VYPR

CVEs

345,857 total · page 6115 of 6,918

AllCriticalHighKEV
  • CVE-2010-0460Jan 28, 2010
    Kayako
    Supportsuite
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in staff/index.php in Kayako SupportSuite 3.60.04 and earlier allow remote authenticated users to inject arbitrary web script or HTML via the (1) subject parameter and (2) contents parameter (aka body) in an insertquestion…

  • CVE-2010-0459Jan 28, 2010
    Yoflash
    Com Mochigames
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Mochigames (com_mochigames) component 0.51 and possibly other versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

  • CVE-2010-0458Jan 28, 2010
    Netartmedia
    Blog System
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in NetArt Media Blog System 1.5 allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to index.php and the (2) note parameter to blog.php.

  • CVE-2010-0457Jan 28, 2010
    Magic Portal
    magic-portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in home.php in magic-portal 2.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-0456Jan 28, 2010
    Indianpulse
    Game Server
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the indianpulse Game Server (com_gameserver) component 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the grp parameter in a gameserver action to index.php.

  • CVE-2010-0455Jan 28, 2010
    Punbb
    Punbb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in forum/viewtopic.php in PunBB 1.3 allows remote attackers to inject arbitrary web script or HTML via the pid parameter.

  • CVE-2010-0454Jan 28, 2010
    Publique!
    Publique!
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in cgi/cgilua.exe/sys/start.htm in Publique! 2.3 allows remote attackers to execute arbitrary SQL commands via the sid parameter.

  • CVE-2010-0142Jan 28, 2010
    Cisco Systems, Inc.
    Unified Meetingplace
    risk 0.00cvss —epss 0.02

    MeetingTime in Cisco Unified MeetingPlace 6 before MR5, and possibly 5, allows remote authenticated users to gain privileges via a modified authentication sequence, aka Bug ID CSCsv66530.

  • CVE-2010-0141Jan 28, 2010
    Cisco Systems, Inc.
    Unified Meetingplace
    risk 0.00cvss —epss 0.01

    MeetingTime in Cisco Unified MeetingPlace 6 before MR5, and possibly 5, allows remote attackers to discover usernames, passwords, and unspecified other data from the user database via a modified authentication sequence to the Audio Server, aka Bug ID CSCsv76935.

  • CVE-2010-0140Jan 28, 2010
    Cisco Systems, Inc.
    Unified Meetingplace
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in the web server in Cisco Unified MeetingPlace 7 before 7.0(2.3) hotfix 5F, 6 before 6.0.639.3, and possibly 5 allow remote attackers to create (1) user or (2) administrator accounts via a crafted URL in a request to the internal interface,…

  • CVE-2010-0139Jan 28, 2010
    Cisco Systems, Inc.
    Unified Meetingplace
    risk 0.00cvss —epss 0.02

    Cisco Unified MeetingPlace 7 before 7.0(2.3) hotfix 5F, 6 before 6.0.639.2, and possibly 5 does not properly validate SQL commands, which allows remote attackers to create, modify, or delete data in a database via unspecified vectors, aka Bug ID CSCtc39691.

  • CVE-2009-4183Jan 28, 2010
    Microfocus
    Storage Data Protector
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in HP OpenView Storage Data Protector 6.00 and 6.10 allows local users to obtain unspecified "access" via unknown vectors.

  • CVE-2009-2902Jan 28, 2010
    Apache
    Tomcat
    risk 0.00cvss —epss 0.11

    Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.

  • CVE-2009-2901Jan 28, 2010
    Apache
    Tomcat
    risk 0.00cvss —epss 0.08

    The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.

  • CVE-2009-2693Jan 28, 2010
    Apache
    Tomcat
    risk 0.00cvss —epss 0.10

    Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.

  • CVE-2005-4885Jan 28, 2010
    Sun Corporation
    Storedge 6130 Arrays
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability on certain Sun StorEdge 6130 (SE6130) Controller Arrays allows remote attackers to delete data via unknown vectors.

  • CVE-2004-2766Jan 28, 2010
    Sun Corporation
    iPlanet Messaging Server
    risk 0.00cvss —epss 0.01

    Webmail in Sun ONE Messaging Server 6.1 and iPlanet Messaging Server 5.2 before 5.2hf2.02 allows remote attackers to obtain unspecified "access" to e-mail via a crafted e-mail message, related to a "session hijacking" issue, a different vulnerability than CVE-2005-2022 and…

  • CVE-2004-2765Jan 28, 2010
    Sun Corporation
    iPlanet Messaging Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Webmail in Sun ONE Messaging Server 6.1 and iPlanet Messaging Server 5.2 before 5.2hf2.02, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, a different…

  • CVE-2003-1576Jan 28, 2010
    Sun Corporation
    Change Manager
    risk 0.00cvss —epss 0.05

    Buffer overflow in pamverifier in Change Manager (CM) 1.0 for Sun Management Center (SunMC) 3.0 on Solaris 8 and 9 on the sparc platform allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2003-1575Jan 28, 2010
    Symantec
    Vxfs
    risk 0.00cvss —epss 0.00

    VERITAS File System (VxFS) 3.3.3, 3.4, and 3.5 before MP1 Rolling Patch 02 for Sun Solaris 2.5.1 through 9 does not properly implement inheritance of default ACLs in certain circumstances related to the characteristics of a directory inode, which allows local users to bypass…

  • CVE-2009-4272HigJan 27, 2010
    Linux
    Kernel
    risk 0.50cvss 7.5epss 0.11

    A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing…

  • CVE-2009-3556Jan 27, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    A certain Red Hat configuration step for the qla2xxx driver in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5, when N_Port ID Virtualization (NPIV) hardware is used, sets world-writable permissions for the (1) vport_create and (2) vport_delete files under…

  • CVE-2010-0392Jan 26, 2010
    Thegreenbow
    Ipsec VPN Client
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in vpnconf.exe in TheGreenBow IPSec VPN Client 4.51.001, 4.65.003, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via a long OpenScriptAfterUp parameter in a policy (.tgb) file, related to "phase 2."

  • CVE-2010-0391Jan 26, 2010
    Embarcadero
    Interbase Smp 2009
    risk 0.00cvss —epss 0.03

    Multiple stack-based buffer overflows in Embarcadero Technologies InterBase SMP 2009 9.0.3.437 allow remote attackers to execute arbitrary code via unknown vectors involving crafted packets. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2010-0390Jan 26, 2010
    Phpf1
    Max\'s Image Uploader
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in maxImageUpload/index.php in PHP F1 Max's Image Uploader 1.0, when Apache is not configured to handle the mime-type for files with pjpeg or jpeg extensions, allows remote attackers to execute arbitrary code by uploading a file with a…

  • CVE-2010-0006Jan 26, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the Linux kernel before 2.6.32.4, when network namespaces are enabled, allows remote attackers to cause a denial of service (NULL pointer dereference) via an invalid IPv6 jumbogram, a related issue to CVE-2007-4567.

  • CVE-2010-0003Jan 26, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The print_fatal_signal function in kernel/signal.c in the Linux kernel before 2.6.32.4 on the i386 platform, when print-fatal-signals is enabled, allows local users to discover the contents of arbitrary memory locations by jumping to an address and then reading a log file, and…

  • CVE-2009-4273Jan 26, 2010
    Systemtap
    Systemtap
    risk 0.04cvss —epss 0.18

    stap-server in SystemTap before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in stap command-line arguments in a request.

  • CVE-2005-4884Jan 25, 2010
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Oracle OLAP component in Oracle Database Server 10.1.0.4 (10g) allows remote authenticated attackers to affect availability via unknown vectors, aka DB02.

  • CVE-2010-0389Jan 25, 2010
    Sun Corporation
    Java System Web Server
    risk 0.00cvss —epss 0.02

    The admin server in Sun Java System Web Server 7.0 Update 6 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an HTTP request that lacks a method token.

  • CVE-2010-0388Jan 25, 2010
    Sun Corporation
    Java System Web Server
    risk 0.04cvss —epss 0.07

    Format string vulnerability in the WebDAV implementation in webservd in Sun Java System Web Server 7.0 Update 6 allows remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in the encoding attribute…

  • CVE-2010-0387Jan 25, 2010
    Sun Corporation
    Java System Web Server
    risk 0.04cvss —epss 0.08

    Multiple heap-based buffer overflows in (1) webservd and (2) the admin server in Sun Java System Web Server 7.0 Update 7 allow remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via a long string in an "Authorization: Digest"…

  • CVE-2010-0386HigJan 25, 2010
    Sun Corporation
    Java System Application Server
    risk 0.53cvss 8.1epss 0.02

    The default configuration of Sun Java System Application Server 7 and 7 2004Q2 enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and authentication credentials via a cross-site tracing (XST) attack, a related issue to CVE-2004-2763 and…

  • CVE-2010-0385Jan 25, 2010
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Tor before 0.2.1.22, and 0.2.2.x before 0.2.2.7-alpha, when functioning as a bridge directory authority, allows remote attackers to obtain sensitive information about bridge identities and bridge descriptors via a dbg-stability.txt directory query.

  • CVE-2010-0384Jan 25, 2010
    Tor
    Tor
    risk 0.00cvss —epss 0.00

    Tor 0.2.2.x before 0.2.2.7-alpha, when functioning as a directory mirror, does not prevent logging of the client IP address upon detection of erroneous client behavior, which might make it easier for local users to discover the identities of clients in opportunistic…

  • CVE-2010-0383Jan 25, 2010
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Tor before 0.2.1.22, and 0.2.2.x before 0.2.2.7-alpha, uses deprecated identity keys for certain directory authorities, which makes it easier for man-in-the-middle attackers to compromise the anonymity of traffic sources and destinations.

  • CVE-2009-4257Jan 25, 2010
    RealNetworks
    Realplayer
    risk 0.01cvss —epss 0.09

    Heap-based buffer overflow in datatype/smil/common/smlpkt.cpp in smlrender.dll in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10 and 11.0.0,…

  • CVE-2009-4248Jan 25, 2010
    RealNetworks
    Realplayer
    risk 0.01cvss —epss 0.07

    Buffer overflow in the RTSPProtocol::HandleSetParameterRequest function in client/core/rtspprotocol.cpp in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux…

  • CVE-2009-4247Jan 25, 2010
    RealNetworks
    Realplayer
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in protocol/rtsp/rtspclnt.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.x; RealPlayer SP 1.0.0 and 1.0.1; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, 11.0, and 11.0.1; Linux RealPlayer 10,…

  • CVE-2009-4246Jan 25, 2010
    RealNetworks
    Realplayer
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows user-assisted remote attackers to…

  • CVE-2009-4245Jan 25, 2010
    RealNetworks
    Realplayer
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to cause a denial…

  • CVE-2009-4244Jan 25, 2010
    RealNetworks
    Realplayer
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute…

  • CVE-2009-4243Jan 25, 2010
    RealNetworks
    Realplayer
    risk 0.00cvss —epss 0.03

    RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allow remote attackers to have an unspecified impact via a crafted…

  • CVE-2009-4242Jan 25, 2010
    RealNetworks
    Realplayer
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in the CGIFCodec::GetPacketBuffer function in datatype/image/gif/common/gifcodec.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1,…

  • CVE-2009-4241Jan 25, 2010
    RealNetworks
    Realplayer
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to execute…

  • CVE-2008-7253Jan 25, 2010
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.02

    The default configuration of the web server in IBM Lotus Domino Server, possibly 6.0 through 8.0, enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and authentication credentials via a cross-site tracing (XST) attack, a related issue to…

  • CVE-2010-0382Jan 22, 2010
    Isc
    Bind
    risk 0.01cvss —epss 0.07

    ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via…

  • CVE-2010-0381Jan 22, 2010
    Phpmyspace
    Phpmyspace
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in modules/arcade/index.php in PHP MySpace Gold Edition 8.0 and 8.10 allows remote attackers to execute arbitrary SQL commands via the gid parameter in a show_stats action. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2010-0380Jan 22, 2010
    Jce Tech
    PHP Calendars Script
    risk 0.03cvss —epss 0.02

    install.php in JCE-Tech PHP Calendars, downloaded 20100121, allows remote attackers to bypass intended access restrictions and modify application settings via a direct request. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the…

  • CVE-2010-0290Jan 22, 2010
    Isc
    Bind
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a…