VYPR

CVEs

345,859 total · page 6108 of 6,918

AllCriticalHighKEV
  • CVE-2009-4657Mar 3, 2010
    Xerver
    Xerver
    risk 0.03cvss —epss 0.02

    The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter application settings by connecting to the application on port 32123, as demonstrated by setting the action option to wizardStep1.

  • CVE-2009-4656Mar 3, 2010
    E Soft.co
    Dj Studio Pro
    risk 0.06cvss —epss 0.32

    Stack-based buffer overflow in E-Soft DJ Studio Pro 4.2 including 4.2.2.7.5, and 5.x including 5.1.4.3.1, allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a playlist file (.pls) containing a long…

  • CVE-2010-0925Mar 3, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    cfnetwork.dll 1.450.5.0 in CFNetwork, as used by safari.exe 531.21.10 in Apple Safari 4.0.4 on Windows, allows remote attackers to cause a denial of service (application crash) via a long string in the SRC attribute of a (1) IMG or (2) IFRAME element.

  • CVE-2010-0924Mar 3, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    cfnetwork.dll 1.450.5.0 in CFNetwork, as used by safari.exe 531.21.10 in Apple Safari 4.0.3 and 4.0.4 on Windows, allows remote attackers to cause a denial of service (application crash) via a long string in the BACKGROUND attribute of a BODY element.

  • CVE-2010-0923Mar 3, 2010
    KDE
    Kde
    risk 0.00cvss —epss 0.00

    Race condition in workspace/krunner/lock/lockdlg.cc in the KRunner lock module in kdebase in KDE SC 4.4.0 allows physically proximate attackers to bypass KScreenSaver screen locking and access an unattended workstation by pressing the Enter key at a certain time, related to…

  • CVE-2010-0922Mar 3, 2010
    IBM
    Aix
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in secldapclntd in IBM AIX 5.3 with SP 5300-11-02 allows attackers to cause a denial of service (LDAP login failure) via unknown vectors. NOTE: some of these details are obtained from third party information. NOTE: there may be no attacker role, and…

  • CVE-2010-0921Mar 3, 2010
    IBM
    Lotus Inotes
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 allows remote attackers to hijack the authentication of unspecified victims via vectors related to lack of "XSS/CSRF Get Filter and Referer…

  • CVE-2010-0920Mar 3, 2010
    IBM
    Lotus Inotes
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 allows remote attackers to inject arbitrary web script or HTML via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."

  • CVE-2010-0919Mar 3, 2010
    IBM
    Domino Web Access
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in the Lotus Domino Web Access ActiveX control in IBM Lotus iNotes (aka Domino Web Access or DWA) 6.5, 7.0 before 7.0.4, 8.0, 8.0.2, and before 229.281 for Domino 8.0.2 FP4 allows remote attackers to execute arbitrary code via a long URL argument to…

  • CVE-2010-0918Mar 3, 2010
    IBM
    Lotus Inotes
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in the UltraLite functionality in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 have unknown impact and attack vectors.

  • CVE-2010-0917Mar 3, 2010
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.24

    Stack-based buffer overflow in VBScript in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, might allow user-assisted remote attackers to execute arbitrary code via a long string in the fourth argument (aka helpfile argument) to…

  • CVE-2010-0766Mar 3, 2010
    Luxology
    Modo
    risk 0.00cvss —epss 0.05

    Integer overflow in the Swap4 function in valet4.dll in Luxology Modo 401 allows user-assisted remote attackers to execute arbitrary code via a .LXO file containing a CHNL subchunk associated with an invalid length.

  • CVE-2010-0483Mar 3, 2010
    Microsoft
    Windows 2000
    risk 0.10cvss —epss 0.86

    vbscript.dll in VBScript 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, allows user-assisted remote attackers to execute arbitrary code by referencing a (1) local pathname, (2) UNC share pathname, or (3)…

  • CVE-2010-0205Mar 3, 2010
    Libpng
    Libpng
    risk 0.00cvss —epss 0.04

    The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to…

  • CVE-2010-0156Mar 3, 2010
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.00

    Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex, or (4) /tmp/puppetdoc.aux temporary file.

  • CVE-2010-0804Mar 2, 2010
    Netartmedia
    Iboutique
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in iBoutique 4.0 allows remote attackers to inject arbitrary web script or HTML via the key parameter in a products action.

  • CVE-2010-0803Mar 2, 2010
    Joomla
    jVideoDirect
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the jVideoDirect (com_jvideodirect) component 1.1 RC3b for Joomla! allows remote attackers to execute arbitrary SQL commands via the v parameter to index.php.

  • CVE-2010-0802Mar 2, 2010
    Aleinbeen
    \(nv2\) Awards
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in (nv2) Awards 1.1.0, a modification for Invision Power Board, allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action.

  • CVE-2010-0801Mar 2, 2010
    Joomla
    AutartiTarot
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in the AutartiTarot (com_autartitarot) component 1.0.3 for Joomla! allows remote authenticated users, with "Public Back-end" group permissions, to read arbitrary files via directory traversal sequences in the controller parameter in an edit task…

  • CVE-2010-0800Mar 2, 2010
    Joomla
    com_dms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Ossolution Team Documents Seller (aka DMS) (com_dms) component 2.5.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a view_category action to index.php.

  • CVE-2010-0799Mar 2, 2010
    Phpunity
    newsmanager
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in misc/tell_a_friend/tell.php in phpunity.newsmanager allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.

  • CVE-2010-0798Mar 2, 2010
    TYPO3
    T3BLOG
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the T3BLOG extension 0.6.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0797Mar 2, 2010
    TYPO3
    T3BLOG
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the T3BLOG extension 0.6.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0796Mar 2, 2010
    Joomla
    JE Quiz
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JE Quiz (com_jequizmanagement) component 1.b01 for Joomla! allows remote attackers to execute arbitrary SQL commands via the eid parameter in a question action to index.php.

  • CVE-2010-0795Mar 2, 2010
    Joomla
    JE Event Calendars
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JE Event Calendars (com_jeeventcalendar) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the event_id parameter in an event action to index.php.

  • CVE-2010-0726Mar 2, 2010
    Tdiary
    Tdiary
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the tb-send.rb (TrackBack transmission) plugin in tDiary 2.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly related to the (1) plugin_tb_url and (2) plugin_tb_excerpt…

  • CVE-2010-0789Mar 2, 2010
    Fuse
    Fuse
    risk 0.00cvss —epss 0.00

    fusermount in FUSE before 2.7.5, and 2.8.x before 2.8.2, allows local users to unmount an arbitrary FUSE filesystem share via a symlink attack on a mountpoint.

  • CVE-2010-0788Mar 2, 2010
    Ncpfs
    Ncpfs
    risk 0.03cvss —epss 0.01

    ncpfs 2.2.6 allows local users to cause a denial of service, obtain sensitive information, or possibly gain privileges via symlink attacks involving the (1) ncpmount and (2) ncpumount programs.

  • CVE-2010-0787Mar 2, 2010
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.01

    client/mount.cifs.c in mount.cifs in smbfs in Samba 3.0.22, 3.0.28a, 3.2.3, 3.3.2, 3.4.0, and 3.4.5 allows local users to mount a CIFS share on an arbitrary mountpoint, and gain privileges, via a symlink attack on the mountpoint directory file.

  • CVE-2010-0765Mar 2, 2010
    FipsForum
    fipsForum
    risk 0.03cvss —epss 0.02

    fipsForum 2.6 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for _database/forumFips.mdb.

  • CVE-2010-0764Mar 2, 2010
    Kuwaitphp
    Esmile
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in KuwaitPHP eSmile allows remote attackers to execute arbitrary SQL commands via the cid parameter in a show action.

  • CVE-2010-0763Mar 2, 2010
    Commodityrentals
    Vacation Rental Software
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in CommodityRentals Vacation Rental Software allows remote attackers to execute arbitrary SQL commands via the rental_id parameter in a CalendarView action.

  • CVE-2010-0762Mar 2, 2010
    Commodityrentals
    Cd Rental Software
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in CommodityRentals CD Rental Software allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a catalog action.

  • CVE-2010-0761Mar 2, 2010
    Commodityrentals
    Books\/ebooks Rentals Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in CommodityRentals Books/eBooks Rentals Script allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a gamecatalog action.

  • CVE-2010-0760Feb 27, 2010
    Joomla
    Core Design Scriptegrator plugin
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in the Core Design Scriptegrator plugin 1.4.1 for Joomla! allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) file parameter to libraries/jquery/js/ui/jsloader.php and the…

  • CVE-2010-0759Feb 27, 2010
    Core Design
    Scriptegrator
    risk 0.04cvss —epss 0.15

    Directory traversal vulnerability in plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php in the Core Design Scriptegrator plugin 1.4.1 for Joomla! allows remote attackers to read, and possibly include and execute, arbitrary files via directory traversal sequences…

  • CVE-2010-0758Feb 27, 2010
    Softbizscripts
    Jobs
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news_desc.php in Softbiz Jobs allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-0757Feb 27, 2010
    Wikyblog
    Wikyblog
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in index.php/Attach in WikyBlog 1.7.3rc2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension using the uploadform action, then accessing it via a direct request to the file in…

  • CVE-2010-0756Feb 27, 2010
    Wikyblog
    Wikyblog
    risk 0.03cvss —epss 0.02

    Session fixation vulnerability in WikyBlog 1.7.3 rc2 allows remote attackers to hijack web sessions by setting the jsessionid parameter to (1) index.php/Comment/Main, (2) index.php/Comment/Main/Home_Wiky, or (3) index.php/Edit/Main.

  • CVE-2010-0755Feb 27, 2010
    Wikyblog
    Wikyblog
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in include/WBmap.php in WikyBlog 1.7.3 rc2 allows remote attackers to execute arbitrary PHP code via a URL in the langFile parameter.

  • CVE-2010-0754Feb 27, 2010
    Wikyblog
    Wikyblog
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php/Special/Main/Templates in WikyBlog 1.7.2 and 1.7.3 rc2 allows remote attackers to inject arbitrary web script or HTML via the which parameter in a copy action.

  • CVE-2010-0753Feb 27, 2010
    Joomla
    SQL Reports
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the SQL Reports (com_sqlreport) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter to ajax/print.php. NOTE: some of these details are obtained from third party information.

  • CVE-2010-0752Feb 27, 2010
    Drupal
    Weekly Archive by Node Type
    risk 0.00cvss —epss 0.01

    The week_post_page function in the Weekly Archive by Node Type module 6.x before 6.x-2.7 for Drupal does not properly implement node access restrictions when constructing SQL queries, which allows remote attackers to read restricted node listings via unspecified vectors.

  • CVE-2010-0725Feb 26, 2010
    Arab Cart
    Arab Cart
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2010-0724Feb 26, 2010
    Arab Cart
    Arab Cart
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-0723Feb 26, 2010
    Mhproducts
    Ero Auktion
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in news.php in Ero Auktion 2.0 and 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-0722Feb 26, 2010
    PHP Auktion Pro
    Php Auktion Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.php in Php Auktion Pro allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-0721Feb 26, 2010
    Auktionshaus Gelb
    Auktionshaus Gelb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.php in Auktionshaus Gelb 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-0720Feb 26, 2010
    Systemsoftware
    Erotik Auktionshaus
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.php in Erotik Auktionshaus allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-0719Feb 26, 2010
    Microsoft
    Windows 2000
    risk 0.00cvss —epss 0.02

    An unspecified API in Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, and Windows 7 does not validate arguments, which allows local users to cause a denial of service (system crash) via a crafted application.