VYPR

CVEs

385,756 total · page 6884 of 7,716

AllCriticalHighKEV
  • CVE-2009-4871May 11, 2010
    Logoshows
    BBS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in globepersonnel_forum.asp in Logoshows BBS 2.0 allows remote attackers to execute arbitrary SQL commands via the forumid parameter.

  • CVE-2009-4870May 11, 2010
    Phpcityportal
    Phpcityportal
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.php in PHPCityPortal allow remote attackers to execute arbitrary SQL commands via the (1) req_username (aka Username) and (2) req_password (aka Password) parameters. NOTE: some of these details are obtained from third party…

  • CVE-2009-4869May 11, 2010
    Nasim
    Guest Book
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Nasim Guest Book 1.2 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2009-4868May 11, 2010
    Hitronsoft
    Answer Me
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Hitron Soft Answer Me 1.0 allows remote attackers to inject arbitrary web script or HTML via the q_id parameter to the answers script (aka answers.php). NOTE: some of these details are obtained from third party information.

  • CVE-2009-4867May 11, 2010
    Tony Million
    Tuniac
    risk 0.03cvss —epss 0.04

    Buffer overflow in Tuniac 090517c allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long URL in a .m3u playlist file.

  • CVE-2009-4866May 11, 2010
    Matt's Script Archive
    Simple Search
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.cgi in Matt's Script Archive (MSA) Simple Search 1.0 allows remote attackers to inject arbitrary web script or HTML via the terms parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4865May 11, 2010
    I Escorts
    I Escorts Directory Script
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in escorts_search.php in I-Escorts Directory Script and Agency Script, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) search_name and (2) languages parameters. NOTE: some of these…

  • CVE-2009-4864May 11, 2010
    I Escorts
    I Escorts Directory Script
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in escorts_search.php in I-Escorts Directory Script and Agency Script allow remote attackers to inject arbitrary web script or HTML via the (1) search_name and (2) languages parameters. NOTE: some of these details are obtained…

  • CVE-2009-4863May 11, 2010
    Ultraplayer
    Ultraplayer Media Player
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in UltraPlayer Media Player 2.112 allows remote attackers to execute arbitrary code via a long string in a .usk file.

  • CVE-2009-4862May 11, 2010
    Abushhab
    Alwasel
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Alwasel 1.5 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) show.php and (2) xml.php.

  • CVE-2009-4861May 11, 2010
    Supportpro
    Supportdesk
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in shownews.php in SupportPRO SupportDesk 3.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  • CVE-2009-4860May 11, 2010
    Typing Pal
    Typing Pal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in demo.php in Typing Pal 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the idTableProduit parameter.

  • CVE-2009-4859May 11, 2010
    Onlinetechtools.com
    Owos Lite
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Online Work Order Suite (OWOS) Lite Edition 3.10 allow remote attackers to inject arbitrary web script or HTML via the show parameter to (1) default.asp and (2) report.asp, and the (3) go parameter to login.asp.

  • CVE-2009-4858May 11, 2010
    Turnkeyforms
    Yahoo Answers Clone
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in questiondetail.php in Yahoo Answers Clone allows remote attackers to inject arbitrary web script or HTML via the questionid parameter.

  • CVE-2009-4857May 11, 2010
    Ecomstudio
    PHP Photo Vote1.3f
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in login.php in PHP Photo Vote 1.3F allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2009-4856May 11, 2010
    Ecomstudio
    PHP Easy Shopping Cart
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in subitems.php in PHP Easy Shopping Cart 3.1R allows remote attackers to inject arbitrary web script or HTML via the name parameter.

  • CVE-2009-4855May 11, 2010
    TYPO3
    Typo3
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in TYPO3 4.0 allows remote attackers to execute arbitrary SQL commands via the showUid parameter. NOTE: the TYPO3 Security Team disputes this report, stating that "there is no such vulnerability... The showUid parameter is generally used…

  • CVE-2010-1868May 7, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.03

    The (1) sqlite_single_query and (2) sqlite_array_query functions in ext/sqlite/sqlite.c in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to execute arbitrary code by calling these functions with an empty SQL query, which triggers access of…

  • CVE-2010-1867May 7, 2010
    Sourcefabric
    Campsite
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the ArticleAttachment::GetAttachmentsByArticleNumber method in javascript/tinymcs/plugins/campsiteattachment/attachments.php in Campsite 3.3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the article_id parameter.

  • CVE-2010-1866CriMay 7, 2010
    PHP
    PHP
    risk 0.67cvss 9.8epss 0.07

    The dechunk filter in PHP 5.3 through 5.3.2, when decoding an HTTP chunked encoding stream, allows context-dependent attackers to cause a denial of service (crash) and possibly trigger memory corruption via a negative chunk size, which bypasses a signed comparison, related to an…

  • CVE-2010-1865May 7, 2010
    Clansphere
    Clansphere
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in ClanSphere 2009.0.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the IP address to the cs_getip function in generate.php in the Captcha module, or (2) the s_email parameter to the cs_sql_select function in…

  • CVE-2010-1864May 7, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The addcslashes function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

  • CVE-2010-1863May 7, 2010
    Clantiger
    Clantiger
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the shoutbox module (modules/shoutbox.php) in ClanTiger 1.1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the s_email parameter.

  • CVE-2010-1862May 7, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The chunk_split function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

  • CVE-2010-1861May 7, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The sysvshm extension for PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to write to arbitrary memory addresses by using an object's __sleep function to interrupt an internal call to the shm_put_var function, which triggers access of a freed…

  • CVE-2010-1860May 7, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The html_entity_decode function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal call, related to the call time…

  • CVE-2010-1859May 7, 2010
    Deluxebb
    Deluxebb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in newpost.php in DeluxeBB 1.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the membercookie cookie when adding a new thread.

  • CVE-2009-4854May 7, 2010
    Talkback
    Talkback
    risk 0.03cvss —epss 0.03

    addons/import.php in TalkBack 2.3.14 allows remote attackers to execute arbitrary commands via the result parameter.

  • CVE-2010-1858May 7, 2010
    Joomla
    SMEStorage
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in the SMEStorage (com_smestorage) component before 1.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.

  • CVE-2010-1857May 7, 2010
    Realitymedias
    Repairshop2
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in RepairShop2 1.9.023 Trial, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the prod parameter in a products.details action. NOTE: the provenance of this information is unknown; the…

  • CVE-2010-1856May 7, 2010
    Realitymedias
    Repairshop2
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in RepairShop2 1.9.023 Trial, when magic_quotes_gpc is disabled, allows remote attackers to inject arbitrary web script or HTML via the prod parameter in a products.details action.

  • CVE-2010-1855May 7, 2010
    Phpscripte24
    Pay Per Watch \& Bid Auktions System
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to execute arbitrary SQL commands via the id_auk parameter.

  • CVE-2010-1854May 7, 2010
    Phpscripte24
    Pay Per Watch \& Bid Auktions System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to inject arbitrary web script or HTML via the id_auk parameter, which is not properly handled in a forced SQL error message. NOTE: the provenance of this…

  • CVE-2010-1853May 7, 2010
    Transmissionbt
    Transmission
    risk 0.00cvss —epss 0.04

    Multiple stack-based buffer overflows in the tr_magnetParse function in libtransmission/magnet.c in Transmission 1.91 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted magnet URL with a large number of (1) tr or (2) ws…

  • CVE-2010-1690May 7, 2010
    Microsoft
    Exchange Server
    risk 0.01cvss —epss 0.07

    The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows Server 2008 SP2 and earlier, Windows Server 2008 R2, Exchange Server 2003 SP3 and earlier, Exchange…

  • CVE-2010-1689May 7, 2010
    Microsoft
    Exchange Server
    risk 0.01cvss —epss 0.07

    The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows Server 2008 SP2 and earlier, Windows Server 2008 R2, Exchange Server 2003 SP3 and earlier, Exchange…

  • CVE-2010-1451May 7, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The TSB I-TLB load implementation in arch/sparc/kernel/tsb.S in the Linux kernel before 2.6.33 on the SPARC platform does not properly obtain the value of a certain _PAGE_EXEC_4U bit and consequently does not properly implement a non-executable stack, which makes it easier for…

  • CVE-2010-1437HigMay 7, 2010
    Linux
    Kernel
    risk 0.49cvss 7.0epss 0.01

    Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands…

  • CVE-2010-1173May 7, 2010
    Linux
    Kernel
    risk 0.05cvss —epss 0.21

    The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a…

  • CVE-2009-4853May 7, 2010
    Jumpbox
    Jumpbox
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in JumpBox before 1.1.2 for Foswiki Wiki System allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4852May 7, 2010
    Semanticscuttle
    Semanticscuttle
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in SemanticScuttle before 0.94.1 allow remote attackers to inject arbitrary web script or HTML via the sort parameter to index.php, and other unspecified vectors, a different issue than CVE-2008-6113. NOTE: some of these…

  • CVE-2009-4851May 7, 2010
    XOOPS
    Xoops
    risk 0.00cvss —epss 0.01

    The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to bypass administrative approval via a request involving activate.php.

  • CVE-2009-4850May 7, 2010
    Awingsoft
    Awakening Winds3d Viewer Plugin
    risk 0.05cvss —epss 0.25

    The Awingsoft Awakening Winds3D Viewer plugin 3.5.0.9 allows remote attackers to execute arbitrary programs via a SceneURL property value with a URL for a .exe file.

  • CVE-2009-4849May 7, 2010
    Toutvirtual
    Virtualiq
    risk 0.03cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to hijack the authentication of administrators for requests that (1) create a new user account via a save action to…

  • CVE-2009-4848May 7, 2010
    Toutvirtual
    Virtualiq
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to inject arbitrary web script or HTML via the (1) userId parameter to tvserver/server/user/setPermissions.jsp, (2) deptName parameter to…

  • CVE-2009-4847May 7, 2010
    Deliantra
    Deliantra
    risk 0.00cvss —epss 0.01

    Deliantra Server before 2.82 allows remote authenticated users to cause a denial of service (daemon crash) via vectors involving an empty treasure list.

  • CVE-2009-4846May 7, 2010
    Deliantra
    Deliantra
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in Deliantra Server before 2.82 allow remote attackers to execute arbitrary code via vectors related to (1) the command_gsay function in server/c_party.C and (2) the book implementation.

  • CVE-2010-1852May 7, 2010
    Microsoft
    Internet Explorer
    risk 0.00cvss —epss 0.04

    Microsoft Internet Explorer, when the Invisible Hand extension is enabled, uses cookies during background HTTP requests in a possibly unexpected manner, which might allow remote web servers to identify specific persons and their product searches via HTTP request logging, related…

  • CVE-2010-1851May 7, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.00

    Google Chrome, when the Invisible Hand extension is enabled, uses cookies during background HTTP requests in a possibly unexpected manner, which might allow remote web servers to identify specific persons and their product searches via HTTP request logging, related to a…

  • CVE-2010-1549May 7, 2010
    Microfocus
    Loadrunner
    risk 0.09cvss —epss 0.78

    Unspecified vulnerability in the Agent in HP LoadRunner before 9.50 and HP Performance Center before 9.50 allows remote attackers to execute arbitrary code via unknown vectors.