VYPR

CVEs

345,196 total · page 6172 of 6,904

AllCriticalHighKEV
  • CVE-2008-6813May 22, 2009
    PhpWebNews
    phpWebNews
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in phpWebNews 0.2 MySQL Edition allows remote attackers to execute arbitrary SQL commands via the id_kat parameter.

  • CVE-2008-6812May 22, 2009
    PhpWebNews
    phpWebNews
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in bukutamu.php in phpWebNews 0.2 MySQL Edition allows remote attackers to execute arbitrary SQL commands via the det parameter.

  • CVE-2009-1746May 21, 2009
    Dian Gemilang
    Dgnews
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in berita.php in Dian Gemilang DGNews 3.0 Beta allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.

  • CVE-2009-1745May 21, 2009
    Armorlogic
    Profense Web Application Firewall
    risk 0.00cvss —epss 0.02

    Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, has a default root password hash, and permits password-based root logins over SSH, which makes it easier for remote attackers to obtain access.

  • CVE-2009-0897May 21, 2009
    IBM
    Websphere Partner Gateway
    risk 0.00cvss —epss 0.01

    IBM WebSphere Partner Gateway (WPG) 6.1.0 before 6.1.0.1 and 6.1.1 before 6.1.1.1 allows remote authenticated users to obtain sensitive information via vectors related to the "schema DB2 instance id" and the bcgarchive (aka the archiver script).

  • CVE-2009-1729May 21, 2009
    Sun Corporation
    Java System Communications Express
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express 6 2005Q4 (aka 6.2) and 6.3 allow remote attackers to inject arbitrary web script or HTML via (1) the abperson_displayName parameter to uwc/abs/search.xml in the Add Contact…

  • CVE-2009-1594May 21, 2009
    Armorlogic
    Profense Web Application Firewall
    risk 0.00cvss —epss 0.01

    Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "positive model," which allows remote attackers to bypass certain protection mechanisms via a %0A (encoded newline), as demonstrated by a %0A in a cross-site…

  • CVE-2009-1593May 21, 2009
    Armorlogic
    Profense Web Application Firewall
    risk 0.03cvss —epss 0.02

    Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "negative model," which allows remote attackers to conduct cross-site scripting (XSS) attacks via a modified end tag of a SCRIPT element.

  • CVE-2009-1161May 21, 2009
    Cisco Systems, Inc.
    Ciscoworks Common Services
    risk 0.01cvss —epss 0.13

    Directory traversal vulnerability in the TFTP service in Cisco CiscoWorks Common Services (CWCS) 3.0.x through 3.2.x on Windows, as used in Cisco Unified Service Monitor, Security Manager, TelePresence Readiness Assessment Manager, Unified Operations Manager, Unified…

  • CVE-2009-1744May 21, 2009
    Pinnaclesys
    Pinnacle Studio
    risk 0.03cvss —epss 0.02

    InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote attackers to cause a denial of service (application crash) via a crafted Hollywood FX Compressed Archive (.hfz) file.

  • CVE-2009-1743May 21, 2009
    Pinnaclesys
    Pinnacle Studio
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote attackers to create and overwrite arbitrary files via a filename containing a ..\ (dot dot backslash) sequence in a…

  • CVE-2009-1742May 20, 2009
    risk 0.03cvss —epss 0.01

    code.php in PC4Arb Pc4 Uploader 9.0 and earlier makes it easier for remote attackers to conduct SQL injection attacks via crafted keyword sequences that are removed from a filter in the id parameter in a banner action, as demonstrated via the "UNIunionON" string, which is…

  • CVE-2009-1741May 20, 2009
    DM
    FileManager
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in login.php in DM FileManager 3.9.2, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.

  • CVE-2009-1740May 20, 2009
    Dlink
    MPEG4 Viewer ActiveX Control
    risk 0.00cvss —epss 0.06

    Multiple heap-based buffer overflows in the D-Link MPEG4 Viewer ActiveX Control (csviewer.ocx) 2.11.918.2006 allow remote attackers to execute arbitrary code via a long argument to the (1) SetFilePath and (2) SetClientCookie methods. NOTE: the provenance of this information is…

  • CVE-2009-1739May 20, 2009
    Pad Site Scripts
    Pad Site Scripts
    risk 0.03cvss —epss 0.03

    PAD Site Scripts 3.6 allows remote attackers to bypass authentication and gain privileges as other users, including administrative privileges, by setting the authuser cookie parameter to a valid username.

  • CVE-2009-1738May 20, 2009
    Drupal
    Feed Block
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Feed Block 6.x-1.x before 6.x-1.1, a module for Drupal, allows remote authenticated users with administrator feed permissions to inject arbitrary web script or HTML via unspecified vectors in "aggregator items."

  • CVE-2009-1737May 20, 2009
    MyPic
    MyPic
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in bom.php in MyPic 2.1 allows remote attackers to list files in arbitrary directories via a .. (dot dot) in the dir parameter.

  • CVE-2009-1736May 20, 2009
    Joomla
    Com Gsticketsystem
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the GridSupport (GS) Ticket System (com_gsticketsystem) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a viewCategory action to index.php.

  • CVE-2009-1735May 20, 2009
    VidSharePro
    VidSharePro
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search.php in VidSharePro allows remote attackers to inject arbitrary web script or HTML via the searchtxt parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-1734May 20, 2009
    VidSharePro
    VidSharePro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in listing_video.php in VidSharePro allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2009-1733May 20, 2009
    Richard Ellerbrock
    Ipplan
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IPplan 4.91a allows remote attackers to hijack the authentication of administrators for requests that (1) change the password, (2) add users, or (3) delete users via unknown vectors.

  • CVE-2009-1732May 20, 2009
    Richard Ellerbrock
    Ipplan
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/usermanager in IPplan 4.91a allows remote attackers to inject arbitrary web script or HTML via the grp parameter.

  • CVE-2009-1731May 20, 2009
    Mlffat
    Mlffat
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in panel/index.php in MLFFAT 2.1 allows remote attackers to execute arbitrary SQL commands via a base64-encoded supervisor cookie.

  • CVE-2009-1730May 20, 2009
    Netmechanica
    Netdecision TFTP Server
    risk 0.07cvss —epss 0.55

    Multiple directory traversal vulnerabilities in NetMechanica NetDecision TFTP Server 4.2 allow remote attackers to read or modify arbitrary files via directory traversal sequences in the (1) GET or (2) PUT command.

  • CVE-2009-1418May 19, 2009
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 3.0.1.73 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-1379May 19, 2009
    OpenSSL Project
    OpenSSL
    risk 0.04cvss —epss 0.18

    Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a…

  • CVE-2009-1378May 19, 2009
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.13

    Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers…

  • CVE-2009-1377May 19, 2009
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.11

    The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer…

  • CVE-2009-1252May 19, 2009
    NTP
    NTP
    risk 0.02cvss —epss 0.21

    Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.

  • CVE-2009-1678May 18, 2009
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the version parameter to boards/boards_rss.php.

  • CVE-2009-1677May 18, 2009
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.02

    Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow (1) remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's "display name" setting and…

  • CVE-2009-1675May 18, 2009
    Electrasoft
    32bit FTP
    risk 0.04cvss —epss 0.14

    Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a long 227 reply to a PASV command.

  • CVE-2009-1674May 18, 2009
    Microchip
    Mplab Ide
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in Microchip MPLAB IDE 8.30 allows user-assisted remote attackers to execute arbitrary code via a long .cof pathname in a [TOOL_SETTINGS] section in a .mcp file, possibly a related issue to CVE-2009-1608.

  • CVE-2009-1673May 18, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    The kernel in Sun Solaris 9 allows local users to cause a denial of service (panic) by calling fstat with a first argument of AT_FDCWD.

  • CVE-2009-1672May 18, 2009
    Sun Corporation
    Jre
    risk 0.04cvss —epss 0.10

    The Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13 allows remote attackers to (1) execute arbitrary code via a .jnlp URL in the argument to the launch method, and might allow remote attackers to launch JRE…

  • CVE-2009-1671May 18, 2009
    Sun Corporation
    Jre
    risk 0.04cvss —epss 0.10

    Multiple buffer overflows in the Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13 allow remote attackers to execute arbitrary code via a long string argument to the (1) setInstallerType, (2)…

  • CVE-2009-1670May 18, 2009
    Tcpdb
    Tcpdb
    risk 0.04cvss —epss 0.07

    user/index.php in TCPDB 3.8 does not require administrative authentication, which allows remote attackers to add admin accounts via unspecified vectors. NOTE: some of these details are obtained from third party information.

  • CVE-2009-1669May 18, 2009
    Smarty
    Smarty
    risk 0.04cvss —epss 0.14

    The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function. NOTE: some of these details are obtained from third…

  • CVE-2009-1668May 18, 2009
    Typsoft
    Typsoft FTP Server
    risk 0.03cvss —epss 0.06

    TYPSoft FTP Server 1.11 allows remote attackers to cause a denial of service (CPU consumption) by sending an ABOR (abort) command without an active file transfer.

  • CVE-2009-1667May 18, 2009
    Mini Stream
    Castripper
    risk 0.05cvss —epss 0.21

    Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a long entry in a .m3u file, a different vector than CVE-2009-5137.

  • CVE-2009-1666May 18, 2009
    Cyclomedia
    Cycloscopelite
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in CycloMedia CycloScopeLite 2.50.3.0 allow remote attackers to execute arbitrary code via the ReturnConnection method in (1) CM_ADOConnection.dll, (2) CM_AddressInfoDBC.dll, and (3) CM_RecordingLocationDBC.dll, related to improper…

  • CVE-2009-0721May 18, 2009
    Microfocus
    Remote Graphics Software
    risk 0.01cvss —epss 0.10

    Unspecified vulnerability in Easy Login in the Sender module in HP Remote Graphics Software (RGS) 4.0.0 through 5.2.4 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2009-1665May 18, 2009
    Easy Scripts
    Answer And Question Script
    risk 0.03cvss —epss 0.02

    myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to remove arbitrary user accounts via a modified userid parameter without specifying any additional fields.

  • CVE-2009-1664May 18, 2009
    Easy Scripts
    Answer And Question Script
    risk 0.03cvss —epss 0.02

    myaccount.php in Easy Scripts Answer and Question Script does not verify the original password before changing passwords, which allows remote attackers to change the password of other users and gain privileges via modified userid, txtpassword, and txtRpassword parameters.

  • CVE-2009-1663May 18, 2009
    Easy Scripts
    Answer And Question Script
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads/[username]…

  • CVE-2009-1662May 18, 2009
    Recipescript
    Recipe Script
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in admin/login.php in Wright Way Services Recipe Script 5 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) Password fields, as reachable from admin/index.php.

  • CVE-2009-1661May 18, 2009
    UTopic
    uTopic
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/utopic.php in uTopic 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the rating parameter to index.php.

  • CVE-2009-1660May 18, 2009
    URUWorks
    ViPlay3
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in URUWorks ViPlay3 3.0 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long file entry in a .vpl file.

  • CVE-2009-1659May 18, 2009
    Intelliants
    Elitius
    risk 0.03cvss —epss 0.02

    Unrestricted file upload vulnerability in admin/uploadimage.php in eLitius 1.0 allows remote attackers to bypass intended access restrictions and upload and execute arbitrary files via an avatar file with an accepted Content-Type such as image/gif, then requesting the file in…

  • CVE-2009-1658May 18, 2009
    Realty Webware Technologies
    Web-Base
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in admin/admin.php in Realty Webware Technologies Realty Web-Base 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) user (username) and (2) password parameters. NOTE: some of these details are obtained from third…