VYPR

CVEs

345,967 total · page 6082 of 6,920

AllCriticalHighKEV
  • CVE-2010-2122Jun 1, 2010
    Joomla
    SimpleDownload
    risk 0.04cvss —epss 0.12

    Directory traversal vulnerability in the SimpleDownload (com_simpledownload) component before 0.9.6 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-2121Jun 1, 2010
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera 9.52 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid (1) news:// or (2) nntp:// URIs.

  • CVE-2010-2120Jun 1, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome 1.0.154.48 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid news:// URIs.

  • CVE-2010-2119Jun 1, 2010
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.09

    Microsoft Internet Explorer 6.0.2900.2180 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid nntp:// URIs.

  • CVE-2010-2118Jun 1, 2010
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.10

    Microsoft Internet Explorer 6.0.2900.2180 and 8.0.7600.16385 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid news:// URIs.

  • CVE-2010-2117Jun 1, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.0.19, 3.5.x, and 3.6.x allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid (1) news:// or (2) nntp:// URIs.

  • CVE-2010-1641Jun 1, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The do_gfs2_set_flags function in fs/gfs2/file.c in the Linux kernel before 2.6.34-git10 does not verify the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS ioctl request.

  • CVE-2010-0830Jun 1, 2010
    GNU
    Glibc
    risk 0.00cvss —epss 0.05

    Integer signedness error in the elf_get_dynamic_info function in elf/dynamic-link.h in ld.so in the GNU C Library (aka glibc or libc6) 2.0.1 through 2.11.1, when the --verify option is used, allows user-assisted remote attackers to execute arbitrary code via a crafted ELF…

  • CVE-2010-0296Jun 1, 2010
    GNU
    Glibc
    risk 0.00cvss —epss 0.01

    The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs, does not properly handle newline characters in mountpoint names, which allows local users to cause a denial of service (mtab corruption), or…

  • CVE-2009-4881Jun 1, 2010
    GNU
    Glibc
    risk 0.00cvss —epss 0.02

    Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted format string, as…

  • CVE-2009-4880Jun 1, 2010
    GNU
    Glibc
    risk 0.04cvss —epss 0.11

    Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow context-dependent attackers to cause a denial of service (memory consumption or application crash) via a crafted format string, as demonstrated by a…

  • CVE-2010-2116May 28, 2010
    McAfee
    Email Gateway
    risk 0.00cvss —epss 0.02

    The web interface in McAfee Email Gateway (formerly IronMail) 6.7.1 allows remote authenticated users, with only Read privileges, to gain Write privileges to modify configuration via the save action in a direct request to admin/systemWebAdminConfig.do.

  • CVE-2010-2115May 28, 2010
    SolarWinds
    TFTP Server
    risk 0.07cvss —epss 0.56

    SolarWinds TFTP Server 10.4.0.10 allows remote attackers to cause a denial of service (no new connections) via a crafted read request.

  • CVE-2010-2114May 28, 2010
    Brekeke
    Pbx
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in pbx/gate in Brekeke PBX 2.4.4.8 allows remote attackers to hijack the authentication of users for requests that change passwords via the pbxadmin.web.PbxUserEdit bean.

  • CVE-2010-2113May 28, 2010
    Uniformserver
    Uniformserver
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in The Uniform Server 5.6.5 allow remote attackers to hijack the authentication of administrators for requests that change passwords via (1) apsetup.php, (2) psetup.php, (3) sslpsetup.php, or (4) mqsetup.php.

  • CVE-2010-2112May 28, 2010
    Intervations
    Filecopa
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the FTP service in FileCOPA before 5.03 allows remote attackers to read or overwrite arbitrary files via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2010-2111May 28, 2010
    Pacifictimesheet
    Pacific Timesheet
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in user/user-set.do in Pacific Timesheet 6.74 build 363 allows remote attackers to hijack the authentication of administrators for requests that create a new administrator via a new_admin action.

  • CVE-2010-2110May 28, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 5.0.375.55 does not properly execute JavaScript code in the extension context, which has unspecified impact and remote attack vectors.

  • CVE-2010-2109May 28, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Google Chrome before 5.0.375.55 allows user-assisted remote attackers to cause a denial of service (memory error) or possibly have unspecified other impact via vectors related to the "drag + drop" functionality.

  • CVE-2010-2108May 28, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Google Chrome before 5.0.375.55 allows remote attackers to bypass the whitelist-mode plugin blocker via unknown vectors.

  • CVE-2010-2107May 28, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Google Chrome before 5.0.375.55 allows attackers to cause a denial of service (memory error) or possibly have unspecified other impact via vectors related to the Safe Browsing functionality.

  • CVE-2010-2106May 28, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Google Chrome before 5.0.375.55 might allow remote attackers to spoof the URL bar via vectors involving unload event handlers.

  • CVE-2010-2105May 28, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 5.0.375.55 does not properly follow the Safe Browsing specification's requirements for canonicalization of URLs, which has unspecified impact and remote attack vectors.

  • CVE-2010-2022May 28, 2010
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.00

    jail.c in jail in FreeBSD 8.0 and 8.1-PRERELEASE, when the "-l -U root" options are omitted, does not properly restrict access to the current working directory, which might allow local users to read, modify, or create arbitrary files via standard filesystem operations.

  • CVE-2010-2020May 28, 2010
    FreeBSD
    FreeBSD
    risk 0.03cvss —epss 0.01

    sys/nfsclient/nfs_vfsops.c in the NFS client in the kernel in FreeBSD 7.2 through 8.1-PRERELEASE, when vfs.usermount is enabled, does not validate the length of a certain fhsize parameter, which allows local users to gain privileges via a crafted mount request.

  • CVE-2010-1938May 28, 2010
    OPIE
    OPIE
    risk 0.05cvss —epss 0.22

    Off-by-one error in the __opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier, as used on FreeBSD 6.4 through 8.1-PRERELEASE and other platforms, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a…

  • CVE-2010-1919May 28, 2010
    EMC Corporation
    Avamar
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in EMC Avamar 4.1.x and 5.0 before SP1 allows remote attackers to cause a denial of service (gsan service hang) by sending a crafted message using TCP.

  • CVE-2010-2104May 27, 2010
    Orbitdownloader
    Orbit Downloader
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in Orbit Downloader 3.0.0.4 and 3.0.0.5 allows user-assisted remote attackers to write arbitrary files via a metalink file containing directory traversal sequences in the name attribute of a file element.

  • CVE-2010-2103May 27, 2010
    Apache
    Axis2
    risk 0.06cvss —epss 0.35

    Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers…

  • CVE-2010-2102May 27, 2010
    Webby
    Webserver
    risk 0.04cvss —epss 0.07

    Buffer overflow in Webby Webserver 1.01 allows remote attackers to execute arbitrary code via a long HTTP GET request.

  • CVE-2010-2101May 27, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The (1) strip_tags, (2) setcookie, (3) strtok, (4) wordwrap, (5) str_word_count, and (6) str_pad functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of…

  • CVE-2010-2100May 27, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The (1) htmlentities, (2) htmlspecialchars, (3) str_getcsv, (4) http_build_query, (5) strpbrk, and (6) strtr functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace…

  • CVE-2010-2099May 27, 2010
    E107
    E107
    risk 0.03cvss —epss 0.05

    bbcode/php.bb in e107 0.7.20 and earlier does not perform access control checks for all inputs that could contain the php bbcode tag, which allows remote attackers to execute arbitrary PHP code, as demonstrated using the toEmail method in contact.php, related to invocations of…

  • CVE-2010-2098May 27, 2010
    E107
    E107
    risk 0.00cvss —epss 0.01

    Incomplete blacklist vulnerability in usersettings.php in e107 0.7.20 and earlier allows remote attackers to conduct SQL injection attacks via the loginname parameter.

  • CVE-2010-2097May 27, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The (1) iconv_mime_decode, (2) iconv_substr, and (3) iconv_mime_encode functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function,…

  • CVE-2010-2096May 27, 2010
    Cmsqlite
    Cmsqlite
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in index.php in CMSQlite 1.2 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod parameter.

  • CVE-2010-2095May 27, 2010
    Cmsqlite
    Cmsqlite
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in CMSQlite 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the c parameter.

  • CVE-2010-2094May 27, 2010
    PHP
    PHP
    risk 0.04cvss —epss 0.13

    Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the (1)…

  • CVE-2010-2093May 27, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the request shutdown functionality in PHP 5.2 before 5.2.13 and 5.3 before 5.3.2 allows context-dependent attackers to cause a denial of service (crash) via a stream context structure that is freed before destruction occurs.

  • CVE-2010-2092May 27, 2010
    Cacti (software)
    Cacti
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rra_id parameter in a GET request in conjunction with a valid rra_id value in a POST request or a cookie, which causes the POST or cookie…

  • CVE-2010-2091May 27, 2010
    Microsoft
    Outlook Web Access
    risk 0.04cvss —epss 0.18

    Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which might allow remote attackers to obtain sensitive information or conduct…

  • CVE-2010-2090May 27, 2010
    IBM
    Communications Server for AIX
    risk 0.00cvss —epss 0.02

    The npb_protocol_error function in sna V5router64 in IBM Communications Server for Windows 6.1.3 and Communications Server for AIX (aka CSAIX or CS/AIX) in sna.rte before 6.3.1.2 allows remote attackers to cause a denial of service (daemon crash) via APPC data containing a GDSID…

  • CVE-2010-2089May 27, 2010
    Python (programming language)
    Python
    risk 0.00cvss —epss 0.15

    The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte string lengths, which allows context-dependent attackers to cause a denial of service (memory corruption and application crash) via crafted arguments, as demonstrated by a…

  • CVE-2010-1959May 27, 2010
    Microfocus
    TestDirector for Quality Center
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP TestDirector for Quality Center 9.2 before Patch8 allows remote attackers to modify data via unknown vectors.

  • CVE-2010-1634May 27, 2010
    Python (programming language)
    Python
    risk 0.00cvss —epss 0.04

    Multiple integer overflows in audioop.c in the audioop module in Python 2.6, 2.7, 3.1, and 3.2 allow context-dependent attackers to cause a denial of service (application crash) via a large fragment, as demonstrated by a call to audioop.lin2lin with a long string in the first…

  • CVE-2010-1450May 27, 2010
    Python (programming language)
    Python
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in the RLE decoder in the rgbimg module in Python 2.5 allow remote attackers to have an unspecified impact via an image file containing crafted data that triggers improper processing within the (1) longimagedata or (2) expandrow function.

  • CVE-2010-1449May 27, 2010
    Python (programming language)
    Python
    risk 0.00cvss —epss 0.04

    Integer overflow in rgbimgmodule.c in the rgbimg module in Python 2.5 allows remote attackers to have an unspecified impact via a large image that triggers a buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-3143.12.

  • CVE-2010-1296May 27, 2010
    Adobe Inc.
    Photoshop
    risk 0.05cvss —epss 0.20

    Multiple buffer overflows in Adobe Photoshop CS4 before 11.0.2 allow user-assisted remote attackers to execute arbitrary code via a crafted (1) .ASL, (2) .ABR, or (3) .GRD file.

  • CVE-2010-0600May 27, 2010
    Cisco Systems, Inc.
    Mediator Framework
    risk 0.00cvss —epss 0.05

    Cisco Mediator Framework 1.5.1 before 1.5.1.build.14-eng, 2.2 before 2.2.1.dev.1, and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 does not properly restrict network access to an unspecified…

  • CVE-2010-0599May 27, 2010
    Cisco Systems, Inc.
    Mediator Framework
    risk 0.00cvss —epss 0.03

    Cisco Mediator Framework 1.5.1 before 1.5.1.build.14-eng, 2.2 before 2.2.1.dev.1, and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 does not encrypt XML RPC sessions from operator workstations, which…