VYPR

CVEs

344,664 total · page 6412 of 6,894

AllCriticalHighKEV
  • CVE-2007-2090Apr 18, 2007
    Tumusika Evolution
    Evolution
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in TuMusika Evolution 1.6 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2007-2091Apr 18, 2007
    Tsdisplay4xoops
    Tsdisplay4xoops
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in blocks/tsdisplay4xoops_block2.php in tsdisplay4xoops (TSD4XOOPS, aka the TeamSpeak display module) 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the xoops_url parameter.

  • CVE-2007-2092Apr 18, 2007
    Limesoft
    Limesoft Guestbook
    risk 0.03cvss —epss 0.02

    Direct static code injection vulnerability in index.php in Limesoft Guestbook (LS Simple Guestbook) allows remote attackers to inject arbitrary PHP code into posts.txt via the name parameter. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2007-2093Apr 18, 2007
    Limesoft
    Limesoft Guestbook
    risk 0.07cvss —epss 0.46

    Direct static code injection vulnerability in index.php in Limesoft Guestbook (LS Simple Guestbook) 1.0 allows remote attackers to inject arbitrary PHP code into posts.txt via the message parameter.

  • CVE-2007-2094Apr 18, 2007
    Anthologia
    Anthologia
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in Anthologia 0.5.2 allows remote attackers to execute arbitrary PHP code via a URL in the ads_file parameter.

  • CVE-2007-2095Apr 18, 2007
    Sky Gunning
    Myspeach
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in chat.php in MySpeach 1.9 allows remote attackers to execute arbitrary PHP code via a URL in the my[root] parameter, a different vector than CVE-2007-0498.

  • CVE-2007-2096Apr 18, 2007
    Hinton Design
    Phphd Download System
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in common.php in Hinton Design PHPHD Download System (phphd_downloads) allows remote attackers to execute arbitrary PHP code via a URL in the phphd_real_path parameter. NOTE: this issue may be present in versions from 2006.

  • CVE-2007-2097Apr 18, 2007
    Openconcept
    Back End CMS
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in OpenConcept Back-End CMS 0.4.7 allow remote attackers to execute arbitrary PHP code via a URL in the includes_path parameter to (1) click.php or (2) pollcollector.php in htdocs/; or (3) index.php, (4) articlepages.php, (5)…

  • CVE-2007-2098Apr 18, 2007
    Wabbit
    Wabbit PHP Gallery
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in showpic.php in Wabbit PHP Gallery 0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) pic and (2) gal parameters.

  • CVE-2007-2099Apr 18, 2007
    Openconcept
    Back End CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in htdocs/php.php in OpenConcept Back-End CMS 0.4.7 allows remote attackers to inject arbitrary web script or HTML via the page[] parameter.

  • CVE-2007-2100Apr 18, 2007
    Fac Guestbook
    Fac Guestbook
    risk 0.00cvss —epss 0.02

    FAC Guestbook 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/Gdb.mdb.

  • CVE-2007-2101Apr 18, 2007
    Fac Guestbook
    Fac Guestbook
    risk 0.00cvss —epss 0.02

    FAC Guestbook 3.01 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/gbdb.mdb. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2007-2102Apr 18, 2007
    My Little Weblog
    my little weblog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in weblog.php in my little weblog allows remote attackers to inject arbitrary web script or HTML via the id parameter, a different vector than CVE-2006-6087.

  • CVE-2007-2103Apr 18, 2007
    My Little Forum
    Mylittleforum
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in my little forum 1.7 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to (1) admin.php and (2) timedifference.php.

  • CVE-2007-2104Apr 18, 2007
    Ixon CMS
    Ixon CMS
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in iXon CMS 0.30 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme_url parameter to (1) index.php, (2) page.php, (3) search.php, (4) single.php, and (5) archives.php.

  • CVE-2007-2105Apr 18, 2007
    Monkey CMS
    Monkey CMS
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in admin/index.php in Monkey CMS 0.0.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the admin_skin parameter.

  • CVE-2007-2106Apr 18, 2007
    Kai Content Management System
    Kai Content Management System
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in index.php in Kai Content Management System (K-CMS) 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the current_theme parameter.

  • CVE-2007-2107Apr 18, 2007
    Rha7 Downloads
    Rha7 Downloads
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in visit.php in the Rha7 Downloads (rha7downloads) 1.0 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter, a different vector than CVE-2007-1960. NOTE: the provenance of this information is unknown; the…

  • CVE-2007-1674Apr 18, 2007
    Ivanti
    Management Suite
    risk 0.09cvss —epss 0.73

    Stack-based buffer overflow in the Alert Service (aolnsrvr.exe) in LANDesk Management Suite 8.7 allows remote attackers to execute arbitrary code via a crafted packet to port 65535/UDP.

  • CVE-2007-1856Apr 18, 2007
    Vixie
    Cron
    risk 0.00cvss —epss 0.00

    Vixie Cron before 4.1-r10 on Gentoo Linux is installed with insecure permissions, which allows local users to cause a denial of service (cron failure) by creating hard links, which results in a failed st_nlink check in database.c.

  • CVE-2007-1869Apr 18, 2007
    Lighttpd
    Lighttpd
    risk 0.00cvss —epss 0.03

    lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences, which triggers an infinite loop and file descriptor consumption.

  • CVE-2007-1870Apr 18, 2007
    Lighttpd
    Lighttpd
    risk 0.00cvss —epss 0.03

    lighttpd before 1.4.14 allows attackers to cause a denial of service (crash) via a request to a file whose mtime is 0, which results in a NULL pointer dereference.

  • CVE-2007-1891Apr 18, 2007
    Akamai Technologies
    Download Manager
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in the GetPrivateProfileSectionW function in Akamai Technologies Download Manager ActiveX Control (DownloadManagerV2.ocx) after 2.0.4.4 but before 2.2.1.0 allows remote attackers to execute arbitrary code, related to misinterpretation of the nSize…

  • CVE-2007-1892Apr 18, 2007
    Akamai Technologies
    Download Manager
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in Akamai Technologies Download Manager ActiveX Control (DownloadManagerV2.ocx) before 2.2.1.0 allows remote attackers to execute arbitrary code via unspecified vectors, a different issue than CVE-2007-1891.

  • CVE-2007-2057Apr 18, 2007
    Aircrack Ng
    Airodump Ng
    risk 0.05cvss —epss 0.19

    Stack-based buffer overflow in aircrack-ng airodump-ng 0.7 allows remote attackers to execute arbitrary code via crafted 802.11 authentication packets.

  • CVE-2007-2058Apr 18, 2007
    Picozip
    Picozip
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in Acubix PicoZip 4.02 allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the file path in an (1) GZ, (2) TAR, (3) RAR, (4) JAR, or (5) ZIP archive.

  • CVE-2007-2059Apr 18, 2007
    Eiqnetworks
    Enterprise Security Analyzer
    risk 0.04cvss —epss 0.07

    Multiple buffer overflows in the ESA protocol implementation in eIQnetworks Enterprise Security Analyzer (ESA) 2.5 allow remote attackers to execute arbitrary code via a long parameter to the (1) DELETESEARCHFOLDER, (2) DELTASK, (3) HMGR_CHECKHOSTSCSV, (4) TASKUPDATEDUSER, (5)…

  • CVE-2007-2060Apr 18, 2007
    Wizz Computers
    Wizz Rss Reader
    risk 0.00cvss —epss 0.03

    Cross-zone scripting vulnerability in the Wizz RSS Reader before 2.1.9 extension to Mozilla Firefox allows remote attackers to execute arbitrary Javascript in the browser chrome via the RSS feed DOM.

  • CVE-2007-2061Apr 18, 2007
    Afterlogic
    Mailbee Webmail
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in check_login.asp in AfterLogic MailBee WebMail Pro 3.4 allows remote attackers to inject arbitrary web script or HTML via the username parameter.

  • CVE-2007-2062Apr 18, 2007
    Vcdgear
    Vcdgear
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in VCDGear 3.55 and 3.56 BETA allows user-assisted remote attackers to execute arbitrary code via a long FILE argument in a CUE file.

  • CVE-2007-2063Apr 18, 2007
    SSH
    Tectia Server
    risk 0.00cvss —epss 0.00

    SSH Tectia Server for IBM z/OS before 5.4.0 uses insecure world-writable permissions for (1) the server pid file, which allows local users to cause arbitrary processes to be stopped, or (2) when _BPX_BATCH_UMASK is missing from the environment, creates HFS files with insecure…

  • CVE-2007-2064Apr 18, 2007
    Actionpoll
    Actionpoll
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Robert Ladstaetter ActionPoll 1.1.0, and possibly 1.1.1, allow remote attackers to execute arbitrary PHP code via a URL in (1) the CONFIG_POLLDB parameter to actionpoll.php or (2) the CONFIG_DB parameter to…

  • CVE-2007-2065Apr 18, 2007
    Actionpoll
    Actionpoll
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in db/PollDB.php in Robert Ladstaetter ActionPoll 1.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG_DATAREADERWRITER parameter, a different vector than CVE-2001-1297. NOTE: the provenance of this…

  • CVE-2007-2066Apr 18, 2007
    Usebb
    Usebb
    risk 0.00cvss —epss 0.01

    UseBB before 1.0.6 allows remote attackers to obtain sensitive information via a request with unspecified GET or POST parameters to an unspecified script, which reveals the path in an error message.

  • CVE-2007-2067Apr 18, 2007
    Webslider
    Webslider
    risk 0.04cvss —epss 0.08

    Multiple PHP remote file inclusion vulnerabilities in Marco Antonio Islas Cruz Web Slider (WebSlider) 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) index.php, (2) modules/pdf.php, (3) plugins/highlight.php, or (4)…

  • CVE-2007-2068Apr 18, 2007
    Gallery Project
    StoreFront
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in the StoreFront mods for Gallery allow remote attackers to execute arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter to (1) mods/business_functions.php or (2) mods/ui_functions.php.

  • CVE-2007-2069Apr 18, 2007
    Openmairie
    Openmairie
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in scr/soustab.php in openMairie 1.11 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the dsn[phptype] parameter.

  • CVE-2007-2070Apr 18, 2007
    Turnkey Web Tools
    Sunshop Shopping Cart
    risk 0.04cvss —epss 0.09

    Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools SunShop Shopping Cart before 3.5.1 allow remote attackers to execute arbitrary PHP code via a URL in the abs_path parameter to (1) index.php or (2) checkout.php.

  • CVE-2007-2071Apr 18, 2007
    Open Gorotto
    Open Gorotto
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Open-gorotto 2.0a 2006/02/08 edition, 2006/03/19 edition, and 2006/04/07 edition before 20070416 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) pub/modules/d/_top.html; (2)…

  • CVE-2007-2072Apr 18, 2007
    Ivan Gallery Script
    Gallery Script
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in Ivan Gallery Script 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: this issue has been disputed by third party researchers for 0.3, stating that the dir variable is properly…

  • CVE-2007-2073Apr 18, 2007
    Ivan Gallery Script
    Gallery Script
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in index.php in Ivan Gallery Script 0.3 allows remote attackers to execute arbitrary PHP code via a URL in the gallery parameter in a new session.

  • CVE-2007-2074Apr 18, 2007
    Scramdisk 4 Linux
    Scramdisk 4 Linux
    risk 0.00cvss —epss 0.00

    Certain programs in containers in ScramDisk 4 Linux before 1.0-1 execute with SUID permissions, which allows local users to gain privileges via mounted containers.

  • CVE-2007-2075Apr 18, 2007
    Scramdisk 4 Linux
    Scramdisk 4 Linux
    risk 0.00cvss —epss 0.00

    ScramDisk 4 Linux before 1.0-1 does not perform permission checks on mount points, which allows local users to gain privileges by using a system directory as a mount point for a container.

  • CVE-2007-2076Apr 18, 2007
    Maianscriptworld
    Gallery
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in Maian Gallery 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter. NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating "this…

  • CVE-2007-2077Apr 18, 2007
    Maianscriptworld
    Search
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in search.php in Maian Search 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter. NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating "this issue…

  • CVE-2007-2078Apr 18, 2007
    Maianscriptworld
    Weblog
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in Maian Weblog 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter. NOTE: this issue was disputed by a third party researcher, since the path_to_folder variable is initialized…

  • CVE-2007-2079Apr 18, 2007
    Apachefriends
    Xampp
    risk 0.04cvss —epss 0.10

    The ADONewConnection Connect function in adodb.php in XAMPP 1.6.0a and earlier for Windows uses untrusted input for the database server hostname, which allows remote attackers to trigger a library buffer overflow and execute arbitrary code via a long host parameter, or have…

  • CVE-2007-2080Apr 18, 2007
    Apachefriends
    Xampp
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in XAMPP 1.6.0a for Windows allow remote attackers to execute arbitrary SQL commands via unspecified vectors in certain test scripts.

  • CVE-2007-2081Apr 18, 2007
    Myblog
    Myblog
    risk 0.04cvss —epss 0.07

    MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication requirements via the admin cookie parameter to certain admin files, as demonstrated by admin/settings.php.

  • CVE-2007-2082Apr 18, 2007
    Myblog
    Myblog
    risk 0.00cvss —epss 0.01

    Direct static code injection vulnerability in admin/settings.php in MyBlog 0.9.8 and earlier allows remote authenticated admin users to inject arbitrary PHP code via the content parameter, which can be executed by accessing index.php. NOTE: a separate vulnerability could be…