VYPR

CVEs

345,958 total · page 6092 of 6,920

AllCriticalHighKEV
  • CVE-2010-1534Apr 26, 2010
    Joomla
    Shoutbox Pro
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in the Shoutbox Pro (com_shoutbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1533Apr 26, 2010
    Joomla
    TweetLA
    risk 0.04cvss —epss 0.15

    Directory traversal vulnerability in the TweetLA (com_tweetla) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1532Apr 26, 2010
    Givesight
    Com Powermail
    risk 0.04cvss —epss 0.16

    Directory traversal vulnerability in the givesight PowerMail Pro (com_powermail) component 1.5.3 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1531Apr 26, 2010
    Joomla
    redSHOP
    risk 0.04cvss —epss 0.17

    Directory traversal vulnerability in the redSHOP (com_redshop) component 1.0.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.

  • CVE-2010-1530Apr 26, 2010
    Drupal
    Internationalization
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Internationalization module 6.x before 6.x-1.4 for Drupal allow remote authenticated users, with translate interface or administer blocks privileges, to inject arbitrary web script or HTML via (1) strings used in block…

  • CVE-2010-1529Apr 26, 2010
    Freestyle
    Faqs Lite
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Freestyle FAQs Lite (com_fsf) component, possibly 1.3, for Joomla! allows remote attackers to execute arbitrary SQL commands via the faqid parameter in an faq action to index.php.

  • CVE-2010-1528Apr 26, 2010
    Uiga
    Proxy
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in include/template.php in Uiga Proxy, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the content parameter.

  • CVE-2010-1506Apr 23, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The Google V8 bindings in Google Chrome before 4.1.249.1059 allow attackers to cause a denial of service (memory corruption) via unknown vectors.

  • CVE-2010-1505Apr 23, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 4.1.249.1059 does not prevent pages from loading with the New Tab page's privileges, which has unknown impact and attack vectors.

  • CVE-2010-1504Apr 23, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Google Chrome before 4.1.249.1059 allows remote attackers to inject arbitrary web script or HTML via vectors related to a chrome://downloads URI.

  • CVE-2010-1503Apr 23, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Google Chrome before 4.1.249.1059 allows remote attackers to inject arbitrary web script or HTML via vectors related to a chrome://net-internals URI.

  • CVE-2010-1502Apr 23, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Google Chrome before 4.1.249.1059 allows remote attackers to access local files via vectors related to "developer tools."

  • CVE-2010-1500Apr 23, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 4.1.249.1059 does not properly support forms, which has unknown impact and attack vectors, related to a "type confusion error."

  • CVE-2010-1499Apr 23, 2010
    Musicbox
    Musicbox
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in genre_artists.php in MusicBox 3.3 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-1498Apr 23, 2010
    Clausvb
    Dl Stats
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in dl_stats before 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) download.php and (2) view_file.php.

  • CVE-2010-1497Apr 23, 2010
    Dl Stats
    dl_stats
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in download_proc.php in dl_stats before 2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2010-1496Apr 23, 2010
    Joomla
    JoltCard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JoltCard (com_joltcard) component 1.2.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cardID parameter in a view action to index.php.

  • CVE-2010-1495Apr 23, 2010
    Joomla
    Matamko
    risk 0.05cvss —epss 0.19

    Directory traversal vulnerability in the Matamko (com_matamko) component 1.01 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1494Apr 23, 2010
    AWDwall
    AWDwall
    risk 0.04cvss —epss 0.17

    Directory traversal vulnerability in the AWDwall (com_awdwall) component 1.5.4 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1493Apr 23, 2010
    Joomla
    AWDwall
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the AWDwall (com_awdwall) component before 1.5.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cbuser parameter in an awdwall action to index.php.

  • CVE-2010-1492Apr 23, 2010
    Elastix
    Elastix
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in help/frameRight.php in Elastix 1.6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id_nodo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2010-1491Apr 23, 2010
    Joomla
    MMS Blog
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1157Apr 23, 2010
    Apache
    Tomcat
    risk 0.07cvss —epss 0.53

    Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the…

  • CVE-2010-1035Apr 23, 2010
    Microfocus
    Virtual Machine Manager
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in HP Virtual Machine Manager (VMM) before 6.0 allow remote authenticated users to execute arbitrary code via unknown vectors.

  • CVE-2010-1034Apr 23, 2010
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP System Management Homepage (SMH) 6.0 before 6.0.0-95 on Linux, and 6.0 before 6.0.0.96 on Windows, allows remote authenticated users to obtain sensitive information, modify data, and cause a denial of service via unknown vectors.

  • CVE-2009-4810Apr 23, 2010
    Samhain Labs
    Samhain
    risk 0.00cvss —epss 0.03

    The Secure Remote Password (SRP) implementation in Samhain before 2.5.4 does not check for a certain zero value where required by the protocol, which allows remote attackers to bypass authentication via crafted input.

  • CVE-2009-4809Apr 23, 2010
    Easy File Sharing
    Web Server
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in thumbnail.ghp in Easy File Sharing (EFS) Web Server 4.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the vfolder parameter.

  • CVE-2009-4808Apr 23, 2010
    Graugon
    PHP Article Publisher
    risk 0.03cvss —epss 0.03

    admin.php in Graugon PHP Article Publisher 1.0 allows remote attackers to bypass authentication and obtain administrative access by setting the g_admin cookie to 1.

  • CVE-2009-4807Apr 23, 2010
    Graugon
    PHP Article Publisher
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Graugon PHP Article Publisher 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) c parameter to index.php and the (2) id parameter to view.php.

  • CVE-2009-4806Apr 23, 2010
    Digital Interchange
    Document Library
    risk 0.03cvss —epss 0.03

    admin/save_user.asp in Digital Interchange Document Library 1.0.1 does not require administrative authentication, which allows remote attackers to read or modify the administrator's credentials via unspecified vectors. NOTE: some of these details are obtained from third party…

  • CVE-2009-4805Apr 23, 2010
    EZ-Blog
    EZ-Blog Beta 1
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in EZ-Blog Beta 1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the storyid parameter to public/view.php or (2) the kill parameter to admin/remove.php.

  • CVE-2009-4804Apr 23, 2010
    TYPO3
    Calendar Base
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Calendar Base (cal) extension before 1.1.1 for TYPO3, when Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via "search parameters."

  • CVE-2009-4803Apr 23, 2010
    Andreas Schwarzkopf
    Accessibility Glossary
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Accessibility Glossary (a21glossary) extension 0.4.10 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4802Apr 23, 2010
    TYPO3
    flatmgr
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Flat Manager (flatmgr) extension before 1.9.16 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4801Apr 23, 2010
    EZ-Blog
    EZ-Blog Beta 1
    risk 0.03cvss —epss 0.02

    EZ-Blog Beta 1 does not require authentication, which allows remote attackers to create or delete arbitrary posts via requests to PHP scripts.

  • CVE-2010-1486Apr 22, 2010
    Cactusoft
    Cactushop
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in _invoice.asp in CactuShop before 6.155 allow remote attackers to inject arbitrary web script or HTML via the (1) billing address or (2) shipping address.

  • CVE-2010-1320Apr 22, 2010
    Mit
    Kerberos 5
    risk 0.04cvss —epss 0.12

    Double free vulnerability in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x before 1.8.2 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a request associated with…

  • CVE-2010-1278Apr 22, 2010
    Adobe Inc.
    Acrobat
    risk 0.01cvss —epss 0.08

    Buffer overflow in the Atlcom.get_atlcom ActiveX control in gp.ocx in Adobe Download Manager, as used in Adobe Reader and Acrobat 8.x before 8.2 and 9.x before 9.3, allows remote attackers to execute arbitrary code via unspecified parameters.

  • CVE-2010-0991Apr 22, 2010
    Imlib2
    Imlib2
    risk 0.00cvss —epss 0.02

    Multiple heap-based buffer overflows in imlib2 1.4.3 allow context-dependent attackers to execute arbitrary code via a crafted (1) ARGB, (2) XPM, or (3) BMP file, related to the IMAGE_DIMENSIONS_OK macro in lib/image.h.

  • CVE-2010-0593Apr 22, 2010
    Cisco Systems, Inc.
    Pvc2300
    risk 0.00cvss —epss 0.03

    The Cisco RVS4000 4-port Gigabit Security Router before 1.3.2.0, PVC2300 Business Internet Video Camera before 1.1.2.6, WVC200 Wireless-G PTZ Internet Video Camera before 1.1.1.15, WVC210 Wireless-G PTZ Internet Video Camera before 1.1.1.15, and WVC2300 Wireless-G Business…

  • CVE-2009-4800Apr 22, 2010
    Sysax
    Multi Server
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in Sysax Multi Server 4.3 and 4.5 allows remote authenticated users to delete arbitrary files via a ..// (dot dot slash slash) in a DELE command.

  • CVE-2009-4799Apr 22, 2010
    Diskos
    Diskos CMS
    risk 0.03cvss —epss 0.03

    Diskos CMS 6.x stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) artikler_prod.mdb or (2) medlemmer.mdb.

  • CVE-2009-4798Apr 22, 2010
    Diskos
    Diskos CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Diskos CMS 6.x allow remote attackers to execute arbitrary SQL commands via the (1) kat parameter to side.asp, and the (2) brugerid and (3) password fields to the administration login feature.

  • CVE-2009-4797Apr 22, 2010
    JobHut
    JobHut
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in browse.php in JobHut 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the pk parameter.

  • CVE-2009-4796Apr 22, 2010
    Glfusion
    Glfusion
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) order and (2) direction parameters to search.php.

  • CVE-2009-4795Apr 22, 2010
    Xlightftpd
    Xlight FTP Server
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Xlight FTP Server before 3.2.1, when ODBC authentication is enabled, allow remote attackers to execute arbitrary SQL commands via the (1) USER (aka username) or (2) PASS (aka password) command.

  • CVE-2009-4794Apr 22, 2010
    Community CMS
    Community CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Community CMS 0.5 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to view.php and the (2) a parameter in an event action to calendar.php, reachable through index.php.

  • CVE-2009-4793Apr 22, 2010
    BandSite
    CMS
    risk 0.03cvss —epss 0.02

    Unrestricted file upload vulnerability in adminpanel/scripts/addphotos.php in BandSite CMS 1.1.4 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension via an addphotos action to adminpanel/index.php, and then…

  • CVE-2009-4792Apr 22, 2010
    BandSite
    CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in includes/content/member_content.php in BandSite CMS 1.1.4 allows remote attackers to execute arbitrary SQL commands via the memid parameter to members.php.

  • CVE-2009-4791Apr 22, 2010
    Haudenschilt
    Family Connections
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Family Connections (aka FCMS) before 1.8.2 allow remote attackers to execute arbitrary SQL commands via the (1) letter parameter to addressbook.php, (2) id parameter to recipes.php, (3) year parameter to register.php, (4) poll_id…