VYPR

CVEs

344,817 total · page 6337 of 6,897

AllCriticalHighKEV
  • CVE-2007-6193Nov 30, 2007
    Citrix Systems
    Netscaler
    risk 0.00cvss —epss 0.01

    The web management interface in Citrix NetScaler 8.0 build 47.8 stores the device's primary IP address in a cookie, which might allow remote attackers to obtain sensitive network configuration information if this address is not the same as the address being used by the web…

  • CVE-2007-6172Nov 30, 2007
    WpQuiz
    WpQuiz
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) viewimage.php and (2) comments.php.

  • CVE-2007-6173Nov 30, 2007
    Liferay
    Liferay Enterprise Portal
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in c/portal/login in Liferay Enterprise Portal 4.3.1 allows remote attackers to inject arbitrary web script or HTML via the emailAddress parameter in a Send New Password action, a different vector than CVE-2007-6055. NOTE: some of these…

  • CVE-2007-6174Nov 30, 2007
    Phpdevshell
    Phpdevshell
    risk 0.00cvss —epss 0.01

    PHPDevShell before 0.7.0 allows remote authenticated users to gain privileges via a crafted request to update a user profile. NOTE: some of these details are obtained from third party information.

  • CVE-2007-6175Nov 30, 2007
    Lhaplus
    Lhaplus
    risk 0.00cvss —epss 0.03

    Buffer overflow in Lhaplus 1.55 and earlier allows remote attackers to execute arbitrary code via a crafted LZH archive, a different vector than CVE-2007-5048.

  • CVE-2007-6176Nov 30, 2007
    Amensa Soft
    K\+b Bestellsystem
    risk 0.03cvss —epss 0.05

    kb_whois.cgi in K+B-Bestellsystem (aka KB-Bestellsystem) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) domain or (2) tld parameter in a check_owner action.

  • CVE-2007-6177Nov 30, 2007
    PHP Con
    PHP Con
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in Exchange/include.php in PHP_CON 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the webappcfg[APPPATH] parameter.

  • CVE-2007-6178Nov 30, 2007
    Easy Hosting Control Panel
    Easy Hosting Control Panel
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Easy Hosting Control Panel for Ubuntu (EHCP) 0.22.8 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the confdir parameter to (1) dbutil.bck.php and (2) dbutil.php in config/.

  • CVE-2007-6179Nov 30, 2007
    Charray's CMS
    Charray's CMS
    risk 0.04cvss —epss 0.08

    Multiple PHP remote file inclusion vulnerabilities in Charray's CMS 0.9.3 allow remote attackers to execute arbitrary PHP code via a URL in the ccms_library_path parameter to (1) markdown.php and (2) gallery.php in decoder/.

  • CVE-2007-6180Nov 30, 2007
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.01

    Race condition in the Remote Procedure Call kernel module (rpcmod) in Sun Solaris 8 through 10 allows local users to cause a denial of service (NULL dereference and panic) via unspecified vectors.

  • CVE-2007-6181Nov 30, 2007
    Cygwin
    Cygwin
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in cygwin1.dll in Cygwin 1.5.7 and earlier allows context-dependent attackers to execute arbitrary code via a filename with a certain length, as demonstrated by a remote authenticated user who uses the SCP protocol to send a file to the Cygwin machine,…

  • CVE-2007-6182Nov 30, 2007
    ISPsystem
    ISPmanager
    risk 0.03cvss —epss 0.01

    The responder program in ISPsystem ISPmanager (aka ISPmgr) 4.2.15.1 allows local users to gain privileges via shell metacharacters in command line arguments.

  • CVE-2007-6183Nov 30, 2007
    Ruby Gnome2
    Ruby Gnome2
    risk 0.00cvss —epss 0.03

    Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via format string specifiers in the message…

  • CVE-2007-6184Nov 30, 2007
    Project Alumni
    Project Alumni
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter.

  • CVE-2007-6185Nov 30, 2007
    Eurologon
    Eurologon CMS
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in users/files.php in Eurologon CMS allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in a download action, as demonstrated by a certain PHP file containing database credentials.

  • CVE-2007-6186Nov 30, 2007
    Phpdevshell
    Phpdevshell
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in PHPDevShell before 0.7.0 has unknown impact and attack vectors, involving a "minor security bug in repair & optimize database."

  • CVE-2007-4346Nov 29, 2007
    Symantec
    Backup Exec For Windows Server
    risk 0.00cvss —epss 0.03

    The Job Engine (bengine.exe) service in Symantec Backup Exec for Windows Servers (BEWS) 11d build 11.0.7170 and 11.0.6.6235 allows remote attackers to cause a denial of service (NULL dereference and service crash) via a crafted packet to port 5633/tcp.

  • CVE-2007-4347Nov 29, 2007
    Symantec
    Backup Exec For Windows Server
    risk 0.00cvss —epss 0.03

    Multiple integer overflows in the Job Engine (bengine.exe) service in Symantec Backup Exec for Windows Servers (BEWS) 11d build 11.0.7170 and 11.0.6.6235 allow remote attackers to cause a denial of service (CPU and memory consumption) via a crafted packet to port 5633/tcp, which…

  • CVE-2007-6156Nov 29, 2007
    Secureideas
    Base
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in base_qry_main.php in Base Analysis and Security Engine (BASE) before 1.3.9 allow remote attackers to inject arbitrary web script or HTML via the (1) sig[0] and (2) sig[1] parameters.

  • CVE-2007-6157Nov 29, 2007
    Simplegallery
    Simplegallery
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in SimpleGallery 0.1.3 allows remote attackers to inject arbitrary web script or HTML via the album parameter.

  • CVE-2007-6158Nov 29, 2007
    Proverbs
    Proverbs Web Calendar
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in caladmin.inc.php in Proverbs Web Calendar 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) loginname (aka Username) and (2) loginpass (aka Password) parameters to caladmin.php.

  • CVE-2007-6159Nov 29, 2007
    Tilde CMS Project
    CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Tilde CMS 4.x and earlier allows remote attackers to execute arbitrary SQL commands via the aarstal parameter in a yeardetail action, a different vector than CVE-2006-1500.

  • CVE-2007-6160Nov 29, 2007
    Tilde CMS Project
    CMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Tilde CMS 4.x and earlier allows remote attackers to inject arbitrary web script or HTML via the aarstal parameter in a yeardetail action.

  • CVE-2007-6161Nov 29, 2007
    Tilde CMS Project
    CMS
    risk 0.00cvss —epss 0.01

    index.php in Tilde CMS 4.x and earlier allows remote attackers to obtain sensitive information via a certain search parameter value in a search action, which reveals the path.

  • CVE-2007-6162Nov 29, 2007
    Wsdeluxe
    Fmdeluxe
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in FMDeluxe 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a category action.

  • CVE-2007-6163Nov 29, 2007
    Gouae
    Dwd Realty
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/index2.asp in GOUAE DWD Realty allows remote attackers to execute arbitrary SQL commands via the pword (aka Password) parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2007-6164Nov 29, 2007
    Eurologon
    Eurologon CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Eurologon CMS allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) reviews.php, (2) links.php and (3) articles.php.

  • CVE-2007-6165Nov 29, 2007
    Apple Inc.
    Mac OS X
    risk 0.07cvss —epss 0.45

    Mail in Apple Mac OS X Leopard (10.5.1) allows user-assisted remote attackers to execute arbitrary code via an AppleDouble attachment containing an apparently-safe file type and script in a resource fork, which does not warn the user that a separate program is going to be…

  • CVE-2007-6166Nov 29, 2007
    Apple Inc.
    Quicktime
    risk 0.06cvss —epss 0.42

    Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.

  • CVE-2007-6167Nov 29, 2007
    SUSE S.A.
    Linux
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in yast2-core in SUSE Linux might allow local users to execute arbitrary code by creating a malicious yast2 module in the current working directory.

  • CVE-2007-6168Nov 29, 2007
    Vu
    Case Manager
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in default.asp in VU Case Manager allows remote attackers to execute arbitrary SQL commands via the username parameter, a different vector than CVE-2007-6143. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2007-6169Nov 29, 2007
    Gouae
    Dwd Realty
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in admin/index2.asp in GOUAE DWD Realty allows remote attackers to execute arbitrary SQL commands via the uname parameter, a different vector than CVE-2007-6163. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2007-4674Nov 27, 2007
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.04

    An "integer arithmetic" error in Apple QuickTime 7.2 allows remote attackers to execute arbitrary code via a crafted movie file containing a movie atom with a large size value, which triggers a stack-based buffer overflow.

  • CVE-2007-6133Nov 27, 2007
    Devmass
    Shopping Cart
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin/kfm/initialise.php in DevMass Shopping Cart 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the kfm_base_path parameter.

  • CVE-2007-6134Nov 27, 2007
    Phpkit
    Phpkit
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pkinc/public/article.php in PHPKIT 1.6.4pl1 allows remote attackers to execute arbitrary SQL commands via the contentid parameter in an article action to include.php, a different vector than CVE-2006-1773.

  • CVE-2007-6135Nov 27, 2007
    Phpslideshow
    Phpslideshow
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in phpslideshow.php in PHPSlideShow 0.9.9.2, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the directory parameter. NOTE: this issue was originally reported for toonchapter8.php, but this is…

  • CVE-2007-6136Nov 27, 2007
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in M2Scripts MySpace Scripts Poll Creator allow remote attackers to inject arbitrary web script or HTML via the (1) title, (2) intro, and (3) question parameters, and (4) unspecified answer parameters, in a…

  • CVE-2007-6137Nov 27, 2007
    Content Injector
    Content Injector
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.php in Content Injector 1.52 allows remote attackers to execute arbitrary SQL commands via the cat parameter to index.php. NOTE: some of these details are obtained from third party information.

  • CVE-2007-6138Nov 27, 2007
    Vu
    Mass Mailer
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in redir.asp in VU Mass Mailer allows remote attackers to execute arbitrary SQL commands via the password parameter to Default.asp (aka the Login Page). NOTE: some of these details are obtained from third party information.

  • CVE-2007-6139Nov 27, 2007
    Mp3 ToolBox
    Mp3 ToolBox
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in Mp3 ToolBox 1.0 beta 5 allows remote attackers to execute arbitrary PHP code via a URL in the skin_file parameter.

  • CVE-2007-6140Nov 27, 2007
    Dora Emlak
    Dora Emlak
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Dora Emlak 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) emlak_detay.asp and (b) haber_detay.asp, the (2) kategori parameter to (c) kategorisirala.asp, and the (3) tip parameter to (d)…

  • CVE-2007-6141Nov 27, 2007
    Vbtube
    Vbtube
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in vBTube.php in vBTube 1.1 Beta allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2007-6142Nov 27, 2007
    Jaf CMS
    Jaf CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC2 allow remote attackers to inject arbitrary web script or HTML via the (1) show parameter to index.php and the (2) print parameter to print.php. NOTE: the provenance of this…

  • CVE-2007-6143Nov 27, 2007
    Vu
    Case Manager
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in default.asp (aka the Login Page) in VU Case Manager allows remote attackers to execute arbitrary SQL commands via the password parameter.

  • CVE-2007-6144Nov 27, 2007
    Xunlei
    Thunder
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in the PPlayer.XPPlayer.1 ActiveX control in pplayer.dll_1_work in Xunlei Thunder 5.7.4.401 allows remote attackers to execute arbitrary code via a long string in a FlvPlayerUrl property value. NOTE: some of these details are obtained from third party…

  • CVE-2007-6145Nov 27, 2007
    Hitachi
    Jp1 File Transmission Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Hitachi JP1/File Transmission Server/FTP 01-00 through 08-10-01 allows remote attackers to bypass authentication and "view files" via unspecified vectors.

  • CVE-2007-6146Nov 27, 2007
    Hitachi
    Jp1 File Transmission Server
    risk 0.00cvss —epss 0.02

    Hitachi JP1/File Transmission Server/FTP 01-00 through 08-10-02 on Windows might allow remote attackers to cause a denial of service (service stop) via a "specific file" argument to an FTP command.

  • CVE-2007-6147Nov 27, 2007
    Iaprcommence
    Iapr Commence
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in IAPR COMMENCE 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the (a) php_root_path and sometimes the (b) privilege_root_path parameter to various PHP scripts under (1) admin/includes/, (2) admin/phase/,…

  • CVE-2007-5959Nov 26, 2007
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger memory corruption.

  • CVE-2007-5960Nov 26, 2007
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass…