VYPR

CVEs

345,967 total · page 6084 of 6,920

AllCriticalHighKEV
  • CVE-2010-2028May 24, 2010
    K23productions
    TFTPUtil GUI
    risk 0.04cvss —epss 0.14

    Buffer overflow in k23productions TFTPUtil GUI (aka TFTPGUI) 1.4.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long transport mode.

  • CVE-2010-2027May 24, 2010
    Mathematica
    Mathematica
    risk 0.00cvss —epss 0.00

    Mathematica 7, when running on Linux, allows local users to overwrite arbitrary files via a symlink attack on (1) files within /tmp/MathLink/ or (2) /tmp/fonts$$.conf.

  • CVE-2010-1688May 24, 2010
    2brightsparks
    Syncback
    risk 0.04cvss —epss 0.15

    Stack-based buffer overflow in 2BrightSparks SyncBack Freeware 3.2.20.0, and possibly other versions before 3.2.21, allows user-assisted remote attackers to execute arbitrary code via a long filename in a (1) .sps or (2) zip profile.

  • CVE-2006-7239May 24, 2010
    GNU
    Gnutls
    risk 0.00cvss —epss 0.02

    The _gnutls_x509_oid2mac_algorithm function in lib/gnutls_algorithms.c in GnuTLS before 1.4.2 allows remote attackers to cause a denial of service (crash) via a crafted X.509 certificate that uses a hash algorithm that is not supported by GnuTLS, which triggers a NULL pointer…

  • CVE-2010-2019May 24, 2010
    Lokomedia
    CMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in downlot.php in Lokomedia CMS 1.4.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the file parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2010-2018May 24, 2010
    Lokomedia
    CMS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in downlot.php in Lokomedia CMS 1.4.1 and 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

  • CVE-2010-2017May 24, 2010
    Bukulokomedia
    Lokomedia CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in hasil-pencarian.html in Lokomedia CMS 1.4.1 and 2.0 allows remote attackers to inject arbitrary web script or HTML via the kata parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-2016May 24, 2010
    Imagetraders
    Iceberg CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in details.php in Iceberg CMS allows remote attackers to execute arbitrary SQL commands via the p_id parameter.

  • CVE-2010-2015May 24, 2010
    LiSK
    LiSK CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in LiSK CMS 4.4 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in a view_inbox action to cp/cp_messages.php or (2) the id parameter to cp/edit_email.php.

  • CVE-2010-2014May 24, 2010
    LiSK
    LiSK CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cp/list_content.php in LiSK CMS 4.4 allows remote attackers to inject arbitrary web script or HTML via the cl or possibly id parameter.

  • CVE-2010-2013May 24, 2010
    LiSK
    LiSK CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cp/edit_email.php in LiSK CMS 4.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2010-2012May 24, 2010
    MigasCMS
    MigasCMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in function.php in MigasCMS 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the categorie parameter in a catalogo action. NOTE: some of these details are obtained from third party information.

  • CVE-2010-2011May 21, 2010
    Microsoft
    Dynamics Gp
    risk 0.01cvss —epss 0.11

    Microsoft Dynamics GP uses a substitution cipher to encrypt the system password field and unspecified other fields, which makes it easier for remote authenticated users to obtain sensitive information by decrypting a field's contents.

  • CVE-2010-2010May 21, 2010
    Chaos Tool Suite Project
    Ctools
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal allow remote attackers to inject arbitrary web script or HTML via a node title.

  • CVE-2010-1548May 21, 2010
    Chaos Tool Suite Project
    Ctools
    risk 0.00cvss —epss 0.01

    The auto-complete functionality in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal does not follow access restrictions, which allows remote authenticated users, with "access content" privileges, to read the title of an unpublished node via a…

  • CVE-2010-1547May 21, 2010
    Chaos Tool Suite Project
    Ctools
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable a page via a q=admin/build/pages/nojs/enable/…

  • CVE-2010-1546May 21, 2010
    Chaos Tool Suite Project
    Ctools
    risk 0.00cvss —epss 0.01

    Multiple eval injection vulnerabilities in the import functionality in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal allow remote authenticated users, with "administer page manager" privileges, to execute arbitrary PHP code via input to a text area,…

  • CVE-2010-0539May 21, 2010
    Apple Inc.
    Java for Mac OS X
    risk 0.00cvss —epss 0.03

    Integer signedness error in the window drawing implementation in Apple Java for Mac OS X 10.5 before Update 7 and Java for Mac OS X 10.6 before Update 2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted applet.

  • CVE-2010-0538May 21, 2010
    Apple Inc.
    Java
    risk 0.00cvss —epss 0.03

    Apple Java for Mac OS X 10.5 before Update 7 and Java for Mac OS X 10.6 before Update 2 do not properly handle mediaLibImage objects, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a…

  • CVE-2010-2009May 21, 2010
    BS.Global
    BS.Player
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in the media library in BS.Global BS.Player 2.51 build 1022, 2.41 build 1003, and possibly other versions allows user-assisted remote attackers to execute arbitrary code via a long ID3 tag in a .MP3 file. NOTE: some of these details are obtained from…

  • CVE-2010-1626May 21, 2010
    MySQL
    MySQL
    risk 0.00cvss —epss 0.00

    MySQL before 5.1.46 allows local users to delete the data and index files of another user's MyISAM table via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than CVE-2008-4098 and CVE-2008-7247.

  • CVE-2010-1446May 21, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    arch/powerpc/mm/fsl_booke_mmu.c in KGDB in the Linux kernel 2.6.30 and other versions before 2.6.33, when running on PowerPC, does not properly perform a security check for access to a kernel page, which allows local users to overwrite arbitrary kernel memory, related to Fsl…

  • CVE-2010-1436May 21, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    gfs2 in the Linux kernel 2.6.18, and possibly other versions, does not properly handle when the gfs2_quota struct occupies two separate pages, which allows local users to cause a denial of service (kernel panic) via certain manipulations that cause an out-of-bounds write, as…

  • CVE-2010-2007May 20, 2010
    Letodms Project
    Letodms
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) 1.7.2 and earlier allow remote attackers to hijack the authentication of administrators for requests that use (1) op/op.EditUserData.php, (2) op/op.UsrMgr.php, (3) out/out.RemoveVersion.php,…

  • CVE-2010-2006May 20, 2010
    Letodms Project
    Letodms
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in op/op.Login.php in LetoDMS (formerly MyDMS) 1.7.2 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.

  • CVE-2010-2005May 20, 2010
    Datalifecms
    DataLife Engine
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in DataLife Engine (DLE) 8.3 allow remote attackers to execute arbitrary PHP code via a URL in (1) the selected_language parameter to engine/inc/include/init.php, (2) the config[langs] parameter to engine/inc/help.php, (3) the…

  • CVE-2010-2004May 20, 2010
    BS.Global
    BS.Player
    risk 0.04cvss —epss 0.09

    Stack-based buffer overflow in BS.Global BS.Player 2.51 Build 1022 Free, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via the Skin parameter in the Options section of a skins file (.bsi), a different vulnerability than…

  • CVE-2010-2003May 20, 2010
    Advanced Poll
    Advanced Poll
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in misc/get_admin.php in Advanced Poll 2.08 allows remote attackers to inject arbitrary web script or HTML via the mysql_host parameter.

  • CVE-2010-2002May 20, 2010
    Drupal
    Wordfilter
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Wordfilter module 5.x before 5.x-1.1 and 6.x before 6.x-1.1 for Drupal allows remote authenticated users, with "administer words filtered" privileges, to inject arbitrary web script or HTML via the word list.

  • CVE-2010-2001May 20, 2010
    Drupal
    CiviRegister
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the CiviRegister module before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via the URI.

  • CVE-2010-2000May 20, 2010
    Drupal
    Bibliography (Biblio) module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Bibliography (Biblio) module 5.x through 5.x-1.17 and 6.x through 6.x-1.9 for Drupal allows remote authenticated users, with "administer biblio" privileges, to inject arbitrary web script or HTML via unspecified vectors, a…

  • CVE-2010-1999May 20, 2010
    Openmairie
    Opencatalogue
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in scr/soustab.php in OpenMairie Opencatalogue 1.024, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the dsn[phptype] parameter, a related issue to…

  • CVE-2010-1998May 20, 2010
    Drupal
    CCK TableField
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the CCK TableField module 6.x before 6.x-1.2 for Drupal allows remote authenticated users, with certain node creation or editing privileges, to inject arbitrary web script or HTML via table headers.

  • CVE-2010-1997May 20, 2010
    Saurus
    CMS
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in admin/edit.php in Saurus CMS 4.7.0 allows remote authenticated users, with "Article list" edit privileges, to inject arbitrary web script or HTML via the pealkiri parameter.

  • CVE-2010-1996May 20, 2010
    Tomatocms
    Tomatocms
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with certain creation privileges, to inject arbitrary web script or HTML via the (1) content parameter in conjunction with a /admin/poll/add PATH_INFO,…

  • CVE-2010-1995May 20, 2010
    Tomatocms
    Tomatocms
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with "Add new article" privileges, to inject arbitrary web script or HTML via the (1) title, (2) subTitle, and (3) author parameters in conjunction with a…

  • CVE-2010-1994May 20, 2010
    Tomatocms
    Tomatocms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in TomatoCMS before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the q parameter in conjunction with a /news/search PATH_INFO.

  • CVE-2010-1993May 20, 2010
    Opera
    Opera Browser
    risk 0.00cvss —epss 0.02

    Opera 9.52 does not properly handle an IFRAME element with a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (resource consumption) via an HTML document with many IFRAME elements.

  • CVE-2010-1992May 20, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome 1.0.154.48 executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many IFRAME elements.

  • CVE-2010-1991May 20, 2010
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.11

    Microsoft Internet Explorer 6.0.2900.2180, 7, and 8.0.7600.16385 executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (excessive application launches) via an HTML…

  • CVE-2010-1990May 20, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.6.x, 3.5.x, 3.0.19, and earlier, and SeaMonkey, executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (excessive application launches) via an HTML…

  • CVE-2010-1989May 20, 2010
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera 9.52 executes a mail application in situations where an IMG element has a SRC attribute that is a redirect to a mailto: URL, which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many images, a related issue…

  • CVE-2010-1988May 20, 2010
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.06

    Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via JavaScript code that performs certain string concatenation and substring operations, a different…

  • CVE-2010-1987May 20, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (memory consumption, out-of-bounds read, and application crash) via JavaScript code that appends long strings to the content of a P element, and performs certain other string…

  • CVE-2010-1986May 20, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (memory consumption and application crash) via JavaScript code that creates multiple arrays containing elements with long string values, and then appends long strings to the content of a…

  • CVE-2010-1039May 20, 2010
    Sgi
    Irix
    risk 0.05cvss —epss 0.20

    Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX B.11.11, B.11.23, and B.11.31; and SGI IRIX 6.5 allows remote attackers to execute arbitrary code…

  • CVE-2010-0745May 20, 2010
    Dovecot (software)
    Dovecot
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Dovecot 1.2.x before 1.2.11 allows remote attackers to cause a denial of service (CPU consumption) via long headers in an e-mail message.

  • CVE-2010-1985May 19, 2010
    Movabletype
    Movabletype
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in Six Apart Movable Type 5.0 and 5.01 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2010-1630May 19, 2010
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in posting.php in phpBB before 3.0.5 has unknown impact and attack vectors related to the use of a "forum id" in circumstances related to a "global announcement."

  • CVE-2010-1629May 19, 2010
    Phorum
    Phorum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Phorum before 5.2.15 allows remote attackers to inject arbitrary web script or HTML via an invalid email address.