VYPR

CVEs

345,234 total · page 6142 of 6,905

AllCriticalHighKEV
  • CVE-2008-7146Sep 1, 2009
    Intralearn
    Intralearn
    risk 0.00cvss —epss 0.01

    IntraLearn Software IntraLearn 2.1, and possibly other versions before 4.2.3, allows remote attackers to obtain sensitive information via a direct request to (1) Knowledge_Impact_Course.htm, (2) LRN-formatted_Course.htm, or (3) Create_Course.htm in help/1/Instructor/, which…

  • CVE-2008-7145Sep 1, 2009
    Coronamatrix
    Phpaddressbook
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in CoronaMatrix phpAddressBook 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) parameters.

  • CVE-2008-7144Sep 1, 2009
    Rarlab
    Winrar
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in RARLAB WinRAR before 3.71 have unknown impact and attack vectors related to crafted (1) ACE, (2) ARJ, (3) BZ2, (4) CAB, (5) GZ, (6) LHA, (7) RAR, (8) TAR, or (9) ZIP files, as demonstrated by the OUSPG PROTOS GENOME test suite for Archive…

  • CVE-2008-7143Sep 1, 2009
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.01

    phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the session via a post in the thread containing a URL to a remotely hosted image, which might include the session ID in the…

  • CVE-2008-7142Sep 1, 2009
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.03

    Absolute path traversal vulnerability in the Disk Usage module (frontend/x/diskusage/index.html) in cPanel 11.18.3 allows remote attackers to list arbitrary directories via the showtree parameter.

  • CVE-2008-7141Sep 1, 2009
    @lex
    Poll
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in setup.php in @lex Poll 2.1 allows remote attackers to inject arbitrary web script or HTML via the language_setup parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-7140Sep 1, 2009
    @lex
    @lex Guestbook
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in @lex Guestbook 4.0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) language_setup parameter to setup.php or (2) test parameter to index.php. NOTE: the provenance of this information…

  • CVE-2008-7139Sep 1, 2009
    Eye.fi
    WS-Proxy
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in WS-Proxy in Eye-Fi 1.1.2 allow remote attackers to hijack the authentication of users for requests that modify configuration via a SOAPAction parameter of (1) urn:SetOptions for autostart, (2) urn:SetDesktopSync for…

  • CVE-2008-7138Sep 1, 2009
    Eye.fi
    Eye-Fi
    risk 0.00cvss —epss 0.01

    The Manager in Eye-Fi 1.1.2 generates predictable snonce values based on the time of day, which allows remote attackers to bypass authentication and upload arbitrary images by guessing the snonce.

  • CVE-2008-7137Sep 1, 2009
    Eye.fi
    WS-Proxy
    risk 0.00cvss —epss 0.02

    WS-Proxy in Eye-Fi 1.1.2 allows remote attackers to cause a denial of service (crash) via an empty query string to port 59278 and other unspecified vectors.

  • CVE-2008-7136Sep 1, 2009
    Icq
    Icq Toolbar
    risk 0.03cvss —epss 0.04

    toolbaru.dll in ICQ Toolbar (ICQToolbar) 2.3 allows remote attackers to cause a denial of service (toolbar crash) via a long argument to the (1) RequestURL, (2) GetPropertyById, or (3) SetPropertyById method, different vectors than CVE-2008-7135.

  • CVE-2008-7135Sep 1, 2009
    Icq
    Icq Toolbar
    risk 0.03cvss —epss 0.02

    toolbaru.dll in ICQ Toolbar (ICQToolbar) 2.3 allows remote attackers to cause a denial of service (toolbar crash) via a long argument to the IsChecked method, a different vector than CVE-2008-7136.

  • CVE-2008-7134Sep 1, 2009
    Redgalaxy
    Download Center
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the default URI in Chris LaPointe RedGalaxy Download Center 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter, (2) message parameter in a login action, (3) category parameter in a…

  • CVE-2008-7133Sep 1, 2009
    Onlinetools.org
    Easyimagecatalogue
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in onlinetools.org EasyImageCatalogue 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) search and (2) d index.php parameters to index.php, (3) dir parameter to thumber.php, and the d parameter to…

  • CVE-2008-7132Sep 1, 2009
    Nuked Klan
    Nuked Klan
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Nuked-Klan 1.3 beta allows remote attackers to inject arbitrary web script or HTML via the nuked_nude parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2009-3026Aug 31, 2009
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.01

    protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the…

  • CVE-2009-3025Aug 31, 2009
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Pidgin 2.6.0 allows remote attackers to cause a denial of service (crash) via a link in a Yahoo IM.

  • CVE-2009-3024Aug 31, 2009
    Io Socket SSL
    Io Socket SSL
    risk 0.00cvss —epss 0.01

    The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate.

  • CVE-2009-3023Aug 31, 2009
    Microsoft
    Internet Information Server
    risk 0.10cvss —epss 0.91

    Buffer overflow in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 6.0 allows remote authenticated users to execute arbitrary code via a crafted NLST (NAME LIST) command that uses wildcards, leading to memory corruption, aka "IIS FTP Service RCE and…

  • CVE-2009-3022MedAug 31, 2009
    Bingo CMS
    bingo!CMS
    risk 0.42cvss 6.5epss 0.01

    Cross-site request forgery (CSRF) vulnerability in bingo!CMS 1.2 and earlier allows remote attackers to hijack the authentication of other users for requests that modify configuration or change content via unspecified vectors.

  • CVE-2009-3021Aug 31, 2009
    Geeklog
    Geeklog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Site Calendar 'mycaljp' plugin 2.0.0 through 2.0.6, as used in the Japanese extended package of Geeklog 1.5.0 through 1.5.2 and when distributed 20090629 or earlier, allows remote attackers to inject arbitrary web script or HTML via…

  • CVE-2009-2944Aug 31, 2009
    Ikiwiki
    Ikiwiki
    risk 0.00cvss —epss 0.02

    Incomplete blacklist vulnerability in the teximg plugin in ikiwiki before 3.1415926 and 2.x before 2.53.4 allows context-dependent attackers to read arbitrary files via crafted TeX commands.

  • CVE-2009-3020Aug 31, 2009
    Microsoft
    Windows Server 2003
    risk 0.04cvss —epss 0.17

    win32k.sys in Microsoft Windows Server 2003 SP2 allows remote attackers to cause a denial of service (system crash) by referencing a crafted .eot file in the src descriptor of an @font-face Cascading Style Sheets (CSS) rule in an HTML document, possibly related to the Embedded…

  • CVE-2009-3019Aug 31, 2009
    Microsoft
    Internet Explorer
    risk 0.04cvss —epss 0.17

    Microsoft Internet Explorer 6 on Windows XP SP2 and SP3, and Internet Explorer 7 on Vista, allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls createElement to create an instance of the LI element, and then calls setAttribute…

  • CVE-2009-3018Aug 31, 2009
    Maxthon
    Maxthon Browser
    risk 0.00cvss —epss 0.01

    Maxthon Browser 3.0.0.145 Alpha with Ultramode does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains…

  • CVE-2009-3017Aug 31, 2009
    Orcabrowser
    Orca Browser
    risk 0.00cvss —epss 0.01

    Orca Browser 1.2 build 5 does not properly block data: URIs in Refresh and Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains JavaScript sequences in…

  • CVE-2009-3016Aug 31, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Apple Safari 4.0.3 does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains a javascript: URI, (2)…

  • CVE-2009-3015Aug 31, 2009
    Qtweb
    Qtweb
    risk 0.00cvss —epss 0.01

    QtWeb 3.0 Builds 001 and 003 does not properly block javascript: and data: URIs in Refresh and Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains a…

  • CVE-2009-3014Aug 31, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly handle javascript: URIs in HTML links within 302 error documents sent from web servers, which allows user-assisted remote attackers to conduct…

  • CVE-2009-3013Aug 31, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that contains…

  • CVE-2009-3012Aug 31, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that…

  • CVE-2009-3011Aug 31, 2009
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome 1.0.154.48 and earlier, 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta does not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh…

  • CVE-2009-3010Aug 31, 2009
    Seamonkey
    Seamonkey
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors…

  • CVE-2008-7131Aug 31, 2009
    Peter Kohlmann
    Db2 Monitoring Console
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier allows remote attackers to gain access to a database via a link to a victim who is already connected to the database.

  • CVE-2008-7130Aug 31, 2009
    Peter Kohlmann
    Db2 Monitoring Console
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier allows remote attackers to upload arbitrary files via unknown vectors.

  • CVE-2008-7129Aug 31, 2009
    Xyssl
    Xyssl
    risk 0.00cvss —epss 0.01

    XySSL before 0.9 allows remote attackers to cause a denial of service (infinite loop) via an X.509 certificate that does not pass the RSA signature check during verification.

  • CVE-2008-7128Aug 31, 2009
    Xyssl
    Xyssl
    risk 0.00cvss —epss 0.01

    The ssl_parse_client_key_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen ciphertext, which allows remote attackers to recover keys via unspecified vectors.

  • CVE-2008-7127Aug 31, 2009
    Microfocus
    Visibroker
    risk 0.00cvss —epss 0.02

    osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) via a crafted packet with a large string length value to UDP port 14000, which triggers a memory allocation failure that is not properly handled.

  • CVE-2008-7126Aug 31, 2009
    Microfocus
    Visibroker
    risk 0.04cvss —epss 0.10

    Integer overflow in osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet with a large string length value to UDP port 14000, which triggers a…

  • CVE-2008-7125Aug 31, 2009
    Ariadne
    Ariadne
    risk 0.00cvss —epss 0.02

    pphoto in Ariadne before 2.6 allows remote authenticated users with certain privileges to execute arbitrary shell commands via vectors related to PINP programs and the annotate command. NOTE: some of these details are obtained from third party information.

  • CVE-2008-7124Aug 31, 2009
    Zkup
    Zkup
    risk 0.04cvss —epss 0.09

    zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote attackers to gain administrator privileges via a direct request, as demonstrated by adding a new administrator.

  • CVE-2008-7123Aug 31, 2009
    Zkup
    Zkup
    risk 0.03cvss —epss 0.04

    Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attackers to inject arbitrary PHP code into fichiers/config.php via a null byte (%00) in the login parameter in an ajout action, which bypasses the regular…

  • CVE-2008-7122Aug 31, 2009
    Evansprogramming
    Registry Pro
    risk 0.00cvss —epss 0.03

    Multiple insecure method vulnerabilities in an ActiveX control in (epRegPro.ocx) in Evans Programming Registry Pro allow remote attackers to read and modify sensitive registry keys via the (1) About, (2) CreateKey, (3) DeleteBranch, (4) DeleteKey, (5) DeleteValue, (6) EnumKeys,…

  • CVE-2009-3008Aug 28, 2009
    Christophe Thibault
    K Meleon
    risk 0.00cvss —epss 0.01

    K-Meleon 1.5.3 allows context-dependent attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary file: URL after a victim has visited any file: URL, as demonstrated by a visit to a file: document written by the attacker.

  • CVE-2009-3007Aug 28, 2009
    Flock
    Flock
    risk 0.00cvss —epss 0.01

    Mozilla Firefox 3.5.1 and SeaMonkey 1.1.17, and Flock 2.5.1, allow context-dependent attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary file: URL after a victim has visited any file: URL, as demonstrated by a visit to a file: document…

  • CVE-2009-3006Aug 28, 2009
    Maxthon
    Maxthon Browser
    risk 0.00cvss —epss 0.01

    Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login…

  • CVE-2009-3005Aug 28, 2009
    Lunascape
    Lunascape
    risk 0.00cvss —epss 0.01

    Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for…

  • CVE-2009-3004Aug 28, 2009
    Avant Browser
    Browser
    risk 0.00cvss —epss 0.01

    Avant Browser 11.7 Builds 35 and 36 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed…

  • CVE-2009-3003Aug 28, 2009
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.11

    Microsoft Internet Explorer 6 through 8 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed…

  • CVE-2009-3002Aug 28, 2009
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read the contents of some kernel memory locations by calling getsockname on (1) an AF_APPLETALK socket, related to the atalk_getname function in…