VYPR

CVEs

346,028 total · page 6061 of 6,921

AllCriticalHighKEV
  • CVE-2010-2361Aug 25, 2010
    Winny
    Winny
    risk 0.00cvss —epss 0.01

    Winny 2.0b7.1 and earlier does not properly process BBS information, which has unspecified impact and remote attack vectors that might lead to use of the product's host for DDoS attacks.

  • CVE-2010-2360Aug 25, 2010
    Winny
    Winny
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in Winny 2.0b7.1 and earlier might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2006-2007.

  • CVE-2010-1808Aug 25, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X 10.5.8 and 10.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted embedded font in a document.

  • CVE-2010-1802Aug 25, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    libsecurity in Apple Mac OS X 10.5.8 and 10.6.4 does not properly perform comparisons to domain-name strings in X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a certificate associated with a similar domain name, as demonstrated by use of a…

  • CVE-2010-1801Aug 25, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in CoreGraphics in Apple Mac OS X 10.5.8 and 10.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF file.

  • CVE-2010-1800Aug 25, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    CFNetwork in Apple Mac OS X 10.6.3 and 10.6.4 supports anonymous SSL and TLS connections, which allows man-in-the-middle attackers to redirect a connection and obtain sensitive information via crafted responses.

  • CVE-2009-4995Aug 25, 2010
    Smartertools
    Smartertrack
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the email address field. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2009-4994Aug 25, 2010
    Smartertools
    Smartertrack
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2009-4993Aug 25, 2010
    Script Shop24
    Lm Starmail Paidmail
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in home.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

  • CVE-2009-4992Aug 25, 2010
    LM Starmail
    Paidmail
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in paidbanner.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2009-4991Aug 25, 2010
    Omnistaretools
    Omnistar Recruiting
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in users/resume_register.php in Omnistar Recruiting allows remote attackers to inject arbitrary web script or HTML via the job2 parameter.

  • CVE-2009-4990Aug 25, 2010
    Drupal
    Webform Report
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Webform report module 5.x and 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via a submission.

  • CVE-2009-4989Aug 25, 2010
    AJ Square
    Aj Auction Pro Oopd
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in AJ Auction Pro OOPD 3.0 allows remote attackers to inject arbitrary web script or HTML via the txtkeyword parameter in a search action.

  • CVE-2009-4988Aug 25, 2010
    SAP
    Business One 2005 A
    risk 0.08cvss —epss 0.66

    Stack-based buffer overflow in NT_Naming_Service.exe in SAP Business One 2005 A 6.80.123 and 6.80.320 allows remote attackers to execute arbitrary code via a long GIOP request to TCP port 30000.

  • CVE-2009-4987Aug 25, 2010
    Scripteen
    Free Image Hosting Script
    risk 0.04cvss —epss 0.06

    admin/header.php in Scripteen Free Image Hosting Script 2.3 allows remote attackers to bypass authentication and gain administrative access by setting the cookgid cookie value to 1, a different vector than CVE-2008-3211.

  • CVE-2009-4986Aug 25, 2010
    In Portal
    In Portal
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in In-Portal 4.3.1, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the env parameter.

  • CVE-2009-4985Aug 25, 2010
    Accessories Me
    PHP Affiliate Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in browse.php in Accessories Me PHP Affiliate Script 1.4 allows remote attackers to execute arbitrary SQL commands via the Go parameter.

  • CVE-2009-4984Aug 25, 2010
    Accessories Me
    PHP Affiliate Script
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Accessories Me PHP Affiliate Script 1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) Keywords parameter to search.php and (2) SearchIndex parameter to browse.php.

  • CVE-2009-4983Aug 25, 2010
    Silurus Classifieds
    Silurus Classifieds
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Silurus Classifieds 1.0 allow remote attackers to inject arbitrary web script or HTML via the ID parameter to (1) category.php and (2) wcategory.php, and the (3) keywords parameter to search.php.

  • CVE-2009-4982Aug 25, 2010
    Irokez
    Irokez CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the select function in Irokez CMS 0.7.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to the default URI.

  • CVE-2009-4981Aug 25, 2010
    Keil Software
    Gallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Photokorn Gallery 1.81 allow remote attackers to hijack the authentication of administrators.

  • CVE-2009-4980Aug 25, 2010
    Keil Software
    Gallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Photokorn Gallery 1.81 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) where[] parameter to search.php and (2) qc parameter to admin.php.

  • CVE-2009-4979Aug 25, 2010
    Keil Software
    Gallery
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in search.php in Photokorn Gallery 1.81 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) where[], (2) sort, (3) order, and (4) Match parameters.

  • CVE-2009-4978Aug 25, 2010
    Tufat
    Mybackup
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in down.php in MyBackup 1.4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.

  • CVE-2009-4977Aug 25, 2010
    Tufat
    Mybackup
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in MyBackup 1.4.0 allows remote authenticated users to execute arbitrary PHP code via a URL in the main_content parameter.

  • CVE-2010-1526Aug 24, 2010
    Mono
    Libgdiplus
    risk 0.00cvss —epss 0.02

    Multiple integer overflows in libgdiplus 2.6.7, as used in Mono, allow attackers to execute arbitrary code via (1) a crafted TIFF file, related to the gdip_load_tiff_image function in tiffcodec.c; (2) a crafted JPEG file, related to the gdip_load_jpeg_image_internal function in…

  • CVE-2010-3120Aug 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 5.0.375.127 does not properly implement the Geolocation feature, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

  • CVE-2010-3119Aug 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 5.0.375.127 and webkitgtk before 1.2.6 do not properly support the Ruby language, which allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

  • CVE-2010-3118Aug 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The autosuggest feature in the Omnibox implementation in Google Chrome before 5.0.375.127 does not anticipate entry of passwords, which might allow remote attackers to obtain sensitive information by reading the network traffic generated by this feature.

  • CVE-2010-3117Aug 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 5.0.375.127 does not properly implement the notifications feature, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via unknown vectors.

  • CVE-2010-3116Aug 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.04

    Multiple use-after-free vulnerabilities in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 5.0.375.127, and webkitgtk before 1.2.6, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via…

  • CVE-2010-3115Aug 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Google Chrome before 5.0.375.127, and webkitgtk before 1.2.6, does not properly implement the history feature, which might allow remote attackers to spoof the address bar via unspecified vectors.

  • CVE-2010-3114Aug 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The text-editing implementation in Google Chrome before 5.0.375.127, and webkitgtk before 1.2.6, does not check a node type before performing a cast, which has unspecified impact and attack vectors related to (1) DeleteSelectionCommand.cpp, (2) InsertLineBreakCommand.cpp, or (3)…

  • CVE-2010-3113Aug 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    Google Chrome before 5.0.375.127, and webkitgtk before 1.2.5, does not properly handle SVG documents, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors related to state changes when using…

  • CVE-2010-3112Aug 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 5.0.375.127 does not properly implement file dialogs, which allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

  • CVE-2010-3111Aug 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 6.0.472.53 does not properly mitigate an unspecified flaw in the Windows kernel, which has unknown impact and attack vectors, a different vulnerability than CVE-2010-2897.

  • CVE-2010-3056Aug 24, 2010
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.11.x before 2.11.10.1 and 3.x before 3.3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) db_search.php, (2) db_sql.php, (3) db_structure.php, (4) js/messages.php, (5)…

  • CVE-2010-3055Aug 24, 2010
    PhpMyAdmin
    phpMyAdmin
    risk 0.01cvss —epss 0.15

    The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.

  • CVE-2010-2947Aug 24, 2010
    Libhx
    libHX
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields.

  • CVE-2010-2811Aug 24, 2010
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.01

    Virtual Desktop Server Manager (VDSM) in Red Hat Enterprise Virtualization (RHEV) 2.2 does not properly accept TCP connections for SSL sessions, which allows remote attackers to cause a denial of service (daemon outage) via crafted SSL traffic.

  • CVE-2010-2784Aug 24, 2010
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.00

    The subpage MMIO initialization functionality in the subpage_register function in exec.c in QEMU-KVM, as used in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and KVM 83, does not properly select the index for access to the callback array,…

  • CVE-2010-0435Aug 24, 2010
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.00

    The Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2, and KVM 83, when the Intel VT-x extension is enabled, allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via vectors related to instruction…

  • CVE-2010-0431Aug 24, 2010
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.00

    QEMU-KVM, as used in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and KVM 83, does not properly validate guest QXL driver pointers, which allows guest OS users to cause a denial of service (invalid pointer dereference and guest OS crash)…

  • CVE-2010-0429Aug 24, 2010
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.00

    libspice, as used in QEMU-KVM in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and qspice 0.3.0, does not properly restrict the addresses upon which memory-management actions are performed, which allows guest OS users to cause a denial of…

  • CVE-2010-0428Aug 24, 2010
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.00

    libspice, as used in QEMU-KVM in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and qspice 0.3.0, does not properly validate guest QXL driver pointers, which allows guest OS users to cause a denial of service (invalid pointer dereference and…

  • CVE-2010-3109Aug 23, 2010
    Novell
    Iprint
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in the browser plugin in Novell iPrint Client before 5.42 allows remote attackers to execute arbitrary code via a long operation parameter.

  • CVE-2010-3108Aug 23, 2010
    Novell
    Iprint
    risk 0.00cvss —epss 0.05

    Buffer overflow in the browser plugin in Novell iPrint Client before 5.42 allows remote attackers to execute arbitrary code by using EMBED elements to pass parameters with long names.

  • CVE-2010-3107Aug 23, 2010
    Novell
    Iprint
    risk 0.00cvss —epss 0.01

    A certain ActiveX control in ienipp.ocx in the browser plugin in Novell iPrint Client before 5.42 does not properly restrict the set of files to be deleted, which allows remote attackers to cause a denial of service (recursive file deletion) via unspecified vectors related to a…

  • CVE-2010-3106Aug 23, 2010
    Novell
    Iprint
    risk 0.06cvss —epss 0.37

    The ienipp.ocx ActiveX control in the browser plugin in Novell iPrint Client before 5.42 does not properly validate the debug parameter, which allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a parameter value with a…

  • CVE-2010-3105Aug 23, 2010
    Novell
    Iprint
    risk 0.00cvss —epss 0.03

    The PluginGetDriverFile function in Novell iPrint Client before 5.44 interprets an uninitialized memory location as a pointer value, which allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: the provenance of this information is unknown; the details…