VYPR

CVEs

385,724 total · page 6899 of 7,715

AllCriticalHighKEV
  • CVE-2010-1118Mar 25, 2010
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.22

    Unspecified vulnerability in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a use-after-free issue, as demonstrated by Peter Vreugdenhil during a Pwn2Own competition at CanSecWest 2010.

  • CVE-2010-1117Mar 25, 2010
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.14

    Heap-based buffer overflow in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to discover the base address of a Windows .dll file, and possibly have unspecified other impact, via unknown vectors, as demonstrated by Peter Vreugdenhil during a Pwn2Own…

  • CVE-2010-0586Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Cisco IOS 12.1 through 12.4, when Cisco Unified Communications Manager Express (CME) or Cisco Unified Survivable Remote Site Telephony (SRST) is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed Skinny Client Control Protocol (SCCP)…

  • CVE-2010-0585Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.1 through 12.4, when Cisco Unified Communications Manager Express (CME) or Cisco Unified Survivable Remote Site Telephony (SRST) is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed Skinny Client Control Protocol (SCCP)…

  • CVE-2010-0584Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco IOS 12.4, when NAT SCCP fragmentation support is enabled, allows remote attackers to cause a denial of service (device reload) via crafted Skinny Client Control Protocol (SCCP) packets, aka Bug ID CSCsy09250.

  • CVE-2010-0583Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Memory leak in the H.323 implementation in Cisco IOS 12.1 through 12.4, and 15.0M before 15.0(1)M1, allows remote attackers to cause a denial of service (memory consumption and device reload) via malformed H.323 packets, aka Bug ID CSCtb93855.

  • CVE-2010-0582Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.1 through 12.4, and 15.0M before 15.0(1)M1, allows remote attackers to cause a denial of service (interface queue wedge) via malformed H.323 packets, aka Bug ID CSCta19962.

  • CVE-2010-0581Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the SIP implementation in Cisco IOS 12.3 and 12.4 allows remote attackers to execute arbitrary code via a malformed SIP message, aka Bug ID CSCsz89904, the "SIP Packet Parsing Arbitrary Code Execution Vulnerability."

  • CVE-2010-0580Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the SIP implementation in Cisco IOS 12.3 and 12.4 allows remote attackers to execute arbitrary code via a malformed SIP message, aka Bug ID CSCsz48680, the "SIP Message Processing Arbitrary Code Execution Vulnerability."

  • CVE-2010-0579Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    The SIP implementation in Cisco IOS 12.3 and 12.4 allows remote attackers to cause a denial of service (device reload) via a malformed SIP message, aka Bug ID CSCtb93416, the "SIP Message Handling Denial of Service Vulnerability."

  • CVE-2010-0578Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    The IKE implementation in Cisco IOS 12.2 through 12.4 on Cisco 7200 and 7301 routers with VAM2+ allows remote attackers to cause a denial of service (device reload) via a malformed IKE packet, aka Bug ID CSCtb13491.

  • CVE-2010-0577Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Cisco IOS 12.2 through 12.4, when certain PMTUD, SNAT, or window-size configurations are used, allows remote attackers to cause a denial of service (infinite loop, and device reload or hang) via a TCP segment with crafted options, aka Bug ID CSCsz75186.

  • CVE-2010-0576Mar 25, 2010
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco IOS 12.0 through 12.4, IOS XE 2.1.x through 2.3.x before 2.3.2, and IOS XR 3.2.x through 3.4.3, when Multiprotocol Label Switching (MPLS) and Label Distribution Protocol (LDP) are enabled, allows remote attackers to cause a denial of service…

  • CVE-2010-0172Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    toolkit/components/passwordmgr/src/nsLoginManagerPrompter.js in the asynchronous Authorization Prompt implementation in Mozilla Firefox 3.6 before 3.6.2 does not properly handle concurrent authorization requests from multiple web sites, which might allow remote web servers to…

  • CVE-2010-0171Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting (XSS) attacks, by using the…

  • CVE-2010-0170Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.6 before 3.6.2 does not offer plugins the expected window.location protection mechanism, which might allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors that are specific to each affected plugin.

  • CVE-2010-0169Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The CSSLoaderImpl::DoSheetComplete function in layout/style/nsCSSLoader.cpp in Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 changes the case of certain strings in a stylesheet before adding…

  • CVE-2010-0168Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.04cvss —epss 0.13

    The nsDocument::MaybePreLoadImage function in content/base/src/nsDocument.cpp in the image-preloading implementation in Mozilla Firefox 3.6 before 3.6.2 does not apply scheme restrictions and policy restrictions to the image's URL, which might allow remote attackers to cause a…

  • CVE-2010-0167Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.04cvss —epss 0.10

    The browser engine in Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute…

  • CVE-2010-0166Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.04cvss —epss 0.07

    The gfxTextRun::SanitizeGlyphRuns function in gfx/thebes/src/gfxFont.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 on Mac OS X, when the Core Text API is used, does not properly perform certain deletions, which allows remote attackers to cause a denial of service…

  • CVE-2010-0165Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The TraceRecorder::traverseScopeChain function in js/src/jstracer.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via vectors…

  • CVE-2010-0164Mar 25, 2010
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in the imgContainer::InternalAddFrameHelper function in src/imgContainer.cpp in libpr0n in Mozilla Firefox 3.6 before 3.6.2 allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute…

  • CVE-2010-1116Mar 25, 2010
    LookMer
    Music Portal
    risk 0.00cvss —epss 0.01

    LookMer Music Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for dbmdb/LookMerSarkiMDB.mdb.

  • CVE-2010-1115Mar 25, 2010
    AnnonceV
    Web Server Creator Web Portal
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in news/include/customize.php in Web Server Creator - Web Portal 0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the l parameter.

  • CVE-2010-1114Mar 25, 2010
    Web Server Creator
    Web Portal (WSC-WebPortal)
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Web Server Creator - Web Portal 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pg parameter to index.php and the (2) path parameter to news/form.php.

  • CVE-2010-1113Mar 25, 2010
    Web Server Creator
    Web Portal (WSC-WebPortal)
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the forum page in Web Server Creator - Web Portal 0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to index.php.

  • CVE-2010-1112Mar 25, 2010
    Tristan Barczyk
    Klonews
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cat.php in KloNews 2.0 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.

  • CVE-2010-1111Mar 25, 2010
    Easysitenetwork
    Jokes Complete Website
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Jokes Complete Website allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to joke.php and the (2) searchingred parameter to results.php.

  • CVE-2010-1110Mar 25, 2010
    PhpMySport
    phpMySport
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in index.php in phpMySport 1.4 allows remote attackers to list arbitrary directories via a .. (dot dot) in the current_folder parameter.

  • CVE-2010-1109Mar 25, 2010
    Djayp
    Phpmysport
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) v2 parameter in a member view action, (2) v1 parameter in a news action, (3) v1 parameter in an…

  • CVE-2010-1108Mar 25, 2010
    Drupal
    Control Panel
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Control Panel module 5.x through 5.x-1.5 and 6.x through 6.x-1.2 for Drupal allows remote authenticated users, with "administer blocks" privileges, to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1107Mar 25, 2010
    Drupal
    Recent Comments
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Recent Comments module 5.x through 5.x-1.2 and 6.x through 6.x-1.0 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a "custom block title interface."

  • CVE-2010-1106Mar 25, 2010
    Advertisementmanager
    Advertisementmanager
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in cgi/index.php in AdvertisementManager 3.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the req parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.

  • CVE-2010-1105Mar 25, 2010
    Advertisementmanager
    Advertisementmanager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cgi/index.php in AdvertisementManager 3.1.0 and 3.6 allows remote attackers to inject arbitrary web script or HTML via the usr parameter.

  • CVE-2010-1104Mar 25, 2010
    Zope
    Zope
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.

  • CVE-2010-1103Mar 24, 2010
    Mesadynamics
    Stainless
    risk 0.00cvss —epss 0.01

    Integer overflow in Stainless allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.

  • CVE-2010-1102Mar 24, 2010
    OmniWeb
    OmniWeb
    risk 0.00cvss —epss 0.01

    Integer overflow in OmniWeb allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.

  • CVE-2010-1101Mar 24, 2010
    Alexander Clauss
    Icab
    risk 0.00cvss —epss 0.01

    Integer overflow in Alexander Clauss iCab allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.

  • CVE-2010-1100Mar 24, 2010
    Arora Browser
    Arora
    risk 0.00cvss —epss 0.01

    Integer overflow in Arora allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.

  • CVE-2010-1099Mar 24, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Integer overflow in Apple Safari allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.

  • CVE-2010-0619Mar 24, 2010
    Lexmark
    X94x
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in the base, IPDS DLE, Forms DLE, Barcode DLE, Prescribe DLE, and Printcryption DLE components on certain Lexmark laser printers and multi-function printers allows remote attackers to execute arbitrary code or cause a denial of service (device hang)…

  • CVE-2010-0618Mar 24, 2010
    Lexmark
    Z2420
    risk 0.00cvss —epss 0.01

    The flood-protection feature in the base, IPDS DLE, Forms DLE, Barcode DLE, Prescribe DLE, and Printcryption DLE components on certain Lexmark laser and inkjet printers and MarkNet devices allows remote attackers to cause a denial of service (TCP outage) by making many passive…

  • CVE-2009-2907Mar 24, 2010
    Gopivotal
    Application Management Suite
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source before 4.2.x, Hyperic HQ 4.0 Enterprise before 4.0.3.2, and Hyperic HQ 4.1 Enterprise before 4.1.2.1…

  • CVE-2010-1098Mar 24, 2010
    Microsoft
    Windows
    risk 0.01cvss —epss 0.15

    The ANI parser in Microsoft Windows before 7 on the x86 platform, as used in Internet Explorer and other applications, allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted biClrUsed value in the BITMAPINFO header of a .ANI file.

  • CVE-2010-1097Mar 24, 2010
    Dedecms
    Dedecms
    risk 0.00cvss —epss 0.01

    include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.auto_start is enabled, allows remote attackers to bypass authentication and gain administrative access via a value of 1 for the _SESSION[dede_admin_id] parameter, as demonstrated by a request to…

  • CVE-2010-1096Mar 24, 2010
    Scriptsfeed
    Dating Software
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in searchmatch.php in ScriptsFeed Dating Software allow remote attackers to execute arbitrary SQL commands via the (1) txtgender and (2) txtlookgender parameters. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2010-1095Mar 24, 2010
    Jan Schutze
    Truc
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in login_reset_password_page.php in Tracking Requirements & Use Cases (TRUC) 0.11.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter. NOTE: the provenance of this information is unknown;…

  • CVE-2010-1094Mar 24, 2010
    Miethner Scripting
    Dz Erotik Auktionshaus V4rgo
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.php in DZ EROTIK Auktionshaus V4rgo allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-1093Mar 24, 2010
    1024 CMS
    1024 CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in rss.php in 1024 CMS 2.1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a vp action.

  • CVE-2010-1092Mar 24, 2010
    Scriptsfeed
    Business Directory Software
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.php in ScriptsFeed Business Directory Software allow remote attackers to execute arbitrary SQL commands via the (1) us and (2) ps parameters.