VYPR

CVEs

386,559 total · page 6750 of 7,732

AllCriticalHighKEV
  • CVE-2010-5083Feb 14, 2012
    PHP-Nuke
    Web_Links module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Web_Links module for PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the url parameter in an Add action to modules.php.

  • CVE-2012-1087Feb 14, 2012
    TYPO3
    bc_post2facebook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1086Feb 14, 2012
    TYPO3
    Aeurltool
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the UrlTool (aeurltool) extension 0.1.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1085Feb 14, 2012
    TYPO3
    Beuserswitch
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2012-1084Feb 14, 2012
    TYPO3
    Beuserswitch
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1083Feb 14, 2012
    TYPO3
    Terminal
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2012-1082Feb 14, 2012
    TYPO3
    Terminal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1081Feb 14, 2012
    TYPO3
    Yet another Google search
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Yet another Google search (ya_googlesearch) extension before 0.3.10 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1080Feb 14, 2012
    TYPO3
    Euro Calculator (skt_eurocalc)
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Euro Calculator (skt_eurocalc) extension 0.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1079Feb 14, 2012
    TYPO3
    typo3_webservice
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Webservices for TYPO3 (typo3_webservice) extension before 0.3.8 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors.

  • CVE-2012-1078Feb 14, 2012
    TYPO3
    sysutils
    risk 0.00cvss —epss 0.01

    The System Utilities (sysutils) extension 1.0.3 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unspecified vectors related to improper "protection" of the "backup output directory."

  • CVE-2012-1077Feb 14, 2012
    TYPO3
    bc_post2facebook
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-1076Feb 14, 2012
    TYPO3
    rtg_files
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1075Feb 14, 2012
    TYPO3
    rtg_files
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-1074Feb 14, 2012
    TYPO3
    White Papers
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the White Papers (mm_whtppr) extension 0.0.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-1073Feb 14, 2012
    TYPO3
    Toi Category
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-1072Feb 14, 2012
    TYPO3
    Category-System
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-1071Feb 14, 2012
    TYPO3
    mv_cooking
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Kitchen recipe (mv_cooking) extension before 0.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild as of February 2012.

  • CVE-2012-1070Feb 14, 2012
    TYPO3
    irfaq
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the "return url parameter."

  • CVE-2012-1069Feb 14, 2012
    LknSupport
    lknSupport
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in module/kb/search_word in the search module in lknSupport allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  • CVE-2012-1068Feb 14, 2012
    WordPress
    Wp Recentcomments
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging.

  • CVE-2012-1067Feb 14, 2012
    WordPress
    Wp Recentcomments
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2012-1066Feb 14, 2012
    Smartycms
    Smartycms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the template module in SmartyCMS 0.9.4 allows remote attackers to inject arbitrary web script or HTML via the title bar.

  • CVE-2012-1065Feb 14, 2012
    risk 0.03cvss —epss 0.04

    Insecure method vulnerability in TuxScripting.dll in the TuxSystem ActiveX control in 2X ApplicationServer 10.1 Build 1224 allows remote attackers to create or overwrite arbitrary files via the ExportSettings method.

  • CVE-2012-1009Feb 14, 2012
    Netsarang
    Xlpd
    risk 0.03cvss —epss 0.03

    NetSarang Xlpd 4 Build 0100 and NetSarang Xmanager Enterprise 4 Build 0186 allow remote attackers to cause a denial of service (daemon crash) via a malformed LPD request.

  • CVE-2011-5080Feb 14, 2012
    Juergen Furrer
    Jftcaforms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in lib/class.tx_jftcaforms_tceFunc.php in the Additional TCA Forms (jftcaforms) extension before 0.2.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2011-5079Feb 14, 2012
    TYPO3
    irfaq
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL, probably in the "return url parameter."

  • CVE-2012-0789Feb 14, 2012
    PHP
    PHP
    risk 0.04cvss —epss 0.08

    Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache.

  • CVE-2012-0788Feb 14, 2012
    PHP
    PHP
    risk 0.04cvss —epss 0.09

    The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (application crash) via a crafted application that uses a PDO driver for a fetch and then calls the session_start…

  • CVE-2012-1063Feb 14, 2012
    Manageengine
    Applications Manager
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to execute arbitrary SQL commands via the (1) viewId parameter to fault/AlarmView.do or (2) period parameter to showHistoryData.do.

  • CVE-2012-1062Feb 14, 2012
    Manageengine
    Applications Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to…

  • CVE-2012-1061Feb 14, 2012
    GForge
    Gforge
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in GForge Advanced Server 6.0.0 and other versions before 6.0.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-1060Feb 14, 2012
    Drupal
    revisioning
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in revisioning_theme.inc in the Taxonomy module in the Revisioning module 6.x-3.13 and other versions before 6.x-3.14 for Drupal allow remote authenticated users with certain privileges to inject arbitrary web script or HTML…

  • CVE-2012-1059Feb 14, 2012
    OsCommerce
    Online Merchant
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Cart/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the value_title parameter, as demonstrated using the "Front" field in…

  • CVE-2012-1058Feb 14, 2012
    Flyspray
    Flyspray
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Flyspray 0.9.9.6 allows remote attackers to hijack the authentication of admins for requests that add admin accounts via an admin.newuser action to index.php.

  • CVE-2012-1057Feb 14, 2012
    Drupal
    Forward
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the clickthrough tracking functionality in the Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that increase node…

  • CVE-2012-1056Feb 14, 2012
    Drupal
    Forward
    risk 0.00cvss —epss 0.01

    The Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal does not properly enforce permissions for (1) Recent forwards, (2) Most forwarded, or (3) Dynamic blocks, which allows remote attackers to obtain node titles via unspecified vectors.

  • CVE-2012-1055Feb 14, 2012
    PhotoLine
    PhotoLine
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in PhotoLine 17.01 and possibly other versions before 17.02 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.

  • CVE-2012-0829Feb 14, 2012
    Mibew
    Messenger
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Mibew Messenger 1.6.4 and earlier allow remote attackers to hijack the authentication of operators for requests that insert cross-site scripting (XSS) sequences via the (1) address or (2) threadid parameters to…

  • CVE-2012-0340Feb 13, 2012
    Cisco Systems, Inc.
    Ironport Encryption Appliance
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the management interface on the Cisco IronPort Encryption Appliance with software before 6.5.3 allows remote attackers to inject arbitrary web script or HTML via the header parameter to the default URI under admin/, aka bug ID 72410.

  • CVE-2012-1052Feb 13, 2012
    Ivanview
    Ivanview
    risk 0.00cvss —epss 0.03

    Buffer overflow in IvanView 1.2.15 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.

  • CVE-2012-1051Feb 13, 2012
    Xnview
    Xnview
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in Xjp2.dll in the JPEG2000 plug-in in XnView 1.98.5 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.

  • CVE-2012-1050Feb 13, 2012
    Mathopd
    Mathopd
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in Mathopd 1.4.x and 1.5.x before 1.5p7, when configured with the * construct for mass virtual hosting, allows remote attackers to read arbitrary files via a crafted Host header.

  • CVE-2012-1049Feb 13, 2012
    Manageengine
    Admanager Plus
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ADManager Plus 5.2 Build 5210 allow remote attackers to inject arbitrary web script or HTML via the (1) domainName parameter to jsp/AddDC.jsp or (2) operation parameter to DomainConfig.do.

  • CVE-2012-1048Feb 12, 2012
    Epignosis
    Community++ edition
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in communityplusplus/www/administrator.php in eFront Community++ edition 3.6.10, and possibly other editions, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.

  • CVE-2012-1047Feb 12, 2012
    Cyberoam
    Cyberoam Central Console
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in the WWWHELP Service (js/html/wwhelp.htm) in Cyberoam Central Console (CCC) 2.00.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter in an Online_help action.

  • CVE-2011-4341Feb 12, 2012
    Getsymphony
    Symphonycms
    risk 0.00cvss —epss 0.03

    Multiple SQL injection vulnerabilities in symphony/content/content.publish.php in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author permissions to execute arbitrary SQL commands via the filter parameter to (1)…

  • CVE-2011-4340Feb 12, 2012
    Getsymphony
    Symphonycms
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author privileges to inject arbitrary web script or HTML via (1) the profile parameter to…

  • CVE-2012-0834Feb 11, 2012
    Phpldapadmin Project
    Phpldapadmin
    risk 0.00cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in lib/QueryRender.php in phpLDAPadmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the base parameter in a query_engine action to cmd.php.

  • CVE-2012-0452Feb 11, 2012
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Use-after-free vulnerability in Mozilla Firefox 10.x before 10.0.1, Thunderbird 10.x before 10.0.1, and SeaMonkey 2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger failure of an…