VYPR

CVEs

345,196 total · page 6168 of 6,904

AllCriticalHighKEV
  • CVE-2009-1959Jun 8, 2009
    Irssi
    Irssi
    risk 0.04cvss —epss 0.08

    Off-by-one error in the event_wallops function in fe-common/irc/fe-events.c in irssi 0.8.13 allows remote IRC servers to cause a denial of service (crash) via an empty command, which triggers a one-byte buffer under-read and a one-byte buffer underflow.

  • CVE-2009-1958Jun 8, 2009
    Strongswan
    Strongswan
    risk 0.00cvss —epss 0.03

    charon/sa/tasks/child_create.c in the charon daemon in strongSWAN before 4.3.1 switches the NULL checks for TSi and TSr payloads, which allows remote attackers to cause a denial of service via an IKE_AUTH request without a (1) TSi or (2) TSr traffic selector.

  • CVE-2009-1957Jun 8, 2009
    Strongswan
    Strongswan
    risk 0.00cvss —epss 0.03

    charon/sa/ike_sa.c in the charon daemon in strongSWAN before 4.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid IKE_SA_INIT request that triggers "an incomplete state," followed by a CREATE_CHILD_SA request.

  • CVE-2009-1956Jun 8, 2009
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.12

    Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.

  • CVE-2009-1955HigJun 8, 2009
    Apache
    HTTP Server
    risk 0.49cvss 7.5epss 0.53

    The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document…

  • CVE-2009-1954Jun 8, 2009
    IBM
    Aix
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in portmapper (aka portmap) in IBM AIX 5.3 allows attackers to cause a denial of service (daemon hang) via unknown vectors, related to libtli.

  • CVE-2009-1953Jun 8, 2009
    IBM
    Filenet Content Manager
    risk 0.00cvss —epss 0.01

    IBM FileNet Content Manager 4.0, 4.0.1, and 4.5, as used in IBM WebSphere Application Server (WAS) and Oracle BEA WebLogic Application Server, when the CE Web Services listener has a certain WSEAF configuration, does not properly restrict use of a cached Subject, which allows…

  • CVE-2009-1419Jun 8, 2009
    Microfocus
    Discovery & Dependency Mapping Inventory (DDMI)
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP Discovery & Dependency Mapping Inventory (DDMI) 2.0.0 through 2.52, 7.50, and 7.51 on Windows allows remote attackers to access DDMI agents via unknown vectors.

  • CVE-2009-0023Jun 8, 2009
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.09

    The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive…

  • CVE-2009-1952Jun 5, 2009
    Propertymaxpro
    Propertymax Pro Free
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the administrative login feature in PropertyMax Pro FREE 0.3, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

  • CVE-2009-1951Jun 5, 2009
    Propertymaxpro
    Propertymax Pro Free
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in PropertyMax Pro FREE 0.3 allows remote attackers to inject arbitrary web script or HTML via the pl parameter in a mi action.

  • CVE-2009-1950Jun 5, 2009
    Ahmet Donmez
    Webeyes Guest Book
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in yorum.asp in WebEyes Guest Book 3 allows remote attackers to execute arbitrary SQL commands via the mesajid parameter.

  • CVE-2009-1949Jun 5, 2009
    Unclassified Newsboard
    Newsboard
    risk 0.03cvss —epss 0.03

    import_wbb1.php in Unclassified NewsBoard (UNB) 1.6.4 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message.

  • CVE-2009-1948Jun 5, 2009
    Unclassified Newsboard
    Newsboard
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in forum.php in Unclassified NewsBoard (UNB) 1.6.4, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to (1) read arbitrary recently-modified files via a .. (dot dot) in the GLOBALS[filename]…

  • CVE-2009-1947Jun 5, 2009
    Unclassified Newsboard
    Unclassified Newsboard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the UnbDbEncode function in unb_lib/database.lib.php in Unclassified NewsBoard (UNB) 1.6.4 allows remote attackers to execute arbitrary SQL commands via the Query parameter in a search action to forum.php, a different vector than CVE-2005-3686.

  • CVE-2009-1946Jun 5, 2009
    Adaptcms
    Adaptbb
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in latestposts.php in AdaptBB 1.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the forumspath parameter.

  • CVE-2009-1945Jun 5, 2009
    Tzo
    Webcal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in webCal3_detail.asp in WebCal 3.04 allows remote attackers to execute arbitrary SQL commands via the event_id parameter.

  • CVE-2009-1944Jun 5, 2009
    Aimp
    Aimp
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in AIMP 2.51 build 330 allows remote attackers to execute arbitrary code via an MP3 file with a long ID3 tag.

  • CVE-2009-1943Jun 5, 2009
    Safenet
    Softremote
    risk 0.09cvss —epss 0.72

    Stack-based buffer overflow in the IKE service (ireIke.exe) in SafeNet SoftRemote before 10.8.6 allows remote attackers to execute arbitrary code via a long request to UDP port 62514.

  • CVE-2008-6825Jun 5, 2009
    Trixbox
    Trixbox
    risk 0.05cvss —epss 0.20

    Directory traversal vulnerability in user/index.php in Fonality trixbox CE 2.6.1 and earlier allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the langChoice parameter.

  • CVE-2009-1942Jun 5, 2009
    Drupal
    Quiz
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Quiz module 5.x, 6.x-2.x before 6.x-2.2, and 6.x-3.x before 6.x-3.0, a module for Drupal, allows remote authenticated users, with create quizzes or quiz questions access, to inject arbitrary web script or HTML via unspecified…

  • CVE-2009-1941Jun 5, 2009
    Pad Site Scripts
    Pad Site Scripts
    risk 0.03cvss —epss 0.02

    PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for dbbackup.txt.

  • CVE-2009-1940Jun 5, 2009
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the administrator panel in the com_users core component for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-1939Jun 5, 2009
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the JA_Purity template for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-1938Jun 5, 2009
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to database output and the frontend administrative panel.

  • CVE-2009-1937Jun 5, 2009
    Lightneasy
    Lightneasy
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the comment posting feature in LightNEasy 2.2.1 "no database" (aka flat) and 2.2.2 SQLite allows remote attackers to inject arbitrary web script or HTML via the (1) commentname (aka Author), (2) commentemail (aka Email), and (3)…

  • CVE-2009-1936CriJun 5, 2009
    Cpcommerce
    Cpcommerce
    risk 0.70cvss 9.8epss 0.42

    _functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass a protection mechanism to conduct remote file inclusion and directory traversal attacks, execute arbitrary PHP…

  • CVE-2009-1934Jun 5, 2009
    Sun Corporation
    Java System Web Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Reverse Proxy Plug-in in Sun Java System Web Server 6.1 before SP11 allows remote attackers to inject arbitrary web script or HTML via the query string in situations that result in a 502 Gateway error.

  • CVE-2009-1933Jun 5, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Kerberos in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_117, does not properly manage credential caches, which allows local users to access Kerberized NFS mount points and Kerberized NFS shares via unspecified vectors.

  • CVE-2009-1717Jun 5, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Integer overflow in Terminal in Apple Mac OS X 10.5 before 10.5.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted size value in a CSI[4 xterm resize escape sequence that triggers a heap-based…

  • CVE-2009-1162Jun 5, 2009
    Cisco Systems, Inc.
    Ironport Asyncos
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Spam Quarantine login page in Cisco IronPort AsyncOS before 6.5.2 on Series C, M, and X appliances allows remote attackers to inject arbitrary web script or HTML via the referrer parameter.

  • CVE-2009-0783MedJun 5, 2009
    Apache
    Tomcat
    risk 0.27cvss 4.2epss 0.01

    Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web…

  • CVE-2009-0580Jun 5, 2009
    Apache
    Tomcat
    risk 0.11cvss —epss 0.94

    Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error…

  • CVE-2009-0033Jun 5, 2009
    Apache
    Tomcat
    risk 0.01cvss —epss 0.10

    Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to…

  • CVE-2009-1932Jun 4, 2009
    Gstreamer
    Good Plug Ins
    risk 0.00cvss —epss 0.05

    Multiple integer overflows in the (1) user_info_callback, (2) user_endrow_callback, and (3) gst_pngdec_task functions (ext/libpng/gstpngdec.c) in GStreamer Good Plug-ins (aka gst-plugins-good or gstreamer-plugins-good) 0.10.15 allow remote attackers to cause a denial of service…

  • CVE-2009-1916Jun 4, 2009
    Gscripts
    DNS Tools
    risk 0.04cvss —epss 0.10

    dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the ns parameter.

  • CVE-2009-1915Jun 4, 2009
    Icq
    Icq
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in the URL Search Hook (ICQToolBar.dll) in ICQ 6.5 allows remote attackers to cause a denial of service (persistent crash) and possibly execute arbitrary code via an Internet shortcut .URL file containing a long URL parameter, which triggers a crash…

  • CVE-2009-1914Jun 4, 2009
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    The pci_register_iommu_region function in arch/sparc/kernel/pci_common.c in the Linux kernel before 2.6.29 on the sparc64 platform allows local users to cause a denial of service (system crash) by reading the /proc/iomem file, related to uninitialized pointers and the…

  • CVE-2009-1913Jun 4, 2009
    Luxbum
    Luxbum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in manager.php in LuxBum 0.5.5, when magic_quotes_gpc is disabled and dotclear authentication is used, allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action.

  • CVE-2009-1912Jun 4, 2009
    Webspell
    Webspell
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in src/func/language.php in webSPELL 4.2.0e and earlier allows remote attackers to include and execute arbitrary local .php files via a .. (dot dot) in a language cookie. NOTE: this can be leveraged for SQL injection by including awards.php.

  • CVE-2009-1911Jun 4, 2009
    Tinywebgallery
    Tinywebgallery
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in .include/init.php (aka admin/_include/init.php) in QuiXplorer 2.3.2 and earlier, as used in TinyWebGallery (TWG) 1.7.6 and earlier, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter…

  • CVE-2009-1910Jun 4, 2009
    Rtwebalbum
    RTWebalbum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in RTWebalbum 1.0.462 allows remote attackers to execute arbitrary SQL commands via the AlbumId parameter.

  • CVE-2009-1909Jun 4, 2009
    Openskip
    Skip
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Skip 1.0.2 and earlier, and 1.1RC2 and earlier 1.1RC versions, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-1908Jun 4, 2009
    Openskip
    Skip
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Skip 1.0.2 and earlier, and 1.1RC2 and earlier 1.1RC versions, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-1907Jun 4, 2009
    Claroline
    Claroline
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in claroline/linker/notfound.php in Claroline 1.8.11 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header.

  • CVE-2009-1387Jun 4, 2009
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.10

    The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a "fragment bug."

  • CVE-2009-1386Jun 4, 2009
    OpenSSL Project
    OpenSSL
    risk 0.09cvss —epss 0.80

    ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.

  • CVE-2009-1385Jun 4, 2009
    Intel
    E1000
    risk 0.03cvss —epss 0.33

    Integer underflow in the e1000_clean_rx_irq function in drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel before 2.6.30-rc8, the e1000e driver in the Linux kernel, and Intel Wired Ethernet (aka e1000) before 7.5.5 allows remote attackers to cause a denial of…

  • CVE-2008-6824Jun 4, 2009
    A Link
    Wl54ap3
    risk 0.03cvss —epss 0.04

    The management interface on the A-LINK WL54AP3 and WL54AP2 access points has a blank default password for the admin account, which makes it easier for remote attackers to obtain access.

  • CVE-2008-6823Jun 4, 2009
    A Link
    Wl54ap3
    risk 0.03cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2 access points before firmware 1.4.2-eng1 allow remote attackers to hijack the authentication of administrators for requests that (1) modify the network…