VYPR

CVEs

386,672 total · page 6700 of 7,734

AllCriticalHighKEV
  • CVE-2011-5113Aug 23, 2012
    Joomla
    Techfolio
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in frontend/models/techfoliodetail.php in Techfolio (com_techfolio) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2011-5112Aug 23, 2012
    Joomla
    Alameda
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Alameda (com_alameda) component before 1.0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the storeid parameter to index.php.

  • CVE-2011-5111Aug 23, 2012
    Kajianwebsite
    CMS Balitbang
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Kajian Website CMS Balitbang 3.x allow remote attackers to execute arbitrary SQL commands via the hal parameter to (1) the data module in alumni.php; or the (2) lih_buku, (3) artikel, (4) album, or (5) berita module in index.php.

  • CVE-2011-5110Aug 23, 2012
    John Geo
    Blogs Manager
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Blogs Manager 1.101 and earlier allow remote attackers to execute arbitrary SQL commands via the SearchField parameter in a search action to (1) _authors_list.php, (2) _blogs_list.php, (3) _category_list.php, (4) _comments_list.php, (5)…

  • CVE-2011-5109Aug 23, 2012
    Freelancer
    Calendar
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Freelancer calendar 1.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the SearchField parameter in a search action to (1) category_list.php, (2) Copy_of_calendar_list.php, (3)…

  • CVE-2011-5108Aug 23, 2012
    Adaptcms
    Adaptcms
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in config.php in AdaptCMS 2.0.0 and 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-5107Aug 23, 2012
    WordPress
    Alert Before You Post
    risk 0.04cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in post_alert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter.

  • CVE-2011-5106Aug 23, 2012
    WordPress
    Flexible Custom Post Type
    risk 0.04cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2011-5105Aug 23, 2012
    Zoho
    ADSelfService Plus
    risk 0.03cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 allow remote attackers to inject arbitrary web script or HTML via the (1) searchType and (2) searchString parameters, a different vulnerability than…

  • CVE-2011-5104Aug 23, 2012
    WordPress
    Wp Ecommerce
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the custom_text parameter. NOTE: some of these details are…

  • CVE-2011-5103Aug 23, 2012
    Alurian
    Prismotube Video Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Alurian Prismotube PHP Video Script allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

  • CVE-2012-4337Aug 23, 2012
    Foxitsoftware
    Reader
    risk 0.00cvss —epss 0.05

    Foxit Reader before 5.3 on Windows XP and Windows 7 allows remote attackers to execute arbitrary code via a PDF document with a crafted attachment that triggers calculation of a negative number during processing of cross references.

  • CVE-2012-4605Aug 23, 2012
    Websense
    Email Security
    risk 0.00cvss —epss 0.01

    The default configuration of the SMTP component in Websense Email Security 6.1 through 7.3 enables weak SSL ciphers in the "SurfControl plc\SuperScout Email Filter\SMTP" registry key, which makes it easier for remote attackers to obtain sensitive information by sniffing the…

  • CVE-2012-4604Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.01

    The TRITON management console in Websense Web Security before 7.6 Hotfix 24 allows remote attackers to bypass authentication and read arbitrary reports via a crafted uid field, in conjunction with a crafted userRoles field, in a cookie, as demonstrated by a request to…

  • CVE-2012-2582Aug 23, 2012
    OTRS
    Otrs
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3.0.x before 3.0.6, and 3.1.x before 3.1.6, allow remote attackers to inject…

  • CVE-2011-5102Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.04

    The Investigative Reports web interface in the TRITON management console in Websense Web Security 7.1 before Hotfix 109, 7.1.1 before Hotfix 06, 7.5 before Hotfix 78, 7.5.1 before Hotfix 12, 7.6 before Hotfix 24, and 7.6.2 before Hotfix 12; Web Filter; Web Security Gateway; and…

  • CVE-2010-5149Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.02

    Websense Web Security and Web Filter before 6.3.3 Hotfix 27 and 7.x before 7.1.1 allow remote attackers to cause a denial of service (Blue Coat appliance integration outage) via a long URL.

  • CVE-2010-5148Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.01

    Websense Web Security and Web Filter before 7.1 Hotfix 21 do not set the secure flag for the Encrypted Session (SSL) cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

  • CVE-2010-5147Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.01

    The Remote Filtering component in Websense Web Security and Web Filter before 6.3.3 Hotfix 18 and 7.x before 7.1.1 allows remote attackers to cause a denial of service (daemon exit) via a large volume of traffic.

  • CVE-2010-5146Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.00

    The Remote Filtering component in Websense Web Security and Web Filter before 7.1 Hotfix 66 allows local users to bypass filtering by (1) renaming the WDC.exe file or (2) deleting driver files.

  • CVE-2010-5145Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.01

    The Filtering Service in Websense Web Security and Web Filter before 6.3.1 Hotfix 136 and 7.x before 7.1.1 on Windows allows remote attackers to cause a denial of service (filtering outage) via a crafted sequence of characters in a URI.

  • CVE-2010-5144Aug 23, 2012
    Websense
    Websense
    risk 0.00cvss —epss 0.01

    The ISAPI Filter plug-in in Websense Enterprise, Websense Web Security, and Websense Web Filter 6.3.3 and earlier, when used in conjunction with a Microsoft ISA or Microsoft Forefront TMG server, allows remote attackers to bypass intended filtering and monitoring activities for…

  • CVE-2009-5122Aug 23, 2012
    Websense
    Email Security
    risk 0.00cvss —epss 0.01

    The Personal Email Manager component in Websense Email Security before 7.2 allows remote attackers to obtain potentially sensitive information from the JBoss status page via an unspecified query.

  • CVE-2009-5121Aug 23, 2012
    Websense
    Email Security
    risk 0.00cvss —epss 0.01

    Websense Email Security 7.1 before Hotfix 4 allows remote attackers to bypass the sender-based blacklist by using the 8BITMIME EHLO keyword in the SMTP session.

  • CVE-2009-5120Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.01

    The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 allows connections to TCP port 1812 from arbitrary source IP addresses, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via…

  • CVE-2009-5119Aug 23, 2012
    Websense
    Websense Web Security
    risk 0.00cvss —epss 0.01

    The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 enables weak SSL ciphers in conf/server.xml, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a…

  • CVE-2008-7312Aug 23, 2012
    Websense
    Websense Enterprise
    risk 0.00cvss —epss 0.01

    The Filtering Service in Websense Enterprise 5.2 through 6.3 does not consider the IP address during URL categorization, which makes it easier for remote attackers to bypass filtering via an HTTP request, as demonstrated by a request to a compromised server associated with a…

  • CVE-2012-3502Aug 22, 2012
    Apache
    HTTP Server
    risk 0.01cvss —epss 0.10

    The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows…

  • CVE-2012-2687Aug 22, 2012
    Apache
    HTTP Server
    risk 0.02cvss —epss 0.23

    Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or…

  • CVE-2012-4599Aug 22, 2012
    McAfee
    SmartFilter Administration Bess Edition
    risk 0.00cvss —epss 0.04

    McAfee SmartFilter Administration, and SmartFilter Administration Bess Edition, before 4.2.1.01 does not require authentication for access to the JBoss Remote Method Invocation (RMI) interface, which allows remote attackers to execute arbitrary code via a crafted .war file.

  • CVE-2012-4598Aug 22, 2012
    McAfee
    Mcafee Virtual Technician
    risk 0.05cvss —epss 0.29

    An unspecified ActiveX control in McAfee Virtual Technician (MVT) before 6.4, and ePO-MVT, allows remote attackers to execute arbitrary code or cause a denial of service (Internet Explorer crash) via a crafted web site.

  • CVE-2012-4597Aug 22, 2012
    McAfee
    Email Gateway
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in McAfee Email and Web Security (EWS) 5.5 through Patch 6 and 5.6 through Patch 3, and McAfee Email Gateway (MEG) 7.0.0 and 7.0.1, allows remote attackers to inject arbitrary web script or HTML via vectors related to the McAfee Security…

  • CVE-2012-4596Aug 22, 2012
    McAfee
    Email Gateway
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in McAfee Email Gateway (MEG) 7.0.0 and 7.0.1 allows remote authenticated users to bypass intended access restrictions and download arbitrary files via a crafted URL.

  • CVE-2012-4595Aug 22, 2012
    McAfee
    Email Gateway
    risk 0.00cvss —epss 0.03

    McAfee Email and Web Security (EWS) 5.5 through Patch 6 and 5.6 through Patch 3, and McAfee Email Gateway (MEG) 7.0.0 and 7.0.1, allows remote attackers to bypass authentication and obtain an admin session ID via unspecified vectors.

  • CVE-2012-4594Aug 22, 2012
    McAfee
    Epolicy Orchestrator
    risk 0.00cvss —epss 0.01

    McAfee ePolicy Orchestrator (ePO) 4.6.1 and earlier allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information from arbitrary reporting panels, via a modified ID value in a console URL.

  • CVE-2012-4593Aug 22, 2012
    McAfee
    Application Control
    risk 0.00cvss —epss 0.01

    McAfee Application Control and Change Control 5.1.x and 6.0.0 do not enforce an intended password requirement in certain situations involving attributes of the password file, which allows local users to bypass authentication by executing a command.

  • CVE-2012-4592Aug 22, 2012
    McAfee
    Enterprise Mobility Manager
    risk 0.00cvss —epss 0.01

    The Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 does not set the secure flag for the ASP.NET session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

  • CVE-2012-4591Aug 22, 2012
    McAfee
    Enterprise Mobility Manager
    risk 0.00cvss —epss 0.01

    About.aspx in the Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 discloses the name of the user account for an IIS worker process, which allows remote attackers to obtain potentially sensitive information by visiting this page.

  • CVE-2012-4590Aug 22, 2012
    McAfee
    Enterprise Mobility Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in About.aspx in the Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 might allow remote attackers to inject arbitrary web script or HTML via the (1) User Agent or (2) Connection variable.

  • CVE-2012-4589Aug 22, 2012
    McAfee
    Enterprise Mobility Manager
    risk 0.00cvss —epss 0.00

    Login.aspx in the Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 does not have an off autocomplete attribute for unspecified form fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.

  • CVE-2012-4588Aug 22, 2012
    McAfee
    Enterprise Mobility Manager
    risk 0.00cvss —epss 0.01

    McAfee Enterprise Mobility Manager (EMM) Agent before 4.8 and Server before 10.1 record all invalid usernames presented in failed login attempts, and place them on a list of accounts that an administrator may wish to unlock, which allows remote attackers to cause a denial of…

  • CVE-2012-4587Aug 22, 2012
    McAfee
    Enterprise Mobility Manager
    risk 0.00cvss —epss 0.01

    McAfee Enterprise Mobility Manager (EMM) Agent before 4.8 and Server before 10.1, when one-time provisioning (OTP) mode is enabled, have an improper dependency on DNS SRV records, which makes it easier for remote attackers to discover user passwords by spoofing the EMM server,…

  • CVE-2012-4586Aug 22, 2012
    McAfee
    Email Gateway
    risk 0.00cvss —epss 0.01

    McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, accesses files with the privileges of the root user, which allows remote authenticated users to bypass intended permission settings by requesting…

  • CVE-2012-4585Aug 22, 2012
    McAfee
    Email Gateway
    risk 0.00cvss —epss 0.01

    McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote authenticated users to read arbitrary files via a crafted URL.

  • CVE-2012-4584Aug 22, 2012
    McAfee
    Email Gateway
    risk 0.00cvss —epss 0.01

    McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, does not properly encrypt system-backup data, which makes it easier for remote authenticated users to obtain sensitive information by reading a…

  • CVE-2012-4583Aug 22, 2012
    McAfee
    Email Gateway
    risk 0.00cvss —epss 0.01

    McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote authenticated users to obtain the session tokens of arbitrary users by navigating within the Dashboard.

  • CVE-2012-4582Aug 22, 2012
    McAfee
    Email Gateway
    risk 0.00cvss —epss 0.01

    McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote authenticated users to reset the passwords of arbitrary administrative accounts via unspecified vectors.

  • CVE-2012-4581Aug 22, 2012
    McAfee
    Email Gateway
    risk 0.00cvss —epss 0.01

    McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, does not disable the server-side session token upon the closing of the Management Console/Dashboard, which makes it easier for remote attackers…

  • CVE-2012-4580Aug 22, 2012
    McAfee
    Email Gateway
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote attackers to inject arbitrary web script or HTML via vectors related to the McAfee…

  • CVE-2012-2864Aug 22, 2012
    Google
    ChromeOS
    risk 0.00cvss —epss 0.05

    Mesa, as used in Google Chrome before 21.0.1183.0 on the Acer AC700, Cr-48, and Samsung Series 5 and 5 550 Chromebook platforms, and the Samsung Chromebox Series 3, allows remote attackers to execute arbitrary code via unspecified vectors that trigger an "array overflow."