VYPR

CVEs

345,986 total · page 6072 of 6,920

AllCriticalHighKEV
  • CVE-2010-2482Jul 6, 2010
    LibTIFF
    Libtiff
    risk 0.04cvss —epss 0.09

    LibTIFF 3.9.4 and earlier does not properly handle an invalid td_stripbytecount field, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted TIFF file, a different vulnerability than CVE-2010-2443.

  • CVE-2010-2481Jul 6, 2010
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.03

    The TIFFExtractData macro in LibTIFF before 3.9.4 does not properly handle unknown tag types in TIFF directory entries, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF file.

  • CVE-2010-2253Jul 6, 2010
    Libwww Perl
    lwp-download
    risk 0.00cvss —epss 0.03

    lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests…

  • CVE-2010-2252Jul 6, 2010
    GNU
    Wget
    risk 0.00cvss —epss 0.04

    GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx…

  • CVE-2010-2251Jul 6, 2010
    LFTP
    lftp
    risk 0.00cvss —epss 0.04

    The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that…

  • CVE-2010-1576Jul 6, 2010
    Cisco Systems, Inc.
    Content Services Switch 11500
    risk 0.00cvss —epss 0.02

    The Cisco Content Services Switch (CSS) 11500 with software before 8.20.4.02 and the Application Control Engine (ACE) 4710 with software before A2(3.0) do not properly handle use of LF, CR, and LFCR as alternatives to the standard CRLF sequence between HTTP headers, which allows…

  • CVE-2010-1575Jul 6, 2010
    Cisco Systems, Inc.
    Content Services Switch 11500
    risk 0.00cvss —epss 0.02

    The Cisco Content Services Switch (CSS) 11500 with software 08.20.1.01 conveys authentication data through ClientCert-* headers but does not delete client-supplied ClientCert-* headers, which might allow remote attackers to bypass authentication via crafted header data, as…

  • CVE-2010-1328Jul 6, 2010
    Tornadostore
    Tornadostore
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) tipo or (2) destino parameter to login_registrese.php3 in the Services section, (3) the rubro parameter to precios.php3…

  • CVE-2010-1327Jul 6, 2010
    Tornadostore
    Tornadostore
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the marca parameter to precios.php3 or (2) the where parameter in a delivery_courier action to control/abm_list.php3.

  • CVE-2010-2627Jul 2, 2010
    Ea
    Battlefield 2
    risk 0.03cvss —epss 0.04

    Multiple directory traversal vulnerabilities in the Refractor 2 engine, as used in Battlefield 2 1.50 (1.5.3153-802.0) and earlier, and Battlefield 2142 (1.10.48.0) and earlier, allow remote servers to overwrite arbitrary files on the client via "..\" (dot dot backslash)…

  • CVE-2010-2626Jul 2, 2010
    Miyabi
    SEO Links
    risk 0.04cvss —epss 0.13

    index.pl in Miyabi CGI Tools SEO Links 1.02 allows remote attackers to execute arbitrary commands via shell metacharacters in the fn command. NOTE: some of these details are obtained from third party information.

  • CVE-2010-2625Jul 2, 2010
    Hitachi
    Jp1\/serverconductor\/deploymentmanager
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Client Service for DPM in Hitachi ServerConductor / Deployment Manager 01-00, 01-01, and 06-00 through 06-00-/A; ServerConductor / Deployment Manager Standard Edition and Enterprise Edition 07-50 through 07-55, and 07-57 through 07-59; and…

  • CVE-2010-2624Jul 2, 2010
    Iscripts
    Easysnaps
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in iScripts EasySnaps 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) comment parameter to add_comments.php, (2) values parameter to tags_details.php, or (3) begin parameter to greetings.php.

  • CVE-2010-2623Jul 2, 2010
    Internet DM Specialist
    Bed and Breakfast
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pages.php in Internet DM Specialist Bed and Breakfast allows remote attackers to execute arbitrary SQL commands via the pp_id parameter.

  • CVE-2010-2622Jul 2, 2010
    Joomanager
    Joomanager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Joomanager component, possibly 1.1.1, for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.

  • CVE-2010-2621Jul 2, 2010
    Qt
    Qt
    risk 0.04cvss —epss 0.11

    The QSslSocketBackendPrivate::transmit function in src_network_ssl_qsslsocket_openssl.cpp in Qt 4.6.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a malformed request.

  • CVE-2010-2620Jul 2, 2010
    Open&Compact
    Open-FTPD
    risk 0.05cvss —epss 0.29

    Open&Compact FTP Server (Open-FTPD) 1.2 and earlier allows remote attackers to bypass authentication by sending (1) LIST, (2) RETR, (3) STOR, or other commands without performing the required login steps first.

  • CVE-2010-2619Jul 2, 2010
    Citrix Systems
    Xenserver
    risk 0.00cvss —epss 0.00

    Citrix XenServer 5.0 Update 2 and earlier, and 5.5 Update 1 and earlier, when using a pvops kernel, allows guest users to cause a denial of service in the host via unspecified vectors that trigger "incorrectly set flags."

  • CVE-2004-2769Jul 2, 2010
    Cerberus
    FTP Server
    risk 0.00cvss —epss 0.01

    Cerberus FTP Server before 4.0.3.0 allows remote authenticated users to list hidden files, even when the "Display hidden files" option is enabled, via the (1) MLSD or (2) MLST commands.

  • CVE-2009-4924Jul 2, 2010
    Dan Pascu
    Python Cjson
    risk 0.00cvss —epss 0.01

    Dan Pascu python-cjson 1.0.5 does not properly handle a ['/'] argument to cjson.encode, which makes it easier for remote attackers to conduct certain cross-site scripting (XSS) attacks involving Firefox and the end tag of a SCRIPT element.

  • CVE-2010-2549Jul 2, 2010
    Microsoft
    Windows
    risk 0.03cvss —epss 0.05

    Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Vista SP1 and SP2 and Server 2008 Gold and SP2 allows local users to gain privileges or cause a denial of service (system crash) by using a large number of calls to the…

  • CVE-2010-2480Jul 2, 2010
    Makotemplates
    Mako
    risk 0.00cvss —epss 0.02

    Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for…

  • CVE-2010-1666Jul 2, 2010
    Dan Pascu
    Python Cjson
    risk 0.00cvss —epss 0.02

    Buffer overflow in Dan Pascu python-cjson 1.0.5, when UCS-4 encoding is enabled, allows context-dependent attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors involving crafted Unicode input to the cjson.encode function.

  • CVE-2010-2618Jul 2, 2010
    Adaptcms
    Adaptcms
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in inc/smarty/libs/init.php in AdaptCMS 2.0.0 Beta, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the sitepath parameter. NOTE: it was later reported that 2.0.1 is also affected.

  • CVE-2010-2617Jul 2, 2010
    Paul Mcenery
    PHP Bible Search
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in bible.php in PHP Bible Search allows remote attackers to inject arbitrary web script or HTML via the chapter parameter.

  • CVE-2010-2616Jul 2, 2010
    Paul Mcenery
    PHP Bible Search
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in bible.php in PHP Bible Search, probably 0.99, allows remote attackers to execute arbitrary SQL commands via the chapter parameter.

  • CVE-2010-2615Jul 2, 2010
    Grafik Power
    Grafik CMS
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in admin/admin.php in Grafik CMS 1.1.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) page_menu and (2) description parameters in an edit_page action.

  • CVE-2010-2614Jul 2, 2010
    Grafik Power
    Grafik CMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in admin/admin.php in Grafik CMS 1.1.2, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit_page action.

  • CVE-2010-2613Jul 2, 2010
    Joomla
    JE Awd Song
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the JExtensions JE Awd Song (com_awd_song) component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the song review field, which is not properly handled in a view action to index.php.

  • CVE-2010-2612Jul 2, 2010
    Microfocus
    Openvms
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the HP OpenVMS Auditing feature in OpenVMS ALPHA 7.3-2, 8.2, and 8.3; and OpenVMS for Integrity Servers 8.3 AND 8.3-1H1; allows local users to obtain sensitive information via unknown vectors.

  • CVE-2010-2611Jul 2, 2010
    I Netsolution
    Job Search Engine Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in show_search_result.php in i-netsolution Job Search Engine allows remote attackers to execute arbitrary SQL commands via the keyword parameter.

  • CVE-2010-2610Jul 2, 2010
    2daybiz
    Job Site Script
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in 2daybiz Job Site Script allow remote attackers to execute arbitrary SQL commands via the (1) jid parameter to view_current_job.php, (2) job_iid parameter to show_search_more.php, and (3) left_cat parameter to show_search_result.php.

  • CVE-2010-2609Jul 2, 2010
    2daybiz
    Job Search Engine Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in show_search_result.php in 2daybiz Job Search Engine Script allows remote attackers to execute arbitrary SQL commands via the keyword parameter.

  • CVE-2010-2598Jul 2, 2010
    Red Hat
    libtiff
    risk 0.00cvss —epss 0.02

    LibTIFF in Red Hat Enterprise Linux (RHEL) 3 on x86_64 platforms, as used in tiff2rgba, attempts to process image data even when the required compression functionality is not configured, which allows remote attackers to cause a denial of service via a crafted TIFF image, related…

  • CVE-2010-2597Jul 2, 2010
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.03

    The TIFFVStripSize function in tif_strip.c in LibTIFF 3.9.0 and 3.9.2 makes incorrect calls to the TIFFGetField function, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image, related to "downsampled OJPEG input" and possibly…

  • CVE-2010-2596Jul 2, 2010
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.02

    The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF image, related to "downsampled OJPEG input."

  • CVE-2010-2595Jul 2, 2010
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.03

    The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in ImageMagick, does not properly handle invalid ReferenceBlackWhite values, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers an array index…

  • CVE-2010-2594Jul 2, 2010
    Intersect Alliance
    Snare Agent
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the web management interface in InterSect Alliance Snare Agent 3.2.3 and earlier on Solaris, Snare Agent 3.1.7 and earlier on Windows, Snare Agent 1.5.0 and earlier on Linux and AIX, Snare Agent 1.4 and earlier on…

  • CVE-2010-2233Jul 2, 2010
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.04

    tif_getimage.c in LibTIFF 3.9.0 and 3.9.2 on 64-bit platforms, as used in ImageMagick, does not properly perform vertical flips, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TIFF image, related to…

  • CVE-2010-1522Jul 2, 2010
    Ordasoft
    Com Booklibrary
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the BookLibrary Basic (com_booklibrary) component 1.5.3 before 1.5.3_2010_06_20 for Joomla! allow remote attackers to execute arbitrary SQL commands via the bid[] parameter in a (1) lend_request or (2) save_lend_request action to…

  • CVE-2010-2518Jun 30, 2010
    IBM
    P8 Content Search Engine
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the P8 Content Engine (P8CE) 4.5.1 before FP3 and the P8 Content Search Engine (P8CSE) before 4.5.0 FP3 and 4.5.1 before FP1, as used in IBM FileNet P8 Content Manager (CM) and FileNet P8 Business Process Manager (BPM), allows remote attackers to…

  • CVE-2010-2517Jun 30, 2010
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in IBM Rational ClearQuest before 7.1.1.02 have unknown impact and attack vectors, as demonstrated by an AppScan report.

  • CVE-2010-2249MedJun 30, 2010
    Libpng
    Libpng
    risk 0.42cvss 6.5epss 0.03

    Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a PNG image containing malformed Physical Scale (aka sCAL) chunks.

  • CVE-2010-2212Jun 30, 2010
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.04

    Buffer overflow in Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a PDF file containing Flash content with a crafted #1023 (3FFh) tag, a…

  • CVE-2010-2211Jun 30, 2010
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.04

    Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-1295, CVE-2010-2202,…

  • CVE-2010-2210Jun 30, 2010
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.04

    Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-1295, CVE-2010-2202,…

  • CVE-2010-2209Jun 30, 2010
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.04

    Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-1295, CVE-2010-2202,…

  • CVE-2010-2208Jun 30, 2010
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.04

    Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, dereference a heap object after this object's deletion, which allows attackers to execute arbitrary code via unspecified vectors.

  • CVE-2010-2207Jun 30, 2010
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.04

    Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-1295, CVE-2010-2202,…

  • CVE-2010-2206Jun 30, 2010
    Adobe Inc.
    Acrobat
    risk 0.01cvss —epss 0.07

    Array index error in AcroForm.api in Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted GIF image in a PDF file, which bypasses a size check and triggers a heap-based buffer…