VYPR

CVEs

386,405 total · page 6780 of 7,729

AllCriticalHighKEV
  • CVE-2011-3859Sep 28, 2011
    WordPress
    Trending
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.

  • CVE-2011-3858Sep 28, 2011
    WordPress
    Pixiv Custom
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3857Sep 28, 2011
    WordPress
    Antisnews
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3856Sep 28, 2011
    WordPress
    Elegant Grunge
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3855Sep 28, 2011
    WordPress
    F8 Lite
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3854Sep 28, 2011
    WordPress
    ZenLite
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the ZenLite theme before 4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3853Sep 28, 2011
    WordPress
    Hybrid
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Hybrid theme before 0.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.

  • CVE-2011-3852Sep 28, 2011
    WordPress
    EvoLve
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the EvoLve theme before 1.2.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3851Sep 28, 2011
    WordPress
    News
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the News theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.

  • CVE-2011-3850Sep 28, 2011
    WordPress
    Atahualpa
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Atahualpa theme before 3.6.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3694Sep 27, 2011
    Netsaro
    Enterprise Messenger Server
    risk 0.00cvss —epss 0.01

    The Server Administration Console in NetSaro Enterprise Messenger Server 2.0 allows remote attackers to read application source code by appending a %00 character to a URL.

  • CVE-2011-3693Sep 27, 2011
    Netsaro
    Enterprise Messenger Server
    risk 0.00cvss —epss 0.00

    NetSaro Enterprise Messenger Server 2.0 allows local users to discover cleartext server credentials by reading the NetSaro.fdb file.

  • CVE-2011-3692Sep 27, 2011
    Netsaro
    Enterprise Messenger Server
    risk 0.00cvss —epss 0.00

    NetSaro Enterprise Messenger Server 2.0 stores cleartext console credentials in configuration.xml, which allows local users to obtain sensitive information by reading this file and performing a base64 decoding step.

  • CVE-2011-3691Sep 27, 2011
    Foxitsoftware
    Reader
    risk 0.00cvss —epss 0.01

    Untrusted search path vulnerability in Foxit Reader before 5.0.2.0718 allows local users to gain privileges via a Trojan horse dwmapi.dll, dwrite.dll, or msdrm.dll in the current working directory.

  • CVE-2011-3690Sep 27, 2011
    Plotsoft
    Pdfill PDF Editor
    risk 0.00cvss —epss 0.01

    Untrusted search path vulnerability in PlotSoft PDFill PDF Editor 8.0 allows local users to gain privileges via a Trojan horse mfc70enu.dll or mfc80loc.dll in the current working directory.

  • CVE-2011-3689Sep 27, 2011
    Wibu
    CodeMeter WebAdmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Licenses.html in Wibu-Systems CodeMeter WebAdmin 3.30 and 4.30 allows remote attackers to inject arbitrary web script or HTML via the BoxSerial parameter.

  • CVE-2011-3688Sep 27, 2011
    Sonexis
    Conferencemanager
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Sonexis ConferenceManager 9.3.14.0 allow remote attackers to execute arbitrary SQL commands via (1) the g parameter to Conference/Audio/AudioResourceContainer.asp or (2) the txtConferenceID parameter to Login/HostLogin.asp.

  • CVE-2011-3687Sep 27, 2011
    Sonexis
    Conferencemanager
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Sonexis ConferenceManager 9.2.11.0 allow remote attackers to inject arbitrary web script or HTML via (1) the txtConferenceID parameter to HostLogin.asp, (2) the txtConferenceID parameter to ParticipantLogin.asp, (3) the acp…

  • CVE-2011-3686Sep 27, 2011
    Sonexis
    Conferencemanager
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in myAddressBook.asp in Sonexis ConferenceManager 9.2.11.0 and 9.3.14.0 allow remote attackers to inject arbitrary web script or HTML via the (1) fname, (2) lname, (3) email_edit, (4) email, (5) email2, (6) email3, (7) sms, (8)…

  • CVE-2011-3685Sep 27, 2011
    Tembria
    Server Monitor
    risk 0.00cvss —epss 0.00

    Tembria Server Monitor before 6.0.5 Build 2252 uses a substitution cipher to encrypt application credentials, which allows local users to obtain sensitive information by leveraging read access to (1) authentication.dat or (2) XML files in the Exports directory.

  • CVE-2011-3684Sep 27, 2011
    Tembria
    Server Monitor
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Tembria Server Monitor before 6.0.5 Build 2252 allow remote attackers to inject arbitrary web script or HTML via (1) the siteid parameter to logbook.asp, (2) the siteid parameter to monitor-events.asp, (3) the siteid…

  • CVE-2011-3645Sep 27, 2011
    Newgensoft
    Omnidocs
    risk 0.03cvss —epss 0.03

    Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter to doccab/doclist.jsp, which leads to arbitrary permission changes; or (2) a modified UserIndex parameter to doccab/userprofile/editprofile.jsp, which selects…

  • CVE-2010-4841Sep 27, 2011
    Manageengine
    EventLog Analyzer
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine EventLog Analyzer 6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) HOST_ID, (2) OS, (3) GROUP, (4) exportFile, (5) load, (6) type, or (7) tab parameter to INDEX.do, the (8) reported…

  • CVE-2010-4840Sep 27, 2011
    Manageengine
    EventLog Analyzer
    risk 0.00cvss —epss 0.02

    Multiple buffer overflows in the Syslog server in ManageEngine EventLog Analyzer 6.1 allow remote attackers to cause a denial of service (SysEvttCol.exe process crash) or possibly execute arbitrary code via a long Syslog PRI message header to UDP port (1) 513 or (2) 514. Fixed…

  • CVE-2010-4852Sep 27, 2011
    Eclime
    Eclime
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in login.php in Eclime 1.1.2b allows remote attackers to inject arbitrary web script or HTML via the reason parameter in a fail action.

  • CVE-2010-4851Sep 27, 2011
    Eclime
    Eclime
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Eclime 1.1.2b allow remote attackers to execute arbitrary SQL commands via the (1) ref or (2) poll_id parameter to index.php, or the (3) country parameter to create_account.php.

  • CVE-2010-4850Sep 27, 2011
    Diferior
    Diferior
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Diferior 8.03 allow remote attackers to inject arbitrary web script or HTML via the (1) post_content parameter to post/edit/2/p1.html, related to views/post.php; the (2) slogan parameter to admin/site/2.html, related to…

  • CVE-2010-4849Sep 27, 2011
    Alibabaclone
    Alibaba Clone
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in countrydetails.php in Alibaba Clone B2B 3.4 allows remote attackers to execute arbitrary SQL commands via the es_id parameter.

  • CVE-2010-4848Sep 27, 2011
    Axscripts
    Axslinks
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in addlink.php in AXScripts AxsLinks 0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) url or (2) title parameter.

  • CVE-2010-4847Sep 27, 2011
    Mhproducts
    Mhp Downloadshop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in view_item.php in MH Products MHP Downloadshop allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.

  • CVE-2010-4846Sep 27, 2011
    Mhproducts
    Pay Pal Shop Digital
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in view_item.php in MH Products Pay Pal Shop Digital allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.

  • CVE-2010-4845Sep 27, 2011
    Mhproducts
    Projekt Shop
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MH Products Projekt Shop allow remote attackers to execute arbitrary SQL commands via the (1) ts parameter to details.php and possibly the (2) ilceler parameter to index.php.

  • CVE-2010-4844Sep 27, 2011
    Mhproducts
    Easy Online Shop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in content.php in MH Products Easy Online Shop allows remote attackers to execute arbitrary SQL commands via the kat parameter.

  • CVE-2010-4843Sep 27, 2011
    PHP Web Scripts
    AD Manager Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in website-page.php in PHP Web Scripts Ad Manager Pro 3.0 allows remote attackers to execute arbitrary SQL commands via the pageId parameter.

  • CVE-2010-4842Sep 27, 2011
    MHP
    DownloadScript
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/login.php in MHP DownloadScript (aka MH Products Download Center) 2.2 allows remote attackers to execute arbitrary SQL commands via the Name parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2011-3826Sep 24, 2011
    Zikula
    Zikula
    risk 0.00cvss —epss 0.01

    Zikula 1.2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/voodoodolly/version.php and certain other files.

  • CVE-2011-3825Sep 24, 2011
    Zend
    Framework
    risk 0.00cvss —epss 0.01

    Zend Framework 1.11.3 in Zend Server CE 5.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Validate.php and certain other files.

  • CVE-2011-3824Sep 24, 2011
    Yourls
    Yourls
    risk 0.00cvss —epss 0.01

    Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.php and certain other files.

  • CVE-2011-3823Sep 24, 2011
    Yamamah
    Yamamah
    risk 0.00cvss —epss 0.01

    Yamamah 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/default/index.php and certain other files.

  • CVE-2011-3822Sep 24, 2011
    XOOPS
    Xoops
    risk 0.00cvss —epss 0.01

    XOOPS 2.5.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/system/xoops_version.php and certain other files.

  • CVE-2011-3821Sep 24, 2011
    Xajax
    Xajax
    risk 0.00cvss —epss 0.01

    xajax 0.6 beta1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xajax_core/plugin_layer/xajaxScriptPlugin.inc.php and certain other files.

  • CVE-2011-3820Sep 24, 2011
    WSN Software
    WSN Software
    risk 0.00cvss —epss 0.01

    WSN Software 6.0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/prestart.php and certain other files.

  • CVE-2011-3819Sep 24, 2011
    53x11
    Wow Server Status
    risk 0.00cvss —epss 0.01

    WoW Server Status 4.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by status.php and certain other files.

  • CVE-2011-3818Sep 24, 2011
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by wp-admin/includes/user.php and certain other files.

  • CVE-2011-3817Sep 24, 2011
    Website Baker
    Websitebaker
    risk 0.00cvss —epss 0.01

    Website Baker 2.8.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/media/parameters.php and certain other files. NOTE: this might overlap…

  • CVE-2011-3816Sep 24, 2011
    Webinsta
    Mailing List Manager
    risk 0.00cvss —epss 0.01

    WEBinsta mailing list manager 1.3e allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by install/install3.php and certain other files.

  • CVE-2011-3815Sep 24, 2011
    Webidsupport
    Webid
    risk 0.00cvss —epss 0.02

    WeBid 1.0.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by js/calendar.php and certain other files.

  • CVE-2011-3814Sep 24, 2011
    Webcalendar
    Webcalendar
    risk 0.00cvss —epss 0.01

    WebCalendar 1.2.3, and other versions before 1.2.5, allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by ws/user_mod.php and certain other files.

  • CVE-2011-3813Sep 24, 2011
    Vwar
    Virtual War
    risk 0.00cvss —epss 0.01

    Virtual War (aka VWar) 1.5.0r15 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/language/dutch.inc.php and certain other files.

  • CVE-2011-3812Sep 24, 2011
    Lussumo
    Vanilla
    risk 0.00cvss —epss 0.01

    Vanilla 2.0.16 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/Minify/min/utils.php and certain other files.