VYPR

CVEs

345,857 total · page 6120 of 6,918

AllCriticalHighKEV
  • CVE-2009-4497Jan 7, 2010
    Lxr
    LXR
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in LXR Cross Referencer 0.9.5 and 0.9.6 allows remote attackers to inject arbitrary web script or HTML via the i parameter to the ident program.

  • CVE-2009-4593Jan 7, 2010
    Bftpd Project
    Bftpd
    risk 0.00cvss —epss 0.01

    The bftpdutmp_log function in bftpdutmp.c in Bftpd before 2.4 does not place a '\0' character at the end of the string value of the ut.bu_host structure member, which might allow remote attackers to cause a denial of service (daemon crash) via unspecified vectors. NOTE: some of…

  • CVE-2009-4592Jan 7, 2010
    Secureideas
    Base
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in base_local_rules.php in Basic Analysis and Security Engine (BASE) before 1.4.4 allows remote attackers to include arbitrary local files via unknown vectors.

  • CVE-2009-4591Jan 7, 2010
    Secureideas
    Base
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Basic Analysis and Security Engine (BASE) before 1.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4590Jan 7, 2010
    Secureideas
    Base
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in base_local_rules.php in Basic Analysis and Security Engine (BASE) before 1.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4589Jan 7, 2010
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaWiki 1.14.0 and 1.15.0 allows remote attackers to inject arbitrary web script or HTML via the ip parameter.

  • CVE-2009-4588Jan 7, 2010
    Awingsoft
    Awakening Winds3d Viewer Plugin
    risk 0.06cvss —epss 0.32

    Heap-based buffer overflow in the WindsPlayerIE.View.1 ActiveX control in WindsPly.ocx 3.5.0.0 Beta, 3.0.0.5, and earlier in AwingSoft Awakening Web3D Player and Winds3D Viewer allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via…

  • CVE-2009-4587Jan 7, 2010
    Cherokee
    Cherokee Httpd
    risk 0.03cvss —epss 0.04

    Cherokee Web Server 0.5.4 allows remote attackers to cause a denial of service (daemon crash) via an MS-DOS reserved word in a URI, as demonstrated by the AUX reserved word.

  • CVE-2009-4586Jan 7, 2010
    Wowd
    Wowd
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.html in Wowd client before 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) sortby, (2) tags, or (3) ctx parameter in a search action.

  • CVE-2010-0158Jan 6, 2010
    Joomlabamboo
    Simpla Admin
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JoomlaBamboo (JB) Simpla Admin template for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an article action to the com_content component, reachable through index.php. NOTE: the vendor disputes this…

  • CVE-2010-0157Jan 6, 2010
    Joomla
    Com Biblestudy
    risk 0.04cvss —epss 0.13

    Directory traversal vulnerability in the Bible Study (com_biblestudy) component 6.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter in a studieslist action to index.php.

  • CVE-2009-4585Jan 6, 2010
    UranyumSoft
    Listing Service
    risk 0.03cvss —epss 0.03

    UranyumSoft Listing Service stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/db.mdb.

  • CVE-2009-4584Jan 6, 2010
    Dbmasters
    Db Masters Multimedia Links Directory
    risk 0.00cvss —epss 0.02

    admin.php in dB Masters Multimedia Links Directory 3.1.3 allows remote attackers to bypass authentication and gain administrative access via a certain value of the admin_log cookie.

  • CVE-2009-4583Jan 6, 2010
    Joomla
    DhForum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the DhForum (com_dhforum) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a grouplist action to index.php.

  • CVE-2009-4582Jan 6, 2010
    XOOPS
    Dictionary module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in detail.php in the Dictionary module for XOOPS 2.0.18 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-4581CriJan 6, 2010
    Roseonlinecms
    Roseonlinecms
    risk 0.67cvss 9.8epss 0.05

    Directory traversal vulnerability in modules/admincp.php in RoseOnlineCMS 3 B1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the admin parameter.

  • CVE-2009-4580Jan 6, 2010
    Hasta
    Blog
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Hasta Blog 2.3 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) yorumyaz.php and (2) blog.php.

  • CVE-2009-4579Jan 6, 2010
    Joomla
    Artist avenue
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Artist avenue (com_artistavenue) component for Joomla! and Mambo allows remote attackers to inject arbitrary web script or HTML via the Itemid parameter to index.php.

  • CVE-2009-4578Jan 6, 2010
    Facileforms
    Facileforms
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Facileforms (com_facileforms) component for Joomla! and Mambo allows remote attackers to inject arbitrary web script or HTML via the Itemid parameter to index.php.

  • CVE-2009-4577Jan 6, 2010
    Maxdev
    Mdforum
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the MDForum module 2.x through 2.07 for MAXdev MDPro allows remote attackers to execute arbitrary SQL commands via the c parameter to index.php.

  • CVE-2009-4576Jan 6, 2010
    Joomla
    BeeHeard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the BeeHeard (com_beeheard) component 1.x for Joomla! allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a suggestions action to index.php.

  • CVE-2009-4575Jan 6, 2010
    Q Personel
    Q-Personel
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Q-Personel (com_qpersonel) component 1.0.2 RC2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the personel_sira parameter in a sirala action to index.php.

  • CVE-2009-4574Jan 6, 2010
    I Escorts
    I Escorts Directory Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in country_escorts.php in I-Escorts Directory Script allows remote attackers to execute arbitrary SQL commands via the country_id parameter.

  • CVE-2009-4573Jan 6, 2010
    Joomlabear
    Mod Joomulus
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Joomulus (mod_joomulus) module 2.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action to (1) tagcloud_ell.swf, (2) tagcloud_eng.swf, (3)…

  • CVE-2009-4572Jan 5, 2010
    Phpshop
    Phpshop
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in PhpShop 0.8.1 allows remote attackers to hijack the authentication of arbitrary users for requests that invoke the cartAdd function in a shop/cart action to the default URI.

  • CVE-2009-4571Jan 5, 2010
    Phpshop
    Phpshop
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in index.php in PhpShop 0.8.1 allow remote attackers to execute arbitrary SQL commands via the (1) module_id parameter in an admin/function_list action, the (2) vendor_id parameter in a vendor/vendor_form action, the (3) module_id parameter…

  • CVE-2009-4570Jan 5, 2010
    Phpshop
    Phpshop
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in PhpShop 0.8.1 allows remote attackers to inject arbitrary web script or HTML via the order_id parameter in an order/order_print action to the default URI.

  • CVE-2009-4569Jan 5, 2010
    Elkagroup
    Image Gallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in elkagroup Image Gallery allows remote attackers to execute arbitrary SQL commands via the id parameter to the default URI under news/.

  • CVE-2009-4568Jan 5, 2010
    Webmin
    Webmin
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Webmin before 1.500 and Usermin before 1.430 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4567Jan 5, 2010
    Viscacha
    Viscacha
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in editprofile.php in Viscacha 0.8 Gold allow remote authenticated users to inject arbitrary web script or HTML via the (1) skype, (2) yahoo, (3) aol, (4) msn, or (5) jabber parameter in a profile2 action. NOTE: some of these…

  • CVE-2009-3734Jan 5, 2010
    S2 Security
    Linear eMerge Access Control System
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the management console in the S2 Security Linear eMerge Access Control System 2.5.x allows remote attackers to cause a denial of service (configuration reset) via a request to a crafted URI.

  • CVE-2009-4566Jan 4, 2010
    Zenphoto
    Zenphoto
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Zenphoto 1.2.5 allows remote attackers to execute arbitrary SQL commands via the title parameter in a news action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2009-4565Jan 4, 2010
    Sendmail, Inc.
    Sendmail
    risk 0.00cvss —epss 0.02

    sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification…

  • CVE-2009-4564Jan 4, 2010
    Zenphoto
    Zenphoto
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Zenphoto 1.2.5, when the ZenPage plugin is enabled, allows remote attackers to execute arbitrary SQL commands via the category parameter, related to a URI under news/category/.

  • CVE-2009-4563Jan 4, 2010
    Zenphoto
    Zenphoto
    risk 0.03cvss —epss 0.04

    Cross-site request forgery (CSRF) vulnerability in zp-core/admin-options.php in Zenphoto 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via the 0-adminpass and 0-adminpass_2 parameters in a…

  • CVE-2009-4562Jan 4, 2010
    Zenphoto
    Zenphoto
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in zp-core/admin.php in Zenphoto 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the from parameter.

  • CVE-2009-4561Jan 4, 2010
    Worms League
    Webleague
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Admin/index.php in WebLeague 2.2.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

  • CVE-2009-4560Jan 4, 2010
    WebLeague
    WebLeague
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in profile.php in WebLeague 2.2.0 allows remote attackers to execute arbitrary SQL commands via the name parameter.

  • CVE-2009-4559Jan 4, 2010
    Drupal
    Submitted By
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Submitted By module 6.x before 6.x-1.3 for Drupal allows remote authenticated users, with "administer content types" privileges, to inject arbitrary web script or HTML via an input string for "submitted by" text.

  • CVE-2009-4558Jan 4, 2010
    Drupal
    Image Assist
    risk 0.00cvss —epss 0.01

    The Image Assist module 5.x-1.x before 5.x-1.8, 5.x-2.x before 2.0-alpha4, 6.x-1.x before 6.x-1.1, 6.x-2.x before 2.0-alpha4, and 6.x-3.x-dev before 2009-07-15, a module for Drupal, does not properly enforce privilege requirements for unspecified pages, which allows remote…

  • CVE-2009-4557Jan 4, 2010
    Drupal
    Image Assist
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Image Assist module 5.x-1.x before 5.x-1.8, 5.x-2.x before 2.0-alpha4, 6.x-1.x before 6.x-1.1, 6.x-2.x before 2.0-alpha4, and 6.x-3.x-dev before 2009-07-15, a module for Drupal, allows remote authenticated users, with image-node…

  • CVE-2009-4556Jan 4, 2010
    Quickheal
    Antivirus Plus 2009
    risk 0.03cvss —epss 0.01

    Quick Heal AntiVirus Plus 2009 10.00 SP1 and Quick Heal Total Security 2009 10.00 SP1 use weak permissions (Everyone: Full Control) for the product files, which allows local users to gain privileges by replacing executables with Trojan horse programs, as demonstrated by…

  • CVE-2009-4555Jan 4, 2010
    AgoraCart
    AgoraCart GOLD
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in AgoraCart 5.2.005 and 5.2.006 and AgoraCart GOLD 5.5.005 allow remote attackers to hijack the authentication of administrators for requests that (1) modify a .htaccess file via an unspecified request to…

  • CVE-2009-4554Jan 4, 2010
    Snitz Forums 2000
    Snitz Forums 2000
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Snitz Forums 2000 3.4.07 allow remote attackers to inject arbitrary web script or HTML via (1) the url parameter to pop_send_to_friend.asp, related to a crafted onload attribute of an IMG element; or (2) an onload attribute…

  • CVE-2009-4553Jan 4, 2010
    iRehearse
    iRehearse
    risk 0.03cvss —epss 0.02

    Stack-based buffer overflow in iRehearse allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long string in a .m3u playlist file.

  • CVE-2009-4552Jan 4, 2010
    Intesync
    Miniweb
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.

  • CVE-2009-4551Jan 4, 2010
    Intesync
    Miniweb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via the campaign_id parameter in a results action to index.php.

  • CVE-2009-4550Jan 4, 2010
    Kunena
    Kunena
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Kunena Forum (com_kunena) component 1.5.3 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the func parameter to index.php.

  • CVE-2009-4549Jan 4, 2010
    A2 Media Player Pro
    A2 Media Player Pro
    risk 0.03cvss —epss 0.04

    Stack-based buffer overflow in A2 Media Player Pro 2.51 allows remote attackers to execute arbitrary code via a long string in a (1) .m3u or (2) .m3l playlist file.

  • CVE-2009-4548Jan 4, 2010
    Viart
    Helpdesk
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web script or HTML via the category_id parameter to (1) products.php, (2) article.php, (3) product_details.php, or (4) reviews.php; the (5) forum_id parameter to…