VYPR

CVEs

344,672 total · page 6397 of 6,894

AllCriticalHighKEV
  • CVE-2007-2847May 24, 2007
    Hlstats
    Hlstats
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in hlstats.php in HLstats 1.35, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) authusername or (2) authpassword parameter, different vectors than CVE-2007-0840 and CVE-2007-2812.

  • CVE-2007-2848May 24, 2007
    Sky Software
    Shcombobox Activex Control
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in the SetPath function in the shComboBox ActiveX control (shcmb80.ocx) in Sky Software Shell MegaPack ActiveX 8.0 allows remote attackers to execute arbitrary code via a long argument. NOTE: the provenance of this information is unknown; the details…

  • CVE-2007-2849May 24, 2007
    Knowledgetree
    Knowledgetree Document Management
    risk 0.00cvss —epss 0.03

    KnowledgeTree Document Management (aka KnowledgeTree Open Source) before STABLE 3.3.7 does not require a password for an unregistered user, when the user exists in Active Directory, which allows remote attackers to log onto KTDMS without the intended authorization check.

  • CVE-2007-2850May 24, 2007
    Citrix Systems
    Metaframe
    risk 0.00cvss —epss 0.03

    The Session Reliability Service (XTE) in Citrix MetaFrame Presentation Server 3.0, Presentation Server 4.0, and Access Essentials 1.0 and 1.5, allows remote attackers to bypass network security policies and connect to arbitrary TCP ports via a modified address:port string.

  • CVE-2007-2851May 24, 2007
    Leadtools
    Raster Variant Object Library
    risk 0.03cvss —epss 0.02

    A certain ActiveX control in LeadTools Raster Variant Object Library (LTRVR14e.dll) 14.5.0.44 allows remote attackers to overwrite arbitrary files via the WriteDataToFile method.

  • CVE-2006-7205May 24, 2007
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The array_fill function in ext/standard/array.c in PHP 4.4.2 and 5.1.2 allows context-dependent attackers to cause a denial of service (memory consumption) via a large num value.

  • CVE-2007-2687May 24, 2007
    MicroWorld Technologies
    Escan
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in the MicroWorld Agent service (MWAGENT.EXE) in MicroWorld Technologies eScan before 9.0.718.1 allows remote attackers to execute arbitrary code via a long command.

  • CVE-2007-2829May 24, 2007
    Madwifi
    Madwifi
    risk 0.00cvss —epss 0.03

    The 802.11 network stack in net80211/ieee80211_input.c in MadWifi before 0.9.3.1 allows remote attackers to cause a denial of service (system hang) via a crafted length field in nested 802.3 Ethernet frames in Fast Frame packets, which results in a NULL pointer dereference.

  • CVE-2007-2830May 24, 2007
    Madwifi
    Madwifi
    risk 0.00cvss —epss 0.02

    The ath_beacon_config function in if_ath.c in MadWifi before 0.9.3.1 allows remote attackers to cause a denial of service (system crash) via crafted beacon interval information when scanning for access points, which triggers a divide-by-zero error.

  • CVE-2007-2831May 24, 2007
    Madwifi
    Madwifi
    risk 0.00cvss —epss 0.03

    Array index error in the (1) ieee80211_ioctl_getwmmparams and (2) ieee80211_ioctl_setwmmparams functions in net80211/ieee80211_wireless.c in MadWifi before 0.9.3.1 allows local users to cause a denial of service (system crash), possibly obtain kernel memory contents, and…

  • CVE-2007-2832May 24, 2007
    Cisco Systems, Inc.
    Unified Callmanager
    risk 0.04cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in the web application firewall in Cisco CallManager before 3.3(5)sr3, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allows remote attackers to inject arbitrary web script or HTML via the pattern parameter to…

  • CVE-2007-2799May 23, 2007
    File Project
    File
    risk 0.00cvss —epss 0.03

    Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert() statement. NOTE: this…

  • CVE-2007-2816May 22, 2007
    Ol Bookmarks
    Ol Bookmarks
    risk 0.04cvss —epss 0.10

    Multiple PHP remote file inclusion vulnerabilities in ol'bookmarks 0.7.4 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter to (1) test1.php, (2) blackorange.php, (3) default.php, (4) frames1.php, (5) frames1_top.php, (7) test2.php, (8)…

  • CVE-2007-2817May 22, 2007
    Ol Bookmarks
    Ol Bookmarks
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in read/index.php in ol'bookmarks 0.7.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2007-2818May 22, 2007
    Cactusoft
    Parodia
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cand_login.asp in CactuSoft Parodia 6.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the strJobIDs parameter.

  • CVE-2007-2819May 22, 2007
    Track\+
    Track\+
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in reportItem.do in Track+ 3.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the projId parameter.

  • CVE-2007-2820May 22, 2007
    Ksign
    Ksignswat
    risk 0.03cvss —epss 0.06

    Multiple stack-based buffer overflows in the KSign KSignSWAT ActiveX Control (AxKSignSWAT.dll) 2.0.3.3 allow remote attackers to execute arbitrary code via long arguments to the (1) SWAT_Init, (2) SWAT_InitEx, (3) SWAT_InitEx2, (4) SWAT_InitEx3, and (5) SWAT_Login functions.

  • CVE-2007-2821May 22, 2007
    WordPress
    WordPress
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via the cookie parameter.

  • CVE-2007-2822May 22, 2007
    Wavelink Media
    Tutorialcms
    risk 0.03cvss —epss 0.04

    TutorialCMS 1.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication via the (1) loggedIn and (2) activated parameters to (a) login.php, (b) headerLinks.php, (c) submit1.php, (d) myFav.php, and (e) userCP.php.

  • CVE-2007-2823May 22, 2007
    Ht Editor
    Ht Editor
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in HT Editor before 2.0.6 might allow remote attackers to execute arbitrary code via unspecified vectors, possibly involving the editor display width. NOTE: some of the details were obtained from third party information.

  • CVE-2007-2824May 22, 2007
    Alstrasoft
    E Friends
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in paypal.php in AlstraSoft E-Friends 4.21 and earlier allows remote attackers to execute arbitrary SQL commands via the pack parameter in a paypal action for index.php.

  • CVE-2007-2825May 22, 2007
    Atmail
    @Mail
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ReadMsg.php in @Mail 5.02 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) links and (2) images.

  • CVE-2007-2826May 22, 2007
    Madirish Webmail
    Webmail
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in lib/addressbook.php in Madirish Webmail 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[basedir] parameter.

  • CVE-2007-2827May 22, 2007
    LEAD Technologies
    Leadtools Isis Activex Control
    risk 0.04cvss —epss 0.06

    Heap-based buffer overflow in LEAD Technologies LEADTOOLS ISIS ActiveX Control (ltisi14E.ocx) 14.5.0.44 and earlier allows remote attackers to execute arbitrary code via a long DriverName property.

  • CVE-2007-2828May 22, 2007
    WordPress
    AdSense-Deluxe
    risk 0.00cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for WordPress allows remote attackers to perform unspecified actions as arbitrary users via unspecified vectors.

  • CVE-2006-3894May 22, 2007
    Rsa
    Cert-C
    risk 0.00cvss —epss 0.04

    The RSA Crypto-C before 6.3.1 and Cert-C before 2.8 libraries, as used by RSA BSAFE, multiple Cisco products, and other products, allows remote attackers to cause a denial of service via malformed ASN.1 objects.

  • CVE-2006-7204May 22, 2007
    PHP
    PHP
    risk 0.00cvss —epss 0.00

    The imap_body function in PHP before 4.4.4 does not implement safemode or open_basedir checks, which allows local users to read arbitrary files or list arbitrary directory contents.

  • CVE-2007-2519May 22, 2007
    Pear
    Pear
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the (1) install-as attribute in the file element in package.xml 1.0 or the (2) as attribute in the…

  • CVE-2007-2686May 22, 2007
    Jetbox
    Jetbox CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Jetbox CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the login parameter in a sendpwd task.

  • CVE-2007-2802May 22, 2007
    Rm
    Rm Easymail Plus
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cp/ps/Main/login/Login in RM EasyMail Plus allows remote attackers to inject arbitrary web script or HTML via the d parameter.

  • CVE-2007-2803May 22, 2007
    Vizayn
    Tanitim Sitesi
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.asp in Vizayn Urun Tanitim Sitesi 0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a haberdetay action.

  • CVE-2007-2804May 22, 2007
    Shoppingtree
    Store
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in scripts/prodList.asp in CandyPress Store 3.5.2.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) brand and (2) Msg parameters.

  • CVE-2007-2805May 22, 2007
    Clientexec
    Clientexec
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in ClientExec (CE) 3.0 beta2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the (1) ticketID, (2) view, and (3) fuse parameters.

  • CVE-2007-2806May 22, 2007
    Galix
    Galix
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in GaliX 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) galix_cat_detail, (2) galix_gal_detail, and (3) galix_cat_detail_sort parameters.

  • CVE-2007-2807May 22, 2007
    Eggdrop
    Eggdrop
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in mod/server.mod/servrmsg.c in Eggdrop 1.6.18, and possibly earlier, allows user-assisted, remote IRC servers to execute arbitrary code via a long private message.

  • CVE-2007-2808May 22, 2007
    GNATS
    GnatsWeb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in gnatsweb.pl in Gnatsweb 4.00 and Gnats 4.1.99 allows remote attackers to inject arbitrary web script or HTML via the database parameter.

  • CVE-2007-2809May 22, 2007
    Opera
    Opera
    risk 0.01cvss —epss 0.06

    Buffer overflow in the transfer manager in Opera before 9.21 for Windows allows user-assisted remote attackers to execute arbitrary code via a crafted torrent file. NOTE: due to the lack of details, it is not clear if this is the same issue as CVE-2007-2274.

  • CVE-2007-2810May 22, 2007
    Gazi
    Download Portal
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in down_indir.asp in Gazi Download Portal allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2007-2811May 22, 2007
    Kk Osk
    Advance Flow
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in OSK Advance-Flow 4.41 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-2812May 22, 2007
    Hlstats
    Hlstats
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in hlstats.php in HLstats 1.35, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO or (2) the action parameter.

  • CVE-2007-2813May 22, 2007
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Cisco IOS 12.4 and earlier, when using the crypto packages and SSL support is enabled, allows remote attackers to cause a denial of service via a malformed (1) ClientHello, (2) ChangeCipherSpec, or (3) Finished message during an SSL session.

  • CVE-2007-2814May 22, 2007
    David Harris
    Imagn Activex Control
    risk 0.03cvss —epss 0.05

    Multiple stack-based buffer overflows in the Pegasus ImagN' ActiveX control (IMW32O40.OCX) 4.00.041 allow remote attackers to execute arbitrary code via (1) a long FileName parameter, or unspecified vectors involving the (2) BeginReport, (3) CreatePictureExA, (4) DefineImage,…

  • CVE-2007-2815May 22, 2007
    Microsoft
    Internet Information Server
    risk 0.09cvss —epss 0.73

    The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configuration, which allows remote attackers to bypass NTLM and basic authentication mechanisms and access private web directories via the…

  • CVE-2007-2788May 22, 2007
    Sun Corporation
    Jdk
    risk 0.04cvss —epss 0.18

    Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and…

  • CVE-2007-2789May 22, 2007
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun Java Runtime Environment in JDK and JRE 6, JDK and JRE 5.0 Update 10 and earlier, SDK and JRE 1.4.2_14 and earlier, and SDK and JRE 1.3.1_19 and earlier, when…

  • CVE-2007-2790May 22, 2007
    Vpasp
    Shopping Cart
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in shopcontent.asp in VP-ASP Shopping Cart 6.50, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the type parameter.

  • CVE-2007-2791May 22, 2007
    Microfocus
    Tru64
    risk 0.04cvss —epss 0.06

    Unspecified vulnerability in the Secure Shell (SSH) in HP Tru64 UNIX 5.1B-4 and 5.1B-3 allows remote attackers to identify valid users via unspecified vectors, probably related to timing attacks and AuthInteractiveFailureRandomTimeout.

  • CVE-2007-2792May 22, 2007
    Joomla
    com_yanc
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in the Yet another Newsletter Component (aka YaNC or com_yanc) component before 1.5 beta 3 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter to index.php. NOTE: some of these details are obtained…

  • CVE-2007-2793May 22, 2007
    Geeklog
    Geeklog
    risk 0.08cvss —epss 0.65

    PHP remote file inclusion vulnerability in ImageImageMagick.php in Geeklog 2.x allows remote attackers to execute arbitrary PHP code via a URL in the glConf[path_system] parameter.

  • CVE-2007-2773May 21, 2007
    Zomplog
    Zomplog
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in plugins/mp3playlist/mp3playlist.php in Zomplog 3.8 and earlier allows remote attackers to execute arbitrary SQL commands via the speler parameter.