VYPR

CVEs

344,557 total · page 6433 of 6,892

AllCriticalHighKEV
  • CVE-2007-1066Feb 22, 2007
    Meetinghouse
    Aegis Secureconnect Client
    risk 0.00cvss —epss 0.00

    Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client use an insecure default Discretionary Access Control Lists (DACL) for the…

  • CVE-2007-1067Feb 22, 2007
    Meetinghouse
    Aegis Secureconnect Client
    risk 0.00cvss —epss 0.00

    Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client do not properly parse commands, which allows local users to gain privileges…

  • CVE-2007-1068Feb 22, 2007
    Meetinghouse
    Aegis Secureconnect Client
    risk 0.00cvss —epss 0.00

    The (1) TTLS CHAP, (2) TTLS MSCHAP, (3) TTLS MSCHAPv2, (4) TTLS PAP, (5) MD5, (6) GTC, (7) LEAP, (8) PEAP MSCHAPv2, (9) PEAP GTC, and (10) FAST authentication methods in Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1…

  • CVE-2007-1059Feb 22, 2007
    Ultimate Fun Book
    Ultimate Fun Book
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in function.php in Ultimate Fun Book 1.02 allows remote attackers to execute arbitrary PHP code via a URL in the gbpfad parameter. NOTE: some sources mention "Ultimate Fun Board," but this appears to be an error.

  • CVE-2007-1060Feb 22, 2007
    Interspire
    Sendstudio
    risk 0.04cvss —epss 0.08

    Multiple PHP remote file inclusion vulnerabilities in Interspire SendStudio 2004.14 and earlier, when register_globals and allow_fopenurl are enabled, allow remote attackers to execute arbitrary PHP code via a URL in the ROOTDIR parameter to (1) createemails.inc.php and (2)…

  • CVE-2007-1061Feb 22, 2007
    PHP-Nuke
    PHP Nuke
    risk 0.08cvss —epss 0.61

    SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" block is enabled, allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header (HTTP_REFERER variable).

  • CVE-2007-1050Feb 21, 2007
    Abledesign
    Mycalendar
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in AbleDesign MyCalendar allow remote attackers to inject arbitrary web script or HTML via (1) the go parameter, (2) the keyword parameter in the search menu (go=search), or (3) the username or (4) the password in…

  • CVE-2007-1051Feb 21, 2007
    Comodo
    Comodo Firewall Pro
    risk 0.00cvss —epss 0.00

    Comodo Firewall Pro (formerly Comodo Personal Firewall) 2.4.17.183 and earlier uses a weak cryptographic hashing function (CRC32) to identify trusted modules, which allows local users to bypass security protections by substituting modified modules that have the same CRC32 value.

  • CVE-2007-1052Feb 21, 2007
    Pblang
    Pblang
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in PBLang (PBL) 4.60 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the dbpath parameter, a different vector than CVE-2006-5062. NOTE: this issue has been disputed by a reliable third party for…

  • CVE-2007-1053Feb 21, 2007
    PhpXmms
    phpXmms
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in phpXmms 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the tcmdp parameter to (1) phpxmmsb.php or (2) phpxmmst.php. NOTE: this issue has been disputed by a reliable third party, stating that the tcmdp…

  • CVE-2007-1054Feb 21, 2007
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.6.x through 1.9.2, when $wgUseAjax is enabled, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded value of the rs parameter, which is processed by Internet…

  • CVE-2007-1055Feb 21, 2007
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.9.x before 1.9.0rc2, and 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the rs parameter. NOTE: this issue might be a duplicate of CVE-2007-0177.

  • CVE-2007-1056Feb 21, 2007
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    VMware Workstation 5.5.3 build 34685 does not provide per-user restrictions on certain privileged actions, which allows local users to perform restricted operations such as changing system time, accessing hardware components, and stopping the "VMware tools service" service.…

  • CVE-2007-1057Feb 21, 2007
    Nortel
    Net Direct Client
    risk 0.03cvss —epss 0.01

    The Net Direct client for Linux before 6.0.5 in Nortel Application Switch 2424, VPN 3050 and 3070, and SSL VPN Module 1000 extracts and executes files with insecure permissions, which allows local users to exploit a race condition to replace a world-writable file in…

  • CVE-2007-1058Feb 21, 2007
    Online Web Building
    Online Web Building
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in user_pages/page.asp in Online Web Building 2.0 allows remote attackers to execute arbitrary SQL commands via the art_id parameter.

  • CVE-2007-1037Feb 21, 2007
    News File Grabber
    News File Grabber
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in News File Grabber 4.1.0.1 and earlier allows remote attackers to execute arbitrary code via a .nzb file with a long subject field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2007-1038Feb 21, 2007
    Shemes
    Grabit
    risk 0.00cvss —epss 0.01

    Shemes.com Grabit 1.5.3, and possibly earlier, allows remote attackers to cause a denial of service (application crash) via a .nzb file with a subject field containing ';' (semicolon) characters. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2007-1039Feb 21, 2007
    Peanutkb
    Peanut Knowledge Base
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Peanut Knowledge Base (PeanutKB) 0.0.3 and earlier has unknown impact and attack vectors.

  • CVE-2007-1040Feb 21, 2007
    Xpression News
    Xpression News
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in archives.php in Xpression News (X-News) 1.0.1 allows remote attackers to include arbitrary files or obtain sensitive information via a .. (dot dot) in the xnews-template parameter.

  • CVE-2007-1041Feb 21, 2007
    S&H Computer Systems
    News Rover
    risk 0.04cvss —epss 0.07

    Multiple stack-based buffer overflows in S&H Computer Systems News Rover 12.1 Rev 1 allow remote attackers to execute arbitrary code via a .nzb file with a long (1) group or (2) subject string.

  • CVE-2007-1042Feb 21, 2007
    Xpression News
    Xpression News
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in news.php in Xpression News (X-News) 1.0.1, when magic_quotes_gpc is disabled, allows remote attackers to include arbitrary files or obtain sensitive information via a .. (dot dot) in the xnews-template parameter. NOTE: the provenance of this…

  • CVE-2007-1043Feb 21, 2007
    Ezboo
    Webstats
    risk 0.04cvss —epss 0.08

    Ezboo webstats, possibly 3.0.3, allows remote attackers to bypass authentication and gain access via a direct request to (1) update.php and (2) config.php.

  • CVE-2007-1044Feb 21, 2007
    Pearson
    Powerschool
    risk 0.04cvss —epss 0.09

    Pearson Education PowerSchool 4.3.6 allows remote attackers to list the contents of the admin folder via a URI composed of the admin/ directory name and an arbitrary filename ending in ".js." NOTE: it was later reported that this issue had been addressed by 5.1.2.

  • CVE-2007-1045Feb 21, 2007
    Malbum
    Malbum
    risk 0.00cvss —epss 0.03

    mAlbum 0.3 has default accounts (1) "login"/"pass" for its administrative account and (2) "dqsfg"/"sdfg", which allows remote attackers to gain privileges.

  • CVE-2007-1046Feb 21, 2007
    Dem Trac
    Dem Trac
    risk 0.00cvss —epss 0.02

    Dem_trac allows remote attackers to read log file contents via a direct request for /anc_sit.txt.

  • CVE-2007-1047Feb 21, 2007
    Rhyolite
    DCC
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Distributed Checksum Clearinghouse (DCC) before 1.3.51 allows remote attackers to delete or add hosts in /var/dcc/maps.

  • CVE-2007-1048Feb 21, 2007
    Phpbb Wordsearch
    Phpbb Wordsearch
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in admin_rebuild_search.php in phpbb_wordsearch allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2007-1049Feb 21, 2007
    WordPress
    WordPress
    risk 0.00cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to…

  • CVE-2007-1010Feb 21, 2007
    Zebrafeeds
    Zebrafeeds
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in ZebraFeeds 1.0, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the zf_path parameter to (1) aggregator.php and (2) controller.php in newsfeeds/includes/.

  • CVE-2007-1011Feb 21, 2007
    Vs Gastebuch
    Vs Gastebuch
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in functions_inc.php in VS-Gastebuch 1.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the gb_pfad parameter.

  • CVE-2007-1012Feb 21, 2007
    Headstart Solutions
    Deskpro
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in faq.php in DeskPRO 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the article parameter.

  • CVE-2007-1013Feb 21, 2007
    Virtualsystem
    Htaccess Passwort Generator
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in generate.php in VirtualSystem Htaccess Passwort Generator 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the ht_pfad parameter.

  • CVE-2007-1014Feb 21, 2007
    Vicftps
    Vicftps
    risk 0.04cvss —epss 0.09

    Stack-based buffer overflow in VicFTPS before 5.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long CWD command.

  • CVE-2007-1015Feb 21, 2007
    Aktueldownload
    Haber script
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in HaberDetay.asp in Aktueldownload Haber script allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2007-1016Feb 21, 2007
    Aktueldownload
    Haber script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Aktueldownload Haber script allows remote attackers to execute arbitrary SQL commands via certain vectors related to the HaberDetay.asp and rss.asp components, and the id and kid parameters. NOTE: the provenance of this information is unknown; the…

  • CVE-2007-1017Feb 21, 2007
    Virtualsystem
    Vs News System
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in show_news_inc.php in VirtualSystem VS-News-System 1.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the newsordner parameter.

  • CVE-2007-1018Feb 21, 2007
    Virtualsystem
    Vs News System
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in tpl/header.php in VirtualSystem VS-News-System 1.2.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the newsordner parameter. NOTE: the provenance of this information…

  • CVE-2007-1019Feb 21, 2007
    Webspell
    Webspell
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.php in webSPELL 4.01.02, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the showonly parameter to index.php, a different vector than CVE-2006-5388.

  • CVE-2007-1020Feb 21, 2007
    Cedstat
    Cedstat
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in index.php in CedStat 1.31 allows remote attackers to inject arbitrary web script or HTML via the hier parameter.

  • CVE-2007-1021Feb 21, 2007
    Codeavalanche
    News
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in inc_listnews.asp in CodeAvalanche News 1.x allows remote attackers to execute arbitrary SQL commands via the CAT_ID parameter.

  • CVE-2007-1022Feb 21, 2007
    Turuncu Portal
    Turuncu Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in h_goster.asp in Turuncu Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2007-1023Feb 21, 2007
    Snitz Communications
    Forums 2000
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pop_profile.asp in Snitz Forums 2000 3.1 SR4 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2007-1024Feb 21, 2007
    Meganoide
    news
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in include.php in Meganoide's news 1.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the _SERVER[DOCUMENT_ROOT] parameter.

  • CVE-2007-1025Feb 21, 2007
    VS Link Partner
    VS-Link-Partner
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in inc/functions_inc.php in VS-Link-Partner 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the gb_pfad, or possibly script_pfad, parameter.

  • CVE-2007-1026Feb 21, 2007
    XLAtunes
    XLAtunes
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in view.php in XLAtunes 0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the album parameter in view mode. NOTE: some of these details are obtained from third party information.

  • CVE-2007-1027Feb 21, 2007
    IBM
    Db2
    risk 0.00cvss —epss 0.00

    Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink attack on the DB2DIAG.LOG temporary file.

  • CVE-2007-1028Feb 21, 2007
    Barry Jaspan
    Image Pager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Barry Jaspan Image Pager 4.7.x-1.x-dev and 5.x-1.x-dev before 2007-02-08 module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to HTML entities and the IMG element.

  • CVE-2007-1029Feb 21, 2007
    Quiksoft
    Easymail Objects
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in the Connect method in the IMAP4 component in Quiksoft EasyMail Objects before 6.5 allows remote attackers to execute arbitrary code via a long host name.

  • CVE-2007-1030Feb 21, 2007
    Libevent Project
    Libevent
    risk 0.00cvss —epss 0.03

    Niels Provos libevent 1.2 and 1.2a allows remote attackers to cause a denial of service (infinite loop) via a DNS response containing a label pointer that references its own offset.

  • CVE-2007-1031Feb 21, 2007
    Spoonlabs
    Vivvo Article Management CMS
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in include/db_conn.php in SpoonLabs Vivvo Article Management CMS 3.4 allows remote attackers to include and execute arbitrary local files via the root parameter.