VYPR

CVEs

386,743 total · page 6686 of 7,735

AllCriticalHighKEV
  • CVE-2011-5185Sep 20, 2012
    Realmatrix
    Online Subtitles Workshop
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in video_comments.php in Online Subtitles Workshop before 2.0 rev 131 allows remote attackers to inject arbitrary web script or HTML via the comment parameter.

  • CVE-2011-5184Sep 20, 2012
    Microfocus
    OpenView Network Node Manager
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in HP Network Node Manager i 9.10 allow remote attackers to inject arbitrary web script or HTML via the (1) node parameter to nnm/mibdiscover; (2) nodename parameter to nnm/protected/configurationpoll.jsp, (3)…

  • CVE-2011-5183Sep 20, 2012
    Bioinformatics
    Ordersys
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in OrderSys 1.6.4 and earlier allow remote attackers to execute arbitrary SQL commands via the where_clause parameter to (1) index.php, (2) index_long.php, or (3) index_short.php in ordering/interface_creator/.

  • CVE-2011-5182Sep 20, 2012
    WordPress
    Lanoba Social Plugin
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor disputes this issue, stating "Lanoba's plug in does…

  • CVE-2011-5181Sep 20, 2012
    WordPress
    ClickDesk Live Support - Live Chat
    risk 0.04cvss —epss 0.10

    Cross-site scripting (XSS) vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cdwidgetid parameter. NOTE: some of these details are obtained from third party…

  • CVE-2011-5180Sep 20, 2012
    Zooeffect
    Zooeffect
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in wp-1pluginjquery.php in the ZooEffect plugin 1.01 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information. NOTE: this…

  • CVE-2011-5179Sep 20, 2012
    Skysa
    Skysa App Bar Integration Plugin
    risk 0.04cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in skysa-official/skysa.php in Skysa App Bar Integration plugin, possibly before 1.04, for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter.

  • CVE-2011-5178Sep 20, 2012
    Infoblox
    Netmri
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in netmri/config/userAdmin/login.tdf in Infoblox NetMRI 6.0.2.42, 6.1.2, 6.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) eulaAccepted or (2) mode parameter.

  • CVE-2011-5177Sep 20, 2012
    Esyndicat
    Pro
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in admin/controller.php in eSyndiCat Pro 2.3.05 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to the admins (2) blocks, (3) articles, or (4) suggest-category; or (5) sort parameter to…

  • CVE-2012-5007Sep 20, 2012
    Drupal
    Fill PDF
    risk 0.00cvss —epss 0.01

    The Fill PDF module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to write to arbitrary PDF files via unspecified vectors related to the fillpdf_merge_pdf function and incorrect arguments, a different vulnerability than CVE-2012-1625. NOTE: some of these details are…

  • CVE-2012-1631Sep 20, 2012
    Drupal
    Admin:hover
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Admin:hover module for Drupal allows remote attackers to hijack the authentication of administrators for requests that unpublish all nodes, and possibly other actions, via unspecified vectors.

  • CVE-2012-1630Sep 20, 2012
    Drupal
    Taxonomy Navigator
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Taxonomy Navigator module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1629Sep 20, 2012
    Drupal
    Taxotouch
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Taxotouch module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1628Sep 20, 2012
    63reasons
    Supercron
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the SuperCron module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1626Sep 20, 2012
    Drupal
    Date
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the conversion form for Events in the Date module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer Date Tools" privilege to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-1625Sep 20, 2012
    Wizonesolutions
    Fillpdf
    risk 0.00cvss —epss 0.01

    Eval injection vulnerability in the fillpdf_form_export_decode function in fillpdf.admin.inc in the Fill PDF module 6.x-1.x before 6.x-1.16 and 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with administer PDFs privileges to execute arbitrary PHP code via…

  • CVE-2012-1633Sep 20, 2012
    Drupal
    Password Policy
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote attackers to hijack the authentication of administrative users for requests that unblock a user.

  • CVE-2012-1632Sep 20, 2012
    Drupal
    Password Policy
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in password_policy.admin.inc in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote authenticated users with administer policies permissions to inject arbitrary web script or HTML via the name parameter.

  • CVE-2012-1627Sep 20, 2012
    Drupal
    Vote Up/Down
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in vud_term.module in the Vote Up/Down module 6.x-2.x before 6.x-2.8 and 6.x-3.x before 6.x-3.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via taxonomy terms.

  • CVE-2012-0988Sep 20, 2012
    Knowledgetree
    Knowledgetree
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in config/dmsDefaults.php in KnowledgeTree 3.7.0.2 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) login.php, (2) admin.php, or (3) preferences.php.

  • CVE-2012-5006Sep 19, 2012
    Caminova
    DjVu Browser Plug-in
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in npdjvu.dll in Caminova DjVu Browser Plug-in 6.1.4 Build 27351 and other versions before 6.1.4.27993 allows remote attackers to execute arbitrary code via a crafted Sjbz chunk in a djvu file.

  • CVE-2012-5005Sep 19, 2012
    VR GPub
    GPub
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin/admin_options.php in VR GPub 4.0 allows remote attackers to hijack the authentication of admins for requests that add admin accounts via an add action.

  • CVE-2012-5004Sep 19, 2012
    Parallels
    H Sphere
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Parallels H-Sphere 3.3 Patch 1 allow remote attackers to hijack the authentication of admins for requests that (1) add group plans via admin/group_plans.html or (2) add extra packages via…

  • CVE-2012-5003Sep 19, 2012
    Nomachine
    Nx Web Companion
    risk 0.00cvss —epss 0.03

    nxapplet.jar in No Machine NX Web Companion 3.x and earlier does not properly verify the authenticity of updates, which allows user-assisted remote attackers to execute arbitrary code via a crafted (1) SiteUrl or (2) RedirectUrl parameter that points to a Trojan Horse client.zip…

  • CVE-2012-1640Sep 19, 2012
    Drupal
    Managesite
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Managesite module 6.x-1.x before 6.1-1.1 for Drupal allow remote authenticated users with "administer managesite" permissions to inject arbitrary web script or HTML via the title parameter when (1) adding or (2) updating…

  • CVE-2012-1638Sep 19, 2012
    Dominique Clause
    Search Autocomplete
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Search Autocomplete module before 7.x-2.1 for Drupal allows remote authenticated users with the "use search_autocomplete" permission to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-5002Sep 19, 2012
    Ricoh
    Sr10 FTP Server
    risk 0.05cvss —epss 0.31

    Stack-based buffer overflow in SR10 FTP server (SR10.exe) 1.1.0.6 in Ricoh DC Software DL-10 4.5.0.1, when the Log file name option is enabled, allows remote attackers to execute arbitrary code via a long USER FTP command.

  • CVE-2012-5001Sep 19, 2012
    Hitachi
    Jp1\/cm2\/network Node Manager
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in Hitachi JP1/Cm2/Network Node Manager i before 09-50-03 allow remote attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors.

  • CVE-2012-5000Sep 19, 2012
    Blueteck
    Witze Addon
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in jokes/index.php in the Witze addon 0.9 for deV!L'z Clanportal allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action.

  • CVE-2012-4999Sep 19, 2012
    MERCURY
    MR804 Router
    risk 0.04cvss —epss 0.07

    Mercury MR804 Router 8.0 3.8.1 Build 101220 Rel.53006nB allows remote attackers to cause a denial of service (service hang) via a crafted string in HTTP header fields such as (1) If-Modified-Since, (2) If-None-Match, or (3) If-Unmodified-Since. NOTE: some of these details are…

  • CVE-2012-4998Sep 19, 2012
    Starcms
    Starcms
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in starCMS allows remote attackers to inject arbitrary web script or HTML via the q parameter.

  • CVE-2012-4997Sep 19, 2012
    Anecms
    Anecms
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in acp/index.php in AneCMS allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p parameter.

  • CVE-2012-4996Sep 19, 2012
    Rivetcode
    Rivettracker
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in RivetTracker 1.03 and earlier allow remote attackers to execute arbitrary SQL commands via the hash parameter to (1) dltorrent.php or (2) torrent_functions.php.

  • CVE-2012-4995Sep 19, 2012
    Limesurvey
    Limesurvey
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin/userrighthandling.php in LimeSurvey before 1.91+ Build 120224 allows remote attackers to inject arbitrary web script or HTML via the full_name parameter in a moduser action to admin/admin.php. NOTE: some of these details are…

  • CVE-2012-4994Sep 19, 2012
    Limesurvey
    Limesurvey
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in admin/admin.php in LimeSurvey before 1.91+ Build 120224 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a browse action. NOTE: some of these details are obtained from third party information.

  • CVE-2012-4993Sep 19, 2012
    Rivetcode
    Rivettracker
    risk 0.03cvss —epss 0.02

    torrent_functions.php in RivetTracker 1.03 and earlier does not properly restrict access, which allows remote attackers to have an unspecified impact.

  • CVE-2012-4992Sep 19, 2012
    Flashfxp
    Flashfxp
    risk 0.04cvss —epss 0.18

    Multiple buffer overflows in FlashFXP.exe in FlashFXP 4.2 allow remote authenticated users to execute arbitrary code via a long unicode string to (1) TListbox or (2) TComboBox.

  • CVE-2012-3373Sep 19, 2012
    Apache
    Wicket
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app.

  • CVE-2012-2991Sep 19, 2012
    OsCommerce
    Online Merchant
    risk 0.00cvss —epss 0.01

    The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.

  • CVE-2012-2105Sep 19, 2012
    Peter Kovacs
    Timesheet Next Gen
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.

  • CVE-2012-1653Sep 19, 2012
    Drupal
    Taxonomy Views Integrator
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Taxonomy Views Integrator (TVI) module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, related to "views pages."

  • CVE-2012-1652Sep 19, 2012
    Wimleers
    Hierarchical Select
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Hierarchical Select module 6.x-3.x before 6.x-3.8 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via unspecified vectors related to "the vocabulary's help…

  • CVE-2012-1651Sep 19, 2012
    Thinkleft
    Submenu Tree
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Submenu Tree module before 6.x-1.5 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-4408Sep 19, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    course/reset.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 checks an update capability instead of a reset capability, which allows remote authenticated users to bypass intended access restrictions via a reset operation.

  • CVE-2012-4407Sep 19, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    lib/filelib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly check the publication state of blog files, which allows remote attackers to obtain sensitive information by reading a blog entry that references a non-public file.

  • CVE-2012-4403Sep 19, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    theme/yui_combo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response.

  • CVE-2012-4402Sep 19, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    webservice/lib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly restrict the use of web-service tokens, which allows remote authenticated users to run arbitrary external-service functions via a token intended for only one service.

  • CVE-2012-4401Sep 19, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended capability restrictions and perform certain topic changes by leveraging course-editing capabilities.

  • CVE-2012-4400Sep 19, 2012
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    repository/repository_ajax.php in Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended upload-size restrictions via a -1 value in the maxbytes field.

  • CVE-2012-2586Sep 19, 2012
    Mailtraq
    Mailtraq
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Mailtraq 2.17.3.3150 allow remote attackers to inject arbitrary web script or HTML via an e-mail message subject with (1) a JavaScript alert function used in conjunction with the fromCharCode method or (2) a SCRIPT element;…