VYPR

CVEs

386,743 total · page 6684 of 7,735

AllCriticalHighKEV
  • CVE-2012-1188Sep 26, 2012
    Fork CMS
    Fork CMS
    risk 0.00cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) type or (2) querystring parameters to private/en/error or (3) name parameter to private/en/locale/index.

  • CVE-2012-1117Sep 26, 2012
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Joomla! 2.5.0 and 2.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1116Sep 26, 2012
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Joomla! 1.7.x and 2.5.x before 2.5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-1646Sep 25, 2012
    Drupal
    Faq
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the FAQ module 6.x-1.x before 6.x-1.13 and 7.x-1.x-rc1 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via the (1) title parameter in faq.admin.inc or (2) detailed_question parameter in…

  • CVE-2012-1293Sep 25, 2012
    Ulli Horlacher
    Fex
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20111129-2 allow remote attackers to inject arbitrary web script or HTML via the (1) to or (2) from parameters.

  • CVE-2012-1103Sep 25, 2012
    Notmuchmail
    Notmuch
    risk 0.00cvss —epss 0.02

    emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message.

  • CVE-2012-0974Sep 25, 2012
    Osclass
    Osclass
    risk 0.00cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) sCity, (2) sPattern, (3) sPriceMax, and (4) sPriceMin parameters…

  • CVE-2012-0973Sep 25, 2012
    Osclass
    Osclass
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the (1) osc_search_category_id function in oc-includes/osclass/helpers/hSearch.php…

  • CVE-2012-0869Sep 25, 2012
    Ulli Horlacher
    Fex
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20120215 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2011-4623Sep 25, 2012
    Rsyslog
    Rsyslog
    risk 0.00cvss —epss 0.00

    Integer overflow in the rsCStrExtendBuf function in runtime/stringbuf.c in the imfile module in rsyslog 4.x before 4.6.6, 5.x before 5.7.4, and 6.x before 6.1.4 allows local users to cause a denial of service (daemon hang) via a large file, which triggers a heap-based buffer…

  • CVE-2012-5159Sep 25, 2012
    PhpMyAdmin
    phpMyAdmin
    risk 0.09cvss —epss 0.75

    phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which allows remote attackers to execute arbitrary PHP code via an eval injection attack.

  • CVE-2012-0209Sep 25, 2012
    Horde (software)
    Horde
    risk 0.09cvss —epss 0.72

    Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan Horse) in templates/javascript/open_calendar.js, which allows remote attackers…

  • CVE-2012-3334Sep 25, 2012
    IBM
    Informix Dynamic Server
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in IBM Informix Dynamic Server (IDS) 11.50 before 11.50.xC9W2 and 11.70 before 11.70.xC5 allows remote authenticated users to execute arbitrary code via crafted arguments in a SET COLLATION statement.

  • CVE-2012-3324Sep 25, 2012
    IBM
    Db2
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows remote authenticated users to modify, delete, or read arbitrary files via a pathname in the file field.

  • CVE-2012-3311Sep 25, 2012
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.00

    IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 on z/OS, in certain configurations involving Federated Repositories for IIOP connections and Optimized Local Adapters, does not perform CBIND checks, which…

  • CVE-2012-3306Sep 25, 2012
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, when multi-domain support is configured, does not purge password data from the authentication cache, which has unspecified impact and remote attack…

  • CVE-2012-3305Sep 25, 2012
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to overwrite arbitrary files via a crafted application file.

  • CVE-2012-3304Sep 25, 2012
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    The Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack sessions via unspecified vectors.

  • CVE-2012-3300Sep 25, 2012
    IBM
    Websphere Commerce
    risk 0.00cvss —epss 0.01

    IBM WebSphere Commerce 7.0 before 7.0.0.6, when persistent sessions and personalization IDs are enabled, allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors.

  • CVE-2012-3298Sep 25, 2012
    IBM
    Websphere Commerce
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the REST services framework in IBM WebSphere Commerce 7.0 Feature Pack 4 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.

  • CVE-2012-2199Sep 25, 2012
    IBM
    Websphere Mq
    risk 0.00cvss —epss 0.02

    The server message channel agent in the queue manager in the server in IBM WebSphere MQ 7.0.1 before 7.0.1.9, 7.1, and 7.5 on Solaris allows remote attackers to cause a denial of service (invalid address alignment exception and daemon crash) via vectors involving a multiplexed…

  • CVE-2012-2187Sep 25, 2012
    IBM
    Remote Supervisor Adapter Ii Firmware
    risk 0.00cvss —epss 0.01

    IBM Remote Supervisor Adapter II firmware for System x3650, x3850 M2, and x3950 M2 1.13 and earlier generates weak RSA keys, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.

  • CVE-2012-4015Sep 25, 2012
    Mylittletools
    Mylittleadmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the management screen in myLittleTools myLittleAdmin for SQL Server 2000 allows remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted database entry.

  • CVE-2012-4014Sep 25, 2012
    McAfee
    Email Anti-virus
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in McAfee Email Anti-virus (formerly WebShield SMTP) allows remote attackers to cause a denial of service via unknown vectors.

  • CVE-2012-3264Sep 25, 2012
    Microfocus
    Sitescope
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1472.

  • CVE-2012-3263Sep 25, 2012
    Microfocus
    Sitescope
    risk 0.01cvss —epss 0.09

    Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1465.

  • CVE-2012-3262Sep 25, 2012
    Microfocus
    Sitescope
    risk 0.01cvss —epss 0.09

    Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1464.

  • CVE-2012-3261Sep 25, 2012
    Microfocus
    Sitescope
    risk 0.06cvss —epss 0.40

    Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1463.

  • CVE-2012-3260Sep 25, 2012
    Microfocus
    Sitescope
    risk 0.06cvss —epss 0.40

    Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1462.

  • CVE-2012-3259Sep 25, 2012
    Microfocus
    Sitescope
    risk 0.05cvss —epss 0.60

    Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1461.

  • CVE-2012-3037Sep 25, 2012
    Siemens Foundation
    Simatic S7 1200 Firmware
    risk 0.00cvss —epss 0.01

    The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof the S7-1200 web server by using this key to create a forged certificate.

  • CVE-2012-3011Sep 25, 2012
    Fultek
    Wintr SCADA
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the web server in Fultek WinTr Scada 4.0.5 and earlier allows remote attackers to read arbitrary files via a crafted request.

  • CVE-2012-2287Sep 25, 2012
    EMC Corporation
    Rsa Authentication Agent
    risk 0.00cvss —epss 0.03

    The authentication functionality in EMC RSA Authentication Agent 7.1 and RSA Authentication Client 3.5 on Windows XP and Windows Server 2003, when an unspecified configuration exists, allows remote authenticated users to bypass an intended token-authentication step, and…

  • CVE-2012-5054HigKEVSep 24, 2012
    Adobe Inc.
    Flashplayer
    risk 0.71cvss 8.8epss 0.21

    Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.

  • CVE-2012-4655Sep 24, 2012
    Cisco Systems, Inc.
    Secure Desktop
    risk 0.00cvss —epss 0.05

    The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug IDs CSCtz76128…

  • CVE-2012-3451Sep 24, 2012
    Apache
    Cxf
    risk 0.00cvss —epss 0.09

    Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.

  • CVE-2012-5105Sep 23, 2012
    Sqlitemanager
    Sqlitemanager
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in SQLiteManager 1.2.4 allow remote attackers to inject arbitrary web script or HTML via the dbsel parameter to (1) main.php or (2) index.php; or (3) nsextt parameter to index.php.

  • CVE-2012-5104Sep 23, 2012
    Ubbcentral
    Ubb.threads
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in forums/ubbthreads.php in UBB.threads 7.5.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the Loginname parameter.

  • CVE-2012-5103Sep 23, 2012
    Shiromuku
    Guestbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in action/add-submit.php in Ggb Guestbook 0.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url or (2) message parameter.

  • CVE-2012-5102Sep 23, 2012
    VertrigoServ
    VertrigoServ
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in inc/extensions.php in VertrigoServ 2.25 allows remote attackers to inject arbitrary web script or HTML via the ext parameter.

  • CVE-2012-5101Sep 23, 2012
    Jextensions
    Je Poll Component
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the JExtensions JE Poll component before 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-5100Sep 23, 2012
    Luizpicanco
    Hserver
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in HServer 0.1.1 allows remote attackers to read arbitrary files via a (1) ..%5c (dot dot encoded backslash) or (2) %2e%2e%5c (encoded dot dot backslash) in the PATH_INFO.

  • CVE-2012-5099Sep 23, 2012
    Phpb2b
    Phpb2b
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in list.php in PHPB2B 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action.

  • CVE-2012-5098Sep 23, 2012
    J Waite
    PHP X Links
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Php-X-Links, possibly 1.0, allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to rate.php, (2) cid parameter to view.php, or (3) t parameter to pop.php.

  • CVE-2011-5201Sep 23, 2012
    Tinyguestbook
    tinyguestbook
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in sign.php in tinyguestbook allow remote attackers to execute arbitrary SQL commands via the (1) name and (2) msg parameters. NOTE: some of these details are obtained from third party information.

  • CVE-2011-5200Sep 23, 2012
    Dedecms
    Dedecms
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in DeDeCMS, possibly 5.6, allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) list.php, (2) members.php, or (3) book.php.

  • CVE-2011-5199Sep 23, 2012
    Tinyguestbook
    tinyguestbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in sign.php in tinyguestbook allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2011-5198Sep 23, 2012
    Neturf
    Ecommerce Shopping Cart
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in search.php in Neturf eCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the SearchFor parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2011-5197Sep 23, 2012
    Public Knowledge Project
    Open Harvester Systems
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Harvester Systems 2.3.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that upload PHP files.

  • CVE-2011-5196Sep 23, 2012
    Public Knowledge Project
    Open Journal Systems
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Journal Systems 2.3.6 and earlier allows remote attackers to hijack the authentication of administrators for requests that upload PHP files.