VYPR

CVEs

385,868 total · page 6852 of 7,718

AllCriticalHighKEV
  • CVE-2010-3479Sep 22, 2010
    Boutikone
    Boutikone
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in list.php in BoutikOne 1.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2009-5003Sep 22, 2010
    Softbizscripts
    Banner Exchange Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in click.php in e-soft24 Banner Exchange Script 1.0 allows remote attackers to execute arbitrary SQL commands via the targetid parameter.

  • CVE-2010-3332Sep 22, 2010
    Microsoft
    .net Framework
    risk 0.08cvss —epss 0.68

    Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View…

  • CVE-2010-3314Sep 22, 2010
    Egroupware
    Egroupware
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in login.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to inject arbitrary web script or HTML via the lang…

  • CVE-2010-3313Sep 22, 2010
    Egroupware
    Egroupware
    risk 0.04cvss —epss 0.09

    phpgwapi/js/fckeditor/editor/dialog/fck_spellerpages/spellerpages/serverscripts/spellchecker.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to execute…

  • CVE-2010-3301Sep 22, 2010
    Linux
    Kernel
    risk 0.03cvss —epss 0.04

    The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by…

  • CVE-2010-3477Sep 21, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The tcf_act_police_dump function in net/sched/act_police.c in the actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc4 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive…

  • CVE-2010-3094Sep 21, 2010
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.18 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) an action description, (2) an action message, (3) a node, or (4) a taxonomy term, related to the…

  • CVE-2010-3093Sep 21, 2010
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    The comment module in Drupal 5.x before 5.23 and 6.x before 6.18 allows remote authenticated users with certain privileges to bypass intended access restrictions and reinstate removed comments via a crafted URL, related to an "unpublishing bypass" issue.

  • CVE-2010-3092Sep 21, 2010
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    The upload module in Drupal 5.x before 5.23 and 6.x before 6.18 does not properly support case-insensitive filename handling in a database configuration, which allows remote authenticated users to bypass the intended restrictions on downloading a file by uploading a different…

  • CVE-2010-1820Sep 21, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Apple Filing Protocol (AFP) Server in Apple Mac OS X 10.6.x through 10.6.4 does not properly handle errors, which allows remote attackers to bypass the password requirement for shared-folder access by leveraging knowledge of a valid account name.

  • CVE-2010-0781Sep 21, 2010
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.33 allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted URL.

  • CVE-2010-3080Sep 21, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Double free vulnerability in the snd_seq_oss_open function in sound/core/seq/oss/seq_oss_init.c in the Linux kernel before 2.6.36-rc4 might allow local users to cause a denial of service or possibly have unspecified other impact via an unsuccessful attempt to open the…

  • CVE-2010-3078MedSep 21, 2010
    Linux
    Kernel
    risk 0.36cvss 5.5epss 0.00

    The xfs_ioc_fsgetxattr function in fs/xfs/linux-2.6/xfs_ioctl.c in the Linux kernel before 2.6.36-rc4 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an ioctl call.

  • CVE-2010-3067Sep 21, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Integer overflow in the do_io_submit function in fs/aio.c in the Linux kernel before 2.6.36-rc4-next-20100915 allows local users to cause a denial of service or possibly have unspecified other impact via crafted use of the io_submit system call.

  • CVE-2010-2942MedSep 21, 2010
    Linux
    Kernel
    risk 0.36cvss 5.5epss 0.00

    The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump operations, which allows local users to obtain potentially sensitive information from kernel memory…

  • CVE-2010-3476Sep 20, 2010
    OTRS
    Otrs
    risk 0.00cvss —epss 0.03

    Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly handle the matching of Perl regular expressions against HTML e-mail messages, which allows remote attackers to cause a denial of service (CPU consumption) via a large message, a…

  • CVE-2010-3475Sep 20, 2010
    IBM
    Db2
    risk 0.00cvss —epss 0.03

    IBM DB2 9.7 before FP3 does not properly enforce privilege requirements for execution of entries in the dynamic SQL cache, which allows remote authenticated users to bypass intended access restrictions by leveraging the cache to execute an UPDATE statement contained in a…

  • CVE-2010-3474Sep 20, 2010
    IBM
    Db2
    risk 0.00cvss —epss 0.03

    IBM DB2 9.7 before FP3 does not perform the expected drops or invalidations of dependent functions upon a loss of privileges by the functions' owners, which allows remote authenticated users to bypass intended access restrictions via calls to these functions, a different…

  • CVE-2010-3473Sep 20, 2010
    IBM
    Filenet P8 Application Engine
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-021 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2010-3472Sep 20, 2010
    IBM
    Filenet P8 Application Engine
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-021 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-3471Sep 20, 2010
    IBM
    Filenet P8 Application Engine
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 4.0.2.x before 4.0.2.7-P8AE-FP007 allows remote attackers to hijack web sessions via unspecified vectors.

  • CVE-2010-3470Sep 20, 2010
    IBM
    Filenet P8 Application Engine
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-021 and 4.0.2.x before 4.0.2.7-P8AE-FP007 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-5002Sep 20, 2010
    IBM
    Filenet P8 Application Engine
    risk 0.00cvss —epss 0.01

    The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 4.0.2.x before 4.0.2.1-P8AE-FP001 does not record Get Content Failure Audit events, which might allow remote attackers to attempt content access without detection.

  • CVE-2009-5001Sep 20, 2010
    IBM
    Filenet P8 Application Engine
    risk 0.00cvss —epss 0.01

    The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 4.0.2.x before 4.0.2.2-P8AE-FP002 grants a document's Creator-Owner full control over an annotation object, even if the default instance security has changed, which might allow remote authenticated…

  • CVE-2009-5000Sep 20, 2010
    IBM
    Filenet P8 Application Engine
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 4.0.2.x before 4.0.2.3-P8AE-FP003 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to .jsp pages.

  • CVE-2009-4999Sep 20, 2010
    IBM
    Filenet P8 Application Engine
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-016 allows remote attackers to inject arbitrary web script or HTML via the Name field.

  • CVE-2009-4998Sep 20, 2010
    IBM
    Filenet P8 Application Engine
    risk 0.00cvss —epss 0.01

    The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-019 and 4.0.2.x before 4.0.2.7-P8AE-FP007, in certain FileTracker configurations, does not apply a security policy to the first document added during a session, which might allow…

  • CVE-2008-7261Sep 20, 2010
    IBM
    Filenet P8 Application Engine
    risk 0.00cvss —epss 0.00

    The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-010 records DEBUG messages containing user credentials in the log4j.xml file, which might allow local users to obtain sensitive information by reading this file.

  • CVE-2006-7242Sep 20, 2010
    IBM
    Filenet P8 Application Engine
    risk 0.00cvss —epss 0.01

    The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-001 does not ensure that the AE Administrator role is present for Site Preferences modifications, which allows remote authenticated users to bypass intended access restrictions via…

  • CVE-2006-7241Sep 20, 2010
    IBM
    Filenet P8 Application Engine
    risk 0.00cvss —epss 0.01

    The Image Viewer component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-002 removes a user from an ACL when the user is denied all permissions for an annotation, which might allow remote authenticated users to bypass intended access restrictions in…

  • CVE-2010-3262Sep 20, 2010
    Flock
    Flock
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Flock Browser 3.x before 3.0.0.4114 allows remote attackers to inject arbitrary web script or HTML via a crafted RSS feed.

  • CVE-2010-3200Sep 20, 2010
    Microsoft
    Word
    risk 0.01cvss —epss 0.11

    MSO.dll in Microsoft Word 2003 SP3 11.8326.11.8324 allows remote attackers to cause a denial of service (NULL pointer dereference and multiple-instance application crash) via a crafted buffer in a Word document, as demonstrated by word_crash_11.8326.8324_poc.doc.

  • CVE-2010-3072Sep 20, 2010
    Squid Cache
    Squid
    risk 0.05cvss —epss 0.60

    The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.

  • CVE-2010-2080Sep 20, 2010
    OTRS
    Otrs
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-3467Sep 17, 2010
    E Xoopport
    Samsara
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in modules/sections/index.php in E-Xoopport Samsara 3.1 and earlier, when the Tutorial module is enabled, allows remote attackers to execute arbitrary SQL commands via the secid parameter in a listarticles action.

  • CVE-2010-3466Sep 17, 2010
    Netartmedia
    Iboutique
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in the hosted_signup module in NetArt Media iBoutique.MALL 1.2 allows remote attackers to inject arbitrary web script or HTML via the tmpl parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-3465Sep 17, 2010
    XSE
    Shopping Cart
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in XSE Shopping Cart 1.5.2.1 and 1.5.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to Default.aspx and the (2) type parameter to SearchResults.aspx.

  • CVE-2010-3464Sep 17, 2010
    Santafox
    Santafox
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin/manager_users.class.php in SantaFox 2.02, and possibly earlier, allows remote attackers to hijack the authentication of administrators for requests, as demonstrated by adding administrative users via the save_admin action…

  • CVE-2010-3463Sep 17, 2010
    Santafox
    Santafox
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in modules/search/search.class.php in SantaFox 2.02, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the search parameter to search.html.

  • CVE-2010-3462Sep 17, 2010
    Mollify
    Mollify
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in backend/plugin/Registration/index.php in Mollify 1.6, 1.6.5.5, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the confirm parameter. NOTE: some of these details are obtained from third…

  • CVE-2010-3461Sep 17, 2010
    Endonesia
    eNdonesia Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Publisher module in eNdonesia 8.4 allows remote attackers to execute arbitrary SQL commands via the artid parameter in a printarticle action to mod.php, a different vector than CVE-2007-3394.

  • CVE-2010-3460Sep 17, 2010
    Gecad Technologies
    Mail Server
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in the HTTP interface in AXIGEN Mail Server 7.4.1 for Windows allows remote attackers to read arbitrary files via a %5C (encoded backslash) in the URL.

  • CVE-2010-3459Sep 17, 2010
    Gecad Technologies
    Mail Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Ajax WebMail interface in AXIGEN Mail Server before 7.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-3458Sep 17, 2010
    Getsymphony
    Symphony
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in lib/toolkit/events/event.section.php in Symphony CMS 2.0.7 and 2.1.1 allows remote attackers to execute arbitrary SQL commands via the send-email[recipient] parameter to about/. NOTE: some of these details are obtained from third party information.

  • CVE-2010-3457Sep 17, 2010
    Getsymphony
    Symphony
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.0.7 and 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) fields[website] parameter in the post comments feature in articles/a-primer-to-symphony-2s-default-theme/ or (2)…

  • CVE-2010-3456Sep 17, 2010
    Energyscripts
    Simple Download
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in download.php in EnergyScripts (ES) Simple Download 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

  • CVE-2010-3455Sep 17, 2010
    AChecker
    AChecker
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in AChecker 1.0 allows remote attackers to inject arbitrary web script or HTML via the uri parameter.

  • CVE-2010-3012Sep 17, 2010
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this issue was originally assigned CVE-2010-3010 due to a CNA error.

  • CVE-2010-3324Sep 17, 2010
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.25

    The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, allows remote attackers to bypass the…