VYPR

CVEs

385,711 total · page 6902 of 7,715

AllCriticalHighKEV
  • CVE-2010-0978Mar 16, 2010
    Kmsoft
    Guestbook
    risk 0.03cvss —epss 0.03

    KMSoft Guestbook (aka GBook) 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/db.mdb.

  • CVE-2010-0977Mar 16, 2010
    Pordus
    Pd Portal
    risk 0.00cvss —epss 0.01

    PD PORTAL 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/db.mdb.

  • CVE-2010-0976Mar 16, 2010
    Acidcat
    Acidcat CMS
    risk 0.03cvss —epss 0.02

    Acidcat CMS 3.5.x does not prevent access to install.asp after installation finishes, which might allow remote attackers to restart the installation process and have unspecified other impact via requests to install.asp and other install_*.asp scripts. NOTE: the final…

  • CVE-2010-0793Mar 16, 2010
    Barnowl
    Barnowl
    risk 0.00cvss —epss 0.04

    Buffer overflow in BarnOwl before 1.5.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted CC: header.

  • CVE-2010-0729Mar 16, 2010
    Red Hat
    Linux kernel
    risk 0.00cvss —epss 0.00

    A certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 4 on the ia64 platform allows local users to use ptrace on an arbitrary process, and consequently gain privileges, via vectors related to a missing ptrace_check_attach call.

  • CVE-2010-0727Mar 16, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows…

  • CVE-2010-0397Mar 16, 2010
    PHP
    PHP
    risk 0.04cvss —epss 0.12

    The xmlrpc extension in PHP 5.3.1 does not properly handle a missing methodName element in the first argument to the xmlrpc_decode_request function, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) and…

  • CVE-2007-6733Mar 16, 2010
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The nfs_lock function in fs/nfs/file.c in the Linux kernel 2.6.9 does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on an NFS filesystem…

  • CVE-2010-0975Mar 16, 2010
    Phpcityportal
    Phpcityportal
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in external.php in PHPCityPortal allows remote attackers to execute arbitrary PHP code via a URL in the url parameter.

  • CVE-2010-0974Mar 16, 2010
    Phpcityportal
    Phpcityportal
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in PHPCityPortal allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) video_show.php, (2) spotlight_detail.php, (3) real_estate_details.php, and (4) auto_details.php.

  • CVE-2010-0973Mar 16, 2010
    Phppool Media
    Domain Verkaus and Auktions Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in phppool media Domain Verkaus and Auktions Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2010-0972Mar 16, 2010
    Joomla
    com_gcalendar
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in the GCalendar (com_gcalendar) component 2.1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2010-0971Mar 16, 2010
    Atutor
    Atutor
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.6.4 allow remote authenticated users, with Instructor privileges, to inject arbitrary web script or HTML via the (1) Question and (2) Choice fields in tools/polls/add.php, the (3) Type and (4) Title fields in…

  • CVE-2010-0970Mar 16, 2010
    PhpMyLogon
    PhpMyLogon
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in phpmylogon.php in PhpMyLogon 2 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-0969Mar 16, 2010
    Unbound
    Unbound
    risk 0.00cvss —epss 0.03

    Unbound before 1.4.3 does not properly align structures on 64-bit platforms, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.

  • CVE-2010-0968Mar 16, 2010
    Geekhelps
    Admp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in bannershow.php in Geekhelps ADMP 1.01 allows remote attackers to execute arbitrary SQL commands via the click parameter.

  • CVE-2010-0967Mar 16, 2010
    Geekhelps
    Admp
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in Geekhelps ADMP 1.01, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the style parameter to (1) colorvoid/footer.php, (2)…

  • CVE-2010-0966Mar 16, 2010
    Dzcp
    Dev\!l\'z Clanportal
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in inc/config.php in deV!L`z Clanportal (DZCP) 1.5.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter.

  • CVE-2010-0965Mar 16, 2010
    Jevci.net
    Jevci Siparis Formu Scripti
    risk 0.00cvss —epss 0.01

    Jevci Siparis Formu Scripti stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for siparis.mdb.

  • CVE-2010-0964Mar 16, 2010
    Media Products
    Eros Webkatalog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in start.php in Eros Webkatalog allows remote attackers to execute arbitrary SQL commands via the id parameter in a rubrik action.

  • CVE-2010-0963Mar 16, 2010
    Yuri D\'elia
    Dl
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in dl Download Ticket Service before 0.7 allows remote attackers to inject arbitrary web script or HTML via the t parameter, related to an invalid ticket ID. NOTE: some of these details are obtained from third party…

  • CVE-2009-4718Mar 15, 2010
    Gonafish
    Webstatcaffe
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in visitorduration.php in Gonafish WebStatCaffe allows remote attackers to execute arbitrary SQL commands via the nodayshow parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2009-4717Mar 15, 2010
    Gonafish
    Webstatcaffe
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Gonafish WebStatCaffe allow remote attackers to inject arbitrary web script or HTML via the (1) host parameter to stat/host.php, nodayshow parameter to (2) mostvisitpage.php and (3) visitorduration.php in stat/, (4)…

  • CVE-2009-4716Mar 15, 2010
    Edgephp
    Ezwebsearch
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in results.php in EDGEPHP EZWebSearch allows remote attackers to inject arbitrary web script or HTML via the language parameter.

  • CVE-2009-4715Mar 15, 2010
    Real Time Currency Exchange
    Real Time Currency Exchange
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in rates.php in Real Time Currency Exchange allows remote attackers to inject arbitrary web script or HTML via the Amount parameter.

  • CVE-2009-4714Mar 15, 2010
    Alexandre Amaral
    Xoops Celepar
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the quiz module for XOOPS Celepar allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to cadastro_usuario.php.

  • CVE-2009-4713Mar 15, 2010
    XOOPS
    Qas
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to inject arbitrary web script or HTML via (1) the cod_categoria parameter to categoria.php, (2) the opcao parameter to index.php, and the PATH_INFO to (3)…

  • CVE-2009-4712Mar 15, 2010
    Tukanas
    Easyclassifieds Script
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Tukanas Classifieds (aka EasyClassifieds) Script 1.0 allows remote attackers to execute arbitrary SQL commands via the b parameter.

  • CVE-2009-4711Mar 15, 2010
    TYPO3
    CoolURI
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the CoolURI (cooluri) extension before 1.0.16 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2008-6686.

  • CVE-2009-4710Mar 15, 2010
    TYPO3
    cwt_resetbepassword
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Reset backend password (cwt_resetbepassword) extension 1.20 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4709Mar 15, 2010
    TYPO3
    datamints Newsticker
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the datamints Newsticker (datamints_newsticker) extension before 0.7.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4708Mar 15, 2010
    TYPO3
    Front End News Submitter
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the [Gobernalia] Front End News Submitter (gb_fenewssubmit) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4707Mar 15, 2010
    TYPO3
    Front End News Submitter
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the [Gobernalia] Front End News Submitter (gb_fenewssubmit) extension 0.1.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4706Mar 15, 2010
    TYPO3
    Mailform
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Mailform (mailform) extension before 0.9.24 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4705Mar 15, 2010
    TYPO3
    Twitter Search
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Twitter Search (twittersearch) extension before 0.1.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4704Mar 15, 2010
    TYPO3
    Ws Ecard
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Webesse E-Card (ws_ecard) extension 1.0.2 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2009-4703Mar 15, 2010
    TYPO3
    Webesse Image Gallery (ws_gallery)
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Webesse Image Gallery (ws_gallery) extension 1.0.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4702Mar 15, 2010
    TYPO3
    pm_tour
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Tour Extension (pm_tour) extension before 0.0.13 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4701Mar 15, 2010
    TYPO3
    myth_download
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Myth download (myth_download) extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4700Mar 15, 2010
    Mail.ru
    Dating
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in SkaDate Dating allows remote attackers to read arbitrary files via a .. (dot dot) in the layout parameter.

  • CVE-2009-4699Mar 15, 2010
    Skadate
    SkaDate Dating
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in SkaDate Dating allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin/auth.php and (2) file_uploader.php.

  • CVE-2009-4698Mar 15, 2010
    XOOPS
    Qas
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to execute arbitrary SQL commands via the codigo parameter to (1) aviso.php and (2) imprimir.php, and the (3) cod_categoria parameter to categoria.php.

  • CVE-2010-0054Mar 15, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving HTML IMG elements.

  • CVE-2010-0053Mar 15, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the run-in Cascading Style Sheets (CSS) display property.

  • CVE-2010-0052Mar 15, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to "callbacks for HTML elements."

  • CVE-2010-0051Mar 15, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit in Apple Safari before 4.0.5 does not properly validate the cross-origin loading of stylesheets, which allows remote attackers to obtain sensitive information via a crafted HTML document. NOTE: this might overlap CVE-2010-0651.

  • CVE-2010-0050HigMar 15, 2010
    Apple Inc.
    Safari
    risk 0.61cvss 8.8epss 0.12

    Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an HTML document with improperly nested tags.

  • CVE-2010-0049Mar 15, 2010
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.11

    Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via HTML elements with right-to-left (RTL) text directionality.

  • CVE-2010-0624Mar 15, 2010
    GNU
    Tar
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client functionality in GNU tar before 1.23 and GNU cpio before 2.11 allows remote rmt servers to cause a denial of service (memory corruption) or possibly execute arbitrary code by sending more…

  • CVE-2010-0396Mar 15, 2010
    Debian
    Dpkg
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the dpkg-source component in dpkg before 1.14.29 allows remote attackers to modify arbitrary files via a crafted Debian source archive.