VYPR

CVEs

386,593 total · page 6728 of 7,732

AllCriticalHighKEV
  • CVE-2012-2924May 21, 2012
    Hypermethod
    Elearning Server
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin/setup.inc.php in Hypermethod eLearning Server 4G allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.

  • CVE-2012-2923May 21, 2012
    Hypermethod
    Elearning Server
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.php4 in Hypermethod eLearning Server 4G allows remote attackers to execute arbitrary SQL commands via the nid parameter.

  • CVE-2012-2922May 21, 2012
    Drupal
    Drupal
    risk 0.00cvss —epss 0.03

    The request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q[] parameter to index.php, which reveals the installation path in an error message.

  • CVE-2012-2921May 21, 2012
    Mark Pilgrim
    Feedparser
    risk 0.00cvss —epss 0.03

    Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.

  • CVE-2012-2920May 21, 2012
    User Photo
    User Photo
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo plugin before 0.9.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to wp-admin/options-general.php. NOTE: some…

  • CVE-2012-2919May 21, 2012
    Chevereto
    Chevereto
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in Upload/engine.php in Chevereto 1.9.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in the v parameter.

  • CVE-2012-2918May 21, 2012
    Chevereto
    Chevereto
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Upload/engine.php in Chevereto 1.91 allows remote attackers to inject arbitrary web script or HTML via the v parameter.

  • CVE-2012-2561May 21, 2012
    Microfocus
    Business Service Management
    risk 0.01cvss —epss 0.09

    HP Business Service Management (BSM) 9.12 does not properly restrict the uploading of .war files, which allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server component via a crafted request to TCP port 1098, 1099, or 4444.

  • CVE-2012-2340May 21, 2012
    Drupal
    Contact Forms
    risk 0.00cvss —epss 0.01

    The Contact Forms module 7.x-1.x before 7.x-1.2 for Drupal does not specify sufficiently restrictive permissions, which allows remote authenticated users with the "access the site-wide contact form" permission to modify the module settings via unspecified vectors.

  • CVE-2012-2339May 21, 2012
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Glossary module 6.x-1.x before 6.x-1.8 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "taxonomy information."

  • CVE-2012-2338May 21, 2012
    Galette
    Galette
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in includes/picture.class.php in Galette 0.63, 0.63.1, 0.63.2, 0.63.3, and 0.64rc1 allows remote attackers to execute arbitrary SQL commands via the id_adh parameter to picture.php.

  • CVE-2012-2271May 21, 2012
    Skincrafter
    Skincrafter
    risk 0.04cvss —epss 0.08

    Buffer overflow in the InitLicenKeys function in a certain ActiveX control in SkinCrafter3_vs2005.dll in SkinCrafter 3.0 allows remote attackers to execute arbitrary code via a long string in the first argument (aka the reg_name argument).

  • CVE-2012-1249May 21, 2012
    Lunascape
    Lunascape
    risk 0.00cvss —epss 0.01

    The iLunascape application 1.0.4.0 and earlier for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive stored information via a crafted application.

  • CVE-2012-0299May 21, 2012
    Symantec
    Web Gateway
    risk 0.08cvss —epss 0.64

    The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to upload arbitrary code to a designated pathname, and possibly execute this code, via unspecified vectors.

  • CVE-2012-0298May 21, 2012
    Symantec
    Web Gateway
    risk 0.04cvss —epss 0.09

    The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to (1) read or (2) delete arbitrary files via unspecified vectors.

  • CVE-2012-0297May 21, 2012
    Symantec
    Web Gateway
    risk 0.09cvss —epss 0.73

    The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting crafted data or (2) including crafted data.

  • CVE-2012-0296May 21, 2012
    Symantec
    Web Gateway
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-5104May 21, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard…

  • CVE-2010-5103May 21, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-5102May 21, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in mod/tools/em/class.em_unzip.php in the unzip library in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote attackers to write arbitrary files via unspecified vectors.

  • CVE-2010-5101May 21, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated administrators to read arbitrary files via unspecified vectors related to the "file inclusion functionality."

  • CVE-2010-5100May 21, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Install Tool in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-5098May 21, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the FORM content object in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-5097May 21, 2012
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the click enlarge functionality in TYPO3 4.3.x before 4.3.9 and 4.4.x before 4.4.5 when the caching framework is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-2917May 21, 2012
    WordPress
    Share and Follow
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key (cnd-key) in a share-and-follow-menu page to wp-admin/admin.php.

  • CVE-2012-2916May 21, 2012
    WordPress
    SABRE
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the active_option parameter to wp-admin/tools.php.

  • CVE-2012-2915May 21, 2012
    Lattice Semiconductor
    Pac Designer
    risk 0.05cvss —epss 0.29

    Stack-based buffer overflow in Lattice Semiconductor PAC-Designer 6.2.1344 allows remote attackers to execute arbitrary code via a long string in a Value tag in a SymbolicSchematicData definition tag in PAC Design (.pac) file.

  • CVE-2012-2914May 21, 2012
    Unijimpe
    Captcha
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in captchademo.php in Unijimpe Captcha allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  • CVE-2012-2913May 21, 2012
    WordPress
    Leaflet
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) leaflet_layer.php or (2) leaflet_marker.php, as reachable through wp-admin/admin.php.

  • CVE-2012-2912May 21, 2012
    WordPress
    LeagueManager
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter in the show-league page or (2) season parameter in the team page to wp-admin/admin.php.

  • CVE-2012-2911May 21, 2012
    Silisoftware
    Backupdb\(\)
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in backupDB.php in SiliSoftware backupDB() 1.2.7a allows remote attackers to inject arbitrary web script or HTML via the onlyDB parameter.

  • CVE-2012-2910May 21, 2012
    Silisoftware
    Phpthumb\(\)
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in SiliSoftware phpThumb() 1.7.11 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter to demo/phpThumb.demo.random.php or (2) title parameter to demo/phpThumb.demo.showpic.php.

  • CVE-2012-2909May 21, 2012
    Viscacha
    Viscacha
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Viscacha 0.8.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) text field in the Private Messages System, (2) Bad Word field in Zensur, or (3) Portal or (4) Topic field in Kommentar.

  • CVE-2012-2908May 21, 2012
    Viscacha
    Viscacha
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in admin/bbcodes.php in Viscacha 0.8.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) bbcodeexample, (2) buttonimage, or (3) bbcodetag parameter.

  • CVE-2012-2907May 21, 2012
    Drupal
    Aberdeen
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the aberdeen_breadcrumb function in template.php in the Aberdeen theme 6.x-1.x before 6.x-1.11 for Drupal, when set to append the content title to the breadcrumb, allows remote attackers to inject arbitrary web script or HTML via the…

  • CVE-2012-2906May 21, 2012
    Artiphp
    CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in artpublic/recommandation/index.php in Artiphp CMS 5.5.0 Neo (r422) allow remote attackers to inject arbitrary web script or HTML via the (1) add_img_name_post, (2) asciiart_post, (3) expediteur, (4) titre_sav, or (5)…

  • CVE-2012-2905May 21, 2012
    Artiphp
    CMS
    risk 0.03cvss —epss 0.03

    Artiphp CMS 5.5.0 Neo (r422) stores database backups with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request.

  • CVE-2012-2904May 21, 2012
    Longtailvideo
    Jw Player
    risk 0.03cvss —epss 0.04

    player.swf in LongTail JW Player 5.9 allows remote attackers to conduct cross-site scripting (XSS) attacks to inject arbitrary web script or HTML via multiple "javascript:" sequences in the debug parameter.

  • CVE-2012-2903May 21, 2012
    Chatelao
    PHP Address Book
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in PHP Address Book 7.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to group.php, or the (2) target_language or (3) target_flag parameter to translate.php.

  • CVE-2012-2902May 21, 2012
    Joomla
    JCE
    risk 0.00cvss —epss 0.01

    Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the Joomla Content Editor (JCE) component before 2.1 for Joomla!, when chunking is set to greater than zero, allows remote authors to execute arbitrary PHP code by uploading a PHP file with a double…

  • CVE-2012-2901May 21, 2012
    Joomla Content Editor
    Joomla Content Editor
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Profile List in the Joomla Content Editor (JCE) component before 2.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the search parameter to administrator/index.php.

  • CVE-2012-2376May 21, 2012
    PHP
    PHP
    risk 0.05cvss —epss 0.20

    Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via crafted arguments that trigger incorrect handling of COM object VARIANT types, as exploited in the wild in May 2012.

  • CVE-2012-2341May 18, 2012
    Drupal
    Take Control
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Take Control module 6.x-2.x before 6.x-2.2 for Drupal allows remote attackers to hijack the authentication of unspecified users for Ajax requests that manipulate files.

  • CVE-2012-2322May 18, 2012
    Connman
    Connman
    risk 0.00cvss —epss 0.03

    Integer overflow in the dhcpv6_get_option function in gdhcp/client.c in ConnMan before 0.85 allows remote attackers to cause a denial of service (infinite loop and crash) via an invalid length value in a DHCP packet.

  • CVE-2012-2321May 18, 2012
    Connman
    Connman
    risk 0.00cvss —epss 0.06

    The loopback plug-in in ConnMan before 0.85 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) host name or (2) domain name in a DHCP reply.

  • CVE-2012-2320May 18, 2012
    Connman
    Connman
    risk 0.00cvss —epss 0.03

    ConnMan before 0.85 does not ensure that netlink messages originate from the kernel, which allows remote attackers to bypass intended access restrictions and cause a denial of service via a crafted netlink message.

  • CVE-2012-2120May 18, 2012
    Texlive Extra Utils
    latex2man
    risk 0.00cvss —epss 0.00

    latex2man in texlive-extra-utils 2011.20120322, and possibly other versions or packages, when used with the H or T option, allows local users to overwrite arbitrary files via a symlink attack on a temporary file.

  • CVE-2012-2118May 18, 2012
    Xorg
    X11
    risk 0.00cvss —epss 0.03

    Format string vulnerability in the LogVHdrMessageVerb function in os/log.c in X.Org X11 1.11 allows attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in an input device name.

  • CVE-2012-2093May 18, 2012
    Gajim
    Gajim
    risk 0.00cvss —epss 0.00

    src/common/latex.py in Gajim 0.15 allows local users to overwrite arbitrary files via a symlink attack on a temporary latex file, related to the get_tmpfile_name function.

  • CVE-2012-2010May 18, 2012
    Microfocus
    Openvms
    risk 0.00cvss —epss 0.00

    The ACMELOGIN implementation in HP OpenVMS 8.3 and 8.4 on the Alpha platform, and 8.3, 8.3-1H1, and 8.4 on the Itanium platform, when the SYS$ACM system service is enabled, allows local users to gain privileges via unspecified vectors.