VYPR

CVEs

345,753 total · page 6132 of 6,916

AllCriticalHighKEV
  • CVE-2009-2823Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    The Apache HTTP Server in Apple Mac OS X before 10.6.2 enables the HTTP TRACE method, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified web client software.

  • CVE-2009-2820Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.03cvss —epss 0.06

    The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks…

  • CVE-2009-2819Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    AFP Client in Apple Mac OS X 10.5.8 allows remote AFP servers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via unspecified vectors.

  • CVE-2009-2818Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Adaptive Firewall in Apple Mac OS X before 10.6.2 does not properly handle invalid usernames in SSH login attempts, which makes it easier for remote attackers to obtain login access via a brute-force attack (aka dictionary attack).

  • CVE-2009-2810Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Launch Services in Apple Mac OS X 10.6.x before 10.6.2 recursively clears quarantine information upon opening a quarantined folder, which allows user-assisted remote attackers to execute arbitrary code via a quarantined application that does not trigger a "potentially unsafe"…

  • CVE-2009-2808Nov 10, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Help Viewer in Apple Mac OS X before 10.6.2 does not use an HTTPS connection to retrieve Apple Help content from a web site, which allows man-in-the-middle attackers to send a crafted help:runscript link, and thereby execute arbitrary code, via a spoofed response.

  • CVE-2009-3727Nov 10, 2009
    Asterisk
    Asterisknow
    risk 0.00cvss —epss 0.04

    Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, 1.6.0.x before 1.6.0.17, and 1.6.1.x before 1.6.1.9; Business Edition A.x.x, B.x.x before B.2.5.12, C.2.x.x before C.2.4.5, and C.3.x.x before C.3.2.2; AsteriskNOW 1.5; and s800i 1.3.x before 1.3.0.5 generate…

  • CVE-2009-3924Nov 10, 2009
    Punkbuster
    Punkbuster
    risk 0.00cvss —epss 0.04

    Buffer overflow in pbsv.dll, as used in Soldier of Fortune II and possibly other applications when Even Balance PunkBuster 1.728 or earlier is enabled, allows remote attackers to cause a denial of service (application server crash) and possibly execute arbitrary code via a long…

  • CVE-2009-3619Nov 10, 2009
    Viewvc
    Viewvc
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 has unknown impact and remote attack vectors related to "printing illegal parameter names and values."

  • CVE-2009-3618Nov 10, 2009
    Viewvc
    Viewvc
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in viewvc.py in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the view parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-3923Nov 10, 2009
    Sun Corporation
    Virtualbox
    risk 0.00cvss —epss 0.02

    The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure (VDI) 3.0 does not require authentication, which allows remote attackers to obtain unspecified access via vectors involving requests to an Apache HTTP Server.

  • CVE-2009-3886Nov 9, 2009
    Sun Corporation
    Java SE 6
    risk 0.00cvss —epss 0.02

    The Java Web Start implementation in Sun Java SE 6 before Update 17 does not properly handle the interaction between a signed JAR file and a JNLP (1) application or (2) applet, which has unspecified impact and attack vectors, related to a "regression," aka Bug Id 6870531.

  • CVE-2009-3885Nov 9, 2009
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.02

    Sun Java SE 5.0 before Update 22 and 6 before Update 17 on Windows allows remote attackers to cause a denial of service via a BMP file containing a link to a UNC share pathname for an International Color Consortium (ICC) profile file, probably a related issue to CVE-2007-2789,…

  • CVE-2009-3884Nov 9, 2009
    Openjdk
    OpenJDK
    risk 0.00cvss —epss 0.03

    The TimeZone.getTimeZone method in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local files via vectors related to handling of zoneinfo (aka tz) files, aka Bug Id 6824265.

  • CVE-2009-3883Nov 9, 2009
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in the Windows Pluggable Look and Feel (PL&F) feature in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and remote attack vectors, related to "information leaks in mutable…

  • CVE-2009-3882Nov 9, 2009
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and remote attack vectors, related to "information leaks in mutable variables," aka Bug Id 6657026.

  • CVE-2009-3881Nov 9, 2009
    Openjdk
    OpenJDK
    risk 0.00cvss —epss 0.03

    Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not prevent the existence of children of a resurrected ClassLoader, which allows remote attackers to gain privileges via unspecified vectors, related to an "information leak vulnerability," aka Bug Id…

  • CVE-2009-3880Nov 9, 2009
    Sun Corporation
    Jre
    risk 0.00cvss —epss 0.02

    The Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not properly restrict the objects that may be sent to loggers, which allows attackers to obtain sensitive information via vectors…

  • CVE-2009-3879Nov 9, 2009
    Sun Corporation
    Openjdk
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in the (1) X11 and (2) Win32GraphicsDevice subsystems in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and attack vectors, related to failure to clone arrays that are returned by the…

  • CVE-2009-3729Nov 9, 2009
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the TrueType font parsing functionality in Sun Java SE 5.0 before Update 22 and 6 before Update 17 allows remote attackers to cause a denial of service (application crash) via a certain test suite, aka Bug Id 6815780.

  • CVE-2009-3728Nov 9, 2009
    Openjdk
    OpenJDK
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in the ICC_Profile.getInstance method in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local International Color Consortium (ICC)…

  • CVE-2009-3726Nov 9, 2009
    Linux
    Kernel
    risk 0.04cvss —epss 0.12

    The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes, which…

  • CVE-2009-3922Nov 9, 2009
    Drupal
    User Protect
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the User Protect module 5.x before 5.x-1.4 and 6.x before 6.x-1.3, a module for Drupal, allow remote attackers to hijack the authentication of administrators for requests that (1) delete the editing protection of a…

  • CVE-2009-3921Nov 9, 2009
    Ezra Barnett Gildesgame
    Smartqueue Og
    risk 0.00cvss —epss 0.01

    The Smartqueue_og module 5.x before 5.x-1.3 and 6.x before 6.x-1.0-rc3, a module for Drupal, does not verify group-node privileges in certain circumstances involving subqueue creation, which allows remote authenticated users to discover arbitrary organic group names by reading…

  • CVE-2009-3920Nov 9, 2009
    Drupal
    NGP COO/CWP Integration (crmngp)
    risk 0.00cvss —epss 0.01

    An administration page in the NGP COO/CWP Integration (crmngp) module 6.x before 6.x-1.12 for Drupal does not perform the expected access control, which allows remote attackers to read log information via unspecified vectors.

  • CVE-2009-3919Nov 9, 2009
    Drupal
    crmngp
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the NGP COO/CWP Integration (crmngp) module 6.x before 6.x-1.12 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified "user-supplied information."

  • CVE-2009-3918Nov 9, 2009
    Karim Ratib
    Zoomify
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Zoomify module 5.x before 5.x-2.2 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the node title.

  • CVE-2009-3917Nov 9, 2009
    Drupal
    S5 Presentation Player
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the S5 Presentation Player module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via an unspecified field that is copied to the HTML HEAD element.

  • CVE-2009-3916Nov 9, 2009
    Drupal
    Node Hierarchy
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Node Hierarchy module 5.x before 5.x-1.3 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a child node title.

  • CVE-2009-3915Nov 9, 2009
    Drupal
    Link Module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the "Separate title and URL" formatter in the Link module 5.x before 5.x-2.6 and 6.x before 6.x-2.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the link title field.

  • CVE-2009-3914Nov 9, 2009
    Drupal
    Temporary Invitation
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Temporary Invitation module 5.x before 5.x-2.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the Name field in an invitation.

  • CVE-2009-3913Nov 9, 2009
    Xerox
    Fiery Webtools
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in summary.php in Xerox Fiery Webtools allows remote attackers to execute arbitrary SQL commands via the select parameter.

  • CVE-2009-3912Nov 9, 2009
    Tftgallery
    Tftgallery
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in TFTgallery 0.13 allows remote attackers to read arbitrary files via a ..%2F (encoded dot dot slash) in the album parameter.

  • CVE-2009-3911Nov 9, 2009
    Tftgallery
    Tftgallery
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in settings.php in TFTgallery 0.13 allows remote attackers to inject arbitrary web script or HTML via the sample parameter.

  • CVE-2009-3555CriNov 9, 2009
    Apache
    HTTP Server
    risk 0.67cvss 9.8epss 0.87

    The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4…

  • CVE-2009-3905Nov 6, 2009
    Ecouriersoftware
    E Courirer CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in e-Courier CMS allow remote attackers to inject arbitrary web script or HTML via the UserGUID parameter to (1) Wizard_tracking.asp, (2) wizard_oe2.asp, (3) your-register.asp, (4) main-whyregister.asp, and (5) your.asp in…

  • CVE-2009-3904Nov 6, 2009
    Cubecart
    Cubecart
    risk 0.04cvss —epss 0.09

    classes/session/cc_admin_session.php in CubeCart 4.3.4 does not properly restrict administrative access permissions, which allows remote attackers to bypass restrictions and gain administrative access via a HTTP request that contains an empty (1) sessID (ccAdmin cookie), (2)…

  • CVE-2009-3903Nov 6, 2009
    Manageengine
    Netflow Analyzer
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in jspui/index.jsp in ManageEngine Netflow Analyzer 7.5 build 7500 allow remote attackers to inject arbitrary web script or HTML via the (1) view and (2) section parameters. NOTE: the provenance of this information is unknown;…

  • CVE-2009-3902Nov 6, 2009
    Cherokee
    Cherokee Httpd
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in Cherokee Web Server 0.5.4 and earlier for Windows allows remote attackers to read arbitrary files via a /\.. (slash backslash dot dot) in the URL.

  • CVE-2009-3901Nov 6, 2009
    E Courier
    e-Courier CMS
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in e-Courier CMS allow remote attackers to inject arbitrary web script or HTML via the UserGUID parameter to home/index.asp and other unspecified vectors.

  • CVE-2009-3900Nov 6, 2009
    IBM
    Powerha
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Cluster Management component in IBM PowerHA 5.4, 5.4.1, 5.5, and 6.1 on AIX allows remote attackers to modify the operating-system configuration via packets to the godm port (6177/tcp).

  • CVE-2009-3899Nov 6, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.03

    Memory leak in the Sockets Direct Protocol (SDP) driver in Sun Solaris 10, and OpenSolaris snv_57 through snv_94, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.

  • CVE-2009-3850Nov 6, 2009
    Blender
    Blender
    risk 0.04cvss —epss 0.09

    Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code via a .blend file that contains Python statements in the onLoad action of a ScriptLink SDNA.

  • CVE-2009-3725Nov 6, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The connector layer in the Linux kernel before 2.6.31.5 does not require the CAP_SYS_ADMIN capability for certain interaction with the (1) uvesafb, (2) pohmelfs, (3) dst, or (4) dm subsystem, which allows local users to bypass intended access restrictions and gain privileges via…

  • CVE-2009-3300Nov 6, 2009
    Internet2
    Identity Provider
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary…

  • CVE-2009-2685Nov 6, 2009
    Microfocus
    Power Manager
    risk 0.09cvss —epss 0.77

    Stack-based buffer overflow in the login form in the management web server in HP Power Manager allows remote attackers to execute arbitrary code via the Login variable.

  • CVE-2009-3878Nov 5, 2009
    Sun Corporation
    Java System Web Server
    risk 0.00cvss —epss 0.02

    Buffer overflow in Sun Java System Web Server 7.0 Update 6 has unspecified impact and remote attack vectors, as demonstrated by the vd_sjws module in VulnDisco Pack Professional 8.12. NOTE: as of 20091105, this disclosure has no actionable information. However, because the…

  • CVE-2009-3877Nov 5, 2009
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP…

  • CVE-2009-3876Nov 5, 2009
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted DER…

  • CVE-2009-3875Nov 5, 2009
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    The MessageDigest.isEqual function in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to spoof HMAC-based digital…