VYPR

CVEs

345,698 total · page 6138 of 6,914

AllCriticalHighKEV
  • CVE-2009-3459HigKEVOct 13, 2009
    Adobe Inc.
    Acrobat
    risk 0.79cvss 8.8epss 0.87

    Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these…

  • CVE-2009-2908Oct 13, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The d_delete function in fs/ecryptfs/inode.c in eCryptfs in the Linux kernel 2.6.31 allows local users to cause a denial of service (kernel OOPS) and possibly execute arbitrary code via unspecified vectors that cause a "negative dentry" and trigger a NULL pointer dereference, as…

  • CVE-2009-2898Oct 13, 2009
    Gopivotal
    Application Management Suite
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote…

  • CVE-2009-2897Oct 13, 2009
    Gopivotal
    Application Management Suite
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite…

  • CVE-2009-2699HigOct 13, 2009
    Apache
    HTTP Server
    risk 0.43cvss 7.5epss 0.14

    The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a…

  • CVE-2009-2684Oct 13, 2009
    Microfocus
    Jetdirect
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL…

  • CVE-2009-3670Oct 11, 2009
    KSP
    Sound Player 2009
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in KSP Sound Player 2009 R2 and R2.1 allows remote attackers to execute arbitrary code via a long string in a .m3u playlist file.

  • CVE-2009-3669Oct 11, 2009
    Foobla
    Com Foobla Suggestions
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the foobla Suggestions (com_foobla_suggestions) component 1.5.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the idea_id parameter to index.php.

  • CVE-2009-3668Oct 11, 2009
    Ardguest
    Ardguest
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in ardguest.php in Ardguest 1.8 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2009-3667Oct 11, 2009
    Adsdx
    Adsdx
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/index.php in AdsDX 3.05 allows remote attackers to execute arbitrary SQL commands via the Username.

  • CVE-2009-3666Oct 11, 2009
    Nullam
    Blog
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in index.php in Nullam Blog 0.1.2 allows remote attackers to inject arbitrary web script or HTML via the e parameter in an error action.

  • CVE-2009-3665Oct 11, 2009
    Nullam
    Blog
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in index.php in Nullam Blog 0.1.2 allow remote attackers to execute arbitrary SQL commands via the (1) i parameter or (2) v parameters in a register action.

  • CVE-2009-3664Oct 11, 2009
    Nullam
    Blog
    risk 0.03cvss —epss 0.06

    Multiple directory traversal vulnerabilities in index.php in Nullam Blog 0.1.2 allow remote attackers to include or execute arbitrary files via a .. (dot dot) in the (1) p and (2) s parameters.

  • CVE-2009-3663Oct 11, 2009
    Httpdx
    httpdx
    risk 0.04cvss —epss 0.15

    Format string vulnerability in the h_readrequest function in http.c in httpdx Web Server 1.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in the Host header.

  • CVE-2009-3662Oct 11, 2009
    Filecopa Ftpserver
    FTP Server
    risk 0.03cvss —epss 0.03

    FileCopa FTP Server 5.01 allows remote attackers to cause a denial of service (server hang) via a large number of crafted NOOP commands.

  • CVE-2009-3661Oct 11, 2009
    Joomla
    DJ-Catalog
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the DJ-Catalog (com_djcatalog) component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a showItem action and (2) cid parameter in a show action to index.php.

  • CVE-2009-3660Oct 11, 2009
    Epignosis
    Efront
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: this is only a vulnerability when the administrator does…

  • CVE-2009-3659Oct 11, 2009
    BS Counter
    BS Counter
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in file/stats.php in BS Counter 2.5.3 allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2009-3658HigOct 9, 2009
    AOL
    SuperBuddy
    risk 0.61cvss 8.8epss 0.09

    Use-after-free vulnerability in the Sb.SuperBuddy.1 ActiveX control (sb.dll) in America Online (AOL) 9.5.0.1 allows remote attackers to trigger memory corruption or possibly execute arbitrary code via a malformed argument to the SetSuperBuddy method.

  • CVE-2009-3657Oct 9, 2009
    Drupal
    Shared Sign-On
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in Shared Sign-On 5.x and 6.x, a module for Drupal, allows remote attackers to hijack web sessions via unspecified vectors.

  • CVE-2009-3656Oct 9, 2009
    Drupal
    Shared Sign-On
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Shared Sign-On 5.x and 6.x, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users via unknown vectors.

  • CVE-2009-3655Oct 9, 2009
    Rhino Software, Inc.
    Serv-U
    risk 0.00cvss —epss 0.04

    Rhino Software Serv-U 7.0.0.1 through 8.2.0.3 allows remote attackers to cause a denial of service (server crash) via unspecified vectors related to the "SITE SET TRANSFERPROGRESS ON" FTP command.

  • CVE-2009-3654Oct 9, 2009
    Drupal
    Boost
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Boost before 6.x-1.03, a module for Drupal, allows remote attackers to create new webroot directories via unknown attack vectors.

  • CVE-2009-3653Oct 9, 2009
    Drupal
    XML Sitemap
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the additional links interface in XML Sitemap 5.x-1.6, a module for Drupal, allows remote authenticated users, with "administer site configuration" permission, to inject arbitrary web script or HTML via unspecified vectors, related to…

  • CVE-2009-3652Oct 9, 2009
    Drupal
    Organic Groups
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Organic Groups (OG) 5.x-7.x before 5.x-7.4, 5.x-8.x before 5.x-8.1, and 6.x-1.x before 6.x-1.4, a module for Drupal, allows remote authenticated users, with create or edit group nodes permissions, to inject arbitrary web script or HTML…

  • CVE-2009-3651Oct 9, 2009
    Drupal
    Browscap
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the "Monitor browsers' feature in Browscap before 5.x-1.1 and 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.

  • CVE-2009-3650Oct 9, 2009
    Drupal
    Dex
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Dex 5.x-1.0 and earlier and 6.x-1.0-rc1 and earlier, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-3649Oct 9, 2009
    Pbboard
    Pbboard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in forums/index.php in Power Bulletin Board (PBBoard) 2.0.2 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter in a new_topic action.

  • CVE-2009-3648Oct 9, 2009
    Drupal
    Service Links
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Service Links 6.x-1.0, a module for Drupal, allows remote authenticated users, with 'administer content types' permissions, to inject arbitrary web script or HTML via unspecified vectors when displaying content type names.

  • CVE-2009-3647Oct 9, 2009
    Yabsoft
    Mega File Hosting Script
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in emaullinks.php in YABSoft Mega File Hosting Script (aka MFH or MFHS) 1.2 allows remote attackers to inject arbitrary web script or HTML via the moudi parameter. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2009-3646Oct 9, 2009
    Intervations
    Navicopa Web Server
    risk 0.03cvss —epss 0.06

    InterVations NaviCOPA Web Server 3.01 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition of ::$DATA after the HTML file name.

  • CVE-2009-3645Oct 9, 2009
    Joomlacache
    CB Resume Builder
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JoomlaCache CB Resume Builder (com_cbresumebuilder) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the group_id parameter in a group_members action to index.php.

  • CVE-2009-3644Oct 9, 2009
    Joomla
    com_soundset
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Soundset (com_soundset) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to index.php.

  • CVE-2009-3643Oct 9, 2009
    Dxmsoft
    Xm Easy Personal FTP Server
    risk 0.04cvss —epss 0.06

    Dxmsoft XM Easy Personal FTP Server 5.8.0 allows remote attackers to cause a denial of service via a long argument to the (1) LIST and (2) NLST commands, a differnt issue than CVE-2008-5626 and CVE-2006-5728.

  • CVE-2009-3642Oct 9, 2009
    Frontrange
    Heat
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Call Logging feature in FrontRange HEAT 8.01 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

  • CVE-2009-3601Oct 8, 2009
    Scriptsez
    Ultimate Poll
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in demo_page.php in Scriptsez Ultimate Poll allows remote attackers to inject arbitrary web script or HTML via the clr parameter in a vote action.

  • CVE-2009-3600Oct 8, 2009
    Freewebscriptz
    Hubscript
    risk 0.00cvss —epss 0.01

    HUBScript 1.0 allows remote attackers to obtain configuration information via a direct request to manage/phpinfo.php, which calls the phpinfo function.

  • CVE-2009-3599Oct 8, 2009
    HUBScript
    HUBScript
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in single_winner1.php in HUBScript 1.0 allows remote attackers to inject arbitrary web script or HTML via the bid_id parameter.

  • CVE-2009-3598Oct 8, 2009
    Ecardmax.com
    Formxp
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in survey_result.php in eCardMAX FormXP 2007 allows remote attackers to inject arbitrary web script or HTML via the sid parameter.

  • CVE-2009-3597Oct 8, 2009
    Digitaldesign
    CMS
    risk 0.03cvss —epss 0.03

    Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for autoconfig.dd.

  • CVE-2009-3596Oct 8, 2009
    Joxtechnology
    Ajox Poll
    risk 0.03cvss —epss 0.02

    JoxTechnology Ajox Poll does not properly restrict access to admin/managepoll.php, which allows remote attackers to bypass authentication and gain administrative access via a direct request.

  • CVE-2009-3595Oct 8, 2009
    Vspanel
    Vs Panel
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in results.php in VS PANEL 7.5.5 allows remote attackers to execute arbitrary SQL commands via the Cat_ID parameter, a different vector than CVE-2009-3590.

  • CVE-2009-3594Oct 8, 2009
    Blob
    Blog System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in bpost.php in BLOB Blog System before 1.2 allows remote attackers to inject arbitrary web script or HTML via the postid parameter.

  • CVE-2009-3593Oct 8, 2009
    Freewebscriptz
    Freelancers
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Freelancers 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to placebid.php and (2) jobid parameter to post_resume.php.

  • CVE-2009-3592Oct 8, 2009
    Qualiteam
    X Cart
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in customer/home.php in Qualiteam X-Cart allows remote attackers to inject arbitrary web script or HTML via the email parameter in a subscribed action, a different vector than CVE-2005-1823.

  • CVE-2009-3591Oct 8, 2009
    Dopewars
    Dopewars
    risk 0.07cvss —epss 0.53

    Dopewars 1.5.12 allows remote attackers to cause a denial of service (segmentation fault) via a REQUESTJET message with an invalid location.

  • CVE-2009-3590Oct 8, 2009
    Vspanel
    Vs Panel
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in showcat.php in VS PANEL 7.3.6 allows remote attackers to execute arbitrary SQL commands via the Cat_ID parameter.

  • CVE-2009-3589Oct 8, 2009
    Incron
    incron
    risk 0.00cvss —epss 0.00

    incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.

  • CVE-2009-2948Oct 7, 2009
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.01

    mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, does not properly enforce permissions, which allows local users to read part of the credentials file and obtain the password by specifying the…

  • CVE-2009-2906Oct 7, 2009
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.04

    smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break notification reply packet.