VYPR

CVEs

344,668 total · page 6406 of 6,894

AllCriticalHighKEV
  • CVE-2007-2425May 2, 2007
    Blackdot
    Imageview
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in fileview.php in Imageview 5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the album parameter.

  • CVE-2007-2426May 2, 2007
    WordPress
    myGallery
    risk 0.08cvss —epss 0.63

    PHP remote file inclusion vulnerability in myfunctions/mygallerybrowser.php in the myGallery 1.4b4 and earlier plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the myPath parameter.

  • CVE-2007-2427May 2, 2007
    Pnflashgames
    Pnflashgames
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in index.php in the pnFlashGames 1.5 module for PostNuke allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2007-2428May 2, 2007
    Ahhp Portal
    Ahhp Portal
    risk 0.04cvss —epss 0.10

    Multiple PHP remote file inclusion vulnerabilities in page.php in Ahhp-Portal allow remote attackers to execute arbitrary PHP code via a URL in the (1) fp or (2) sc parameter.

  • CVE-2007-2429May 2, 2007
    Manageengine
    Passwordmanager Pro
    risk 0.04cvss —epss 0.08

    ManageEngine PasswordManager Pro (PMP) allows remote attackers to obtain administrative access to a database by injecting a certain command line for the mysql program, as demonstrated by the "-port 2345" and "-u root" arguments. NOTE: the provenance of this information is…

  • CVE-2007-2430May 2, 2007
    TCExam
    TCExam
    risk 0.03cvss —epss 0.04

    shared/code/tce_tmx.php in TCExam 4.0.011 and earlier allows remote attackers to create arbitrary PHP files in cache/ by placing file contents and directory traversal manipulations into a SessionUserLang cookie to public/code/index.php.

  • CVE-2007-2431May 2, 2007
    TCExam
    TCExam
    risk 0.03cvss —epss 0.05

    Dynamic variable evaluation vulnerability in shared/config/tce_config.php in TCExam 4.0.011 and earlier allows remote attackers to conduct cross-site scripting (XSS) and possibly other attacks by modifying critical variables such as $_SERVER, as demonstrated by injecting web…

  • CVE-2007-2411May 1, 2007
    Sphider
    Sphider
    risk 0.00cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in Sphider 1.2.x allows remote attackers to execute arbitrary PHP code via a URL in the include_dir parameter. NOTE: a third party disputes this vulnerability, stating that "the application is not vulnerable to this issue.

  • CVE-2007-2412May 1, 2007
    Seir Anphin
    Seir Anphin
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in modules/file.php in Seir Anphin allows remote attackers to obtain sensitive information via a .. (dot dot) in the a[filepath] parameter. NOTE: a third party has disputed this issue because the a array is populated by a database query before…

  • CVE-2007-2414May 1, 2007
    Caddy Project
    Myserver
    risk 0.00cvss —epss 0.03

    MyServer before 0.8.8 allows remote attackers to cause a denial of service via unspecified vectors.

  • CVE-2007-2415May 1, 2007
    risk 0.00cvss —epss 0.02

    Pi3Web Web Server 2.0.3 PL1 allows remote attackers to cause a denial of service (application exit) via a long URI. NOTE: this issue was originally reported as a crash, but the vendor states that the impact is a "clean" exit in which "the server I/O loop finishes and the…

  • CVE-2007-2416May 1, 2007
    E Annu
    E Annu
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in home.php in E-Annu allows remote attackers to execute arbitrary SQL commands via the a parameter.

  • CVE-2006-7199Apr 30, 2007
    EMC Corporation
    Rsa Security Sitekey
    risk 0.00cvss —epss 0.02

    EMC RSA Security SiteKey allows remote attackers to display the correct image via a man-in-the-middle (MITM) attack in which an attacker-controlled server proxies authentication data to and from a legitimate SiteKey server. NOTE: the vendor disputes the severity of the issue,…

  • CVE-2006-7200Apr 30, 2007
    EMC Corporation
    Rsa Security Sitekey
    risk 0.00cvss —epss 0.01

    EMC RSA Security SiteKey issues challenge-bypass tokens that persist forever without a cancellation interface for end users, which makes it easier for attackers to bypass one stage of authentication by stealing and replaying a token.

  • CVE-2006-7201Apr 30, 2007
    EMC Corporation
    Rsa Security Sitekey
    risk 0.00cvss —epss 0.02

    EMC RSA Security SiteKey does not set the secure qualifier on the SiteKey Flash token (aka the PassMark Flash shared object), which might allow remote attackers to obtain the token via HTTP.

  • CVE-2007-2367Apr 30, 2007
    Wserve HTTP Server
    Wserve HTTP Server
    risk 0.03cvss —epss 0.04

    Buffer overflow in wserve_console.exe in Wserve HTTP Server (whttp) 4.6 allows remote attackers to cause a denial of service (forced application exit) via a long directory name in the URI.

  • CVE-2007-2368Apr 30, 2007
    Webspell
    Webspell
    risk 0.03cvss —epss 0.02

    picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter.

  • CVE-2007-2369Apr 30, 2007
    PHP
    PHP
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in picture.php in WebSPELL 4.01.02 and earlier, when PHP before 4.3.0 is used, allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.

  • CVE-2007-2370Apr 30, 2007
    XOOPS
    John Mordo Jobs Module
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in index.php in the John Mordo Jobs 2.4 and earlier module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter in a jobsview action. NOTE: the module name was originally reported as Job Listings.

  • CVE-2007-2371Apr 30, 2007
    Gregory Kokanosky
    Phpmynewsletter
    risk 0.04cvss —epss 0.08

    admin/index.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier provides access to configuration modification before login, which allows remote attackers to cause a denial of service (loss of configuration data), and possibly perform direct static code injection, via…

  • CVE-2007-2372Apr 30, 2007
    Gregory Kokanosky
    Phpmynewsletter
    risk 0.04cvss —epss 0.08

    admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to compose an e-mail message via a post with the subject, message, format, and…

  • CVE-2007-2373Apr 30, 2007
    Wf Links
    Wf Links
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in viewcat.php in the WF-Links (wflinks) 1.03 and earlier module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2007-2374Apr 30, 2007
    Microsoft
    Windows 2000
    risk 0.01cvss —epss 0.17

    Unspecified vulnerability in Microsoft Windows 2000, XP, and Server 2003 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. NOTE: this information is based upon a vague pre-advisory with no actionable information. However, the advisory is…

  • CVE-2007-2375Apr 30, 2007
    Symantec
    Enterprise Security Manager
    risk 0.00cvss —epss 0.06

    The agent remote upgrade interface in Symantec Enterprise Security Manager (ESM) before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol.

  • CVE-2007-2376Apr 30, 2007
    Dojotoolkit
    Dojo
    risk 0.00cvss —epss 0.02

    The Dojo framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data…

  • CVE-2007-2377Apr 30, 2007
    Directwebremoting
    Direct Web Remoting
    risk 0.00cvss —epss 0.02

    The Getahead Direct Web Remoting (DWR) framework 1.1.4 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a…

  • CVE-2007-2378Apr 30, 2007
    Google
    Web Toolkit
    risk 0.00cvss —epss 0.01

    The Google Web Toolkit (GWT) framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element…

  • CVE-2007-2379Apr 30, 2007
    jQuery
    jQuery
    risk 0.00cvss —epss 0.03

    The jQuery framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the…

  • CVE-2007-2380Apr 30, 2007
    Microsoft
    Atlas Framework
    risk 0.01cvss —epss 0.12

    The Microsoft Atlas framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and…

  • CVE-2007-2381Apr 30, 2007
    Mochikit
    Mochikit Framework
    risk 0.00cvss —epss 0.02

    The MochiKit framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the…

  • CVE-2007-2382Apr 30, 2007
    risk 0.00cvss —epss 0.02

    The Moo.fx framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the…

  • CVE-2007-2383Apr 30, 2007
    Prototypejs
    Prototype
    risk 0.00cvss —epss 0.02

    The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a…

  • CVE-2007-2384Apr 30, 2007
    Script.aculo.us
    Script.aculo.us
    risk 0.00cvss —epss 0.01

    The Script.aculo.us framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and…

  • CVE-2007-2385Apr 30, 2007
    Yahoo
    Yahoo! UI framework
    risk 0.00cvss —epss 0.01

    The Yahoo! UI framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the…

  • CVE-2006-4520Apr 30, 2007
    Novell
    Edirectory
    risk 0.00cvss —epss 0.03

    ncp in Novell eDirectory before 8.7.3 SP9, and 8.8.x before 8.8.1 FTF2, does not properly handle NCP fragments with a negative length, which allows remote attackers to cause a denial of service (daemon crash) when the heap is written to a log file.

  • CVE-2006-7198Apr 30, 2007
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in IBM WebSphere Application Server (WAS) before 5.1.1.14, and WAS for z/OS 601 before 6.0.2.13, has unknown impact and attack vectors, related to a "Potential security exposure," aka PK26123.

  • CVE-2007-2029Apr 30, 2007
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.03

    File descriptor leak in the PDF handler in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service via a crafted PDF file.

  • CVE-2007-2053Apr 30, 2007
    Afflib
    Afflib
    risk 0.01cvss —epss 0.07

    Multiple stack-based buffer overflows in AFFLIB before 2.2.6 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) a long LastModified value in an S3 XML response in lib/s3.cpp; (2) a long (a) path or (b) bucket in an S3 URL in…

  • CVE-2007-2054Apr 30, 2007
    Afflib
    Afflib
    risk 0.00cvss —epss 0.03

    Multiple format string vulnerabilities in AFFLIB before 2.2.6 allow remote attackers to execute arbitrary code via certain command line parameters, which are used in (1) warn and (2) err calls in (a) lib/s3.cpp, (b) tools/afconvert.cpp, (c) tools/afcopy.cpp, (d)…

  • CVE-2007-2055Apr 30, 2007
    Afflib
    Afflib
    risk 0.00cvss —epss 0.02

    AFFLIB 2.2.8 and earlier allows attackers to execute arbitrary commands via shell metacharacters involving (1) certain command line parameters in tools/afconvert.cpp and (2) arguments to the get_parameter function in aimage/ident.cpp. NOTE: it is unknown if the get_parameter…

  • CVE-2007-2349Apr 30, 2007
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Invision Power Board (IP.Board) 2.1.x and 2.2.x allows remote attackers to inject arbitrary web script or HTML by uploading crafted images or PDF files.

  • CVE-2007-2350Apr 30, 2007
    Freepbx
    Freepbx
    risk 0.00cvss —epss 0.02

    admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the del parameter.

  • CVE-2007-2351Apr 30, 2007
    Microfocus
    Power Manager Remote Agent (RA)
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the HP Power Manager Remote Agent (RA) 4.0Build10 and earlier in HP-UX B.11.11 and B.11.23 allows local users to execute arbitrary code via unspecified vectors.

  • CVE-2007-2352Apr 30, 2007
    Afflib
    Afflib
    risk 0.00cvss —epss 0.05

    Multiple format string vulnerabilities in AFFLIB 2.2.6 allow remote attackers to execute arbitrary code via certain command line parameters, which are used in (1) warn and (2) err calls, possibly involving (a) lib/s3.cpp, (b) tools/afconvert.cpp, (c) tools/afcopy.cpp, (d)…

  • CVE-2007-2353Apr 30, 2007
    Apache
    Axis
    risk 0.00cvss —epss 0.28

    Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.

  • CVE-2007-2354Apr 30, 2007
    Progress (organisation)
    Webspeed Messenger
    risk 0.00cvss —epss 0.02

    Progress Webspeed Messenger allows remote attackers to obtain sensitive information via a WService parameter containing "wsbroker1/webutil/about.r", which reveals the operating system and product information.

  • CVE-2007-2355Apr 30, 2007
    Opendap
    CGI_server
    risk 0.00cvss —epss 0.06

    The get_url function in DODS_Dispatch.pm for the CGI_server in OPeNDAP 3 allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.

  • CVE-2007-2356Apr 30, 2007
    GIMP
    Gimp
    risk 0.04cvss —epss 0.16

    Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file.

  • CVE-2007-2357Apr 30, 2007
    Sinecms
    Sinecms
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in mods/Core/result.php in SineCms 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the stringa parameter.

  • CVE-2007-2358Apr 30, 2007
    B2evolution
    B2evolution
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in b2evolution allow remote attackers to execute arbitrary PHP code via a URL in the (1) inc_path parameter to (a) a_noskin.php, (b) a_stub.php, (c) admin.php, (d) contact.php, (e) default.php, (f) index.php, and (g)…