VYPR

CVEs

345,986 total · page 6075 of 6,920

AllCriticalHighKEV
  • CVE-2010-1199Jun 24, 2010
    Mozilla Corporation
    Firefox
    risk 0.04cvss —epss 0.11

    Integer overflow in the XSLT node sorting implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a large text value for a node.

  • CVE-2010-1198Jun 24, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, allows remote attackers to execute arbitrary code via vectors involving multiple plugin instances.

  • CVE-2010-1197Jun 24, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, does not properly handle situations in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers, which allows remote attackers to conduct…

  • CVE-2010-1196Jun 24, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Integer overflow in the nsGenericDOMDataNode::SetTextInternal function in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a DOM node with a long text value that…

  • CVE-2010-0183Jun 24, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Use-after-free vulnerability in the nsCycleCollector::MarkRoots function in Mozilla Firefox 3.5.x before 3.5.10 and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a crafted HTML document, related to an improper frame construction process for menus.

  • CVE-2010-2433Jun 24, 2010
    IBM
    Websphere Ilog Jrules
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in content/internalError.jsp in IBM WebSphere ILOG JRules 6.7 allow remote attackers to inject arbitrary web script or HTML via an RTS URL to (1) explore/explore.jsp, (2) compose/compose.jsp, or (3) home.jsp in faces/.

  • CVE-2010-2429Jun 24, 2010
    Splunk
    Splunk
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Splunk 4.0 through 4.1.2, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer in a "404 Not Found" response.

  • CVE-2010-2428Jun 24, 2010
    Wing FTP
    Wing FTP Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin_loginok.html in the Administrator web interface in Wing FTP Server for Windows 3.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted POST request.

  • CVE-2010-2426Jun 24, 2010
    South River Technologies
    Titan FTP Server
    risk 0.04cvss —epss 0.12

    Directory traversal vulnerability in TitanFTPd in South River Technologies Titan FTP Server 8.10.1125, and probably earlier versions, allows remote authenticated users to read arbitrary files, determine file size, via "..//" sequences in the xcrc command.

  • CVE-2010-2425Jun 24, 2010
    South River Technologies
    Titan FTP Server
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in TitanFTPd in South River Technologies Titan FTP Server 8.10.1125, and probably earlier versions, allows remote authenticated users to read or delete arbitrary files via "..//" sequences in a COMB command.

  • CVE-2010-2422Jun 24, 2010
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in PortalTransforms in Plone 2.1 through 3.3.4 before hotfix 20100612 allows remote attackers to inject arbitrary web script or HTML via the safe_html transform.

  • CVE-2010-2432Jun 22, 2010
    Apple Inc.
    Cups
    risk 0.00cvss —epss 0.02

    The cupsDoAuthentication function in auth.c in the client in CUPS before 1.4.4, when HAVE_GSSAPI is omitted, does not properly handle a demand for authorization, which allows remote CUPS servers to cause a denial of service (infinite loop) via HTTP_UNAUTHORIZED responses.

  • CVE-2010-2431Jun 22, 2010
    Apple Inc.
    Cups
    risk 0.00cvss —epss 0.00

    The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file.

  • CVE-2010-1775Jun 22, 2010
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    Race condition in Passcode Lock in Apple iOS before 4 on the iPhone and iPod touch allows physically proximate attackers to bypass intended passcode requirements, and pair a locked device with a computer and access arbitrary data, via vectors involving the initial boot.

  • CVE-2010-1757Jun 22, 2010
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.04

    WebKit in Apple iOS before 4 on the iPhone and iPod touch does not enforce the expected boundary restrictions on content display by an IFRAME element, which allows remote attackers to spoof the user interface via a crafted HTML document.

  • CVE-2010-1756Jun 22, 2010
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    The Settings application in Apple iOS before 4 on the iPhone and iPod touch does not properly report the wireless network that is in use, which might make it easier for remote attackers to trick users into communicating over an unintended network.

  • CVE-2010-1755Jun 22, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Safari in Apple iOS before 4 on the iPhone and iPod touch does not properly implement the Accept Cookies preference, which makes it easier for remote web servers to track users via a cookie.

  • CVE-2010-1754Jun 22, 2010
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    Passcode Lock in Apple iOS before 4 on the iPhone and iPod touch does not properly handle alert-based unlocks in conjunction with subsequent Remote Lock operations through MobileMe, which allows physically proximate attackers to bypass intended passcode requirements via…

  • CVE-2010-1753Jun 22, 2010
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.03

    ImageIO in Apple iOS before 4 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted JPEG image.

  • CVE-2010-1752Jun 22, 2010
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in CFNetwork in Apple iOS before 4 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to URL handling.

  • CVE-2010-1751Jun 22, 2010
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    Application Sandbox in Apple iOS before 4 on the iPhone and iPod touch does not prevent photo-library access, which might allow remote attackers to obtain location information via unspecified vectors.

  • CVE-2010-1632Jun 22, 2010
    Apache
    Axis2
    risk 0.02cvss —epss 0.22

    Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products,…

  • CVE-2010-1407Jun 22, 2010
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.03

    WebKit in Apple iOS before 4 on the iPhone and iPod touch does not properly implement the history.replaceState method in certain situations involving IFRAME elements, which allows remote attackers to obtain sensitive information via a crafted HTML document.

  • CVE-2010-2421Jun 22, 2010
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Opera before 10.54 have unknown impact and attack vectors related to (1) "extremely severe," (2) "highly severe," (3) "moderately severe," and (4) "less severe" issues.

  • CVE-2010-2420Jun 22, 2010
    Fenrir Inc
    Activegeckobrowser
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Fenrir Inc. ActiveGeckoBrowser 1.0.0 and 1.0.5 alpha, a module for the Sleipnir web browser, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the Gecko engine.

  • CVE-2010-1638Jun 22, 2010
    Horde (software)
    Horde
    risk 0.00cvss —epss 0.01

    The IMP plugin in Horde allows remote attackers to bypass firewall restrictions and use Horde as a proxy to scan internal networks via a crafted request to an unspecified test script. NOTE: this is only a vulnerability when the administrator does not follow recommendations in…

  • CVE-2010-1637MedJun 22, 2010
    SquirrelMail
    Squirrelmail
    risk 0.42cvss 6.5epss 0.03

    The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.

  • CVE-2010-2359Jun 21, 2010
    Activewebsoftwares
    Ewebquiz
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in eWebQuiz.asp in ActiveWebSoftwares.com eWebquiz 8 allows remote attackers to execute arbitrary SQL commands via the QuizType parameter, a different vector than CVE-2007-1706.

  • CVE-2010-2358Jun 21, 2010
    Jeffkilroy
    Nakid CMS
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in modules/catalog/upload_photo.php in Nakid CMS 0.5.2, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the core[system_path] parameter. NOTE: some of…

  • CVE-2010-2357Jun 21, 2010
    Eicra
    Realestate Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Eicra Realestate Script 1.0 and 1.6.0 allows remote attackers to execute arbitrary SQL commands via the p_id parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-2356Jun 21, 2010
    Pilotgroup
    Elms Pro
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in subscribe.php in Pilot Group (PG) eLMS Pro allows remote attackers to inject arbitrary web script or HTML via the course_id parameter.

  • CVE-2010-2355Jun 21, 2010
    Pilotgroup
    Elms Pro
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in error.php in Pilot Group (PG) eLMS Pro allows remote attackers to inject arbitrary web script or HTML via the message parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2010-2354Jun 21, 2010
    Pilotgroup
    Elms Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in subscribe.php in Pilot Group (PG) eLMS Pro allows remote attackers to execute arbitrary SQL commands via the course_id parameter.

  • CVE-2010-2353Jun 21, 2010
    Drupal
    Content Construction Kit
    risk 0.00cvss —epss 0.02

    The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes.

  • CVE-2010-2352Jun 21, 2010
    Drupal
    Content Construction Kit
    risk 0.00cvss —epss 0.03

    The Node Reference module in Content Construction Kit (CCK) module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes.

  • CVE-2010-2351Jun 21, 2010
    Novell
    Netware
    risk 0.04cvss —epss 0.16

    Stack-based buffer overflow in the CIFS.NLM driver in Netware SMB 1.0 for Novell Netware 6.5 SP8 and earlier allows remote attackers to execute arbitrary code via a Sessions Setup AndX packet with a long AccountName.

  • CVE-2010-2350Jun 21, 2010
    Ziproxy
    Ziproxy
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in the PNG decoder in Ziproxy 3.1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PNG file.

  • CVE-2010-2349Jun 21, 2010
    Timhillone
    H264webcam
    risk 0.03cvss —epss 0.05

    H264WebCam 3.7 allows remote attackers to cause a denial of service (crash) via a long URI in a GET request, which triggers a NULL pointer dereference. NOTE: some of these details are obtained from third party information.

  • CVE-2010-2348Jun 21, 2010
    Freesoftwaretoolbox
    Batch Audio Converter
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in Batch Audio Converter Lite Edition 1.0.0.0 and earlier allows remote attackers to execute arbitrary code via a long line in a .WAV file.

  • CVE-2010-2347Jun 21, 2010
    SAP
    Server Core
    risk 0.00cvss —epss 0.01

    The Telnet interface in the SAP J2EE Engine Core (SAP-JEECOR) 6.40 through 7.02, and Server Core (SERVERCORE) 7.10 through 7.30 allows remote authenticated users to bypass a security check and conduct SMB relay attacks via unspecified vectors.

  • CVE-2010-1958Jun 21, 2010
    Filefield Project
    Filefield
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and 'Path to File' or 'URL to File' display enabled, to inject arbitrary web script or HTML…

  • CVE-2010-1622Jun 21, 2010
    Gopivotal
    Spring Framework
    risk 0.00cvss —epss 0.52

    SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

  • CVE-2010-1168Jun 21, 2010
    Rafael Garcia Suarez
    Safe
    risk 0.00cvss —epss 0.04

    The Safe (aka Safe.pm) module before 2.25 for Perl allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving implicitly called methods and implicitly blessed objects,…

  • CVE-2010-0542Jun 21, 2010
    Apple Inc.
    Cups
    risk 0.00cvss —epss 0.04

    The _WriteProlog function in texttops.c in texttops in the Text Filter subsystem in CUPS before 1.4.4 does not check the return values of certain calloc calls, which allows remote attackers to cause a denial of service (NULL pointer dereference or heap memory corruption) or…

  • CVE-2010-2345Jun 21, 2010
    Odcms
    Odcms
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in odCMS 1.06, and possibly earlier, allows remote attackers to hijack the authentication of administrators for requests that change the administrative password, and other unspecified requests.

  • CVE-2010-2344Jun 21, 2010
    Odcms
    Odcms
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in odCMS 1.06, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the Page parameter to (1) _main/index.php, (2) _members/index.php, (3) _forum/index.php, (4) _docs/index.php, and (5)…

  • CVE-2010-2343Jun 21, 2010
    Dennisre
    Audio Converter
    risk 0.06cvss —epss 0.37

    Stack-based buffer overflow in D.R. Software Audio Converter 8.1, 2007, and 8.05 allows remote attackers to execute arbitrary code via a crafted pls playlist file.

  • CVE-2010-2342Jun 21, 2010
    Dmxready
    Online Notebook Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in onlinenotebookmanager.asp in DMXReady Online Notebook Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.

  • CVE-2010-2341Jun 18, 2010
    Ezpx
    Ezpx Photoblog
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in system/application/views/public/commentform.php in EZPX Photoblog 1.2 beta allows remote attackers to execute arbitrary PHP code via a URL in the tpl_base_dir parameter.

  • CVE-2010-2340Jun 18, 2010
    Arab Portal
    Arab Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in members.php in Arab Portal 2.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the by parameter in the msearch action.