VYPR

CVEs

345,178 total · page 6181 of 6,904

AllCriticalHighKEV
  • CVE-2009-1330Apr 17, 2009
    Mini Stream
    Rm Mp3 Converter
    risk 0.05cvss —epss 0.22

    Stack-based buffer overflow in Easy RM to MP3 Converter allows remote attackers to execute arbitrary code via a long filename in a playlist (.pls) file.

  • CVE-2009-1329Apr 17, 2009
    Mini Stream
    Shadow Stream Recorder
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in Mini-stream Shadow Stream Recorder 3.0.1.7 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.

  • CVE-2009-1328Apr 17, 2009
    Mini Stream
    Rm Mp3 Converter
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in Mini-stream RM-MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.

  • CVE-2009-1327Apr 17, 2009
    Mini Stream
    Wm Downloader
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in Mini-stream WM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.

  • CVE-2009-1326Apr 17, 2009
    Mini Stream
    Rm Downloader
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in Mini-stream RM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.

  • CVE-2009-1325Apr 17, 2009
    Mini Stream
    Ripper
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in Mini-stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.

  • CVE-2009-1324Apr 17, 2009
    Mini Stream
    Asx To Mp3 Converter
    risk 0.04cvss —epss 0.17

    Stack-based buffer overflow in Mini-stream ASX to MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.

  • CVE-2009-1323Apr 17, 2009
    Webfileexplorer
    Web File Explorer
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in body.asp in Web File Explorer 3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-1322Apr 17, 2009
    Humayun Shabbir Bhutta
    Asp Product Catalog
    risk 0.03cvss —epss 0.02

    ASP Product Catalog 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for database/aspProductCatalog.mdb.

  • CVE-2009-1321Apr 17, 2009
    Humayun Shabbir Bhutta
    Asp Product Catalog
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.asp in ASP Product Catalog 1.0 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.

  • CVE-2009-1320Apr 17, 2009
    Zazzle
    Store Builder
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in include/zstore.php in Zazzle Store Builder 1.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) gridPage and (2) gridSort parameters. NOTE: some of these details are obtained from third party…

  • CVE-2009-1319Apr 17, 2009
    Guestcal
    Guest Cal
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in includes/ini.inc.php in GuestCal 2.1 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the lang parameter to index.php.

  • CVE-2009-1318Apr 17, 2009
    Jamroom
    Jamroom
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in Jamroom 3.1.2, 3.2.3 through 3.2.6, 4.0.2, and possibly other versions before 3.4.0 allows remote attackers to include arbitrary files via directory traversal sequences in the t parameter.

  • CVE-2009-1317Apr 17, 2009
    Aquacms
    Aqua CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Aqua CMS 1.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) userSID cookie parameter to droplets/functions/base.php and the (2) username parameter to admin/index.php.

  • CVE-2009-1316Apr 17, 2009
    AbleSpace
    AbleSpace
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in AbleSpace 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to events_view.php and the (2) id parameter to events_clndr_view.php.

  • CVE-2009-1315Apr 17, 2009
    AbleSpace
    AbleSpace
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in AbleSpace 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) gid parameter to groups_profile.php, (2) cat_id and (3) razd_id parameters to adv_cat.php, and the (4) URL to blogs_full.php.

  • CVE-2008-6726Apr 17, 2009
    Cmscout
    Cmscout
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in CMScout 2.06, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the bit parameter to (1) admin.php and (2) index.php, different vectors than CVE-2008-3415.

  • CVE-2008-6725Apr 17, 2009
    Cmscout
    Cmscout
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) index.php in a mythings page (mythings.php) and (2) the users page in admin.php.

  • CVE-2008-6724Apr 17, 2009
    Perl Nopaste
    Perl Nopaste
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.pl in Perl Nopaste 1.0 allows remote attackers to inject arbitrary web script or HTML via the language parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-1314Apr 17, 2009
    Webfileexplorer
    Web File Explorer
    risk 0.04cvss —epss 0.10

    body.asp in Web File Explorer 3.1 allows remote attackers to create arbitrary files and execute arbitrary code via the savefile action with a file parameter containing a filename that has an executable extension.

  • CVE-2009-0946Apr 17, 2009
    FreeType
    Freetype
    risk 0.01cvss —epss 0.09

    Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.

  • CVE-2008-1107Apr 17, 2009
    Danske Bank
    Danskesikker.ocx
    risk 0.00cvss —epss 0.05

    Multiple stack-based buffer overflows in the Danske Bank e-Sec Control Module ActiveX control (DanskeSikker.ocx) 3.1.0.48, and possibly earlier versions, allow remote attackers to execute arbitrary code via long arguments to unspecified methods, which are not properly handled by…

  • CVE-2009-1301Apr 16, 2009
    risk 0.00cvss —epss 0.05

    Integer signedness error in the store_id3_text function in the ID3v2 code in mpg123 before 1.7.2 allows remote attackers to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via an ID3 tag with a negative encoding value. NOTE: some of…

  • CVE-2009-1300Apr 16, 2009
    Debian
    Apt
    risk 0.00cvss —epss 0.02

    apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.

  • CVE-2009-1294Apr 16, 2009
    Novell
    Teaming
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in web/guest/home in the Liferay 4.3.0 portal in Novell Teaming 1.0 through SP3 (1.0.3) allow remote attackers to inject arbitrary web script or HTML via the (1) p_p_state or (2) p_p_mode parameters.

  • CVE-2009-1293Apr 16, 2009
    Novell
    Teaming
    risk 0.00cvss —epss 0.02

    The web login functionality (c/portal/login) in Novell Teaming 1.0 through SP3 (1.0.3) generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames.

  • CVE-2009-1285Apr 16, 2009
    PhpMyAdmin
    phpMyAdmin
    risk 0.04cvss —epss 0.11

    Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files.

  • CVE-2009-0579Apr 16, 2009
    Linux Pam
    Linux Pam
    risk 0.00cvss —epss 0.00

    Linux-PAM before 1.0.4 does not enforce the minimum password age (MINDAYS) as specified in /etc/shadow, which allows local users to bypass intended security policy and change their passwords sooner than specified.

  • CVE-2009-0196Apr 16, 2009
    Artifex
    Ghostscript
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2 decoding library (jbig2dec) in Ghostscript 8.64, and probably earlier versions, allows remote attackers to execute arbitrary code via a PDF file with a JBIG2 symbol dictionary…

  • CVE-2008-5259Apr 16, 2009
    Divx
    Web Player
    risk 0.00cvss —epss 0.06

    Integer signedness error in DivX Web Player 1.4.2.7, and possibly earlier versions, allows remote attackers to execute arbitrary code via a DivX file containing a crafted Stream Format (STRF) chunk, which triggers a heap-based buffer overflow.

  • CVE-2008-4830Apr 16, 2009
    SAP
    KWEdit ActiveX control
    risk 0.05cvss —epss 0.28

    Insecure method vulnerability in the KWEdit ActiveX control in SAP GUI 6.40 Patch 29 (KWEDIT.DLL 6400.1.1.41) and 7.10 Patch 5 (KWEDIT.DLL 7100.1.1.43) allows remote attackers to (1) overwrite arbitrary files via the SaveDocumentAs method or (2) read or execute arbitrary files…

  • CVE-2007-2238Apr 16, 2009
    Microsoft
    Whale Client Components ActiveX control
    risk 0.07cvss —epss 0.46

    Multiple stack-based buffer overflows in the Whale Client Components ActiveX control (WhlMgr.dll), as used in Microsoft Intelligent Application Gateway (IAG) before 3.7 SP2, allow remote attackers to execute arbitrary code via long arguments to the (1) CheckForUpdates or (2)…

  • CVE-2009-1119Apr 15, 2009
    EMC Corporation
    Replistor
    risk 0.00cvss —epss 0.05

    Multiple heap-based buffer overflows in EMC RepliStor 6.2 before SP5 and 6.3 before SP2 allow remote attackers to execute arbitrary code via a crafted message to (1) ctrlservice.exe or (2) rep_srv.exe, possibly related to an integer overflow.

  • CVE-2009-1017Apr 15, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, 10.1.3.3.3, and 10.1.3.4 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2009-0994.

  • CVE-2009-1016Apr 15, 2009
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote authenticated users to affect confidentiality, integrity, and availability, related to IIS. NOTE: the previous information was…

  • CVE-2009-1014Apr 15, 2009
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.19 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-1013.

  • CVE-2009-1013Apr 15, 2009
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.19 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-1014.

  • CVE-2009-1012Apr 15, 2009
    Oracle Corporation
    BEA WebLogic Server
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the plug-ins for Apache and IIS web servers in Oracle BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP3, 10.0 Gold through MP1, and 10.3 allows remote attackers to affect confidentiality, integrity, and…

  • CVE-2009-1011Apr 15, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML. NOTE: the previous information was obtained from the April 2009 CPU. Oracle…

  • CVE-2009-1010Apr 15, 2009
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML, a different vulnerability than CVE-2009-1008.

  • CVE-2009-1009Apr 15, 2009
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.1.9 allows local users to affect confidentiality, integrity, and availability, related to HTML.

  • CVE-2009-1008Apr 15, 2009
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML, a different vulnerability than CVE-2009-1010.

  • CVE-2009-1006Apr 15, 2009
    Bea
    BEA Product Suite
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the JRockit component in BEA Product Suite R27.6.2 and earlier, with SDK/JRE 1.4.2, JRE/JDK 5, and JRE/JDK 6, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

  • CVE-2009-1005Apr 15, 2009
    Oracle Corporation
    Bea Product Suite
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Oracle Data Service Integrator (AquaLogic Data Services Platform) component in BEA Product Suite 10.3.0, 3.2, 3.0.1, and 3.0 allows local users to affect confidentiality, integrity, and availability via unknown vectors.

  • CVE-2009-1004Apr 15, 2009
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3 allows remote attackers to affect confidentiality and integrity via unknown vectors.

  • CVE-2009-1003Apr 15, 2009
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, and 9.0 allows remote attackers to affect integrity via unknown vectors related to "access to source code of web pages."

  • CVE-2009-1002Apr 15, 2009
    Oracle Corporation
    BEA WebLogic Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Oracle BEA WebLogic Server 10.3, 10.0 Gold through MP1, 9.2 Gold through MP3, 9.1, 9.0, 8.1 Gold through SP6, and 7.0 Gold through SP7 allows remote attackers to gain privileges via unknown vectors.

  • CVE-2009-1001Apr 15, 2009
    Oracle Corporation
    Weblogic Portal
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Oracle BEA WebLogic Portal 8.1 Gold through SP6 allows remote authenticated users to gain privileges via unknown vectors.

  • CVE-2009-1000Apr 15, 2009
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.02

    The Oracle Applications Framework component in Oracle E-Business Suite 12.0.6 and 11i10CU2 uses default passwords for unspecified "FND Applications Users (not DB users)," which has unknown impact and attack vectors.

  • CVE-2009-0999Apr 15, 2009
    Oracle Corporation
    Application Object Library
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.