VYPR

CVEs

346,031 total · page 6054 of 6,921

AllCriticalHighKEV
  • CVE-2010-3602Sep 24, 2010
    MojoPortal
    mojoPortal
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in ProfileView.aspx in mojoPortal 2.3.4.3 and 2.3.5.1 allows remote attackers to inject arbitrary web script or HTML via the User ID parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-3601Sep 24, 2010
    IbPhotohost
    ibPhotohost
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in ibPhotohost 1.1.2 allows remote attackers to execute arbitrary SQL commands via the img parameter.

  • CVE-2010-3081HigSep 24, 2010
    Linux
    Kernel
    risk 0.54cvss 7.8epss 0.04

    The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging…

  • CVE-2010-3306Sep 24, 2010
    Weborf
    weborf
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in the modURL function in instance.c in Weborf before 0.12.3 allows remote attackers to read arbitrary files via ..%2f sequences in a URI.

  • CVE-2010-3304Sep 24, 2010
    Dovecot (software)
    Dovecot
    risk 0.00cvss —epss 0.03

    The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.

  • CVE-2010-3294Sep 24, 2010
    PHP
    APC
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in apc.php in the Alternative PHP Cache (APC) extension before 3.1.4 for PHP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-3285Sep 24, 2010
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to cause a denial of service via unknown vectors.

  • CVE-2010-3284Sep 24, 2010
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP System Management Homepage (SMH) before 6.2 allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2010-3283Sep 24, 2010
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in HP System Management Homepage (SMH) before 6.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2010-3261Sep 24, 2010
    Rsa
    Authentication Agent For Web
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in RSA Authentication Agent 7.0 before P2 for Web allows remote attackers to read unspecified data via unknown vectors.

  • CVE-2010-2491Sep 24, 2010
    Roundup Tracker
    Roundup
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script or HTML via the template argument to the /issue program.

  • CVE-2010-1825Sep 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in WebKit, as used in Google Chrome before 6.0.472.59, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to nested SVG elements.

  • CVE-2010-1824Sep 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.04

    Use-after-free vulnerability in WebKit, as used in Apple iTunes before 10.2 on Windows, Apple Safari, and Google Chrome before 6.0.472.59, allows remote attackers to execute arbitrary code or cause a denial of service via vectors related to SVG styles, the DOM tree, and error…

  • CVE-2010-1823Sep 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    Use-after-free vulnerability in WebKit before r65958, as used in Google Chrome before 6.0.472.59, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger use of document APIs such as document.close during parsing,…

  • CVE-2010-1773HigSep 24, 2010
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.02

    Off-by-one error in the toAlphabetic function in rendering/RenderListMarker.cpp in WebCore in WebKit before r59950, as used in Google Chrome before 5.0.375.70, allows remote attackers to obtain sensitive information, cause a denial of service (memory corruption and application…

  • CVE-2010-1772HigSep 24, 2010
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.02

    Use-after-free vulnerability in page/Geolocation.cpp in WebCore in WebKit before r59859, as used in Google Chrome before 5.0.375.70, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site, related to failure to…

  • CVE-2010-1767Sep 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in loader/DocumentThreadableLoader.cpp in WebCore in WebKit before r57041, as used in Google Chrome before 4.1.249.1059, allows remote attackers to hijack the authentication of unspecified victims via a crafted synchronous…

  • CVE-2010-3281Sep 23, 2010
    Alcatel Lucent
    Omnivista 4760 Server
    risk 0.00cvss —epss 0.02

    Stack-based buffer overflow in the HTTP proxy service in Alcatel-Lucent OmniVista 4760 server before R5.1.06.03.c_Patch3 allows remote attackers to execute arbitrary code or cause a denial of service (service crash) via a long request.

  • CVE-2010-3280Sep 23, 2010
    Alcatel Lucent
    Ccagent
    risk 0.00cvss —epss 0.01

    The CCAgent option 9.0.8.4 and earlier in the management server (aka TSA) component in Alcatel-Lucent OmniTouch Contact Center Standard Edition relies on client-side authorization checking, and unconditionally sends the SuperUser password to the client for use during an…

  • CVE-2010-3279Sep 23, 2010
    Alcatel Lucent
    Ccagent
    risk 0.00cvss —epss 0.01

    The default configuration of the CCAgent option before 9.0.8.4 in the management server (aka TSA) component in Alcatel-Lucent OmniTouch Contact Center Standard Edition enables maintenance access, which allows remote attackers to monitor or reconfigure Contact Center operations…

  • CVE-2010-2836Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Memory leak in the SSL VPN feature in Cisco IOS 12.4, 15.0, and 15.1, when HTTP port redirection is enabled, allows remote attackers to cause a denial of service (memory consumption) by improperly disconnecting SSL sessions, leading to connections that remain in the CLOSE-WAIT…

  • CVE-2010-2835Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5), 7.0 before 7.0(2a)su3, 7.1su before 7.1(3b)su2, 7.1 before 7.1(5), and 8.0 before 8.0(1)…

  • CVE-2010-2834Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)SU1, 7.x before 7.1(5), and 8.0 before 8.0(2) allow remote attackers to cause a denial of…

  • CVE-2010-2833Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the NAT for H.225.0 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1 allows remote attackers to cause a denial of service (device reload) via transit traffic, aka Bug ID CSCtd86472.

  • CVE-2010-2832Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the NAT for H.323 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1 allows remote attackers to cause a denial of service (device reload) via transit traffic, aka Bug ID CSCtf91428.

  • CVE-2010-2831Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the NAT for SIP implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1 allows remote attackers to cause a denial of service (device reload) via transit traffic on UDP port 5060, aka Bug ID CSCtf17624.

  • CVE-2010-2830Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    The IGMPv3 implementation in Cisco IOS 12.2, 12.3, 12.4, and 15.0 and IOS XE 2.5.x before 2.5.2, when PIM is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed IGMP packet, aka Bug ID CSCte14603.

  • CVE-2010-2829Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the H.323 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 2.5.x before 2.5.2 and 2.6.x before 2.6.1, allows remote attackers to cause a denial of service (traceback and device reload) via crafted H.323 packets, aka Bug…

  • CVE-2010-2828Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the H.323 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 2.5.x before 2.5.2 and 2.6.x before 2.6.1, allows remote attackers to cause a denial of service (device reload) via crafted H.323 packets, aka Bug ID CSCtc73759.

  • CVE-2010-3489Sep 22, 2010
    Digitalworkroom
    CMS Digital Workroom
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in netautor/napro4/home/login2.php in CMS Digital Workroom (formerly Netautor Professional) 5.5.0 allows remote attackers to inject arbitrary web script or HTML via the goback parameter.

  • CVE-2010-3488Sep 22, 2010
    Houbysoft
    Quickshare
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in QuickShare 1.0 allows remote attackers to read arbitrary files via a ... (triple dot) in the URL.

  • CVE-2010-3487Sep 22, 2010
    Yellosoft
    Pinky
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in YelloSoft Pinky 1.0 for Windows allows remote attackers to read arbitrary files via a %5C (encoded backslash) in the URL.

  • CVE-2010-3486Sep 22, 2010
    SmarterMail
    SmarterMail
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in FileStorageUpload.ashx in SmarterMail 7.1.3876 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slash), (2) %5C (encoded backslash), or (3) %255c (double-encoded backslash) in the name parameter.

  • CVE-2010-3485Sep 22, 2010
    Lightneasy
    Lightneasy
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the userhandle cookie to LightNEasy.php, a different vector than CVE-2008-6593. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2010-3484Sep 22, 2010
    Lightneasy
    Lightneasy
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the handle parameter to LightNEasy.php, a different vector than CVE-2008-6593.

  • CVE-2010-3483Sep 22, 2010
    Primitive CMS
    Primitive CMS
    risk 0.03cvss —epss 0.02

    cms_write.php in Primitive CMS 1.0.9 does not properly restrict access, which allows remote attackers to gain administrative privileges via a direct request. NOTE: this vulnerability can be leveraged to conduct cross-site scripting attacks, as demonstrated using the (1) title,…

  • CVE-2010-3482Sep 22, 2010
    Primitive
    Primitive CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in cms_write.php in Primitive CMS 1.0.9 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) title and (2) menutitle parameters. NOTE: this can be leveraged with CVE-2010-3483 to conduct attacks without…

  • CVE-2010-3481Sep 22, 2010
    Apphp
    PHP Microcms
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) user_name and (2) password variables, possibly related to include/classes/Login.php. NOTE:…

  • CVE-2010-3480Sep 22, 2010
    Apphp
    PHP Microcms
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.

  • CVE-2010-3479Sep 22, 2010
    Boutikone
    Boutikone
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in list.php in BoutikOne 1.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2009-5003Sep 22, 2010
    Softbizscripts
    Banner Exchange Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in click.php in e-soft24 Banner Exchange Script 1.0 allows remote attackers to execute arbitrary SQL commands via the targetid parameter.

  • CVE-2010-3332Sep 22, 2010
    Microsoft
    .net Framework
    risk 0.08cvss —epss 0.67

    Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View…

  • CVE-2010-3314Sep 22, 2010
    Egroupware
    Egroupware
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in login.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to inject arbitrary web script or HTML via the lang…

  • CVE-2010-3313Sep 22, 2010
    Egroupware
    Egroupware
    risk 0.04cvss —epss 0.09

    phpgwapi/js/fckeditor/editor/dialog/fck_spellerpages/spellerpages/serverscripts/spellchecker.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to execute…

  • CVE-2010-3301Sep 22, 2010
    Linux
    Kernel
    risk 0.03cvss —epss 0.04

    The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by…

  • CVE-2010-3477Sep 21, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The tcf_act_police_dump function in net/sched/act_police.c in the actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc4 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive…

  • CVE-2010-3094Sep 21, 2010
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.18 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) an action description, (2) an action message, (3) a node, or (4) a taxonomy term, related to the…

  • CVE-2010-3093Sep 21, 2010
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    The comment module in Drupal 5.x before 5.23 and 6.x before 6.18 allows remote authenticated users with certain privileges to bypass intended access restrictions and reinstate removed comments via a crafted URL, related to an "unpublishing bypass" issue.

  • CVE-2010-3092Sep 21, 2010
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    The upload module in Drupal 5.x before 5.23 and 6.x before 6.18 does not properly support case-insensitive filename handling in a database configuration, which allows remote authenticated users to bypass the intended restrictions on downloading a file by uploading a different…

  • CVE-2010-1820Sep 21, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Apple Filing Protocol (AFP) Server in Apple Mac OS X 10.6.x through 10.6.4 does not properly handle errors, which allows remote attackers to bypass the password requirement for shared-folder access by leveraging knowledge of a valid account name.