VYPR

CVEs

345,859 total · page 6112 of 6,918

AllCriticalHighKEV
  • CVE-2010-0637Feb 12, 2010
    Webcalendar
    Webcalendar
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to hijack the authentication of administrators for requests that (1) delete an event or (2) ban an IP address from posting via unknown…

  • CVE-2010-0636Feb 12, 2010
    Webcalendar
    Webcalendar
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to inject arbitrary web script or HTML via the (1) tab parameter to users.php and the PATH_INFO to (2) day.php, (3) month.php, and (4) week.php. …

  • CVE-2010-0635Feb 12, 2010
    Jevents
    Jevents Search Plugin
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the plgSearchEventsearch::onSearch method in eventsearch.php in the JEvents Search plugin 1.5 through 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained…

  • CVE-2010-0634Feb 12, 2010
    Will Estes And John Millaway
    flex
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Fast Lexical Analyzer Generator (flex) before 2.5.35 has unknown impact and attack vectors.

  • CVE-2010-0633Feb 12, 2010
    Citrix Systems
    Xenserver
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Citrix XenServer 5.0 Update 3 and earlier, and 5.5, allows local users to bypass authentication and execute unspecified Xen API (XAPI) calls via unknown vectors.

  • CVE-2010-0632Feb 12, 2010
    Parkviewconsultants
    Com Simplefaq
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Parkview Consultants SimpleFAQ (com_simplefaq) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a display action to index.php.

  • CVE-2010-0631Feb 12, 2010
    Eicrasoft
    Eicra Car Rental Script
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Eicra Car Rental-Script, when the plugin_id parameter is 4, allow remote attackers to execute arbitrary SQL commands via the (1) users (username) and (2) passwords parameters.

  • CVE-2010-0630Feb 12, 2010
    Evernew
    Free Joke Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in viewjokes.php in Evernew Free Joke Script 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-4274Feb 12, 2010
    Netpbm
    Netpbm
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in converter/ppm/xpmtoppm.c in netpbm before 10.47.07 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an XPM image file that contains a crafted header field associated with a…

  • CVE-2001-1586Feb 12, 2010
    SimpleServer
    SimpleServer:WWW
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in SimpleServer:WWW 1.13 and earlier allows remote attackers to execute arbitrary programs via encoded ../ ("%2E%2E%2F%") sequences in a request to the cgi-bin/ directory, a different vulnerability than CVE-2000-0664.

  • CVE-2010-0446Feb 12, 2010
    Microfocus
    Dreamscreen
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability on the HP DreamScreen 100 and 130 with firmware before 1.6.0.0, when using a web-connected configuration, allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2010-0309Feb 12, 2010
    KVM
    KVM
    risk 0.00cvss —epss 0.03

    The pit_ioport_read function in the Programmable Interval Timer (PIT) emulation in i8254.c in KVM 83 does not properly use the pit_state data structure, which allows guest OS users to cause a denial of service (host OS crash or hang) by attempting to read the /dev/port file.

  • CVE-2010-0306Feb 12, 2010
    KVM
    KVM
    risk 0.00cvss —epss 0.00

    The x86 emulator in KVM 83, when a guest is configured for Symmetric Multiprocessing (SMP), does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) to restrict instruction execution, which allows guest OS users to cause a denial of service (guest OS crash)…

  • CVE-2010-0298Feb 12, 2010
    KVM
    KVM
    risk 0.00cvss —epss 0.02

    The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to CPL3 code, which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by…

  • CVE-2010-0297Feb 12, 2010
    QEMU
    Qemu
    risk 0.00cvss —epss 0.01

    Buffer overflow in the usb_host_handle_control function in the USB passthrough handling implementation in usb-linux.c in QEMU before 0.11.1 allows guest OS users to cause a denial of service (guest OS crash or hang) or possibly execute arbitrary code on the host OS via a crafted…

  • CVE-2009-4642Feb 11, 2010
    GNOME Foundation
    Screensaver
    risk 0.00cvss —epss 0.00

    gnome-screensaver 2.26.1 relies on the gnome-session D-Bus interface to determine session idle time, even when an Xfce desktop such as Xubuntu or Mythbuntu is used, which allows physically proximate attackers to access an unattended workstation on which screen locking had been…

  • CVE-2009-4641Feb 11, 2010
    GNOME Foundation
    Screensaver
    risk 0.00cvss —epss 0.00

    gnome-screensaver 2.28.0 does not resume adherence to its activation settings after an inhibiting application becomes unavailable on the session bus, which allows physically proximate attackers to access an unattended workstation on which screen locking had been intended.

  • CVE-2010-0414Feb 11, 2010
    GNOME Foundation
    Screensaver
    risk 0.00cvss —epss 0.00

    gnome-screensaver before 2.28.2 allows physically proximate attackers to bypass screen locking and access an unattended workstation by moving the mouse position to an external monitor and then disconnecting that monitor.

  • CVE-2010-0617Feb 11, 2010
    evalSMSI
    evalSMSI
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to inject arbitrary web script or HTML via the return parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2010-0616Feb 11, 2010
    evalSMSI
    evalSMSI
    risk 0.00cvss —epss 0.01

    evalSMSI 2.1.03 stores passwords in cleartext in the database, which allows attackers with database access to gain privileges. NOTE: remote attack vectors are possible by leveraging a separate SQL injection vulnerability.

  • CVE-2010-0615Feb 11, 2010
    evalSMSI
    evalSMSI
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in assess.php in evalSMSI 2.1.03 allows remote attackers to inject arbitrary web script or HTML via the reports comment box in a continue_assess action. NOTE: some of these details are obtained from third party information.

  • CVE-2010-0614Feb 11, 2010
    evalSMSI
    evalSMSI
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to execute arbitrary SQL commands via the query parameter in the (1) question action, and possibly the (2) sub_par or (3) num_quest actions.

  • CVE-2010-0613Feb 11, 2010
    Arwscripts
    Fonts Script
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in viewfile.php in ARWScripts Fonts Script allows remote attackers to read arbitrary local files via directory traversal sequences in a base64-encoded f parameter. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2010-0612Feb 11, 2010
    Dmanager
    Documentmanager
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in DocumentManager before 4.0 has unknown impact and attack vectors, related to file rights.

  • CVE-2010-0611Feb 11, 2010
    Baalsystems
    Baal Systems
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in adminlogin.php in Baal Systems 3.8 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

  • CVE-2010-0610Feb 11, 2010
    Pixelpost
    Photoblog
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Photoblog (com_photoblog) component for Joomla! allow remote attackers to execute arbitrary SQL commands via the blog parameter in an images action to index.php. NOTE: a separate vector for the id parameter to detail.php may also…

  • CVE-2010-0609Feb 11, 2010
    Novaboard
    Novaboard
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in header.php in NovaBoard 1.1.2 allows remote attackers to execute arbitrary SQL commands via the nova_name cookie parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2010-0608Feb 11, 2010
    Novaboard
    Novaboard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in NovaBoard 1.1.2 allows remote attackers to execute arbitrary SQL commands via the forums[] parameter in a search action.

  • CVE-2010-0607Feb 11, 2010
    Sterlitetechnologies
    Sam300 Ax Router
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Forms/status_statistics_1 in the Sterlite SAM300 AX Router allows remote attackers to inject arbitrary web script or HTML via the Stat_Radio parameter.

  • CVE-2010-0606Feb 11, 2010
    Osticket
    Osticket
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php.

  • CVE-2010-0605Feb 11, 2010
    Osticket
    Osticket
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Staff" permissions, to execute arbitrary SQL commands via the input parameter.

  • CVE-2010-0445Feb 11, 2010
    Microfocus
    OpenView Network Node Manager
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in HP Network Node Manager (NNM) 8.10, 8.11, 8.12, and 8.13 allows remote attackers to execute arbitrary commands via unknown vectors.

  • CVE-2010-0145Feb 11, 2010
    Cisco Systems, Inc.
    Ironport Encryption Appliance
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the embedded HTTPS server on the Cisco IronPort Encryption Appliance 6.2.x before 6.2.9.1 and 6.5.x before 6.5.2, and the IronPort PostX MAP before 6.2.9.1, allows remote attackers to execute arbitrary code via unknown vectors, aka IronPort Bug 65923.

  • CVE-2010-0144Feb 11, 2010
    Cisco Systems, Inc.
    Ironport Encryption Appliance
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the WebSafe DistributorServlet in the embedded HTTPS server on the Cisco IronPort Encryption Appliance 6.2.x before 6.2.9.1 and 6.5.x before 6.5.2, and the IronPort PostX MAP before 6.2.9.1, allows remote attackers to read arbitrary files via unknown…

  • CVE-2010-0143Feb 11, 2010
    Cisco Systems, Inc.
    Ironport Encryption Appliance
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the administrative interface in the embedded HTTPS server on the Cisco IronPort Encryption Appliance 6.2.x before 6.2.9.1 and 6.5.x before 6.5.2, and the IronPort PostX MAP before 6.2.9.1, allows remote attackers to read arbitrary files via unknown…

  • CVE-2009-3735Feb 11, 2010
    Panda Project
    Activescan
    risk 0.00cvss —epss 0.06

    The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located at an arbitrary URL, and does not verify the archive's digital signature before installation, which…

  • CVE-2010-0252Feb 10, 2010
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.29

    The Microsoft Data Analyzer ActiveX control (aka the Office Excel ActiveX control for Data Analysis) in max3activex.dll in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and…

  • CVE-2010-0250Feb 10, 2010
    Microsoft
    Windows
    risk 0.03cvss —epss 0.32

    Heap-based buffer overflow in DirectShow in Microsoft DirectX, as used in the AVI Filter on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2, and in Quartz on Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and…

  • CVE-2010-0243Feb 10, 2010
    Microsoft
    Office
    risk 0.02cvss —epss 0.24

    Buffer overflow in MSO.DLL in Microsoft Office XP SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted Office document, aka "MSO.DLL Buffer Overflow."

  • CVE-2010-0242Feb 10, 2010
    Microsoft
    Windows
    risk 0.05cvss —epss 0.66

    The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 allows remote attackers to cause a denial of service (system hang) via crafted packets with malformed TCP selective acknowledgement (SACK) values, aka "TCP/IP Selective…

  • CVE-2010-0241Feb 10, 2010
    Microsoft
    Windows
    risk 0.04cvss —epss 0.49

    The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when IPv6 is enabled, does not properly perform bounds checking on ICMPv6 Route Information packets, which allows remote attackers to execute arbitrary code via crafted packets,…

  • CVE-2010-0240Feb 10, 2010
    Microsoft
    Windows
    risk 0.04cvss —epss 0.49

    The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when a custom network driver is used, does not properly handle local fragmentation of Encapsulating Security Payload (ESP) over UDP packets, which allows remote attackers to…

  • CVE-2010-0239Feb 10, 2010
    Microsoft
    Windows
    risk 0.08cvss —epss 0.61

    The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when IPv6 is enabled, does not properly perform bounds checking on ICMPv6 Router Advertisement packets, which allows remote attackers to execute arbitrary code via crafted…

  • CVE-2010-0233Feb 10, 2010
    Microsoft
    Windows 2000
    risk 0.03cvss —epss 0.03

    Double free vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows local users to gain privileges via a crafted application, aka "Windows Kernel Double Free Vulnerability."

  • CVE-2010-0231Feb 10, 2010
    Microsoft
    Windows 2000
    risk 0.06cvss —epss 0.41

    The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not use a sufficient source of entropy, which allows remote…

  • CVE-2010-0035Feb 10, 2010
    Microsoft
    Windows 2000
    risk 0.01cvss —epss 0.16

    The Key Distribution Center (KDC) in Kerberos in Microsoft Windows 2000 SP4, Server 2003 SP2, and Server 2008 Gold and SP2, when a trust relationship with a non-Windows Kerberos realm exists, allows remote authenticated users to cause a denial of service (NULL pointer…

  • CVE-2010-0034Feb 10, 2010
    Microsoft
    Powerpoint
    risk 0.02cvss —epss 0.29

    Stack-based buffer overflow in Microsoft Office PowerPoint 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "Office PowerPoint Viewer TextCharsAtom Record Stack Overflow Vulnerability."

  • CVE-2010-0033Feb 10, 2010
    Microsoft
    Powerpoint
    risk 0.07cvss —epss 0.51

    Stack-based buffer overflow in Microsoft Office PowerPoint 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "PowerPoint Viewer TextBytesAtom Record Stack Overflow Vulnerability."

  • CVE-2010-0032Feb 10, 2010
    Microsoft
    Powerpoint
    risk 0.02cvss —epss 0.21

    Use-after-free vulnerability in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "OEPlaceholderAtom Use After Free Vulnerability."

  • CVE-2010-0031Feb 10, 2010
    Microsoft
    Office
    risk 0.02cvss —epss 0.21

    Array index error in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3, and PowerPoint in Office 2004 for Mac, allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "PowerPoint OEPlaceholderAtom 'placementId' Invalid Array Indexing…