VYPR

CVEs

345,859 total · page 6109 of 6,918

AllCriticalHighKEV
  • CVE-2010-0718Feb 26, 2010
    Microsoft
    Windows Media Player
    risk 0.04cvss —epss 0.09

    Buffer overflow in Microsoft Windows Media Player 9 and 11.0.5721.5145 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted .mpg file.

  • CVE-2010-0717Feb 26, 2010
    Moinmo
    Moinmoin
    risk 0.00cvss —epss 0.02

    The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.

  • CVE-2010-0716Feb 26, 2010
    Microsoft
    Sharepoint Server
    risk 0.01cvss —epss 0.09

    _layouts/Upload.aspx in the Documents module in Microsoft SharePoint before 2010 uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage…

  • CVE-2010-0715Feb 26, 2010
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus…

  • CVE-2010-0714Feb 26, 2010
    IBM
    Websphere Portal
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0;…

  • CVE-2010-0689Feb 26, 2010
    Datev
    Base System
    risk 0.00cvss —epss 0.06

    The ExecuteExe method in the DVBSExeCall Control ActiveX control 1.0.0.1 in DVBSExeCall.ocx in DATEV Base System (aka Grundpaket Basis) allows remote attackers to execute arbitrary commands via unspecified vectors.

  • CVE-2010-0669Feb 26, 2010
    Moinmo
    Moinmoin
    risk 0.00cvss —epss 0.02

    MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.

  • CVE-2010-0668Feb 26, 2010
    Moinmo
    Moinmoin
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in MoinMoin 1.5.x through 1.7.x, 1.8.x before 1.8.7, and 1.9.x before 1.9.2 has unknown impact and attack vectors, related to configurations that have a non-empty superuser list, the xmlrpc action enabled, the SyncPages action enabled, or OpenID…

  • CVE-2010-0667Feb 26, 2010
    Moinmo
    Moinmoin
    risk 0.00cvss —epss 0.02

    MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain sensitive information via unspecified vectors.

  • CVE-2005-4886Feb 26, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    The selinux_parse_skb_ipv6 function in security/selinux/hooks.c in the Linux kernel before 2.6.12-rc4 allows remote attackers to cause a denial of service (OOPS) via vectors associated with an incorrect call to the ipv6_skip_exthdr function.

  • CVE-2009-4655Feb 26, 2010
    Novell
    Edirectory
    risk 0.07cvss —epss 0.50

    The dhost web service in Novell eDirectory 8.8.5 uses a predictable session cookie, which makes it easier for remote attackers to hijack sessions via a modified cookie.

  • CVE-2009-4654Feb 26, 2010
    Novell
    Edirectory
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in the dhost module in Novell eDirectory 8.8 SP5 for Windows allows remote authenticated users to execute arbitrary code via long sadminpwd and verifypwd parameters in a submit action to /dhost/httpstk.

  • CVE-2009-4653Feb 26, 2010
    Novell
    Edirectory
    risk 0.04cvss —epss 0.13

    Stack-based buffer overflow in the dhost module in Novell eDirectory 8.8 SP5 for Windows allows remote authenticated users to cause a denial of service (dhost.exe crash) and possibly execute arbitrary code via a long string to /dhost/modules?I:.

  • CVE-2009-4652Feb 26, 2010
    Ngircd
    Ngircd
    risk 0.00cvss —epss 0.02

    The (1) Conn_GetCipherInfo and (2) Conn_UsesSSL functions in src/ngircd/conn.c in ngIRCd 13 and 14, when SSL/TLS support is present and standalone mode is disabled, allow remote attackers to cause a denial of service (application crash) by sending the MOTD command from another…

  • CVE-2010-0713Feb 26, 2010
    Zenoss
    Core
    risk 0.03cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in Zenoss 2.3.3, and other versions before 2.5, allow remote attackers to hijack the authentication of an administrator for (1) requests that reset user passwords via zport/dmd/ZenUsers/admin, and (2) requests that…

  • CVE-2010-0712Feb 26, 2010
    Zenoss
    Core
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in zport/dmd/Events/getJSONEventsInfo in Zenoss 2.3.3, and other versions before 2.5, allow remote authenticated users to execute arbitrary SQL commands via the (1) severity, (2) state, (3) filter, (4) offset, and (5) count parameters.

  • CVE-2010-0711Feb 25, 2010
    ASPCode
    CMS
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in default.asp in ASPCode CMS 1.5.8, 2.0.0 Build 103, and possibly other versions, allows remote attackers to hijack the authentication of an administrator for requests that (1) delete users via the delete action in the ma2…

  • CVE-2010-0710Feb 25, 2010
    ASPCode
    CMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in default.asp in ASPCode CMS 1.5.8, 2.0.0 Build 103, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the newsid parameter when the sec parameter is 26. NOTE: the provenance of this information is unknown;…

  • CVE-2010-0709Feb 25, 2010
    Limny
    Limny
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Limny 2.0 allow remote attackers to (1) hijack the authentication of users or administrators for requests that change the email address or password via the user action to index.php, and (2) hijack the authentication…

  • CVE-2010-0708Feb 25, 2010
    Sun Corporation
    Java System Directory Server
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in (1) ns-slapd and (2) slapd.exe in Sun Directory Server Enterprise Edition 7.0, Sun Java System Directory Server 5.2, and Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 allow remote attackers to cause a denial of…

  • CVE-2010-0683Feb 25, 2010
    TIBCO Software
    Administrator
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in TIBRepoServer5.jar in TIBCO Administrator 5.4.0 through 5.6.0, when JMS transport is used, allows remote authenticated users to execute arbitrary code on all domain nodes via vectors related to leveraging administrative credentials.

  • CVE-2010-0427Feb 25, 2010
    Todd Miller
    Sudo
    risk 0.00cvss —epss 0.00

    sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command.

  • CVE-2010-0424Feb 25, 2010
    Cronie
    cronie
    risk 0.00cvss —epss 0.00

    The edit_cmd function in crontab.c in (1) cronie before 1.4.4 and (2) Vixie cron (vixie-cron) allows local users to change the modification times of arbitrary files, and consequently cause a denial of service, via a symlink attack on a temporary file in the /tmp directory.

  • CVE-2010-0011Feb 25, 2010
    Uzbl
    Uzbl
    risk 0.00cvss —epss 0.02

    The eval_js function in uzbl-core.c in Uzbl before 2010.01.05 exposes the run method of the Uzbl object, which allows remote attackers to execute arbitrary commands via JavaScript code.

  • CVE-2003-1590Feb 25, 2010
    Sun ONE
    Web Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Sun ONE (aka iPlanet) Web Server 6.0 SP3 through SP5 on Windows allows remote attackers to cause a denial of service (daemon crash) via unknown vectors.

  • CVE-2003-1589Feb 25, 2010
    Sun Corporation
    One Web Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Sun ONE (aka iPlanet) Web Server 4.1 before SP13 and 6.0 before SP6 on Windows allows attackers to cause a denial of service (daemon crash) via unknown vectors.

  • CVE-2010-0707Feb 25, 2010
    Timeclock Software
    Employee Timeclock Software
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in add_user.php in Employee Timeclock Software 0.99 allows remote attackers to hijack the authentication of an administrator for requests that create new administrative users. NOTE: some of these details are obtained from third…

  • CVE-2010-0706Feb 25, 2010
    Subex
    Nikira Fraud Management System
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the login/prompt component in Subex Nikira Fraud Management System allows remote attackers to inject arbitrary web script or HTML via the message parameter.

  • CVE-2010-0705Feb 25, 2010
    Avast\!
    Avast
    risk 0.03cvss —epss 0.01

    Aavmker4.sys in avast! 4.8 through 4.8.1368.0 and 5.0 before 5.0.418.0 running on Windows 2000 and XP does not properly validate input to IOCTL 0xb2d60030, which allows local users to cause a denial of service (system crash) or execute arbitrary code to gain privileges via IOCTL…

  • CVE-2010-0704Feb 25, 2010
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Portlet Palette in IBM WebSphere Portal 6.0.1.5 wp6015_008_01 allows remote attackers to inject arbitrary web script or HTML via the search field.

  • CVE-2010-0620Feb 25, 2010
    EMC Corporation
    Homebase Server
    risk 0.05cvss —epss 0.19

    Directory traversal vulnerability in the SSL Service in EMC HomeBase Server 6.2.x before 6.2.3 and 6.3.x before 6.3.2 allows remote attackers to overwrite arbitrary files with any content, and consequently execute arbitrary code, via a .. (dot dot) in an unspecified parameter.

  • CVE-2010-0412Feb 25, 2010
    Systemtap
    Systemtap
    risk 0.00cvss —epss 0.02

    stap-server in SystemTap 1.1 does not properly restrict the value of the -B (aka BUILD) option, which allows attackers to have an unspecified impact via vectors associated with executing the make program, a different vulnerability than CVE-2009-4273.

  • CVE-2010-0119Feb 25, 2010
    Bournal
    bournal
    risk 0.00cvss —epss 0.00

    Bournal before 1.4.1 on FreeBSD 8.0, when the -K option is used, places a ccrypt key on the command line, which allows local users to obtain sensitive information by listing the process and its arguments, related to "echoing."

  • CVE-2010-0118Feb 25, 2010
    Bournal
    bournal
    risk 0.00cvss —epss 0.00

    Bournal before 1.4.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified temporary files associated with a --hack_the_gibson update check.

  • CVE-2010-0640Feb 24, 2010
    Ca
    Ehealth Performance Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in CA eHealth Performance Manager 6.0.x through 6.2.x, when malicious HTML detection is disabled, allows remote attackers to inject arbitrary web script or HTML via a crafted request.

  • CVE-2010-0426Feb 24, 2010
    Todd Miller
    Sudo
    risk 0.00cvss —epss 0.01

    sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file,…

  • CVE-2010-0423Feb 24, 2010
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.02

    gtkimhtml.c in Pidgin before 2.6.6 allows remote attackers to cause a denial of service (CPU consumption and application hang) by sending many smileys in a (1) IM or (2) chat.

  • CVE-2010-0422Feb 24, 2010
    GNOME Foundation
    Screensaver
    risk 0.00cvss —epss 0.00

    gnome-screensaver 2.28.x before 2.28.3 does not properly synchronize the state of screen locking and the unlock dialog in situations involving a change to the number of monitors, which allows physically proximate attackers to bypass screen locking and access an unattended…

  • CVE-2010-0420Feb 24, 2010
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.03

    libpurple in Finch in Pidgin before 2.6.6, when an XMPP multi-user chat (MUC) room is used, does not properly parse nicknames containing sequences, which allows remote attackers to cause a denial of service (application crash) via a crafted nickname.

  • CVE-2010-0285Feb 24, 2010
    GNOME Foundation
    Screensaver
    risk 0.00cvss —epss 0.00

    gnome-screensaver 2.14.3, 2.22.2, 2.27.x, 2.28.0, and 2.28.3, when the X configuration enables the extend screen option, allows physically proximate attackers to bypass screen locking, access an unattended workstation, and view half of the GNOME desktop by attaching an external…

  • CVE-2010-0703Feb 23, 2010
    Portwise
    SSL VPN
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in wa/auth in PortWise SSL VPN 4.6 allows remote attackers to inject arbitrary web script or HTML via the reloadFrame parameter.

  • CVE-2010-0702Feb 23, 2010
    Fonality
    trixbox
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in cisco/services/PhonecDirectory.php in Fonality Trixbox 2.2.4 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2010-0701Feb 23, 2010
    Newgen Software
    OmniDocs
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ForceChangePassword.jsp in Newgen Software OmniDocs allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0700Feb 23, 2010
    Wampserver
    Wampserver
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in WampServer 2.0i allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

  • CVE-2010-0699Feb 23, 2010
    Videosearchscript
    Videosearchscript Pro
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in VideoSearchScript Pro 3.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter.

  • CVE-2010-0698Feb 23, 2010
    Dynamicsoft
    Wsc CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in backoffice/login.asp in Dynamicsoft WSC CMS 2.2 allows remote attackers to execute arbitrary SQL commands via the Password parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-0697Feb 23, 2010
    Drupal
    iTweak Upload
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the iTweak Upload module 6.x-1.x before 6.x-1.2 and 6.x-2.x before 6.x-2.3 for Drupal allows remote authenticated users, with create content and upload file permissions, to inject arbitrary web script or HTML via the file name of an…

  • CVE-2010-0685Feb 23, 2010
    Digium
    Asterisk
    risk 0.00cvss —epss 0.01

    The design of the dialplan functionality in Asterisk Open Source 1.2.x, 1.4.x, and 1.6.x; and Asterisk Business Edition B.x.x and C.x.x, when using the ${EXTEN} channel variable and wildcard pattern matches, allows context-dependent attackers to inject strings into the dialplan…

  • CVE-2010-0682Feb 23, 2010
    WordPress
    WordPress
    risk 0.00cvss —epss 0.10

    WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter.

  • CVE-2010-0189Feb 23, 2010
    NOS Microsystems
    getPlus Download Manager
    risk 0.00cvss —epss 0.05

    A certain ActiveX control in NOS Microsystems getPlus Download Manager (aka DLM or Downloader) 1.5.2.35, as used in Adobe Download Manager, improperly validates requests involving web sites that are not in subdomains, which allows remote attackers to force the download and…