VYPR

CVEs

385,724 total · page 6901 of 7,715

AllCriticalHighKEV
  • CVE-2009-3385Mar 23, 2010
    Mozilla Corporation
    Seamonkey
    risk 0.00cvss —epss 0.03

    The mail component in Mozilla SeaMonkey before 1.1.19 does not properly restrict execution of scriptable plugin content, which allows user-assisted remote attackers to obtain sensitive information via crafted content in an IFRAME element in an HTML e-mail message, as…

  • CVE-2010-1029Mar 19, 2010
    Google
    Chrome
    risk 0.04cvss —epss 0.12

    Stack consumption vulnerability in the WebCore::CSSSelector function in WebKit, as used in Apple Safari 4.0.4, Apple Safari on iPhone OS and iPhone OS for iPod touch, and Google Chrome 4.0.249, allows remote attackers to cause a denial of service (application crash) or possibly…

  • CVE-2010-1028Mar 19, 2010
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.09

    Integer overflow in the decompression functionality in the Web Open Fonts Format (WOFF) decoder in Mozilla Firefox 3.6 before 3.6.2 and 3.7 before 3.7 alpha 3 allows remote attackers to execute arbitrary code via a crafted WOFF file that triggers a buffer overflow, as…

  • CVE-2010-1003Mar 19, 2010
    Epignosis
    Efront
    risk 0.03cvss —epss 0.05

    Directory traversal vulnerability in www/editor/tiny_mce/langs/language.php in eFront 3.5.x through 3.5.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the langname parameter.

  • CVE-2010-0688Mar 19, 2010
    Orbitals
    Orbital Viewer
    risk 0.06cvss —epss 0.38

    Stack-based buffer overflow in Orbital Viewer 1.04 allows user-assisted remote attackers to execute arbitrary code via a crafted (1) .orb or (2) .ov file.

  • CVE-2010-0736Mar 19, 2010
    Viewvc
    Viewvc
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the view_queryform function in lib/viewvc.py in ViewVC before 1.0.10, and 1.1.x before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via "user-provided input."

  • CVE-2010-0734Mar 19, 2010
    Curl
    Libcurl
    risk 0.00cvss —epss 0.04

    content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or…

  • CVE-2010-0733Mar 19, 2010
    PostgreSQL
    PostgreSQL
    risk 0.04cvss —epss 0.07

    Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier, and 8.5 through 8.5alpha2, allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with many LEFT JOIN clauses, related to certain hashtable size…

  • CVE-2010-0732Mar 19, 2010
    GNOME Foundation
    Gtk
    risk 0.00cvss —epss 0.00

    gdk/gdkwindow.c in GTK+ before 2.18.5, as used in gnome-screensaver before 2.28.1, performs implicit paints on windows of type GDK_WINDOW_FOREIGN, which triggers an X error in certain circumstances and consequently allows physically proximate attackers to bypass screen locking…

  • CVE-2010-0465Mar 19, 2010
    Sugarcrm
    Sugarcrm
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the online Documents functionality in SugarCRM 5.2.x before 5.2.0l and 5.5.x before 5.5.0a allows remote authenticated users to inject arbitrary web script or HTML via the Document Name field.

  • CVE-2010-0008Mar 19, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    The sctp_rcv_ootb function in the SCTP implementation in the Linux kernel before 2.6.23 allows remote attackers to cause a denial of service (infinite loop) via (1) an Out Of The Blue (OOTB) chunk or (2) a chunk of zero length.

  • CVE-2009-4271Mar 19, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The Linux kernel 2.6.9 through 2.6.17 on the x86_64 and amd64 platforms allows local users to cause a denial of service (panic) via a 32-bit application that calls mprotect on its Virtual Dynamic Shared Object (VDSO) page and then triggers a segmentation fault.

  • CVE-2010-1027Mar 19, 2010
    TYPO3
    Meet Travelmates
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Meet Travelmates (travelmate) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1026Mar 19, 2010
    TYPO3
    CleanDB
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the CleanDB - DBAL (tmsw_cleandb) extension 2.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1025Mar 19, 2010
    TYPO3
    TGM-Newsletter
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the TGM-Newsletter (tgm_newsletter) extension 0.0.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1024Mar 19, 2010
    TYPO3
    TGM-Newsletter
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the TGM-Newsletter (tgm_newsletter) extension 0.0.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1023Mar 19, 2010
    TYPO3
    taskcenter_recent
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the UserTask Center, Recent (taskcenter_recent) extension 0.1.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1022Mar 19, 2010
    Marcus Krause
    T3sec Saltedpw
    risk 0.00cvss —epss 0.01

    The TYPO3 Security - Salted user password hashes (t3sec_saltedpw) extension before 0.2.13 for TYPO3 allows remote attackers to bypass authentication via unspecified vectors.

  • CVE-2010-1021Mar 19, 2010
    TYPO3
    t3quixplorer
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Typo3 Quixplorer (t3quixplorer) extension before 1.7.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1020Mar 19, 2010
    TYPO3
    Simple Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Simple Gallery (sk_simplegallery) extension 0.0.9 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1019Mar 19, 2010
    TYPO3
    Simple Gallery
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Simple Gallery (sk_simplegallery) extension 0.0.9 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1018Mar 19, 2010
    TYPO3
    Book Reviews
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Book Reviews (sk_bookreview) extension 0.0.12 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1017Mar 19, 2010
    TYPO3
    SAV Filter Months
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the SAV Filter Months (sav_filter_months) extension before 1.0.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1016Mar 19, 2010
    TYPO3
    SAV Filter Selectors
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the SAV Filter Selectors (sav_filter_selectors) extension before 1.0.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1015Mar 19, 2010
    TYPO3
    SAV Filter Alphabetic
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the SAV Filter Alphabetic (sav_filter_abc) extension before 1.0.9 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1014Mar 19, 2010
    TYPO3
    Reports Logfile View
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Reports Logfile View (reports_logview) extension 1.2.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1013Mar 19, 2010
    TYPO3
    Diocese of Portsmouth Database
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Diocese of Portsmouth Database (pd_diocesedatabase) extension before 0.7.13 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1012Mar 19, 2010
    TYPO3
    nf_cleandb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the CleanDB (nf_cleandb) extension 1.0.7 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1011Mar 19, 2010
    TYPO3
    myDashboard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the myDashboard (mydashboard) extension 0.1.13 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1010Mar 19, 2010
    TYPO3
    MK Wastebasket
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the MK Wastebasket (mk_wastebasket) extension 2.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1009Mar 19, 2010
    TYPO3
    Educator
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Educator extension 0.1.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1008Mar 19, 2010
    TYPO3
    chsellector
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Sellector.com Widget Integration (chsellector) extension before 0.1.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1007Mar 19, 2010
    TYPO3
    ch_lightem
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Power Extension Manager (ch_lightem) extension 1.0.34 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2010-1006Mar 19, 2010
    TYPO3
    Brainstorming extension
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Brainstorming extension 0.1.8 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-1005Mar 19, 2010
    TYPO3
    YATSE
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Yet another TYPO3 search engine (YATSE) extension before 0.3.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-1004Mar 19, 2010
    TYPO3
    Yet another TYPO3 search engine (YATSE)
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Yet another TYPO3 search engine (YATSE) extension before 0.3.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4735Mar 18, 2010
    Allomani
    Audio \& Video Library
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.php in Allomani Audio & Video Library (Songs & Clips version) 2.7.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action.

  • CVE-2009-4734Mar 18, 2010
    Allomani
    Movies Library
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.php in Allomani Movies Library (Movies & Clips) 2.7.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action.

  • CVE-2009-4733Mar 18, 2010
    SimpleLoginSys
    SimpleLoginSys
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in checkuser.php in SimpleLoginSys 0.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4732Mar 18, 2010
    Technotoad
    Tt Web Site Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in tt/index.php in TT Web Site Manager 0.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the tt_name parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4731Mar 18, 2010
    Boldfx
    Model Agency Manager Pro
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in photos.php in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allows remote attackers to execute arbitrary SQL commands via the album parameter.

  • CVE-2009-4730Mar 18, 2010
    x10 Media
    Adult Media Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in report.php in x10 Adult Media Script 1.7 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-4729Mar 18, 2010
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in x10 Adult Media Script 1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) pic_id parameter to includes/video_ad.php, (2) category parameter to linkvideos_listing.php, (3) id parameter to…

  • CVE-2009-4728Mar 18, 2010
    Questions Answered
    Questions Answered
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the administrative interface in Questions Answered 1.3 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4727Mar 18, 2010
    Junglescripts
    Ajax Short URL Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in x/login in JungleScripts Ajax Short Url Script allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2009-4726Mar 18, 2010
    Quickdev
    Quickdev
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in download.php in Quickdev 4 PHP allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

  • CVE-2009-4725Mar 18, 2010
    Arab Portal
    Arab Portal
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in modules/aljazeera/admin/setup.php in Arab Portal 2.2 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module…

  • CVE-2009-4724Mar 18, 2010
    Paymentprocessorscript
    Ppscript
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in shop.htm in PaymentProcessorScript.net PPScript allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2009-4723Mar 18, 2010
    Netpet
    Netpet CMS
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in confirm.php in Netpet CMS 1.9 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.

  • CVE-2009-4722Mar 18, 2010
    Limny
    Limny
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the CheckLogin function in includes/functions.php in Limny 1.01, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.