VYPR

CVEs

345,040 total · page 6201 of 6,901

AllCriticalHighKEV
  • CVE-2008-6220Feb 20, 2009
    Simple Document Management System
    SDMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the pass parameter.

  • CVE-2009-0659Feb 20, 2009
    Tptest
    Tptest
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 allows remote attackers to have an unknown impact via a STATS line with a long email field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2009-0658HigFeb 20, 2009
    Adobe Inc.
    Acrobat
    risk 0.61cvss 7.8epss 0.88

    Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as exploited in the wild in February…

  • CVE-2009-0657Feb 20, 2009
    Toshiba
    Face Recognition
    risk 0.00cvss —epss 0.00

    Toshiba Face Recognition 2.0.2.32 allows physically proximate attackers to obtain notebook access by presenting a large number of images for which the viewpoint and lighting have been modified to match a stored image of the authorized notebook user.

  • CVE-2009-0656Feb 20, 2009
    Asus
    Smartlogon
    risk 0.00cvss —epss 0.00

    Asus SmartLogon 1.0.0005 allows physically proximate attackers to bypass "security functions" by presenting an image with a modified viewpoint that matches the posture of a stored image of the authorized notebook user.

  • CVE-2009-0655Feb 20, 2009
    Lenovo
    Veriface III
    risk 0.00cvss —epss 0.00

    Lenovo Veriface III allows physically proximate attackers to login to a Windows account by presenting a "plain image" of the authorized user.

  • CVE-2009-0654Feb 20, 2009
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Tor 0.2.0.28, and probably 0.2.0.34 and earlier, allows remote attackers, with control of an entry router and an exit router, to confirm that a sender and receiver are communicating via vectors involving (1) replaying, (2) modifying, (3) inserting, or (4) deleting a single cell,…

  • CVE-2009-0653Feb 20, 2009
    OpenSSL Project
    OpenSSL
    risk 0.00cvss —epss 0.01

    OpenSSL, probably 0.9.6, does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack, a related issue to CVE-2002-0970.

  • CVE-2009-0652Feb 20, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    The Internationalized Domain Names (IDN) blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows remote attackers to spoof URLs and conduct phishing…

  • CVE-2009-0577Feb 20, 2009
    Apple Inc.
    Cups
    risk 0.00cvss —epss 0.04

    Integer overflow in the WriteProlog function in texttops in CUPS 1.1.17 on Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to execute arbitrary code via a crafted PostScript file that triggers a heap-based buffer overflow. NOTE: this issue exists because of an…

  • CVE-2009-0651Feb 20, 2009
    Symantec
    Netbackup
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Veritas network daemon (aka vnetd) in Symantec Veritas NetBackup Server / Enterprise Server 5.x, 6.0 before MP7 SP1, and 6.5 before 6.5.3.1 allows remote attackers to execute arbitrary code via unknown vectors related to "initial communications…

  • CVE-2009-0650Feb 20, 2009
    Tptest
    Tptest
    risk 0.04cvss —epss 0.13

    Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 and earlier, and possibly 5.02, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a STATS line with a long pwd field. NOTE: some of these…

  • CVE-2009-0649Feb 20, 2009
    Nokia
    N95
    risk 0.04cvss —epss 0.08

    The web browser in Symbian OS on the Nokia N95 cell phone allows remote attackers to cause a denial of service (crash) via JavaScript code that calls the setAttributeNode method.

  • CVE-2008-6219Feb 20, 2009
    EMC Corporation
    Networker
    risk 0.00cvss —epss 0.03

    nsrexecd.exe in multiple EMC Networker products including EMC NetWorker Server, Storage Node, and Client 7.3.x and 7.4, 7.4.1, 7.4.2, Client and Storage Node for Open VMS 7.3.2 ECO6 and earlier, Module for Microsoft Exchange 5.1 and earlier, Module for Microsoft Applications 2.0…

  • CVE-2008-6218Feb 20, 2009
    Libpng
    Libpng
    risk 0.00cvss —epss 0.02

    Memory leak in the png_handle_tEXt function in pngrutil.c in libpng before 1.2.33 rc02 and 1.4.0 beta36 allows context-dependent attackers to cause a denial of service (memory exhaustion) via a crafted PNG file.

  • CVE-2008-6217Feb 20, 2009
    Extrakt Framework
    Extrakt Framework
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Extrakt Framework 0.7 allows remote attackers to inject arbitrary web script or HTML via the plugins[file][id] parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third…

  • CVE-2008-6216Feb 20, 2009
    Venalsur
    Booking Centre Booking System for Hotels Group
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in cadena_ofertas_ext.php in Venalsur Booking Centre Booking System for Hotels Group allows remote attackers to execute arbitrary SQL commands via the OfertaID parameter.

  • CVE-2008-6215Feb 20, 2009
    Venalsur
    Booking Centre Booking System for Hotels Group
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in cadena_ofertas_ext.php in Venalsur Booking Centre Booking System for Hotels Group allows remote attackers to inject arbitrary web script or HTML via the OfertaID parameter.

  • CVE-2008-6214Feb 20, 2009
    Harlandscripts
    Pro Traffic One
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in poll_results.php in Harlandscripts Pro Traffic One allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-6213Feb 20, 2009
    Harlandscripts
    Pro Traffic One
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in mypage.php in Harlandscripts Pro Traffic One allows remote attackers to execute arbitrary SQL commands via the trg parameter.

  • CVE-2009-0643Feb 20, 2009
    Simple PHP News
    Simple PHP News
    risk 0.03cvss —epss 0.05

    Static code injection vulnerability in post.php in Simple PHP News 1.0 final allows remote attackers to inject arbitrary PHP code into news.txt via the post parameter, and then execute the code via a direct request to display.php. NOTE: some of these details are obtained from…

  • CVE-2009-0642Feb 20, 2009
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.03

    ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verify function, which might allow remote attackers to successfully present an invalid X.509 certificate, possibly involving a revoked certificate.

  • CVE-2009-0641Feb 20, 2009
    FreeBSD
    FreeBSD
    risk 0.04cvss —epss 0.09

    sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x versions deletes dangerous environment variables with a method that was valid only in older FreeBSD distributions, which might allow remote attackers to execute arbitrary code by passing a crafted environment variable…

  • CVE-2009-0640Feb 20, 2009
    Swannsecurity
    Dvr4 Securanet
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in the administrative web server in Swann DVR4-SecuraNet allows remote attackers to read arbitrary files via a .. (dot dot) in the URI, as demonstrated by reading the vy_netman.cfg file that contains passwords.

  • CVE-2008-6164Feb 20, 2009
    Dreamcost
    Hostadmin
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in DreamCost HostAdmin 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2008-6163Feb 20, 2009
    Openx
    Openx
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL commands via the bannerid parameter.

  • CVE-2008-6162Feb 20, 2009
    Bux
    Bux.to Clone Script
    risk 0.03cvss —epss 0.03

    Bux.to Clone script allows remote attackers to bypass authentication and gain administrative access by setting the loggedin cookie to 1 and the usNick cookie to admin.

  • CVE-2008-6212Feb 20, 2009
    PHP Stats
    Phpstats
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin.php in Php-Stats 0.1.9.1 allows remote attackers to inject arbitrary web script or HTML via the (1) sel_mese and (2) sel_anno parameters in a systems action. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2008-6211Feb 20, 2009
    PhpForums.net
    mcGallery
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in PhpForums.net mcGallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the lang parameter to (1) admin.php, (2) index.php, (3) sess.php, (4) stats.php, (5) detail.php, (6) resize.php, and (7) show.php.…

  • CVE-2008-6210Feb 20, 2009
    Dream4
    Koobi CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in dream4 Koobi 4.4 and 5.4 allows remote attackers to execute arbitrary SQL commands via the img_id parameter in the gallerypic page.

  • CVE-2008-6209Feb 20, 2009
    Vastal
    Software Zone
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in view_product.php in Vastal I-Tech Software Zone allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.

  • CVE-2008-6208Feb 20, 2009
    E107
    E107
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in submitnews.php in e107 CMS 0.7.11 allows remote attackers to inject arbitrary web script or HTML via the (1) author_name, (2) itemtitle, and (3) item parameters. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2008-6207Feb 20, 2009
    Phpg Upload
    Phpg Upload
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in form_upload.php in PHPG Upload 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file. NOTE: the provenance of this…

  • CVE-2008-6206Feb 20, 2009
    Robotstats
    Robotstats
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in RobotStats 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter to (1) graph.php and (2) robotstats.inc.php. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2008-6205Feb 20, 2009
    Xavier Flahaut
    URLStreet
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in seeurl.php in Xavier Flahaut URLStreet 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) language, (2) order, and (3) filter parameters. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2008-6204Feb 20, 2009
    Supernet
    Supernet Shop
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in SuperNET Shop 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to secure/admin/guncelle.asp, (2) kulad and sifre parameters to secure/admin/giris.asp, and (3) username and password to…

  • CVE-2008-6203Feb 20, 2009
    Cobalt
    CoBaLT
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in adminler.asp in CoBaLT 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-6202Feb 20, 2009
    Cobalt
    CoBaLT
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in CoBaLT 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) urun.asp, (2) admin/bayi_listele.asp, (3) admin/urun_grup_listele.asp, and (4) admin/urun_listele.asp.

  • CVE-2008-6201Feb 20, 2009
    Kwsphp
    Kwsphp
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in help.php in the eskuel module in KwsPHP 1.3.456, as available before 20080416, allows remote attackers to execute arbitrary commands via the action parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2008-6200Feb 20, 2009
    Swiki
    Swiki
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Swiki 1.5 allow remote attackers to inject arbitrary web script or HTML via (1) the query string and (2) a new wiki entry.

  • CVE-2008-6199Feb 20, 2009
    2532designs
    2532|Gigs
    risk 0.03cvss —epss 0.02

    2532designs 2532|Gigs 1.2.2 and earlier allows remote attackers to trigger a backup and obtain sensitive information via a direct request to backup.php, which creates backup.sql under the web root with insufficient access control.

  • CVE-2008-6198Feb 20, 2009
    MyBB
    MyBulletinBoard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pages.php in Custom Pages 1.0 plugin for MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2008-6197Feb 20, 2009
    Kwsphp
    Galerie Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the galerie module for KwsPHP 1.3.456 allows remote attackers to execute arbitrary SQL commands via the id_gal parameter in a gal action.

  • CVE-2008-6196Feb 20, 2009
    Easysitecms
    Easysite
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Philippe CROCHAT EasySite 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the EASYSITE_BASE parameter to (1) browser.php, (2) image_editor.php and (3) skin_chooser.php in configuration/. NOTE: the…

  • CVE-2008-6195Feb 20, 2009
    Ivanti
    Management Suite
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in the PXE TFTP Service (PXEMTFTP.exe) in LANDesk Management Suite (LDMS) 8.80.1.1 and earlier allows remote attackers to read arbitrary files via a subdirectory name followed by ".." sequences, a different vulnerability than CVE-2008-1643.

  • CVE-2008-6194Feb 19, 2009
    Microsoft
    Windows
    risk 0.01cvss —epss 0.11

    Memory leak in the DNS server in Microsoft Windows allows remote attackers to cause a denial of service (memory consumption) via DNS packets. NOTE: this issue reportedly exists because of an incorrect fix for CVE-2007-3898.

  • CVE-2008-6193Feb 19, 2009
    Myblog
    Myblog
    risk 0.03cvss —epss 0.02

    Sam Crew MyBlog stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information.

  • CVE-2008-6192Feb 19, 2009
    Sun Corporation
    Java System Portal Server
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in unspecified Portlets in Sun Java System Portal Server 7.0 and 7.1 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2008-6191Feb 19, 2009
    Intrinsic
    Swimage Encore
    risk 0.00cvss —epss 0.00

    Conductor.exe in Intrinsic Swimage Encore before 5.0.1.21 contains a hardcoded password, which might allow local users to decrypt certain .bin files. NOTE: it is not clear whether this issue crosses privilege boundaries.

  • CVE-2008-6190Feb 19, 2009
    EEBCMS
    EEBCMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in EEBCMS 0.95 allows remote attackers to inject arbitrary web script or HTML via the content parameter.