VYPR

CVEs

385,854 total · page 6863 of 7,718

AllCriticalHighKEV
  • CVE-2010-2713Aug 5, 2010
    Nalin Dahyabhai
    Vte
    risk 0.00cvss —epss 0.03

    The vte_sequence_handler_window_manipulation function in vteseq.c in libvte (aka libvte9) in VTE 0.25.1 and earlier, as used in gnome-terminal, does not properly handle escape sequences, which allows remote attackers to execute arbitrary commands or obtain potentially sensitive…

  • CVE-2010-2709Aug 5, 2010
    Microfocus
    OpenView Network Node Manager
    risk 0.06cvss —epss 0.42

    Stack-based buffer overflow in webappmon.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a long OvJavaLocale value in a cookie.

  • CVE-2010-2547HigAug 5, 2010
    Gnupg
    Gnupg
    risk 0.53cvss 8.1epss 0.05

    Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled…

  • CVE-2009-2696Aug 5, 2010
    Apache
    Tomcat
    risk 0.00cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via…

  • CVE-2010-2933Aug 5, 2010
    AV Scripts
    AV Arcade
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in AV Scripts AV Arcade 3 allows remote attackers to execute arbitrary SQL commands via the ava_code cookie to the "main page," related to index.php and the login task.

  • CVE-2010-2932Aug 5, 2010
    Barcodewiz
    BarCodeWiz
    risk 0.04cvss —epss 0.07

    Buffer overflow in BarCodeWiz BarCode 3.29 ActiveX control (BarcodeWiz.dll) allows remote attackers to execute arbitrary code via a long argument to the LoadProperties method.

  • CVE-2010-2931Aug 5, 2010
    SigPlus
    SigPlus Pro
    risk 0.04cvss —epss 0.09

    Stack-based buffer overflow in SigPlus Pro 3.74 ActiveX control allows remote attackers to execute arbitrary code via a long eighth argument (HexString) to the LCDWriteString method.

  • CVE-2010-2790Aug 5, 2010
    Zabbix
    Zabbix
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the formatQuery function in frontends/php/include/classes/class.curl.php in Zabbix before 1.8.3rc1 allow remote attackers to inject arbitrary web script or HTML via the (1) filter_set, (2) show_details, (3) filter_rst, or…

  • CVE-2010-2725Aug 5, 2010
    Barnowl
    Barnowl
    risk 0.00cvss —epss 0.03

    BarnOwl before 1.6.2 does not check the return code of calls to the (1) ZPending and (2) ZReceiveNotice functions in libzephyr, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.

  • CVE-2010-1871HigKEVAug 5, 2010
    NetApp
    Oncommand Balance
    risk 0.79cvss 8.8epss 0.83

    JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only…

  • CVE-2010-2971Aug 5, 2010
    Mikmod
    libmikmod
    risk 0.00cvss —epss 0.04

    loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker…

  • CVE-2010-2970Aug 5, 2010
    Moinmo
    Moinmoin
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue…

  • CVE-2010-2969Aug 5, 2010
    Moinmo
    Moinmoin
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, and 1.9.x before 1.9.3, allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/LikePages.py, (2) action/chart.py, and (3) action/userprofile.py, a…

  • CVE-2010-2968Aug 5, 2010
    Windriver
    Vxworks
    risk 0.00cvss —epss 0.01

    The FTP daemon in Wind River VxWorks does not close the TCP connection after a number of failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.

  • CVE-2010-2967Aug 5, 2010
    Windriver
    Vxworks
    risk 0.00cvss —epss 0.02

    The loginDefaultEncrypt algorithm in loginLib in Wind River VxWorks before 6.9 does not properly support a large set of distinct possible passwords, which makes it easier for remote attackers to obtain access via a (1) telnet, (2) rlogin, or (3) FTP session.

  • CVE-2010-2966Aug 5, 2010
    Windriver
    Vxworks
    risk 0.00cvss —epss 0.02

    The INCLUDE_SECURITY functionality in Wind River VxWorks 6.x, 5.x, and earlier uses the LOGIN_USER_NAME and LOGIN_USER_PASSWORD (aka LOGIN_PASSWORD) parameters to create hardcoded credentials, which makes it easier for remote attackers to obtain access via a (1) telnet, (2)…

  • CVE-2010-2965CriAug 5, 2010
    Windriver
    Vxworks
    risk 0.67cvss 9.8epss 0.47

    The WDB target agent debug service in Wind River VxWorks 6.x, 5.x, and earlier, as used on the Rockwell Automation 1756-ENBT series A with firmware 3.2.6 and 3.6.1 and other products, allows remote attackers to read or modify arbitrary memory locations, perform function calls,…

  • CVE-2010-2860Aug 5, 2010
    EMC Corporation
    Celerra Network Attached Storage
    risk 0.03cvss —epss 0.04

    The EMC Celerra Network Attached Storage (NAS) appliance accepts external network traffic to IP addresses intended for an intranet network within the appliance, which allows remote attackers to read, create, or modify arbitrary files in the user data directory via NFS requests.

  • CVE-2010-2546Aug 5, 2010
    Mikmod
    libmikmod
    risk 0.01cvss —epss 0.07

    Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file, related to panpts, pitpts, and…

  • CVE-2010-2526Aug 5, 2010
    Heinz Mauelshagen
    Lvm2
    risk 0.00cvss —epss 0.00

    The cluster logical volume manager daemon (clvmd) in lvm2-cluster in LVM2 before 2.02.72, as used in Red Hat Global File System (GFS) and other products, does not verify client credentials upon a socket connection, which allows local users to cause a denial of service (daemon…

  • CVE-2010-2487Aug 5, 2010
    Moinmo
    Moinmoin
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py,…

  • CVE-2010-2786Aug 2, 2010
    Piwik
    Piwik
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in Piwik 0.6 through 0.6.3 allows remote attackers to include arbitrary local files and possibly have unspecified other impact via directory traversal sequences in a crafted data-renderer request.

  • CVE-2010-2633Aug 2, 2010
    EMC Corporation
    Disk Library
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in EMC Disk Library (EDL) before 3.2.7, 3.3.x before 3.3.2 epatch 8, and 4.0.x before 4.0.1 epatch 4 allows remote attackers to cause a denial of service (communication-module crash) by sending a crafted message through TCP.

  • CVE-2010-2540Aug 2, 2010
    MapServer
    Mapserver
    risk 0.00cvss —epss 0.04

    mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI command-line arguments that were intended for debugging, which allows remote attackers to have an unspecified impact via crafted arguments.

  • CVE-2010-2539Aug 2, 2010
    MapServer
    Mapserver
    risk 0.00cvss —epss 0.00

    Buffer overflow in the msTmpFile function in maputil.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 allows local users to cause a denial of service via vectors involving names of temporary files.

  • CVE-2010-2930Aug 2, 2010
    Hsolink
    hsolink
    risk 0.00cvss —epss 0.00

    Multiple stack-based buffer overflows in hsolinkcontrol in hsolink 1.0.118 allow local users to gain privileges via long command-line arguments, a different vulnerability than CVE-2010-1671. NOTE: some of these details are obtained from third party information.

  • CVE-2010-2929Aug 2, 2010
    Hsolink
    hsolink
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in hsolinkcontrol in hsolink 1.0.118 allows local users to gain privileges via a modified PATH environment variable, which is used during execution of the (1) route, (2) mv, and (3) cp programs, a different vulnerability than CVE-2010-1671.

  • CVE-2010-2536Aug 2, 2010
    Rekonq
    rekonq
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in rekonq 0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) a URL associated with a nonexistent domain name, related to webpage.cpp, aka a "universal XSS" issue; (2) unspecified vectors…

  • CVE-2010-1671Aug 2, 2010
    Hsolink
    hsolink
    risk 0.00cvss —epss 0.00

    hsolinkcontrol in hsolink 1.0.118 allows local users to gain privileges via shell metacharacters in command-line arguments, as demonstrated by the second argument in a down action.

  • CVE-2009-4976Aug 2, 2010
    Urs Wolfer
    Kwebkitpart
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in webkitpart.cpp in kwebkitpart allows remote attackers to inject arbitrary web script or HTML via a URL associated with a nonexistent domain name, related to a "universal XSS" issue, a similar vulnerability to CVE-2010-2536.

  • CVE-2009-4975Aug 2, 2010
    Qt
    QtDemoBrowser
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in webview.cpp in QtDemoBrowser allows remote attackers to inject arbitrary web script or HTML via a URL associated with a nonexistent domain name, related to a "universal XSS" issue, a similar vulnerability to CVE-2010-2536.

  • CVE-2010-2927Aug 2, 2010
    IBM
    Tivoli Directory Server
    risk 0.00cvss —epss 0.02

    The slapi_printmessage function in IBM Tivoli Directory Server (ITDS) before 6.0.0.8-TIV-ITDS-IF0006 allows remote attackers to cause a denial of service (daemon crash) via multiple incomplete DIGEST-MD5 connection attempts.

  • CVE-2010-2785Aug 2, 2010
    Kvirc
    Kvirc
    risk 0.04cvss —epss 0.08

    The IRC Protocol component in KVIrc 3.x and 4.x before r4693 does not properly handle \ (backslash) characters, which allows remote authenticated users to execute arbitrary CTCP commands via vectors involving \r and \40 sequences, a different vulnerability than CVE-2010-2451 and…

  • CVE-2010-2320Aug 2, 2010
    Bozotic HTTP Server
    bozohttpd
    risk 0.00cvss —epss 0.02

    bozotic HTTP server (aka bozohttpd) before 20100621 allows remote attackers to list the contents of home directories, and determine the existence of user accounts, via multiple requests for URIs beginning with /~ sequences.

  • CVE-2010-2195Aug 2, 2010
    Bozotic
    bozohttpd
    risk 0.00cvss —epss 0.02

    bozotic HTTP server (aka bozohttpd) 20090522 through 20100512 allows attackers to cause a denial of service via vectors related to a "wrong code generation interaction with GCC."

  • CVE-2010-1794Aug 2, 2010
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    The webdav_mount function in webdav_vfsops.c in the WebDAV kernel extension (aka webdav_fs.kext) for Mac OS X 10.6 allows local users to cause a denial of service (panic) via a mount request with a large integer in the pa_socket_namelen field.

  • CVE-2010-1518Aug 2, 2010
    Gigabyte
    Dldrv2 Activex Control
    risk 0.00cvss —epss 0.03

    Array index error in the SetDLInfo method in the GIGABYTE Dldrv2 ActiveX control 1.4.206.11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via the item argument.

  • CVE-2010-1517Aug 2, 2010
    Gigabyte
    Dldrv2 Activex Control
    risk 0.00cvss —epss 0.02

    The GIGABYTE Dldrv2 ActiveX control 1.4.206.11 allows remote attackers to (1) download arbitrary programs onto a client system, and execute these programs, via vectors involving the dl method; and (2) download arbitrary programs onto a client system via vectors involving the…

  • CVE-2009-4896Aug 2, 2010
    Mlmmj
    Mlmmj
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in the mlmmj-php-admin web interface for Mailing List Managing Made Joyful (mlmmj) 1.2.15 through 1.2.17 allow remote authenticated users to overwrite, create, or delete arbitrary files, or determine the existence of arbitrary…

  • CVE-2010-2926Jul 30, 2010
    Solucija
    Snews
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in sNews 1.7 allows remote attackers to execute arbitrary SQL commands via the category parameter.

  • CVE-2010-2925Jul 30, 2010
    Freeway CMS
    Freeway CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Freeway CMS 1.4.3.210 allows remote attackers to execute arbitrary SQL commands via the ecPath parameter.

  • CVE-2010-2924Jul 30, 2010
    WordPress
    Mylinksdump
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the url parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-2923Jul 30, 2010
    Joomla
    com_youtube
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the YouTube (com_youtube) component 1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id_cate parameter to index.php.

  • CVE-2010-2922Jul 30, 2010
    AKY
    AKY Blog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.asp in AKY Blog allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-2921Jul 30, 2010
    Joomla
    Golf Course Guide
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Golf Course Guide (com_golfcourseguide) component 0.9.6.0 beta and 1 beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a golfcourses action to index.php.

  • CVE-2010-2920Jul 30, 2010
    Foobla
    Com Foobla Suggestions
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in the Foobla Suggestions (com_foobla_suggestions) component 1.5.1.2 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.

  • CVE-2010-2919Jul 30, 2010
    Joomla
    StaticXT
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the StaticXT (com_staticxt) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

  • CVE-2010-2918Jul 30, 2010
    Joomla
    Visites
    risk 0.04cvss —epss 0.14

    PHP remote file inclusion vulnerability in core/include/myMailer.class.php in the Visites (com_joomla-visites) component 1.1 RC2 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2010-2917Jul 30, 2010
    AJ Square
    Aj Article
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in AJ Square AJ Article 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) emailid, (2) fname, (3) lname, (4) company, (5) address1, (6) address2, (7) city, (8) state, (9) zipcode, (10)…

  • CVE-2010-2916Jul 30, 2010
    AJ Square
    Aj Hyip
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.php in AJ Square AJ HYIP MERIDIAN allows remote attackers to execute arbitrary SQL commands via the id parameter.