VYPR

CVEs

385,672 total · page 6914 of 7,714

AllCriticalHighKEV
  • CVE-2010-0350Jan 15, 2010
    TYPO3
    Photo Book (goof_fotoboek)
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in the Photo Book (goof_fotoboek) extension 1.7.14 and earlier for TYPO3 has unknown impact and remote attack vectors.

  • CVE-2010-0349Jan 15, 2010
    C3 Corp.
    WebCalenderC3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in C3 Corp. WebCalenderC3 0.32 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors. NOTE: this issue could not be reproduced by the vendor, but a patch was provided anyway. The original…

  • CVE-2010-0348Jan 15, 2010
    C3 Corp.
    WebCalenderC3
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in C3 Corp. WebCalenderC3 0.32 and earlier allows remote attackers to read arbitrary files via unknown vectors.

  • CVE-2010-0347Jan 15, 2010
    TYPO3
    VD / Geomap (vd_geomap)
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the VD / Geomap (vd_geomap) extension 0.3.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0346Jan 15, 2010
    TYPO3
    Mimi Tipfriends
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Tip many friends (mimi_tipfriends) extension 0.0.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0345Jan 15, 2010
    TYPO3
    Majordomo
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Majordomo extension 1.1.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0344Jan 15, 2010
    TYPO3
    Zak Store Management
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the zak_store_management extension 1.0.0 and earlier TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0343Jan 15, 2010
    TYPO3
    Clan Users List
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Clan Users List (pb_clanlist) extension 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0342Jan 15, 2010
    TYPO3
    Job Reports
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Reports for Job (job_reports) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0341Jan 15, 2010
    TYPO3
    Bb Simplejobs
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the BB Simple Jobs (bb_simplejobs) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0340Jan 15, 2010
    TYPO3
    Mjseventpro
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the MJS Event Pro (mjseventpro) extension 0.2.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0339Jan 15, 2010
    TYPO3
    User Links
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the User Links (vm19_userlinks) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0338Jan 15, 2010
    TYPO3
    Ttpedit
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the TT_Products editor (ttpedit) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0337Jan 15, 2010
    TYPO3
    tt_news Mail alert
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the tt_news Mail alert (dl3_tt_news_alerts) extension 0.2.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0336Jan 15, 2010
    TYPO3
    Kiddog Mysqldumper
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the kiddog_mysqldumper (kiddog_mysqldumper) extension 0.0.3 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.

  • CVE-2010-0335Jan 15, 2010
    TYPO3
    vote_for_tt_news
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Vote rank for news (vote_for_tt_news) extension 1.0.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0334Jan 15, 2010
    TYPO3
    vote_for_tt_news
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Vote rank for news (vote_for_tt_news) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0333Jan 15, 2010
    TYPO3
    Helpdesk (mg_help)
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Helpdesk (mg_help) extension 1.1.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0332Jan 15, 2010
    TYPO3
    TV21 Talkshow
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the TV21 Talkshow (tv21_talkshow) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0331Jan 15, 2010
    TYPO3
    TV21 Talkshow
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the TV21 Talkshow (tv21_talkshow) extension 1.0.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0330Jan 15, 2010
    Julian Fries
    Jf Easymaps
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Googlemaps for tt_news (jf_easymaps) extension 1.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0329Jan 15, 2010
    Alex Kellner
    Powermail
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the powermail extension 1.5.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to the "SQL selection field" and "typoscript."

  • CVE-2010-0328Jan 15, 2010
    Rastislav Birka
    Cs2 Unitconv
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Unit Converter (cs2_unitconv) extension 1.0.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0327Jan 15, 2010
    TYPO3
    Kj Imagelightbox2
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the KJ: Imagelightbox (kj_imagelightbox2) extension 2.0.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2008-2490.

  • CVE-2010-0326Jan 15, 2010
    TYPO3
    devlog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Developer log (devlog) extension 2.9.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2010-0325Jan 15, 2010
    TYPO3
    SB Folderdownload
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the SB Folderdownload (sb_folderdownload) extension 0.2.2 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.

  • CVE-2010-0324Jan 15, 2010
    Patrick Bauerochse
    Ref List
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Customer Reference List (ref_list) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0323Jan 15, 2010
    TYPO3
    Photo Book
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Photo Book (goof_fotoboek) extension 1.7.14 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.

  • CVE-2010-0322Jan 15, 2010
    TYPO3
    MK-AnydropdownMenu
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the init function in MK-AnydropdownMenu (mk_anydropdownmenu) extension 0.3.28 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2010-0321Jan 15, 2010
    Jamit
    Jamit Job Board
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in jobs/index.php in Jamit Job Board 3.0 allows remote attackers to inject arbitrary web script or HTML via the post_id parameter.

  • CVE-2010-0320Jan 15, 2010
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in submitlink.php in Glitter Central Script allows remote attackers to inject arbitrary web script or HTML via the catid parameter.

  • CVE-2010-0319Jan 15, 2010
    Docmint
    Docmint
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Docmint 1.0 and 2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-0318Jan 15, 2010
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.00

    The replay functionality for ZFS Intent Log (ZIL) in FreeBSD 7.1, 7.2, and 8.0, when creating files during replay of a setattr transaction, uses 7777 permissions instead of the original permissions, which might allow local users to read or modify unauthorized files in…

  • CVE-2010-0317Jan 15, 2010
    Novell
    Netware
    risk 0.04cvss —epss 0.10

    Novell Netware 6.5 SP8 allows remote attackers to cause a denial of service (NULL pointer dereference, memory consumption, ABEND, and crash) via a large number of malformed or AFP requests that are not properly handled by (1) the CIFS functionality in CIFS.nlm Semantic Agent…

  • CVE-2010-0316Jan 15, 2010
    Google
    Sketchup
    risk 0.00cvss —epss 0.03

    Integer overflow in Google SketchUp before 7.1 M2 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via a crafted SKP file.

  • CVE-2010-0280Jan 15, 2010
    Google
    Sketchup
    risk 0.01cvss —epss 0.08

    Array index error in Jan Eric Kyprianidis lib3ds 1.x, as used in Google SketchUp 7.x before 7.1 M2, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted structures in a 3DS file, probably related to mesh.c.

  • CVE-2010-0249HigKEVJan 15, 2010
    Microsoft
    Internet Explorer
    risk 0.80cvss 8.8epss 0.92

    Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute…

  • CVE-2010-0315Jan 14, 2010
    Google
    Chrome
    risk 0.04cvss —epss 0.07

    WebKit before r53607, as used in Google Chrome before 4.0.249.89, allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the…

  • CVE-2010-0314Jan 14, 2010
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.08

    Apple Safari allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets[0].href property value.

  • CVE-2010-0313Jan 14, 2010
    Sun Corporation
    Java System Directory Server
    risk 0.04cvss —epss 0.09

    The core_get_proxyauth_dn function in ns-slapd in Sun Java System Directory Server Enterprise Edition 7.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted LDAP Search Request message.

  • CVE-2010-0312Jan 14, 2010
    IBM
    Tivoli Directory Server
    risk 0.00cvss —epss 0.02

    The do_extendedOp function in ibmslapd in IBM Tivoli Directory Server (TDS) 6.2 on Linux allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted SecureWay 3.2 Event Registration Request (aka a 1.3.18.0.2.12.1 request).

  • CVE-2010-0311Jan 14, 2010
    Sun Corporation
    Java System Identity Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Sun Java System Identity Manager (aka IdM) 8.1.0.5 and 8.1.0.6, when Sun Java System Access Manager, OpenSSO Enterprise 8.0, or IBM Tivoli Access Manager is used, allows remote attackers to obtain administrative access via unknown vectors.

  • CVE-2010-0310Jan 14, 2010
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Trusted Extensions in Sun Solaris 10 allows local users to gain privileges via vectors related to omission of unspecified libraries from software updates.

  • CVE-2010-0184Jan 14, 2010
    TIBCO Software
    Runtime Agent
    risk 0.00cvss —epss 0.00

    The (1) domainutility and (2) domainutilitycmd components in TIBCO Domain Utility in TIBCO Runtime Agent (TRA) before 5.6.2, as used in TIBCO ActiveMatrix BusinessWorks and other products, set weak permissions on domain properties files, which allows local users to obtain domain…

  • CVE-2009-4613Jan 14, 2010
    Netartmedia
    Real Estate Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in realestate20/loginaction.php in NetArt Media Real Estate Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the Password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2009-4355Jan 14, 2010
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.09

    Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the…

  • CVE-2010-0015Jan 14, 2010
    GNU
    Glibc
    risk 0.00cvss —epss 0.03

    nis/nss_nis/nis-pwd.c in the GNU C Library (aka glibc or libc6) 2.7 and Embedded GLIBC (EGLIBC) 2.10.2 adds information from the passwd.adjunct.byname map to entries in the passwd map, which allows remote attackers to obtain the encrypted passwords of NIS accounts by calling the…

  • CVE-2010-0014Jan 14, 2010
    Fedoraproject
    Sssd
    risk 0.00cvss —epss 0.01

    System Security Services Daemon (SSSD) before 1.0.1, when the krb5 auth_provider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's…

  • CVE-2010-0002Jan 14, 2010
    Mandriva
    Bash
    risk 0.03cvss —epss 0.01

    The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a…

  • CVE-2009-4182Jan 14, 2010
    Microfocus
    Jetadmin
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in HP Web Jetadmin 10.2, when a remote SQL server is used, allow remote attackers to obtain access to data or cause a denial of service, possibly by leveraging authentication and encryption weaknesses on the SQL server.