VYPR

CVEs

344,694 total · page 6373 of 6,894

AllCriticalHighKEV
  • CVE-2007-4110Jul 31, 2007
    Codewidgets
    Threaded Discussion Forum Application
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in sign_in.aspx in Message Board / Threaded Discussion Forum Application Template allows remote attackers to execute arbitrary SQL commands via the Password parameter.

  • CVE-2007-4111Jul 31, 2007
    Real Estate Listing Website Application Template
    Real Estate listing website application template
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the login script in Real Estate listing website application template, when logging in as user or manager, allows remote attackers to execute arbitrary SQL commands via the Password parameter.

  • CVE-2007-4112Jul 31, 2007
    Advanced Webhost Billing System
    Advanced Webhost Billing System
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Advanced Webhost Billing System (AWBS) before 2.6.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be leveraged for XSS attacks that "bypass AWBS's…

  • CVE-2007-4113Jul 31, 2007
    Advanced Webhost Billing System
    Advanced Webhost Billing System
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Advanced Webhost Billing System (AWBS) before 2.6.0 allows remote authenticated users to obtain configuration data about other dedicated servers via unspecified vectors.

  • CVE-2007-4114Jul 31, 2007
    Suskunduygular
    Uyelik Sistemi
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in unuttum.asp in SuskunDuygular Uyelik Sistemi 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) kadi or (2) email parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2007-4115Jul 31, 2007
    CMS
    狮子鱼CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in IT!CMS (itcms) 0.2 allow remote attackers to inject arbitrary web script or HTML via the wndtitle parameter to (1) lang-en.php, (2) menu-ed.php, or (3) titletext-ed.php.

  • CVE-2007-4116Jul 31, 2007
    Metyus
    Forum Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in philboard_forum.asp in Metyus Forum Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the forumid parameter. NOTE: this might be related to CVE-2007-0920 or CVE-2007-3884.

  • CVE-2007-3387Jul 30, 2007
    Xpdf
    Xpdf
    risk 0.01cvss —epss 0.09

    Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted…

  • CVE-2007-4096Jul 30, 2007
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Buffer overflow in Tor before 0.1.2.15, when using BSD natd support, allows remote attackers to cause a denial of service via unspecified vectors.

  • CVE-2007-4097Jul 30, 2007
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Tor before 0.1.2.15 sends "destroy cells" containing the reason for tearing down a circuit, which allows remote attackers to obtain sensitive information, contrary to specifications.

  • CVE-2007-4098Jul 30, 2007
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams.

  • CVE-2007-4099Jul 30, 2007
    Tor
    Tor
    risk 0.00cvss —epss 0.02

    Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.

  • CVE-2007-4092Jul 30, 2007
    Ifoto
    Ifoto
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in iFoto 1.0.1 and earlier allows remote attackers to list arbitrary directories, and possibly download arbitrary photos, via a .. (dot dot) in the dir parameter.

  • CVE-2007-4093Jul 30, 2007
    Minb Is Not A Blog
    Minb Is Not a Blog
    risk 0.00cvss —epss 0.01

    Minb Is Not a Blog (minb) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing usernames and encrypted passwords via a direct request for db/users.db.

  • CVE-2007-4094Jul 30, 2007
    Idevspot
    Phphostbot
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in library/authorize.php in IDevSpot PhpHostBot allows remote attackers to execute arbitrary PHP code via a URL in the login_form parameter, a different vector than CVE-2006-3776.

  • CVE-2007-4095Jul 30, 2007
    Bsm Store
    Dependent Forums
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in BSM Store Dependent Forums 1.02 allows remote attackers to execute arbitrary SQL commands via a Username field in an unspecified component, probably the FrmUserName parameter in login.asp.

  • CVE-2007-3911Jul 30, 2007
    Bakbone
    Netvault Reporter
    risk 0.01cvss —epss 0.07

    Multiple heap-based buffer overflows in (1) clsscheduler.exe (aka scheduler client) and (2) srvscheduler.exe (aka scheduler server) in BakBone NetVault Reporter 3.5 before Update4 allow remote attackers to execute arbitrary code via long filename arguments in HTTP requests.

  • CVE-2007-4053Jul 30, 2007
    Linpha
    Linpha
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in include/img_view.class.php in LinPHA 1.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the order parameter to new_images.php.

  • CVE-2007-4054Jul 30, 2007
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in category.php in PHP123 Top Sites allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2007-4055Jul 30, 2007
    8pixel.net
    Simple Blog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in comments_get.asp in SimpleBlog 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: this may be related to CVE-2006-4300.

  • CVE-2007-4056Jul 30, 2007
    Adult Directory
    Adult Directory
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in directory.php in Prozilla Adult Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action. NOTE: the original report indicated that this was the "photo" SourceForge project (aka Maan Bsat Photo…

  • CVE-2007-4057Jul 30, 2007
    Neocrome
    Seditio
    risk 0.03cvss —epss 0.02

    Unrestricted file upload vulnerability in pfs.php in Neocrome Seditio 121 and earlier allows remote authenticated users to upload arbitrary PHP code via a filename ending with (1) .php.gif, (2) .php.jpg, or (3) .php.png.

  • CVE-2007-4058Jul 30, 2007
    EMC Corporation
    Vmware
    risk 0.05cvss —epss 0.22

    Absolute path traversal vulnerability in a certain ActiveX control in vielib.dll 2.2.5.42958 in EMC VMware 6.0.0 allows remote attackers to execute arbitrary local programs via a full pathname in the first argument to the StartProcess method.

  • CVE-2007-4059Jul 30, 2007
    EMC Corporation
    Vmware
    risk 0.04cvss —epss 0.07

    Absolute path traversal vulnerability in a certain ActiveX control in IntraProcessLogging.dll 5.5.3.42958 in EMC VMware allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the SetLogFileName method.

  • CVE-2007-4060Jul 30, 2007
    Frank Yaul
    Corehttp
    risk 0.03cvss —epss 0.05

    Multiple buffer overflows in the HttpSprockMake function in http.c in Frank Yaul corehttp 0.5.3alpha allow remote attackers to execute arbitrary code via a long string in the (1) method name or (2) URI in an HTTP request.

  • CVE-2007-4061Jul 30, 2007
    Tenable
    Vulnerability Scanner
    risk 0.04cvss —epss 0.11

    Directory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the argument to the saveNessusRC method, which writes text specified by the addsetConfig…

  • CVE-2007-4062Jul 30, 2007
    Tenable
    Vulnerability Scanner
    risk 0.03cvss —epss 0.02

    The SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via unspecified vectors involving the deleteNessusRC method, probably a directory traversal vulnerability.

  • CVE-2007-4063Jul 30, 2007
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.2 allow remote attackers to (1) delete comments, (2) delete content revisions, and (3) disable menu items as privileged users, related to improper use of HTTP GET and the Forms API.

  • CVE-2007-4064Jul 30, 2007
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, (1) allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHP_SELF; and (2) allow remote authenticated administrators to inject…

  • CVE-2007-4067Jul 30, 2007
    Clever Internet
    ActiveX Suite
    risk 0.04cvss —epss 0.07

    Absolute path traversal vulnerability in the clInetSuiteX6.clWebDav ActiveX control in CLINETSUITEX6.OCX in Clever Internet ActiveX Suite 6.2 allows remote attackers to create or overwrite arbitrary files via a full pathname in the second argument to the GetToFile method. NOTE:…

  • CVE-2007-4068Jul 30, 2007
    Webyapar
    Webyapar
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Webyapar 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the kat_id parameter to the default URI in a download action or (2) the id parameter to the default URI in a duyurular_detay action.

  • CVE-2007-4069Jul 30, 2007
    Index Script
    Indexscript
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in show_cat.php in IndexScript 2.8 and earlier allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.

  • CVE-2007-4070Jul 30, 2007
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Low Bandwidth X proxy (lbxproxy) on Sun Solaris 8 through 10 before 20070725 allows local users to read arbitrary files with root group ownership via unknown vectors.

  • CVE-2007-4071Jul 30, 2007
    Webbler
    Webbler CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in uploader/index.php in Webbler CMS before 3.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) login parameter.

  • CVE-2007-4072Jul 30, 2007
    Webbler
    Webbler CMS
    risk 0.00cvss —epss 0.01

    Webbler CMS before 3.1.6 provides the full installation path within HTML comments in certain documents, which allows remote attackers to obtain sensitive information by viewing the HTML source, as demonstrated by viewing the source generated from index.php.

  • CVE-2007-4073Jul 30, 2007
    Webbler
    Webbler CMS
    risk 0.00cvss —epss 0.01

    Webbler CMS before 3.1.6 does not properly restrict use of "mail a friend" forms, which allows remote attackers to send arbitrary amounts of forged e-mail. NOTE: this could be leveraged for spam or phishing attacks.

  • CVE-2007-4074Jul 30, 2007
    Centre For Speech Technology Research
    Gentoo Linux
    risk 0.00cvss —epss 0.05

    The default configuration of Centre for Speech Technology Research (CSTR) Festival 1.95 beta (aka 2.0 beta) on Gentoo Linux, SUSE Linux, and possibly other distributions, is run locally with elevated privileges without requiring authentication, which allows local and remote…

  • CVE-2007-4075Jul 30, 2007
    Dora Emlak
    Alisveris Sitesi Script
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.asp in Alisveris Sitesi Scripti allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search mod action. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2007-4076Jul 30, 2007
    Alisveris Sitesi Scripti
    Alisveris Sitesi Scripti
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.asp in Alisveris Sitesi Scripti allow remote attackers to execute arbitrary SQL commands via the (1) product_id or (2) cat_id parameter in a product mod action. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2007-4077Jul 30, 2007
    Alstrasoft
    Video Share Enterprise
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to inject arbitrary web script or HTML via the (1) msg, (2) page, (3) viewkey, or (4) viewtype parameter to (a) view_video.php; the (5) next parameter to (b)…

  • CVE-2007-4078Jul 30, 2007
    Alstrasoft
    Text Ads Enterprise
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Text Ads Enterprise allow remote attackers to inject arbitrary web script or HTML via the (1) r parameter to (a) forgot_uid.php, the (2) query or (3) sk parameter to (b) search_results.php, or (4) the pageId…

  • CVE-2007-4079Jul 30, 2007
    Alstrasoft
    Sms Text Messaging Enterprise
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft SMS Text Messaging Enterprise allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2) q parameter to (a) admin/membersearch.php, or (3) the userid parameter to (b)…

  • CVE-2007-4080Jul 30, 2007
    Alstrasoft
    E Friends
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php AlstraSoft E-Friends allows remote attackers to inject arbitrary web script or HTML via the p_id parameter in a people_card action. NOTE: this might overlap CVE-2006-2564.

  • CVE-2007-4081Jul 30, 2007
    Alstrasoft
    Affiliate Network Pro
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to inject arbitrary web script or HTML via vectors in (a) merchants/index.php, including the (1) id or (2) msg parameter in a programedit action; the (3) pgmid…

  • CVE-2007-4082Jul 30, 2007
    Alstrasoft
    Article Manager Pro
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in contact_author.php AlstraSoft Article Manager Pro allows remote attackers to inject arbitrary web script or HTML via the userid parameter.

  • CVE-2007-4083Jul 30, 2007
    Alstrasoft
    Askme Pro
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to inject arbitrary web script or HTML via (1) the cat_id parameter to search.php or the (2) typ parameter to register.php.

  • CVE-2007-4084Jul 30, 2007
    Alstrasoft
    Affiliate Network Pro
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to execute arbitrary SQL commands via (1) the pgmid parameter in an uploadProducts action to merchants/index.php and possibly (2) the rowid parameter to merchants/temp.php.

  • CVE-2007-4085Jul 30, 2007
    Alstrasoft
    Askme Pro
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to execute arbitrary SQL commands via the (1) que_id parameter to forum_answer.php or (2) the cat_id parameter to search.php.

  • CVE-2007-4086Jul 30, 2007
    Alstrasoft
    Video Share Enterprise
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to execute arbitrary SQL commands via (1) the gid parameter to gmembers.php, or (2) the UID parameter to (a) uvideos.php, (b) ugroups.php, (c) uprofile.php, (d) ufavour.php, (e)…

  • CVE-2007-4087Jul 30, 2007
    Alstrasoft
    Video Share Enterprise
    risk 0.00cvss —epss 0.01

    AlstraSoft Video Share Enterprise allows remote attackers to obtain sensitive information (the full path) via (1) a ' (quote) character in the category parameter to view_video.php, or (2) an XSS sequence in the UID parameter to (a) uprofile.php, (b) channel_detail.php, (c)…