VYPR

CVEs

385,841 total · page 6868 of 7,717

AllCriticalHighKEV
  • CVE-2010-2698Jul 12, 2010
    Sijio
    Community Software
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Sijio Community Software allow remote authenticated users to inject arbitrary web script or HTML via the title parameter when (1) editing a new blog, (2) adding an album, or (3) editing an album. NOTE: the provenance of…

  • CVE-2010-2697Jul 12, 2010
    Sijio
    Community Software
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Sijio Community Software allows remote authenticated users to inject arbitrary web script or HTML via the title parameter when adding a new blog, related to edit_blog/index.php. NOTE: some of these details are obtained from third…

  • CVE-2010-2696Jul 12, 2010
    Sijio
    Community Software
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in gallery/index.php in Sijio Community Software allows remote attackers to execute arbitrary SQL commands via the parent parameter.

  • CVE-2010-2695Jul 12, 2010
    Xlightftpd
    Xlight FTP Server
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the SFTP/SSH2 virtual server in Xlight FTP Server 3.5.0, 3.5.5, and possibly other versions before 3.6 allows remote authenticated users to read, overwrite, or delete arbitrary files via .. (dot dot) sequences in the (1) ls, (2) rm, (3)…

  • CVE-2010-2694Jul 12, 2010
    Redcomponent
    Com Redshop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the redSHOP Component (com_redshop) 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter to index.php.

  • CVE-2010-2448Jul 12, 2010
    Znc
    Znc
    risk 0.00cvss —epss 0.02

    znc.cpp in ZNC before 0.092 allows remote authenticated users to cause a denial of service (crash) by requesting traffic statistics when there is an active unauthenticated connection, which triggers a NULL pointer dereference, as demonstrated using (1) a traffic link in the web…

  • CVE-2010-0832Jul 12, 2010
    Ubuntu
    pam_motd
    risk 0.03cvss —epss 0.01

    pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home…

  • CVE-2010-2692Jul 12, 2010
    2daybiz
    Custom T Shirt Design Script
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in 2daybiz Custom T-Shirt Design Script allows remote attackers to inject arbitrary web script or HTML via a review comment.

  • CVE-2010-2691Jul 12, 2010
    2daybiz
    Custom T Shirt Design Script
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in 2daybiz Custom T-Shirt Design Script allow remote attackers to execute arbitrary SQL commands via the (1) sbid parameter to products_details.php, (2) pid parameter to products/products.php, and (3) designid parameter to designview.php.

  • CVE-2010-2690Jul 12, 2010
    Jooforge
    Com Gamesbox
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JOOFORGE Gamesbox (com_gamesbox) component 1.0.2, and possibly earlier, for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a consoles action to index.php.

  • CVE-2010-2689Jul 12, 2010
    Internetdm
    Webdm CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in cont_form.php in Internet DM WebDM CMS allows remote attackers to execute arbitrary SQL commands via the cf_id parameter.

  • CVE-2010-2688Jul 12, 2010
    Site2nite
    Boat Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in detail.asp in Site2Nite Boat Classifieds allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2010-2687Jul 12, 2010
    Site2nite
    Boat Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in printdetail.asp in Site2Nite Boat Classifieds allows remote attackers to execute arbitrary SQL commands via the Id parameter.

  • CVE-2010-2686Jul 12, 2010
    Topmanage
    Olk Module
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in clientes.asp in the TopManage OLK module 1.91.30 for SAP allow remote attackers to execute arbitrary SQL commands via the (1) PriceFrom, (2) PriceTo, and (3) InvFrom parameters, as reachable from olk/c_p/searchCart.asp, and other…

  • CVE-2010-2685Jul 12, 2010
    Customerparadigm
    Pagedirector CMS
    risk 0.03cvss —epss 0.02

    siteadmin/adduser.php in Customer Paradigm PageDirector CMS does not properly restrict access, which allows remote attackers to bypass intended restrictions and add administrative users via a direct request.

  • CVE-2010-2684Jul 12, 2010
    Customerparadigm
    Pagedirector CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Customer Paradigm PageDirector CMS allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-2683Jul 12, 2010
    Customerparadigm
    Pagedirector CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in result.php in Customer Paradigm PageDirector CMS allows remote attackers to execute arbitrary SQL commands via the sub_catid parameter.

  • CVE-2010-2682Jul 12, 2010
    Joomla
    Realtyna Translator
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in the Realtyna Translator (com_realtyna) component 1.0.15 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-2681Jul 12, 2010
    Joomla
    SEF404x (com_sef)
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in the SEF404x (com_sef) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig.absolute.path parameter to index.php.

  • CVE-2010-2680Jul 12, 2010
    Jextensions
    JE Section/Property Finder
    risk 0.03cvss —epss 0.05

    Directory traversal vulnerability in the JExtensions JE Section/Property Finder (jesectionfinder) component for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the view parameter to index.php.

  • CVE-2010-2489Jul 12, 2010
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.00

    Buffer overflow in Ruby 1.9.x before 1.9.1-p429 on Windows might allow local users to gain privileges via a crafted ARGF.inplace_mode value that is not properly handled when constructing the filenames of the backup files.

  • CVE-2009-4935Jul 12, 2010
    Online Guestbook Pro
    ogp_show.php
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ogp_show.php in Online Guestbook Pro allows remote attackers to execute arbitrary SQL commands via the display parameter.

  • CVE-2009-4934Jul 12, 2010
    Esoftpro
    Online Photo Pro
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Online Photo Pro 2.0 allows remote attackers to inject arbitrary web script or HTML via the section parameter.

  • CVE-2009-4933Jul 12, 2010
    EZ Webitor
    EZ Webitor
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.php in EZ Webitor allow remote attackers to execute arbitrary SQL commands via the (1) txtUserId (Username) and (2) txtPassword (Password) parameters. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4932Jul 12, 2010
    Mpesch3.de1
    1by1
    risk 0.03cvss —epss 0.04

    Stack-based buffer overflow in 1by1 1.67 (aka 1.6.7.0) allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .m3u playlist file.

  • CVE-2009-4931Jul 12, 2010
    Groovy Media Player
    Groovy Media Player
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in Groovy Media Player 1.1.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .m3u playlist file.

  • CVE-2009-4930Jul 12, 2010
    Ellucian
    Banner Student
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the twbkwbis.P_SecurityQuestion (aka Change Security Question) page in SunGard Banner Student System 7.4 allows remote attackers to inject arbitrary web script or HTML via the New Question field.

  • CVE-2009-4929Jul 12, 2010
    TotalCalendar
    TotalCalendar
    risk 0.03cvss —epss 0.02

    admin/manage_users.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrary passwords via the newPW1 and newPW2 parameters.

  • CVE-2009-4928Jul 12, 2010
    TotalCalendar
    TotalCalendar
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in config.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter, a different vector than CVE-2006-1922 and CVE-2006-7055.

  • CVE-2009-4927Jul 12, 2010
    WB News
    WBNews
    risk 0.03cvss —epss 0.02

    WB News 2.1.2 allows remote attackers to bypass authentication and gain administrative access via a modified WBNEWS cookie, as demonstrated by setting this cookie to 1.

  • CVE-2009-4926Jul 12, 2010
    Esoftpro
    Online Contact Manager
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Online Contact Manager (formerly EContact PRO) 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) showGroup parameter to (a) index.php and the (2) id parameter to (b) view.php, (c) email.php, (d)…

  • CVE-2009-4925Jul 12, 2010
    Creasito
    Creasito E Commerce Content Manager
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Portale e-commerce Creasito (aka creasito e-commerce content manager) 1.3.16, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the username parameter to (1) admin/checkuser.php and (2)…

  • CVE-2010-2679Jul 8, 2010
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Weblinks (com_weblinks) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.

  • CVE-2010-2678Jul 8, 2010
    Joomla
    xmap
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in xmap (com_xmap) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.

  • CVE-2010-2677Jul 8, 2010
    Openwebanalytics
    Open Web Analytics
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in mw_plugin.php in Open Web Analytics (OWA) 1.2.3, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the IP parameter. NOTE: some of these details are…

  • CVE-2010-2676Jul 8, 2010
    Openwebanalytics
    Open Web Analytics
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in index.php in Open Web Analytics (OWA) 1.2.3 might allow remote attackers to read arbitrary files via directory traversal sequences in the (1) owa_action and (2) owa_do parameters.

  • CVE-2010-2675Jul 8, 2010
    TSOKA
    CMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in TSOKA:CMS 1.1, 1.9, and 2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter in an articolo action.

  • CVE-2010-2674Jul 8, 2010
    Siteserver
    CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in TSOKA:CMS 1.1, 1.9, and 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in an articolo action.

  • CVE-2010-2673Jul 8, 2010
    Devana
    Devana
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in profile_view.php in Devana 1.6.6 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-2672Jul 8, 2010
    Ez
    Ez Publish
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in eZ Publish 3.7.0 through 4.2.0 allow remote attackers to execute arbitrary SQL commands via the (1) SectionID and (2) SearchTimestamp parameters to the search feature and the (3) SearchContentClassAttributeID parameter to the…

  • CVE-2010-2671Jul 8, 2010
    Ez
    Ez Publish
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in advancedsearch.php in eZ Publish 3.7.0 through 4.2.0 allows remote attackers to inject arbitrary web script or HTML via the subTreeItem parameter.

  • CVE-2010-2670Jul 8, 2010
    Brotherscripts
    Recipe Website
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in recipedetail.php in BrotherScripts Recipe Website allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-2669Jul 8, 2010
    Orbis
    Orbis CMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin/editors/text/editor-body.php in Orbis CMS 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2010-2668Jul 8, 2010
    Adaptive Micro Systems
    ALPHA Ethernet Adapter II Web-Manager
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Adaptive Micro Systems ALPHA Ethernet Adapter II Web-Manager 3.40.2 allows remote attackers to bypass authentication and read or write configuration files via unknown vectors.

  • CVE-2010-2494Jul 8, 2010
    Bogofilter
    Bogofilter
    risk 0.00cvss —epss 0.03

    Multiple buffer underflows in the base64 decoder in base64.c in (1) bogofilter and (2) bogolexer in bogofilter before 1.2.2 allow remote attackers to cause a denial of service (heap memory corruption and application crash) via an e-mail message with invalid base64 data that…

  • CVE-2010-2221Jul 8, 2010
    Iscsitarget
    Iscsitarget
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in the iSNS implementation in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) before 1.0.6, (2) iSCSI Enterprise Target (aka iscsitarget or IET) 1.4.20.1 and earlier, and (3) Generic SCSI Target Subsystem for Linux (aka SCST or…

  • CVE-2010-1574Jul 8, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.05

    IOS 12.2(52)SE and 12.2(52)SE1 on Cisco Industrial Ethernet (IE) 3000 series switches has (1) a community name of public for RO access and (2) a community name of private for RW access, which makes it easier for remote attackers to modify the configuration or obtain potentially…

  • CVE-2010-2666Jul 8, 2010
    Opera
    Opera
    risk 0.00cvss —epss 0.05

    Opera before 10.54 on Windows and Mac OS X does not properly enforce permission requirements for widget filesystem access and directory selection, which allows user-assisted remote attackers to create or modify arbitrary files, and consequently execute arbitrary code, via widget…

  • CVE-2010-2665Jul 8, 2010
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Opera before 10.54 on Windows and Mac OS X, and before 10.11 on UNIX platforms, allows remote attackers to inject arbitrary web script or HTML via a data: URI, related to incorrect detection of the "opening site."

  • CVE-2010-2664Jul 8, 2010
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via certain HTML content that has an unclosed SPAN element with absolute positioning.