VYPR

CVEs

345,967 total · page 6083 of 6,920

AllCriticalHighKEV
  • CVE-2010-0598May 27, 2010
    Cisco Systems, Inc.
    Mediator Framework
    risk 0.00cvss —epss 0.03

    Cisco Mediator Framework 1.5.1 before 1.5.1.build.14-eng, 2.2 before 2.2.1.dev.1, and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 does not encrypt HTTP sessions from operator workstations, which…

  • CVE-2010-0597May 27, 2010
    Cisco Systems, Inc.
    Mediator Framework
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Cisco Mediator Framework 1.5.1 before 1.5.1.build.14-eng, 2.2 before 2.2.1.dev.1, and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 allows remote authenticated users to…

  • CVE-2010-0596May 27, 2010
    Cisco Systems, Inc.
    Mediator Framework
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Cisco Mediator Framework 2.2 before 2.2.1.dev.1 and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 allows remote authenticated users to read or modify the device…

  • CVE-2010-0595May 27, 2010
    Cisco Systems, Inc.
    Mediator Framework
    risk 0.00cvss —epss 0.03

    Cisco Mediator Framework 1.5.1 before 1.5.1.build.14-eng, 2.2 before 2.2.1.dev.1, and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 has a default password for the administrative user account and…

  • CVE-2009-4134May 27, 2010
    Python (programming language)
    Python
    risk 0.00cvss —epss 0.04

    Buffer underflow in the rgbimg module in Python 2.5 allows remote attackers to cause a denial of service (application crash) via a large ZSIZE value in a black-and-white (aka B/W) RGB image that triggers an invalid pointer dereference.

  • CVE-2010-2088May 27, 2010
    Microsoft
    Asp.net
    risk 0.01cvss —epss 0.09

    ASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks against the form control via the __VIEWSTATE parameter.

  • CVE-2010-2087May 27, 2010
    Oracle Corporation
    Mojarra
    risk 0.00cvss —epss 0.01

    Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression…

  • CVE-2010-2086May 27, 2010
    Apache
    Myfaces
    risk 0.00cvss —epss 0.02

    Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL)…

  • CVE-2010-2085May 27, 2010
    Microsoft
    .net Framework
    risk 0.01cvss —epss 0.09

    The default configuration of ASP.NET in Microsoft .NET before 1.1 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the __VIEWSTATE parameter.

  • CVE-2010-2084May 27, 2010
    Microsoft
    Asp.net
    risk 0.01cvss —epss 0.13

    Microsoft ASP.NET 2.0 does not prevent setting the InnerHtml property on a control that inherits from HtmlContainerControl, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to an attribute.

  • CVE-2010-1459May 27, 2010
    Mono
    Mono
    risk 0.00cvss —epss 0.02

    The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample…

  • CVE-2010-2083May 26, 2010
    Microsoft
    Dynamics Gp
    risk 0.01cvss —epss 0.08

    Microsoft Dynamics GP has a default value of ACCESS for the system password, which might make it easier for remote authenticated users to bypass intended access restrictions via unspecified vectors.

  • CVE-2010-2082May 26, 2010
    Cisco Systems, Inc.
    Scientific Atlanta Webstar Dpc2100r2
    risk 0.00cvss —epss 0.01

    The web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 has a default administrative password (aka SAPassword) of W2402, which makes it easier for remote attackers to obtain privileged access.

  • CVE-2010-2026May 26, 2010
    Cisco Systems, Inc.
    Scientific Atlanta Webstar Dpc2100r2
    risk 0.00cvss —epss 0.02

    The web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 allows remote attackers to bypass authentication, and reset the modem or replace the firmware, via a direct request to an unspecified page.

  • CVE-2010-2025May 26, 2010
    Cisco Systems, Inc.
    Scientific Atlanta Webstar Dpc2100r2
    risk 0.03cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 allow remote attackers to hijack the authentication of administrators for requests that (1) reset the…

  • CVE-2010-1513May 26, 2010
    Ziproxy
    Ziproxy
    risk 0.00cvss —epss 0.03

    Multiple integer overflows in src/image.c in Ziproxy before 3.0.1 allow remote attackers to execute arbitrary code via (1) a large JPG image, related to the jpg2bitmap function or (2) a large PNG image, related to the png2bitmap function, leading to heap-based buffer overflows.

  • CVE-2010-1640May 26, 2010
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.03

    Off-by-one error in the parseicon function in libclamav/pe_icons.c in ClamAV 0.96 allows remote attackers to cause a denial of service (crash) via a crafted PE icon that triggers an out-of-bounds read, related to improper rounding during scaling.

  • CVE-2010-1639May 26, 2010
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.03

    The cli_pdf function in libclamav/pdf.c in ClamAV before 0.96.1 allows remote attackers to cause a denial of service (crash) via a malformed PDF file, related to an inconsistency in the calculated stream length and the real stream length.

  • CVE-2009-4879May 26, 2010
    Novell
    Access Manager
    risk 0.00cvss —epss 0.01

    The Identity Server in Novell Access Manager before 3.1 SP1 allows attackers with disabled Active Directory accounts to authenticate using X.509 authentication, which bypasses intended access restrictions.

  • CVE-2009-4878May 26, 2010
    Novell
    Access Manager
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Administration Console in Novell Access Manager before 3.1 SP1 allows attackers to access system files via unknown attack vectors.

  • CVE-2009-4877May 26, 2010
    Webgui
    Webgui
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in WebGUI before 7.7.14 allow remote attackers to hijack the authentication of users for unspecified requests via unknown vectors.

  • CVE-2009-4876May 26, 2010
    Netrix
    Netrix CMS
    risk 0.03cvss —epss 0.02

    admin/cikkform.php in Netrix CMS 1.0 allows remote attackers to modify arbitrary pages via a direct request using the cid parameter.

  • CVE-2009-4875May 26, 2010
    Fckeditor
    Fckeditor.java
    risk 0.00cvss —epss 0.03

    FCKeditor.Java 2.4 allows remote attackers to cause a denial of service (infinite loop) via a malformed request parameter that contains "ctrl" characters.

  • CVE-2009-4874May 26, 2010
    Talkback
    Talkback
    risk 0.03cvss —epss 0.03

    TalkBack 2.3.14 does not properly restrict access to the edit comment feature (comments.php), which allows remote attackers to modify comments.

  • CVE-2009-4873May 26, 2010
    Rhino Software, Inc.
    Serv-U Web Client
    risk 0.05cvss —epss 0.21

    Stack-based buffer overflow in the HTTP server in Rhino Software Serv-U Web Client 9.0.0.5 allows remote attackers to cause a denial of service (server crash) or execute arbitrary code via a long Session cookie.

  • CVE-2010-2079May 25, 2010
    Magnoware
    Datatrack System
    risk 0.00cvss —epss 0.01

    DataTrack System 3.5 allows remote attackers to bypass intended restrictions on file extensions, and read arbitrary files, via a trailing backslash in a URI, as demonstrated by (1) web.config\ and (2) .ascx\ files.

  • CVE-2010-2078May 25, 2010
    DataTrack
    System 3.5
    risk 0.00cvss —epss 0.01

    DataTrack System 3.5 allows remote attackers to list the root directory via a (1) /%u0085/ or (2) /%u00A0/ URI.

  • CVE-2010-2051May 25, 2010
    Debliteck
    Dbcart
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in article.php in Debliteck DBCart allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-2050May 25, 2010
    Joomla
    MS Comment
    risk 0.04cvss —epss 0.13

    Directory traversal vulnerability in the Moron Solutions MS Comment (com_mscomment) component 0.8.0b for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-2049May 25, 2010
    Manageengine
    Adaudit Plus
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in jsp/audit/reports/ExportReport.jsp in ManageEngine ADAudit Plus 4.0.0 build 4043 allows remote attackers to inject arbitrary web script or HTML via the reportList parameter. NOTE: the provenance of this information is unknown; the…

  • CVE-2010-2048May 25, 2010
    Linux Ha
    Heartbeat
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Heartbeat module 6.x before 6.x-4.9 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-2047May 25, 2010
    Joenasejes
    Je CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in JE CMS 1.0.0 and 1.1 allows remote attackers to execute arbitrary SQL commands via the categoryid parameter in a viewcategory action. NOTE: some of these details are obtained from third party information.

  • CVE-2010-2046May 25, 2010
    Joomla
    ActiveHelper LiveHelp
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the ActiveHelper LiveHelp (com_activehelper_livehelp) component 2.0.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via (1) the DOMAINID parameter to server/cookies.php or (2) the SERVER parameter…

  • CVE-2010-2045May 25, 2010
    Joomla
    Dione Form Wizard
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in the Dione Form Wizard (aka FDione or com_dioneformwizard) component 1.0.2 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.

  • CVE-2010-2044May 25, 2010
    Joomla
    Konsultasi
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Konsultasi (com_konsultasi) component 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the sid parameter in a detail action to index.php.

  • CVE-2010-2043May 25, 2010
    DataTrack
    DataTrack System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Home.aspx in DataTrack System 3.5 and 3.5.8019.4 allows remote attackers to inject arbitrary web script or HTML via the Work_Order_Summary parameter (aka the request summary). NOTE: some of these details are obtained from third party…

  • CVE-2010-2042May 25, 2010
    Ecshop
    Ecshop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in search.php in ECShop 2.7.2 allows remote attackers to execute arbitrary SQL commands via the encode parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-2041May 25, 2010
    PHP Calendar
    PHP Calendar
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in PHP-Calendar before 2.0 Beta7 allow remote attackers to inject arbitrary web script or HTML via the (1) description and (2) lastaction parameters.

  • CVE-2010-2040May 25, 2010
    V Eva
    Shopzilla Affiliate Script PHP
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in V-EVA Shopzilla Affiliate Script PHP allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2010-2039May 25, 2010
    Gpeasy
    Gpeasy CMS
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in gpEasy CMS 1.6.2, 1.6.1, and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an Admin_Users action to index.php. NOTE: some of these details…

  • CVE-2010-2038May 25, 2010
    Gpeasy
    Gpeasy CMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in include/tool/editing_files.php in gpEasy CMS 1.6.2 allows remote authenticated users, with Edit privileges, to inject arbitrary web script or HTML via the gpcontent parameter to index.php. NOTE: some of these details are obtained from…

  • CVE-2010-2037May 25, 2010
    Percha
    Com Perchadownloadsattach
    risk 0.04cvss —epss 0.11

    Directory traversal vulnerability in the Percha Downloads Attach (com_perchadownloadsattach) component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-2036May 25, 2010
    Joomla
    Percha Fields Attach
    risk 0.04cvss —epss 0.13

    Directory traversal vulnerability in the Percha Fields Attach (com_perchafieldsattach) component 1.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-2035May 25, 2010
    Joomla
    PerchaGallery
    risk 0.04cvss —epss 0.16

    Directory traversal vulnerability in the Percha Gallery (com_perchagallery) component 1.6 Beta for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-2034May 25, 2010
    Joomla
    Percha Image Attach
    risk 0.04cvss —epss 0.11

    Directory traversal vulnerability in the Percha Image Attach (com_perchaimageattach) component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-2033May 25, 2010
    Percha
    Com Perchacategoriestree
    risk 0.04cvss —epss 0.16

    Directory traversal vulnerability in the Percha Multicategory Article (com_perchacategoriestree) component 0.6 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-2032May 24, 2010
    Caucho Technology
    Resin
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in resin-admin/digest.php in Caucho Technology Resin Professional 3.1.5, 3.1.10, 4.0.6, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the (1) digest_realm or (2) digest_username…

  • CVE-2010-2031May 24, 2010
    Kingsoft
    Webshield
    risk 0.03cvss —epss 0.01

    KAVSafe.sys 2010.4.14.609 and earlier, as used in Kingsoft Webshield 3.5.1.2 and earlier, allows local users to overwrite arbitrary kernel memory via a crafted request to IOCTL 0x830020d4 on the KAVSafe device.

  • CVE-2010-2030May 24, 2010
    Drupal
    External Link Page
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the External Link Page module 5.x before 5.x-1.0 and 6.x before 6.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to the administration and redirect pages.

  • CVE-2010-2029May 24, 2010
    Cybozu
    Office
    risk 0.00cvss —epss 0.01

    Cybozu Office 7 Ktai and Dotsales do not properly restrict access to the login page, which allows remote attackers to bypass authentication and obtain or modify sensitive information by using the unique ID of the user's cell phone.