VYPR

CVEs

345,868 total · page 6103 of 6,918

AllCriticalHighKEV
  • CVE-2010-1058Mar 23, 2010
    Phpkobo
    Address Book Script
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in codelib/cfg/common.inc.php in Phpkobo Address Book Script 1.09, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the LANG_CODE parameter.

  • CVE-2010-1057Mar 23, 2010
    Phpkobo
    Adfreely
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in Phpkobo AdFreely (aka Ad Board Script) 1.01, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a ..// (dot dot slash slash) in the LANG_CODE parameter to common.inc.php in…

  • CVE-2010-1056Mar 23, 2010
    Rockettheme
    Com Rokdownloads
    risk 0.04cvss —epss 0.11

    Directory traversal vulnerability in the RokDownloads (com_rokdownloads) component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1055Mar 23, 2010
    Osdate
    Osdate
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in osDate 2.1.9 and 2.5.4, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the config[forum_installed] parameter to (1) forum/adminLogin.php…

  • CVE-2010-1054Mar 23, 2010
    Parscms
    Parscms
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ParsCMS allow remote attackers to execute arbitrary SQL commands via the RP parameter to (1) fa_default.asp and (2) en_default.asp.

  • CVE-2010-1053Mar 23, 2010
    Zentracking
    Zen Time Tracking
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Zen Time Tracking 2.2 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters to (a) userlogin.php and (b) managerlogin.php. NOTE: some of…

  • CVE-2010-1052Mar 23, 2010
    AudiStat
    AudiStat
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in AudiStat 1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) year and (2) mday parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2010-1051Mar 23, 2010
    AudiStat
    AudiStat
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in AudiStat 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) year and (2) month parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2010-1050Mar 23, 2010
    AudiStat
    AudiStat
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in AudiStat 1.3 allows remote attackers to execute arbitrary SQL commands via the mday parameter.

  • CVE-2010-1049Mar 23, 2010
    Uiga
    Business Portal
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Uiga Business Portal allow remote attackers to execute arbitrary SQL commands via the (1) noentryid parameter to blog/index.php and the (2) p parameter to index2.php.

  • CVE-2010-1048Mar 23, 2010
    Uiga
    Business Portal
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in blog/index.php in Uiga Business Portal allows remote attackers to inject arbitrary web script or HTML via the textcomment parameter (aka the Comment Box) in a noentryid action. NOTE: some of these details are obtained from third party…

  • CVE-2010-1047Mar 23, 2010
    Masa2el
    Music City
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in MASA2EL Music City 1.0 and 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter in a singer action.

  • CVE-2010-1046Mar 23, 2010
    Rostermain
    Rostermain
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Rostermain 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) userid (username) and (2) password parameters.

  • CVE-2010-1045Mar 23, 2010
    Joomla
    Productbook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Productbook (com_productbook) component 1.0.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php. NOTE: some of these details are obtained from third party information.

  • CVE-2010-1044Mar 23, 2010
    Manageengine
    Oputils
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Login.do in ManageEngine OpUtils 5.0 allows remote attackers to execute arbitrary SQL commands via the isHttpPort parameter.

  • CVE-2010-1043Mar 23, 2010
    Jaxcms
    Jaxcms
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in jaxCMS 1.0 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter.

  • CVE-2010-1042Mar 23, 2010
    Microsoft
    Windows Media Player
    risk 0.04cvss —epss 0.10

    Microsoft Windows Media Player 11 does not properly perform colorspace conversion, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted .AVI file. NOTE: the provenance of this information is unknown; the…

  • CVE-2010-1041Mar 23, 2010
    IBM
    Db2 Content Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the single sign-on functionality in the Web Services implementation in IBM DB2 Content Manager (CM) Toolkit 8.3 before FP13 on z/OS and DB2 Information Integrator for Content 8.3 before FP13 has unknown impact and remote attack vectors.

  • CVE-2010-0163Mar 23, 2010
    Mozilla Corporation
    Thunderbird
    risk 0.00cvss —epss 0.03

    Mozilla Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 process e-mail attachments with a parser that performs casts and line termination incorrectly, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a…

  • CVE-2010-0161Mar 23, 2010
    Mozilla Corporation
    Thunderbird
    risk 0.00cvss —epss 0.02

    The nsAuthSSPI::Unwrap function in extensions/auth/nsAuthSSPI.cpp in Mozilla Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 on Windows Vista, Windows Server 2008 R2, and Windows 7 allows remote SMTP, IMAP, and POP servers to cause a denial of service (heap memory…

  • CVE-2009-3385Mar 23, 2010
    Mozilla Corporation
    Seamonkey
    risk 0.00cvss —epss 0.03

    The mail component in Mozilla SeaMonkey before 1.1.19 does not properly restrict execution of scriptable plugin content, which allows user-assisted remote attackers to obtain sensitive information via crafted content in an IFRAME element in an HTML e-mail message, as…

  • CVE-2010-1029Mar 19, 2010
    Google
    Chrome
    risk 0.04cvss —epss 0.10

    Stack consumption vulnerability in the WebCore::CSSSelector function in WebKit, as used in Apple Safari 4.0.4, Apple Safari on iPhone OS and iPhone OS for iPod touch, and Google Chrome 4.0.249, allows remote attackers to cause a denial of service (application crash) or possibly…

  • CVE-2010-1028Mar 19, 2010
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.09

    Integer overflow in the decompression functionality in the Web Open Fonts Format (WOFF) decoder in Mozilla Firefox 3.6 before 3.6.2 and 3.7 before 3.7 alpha 3 allows remote attackers to execute arbitrary code via a crafted WOFF file that triggers a buffer overflow, as…

  • CVE-2010-1003Mar 19, 2010
    Epignosis
    Efront
    risk 0.03cvss —epss 0.05

    Directory traversal vulnerability in www/editor/tiny_mce/langs/language.php in eFront 3.5.x through 3.5.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the langname parameter.

  • CVE-2010-0688Mar 19, 2010
    Orbitals
    Orbital Viewer
    risk 0.06cvss —epss 0.38

    Stack-based buffer overflow in Orbital Viewer 1.04 allows user-assisted remote attackers to execute arbitrary code via a crafted (1) .orb or (2) .ov file.

  • CVE-2010-0736Mar 19, 2010
    Viewvc
    Viewvc
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the view_queryform function in lib/viewvc.py in ViewVC before 1.0.10, and 1.1.x before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via "user-provided input."

  • CVE-2010-0734Mar 19, 2010
    Curl
    Libcurl
    risk 0.00cvss —epss 0.04

    content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or…

  • CVE-2010-0733Mar 19, 2010
    PostgreSQL
    PostgreSQL
    risk 0.04cvss —epss 0.07

    Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier, and 8.5 through 8.5alpha2, allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with many LEFT JOIN clauses, related to certain hashtable size…

  • CVE-2010-0732Mar 19, 2010
    GNOME Foundation
    Gtk
    risk 0.00cvss —epss 0.00

    gdk/gdkwindow.c in GTK+ before 2.18.5, as used in gnome-screensaver before 2.28.1, performs implicit paints on windows of type GDK_WINDOW_FOREIGN, which triggers an X error in certain circumstances and consequently allows physically proximate attackers to bypass screen locking…

  • CVE-2010-0465Mar 19, 2010
    Sugarcrm
    Sugarcrm
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the online Documents functionality in SugarCRM 5.2.x before 5.2.0l and 5.5.x before 5.5.0a allows remote authenticated users to inject arbitrary web script or HTML via the Document Name field.

  • CVE-2010-0008Mar 19, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.05

    The sctp_rcv_ootb function in the SCTP implementation in the Linux kernel before 2.6.23 allows remote attackers to cause a denial of service (infinite loop) via (1) an Out Of The Blue (OOTB) chunk or (2) a chunk of zero length.

  • CVE-2009-4271Mar 19, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The Linux kernel 2.6.9 through 2.6.17 on the x86_64 and amd64 platforms allows local users to cause a denial of service (panic) via a 32-bit application that calls mprotect on its Virtual Dynamic Shared Object (VDSO) page and then triggers a segmentation fault.

  • CVE-2010-1027Mar 19, 2010
    TYPO3
    Meet Travelmates
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Meet Travelmates (travelmate) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1026Mar 19, 2010
    TYPO3
    CleanDB
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the CleanDB - DBAL (tmsw_cleandb) extension 2.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1025Mar 19, 2010
    TYPO3
    TGM-Newsletter
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the TGM-Newsletter (tgm_newsletter) extension 0.0.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1024Mar 19, 2010
    TYPO3
    TGM-Newsletter
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the TGM-Newsletter (tgm_newsletter) extension 0.0.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1023Mar 19, 2010
    TYPO3
    taskcenter_recent
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the UserTask Center, Recent (taskcenter_recent) extension 0.1.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1022Mar 19, 2010
    Marcus Krause
    T3sec Saltedpw
    risk 0.00cvss —epss 0.01

    The TYPO3 Security - Salted user password hashes (t3sec_saltedpw) extension before 0.2.13 for TYPO3 allows remote attackers to bypass authentication via unspecified vectors.

  • CVE-2010-1021Mar 19, 2010
    TYPO3
    t3quixplorer
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Typo3 Quixplorer (t3quixplorer) extension before 1.7.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1020Mar 19, 2010
    TYPO3
    Simple Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Simple Gallery (sk_simplegallery) extension 0.0.9 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1019Mar 19, 2010
    TYPO3
    Simple Gallery
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Simple Gallery (sk_simplegallery) extension 0.0.9 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1018Mar 19, 2010
    TYPO3
    Book Reviews
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Book Reviews (sk_bookreview) extension 0.0.12 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1017Mar 19, 2010
    TYPO3
    SAV Filter Months
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the SAV Filter Months (sav_filter_months) extension before 1.0.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1016Mar 19, 2010
    TYPO3
    SAV Filter Selectors
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the SAV Filter Selectors (sav_filter_selectors) extension before 1.0.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1015Mar 19, 2010
    TYPO3
    SAV Filter Alphabetic
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the SAV Filter Alphabetic (sav_filter_abc) extension before 1.0.9 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1014Mar 19, 2010
    TYPO3
    Reports Logfile View
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Reports Logfile View (reports_logview) extension 1.2.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1013Mar 19, 2010
    TYPO3
    Diocese of Portsmouth Database
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Diocese of Portsmouth Database (pd_diocesedatabase) extension before 0.7.13 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1012Mar 19, 2010
    TYPO3
    nf_cleandb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the CleanDB (nf_cleandb) extension 1.0.7 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1011Mar 19, 2010
    TYPO3
    myDashboard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the myDashboard (mydashboard) extension 0.1.13 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1010Mar 19, 2010
    TYPO3
    MK Wastebasket
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the MK Wastebasket (mk_wastebasket) extension 2.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.