VYPR

CVEs

345,015 total · page 6213 of 6,901

AllCriticalHighKEV
  • CVE-2008-5964Jan 23, 2009
    Impresscms
    Impresscms
    risk 0.00cvss —epss 0.02

    Session fixation vulnerability in Social ImpressCMS before 1.1.1 RC1 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.

  • CVE-2008-5963Jan 23, 2009
    Gravity Gtd
    Gravity Gtd
    risk 0.03cvss —epss 0.03

    Eval injection vulnerability in library/setup/rpc.php in Gravity Getting Things Done (GTD) 0.4.5 and earlier allows remote attackers to execute arbitrary PHP code via the objectname parameter.

  • CVE-2008-5962Jan 23, 2009
    Gravity Gtd
    Gravity Gtd
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in library/setup/rpc.php in Gravity Getting Things Done (GTD) 0.4.5 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the objectname parameter.

  • CVE-2008-5961Jan 23, 2009
    Tribiq
    CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Tribiq CMS Community 5.0.10B and 5.0.11E allows remote attackers to inject arbitrary web script or HTML via the cID parameter in a document action. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2008-5960Jan 23, 2009
    Tribiq
    CMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Tribiq CMS Community 5.0.10B and 5.0.11E allows remote attackers to execute arbitrary SQL commands via the cID parameter in a document action. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2008-5959Jan 23, 2009
    Active Test
    Active Test
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in start.asp in Active Test 2.1 allow remote attackers to execute arbitrary SQL commands via the (1) useremail parameter (aka username field) or (2) password parameter (aka password field). NOTE: some of these details are obtained from…

  • CVE-2008-5958Jan 23, 2009
    Active Test
    Active Test
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Active Test 2.1 allow remote attackers to execute arbitrary SQL commands via the QuizID parameter to (1) questions.asp, (2) importquestions.asp, and (3) quiztakers.asp.

  • CVE-2008-5957Jan 23, 2009
    Mydyngallery
    Mydyngallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Mydyngallery (com_mydyngallery) component 1.4.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the directory parameter to index.php.

  • CVE-2008-5956Jan 23, 2009
    Phpstreet
    Webboard
    risk 0.03cvss —epss 0.03

    Wbstreet (aka PHPSTREET Webboard) 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database credentials via a direct request to connect.inc.

  • CVE-2008-5955Jan 23, 2009
    Phpstreet
    Webboard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in show.php in Wbstreet (aka PHPSTREET Webboard) 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-5954Jan 23, 2009
    KTP Computer
    Ktp Computer Customer Database
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the lname parameter in a login action to an unspecified component. NOTE: the provenance of this…

  • CVE-2008-5953Jan 23, 2009
    KTP Computer
    Ktp Computer Customer Database
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p parameter to the default URI.

  • CVE-2008-5952Jan 23, 2009
    KTP Computer
    Ktp Computer Customer Database
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the tid parameter in a vtech action to the default URI.

  • CVE-2008-5951Jan 23, 2009
    ASP Template Creature
    ASP Template Creature
    risk 0.03cvss —epss 0.02

    ASP Template Creature stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for workDB/templatemonster.mdb.

  • CVE-2008-5950Jan 23, 2009
    ASP Template Creature
    ASP Template Creature
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in media/media_level.asp in ASP Template Creature allows remote attackers to execute arbitrary SQL commands via the mcatid parameter.

  • CVE-2008-5949Jan 23, 2009
    ccTiddly
    ccTiddly
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in ccTiddly 1.7.4 and 1.7.6 allow remote attackers to execute arbitrary PHP code via a URL in the cct_base parameter to (1) index.php; (2) handle/proxy.php; (3) header.php, (4) include.php, and (5) workspace.php in includes/;…

  • CVE-2008-5948Jan 23, 2009
    Bncwi
    Bncwi
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in BNCwi 1.04 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the newlanguage parameter.

  • CVE-2009-0259Jan 22, 2009
    Openoffice
    Openoffice
    risk 0.04cvss —epss 0.07

    The Word processor in OpenOffice.org 1.1.2 through 1.1.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) .doc, (2) .wri, or (3) .rtf Word 97 file that triggers memory corruption, as exploited in the wild in…

  • CVE-2009-0258Jan 22, 2009
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.03

    The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by…

  • CVE-2009-0257Jan 22, 2009
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) content of indexed files to the (a) Indexed Search Engine…

  • CVE-2009-0256Jan 22, 2009
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to hijack web sessions via unspecified vectors related to (1) frontend and (2) backend authentication.

  • CVE-2009-0255HigJan 22, 2009
    TYPO3
    Typo3
    risk 0.53cvss 7.5epss 0.09

    The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which makes it easier for attackers to crack the key.

  • CVE-2009-0254Jan 22, 2009
    Easyhdr
    Easyhdr
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in easyHDR PRO 1.60.2 allows user-assisted attackers to execute arbitrary code via an invalid Flexible Image Transport System (FITS) file. NOTE: some of these details are obtained from third party information.

  • CVE-2009-0253Jan 22, 2009
    Mozilla Corporation
    Firefox
    risk 0.03cvss —epss 0.03

    Mozilla Firefox 3.0.5 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted element to the current mouse position, related to a "Status Bar Obfuscation" and "Clickjacking" attack.

  • CVE-2009-0057Jan 22, 2009
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    The Certificate Authority Proxy Function (CAPF) service in Cisco Unified Communications Manager 5.x before 5.1(3e) and 6.x before 6.1(3) allows remote attackers to cause a denial of service (voice service outage) by sending malformed input over a TCP session in which the "client…

  • CVE-2009-0008Jan 22, 2009
    Apple Inc.
    Quicktime Mpeg 2 Playback Component
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Apple QuickTime MPEG-2 Playback Component before 7.60.92.0 on Windows allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted MPEG-2 movie.

  • CVE-2008-3820Jan 22, 2009
    Cisco Systems, Inc.
    Security Manager
    risk 0.00cvss —epss 0.01

    Cisco Security Manager 3.1 and 3.2 before 3.2.2, when Cisco IPS Event Viewer (IEV) is used, exposes TCP ports used by the MySQL daemon and IEV server, which allows remote attackers to obtain "root access" to IEV via unspecified use of TCP sessions to these ports.

  • CVE-2008-2384Jan 22, 2009
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ (backslash) as part of the character encoding, allows remote attackers to…

  • CVE-2009-0252Jan 22, 2009
    Enthrallweb
    Ereservations
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in default.asp in Enthrallweb eReservations allow remote attackers to execute arbitrary SQL commands via the (1) Login parameter (aka username field) or the (2) Password parameter (aka password field). NOTE: some of these details are…

  • CVE-2009-0251Jan 22, 2009
    Ryneezy
    Phosheezy
    risk 0.03cvss —epss 0.06

    Static code injection vulnerability in admin.php in Ryneezy phoSheezy 0.2 allows remote authenticated administrators to inject arbitrary PHP code into config/footer via the footer parameter. NOTE: this can be exploited by unauthenticated attackers by leveraging CVE-2009-0250.…

  • CVE-2009-0250Jan 22, 2009
    Ryneezy
    Phosheezy
    risk 0.04cvss —epss 0.06

    Ryneezy phoSheezy 0.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the file containing the administrator's password hash via a direct request for config/password.

  • CVE-2009-0249Jan 22, 2009
    Katywhitton
    Rankem
    risk 0.03cvss —epss 0.02

    Katy Whitton RankEm stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for database/topsites.mdb.

  • CVE-2009-0248Jan 22, 2009
    Katywhitton
    Rankem
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to inject arbitrary web script or HTML via the siteID parameter.

  • CVE-2009-0247Jan 22, 2009
    risk 0.00cvss —epss 0.01

    The server for 53KF Web IM 2009 Home, Professional, and Enterprise editions relies on client-side protection mechanisms against cross-site scripting (XSS), which allows remote attackers to conduct XSS attacks by using a modified client to send a crafted IM message, related to…

  • CVE-2009-0246Jan 22, 2009
    Easyhdr
    Easyhdr
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in easyHDR PRO 1.60.2 allows user-assisted attackers to execute arbitrary code via an invalid Radiance RGBE (aka .hdr) file.

  • CVE-2008-5947Jan 22, 2009
    Yapbb
    Yapbb
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in include/class_yapbbcooker.php in YapBB 1.2.Beta 2 allows remote attackers to execute arbitrary PHP code via a URL in the cfgIncludeDirectory parameter.

  • CVE-2008-5946Jan 22, 2009
    PHP-Fusion
    Phpfusion
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in readmore.php in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the news_id parameter.

  • CVE-2008-5945Jan 22, 2009
    Vinades
    NukeViet
    risk 0.03cvss —epss 0.02

    Nukeviet 2.0 Beta allows remote attackers to bypass authentication and gain administrative access by setting the admf cookie to 1. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-5944Jan 22, 2009
    Navboard
    Navboard
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in modules.php in NavBoard 16 (2.6.0) allows remote attackers to inject arbitrary web script or HTML via the module parameter.

  • CVE-2008-5943Jan 22, 2009
    Navboard
    Navboard
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in NavBoard 16 (2.6.0) allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module parameter to (1) admin_modules.php and (2) modules.php.

  • CVE-2008-5942Jan 22, 2009
    Modx
    MODX
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in MODx before 0.9.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the preserveUrls function and (2) "username input." NOTE: vector 2 may be related to CVE-2008-5939.

  • CVE-2008-5941Jan 22, 2009
    Modx
    MODX
    risk 0.00cvss —epss 0.00

    Cross-site request forgery (CSRF) vulnerability in MODx 0.9.6.1p2 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors.

  • CVE-2008-5940Jan 22, 2009
    Modx
    MODX
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in MODx 0.9.6.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the searchid parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2008-5939Jan 22, 2009
    Modx
    MODX
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as…

  • CVE-2008-5938Jan 22, 2009
    Modx
    MODX
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the reflect_base parameter.

  • CVE-2009-0245Jan 22, 2009
    Usagi Project
    MyNETS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Usagi Project MyNETS 1.2.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2008-4629.

  • CVE-2008-5937Jan 22, 2009
    AyeView
    AyeView
    risk 0.03cvss —epss 0.03

    AyeView 2.20 allows user-assisted attackers to cause a denial of service (memory consumption or application crash) via a bitmap (aka .bmp) file with large height and width values.

  • CVE-2008-5936Jan 22, 2009
    Mini Pub
    Mini Pub
    risk 0.03cvss —epss 0.02

    front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a filename in the sFileName parameter.

  • CVE-2009-0244HigJan 21, 2009
    Microsoft
    Windows Mobile
    risk 0.60cvss 8.8epss 0.30

    Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional, and probably Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phone Edition, allows remote authenticated users to list arbitrary directories, and…

  • CVE-2009-0243Jan 21, 2009
    Microsoft
    Windows
    risk 0.01cvss —epss 0.06

    Microsoft Windows does not properly enforce the Autorun and NoDriveTypeAutoRun registry values, which allows physically proximate attackers to execute arbitrary code by (1) inserting CD-ROM media, (2) inserting DVD media, (3) connecting a USB device, and (4) connecting a…