VYPR

CVEs

345,868 total · page 6101 of 6,918

AllCriticalHighKEV
  • CVE-2009-4745Mar 26, 2010
    Dreamlevels
    Dreampoll
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Dreamlevels DreamPoll 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) sortField, (2) sortDesc, or (3) pageNumber parameter in a login action.

  • CVE-2009-4744Mar 26, 2010
    Exponent
    Exponent CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Contact module in Exponent CMS 0.97-GA20090213 allows remote attackers to inject arbitrary web script or HTML via the email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third…

  • CVE-2009-4743Mar 26, 2010
    Afterlogic
    Webmail
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in history-storage.aspx in AfterLogic WebMail Pro 4.7.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) HistoryStorageObjectName and (2) HistoryKey parameters.

  • CVE-2009-4742Mar 26, 2010
    Docebo
    Docebo
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Docebo 3.6.0.3 allow remote attackers to execute arbitrary SQL commands via (1) the word parameter in a play help action to the faq module, reachable through index.php; (2) the word parameter in a play keyw action to the link module,…

  • CVE-2009-4741Mar 26, 2010
    Skype Technologies
    Skype
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Extras Manager before 2.0.0.67 in Skype before 4.1.0.179 on Windows has unknown impact and attack vectors.

  • CVE-2009-4740Mar 26, 2010
    TYPO3
    Webesse E-Card
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in the Webesse E-Card (ws_ecard) extension 1.0.2 and earlier for TYPO3 has unspecified impact and remote attack vectors.

  • CVE-2009-4739Mar 26, 2010
    Mail.ru
    Dating
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in SkaDate Dating allows remote attackers to execute arbitrary PHP code via a URL in the language_id parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences.

  • CVE-2010-1124Mar 26, 2010
    IBM
    Aix
    risk 0.00cvss —epss 0.01

    bos.rte.libc 5.3.9.4 on IBM AIX 5.3 does not properly support reading a certain address field after a successful getaddrinfo function call, which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors, as demonstrated by IBM…

  • CVE-2010-1123Mar 26, 2010
    Chip Salzenberg
    Deliver
    risk 0.00cvss —epss 0.00

    Chip Salzenberg Deliver does not properly associate a lockfile with the user who created the file, which allows local users to cause a denial of service (blockage of incoming e-mail) by creating lockfiles for arbitrary mailboxes.

  • CVE-2010-0989Mar 26, 2010
    Pulsecms
    Pulse CMS
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in delete.php in Pulse CMS before 1.2.3 allows remote authenticated users to delete arbitrary files via directory traversal sequences in the f parameter.

  • CVE-2010-0988Mar 26, 2010
    Pulsecms
    Pulse CMS
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Pulse CMS before 1.2.3 allow (1) remote attackers to write to arbitrary files and execute arbitrary PHP code via vectors related to improper handling of login failures by includes/login.php; and allow remote authenticated users to write to…

  • CVE-2010-0740Mar 26, 2010
    OpenSSL Project
    OpenSSL
    risk 0.05cvss —epss 0.20

    The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection that triggers a NULL pointer dereference, related to the minor version number. NOTE: some of…

  • CVE-2010-0731Mar 26, 2010
    GNU
    Gnutls
    risk 0.00cvss —epss 0.03

    The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1, when running on big-endian, 64-bit platforms, calls the asn1_read_value with a pointer to the wrong data type and the wrong length value, which allows remote attackers to bypass the certificate…

  • CVE-2010-0439Mar 26, 2010
    Chip Salzenberg
    Deliver
    risk 0.00cvss —epss 0.00

    Chip Salzenberg Deliver allows local users to cause a denial of service, obtain sensitive information, and possibly change the ownership of arbitrary files via a symlink attack on an unspecified file.

  • CVE-2009-4505Mar 26, 2010
    OpenCMS
    OAMP Comments Module
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in OpenCMS OAMP Comments Module 1.0.1 allow remote attackers to inject arbitrary web script or HTML via the name field in a comment, and other unspecified vectors.

  • CVE-2010-1122Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Mozilla Firefox 3.5.x through 3.5.8 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly have unknown other impact via vectors that might involve compressed data, a different vulnerability than…

  • CVE-2010-0628Mar 25, 2010
    Mit
    Kerberos 5
    risk 0.00cvss —epss 0.03

    The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in the SPNEGO GSS-API functionality in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2 and 1.8 before 1.8.1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an…

  • CVE-2010-1121Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Mozilla Firefox 3.6.x before 3.6.3 does not properly manage the scopes of DOM nodes that are moved from one document to another, which allows remote attackers to conduct use-after-free attacks and execute arbitrary code via unspecified vectors involving improper interaction with…

  • CVE-2010-1120Mar 25, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Safari 4 on Apple Mac OS X 10.6 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by Charlie Miller during a Pwn2Own competition at CanSecWest 2010.

  • CVE-2010-1119Mar 25, 2010
    Apple Inc.
    Mac OS X
    risk 0.05cvss —epss 0.19

    Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash), or…

  • CVE-2010-1118Mar 25, 2010
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.22

    Unspecified vulnerability in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a use-after-free issue, as demonstrated by Peter Vreugdenhil during a Pwn2Own competition at CanSecWest 2010.

  • CVE-2010-1117Mar 25, 2010
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.14

    Heap-based buffer overflow in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to discover the base address of a Windows .dll file, and possibly have unspecified other impact, via unknown vectors, as demonstrated by Peter Vreugdenhil during a Pwn2Own…

  • CVE-2010-0586Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Cisco IOS 12.1 through 12.4, when Cisco Unified Communications Manager Express (CME) or Cisco Unified Survivable Remote Site Telephony (SRST) is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed Skinny Client Control Protocol (SCCP)…

  • CVE-2010-0585Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.1 through 12.4, when Cisco Unified Communications Manager Express (CME) or Cisco Unified Survivable Remote Site Telephony (SRST) is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed Skinny Client Control Protocol (SCCP)…

  • CVE-2010-0584Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco IOS 12.4, when NAT SCCP fragmentation support is enabled, allows remote attackers to cause a denial of service (device reload) via crafted Skinny Client Control Protocol (SCCP) packets, aka Bug ID CSCsy09250.

  • CVE-2010-0583Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Memory leak in the H.323 implementation in Cisco IOS 12.1 through 12.4, and 15.0M before 15.0(1)M1, allows remote attackers to cause a denial of service (memory consumption and device reload) via malformed H.323 packets, aka Bug ID CSCtb93855.

  • CVE-2010-0582Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Cisco IOS 12.1 through 12.4, and 15.0M before 15.0(1)M1, allows remote attackers to cause a denial of service (interface queue wedge) via malformed H.323 packets, aka Bug ID CSCta19962.

  • CVE-2010-0581Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the SIP implementation in Cisco IOS 12.3 and 12.4 allows remote attackers to execute arbitrary code via a malformed SIP message, aka Bug ID CSCsz89904, the "SIP Packet Parsing Arbitrary Code Execution Vulnerability."

  • CVE-2010-0580Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the SIP implementation in Cisco IOS 12.3 and 12.4 allows remote attackers to execute arbitrary code via a malformed SIP message, aka Bug ID CSCsz48680, the "SIP Message Processing Arbitrary Code Execution Vulnerability."

  • CVE-2010-0579Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    The SIP implementation in Cisco IOS 12.3 and 12.4 allows remote attackers to cause a denial of service (device reload) via a malformed SIP message, aka Bug ID CSCtb93416, the "SIP Message Handling Denial of Service Vulnerability."

  • CVE-2010-0578Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    The IKE implementation in Cisco IOS 12.2 through 12.4 on Cisco 7200 and 7301 routers with VAM2+ allows remote attackers to cause a denial of service (device reload) via a malformed IKE packet, aka Bug ID CSCtb13491.

  • CVE-2010-0577Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Cisco IOS 12.2 through 12.4, when certain PMTUD, SNAT, or window-size configurations are used, allows remote attackers to cause a denial of service (infinite loop, and device reload or hang) via a TCP segment with crafted options, aka Bug ID CSCsz75186.

  • CVE-2010-0576Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco IOS 12.0 through 12.4, IOS XE 2.1.x through 2.3.x before 2.3.2, and IOS XR 3.2.x through 3.4.3, when Multiprotocol Label Switching (MPLS) and Label Distribution Protocol (LDP) are enabled, allows remote attackers to cause a denial of service…

  • CVE-2010-0172Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    toolkit/components/passwordmgr/src/nsLoginManagerPrompter.js in the asynchronous Authorization Prompt implementation in Mozilla Firefox 3.6 before 3.6.2 does not properly handle concurrent authorization requests from multiple web sites, which might allow remote web servers to…

  • CVE-2010-0171Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting (XSS) attacks, by using the…

  • CVE-2010-0170Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.6 before 3.6.2 does not offer plugins the expected window.location protection mechanism, which might allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors that are specific to each affected plugin.

  • CVE-2010-0169Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The CSSLoaderImpl::DoSheetComplete function in layout/style/nsCSSLoader.cpp in Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 changes the case of certain strings in a stylesheet before adding…

  • CVE-2010-0168Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.04cvss —epss 0.12

    The nsDocument::MaybePreLoadImage function in content/base/src/nsDocument.cpp in the image-preloading implementation in Mozilla Firefox 3.6 before 3.6.2 does not apply scheme restrictions and policy restrictions to the image's URL, which might allow remote attackers to cause a…

  • CVE-2010-0167Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.04cvss —epss 0.11

    The browser engine in Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute…

  • CVE-2010-0166Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.04cvss —epss 0.07

    The gfxTextRun::SanitizeGlyphRuns function in gfx/thebes/src/gfxFont.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 on Mac OS X, when the Core Text API is used, does not properly perform certain deletions, which allows remote attackers to cause a denial of service…

  • CVE-2010-0165Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The TraceRecorder::traverseScopeChain function in js/src/jstracer.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via vectors…

  • CVE-2010-0164Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the imgContainer::InternalAddFrameHelper function in src/imgContainer.cpp in libpr0n in Mozilla Firefox 3.6 before 3.6.2 allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute…

  • CVE-2010-1116Mar 25, 2010
    LookMer
    Music Portal
    risk 0.00cvss —epss 0.01

    LookMer Music Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for dbmdb/LookMerSarkiMDB.mdb.

  • CVE-2010-1115Mar 25, 2010
    AnnonceV
    Web Server Creator Web Portal
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in news/include/customize.php in Web Server Creator - Web Portal 0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the l parameter.

  • CVE-2010-1114Mar 25, 2010
    Web Server Creator
    Web Portal (WSC-WebPortal)
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Web Server Creator - Web Portal 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pg parameter to index.php and the (2) path parameter to news/form.php.

  • CVE-2010-1113Mar 25, 2010
    Web Server Creator
    Web Portal (WSC-WebPortal)
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the forum page in Web Server Creator - Web Portal 0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to index.php.

  • CVE-2010-1112Mar 25, 2010
    Tristan Barczyk
    Klonews
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cat.php in KloNews 2.0 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.

  • CVE-2010-1111Mar 25, 2010
    Easysitenetwork
    Jokes Complete Website
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Jokes Complete Website allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to joke.php and the (2) searchingred parameter to results.php.

  • CVE-2010-1110Mar 25, 2010
    PhpMySport
    phpMySport
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in index.php in phpMySport 1.4 allows remote attackers to list arbitrary directories via a .. (dot dot) in the current_folder parameter.

  • CVE-2010-1109Mar 25, 2010
    Djayp
    Phpmysport
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) v2 parameter in a member view action, (2) v1 parameter in a news action, (3) v1 parameter in an…