VYPR

CVEs

381,115 total · page 6891 of 7,623

AllCriticalHighKEV
  • CVE-2009-1741May 20, 2009
    DM
    FileManager
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in login.php in DM FileManager 3.9.2, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.

  • CVE-2009-1740May 20, 2009
    Dlink
    MPEG4 Viewer ActiveX Control
    risk 0.00cvss —epss 0.06

    Multiple heap-based buffer overflows in the D-Link MPEG4 Viewer ActiveX Control (csviewer.ocx) 2.11.918.2006 allow remote attackers to execute arbitrary code via a long argument to the (1) SetFilePath and (2) SetClientCookie methods. NOTE: the provenance of this information is…

  • CVE-2009-1739May 20, 2009
    Pad Site Scripts
    Pad Site Scripts
    risk 0.03cvss —epss 0.03

    PAD Site Scripts 3.6 allows remote attackers to bypass authentication and gain privileges as other users, including administrative privileges, by setting the authuser cookie parameter to a valid username.

  • CVE-2009-1738May 20, 2009
    Drupal
    Feed Block
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Feed Block 6.x-1.x before 6.x-1.1, a module for Drupal, allows remote authenticated users with administrator feed permissions to inject arbitrary web script or HTML via unspecified vectors in "aggregator items."

  • CVE-2009-1737May 20, 2009
    MyPic
    MyPic
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in bom.php in MyPic 2.1 allows remote attackers to list files in arbitrary directories via a .. (dot dot) in the dir parameter.

  • CVE-2009-1736May 20, 2009
    Joomla
    Com Gsticketsystem
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the GridSupport (GS) Ticket System (com_gsticketsystem) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a viewCategory action to index.php.

  • CVE-2009-1735May 20, 2009
    VidSharePro
    VidSharePro
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search.php in VidSharePro allows remote attackers to inject arbitrary web script or HTML via the searchtxt parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-1734May 20, 2009
    VidSharePro
    VidSharePro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in listing_video.php in VidSharePro allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2009-1733May 20, 2009
    Richard Ellerbrock
    Ipplan
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IPplan 4.91a allows remote attackers to hijack the authentication of administrators for requests that (1) change the password, (2) add users, or (3) delete users via unknown vectors.

  • CVE-2009-1732May 20, 2009
    Richard Ellerbrock
    Ipplan
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/usermanager in IPplan 4.91a allows remote attackers to inject arbitrary web script or HTML via the grp parameter.

  • CVE-2009-1731May 20, 2009
    Mlffat
    Mlffat
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in panel/index.php in MLFFAT 2.1 allows remote attackers to execute arbitrary SQL commands via a base64-encoded supervisor cookie.

  • CVE-2009-1730May 20, 2009
    Netmechanica
    Netdecision TFTP Server
    risk 0.07cvss —epss 0.55

    Multiple directory traversal vulnerabilities in NetMechanica NetDecision TFTP Server 4.2 allow remote attackers to read or modify arbitrary files via directory traversal sequences in the (1) GET or (2) PUT command.

  • CVE-2009-1418May 19, 2009
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 3.0.1.73 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-1379May 19, 2009
    OpenSSL Project
    OpenSSL
    risk 0.04cvss —epss 0.18

    Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet, as demonstrated by a…

  • CVE-2009-1378May 19, 2009
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.13

    Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers…

  • CVE-2009-1377May 19, 2009
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.11

    The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer…

  • CVE-2009-1252May 19, 2009
    NTP
    NTP
    risk 0.02cvss —epss 0.21

    Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.

  • CVE-2009-1678May 18, 2009
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the version parameter to boards/boards_rss.php.

  • CVE-2009-1677May 18, 2009
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.02

    Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow (1) remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's "display name" setting and…

  • CVE-2009-1675May 18, 2009
    Electrasoft
    32bit FTP
    risk 0.04cvss —epss 0.14

    Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a long 227 reply to a PASV command.

  • CVE-2009-1674May 18, 2009
    Microchip
    Mplab Ide
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in Microchip MPLAB IDE 8.30 allows user-assisted remote attackers to execute arbitrary code via a long .cof pathname in a [TOOL_SETTINGS] section in a .mcp file, possibly a related issue to CVE-2009-1608.

  • CVE-2009-1673May 18, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    The kernel in Sun Solaris 9 allows local users to cause a denial of service (panic) by calling fstat with a first argument of AT_FDCWD.

  • CVE-2009-1672May 18, 2009
    Sun Corporation
    Jre
    risk 0.04cvss —epss 0.10

    The Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13 allows remote attackers to (1) execute arbitrary code via a .jnlp URL in the argument to the launch method, and might allow remote attackers to launch JRE…

  • CVE-2009-1671May 18, 2009
    Sun Corporation
    Jre
    risk 0.04cvss —epss 0.10

    Multiple buffer overflows in the Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13 allow remote attackers to execute arbitrary code via a long string argument to the (1) setInstallerType, (2)…

  • CVE-2009-1670May 18, 2009
    Tcpdb
    Tcpdb
    risk 0.04cvss —epss 0.07

    user/index.php in TCPDB 3.8 does not require administrative authentication, which allows remote attackers to add admin accounts via unspecified vectors. NOTE: some of these details are obtained from third party information.

  • CVE-2009-1669May 18, 2009
    Smarty
    Smarty
    risk 0.04cvss —epss 0.14

    The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function. NOTE: some of these details are obtained from third…

  • CVE-2009-1668May 18, 2009
    Typsoft
    Typsoft FTP Server
    risk 0.03cvss —epss 0.06

    TYPSoft FTP Server 1.11 allows remote attackers to cause a denial of service (CPU consumption) by sending an ABOR (abort) command without an active file transfer.

  • CVE-2009-1667May 18, 2009
    Mini Stream
    Castripper
    risk 0.05cvss —epss 0.21

    Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a long entry in a .m3u file, a different vector than CVE-2009-5137.

  • CVE-2009-1666May 18, 2009
    Cyclomedia
    Cycloscopelite
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in CycloMedia CycloScopeLite 2.50.3.0 allow remote attackers to execute arbitrary code via the ReturnConnection method in (1) CM_ADOConnection.dll, (2) CM_AddressInfoDBC.dll, and (3) CM_RecordingLocationDBC.dll, related to improper…

  • CVE-2009-0721May 18, 2009
    Microfocus
    Remote Graphics Software
    risk 0.01cvss —epss 0.10

    Unspecified vulnerability in Easy Login in the Sender module in HP Remote Graphics Software (RGS) 4.0.0 through 5.2.4 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2009-1665May 18, 2009
    Easy Scripts
    Answer And Question Script
    risk 0.03cvss —epss 0.02

    myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to remove arbitrary user accounts via a modified userid parameter without specifying any additional fields.

  • CVE-2009-1664May 18, 2009
    Easy Scripts
    Answer And Question Script
    risk 0.03cvss —epss 0.02

    myaccount.php in Easy Scripts Answer and Question Script does not verify the original password before changing passwords, which allows remote attackers to change the password of other users and gain privileges via modified userid, txtpassword, and txtRpassword parameters.

  • CVE-2009-1663May 18, 2009
    Easy Scripts
    Answer And Question Script
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads/[username]…

  • CVE-2009-1662May 18, 2009
    Recipescript
    Recipe Script
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in admin/login.php in Wright Way Services Recipe Script 5 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) Password fields, as reachable from admin/index.php.

  • CVE-2009-1661May 18, 2009
    UTopic
    uTopic
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/utopic.php in uTopic 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the rating parameter to index.php.

  • CVE-2009-1660May 18, 2009
    URUWorks
    ViPlay3
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in URUWorks ViPlay3 3.0 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long file entry in a .vpl file.

  • CVE-2009-1659May 18, 2009
    Intelliants
    Elitius
    risk 0.03cvss —epss 0.02

    Unrestricted file upload vulnerability in admin/uploadimage.php in eLitius 1.0 allows remote attackers to bypass intended access restrictions and upload and execute arbitrary files via an avatar file with an accepted Content-Type such as image/gif, then requesting the file in…

  • CVE-2009-1658May 18, 2009
    Realty Webware Technologies
    Web-Base
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in admin/admin.php in Realty Webware Technologies Realty Web-Base 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) user (username) and (2) password parameters. NOTE: some of these details are obtained from third…

  • CVE-2009-1657May 18, 2009
    B2evolution
    B2evolution
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Starrating plugin before 0.7.7 for b2evolution allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-6811May 18, 2009
    WordPress
    e-Commerce Plugin
    risk 0.04cvss —epss 0.07

    Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in…

  • CVE-2008-6810May 18, 2009
    Venalsur
    Booking Centre Booking System for Hotels Group
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in admin/checklogin.php in Venalsur Booking Centre Booking System for Hotels Group 2.01 allow remote attackers to execute arbitrary SQL commands via the (1) myusername (username) and (2) password parameters. NOTE: some of these details are…

  • CVE-2008-6809May 18, 2009
    Venalsur
    Booking Centre Booking System for Hotels Group
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in hotel_habitaciones.php in Venalsur Booking Centre Booking System for Hotels Group 2.01 allows remote attackers to execute arbitrary SQL commands via the HotelID parameter.

  • CVE-2009-1656May 16, 2009
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.04

    Xerox WorkCentre and WorkCentre Pro 232, 238, 245, 255, 265, 275; and WorkCentre 5632, 5638, 5645, 5655, 5665, 5675, 5687, 7655, 7656, and 7675 allows remote attackers to execute arbitrary commands via unknown attack vectors, aka "command injection vulnerability."

  • CVE-2009-1655May 16, 2009
    Easy Scripts
    Answer And Question Script
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in myaccount.php in Easy Scripts Answer and Question Script allow remote authenticated users to execute arbitrary SQL commands via the (1) user name (userid parameter) and (2) password.

  • CVE-2009-1654May 16, 2009
    Easy Scripts
    Answer And Question Script
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in questiondetail.php in Easy Scripts Answer and Question Script allows remote attackers to inject arbitrary web script or HTML via the questionid parameter.

  • CVE-2009-1653May 16, 2009
    Tinybutstrong
    Tinybutstrong
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in examples/tbs_us_examples_0view.php in TinyButStrong 3.4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the script parameter.

  • CVE-2009-1652May 16, 2009
    Business Community Script
    Business Community Script
    risk 0.03cvss —epss 0.06

    admin/adminaddeditdetails.php in Business Community Script does not properly restrict access, which allows remote attackers to gain privileges and add administrators via a direct request.

  • CVE-2009-1651May 16, 2009
    2daybiz
    Business Community Script
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in admin/member_details.php in 2daybiz Business Community Script allows remote attackers to execute arbitrary SQL commands via the mid parameter.

  • CVE-2009-1650May 16, 2009
    Tenfourzero
    Shutter
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in photos.php in Shutter 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) albumID, (2) tagID, and (3) photoID parameters to index.html.

  • CVE-2009-1649May 16, 2009
    BeLive
    beLive
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in arch.php in beLive 0.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the arch parameter.