VYPR

CVEs

386,623 total · page 6704 of 7,733

AllCriticalHighKEV
  • CVE-2012-4327Aug 14, 2012
    WordPress
    Image News slider
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Image News slider plugin before 3.3 for WordPress has unspecified impact and remote attack vectors.

  • CVE-2012-4326Aug 14, 2012
    Alstrasoft
    Site Uptime Enterprise
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in commonsettings.php in AlstraSoft Site Uptime Enterprise, possibly 5.4, allows remote attackers to hijack the authentication of administrators.

  • CVE-2012-4325Aug 14, 2012
    Utopia News Pro
    Utopia News Pro
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in upload/users.php in Utopia News Pro (UNP) 1.4.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts.

  • CVE-2012-4324Aug 14, 2012
    Phpjabbers
    Vacation Rental Script
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in PHPJabbers Vacation Rental Script allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via a create action in the AdminUsers module to index.php.

  • CVE-2012-2097Aug 14, 2012
    Drupal
    Autosave
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Autosave module 6.x before 6.x-2.10 and 7.x-2.x before 7.x-2.0 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests involving "submitting saved results to a node."

  • CVE-2012-2096Aug 14, 2012
    Drupal
    Fivestar
    risk 0.00cvss —epss 0.02

    The Fivestar module 6.x-1.x before 6.x-1.20 for Drupal does not properly validate voting data, which allows remote attackers to manipulate voting averages via a negative value in the vote parameter.

  • CVE-2012-1835Aug 14, 2012
    WordPress
    All-in-One Event Calendar
    risk 0.04cvss —epss 0.09

    Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4)…

  • CVE-2012-4283Aug 13, 2012
    WordPress
    Login With Ajax
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Login With Ajax plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter.

  • CVE-2012-4282Aug 13, 2012
    Trombinoscope
    Trombinoscope
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in photo.php in Trombinoscope 3.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2012-2332Aug 13, 2012
    Serendipity
    Serendipity
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQL commands via the serendipity[plugin_to_conf] parameter. NOTE: this issue might be resultant from cross-site request forgery (CSRF).

  • CVE-2012-2331Aug 13, 2012
    Serendipity
    Serendipity
    risk 0.00cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in Serendipity before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the serendipity[textarea] parameter. NOTE: this issue might be resultant from cross-site…

  • CVE-2012-2330Aug 13, 2012
    Node.js
    Node.js
    risk 0.00cvss —epss 0.03

    The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length…

  • CVE-2012-2274Aug 13, 2012
    Pivotx
    Pivotx
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in pivotx/ajaxhelper.php in PivotX 2.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the file parameter.

  • CVE-2010-5096Aug 13, 2012
    MyBB
    Mybb
    risk 0.03cvss —epss 0.06

    Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the keywords parameter in a (1) do_search action to search.php or (2) do_stuff action to private.php. NOTE: the vendor disputes this…

  • CVE-2012-4281Aug 13, 2012
    Travelon
    Express
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Travelon Express 6.2.2 allow remote attackers to execute arbitrary SQL commands via the hid parameter to (1) holiday.php or (2) holiday_book.php, (3) id parameter to pages.php, (4) fid parameter to admin/airline-edit.php, or (5) cid…

  • CVE-2012-4280Aug 13, 2012
    Free Realty
    Free Realty
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote attackers to hijack the authentication of administrators for requests that (1) add an agent via an addagent action or (2) modify an agent.

  • CVE-2012-4279Aug 13, 2012
    Free Realty
    Free Realty
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to execute arbitrary SQL commands via the (1) view parameter to agentdisplay.php or (2) edit parameter to admin/admin.php.

  • CVE-2012-4278Aug 13, 2012
    Free Realty
    Free Realty
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) notes parameter to (a) admin/agenteditor.php; (2) title, (3) previewdesc, (4) fulldesc, or (5) notes parameter (b) to…

  • CVE-2012-4277Aug 13, 2012
    Smarty
    Smarty
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the smarty_function_html_options_optoutput function in distribution/libs/plugins/function.html_options.php in Smarty before 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-4276Aug 13, 2012
    Hitachi
    It Operations Director
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07, 03-00 before 03-00-08 allows attackers to cause a denial of service via unknown attack vectors.

  • CVE-2012-4275Aug 13, 2012
    Hitachi
    It Operations Director
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07, 03-00 before 03-00-08 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-4274Aug 13, 2012
    Hitachi
    Cobol Gui Option
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Hitachi Cobol GUI Option 06-00, 06-01 through 06-01-/A, 07-00, 07-01 before 07-01-/B, and 08-00 before 08-00-/B and Cobol GUI Option Server 07-00, 07-01 before 07-01-/B, and 08-00 before 08-00-/B allows remote attackers to execute arbitrary code via…

  • CVE-2012-4273Aug 13, 2012
    WordPress
    2 Click Social Media Buttons
    risk 0.00cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter.

  • CVE-2012-4272Aug 13, 2012
    WordPress
    2 Click Social Media Buttons
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the "processing of the buttons of Xing and Pinterest".

  • CVE-2012-4271Aug 13, 2012
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in bad-behavior-wordpress-admin.php in the Bad Behavior plugin before 2.0.47 and 2.2.x before 2.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, (2) httpbl_key, (3)…

  • CVE-2012-4270Aug 13, 2012
    Epignosis
    Efront
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in eFront 3.6.11 allows remote authenticated users to inject arbitrary web script or HTML via the subject box of a message.

  • CVE-2012-4269Aug 13, 2012
    Epignosis
    Efront
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in eFront 3.6.11 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension via an attachment in a message.

  • CVE-2012-4268Aug 13, 2012
    WordPress
    Bulletproof Security
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in bulletproof-security/admin/options.php in the BulletProof Security plugin before .47.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP_ACCEPT_ENCODING header.

  • CVE-2012-4267Aug 13, 2012
    Pu Gh
    Sockso
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in user/register in Sockso 1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter.

  • CVE-2012-4266Aug 13, 2012
    Proman Xpress
    Proman Xpress
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in client_details.php in Proman Xpress 5.0.1 allows remote attackers to inject arbitrary web script or HTML via the cl_comments parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2012-4265Aug 13, 2012
    Proman
    Xpress
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in category_edit.php in Proman Xpress 5.0.1 allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2012-4264Aug 13, 2012
    WordPress
    Better Wp Security
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "server variables," a different vulnerability…

  • CVE-2012-4263Aug 13, 2012
    WordPress
    Better Wp Security
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP_USER_AGENT header.

  • CVE-2012-3869Aug 13, 2012
    Redaxo
    Redaxo
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in include/classes/class.rex_list.inc.php in REDAXO 4.3.x and 4.4 allows remote attackers to inject arbitrary web script or HTML via the subpage parameter to index.php.

  • CVE-2012-3425Aug 13, 2012
    Libpng
    Libpng
    risk 0.00cvss —epss 0.03

    The png_push_read_zTXt function in pngpread.c in libpng 1.0.x before 1.0.58, 1.2.x before 1.2.48, 1.4.x before 1.4.10, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large avail_in field value in a PNG image.

  • CVE-2012-3417Aug 13, 2012
    Jan Kara
    Linux Diskquota
    risk 0.00cvss —epss 0.03

    The good_client function in rquotad (rquota_svc.c) in Linux DiskQuota (aka quota) before 3.17 invokes the hosts_ctl function the first time without a host name, which might allow remote attackers to bypass TCP Wrappers rules in hosts.deny.

  • CVE-2012-3401Aug 13, 2012
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.04

    The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error conditions, which allows context-dependent attackers to cause a denial of service (crash) and possibly execute…

  • CVE-2012-3367Aug 13, 2012
    Dogtag
    Certificate System
    risk 0.00cvss —epss 0.01

    Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System does not properly check certificate revocation requests made through the web interface, which allows remote attackers with permissions to revoke end entity certificates to revoke the Certificate…

  • CVE-2012-2806HigAug 13, 2012
    Libjpeg Turbo
    Libjpeg Turbo
    risk 0.58cvss 8.8epss 0.05

    Heap-based buffer overflow in the get_sos function in jdmarker.c in libjpeg-turbo 1.2.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large component count in the header of a JPEG image.

  • CVE-2012-2662Aug 13, 2012
    Red Hat
    Certificate System
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to the (1) System Agent or (2) End Entity pages.

  • CVE-2012-2371Aug 13, 2012
    WordPress
    WP-FaceThumb
    risk 0.04cvss —epss 0.13

    Cross-site scripting (XSS) vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pagination_wp_facethumb parameter.

  • CVE-2012-2370Aug 13, 2012
    GNOME Foundation
    Gdkpixbuf
    risk 0.00cvss —epss 0.04

    Multiple integer overflows in the read_bitmap_file_data function in io-xbm.c in gdk-pixbuf before 2.26.1 allow remote attackers to cause a denial of service (application crash) via a negative (1) height or (2) width in an XBM file, which triggers a heap-based buffer overflow.

  • CVE-2012-2368Aug 13, 2012
    Bytemark
    Symbiosis
    risk 0.00cvss —epss 0.01

    Bytemark Symbiosis before Revision 1322 does not properly validate passwords, which allows remote attackers to gain access to email accounts via an arbitrary password.

  • CVE-2011-0524Aug 13, 2012
    Gypsy
    gypsy
    risk 0.00cvss —epss 0.00

    Multiple buffer overflows in the NMEA parser (nmea-gen.c) in gypsy 0.8 allow local users to cause a denial of service (crash) via unspecified vectors related to the sprintf function.

  • CVE-2011-0523Aug 13, 2012
    Gypsy
    gypsy
    risk 0.00cvss —epss 0.00

    gypsy 0.8 does not properly restrict the files that can be read while running with root privileges, which allows local users to read otherwise restricted files via unspecified vectors.

  • CVE-2009-5066Aug 13, 2012
    Red Hat
    JBoss AS
    risk 0.00cvss —epss 0.00

    twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments.

  • CVE-2012-4262Aug 13, 2012
    Hccgmbh
    Mycare2x
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in myCare2x allow remote attackers to inject arbitrary web script or HTML via the (1) name_last, (2) name_first, (3) name_middle, or (4) name_maiden parameter to modules/patient/mycare_pid.php; (5) favorites or (6) lang…

  • CVE-2012-4261Aug 13, 2012
    MyCare2x
    myCare2x
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in modules/patient/mycare2x_pat_info.php in myCare2x allows remote attackers to execute arbitrary SQL commands via the lang parameter.

  • CVE-2012-4260Aug 13, 2012
    MyCare2x
    myCare2x
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in myCare2x allow remote attackers to execute arbitrary SQL commands via the (1) aktion or (2) callurl parameter to modules/patient/mycare2x_pat_info.php; (3) dept_nr or (4) pid parameter to modules/importer/mycare2x_importer.php; (5)…

  • CVE-2012-4259Aug 13, 2012
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the contacts in (1) XPhone UC Web and the (2) web frontend for XPhone Virtual Directory in C4B XPhone Unified Communications (UC) 2011 Web 4.1.890S R1 allows remote attackers to inject arbitrary web script or HTML via the company name.…