VYPR

CVEs

345,986 total · page 6070 of 6,920

AllCriticalHighKEV
  • CVE-2009-3763Jul 13, 2010
    Oracle Corporation
    Opensso Enterprise
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Access Manager / OpenSSO component in Oracle OpenSSO Enterprise 7.1, 7, 2005Q4, and 8.0 allows remote attackers to affect integrity via unknown vectors.

  • CVE-2010-2693Jul 13, 2010
    FreeBSD
    FreeBSD
    risk 0.03cvss —epss 0.01

    FreeBSD 7.1 through 8.1-PRERELEASE does not copy the read-only flag when creating a duplicate mbuf buffer reference, which allows local users to cause a denial of service (system file corruption) and gain privileges via the sendfile system call.

  • CVE-2010-2008Jul 13, 2010
    MySQL
    MySQL
    risk 0.04cvss —epss 0.09

    MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . (dot), .. (dot dot), ../ (dot dot slash) or similar sequence,…

  • CVE-2010-2724Jul 13, 2010
    Drupal
    Hierarchical Select
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Hierarchical Select module 5.x before 5.x-3.2 and 6.x before 6.x-3.2 for Drupal allows remote authenticated users, with administer taxonomy permissions, to inject arbitrary web script or HTML via unspecified vectors in the…

  • CVE-2010-2723Jul 13, 2010
    Lsoft
    Listserv
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in LISTSERV 15 and 16 allows remote attackers to inject arbitrary web script or HTML via the T parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2010-2722Jul 13, 2010
    Rightinpoint
    Lyrics Script
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in RightInPoint Lyrics Script 3.0 allows remote attackers to inject arbitrary web script or HTML via the artist_id parameter, which is not properly handled in a forced SQL error message. NOTE: the provenance of this…

  • CVE-2010-2721Jul 13, 2010
    Rightinpoint
    Lyrics Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in RightInPoint Lyrics Script 3.0 allows remote attackers to execute arbitrary SQL commands via the artist_id parameter in an addalbum action.

  • CVE-2010-2720Jul 13, 2010
    Phpaa
    Phpaacms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in list.php in phpaaCms 0.3.1 UTF-8, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-2719Jul 13, 2010
    Phpaa
    Phpaacms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in show.php in phpaaCms 0.3.1 UTF-8, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-2718Jul 13, 2010
    Crux Software
    Cruxpa
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in CruxSoftware CruxPA 2.00, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) txtusername parameter to login.php, (2) todo parameter to newtodo.php, and unspecified vectors to (3)…

  • CVE-2010-2717Jul 13, 2010
    Crux Software
    Cruxcms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in manager/login.php in CruxSoftware CruxCMS 3.0, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the txtusername parameter.

  • CVE-2010-2716Jul 13, 2010
    Psnews
    Psnews
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in PsNews 1.3 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) ndetail.php and (2) print.php.

  • CVE-2010-2715Jul 13, 2010
    TCW
    PHP Album
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in photos/index.php in TCW PHP Album 1.0 allows remote attackers to inject arbitrary web script or HTML via the album parameter.

  • CVE-2010-2714Jul 13, 2010
    TCW
    PHP Album
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in photos/index.php in TCW PHP Album 1.0 allows remote attackers to execute arbitrary SQL commands via the album parameter.

  • CVE-2010-2523Jul 13, 2010
    UMIP
    UMIP
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in ha.c in the mipv6 daemon in UMIP 0.4 allow remote attackers to have an unspecified impact via a crafted (1) ND_OPT_PREFIX_INFORMATION or (2) ND_OPT_HOME_AGENT_INFO packet.

  • CVE-2010-2522Jul 13, 2010
    UMIP
    UMIP
    risk 0.00cvss —epss 0.00

    The mipv6 daemon in UMIP 0.4 does not verify that netlink messages originated in the kernel, which allows local users to spoof netlink socket communication via a crafted unicast message.

  • CVE-2010-2227Jul 13, 2010
    Apache
    Tomcat
    risk 0.00cvss —epss 0.55

    Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that…

  • CVE-2010-2702Jul 12, 2010
    Epic Games
    Unreal Engine
    risk 0.00cvss —epss 0.05

    Buffer overflow in the UGameEngine::UpdateConnectingMessage function in the Unreal engine 1, 2, and 2.5, as used in multiple games including Unreal Tournament 2004, Unreal tournament 2003, Postal 2, Raven Shield, and SWAT4, when downloads are enabled, allows remote attackers to…

  • CVE-2010-2701Jul 12, 2010
    FathFTP
    FathFTP ActiveX control
    risk 0.03cvss —epss 0.05

    Multiple buffer overflows in the FathFTP ActiveX control 1.7 allow remote attackers to execute arbitrary code via (1) the GetFromURL member or (2) a long argument to the RasIsConnected method.

  • CVE-2010-2700Jul 12, 2010
    Edgephp
    Clickbank Affiliate Marketplace Script
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Edge PHP Clickbank Affiliate Marketplace Script (CBQuick) allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2010-2699Jul 12, 2010
    Edgephp
    Clickbank Affiliate Marketplace Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Edge PHP Clickbank Affiliate Marketplace Script (CBQuick) allows remote attackers to execute arbitrary SQL commands via the search parameter.

  • CVE-2010-2698Jul 12, 2010
    Sijio
    Community Software
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Sijio Community Software allow remote authenticated users to inject arbitrary web script or HTML via the title parameter when (1) editing a new blog, (2) adding an album, or (3) editing an album. NOTE: the provenance of…

  • CVE-2010-2697Jul 12, 2010
    Sijio
    Community Software
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Sijio Community Software allows remote authenticated users to inject arbitrary web script or HTML via the title parameter when adding a new blog, related to edit_blog/index.php. NOTE: some of these details are obtained from third…

  • CVE-2010-2696Jul 12, 2010
    Sijio
    Community Software
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in gallery/index.php in Sijio Community Software allows remote attackers to execute arbitrary SQL commands via the parent parameter.

  • CVE-2010-2695Jul 12, 2010
    Xlightftpd
    Xlight FTP Server
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the SFTP/SSH2 virtual server in Xlight FTP Server 3.5.0, 3.5.5, and possibly other versions before 3.6 allows remote authenticated users to read, overwrite, or delete arbitrary files via .. (dot dot) sequences in the (1) ls, (2) rm, (3)…

  • CVE-2010-2694Jul 12, 2010
    Redcomponent
    Com Redshop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the redSHOP Component (com_redshop) 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter to index.php.

  • CVE-2010-2448Jul 12, 2010
    Znc
    Znc
    risk 0.00cvss —epss 0.02

    znc.cpp in ZNC before 0.092 allows remote authenticated users to cause a denial of service (crash) by requesting traffic statistics when there is an active unauthenticated connection, which triggers a NULL pointer dereference, as demonstrated using (1) a traffic link in the web…

  • CVE-2010-0832Jul 12, 2010
    Ubuntu
    pam_motd
    risk 0.03cvss —epss 0.01

    pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home…

  • CVE-2010-2692Jul 12, 2010
    2daybiz
    Custom T Shirt Design Script
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in 2daybiz Custom T-Shirt Design Script allows remote attackers to inject arbitrary web script or HTML via a review comment.

  • CVE-2010-2691Jul 12, 2010
    2daybiz
    Custom T Shirt Design Script
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in 2daybiz Custom T-Shirt Design Script allow remote attackers to execute arbitrary SQL commands via the (1) sbid parameter to products_details.php, (2) pid parameter to products/products.php, and (3) designid parameter to designview.php.

  • CVE-2010-2690Jul 12, 2010
    Jooforge
    Com Gamesbox
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JOOFORGE Gamesbox (com_gamesbox) component 1.0.2, and possibly earlier, for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a consoles action to index.php.

  • CVE-2010-2689Jul 12, 2010
    Internetdm
    Webdm CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in cont_form.php in Internet DM WebDM CMS allows remote attackers to execute arbitrary SQL commands via the cf_id parameter.

  • CVE-2010-2688Jul 12, 2010
    Site2nite
    Boat Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in detail.asp in Site2Nite Boat Classifieds allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2010-2687Jul 12, 2010
    Site2nite
    Boat Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in printdetail.asp in Site2Nite Boat Classifieds allows remote attackers to execute arbitrary SQL commands via the Id parameter.

  • CVE-2010-2686Jul 12, 2010
    Topmanage
    Olk Module
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in clientes.asp in the TopManage OLK module 1.91.30 for SAP allow remote attackers to execute arbitrary SQL commands via the (1) PriceFrom, (2) PriceTo, and (3) InvFrom parameters, as reachable from olk/c_p/searchCart.asp, and other…

  • CVE-2010-2685Jul 12, 2010
    Customerparadigm
    Pagedirector CMS
    risk 0.03cvss —epss 0.02

    siteadmin/adduser.php in Customer Paradigm PageDirector CMS does not properly restrict access, which allows remote attackers to bypass intended restrictions and add administrative users via a direct request.

  • CVE-2010-2684Jul 12, 2010
    Customerparadigm
    Pagedirector CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Customer Paradigm PageDirector CMS allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-2683Jul 12, 2010
    Customerparadigm
    Pagedirector CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in result.php in Customer Paradigm PageDirector CMS allows remote attackers to execute arbitrary SQL commands via the sub_catid parameter.

  • CVE-2010-2682Jul 12, 2010
    Joomla
    Realtyna Translator
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in the Realtyna Translator (com_realtyna) component 1.0.15 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-2681Jul 12, 2010
    Joomla
    SEF404x (com_sef)
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in the SEF404x (com_sef) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig.absolute.path parameter to index.php.

  • CVE-2010-2680Jul 12, 2010
    Jextensions
    JE Section/Property Finder
    risk 0.03cvss —epss 0.05

    Directory traversal vulnerability in the JExtensions JE Section/Property Finder (jesectionfinder) component for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the view parameter to index.php.

  • CVE-2010-2489Jul 12, 2010
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.00

    Buffer overflow in Ruby 1.9.x before 1.9.1-p429 on Windows might allow local users to gain privileges via a crafted ARGF.inplace_mode value that is not properly handled when constructing the filenames of the backup files.

  • CVE-2009-4935Jul 12, 2010
    Online Guestbook Pro
    ogp_show.php
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ogp_show.php in Online Guestbook Pro allows remote attackers to execute arbitrary SQL commands via the display parameter.

  • CVE-2009-4934Jul 12, 2010
    Esoftpro
    Online Photo Pro
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Online Photo Pro 2.0 allows remote attackers to inject arbitrary web script or HTML via the section parameter.

  • CVE-2009-4933Jul 12, 2010
    EZ Webitor
    EZ Webitor
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.php in EZ Webitor allow remote attackers to execute arbitrary SQL commands via the (1) txtUserId (Username) and (2) txtPassword (Password) parameters. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4932Jul 12, 2010
    Mpesch3.de1
    1by1
    risk 0.03cvss —epss 0.04

    Stack-based buffer overflow in 1by1 1.67 (aka 1.6.7.0) allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .m3u playlist file.

  • CVE-2009-4931Jul 12, 2010
    Groovy Media Player
    Groovy Media Player
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in Groovy Media Player 1.1.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .m3u playlist file.

  • CVE-2009-4930Jul 12, 2010
    Ellucian
    Banner Student
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the twbkwbis.P_SecurityQuestion (aka Change Security Question) page in SunGard Banner Student System 7.4 allows remote attackers to inject arbitrary web script or HTML via the New Question field.

  • CVE-2009-4929Jul 12, 2010
    TotalCalendar
    TotalCalendar
    risk 0.03cvss —epss 0.02

    admin/manage_users.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrary passwords via the newPW1 and newPW2 parameters.

  • CVE-2009-4928Jul 12, 2010
    TotalCalendar
    TotalCalendar
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in config.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter, a different vector than CVE-2006-1922 and CVE-2006-7055.