VYPR

CVEs

345,769 total · page 6123 of 6,916

AllCriticalHighKEV
  • CVE-2009-4359Dec 20, 2009
    Marc Andre Lanciault
    Smartmedia
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in folder.php in the SmartMedia 0.85 Beta module for XOOPS allows remote attackers to inject arbitrary web script or HTML via the categoryid parameter.

  • CVE-2009-4358Dec 20, 2009
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.00

    freebsd-update in FreeBSD 8.0, 7.2, 7.1, 6.4, and 6.3 uses insecure permissions in its working directory (/var/db/freebsd-update by default), which allows local users to read copies of sensitive files after a (1) freebsd-update fetch (fetch) or (2) freebsd-update upgrade…

  • CVE-2009-4029Dec 20, 2009
    GNU
    Automake
    risk 0.00cvss —epss 0.00

    The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, and release branches branch-1-4 through branch-1-9, when producing a distribution tarball for a package that uses Automake, assign insecure permissions (777) to directories in the build tree, which introduces a…

  • CVE-2009-4357Dec 18, 2009
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.01

    CQWeb (aka the web interface) in IBM Rational ClearQuest before 7.1.1 does not properly handle use of legacy URLs for automatic login, which might allow attackers to discover the passwords for user accounts via unspecified vectors.

  • CVE-2009-4356Dec 18, 2009
    Winamp
    Winamp
    risk 0.00cvss —epss 0.05

    Multiple integer overflows in the jpeg.w5s and png.w5s filters in Winamp before 5.57 allow remote attackers to execute arbitrary code via malformed (1) JPEG or (2) PNG data in an MP3 file.

  • CVE-2009-3996Dec 18, 2009
    Mikmod
    libmikmod
    risk 0.01cvss —epss 0.06

    Heap-based buffer overflow in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via an Ultratracker file.

  • CVE-2009-3703Dec 18, 2009
    WordPress
    Wp Forum
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the forum parameter to an…

  • CVE-2009-2880Dec 18, 2009
    Cisco Systems, Inc.
    Webex
    risk 0.00cvss —epss 0.05

    Buffer overflow in atrpui.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 for Windows, 27.x before 27.10.x for Windows, 26.x before 26.49.35 for Mac OS X and Linux, and 27.x before 27.11.8 for Mac OS X and Linux allows remote attackers to cause a denial of service…

  • CVE-2009-2879Dec 18, 2009
    Cisco Systems, Inc.
    Webex
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for Windows, 27.x before 27.10.x (aka T27SP10) for Windows, 26.x before 26.49.35 for Mac OS X and Linux, and 27.x before 27.11.8 for Mac OS X and Linux allows remote…

  • CVE-2009-2878Dec 18, 2009
    Cisco Systems, Inc.
    Webex
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for Windows, 27.x before 27.10.x (aka T27SP10) for Windows, 26.x before 26.49.35 for Mac OS X and Linux, and 27.x before 27.11.8 for Mac OS X and Linux allows remote…

  • CVE-2009-2877Dec 18, 2009
    Cisco Systems, Inc.
    Webex
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in ataudio.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 for Windows, 27.x before 27.10.x (aka T27SP10) for Windows, 26.x before 26.49.35 for Mac OS X and Linux, and 27.x before 27.11.8 for Mac OS X and Linux allows remote attackers to cause…

  • CVE-2009-2876Dec 18, 2009
    Cisco Systems, Inc.
    Webex
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for Windows, 27.x before 27.10.x (aka T27SP10) for Windows, 26.x before 26.49.35 for Mac OS X and Linux, and 27.x before 27.11.8 for Mac OS X and Linux allows remote…

  • CVE-2009-2875Dec 18, 2009
    Cisco Systems, Inc.
    Webex
    risk 0.00cvss —epss 0.05

    Buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 for Windows, 27.x before 27.10.x for Windows, 26.x before 26.49.35 for Mac OS X and Linux, and 27.x before 27.11.8 for Mac OS X and Linux allows remote attackers to cause a denial of service…

  • CVE-2007-2281Dec 18, 2009
    Microfocus
    Storage Data Protector
    risk 0.01cvss —epss 0.09

    Integer overflow in the _ncp32._NtrpTCPReceiveMsg function in rds.exe in the Cell Manager Database Service in the Application Recovery Manager component in HP OpenView Storage Data Protector 5.50 and 6.0 allows remote attackers to execute arbitrary code via a large value in the…

  • CVE-2007-2280Dec 18, 2009
    Microfocus
    Storage Data Protector
    risk 0.08cvss —epss 0.60

    Stack-based buffer overflow in OmniInet.exe (aka the backup client service daemon) in the Application Recovery Manager component in HP OpenView Storage Data Protector 5.50 and 6.0 allows remote attackers to execute arbitrary code via an MSG_PROTOCOL command with long arguments,…

  • CVE-2009-3997Dec 18, 2009
    Winamp
    Winamp
    risk 0.00cvss —epss 0.06

    Integer overflow in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57 might allow remote attackers to execute arbitrary code via an Oktalyzer file that triggers a heap-based buffer overflow.

  • CVE-2009-3995Dec 18, 2009
    Mikmod
    libmikmod
    risk 0.01cvss —epss 0.07

    Multiple heap-based buffer overflows in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file. …

  • CVE-2009-4354Dec 17, 2009
    Transware
    Active\! Mail
    risk 0.00cvss —epss 0.01

    TransWARE Active! mail 2003 build 2003.0139.0871 and earlier does not properly secure the session ID in a session cookie, which allows remote attackers to hijack web sessions, probably related to the "secure" flag for cookies in SSL sessions.

  • CVE-2009-4353Dec 17, 2009
    Transware
    Active\! Mail
    risk 0.00cvss —epss 0.01

    The Mobile Edition of TransWARE Active! mail 2003 build 2003.0139.0871 and earlier, and possibly other versions before 2003.0139.0911, does not remove the session ID in a Referer URL, which allows remote attackers to hijack web sessions via vectors such as an email with an…

  • CVE-2009-4352Dec 17, 2009
    Transware
    Active\! Mail
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in TransWARE Active! mail 2003 build 2003.0139.0871 and earlier, and possibly other versions before 2003.0139.0939, allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Cc, and (4) Bcc…

  • CVE-2009-4351Dec 17, 2009
    Wscreator
    Wscreator
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ADMIN/loginaction.php in WSCreator 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the Email (aka username) parameter.

  • CVE-2009-4350Dec 17, 2009
    Arctic
    Issue Tracker
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Arctic Issue Tracker 2.1.1 allows remote attackers to execute arbitrary SQL commands via the (1) matchings[id] or (2) matchings[title] parameters in a Login action to an unspecified program, or (3) the matchings[id] parameter in a…

  • CVE-2009-4349Dec 17, 2009
    PHP Web Scripts
    Link Up Gold
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in administration/administrators.php in Link Up Gold 5.0 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.

  • CVE-2009-4348Dec 17, 2009
    Harold Bakker
    Hb Ns
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Harold Bakker's NewsScript (HB-NS) 1.3 allows remote attackers to inject arbitrary web script or HTML via the topic parameter in a topic action, a different vector than CVE-2006-2146.

  • CVE-2009-4347Dec 17, 2009
    DaloRADIUS
    daloRADIUS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in daloradius-users/login.php in daloRADIUS 0.9-8 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter.

  • CVE-2009-4346Dec 17, 2009
    TYPO3
    fe_rtenews
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Frontend news submitter with RTE (fe_rtenews) extension 1.4.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4345Dec 17, 2009
    TYPO3
    vShoutbox
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the vShoutbox (vshoutbox) extension 0.0.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4344Dec 17, 2009
    TYPO3
    ZID Linkliste
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the ZID Linkliste (zid_linklist) extension 1.0.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4343Dec 17, 2009
    TYPO3
    Training Company Database
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Training Company Database (trainincdb) extension 0.4.7 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4342Dec 17, 2009
    TYPO3
    Job Exchange
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Job Exchange (jobexchange) extension 0.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2009-4341Dec 17, 2009
    TYPO3
    No indexed Search
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the No indexed Search (no_indexed_search) extension 0.2.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2009-4340Dec 17, 2009
    TYPO3
    No indexed Search
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the No indexed Search (no_indexed_search) extension 0.2.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4339Dec 17, 2009
    TYPO3
    mf_subscription
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Subscription (mf_subscription) extension 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2009-4338Dec 17, 2009
    TYPO3
    Flash SlideShow
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Flash SlideShow (slideshow) extension 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2009-4337Dec 17, 2009
    TYPO3
    pd_calendar
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the Diocese of Portsmouth Calendar (pd_calendar) extension 0.4.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors, a different issue than CVE-2008-6691.

  • CVE-2009-4336Dec 17, 2009
    TYPO3
    pd_calendar
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Diocese of Portsmouth Calendar (pd_calendar) extension 0.4.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-3987Dec 17, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The GeckoActiveXObject function in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, generates different exception messages depending on whether the referenced COM object is listed in the registry, which allows remote attackers to obtain…

  • CVE-2009-3986Dec 17, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to execute arbitrary JavaScript with chrome privileges by leveraging a reference to a chrome window from a content window, related to the window.opener property.

  • CVE-2009-3985Dec 17, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to associate spoofed content with an invalid URL by setting document.location to this URL, and then writing arbitrary web script or HTML to the associated blank document, a…

  • CVE-2009-3984Dec 17, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to spoof an SSL indicator for an http URL or a file URL by setting document.location to an https URL corresponding to a site that responds with a No Content (aka 204) status…

  • CVE-2009-3983Dec 17, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to send authenticated requests to arbitrary applications by replaying the NTLM credentials of a browser user.

  • CVE-2009-3982Dec 17, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via…

  • CVE-2009-3981Dec 17, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the browser engine in Mozilla Firefox before 3.0.16, SeaMonkey before 2.0.1, and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

  • CVE-2009-3980Dec 17, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown…

  • CVE-2009-3979Dec 17, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary…

  • CVE-2009-3389Dec 17, 2009
    Xiph.Org
    libtheora
    risk 0.00cvss —epss 0.05

    Integer overflow in libtheora in Xiph.Org Theora before 1.1, as used in Mozilla Firefox 3.5 before 3.5.6 and SeaMonkey before 2.0.1, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a video with large dimensions.

  • CVE-2009-3388Dec 17, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    liboggplay in Mozilla Firefox 3.5.x before 3.5.6 and SeaMonkey before 2.0.1 might allow context-dependent attackers to cause a denial of service (application crash) or execute arbitrary code via unspecified vectors, related to "memory safety issues."

  • CVE-2009-4138Dec 16, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    drivers/firewire/ohci.c in the Linux kernel before 2.6.32-git9, when packet-per-buffer mode is used, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unknown other impact via an unspecified ioctl associated with…

  • CVE-2009-4335Dec 16, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in bundled stored procedures in the Spatial Extender component in IBM DB2 9.5 before FP5 have unknown impact and remote attack vectors, related to "remote exploits."

  • CVE-2009-4334Dec 16, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.00

    The Self Tuning Memory Manager (STMM) component in IBM DB2 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 uses 0666 permissions for the STMM log file, which allows local users to cause a denial of service or have unspecified other impact by writing to this file.