VYPR

CVEs

385,660 total · page 6917 of 7,714

AllCriticalHighKEV
  • CVE-2009-4573Jan 6, 2010
    Joomlabear
    Mod Joomulus
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Joomulus (mod_joomulus) module 2.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action to (1) tagcloud_ell.swf, (2) tagcloud_eng.swf, (3)…

  • CVE-2009-4572Jan 5, 2010
    Phpshop
    Phpshop
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in PhpShop 0.8.1 allows remote attackers to hijack the authentication of arbitrary users for requests that invoke the cartAdd function in a shop/cart action to the default URI.

  • CVE-2009-4571Jan 5, 2010
    Phpshop
    Phpshop
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in index.php in PhpShop 0.8.1 allow remote attackers to execute arbitrary SQL commands via the (1) module_id parameter in an admin/function_list action, the (2) vendor_id parameter in a vendor/vendor_form action, the (3) module_id parameter…

  • CVE-2009-4570Jan 5, 2010
    Phpshop
    Phpshop
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in PhpShop 0.8.1 allows remote attackers to inject arbitrary web script or HTML via the order_id parameter in an order/order_print action to the default URI.

  • CVE-2009-4569Jan 5, 2010
    Elkagroup
    Image Gallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in elkagroup Image Gallery allows remote attackers to execute arbitrary SQL commands via the id parameter to the default URI under news/.

  • CVE-2009-4568Jan 5, 2010
    Webmin
    Webmin
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Webmin before 1.500 and Usermin before 1.430 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4567Jan 5, 2010
    Viscacha
    Viscacha
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in editprofile.php in Viscacha 0.8 Gold allow remote authenticated users to inject arbitrary web script or HTML via the (1) skype, (2) yahoo, (3) aol, (4) msn, or (5) jabber parameter in a profile2 action. NOTE: some of these…

  • CVE-2009-3734Jan 5, 2010
    S2 Security
    Linear eMerge Access Control System
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the management console in the S2 Security Linear eMerge Access Control System 2.5.x allows remote attackers to cause a denial of service (configuration reset) via a request to a crafted URI.

  • CVE-2009-4566Jan 4, 2010
    Zenphoto
    Zenphoto
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Zenphoto 1.2.5 allows remote attackers to execute arbitrary SQL commands via the title parameter in a news action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2009-4565Jan 4, 2010
    Sendmail, Inc.
    Sendmail
    risk 0.00cvss —epss 0.02

    sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification…

  • CVE-2009-4564Jan 4, 2010
    Zenphoto
    Zenphoto
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Zenphoto 1.2.5, when the ZenPage plugin is enabled, allows remote attackers to execute arbitrary SQL commands via the category parameter, related to a URI under news/category/.

  • CVE-2009-4563Jan 4, 2010
    Zenphoto
    Zenphoto
    risk 0.03cvss —epss 0.04

    Cross-site request forgery (CSRF) vulnerability in zp-core/admin-options.php in Zenphoto 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via the 0-adminpass and 0-adminpass_2 parameters in a…

  • CVE-2009-4562Jan 4, 2010
    Zenphoto
    Zenphoto
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in zp-core/admin.php in Zenphoto 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the from parameter.

  • CVE-2009-4561Jan 4, 2010
    Worms League
    Webleague
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Admin/index.php in WebLeague 2.2.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

  • CVE-2009-4560Jan 4, 2010
    WebLeague
    WebLeague
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in profile.php in WebLeague 2.2.0 allows remote attackers to execute arbitrary SQL commands via the name parameter.

  • CVE-2009-4559Jan 4, 2010
    Drupal
    Submitted By
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Submitted By module 6.x before 6.x-1.3 for Drupal allows remote authenticated users, with "administer content types" privileges, to inject arbitrary web script or HTML via an input string for "submitted by" text.

  • CVE-2009-4558Jan 4, 2010
    Drupal
    Image Assist
    risk 0.00cvss —epss 0.01

    The Image Assist module 5.x-1.x before 5.x-1.8, 5.x-2.x before 2.0-alpha4, 6.x-1.x before 6.x-1.1, 6.x-2.x before 2.0-alpha4, and 6.x-3.x-dev before 2009-07-15, a module for Drupal, does not properly enforce privilege requirements for unspecified pages, which allows remote…

  • CVE-2009-4557Jan 4, 2010
    Drupal
    Image Assist
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Image Assist module 5.x-1.x before 5.x-1.8, 5.x-2.x before 2.0-alpha4, 6.x-1.x before 6.x-1.1, 6.x-2.x before 2.0-alpha4, and 6.x-3.x-dev before 2009-07-15, a module for Drupal, allows remote authenticated users, with image-node…

  • CVE-2009-4556Jan 4, 2010
    Quickheal
    Antivirus Plus 2009
    risk 0.03cvss —epss 0.01

    Quick Heal AntiVirus Plus 2009 10.00 SP1 and Quick Heal Total Security 2009 10.00 SP1 use weak permissions (Everyone: Full Control) for the product files, which allows local users to gain privileges by replacing executables with Trojan horse programs, as demonstrated by…

  • CVE-2009-4555Jan 4, 2010
    AgoraCart
    AgoraCart GOLD
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in AgoraCart 5.2.005 and 5.2.006 and AgoraCart GOLD 5.5.005 allow remote attackers to hijack the authentication of administrators for requests that (1) modify a .htaccess file via an unspecified request to…

  • CVE-2009-4554Jan 4, 2010
    Snitz Forums 2000
    Snitz Forums 2000
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Snitz Forums 2000 3.4.07 allow remote attackers to inject arbitrary web script or HTML via (1) the url parameter to pop_send_to_friend.asp, related to a crafted onload attribute of an IMG element; or (2) an onload attribute…

  • CVE-2009-4553Jan 4, 2010
    iRehearse
    iRehearse
    risk 0.03cvss —epss 0.02

    Stack-based buffer overflow in iRehearse allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long string in a .m3u playlist file.

  • CVE-2009-4552Jan 4, 2010
    Intesync
    Miniweb
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.

  • CVE-2009-4551Jan 4, 2010
    Intesync
    Miniweb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via the campaign_id parameter in a results action to index.php.

  • CVE-2009-4550Jan 4, 2010
    Kunena
    Kunena
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Kunena Forum (com_kunena) component 1.5.3 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the func parameter to index.php.

  • CVE-2009-4549Jan 4, 2010
    A2 Media Player Pro
    A2 Media Player Pro
    risk 0.03cvss —epss 0.04

    Stack-based buffer overflow in A2 Media Player Pro 2.51 allows remote attackers to execute arbitrary code via a long string in a (1) .m3u or (2) .m3l playlist file.

  • CVE-2009-4548Jan 4, 2010
    Viart
    Helpdesk
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web script or HTML via the category_id parameter to (1) products.php, (2) article.php, (3) product_details.php, or (4) reviews.php; the (5) forum_id parameter to…

  • CVE-2009-4547Jan 4, 2010
    Viart
    CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ViArt CMS 3.x allow remote attackers to inject arbitrary web script or HTML via the (1) category_id parameter to forums.php, or the forum_id parameter to (2) forum.php or (3) forum_topic_new.php.

  • CVE-2009-4546Jan 4, 2010
    Logoshows
    BBS
    risk 0.03cvss —epss 0.03

    globepersonnel_login.asp in Logoshows BBS 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the (1) pb_username (aka pb%5Fusername) and (2) level cookies.

  • CVE-2009-4545Jan 4, 2010
    Logoshows
    BBS
    risk 0.03cvss —epss 0.02

    Logoshows BBS 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/globepersonnel.mdb.

  • CVE-2009-4544Jan 4, 2010
    Cromosoft
    Facil Helpdesk
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in kbase/kbase.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  • CVE-2009-4543Jan 4, 2010
    Cromosoft
    Facil Helpdesk
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to execute arbitrary PHP code via a URL in the lng parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot…

  • CVE-2009-4542Jan 4, 2010
    Isolsoft
    Support Center
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in newticket.php in IsolSoft Support Center 2.5 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

  • CVE-2009-4541Jan 4, 2010
    Isolsoft
    Support Center
    risk 0.04cvss —epss 0.08

    Multiple PHP remote file inclusion vulnerabilities in IsolSoft Support Center 2.5 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to (1) newticket.php or (2) rempass.php, or a URL in the lang parameter in an adduser action to (3) index.php.…

  • CVE-2009-4540Jan 4, 2010
    Mini CMS
    Mini CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in page.php in Mini CMS 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-4539Jan 4, 2010
    Sqlitemanager
    Sqlitemanager
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in main.php in SQLiteManager 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.

  • CVE-2009-4535Dec 31, 2009
    Valenok
    Mongoose
    risk 0.00cvss —epss 0.07

    Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending a / (slash) character to the URI.

  • CVE-2009-4534Dec 31, 2009
    Nanwich
    Faq Ask
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2009-4533Dec 31, 2009
    Drupal
    webform
    risk 0.00cvss —epss 0.02

    The Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, does not prevent caching of a page that contains token placeholders for a default value, which allows remote attackers to read session variables via unspecified vectors.

  • CVE-2009-4532Dec 31, 2009
    Drupal
    webform
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, allows remote authenticated users, with webform creation privileges, to inject arbitrary web script or HTML via a field label.

  • CVE-2009-4531Dec 31, 2009
    Httpdx
    httpdx
    risk 0.04cvss —epss 0.07

    httpdx 1.4.4 and earlier allows remote attackers to obtain the source code for a web page by appending a . (dot) character to the URI.

  • CVE-2009-4530Dec 31, 2009
    Sergey Lyubka
    Mongoose
    risk 0.00cvss —epss 0.01

    Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending ::$DATA to the URI.

  • CVE-2009-4529Dec 31, 2009
    Intervations
    Navicopa Web Server
    risk 0.00cvss —epss 0.02

    InterVations NaviCOPA Web Server 3.0.1.2 and earlier allows remote attackers to obtain the source code for a web page via a trailing encoded space character in a URI, as demonstrated by /index.html%20 and /index.php%20 URIs.

  • CVE-2009-4528Dec 31, 2009
    Drupal
    Organic Groups OG Vocabulary
    risk 0.00cvss —epss 0.01

    The Organic Groups (OG) Vocabulary module 6.x before 6.x-1.0 for Drupal allows remote authenticated group members to bypass intended access restrictions, and create, modify, or read a vocabulary, via unspecified vectors.

  • CVE-2009-4527Dec 31, 2009
    Drupal
    Shibboleth
    risk 0.00cvss —epss 0.00

    The Shibboleth authentication module 5.x before 5.x-3.4 and 6.x before 6.x-3.2, a module for Drupal, does not properly remove statically granted privileges after a logout or other session change, which allows physically proximate attackers to gain privileges by using an…

  • CVE-2009-4526Dec 31, 2009
    Drupal
    Print
    risk 0.00cvss —epss 0.01

    The Send by e-mail sub-module in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.9 and 6.x before 6.x-1.9, a module for Drupal, does not properly enforce privilege requirements, which allows remote attackers to read page titles by requesting a "Send to…

  • CVE-2009-4525Dec 31, 2009
    Drupal
    Print
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.9 and 6.x before 6.x-1.9, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via crafted data in a list of links.

  • CVE-2009-4524Dec 31, 2009
    Drupal
    Realname
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the RealName module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a realname (aka real name) element.

  • CVE-2009-4523Dec 31, 2009
    Zainu
    Zainu
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Zainu 1.0 allows remote attackers to inject arbitrary web script or HTML via the searchSongKeyword parameter in a SearchSong action.

  • CVE-2009-4522Dec 31, 2009
    Bloofoxcms
    Bloofoxcms
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search.5.html in BloofoxCMS 0.3.5 allows remote attackers to inject arbitrary web script or HTML via the search parameter to index.php. NOTE: some of these details are obtained from third party information.