VYPR

CVEs

385,730 total · page 6893 of 7,715

AllCriticalHighKEV
  • CVE-2010-0741Apr 12, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    The virtio_net_bad_features function in hw/virtio-net.c in the virtio-net driver in the Linux kernel before 2.6.26, when used on a guest OS in conjunction with qemu-kvm 0.11.0 or KVM 83, allows remote attackers to cause a denial of service (guest OS crash, and an associated…

  • CVE-2009-3732Apr 12, 2010
    VMware
    Remote Console
    risk 0.04cvss —epss 0.16

    Format string vulnerability in vmware-vmrc.exe build 158248 in VMware Remote Console (aka VMrc) allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2009-1565Apr 12, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.06

    vmnc.dll in the VMnc media codec in VMware Movie Decoder before 6.5.4 Build 246459 on Windows, and the movie decoder in VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Windows, allows remote attackers to…

  • CVE-2009-1564Apr 12, 2010
    VMware
    Workstation
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in vmnc.dll in the VMnc media codec in VMware Movie Decoder before 6.5.4 Build 246459 on Windows, and the movie decoder in VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on…

  • CVE-2010-1348Apr 12, 2010
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the login process in IBM WebSphere Portal 6.0.1.1, and 6.1.0.x before 6.1.0.3 Cumulative Fix 03, has unknown impact and remote attack vectors.

  • CVE-2010-1347Apr 12, 2010
    IBM
    Director Agent
    risk 0.00cvss —epss 0.00

    Director Agent 6.1 before 6.1.2.3 in IBM Systems Director on AIX and Linux uses incorrect permissions for the (1) diruninstall and (2) opt/ibm/director/bin/wcitinst scripts, which allows local users to gain privileges by executing these scripts.

  • CVE-2010-1148Apr 12, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The cifs_create function in fs/cifs/dir.c in the Linux kernel 2.6.33.2 and earlier allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a NULL nameidata (aka nd) field in a POSIX file-creation request…

  • CVE-2010-1346Apr 9, 2010
    Ribafs
    Mini CMS Ribafs
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/login.php in Mini CMS RibaFS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the login parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-1345Apr 9, 2010
    Joomla
    CKForms
    risk 0.04cvss —epss 0.17

    Directory traversal vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1344Apr 9, 2010
    Joomla
    CKForms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the fid parameter in a detail action to index.php.

  • CVE-2010-1343Apr 9, 2010
    Bj Sintay
    Sitex
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in photo.php in SiteX 0.7.4 beta allows remote attackers to execute arbitrary SQL commands via the albumid parameter.

  • CVE-2010-1342Apr 9, 2010
    Direct News
    Direct News
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Direct News 4.10.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to (1) admin/menu.php and (2) library/lib.menu.php; and the adminroot parameter to…

  • CVE-2010-1341Apr 9, 2010
    Systemsoftware
    Community Black Forum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Systemsoftware Community Black Forum allows remote attackers to execute arbitrary SQL commands via the s_flaeche parameter.

  • CVE-2010-1340Apr 9, 2010
    Joomla Research
    Com Jresearch
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in jresearch.php in the J!Research (com_jresearch) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1339Apr 9, 2010
    Woltlab
    Teamsite Hack
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in ts_other.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows remote attackers to inject arbitrary web script or HTML via the userid parameter in a modboard action, which is not properly handled in a forced…

  • CVE-2010-1338Apr 9, 2010
    Woltlab
    Teamsite Hack
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in ts_other.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows remote attackers to execute arbitrary SQL commands via the userid parameter in a modboard action.

  • CVE-2010-1337Apr 9, 2010
    Lussumo
    Vanilla
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in definitions.php in Lussumo Vanilla 1.1.10, and possibly 0.9.2 and other versions, allow remote attackers to execute arbitrary PHP code via a URL in the (1) include and (2) Configuration['LANGUAGE'] parameters.

  • CVE-2010-1336Apr 9, 2010
    Invohost
    Invohost
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in INVOhost 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) newlanguage parameters to site.php, (3) search parameter to manuals.php, and (4) unspecified vectors to faq.php. NOTE: some of these details…

  • CVE-2010-1335Apr 9, 2010
    Insky
    CMS
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Insky CMS 006-0111, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the ROOT parameter to (1) city.get/city.get.php, (2) city.get/index.php, (3)…

  • CVE-2010-1334Apr 9, 2010
    Pulse
    Pulse CMS Basic
    risk 0.00cvss —epss 0.01

    Unrestricted file upload vulnerability in Pulse CMS Basic 1.2.4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in an unspecified…

  • CVE-2010-1333Apr 9, 2010
    Almas
    Compiere
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Almas Inc. Compiere J300_A02 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1332Apr 9, 2010
    Prettybook
    Prettyformmail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in PrettyBook PrettyFormMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1331Apr 9, 2010
    Heartlogic
    Hl Sitemanager
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Heartlogic HL-SiteManager allows remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2010-0993Apr 9, 2010
    Pulse
    Pulse CMS Basic
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in Pulse CMS Basic 1.2.2 and 1.2.3, and possibly Pulse Pro before 1.3.2, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an…

  • CVE-2010-0992Apr 9, 2010
    Pulse CMS
    Basic
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Pulse CMS Basic 1.2.2 and 1.2.3, and possibly Pulse Pro before 1.3.2, allow remote attackers to hijack the authentication of users for requests that (1) upload image files, (2) delete image files, or (3) create blocks.

  • CVE-2010-1315Apr 8, 2010
    Joomlamo
    Com Weberpcustomer
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1.x before 1.06.02 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these…

  • CVE-2010-1314Apr 8, 2010
    Joomla
    Highslide JS
    risk 0.04cvss —epss 0.16

    Directory traversal vulnerability in the Highslide JS (com_hsconfig) component 1.5 and 2.0.9 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party…

  • CVE-2010-1313Apr 8, 2010
    Joomla
    Seber Cart
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in the Seber Cart (com_sebercart) component 1.0.0.12 and 1.0.0.13 for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php. NOTE: some of these details…

  • CVE-2010-1312Apr 8, 2010
    Ijoomla
    Com News Portal
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in the iJoomla News Portal (com_news_portal) component 1.5.x for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1311Apr 8, 2010
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.03

    The qtm_decompress function in libclamav/mspack.c in ClamAV before 0.96 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted CAB archive that uses the Quantum (aka .Q) compression format. NOTE: some of these details are…

  • CVE-2010-1310Apr 8, 2010
    Opera
    Opera
    risk 0.00cvss —epss 0.01

    Opera 10.50 allows remote attackers to obtain sensitive information via crafted XSLT constructs, which cause Opera to return cached contents of other pages.

  • CVE-2010-1309Apr 8, 2010
    Irmin
    Irmin CMS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in Irmin CMS (formerly Pepsi CMS) 0.6 BETA2 allows remote attackers to read arbitrary files via a .. (dot dot) in the w parameter to index.php.

  • CVE-2010-0743Apr 8, 2010
    Iscsitarget
    Iscsitarget
    risk 0.00cvss —epss 0.03

    Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or…

  • CVE-2010-0098Apr 8, 2010
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.05

    ClamAV before 0.96 does not properly handle the (1) CAB and (2) 7z file formats, which allows remote attackers to bypass virus detection via a crafted archive that is compatible with standard archive utilities.

  • CVE-2010-1308Apr 8, 2010
    Joomla
    SVMap
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in the SVMap (com_svmap) component 1.1.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1307Apr 8, 2010
    Joomla
    Magic Updater
    risk 0.04cvss —epss 0.10

    Directory traversal vulnerability in the Magic Updater (com_joomlaupdater) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1306Apr 8, 2010
    Roberto Aloi
    Com Joomlapicasa2
    risk 0.04cvss —epss 0.16

    Directory traversal vulnerability in the Picasa (com_joomlapicasa2) component 2.0 and 2.0.5 for Joomla! allows remote attackers to read arbitrary local files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party…

  • CVE-2010-1305Apr 8, 2010
    Joomla
    JInventory
    risk 0.05cvss —epss 0.21

    Directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly other versions before 1.26.03, a module for Joomla!, allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1304Apr 8, 2010
    Joomlamo
    Com Userstatus
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in userstatus.php in the User Status (com_userstatus) component 1.21.16 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-1303Apr 8, 2010
    Jim Berry
    Taxonomy Filter
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy Filter module 6.x before 6.x-1.1 for Drupal allow remote authenticated users, with administer taxonomy permissions or create node permissions when free tagging is enabled, to inject arbitrary web script or HTML…

  • CVE-2010-1302Apr 7, 2010
    Decryptweb
    DW Graphs
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in dwgraphs.php in the DecryptWeb DW Graphs (com_dwgraphs) component 1.0 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.

  • CVE-2010-1301Apr 7, 2010
    Centreon
    Centreon
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in main.php in Centreon 2.1.5 allows remote attackers to execute arbitrary SQL commands via the host_id parameter.

  • CVE-2010-1300Apr 7, 2010
    Yamamah
    Yamamah
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in Yamamah (aka Dove Photo Album) 1.00 allows remote attackers to execute arbitrary SQL commands via the calbums parameter.

  • CVE-2010-1299Apr 7, 2010
    Dynpg
    Dynpg
    risk 0.04cvss —epss 0.11

    Multiple PHP remote file inclusion vulnerabilities in DynPG CMS 4.1.0, and possibly earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) DefineRootToTool parameter to counter.php,…

  • CVE-2008-7254Apr 7, 2010
    Irmin
    Irmin CMS
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in includes/template-loader.php in Irmin CMS (formerly Pepsi CMS) 0.5 and 0.6 BETA2, when register_globals is enabled, allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the _Root_Path parameter. NOTE: some of…

  • CVE-2010-1223Apr 7, 2010
    Ca
    XOsoft
    risk 0.01cvss —epss 0.17

    Multiple buffer overflows in CA XOsoft r12.0 and r12.5 allow remote attackers to execute arbitrary code via (1) a malformed request to the ws_man/xosoapapi.asmx SOAP endpoint or (2) a long string to the entry_point.aspx service.

  • CVE-2010-1222Apr 7, 2010
    Ca
    XOsoft
    risk 0.00cvss —epss 0.02

    CA XOsoft r12.5 does not properly perform authentication, which allows remote attackers to obtain potentially sensitive information via a SOAP request.

  • CVE-2010-1221Apr 7, 2010
    Ca
    XOsoft
    risk 0.00cvss —epss 0.02

    CA XOsoft r12.0 and r12.5 does not properly perform authentication, which allows remote attackers to enumerate usernames via a SOAP request.

  • CVE-2010-1186Apr 7, 2010
    WordPress
    Nextgen Gallery
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.

  • CVE-2010-0629MedApr 7, 2010
    Mit
    Kerberos 5
    risk 0.43cvss 6.5epss 0.05

    Use-after-free vulnerability in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote authenticated users to cause a denial of service (daemon crash) via a request from a kadmin client that sends an invalid API version number.