VYPR

CVEs

344,664 total · page 6410 of 6,894

AllCriticalHighKEV
  • CVE-2007-2180Apr 24, 2007
    Nullsoft
    Winamp
    risk 0.03cvss —epss 0.03

    Buffer overflow in Nullsoft Winamp 5.3 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted WMV file.

  • CVE-2007-2181Apr 24, 2007
    Webinsta
    Fm Manager
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin/login.php in Webinsta FM Manager 0.1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter, a different product and vector than CVE-2005-0748.

  • CVE-2007-2182Apr 24, 2007
    Maran
    PHP Forum
    risk 0.03cvss —epss 0.04

    Unrestricted file upload vulnerability in forum_write.php in Maran PHP Forum allows remote attackers to upload and execute arbitrary PHP files via a trailing %00 in a filename in the page parameter.

  • CVE-2007-2183Apr 24, 2007
    PHP Ring
    Webring System
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in PHP-Ring Webring System (aka uPHP_ring_website) 0.9 allows remote attackers to execute arbitrary SQL commands via the ring parameter.

  • CVE-2007-2184Apr 24, 2007
    Jchit
    Counter
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in imgsrv.php in jchit counter 1.0.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the acc parameter.

  • CVE-2007-2185Apr 24, 2007
    Supasite
    Supasite
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in Supasite 1.23b allow remote attackers to execute arbitrary PHP code via a URL in the supa[db_path] parameter to (1) common_functions.php, (2) admin_auth_cookies.php, (3) admin_mods.php, (4) admin_news.php, (5)…

  • CVE-2007-2186Apr 24, 2007
    Foxitsoftware
    Reader
    risk 0.04cvss —epss 0.08

    Foxit Reader 2.0 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document.

  • CVE-2007-2187Apr 24, 2007
    Extremail
    Extremail
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in eXtremail 2.1.1 and earlier allows remote attackers to execute arbitrary code via a long DNS response. NOTE: this might be related to CVE-2006-6926.

  • CVE-2007-2188Apr 24, 2007
    Extremail
    Extremail
    risk 0.00cvss —epss 0.02

    eXtremail 2.1.1 and earlier does not verify the ID field (aka transaction id) in DNS responses, which makes it easier for remote attackers to conduct DNS spoofing.

  • CVE-2007-2189Apr 24, 2007
    Mx Smartor
    Full Album Pack
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in admin/admin_album_otf.php in the MX Smartor Full Album Pack (FAP) 2.0 RC1 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2007-2190Apr 24, 2007
    Eba News
    Eba News
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in admin/public/webpages.php in Eba News 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter.

  • CVE-2007-2191Apr 24, 2007
    Freepbx
    Freepbx
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Call-ID, (4) User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and…

  • CVE-2007-2192Apr 24, 2007
    Antonio Da Cruz
    Photofiltre Studio
    risk 0.04cvss —epss 0.07

    Buffer overflow in Photofiltre Studio 8.1.1 allows user-assisted remote attackers to execute arbitrary code via a crafted .tif file.

  • CVE-2007-2193Apr 24, 2007
    Acdsee
    Acdsee
    risk 0.06cvss —epss 0.37

    Stack-based buffer overflow in the ID_X.apl plugin in ACDSee 9.0 Build 108, Pro 8.1 Build 99, and Photo Editor 4.0 Build 195 allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a long section string. NOTE: some of these details are…

  • CVE-2007-2194Apr 24, 2007
    Xnview
    Xnview
    risk 0.05cvss —epss 0.19

    Stack-based buffer overflow in XnView 1.90.3 allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a long section string. NOTE: some of these details are obtained from third party information.

  • CVE-2007-2195Apr 24, 2007
    Amsn
    Amsn
    risk 0.03cvss —epss 0.03

    aMSN (aka Alvaro's Messenger) 0.96 and earlier allows remote attackers to cause a denial of service (application crash) by sending invalid data to TCP port 31337.

  • CVE-2007-2196Apr 24, 2007
    Joomla
    Jambook
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in jambook.php in the Jambook (com_Jambook) 1.0 beta7 module for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: this issue has been disputed by a reliable…

  • CVE-2007-2197Apr 24, 2007
    NeatUpload
    NeatUpload
    risk 0.00cvss —epss 0.01

    Race condition in the NeatUpload ASP.NET component 1.2.11 through 1.2.16, 1.1.18 through 1.1.23, and trunk.379 through trunk.445 allows remote attackers to obtain other clients' HTTP responses via multiple simultaneous requests, which triggers multiple calls to…

  • CVE-2007-0443Apr 24, 2007
    Gracenote
    Cddbcontrol Activex Control
    risk 0.01cvss —epss 0.07

    Multiple buffer overflows in the CDDBControl ActiveX control in Gracenote CDDB before 20070418 allow remote attackers to execute arbitrary code via long values for certain Proxy configuration parameters.

  • CVE-2007-0725Apr 24, 2007
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Buffer overflow in the AirPortDriver module for AirPort in Apple Mac OS X 10.3.9 through 10.4.9, when running on hardware with the original AirPort wireless card, allows local users to execute arbitrary code by "sending malformed control commands."

  • CVE-2007-0729Apr 24, 2007
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Apple File Protocol (AFP) Client in Apple Mac OS X 10.3.9 through 10.4.9 does not properly clean the environment before executing commands, which allows local users to gain privileges by setting unspecified environment variables.

  • CVE-2007-0732Apr 24, 2007
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the CoreServices daemon in CarbonCore in Apple Mac OS X 10.4 through 10.4.9 allows local users to gain privileges via unspecified vectors involving "obtaining a send right to [the] Mach task port."

  • CVE-2007-1353Apr 24, 2007
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The setsockopt function in the L2CAP and HCI Bluetooth support in the Linux kernel before 2.4.34.3 allows context-dependent attackers to read kernel memory and obtain sensitive information via unspecified vectors involving the copy_from_user function accessing an uninitialized…

  • CVE-2007-2173Apr 24, 2007
    File Project
    Courier-IMAP
    risk 0.00cvss —epss 0.05

    Eval injection vulnerability in (1) courier-imapd.indirect and (2) courier-pop3d.indirect in Courier-IMAP before 4.0.6-r2, and 4.1.x before 4.1.2-r1, on Gentoo Linux allows remote attackers to execute arbitrary commands via the XMAILDIR variable, related to the LOGINRUN variable.

  • CVE-2007-2174Apr 24, 2007
    Checkpoint
    Zonealarm
    risk 0.00cvss —epss 0.00

    The IOCTL handling in srescan.sys in the ZoneAlarm Spyware Removal Engine (SRE) in Check Point ZoneAlarm before 5.0.156.0 allows local users to execute arbitrary code via certain IOCTL lrp parameter addresses.

  • CVE-2007-2175Apr 24, 2007
    Apple Inc.
    Safari
    risk 0.10cvss —epss 0.84

    Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory…

  • CVE-2007-2176Apr 24, 2007
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Mozilla Firefox allows remote attackers to execute arbitrary code via unspecified vectors involving Javascript errors. NOTE: this might be the same issue as CVE-2007-2175.

  • CVE-2007-2177Apr 24, 2007
    Microgaming
    Download Helper Activex Control
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in the Microgaming Download Helper ActiveX control (dlhelper.dll) before 7.2.0.19, and the WebHandler Class control, allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2007-1972Apr 22, 2007
    BMC Software
    Performance Manager
    risk 0.00cvss —epss 0.04

    PatrolAgent.exe in BMC Performance Manager does not require authentication for requests to modify configuration files, which allows remote attackers to execute arbitrary code via a request on TCP port 3181 for modification of the masterAgentName and masterAgentStartLine SNMP…

  • CVE-2007-2136Apr 22, 2007
    BMC Software
    Patrol Agent
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in bgs_sdservice.exe in BMC Patrol PerformAgent allows remote attackers to execute arbitrary code by connecting to TCP port 10128 and sending certain XDR data, which is not properly parsed.

  • CVE-2007-2137Apr 22, 2007
    IBM
    Tivoli Monitoring
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in kde.dll in IBM Tivoli Monitoring Express 6.1.0 before Fix Pack 2, as used in Tivoli Universal Agent, Windows OS Monitoring agent, and Enterprise Portal Server, allows remote attackers to execute arbitrary code by sending a long string to a certain…

  • CVE-2007-2159Apr 22, 2007
    Drupal
    Database Administration Module
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Database Administration (dba) module 4.6.x-*, and before 4.7.x-1.2 in the 4.7.x-1.* series, for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors relating to (1) direct display…

  • CVE-2007-2160Apr 22, 2007
    Drupal
    Database Administration Module
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Database Administration (dba) module 4.6.x-*, and before 4.7.x-1.2 in the 4.7.x-1.* series, for Drupal allow remote attackers to perform unauthorized actions as an arbitrary user, a related issue to CVE-2006-5476.

  • CVE-2007-2161Apr 22, 2007
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.12

    Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (browser hang) via JavaScript that matches a regular expression against a long string, as demonstrated using /(.)*/.

  • CVE-2007-2162Apr 22, 2007
    GNU
    Iceweasel
    risk 0.00cvss —epss 0.01

    (1) Mozilla Firefox 2.0.0.3 and (2) GNU IceWeasel 2.0.0.3 allow remote attackers to cause a denial of service (browser crash or system hang) via JavaScript that matches a regular expression against a long string, as demonstrated using /(.)*/.

  • CVE-2007-2163Apr 22, 2007
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Apple Safari allows remote attackers to cause a denial of service (browser crash) via JavaScript that matches a regular expression against a long string, as demonstrated using /(.)*/.

  • CVE-2007-2164Apr 22, 2007
    KDE
    Konqueror
    risk 0.00cvss —epss 0.01

    Konqueror 3.5.5 release 45.4 allows remote attackers to cause a denial of service (browser crash or abort) via JavaScript that matches a regular expression against a long string, as demonstrated using /(.)*/.

  • CVE-2007-2165Apr 22, 2007
    Proftpd
    Proftpd
    risk 0.01cvss —epss 0.13

    The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass…

  • CVE-2007-2166Apr 22, 2007
    Opensurveypilot
    Opensurveypilot
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in administration/user/lib/group.inc.php in OpenSurveyPilot (osp) 1.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cfgPathToProjectAdmin parameter.

  • CVE-2007-2167Apr 22, 2007
    Aimstats
    Aimstats
    risk 0.07cvss —epss 0.44

    Static code injection vulnerability in process.php in AimStats 3.2 allows remote attackers to inject PHP code into config.php via the number parameter in an update action.

  • CVE-2007-2168Apr 22, 2007
    Aimstats
    Aimstats
    risk 0.03cvss —epss 0.02

    Static code injection vulnerability in process.php in AimStats 3.2 and earlier allows remote attackers to inject PHP code into config.php via the databasehost parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2007-2169Apr 22, 2007
    Mozzers
    SubSystem
    risk 0.03cvss —epss 0.06

    Static code injection vulnerability in add.php in Mozzers SubSystem 1.0 allows remote attackers to inject PHP code into subs.php via the (1) Sub-name or (2) Sub-url field. NOTE: an earlier report indicated that the add action can be reached through a request to index.php.

  • CVE-2007-2172Apr 22, 2007
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    A typo in Linux kernel 2.6 before 2.6.21-rc6 and 2.4 before 2.4.35 causes RTA_MAX to be used as an array size instead of RTN_MAX, which leads to an "out of bound access" by the (1) dn_fib_props (dn_fib.c, DECNet) and (2) fib_props (fib_semantics.c, IPv4) functions.

  • CVE-2007-1009Apr 19, 2007
    Macrovision
    Installanywhere
    risk 0.00cvss —epss 0.00

    Macrovision InstallAnywhere Enterprise before 8.0.1 uses the InstallScript.iap_xml configuration file without integrity protection to verify authorization for installing an application, which allows local users to perform unauthorized installations by removing the (1) password…

  • CVE-2007-1681Apr 19, 2007
    Sun Corporation
    Java Web Console
    risk 0.00cvss —epss 0.05

    Format string vulnerability in libwebconsole_services.so in Sun Java Web Console 2.2.2 through 2.2.5 allows remote attackers to cause a denial of service (application crash), obtain sensitive information, and possibly execute arbitrary code via unspecified vectors during a…

  • CVE-2007-1690Apr 19, 2007
    Second Sight Software
    Activegs
    risk 0.03cvss —epss 0.06

    Multiple stack-based buffer overflows in Second Sight Software ActiveGS ActiveX control (ActiveGS.ocx) allow remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2007-1691Apr 19, 2007
    Second Sight Software
    Activemod
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in Second Sight Software ActiveMod ActiveX control (ActiveMod.ocx) allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2007-2140Apr 19, 2007
    Franklin Huang
    Flip Search Add On
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in everything.php in Franklin Huang Flip (aka Flip-search-add-on) 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the incpath parameter.

  • CVE-2007-2141Apr 19, 2007
    Shoutpro
    Shoutpro
    risk 0.07cvss —epss 0.46

    Direct static code injection vulnerability in shoutbox.php in ShoutPro 1.5.2 allows remote attackers to inject arbitrary PHP code into shouts.php via the shout parameter.

  • CVE-2007-2142Apr 19, 2007
    Ajportal2php
    Ajportal2php
    risk 0.04cvss —epss 0.10

    Multiple PHP remote file inclusion vulnerabilities in AjPortal2Php allow remote attackers to execute arbitrary PHP code via a URL in the PagePrefix parameter to (1) begin.inc.php, (2) connection.inc.php, (3) events.inc.php, (4) footer.inc.php, (5) header.inc.php, (6)…