VYPR

CVEs

345,857 total · page 6117 of 6,918

AllCriticalHighKEV
  • CVE-2009-4623Jan 18, 2010
    Advanced Comment System
    Advanced Comment System
    risk 0.04cvss —epss 0.10

    Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the ACS_path parameter to (1) index.php and (2) admin.php in advanced_comment_system/. NOTE: this might only be a vulnerability…

  • CVE-2009-4622Jan 18, 2010
    Drunken:Golem
    Gaming Portal
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in admin/admin_news_bot.php in Drunken:Golem Gaming Portal 0.5.1 alpha 2 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter, a different vector than CVE-2007-0572.

  • CVE-2009-4621Jan 18, 2010
    Discuz
    JiangHu Inn plugin
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JiangHu Inn plugin 1.1 and earlier for Discuz! allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action to forummission.php.

  • CVE-2009-4620Jan 18, 2010
    Joomla
    Joomloc
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Joomloc (com_joomloc) component 1.0 for Joomla allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit task to index.php.

  • CVE-2009-4619Jan 18, 2010
    Joomla
    com_lucygames
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Lucy Games (com_lucygames) component 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gameid parameter in a game action to index.php. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4618Jan 18, 2010
    Tourismscripts
    Bus Script
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Tourism Script Bus Script allow remote attackers to execute arbitrary SQL commands via the sitetext_id parameter to (1) aboutus.php and (2) faq.php.

  • CVE-2009-4617Jan 18, 2010
    Tourismscripts
    Tourism Script Accomodation Hotel Booking Portal Script
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Tourism Script Accommodation Hotel Booking Portal Script allow remote attackers to execute arbitrary SQL commands via the hotel_id parameter to (1) hotel.php, (2) details.php, (3) roomtypes.php, (4) photos.php, (5) map.php, (6)…

  • CVE-2009-4616Jan 18, 2010
    Myrephp
    Holiday Rental Manager
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in MYRE Holiday Rental Manager allows remote attackers to inject arbitrary web script or HTML via the cat_id1 parameter.

  • CVE-2009-4615Jan 18, 2010
    Myrephp
    Holiday Rental Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in review.php in MYRE Holiday Rental Manager allows remote attackers to execute arbitrary SQL commands via the link_id parameter in a show_review action.

  • CVE-2009-4614Jan 18, 2010
    Moa
    Moa Gallery
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Moa Gallery 1.2.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the MOA_PATH parameter to (1) _error_funcs.php, (2) _integrity_funcs.php, (3) _template_component_admin.php, (4)…

  • CVE-2010-0356Jan 18, 2010
    Viscom Software
    Movie Player Pro SDK ActiveX
    risk 0.05cvss —epss 0.30

    Stack-based buffer overflow in the MOVIEPLAYER.MoviePlayerCtrl.1 ActiveX control in MoviePlayer.ocx 6.8.0.0 in Viscom Software Movie Player Pro SDK ActiveX 6.8 allows remote attackers to execute arbitrary code via a long strFontName parameter to the DrawText method.

  • CVE-2010-0350Jan 15, 2010
    TYPO3
    Photo Book (goof_fotoboek)
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in the Photo Book (goof_fotoboek) extension 1.7.14 and earlier for TYPO3 has unknown impact and remote attack vectors.

  • CVE-2010-0349Jan 15, 2010
    C3 Corp.
    WebCalenderC3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in C3 Corp. WebCalenderC3 0.32 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors. NOTE: this issue could not be reproduced by the vendor, but a patch was provided anyway. The original…

  • CVE-2010-0348Jan 15, 2010
    C3 Corp.
    WebCalenderC3
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in C3 Corp. WebCalenderC3 0.32 and earlier allows remote attackers to read arbitrary files via unknown vectors.

  • CVE-2010-0347Jan 15, 2010
    TYPO3
    VD / Geomap (vd_geomap)
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the VD / Geomap (vd_geomap) extension 0.3.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0346Jan 15, 2010
    TYPO3
    Mimi Tipfriends
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Tip many friends (mimi_tipfriends) extension 0.0.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0345Jan 15, 2010
    TYPO3
    Majordomo
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Majordomo extension 1.1.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0344Jan 15, 2010
    TYPO3
    Zak Store Management
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the zak_store_management extension 1.0.0 and earlier TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0343Jan 15, 2010
    TYPO3
    Clan Users List
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Clan Users List (pb_clanlist) extension 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0342Jan 15, 2010
    TYPO3
    Job Reports
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Reports for Job (job_reports) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0341Jan 15, 2010
    TYPO3
    Bb Simplejobs
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the BB Simple Jobs (bb_simplejobs) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0340Jan 15, 2010
    TYPO3
    Mjseventpro
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the MJS Event Pro (mjseventpro) extension 0.2.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0339Jan 15, 2010
    TYPO3
    User Links
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the User Links (vm19_userlinks) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0338Jan 15, 2010
    TYPO3
    Ttpedit
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the TT_Products editor (ttpedit) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0337Jan 15, 2010
    TYPO3
    tt_news Mail alert
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the tt_news Mail alert (dl3_tt_news_alerts) extension 0.2.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0336Jan 15, 2010
    TYPO3
    Kiddog Mysqldumper
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the kiddog_mysqldumper (kiddog_mysqldumper) extension 0.0.3 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.

  • CVE-2010-0335Jan 15, 2010
    TYPO3
    vote_for_tt_news
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Vote rank for news (vote_for_tt_news) extension 1.0.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0334Jan 15, 2010
    TYPO3
    vote_for_tt_news
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Vote rank for news (vote_for_tt_news) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0333Jan 15, 2010
    TYPO3
    Helpdesk (mg_help)
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Helpdesk (mg_help) extension 1.1.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0332Jan 15, 2010
    TYPO3
    TV21 Talkshow
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the TV21 Talkshow (tv21_talkshow) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0331Jan 15, 2010
    TYPO3
    TV21 Talkshow
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the TV21 Talkshow (tv21_talkshow) extension 1.0.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0330Jan 15, 2010
    Julian Fries
    Jf Easymaps
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Googlemaps for tt_news (jf_easymaps) extension 1.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0329Jan 15, 2010
    Alex Kellner
    Powermail
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the powermail extension 1.5.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to the "SQL selection field" and "typoscript."

  • CVE-2010-0328Jan 15, 2010
    Rastislav Birka
    Cs2 Unitconv
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Unit Converter (cs2_unitconv) extension 1.0.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0327Jan 15, 2010
    TYPO3
    Kj Imagelightbox2
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the KJ: Imagelightbox (kj_imagelightbox2) extension 2.0.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2008-2490.

  • CVE-2010-0326Jan 15, 2010
    TYPO3
    devlog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Developer log (devlog) extension 2.9.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0325Jan 15, 2010
    TYPO3
    SB Folderdownload
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the SB Folderdownload (sb_folderdownload) extension 0.2.2 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.

  • CVE-2010-0324Jan 15, 2010
    Patrick Bauerochse
    Ref List
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Customer Reference List (ref_list) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0323Jan 15, 2010
    TYPO3
    Photo Book
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Photo Book (goof_fotoboek) extension 1.7.14 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.

  • CVE-2010-0322Jan 15, 2010
    TYPO3
    MK-AnydropdownMenu
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the init function in MK-AnydropdownMenu (mk_anydropdownmenu) extension 0.3.28 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0321Jan 15, 2010
    Jamit
    Jamit Job Board
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in jobs/index.php in Jamit Job Board 3.0 allows remote attackers to inject arbitrary web script or HTML via the post_id parameter.

  • CVE-2010-0320Jan 15, 2010
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in submitlink.php in Glitter Central Script allows remote attackers to inject arbitrary web script or HTML via the catid parameter.

  • CVE-2010-0319Jan 15, 2010
    Docmint
    Docmint
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Docmint 1.0 and 2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-0318Jan 15, 2010
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.00

    The replay functionality for ZFS Intent Log (ZIL) in FreeBSD 7.1, 7.2, and 8.0, when creating files during replay of a setattr transaction, uses 7777 permissions instead of the original permissions, which might allow local users to read or modify unauthorized files in…

  • CVE-2010-0317Jan 15, 2010
    Novell
    Netware
    risk 0.04cvss —epss 0.10

    Novell Netware 6.5 SP8 allows remote attackers to cause a denial of service (NULL pointer dereference, memory consumption, ABEND, and crash) via a large number of malformed or AFP requests that are not properly handled by (1) the CIFS functionality in CIFS.nlm Semantic Agent…

  • CVE-2010-0316Jan 15, 2010
    Google
    Sketchup
    risk 0.00cvss —epss 0.04

    Integer overflow in Google SketchUp before 7.1 M2 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via a crafted SKP file.

  • CVE-2010-0280Jan 15, 2010
    Google
    Sketchup
    risk 0.01cvss —epss 0.07

    Array index error in Jan Eric Kyprianidis lib3ds 1.x, as used in Google SketchUp 7.x before 7.1 M2, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted structures in a 3DS file, probably related to mesh.c.

  • CVE-2010-0249HigKEVJan 15, 2010
    Microsoft
    Internet Explorer
    risk 0.80cvss 8.8epss 0.92

    Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute…

  • CVE-2010-0315Jan 14, 2010
    Google
    Chrome
    risk 0.04cvss —epss 0.07

    WebKit before r53607, as used in Google Chrome before 4.0.249.89, allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the…

  • CVE-2010-0314Jan 14, 2010
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.07

    Apple Safari allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets[0].href property value.