VYPR

CVEs

345,769 total · page 6124 of 6,916

AllCriticalHighKEV
  • CVE-2009-4333Dec 16, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.01

    The Relational Data Services component in IBM DB2 9.5 before FP5 allows attackers to obtain the password argument from the SET ENCRYPTION PASSWORD statement via vectors involving the GET SNAPSHOT FOR DYNAMIC SQL command.

  • CVE-2009-4332Dec 16, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    db2pd in the Problem Determination component in IBM DB2 9.1 before FP7 and 9.5 before FP5 allows attackers to cause a denial of service (NULL pointer dereference and application termination) via unspecified vectors.

  • CVE-2009-4331Dec 16, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.01

    The Install component in IBM DB2 9.5 before FP5 and 9.7 before FP1 configures the High Availability (HA) scripts with incorrect file-permission and authorization settings, which has unknown impact and local attack vectors.

  • CVE-2009-4330Dec 16, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in db2licm in the Engine Utilities component in IBM DB2 9.5 before FP5 has unknown impact and local attack vectors.

  • CVE-2009-4329Dec 16, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Engine Utilities component in IBM DB2 9.5 before FP5 allows remote authenticated users to cause a denial of service (segmentation fault) by modifying the db2ra data stream sent in a request from the Load Utility.

  • CVE-2009-4328Dec 16, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the DRDA Services component in IBM DB2 9.5 before FP5 allows remote authenticated users to cause a denial of service (server trap) by calling a SQL stored procedure in unknown circumstances.

  • CVE-2009-4327Dec 16, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    The Common Code Infrastructure component in IBM DB2 9.5 before FP5 and 9.7 before FP1 does not properly validate the size of a memory pool during a creation attempt, which allows attackers to cause a denial of service (memory consumption) via unspecified vectors.

  • CVE-2009-4326Dec 16, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    The RAND scalar function in the Common Code Infrastructure component in IBM DB2 9.5 before FP5 and 9.7 before FP1, when the Database Partitioning Feature (DPF) is used, produces "repeating" return values, which might allow attackers to defeat protection mechanisms based on…

  • CVE-2009-4325Dec 16, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.03

    The Client Interfaces component in IBM DB2 8.2 before FP18, 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 does not validate an unspecified pointer, which allows attackers to overwrite "external memory" via unknown vectors, related to a missing "check for null pointers."

  • CVE-2009-3731Dec 16, 2009
    VMware
    Server
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x…

  • CVE-2009-4305Dec 16, 2009
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an "escaping issue when processing AICC CRS file (Course_Title)."

  • CVE-2009-4304Dec 16, 2009
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not use a random password salt in config.php, which makes it easier for attackers to conduct brute-force password guessing attacks.

  • CVE-2009-4303Dec 16, 2009
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores (1) password hashes and (2) unspecified "secrets" in backup files, which might allow attackers to obtain sensitive information.

  • CVE-2009-4302Dec 16, 2009
    Moodle
    Moodle
    risk 0.00cvss —epss 0.03

    login/index_form.html in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 links to an index page on the HTTP port even when the page is served from an HTTPS port, which might cause login credentials to be sent in cleartext, even when SSL is intended, and allows remote attackers to…

  • CVE-2009-4301Dec 16, 2009
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    mnet/lib.php in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7, when MNET services are enabled, does not properly check permissions, which allows remote authenticated servers to execute arbitrary MNET functions.

  • CVE-2009-4300Dec 16, 2009
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    Multiple unspecified authentication plugins in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 store the MD5 hashes for passwords in the user table, even when the cached hashes are not used by the plugin, which might make it easier for attackers to obtain credentials via…

  • CVE-2009-4299Dec 16, 2009
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    mod/glossary/showentry.php in the Glossary module for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not properly perform access control, which allows attackers to read unauthorized Glossary entries via unknown vectors.

  • CVE-2009-4298Dec 16, 2009
    Moodle
    Moodle
    risk 0.00cvss —epss 0.02

    The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the (1) username, (2) firstname, and (3) lastname fields within the user table, which allows attackers to obtain user account information via unknown vectors.

  • CVE-2009-4297Dec 16, 2009
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2008-7248Dec 16, 2009
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.08

    Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated…

  • CVE-2009-4136Dec 15, 2009
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.04

    PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated…

  • CVE-2009-4034Dec 15, 2009
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.02

    PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows…

  • CVE-2009-3554Dec 15, 2009
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.00cvss —epss 0.00

    Twiddle in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by…

  • CVE-2009-2405Dec 15, 2009
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in the Web Console in the Application Server in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2.0 before 4.2.0.CP08, 4.2.2GA, 4.3 before 4.3.0.CP07, and 5.1.0GA allow remote attackers to inject…

  • CVE-2009-1380Dec 15, 2009
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter,…

  • CVE-2009-4324HigKEVDec 15, 2009
    Adobe Inc.
    Acrobat
    risk 0.72cvss 7.8epss 0.82

    Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as…

  • CVE-2009-4323Dec 14, 2009
    Zen Cart
    ZenCart
    risk 0.00cvss —epss 0.03

    The installation for Zen Cart stores sensitive information and insecure programs under the (1) docs, (2) extras, and (3) zc_install folders, and (4) install.txt, which allows remote attackers to obtain sensitive information, delete the database, and conduct other attacks via a…

  • CVE-2009-4322Dec 14, 2009
    Zen Cart
    ZenCart
    risk 0.00cvss —epss 0.01

    extras/ipn_test_return.php in Zen Cart allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message.

  • CVE-2009-4321Dec 14, 2009
    Zen Cart
    ZenCart
    risk 0.00cvss —epss 0.02

    extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4320Dec 14, 2009
    TNG
    TNG
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in searchform.php in The Next Generation of Genealogy Sitebuilding (TNG) 7.1.2 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2009-4319Dec 14, 2009
    Eocms
    Eocms
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in js/bbcodepress/bbcode-form.php in eoCMS 0.9.03 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the BBCODE_path parameter.

  • CVE-2009-4318Dec 14, 2009
    Webcodingplace
    Real Estate Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Real Estate Manager 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4317Dec 14, 2009
    Scriptsez
    Ez Cart
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez Cart allows remote attackers to inject arbitrary web script or HTML via the sid parameter in a showcat action.

  • CVE-2009-4316Dec 14, 2009
    Zeeways
    Zeelyrics
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in searchresults_main.php in ZeeLyrics 3x allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2009-4315Dec 14, 2009
    Nuggetz
    Nuggetz CMS
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in admin/ajaxsave.php in Nuggetz CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to create or modify arbitrary files via a .. (dot dot) in the nugget parameter and a modified pagevalue parameter, as demonstrated by creating…

  • CVE-2009-4314Dec 14, 2009
    Sun Corporation
    Ray Server Software
    risk 0.00cvss —epss 0.00

    Sun Ray Server Software 4.1 on Solaris 10, when Automatic Multi-Group Hotdesking (AMGH) is enabled, responds to a logout action by immediately logging the user in again, which makes it easier for physically proximate attackers to obtain access to a session by going to an…

  • CVE-2009-4130Dec 14, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Visual truncation vulnerability in the MakeScriptDialogTitle function in nsGlobalWindow.cpp in Mozilla Firefox allows remote attackers to spoof the origin domain name of a script via a long name.

  • CVE-2009-4129Dec 14, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Race condition in Mozilla Firefox allows remote attackers to produce a JavaScript message with a spoofed domain association by writing the message in between the document request and document load for a web page in a different domain.

  • CVE-2009-4313Dec 13, 2009
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.21

    ir32_32.dll 3.24.15.3 in the Indeo32 codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to cause a denial of service (heap corruption) or execute arbitrary code via malformed data in a stream in a media file, as demonstrated by an…

  • CVE-2009-4312Dec 13, 2009
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.21

    Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted media content, as reported to Microsoft by Dave Lenoe of Adobe.

  • CVE-2009-4311Dec 13, 2009
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.22

    Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted media content, as reported to Microsoft by Paul Byrne of NGS Software. NOTE: this might overlap…

  • CVE-2009-4310Dec 13, 2009
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.24

    Stack-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted compressed video data in an IV41 stream in a media file, leading to…

  • CVE-2009-4309Dec 13, 2009
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.24

    Heap-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via a large size value in a movi record in an IV41 stream in a media file, as…

  • CVE-2009-4308Dec 13, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only…

  • CVE-2009-4307Dec 13, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size…

  • CVE-2009-4306Dec 13, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel 2.6.32-git6 and earlier allows local users to cause a denial of service (filesystem corruption) via unknown vectors, a different vulnerability…

  • CVE-2009-4210Dec 13, 2009
    Microsoft
    Windows 2000
    risk 0.01cvss —epss 0.17

    The Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted media content.

  • CVE-2009-4131Dec 13, 2009
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    The EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel before 2.6.32-git6 allows local users to overwrite arbitrary files via a crafted request, related to insufficient checks for file permissions.

  • CVE-2009-4296Dec 11, 2009
    Brian Miller
    Taxonomy Timer
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Taxonomy Timer module 5.x-1.8 and earlier and 6.x-alpha1 and earlier for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4295Dec 11, 2009
    Sun Corporation
    Ray Server Software
    risk 0.00cvss —epss 0.01

    Sun Ray Server Software 4.0 and 4.1 does not generate a unique DSA private key for the firmware on each Sun Ray 1, 1g, 100, and 150 DTU device, which makes it easier for remote attackers to obtain sensitive information by predicting a key and then using it to decrypt sniffed…