VYPR

CVEs

385,798 total · page 6878 of 7,716

AllCriticalHighKEV
  • CVE-2010-1848Jun 8, 2010
    MySQL
    MySQL
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to bypass intended table grants to read field definitions of arbitrary tables, and on 5.1 to read or delete content of arbitrary tables, via a .. (dot dot) in a…

  • CVE-2010-1649Jun 8, 2010
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the back end in Joomla! 1.5 through 1.5.17 allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to "various administrator screens," possibly the search parameter in…

  • CVE-2010-1648Jun 8, 2010
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that (1) create accounts or (2) reset passwords, related to the…

  • CVE-2010-1647Jun 8, 2010
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) strings that are processed as script by Internet Explorer.

  • CVE-2010-1636Jun 8, 2010
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the btrfs functionality in the Linux kernel 2.6.29 through 2.6.32, and possibly other versions, does not ensure that a cloned file descriptor has been opened for reading, which allows local users to read sensitive information…

  • CVE-2010-2156Jun 7, 2010
    Isc
    DHCP
    risk 0.09cvss —epss 0.76

    ISC DHCP 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1 allows remote attackers to cause a denial of service (server exit) via a zero-length client ID.

  • CVE-2010-2058Jun 7, 2010
    Prelude Technologies
    Prewikka
    risk 0.00cvss —epss 0.00

    setup.py in Prewikka 0.9.14 installs prewikka.conf with world-readable permissions, which allows local users to obtain the SQL database password.

  • CVE-2010-2053Jun 7, 2010
    Emesene
    Emesene
    risk 0.00cvss —epss 0.00

    emesenelib/ProfileManager.py in emesene before 1.6.2 allows local users to overwrite arbitrary files via a symlink attack on the emsnpic temporary file.

  • CVE-2010-2158Jun 7, 2010
    Drupal
    Storm
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Storm module 5.x and 6.x before 6.x-1.33 for Drupal allow remote authenticated users, with certain module privileges, to inject arbitrary web script or HTML via the (1) fullname, (2) phone, or (3) im parameter in a…

  • CVE-2010-2157Jun 7, 2010
    Ca Technologies, A Broadcom Company
    ARCserve Backup
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in CA ARCserve Backup r11.5 SP4, r12.0 SP2, and r12.5 SP1 on Windows allows local users to obtain sensitive information via unknown vectors.

  • CVE-2010-2024Jun 7, 2010
    Exim
    Exim
    risk 0.00cvss —epss 0.00

    transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.

  • CVE-2010-2023Jun 7, 2010
    Exim
    Exim
    risk 0.00cvss —epss 0.00

    transports/appendfile.c in Exim before 4.72, when a world-writable sticky-bit mail directory is used, does not verify the st_nlink field of mailbox files, which allows local users to cause a denial of service or possibly gain privileges by creating a hard link to another user's…

  • CVE-2010-1963Jun 7, 2010
    Microfocus
    Servicecenter
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in HP ServiceCenter allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1962Jun 7, 2010
    Microfocus
    StorageWorks Storage Mirroring
    risk 0.01cvss —epss 0.12

    Unspecified vulnerability in HP StorageWorks Storage Mirroring 5 before 5.2.1.870.0 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2010-1904Jun 7, 2010
    EMC Corporation
    Rsa Key Manager Client
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in EMC RSA Key Manager (RKM) C Client 1.5.x allows user-assisted remote attackers to execute arbitrary SQL commands via the metadata section of encrypted key data.

  • CVE-2010-1646Jun 7, 2010
    Todd Miller
    Sudo
    risk 0.00cvss —epss 0.00

    The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable.

  • CVE-2010-1439Jun 7, 2010
    Red Hat
    Yum Rhn Plugin
    risk 0.00cvss —epss 0.00

    yum-rhn-plugin in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Enterprise Linux (RHEL) 5 and Fedora uses world-readable permissions for the /var/spool/up2date/loginAuth.pkl file, which allows local users to access the Red Hat Network profile, and possibly…

  • CVE-2010-2155Jun 3, 2010
    Zonecheck
    Zonecheck
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in zc/publisher/html.rb in ZoneCheck 2.1.0 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) xmlnode.value, (2) zc-error text, (3) $zc_version, (4) domainname in a zc-title row, different…

  • CVE-2010-2154Jun 3, 2010
    Cmscout
    Cmscout
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Search Site in CMScout 2.09, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-2153Jun 3, 2010
    TCExam
    TCExam
    risk 0.04cvss —epss 0.07

    Unrestricted file upload vulnerability in admin/code/tce_functions_tcecode_editor.php in TCExam 10.1.006 and 10.1.007 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in cache/.

  • CVE-2010-2152Jun 3, 2010
    Justsystems
    Ichitaro
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in JustSystems Ichitaro 2004 through 2009, Ichitaro Government 2006 through 2009, and Just School 2008 and 2009 allows remote attackers to execute arbitrary code via unknown vectors related to "product character attribute processing" for a document.

  • CVE-2010-2151Jun 3, 2010
    Fujitsu
    E Pares
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Fujitsu e-Pares V01 L01 V01 L01, L03, L10, L20, L30, and L40 allows remote attackers to hijack the authentication of users for requests that modify "facility reservation data" via unknown vectors.

  • CVE-2010-2150Jun 3, 2010
    Fujitsu
    E Pares
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability Fujitsu e-Pares V01 L01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-2149Jun 3, 2010
    Fujitsu
    E Pares
    risk 0.00cvss —epss 0.02

    Session fixation vulnerability in Fujitsu e-Pares V01 L01, L03, L10, L20, L30 allows remote attackers to hijack web sessions via unspecified vectors.

  • CVE-2010-2148Jun 3, 2010
    Joomla
    My Car
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the My Car (com_mycar) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pagina parameter to index.php.

  • CVE-2010-2147Jun 3, 2010
    Unisoft
    Com Mycar
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the My Car (com_mycar) component 1.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the modveh parameter to index.php.

  • CVE-2010-2146Jun 3, 2010
    Graviton Mediatech
    Visitor Logger
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in banned.php in Visitor Logger allows remote attackers to execute arbitrary PHP code via a URL in the VL_include_path parameter.

  • CVE-2010-2145Jun 3, 2010
    ClearSite
    ClearSite
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in ClearSite Beta 4.50, and possibly other versions, allow remote attackers to execute arbitrary PHP code via a URL in the cs_base_path parameter to (1) docs.php and (2) include/admin/device_admin.php. NOTE: the header.php…

  • CVE-2010-2144Jun 3, 2010
    Zeeways
    Ebay Clone Auction Script
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in signinform.php in Zeeways eBay Clone Auction Script allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-2143Jun 3, 2010
    Getsymphony
    Symphony
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in index.php in Symphony CMS 2.0.7 allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the mode parameter.

  • CVE-2010-1643Jun 3, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    mm/shmem.c in the Linux kernel before 2.6.28-rc3, when strict overcommit is enabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other…

  • CVE-2010-1633Jun 3, 2010
    OpenSSL Project
    OpenSSL
    risk 0.00cvss —epss 0.02

    RSA verification recovery in the EVP_PKEY_verify_recover function in OpenSSL 1.x before 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent attackers to bypass intended key requirements or…

  • CVE-2010-0742Jun 3, 2010
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.08

    The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows context-dependent attackers to modify invalid memory locations or conduct…

  • CVE-2008-7256Jun 3, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    mm/shmem.c in the Linux kernel before 2.6.28-rc8, when strict overcommit is enabled and CONFIG_SECURITY is disabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or…

  • CVE-2010-2142Jun 2, 2010
    Murat Ersoy
    Cyberhost
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in default.asp in Cyberhost allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-2141Jun 2, 2010
    NITRO Web Gallery
    NITRO Web Gallery
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in NITRO Web Gallery allows remote attackers to execute arbitrary SQL commands via the PictureId parameter in an open action.

  • CVE-2010-2140Jun 2, 2010
    Multishopcms
    Multishop CMS
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in itemdetail.php in Multishop CMS allows remote attackers to execute arbitrary SQL commands via the itemid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2010-2139Jun 2, 2010
    Multishopcms
    Multishop CMS
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in pages.php in Multishop CMS allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2009-4882Jun 2, 2010
    Zonecheck
    Zonecheck
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in zc/publisher/html.rb in ZoneCheck 2.0.4-13 and 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the ns parameter to zc.cgi.

  • CVE-2010-2138Jun 2, 2010
    Proman
    ProMan
    risk 0.03cvss —epss 0.04

    Multiple directory traversal vulnerabilities in ProMan 0.1.1 and earlier allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the _SESSION[userLang] parameter to (1) elisttasks.php, (2) managepmanagers.php, (3) manageusers.php,…

  • CVE-2010-2137Jun 2, 2010
    Proman
    ProMan
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in _center.php in ProMan 0.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

  • CVE-2010-2136Jun 2, 2010
    Articlefriendly
    Article Friendly
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in admin/index.php in Article Friendly, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.

  • CVE-2010-2135Jun 2, 2010
    Hazelpress
    Hazelpress
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in login.php in HazelPress Lite 0.0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) password fields.

  • CVE-2010-2134Jun 2, 2010
    HTTP Solution
    Project Man
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in login.php in Project Man 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.

  • CVE-2010-2133Jun 2, 2010
    My Little Forum
    Mylittleforum
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in contact.php in My Little Forum allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2007-2942.

  • CVE-2010-2132Jun 2, 2010
    Open Education System
    OES
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Open Education System (OES) 0.1 beta allow remote attackers to execute arbitrary PHP code via a URL in the CONF_INCLUDE_PATH parameter to (1) forum/admin.php and (2) plotgraph/index.php in admin/modules/modules/, and (3)…

  • CVE-2010-2131Jun 2, 2010
    Mario Matzulla
    Cal
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the Calendar Base (cal) extension before 1.3.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via iCalendar data.

  • CVE-2010-2130Jun 2, 2010
    Arisglobal
    Arisg
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in wflogin.jsp in Aris Global ARISg 5.0 allows remote attackers to inject arbitrary web script or HTML via the errmsg parameter.

  • CVE-2010-2129Jun 1, 2010
    Joomla
    JE Ajax Event Calendar
    risk 0.03cvss —epss 0.05

    Directory traversal vulnerability in the JE Ajax Event Calendar (com_jeajaxeventcalendar) component 1.0.1 and 1.0.3 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php. NOTE: some of these details are obtained from…

  • CVE-2010-2128Jun 1, 2010
    Joomla
    JE Quotation Form
    risk 0.04cvss —epss 0.16

    Directory traversal vulnerability in the JE Quotation Form (com_jequoteform) component 1.0b1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the view parameter to index.php.