VYPR

CVEs

386,559 total · page 6747 of 7,732

AllCriticalHighKEV
  • CVE-2012-1209Feb 24, 2012
    Fork CMS
    Fork CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.

  • CVE-2012-1208Feb 24, 2012
    Fork CMS
    Fork CMS
    risk 0.00cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) report parameter to blog/settings or (2) error parameter to…

  • CVE-2012-1207Feb 24, 2012
    Fork CMS
    Fork CMS
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter to frontend/js.php.

  • CVE-2012-1206Feb 24, 2012
    Hancom
    Hancom Office 2010 Se
    risk 0.00cvss —epss 0.05

    Multiple integer overflows in Hancom Office 2010 SE 8.5.5 allow remote attackers to execute arbitrary code via large dimension values in a (1) JPG image to the ImportGR in the JPG image filter module (HncJpeg10.flt) or (2) PNG image to the PNG image filter module (HncPng10.flt),…

  • CVE-2012-1205Feb 24, 2012
    WordPress
    Relocate Upload
    risk 0.00cvss —epss 0.25

    PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.

  • CVE-2012-1000Feb 24, 2012
    Lepton CMS
    Lepton
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) message parameter to admins/login/forgot/index.php, or the (2) display_name or (3) email parameter to…

  • CVE-2012-0999Feb 24, 2012
    Lepton CMS
    Lepton
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in modules/news/rss.php in LEPTON before 1.1.4 allows remote attackers to execute arbitrary SQL commands via the group_id parameter.

  • CVE-2012-0998Feb 24, 2012
    Lepton CMS
    Lepton
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in account/preferences.php in LEPTON before 1.1.4 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the language parameter.

  • CVE-2012-0997Feb 24, 2012
    11in1
    11in1
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin/index.php in 11in1 1.2.1 stable 12-31-2011 allows remote attackers to hijack the authentication of administrators for requests that add new topics via an addTopic action.

  • CVE-2012-0996Feb 24, 2012
    11in1
    11in1
    risk 0.04cvss —epss 0.08

    Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. (dot dot) in the class parameter to (1) index.php or (2) admin/index.php.

  • CVE-2012-1294Feb 23, 2012
    Contimex
    Impulsio CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in CONTIMEX Impulsio CMS allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

  • CVE-2012-0873Feb 23, 2012
    Boonex
    Dolphin
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in Boonex Dolphin before 7.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) explain parameter to explanation.php or the (2) photos_only, (3) online_only, or (4) mode parameters to viewFriends.php.

  • CVE-2012-0823Feb 23, 2012
    Webmproject
    Libvpx
    risk 0.00cvss —epss 0.03

    VP8 Codec SDK (libvpx) before 1.0.0 "Duclair" allows remote attackers to cause a denial of service (application crash) via (1) unspecified "corrupt input" or (2) by "starting decoding from a P-frame," which triggers an out-of-bounds read, related to "the clamping of motion…

  • CVE-2012-1292Feb 23, 2012
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the MessagingSystem servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the MessagingSystem Performance Data via unspecified vectors.

  • CVE-2012-1291Feb 23, 2012
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the com.sap.aii.mdt.amt.web.AMTPageProcessor servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the Adapter Monitor via unspecified vectors, possibly related to the EnableInvokerServletGlobally property in the…

  • CVE-2012-1290Feb 23, 2012
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in b2b/auction/container.jsp in the Internet Sales (crm.b2b) module in SAP NetWeaver 7.0 allows remote attackers to inject arbitrary web script or HTML via the _loadPage parameter.

  • CVE-2012-1289Feb 23, 2012
    SAP
    Netweaver
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the logfilename parameter to (1) b2b/admin/log.jsp or (2) b2b/admin/log_view.jsp in the Internet Sales (crm.b2b) component, or (3)…

  • CVE-2012-1288Feb 23, 2012
    UTC Fire & Security
    GE-MC100-NTP/GPS-ZB Master Clock
    risk 0.00cvss —epss 0.03

    The UTC Fire & Security GE-MC100-NTP/GPS-ZB Master Clock device uses hardcoded credentials for an administrative account, which makes it easier for remote attackers to obtain access via an HTTP session.

  • CVE-2012-0870Feb 23, 2012
    Blackberry
    PlayBook
    risk 0.01cvss —epss 0.06

    Heap-based buffer overflow in process.c in smbd in Samba 3.0, as used in the file-sharing service on the BlackBerry PlayBook tablet before 2.0.0.7971 and other products, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a…

  • CVE-2012-0707Feb 23, 2012
    IBM
    WebSphere Lombardi Edition
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM WebSphere Lombardi Edition 7.2 allows remote attackers to inject arbitrary web script or HTML via crafted text input to a coach that is configured with a document attachment control section.

  • CVE-2012-1256Feb 22, 2012
    Easyvista
    Easyvista
    risk 0.00cvss —epss 0.01

    The single sign-on (SSO) implementation in EasyVista before 2010.1.1.89 allows remote attackers to bypass authentication via a modified url_account parameter, in conjunction with a valid login name in the SSPI_HEADER parameter, to index.php.

  • CVE-2012-0315Feb 22, 2012
    Estsoft
    Alftp
    risk 0.00cvss —epss 0.02

    Untrusted search path vulnerability in ALFTP before 5.31 allows local users to gain privileges via a Trojan horse executable file in a directory that is accessed for reading an extensionless file, as demonstrated by executing the README.exe file when a user attempts to access…

  • CVE-2012-0291Feb 22, 2012
    Symantec
    Pcanywhere
    risk 0.00cvss —epss 0.02

    Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), Altiris Client Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), and Altiris Deployment Solution Remote pcAnywhere Solution 7.1…

  • CVE-2012-0223Feb 22, 2012
    7-Technologies
    TERMIS
    risk 0.00cvss —epss 0.01

    Untrusted search path vulnerability in 7-Technologies (7T) TERMIS 2.10 and earlier allows local users to gain privileges via a Trojan horse DLL in the current working directory, a different vulnerability than CVE-2012-0224.

  • CVE-2012-1235Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.00

    Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0235.

  • CVE-2012-1234Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0234.

  • CVE-2012-0244Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Advantech/BroadWin WebAccess before 7.0 allow remote attackers to execute arbitrary SQL commands via crafted string input.

  • CVE-2012-0243Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.04

    Buffer overflow in an ActiveX control in bwocxrun.ocx in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code by leveraging the ability to write arbitrary content to any pathname.

  • CVE-2012-0242Feb 21, 2012
    Advantech
    Webaccess
    risk 0.04cvss —epss 0.07

    Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string.

  • CVE-2012-0241Feb 21, 2012
    Advantech
    Webaccess
    risk 0.03cvss —epss 0.05

    Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service (memory corruption) via a modified stream identifier to a function.

  • CVE-2012-0240Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.04

    GbScriptAddUp.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2012-0239Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative password via a password-change request.

  • CVE-2012-0238Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in opcImg.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2012-0237Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    Advantech/BroadWin WebAccess before 7.0 allows remote attackers to (1) enable date and time syncing or (2) disable date and time syncing via a crafted URL.

  • CVE-2012-0236Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL. NOTE: the vendor reportedly "does not consider it to be a security risk."

  • CVE-2012-0235Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.00

    Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2012-0234Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via a malformed URL.

  • CVE-2012-0233Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via a malformed URL.

  • CVE-2012-0200Feb 21, 2012
    IBM
    Soliddb
    risk 0.03cvss —epss 0.05

    The server in IBM solidDB 6.5 before Interim Fix 6 does not properly initialize data structures, which allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a redundant WHERE condition.

  • CVE-2011-4890Feb 21, 2012
    IBM
    Soliddb
    risk 0.00cvss —epss 0.02

    The server in IBM solidDB 6.5 before FP9 and 7.0 before FP1 allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a ROWNUM condition involving a subquery.

  • CVE-2011-4526Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.04

    Buffer overflow in an ActiveX control in Advantech/BroadWin WebAccess before 7.0 might allow remote attackers to execute arbitrary code via a long string value in unspecified parameters.

  • CVE-2011-4525Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.02

    Advantech/BroadWin WebAccess before 7.0 allows remote attackers to trigger the extraction of arbitrary web content into a batch file on a client system, and execute this batch file, via unspecified vectors.

  • CVE-2011-4524Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.04

    Buffer overflow in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via a long string value in unspecified parameters.

  • CVE-2011-4523Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in bwview.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

  • CVE-2011-4522Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in bwerrdn.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

  • CVE-2011-4521Feb 21, 2012
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via crafted string input.

  • CVE-2011-1914Feb 21, 2012
    Advantech
    Adam Opc Server
    risk 0.00cvss —epss 0.04

    Buffer overflow in the Advantech ADAM OLE for Process Control (OPC) Server ActiveX control in ADAM OPC Server before 3.01.012, Modbus RTU OPC Server before 3.01.010, and Modbus TCP OPC Server before 3.01.010 allows remote attackers to execute arbitrary code via unspecified…

  • CVE-2012-1227Feb 21, 2012
    Pluck
    Pluck
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in pluck 4.7 allow remote attackers to hijack the authentication of admins for requests that (1) modify the admin email address or (2) modify the blog title via a settings action; (3) add a page via an…

  • CVE-2012-1226Feb 21, 2012
    Dolibarr
    Dolibarr
    risk 0.00cvss —epss 0.24

    Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the (1) file parameter to document.php or (2) backtopage parameter in a create action to…

  • CVE-2012-1225Feb 21, 2012
    Dolibarr
    Dolibarr
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Dolibarr CMS 3.2.0 Alpha and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) memberslist parameter (aka Member List) in list.php or (2) rowid parameter to adherents/fiche.php.