VYPR

CVEs

385,868 total · page 6851 of 7,718

AllCriticalHighKEV
  • CVE-2010-3277Sep 28, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    The installer in VMware Workstation 7.x before 7.1.2 build 301548 and VMware Player 3.x before 3.1.2 build 301548 renders an index.htm file if present in the installation directory, which might allow local users to trigger unintended interpretation of web script or HTML by…

  • CVE-2010-3087Sep 28, 2010
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.03

    LibTIFF before 3.9.2-5.2.1 in SUSE openSUSE 11.3 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TIFF image.

  • CVE-2010-3070Sep 28, 2010
    Nusoap
    NuSOAP
    risk 0.03cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to an arbitrary PHP script that uses NuSOAP classes.

  • CVE-2010-2950Sep 28, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.06

    Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the…

  • CVE-2010-0405Sep 28, 2010
    Bzip
    Bzip2
    risk 0.00cvss —epss 0.03

    Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted compressed file.

  • CVE-2010-3608Sep 24, 2010
    WpQuiz
    WpQuiz
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) password (pw) parameters to (a) admin.php or (b) user.php.

  • CVE-2010-3607Sep 24, 2010
    Netartmedia
    Real Estate Portal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in AGENTS/index.php in NetArt MEDIA Real Estate Portal 2.0 allows remote authenticated users to inject arbitrary web script or HTML via the id parameter.

  • CVE-2010-3606Sep 24, 2010
    Netartmedia
    Real Estate Portal
    risk 0.00cvss —epss 0.01

    Multiple directory traversal vulnerabilities in AGENTS/index.php in NetArt MEDIA Real Estate Portal 2.0 allow remote emote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) folder and (2) action parameters.

  • CVE-2010-3605Sep 24, 2010
    TYPO3
    powermail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-3604Sep 24, 2010
    Alex Kellner
    Powermail
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-3603Sep 24, 2010
    MojoPortal
    mojoPortal
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in the file manager service (Services/FileService.ashx) in mojoPortal 2.3.4.3 and 2.3.5.1 allows remote attackers to hijack the authentication of administrators for requests that rename arbitrary files, as demonstrated by causing…

  • CVE-2010-3602Sep 24, 2010
    MojoPortal
    mojoPortal
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in ProfileView.aspx in mojoPortal 2.3.4.3 and 2.3.5.1 allows remote attackers to inject arbitrary web script or HTML via the User ID parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-3601Sep 24, 2010
    IbPhotohost
    ibPhotohost
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in ibPhotohost 1.1.2 allows remote attackers to execute arbitrary SQL commands via the img parameter.

  • CVE-2010-3081HigSep 24, 2010
    Linux
    Kernel
    risk 0.54cvss 7.8epss 0.04

    The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging…

  • CVE-2010-3306Sep 24, 2010
    Weborf
    weborf
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in the modURL function in instance.c in Weborf before 0.12.3 allows remote attackers to read arbitrary files via ..%2f sequences in a URI.

  • CVE-2010-3304Sep 24, 2010
    Dovecot (software)
    Dovecot
    risk 0.00cvss —epss 0.03

    The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.

  • CVE-2010-3294Sep 24, 2010
    PHP
    APC
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in apc.php in the Alternative PHP Cache (APC) extension before 3.1.4 for PHP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-3285Sep 24, 2010
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to cause a denial of service via unknown vectors.

  • CVE-2010-3284Sep 24, 2010
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP System Management Homepage (SMH) before 6.2 allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2010-3283Sep 24, 2010
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in HP System Management Homepage (SMH) before 6.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2010-3261Sep 24, 2010
    Rsa
    Authentication Agent For Web
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in RSA Authentication Agent 7.0 before P2 for Web allows remote attackers to read unspecified data via unknown vectors.

  • CVE-2010-2491Sep 24, 2010
    Roundup Tracker
    Roundup
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script or HTML via the template argument to the /issue program.

  • CVE-2010-1825Sep 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in WebKit, as used in Google Chrome before 6.0.472.59, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to nested SVG elements.

  • CVE-2010-1824Sep 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.04

    Use-after-free vulnerability in WebKit, as used in Apple iTunes before 10.2 on Windows, Apple Safari, and Google Chrome before 6.0.472.59, allows remote attackers to execute arbitrary code or cause a denial of service via vectors related to SVG styles, the DOM tree, and error…

  • CVE-2010-1823Sep 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    Use-after-free vulnerability in WebKit before r65958, as used in Google Chrome before 6.0.472.59, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger use of document APIs such as document.close during parsing,…

  • CVE-2010-1773HigSep 24, 2010
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.02

    Off-by-one error in the toAlphabetic function in rendering/RenderListMarker.cpp in WebCore in WebKit before r59950, as used in Google Chrome before 5.0.375.70, allows remote attackers to obtain sensitive information, cause a denial of service (memory corruption and application…

  • CVE-2010-1772HigSep 24, 2010
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.02

    Use-after-free vulnerability in page/Geolocation.cpp in WebCore in WebKit before r59859, as used in Google Chrome before 5.0.375.70, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site, related to failure to…

  • CVE-2010-1767Sep 24, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in loader/DocumentThreadableLoader.cpp in WebCore in WebKit before r57041, as used in Google Chrome before 4.1.249.1059, allows remote attackers to hijack the authentication of unspecified victims via a crafted synchronous…

  • CVE-2010-3281Sep 23, 2010
    Alcatel Lucent
    Omnivista 4760 Server
    risk 0.00cvss —epss 0.02

    Stack-based buffer overflow in the HTTP proxy service in Alcatel-Lucent OmniVista 4760 server before R5.1.06.03.c_Patch3 allows remote attackers to execute arbitrary code or cause a denial of service (service crash) via a long request.

  • CVE-2010-3280Sep 23, 2010
    Alcatel Lucent
    Ccagent
    risk 0.00cvss —epss 0.01

    The CCAgent option 9.0.8.4 and earlier in the management server (aka TSA) component in Alcatel-Lucent OmniTouch Contact Center Standard Edition relies on client-side authorization checking, and unconditionally sends the SuperUser password to the client for use during an…

  • CVE-2010-3279Sep 23, 2010
    Alcatel Lucent
    Ccagent
    risk 0.00cvss —epss 0.01

    The default configuration of the CCAgent option before 9.0.8.4 in the management server (aka TSA) component in Alcatel-Lucent OmniTouch Contact Center Standard Edition enables maintenance access, which allows remote attackers to monitor or reconfigure Contact Center operations…

  • CVE-2010-2836Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Memory leak in the SSL VPN feature in Cisco IOS 12.4, 15.0, and 15.1, when HTTP port redirection is enabled, allows remote attackers to cause a denial of service (memory consumption) by improperly disconnecting SSL sessions, leading to connections that remain in the CLOSE-WAIT…

  • CVE-2010-2835Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5), 7.0 before 7.0(2a)su3, 7.1su before 7.1(3b)su2, 7.1 before 7.1(5), and 8.0 before 8.0(1)…

  • CVE-2010-2834Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)SU1, 7.x before 7.1(5), and 8.0 before 8.0(2) allow remote attackers to cause a denial of…

  • CVE-2010-2833Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the NAT for H.225.0 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1 allows remote attackers to cause a denial of service (device reload) via transit traffic, aka Bug ID CSCtd86472.

  • CVE-2010-2832Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the NAT for H.323 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1 allows remote attackers to cause a denial of service (device reload) via transit traffic, aka Bug ID CSCtf91428.

  • CVE-2010-2831Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the NAT for SIP implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1 allows remote attackers to cause a denial of service (device reload) via transit traffic on UDP port 5060, aka Bug ID CSCtf17624.

  • CVE-2010-2830Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    The IGMPv3 implementation in Cisco IOS 12.2, 12.3, 12.4, and 15.0 and IOS XE 2.5.x before 2.5.2, when PIM is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed IGMP packet, aka Bug ID CSCte14603.

  • CVE-2010-2829Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the H.323 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 2.5.x before 2.5.2 and 2.6.x before 2.6.1, allows remote attackers to cause a denial of service (traceback and device reload) via crafted H.323 packets, aka Bug…

  • CVE-2010-2828Sep 23, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the H.323 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 2.5.x before 2.5.2 and 2.6.x before 2.6.1, allows remote attackers to cause a denial of service (device reload) via crafted H.323 packets, aka Bug ID CSCtc73759.

  • CVE-2010-3489Sep 22, 2010
    Digitalworkroom
    CMS Digital Workroom
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in netautor/napro4/home/login2.php in CMS Digital Workroom (formerly Netautor Professional) 5.5.0 allows remote attackers to inject arbitrary web script or HTML via the goback parameter.

  • CVE-2010-3488Sep 22, 2010
    Houbysoft
    Quickshare
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in QuickShare 1.0 allows remote attackers to read arbitrary files via a ... (triple dot) in the URL.

  • CVE-2010-3487Sep 22, 2010
    Yellosoft
    Pinky
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in YelloSoft Pinky 1.0 for Windows allows remote attackers to read arbitrary files via a %5C (encoded backslash) in the URL.

  • CVE-2010-3486Sep 22, 2010
    SmarterMail
    SmarterMail
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in FileStorageUpload.ashx in SmarterMail 7.1.3876 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slash), (2) %5C (encoded backslash), or (3) %255c (double-encoded backslash) in the name parameter.

  • CVE-2010-3485Sep 22, 2010
    Lightneasy
    Lightneasy
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the userhandle cookie to LightNEasy.php, a different vector than CVE-2008-6593. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2010-3484Sep 22, 2010
    Lightneasy
    Lightneasy
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the handle parameter to LightNEasy.php, a different vector than CVE-2008-6593.

  • CVE-2010-3483Sep 22, 2010
    Primitive CMS
    Primitive CMS
    risk 0.03cvss —epss 0.02

    cms_write.php in Primitive CMS 1.0.9 does not properly restrict access, which allows remote attackers to gain administrative privileges via a direct request. NOTE: this vulnerability can be leveraged to conduct cross-site scripting attacks, as demonstrated using the (1) title,…

  • CVE-2010-3482Sep 22, 2010
    Primitive
    Primitive CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in cms_write.php in Primitive CMS 1.0.9 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) title and (2) menutitle parameters. NOTE: this can be leveraged with CVE-2010-3483 to conduct attacks without…

  • CVE-2010-3481Sep 22, 2010
    Apphp
    PHP Microcms
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) user_name and (2) password variables, possibly related to include/classes/Login.php. NOTE:…

  • CVE-2010-3480Sep 22, 2010
    Apphp
    PHP Microcms
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.