VYPR

CVEs

345,868 total · page 6095 of 6,918

AllCriticalHighKEV
  • CVE-2010-1354Apr 12, 2010
    Joomla
    com_vjdeo
    risk 0.04cvss —epss 0.16

    Directory traversal vulnerability in the VJDEO (com_vjdeo) component 1.0 and 1.0.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party information.

  • CVE-2010-1353Apr 12, 2010
    Joomla
    com_loginbox
    risk 0.05cvss —epss 0.19

    Directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.

  • CVE-2010-1352Apr 12, 2010
    Jooforge
    Jutebox
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in the JOOFORGE Jutebox (com_jukebox) component 1.0 and 1.7 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party…

  • CVE-2010-1351Apr 12, 2010
    Nodesforum
    Nodesforum
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Nodesforum 1.033 and 1.045, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) _nodesforum_path_from_here_to_nodesforum_folder parameter to erase_user_data.php and the…

  • CVE-2010-1350Apr 12, 2010
    Joomla
    JP Jobs
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JP Jobs (com_jp_jobs) component 1.4.1 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.

  • CVE-2010-1349Apr 12, 2010
    Opera
    Opera
    risk 0.05cvss —epss 0.20

    Integer overflow in Opera 10.10 through 10.50 allows remote attackers to execute arbitrary code via a large Content-Length value, which triggers a heap overflow.

  • CVE-2010-1152Apr 12, 2010
    Memcached
    Memcached
    risk 0.00cvss —epss 0.10

    memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a long line that triggers excessive memory allocation. NOTE: some of these details are obtained from third party information.

  • CVE-2010-1149Apr 12, 2010
    Xorg
    Udisks
    risk 0.00cvss —epss 0.00

    probers/udisks-dm-export.c in udisks before 1.0.1 exports UDISKS_DM_TARGETS_PARAMS information to udev even for a crypt UDISKS_DM_TARGETS_TYPE, which allows local users to discover encryption keys by (1) running a certain udevadm command or (2) reading a certain file under…

  • CVE-2010-1146Apr 12, 2010
    Linux
    Kernel
    risk 0.03cvss —epss 0.02

    The Linux kernel 2.6.33.2 and earlier, when a ReiserFS filesystem exists, does not restrict read or write access to the .reiserfs_priv directory, which allows local users to gain privileges by modifying (1) extended attributes or (2) ACLs, as demonstrated by deleting a file…

  • CVE-2010-1142Apr 12, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.02

    VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x before 2.0.2 build 203138; VMware Fusion 2.x before 2.0.6 build 246742; VMware ESXi 3.5 and 4.0; and…

  • CVE-2010-1141Apr 12, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.04

    VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x before 2.0.2 build 203138; VMware Fusion 2.x before 2.0.6 build 246742; VMware ESXi 3.5 and 4.0; and…

  • CVE-2010-1140Apr 12, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    The USB service in VMware Workstation 7.0 before 7.0.1 build 227600 and VMware Player 3.0 before 3.0.1 build 227600 on Windows might allow host OS users to gain privileges by placing a Trojan horse program at an unspecified location on the host OS disk.

  • CVE-2010-1139Apr 12, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    Format string vulnerability in vmrun in VMware VIX API 1.6.x, VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Linux, and VMware Fusion 2.x before 2.0.7 build 246742, allows local users to gain privileges…

  • CVE-2010-1138Apr 12, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.02

    The virtual networking stack in VMware Workstation 7.0 before 7.0.1 build 227600, VMware Workstation 6.5.x before 6.5.4 build 246459 on Windows, VMware Player 3.0 before 3.0.1 build 227600, VMware Player 2.5.x before 2.5.4 build 246459 on Windows, VMware ACE 2.6 before 2.6.1…

  • CVE-2010-0741Apr 12, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    The virtio_net_bad_features function in hw/virtio-net.c in the virtio-net driver in the Linux kernel before 2.6.26, when used on a guest OS in conjunction with qemu-kvm 0.11.0 or KVM 83, allows remote attackers to cause a denial of service (guest OS crash, and an associated…

  • CVE-2009-3732Apr 12, 2010
    VMware
    VMware Remote Console
    risk 0.04cvss —epss 0.16

    Format string vulnerability in vmware-vmrc.exe build 158248 in VMware Remote Console (aka VMrc) allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2009-1565Apr 12, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.06

    vmnc.dll in the VMnc media codec in VMware Movie Decoder before 6.5.4 Build 246459 on Windows, and the movie decoder in VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Windows, allows remote attackers to…

  • CVE-2009-1564Apr 12, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in vmnc.dll in the VMnc media codec in VMware Movie Decoder before 6.5.4 Build 246459 on Windows, and the movie decoder in VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on…

  • CVE-2010-1348Apr 12, 2010
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the login process in IBM WebSphere Portal 6.0.1.1, and 6.1.0.x before 6.1.0.3 Cumulative Fix 03, has unknown impact and remote attack vectors.

  • CVE-2010-1347Apr 12, 2010
    IBM
    Director Agent
    risk 0.00cvss —epss 0.00

    Director Agent 6.1 before 6.1.2.3 in IBM Systems Director on AIX and Linux uses incorrect permissions for the (1) diruninstall and (2) opt/ibm/director/bin/wcitinst scripts, which allows local users to gain privileges by executing these scripts.

  • CVE-2010-1148Apr 12, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The cifs_create function in fs/cifs/dir.c in the Linux kernel 2.6.33.2 and earlier allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a NULL nameidata (aka nd) field in a POSIX file-creation request…

  • CVE-2010-1346Apr 9, 2010
    Ribafs
    Mini CMS Ribafs
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/login.php in Mini CMS RibaFS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the login parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-1345Apr 9, 2010
    Joomla
    CKForms
    risk 0.04cvss —epss 0.17

    Directory traversal vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1344Apr 9, 2010
    Joomla
    CKForms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the fid parameter in a detail action to index.php.

  • CVE-2010-1343Apr 9, 2010
    Bj Sintay
    Sitex
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in photo.php in SiteX 0.7.4 beta allows remote attackers to execute arbitrary SQL commands via the albumid parameter.

  • CVE-2010-1342Apr 9, 2010
    Direct News
    Direct News
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Direct News 4.10.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to (1) admin/menu.php and (2) library/lib.menu.php; and the adminroot parameter to…

  • CVE-2010-1341Apr 9, 2010
    Systemsoftware
    Community Black Forum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Systemsoftware Community Black Forum allows remote attackers to execute arbitrary SQL commands via the s_flaeche parameter.

  • CVE-2010-1340Apr 9, 2010
    Joomla Research
    Com Jresearch
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in jresearch.php in the J!Research (com_jresearch) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1339Apr 9, 2010
    Woltlab
    Teamsite Hack
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in ts_other.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows remote attackers to inject arbitrary web script or HTML via the userid parameter in a modboard action, which is not properly handled in a forced…

  • CVE-2010-1338Apr 9, 2010
    Woltlab
    Teamsite Hack
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in ts_other.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows remote attackers to execute arbitrary SQL commands via the userid parameter in a modboard action.

  • CVE-2010-1337Apr 9, 2010
    Lussumo
    Vanilla
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in definitions.php in Lussumo Vanilla 1.1.10, and possibly 0.9.2 and other versions, allow remote attackers to execute arbitrary PHP code via a URL in the (1) include and (2) Configuration['LANGUAGE'] parameters.

  • CVE-2010-1336Apr 9, 2010
    Invohost
    Invohost
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in INVOhost 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) newlanguage parameters to site.php, (3) search parameter to manuals.php, and (4) unspecified vectors to faq.php. NOTE: some of these details…

  • CVE-2010-1335Apr 9, 2010
    Insky
    CMS
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Insky CMS 006-0111, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the ROOT parameter to (1) city.get/city.get.php, (2) city.get/index.php, (3)…

  • CVE-2010-1334Apr 9, 2010
    Pulse
    Pulse CMS Basic
    risk 0.00cvss —epss 0.01

    Unrestricted file upload vulnerability in Pulse CMS Basic 1.2.4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in an unspecified…

  • CVE-2010-1333Apr 9, 2010
    Almas
    Compiere
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Almas Inc. Compiere J300_A02 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1332Apr 9, 2010
    Prettybook
    Prettyformmail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in PrettyBook PrettyFormMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1331Apr 9, 2010
    Heartlogic
    Hl Sitemanager
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Heartlogic HL-SiteManager allows remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2010-0993Apr 9, 2010
    Pulse
    Pulse CMS Basic
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in Pulse CMS Basic 1.2.2 and 1.2.3, and possibly Pulse Pro before 1.3.2, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an…

  • CVE-2010-0992Apr 9, 2010
    Pulse CMS
    Basic
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Pulse CMS Basic 1.2.2 and 1.2.3, and possibly Pulse Pro before 1.3.2, allow remote attackers to hijack the authentication of users for requests that (1) upload image files, (2) delete image files, or (3) create blocks.

  • CVE-2010-1315Apr 8, 2010
    Joomlamo
    Com Weberpcustomer
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1.x before 1.06.02 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these…

  • CVE-2010-1314Apr 8, 2010
    Joomla
    Highslide JS
    risk 0.04cvss —epss 0.16

    Directory traversal vulnerability in the Highslide JS (com_hsconfig) component 1.5 and 2.0.9 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party…

  • CVE-2010-1313Apr 8, 2010
    Joomla
    Seber Cart
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in the Seber Cart (com_sebercart) component 1.0.0.12 and 1.0.0.13 for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php. NOTE: some of these details…

  • CVE-2010-1312Apr 8, 2010
    Ijoomla
    Com News Portal
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in the iJoomla News Portal (com_news_portal) component 1.5.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1311Apr 8, 2010
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.03

    The qtm_decompress function in libclamav/mspack.c in ClamAV before 0.96 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted CAB archive that uses the Quantum (aka .Q) compression format. NOTE: some of these details are…

  • CVE-2010-1310Apr 8, 2010
    Opera
    Opera
    risk 0.00cvss —epss 0.01

    Opera 10.50 allows remote attackers to obtain sensitive information via crafted XSLT constructs, which cause Opera to return cached contents of other pages.

  • CVE-2010-1309Apr 8, 2010
    Irmin
    Irmin CMS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in Irmin CMS (formerly Pepsi CMS) 0.6 BETA2 allows remote attackers to read arbitrary files via a .. (dot dot) in the w parameter to index.php.

  • CVE-2010-0743Apr 8, 2010
    Iscsitarget
    Iscsitarget
    risk 0.00cvss —epss 0.03

    Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or…

  • CVE-2010-0098Apr 8, 2010
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.05

    ClamAV before 0.96 does not properly handle the (1) CAB and (2) 7z file formats, which allows remote attackers to bypass virus detection via a crafted archive that is compatible with standard archive utilities.

  • CVE-2010-1308Apr 8, 2010
    Joomla
    SVMap
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in the SVMap (com_svmap) component 1.1.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1307Apr 8, 2010
    Joomla
    Magic Updater
    risk 0.04cvss —epss 0.10

    Directory traversal vulnerability in the Magic Updater (com_joomlaupdater) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.