VYPR

CVEs

345,051 total · page 6191 of 6,902

AllCriticalHighKEV
  • CVE-2008-6483Mar 18, 2009
    Ecom Solutions
    VirtueMart Google Base
    risk 0.05cvss —epss 0.20

    PHP remote file inclusion vulnerability in admin.googlebase.php in the Ecom Solutions VirtueMart Google Base (aka com_googlebase or Froogle) component 1.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2008-6482Mar 18, 2009
    Joomla
    Flash Tree Gallery
    risk 0.04cvss —epss 0.16

    PHP remote file inclusion vulnerability in admin.treeg.php in the Flash Tree Gallery (com_treeg) component 1.0 for Joomla!, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the mosConfig_live_site parameter.

  • CVE-2008-4564Mar 18, 2009
    IBM
    Lotus Notes
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in wp6sr.dll in the Autonomy KeyView SDK 10.4 and earlier, as used in IBM Lotus Notes, Symantec Mail Security (SMS) products, Symantec BrightMail Appliance products, and Symantec Data Loss Prevention (DLP) products, allows remote attackers to execute…

  • CVE-2007-5543Mar 18, 2009
    Miranda Im
    Miranda Im
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in Miranda IM 0.6.8 and 0.7.0 allows remote attackers to execute arbitrary code via a crafted Yahoo! Messenger packet. NOTE: this might overlap CVE-2007-5590.

  • CVE-2007-5542Mar 18, 2009
    Miranda Im
    Miranda Im
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in Miranda IM 0.6.8 allows remote attackers to execute arbitrary code via a crafted Yahoo! Messenger packet. NOTE: this might overlap CVE-2007-5590.

  • CVE-2009-0939Mar 18, 2009
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Tor before 0.2.0.34 treats incomplete IPv4 addresses as valid, which has unknown impact and attack vectors related to "Spec conformance," as demonstrated using 192.168.0.

  • CVE-2009-0938Mar 18, 2009
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Tor before 0.2.0.34 allows directory mirrors to cause a denial of service (exit node crash) via "malformed input."

  • CVE-2009-0937Mar 18, 2009
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Tor before 0.2.0.34 allows directory mirrors to cause a denial of service via unknown vectors.

  • CVE-2009-0936Mar 18, 2009
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Tor before 0.2.0.34 allows attackers to cause a denial of service (infinite loop) via "corrupt votes."

  • CVE-2009-0935MedMar 18, 2009
    Linux
    Kernel
    risk 0.36cvss 5.5epss 0.00

    The inotify_read function in the Linux kernel 2.6.27 to 2.6.27.13, 2.6.28 to 2.6.28.2, and 2.6.29-rc3 allows local users to cause a denial of service (OOPS) via a read with an invalid address to an inotify instance, which causes the device's event list mutex to be unlocked twice…

  • CVE-2009-0934Mar 18, 2009
    Ejabberd
    ejabberd
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ejabberd before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to links and MUC logs.

  • CVE-2009-0933Mar 17, 2009
    Dotclear
    Dotclear
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the administrative interface in Dotclear before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-0932Mar 17, 2009
    Horde (software)
    Horde
    risk 0.06cvss —epss 0.41

    Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Horde_Image driver name.

  • CVE-2009-0931Mar 17, 2009
    Horde (software)
    Horde
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the tag cloud search script (horde/services/portal/cloud_search.php) in Horde before 3.2.4 and 3.3.3, and Horde Groupware before 1.1.5, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-0930Mar 17, 2009
    Horde (software)
    Imp
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 4.2.2 and 4.3.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) smime.php, (2) pgp.php, and (3) message.php.

  • CVE-2009-0929Mar 17, 2009
    Nucleus CMS
    Nucleus CMS
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the media manager in Nucleus CMS before 3.40 allows remote attackers to read arbitrary files via unknown vectors.

  • CVE-2009-0926Mar 17, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the UFS filesystem functionality in Sun OpenSolaris snv_86 through snv_91, when running in 32-bit mode on x86 systems, allows local users to cause a denial of service (panic) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage…

  • CVE-2009-0925Mar 17, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Sun Solaris 10 on SPARC sun4v systems, and OpenSolaris snv_47 through snv_85, allows local users to cause a denial of service (hang of UFS filesystem write) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage routines, aka CR…

  • CVE-2009-0924Mar 17, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Sun OpenSolaris snv_39 through snv_45, when running in 64-bit mode on x86 architectures, allows local users to cause a denial of service (hang of UFS filesystem write) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage routines,…

  • CVE-2009-0923Mar 17, 2009
    Solaris
    Kerberos Incremental Propagation
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Kerberos Incremental Propagation in Solaris 10 and OpenSolaris snv_01 through snv_110 allows remote attackers to cause a denial of service (loss of incremental propagation requests to slave KDC servers) via unknown vectors related to the master Key…

  • CVE-2008-6481Mar 17, 2009
    Joomla
    com_versioning
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Versioning component (com_versioning) 1.0.2 in Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit task to index.php.

  • CVE-2009-0922Mar 17, 2009
    PostgreSQL
    PostgreSQL
    risk 0.04cvss —epss 0.10

    PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumption and crash) by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using…

  • CVE-2009-0919Mar 16, 2009
    Xampp
    XAMPP
    risk 0.01cvss —epss 0.07

    XAMPP installs multiple packages with insecure default passwords, which makes it easier for remote attackers to obtain access via (1) the "lampp" default password for the "nobody" account within the included ProFTPD installation, (2) a blank default password for the "root"…

  • CVE-2009-0918Mar 16, 2009
    Dflabs
    Ptk
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in DFLabs PTK 1.0.0 through 1.0.4 allow remote attackers to execute arbitrary commands in processes launched by PTK's Apache HTTP Server via (1) "external tools" or (2) a crafted forensic image.

  • CVE-2009-0917Mar 16, 2009
    Dflabs
    Ptk
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in DFLabs PTK 1.0.0 through 1.0.4 allows remote attackers to inject arbitrary web script or HTML by providing a forensic image containing HTML documents, which are rendered in web browsers during inspection by PTK. NOTE: the vendor…

  • CVE-2009-0916Mar 16, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Opera before 9.64 has unknown impact and attack vectors, related to a "moderately severe issue."

  • CVE-2009-0915Mar 16, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Opera before 9.64 allows remote attackers to conduct cross-domain scripting attacks via unspecified vectors related to plug-ins.

  • CVE-2009-0914Mar 16, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.05

    Opera before 9.64 allows remote attackers to execute arbitrary code via a crafted JPEG image that triggers memory corruption.

  • CVE-2009-0508Mar 16, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.03

    The Servlet Engine/Web Container and JSP components in IBM WebSphere Application Server (WAS) 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3 allow remote attackers to read arbitrary files contained in war files in (1) web-inf, (2) meta-inf,…

  • CVE-2008-6480Mar 16, 2009
    DataLife Engine
    DataLife Engine
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in engine/modules/imagepreview.php in Datalife Engine 6.7 allows remote attackers to hijack the authentication of arbitrary users for requests that use a modified image parameter.

  • CVE-2008-6479Mar 16, 2009
    Parallels
    Virtuozzo
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the "change password" feature in the VZPP web interface for Parallels Virtuozzo 25.4.swsoft (build 3.0.0-25.4.swsoft) allows remote attackers to modify the password via a link or IMG tag to vz/cp/pwd.

  • CVE-2008-6478Mar 16, 2009
    Parallels
    Virtuozzo Containers
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the file manager in the VZPP web interface for Parallels Virtuozzo 365.6.swsoft (build 4.0.0-365.6.swsoft) and 25.4.swsoft (build 3.0.0-25.4.swsoft) allows remote attackers to create and delete arbitrary files as the…

  • CVE-2009-0913Mar 16, 2009
    Solaris
    keysock kernel module
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the keysock kernel module in Solaris 10 and OpenSolaris builds snv_01 through snv_108 allows local users to cause a denial of service (system panic) via unknown vectors related to PF_KEY socket, probably related to setting socket options.

  • CVE-2009-0912Mar 16, 2009
    Mandriva
    Linux
    risk 0.00cvss —epss 0.00

    perl-MDK-Common 1.1.11 and 1.1.24, 1.2.9 through 1.2.14, and possibly other versions, in Mandriva Linux does not properly handle strings when writing them to configuration files, which allows attackers to gain privileges via "special characters" in unspecified vectors.

  • CVE-2008-6477Mar 16, 2009
    Mumbo Jumbo Media
    OP4
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Mumbo Jumbo Media OP4 allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

  • CVE-2008-6476Mar 16, 2009
    BlogEngine.NET
    BlogEngine.NET
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in blog/search.aspx in BlogEngine.NET allows remote attackers to inject arbitrary web script or HTML via the q parameter.

  • CVE-2008-6475Mar 16, 2009
    Drake Team
    Drake CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earlier allows remote attackers to execute arbitrary SQL commands via the Via HTTP header (HTTP_VIA) to index.php.

  • CVE-2008-6474Mar 16, 2009
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.03

    The management interface in F5 BIG-IP 9.4.3 allows remote authenticated users with Resource Manager privileges to inject arbitrary Perl code via unspecified configuration settings related to Perl EP3 with templates, probably triggering static code injection.

  • CVE-2008-6473Mar 16, 2009
    Blogator Script
    Blogator Script
    risk 0.03cvss —epss 0.02

    _blogadata/include/init_pass2.php in Blogator-script 0.95 allows remote attackers to change the password for arbitrary users via a modified "a" parameter with a "%" wildcard symbol in the b parameter.

  • CVE-2009-0824Mar 14, 2009
    Slysoft
    Anydvd
    risk 0.03cvss —epss 0.01

    Elaborate Bytes ElbyCDIO.sys 6.0.2.0 and earlier, as distributed in SlySoft AnyDVD before 6.5.2.6, Virtual CloneDrive 5.4.2.3 and earlier, CloneDVD 2.9.2.0 and earlier, and CloneCD 5.3.1.3 and earlier, uses the METHOD_NEITHER communication method for IOCTLs and does not properly…

  • CVE-2009-0587Mar 14, 2009
    Evolution
    evolution-data-server
    risk 0.00cvss —epss 0.03

    Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation in (1) addressbook/libebook/e-vcard.c in evc or (2)…

  • CVE-2009-0586Mar 14, 2009
    Gstreamer
    Gstreamer
    risk 0.00cvss —epss 0.06

    Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that…

  • CVE-2009-0585Mar 14, 2009
    Libsoup
    Libsoup
    risk 0.00cvss —epss 0.04

    Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation.

  • CVE-2009-0582Mar 14, 2009
    Evolution
    evolution-data-server
    risk 0.00cvss —epss 0.02

    The ntlm_challenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server (aka evolution-data-server) 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is…

  • CVE-2009-0143Mar 14, 2009
    Apple Inc.
    iTunes
    risk 0.00cvss —epss 0.02

    Apple iTunes before 8.1 does not properly inform the user about the origin of an authentication request, which makes it easier for remote podcast servers to trick a user into providing a username and password when subscribing to a crafted podcast.

  • CVE-2009-0016Mar 14, 2009
    Apple Inc.
    iTunes
    risk 0.00cvss —epss 0.02

    Apple iTunes before 8.1 on Windows allows remote attackers to cause a denial of service (infinite loop) via a Digital Audio Access Protocol (DAAP) message with a crafted Content-Length header.

  • CVE-2008-6472Mar 14, 2009
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The WLCCP dissector in Wireshark 0.99.7 through 1.0.4 allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.

  • CVE-2008-4316Mar 14, 2009
    Glib
    glib
    risk 0.00cvss —epss 0.00

    Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation.

  • CVE-2008-6471Mar 13, 2009
    Mountaingrafix
    Easylink
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in detail.php in MountainGrafix easyLink 1.1.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter in a show action.

  • CVE-2008-6470Mar 13, 2009
    Clansphere
    Clansphere
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in ClanSphere before 2008.2.1 allow remote attackers to obtain sensitive information, and possibly have unknown other impact, via vectors related to "javascript insert" and the (1) mods/messages/getusers.php and (2) mods/abcode/listimg.php…