VYPR

CVEs

344,562 total · page 6423 of 6,892

AllCriticalHighKEV
  • CVE-2007-1450Mar 14, 2007
    Warpspeed
    PHP Nuke
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in mainfile.php in PHP-Nuke 8.0 and earlier allows remote attackers to execute arbitrary SQL commands in the Top or News module via the lang parameter.

  • CVE-2007-1451Mar 14, 2007
    Guppy
    Guppy
    risk 0.00cvss —epss 0.02

    GuppY 4.0 allows remote attackers to delete arbitrary files via a direct request to install/install.php, then selecting "Installation propre" (cleanup.php) and then "Suppression des fichiers d'installation" (delete.php).

  • CVE-2007-1452Mar 14, 2007
    PHP
    PHP
    risk 0.03cvss —epss 0.05

    The FDF support (ext/fdf) in PHP 5.2.0 and earlier does not implement the input filtering hooks for ext/filter, which allows remote attackers to bypass web site filters via an application/vnd.fdf formatted POST.

  • CVE-2007-1453Mar 14, 2007
    PHP
    PHP
    risk 0.04cvss —epss 0.10

    Buffer underflow in the PHP_FILTER_TRIM_DEFAULT macro in the filtering extension (ext/filter) in PHP 5.2.0 allows context-dependent attackers to execute arbitrary code by calling filter_var with certain modes such as FILTER_VALIDATE_INT, which causes filter to write a null byte…

  • CVE-2007-1454Mar 14, 2007
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    ext/filter in PHP 5.2.0, when FILTER_SANITIZE_STRING is used with the FILTER_FLAG_STRIP_LOW flag, does not properly strip HTML tags, which allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML with a '<' character followed by certain whitespace…

  • CVE-2007-1455Mar 14, 2007
    CPanel
    Fantastico De Luxe
    risk 0.04cvss —epss 0.07

    Multiple absolute path traversal vulnerabilities in Fantastico, as used with cPanel 10.x, allow remote authenticated users to include and execute arbitrary local files via (1) the userlanguage parameter to includes/load_language.php or (2) the fantasticopath parameter to…

  • CVE-2007-1456Mar 14, 2007
    Phpalbum.net
    Phpalbum
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in common.php in PHP Photo Album allows remote attackers to execute arbitrary PHP code via a URL in the db_file parameter. NOTE: CVE disputes this vulnerability, because versions 0.3.2.6 and 0.4.1beta do not contain this file. However, it…

  • CVE-2007-1457Mar 14, 2007
    Christian Scheurer
    Unrarlib
    risk 0.00cvss —epss 0.03

    Buffer overflow in the urarlib_get function in Christian Scheurer UniquE RAR File Library (unrarlib, aka URARFileLib) 0.4 allows context-dependent attackers to execute arbitrary code via a long (1) filename, (2) rarfile, or (3) libpassword argument.

  • CVE-2007-1458Mar 14, 2007
    Care2x
    Care2x
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in CARE2X 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) inc_checkdate_lang.php, (2) inc_charset_fx.php, (3) inc_config_color.php, (4) inc_currency_set.php, (5)…

  • CVE-2007-1459Mar 14, 2007
    Webcreator
    Webcreator
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in WebCreator 0.2.6-rc3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the moddir parameter to (1) content/load.inc.php, (2) config/load.inc.php, (3) http/load.inc.php, and unspecified other files.

  • CVE-2007-1460Mar 14, 2007
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The zip:// URL wrapper provided by the PECL zip extension in PHP before 4.4.7, and 5.2.0 and 5.2.1, does not implement safemode or open_basedir checks, which allows remote attackers to read ZIP archives located outside of the intended directories.

  • CVE-2007-1461Mar 14, 2007
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The compress.bzip2:// URL wrapper provided by the bz2 extension in PHP before 4.4.7, and 5.x before 5.2.2, does not implement safemode or open_basedir checks, which allows remote attackers to read bzip2 archives located outside of the intended directories.

  • CVE-2007-1441Mar 14, 2007
    Rim
    Blackberry
    risk 0.00cvss —epss 0.02

    The 4thPass browser (BlackBerry Browser) on the RIM BlackBerry 8100 (Pearl) before 4.2.1 allows remote attackers to cause a denial of service (temporary functionality loss) via a long href attribute in a link in a WML page.

  • CVE-2007-1442Mar 14, 2007
    Oracle Corporation
    Database 10g
    risk 0.00cvss —epss 0.00

    Oracle Database 10g uses a NULL pDacl parameter when calling the SetSecurityDescriptorDacl function to create discretionary access control lists (DACLs), which allows local users to gain privileges.

  • CVE-2007-1443Mar 14, 2007
    Woltlab
    Burning Board
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in register.php in Woltlab Burning Board (wBB) 2.3.6 and Burning Board Lite 1.0.2pl3e allow remote attackers to inject arbitrary web script or HTML via the (1) r_username, (2) r_email, (3) r_password, (4) r_confirmpassword, (5)…

  • CVE-2007-1444Mar 14, 2007
    Netperf
    Netperf
    risk 0.00cvss —epss 0.00

    netserver in netperf 2.4.3 allows local users to overwrite arbitrary files via a symlink attack on /tmp/netperf.debug.

  • CVE-2007-1445Mar 14, 2007
    Betaparticle
    bp blog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the heme preview feature for default.asp in BP Blog 7.0 through 7.0.2 allows remote attackers to execute arbitrary SQL commands via the layout parameter.

  • CVE-2007-1446Mar 14, 2007
    Danny Ho
    Oes
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in Open Education System (OES) 0.1beta allow remote attackers to execute arbitrary PHP code via a URL in the CONF_INCLUDE_PATH parameter to (1) lib-account.inc.php, (2) lib-file.inc.php, (3) lib-group.inc.php, (4)…

  • CVE-2007-1438Mar 13, 2007
    X Ice
    News System
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in devami.asp in X-Ice News System 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2007-1439Mar 13, 2007
    Bitesser
    Mysql Commander
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in ressourcen/dbopen.php in bitesser MySQL Commander 2.7 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the home parameter.

  • CVE-2007-1440Mar 13, 2007
    Jgbbs
    Jgbbs
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in search.asp in JGBBS 3.0 Beta 1 allows remote attackers to execute arbitrary SQL commands via the author parameter.

  • CVE-2007-0721Mar 13, 2007
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in diskimages-helper in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 allows remote user-assisted attackers to execute arbitrary code via a crafted compressed disk image that triggers memory corruption.

  • CVE-2007-0722Mar 13, 2007
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    Integer overflow in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 allows remote user-assisted attackers to execute arbitrary code via a crafted AppleSingleEncoding disk image.

  • CVE-2007-0723Mar 13, 2007
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the authentication feature for DirectoryService (DS Plug-Ins) for Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 allows remote authenticated LDAP users to modify the root password and gain privileges via unknown vectors.

  • CVE-2007-0724Mar 13, 2007
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    The IOKit HID interface in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 does not sufficiently limit access to certain controls, which allows local users to gain privileges by using HID device events to read keystrokes from the console.

  • CVE-2007-0726Mar 13, 2007
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    The SSH key generation process in OpenSSH in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 allows remote attackers to cause a denial of service by connecting to the server before SSH has finished creating keys, which causes the keys to be regenerated and can break trust…

  • CVE-2007-0728Mar 13, 2007
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 creates files insecurely while initializing a USB printer, which allows local users to create or overwrite arbitrary files.

  • CVE-2007-0730Mar 13, 2007
    Apple Inc.
    Server Manager
    risk 0.00cvss —epss 0.02

    Server Manager (servermgrd) in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 does not sufficiently validate authentication credentials, which allows remote attackers to bypass authentication and modify system configuration.

  • CVE-2007-0731Mar 13, 2007
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the Apple-specific Samba module (SMB File Server) in Apple Mac OS X 10.4 through 10.4.8 allows context-dependent attackers to execute arbitrary code via a long ACL.

  • CVE-2007-0733Mar 13, 2007
    Apple Inc.
    Imageio
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in ImageIO in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 allows remote user-assisted attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted RAW image that triggers memory corruption.

  • CVE-2007-0719Mar 13, 2007
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 allows remote user-assisted attackers to execute arbitrary code via an image with a crafted ColorSync profile.

  • CVE-2007-0720Mar 13, 2007
    Openprinting
    Cups
    risk 0.00cvss —epss 0.05

    The CUPS service on multiple platforms allows remote attackers to cause a denial of service (service hang) via a "partially-negotiated" SSL connection, which prevents other requests from being accepted.

  • CVE-2007-1387Mar 13, 2007
    MPlayer
    Mplayer
    risk 0.00cvss —epss 0.04

    The DirectShow loader (loader/dshow/DS_VideoDecoder.c) in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different…

  • CVE-2007-1431Mar 13, 2007
    Pennmush
    Pennmush
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in PennMUSH 1.8.3 before 1.8.3p1 and 1.8.2 before 1.8.2p3 allow attackers to cause a denial of service (crash) related to the (1) speak and (2) buy functions.

  • CVE-2007-1432Mar 13, 2007
    Grayscale
    Blog
    risk 0.03cvss —epss 0.02

    Grayscale Blog 0.8.0, and possibly earlier versions, allows remote attackers to gain privileges via direct requests with modified arguments in (1) the user_permissions parameter to add_users.php, and unspecified parameters to (2) addblog.php, (3) editblog.php, (4) editlinks.php,…

  • CVE-2007-1433Mar 13, 2007
    Grayscale
    Blog
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Grayscale Blog 0.8.0, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the comment fields to (1) scripts/addblog_comment.php and (2) detail.php.

  • CVE-2007-1434Mar 13, 2007
    Grayscale
    Blog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Grayscale Blog 0.8.0, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) userdetail.php, id and (2) url parameter to (b) jump.php, and id variable to (c) detail.php.

  • CVE-2007-1435Mar 13, 2007
    Dlink
    TFTP Server
    risk 0.06cvss —epss 0.43

    Buffer overflow in D-Link TFTP Server 1.0 allows remote attackers to cause a denial of service (crash) via a long (1) GET or (2) PUT request, which triggers memory corruption. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2007-1436Mar 13, 2007
    Ledgersmb
    Ledgersmb
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in admin.pl in SQL-Ledger before 2.6.26 and LedgerSMB before 1.1.9 allows remote attackers to bypass authentication via unknown vectors that prevents a password check from occurring.

  • CVE-2007-1437Mar 13, 2007
    Ledgersmb
    Ledgersmb
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in LedgerSMB before 1.1.5 and SQL-Ledger before 2.6.25 allows remote attackers to overwrite files and possibly bypass authentication, and remote authenticated users to execute unauthorized code, by calling a custom error function that returns from…

  • CVE-2007-1421Mar 13, 2007
    Premod
    Premod Subdog
    risk 0.04cvss —epss 0.11

    Multiple PHP remote file inclusion vulnerabilities in Premod SubDog 2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) functions_kb.php, (2) themen_portal_mitte.php, or (3) logger_engine.php in includes/.

  • CVE-2007-1422Mar 13, 2007
    Duyuru Scripti
    Duyuru Scripti
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in goster.asp in fystyq Duyuru Scripti allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2007-0688.

  • CVE-2007-1423Mar 13, 2007
    Work System E Commerce
    system e-commerce
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in WORK system e-commerce 3.0.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the g_include parameter to include/include_top.php and certain other PHP scripts.

  • CVE-2007-1424Mar 13, 2007
    Datalifecms
    DataLife Engine
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Softnews Media Group DataLife Engine allow remote attackers to execute arbitrary PHP code via a URL in the root_dir parameter to (1) init.php and (2) Ajax/editnews.php. NOTE: some of these details are obtained from third…

  • CVE-2007-1425Mar 13, 2007
    Triexa
    Sonicmailer Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Triexa SonicMailer Pro 3.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the list parameter in an archive action.

  • CVE-2007-1426Mar 13, 2007
    Astrocam
    Astrocam
    risk 0.00cvss —epss 0.02

    The web interface in AstroCam 2.0.0 through 2.6.5 allows remote attackers to cause a denial of service (daemon shutdown) via requests that contain a large amount of data in the "a" variable, which "fills up the message queue."

  • CVE-2007-1427Mar 13, 2007
    Assetman
    Assetman
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in download_pdf.php in AssetMan 2.4a and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the pdf_file parameter.

  • CVE-2007-1428Mar 13, 2007
    PHP Labs
    Jobsitepro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in search.php in PHP Labs JobSitePro 1.0 allows remote attackers to execute arbitrary SQL commands via the salary parameter.

  • CVE-2007-1429Mar 13, 2007
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in Moodle 1.7.1 allow remote attackers to execute arbitrary PHP code via a URL in the cmd parameter to (1) admin/utfdbmigrate.php or (2) filter.php.

  • CVE-2007-1430Mar 13, 2007
    Clip Share
    Clipshare
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in include/adodb-connection.inc.php in ClipShare 1.5.3 allows remote attackers to execute arbitrary PHP code via a URL in the cmd parameter.