VYPR

CVEs

345,196 total · page 6162 of 6,904

AllCriticalHighKEV
  • CVE-2009-2210Jun 25, 2009
    Mozilla Corporation
    Thunderbird
    risk 0.00cvss —epss 0.04

    Mozilla Thunderbird before 2.0.0.22 and SeaMonkey before 1.1.17 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a multipart/alternative e-mail message containing a text/enhanced part that triggers access to an…

  • CVE-2009-1203Jun 25, 2009
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.03cvss —epss 0.04

    WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 does not properly distinguish its own login screen from the login screens it produces for third-party (1) FTP and (2) CIFS servers, which makes it easier for remote attackers to…

  • CVE-2009-1202Jun 25, 2009
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass certain protection mechanisms involving URL rewriting and HTML rewriting, and conduct cross-site scripting (XSS) attacks, by modifying the first…

  • CVE-2009-1201Jun 25, 2009
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.04cvss —epss 0.09

    Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by…

  • CVE-2009-2209Jun 25, 2009
    Rs CMS
    Rs CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in rscms_mod_newsview.php in RS-CMS 2.1 allows remote attackers to execute arbitrary SQL commands via the key parameter.

  • CVE-2009-2208Jun 25, 2009
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.00

    FreeBSD 6.3, 6.4, 7.1, and 7.2 does not enforce permissions on the SIOCSIFINFO_IN6 IOCTL, which allows local users to modify or disable IPv6 network interfaces, as demonstrated by modifying the MTU.

  • CVE-2009-2185Jun 25, 2009
    Strongswan
    Strongswan
    risk 0.00cvss —epss 0.02

    The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of…

  • CVE-2009-2187Jun 25, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Multiple memory leaks in the (1) IP and (2) IPv6 multicast implementation in the kernel in Sun Solaris 10, and OpenSolaris snv_67 through snv_93, allow local users to cause a denial of service (memory consumption) via vectors related to the association of (a) DL_ENABMULTI_REQ…

  • CVE-2009-2186Jun 25, 2009
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Adobe Shockwave Player before 11.0.0.465 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2009-1860, related to an older issue that "was previously resolved in Shockwave Player 11.0.0.465."

  • CVE-2009-2046Jun 25, 2009
    Cisco Systems, Inc.
    Video Surveillance 2500 Series IP Camera
    risk 0.00cvss —epss 0.01

    The embedded web server on the Cisco Video Surveillance 2500 Series IP Camera with firmware before 2.1 allows remote attackers to read arbitrary files via a (1) http or (2) https request, related to the (a) SD Camera Web Server and the (b) Wireless Camera HTTP Server, aka Bug…

  • CVE-2009-2045Jun 25, 2009
    Cisco Systems, Inc.
    Video Surveillance Stream Manager
    risk 0.00cvss —epss 0.02

    The Cisco Video Surveillance Stream Manager firmware before 5.3, as used on Cisco Video Surveillance Services Platforms and Video Surveillance Integrated Services Platforms, allows remote attackers to cause a denial of service (reboot) via a malformed payload in a UDP packet to…

  • CVE-2009-1888Jun 25, 2009
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.05

    The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to…

  • CVE-2009-1886Jun 25, 2009
    Samba (software)
    Samba
    risk 0.04cvss —epss 0.12

    Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 through 3.2.12 might allow context-dependent attackers to execute arbitrary code via format string specifiers in a filename.

  • CVE-2009-1860Jun 25, 2009
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in Adobe Shockwave Player before 11.5.0.600 allows remote attackers to execute arbitrary code via crafted Shockwave Player 10 content.

  • CVE-2009-1163Jun 25, 2009
    Cisco Systems, Inc.
    Physical Access Gateway
    risk 0.00cvss —epss 0.02

    Memory leak on the Cisco Physical Access Gateway with software before 1.1 allows remote attackers to cause a denial of service (memory consumption) via unspecified TCP packets.

  • CVE-2009-0903Jun 25, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3, and the Feature Pack for Web Services for WAS 6.1 before 6.1.0.25, when a WS-Security policy is established at the operation level, does not properly handle inbound requests that lack a SOAPAction or WS-Addressing…

  • CVE-2009-2184Jun 23, 2009
    Gravy Media
    Media Photo Host
    risk 0.03cvss —epss 0.03

    Absolute path traversal vulnerability in forcedownload.php in Gravy Media Photo Host 1.0.8 allows remote attackers to read arbitrary files via an encoded "/" (slash) in the file parameter.

  • CVE-2009-2183Jun 23, 2009
    Sourcefabric
    Campsite
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in admin-files/ad.php in Campsite 3.3.0 RC1 allows remote attackers to read and possibly execute arbitrary local files via a .. (dot dot) in the GLOBALS[g_campsiteDir] parameter.

  • CVE-2009-2182Jun 23, 2009
    Sourcefabric
    Campsite
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Campsite 3.3.0 RC1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[g_campsiteDir] parameter to (1) ad_popup.php, (2) camp_html.php, (3) init_content.php, (4) logout.php, (5) menu.php, and (6)…

  • CVE-2009-2181Jun 23, 2009
    Sourcefabric
    Campsite
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin-files/templates/list_dir.php in Campsite 3.3.0 RC1 allows remote attackers to inject arbitrary web script or HTML via the listbasedir parameter.

  • CVE-2009-2180Jun 23, 2009
    E Uploader
    E-Uploader Pro
    risk 0.03cvss —epss 0.06

    Multiple directory traversal vulnerabilities in upfiles/index.php in Pc4 Uploader 10.0 and earlier allow remote attackers to read arbitrary files via (1) a .. (dot dot) or (2) absolute path in the file parameter.

  • CVE-2009-2179Jun 23, 2009
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in search.php in phpDatingClub 3.7 allows remote attackers to execute arbitrary SQL commands via the sform[day] parameter.

  • CVE-2009-2178Jun 23, 2009
    phpDatingClub
    phpDatingClub
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in website.php in phpDatingClub 3.7 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2009-2177Jun 23, 2009
    Fuzzylime
    cms
    risk 0.03cvss —epss 0.04

    code/display.php in fuzzylime (cms) 3.03a and earlier, when magic_quotes_gpc is disabled, allows remote attackers to conduct directory traversal attacks and overwrite arbitrary files via a "....//" (dot dot) in the s parameter, which is collapsed into a "../" value.

  • CVE-2009-2176Jun 23, 2009
    Fuzzylime
    cms
    risk 0.04cvss —epss 0.07

    Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.03a and earlier, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) list parameter to code/confirm.php and the (2)…

  • CVE-2009-2175Jun 23, 2009
    Xcftools
    xcftools
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in the flattenIncrementally function in flatten.c in xcftools 1.0.4, as reachable from the (1) xcf2pnm and (2) xcf2png utilities, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted image that…

  • CVE-2009-2174Jun 23, 2009
    Gupnp
    Gupnp
    risk 0.03cvss —epss 0.05

    GUPnP 0.12.7 allows remote attackers to cause a denial of service (crash) via an empty (1) subscription or (2) control message.

  • CVE-2009-2173Jun 23, 2009
    Carom3D
    Carom3D
    risk 0.03cvss —epss 0.02

    The LAN game feature in Carom3D 5.06 allows remote authenticated users to cause a denial of service (application hang) via a crafted HTTP request to TCP port 28012.

  • CVE-2009-2172Jun 23, 2009
    Dream
    Radio And Tv Player Addon For Vbulletin
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in forum/radioandtv.php in the Radio and TV Player addon for vBulletin allows remote registered users to inject arbitrary web script or HTML via the station parameter.

  • CVE-2009-2121Jun 23, 2009
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Buffer overflow in the browser kernel in Google Chrome before 2.0.172.33 allows remote HTTP servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted response.

  • CVE-2009-0691Jun 23, 2009
    Foxitsoftware
    Reader
    risk 0.00cvss —epss 0.06

    The Foxit JPEG2000/JBIG2 Decoder add-on before 2.0.2009.616 for Foxit Reader 3.0 before Build 1817 does not properly handle a fatal error during decoding of a JPEG2000 (aka JPX) header, which allows remote attackers to cause a denial of service (memory corruption and application…

  • CVE-2009-0690Jun 23, 2009
    Foxitsoftware
    Reader
    risk 0.00cvss —epss 0.06

    The Foxit JPEG2000/JBIG2 Decoder add-on before 2.0.2009.616 for Foxit Reader 3.0 before Build 1817 does not properly handle a negative value for the stream offset in a JPEG2000 (aka JPX) stream, which allows remote attackers to cause a denial of service (memory corruption and…

  • CVE-2009-2171Jun 23, 2009
    Mahara (software)
    Mahara
    risk 0.00cvss —epss 0.01

    Mahara 1.1 before 1.1.5 does not apply permission checks when saving a view that contains artefacts, which allows remote authenticated users to read another user's artefact.

  • CVE-2009-2170Jun 23, 2009
    Mahara (software)
    Mahara
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0 before 1.0.12 and 1.1 before 1.1.5 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2009-2169Jun 22, 2009
    Edraw
    PDF Viewer Component
    risk 0.03cvss —epss 0.04

    Insecure method vulnerability in the PDFVIEWER.PDFViewerCtrl.1 ActiveX control (pdfviewer.ocx) in Edraw PDF Viewer Component before 3.2.0.126 allows remote attackers to create and overwrite arbitrary files via a URL argument to the FtpConnect argument and a target filename…

  • CVE-2009-2168CriJun 22, 2009
    Egyplus
    7ammel
    risk 0.68cvss 9.8epss 0.12

    cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit when the supplied credentials are incorrect, which allows remote attackers to bypass authentication by providing arbitrary username and password parameters.

  • CVE-2009-2167Jun 22, 2009
    Egyplus
    7ammel
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.

  • CVE-2009-2166Jun 22, 2009
    Ocsinventory Ng
    Ocsinventory Ng
    risk 0.03cvss —epss 0.03

    Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to read arbitrary files via a full pathname in the log parameter.

  • CVE-2009-2165Jun 22, 2009
    Serendipitynz
    Serene Bach
    risk 0.00cvss —epss 0.01

    SerendipityNZ (aka SimpleBoxes) Serene Bach 2.20R and earlier, and 3.00 beta023 and earlier 3.x versions, uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id.

  • CVE-2009-2164Jun 22, 2009
    Kjtechforce
    Mailman
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the code parameter to activate.php or (2) the dest parameter to index.php.

  • CVE-2009-2163Jun 22, 2009
    Sitecore
    CMS
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in login/default.aspx in Sitecore CMS before 6.0.2 Update-1 090507 allows remote attackers to inject arbitrary web script or HTML via the sc_error parameter.

  • CVE-2008-6834Jun 22, 2009
    Fuzzylime
    cms
    risk 0.03cvss —epss 0.04

    Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.01 and 3.01a allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the s parameter to code/commupdate.php in a count action or (2) the heads parameter to code/newsheads.php.…

  • CVE-2008-6833Jun 22, 2009
    Fuzzylime
    cms
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in commsrss.php in fuzzylime (cms) before 3.01b allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a files array element for a blogs action, as demonstrated by the files[0] parameter.

  • CVE-2009-2162Jun 22, 2009
    XOOPS MANIAC
    PukiWikiMod
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the XOOPS MANIAC PukiWikiMod module 1.6.6.2 and earlier for XOOPS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-2161Jun 22, 2009
    Torrenttrader
    Torrenttrader
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic 1.09, when used on a case-insensitive web site, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ss_uri parameter, in conjunction with a…

  • CVE-2009-2160Jun 22, 2009
    Torrenttrader
    Torrenttrader
    risk 0.03cvss —epss 0.03

    TorrentTrader Classic 1.09 allows remote attackers to (1) obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function; and allows remote attackers to (2) obtain other potentially sensitive information via a direct request to check.php.

  • CVE-2009-2159Jun 22, 2009
    Torrenttrader
    Torrenttrader
    risk 0.03cvss —epss 0.03

    backup-database.php in TorrentTrader Classic 1.09 does not require administrative authentication, which allows remote attackers to create and download a backup database by making a direct request and then retrieving a .gz file from backups/.

  • CVE-2009-2158HigJun 22, 2009
    Torrenttrader
    Torrenttrader
    risk 0.52cvss 7.5epss 0.05

    account-recover.php in TorrentTrader Classic 1.09 chooses random passwords from an insufficiently large set, which makes it easier for remote attackers to obtain a password via a brute-force attack.

  • CVE-2009-2157Jun 22, 2009
    Torrenttrader
    Torrenttrader
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to execute arbitrary SQL commands via (1) the origmsg parameter to account-inbox.php; the categ parameter to (2) delreq.php and (3) admin-delreq.php; (4) the choice parameter to…

  • CVE-2009-2156Jun 22, 2009
    Torrenttrader
    Torrenttrader
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Title field to requests.php, related to viewrequests.php; and (2) the Torrent Name field to torrents-upload.php,…