VYPR

CVEs

345,986 total · page 6074 of 6,920

AllCriticalHighKEV
  • CVE-2010-1204Jun 28, 2010
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Search.pm in Bugzilla 2.17.1 through 3.2.6, 3.3.1 through 3.4.6, 3.5.1 through 3.6, and 3.7 allows remote attackers to obtain potentially sensitive time-tracking information via a crafted search URL, related to a "boolean chart search."

  • CVE-2010-0180Jun 28, 2010
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.00

    Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6 and 3.7, when use_suexec is enabled, uses world-readable permissions for the localconfig files, which allows local users to read sensitive configuration fields, as demonstrated by the database password field and the…

  • CVE-2010-2469Jun 25, 2010
    Linearcorp
    Emerge 50
    risk 0.00cvss —epss 0.01

    The Linear eMerge 50 and 5000 uses a default password of eMerge for the IEIeMerge account, which makes it easier for remote attackers to obtain Video Recorder data by establishing a session to the device.

  • CVE-2010-2468Jun 25, 2010
    Sonitrol
    Eaccess
    risk 0.00cvss —epss 0.02

    The S2 Security NetBox 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, uses a weak hash algorithm for storing the Administrator password, which makes it easier for context-dependent attackers to obtain privileged access by recovering the cleartext…

  • CVE-2010-2467Jun 25, 2010
    Sonitrol
    Eaccess
    risk 0.00cvss —epss 0.01

    The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not require setting a password for the FTP server that stores database backups, which makes it easier for remote attackers to download backup files via…

  • CVE-2010-2466Jun 25, 2010
    Sonitrol
    Eaccess
    risk 0.00cvss —epss 0.02

    The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not properly prevent downloading of database backups, which allows remote attackers to obtain sensitive information via requests for full_*.dar files with…

  • CVE-2010-2465Jun 25, 2010
    Sonitrol
    Eaccess
    risk 0.00cvss —epss 0.02

    The S2 Security NetBox 2.5, 3.3, and 4.0, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download node logs, photographs of persons, and backup…

  • CVE-2010-2464Jun 25, 2010
    Rsjoomla
    Com Rscomments
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the RSComments (com_rscomments) component 1.0.0 Rev 2 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website and (2) name parameters to index.php.

  • CVE-2010-2463Jun 25, 2010
    Jamroom
    Jamroom
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in forum.php in Jamroom before 4.1.9 allows remote attackers to inject arbitrary web script or HTML via the post_id parameter in a modify action.

  • CVE-2010-2462Jun 25, 2010
    Tomacero
    Orohyip
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in withdraw_money.php in Toma Cero OroHYIP allows remote attackers to execute arbitrary SQL commands via the id parameter in a cancel action.

  • CVE-2010-2461Jun 25, 2010
    Jce Tech
    Overstock Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in storecat.php in JCE-Tech Overstock 1 allows remote attackers to execute arbitrary SQL commands via the store parameter.

  • CVE-2010-2460Jun 25, 2010
    Jce Tech
    Shareasale Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in merchant_product_list.php in JCE-Tech Shareasale Script (SASS) 1 allows remote attackers to execute arbitrary SQL commands via the mechant_id parameter.

  • CVE-2010-2459Jun 25, 2010
    2daybiz
    Video Community Portal Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in video.php in 2daybiz Video Community Portal Script 1.0 allows remote attackers to execute arbitrary SQL commands via the videoid parameter.

  • CVE-2010-2458Jun 25, 2010
    2daybiz
    Video Community Portal Script
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in video.php in 2daybiz Video Community Portal Script 1.0 allows remote attackers to inject arbitrary web script or HTML via the videoid parameter.

  • CVE-2010-2457Jun 25, 2010
    Qsoft Inc
    K Search
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in K-Search allows remote attackers to inject arbitrary web script or HTML via the term parameter.

  • CVE-2010-2456Jun 25, 2010
    Linker
    IMG
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in index.php in Linker IMG 1.0 and earlier allow remote attackers to read and execute arbitrary local files via a URL in the (1) cook_lan cookie parameter ($lan_dir variable) or possibly (2) Sdb_type parameter. NOTE: this was…

  • CVE-2010-2455Jun 25, 2010
    Opera
    Opera
    risk 0.00cvss —epss 0.01

    Opera does not properly manage the address bar between the request to open a URL and the retrieval of the new document's content, which might allow remote attackers to conduct spoofing attacks via a crafted HTML document, a related issue to CVE-2010-1206.

  • CVE-2010-2454Jun 25, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Apple Safari does not properly manage the address bar between the request to open a URL and the retrieval of the new document's content, which might allow remote attackers to conduct spoofing attacks via a crafted HTML document, a related issue to CVE-2010-1206.

  • CVE-2010-1206Jun 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    The startDocumentLoad function in browser/base/content/browser.js in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, does not properly implement the Same Origin Policy in certain circumstances related to the about:blank document and a…

  • CVE-2009-4909Jun 25, 2010
    Dootzky
    Oblog
    risk 0.00cvss —epss 0.02

    admin/index.php in oBlog allows remote attackers to conduct brute-force password guessing attacks via HTTP requests.

  • CVE-2009-4908Jun 25, 2010
    Dootzky
    Oblog
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in oBlog allow remote attackers to inject arbitrary web script or HTML via the (1) commentName, (2) commentEmail, (3) commentWeb, or (4) commentText parameter to article.php; and allow remote authenticated administrators to…

  • CVE-2009-4907Jun 25, 2010
    OBlog
    oBlog
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin password, (2) force an admin logout, (3) change the visibility of posts, (4) remove links, and (5)…

  • CVE-2009-4906Jun 25, 2010
    Acc
    PHP eMail
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in index.php in Acc PHP eMail 1.1 allows remote attackers to hijack the authentication of administrators for requests that change passwords.

  • CVE-2009-4905Jun 25, 2010
    Accscripts
    Acc Statistics
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Acc Statistics 1.1 allow remote attackers to hijack the authentication of administrators for requests that change (1) passwords, (2) usernames, and (3) e-mail addresses.

  • CVE-2009-4904Jun 25, 2010
    OBlog
    oBlog
    risk 0.00cvss —epss 0.01

    article.php in oBlog does not properly restrict comments, which allows remote attackers to cause a denial of service (blog spam) via a comment=new action.

  • CVE-2009-4903Jun 25, 2010
    Dootzky
    Oblog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in oBlog allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2010-2444Jun 25, 2010
    Maradns
    Maradns
    risk 0.00cvss —epss 0.02

    parse/Csv2_parse.c in MaraDNS 1.3.03, and other versions before 1.4.03, does not properly handle hostnames that do not end in a "." (dot) character, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted csv2 zone file.

  • CVE-2010-2434Jun 25, 2010
    Pon Software
    Arcext.dll
    risk 0.00cvss —epss 0.05

    Buffer overflow in Arcext.dll 2.16.1 and earlier in pon software Explzh 5.62 and earlier allows remote attackers to execute arbitrary code via an LZH LHA file with a crafted header that is not properly handled during expansion.

  • CVE-2010-2443Jun 24, 2010
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.03

    The OJPEGReadBufferFill function in tif_ojpeg.c in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an OJPEG image with undefined strip offsets, related to the TIFFVGetField function.

  • CVE-2010-2442Jun 24, 2010
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.12

    Microsoft Internet Explorer, possibly 8, does not properly restrict focus changes, which allows remote attackers to read keystrokes via "cross-domain IFRAME gadgets."

  • CVE-2010-2441Jun 24, 2010
    Apple Inc.
    Webkit
    risk 0.00cvss —epss 0.02

    WebKit does not properly restrict focus changes, which allows remote attackers to read keystrokes via "cross-domain IFRAME gadgets," a different vulnerability than CVE-2010-1126, CVE-2010-1422, and CVE-2010-2295.

  • CVE-2010-2440Jun 24, 2010
    Subtitle Translation Wizard
    Subtitle Translation Wizard
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in st-wizard.exe in Subtitle Translation Wizard 3.0 allows user-assisted remote attackers to execute arbitrary code via a crafted SRT file with a long line after a time range. NOTE: some of these details are obtained from third party information.

  • CVE-2010-2439Jun 24, 2010
    Moreforge
    Moreamp
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in MoreAmp allows remote attackers to execute arbitrary code via a long line in a song list (.maf file).

  • CVE-2010-2438Jun 24, 2010
    Laubrotel
    G.CMS Generator
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in G.CMS generator allows remote attackers to execute arbitrary SQL commands via the lang parameter to the default URI, probably index.php.

  • CVE-2010-2437Jun 24, 2010
    Anecms
    Blog
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in class/tools.class.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the comment variable to modules/blog/index.php.

  • CVE-2010-2436Jun 24, 2010
    Anecms
    Blog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in modules/blog/index.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO.

  • CVE-2010-2435Jun 24, 2010
    Weborf
    Weborf HTTP Server
    risk 0.04cvss —epss 0.06

    Weborf HTTP Server 0.12.1 and earlier allows remote attackers to cause a denial of service (crash) via Unicode characters in a Connection HTTP header, and possibly other headers.

  • CVE-2010-2224Jun 24, 2010
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.00

    The snapshot merging functionality in Red Hat Enterprise Virtualization Manager (aka RHEV-M) before 2.2 does not properly pass the postzero parameter during operations on deleted volumes, which allows guest OS users to obtain sensitive information by examining the disk blocks…

  • CVE-2010-2223Jun 24, 2010
    Red Hat
    Enterprise Virtualization
    risk 0.00cvss —epss 0.00

    Virtual Desktop Server Manager (VDSM) in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H or rhev-hypervisor) before 5.5-2.2 does not properly perform VM post-zeroing after the removal of a virtual machine's data, which allows guest OS users to obtain sensitive…

  • CVE-2010-0779Jun 24, 2010
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.33, and 7.0 before 7.0.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0778Jun 24, 2010
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.33 and 7.0 before 7.0.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-2225Jun 24, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the SplObjectStorage unserializer in PHP 5.2.x and 5.3.x through 5.3.2 allows remote attackers to execute arbitrary code or obtain sensitive information via serialized data, related to the PHP unserialize function.

  • CVE-2010-2067Jun 24, 2010
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in the TIFFFetchSubjectDistance function in tif_dirread.c in LibTIFF before 3.9.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long EXIF SubjectDistance field in a TIFF file.

  • CVE-2010-2065Jun 24, 2010
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.06

    Integer overflow in the TIFFroundup macro in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TIFF file that triggers a buffer overflow.

  • CVE-2010-1625Jun 24, 2010
    Lxr
    LXR
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in LXR Cross Referencer before 0.9.7 allows remote attackers to inject arbitrary web script or HTML via vectors related to the search body and the results page for a search, a different vulnerability than CVE-2009-4497 and CVE-2010-1448.

  • CVE-2010-1448Jun 24, 2010
    Lxr
    LXR
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in lib/LXR/Common.pm in LXR Cross Referencer before 0.9.8 allows remote attackers to inject arbitrary web script or HTML via vectors related to a string in the search page's TITLE element, a different vulnerability than CVE-2009-4497 and…

  • CVE-2010-1203Jun 24, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The JavaScript engine in Mozilla Firefox 3.6.x before 3.6.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors that trigger an assertion failure in jstracer.cpp.

  • CVE-2010-1202Jun 24, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or…

  • CVE-2010-1201Jun 24, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.10, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via…

  • CVE-2010-1200Jun 24, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or…