VYPR

CVEs

344,683 total · page 6392 of 6,894

AllCriticalHighKEV
  • CVE-2007-3144Jun 11, 2007
    Mozilla Corporation
    Mozilla
    risk 0.00cvss —epss 0.01

    Visual truncation vulnerability in Mozilla 1.7.12 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after a certain number of characters, as demonstrated by a phishing attack using HTTP Basic…

  • CVE-2007-3145Jun 11, 2007
    Galeon
    Galeon Browser
    risk 0.00cvss —epss 0.01

    Visual truncation vulnerability in Galeon 2.0.1 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated after a certain number of characters, as demonstrated by a phishing attack using HTTP Basic…

  • CVE-2007-3146Jun 11, 2007
    Zen Help Desk Software
    Zen Help Desk
    risk 0.00cvss —epss 0.01

    Zen Help Desk 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing a password via a direct request for ZenHelpDesk.mdb.

  • CVE-2007-3147Jun 11, 2007
    Yahoo
    Messenger
    risk 0.06cvss —epss 0.40

    Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary code via a long server property value to the send method. NOTE: some of these details are obtained from third party…

  • CVE-2007-3148Jun 11, 2007
    Yahoo
    Messenger
    risk 0.04cvss —epss 0.12

    Buffer overflow in the Yahoo! Webcam Viewer ActiveX control in ywcvwr.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary code via a long server property value to the receive method.

  • CVE-2007-3149Jun 11, 2007
    Mit
    Kerberos 5
    risk 0.00cvss —epss 0.00

    sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5_ environment variable settings. NOTE:…

  • CVE-2007-1685Jun 8, 2007
    Bluecoat
    K9 Web Protection
    risk 0.04cvss —epss 0.14

    Buffer overflow in k9filter.exe in BlueCoat K9 Web Protection 3.2.36, and probably other versions before 3.2.44, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request to port 2372.

  • CVE-2007-3130Jun 8, 2007
    Joomla
    OpenWiki
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in the OpenWiki (formerly JD-Wiki) component (com_jd-wiki) 1.0.2, and possibly earlier, for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) dwpage.php or (2)…

  • CVE-2007-3131Jun 8, 2007
    Public Warehouse
    Light Blog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in add_comment.php in Light Blog 4.1 before 20070606 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2007-3132Jun 8, 2007
    Symantec
    Norton Ghost
    risk 0.00cvss —epss 0.02

    Multiple vulnerabilities in Symantec Ghost Solution Suite 2.0.0 and earlier, with Ghost 8.0.992 and possibly other versions, allow remote attackers to cause a denial of service (client or server crash) via malformed requests to the daemon port, 1346/udp or 1347/udp.

  • CVE-2007-3133Jun 8, 2007
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in urunbak.asp in W1L3D4 WEBmarket 0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2007-3134Jun 8, 2007
    Atomphotoblog
    Atomphotoblog
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in atomPhotoBlog.php in Atom PhotoBlog 1.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Your Name, (2) Your Homepage, and (3) Your Comment fields, when using "Approve Comments."

  • CVE-2007-3135Jun 8, 2007
    Atomphotoblog
    Atomphotoblog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in atomPhotoBlog.php in Atom Photoblog 1.0.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the tag parameter.

  • CVE-2007-3136Jun 8, 2007
    Newssync
    Newssync
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in inc/nuke_include.php in newsSync 1.5.0rc6 allows remote attackers to execute arbitrary PHP code via a URL in the newsSync_NUKE_PATH parameter.

  • CVE-2007-3137Jun 8, 2007
    WmsCMS
    WmsCMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in 4print.asp in WmsCMS 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) sbl, (2) sbr, or (3) search parameter. NOTE: the original disclosure claims the pageid parameter in index.php is…

  • CVE-2007-3138Jun 8, 2007
    Open Solution
    Quick.cart
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in Open Solution Quick.Cart 2.2 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in an sLanguage cookie, which is used to define a value in config/general.php.

  • CVE-2007-3139Jun 8, 2007
    Open Solution
    Quick.cart
    risk 0.03cvss —epss 0.04

    config/general.php in Quick.Cart 2.2 and earlier uses a default username and password, which allows remote attackers to access the application via a login action to admin.php. NOTE: this can be leveraged to upload and execute arbitrary code.

  • CVE-2007-3140Jun 8, 2007
    WordPress
    WordPress
    risk 0.04cvss —epss 0.07

    SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a parameter value in an XML RPC wp.suggestCategories methodCall, a different vector than CVE-2007-1897.

  • CVE-2007-3126Jun 8, 2007
    GIMP
    Gimp
    risk 0.00cvss —epss 0.03

    Gimp before 2.8.22 allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, a similar issue to CVE-2007-2237.

  • CVE-2007-3024Jun 7, 2007
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.00

    libclamav/others.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 uses insecure permissions for temporary files that are created by the cli_gentempstream function in clamd/clamdscan, which might allow local users to read sensitive files.

  • CVE-2007-3025Jun 7, 2007
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in libclamav/phishcheck.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1, when running on Solaris, allows remote attackers to cause a denial of service (hang) via unknown vectors related to the isURL function and regular expressions.

  • CVE-2007-3124Jun 7, 2007
    Freevms
    Freevms
    risk 0.00cvss —epss 0.00

    Buffer overflow in backup/src/vmsbackup.c (aka the backup utility) in FreeVMS before 0.3.6 might allow local users to gain privileges via a long string in response to an "extract [ny]" prompt.

  • CVE-2007-2512Jun 7, 2007
    Alcatel Lucent
    Omnipcx
    risk 0.00cvss —epss 0.01

    Alcatel-Lucent IP-Touch Telephone running OmniPCX Enterprise 7.0 and later enables the mini switch by default, which allows attackers to gain access to the voice VLAN via daisy-chained systems.

  • CVE-2007-2948Jun 7, 2007
    MPlayer
    Mplayer
    risk 0.00cvss —epss 0.06

    Multiple stack-based buffer overflows in stream/stream_cddb.c in MPlayer before 1.0rc1try3 allow remote attackers to execute arbitrary code via a CDDB entry with a long (1) album title or (2) category.

  • CVE-2007-3023Jun 7, 2007
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.02

    unsp.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 does not properly calculate the end of a certain buffer, with unknown impact and remote attack vectors.

  • CVE-2007-3109Jun 7, 2007
    Microsoft
    Frontpage
    risk 0.01cvss —epss 0.11

    The CERN Image Map Dispatcher (htimage.exe) in Microsoft FrontPage allows remote attackers to determine the existence, and possibly partial contents, of arbitrary files under the web root via a relative pathname in the PATH_INFO.

  • CVE-2007-3110Jun 7, 2007
    Beatnik
    Beatnik Player
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Andy Frank Beatnik 1.0 extension for Firefox allows remote attackers to inject arbitrary web script or HTML via an RSS feed. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2007-3111Jun 7, 2007
    Provideo
    Camimage Activex Control
    risk 0.07cvss —epss 0.47

    Buffer overflow in the Provideo Camimage ActiveX control in ISSCamControl.dll 1.0.1.5, when Internet Explorer 6 is used on Windows 2000 SP4, allows remote attackers to execute arbitrary code via a long URL property value.

  • CVE-2007-3112Jun 7, 2007
    Cacti (software)
    Cacti
    risk 0.00cvss —epss 0.02

    graph_image.php in Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_start or (2) graph_end parameter, different vectors than CVE-2007-3113.

  • CVE-2007-3113Jun 7, 2007
    Cacti (software)
    Cacti
    risk 0.00cvss —epss 0.03

    Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_height or (2) graph_width parameter, different vectors than CVE-2007-3112.

  • CVE-2007-3114Jun 7, 2007
    Maradns
    Maradns
    risk 0.00cvss —epss 0.02

    Memory leak in server/MaraDNS.c in MaraDNS before 1.2.12.05, and 1.3.x before 1.3.03, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, a different set of affected versions than CVE-2007-3115 and CVE-2007-3116.

  • CVE-2007-3115Jun 7, 2007
    Maradns
    Maradns
    risk 0.00cvss —epss 0.02

    Multiple memory leaks in server/MaraDNS.c in MaraDNS before 1.2.12.06, and 1.3.x before 1.3.05, allow remote attackers to cause a denial of service (memory consumption) via (1) reverse lookups or (2) requests for records in a class other than Internet (IN), a different set of…

  • CVE-2007-3116Jun 7, 2007
    Maradns
    Maradns
    risk 0.00cvss —epss 0.01

    Memory leak in server/MaraDNS.c in MaraDNS 1.2.12.06 and 1.3.05 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, a different set of affected versions than CVE-2007-3114 and CVE-2007-3115.

  • CVE-2007-3117Jun 7, 2007
    Adplan
    Seo
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the SEO module in ADPLAN 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to HTTP headers.

  • CVE-2007-3118Jun 7, 2007
    Kravchuk
    K-letter
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Kravchuk letter (K-letter) 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the scdir parameter to (1) action.php, (2) subs.php, or (3) unsubs.php.

  • CVE-2007-3119Jun 7, 2007
    Kartli
    Alisveris Sistemi
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.asp in Kartli Alisveris Sistemi (aka Free-PayPal-Shopping-Cart) 1.0 allows remote attackers to execute arbitrary SQL commands via the news_id parameter.

  • CVE-2007-3120Jun 7, 2007
    Tecnick
    Aiocp
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in public/code/cp_dpage.php in All In One Control Panel (AIOCP) before 1.3.017 allows remote attackers to inject arbitrary web script or HTML via the aiocp_dp parameter. NOTE: some of these details are obtained from third party…

  • CVE-2007-3121Jun 7, 2007
    Zapping
    Zapping Vbi Library
    risk 0.00cvss —epss 0.02

    Buffer overflow in the CCdecode function in contrib/ntsc-cc.c in the zvbi-ntsc-cc tool in Zapping VBI Library (ZVBI) before 0.2.25 allows attackers to cause a denial of service (application crash) and possibly execute arbitrary code via long data during a reception error. NOTE:…

  • CVE-2007-3122Jun 7, 2007
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.03

    The parsing engine in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to bypass scanning via a RAR file with a header flag value of 10, which can be processed by WinRAR.

  • CVE-2007-3123Jun 7, 2007
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.03

    unrar.c in libclamav in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to cause a denial of service (core dump) via a crafted RAR file with a modified vm_codesize value, which triggers a heap-based buffer overflow.

  • CVE-2007-2919Jun 6, 2007
    E Book Systems
    Flipviewer
    risk 0.06cvss —epss 0.34

    Multiple stack-based buffer overflows in the FViewerLoading ActiveX control (FlipViewerX.dll) in E-Book Systems FlipViewer before 4.1 allow remote attackers to cause a denial of service (crash) or execute arbitrary code via long (1) UID, (2) Opf, (3) PAGENO, (4) LaunchMode, (5)…

  • CVE-2007-3095Jun 6, 2007
    Symantec
    Client Security
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition (SAV CE) 10.1 and later, allows attackers to "disable the authentication system" and…

  • CVE-2007-3096Jun 6, 2007
    Pblang
    Pblang
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in login.php in PBLang (PBL) 4.67.16.a and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.

  • CVE-2007-3097Jun 6, 2007
    F5, Inc.
    FirePass 1000 SSL VPN
    risk 0.00cvss —epss 0.02

    my.activation.php3 in F5 FirePass 4100 SSL VPN allows remote attackers to execute arbitrary shell commands via shell metacharacters in the username parameter.

  • CVE-2007-3098Jun 6, 2007
    Castlerock
    Snmpc
    risk 0.03cvss —epss 0.04

    The SNMPc Server (crserv.exe) process in Castle Rock Computing SNMPc before 7.0.19 allows remote attackers to cause a denial of service (crash) via a crafted packet to port 165/TCP.

  • CVE-2007-0068Jun 6, 2007
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.02

    IBM Lotus Domino 7.0.x before 7.0.3 does not revalidate the signature on a signed scheduled agent after the agent is modified, which allows remote authenticated users to gain privileges via a modified agent in a server database.

  • CVE-2007-2863Jun 6, 2007
    Ca
    Anti-Virus Engine
    risk 0.02cvss —epss 0.23

    Stack-based buffer overflow in the Anti-Virus engine before content update 30.6 in multiple CA (formerly Computer Associates) products allows remote attackers to execute arbitrary code via a long filename in a .CAB file.

  • CVE-2007-2864Jun 6, 2007
    Ca
    Anti-Virus Engine
    risk 0.07cvss —epss 0.50

    Stack-based buffer overflow in the Anti-Virus engine before content update 30.6 in multiple CA (formerly Computer Associates) products allows remote attackers to execute arbitrary code via a large invalid value of the coffFiles field in a .CAB file.

  • CVE-2007-3089Jun 6, 2007
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Mozilla Firefox before 2.0.0.5 does not prevent use of document.write to replace an IFRAME (1) during the load stage or (2) in the case of an about:blank frame, which allows remote attackers to display arbitrary HTML or execute certain JavaScript code, as demonstrated by code…

  • CVE-2007-3091Jun 6, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.28

    Race condition in Microsoft Internet Explorer 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 allows remote attackers to execute arbitrary code or perform other actions upon a page transition, with…