VYPR

CVEs

345,251 total · page 6141 of 6,906

AllCriticalHighKEV
  • CVE-2008-7174Sep 8, 2009
    Jura
    Internet Connection Kit
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in the Jura Internet Connection Kit for the Jura Impressa F90 coffee maker allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors related to improper use of the gets and sprintf functions.

  • CVE-2008-7173Sep 8, 2009
    Jura
    Internet Connection Kit
    risk 0.00cvss —epss 0.05

    The Jura Internet Connection Kit for the Jura Impressa F90 coffee maker does not properly restrict access to privileged functions, which allows remote attackers to cause a denial of service (physical damage), modify coffee settings, and possibly execute code via a crafted…

  • CVE-2008-7172Sep 8, 2009
    Lightweight news portal (LNP)
    Lightweight news portal (LNP)
    risk 0.03cvss —epss 0.02

    Lightweight news portal (LNP) 1.0b does not properly restrict access to administrator functionality, which allows remote attackers to gain administrator privileges via direct requests to admin.php with the (1) potd_delete, (2) potd, (3) vote_update, (4) vote, or (5) modifynews…

  • CVE-2008-7171Sep 8, 2009
    Lightweight news portal (LNP)
    Lightweight news portal (LNP)
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Lightweight news portal (LNP) 1.0b allow remote attackers to inject arbitrary web script or HTML via the (1) photo parameter to show_photo.php, (2) potd parameter to show_potd.php, or (3) the Current question field in a vote…

  • CVE-2008-7170Sep 8, 2009
    GSC
    GSC
    risk 0.04cvss —epss 0.10

    GSC build 2067 and earlier relies on the client to enforce administrator privileges, which allows remote attackers to execute arbitrary administrator commands via a crafted packet.

  • CVE-2008-7169Sep 8, 2009
    Joomla
    com_jabode
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Jabode horoscope extension (com_jabode) for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a sign task to index.php.

  • CVE-2008-7168Sep 8, 2009
    Uusee
    Uusee
    risk 0.03cvss —epss 0.06

    Insecure method vulnerability in the UUSee UUUpgrade ActiveX control (UUUpgrade.ocx 3.0.2.12) allows remote attackers to force the download and overwrite of arbitrary files via crafted arguments to the Update method, as exploited in the wild in June 2009.

  • CVE-2008-7167Sep 8, 2009
    Sami Ekblad
    Page Manager
    risk 0.03cvss —epss 0.04

    Unrestricted file upload vulnerability in upload.php in Page Manager 2006-02-04 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.

  • CVE-2009-3082Sep 4, 2009
    Snowhall
    Silurus System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in wcategory.php in Snow Hall Silurus System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2009-3081Sep 4, 2009
    Uiga
    Church Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Uiga Church Portal allows remote attackers to execute arbitrary SQL commands via the month parameter in a calendar action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2009-2946Sep 4, 2009
    Devscripts Devel Team
    Devscripts
    risk 0.00cvss —epss 0.03

    Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.

  • CVE-2009-2697Sep 4, 2009
    GNOME Foundation
    Gdm
    risk 0.00cvss —epss 0.02

    The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat Enterprise Linux (RHEL) 5 omits TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions via XDMCP connections, a different vulnerability than…

  • CVE-2009-3068Sep 4, 2009
    Adobe Inc.
    Robohelp
    risk 0.09cvss —epss 0.78

    Unrestricted file upload vulnerability in the RoboHelpServer Servlet (robohelp/server) in Adobe RoboHelp Server 8 allows remote attackers to execute arbitrary code by uploading a Java Archive (.jsp) file during a PUBLISH action, then accessing it via a direct request to the file…

  • CVE-2009-2521Sep 4, 2009
    Microsoft
    Internet Information Server
    risk 0.10cvss —epss 0.82

    Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service (daemon crash) via a list (ls) -R command containing a wildcard that references a subdirectory,…

  • CVE-2008-7166Sep 4, 2009
    Utorrent
    Utorrent
    risk 0.00cvss —epss 0.03

    Buffer overflow in the web interface in BitTorrent 6.0.1 (build 7859) and earlier, and uTorrent 1.7.6 (build 7859) and earlier, allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted Range header. NOTE: this is probably a different…

  • CVE-2008-7165Sep 4, 2009
    TELECOM ITALIA
    Alice Gate2 Plus Wi-Fi
    risk 0.03cvss —epss 0.01

    Cross-site request forgery in cp06_wifi_m_nocifr.cgi in the administrator panel in TELECOM ITALIA Alice Gate2 Plus Wi-Fi allows remote attackers to hijack the authentication of administrators for requests that disable Wi-Fi encryption via certain values for the wlChannel and…

  • CVE-2008-7164Sep 4, 2009
    Shareaza
    Shareaza
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Shareaza before 2.3.1.0 have unknown impact and attack vectors related to "very important security fixes," possibly involving update notifications and a domain that is no longer controlled by the vendor.

  • CVE-2008-7163Sep 4, 2009
    Sinecms
    Sinecms
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in mods/Integrated/index.php in SineCMS 2.3.5 and earlier, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the sine[config][index_main] parameter.

  • CVE-2008-7162Sep 4, 2009
    Hero
    Super Player 3000
    risk 0.03cvss —epss 0.06

    Buffer overflow in Hero Super Player 3000 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long filename in a .M3U file. NOTE: this might be related to CVE-2008-4504.

  • CVE-2008-7161Sep 4, 2009
    Fortinet
    Fortigate 1000
    risk 0.04cvss —epss 0.06

    Fortinet FortiGuard Fortinet FortiGate-1000 3.00 build 040075,070111 allows remote attackers to bypass URL filtering via fragmented GET or POST requests that use HTTP/1.0 without the Host header. NOTE: this issue might be related to CVE-2005-3058.

  • CVE-2009-3067Sep 3, 2009
    Webformatique
    Reservation Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Reservation Manager allows remote attackers to inject arbitrary web script or HTML via the resman_startdate parameter.

  • CVE-2009-3066Sep 3, 2009
    Propertywatchscript
    Property Watch
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in PropertyWatchScript.com Property Watch 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) videoid parameter to tools/email.php and (2) redirect parameter to tools/login.php.

  • CVE-2009-3065Sep 3, 2009
    Rein Velt
    Vedit
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in editor/edit_htmlarea.php in Ve-EDIT 0.1.4 allows remote attackers to execute arbitrary PHP code via a URL in the highlighter parameter.

  • CVE-2009-3064Sep 3, 2009
    Rein Velt
    Vedit
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in debugger/debug_php.php in Ve-EDIT 0.1.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _GET[filename] parameter.

  • CVE-2009-3063Sep 3, 2009
    Joomla
    Game Server
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Game Server (com_gameserver) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a gamepanel action to index.php.

  • CVE-2009-3062Sep 3, 2009
    PHP Live
    PHP Live
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in message_box.php in OSI Codes PHP Live! 3.3 allows remote attackers to execute arbitrary SQL commands via the deptid parameter.

  • CVE-2009-3061Sep 3, 2009
    Alqa6ari
    Script Q R
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in lesson.php in Alqatari Q R Script 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-3060Sep 3, 2009
    Joker Board
    JBoard
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Joker Board (aka JBoard) 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the notice parameter to editform.php, (2) the edit_user_message parameter to core/edit_user_message.php, or (3)…

  • CVE-2009-3059Sep 3, 2009
    Joker Board
    JBoard
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Joker Board (aka JBoard) 2.0 and earlier allow remote attackers to execute arbitrary SQL commands via (1) core/select.php or (2) the city parameter to top_add.inc.php, reachable through sboard.php.

  • CVE-2009-3058Sep 3, 2009
    AkPlayer
    akPlayer
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in akPlayer 1.9.0 allows remote attackers to execute arbitrary code via a long string in a .plt playlist file.

  • CVE-2009-3057Sep 3, 2009
    Aom Software
    Beex
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in AOM Software Beex 3 allow remote attackers to inject arbitrary web script or HTML via the navaction parameter to (1) news.php and (2) partneralle.php.

  • CVE-2009-3056Sep 3, 2009
    KingCMS
    KingCMS
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in include/engine/content/elements/menu.php in KingCMS 0.6.0 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[AdminPath] parameter.

  • CVE-2009-3055Sep 3, 2009
    DataLife Engine
    DataLife Engine
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in engine/api/api.class.php in DataLife Engine (DLE) 8.2 allows remote attackers to execute arbitrary PHP code via a URL in the dle_config_api parameter.

  • CVE-2009-3054Sep 3, 2009
    Artetics.com
    Art Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Artetics.com Art Portal (com_artportal) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the portalid parameter to index.php.

  • CVE-2009-3053Sep 3, 2009
    Jvitals
    Com Agora
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in the Agora (com_agora) component 3.0.0b for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action parameter to the avatars page, reachable through index.php.

  • CVE-2009-3052Sep 3, 2009
    Absoluteanime
    Prime Quick Style
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in root/includes/prime_quick_style.php in the Prime Quick Style addon before 1.2.3 for phpBB 3 allows remote authenticated users to execute arbitrary SQL commands via the prime_quick_style parameter to ucp.php.

  • CVE-2009-3050Sep 2, 2009
    Htmldoc
    Htmldoc
    risk 0.00cvss —epss 0.04

    Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitrary code via a long MEDIA SIZE comment. NOTE: it was later reported that there were additional vectors in htmllib.cxx and ps-pdf.cxx using…

  • CVE-2009-3049Sep 2, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 10.00 does not properly display all characters in Internationalized Domain Names (IDN) in the address bar, which allows remote attackers to spoof URLs and conduct phishing attacks, related to Unicode and Punycode.

  • CVE-2009-3048Sep 2, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 10.00 on Linux, Solaris, and FreeBSD does not properly implement the "INPUT TYPE=file" functionality, which allows remote attackers to trick a user into uploading an unintended file via vectors involving a "dropped file."

  • CVE-2009-3047Sep 2, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 10.00, when a collapsed address bar is used, does not properly update the domain name from the previously visited site to the currently visited site, which might allow remote attackers to spoof URLs.

  • CVE-2009-3046HigSep 2, 2009
    Opera
    Opera
    risk 0.49cvss 7.5epss 0.01

    Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked certificate.

  • CVE-2009-3045Sep 2, 2009
    Opera
    Opera Browser
    risk 0.00cvss —epss 0.01

    Opera before 10.00 trusts root X.509 certificates signed with the MD2 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted server certificate.

  • CVE-2009-3044Sep 2, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.01

    Opera before 10.00 does not properly handle a (1) '\0' character or (2) invalid wildcard character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate…

  • CVE-2009-3043Sep 2, 2009
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    The tty_ldisc_hangup function in drivers/char/tty_ldisc.c in the Linux kernel 2.6.31-rc before 2.6.31-rc8 allows local users to cause a denial of service (system crash, sometimes preceded by a NULL pointer dereference) or possibly gain privileges via certain pseudo-terminal I/O…

  • CVE-2009-2968Sep 2, 2009
    VMware
    Studio
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in a support component in the web interface in VMware Studio 2.0 public beta before build 1017-185256 allows remote attackers to upload files to arbitrary locations via unspecified vectors.

  • CVE-2009-2700Sep 2, 2009
    Qt
    Qt
    risk 0.00cvss —epss 0.01

    src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.x does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted…

  • CVE-2009-0201Sep 2, 2009
    Openoffice
    Openoffice
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in OpenOffice.org (OOo) before 3.1.1 and StarOffice/StarSuite 7, 8, and 9 might allow remote attackers to execute arbitrary code via unspecified records in a crafted Word document, related to "table parsing."

  • CVE-2009-0200Sep 2, 2009
    Openoffice
    Openoffice
    risk 0.01cvss —epss 0.07

    Integer underflow in OpenOffice.org (OOo) before 3.1.1 and StarOffice/StarSuite 7, 8, and 9 might allow remote attackers to execute arbitrary code via crafted records in the document table of a Word document, leading to a heap-based buffer overflow.

  • CVE-2008-7158Sep 2, 2009
    Numara
    Footprints
    risk 0.00cvss —epss 0.03

    Numara FootPrints 7.5a through 7.5a1 and 8.0 through 8.0a allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) transcriptFile parameter to MRcgi/MRchat.pl or (2) LOADFILE parameter to MRcgi/MRABLoad2.pl. NOTE: some of these details are…

  • CVE-2008-7157Sep 2, 2009
    Ekinboard
    Ekinboard
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in EkinBoard 1.1.0 and earlier allows remote attackers to execute arbitrary code by uploading an avatar file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in uploaded/avatars/.