VYPR

CVEs

345,967 total · page 6087 of 6,920

AllCriticalHighKEV
  • CVE-2010-1925May 12, 2010
    Tekno.portal
    Tekno.portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in makale.php in tekno.Portal 0.1b allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2006-2817.

  • CVE-2010-1924May 12, 2010
    Phpscripte24
    Live Shopping Multi Portal System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Hi Web Wiesbaden Live Shopping Multi Portal System allows remote attackers to execute arbitrary SQL commands via the artikel parameter.

  • CVE-2010-1923May 12, 2010
    Phpscripte24
    Web 2.0 Social Network Freunde Community System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in user.php in Hi Web Wiesbaden Web 2.0 Social Network Freunde Community System allows remote attackers to execute arbitrary SQL commands via the id parameter in a showgallery action.

  • CVE-2010-1922May 12, 2010
    29o3 CMS
    29o3 CMS
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in 29o3 CMS 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the LibDir parameter to (1) lib/page/pageDescriptionObject.php, and (2) layoutHeaderFuncs.php, (3) layoutManager.php, and (4) layoutParser.php in…

  • CVE-2010-1921May 12, 2010
    Openmairie
    Openannuaire
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in OpenMairie openAnnuaire 2.00, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) annuaire.class.php, (2) droit.class.php, (3)…

  • CVE-2010-1920May 12, 2010
    Openmairie
    Openannuaire
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in scr/soustab.php in OpenMairie openAnnuaire 2.00, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the dsn[phptype] parameter, a related issue to…

  • CVE-2010-1482May 12, 2010
    Cmsmadesimple
    Cmsmadesimple
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter.

  • CVE-2010-1620May 12, 2010
    Gnustep
    Base
    risk 0.00cvss —epss 0.01

    Integer overflow in the load_iface function in Tools/gdomap.c in gdomap in GNUstep Base before 1.20.0 might allow context-dependent attackers to execute arbitrary code via a (1) file or (2) socket that provides configuration data with many entries, leading to a heap-based buffer…

  • CVE-2010-1457May 12, 2010
    Gnustep
    Base
    risk 0.03cvss —epss 0.01

    Tools/gdomap.c in gdomap in GNUstep Base before 1.20.0 allows local users to read arbitrary files via a (1) -c or (2) -a option, which prints file contents in an error message.

  • CVE-2010-0816May 12, 2010
    Microsoft
    Outlook Express
    risk 0.05cvss —epss 0.20

    Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7; and Windows Mail on Windows Vista SP1 and SP2, Windows Server 2008…

  • CVE-2010-0815May 12, 2010
    Microsoft
    Office
    risk 0.02cvss —epss 0.22

    VBE6.DLL in Microsoft Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Visual Basic for Applications (VBA), and VBA SDK 6.3 through 6.5 does not properly search for ActiveX controls that are embedded in documents, which allows remote attackers to execute…

  • CVE-2010-1918May 12, 2010
    Epignosis
    Efront
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ask_chat.php in eFront 3.6.2 and earlier allows remote attackers to execute arbitrary SQL commands via the chatrooms_ID parameter.

  • CVE-2010-1917May 12, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.03

    Stack consumption vulnerability in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (PHP crash) via a crafted first argument to the fnmatch function, as demonstrated using a long string.

  • CVE-2010-1916May 12, 2010
    Xinha
    Wysiwyg Editor
    risk 0.00cvss —epss 0.03

    The dynamic configuration feature in Xinha WYSIWYG editor 0.96 Beta 2 and earlier, as used in Serendipity 1.5.2 and earlier, allows remote attackers to bypass intended access restrictions and modify the configuration of arbitrary plugins via (1) crafted…

  • CVE-2010-1915May 12, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The preg_quote function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature,…

  • CVE-2010-1914May 12, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The Zend Engine in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information by interrupting the handler for the (1) ZEND_BW_XOR opcode (shift_left_function), (2) ZEND_SL opcode (bitwise_xor_function), or (3) ZEND_SR opcode…

  • CVE-2010-1869May 12, 2010
    Artifex
    Ghostscript
    risk 0.04cvss —epss 0.09

    Stack-based buffer overflow in the parser function in GhostScript 8.70 and 8.64 allows context-dependent attackers to execute arbitrary code via a crafted PostScript file.

  • CVE-2010-1913May 12, 2010
    Consona
    Consona Live Assistance
    risk 0.00cvss —epss 0.05

    The default configuration of pluginlicense.ini for the SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance, when downloaded from a server operated by Telefonica or possibly other companies, contains an incorrect DNS…

  • CVE-2010-1912May 12, 2010
    Consona
    Consona Live Assistance
    risk 0.00cvss —epss 0.05

    The SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to bypass intended restrictions on ActiveX execution via "instantiation/free attacks."

  • CVE-2010-1911May 12, 2010
    Consona
    Consona Live Assistance
    risk 0.00cvss —epss 0.03

    The site-locking implementation in the SdcWebSecureBase interface in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance relies on a list of server domain names to restrict execution of ActiveX controls, which makes it easier for man-in-the-middle…

  • CVE-2010-1910May 12, 2010
    Consona
    Consona Live Assistance
    risk 0.00cvss —epss 0.02

    The Forgot Password implementation in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to reset passwords of accounts with blank Hint questions and Hint answers by sending an empty value for each of these two Hint fields.

  • CVE-2010-1909May 12, 2010
    Consona
    Consona Live Assistance
    risk 0.00cvss —epss 0.06

    Buffer overflow in the RunCmd method in the SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to execute arbitrary code via vectors involving "CreateProcess params." NOTE: some of these…

  • CVE-2010-1908May 12, 2010
    Consona
    Consona Live Assistance
    risk 0.00cvss —epss 0.02

    The SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance does not properly restrict access to the HTTPDownloadFile, HTTPGetFile, Install, and RunCmd methods, which allows remote attackers to execute arbitrary…

  • CVE-2010-1907May 12, 2010
    Consona
    Consona Live Assistance
    risk 0.00cvss —epss 0.02

    The SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to discover the username of the client user, and consequently determine a pathname to a certain user directory, via a call to the…

  • CVE-2010-1906May 12, 2010
    Consona
    Consona Dynamic Agent
    risk 0.00cvss —epss 0.04

    tgsrv.exe in the Repair Service in Consona Dynamic Agent, Repair Manager, Subscriber Activation, and Subscriber Agent relies on a predictable timestamp field to validate input to the \\.\pipe\__RepairService_pipe__company named pipe, which allows remote authenticated users to…

  • CVE-2010-1905May 12, 2010
    Consona
    Consona Live Assistance
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allow remote attackers to inject arbitrary web script or HTML via crafted input to ASP pages, as demonstrated using the backurl parameter to…

  • CVE-2010-1481May 12, 2010
    Pmwiki
    Pmwiki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the table feature in PmWiki 2.2.15 allows remote authenticated users to inject arbitrary web script or HTML via the width attribute.

  • CVE-2010-1455May 12, 2010
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The DOCSIS dissector in Wireshark 0.9.6 through 1.0.12 and 1.2.0 through 1.2.7 allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed packet trace file.

  • CVE-2010-0730May 12, 2010
    Red Hat
    Xen hypervisor
    risk 0.00cvss —epss 0.02

    The MMIO instruction decoder in the Xen hypervisor in the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows guest OS users to cause a denial of service (32-bit guest OS crash) via vectors that trigger an unspecified instruction emulation.

  • CVE-2010-1878May 12, 2010
    Joomla
    OrgChart
    risk 0.04cvss —epss 0.11

    Directory traversal vulnerability in the OrgChart (com_orgchart) component 1.0.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1877May 12, 2010
    Joomla
    JTM Reseller
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JTM Reseller (com_jtm) component 1.9 Beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the author parameter in a search action to index.php.

  • CVE-2010-1876May 12, 2010
    AJ
    Shopping Cart
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in AJ Shopping Cart 1.0 allows remote attackers to execute arbitrary SQL commands via the maincatid parameter in a showmaincatlanding action.

  • CVE-2010-1875May 12, 2010
    Joomla
    com_properties
    risk 0.04cvss —epss 0.16

    Directory traversal vulnerability in the Real Estate Property (com_properties) component 3.1.22-03 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php. NOTE: some of…

  • CVE-2010-1874May 12, 2010
    Joomla
    Real Estate Property (com_properties)
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the Real Estate Property (com_properties) component 3.1.22-03 for Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in an agentlisting action to index.php. NOTE: some of these details are obtained from third…

  • CVE-2010-1873May 12, 2010
    Joomla
    Jvehicles
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in the Jvehicles (com_jvehicles) component 1.0, 2.0, and 2.1111 for Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in an agentlisting action to index.php. NOTE: some of these details are obtained from third…

  • CVE-2010-1872May 12, 2010
    Tufat
    Flashcard
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cPlayer.php in FlashCard 2.6.5 and 3.0.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4872May 11, 2010
    Logoshows
    BBS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in globepersonnel_login.asp in Logoshows BBS 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields.

  • CVE-2009-4871May 11, 2010
    Logoshows
    BBS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in globepersonnel_forum.asp in Logoshows BBS 2.0 allows remote attackers to execute arbitrary SQL commands via the forumid parameter.

  • CVE-2009-4870May 11, 2010
    Phpcityportal
    Phpcityportal
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.php in PHPCityPortal allow remote attackers to execute arbitrary SQL commands via the (1) req_username (aka Username) and (2) req_password (aka Password) parameters. NOTE: some of these details are obtained from third party…

  • CVE-2009-4869May 11, 2010
    Nasim
    Guest Book
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Nasim Guest Book 1.2 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2009-4868May 11, 2010
    Hitronsoft
    Answer Me
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Hitron Soft Answer Me 1.0 allows remote attackers to inject arbitrary web script or HTML via the q_id parameter to the answers script (aka answers.php). NOTE: some of these details are obtained from third party information.

  • CVE-2009-4867May 11, 2010
    Tony Million
    Tuniac
    risk 0.03cvss —epss 0.04

    Buffer overflow in Tuniac 090517c allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long URL in a .m3u playlist file.

  • CVE-2009-4866May 11, 2010
    Matt's Script Archive
    Simple Search
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.cgi in Matt's Script Archive (MSA) Simple Search 1.0 allows remote attackers to inject arbitrary web script or HTML via the terms parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4865May 11, 2010
    I Escorts
    I Escorts Directory Script
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in escorts_search.php in I-Escorts Directory Script and Agency Script, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) search_name and (2) languages parameters. NOTE: some of these…

  • CVE-2009-4864May 11, 2010
    I Escorts
    I Escorts Directory Script
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in escorts_search.php in I-Escorts Directory Script and Agency Script allow remote attackers to inject arbitrary web script or HTML via the (1) search_name and (2) languages parameters. NOTE: some of these details are obtained…

  • CVE-2009-4863May 11, 2010
    Ultraplayer
    Ultraplayer Media Player
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in UltraPlayer Media Player 2.112 allows remote attackers to execute arbitrary code via a long string in a .usk file.

  • CVE-2009-4862May 11, 2010
    Abushhab
    Alwasel
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Alwasel 1.5 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) show.php and (2) xml.php.

  • CVE-2009-4861May 11, 2010
    Supportpro
    Supportdesk
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in shownews.php in SupportPRO SupportDesk 3.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  • CVE-2009-4860May 11, 2010
    Typing Pal
    Typing Pal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in demo.php in Typing Pal 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the idTableProduit parameter.

  • CVE-2009-4859May 11, 2010
    Onlinetechtools.com
    Owos Lite
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Online Work Order Suite (OWOS) Lite Edition 3.10 allow remote attackers to inject arbitrary web script or HTML via the show parameter to (1) default.asp and (2) report.asp, and the (3) go parameter to login.asp.