VYPR

CVEs

345,217 total · page 6147 of 6,905

AllCriticalHighKEV
  • CVE-2008-6993Aug 19, 2009
    Siemens Foundation
    Gigaset Wlan Camera
    risk 0.00cvss —epss 0.02

    Siemens Gigaset WLAN Camera 1.27 has an insecure default password, which allows remote attackers to conduct unauthorized activities. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-6992Aug 19, 2009
    Greensql
    Greensql Firewall
    risk 0.03cvss —epss 0.01

    GreenSQL Firewall (greensql-fw), possibly before 0.9.2 or 0.9.4, allows remote attackers to bypass the SQL injection protection mechanism via a WHERE clause containing an expression such as "x=y=z", which is successfully parsed by MySQL.

  • CVE-2008-6991Aug 19, 2009
    Cmsbright
    Cmsbright
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in public/page.php in Websens CMSbright allows remote attackers to execute arbitrary SQL commands via the id_rub_page parameter.

  • CVE-2008-6990Aug 19, 2009
    Ezphotogallery
    Ezphotogallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in gallery.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-6989Aug 19, 2009
    Ezphotogallery
    Ezphotogallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in gallery.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2008-6988Aug 19, 2009
    Ezphotogallery
    Ezphotogallery
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Easy Photo Gallery (aka Ezphotogallery) 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) galleryid parameter to gallery.php, and the (2) size or (3) imageid parameters to show.php.

  • CVE-2008-6987Aug 19, 2009
    Ezonescripts
    Dating Website Script
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in eZoneScripts Dating Website script allows remote attackers to execute arbitrary code via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-6986Aug 19, 2009
    Zen Cart
    ZenCart
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a…

  • CVE-2008-6985Aug 19, 2009
    Zen Cart
    ZenCart
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when (1) adding or (2) updating the shopping cart.

  • CVE-2008-6984Aug 19, 2009
    Parallels
    Plesk
    risk 0.00cvss —epss 0.01

    Plesk 8.6.0, when short mail login names (SHORTNAMES) are enabled, allows remote attackers to bypass authentication and send spam e-mail via a message with (1) a base64-encoded username that begins with a valid shortname, or (2) a username that matches a valid password, as…

  • CVE-2008-6983Aug 19, 2009
    Devalcms
    Devalcms
    risk 0.03cvss —epss 0.06

    modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file specified in the gv_folder_data parameter, as demonstrated by modifying modules/tool/url2header.php.

  • CVE-2008-6982Aug 19, 2009
    Devalcms
    Devalcms
    risk 0.03cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in index.php in devalcms 1.4a allows remote attackers to inject arbitrary web script or HTML via the currentpath parameter.

  • CVE-2008-6981Aug 19, 2009
    Phpadultsite
    Phpadultsite CMS
    risk 0.00cvss —epss 0.01

    index.php in phpAdultSite CMS, possibly 2.3.2, allows remote attackers to obtain the full installation path via an invalid results_per_page parameter, which leaks the path in an error message. NOTE: this issue might be resultant from a separate SQL injection vulnerability.

  • CVE-2008-6980Aug 19, 2009
    Phpadultsite
    Phpadultsite CMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in as_archives.php in phpAdultSite CMS, possibly 2.3.2, allows remote attackers to execute arbitrary SQL commands via the results_per_page parameter to index.php. NOTE: some of these details are obtained from third party information.

  • CVE-2008-6979Aug 19, 2009
    Phpadultsite
    Phpadultsite CMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in as_archives.php in phpAdultSite CMS, possibly 2.3.2, allows remote attackers to inject arbitrary web script or HTML via the results_per_page parameter to index.php. NOTE: some of these details are obtained from third party…

  • CVE-2008-6978Aug 19, 2009
    Fullrevolution
    Aspwebalbum
    risk 0.03cvss —epss 0.04

    Unrestricted file upload vulnerability in Full Revolution aspWebAlbum 3.2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in pics/, related to the uploadmedia action in…

  • CVE-2008-6977Aug 19, 2009
    Fullrevolution
    Aspwebalbum
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in album.asp in Full Revolution aspWebAlbum 3.2 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a summary action.

  • CVE-2008-6976Aug 19, 2009
    Mikrotik
    Routeros
    risk 0.04cvss —epss 0.09

    MikroTik RouterOS 3.x through 3.13 and 2.x through 2.9.51 allows remote attackers to modify Network Management System (NMS) settings via a crafted SNMP set request.

  • CVE-2009-2856Aug 18, 2009
    Sun Corporation
    Virtual Desktop Infrastructure
    risk 0.00cvss —epss 0.01

    Sun Virtual Desktop Infrastructure (VDI) 3.0, when anonymous binding is enabled, does not properly handle a client's attempt to establish an authenticated and encrypted connection, which might allow remote attackers to read cleartext VDI configuration-data requests by sniffing…

  • CVE-2009-1878Aug 18, 2009
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.02

    Session fixation vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to hijack web sessions via unspecified vectors.

  • CVE-2009-1877Aug 18, 2009
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1875.

  • CVE-2009-1876Aug 18, 2009
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.03

    Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspecified vectors, related to a "double-encoded null character vulnerability."

  • CVE-2009-1875Aug 18, 2009
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1877.

  • CVE-2009-1874Aug 18, 2009
    Adobe Inc.
    Jrun
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Adobe JRun 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-1873Aug 18, 2009
    Adobe Inc.
    Jrun
    risk 0.03cvss —epss 0.05

    Directory traversal vulnerability in logging/logviewer.jsp in the Management Console in Adobe JRun Application Server 4 Updater 7 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the logfile parameter.

  • CVE-2009-1872Aug 18, 2009
    Adobe Inc.
    Coldfusion
    risk 0.04cvss —epss 0.16

    Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2)…

  • CVE-2009-2855Aug 18, 2009
    Squid Cache
    Squid
    risk 0.03cvss —epss 0.37

    The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.

  • CVE-2009-2854Aug 18, 2009
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to (1) edit-comments.php, (2) edit-pages.php, (3) edit.php, (4) edit-category-form.php, (5)…

  • CVE-2009-2853Aug 18, 2009
    WordPress
    WordPress
    risk 0.00cvss —epss 0.05

    Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-form-comment.php, (5) edit-link-category-form.php, (6) edit-link-form.php, (7) edit-page-form.php, and…

  • CVE-2009-2852Aug 18, 2009
    WordPress
    Wp Syntax
    risk 0.03cvss —epss 0.05

    WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_head] array parameter to test/index.php, which is used in a call to the call_user_func_array function.

  • CVE-2009-2851Aug 18, 2009
    WordPress
    WordPress
    risk 0.00cvss —epss 0.08

    Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via a comment author URL.

  • CVE-2009-2850Aug 18, 2009
    Nasa
    Common Data Format
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in NASA Common Data Format (CDF) allow context-dependent attackers to execute arbitrary code, as demonstrated using (1) an array index error in the ReadAEDRList64 function, and other errors in the (2) SearchForRecord_r_64, (3) LastRecord64, (4)…

  • CVE-2009-2849Aug 18, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The md driver (drivers/md/md.c) in the Linux kernel before 2.6.30.2 might allow local users to cause a denial of service (NULL pointer dereference) via vectors related to "suspend_* sysfs attributes" and the (1) suspend_lo_store or (2) suspend_hi_store functions. NOTE: this is…

  • CVE-2009-2848Aug 18, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with…

  • CVE-2009-2847Aug 18, 2009
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not clear certain padding bytes from a structure, which allows local users to obtain sensitive information from the kernel stack via…

  • CVE-2009-2846Aug 18, 2009
    Linux
    Kernel
    risk 0.01cvss —epss 0.08

    The eisa_eeprom_read function in the parisc isa-eeprom component (drivers/parisc/eisa_eeprom.c) in the Linux kernel before 2.6.31-rc6 allows local users to access restricted memory via a negative ppos argument, which bypasses a check that assumes that ppos is positive and causes…

  • CVE-2009-2844Aug 18, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    cfg80211 in net/wireless/scan.c in the Linux kernel 2.6.30-rc1 and other versions before 2.6.31-rc6 allows remote attackers to cause a denial of service (crash) via a sequence of beacon frames in which one frame omits an SSID Information Element (IE) and the subsequent frame…

  • CVE-2009-2792Aug 17, 2009
    Simple CMS
    Simple CMS
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in plugings/pagecontent.php in Really Simple CMS (RSCMS) 0.3a allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PT parameter.

  • CVE-2009-2791Aug 17, 2009
    Webdynamite
    Projectbutler
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in pda_projects.php in WebDynamite ProjectButler 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the offset parameter.

  • CVE-2009-2790Aug 17, 2009
    Softbizscripts
    Dating Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in cat_products.php in SoftBiz Dating Script allows remote attackers to execute arbitrary SQL commands via the cid parameter. NOTE: this might overlap CVE-2006-3271.4.

  • CVE-2009-2789Aug 17, 2009
    Joomla
    Permis
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Permis (com_groups) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a list action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2009-2788Aug 17, 2009
    Mobilelib
    GOLD
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Mobilelib GOLD 3 allow remote attackers to execute arbitrary SQL commands via the (1) adminName parameter to cp/auth.php, (2) cid parameter to artcat.php, and (3) catid parameter to show.php.

  • CVE-2009-2787Aug 17, 2009
    Reputation
    Reputation
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in include/reputation/rep_profile.php in the Reputation plugin 2.2.4, 2.2.3, 2.0.4, and earlier for PunBB, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files…

  • CVE-2009-2786Aug 17, 2009
    Reputation
    Reputation
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in reputation.php in the Reputation plugin 2.2.4, 2.2.3, 2.0.4, and earlier for PunBB allows remote attackers to execute arbitrary SQL commands via the poster parameter.

  • CVE-2009-2785Aug 17, 2009
    Classifiedphpscript
    PHP Open Classifieds Script
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in PHP Open Classifieds Script allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter to buy.php and the id parameter to (2) contact.php and (3) tellafriend.php.

  • CVE-2009-2784Aug 17, 2009
    Ditcms
    Dit.CMS
    risk 0.03cvss —epss 0.04

    Multiple directory traversal vulnerabilities in dit.cms 1.3, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the path parameter to index.php in (1) install/, (2) menus/left_rightslideopen/, (3)…

  • CVE-2009-2783Aug 17, 2009
    XOOPS
    Xoops
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.3.3 allow remote attackers to inject arbitrary web script or HTML via the (1) op parameter to modules/pm/viewpmsg.php and (2) query string to modules/profile/user.php.

  • CVE-2009-2782Aug 17, 2009
    Jfusion
    Com Jfusion
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JFusion (com_jfusion) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.

  • CVE-2009-2781Aug 17, 2009
    Arab Portal
    Arab Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in forum.php in Arab Portal 2.x, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the qc parameter in an addcomment action, a different vector than CVE-2006-1666.

  • CVE-2009-2780Aug 17, 2009
    68 Classifieds
    68 Classifieds
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in 68 Classifieds 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to category.php, view parameter to (2) login.php and (3) viewlisting.php, page parameter to (4) searchresults.php and…