.

  • CVE-2010-4616Dec 29, 2010
    Impresscms
    Impresscms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in modules/content/admin/content.php in ImpressCMS 1.2.3 Final, and possibly other versions before 1.2.4, allows remote attackers to inject arbitrary web script or HTML via the quicksearch_ContentContent parameter.

  • CVE-2010-4615Dec 29, 2010
    Oto Galeri Sistemi
    Oto Galeri Sistemi
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Oto Galeri Sistemi 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) arac parameter to carsdetail.asp and the (2) marka parameter to twohandscars.asp.

  • CVE-2010-4614Dec 29, 2010
    Mhproducts
    Ero Auktion
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in item.php in Ero Auktion 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2010-0723.

  • CVE-2010-4613Dec 29, 2010
    Hycus
    CMS
    risk 0.03cvss —epss 0.06

    Multiple directory traversal vulnerabilities in Hycus CMS 1.0.3 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the site parameter to (1) index.php and (2) admin.php.

  • CVE-2010-4612Dec 29, 2010
    Hycus
    CMS
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in index.php in Hycus CMS 1.0.3, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) user_name and (2) usr_email parameters to user/1/hregister.html, (3) usr_email parameter to…

  • CVE-2010-4611Dec 29, 2010
    HTML Edit
    CMS
    risk 0.03cvss —epss 0.02

    Html-edit CMS 3.1.8 allows remote attackers to obtain sensitive information via a direct request to (1) pages.php and (2) menu.php in includes/core_files and (3) extensions/login/frontend/pages/antihacker.php, which reveals the installation path in an error message.

  • CVE-2010-4610Dec 29, 2010
    HTML Edit
    CMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Html-edit CMS 3.1.8 allows remote attackers to inject arbitrary web script or HTML via the error parameter.

  • CVE-2010-4609Dec 29, 2010
    HTML Edit
    CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Html-edit CMS 3.1.8 allows remote attackers to execute arbitrary SQL commands via the nuser parameter in a registrate action.

  • CVE-2010-4608Dec 29, 2010
    Habariproject
    Habari
    risk 0.03cvss —epss 0.02

    Habari 0.6.5 allows remote attackers to obtain sensitive information via a direct request to (1) header.php and (2) comments_items.php in system/admin/, which reveals the installation path in an error message.

  • CVE-2010-4607Dec 29, 2010
    Habariproject
    Habari
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Habari 0.6.5, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) additem_form parameter to system/admin/dash_additem.php and the (2) status_data[] parameter to…

  • CVE-2010-4606Dec 29, 2010
    IBM
    Tivoli Storage Manager
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the Space Management client in the Hierarchical Storage Management (HSM) component in IBM Tivoli Storage Manager (TSM) 5.4.x before 5.4.3.4, 5.5.x before 5.5.3, 6.1.x before 6.1.4, and 6.2.x before 6.2.2 on Unix and Linux allows remote attackers to…

  • CVE-2010-4605Dec 29, 2010
    IBM
    Tivoli Storage Manager
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.6.10, 5.4.x before 5.4.3.4, 5.5.x before 5.5.3, 6.1.x before 6.1.4, and 6.2.x before 6.2.2 on Unix and Linux allows local users to overwrite arbitrary files via unknown…

  • CVE-2010-4604Dec 29, 2010
    IBM
    Tivoli Storage Manager
    risk 0.03cvss —epss 0.01

    Stack-based buffer overflow in the GeneratePassword function in dsmtca (aka the Trusted Communications Agent or TCA) in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.6.10, 5.4.x before 5.4.3.4, 5.5.x before 5.5.2.10, and 6.1.x before 6.1.3.1 on…

  • CVE-2010-4603Dec 29, 2010
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.02

    IBM Rational ClearQuest 7.0.x before 7.0.1.11, 7.1.1.x before 7.1.1.4, and 7.1.2.x before 7.1.2.1 does not prevent modification of back-reference fields, which allows remote authenticated users to interfere with intended record relationships, and possibly cause a denial of…

  • CVE-2010-4602Dec 29, 2010
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.01

    The Web client in IBM Rational ClearQuest 7.1.1.x before 7.1.1.4 and 7.1.2.x before 7.1.2.1 allows remote authenticated users to bypass "restricted user" limitations, and read arbitrary records, via a modified record number in the URL for a RECORD action, as demonstrated by a…

  • CVE-2010-4601Dec 29, 2010
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in IBM Rational ClearQuest 7.0.x before 7.0.1.11, 7.1.1.x before 7.1.1.4, and 7.1.2.x before 7.1.2.1 allow attackers to have an unknown impact via vectors related to third-party .ocx files.

  • CVE-2010-4600Dec 29, 2010
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.01

    Dojo Toolkit, as used in the Web client in IBM Rational ClearQuest 7.1.1.x before 7.1.1.4 and 7.1.2.x before 7.1.2.1, allows remote attackers to read cookies by navigating to a Dojo file, related to an "open direct" issue.

  • CVE-2010-4565Dec 29, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The bcm_connect function in net/can/bcm.c (aka the Broadcast Manager) in the Controller Area Network (CAN) implementation in the Linux kernel 2.6.36 and earlier creates a publicly accessible file with a filename containing a kernel memory address, which allows local users to…

  • CVE-2010-4343MedDec 29, 2010
    Linux
    Kernel
    risk 0.36cvss 5.5epss 0.00

    drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure, which allows local users to cause a denial of service (system crash) via read operations on an fc_host statistics file.

  • CVE-2010-3874Dec 29, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Heap-based buffer overflow in the bcm_connect function in net/can/bcm.c (aka the Broadcast Manager) in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.36.2 on 64-bit platforms might allow local users to cause a denial of service (memory…

  • CVE-2010-3859Dec 29, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Multiple integer signedness errors in the TIPC implementation in the Linux kernel before 2.6.36.2 allow local users to gain privileges via a crafted sendmsg call that triggers a heap-based buffer overflow, related to the tipc_msg_build function in net/tipc/msg.c and the…

  • CVE-2010-4599Dec 23, 2010
    Ecava
    Integraxor
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in Ecava IntegraXor 3.6.4000.0 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2010-4598Dec 23, 2010
    Ecava
    Integraxor
    risk 0.05cvss —epss 0.26

    Directory traversal vulnerability in Ecava IntegraXor 3.6.4000.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file_name parameter in an open request.

  • CVE-2010-4597Dec 23, 2010
    Ecava
    Integraxor
    risk 0.05cvss —epss 0.19

    Stack-based buffer overflow in the save method in the IntegraXor.Project ActiveX control in igcomm.dll in Ecava IntegraXor Human-Machine Interface (HMI) before 3.5.3900.10 allows remote attackers to execute arbitrary code via a long string in the second argument.

  • CVE-2010-4588Dec 23, 2010
    Microsoft
    Wmi Administrative Tools
    risk 0.06cvss —epss 0.33

    The WBEMSingleView.ocx ActiveX control 1.50.1131.0 in Microsoft WMI Administrative Tools 1.1 and earlier allows remote attackers to execute arbitrary code via a crafted argument to the ReleaseContext method, a different vector than CVE-2010-3973, possibly an untrusted pointer…

  • CVE-2010-4521Dec 23, 2010
    Drupal
    Views
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Views module 6.x before 6.x-2.12 for Drupal allows remote attackers to inject arbitrary web script or HTML via a page path.

  • CVE-2010-4520Dec 23, 2010
    Drupal
    Views
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Views module 6.x before 6.x-2.11 for Drupal allow remote attackers to inject arbitrary web script or HTML via (1) a URL or (2) an aggregator feed title.

  • CVE-2010-4519Dec 23, 2010
    Drupal
    Views
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Views UI implementation in the Views module 5.x before 5.x-1.8 and 6.x before 6.x-2.11 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable all Views or (2)…

  • CVE-2010-3973Dec 23, 2010
    Microsoft
    Wmi Administrative Tools
    risk 0.09cvss —epss 0.72

    The WMITools ActiveX control in WBEMSingleView.ocx 1.50.1131.0 in Microsoft WMI Administrative Tools 1.1 and earlier in Microsoft Windows XP SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted argument to the AddContextRef method, possibly an untrusted…