VYPR

CVEs

344,756 total · page 6351 of 6,896

AllCriticalHighKEV
  • CVE-2007-5370Oct 11, 2007
    Netwin
    Dnewsweb
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/dnewsweb.exe in NetWin DNewsWeb (DNews News Server) 57e1 allow remote attackers to inject arbitrary web script or HTML via the (1) group or (2) utag parameter.

  • CVE-2007-5371Oct 11, 2007
    Modx
    MODX
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in mutate_content.dynamic.php in MODx 0.9.6 allow remote attackers to execute arbitrary SQL commands via the (1) documentDirty or (2) modVariables parameter.

  • CVE-2007-5372Oct 11, 2007
    Ledgersmb
    Ledgersmb
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via (1) the invoice quantity field or (2) the sort field.

  • CVE-2007-5373Oct 11, 2007
    Ldapscripts
    Ldapscripts
    risk 0.00cvss —epss 0.00

    ldapscripts 1.4 and 1.7 sends a password as a command line argument when calling some LDAP programs, which might allow local users to read the password by listing the process and its arguments, as demonstrated by a call to ldappasswd in the _changepassword function.

  • CVE-2007-5374Oct 11, 2007
    Lightblog
    Lightblog
    risk 0.03cvss —epss 0.02

    cp_memberedit.php in LightBlog 8.4.1.1 does not check for administrative credentials when processing an admin action, which allows remote authenticated users to increase the privileges of any account.

  • CVE-2007-5375Oct 11, 2007
    Sun Corporation
    Java Virtual Machine
    risk 0.00cvss —epss 0.01

    Interpretation conflict in the Sun Java Virtual Machine (JVM) allows user-assisted remote attackers to conduct a multi-pin DNS rebinding attack and execute arbitrary JavaScript in an intranet context, when an intranet web server has an HTML document that references a…

  • CVE-2007-5362Oct 11, 2007
    Joomla
    Joomla!
    risk 0.06cvss —epss 0.37

    Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite (com_mosmedia) 4.5.1 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) credits.html.php, (2)…

  • CVE-2007-5363Oct 11, 2007
    Joomla
    Joomla!
    risk 0.06cvss —epss 0.31

    PHP remote file inclusion vulnerability in admin.panoramic.php in the Panoramic Picture Viewer (com_panoramic) mambot (plugin) 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter. NOTE: the provenance of this…

  • CVE-2007-5364Oct 11, 2007
    Viart
    Shopping Cart
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in payments/ideal_process.php in the iDEAL transaction handler in ViArt Shopping Cart allows remote attackers to have an unknown impact via directory traversal sequences in the filename parameter to the createCertFingerprint function. NOTE:…

  • CVE-2007-3896Oct 11, 2007
    Microsoft
    Internet Explorer
    risk 0.07cvss —epss 0.54

    The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid "%" sequences in a mailto: or other URI handler, as demonstrated using mIRC,…

  • CVE-2007-4992Oct 11, 2007
    Firebirdsql
    Firebird
    risk 0.01cvss —epss 0.08

    Stack-based buffer overflow in the process_packet function in fbserver.exe in Firebird SQL 2.0.2 allows remote attackers to execute arbitrary code via a long request to TCP port 3050.

  • CVE-2007-5323Oct 11, 2007
    EMC Corporation
    Replistor
    risk 0.00cvss —epss 0.05

    The RepliStor Server Service in EMC Replistor 6.1.3 allows remote attackers to execute arbitrary code via a size value that causes RepliStor to create a smaller buffer than expected, which triggers a buffer overflow when that buffer is used in a recv function call.

  • CVE-2007-2217Oct 9, 2007
    Kodak
    Image Viewer
    risk 0.06cvss —epss 0.41

    Kodak Image Viewer in Microsoft Windows 2000 SP4, and in some cases XP SP2 and Server 2003 SP1 and SP2, allows remote attackers to execute arbitrary code via crafted image files that trigger memory corruption, as demonstrated by a certain .tif (TIFF) file.

  • CVE-2007-2228Oct 9, 2007
    Microsoft
    Windows 2000
    risk 0.03cvss —epss 0.43

    rpcrt4.dll (aka the RPC runtime library) in Microsoft Windows XP SP2, XP Professional x64 Edition, Server 2003 SP1 and SP2, Server 2003 x64 Edition and x64 Edition SP2, and Vista and Vista x64 Edition allows remote attackers to cause a denial of service (RPCSS service stop and…

  • CVE-2007-3892Oct 9, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.26

    Microsoft Internet Explorer 5.01 through 7 allows remote attackers to spoof the URL address bar and other "trust UI" components via unspecified vectors, a different issue than CVE-2007-1091 and CVE-2007-3826.

  • CVE-2007-3893Oct 9, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.24

    Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via unspecified vectors involving memory corruption from an unhandled error.

  • CVE-2007-3897Oct 9, 2007
    Microsoft
    Outlook Express
    risk 0.04cvss —epss 0.55

    Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption.

  • CVE-2007-3899Oct 9, 2007
    Microsoft
    Word
    risk 0.02cvss —epss 0.29

    Unspecified vulnerability in Microsoft Word 2000 SP3, Word 2002 SP3, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a malformed string in a Word file, aka "Word Memory Corruption Vulnerability."

  • CVE-2007-4466Oct 9, 2007
    Electronic Arts
    Snoopyctrl
    risk 0.05cvss —epss 0.31

    Multiple stack-based buffer overflows in Electronic Arts (EA) SnoopyCtrl ActiveX control (NPSnpy.dll) allow remote attackers to execute arbitrary code via unspecified methods and parameters.

  • CVE-2007-5319Oct 9, 2007
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the vuidmice STREAMS modules in Sun Solaris 8, 9, and 10 allows local users with console (/dev/console) access to cause a denial of service ("unusable" system console) via unspecified vectors.

  • CVE-2007-5320Oct 9, 2007
    Pegasus Imaging
    Imagxpress
    risk 0.04cvss —epss 0.07

    Multiple absolute path traversal vulnerabilities in Pegasus Imaging ImagXpress 8.0 allow remote attackers to (1) delete arbitrary files via the CacheFile attribute in the ThumbnailXpres.1 ActiveX control (PegasusImaging.ActiveX.ThumnailXpress1.dll) or (2) overwrite arbitrary…

  • CVE-2007-5321Oct 9, 2007
    Verlihub Project
    Verlihub Control Panel
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in Verlihub Control Panel (VHCP) 1.7 and earlier allows remote attackers to include arbitrary files via a .. (dot dot) in the page parameter.

  • CVE-2007-5322Oct 9, 2007
    Microsoft
    Visual Foxpro
    risk 0.04cvss —epss 0.19

    Insecure method vulnerability in the FPOLE.OCX 6.0.8450.0 ActiveX control in Microsoft Visual FoxPro 6.0 allows remote attackers to execute arbitrary programs by specifying them as an argument to the FoxDoCmd function.

  • CVE-2007-5309Oct 9, 2007
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in admin.wmtgallery.php in the webmaster-tips.net Flash Image Gallery (com_wmtgallery) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.

  • CVE-2007-5310Oct 9, 2007
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in admin.wmtportfolio.php in the webmaster-tips.net wmtportfolio 1.0 (com_wmtportfolio) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2007-5311Oct 9, 2007
    Torrenttrader
    Torrenttrader
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic Edition 1.07 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ss_uri parameter.

  • CVE-2007-5312Oct 9, 2007
    Torrenttrader
    Torrenttrader
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in TorrentTrader Classic 1.07 allows remote attackers to inject arbitrary web script or HTML via the (1) color parameter to pjirc/css.php and the (2) cat parameter to browse.php.

  • CVE-2007-5313Oct 9, 2007
    Script Solution.de
    Picturesolution
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in install/config.php in Picturesolution 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.

  • CVE-2007-5314Oct 9, 2007
    Xkiosk
    WEB
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in system/funcs/xkurl.php in xKiosk WEB 3.0.1i, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the PEARPATH parameter.

  • CVE-2007-5315Oct 9, 2007
    Softpedia
    Livealbum
    risk 0.06cvss —epss 0.39

    PHP remote file inclusion vulnerability in common.php in LiveAlbum 0.9.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the livealbum_dir parameter.

  • CVE-2007-5316Oct 9, 2007
    Softbizscripts
    Jobs and Recruitment Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in browsecats.php in Softbiz Jobs and Recruitment Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2007-5318Oct 9, 2007
    Typolight
    Typolight Webcms
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in preview.php in TYPOlight webCMS 2.4.6 allows remote attackers to download arbitrary files via the src parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2007-5290Oct 9, 2007
    MailBee
    WebMail Lite ASP
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMail Lite ASP before 4.0.11, and WebMail Lite PHP before 4.0.22; allow remote attackers to inject arbitrary web script or HTML via…

  • CVE-2007-5291Oct 9, 2007
    Daniel Broadbent
    Db Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Edit.asp in DB Manager 2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2007-5292Oct 9, 2007
    Splitside
    Directory Image Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in photos.cfm in Directory Image Gallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the backwardDirectory parameter.

  • CVE-2007-5293Oct 9, 2007
    Idmos
    Idmos
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in IDMOS 1.0-beta (aka Phoenix) allow remote attackers to inject arbitrary web script or HTML via the (1) err_msg parameter to error.php and the (2) content parameter to templates/simple/ia.php.

  • CVE-2007-5294Oct 9, 2007
    Idmos
    Idmos
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in core/aural.php in IDMOS 1.0-beta (aka Phoenix) allows remote attackers to execute arbitrary PHP code via a URL in the site_absolute_path parameter.

  • CVE-2007-5295Oct 9, 2007
    Wikepage
    Opus
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in (a) Wikepage Opus 13 2007.2 and (b) TipiWiki 2 allow remote attackers to inject arbitrary web script or HTML via the (1) PageContent and (2) PageName parameters.

  • CVE-2007-5296Oct 9, 2007
    Livio Siri
    Dblist
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in dblisttest.asp in dbList 8.1 allow remote attackers to inject arbitrary web script or HTML via the (1) db, (2) pagesize, (3) sort, (4) strKeyWords, and (5) table parameters. NOTE: some of these details are obtained from…

  • CVE-2007-5297Oct 9, 2007
    Minki
    Minki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Minki 1.30 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2007-5298Oct 9, 2007
    Creamotion
    Creamotion
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in CMS Creamotion allow remote attackers to execute arbitrary PHP code via a URL in the cfg[document_uri] parameter to (1) _administration/securite.php and (2) _administration/gestion_configurations/save_config.php.

  • CVE-2007-5299Oct 9, 2007
    Skadate
    Skadate Online Dating Software
    risk 0.04cvss —epss 0.08

    Multiple directory traversal vulnerabilities in SkaDate 5.0 and 6.0, and possibly later versions such as 6.482, allow remote attackers to read arbitrary files via a .. (dot dot) in the view_mode parameter to (1) featured_list.php and (2) online_list.php in member/.

  • CVE-2007-5300Oct 9, 2007
    Wzdftpd
    Wzdftpd
    risk 0.03cvss —epss 0.05

    Off-by-one error in the do_login_loop function in libwzd-core/wzd_login.c in wzdftpd 0.8.0, 0.8.2, and possibly other versions allows remote attackers to cause a denial of service (daemon crash) via a long USER command that triggers a stack-based buffer overflow. NOTE: some of…

  • CVE-2007-5301Oct 9, 2007
    Alsaplayer
    Alsaplayer
    risk 0.04cvss —epss 0.10

    Buffer overflow in the vorbis_stream_info function in input/vorbis/vorbis_engine.c (aka the vorbis input plugin) in AlsaPlayer before 0.99.80-rc3 allows remote attackers to execute arbitrary code via a .OGG file with long comments.

  • CVE-2007-5302Oct 9, 2007
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in HP System Management Homepage (SMH) in HP-UX B.11.11, B.11.23, and B.11.31, and SMH before 2.1.10 for Linux and Windows, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-5303Oct 9, 2007
    Snewscms
    Snewscms Rus
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in news_page.php in SnewsCMS Rus 2.1 allows remote attackers to inject arbitrary web script or HTML via the page_id parameter.

  • CVE-2007-5304Oct 9, 2007
    ELSEIF
    CMS
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) repertimage parameter to utilisateurs/vousetesbannis.php, the (2) elseifvotetxtresultatduvote parameter to…

  • CVE-2007-5305Oct 9, 2007
    ELSEIF
    CMS
    risk 0.04cvss —epss 0.09

    Multiple PHP remote file inclusion vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the (1) contenus parameter to (a) contenus.php; the (2) tpelseifportalrepertoire parameter to (b) votes.php, (c) espaceperso.php, (d)…

  • CVE-2007-5306Oct 9, 2007
    ELSEIF
    CMS
    risk 0.03cvss —epss 0.03

    ELSEIF CMS Beta 0.6 allows remote attackers to obtain sensitive information (full path) via unspecified vectors to utilisateurs/votesresultats.php.

  • CVE-2007-5307Oct 9, 2007
    ELSEIF
    CMS
    risk 0.03cvss —epss 0.02

    ELSEIF CMS Beta 0.6 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a .php file via…