VYPR

CVEs

345,868 total · page 6104 of 6,918

AllCriticalHighKEV
  • CVE-2010-1009Mar 19, 2010
    TYPO3
    Educator
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Educator extension 0.1.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1008Mar 19, 2010
    TYPO3
    chsellector
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Sellector.com Widget Integration (chsellector) extension before 0.1.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1007Mar 19, 2010
    TYPO3
    ch_lightem
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Power Extension Manager (ch_lightem) extension 1.0.34 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2010-1006Mar 19, 2010
    TYPO3
    Brainstorming extension
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Brainstorming extension 0.1.8 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1005Mar 19, 2010
    TYPO3
    YATSE
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Yet another TYPO3 search engine (YATSE) extension before 0.3.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1004Mar 19, 2010
    TYPO3
    Yet another TYPO3 search engine (YATSE)
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Yet another TYPO3 search engine (YATSE) extension before 0.3.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4735Mar 18, 2010
    Allomani
    Audio \& Video Library
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.php in Allomani Audio & Video Library (Songs & Clips version) 2.7.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action.

  • CVE-2009-4734Mar 18, 2010
    Allomani
    Movies Library
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.php in Allomani Movies Library (Movies & Clips) 2.7.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action.

  • CVE-2009-4733Mar 18, 2010
    SimpleLoginSys
    SimpleLoginSys
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in checkuser.php in SimpleLoginSys 0.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4732Mar 18, 2010
    Technotoad
    Tt Web Site Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in tt/index.php in TT Web Site Manager 0.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the tt_name parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4731Mar 18, 2010
    Boldfx
    Model Agency Manager Pro
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in photos.php in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allows remote attackers to execute arbitrary SQL commands via the album parameter.

  • CVE-2009-4730Mar 18, 2010
    x10 Media
    Adult Media Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in report.php in x10 Adult Media Script 1.7 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-4729Mar 18, 2010
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in x10 Adult Media Script 1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) pic_id parameter to includes/video_ad.php, (2) category parameter to linkvideos_listing.php, (3) id parameter to…

  • CVE-2009-4728Mar 18, 2010
    Questions Answered
    Questions Answered
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the administrative interface in Questions Answered 1.3 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4727Mar 18, 2010
    Junglescripts
    Ajax Short URL Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in x/login in JungleScripts Ajax Short Url Script allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2009-4726Mar 18, 2010
    Quickdev
    Quickdev
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in download.php in Quickdev 4 PHP allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

  • CVE-2009-4725Mar 18, 2010
    Arab Portal
    Arab Portal
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in modules/aljazeera/admin/setup.php in Arab Portal 2.2 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module…

  • CVE-2009-4724Mar 18, 2010
    Paymentprocessorscript
    Ppscript
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in shop.htm in PaymentProcessorScript.net PPScript allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2009-4723Mar 18, 2010
    Netpet
    Netpet CMS
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in confirm.php in Netpet CMS 1.9 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.

  • CVE-2009-4722Mar 18, 2010
    Limny
    Limny
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the CheckLogin function in includes/functions.php in Limny 1.01, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2009-4721Mar 18, 2010
    Andrews Web
    Aw Bannerad
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Admin/index.asp in Andrews-Web (A-W) BannerAd 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) User and (2) Password parameters. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4720Mar 18, 2010
    Gnudip
    Gnudip
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in cgi-bin/gnudip.cgi in GnuDIP 2.1.1 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4719Mar 18, 2010
    Discloser
    Discloser
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Discloser 0.0.4 rc2 allows remote attackers to execute arbitrary SQL commands via the more parameter.

  • CVE-2010-0421Mar 18, 2010
    GNOME Foundation
    Pango
    risk 0.00cvss —epss 0.02

    Array index error in the hb_ot_layout_build_glyph_classes function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted font file, related to building a synthetic Glyph…

  • CVE-2010-0104Mar 18, 2010
    Broadcom Corporation
    Broadcom
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in the Broadcom Integrated NIC Management Firmware 1.x before 1.40.0.0 and 8.x before 8.08 on the HP Small Form Factor and Microtower platforms allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2009-1299Mar 18, 2010
    Pulseaudio
    Pulseaudio
    risk 0.00cvss —epss 0.00

    The pa_make_secure_dir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows local users to change the ownership and permissions of arbitrary files via a symlink attack on a /tmp/.esd-##### temporary file.

  • CVE-2010-0985Mar 16, 2010
    Joomla
    Abbreviations Manager
    risk 0.04cvss —epss 0.13

    Directory traversal vulnerability in the Abbreviations Manager (com_abbrev) component 1.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from…

  • CVE-2010-0984Mar 16, 2010
    Acidcat
    Acidcat CMS
    risk 0.03cvss —epss 0.03

    Acidcat CMS 3.5.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for databases/acidcat_3.mdb.

  • CVE-2010-0983Mar 16, 2010
    Utilo
    Rezervi
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in include/mail.inc.php in Rezervi 3.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the root parameter, a different vector than CVE-2007-2156.

  • CVE-2010-0982Mar 16, 2010
    Joomlamo
    Com Cartweberp
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in the CARTwebERP (com_cartweberp) component 1.56.75 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-0981Mar 16, 2010
    Joomla
    TPJobs
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the TPJobs (com_tpjobs) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id_c[] parameter in a resadvsearch action to index.php.

  • CVE-2010-0980Mar 16, 2010
    Mitchell Sleeper
    L4d Stats
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in player.php in Left 4 Dead (L4D) Stats 1.1 allows remote attackers to execute arbitrary SQL commands via the steamid parameter.

  • CVE-2010-0979Mar 16, 2010
    Obsession Design
    Image Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in display.php in Obsession-Design Image-Gallery (ODIG) 1.1 allows remote attackers to inject arbitrary web script or HTML via the folder parameter.

  • CVE-2010-0978Mar 16, 2010
    Kmsoft
    Guestbook
    risk 0.03cvss —epss 0.03

    KMSoft Guestbook (aka GBook) 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/db.mdb.

  • CVE-2010-0977Mar 16, 2010
    Pordus
    Pd Portal
    risk 0.00cvss —epss 0.01

    PD PORTAL 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/db.mdb.

  • CVE-2010-0976Mar 16, 2010
    Acidcat
    Acidcat CMS
    risk 0.03cvss —epss 0.02

    Acidcat CMS 3.5.x does not prevent access to install.asp after installation finishes, which might allow remote attackers to restart the installation process and have unspecified other impact via requests to install.asp and other install_*.asp scripts. NOTE: the final…

  • CVE-2010-0793Mar 16, 2010
    Barnowl
    Barnowl
    risk 0.00cvss —epss 0.04

    Buffer overflow in BarnOwl before 1.5.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted CC: header.

  • CVE-2010-0729Mar 16, 2010
    Red Hat
    Linux kernel
    risk 0.00cvss —epss 0.00

    A certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 4 on the ia64 platform allows local users to use ptrace on an arbitrary process, and consequently gain privileges, via vectors related to a missing ptrace_check_attach call.

  • CVE-2010-0727Mar 16, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows…

  • CVE-2010-0397Mar 16, 2010
    PHP
    PHP
    risk 0.04cvss —epss 0.12

    The xmlrpc extension in PHP 5.3.1 does not properly handle a missing methodName element in the first argument to the xmlrpc_decode_request function, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) and…

  • CVE-2007-6733Mar 16, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The nfs_lock function in fs/nfs/file.c in the Linux kernel 2.6.9 does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on an NFS filesystem…

  • CVE-2010-0975Mar 16, 2010
    Phpcityportal
    Phpcityportal
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in external.php in PHPCityPortal allows remote attackers to execute arbitrary PHP code via a URL in the url parameter.

  • CVE-2010-0974Mar 16, 2010
    Phpcityportal
    Phpcityportal
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in PHPCityPortal allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) video_show.php, (2) spotlight_detail.php, (3) real_estate_details.php, and (4) auto_details.php.

  • CVE-2010-0973Mar 16, 2010
    Phppool Media
    Domain Verkaus and Auktions Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in phppool media Domain Verkaus and Auktions Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-0972Mar 16, 2010
    Joomla
    com_gcalendar
    risk 0.04cvss —epss 0.13

    Directory traversal vulnerability in the GCalendar (com_gcalendar) component 2.1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-0971Mar 16, 2010
    Atutor
    Atutor
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.6.4 allow remote authenticated users, with Instructor privileges, to inject arbitrary web script or HTML via the (1) Question and (2) Choice fields in tools/polls/add.php, the (3) Type and (4) Title fields in…

  • CVE-2010-0970Mar 16, 2010
    PhpMyLogon
    PhpMyLogon
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in phpmylogon.php in PhpMyLogon 2 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-0969Mar 16, 2010
    Unbound
    Unbound
    risk 0.00cvss —epss 0.03

    Unbound before 1.4.3 does not properly align structures on 64-bit platforms, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.

  • CVE-2010-0968Mar 16, 2010
    Geekhelps
    Admp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in bannershow.php in Geekhelps ADMP 1.01 allows remote attackers to execute arbitrary SQL commands via the click parameter.

  • CVE-2010-0967Mar 16, 2010
    Geekhelps
    Admp
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in Geekhelps ADMP 1.01, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the style parameter to (1) colorvoid/footer.php, (2)…