VYPR

CVEs

345,958 total · page 6088 of 6,920

AllCriticalHighKEV
  • CVE-2010-1863May 7, 2010
    Clantiger
    Clantiger
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the shoutbox module (modules/shoutbox.php) in ClanTiger 1.1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the s_email parameter.

  • CVE-2010-1862May 7, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The chunk_split function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

  • CVE-2010-1861May 7, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The sysvshm extension for PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to write to arbitrary memory addresses by using an object's __sleep function to interrupt an internal call to the shm_put_var function, which triggers access of a freed…

  • CVE-2010-1860May 7, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The html_entity_decode function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal call, related to the call time…

  • CVE-2010-1859May 7, 2010
    Deluxebb
    Deluxebb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in newpost.php in DeluxeBB 1.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the membercookie cookie when adding a new thread.

  • CVE-2009-4854May 7, 2010
    Talkback
    Talkback
    risk 0.03cvss —epss 0.03

    addons/import.php in TalkBack 2.3.14 allows remote attackers to execute arbitrary commands via the result parameter.

  • CVE-2010-1858May 7, 2010
    Joomla
    SMEStorage
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in the SMEStorage (com_smestorage) component before 1.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.

  • CVE-2010-1857May 7, 2010
    Realitymedias
    Repairshop2
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in RepairShop2 1.9.023 Trial, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the prod parameter in a products.details action. NOTE: the provenance of this information is unknown; the…

  • CVE-2010-1856May 7, 2010
    Realitymedias
    Repairshop2
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in RepairShop2 1.9.023 Trial, when magic_quotes_gpc is disabled, allows remote attackers to inject arbitrary web script or HTML via the prod parameter in a products.details action.

  • CVE-2010-1855May 7, 2010
    Phpscripte24
    Pay Per Watch \& Bid Auktions System
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to execute arbitrary SQL commands via the id_auk parameter.

  • CVE-2010-1854May 7, 2010
    Phpscripte24
    Pay Per Watch \& Bid Auktions System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to inject arbitrary web script or HTML via the id_auk parameter, which is not properly handled in a forced SQL error message. NOTE: the provenance of this…

  • CVE-2010-1853May 7, 2010
    Transmissionbt
    Transmission
    risk 0.00cvss —epss 0.04

    Multiple stack-based buffer overflows in the tr_magnetParse function in libtransmission/magnet.c in Transmission 1.91 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted magnet URL with a large number of (1) tr or (2) ws…

  • CVE-2010-1690May 7, 2010
    Microsoft
    Exchange Server
    risk 0.01cvss —epss 0.07

    The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows Server 2008 SP2 and earlier, Windows Server 2008 R2, Exchange Server 2003 SP3 and earlier, Exchange…

  • CVE-2010-1689May 7, 2010
    Microsoft
    Exchange Server
    risk 0.01cvss —epss 0.07

    The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows Server 2008 SP2 and earlier, Windows Server 2008 R2, Exchange Server 2003 SP3 and earlier, Exchange…

  • CVE-2010-1451May 7, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The TSB I-TLB load implementation in arch/sparc/kernel/tsb.S in the Linux kernel before 2.6.33 on the SPARC platform does not properly obtain the value of a certain _PAGE_EXEC_4U bit and consequently does not properly implement a non-executable stack, which makes it easier for…

  • CVE-2010-1437HigMay 7, 2010
    Linux
    Kernel
    risk 0.49cvss 7.0epss 0.01

    Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands…

  • CVE-2010-1173May 7, 2010
    Linux
    Kernel
    risk 0.05cvss —epss 0.21

    The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a…

  • CVE-2009-4853May 7, 2010
    Jumpbox
    Jumpbox
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in JumpBox before 1.1.2 for Foswiki Wiki System allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4852May 7, 2010
    Semanticscuttle
    Semanticscuttle
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in SemanticScuttle before 0.94.1 allow remote attackers to inject arbitrary web script or HTML via the sort parameter to index.php, and other unspecified vectors, a different issue than CVE-2008-6113. NOTE: some of these…

  • CVE-2009-4851May 7, 2010
    XOOPS
    Xoops
    risk 0.00cvss —epss 0.01

    The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to bypass administrative approval via a request involving activate.php.

  • CVE-2009-4850May 7, 2010
    Awingsoft
    Awakening Winds3d Viewer Plugin
    risk 0.05cvss —epss 0.25

    The Awingsoft Awakening Winds3D Viewer plugin 3.5.0.9 allows remote attackers to execute arbitrary programs via a SceneURL property value with a URL for a .exe file.

  • CVE-2009-4849May 7, 2010
    Toutvirtual
    Virtualiq
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to hijack the authentication of administrators for requests that (1) create a new user account via a save action to…

  • CVE-2009-4848May 7, 2010
    Toutvirtual
    Virtualiq
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to inject arbitrary web script or HTML via the (1) userId parameter to tvserver/server/user/setPermissions.jsp, (2) deptName parameter to…

  • CVE-2009-4847May 7, 2010
    Deliantra
    Deliantra
    risk 0.00cvss —epss 0.01

    Deliantra Server before 2.82 allows remote authenticated users to cause a denial of service (daemon crash) via vectors involving an empty treasure list.

  • CVE-2009-4846May 7, 2010
    Deliantra
    Deliantra
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in Deliantra Server before 2.82 allow remote attackers to execute arbitrary code via vectors related to (1) the command_gsay function in server/c_party.C and (2) the book implementation.

  • CVE-2010-1852May 7, 2010
    Microsoft
    Internet Explorer
    risk 0.00cvss —epss 0.04

    Microsoft Internet Explorer, when the Invisible Hand extension is enabled, uses cookies during background HTTP requests in a possibly unexpected manner, which might allow remote web servers to identify specific persons and their product searches via HTTP request logging, related…

  • CVE-2010-1851May 7, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.00

    Google Chrome, when the Invisible Hand extension is enabled, uses cookies during background HTTP requests in a possibly unexpected manner, which might allow remote web servers to identify specific persons and their product searches via HTTP request logging, related to a…

  • CVE-2010-1549May 7, 2010
    Microfocus
    Loadrunner
    risk 0.09cvss —epss 0.79

    Unspecified vulnerability in the Agent in HP LoadRunner before 9.50 and HP Performance Center before 9.50 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2010-1453May 7, 2010
    Piwik
    Piwik
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the form_url parameter.

  • CVE-2010-1440May 7, 2010
    Tetex
    Tetex
    risk 0.00cvss —epss 0.03

    Multiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009 and earlier, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a special command in a DVI file, related to the (1) predospecial and…

  • CVE-2010-1167May 7, 2010
    Fetchmail
    Fetchmail
    risk 0.00cvss —epss 0.02

    fetchmail 4.6.3 through 6.3.16, when debug mode is enabled, does not properly handle invalid characters in a multi-character locale, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted (1) message header or (2) POP3…

  • CVE-2010-1143May 7, 2010
    VMware
    View
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in VMware View (formerly Virtual Desktop Manager or VDM) 3.1.x before 3.1.3 build 252693 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0829May 7, 2010
    dvipng
    dvipng
    risk 0.00cvss —epss 0.05

    Multiple array index errors in set.c in dvipng 1.11 and 1.12, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed DVI file.

  • CVE-2010-0827May 7, 2010
    Tetex
    Tetex
    risk 0.00cvss —epss 0.04

    Integer overflow in dvips in TeX Live 2009 and earlier, and teTeX, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted virtual font (VF) file associated with a DVI file.

  • CVE-2009-4845May 7, 2010
    Toutvirtual
    Virtualiq
    risk 0.00cvss —epss 0.01

    The configuration page in ToutVirtual VirtualIQ Pro 3.2 build 7882 contains cleartext SSH credentials, which allows remote attackers to obtain sensitive information by reading the username and password fields.

  • CVE-2009-4844May 7, 2010
    Toutvirtual
    Virtualiq
    risk 0.00cvss —epss 0.01

    ToutVirtual VirtualIQ Pro 3.2 build 7882 does not restrict access to the /status URI on port 9080, which allows remote attackers to obtain sensitive Tomcat information via a direct request.

  • CVE-2009-4843May 7, 2010
    Toutvirtual
    Virtualiq
    risk 0.00cvss —epss 0.02

    ToutVirtual VirtualIQ Pro before 3.5 build 8691 does not require administrative authentication for JBoss console access, which allows remote attackers to execute arbitrary commands via requests to (1) the JMX Management Console or (2) the Web Console.

  • CVE-2009-4842May 7, 2010
    Toutvirtual
    Virtualiq
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ToutVirtual VirtualIQ Pro 3.5 build 8691 allow remote attackers to inject arbitrary web script or HTML via the (1) addNewDept, (2) deptId, or (3) deptDesc parameter to tvserver/server/user/addDepartment.jsp; or the (4)…

  • CVE-2010-1746May 6, 2010
    Joomla
    Table JX
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Table JX (com_grid) component for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) data_search and (2) rpp parameters to index.php.

  • CVE-2010-1744May 6, 2010
    Alibabaclone
    B2b Gold Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in product.html in B2B Gold Script allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-1743May 6, 2010
    Satyadeep
    Scratcher
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in projects.php in Scratcher allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-1742May 6, 2010
    Satyadeep
    Scratcher
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in projects.php in Scratcher allows remote attackers to inject arbitrary web script or HTML via the show parameter.

  • CVE-2010-1741May 6, 2010
    Billwerx
    Billwerx Rc
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in request_account.php in Billwerx RC 5.2.2 PL2 allows remote attackers to execute arbitrary SQL commands via the primary_number parameter.

  • CVE-2010-1740May 6, 2010
    Guppy
    Guppy
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in newsletter.php in GuppY 4.5.18 allows remote attackers to execute arbitrary SQL commands via the lng parameter.

  • CVE-2010-1739May 6, 2010
    Joomla
    Com Newsfeeds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Newsfeeds (com_newsfeeds) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the feedid parameter in a categories action to index.php.

  • CVE-2010-1737May 6, 2010
    Gallo
    Gallo
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in core/includes/gfw_smarty.php in Gallo 0.1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the config[gfwroot] parameter.

  • CVE-2010-1736May 6, 2010
    KrM
    Haber
    risk 0.00cvss —epss 0.01

    KrM Haber 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for d_atabase/Krmdb.mdb.

  • CVE-2010-1731May 6, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome on the HTC Hero allows remote attackers to cause a denial of service (application crash) via JavaScript that writes sequences in an infinite loop.

  • CVE-2010-1730May 6, 2010
    Dolphin Browser
    Dolphin Browser
    risk 0.00cvss —epss 0.01

    Dolphin Browser 2.5.0 on the HTC Hero allows remote attackers to cause a denial of service (application crash) via JavaScript that writes sequences in an infinite loop.

  • CVE-2010-1729May 6, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit.dll in WebKit, as used in Safari.exe 4.531.9.1 in Apple Safari, allows remote attackers to cause a denial of service (application crash) via JavaScript that writes sequences in an infinite loop.