VYPR

CVEs

345,196 total · page 6153 of 6,904

AllCriticalHighKEV
  • CVE-2009-2642Jul 28, 2009
    Desi
    Short URL Script
    risk 0.03cvss —epss 0.02

    index.php in Desi Short URL Script 1.0 allows remote attackers to bypass authentication by setting the logged cookie to 1 and the uid cookie to an integer value, as demonstrated by a value of 13.

  • CVE-2009-2641Jul 28, 2009
    School Data Navigator
    School Data Navigator
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in app_and_readme/navigator/index.php in School Data Navigator allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via ..…

  • CVE-2009-2640Jul 28, 2009
    Interlogy
    Profile Manager
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in cgi/admin.cgi in Interlogy Profile Manager Basic allow remote attackers to execute arbitrary SQL commands via a pmadm cookie in (1) an edittemp action or (2) a users action.

  • CVE-2009-2639Jul 28, 2009
    Mrcgiguy
    The Ticket System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin.php in MRCGIGUY The Ticket System 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewticket action.

  • CVE-2009-2638Jul 28, 2009
    Joomla
    Akobook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the AkoBook (com_akobook) component 2.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gbid parameter in a reply action to index.php.

  • CVE-2009-2637Jul 28, 2009
    Joomla
    BookLibrary
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in toolbar_ext.php in the BookLibrary (com_booklibrary) component 1.5.2.4 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2009-2636Jul 28, 2009
    Kerio Technologies
    Kerio Mailserver
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Integration page in the WebMail component in Kerio MailServer 6.6.0, 6.6.1, 6.6.2, and 6.7.0 allows remote attackers to inject arbitrary web script or HTML via an e-mail message.

  • CVE-2009-2635Jul 28, 2009
    Joomla
    RealEstateManager
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in toolbar_ext.php in the RealEstateManager (com_realestatemanager) component 1.0 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2009-2634Jul 28, 2009
    Joomla
    MediaLibrary
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in toolbar_ext.php in the MediaLibrary (com_media_library) component 1.5.3 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2009-2633Jul 28, 2009
    Joomla
    VehicleManager
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in toolbar_ext.php in the VehicleManager (com_vehiclemanager) component 1.0 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2009-2622Jul 28, 2009
    Squid Cache
    Squid
    risk 0.05cvss —epss 0.57

    Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) "missing or mismatched protocol identifier," (2) missing or negative status value," (3) "missing version," or (4) "missing or invalid…

  • CVE-2009-2621Jul 28, 2009
    Squid Cache
    Squid
    risk 0.02cvss —epss 0.23

    Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 does not properly enforce "buffer limits and related bound checks," which allows remote attackers to cause a denial of service via (1) an incomplete request or (2) a request with a large header size, related to (a)…

  • CVE-2009-2619Jul 27, 2009
    DataCheck Solutions
    V-SpacePal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.asp in DataCheck Solutions V-SpacePal allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2009-2618Jul 27, 2009
    MDPro
    Surveys
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Surveys (aka NS-Polls) module in MDPro (MD-Pro) 1.083.x allows remote attackers to execute arbitrary SQL commands via the pollID parameter in a results action to modules.php.

  • CVE-2009-2617Jul 27, 2009
    Baofeng
    Storm
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in medialib.dll in BaoFeng Storm 3.9.62 allows remote attackers to execute arbitrary code via a long pathname in the source attribute of an item element in a .smpl playlist file.

  • CVE-2009-2616Jul 27, 2009
    DataCheck Solutions
    SitePal
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in z_admin_login.asp in DataCheck Solutions SitePal 1.x allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2009-2615Jul 27, 2009
    DataCheck Solutions
    SitePal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in DataCheck Solutions SitePal 1.x allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) z_admin_login.asp, (2) z_forgot.asp, and possibly unspecified other components. NOTE: the…

  • CVE-2009-2614Jul 27, 2009
    Datachecknh
    Linkpal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in z_admin_login.asp in DataCheck Solutions LinkPal 1.x allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2009-2613Jul 27, 2009
    DataCheck Solutions
    LinkPal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in DataCheck Solutions LinkPal 1.x allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) z_loginfailed.asp, (2) z_admin_login.asp, (3) z_forgot.asp, and possibly unspecified other…

  • CVE-2009-2612Jul 27, 2009
    Prosmdr
    Prosmdr
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in login.aspx in ProSMDR allows remote attackers to execute arbitrary SQL commands via the txtUser parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2009-2611Jul 27, 2009
    Gander
    Myfusion
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in infusions/last_seen_users_panel/last_seen_users_panel.php in MyFusion (aka MyF) 6 Beta, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the settings[locale]…

  • CVE-2009-2610Jul 27, 2009
    Drupal
    Links Related
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Links Related module in the Links Package 5.x before 5.x-1.13 and 6.x before 6.x-1.2, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via the title field.

  • CVE-2009-2609Jul 27, 2009
    Joomla
    amoCourse
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the amoCourse (com_amocourse) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a category action to index.php.

  • CVE-2009-2608Jul 27, 2009
    PHP Address
    PHP Address
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in PHP Address Book 4.0.x allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to delete.php or (2) alphabet parameter to index.php. NOTE: the edit.php and view.php vectors are already covered by CVE-2008-2565.

  • CVE-2009-2607Jul 27, 2009
    Joomla
    com_pinboard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the com_pinboard component for Joomla! allows remote attackers to execute arbitrary SQL commands via the task parameter in a showpic action to index.php.

  • CVE-2009-2606Jul 27, 2009
    Brainjar
    Asp Football Pool
    risk 0.03cvss —epss 0.02

    ASP Football Pool 2.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for NFL.mdb.

  • CVE-2009-2605Jul 27, 2009
    Traidnt
    Traidnt Up
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in adminquery.php in Traidnt Up 2.0 allow remote attackers to execute arbitrary SQL commands via (1) trupuser and (2) truppassword cookies to uploadcp/index.php.

  • CVE-2009-2604Jul 27, 2009
    Zenhelpdesk
    Zen Help Desk
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in adminlogin.asp in Zen Help Desk 2.1 allow remote attackers to execute arbitrary SQL commands via the (1) userid (aka username) and (2) PassWord parameters to admin.asp.

  • CVE-2009-2603Jul 27, 2009
    Escon
    SupportPortal Pro
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Escon SupportPortal Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) cat and (2) tid parameters.

  • CVE-2009-2602Jul 27, 2009
    WordPress
    R2 Newsletter
    risk 0.03cvss —epss 0.02

    R2 Newsletter Lite, Pro, and Stats stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for admin.mdb.

  • CVE-2009-2601Jul 27, 2009
    Joomlaequipment
    Juser
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Joomlaequipment (aka JUser or com_juser) component 2.0.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a show_profile action to index.php.

  • CVE-2009-2600Jul 27, 2009
    Webboa
    Webboa
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in view.php in Webboard 2.90 beta and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the topic parameter.

  • CVE-2009-2599Jul 27, 2009
    RadCLASSIFIEDS
    RadCLASSIFIEDS Gold
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in RadCLASSIFIEDS Gold 2.0 allows remote attackers to execute arbitrary SQL commands via the seller parameter in a search action.

  • CVE-2009-2598Jul 27, 2009
    Online Grades & Attendance
    Online Grades & Attendance
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Online Grades & Attendance 3.2.6 and earlier allow (1) remote attackers to execute arbitrary SQL commands via the key parameter in a resetpass action to index.php and (2) remote authenticated users to execute arbitrary SQL commands via…

  • CVE-2009-2597Jul 27, 2009
    Sun Corporation
    Access Manager Policy Agent
    risk 0.00cvss —epss 0.03

    The Sun Java System (SJS) Access Manager Policy Agent module 2.2 for SJS Web Proxy Server 4.0 allows remote attackers to cause a denial of service (daemon crash) via a GET request.

  • CVE-2009-2596Jul 27, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Solaris Auditing subsystem in Sun Solaris 9 and 10 and OpenSolaris before snv_121, when extended file attributes are used, allows local users to cause a denial of service (panic) via vectors related to fad_aupath structure members.

  • CVE-2008-6878Jul 27, 2009
    Zen Cart
    ZenCart
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _SESSION[language] parameter. NOTE:…

  • CVE-2008-6877Jul 27, 2009
    Zen Cart
    ZenCart
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the loader_file parameter. NOTE: the vendor disputes this…

  • CVE-2008-6876Jul 24, 2009
    EsPartenaires
    EsPartenaires
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in login.php in EsPartenaires 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: the EsContacts 1.0 issue is covered in CVE-2008-2037.

  • CVE-2009-2595Jul 24, 2009
    Censura
    Censura
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in productSearch.html in Censura 2.0.4 and 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a ProductSearch action.

  • CVE-2009-2594Jul 24, 2009
    Censura
    Censura
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in censura.php in Censura 1.16.04 allows remote attackers to inject arbitrary web script or HTML via the itemid parameter in a details action.

  • CVE-2009-2593Jul 24, 2009
    Censura
    Censura
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in censura.php in Censura 1.16.04 allows remote attackers to execute arbitrary SQL commands via the itemid parameter in a details action.

  • CVE-2009-2592Jul 24, 2009
    Phpjunkyard
    Gbook
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in guestbook.php in PHPJunkYard GBook 1.6 allows remote attackers to execute arbitrary SQL commands via the mes_id parameter.

  • CVE-2009-2591Jul 24, 2009
    Runcms
    Myannonces
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the MyAnnonces module for E-Xoopport 3.1 allows remote attackers to execute arbitrary SQL commands via the lid parameter in a viewannonces action to index.php.

  • CVE-2009-2590Jul 24, 2009
    Hutscripts
    PHP Website Script
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in showcategory.php in Hutscripts PHP Website Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2009-2589Jul 24, 2009
    Hutscripts
    PHP Website Script
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Hutscripts PHP Website Script allow remote attackers to inject arbitrary web script or HTML via the msg parameter to (1) feedback.php, (2) index.php, and (3) lostpassword.php.

  • CVE-2009-2588Jul 24, 2009
    Resalecode
    Hotscripts Type PHP Clone Script
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Hotscripts Type PHP Clone Script allow remote attackers to inject arbitrary web script or HTML via the msg parameter to (1) feedback.php, (2) index.php, and (3) lostpassword.php.

  • CVE-2009-2587Jul 24, 2009
    Dragdropcart
    Dragdropcart
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in DragDropCart allow remote attackers to inject arbitrary web script or HTML via the (1) sid parameter to assets/js/ddcart.php, the (2) prefix parameter to includes/ajax/getstate.php, the search parameter to (3) index.php and…

  • CVE-2009-2586Jul 24, 2009
    Edgephp
    Ezarticles
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in articles.php in EDGEPHP EZArticles allows remote attackers to inject arbitrary web script or HTML via the title parameter.

  • CVE-2009-2585Jul 24, 2009
    Mlffat
    Mlffat
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Mlffat 2.2 allows remote attackers to execute arbitrary SQL commands via a member cookie in an account editprofile action, a different vector than CVE-2009-1731.