VYPR

CVEs

344,668 total · page 6403 of 6,894

AllCriticalHighKEV
  • CVE-2007-2563May 9, 2007
    Versalsoft
    HTTP File Upload Activex Control
    risk 0.04cvss —epss 0.07

    Buffer overflow in the AddFile function in VersalSoft HTTP File Upload ActiveX control (UFileUploaderD.dll) allows remote attackers to execute arbitrary code via a long argument.

  • CVE-2007-2564May 9, 2007
    Sienzo
    Digital Music Mentor
    risk 0.00cvss —epss 0.05

    Multiple stack-based buffer overflows in the Sienzo Digital Music Mentor (DMM) 2.6.0.4 ActiveX control (DSKernel2.dll) allow remote attackers to execute arbitrary code via a long argument to the (1) LockModules or (2) UnlockModule function.

  • CVE-2007-2565May 9, 2007
    Cdelia Software
    Imageprocessing
    risk 0.03cvss —epss 0.03

    Cdelia Software ImageProcessing allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted BMP file.

  • CVE-2007-2566May 9, 2007
    Taltech
    Tal Bar Code Activex Control
    risk 0.03cvss —epss 0.03

    The SaveBarCode function in the Taltech Tal Bar Code ActiveX control allows remote attackers to cause a denial of service (disk consumption) by uploading multiple bar codes, as demonstrated by a WSF package.

  • CVE-2007-2567May 9, 2007
    Taltech
    Tal Bar Code Activex Control
    risk 0.00cvss —epss 0.04

    Buffer overflow in the SaveBarCode function in the Taltech Tal Bar Code ActiveX control allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2007-0605May 9, 2007
    Advanced Guestbook
    Advanced Guestbook
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in picture.php in Advanced Guestbook 2.4.2 allows remote attackers to inject arbitrary web script or HTML via the picture parameter.

  • CVE-2007-0608May 9, 2007
    Advanced Guestbook
    Advanced Guestbook
    risk 0.00cvss —epss 0.02

    Advanced Guestbook 2.4.2 allows remote attackers to obtain sensitive information via an invalid (1) GB_TBL parameter to (a) lang/codes-english.php or (b) image.php, which reveal the database name; (2) an invalid GB_DB parameter to index.php, coupled with a ../index lang cookie,…

  • CVE-2007-0609May 9, 2007
    Advanced Guestbook
    Advanced Guestbook
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in Advanced Guestbook 2.4.2 allows remote attackers to bypass .htaccess settings, and execute arbitrary PHP local files or read arbitrary local templates, via a .. (dot dot) in a lang cookie, followed by a filename without its .php extension, as…

  • CVE-2007-2553May 9, 2007
    Microfocus
    Tru64
    risk 0.03cvss —epss 0.01

    Unspecified vulnerability in dop in HP Tru64 UNIX 5.1B-4, 5.1B-3, and 5.1A PK6 allows local users to gain privileges via a large amount of data in the environment, as demonstrated by a long environment variable.

  • CVE-2007-2554May 9, 2007
    Associated Press
    Newspower
    risk 0.00cvss —epss 0.01

    Associated Press (AP) Newspower 4.0.1 and earlier uses a default blank password for the MySQL root account, which allows remote attackers to insert or modify news articles via shows.tblscript.

  • CVE-2007-2555May 9, 2007
    Podium CMS
    Podium CMS
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Default.aspx in Podium CMS allows remote attackers to have an unknown impact, possibly session fixation, via a META HTTP-EQUIV Set-cookie expression in the id parameter, related to "cookie manipulation." NOTE: this issue might be cross-site…

  • CVE-2007-2546May 9, 2007
    Simple Machines
    Simple Machines Forum
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in Simple Machines Forum (SMF) 1.1.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.

  • CVE-2007-2547May 9, 2007
    Turnkey Web Tools
    Sunshop Shopping Cart
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in TurnkeyWebTools SunShop Shopping Cart 4.0 allows remote attackers to inject arbitrary web script or HTML via the l parameter.

  • CVE-2007-2548May 9, 2007
    Turnkey Web Tools
    Sunshop Shopping Cart
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in index.php in TurnkeyWebTools SunShop Shopping Cart 4.0 has unknown impact and an l remote attack vector, related to "Cookie Manipulation."

  • CVE-2007-2549May 9, 2007
    Turnkey Web Tools
    Sunshop Shopping Cart
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in TurnkeyWebTools SunShop Shopping Cart 4.0 allows remote attackers to execute arbitrary SQL commands via the (1) c or (2) quantity parameter.

  • CVE-2007-2550May 9, 2007
    Cubecart
    Cubecart
    risk 0.00cvss —epss 0.02

    Multiple CRLF injection vulnerabilities in Devellion CubeCart 3.0.15 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a cookie name beginning with "ccSID" to (1) cart.php or (2) index.php.

  • CVE-2007-2551May 9, 2007
    Wikkawiki
    Wikkawiki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in usersettings.php in WikkaWiki (Wikka Wiki) before 1.1.6.3 allows remote attackers to inject arbitrary web script or HTML via the name parameter.

  • CVE-2007-2552May 9, 2007
    Wikkawiki
    Wikkawiki
    risk 0.00cvss —epss 0.01

    The RecentChanges feature in WikkaWiki (Wikka Wiki) before 1.1.6.3 allows remote attackers to obtain the names, and possibly revision notes and dates, of private pages via RSS feeds.

  • CVE-2007-1673May 9, 2007
    Unzoo
    Unzoo
    risk 0.00cvss —epss 0.03

    unzoo.c, as used in multiple products including AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.

  • CVE-2007-2535May 9, 2007
    Winace
    Winace
    risk 0.00cvss —epss 0.03

    WinAce allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.

  • CVE-2007-2536May 9, 2007
    Picozip
    Picozip
    risk 0.04cvss —epss 0.09

    PicoZip allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.

  • CVE-2007-2537May 9, 2007
    Npds
    Npds
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in mainfile.php in NPDS 5.10 and earlier allow remote authenticated users to execute arbitrary SQL commands via a (1) nickname or (2) Id in a cookie, or (3) the X-Forwarded-For (X_FORWARDED_FOR) HTTP header.

  • CVE-2007-2538May 9, 2007
    Runcms
    Runcms
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in class/debug/debug_show.php in RunCms 1.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the executed_queries array parameter.

  • CVE-2007-2539May 9, 2007
    Runcms
    Runcms
    risk 0.04cvss —epss 0.08

    The show_files function in RunCms 1.5.2 and earlier allows remote attackers to obtain sensitive information (file existence and file metadata) via unspecified vectors.

  • CVE-2007-2540May 9, 2007
    Pmecms
    Pmecms
    risk 0.04cvss —epss 0.09

    Multiple PHP remote file inclusion vulnerabilities in PMECMS 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the config[pathMod] parameter to index.php in (1) mod/image/, (2) mod/liens/, (3) mod/liste/, (4) mod/special/, or (5) mod/texte/.

  • CVE-2007-2541May 9, 2007
    Versado
    CMS
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/ajax_listado.php in Versado CMS 1.07 allows remote attackers to execute arbitrary PHP code via a URL in the urlModulo parameter.

  • CVE-2007-2542May 9, 2007
    workbench
    survival guide
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in header.php in workbench survival guide 0.11 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.

  • CVE-2007-2543May 9, 2007
    XOOPS
    Flashgames Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in game.php in the Flashgames 1.0.1 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the lid parameter.

  • CVE-2007-2544May 9, 2007
    PHP Toptree Bbs
    PHP Toptree Bbs
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in templates/default/tpl_message.php in PHP TopTree BBS 2.0.1a and earlier allows remote attackers to execute arbitrary PHP code via a URL in the right_file parameter.

  • CVE-2007-2545May 9, 2007
    Persism CMS
    Persism CMS
    risk 0.08cvss —epss 0.69

    Multiple PHP remote file inclusion vulnerabilities in Persism CMS 0.9.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the system[path] parameter to (1) blocks/headerfile.php, (2) files/blocks/latest_files.php, (3) filters/headerfile.php, (4)…

  • CVE-2007-1669May 9, 2007
    Amavis
    Amavis
    risk 0.04cvss —epss 0.12

    zoo decoder 2.10 (zoo-2.10), as used in multiple products including (1) Barracuda Spam Firewall 3.4 and later with virusdef before 2.0.6399, (2) Spam Firewall before 3.4 20070319 with virusdef before 2.0.6399o, and (3) AMaViS 2.4.1 and earlier, allows remote attackers to cause a…

  • CVE-2007-1670May 9, 2007
    Panda Project
    Panda Antivirus
    risk 0.00cvss —epss 0.03

    Panda Software Antivirus before 20070402 allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.

  • CVE-2007-1671May 9, 2007
    Avira
    Antivir
    risk 0.00cvss —epss 0.02

    avpack32.dll before 7.3.0.6 in Avira AntiVir allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.

  • CVE-2007-1672May 9, 2007
    Avast\!
    Antivirus
    risk 0.00cvss —epss 0.03

    avast! antivirus before 4.7.981 allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.

  • CVE-2007-1864May 9, 2007
    PHP
    PHP
    risk 0.00cvss —epss 0.03

    Buffer overflow in the bundled libxmlrpc library in PHP before 4.4.7, and 5.x before 5.2.2, has unknown impact and remote attack vectors.

  • CVE-2007-2509May 9, 2007
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in the ftp_putcmd function in PHP before 4.4.7, and 5.x before 5.2.2 allows remote attackers to inject arbitrary FTP commands via CRLF sequences in the parameters to earlier FTP commands.

  • CVE-2007-2510May 9, 2007
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    Buffer overflow in the make_http_soap_request function in PHP before 5.2.2 has unknown impact and remote attack vectors, possibly related to "/" (slash) characters.

  • CVE-2007-2511May 9, 2007
    PHP
    PHP
    risk 0.00cvss —epss 0.00

    Buffer overflow in the user_filter_factory_create function in PHP before 5.2.2 has unknown impact and local attack vectors.

  • CVE-2007-2529May 9, 2007
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Integer signedness error in the acl (facl) system call in Solaris 10 before 20070507 allows local users to cause a denial of service (kernel panic) and possibly gain privileges via a certain argument, related to ACE_SETACL.

  • CVE-2007-2530May 9, 2007
    Tropicalm
    Tropicalm Crowell Resource
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Tropicalm Crowell Resource 4.5.2 allow remote attackers to execute arbitrary PHP code via a URL in the RESPATH parameter to (1) dosearch.php or (2) printfriendly.php.

  • CVE-2007-2531May 9, 2007
    Berylium
    Berylium2
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in berylium-classes.php in Berylium2 2003-08-18 allows remote attackers to execute arbitrary PHP code via a URL in the beryliumroot parameter.

  • CVE-2007-2532May 9, 2007
    Obie Website
    Mini Web Shop
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in Minh Nguyen Duong Obie Website Mini Web Shop 2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) to (1) sendmail.php or (2) order_form.php, different vectors than CVE-2006-6734.

  • CVE-2007-2533May 9, 2007
    Trend Micro
    Serverprotect
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in Trend Micro ServerProtect 5.58 before Security Patch 2- Build 1174 allow remote attackers to execute arbitrary code via a crafted RPC message processed by the (1) the RPCFN_ActiveRollback function in (a) stcommon.dll, or the (2)…

  • CVE-2007-2534CriMay 9, 2007
    Phphoo3
    Phphoo3
    risk 0.64cvss 9.8epss 0.01

    Multiple SQL injection vulnerabilities in admin.php in phpHoo3 allow remote attackers to execute arbitrary SQL commands via the (1) ADMIN_USER (USER) and (2) ADMIN_PASS (PASS) parameters during a login. NOTE: CVE disputes this vulnerability, since ADMIN_USER/ADMIN_PASS are…

  • CVE-2007-0039May 8, 2007
    Microsoft
    Exchange Server
    risk 0.04cvss —epss 0.45

    The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS…

  • CVE-2007-0213May 8, 2007
    Microsoft
    Exchange Server
    risk 0.08cvss —epss 0.66

    Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, which allows remote attackers to execute arbitrary code via a crafted base64-encoded MIME e-mail message.

  • CVE-2007-0220May 8, 2007
    Microsoft
    Exchange Server
    risk 0.03cvss —epss 0.33

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail…

  • CVE-2007-0221May 8, 2007
    Microsoft
    Exchange Server
    risk 0.03cvss —epss 0.37

    Integer overflow in the IMAP (IMAP4) support in Microsoft Exchange Server 2000 SP3 allows remote attackers to cause a denial of service (service hang) via crafted literals in an IMAP command, aka the "IMAP Literal Processing Vulnerability."

  • CVE-2007-0323May 8, 2007
    Rim
    Teamon Import Object Activex Control
    risk 0.01cvss —epss 0.08

    Buffer overflow in the SetLanguage function in Research In Motion (RIM) TeamOn Import Object ActiveX control (TOImport.dll) allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2007-0940May 8, 2007
    Microsoft
    Biztalk Server
    risk 0.06cvss —epss 0.76

    Unspecified vulnerability in the Cryptographic API Component Object Model Certificates ActiveX control (CAPICOM.dll) in Microsoft CAPICOM and BizTalk Server 2004 SP1 and SP2 allows remote attackers to execute arbitrary code via unspecified vectors, aka the "CAPICOM.Certificates…