VYPR

CVEs

345,753 total · page 6127 of 6,916

AllCriticalHighKEV
  • CVE-2009-4186Dec 3, 2009
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.07

    Stack consumption vulnerability in Apple Safari 4.0.3 on Windows allows remote attackers to cause a denial of service (application crash) via a long URI value (aka url) in the Cascading Style Sheets (CSS) background property.

  • CVE-2009-1567Dec 3, 2009
    Lateral Arts
    Photobox uploader
    risk 0.00cvss —epss 0.05

    Multiple stack-based buffer overflows in the Lateral Arts Photobox uploader ActiveX control 1.x before 1.3, and 2.2.0.6, allow remote attackers to execute arbitrary code via a long URL string for the (1) LogURL, (2) ConnectURL, (3) SkinURL, (4) AlbumCreateURL, (5) ErrorURL, or…

  • CVE-2009-0895Dec 3, 2009
    Novell
    Edirectory
    risk 0.01cvss —epss 0.07

    Integer overflow in Novell eDirectory 8.7.3.x before 8.7.3.10 ftf2 and 8.8.x before 8.8.5.2 allows remote attackers to execute arbitrary code via an NDS Verb 0x1 request containing a large integer value that triggers a heap-based buffer overflow.

  • CVE-2009-4175Dec 2, 2009
    Cutephp
    Cutenews
    risk 0.03cvss —epss 0.03

    CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to obtain sensitive information via an invalid date value in the from_date_day parameter to search.php, which reveals the installation path in an error message.

  • CVE-2009-4174Dec 2, 2009
    Cutephp
    Cutenews
    risk 0.03cvss —epss 0.02

    The editnews module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b, when magic_quotes_gpc is disabled, allows remote authenticated users with Journalist or Editor access to bypass administrative moderation and edit previously submitted articles via a modified id…

  • CVE-2009-4173Dec 2, 2009
    Cutephp
    Cutenews
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to hijack the authentication of administrators for requests that create new users, including a new administrator, via an adduser action in the editusers…

  • CVE-2009-4172Dec 2, 2009
    Cutephp
    Cutenews
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews 8 and 8b, when magic_quotes_gpc is disabled, allows remote attackers to inject arbitrary web script or HTML via the body of a news article in an addnews action.

  • CVE-2009-4171Dec 2, 2009
    Yahoo
    Messenger
    risk 0.03cvss —epss 0.05

    An ActiveX control in YahooBridgeLib.dll for Yahoo! Messenger 9.0.0.2162, and possibly other 9.0 versions, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by calling the RegisterMe method with a long argument.

  • CVE-2009-4147Dec 2, 2009
    FreeBSD
    FreeBSD
    risk 0.03cvss —epss 0.04

    The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1 and 8.0 does not clear the (1) LD_LIBMAP, (2) LD_LIBRARY_PATH, (3) LD_LIBMAP_DISABLE, (4) LD_DEBUG, and (5) LD_ELF_HINTS_PATH environment variables, which allows local users to gain…

  • CVE-2009-4127Dec 2, 2009
    Wikipedia
    Wikipedia Toolbar
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Wikipedia Toolbar extension before 0.5.9.2 for Firefox allows user-assisted remote attackers to execute arbitrary JavaScript with Chrome privileges via vectors involving unspecified Toolbar buttons and the eval function. NOTE: the provenance of this…

  • CVE-2009-4170Dec 2, 2009
    WordPress
    WP-Cumulus
    risk 0.04cvss —epss 0.06

    WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.php, probably without parameters, which reveals the installation path in an error message.

  • CVE-2009-4169Dec 2, 2009
    WordPress
    WP-Cumulus
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in before 1.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4168Dec 2, 2009
    Joomla
    Joomulus
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags…

  • CVE-2009-4146Dec 2, 2009
    FreeBSD
    FreeBSD
    risk 0.03cvss —epss 0.04

    The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1, 7.2, and 8.0 does not clear the LD_PRELOAD environment variable, which allows local users to gain privileges by executing a setuid or setguid program with a modified LD_PRELOAD…

  • CVE-2009-4167Dec 2, 2009
    TYPO3
    Automatic Base Tags for RealUrl
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Automatic Base Tags for RealUrl (lt_basetag) extension 1.0.0 for TYPO3 allows remote attackers to conduct "Cache spoofing" attacks via unspecified vectors.

  • CVE-2009-4166Dec 2, 2009
    TYPO3
    mchtrips
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Trips (mchtrips) extension 2.0.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4165Dec 2, 2009
    Simple Glossar
    Simple Glossar
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the simple Glossar (simple_glossar) extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4164Dec 2, 2009
    Simple Glossar
    Simple Glossar
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the simple Glossar (simple_glossar) extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4163Dec 2, 2009
    Tw Productfinder
    Tw Productfinder
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the TW Productfinder (tw_productfinder) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4162Dec 2, 2009
    TYPO3
    DB Integration (wfqbe)
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the DB Integration (wfqbe) extension 1.3.1 and earlier for TYPO3 allows local users to execute arbitrary commands via unspecified vectors.

  • CVE-2009-4161Dec 2, 2009
    TYPO3
    AN Search it!
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the [AN] Search it! (an_searchit) extension 2.4.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4160Dec 2, 2009
    Kurt Kunig
    Kk Downloader
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Simple download-system with counter and categories (kk_downloader) extension 1.2.1 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.

  • CVE-2009-4159Dec 2, 2009
    Dkd
    Direct Mail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the newsletter configuration feature in the backend module in the Direct Mail (direct_mail) extension 2.6.4 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4158Dec 2, 2009
    TYPO3
    Calendar Base
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Calendar Base (cal) extension before 1.2.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4157Dec 2, 2009
    Joomlatune
    Com Proofreader
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in the ProofReader (com_proofreader) component 1.0 RC9 and earlier for Joomla! allow remote attackers to inject arbitrary web script or HTML via the URI, which is not properly handled in (1) 404 or (2) error pages.

  • CVE-2009-4156Dec 2, 2009
    Ciamos
    Ciamos CMS
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in modules/pms/index.php in Ciamos CMS 0.9.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the module_path parameter.

  • CVE-2009-4155Dec 2, 2009
    Eshopbuilder
    Eshopbuilde CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Eshopbuilde CMS allow remote attackers to execute arbitrary SQL commands via the sitebid parameter to (1) home-f.asp and (2) opinions-f.asp; (3) sitebid, (4) id, (5) secText, (6) client-ip, and (7) G_id parameters to more-f.asp; (8)…

  • CVE-2009-4154Dec 2, 2009
    Elxis
    CMS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in includes/feedcreator.class.php in Elxis CMS allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.

  • CVE-2009-4153Dec 2, 2009
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the XMLAccess component in IBM WebSphere Portal 6.1.x before 6.1.0.3 has unknown impact and attack vectors, related to the work directory.

  • CVE-2009-4152Dec 2, 2009
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Collaboration component in IBM WebSphere Portal 6.1.x before 6.1.0.3 allows remote attackers to inject arbitrary web script or HTML via the people picker tag.

  • CVE-2009-4151Dec 2, 2009
    Bestpractical
    Rt
    risk 0.00cvss —epss 0.02

    Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 and 3.8.x through 3.8.5 allows remote attackers to hijack web sessions by setting the session identifier via a manipulation that leverages "HTTP access to the RT…

  • CVE-2009-4027Dec 2, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.02

    Race condition in the mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of service (system crash) via a Delete Block ACK (aka DELBA) packet that triggers a certain state change in the absence of an aggregation…

  • CVE-2009-4026Dec 2, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    The mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of service (panic) via a crafted Delete Block ACK (aka DELBA) packet, related to an erroneous "code shuffling patch."

  • CVE-2009-3585Dec 2, 2009
    Bestpractical
    Rt
    risk 0.00cvss —epss 0.03

    Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 and 3.8.x through 3.8.5 allows remote attackers to hijack web sessions by setting the session identifier via a manipulation that leverages a second web server…

  • CVE-2009-2686Dec 2, 2009
    Microfocus
    NonStop
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in HP NonStop G06.12.00 through G06.32.00, H06.08.00 through H06.18.01, and J06.04.00 through J06.07.01 allows local users to gain privileges, cause a denial of service, or obtain "access to data" via unknown vectors.

  • CVE-2009-4150Dec 2, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.00

    dasauto in IBM DB2 8 before FP18, 9.1 before FP8, 9.5 before FP4, and 9.7 before FP1 permits execution by unprivileged user accounts, which has unspecified impact and local attack vectors.

  • CVE-2009-4055Dec 2, 2009
    Asterisk
    Business Edition
    risk 0.00cvss —epss 0.03

    rtp.c in Asterisk Open Source 1.2.x before 1.2.37, 1.4.x before 1.4.27.1, 1.6.0.x before 1.6.0.19, and 1.6.1.x before 1.6.1.11; Business Edition B.x.x before B.2.5.13, C.2.x.x before C.2.4.6, and C.3.x.x before C.3.2.3; and s800i 1.3.x before 1.3.0.6 allows remote attackers to…

  • CVE-2009-3672Dec 2, 2009
    Microsoft
    Internet Explorer
    risk 0.09cvss —epss 0.72

    Microsoft Internet Explorer 6 and 7 does not properly handle objects in memory that (1) were not properly initialized or (2) are deleted, which allows remote attackers to execute arbitrary code via vectors involving a call to the getElementsByTagName method for the STYLE tag…

  • CVE-2009-4128Dec 1, 2009
    GNU
    Grub2
    risk 0.00cvss —epss 0.01

    GNU GRand Unified Bootloader (GRUB) 2 1.97 only compares the submitted portion of a password with the actual password, which makes it easier for physically proximate attackers to conduct brute force attacks and bypass authentication by submitting a password whose length is 1.

  • CVE-2009-2626Dec 1, 2009
    PHP
    PHP
    risk 0.04cvss —epss 0.08

    The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the ini_set function to declare a variable, then using the…

  • CVE-2009-4121Dec 1, 2009
    Open Solution
    Quick.CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Quick.CMS 2.4 and Quick.CMS.Lite 2.4 allow remote attackers to hijack the authentication of the administrator for requests that (1) delete web pages via a p-delete action to admin.php, and possibly (2) delete products…

  • CVE-2009-4120Dec 1, 2009
    Open Solution
    Quick.cart
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Quick.Cart 3.4 allow remote attackers to hijack the authentication of the administrator for requests that (1) delete orders via an orders-delete action to admin.php, and possibly (2) delete products or (3) delete…

  • CVE-2009-4119Dec 1, 2009
    Drupal
    Feed Element Mapper
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Feed Element Mapper module 5.x before 5.x-1.3, 6.x before 6.x-1.3, and 6.x-2.0-alpha before 6.x-2.0-alpha4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4118Dec 1, 2009
    Cisco Systems, Inc.
    VPN Client
    risk 0.03cvss —epss 0.03

    The StartServiceCtrlDispatcher function in the cvpnd service (cvpnd.exe) in Cisco VPN client for Windows before 5.0.06.0100 does not properly handle an ERROR_FAILED_SERVICE_CONTROLLER_CONNECT error, which allows local users to cause a denial of service (service crash and VPN…

  • CVE-2009-4117Dec 1, 2009
    MuPDF
    MuPDF
    risk 0.04cvss —epss 0.08

    Multiple stack-based buffer overflows in pdf_shade4.c in MuPDF before commit 20091125231942, as used in SumatraPDF before 1.0.1, allow remote attackers to cause a denial of service and possibly execute arbitrary code via a /Decode array for certain types of shading that are not…

  • CVE-2009-4116Nov 30, 2009
    Cutephp
    Cutenews
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in CutePHP CuteNews 1.4.6, when magic_quotes_gpc is disabled, allow remote authenticated users with editor or administrative application access to read arbitrary files via a .. (dot dot) in the source parameter in a (1) list or (2)…

  • CVE-2009-4115Nov 30, 2009
    Cutephp
    Cutenews
    risk 0.03cvss —epss 0.02

    Multiple static code injection vulnerabilities in the Categories module in CutePHP CuteNews 1.4.6 allow remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the (1) category and (2) Icon URL fields; or…

  • CVE-2009-4114Nov 30, 2009
    Kaspersky Lab
    Anti Virus
    risk 0.03cvss —epss 0.01

    kl1.sys in Kaspersky Anti-Virus 2010 9.0.0.463, and possibly other versions before 9.0.0.736, does not properly validate input to IOCTL 0x0022c008, which allows local users to cause a denial of service (system crash) via IOCTL requests using crafted kernel addresses that trigger…

  • CVE-2009-4113Nov 30, 2009
    Cutephp
    Cutenews
    risk 0.00cvss —epss 0.01

    Static code injection vulnerability in the Categories module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the Category Access field.

  • CVE-2009-4112Nov 30, 2009
    Cacti (software)
    Cacti
    risk 0.00cvss —epss 0.11

    Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.