VYPR

CVEs

386,122 total · page 6828 of 7,723

AllCriticalHighKEV
  • CVE-2011-0635Jan 22, 2011
    Simploo
    Simploo CMS
    risk 0.03cvss —epss 0.02

    Static code injection vulnerability in Simploo CMS 1.7.1 and earlier allows remote authenticated users to inject arbitrary PHP code into config/custom/base.ini.php via the ftpserver parameter (FTP-Server field) to the sicore/updates/optionssav operation for index.php.

  • CVE-2011-0002Jan 22, 2011
    Libuser
    Libuser
    risk 0.00cvss —epss 0.04

    libuser before 0.57 uses a cleartext password value of (1) !! or (2) x for new LDAP user accounts, which makes it easier for remote attackers to obtain access by specifying one of these values.

  • CVE-2010-4705Jan 22, 2011
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.01

    Integer overflow in the vorbis_residue_decode_internal function in libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg, possibly 0.6, has unspecified impact and remote attack vectors, related to the sizes of certain integer data types. NOTE: this might overlap CVE-2011-0480.

  • CVE-2010-4704Jan 22, 2011
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.03

    libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg 0.6.1 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted .ogg file, related to the vorbis_floor0_decode function. NOTE: this might overlap CVE-2011-0480.

  • CVE-2010-4243Jan 22, 2011
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial of service (memory consumption) via a crafted exec system call, aka…

  • CVE-2010-4238Jan 22, 2011
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    The vbd_create function in Xen 3.1.2, when the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 is used, allows guest OS users to cause a denial of service (host OS panic) via an attempted access to a virtual CD-ROM device through the blkback driver. NOTE: some of these…

  • CVE-2010-3879Jan 22, 2011
    Fuse
    Fuse
    risk 0.04cvss —epss 0.10

    FUSE, possibly 2.8.5 and earlier, allows local users to create mtab entries with arbitrary pathnames, and consequently unmount any filesystem, via a symlink attack on the parent directory of the mountpoint of a FUSE filesystem, a different vulnerability than CVE-2010-0789.

  • CVE-2010-2743Jan 20, 2011
    Microsoft
    Windows
    risk 0.04cvss —epss 0.15

    The kernel-mode drivers in Microsoft Windows XP SP3 do not properly perform indexing of a function-pointer table during the loading of keyboard layouts from disk, which allows local users to gain privileges via a crafted application, as demonstrated in the wild in July 2010 by…

  • CVE-2011-0519Jan 20, 2011
    Gallarific
    PHP Photo Gallery Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in gallery.php in Gallarific PHP Photo Gallery script 2.1 and possibly other versions allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2011-0518Jan 20, 2011
    Lotuscms
    Fraise
    risk 0.04cvss —epss 0.16

    Directory traversal vulnerability in core/lib/router.php in LotusCMS Fraise 3.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via the system parameter to index.php.

  • CVE-2011-0517Jan 20, 2011
    Sielcosistemi
    Winlog Pro
    risk 0.06cvss —epss 0.40

    Stack-based buffer overflow in Sielco Sistemi Winlog Pro 2.07.00 and earlier, when Run TCP/IP server is enabled, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a crafted 0x02 opcode to TCP port 46823.

  • CVE-2011-0516Jan 20, 2011
    Epromptc
    Betmore Site Suite
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in mainx_a.php in E-PROMPT C BetMore Site Suite 4.0 through 4.2.0 allows remote attackers to execute arbitrary SQL commands via the bid parameter.

  • CVE-2011-0515Jan 20, 2011
    Kingsoft
    Antivirus
    risk 0.03cvss —epss 0.01

    KisKrnl.sys 2011.1.13.89 and earlier in Kingsoft AntiVirus 2011 SP5.2 allows local users to cause a denial of service (crash) via a crafted request that is not properly handled by the KiFastCallEntry hook.

  • CVE-2011-0514Jan 20, 2011
    Microfocus
    Data Protector Manager
    risk 0.07cvss —epss 0.49

    The RDS service (rds.exe) in HP Data Protector Manager 6.11 allows remote attackers to cause a denial of service (crash) via a packet with a large data size to TCP port 1530.

  • CVE-2011-0513Jan 20, 2011
    Securstar
    Drivecrypt
    risk 0.03cvss —epss 0.01

    DCR.sys driver in SecurStar DriveCrypt 5.4, 5.3, and earlier allows local users to execute arbitrary code via a crafted argument to the 0x00073800 IOCTL.

  • CVE-2011-0512Jan 20, 2011
    PHP-Fusion
    Teams Structure
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in team.php in the Teams Structure module 3.0 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the team_id parameter.

  • CVE-2011-0511Jan 20, 2011
    Joomla
    allCineVid
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the allCineVid component (com_allcinevid) 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

  • CVE-2011-0510Jan 20, 2011
    Advanced Webhost Billing System
    Advanced Webhost Billing System
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in cart.php in Advanced Webhost Billing System (AWBS) 2.9.2 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the oid parameter in an add_other action.

  • CVE-2011-0509Jan 20, 2011
    Vaadin
    Vaadin
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Vaadin before 6.4.9 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the index page.

  • CVE-2011-0508Jan 20, 2011
    Contao
    CMS
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in system/modules/comments/Comments.php in Contao CMS 2.9.2, and possibly other versions before 2.9.3, allows remote attackers to inject arbitrary web script or HTML via the HTTP X_FORWARDED_FOR header, which is stored by…

  • CVE-2011-0507Jan 20, 2011
    BlackMoon
    FTP
    risk 0.03cvss —epss 0.05

    FTPService.exe in Blackmoon FTP 3.1 Build 1735 and Build 1736 (3.1.7.1736), and possibly other versions before 3.1.8.1737, allows remote attackers to cause a denial of service (crash) via a large number of PORT commands with long arguments, which triggers a NULL pointer…

  • CVE-2011-0506Jan 20, 2011
    Ax
    Ax Developer CMS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in modules/profile/user.php in Ax Developer CMS (AxDCMS) 0.1.1 allows remote attackers to execute arbitrary code via a .. (dot dot) in the aXconf[default_language] parameter.

  • CVE-2011-0505Jan 20, 2011
    Zwii
    Zwii
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in system/system.php in Zwii 2.1.1, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the set[template][value] parameter.

  • CVE-2011-0504Jan 20, 2011
    VAM
    Shop
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in VaM Shop 1.6, 1.6.1, and probably earlier versions llow remote attackers to inject arbitrary web script or HTML via the (1) status parameter to admin/orders.php, (2) search parameter to admin/customers.php, or (3) STORE_NAME…

  • CVE-2011-0503Jan 20, 2011
    VaM Shop
    VaM Shop
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in VaM Shop 1.6, 1.6.1, and probably earlier versions allows remote attackers to hijack the authentication of administrators for requests that (1) change user status via admin/customers.php or (2) change user permissions via…

  • CVE-2011-0502Jan 20, 2011
    Musanim
    Music Animation Machine Midi Player
    risk 0.03cvss —epss 0.06

    Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions allows user-assisted remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a long line in a MIDI (.mid) file.

  • CVE-2011-0501Jan 20, 2011
    Music Animation Machine
    MIDI Player
    risk 0.04cvss —epss 0.16

    Stack-based buffer overflow in Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions allows user-assisted remote attackers to execute arbitrary code via a long line in a .mamx file.

  • CVE-2011-0500Jan 20, 2011
    Verytools
    Videospirit Lite
    risk 0.05cvss —epss 0.31

    Buffer overflow in VideoSpirit Pro 1.6.8.1, 1.68, and earlier; and VideoSpirit Lite 1.4.0.1 and possibly other versions; allows user-assisted remote attackers to execute arbitrary code via a VideoSpirit project (.visprj) file containing a valitem element with a long "value"…

  • CVE-2011-0499Jan 20, 2011
    Verytools
    Videospirit Lite
    risk 0.05cvss —epss 0.31

    Buffer overflow in VideoSpirit Pro 1.6.8.1 and possibly earlier versions, and VideoSpirit Lite 1.4.0.1 and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via a VideoSpirit project (.visprj) file containing a valitem element with a long…

  • CVE-2011-0498Jan 20, 2011
    Nokia
    Multimedia Player
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in Nokia Multimedia Player 1.00.55.5010, and possibly other versions, allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long entry in a playlist (.npl) file.

  • CVE-2011-0497Jan 20, 2011
    Sybase
    Easerver
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Sybase EAServer 6.x before 6.3 ESD#2, as used in Appeon, Replication Server Messaging Edition (RSME), and WorkSpace, allows remote attackers to read arbitrary files via "../\" (dot dot forward-slash backslash) sequences in a crafted request.

  • CVE-2011-0496Jan 20, 2011
    Sybase
    Easerver
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Sybase EAServer 5.x and 6.x before 6.3 ESD#2, as used in Appeon, Replication Server Messaging Edition (RSME), and WorkSpace, allows remote attackers to install arbitrary web services and execute arbitrary code, related to a "design vulnerability."

  • CVE-2011-0495Jan 20, 2011
    Asterisk
    Business Edition
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the ast_uri_encode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users…

  • CVE-2011-0008Jan 20, 2011
    Todd Miller
    Sudo
    risk 0.00cvss —epss 0.00

    A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable…

  • CVE-2010-4703Jan 20, 2011
    Hotwebscripts
    Rentals
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in default.asp in HotWebScripts HotWeb Rentals allows remote attackers to execute arbitrary SQL commands via the PageId parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2010-4702Jan 20, 2011
    Joomla
    JRadio
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in JRadio (com_jradio) component before 1.5.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-4701Jan 20, 2011
    Microsoft
    Windows Xp
    risk 0.07cvss —epss 0.48

    Heap-based buffer overflow in the CDrawPoly::Serialize function in fxscover.exe in Microsoft Windows Fax Services Cover Page Editor 5.2 r2 in Windows XP Professional SP3, Server 2003 R2 Enterprise Edition SP2, and Windows 7 Professional allows remote attackers to execute…

  • CVE-2010-4351Jan 20, 2011
    IcedTea
    IcedTea6
    risk 0.00cvss —epss 0.03

    The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass…

  • CVE-2010-4338Jan 20, 2011
    Jwilk
    Ocrodjvu
    risk 0.00cvss —epss 0.00

    ocrodjvu 0.4.6-1 on Debian GNU/Linux allows local users to modify arbitrary files via a symlink attack on temporary files that are generated when Cuneiform is invoked as the OCR engine.

  • CVE-2010-4331Jan 20, 2011
    Seopanel
    Seopanel
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Seo Panel 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) default_news or (2) sponsors cookies, which are not properly handled by (a) controllers/index.ctrl.php or (b)…

  • CVE-2010-4267Jan 20, 2011
    Hewlett-Packard
    hplip
    risk 0.01cvss —epss 0.11

    Stack-based buffer overflow in the hpmud_get_pml function in io/hpmud/pml.c in Hewlett-Packard Linux Imaging and Printing (HPLIP) 1.6.7, 3.9.8, 3.10.9, and probably other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code…

  • CVE-2010-4071Jan 20, 2011
    OTRS
    Otrs
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in AgentTicketZoom in OTRS 2.4.x before 2.4.9, when RichText is enabled, allows remote attackers to inject arbitrary web script or HTML via JavaScript in an HTML e-mail.

  • CVE-2010-3931Jan 20, 2011
    Rocomotion
    P Forum
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in multiple Rocomotion products, including P board 1.18 and other versions, P forum 1.30 and earlier, P up board 1.38 and other versions, P diary R 1.13 and earlier, P link 1.11 and earlier, P link compact 1.04 and earlier, pplog 3.31 and…

  • CVE-2010-3928Jan 20, 2011
    RVM
    Ruby Version Manager
    risk 0.00cvss —epss 0.02

    Ruby Version Manager (RVM) before 1.2.1 writes file contents to a terminal without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via a crafted file, related to an "escape sequence injection vulnerability." NOTE: some of…

  • CVE-2010-4464Jan 19, 2011
    Oracle Corporation
    Sun Convergence
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Oracle Sun Convergence 1.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Webmail.

  • CVE-2010-4461Jan 19, 2011
    Oracle Corporation
    Peoplesoft Enterprise Hrms
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft and JDEdwards Suite 8.9 Bundle #23, 9.0 Bundle #14, and 9.1 Bundle #4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to ePerformance.

  • CVE-2010-4460Jan 19, 2011
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Oracle Solaris 10 allows local users to affect confidentiality and integrity via unknown vectors related to Fault Manager Daemon.

  • CVE-2010-4459Jan 19, 2011
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Oracle Solaris 11 Express allows local users to affect availability via unknown vectors related to SCTP and Kernel/sockfs.

  • CVE-2010-4458Jan 19, 2011
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Oracle Solaris 11 Express allows local users to affect availability, related to ZFS.

  • CVE-2010-4457Jan 19, 2011
    Sun Corporation
    Sunos
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Oracle Solaris 11 Express allows remote attackers to affect availability, related to SMB and CIFS.