VYPR

CVEs

345,769 total · page 6121 of 6,916

AllCriticalHighKEV
  • CVE-2009-1798Dec 28, 2009
    Apcupsd
    Network Management Card
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities on the Network Management Card (NMC) on American Power Conversion (APC) Switched Rack PDU (aka Rack Mount Power Distribution) devices and other devices allow remote attackers to inject arbitrary web script or HTML via…

  • CVE-2009-1797Dec 28, 2009
    Apcupsd
    Network Management Card
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities on the Network Management Card (NMC) on American Power Conversion (APC) Switched Rack PDU (aka Rack Mount Power Distribution) devices and other devices allow remote attackers to hijack the authentication of (1)…

  • CVE-2009-4437Dec 28, 2009
    Active Auction House
    Active Auction House
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Active Auction House 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter to wishlist.asp and the (2) linkid parameter to links.asp. NOTE: vector 1 might overlap CVE-2005-1029.1.

  • CVE-2009-4436Dec 28, 2009
    Activewebsoftwares
    Ewebquiz
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Active Web Softwares eWebquiz 8 allow remote attackers to execute arbitrary SQL commands via the QuizID parameter to (1) questions.asp, (2) importquestions.asp, and (3) quiztakers.asp, different vectors than CVE-2007-1706.

  • CVE-2009-4435Dec 28, 2009
    Compmaster.prv.pl
    F3site
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in F3Site 2009 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the GLOBALS[nlang] parameter to (1) mod/poll.php and (2) mod/new.php.

  • CVE-2009-4434Dec 28, 2009
    Idevspot
    Isupport
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in IDevSpot iSupport 1.8 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the include_file parameter.

  • CVE-2009-4433Dec 28, 2009
    Idevspot
    Isupport
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in IDevSpot iSupport 1.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (a) 5 or (b) 9 field in a post action to ticket_function.php, reachable through ticket_submit.php and index.php; (c) the…

  • CVE-2009-4432Dec 28, 2009
    Codemight
    Videocms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in CodeMight VideoCMS 3.1 allows remote attackers to execute arbitrary SQL commands via the v parameter in a video action.

  • CVE-2009-4431Dec 28, 2009
    Anything Digital Development
    JCal Pro
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in cal_popup.php in the Anything Digital Development JCal Pro (aka com_jcalpro or JCP) component 1.5.3.6 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2009-4430Dec 28, 2009
    Virtuemart
    Virtuemart
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in VirtueMart 1.0 allows remote attackers to execute arbitrary SQL commands via the product_id parameter in a shop.product_details shop.flypage action.

  • CVE-2009-4429Dec 28, 2009
    Drupal
    Sections
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Sections module 5.x before 5.x-1.3 and 6.x before 6.x-1.3 for Drupal allows remote authenticated users with "administer sections" privileges to inject arbitrary web script or HTML via a section name (aka the Name field).

  • CVE-2009-4428Dec 28, 2009
    Joomla
    JoomPortfolio
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JoomPortfolio (com_joomportfolio) component 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the secid parameter in a showcat action to index.php.

  • CVE-2009-4427Dec 28, 2009
    Phpldapadmin Project
    Phpldapadmin
    risk 0.04cvss —epss 0.10

    Directory traversal vulnerability in cmd.php in phpLDAPadmin 1.1.0.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cmd parameter.

  • CVE-2009-4426Dec 28, 2009
    Launchpad
    Ignition
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in Ignition 1.2, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the blog parameter to (1) comment.php and (2) view.php.

  • CVE-2009-4425Dec 28, 2009
    IDevCart
    iDevCart
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in iDevCart 1.09 allows remote attackers to inject arbitrary web script or HTML via the SEARCH parameter in a browse action.

  • CVE-2009-4424Dec 28, 2009
    WordPress
    Pyrmont
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-4423Dec 24, 2009
    WeenCompany
    weenCompany
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in weenCompany 4.0.0 allows remote attackers to execute arbitrary SQL commands via the moduleid parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4422Dec 24, 2009
    Jpgraph
    Jpgraph
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the GetURLArguments function in jpgraph.php in Aditus Consulting JpGraph 3.0.6 allow remote attackers to inject arbitrary web script or HTML via a key to csim_in_html_ex1.php, and other unspecified vectors.

  • CVE-2009-4421Dec 24, 2009
    Alexander Palmo
    Simple PHP Blog
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in languages_cgi.php in Simple PHP Blog 0.5.1 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the blog_language1 parameter.

  • CVE-2009-4420Dec 24, 2009
    F5, Inc.
    BIG-IP Application Security Manager
    risk 0.00cvss —epss 0.02

    Buffer overflow in the bd daemon in F5 Networks BIG-IP Application Security Manager (ASM) 9.4.4 through 9.4.7 and 10.0.0 through 10.0.1, and Protocol Security Manager (PSM) 9.4.5 through 9.4.7 and 10.0.0 through 10.0.1, allows remote attackers to cause a denial of service…

  • CVE-2009-4419Dec 24, 2009
    Intel
    Q43 Express Chipset
    risk 0.00cvss —epss 0.00

    Intel Q35, GM45, PM45 Express, Q45, and Q43 Express chipsets in the SINIT Authenticated Code Module (ACM), which allows local users to bypass the Trusted Execution Technology protection mechanism and gain privileges by modifying the MCHBAR register to point to an…

  • CVE-2009-4418Dec 24, 2009
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The unserialize function in PHP 5.3.0 and earlier allows context-dependent attackers to cause a denial of service (resource consumption) via a deeply nested serialized variable, as demonstrated by a string beginning with a:1: followed by many {a:1: sequences.

  • CVE-2009-4417Dec 24, 2009
    Zend
    Framework
    risk 0.00cvss —epss 0.01

    The shutdown function in the Zend_Log_Writer_Mail class in Zend Framework (ZF) allows context-dependent attackers to send arbitrary e-mail messages to any recipient address via vectors related to "events not yet mailed."

  • CVE-2009-4416Dec 24, 2009
    PhpGroupWare
    Phpgroupware
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter whose name begins with the "phpgw_" sequence.

  • CVE-2009-4415Dec 24, 2009
    PhpGroupWare
    Phpgroupware
    risk 0.00cvss —epss 0.03

    Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attackers to (1) read arbitrary files via the csvfile parameter to addressbook/csv_import.php, or (2) include and execute arbitrary local files via…

  • CVE-2009-4414Dec 24, 2009
    PhpGroupWare
    Phpgroupware
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in phpgwapi /inc/class.auth_sql.inc.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the passwd parameter to login.php.

  • CVE-2009-4413Dec 24, 2009
    Polipo
    Polipo
    risk 0.04cvss —epss 0.09

    The httpClientDiscardBody function in client.c in Polipo 0.9.8, 0.9.12, 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a large Content-Length value, which triggers an integer overflow, a signed-to-unsigned…

  • CVE-2009-4412Dec 24, 2009
    Serendipity
    Serendipity
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in Serendipity before 1.5 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in an unspecified…

  • CVE-2009-4411Dec 24, 2009
    Xfs
    ACL
    risk 0.00cvss —epss 0.00

    The (1) setfacl and (2) getfacl commands in XFS acl 2.2.47, when running in recursive (-R) mode, follow symbolic links even when the --physical (aka -P) or -L option is specified, which might allow local users to modify the ACL for arbitrary files or directories via a symlink…

  • CVE-2009-4410Dec 24, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The fuse_ioctl_copy_user function in the ioctl handler in fs/fuse/file.c in the Linux kernel 2.6.29-rc1 through 2.6.30.y uses the wrong variable in an argument to the kunmap function, which allows local users to cause a denial of service (panic) via unknown vectors.

  • CVE-2009-4137Dec 24, 2009
    Piwik
    Piwik
    risk 0.01cvss —epss 0.17

    The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the…

  • CVE-2009-3305Dec 24, 2009
    Polipo
    Polipo
    risk 0.04cvss —epss 0.10

    Polipo 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a Cache-Control header that lacks a value for the max-age field, which triggers a segmentation fault in the httpParseHeaders function in http_parse.c, and…

  • CVE-2009-4409Dec 23, 2009
    Seil
    SEIL/X1, X2, B1
    risk 0.00cvss —epss 0.01

    The (1) CHAP and (2) MS-CHAP-V2 authentication capabilities in the PPP Access Concentrator (PPPAC) function in Internet Initiative Japan SEIL/B1 firmware 1.00 through 2.52 use the same challenge for each authentication attempt, which allows remote attackers to bypass…

  • CVE-2009-4408Dec 23, 2009
    Pyforum
    Pyforum
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in models.parser in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, allow remote attackers to inject arbitrary web script or HTML via crafted BBcode (1) img or (2) url tags, which are not properly handled when…

  • CVE-2009-4407Dec 23, 2009
    Pyforum
    Pyforum
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, allow remote attackers to hijack the authentication of victims for requests that change passwords, and other unspecified requests, via unknown vectors.

  • CVE-2009-4406Dec 23, 2009
    Apcupsd
    AP7932
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Forms/login1 in American Power Conversion (APC) Switched Rack PDU AP7932 B2, running rpdu 3.3.3 or 3.7.0 on AOS 3.3.4, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the login_username…

  • CVE-2009-4405Dec 23, 2009
    Firestats
    Trac
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."

  • CVE-2009-4145Dec 23, 2009
    GNOME Foundation
    Networkmanager
    risk 0.00cvss —epss 0.00

    nm-connection-editor in NetworkManager (NM) 0.7.x exports connection objects over D-Bus upon actions in the connection editor GUI, which allows local users to obtain sensitive information by reading D-Bus signals, as demonstrated by using dbus-monitor to discover the password…

  • CVE-2009-4144Dec 23, 2009
    Networkmanager
    Networkmanager
    risk 0.00cvss —epss 0.02

    NetworkManager (NM) 0.7.2 does not ensure that the configured Certification Authority (CA) certificate file for a (1) WPA Enterprise or (2) 802.1x network remains present upon a connection attempt, which might allow remote attackers to obtain sensitive information or cause a…

  • CVE-2009-4404Dec 23, 2009
    T Prot
    t-prot
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in t-prot (TOFU Protection) before 2.8 allows remote attackers to cause a denial of service via unspecified vectors related to the "--maxlines" option and a crafted email message. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4403Dec 23, 2009
    Rumba XML
    Rumba XML
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Rumba XML 1.8 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4402Dec 23, 2009
    SQL Ledger
    SQL Ledger
    risk 0.00cvss —epss 0.01

    The default configuration of SQL-Ledger 2.8.24 allows remote attackers to perform unspecified administrative operations by providing an arbitrary password to the admin interface.

  • CVE-2009-4133Dec 23, 2009
    Condor Project
    Condor
    risk 0.00cvss —epss 0.02

    Condor 6.5.4 through 7.2.4, 7.3.x, and 7.4.0, as used in MRG, Grid for MRG, and Grid Execute Node for MRG, allows remote authenticated users to queue jobs as an arbitrary user, and thereby gain privileges, by using a Condor command-line tool to modify an unspecified job…

  • CVE-2009-3584Dec 23, 2009
    SQL Ledger
    SQL Ledger
    risk 0.00cvss —epss 0.01

    SQL-Ledger 2.8.24 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

  • CVE-2009-3583Dec 23, 2009
    SQL Ledger
    SQL Ledger
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in the Preferences menu item in SQL-Ledger 2.8.24 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the countrycode field.

  • CVE-2009-3582Dec 23, 2009
    SQL Ledger
    SQL Ledger
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the delete subroutine in SQL-Ledger 2.8.24 allow remote authenticated users to execute arbitrary SQL commands via the (1) id and possibly (2) db parameters in a Delete action to the output of a Vendors>Reports>Search search operation.

  • CVE-2009-3581Dec 23, 2009
    SQL Ledger
    SQL Ledger
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via (1) the DCN Description field in the Accounts Receivables menu item for Add Transaction, (2) the Description field in the Accounts…

  • CVE-2009-3580Dec 23, 2009
    SQL Ledger
    SQL Ledger
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in am.pl in SQL-Ledger 2.8.24 allows remote attackers to hijack the authentication of arbitrary users for requests that change a password via the login, new_password, and confirm_password parameters in a preferences action.

  • CVE-2009-4401Dec 22, 2009
    TYPO3
    ste_parish_admin
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Parish Administration Database (ste_parish_admin) extension 0.1.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4400Dec 22, 2009
    TYPO3
    ste_parish_admin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Parish Administration Database (ste_parish_admin) extension 0.1.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.