VYPR

CVEs

385,739 total · page 6885 of 7,715

AllCriticalHighKEV
  • CVE-2010-1737May 6, 2010
    Gallo
    Gallo
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in core/includes/gfw_smarty.php in Gallo 0.1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the config[gfwroot] parameter.

  • CVE-2010-1736May 6, 2010
    KrM
    Haber
    risk 0.00cvss —epss 0.01

    KrM Haber 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for d_atabase/Krmdb.mdb.

  • CVE-2010-1731May 6, 2010
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome on the HTC Hero allows remote attackers to cause a denial of service (application crash) via JavaScript that writes sequences in an infinite loop.

  • CVE-2010-1730May 6, 2010
    Dolphin Browser
    Dolphin Browser
    risk 0.00cvss —epss 0.01

    Dolphin Browser 2.5.0 on the HTC Hero allows remote attackers to cause a denial of service (application crash) via JavaScript that writes sequences in an infinite loop.

  • CVE-2010-1729May 6, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit.dll in WebKit, as used in Safari.exe 4.531.9.1 in Apple Safari, allows remote attackers to cause a denial of service (application crash) via JavaScript that writes sequences in an infinite loop.

  • CVE-2010-1728May 6, 2010
    Opera
    Opera
    risk 0.01cvss —epss 0.07

    Opera before 10.53 on Windows and Mac OS X does not properly handle a series of document modifications that occur asynchronously, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via JavaScript that writes …

  • CVE-2010-1727May 6, 2010
    Aspsiteware
    Jobpost
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in type.asp in JobPost 1.0 allows remote attackers to execute arbitrary SQL commands via the iType parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-1726May 6, 2010
    Alibabaclone
    Ec21 Clone
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in offers_buy.php in EC21 Clone 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-1725May 6, 2010
    Alibabaclone
    Alibaba Clone
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in offers_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-1724May 6, 2010
    Zikula
    Zikula Application Framework
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in Zikula Application Framework 1.2.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) func parameter to index.php, or the (2) lang parameter to index.php, which is not properly…

  • CVE-2010-1438May 6, 2010
    Webapplicationfingerprinter
    Web Application Finger Printer
    risk 0.00cvss —epss 0.00

    Web Application Finger Printer (WAFP) 0.01-26c3 uses fixed pathnames under /tmp for temporary files and directories, which (1) allows local users to cause a denial of service (application outage) by creating a file with a pathname that the product expects is available for its…

  • CVE-2010-0995May 6, 2010
    Tonec Inc.
    Internet Download Manager
    risk 0.01cvss —epss 0.08

    Stack-based buffer overflow in Internet Download Manager (IDM) before 5.19 allows remote attackers to execute arbitrary code via a crafted FTP URI that causes unspecified "test sequences" to be sent from client to server.

  • CVE-2010-1735May 6, 2010
    Microsoft
    Windows 2000
    risk 0.03cvss —epss 0.02

    The SfnLOGONNOTIFY function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x4c value in the second argument (aka the Msg argument) of a PostMessage function call for the DDEMLEvent…

  • CVE-2010-1734May 6, 2010
    Microsoft
    Windows 2000
    risk 0.03cvss —epss 0.03

    The SfnINSTRING function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x18d value in the second argument (aka the Msg argument) of a PostMessage function call for the DDEMLEvent…

  • CVE-2010-1733May 6, 2010
    Ocsinventory Ng
    Ocsinventory Ng
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in OCS Inventory NG before 1.02.3 allow remote attackers to execute arbitrary SQL commands via (1) multiple inventory fields to the search form, reachable through index.php; or (2) the "Software name" field to the "All softwares" search…

  • CVE-2010-1732May 6, 2010
    Zikula
    Zikula Application Framework
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the users module in Zikula Application Framework before 1.2.3 allows remote attackers to hijack the authentication of administrators for requests that change the administrator email address (updateemail action).

  • CVE-2010-1681May 6, 2010
    Microsoft
    Visio
    risk 0.08cvss —epss 0.67

    Buffer overflow in VISIODWG.DLL before 10.0.6880.4 in Microsoft Office Visio allows user-assisted remote attackers to execute arbitrary code via a crafted DXF file, a different vulnerability than CVE-2010-0254 and CVE-2010-0256.

  • CVE-2010-1583May 6, 2010
    Taskfreak
    Taskfreak\!
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the loadByKey function in the TznDbConnection class in tzn_mysql.php in Tirzen (aka TZN) Framework 1.5, as used in TaskFreak! before 0.6.3, allows remote attackers to execute arbitrary SQL commands via the username field in a login action.

  • CVE-2009-4841May 6, 2010
    Roxio
    Cineplayer
    risk 0.04cvss —epss 0.07

    Heap-based buffer overflow in the SonicMediaPlayer ActiveX control in SonicMediaPlayer.dll in Roxio CinePlayer 3.2 allows remote attackers to execute arbitrary code via a long argument to the DiskType method. NOTE: this might overlap CVE-2007-1559.

  • CVE-2009-4840May 6, 2010
    Roxio
    Cineplayer
    risk 0.04cvss —epss 0.08

    Heap-based buffer overflow in the IAManager ActiveX control in IAManager.dll in Roxio CinePlayer 3.2 allows remote attackers to execute arbitrary code via a long argument to the SetIAPlayerName method.

  • CVE-2009-4839May 6, 2010
    Secureideas
    Basic Analysis and Security Engine
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE), possibly 1.4.4 and earlier, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) admin/base_roleadmin.php, (2) admin/base_useradmin.php,…

  • CVE-2009-4838May 6, 2010
    Secureideas
    Basic Analysis and Security Engine
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in base_ag_common.php in Basic Analysis and Security Engine (BASE) before 1.4.3.1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4837May 6, 2010
    Secureideas
    Basic Analysis and Security Engine
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE) before 1.4.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) sig[1] parameter to base/base_qry_main.php, or the time[0][1] parameter to (2)…

  • CVE-2009-4836May 6, 2010
    Moviephp
    Movie PHP Script
    risk 0.03cvss —epss 0.06

    Eval injection vulnerability in system/services/init.php in Movie PHP Script 2.0 allows remote attackers to execute arbitrary PHP code via the anticode parameter.

  • CVE-2009-4835May 6, 2010
    Libsndfile Project
    Libsndfile
    risk 0.00cvss —epss 0.01

    The (1) htk_read_header, (2) alaw_init, (3) ulaw_init, (4) pcm_init, (5) float32_init, and (6) sds_read_header functions in libsndfile 1.0.20 allow context-dependent attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted audio file.

  • CVE-2010-1686May 5, 2010
    Abcbackup
    Abc Backup
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in (1) Urgent Backup 3.20, and (2) ABC Backup Pro 5.20 and ABC Backup 5.50, allows user-assisted remote attackers to execute arbitrary code via a crafted ZIP archive.

  • CVE-2010-1279May 5, 2010
    Adobe Inc.
    Photoshop
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in Adobe Photoshop CS4 11.x before 11.0.1 allow user-assisted remote attackers to execute arbitrary code via a crafted TIFF file.

  • CVE-2010-0406May 5, 2010
    OpenTTD
    Openttd
    risk 0.00cvss —epss 0.02

    OpenTTD before 1.0.1 allows remote attackers to cause a denial of service (file-descriptor exhaustion and daemon crash) by performing incomplete downloads of the map.

  • CVE-2010-0402May 5, 2010
    OpenTTD
    Openttd
    risk 0.00cvss —epss 0.02

    OpenTTD before 1.0.1 does not properly validate index values of certain items, which allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted in-game command.

  • CVE-2010-0401May 5, 2010
    OpenTTD
    Openttd
    risk 0.00cvss —epss 0.01

    OpenTTD before 1.0.1 accepts a company password for authentication in response to a request for the server password, which allows remote authenticated users to bypass intended access restrictions or cause a denial of service (daemon crash) by sending a company password packet.

  • CVE-2010-1723May 4, 2010
    Joomlacomponent.inetlanka
    Com Drawroot
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in the iNetLanka Contact Us Draw Root Map (com_drawroot) component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1722May 4, 2010
    Joomla
    Online Market
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in the Online Market (com_market) component 2.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1721May 4, 2010
    Joomla
    Intellectual Property
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Intellectual Property (aka IProperty or com_iproperty) component 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an agentproperties action to index.php.

  • CVE-2010-1720May 4, 2010
    Joomla
    Q-Personel
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Q-Personel (com_qpersonel) component 1.0.2 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the katid parameter in a qpListele action to index.php.

  • CVE-2010-1719May 4, 2010
    Joomla
    MT Fire Eagle
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in the MT Fire Eagle (com_mtfireeagle) component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1718May 4, 2010
    Joomla
    Archery Scores
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in archeryscores.php in the Archery Scores (com_archeryscores) component 1.0.6 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1717May 4, 2010
    If Surfalert Project
    If Surfalert
    risk 0.05cvss —epss 0.22

    Directory traversal vulnerability in the iF surfALERT (com_if_surfalert) component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1716May 4, 2010
    Joomla
    Agenda Address Book
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Agenda Address Book (com_agenda) component 1.0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.

  • CVE-2010-1715May 4, 2010
    Joomla
    Online Examination
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in the Online Examination (aka Online Exam or com_onlineexam) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from…

  • CVE-2010-1714May 4, 2010
    Joomla
    Arcade Games
    risk 0.04cvss —epss 0.19

    Directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1713May 4, 2010
    Postnuke
    Postnuke
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in modules.php in PostNuke 0.764 allows remote attackers to execute arbitrary SQL commands via the sid parameter in a News article modload action.

  • CVE-2010-1712May 4, 2010
    Webmobo
    Wbnews
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in base/Comments.php in Webmobo WB News 2.3.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name and possibly (2) message parameters. NOTE: some of these details are obtained from third party…

  • CVE-2010-1711May 4, 2010
    Ramoncastro
    Siestta
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in carga_foto_al.php in Siestta 2.0, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the usuario parameter.

  • CVE-2010-1710May 4, 2010
    Ramoncastro
    Siestta
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in login.php in Siestta 2.0, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the idioma parameter.

  • CVE-2010-1709May 4, 2010
    G5 Scripts
    Auto Img Gallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in upload.cgi in G5-Scripts Auto-Img-Gallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) user and (2) pass parameters.

  • CVE-2010-1708May 4, 2010
    Free Realty
    Free Realty
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in agentadmin.php in Free Realty allow remote attackers to execute arbitrary SQL commands via the (1) login field (aka agentname parameter) or (2) password field (aka agentpassword parameter).

  • CVE-2010-1707May 4, 2010
    Piwigo
    Piwigo
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in register.php in Piwigo 2.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) login and (2) mail_address parameters.

  • CVE-2010-1706May 4, 2010
    2daybiz
    Auction Script
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.php in 2daybiz Auction Script allow remote attackers to execute arbitrary SQL commands via (1) the login field (aka the username parameter), and possibly (2) the password field, to index.php. NOTE: some of these details are…

  • CVE-2010-1705May 4, 2010
    Modelbook
    Modelbook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in casting_view.php in Modelbook allows remote attackers to execute arbitrary SQL commands via the adnum parameter.

  • CVE-2010-1704May 4, 2010
    Webbdomain
    Polls
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in 2daybiz Polls (aka Advanced Poll) Script allow remote attackers to execute arbitrary SQL commands via (1) the password field to login.php, (2) the login field (aka email parameter) to login.php, (3) the password field (aka pass…