VYPR

CVEs

345,738 total · page 6135 of 6,915

AllCriticalHighKEV
  • CVE-2009-3790Oct 26, 2009
    Cutepdf
    Formmax
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in FormMax (formerly AcroForm) evaluation 3.5 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted FormMax import (.aim) file. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2009-3789Oct 26, 2009
    Opendocman
    Opendocman
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in OpenDocMan 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the last_message parameter to (1) add.php, (2) toBePublished.php, (3) index.php, and (4) admin.php; the PATH_INFO to the default URI to (5)…

  • CVE-2009-3788Oct 26, 2009
    Opendocman
    Opendocman
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in OpenDocMan 1.2.5 allows remote attackers to execute arbitrary SQL commands via the frmuser (aka Username) parameter.

  • CVE-2009-3787Oct 26, 2009
    Vivvo
    Vivvo
    risk 0.04cvss —epss 0.07

    files.php in Vivvo CMS 4.1.5.1 allows remote attackers to conduct directory traversal attacks and read arbitrary files via the file parameter with "logs/" in between two . (dot) characters, which is filtered into a "../" sequence.

  • CVE-2009-3786Oct 26, 2009
    Drupal
    Organic Groups OG Vocabulary
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Organic Groups (OG) Vocabulary 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the group title.

  • CVE-2009-3785Oct 26, 2009
    Drupal
    Simplenews Statistics
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allow remote attackers to hijack the authentication of arbitrary users via unknown vectors.

  • CVE-2009-3784Oct 26, 2009
    Drupal
    Simplenews Statistics
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2009-3783Oct 26, 2009
    Drupal
    Simplenews Statistics
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vector.

  • CVE-2009-3782Oct 26, 2009
    Drupal
    Userpoints
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Userpoints 6.x before 6.x-1.1, a module for Drupal, allows remote authenticated users with "View own userpoints" permissions to read the userpoint data of arbitrary users via unknown attack vectors.

  • CVE-2009-3781Oct 26, 2009
    Drupal
    FileField
    risk 0.00cvss —epss 0.02

    The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors.

  • CVE-2009-3780Oct 26, 2009
    Abuse
    Abuse
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Abuse 5.x before 5.x-2.1 and 6.x before 6.x-1.1-alpha1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-3779Oct 26, 2009
    Drupal
    vCard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in vCard 5.x before 5.x-1.4 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the addition of the theme_vcard function to a theme and the use of…

  • CVE-2009-3778Oct 26, 2009
    Drupal
    Moodle Course List
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Moodle Course List 6.x before 6.x-1.2, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-3625Oct 26, 2009
    Sahana
    Sahana
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in www/index.php in Sahana 0.6.2.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod parameter.

  • CVE-2009-3611HigOct 26, 2009
    Back In Time
    backintime
    risk 0.46cvss 7.1epss 0.00

    common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allows local users to obtain sensitive information by reading these files, or interfere with backup integrity by modifying…

  • CVE-2009-3767Oct 23, 2009
    OpenLDAP
    Openldap
    risk 0.00cvss —epss 0.03

    libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof…

  • CVE-2009-3766Oct 23, 2009
    Mutt
    Mutt
    risk 0.00cvss —epss 0.01

    mutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

  • CVE-2009-3765Oct 23, 2009
    Mutt
    Mutt
    risk 0.00cvss —epss 0.01

    mutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted…

  • CVE-2009-3622Oct 23, 2009
    WordPress
    WordPress
    risk 0.00cvss —epss 0.06

    Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service (CPU consumption and server hang) via a long title parameter in conjunction with a charset parameter composed of many comma-separated "UTF-8"…

  • CVE-2009-3616CriOct 23, 2009
    QEMU
    Qemu
    risk 0.58cvss 9.9epss 0.04

    Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.10.6 and earlier might allow guest OS users to execute arbitrary code on the host OS by establishing a connection from a VNC client and then (1) disconnecting during data transfer, (2) sending a message…

  • CVE-2009-2281Oct 23, 2009
    MapServer
    Mapserver
    risk 0.00cvss —epss 0.06

    Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to…

  • CVE-2009-1297Oct 23, 2009
    Novell
    Suse Linux
    risk 0.00cvss —epss 0.00

    iscsi_discovery in open-iscsi in SUSE openSUSE 10.3 through 11.1 and SUSE Linux Enterprise (SLE) 10 SP2 and 11, and other operating systems, allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file that has a predictable name.

  • CVE-2009-3409Oct 22, 2009
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PeopleSoft Enterprise HCM (TAM) component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 9.0 Bundle 10 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

  • CVE-2009-3408Oct 22, 2009
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

  • CVE-2009-3407Oct 22, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Portal component in Oracle Application Server 10.1.2.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than CVE-2009-0974 and CVE-2009-0983.

  • CVE-2009-3406Oct 22, 2009
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the JD Edwards Tools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.98.2.1 allows remote authenticated users to affect confidentiality via unknown vectors.

  • CVE-2009-3405Oct 22, 2009
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the JD Edwards Tools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.98.1.4 allows remote authenticated users to affect integrity and availability via unknown vectors.

  • CVE-2009-3404Oct 22, 2009
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PeopleSoft PeopleTools & Enterprise Portal component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.23 allows remote authenticated users to affect integrity via unknown vectors.

  • CVE-2009-3403Oct 22, 2009
    Oracle Corporation
    Bea Product Suite
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the JRockit component in BEA Product Suite R27.6.4: JRE/JDK, 1.4.2, 5, and, and 6 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: this issue subsumes CVE-2009-2670, CVE-2009-2671,…

  • CVE-2009-3402Oct 22, 2009
    Oracle Corporation
    Applications Framework
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.1 allows remote authenticated users to affect confidentiality via unknown vectors.

  • CVE-2009-3401Oct 22, 2009
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.1 allows local users to affect confidentiality via unknown vectors.

  • CVE-2009-3400Oct 22, 2009
    Oracle Corporation
    Oracle Advanced Benefits
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Advanced Benefits component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

  • CVE-2009-3399Oct 22, 2009
    Oracle Corporation
    Bea Product Suite
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 7.0.6 and 8.1.5 allows remote attackers to affect integrity, related to WLS Console.

  • CVE-2009-3397Oct 22, 2009
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors.

  • CVE-2009-3396Oct 22, 2009
    Oracle Corporation
    Bea Product Suite
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 9.0, 9.1, 9.2.3, 10.0.1, and 10.3 allows remote attackers to affect integrity, related to WLS Console.

  • CVE-2009-3395Oct 22, 2009
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the AutoVue component in Oracle E-Business Suite 19.3.2 allows remote attackers to affect availability via unknown vectors.

  • CVE-2009-3393Oct 22, 2009
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors.

  • CVE-2009-3392Oct 22, 2009
    Oracle Corporation
    Agile Engineering Data Management
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Agile Engineering Data Management (EDM) component in Oracle E-Business Suite 6.1.0.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

  • CVE-2009-2002Oct 22, 2009
    Oracle Corporation
    Bea Product Suite
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the WebLogic Portal component in BEA Product Suite 8.1.6, 9.2.3, 10.0.1, 10.2.1, and 10.3.1.0.0 allows remote attackers to affect integrity via unknown vectors.

  • CVE-2009-2001Oct 22, 2009
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PL/SQL component in Oracle Database 10.2.0.4 and 11.1.0.7 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.

  • CVE-2009-2000Oct 22, 2009
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Authentication component in Oracle Database 11.1.0.7 allows remote attackers to affect confidentiality via unknown vectors.

  • CVE-2009-1999Oct 22, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Business Intelligence Enterprise Edition component in unspecified Oracle Application Server versions allows remote attackers to affect integrity via unknown vectors.

  • CVE-2009-1998Oct 22, 2009
    Oracle Corporation
    Industry Applications
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Communications Order and Service Management component in Oracle Industry Applications 2.8.0, 6.2.0, 6.3.0, and 6.3.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

  • CVE-2009-1997Oct 22, 2009
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Authentication component in Oracle Database 10.2.0.3 and 11.1.0.7 allows remote attackers to affect confidentiality via unknown vectors.

  • CVE-2009-1995Oct 22, 2009
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Advanced Queuing component in Oracle Database 10.2.0.4 and 11.1.0.7 allows remote authenticated users to affect confidentiality and integrity, related to SYS.DBMS_AQ_INV.

  • CVE-2009-1994Oct 22, 2009
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 allows remote authenticated users to affect confidentiality, integrity, and availability, related to MDSYS.PRVT_CMT_CBK.

  • CVE-2009-1993Oct 22, 2009
    Oracle Corporation
    Application Express
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Application Express component in Oracle Database 3.0.1 allows remote authenticated users to affect confidentiality and integrity, related to FLOWS_030000.WWV_EXECUTE_IMMEDIATE.

  • CVE-2009-1992Oct 22, 2009
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

  • CVE-2009-1991Oct 22, 2009
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Text component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity, related to CTXSYS.DRVXTABC. NOTE: the previous information was obtained from the…

  • CVE-2009-1990Oct 22, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Business Intelligence Enterprise Edition component in Oracle Application Server 10.1.3.4.1 allows local users to affect confidentiality via unknown vectors.