VYPR

CVEs

345,986 total · page 6068 of 6,920

AllCriticalHighKEV
  • CVE-2010-2846Jul 25, 2010
    Joomla
    InterJoomla ArtForms
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the InterJoomla ArtForms (com_artforms) component 2.1b7.2 RC2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the afmsg parameter to index.php.

  • CVE-2010-2845Jul 25, 2010
    Joomla
    QuickFAQ
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the QuickFAQ (com_quickfaq) component 1.0.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a category action to index.php.

  • CVE-2010-2844Jul 25, 2010
    Newanz
    Newsoffice
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in news_show.php in Newanz NewsOffice 2.0.18 allows remote attackers to inject arbitrary web script or HTML via the n-cat parameter.

  • CVE-2009-4957Jul 22, 2010
    Interspire
    Activekb
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in loadpanel.php in Interspire ActiveKB allows remote attackers to read arbitrary files and possibly have unspecified other impact via directory traversal sequences in the Panel parameter.

  • CVE-2009-4956Jul 22, 2010
    TYPO3
    ws_stats
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Visitor Tracking (ws_stats) extension before 0.1.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4955Jul 22, 2010
    TYPO3
    th_ultracards
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the ultraCards (th_ultracards) extension before 0.5.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4954Jul 22, 2010
    TYPO3
    Versatile Calendar Extension [VCE] (sk_calendar)
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Versatile Calendar Extension [VCE] (sk_calendar) extension before 0.3.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4953Jul 22, 2010
    TYPO3
    sg_userdata
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Userdata Create/Edit (sg_userdata) extension before 0.91.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4952Jul 22, 2010
    TYPO3
    Directory Listing
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the Directory Listing (dir_listing) extension 1.1.0 and earlier for TYPO3 allows remote attackers to have an unspecified impact via unknown vectors.

  • CVE-2009-4951Jul 22, 2010
    TYPO3
    ClickStream Analyzer [output]
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the ClickStream Analyzer [output] (alternet_csa_out) extension 0.3.0 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2009-4950Jul 22, 2010
    TYPO3
    A21glossary Advanced Output
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the A21glossary Advanced Output (a21glossary_advanced_output) extension before 0.1.12 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4949Jul 22, 2010
    Joachim Ruhs
    Locator
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Store Locator extension before 1.2.8 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4948Jul 22, 2010
    Joachim Ruhs
    Locator
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Store Locator extension before 1.2.8 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4947Jul 22, 2010
    Q2 Solutions
    ConnX
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in frmLoginPwdReminderPopup.aspx in Q2 Solutions ConnX 4.0.20080606 allows remote attackers to execute arbitrary SQL commands via the txtEmail parameter.

  • CVE-2009-4946Jul 22, 2010
    Joomla
    Messaging
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in the Messaging (com_messaging) component before 1.5.1 for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter in a messages action to index.php. NOTE: the…

  • CVE-2010-2772HigJul 22, 2010
    Siemens Foundation
    Wincc
    risk 0.51cvss 7.8epss 0.01

    Siemens Simatic WinCC and PCS 7 SCADA system uses a hard-coded password, which allows local users to access a back-end database and gain privileges, as demonstrated in the wild in July 2010 by the Stuxnet worm, a different vulnerability than CVE-2010-2568.

  • CVE-2010-2771Jul 22, 2010
    IBM
    Soliddb
    risk 0.00cvss —epss 0.05

    solid.exe in IBM solidDB before 6.5 FP2 allows remote attackers to execute arbitrary code via a long username field in the first handshake packet.

  • CVE-2010-2667Jul 22, 2010
    VMware
    Studio
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in the Virtual Appliance Management Infrastructure (VAMI) in VMware Studio 2.0 allow remote authenticated users to execute arbitrary commands via vectors involving (1) the Studio virtual appliance or (2) a virtual appliance created by the…

  • CVE-2010-2568HigKEVJul 22, 2010
    Microsoft
    Windows
    risk 0.73cvss 7.8epss 0.91

    Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon…

  • CVE-2010-2427Jul 22, 2010
    VMware
    Studio
    risk 0.00cvss —epss 0.00

    VMware Studio 2.0 does not properly write to temporary files, which allows local users to gain privileges via unspecified vectors.

  • CVE-2010-2056Jul 22, 2010
    GNU
    Gv
    risk 0.00cvss —epss 0.00

    GNU gv before 3.7.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.

  • CVE-2010-2055Jul 22, 2010
    Artifex
    Ghostscript
    risk 0.00cvss —epss 0.01

    Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows local users to execute arbitrary PostScript commands via a Trojan horse file, related to improper support for the -P- option to the gs program, as demonstrated using…

  • CVE-2010-1973Jul 22, 2010
    Microfocus
    Openvms
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Auditing subsystem in HP OpenVMS 8.3, 8.2, 7.3-2, and earlier on the ALPHA platform, and 8.3-1H1, 8.3, 8.2-1, and earlier on the Itanium platform, allows local users to gain privileges or obtain sensitive information via unknown vectors.

  • CVE-2010-1972Jul 22, 2010
    Microfocus
    Client Automation Enterprise
    risk 0.00cvss —epss 0.03

    The default configuration of HP Client Automation (HPCA) Enterprise Infrastructure (aka Radia) allows remote attackers to read log files, and consequently cause a denial of service or have unspecified other impact, via web requests.

  • CVE-2010-1969Jul 22, 2010
    Microfocus
    Virtual Connect Enterprise Manager
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in HP Virtual Connect Enterprise Manager for Windows before 6.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2010-1766Jul 22, 2010
    Wpewebkit
    Webkit
    risk 0.00cvss —epss 0.02

    Off-by-one error in the WebSocketHandshake::readServerHandshake function in websockets/WebSocketHandshake.cpp in WebCore in WebKit before r56380, as used in Qt and other products, allows remote websockets servers to cause a denial of service (memory corruption) or possibly have…

  • CVE-2009-4945Jul 22, 2010
    Atutor
    Acollab
    risk 0.00cvss —epss 0.01

    AdPeeps 8.5d1 has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via requests to index.php.

  • CVE-2009-4944Jul 22, 2010
    ATRC
    ACollab
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ATRC ACollab 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) address parameter to profile.php or the (2) description parameter to events/add_event.php. NOTE: the provenance of this information…

  • CVE-2009-4943Jul 22, 2010
    Impactsoftcompany
    Adpeeps
    risk 0.00cvss —epss 0.01

    index.php in AdPeeps 8.5d1 allows remote attackers to obtain sensitive information via (1) a view_adrates action with an invalid uid parameter, which reveals the installation path in an error message; or (2) an adminlogin action with a crafted uid parameter, which reveals the…

  • CVE-2009-4942Jul 22, 2010
    ACollab
    ACollab
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in ACollab 1.2 allows remote attackers to hijack the authentication of arbitrary users for requests that add personal agenda items.

  • CVE-2009-4941Jul 22, 2010
    ATRC
    ACollab
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in sign_in.php in ATRC ACollab 1.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter.

  • CVE-2009-4940Jul 22, 2010
    Zeuscart
    Zeuscart
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Zeus Cart 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the maincatid parameter in a showmaincatlanding action.

  • CVE-2009-4939Jul 22, 2010
    Impactsoftcompany
    Adpeeps
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in AdPeeps 8.5d1 allow remote attackers to inject arbitrary web script or HTML via the (1) uid parameter, (2) uid parameter in a login_lookup action, (3) uid parameter in an adminlogin action, (4) campaignid…

  • CVE-2009-4938Jul 22, 2010
    Joomla
    JVideo!
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the JVideo! (com_jvideo) component 0.3.11c Beta and 0.3.x for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter in a user action to index.php.

  • CVE-2009-4937Jul 22, 2010
    Spirate
    Small Pirate
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Small Pirate (SPirate) 2.1 allows remote attackers to inject arbitrary web script or HTML via an onmouseover action in an img BBCode tag within a url BBCode tag.

  • CVE-2009-4936Jul 22, 2010
    Spirate
    Small Pirate
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Small Pirate (SPirate) 2.1 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to the default URI in an rss .xml action, or the id parameter to (2) pag1.php, (3) pag1-guest.php, (4) rss-comment_post.php (aka…

  • CVE-2009-4897Jul 22, 2010
    Artifex
    Ghostscript
    risk 0.01cvss —epss 0.07

    Buffer overflow in gs/psi/iscan.c in Ghostscript 8.64 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document containing a long name.

  • CVE-2010-1971Jul 15, 2010
    Microfocus
    Insight Software Installer
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in HP Insight Software Installer for Windows before 6.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors, a different vulnerability than CVE-2010-1968.

  • CVE-2010-1970Jul 15, 2010
    Microfocus
    Insight Software Installer
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in HP Insight Software Installer for Windows before 6.1 allows local users to read or modify data, and consequently gain privileges, via unknown vectors.

  • CVE-2010-1968Jul 15, 2010
    Microfocus
    Insight Software Installer
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in HP Insight Software Installer for Windows before 6.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors, a different vulnerability than CVE-2010-1971.

  • CVE-2010-1967Jul 15, 2010
    Microfocus
    Insight Software Installer
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in HP Insight Software Installer for Windows before 6.1 allows local users to read or modify data via unknown vectors.

  • CVE-2010-1966Jul 15, 2010
    Microfocus
    Insight Control
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in HP Insight Control power management for Windows before 6.1 allows local users to read or modify data, or cause a denial of service, via unknown vectors.

  • CVE-2010-1965Jul 15, 2010
    Microfocus
    Insight Orchestration
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP Insight Orchestration for Windows before 6.1 allows remote attackers to read or modify data via unknown vectors.

  • CVE-2010-1881Jul 15, 2010
    Microsoft
    Access
    risk 0.02cvss —epss 0.20

    The FieldList ActiveX control in the Microsoft Access Wizard Controls in ACCWIZ.dll in Microsoft Office Access 2003 SP3 does not properly interact with the memory-access approach used by Internet Explorer and Office during instantiation, which allows remote attackers to execute…

  • CVE-2010-0814Jul 15, 2010
    Microsoft
    Access
    risk 0.02cvss —epss 0.23

    The Microsoft Access Wizard Controls in ACCWIZ.dll in Microsoft Office Access 2003 SP3 and 2007 SP1 and SP2 do not properly interact with the memory-allocation approach used by Internet Explorer during instantiation, which allows remote attackers to execute arbitrary code via a…

  • CVE-2010-0266Jul 15, 2010
    Microsoft
    Outlook
    risk 0.07cvss —epss 0.55

    Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD property value of ATTACH_BY_REFERENCE, which allows user-assisted remote attackers to execute arbitrary code via a crafted message, aka…

  • CVE-2010-2403Jul 13, 2010
    Oracle Corporation
    Peoplesoft And Jdedwards Suite Campus Solutions
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the PeopleSoft Enterprise Campus Solutions component in Oracle PeopleSoft and JDEdwards Suite Campus Solutions 9.0 Bundle #17 allows remote authenticated users to affect confidentiality via unknown vectors.

  • CVE-2010-2402Jul 13, 2010
    Oracle Corporation
    Peoplesoft Enterprise Peopletools
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft and JDEdwards Suite 8.49.27 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

  • CVE-2010-2401Jul 13, 2010
    Oracle Corporation
    Peoplesoft And Jdedwards Suite Hcm
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the PeopleSoft Enterprise HCM - eProfile Mgr component in Oracle PeopleSoft and JDEdwards Suite HCM 9.0 Bundle #9 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

  • CVE-2010-2400Jul 13, 2010
    Oracle Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Oracle Solaris 9 and 10, and OpenSolaris, allows local users to affect availability via unknown vectors related to Kernel/Filesystem.