VYPR

CVEs

385,711 total · page 6905 of 7,715

AllCriticalHighKEV
  • CVE-2009-4673Mar 5, 2010
    Mole Group
    Adult Portal Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in profile.php in Mole Group Adult Portal Script allows remote attackers to execute arbitrary SQL commands via the user_id parameter.

  • CVE-2009-4672Mar 5, 2010
    WordPress
    WP-Lytebox
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pg parameter.

  • CVE-2009-4671Mar 5, 2010
    Beaussier
    Roomphplanning
    risk 0.03cvss —epss 0.02

    Login.php in RoomPHPlanning 1.6 allows remote attackers to bypass authentication and obtain administrative access by setting the room_phplanning cookie to a value associated with the admin account.

  • CVE-2009-4670Mar 5, 2010
    RoomPHPlanning
    RoomPHPlanning
    risk 0.03cvss —epss 0.02

    admin/delitem.php in RoomPHPlanning 1.6 does not require authentication, which allows remote attackers to (1) delete arbitrary users via the user parameter or (2) delete arbitrary rooms via the room parameter.

  • CVE-2009-4669Mar 5, 2010
    Beaussier
    Roomphplanning
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in RoomPHPlanning 1.6 allow remote attackers to execute arbitrary SQL commands via (1) the loginus parameter to Login.php or (2) the Old Password field to changepwd.php, and allow (3) remote authenticated administrators to execute arbitrary…

  • CVE-2009-4668Mar 5, 2010
    Cowon America
    Jetaudio
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in JetCast.exe 2.0.4.1109 in jetAudio 7.5.2 and 7.5.3.15 allows remote attackers to execute arbitrary code via a long ID3 tag in an MP3 file. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4667Mar 5, 2010
    Phpmember
    Webmember
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in form.php in WebMember 1.0 allows remote authenticated users to execute arbitrary SQL commands via the formID parameter.

  • CVE-2009-4666Mar 5, 2010
    Webradev
    Download Protect
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Webradev Download Protect 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[RootPath] parameter to (1) Framework/EmailTemplates.class.php, (2) Customers/PDPEmailReplaceConstants.class.php, and…

  • CVE-2009-4665Mar 5, 2010
    Cutesoft Components
    Cute Editor For Asp.net
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in CuteSoft_Client/CuteEditor/Load.ashx in CuteSoft Components Cute Editor for ASP.NET allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

  • CVE-2010-0927Mar 5, 2010
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in help/readme.nsf/Header in the Help component in IBM Lotus Domino 7.x before 7.0.4 and 8.x before 8.0.2 allows remote attackers to inject arbitrary web script or HTML via the BaseTarget parameter in an OpenPage action. NOTE: this may…

  • CVE-2010-0592Mar 5, 2010
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.03

    The CTI Manager service in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x before 4.3(2)sr1a, 6.x before 6.1(3), 7.0x before 7.0(2), 7.1x before 7.1(2), and 8.x before 8.0(1) allows remote attackers to cause a denial of service (service failure) via a…

  • CVE-2010-0591Mar 5, 2010
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.02

    Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5), 7.x before 7.1(3b)SU2, and 8.x before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SIP REG message, related to an overflow of the…

  • CVE-2010-0590Mar 5, 2010
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.03

    The CMSIPUtility component in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 7.x before 7.1(3a)su1 and 8.x before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SIP Register message, aka Bug ID CSCtc37188.

  • CVE-2010-0588Mar 5, 2010
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.02

    Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5), 7.x before 7.1(3a)su1, and 8.x before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SCCP (1) RegAvailableLines or (2) FwdStatReq message with…

  • CVE-2010-0587Mar 5, 2010
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.03

    Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x before 4.3(2)SR2, 6.x before 6.1(5), 7.x before 7.1(3a)su1, and 8.x before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SCCP StationCapabilitiesRes message…

  • CVE-2010-0419Mar 5, 2010
    Red Hat
    Kvm
    risk 0.00cvss —epss 0.00

    The x86 emulator in KVM 83, when a guest is configured for Symmetric Multiprocessing (SMP), does not properly restrict writing of segment selectors to segment registers, which might allow guest OS users to cause a denial of service (guest OS crash) or gain privileges on the…

  • CVE-2010-0408Mar 5, 2010
    Apache
    HTTP Server
    risk 0.02cvss —epss 0.21

    The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server…

  • CVE-2009-2754Mar 5, 2010
    IBM
    Informix Dynamic Server
    risk 0.06cvss —epss 0.40

    Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3 and EMC Legato NetWorker, allows…

  • CVE-2009-2753Mar 5, 2010
    IBM
    Informix Dynamic Server
    risk 0.04cvss —epss 0.11

    Multiple buffer overflows in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3, allow remote attackers to execute…

  • CVE-2009-4664Mar 3, 2010
    Firewall Builder
    Firewall Builder
    risk 0.00cvss —epss 0.00

    Firewall Builder 3.0.4, 3.0.5, and 3.0.6, when running on Linux, allows local users to gain privileges via a symlink attack on an unspecified temporary file that is created by the iptables script.

  • CVE-2009-4663Mar 3, 2010
    Quiksoft
    Easymail Objects
    risk 0.04cvss —epss 0.10

    Heap-based buffer overflow in the Quiksoft EasyMail Objects 6 ActiveX control allows remote attackers to execute arbitrary code via a long argument to the AddAttachment method.

  • CVE-2009-4662Mar 3, 2010
    Novell
    Groupwise
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 7.0 before 7.03 HP4 and 8.0 before 8.0 SP1 allows remote attackers to inject arbitrary web script or HTML via the User.Theme.index parameter.

  • CVE-2009-4661Mar 3, 2010
    Bigantsoft
    Bigant Server
    risk 0.03cvss —epss 0.02

    Multiple buffer overflows in BigAnt Server 2.50 SP6 and earlier allow user-assisted remote attackers to cause a denial of service (application crash) via a crafted ZIP file that is not properly handled when the victim uses the (1) Update or (2) Plug-In console menu item.

  • CVE-2009-4660Mar 3, 2010
    Bigantsoft
    AntServer Module
    risk 0.08cvss —epss 0.63

    Stack-based buffer overflow in the AntServer Module (AntServer.exe) in BigAnt IM Server 2.50 allows remote attackers to execute arbitrary code via a long GET request to TCP port 6660.

  • CVE-2009-4659Mar 3, 2010
    Mp3 Cutter
    Ease Audio Cutter
    risk 0.03cvss —epss 0.02

    Unspecified vulnerability in MP3-Cutter Ease Audio Cutter 1.20 allows user-assisted remote attackers to cause a denial of service (application crash) via a long string in a WAV file.

  • CVE-2009-4658Mar 3, 2010
    Xerver
    Xerver
    risk 0.03cvss —epss 0.02

    Xerver 4.32 allows remote authenticated users to cause a denial of service (daemon crash) via a non-numeric web port assignment in the management interface. NOTE: this can be leveraged by non-authenticated attackers using CVE-2009-4657.

  • CVE-2009-4657Mar 3, 2010
    Xerver
    Xerver
    risk 0.03cvss —epss 0.02

    The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter application settings by connecting to the application on port 32123, as demonstrated by setting the action option to wizardStep1.

  • CVE-2009-4656Mar 3, 2010
    E Soft.co
    Dj Studio Pro
    risk 0.06cvss —epss 0.32

    Stack-based buffer overflow in E-Soft DJ Studio Pro 4.2 including 4.2.2.7.5, and 5.x including 5.1.4.3.1, allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a playlist file (.pls) containing a long…

  • CVE-2010-0925Mar 3, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    cfnetwork.dll 1.450.5.0 in CFNetwork, as used by safari.exe 531.21.10 in Apple Safari 4.0.4 on Windows, allows remote attackers to cause a denial of service (application crash) via a long string in the SRC attribute of a (1) IMG or (2) IFRAME element.

  • CVE-2010-0924Mar 3, 2010
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    cfnetwork.dll 1.450.5.0 in CFNetwork, as used by safari.exe 531.21.10 in Apple Safari 4.0.3 and 4.0.4 on Windows, allows remote attackers to cause a denial of service (application crash) via a long string in the BACKGROUND attribute of a BODY element.

  • CVE-2010-0923Mar 3, 2010
    KDE
    Kde
    risk 0.00cvss —epss 0.00

    Race condition in workspace/krunner/lock/lockdlg.cc in the KRunner lock module in kdebase in KDE SC 4.4.0 allows physically proximate attackers to bypass KScreenSaver screen locking and access an unattended workstation by pressing the Enter key at a certain time, related to…

  • CVE-2010-0922Mar 3, 2010
    IBM
    Aix
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in secldapclntd in IBM AIX 5.3 with SP 5300-11-02 allows attackers to cause a denial of service (LDAP login failure) via unknown vectors. NOTE: some of these details are obtained from third party information. NOTE: there may be no attacker role, and…

  • CVE-2010-0921Mar 3, 2010
    IBM
    Lotus Inotes
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 allows remote attackers to hijack the authentication of unspecified victims via vectors related to lack of "XSS/CSRF Get Filter and Referer…

  • CVE-2010-0920Mar 3, 2010
    IBM
    Lotus Inotes
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 allows remote attackers to inject arbitrary web script or HTML via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."

  • CVE-2010-0919Mar 3, 2010
    IBM
    Domino Web Access
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in the Lotus Domino Web Access ActiveX control in IBM Lotus iNotes (aka Domino Web Access or DWA) 6.5, 7.0 before 7.0.4, 8.0, 8.0.2, and before 229.281 for Domino 8.0.2 FP4 allows remote attackers to execute arbitrary code via a long URL argument to…

  • CVE-2010-0918Mar 3, 2010
    IBM
    Lotus Inotes
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in the UltraLite functionality in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 have unknown impact and attack vectors.

  • CVE-2010-0917Mar 3, 2010
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.25

    Stack-based buffer overflow in VBScript in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, might allow user-assisted remote attackers to execute arbitrary code via a long string in the fourth argument (aka helpfile argument) to…

  • CVE-2010-0766Mar 3, 2010
    Luxology
    Modo
    risk 0.00cvss —epss 0.05

    Integer overflow in the Swap4 function in valet4.dll in Luxology Modo 401 allows user-assisted remote attackers to execute arbitrary code via a .LXO file containing a CHNL subchunk associated with an invalid length.

  • CVE-2010-0483Mar 3, 2010
    Microsoft
    Windows 2000
    risk 0.10cvss —epss 0.87

    vbscript.dll in VBScript 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, allows user-assisted remote attackers to execute arbitrary code by referencing a (1) local pathname, (2) UNC share pathname, or (3)…

  • CVE-2010-0205Mar 3, 2010
    Libpng
    Libpng
    risk 0.00cvss —epss 0.04

    The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to…

  • CVE-2010-0156Mar 3, 2010
    Puppet (software)
    Puppet
    risk 0.00cvss —epss 0.00

    Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daemonout, (2) /tmp/puppetdoc.txt, (3) /tmp/puppetdoc.tex, or (4) /tmp/puppetdoc.aux temporary file.

  • CVE-2010-0804Mar 2, 2010
    Netartmedia
    Iboutique
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in iBoutique 4.0 allows remote attackers to inject arbitrary web script or HTML via the key parameter in a products action.

  • CVE-2010-0803Mar 2, 2010
    Joomla
    jVideoDirect
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the jVideoDirect (com_jvideodirect) component 1.1 RC3b for Joomla! allows remote attackers to execute arbitrary SQL commands via the v parameter to index.php.

  • CVE-2010-0802Mar 2, 2010
    Aleinbeen
    \(nv2\) Awards
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in (nv2) Awards 1.1.0, a modification for Invision Power Board, allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action.

  • CVE-2010-0801Mar 2, 2010
    Joomla
    AutartiTarot
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in the AutartiTarot (com_autartitarot) component 1.0.3 for Joomla! allows remote authenticated users, with "Public Back-end" group permissions, to read arbitrary files via directory traversal sequences in the controller parameter in an edit task…

  • CVE-2010-0800Mar 2, 2010
    Joomla
    com_dms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Ossolution Team Documents Seller (aka DMS) (com_dms) component 2.5.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a view_category action to index.php.

  • CVE-2010-0799Mar 2, 2010
    Phpunity
    newsmanager
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in misc/tell_a_friend/tell.php in phpunity.newsmanager allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.

  • CVE-2010-0798Mar 2, 2010
    TYPO3
    T3BLOG
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the T3BLOG extension 0.6.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0797Mar 2, 2010
    TYPO3
    T3BLOG
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the T3BLOG extension 0.6.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0796Mar 2, 2010
    Joomla
    JE Quiz
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JE Quiz (com_jequizmanagement) component 1.b01 for Joomla! allows remote attackers to execute arbitrary SQL commands via the eid parameter in a question action to index.php.