VYPR

CVEs

345,753 total · page 6129 of 6,916

AllCriticalHighKEV
  • CVE-2009-4022Nov 25, 2009
    Isc
    Bind
    risk 0.01cvss —epss 0.08

    Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by…

  • CVE-2009-4021Nov 25, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The fuse_direct_io function in fs/fuse/file.c in the fuse subsystem in the Linux kernel before 2.6.32-rc7 might allow attackers to cause a denial of service (invalid pointer dereference and OOPS) via vectors possibly related to a memory-consumption attack.

  • CVE-2009-3033Nov 25, 2009
    Symantec
    Management Platform
    risk 0.06cvss —epss 0.40

    Buffer overflow in the RunCmd method in the Altiris eXpress NS Console Utilities ActiveX control in AeXNSConsoleUtilities.dll in the web console in Symantec Altiris Deployment Solution 6.9.x, Altiris Notification Server 6.0.x, and Management Platform 7.0.x allows remote…

  • CVE-2009-4073Nov 24, 2009
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    The printing functionality in Microsoft Internet Explorer 8 allows remote attackers to discover a local pathname, and possibly a local username, by reading the dc:title element of a PDF document that was generated from a local web page.

  • CVE-2009-4072Nov 24, 2009
    Opera
    Opera Browser
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Opera before 10.10 has unknown impact and attack vectors, related to a "moderately severe issue."

  • CVE-2009-4071Nov 24, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 10.10, when exception stacktraces are enabled, places scripting error messages from a web site into variables that can be read by a different web site, which allows remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via…

  • CVE-2009-4070Nov 24, 2009
    GForge
    Gforge
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in GForge 4.5.14, 4.7.3, and possibly other versions allows remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2009-4069Nov 24, 2009
    GForge
    Gforge
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in GForge 4.5.14, 4.7.3, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-3898Nov 24, 2009
    Nginx
    Nginx
    risk 0.04cvss —epss 0.18

    Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV…

  • CVE-2009-3897MedNov 24, 2009
    Dovecot (software)
    Dovecot
    risk 0.36cvss 5.5epss 0.00

    Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the…

  • CVE-2009-3896Nov 24, 2009
    Nginx
    Nginx
    risk 0.01cvss —epss 0.11

    src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.

  • CVE-2009-3578Nov 24, 2009
    Autodesk
    Alias Wavefront Maya
    risk 0.03cvss —epss 0.04

    Autodesk Maya 8.0, 8.5, 2008, 2009, and 2010 and Alias Wavefront Maya 6.5 and 7.0 allow remote attackers to execute arbitrary code via a (1) .ma or (2) .mb file that uses the Maya Embedded Language (MEL) python command or unspecified other MEL commands, related to "Script Nodes."

  • CVE-2009-3577Nov 24, 2009
    Autodesk
    3D Studio Max
    risk 0.03cvss —epss 0.05

    Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method, related to "application callbacks."

  • CVE-2009-3576Nov 24, 2009
    Autodesk
    Softimage
    risk 0.03cvss —epss 0.03

    Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the WScript.Shell ActiveX…

  • CVE-2009-3303Nov 24, 2009
    GForge
    Gforge
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in www/help/tracker.php in GForge 4.5.14, 4.7 rc2, and 4.8.1 allows remote attackers to inject arbitrary web script or HTML via the helpname parameter.

  • CVE-2009-4066Nov 24, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the "My Account" feature in PHPList Integration module 5 before 5.x-1.2 and 6 before 6.x-1.1 for Drupal allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) subscribing or…

  • CVE-2009-4065Nov 24, 2009
    Drupal
    Strongarm
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the settings page in the Strongarm module 6.x before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via the value field when viewing overridden variables.

  • CVE-2009-4064Nov 24, 2009
    Drupal
    Gallery Assist
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Gallery Assist module 6.x before 6.x-1.7 for Drupal allows remote attackers to inject arbitrary web script or HTML via node titles.

  • CVE-2009-4063Nov 24, 2009
    Drupal
    Subgroups for Organic Groups (OG)
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Subgroups for Organic Groups (OG) module 5.x before 5.x-4.0 and 5.x before 5.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified node titles.

  • CVE-2009-4062Nov 24, 2009
    Drupal
    Printfriendly
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Printfriendly module 6.x before 6.x-1.6 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4061Nov 24, 2009
    Drupal
    Agreement
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Agreement module 6.x before 6.x-1.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4060Nov 24, 2009
    Cubecart
    Cubecart
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in includes/content/viewProd.inc.php in CubeCart before 4.3.7 remote attackers to execute arbitrary SQL commands via the productId parameter.

  • CVE-2009-4059Nov 24, 2009
    Joomclan
    Com Joomclip
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JoomClip (com_joomclip) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in a thumbs action to index.php.

  • CVE-2009-4058Nov 24, 2009
    Telebid
    Auction Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in allauctions.php in Telebid Auction Script allows remote attackers to execute arbitrary SQL commands via the aid parameter.

  • CVE-2009-4057Nov 24, 2009
    Inertialfate
    iF Portfolio Nexus
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an item action to index.php.

  • CVE-2009-4056Nov 24, 2009
    Betsy
    Betsy CMS
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in admin/popup.php in Betsy CMS 3.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the popup parameter.

  • CVE-2009-4017Nov 24, 2009
    PHP
    PHP
    risk 0.04cvss —epss 0.12

    PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to…

  • CVE-2009-3843Nov 24, 2009
    Microfocus
    Operations Manager
    risk 0.09cvss —epss 0.79

    HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby execute arbitrary code, by using the org.apache.catalina.manager.HTMLManagerServle…

  • CVE-2009-4053MedNov 23, 2009
    Home FTP Server Project
    Home Ftp Server
    risk 0.46cvss 6.5epss 0.04

    Multiple directory traversal vulnerabilities in Home FTP Server 1.10.1.139 allow remote authenticated users to (1) create arbitrary directories via directory traversal sequences in an MKD command or (2) create files with any contents in arbitrary directories via directory…

  • CVE-2009-4052Nov 23, 2009
    IBM
    Rational Application Developer For Websphere
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the JSF Widget Library Runtime in IBM Rational Application Developer for WebSphere Software before 7.0.0.10 and Rational Software Architect before 7.0.0.10 allow remote attackers to inject arbitrary web script or HTML via…

  • CVE-2009-4051Nov 23, 2009
    Home FTP Server Project
    Home Ftp Server
    risk 0.03cvss —epss 0.06

    Home FTP Server 1.10.1.139 allows remote attackers to cause a denial of service (daemon outage) via multiple invalid SITE INDEX commands.

  • CVE-2009-4050Nov 23, 2009
    Phpmybackuppro
    Phpmybackuppro
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2009-4049Nov 23, 2009
    Avast\!
    aswRdr.sys
    risk 0.03cvss —epss 0.01

    Heap-based buffer overflow in aswRdr.sys (aka the TDI RDR driver) in avast! Home and Professional 4.8.1356.0 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via crafted arguments to IOCTL 0x80002024.

  • CVE-2009-4048Nov 23, 2009
    Dxmsoft
    Xm Easy Personal FTP Server
    risk 0.03cvss —epss 0.02

    Dxmsoft XM Easy Personal FTP Server 5.8.0 allows remote authenticated users to cause a denial of service (daemon outage) via an APPE command to one socket in conjunction with a DELE command to a second socket.

  • CVE-2009-4047Nov 23, 2009
    P Hd
    Phd Help Desk
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in PHD Help Desk 1.43 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to area.php; the (2) pagina, (3) sentido, (4) q_registros, and (5) orden parameters to area.php; (6) the q_registros…

  • CVE-2009-3559Nov 23, 2009
    PHP
    PHP
    risk 0.00cvss —epss 0.03

    main/streams/plain_wrapper.c in PHP 5.3.x before 5.3.1 does not recognize the safe_mode_include_dir directive, which allows context-dependent attackers to have an unknown impact by triggering the failure of PHP scripts that perform include or require operations, as demonstrated…

  • CVE-2009-3558Nov 23, 2009
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The posix_mkfifo function in ext/posix/posix.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass open_basedir restrictions, and create FIFO files, via the pathname and mode arguments, as demonstrated by creating a .htaccess file.

  • CVE-2009-3557Nov 23, 2009
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The tempnam function in ext/standard/file.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass safe_mode restrictions, and create files in group-writable or world-writable directories, via the dir and prefix arguments.

  • CVE-2009-4046Nov 20, 2009
    Frontaccounting
    Frontaccounting
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_accounts.php, (2) currencies.php, (3) exchange_rates.php, (4) gl_account_types.php, and (5)…

  • CVE-2009-4045Nov 20, 2009
    Frontaccounting
    Frontaccounting
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to various .inc and .php files in (1) reporting/, (2) sales/, (3) sales/includes/, (4) sales/includes/db/, (5)…

  • CVE-2009-4044Nov 20, 2009
    Drupal
    Web Services
    risk 0.00cvss —epss 0.01

    The Web Services module 6.x for Drupal does not perform the expected access control, which allows remote attackers to make unspecified use of an API via unknown vectors.

  • CVE-2009-4043Nov 20, 2009
    Drupal
    AddToAny
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the AddToAny module 5.x before 5.x-2.4 and 6.x before 6.x-2.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via a node title.

  • CVE-2009-4042Nov 20, 2009
    Drupal
    RootCandy
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the RootCandy theme 6.x before 6.x-1.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via the URI.

  • CVE-2009-4041Nov 20, 2009
    Usebb
    Usebb
    risk 0.00cvss —epss 0.02

    UseBB 1.0.9 before 1.0.10 allows remote attackers to cause a denial of service (infinite loop) via crafted BBCode tags.

  • CVE-2009-4040Nov 20, 2009
    PhpMyAdmin
    Phpmyfaq
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.0.17 and 2.5.x before 2.5.2, when used with Internet Explorer 6 or 7, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to the search page.

  • CVE-2009-4039Nov 20, 2009
    Piwigo
    Piwigo
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Piwigo before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4038Nov 20, 2009
    Nch
    Axon Virtual Pbx
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in NCH Software Axon Virtual PBX 2.10 and 2.11 allow remote attackers to inject arbitrary web script or HTML via the (1) onok or (2) oncancel parameter to the logon program. NOTE: the provenance of this information is unknown;…

  • CVE-2009-4037Nov 20, 2009
    Frontaccounting
    Frontaccounting
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7, and 2.2.x before 2.2 RC, allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) admin/db/users_db.inc, and various other .inc and .php files under (2) admin/, (3)…

  • CVE-2005-4883Nov 20, 2009
    Philippe Jounin
    Tftpd32
    risk 0.00cvss —epss 0.01

    Race condition in Philippe Jounin Tftpd32 before 2.80 allows remote attackers to cause a denial of service (daemon crash) via invalid "connect frames."

  • CVE-2005-4882Nov 20, 2009
    Philippe Jounin
    Tftpd32
    risk 0.00cvss —epss 0.02

    tftpd in Philippe Jounin Tftpd32 2.74 and earlier, as used in Wyse Simple Imager (WSI) and other products, allows remote attackers to cause a denial of service (daemon crash) via a long filename in a TFTP read (aka RRQ or get) request, a different vulnerability than…