VYPR

CVEs

385,660 total · page 6918 of 7,714

AllCriticalHighKEV
  • CVE-2009-4521Dec 31, 2009
    Eclipse
    Birt
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in birt-viewer/run in Eclipse Business Intelligence and Reporting Tools (BIRT) before 2.5.0, as used in KonaKart and other products, allows remote attackers to inject arbitrary web script or HTML via the __report parameter.

  • CVE-2009-4520Dec 31, 2009
    Drupal
    Cck Comment Reference
    risk 0.00cvss —epss 0.01

    The CCK Comment Reference module 5.x before 5.x-1.2 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to bypass intended access restrictions and read comments by using the autocomplete path.

  • CVE-2009-4519Dec 31, 2009
    Ortro
    Ortro
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Ortro before 1.3.4 have unknown impact and attack vectors.

  • CVE-2009-4518Dec 31, 2009
    Drupal
    Insert Node
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Insert Node module 5.x before 5.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via an inserted node.

  • CVE-2009-4517Dec 31, 2009
    Drupal
    FAQ Ask
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that access unpublished content.

  • CVE-2009-4516Dec 31, 2009
    Drupal
    FAQ Ask
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4515Dec 31, 2009
    Drupal
    Storm
    risk 0.00cvss —epss 0.01

    The Storm module 6.x before 6.x-1.25 for Drupal does not enforce privilege requirements for storminvoiceitem nodes, which allows remote attackers to read node titles via unspecified vectors.

  • CVE-2009-4514Dec 31, 2009
    Drupal
    OpenSocial Shindig-Integrator
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the OpenSocial Shindig-Integrator module 5.x and 6.x before 6.x-2.1, a module for Drupal, allows remote authenticated users, with "create application" privileges, to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4513Dec 31, 2009
    Drupal
    Workflow
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Workflow module 5.x before 5.x-2.4 and 6.x before 6.x-1.2, a module for Drupal, allow remote authenticated users, with "administer workflow" privileges, to inject arbitrary web script or HTML via the name of a (1)…

  • CVE-2009-4512Dec 31, 2009
    Oscailt
    Oscailt
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in Oscailt 3.3, when Use Friendly URL's is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the obj_id parameter.

  • CVE-2009-4502Dec 31, 2009
    Zabbix
    Zabbix
    risk 0.05cvss —epss 0.22

    The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen. NOTE: this attack…

  • CVE-2009-4501Dec 31, 2009
    Zabbix
    Zabbix
    risk 0.04cvss —epss 0.09

    The zbx_get_next_field function in libs/zbxcommon/str.c in Zabbix Server before 1.6.8 allows remote attackers to cause a denial of service (crash) via a request that lacks expected separators, which triggers a NULL pointer dereference, as demonstrated using the Command keyword.

  • CVE-2009-4500Dec 31, 2009
    Zabbix
    Zabbix
    risk 0.00cvss —epss 0.02

    The process_trap function in trapper/trapper.c in Zabbix Server before 1.6.6 allows remote attackers to cause a denial of service (crash) via a crafted request with data that lacks an expected : (colon) separator, which triggers a NULL pointer dereference.

  • CVE-2009-4499Dec 31, 2009
    Zabbix
    Zabbix
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the get_history_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to execute arbitrary SQL commands via a crafted request, possibly related to the send_history_last_id function in…

  • CVE-2009-4498Dec 31, 2009
    Zabbix
    Zabbix
    risk 0.06cvss —epss 0.32

    The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request.

  • CVE-2008-7250Dec 30, 2009
    Sarg
    Sarg
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Squid Analysis Report Generator (Sarg) 2.2.4 allows remote attackers to inject arbitrary web script or HTML via a JavaScript onload event in the User-Agent header, which is not properly handled when displaying the Squid proxy log.…

  • CVE-2008-7249Dec 30, 2009
    Squid Analysis Report Generator
    Sarg
    risk 0.00cvss —epss 0.04

    Buffer overflow in Squid Analysis Report Generator (Sarg) 2.2.3.1, and probably later, allows user-assisted remote attackers to execute arbitrary code via a long HTTP request method in a crafted access.log file, a different vulnerability than CVE-2008-1167.

  • CVE-2009-4484Dec 30, 2009
    MySQL
    MySQL
    risk 0.09cvss —epss 0.70

    Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products, allow remote attackers to…

  • CVE-2009-4483Dec 30, 2009
    Rockliffe
    Mailsite
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in LDAP3A.exe in MailSite 8.0.4 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.13 through 8.11. NOTE: as of 20091229, this disclosure has no…

  • CVE-2009-4482Dec 30, 2009
    Tversity
    Tversity
    risk 0.00cvss —epss 0.05

    Buffer overflow in MediaServer.exe in TVersity 1.6 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by the vd_tversity module in VulnDisco Pack Professional 8.11. NOTE: as of 20091229, this disclosure has no actionable information.…

  • CVE-2009-4480Dec 30, 2009
    Azeotech
    Daqfactory
    risk 0.00cvss —epss 0.03

    Buffer overflow in the web service in AzeoTech DAQFactory 5.77 might allow remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.16 through 8.11. NOTE: as of 20091229, this disclosure has no…

  • CVE-2009-4479Dec 30, 2009
    Rockliffe
    Mailsite
    risk 0.00cvss —epss 0.02

    LDAP3A.exe in MailSite 8.0.4 allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.13 through 8.11. NOTE: as of 20091229, this disclosure has…

  • CVE-2009-4478Dec 30, 2009
    Phpstore
    Real Estate
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Xstate Real Estate 1.0 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) home.html or (2) lands.html.

  • CVE-2009-4477Dec 30, 2009
    Phpstore
    Real Estate
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in page.html in Xstate Real Estate 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter.

  • CVE-2009-4476Dec 30, 2009
    Hauri
    Virobot
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in HAURI ViRobot Desktop 5.5 before 2009-09-28.00 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.15 through 8.11. NOTE: some of these details are…

  • CVE-2009-4475Dec 30, 2009
    Joomlub
    Com Joomlub
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Joomlub (com_joomlub) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in an auction edit action to index.php.

  • CVE-2009-4474Dec 30, 2009
    Mambo (software)
    zoom
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Mike de Boer zoom (com_zoom) component 2.0 for Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.

  • CVE-2009-4473Dec 30, 2009
    Ektron
    Cms4000.net
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in WorkArea/ContentDesigner/ekformsiframe.aspx in Ektron CMS400.NET 7.6.1.53 and 7.6.6.47, and possibly 7.52 through 7.66sp2, allow remote attackers to inject arbitrary web script or HTML via the (1) css, (2) eca, (3) id, and…

  • CVE-2009-4472Dec 30, 2009
    Phpope
    Phpope
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in PHPope 1.0.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[config][dir][plugins] parameter to plugins/address/admin/index.php, (2) GLOBALS[config][dir][functions] parameter to…

  • CVE-2009-4471Dec 30, 2009
    Freeschool
    Freeschool
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in FreeSchool 1.1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CLASSPATH parameter to (1) bib_form.php, (2) bib_pldetails.php, (3) bib_plform.php, (4) bib_plsearchc.php, (5)…

  • CVE-2009-4470Dec 30, 2009
    Dvbbs
    Dvbbs
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in boardrule.php in DVBBS 2.0 allows remote attackers to execute arbitrary SQL commands via the groupboardid parameter.

  • CVE-2009-4469Dec 30, 2009
    PhpPowerCards
    phpPowerCards
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in pagenumber.inc.php in phpPowerCards 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, the (2) archiv parameter, and the (3) subcat parameter.

  • CVE-2009-4468Dec 30, 2009
    Deluxebb
    Deluxebb
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in misc.php in DeluxeBB 1.3 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2009-4467Dec 30, 2009
    Deluxebb
    Deluxebb
    risk 0.03cvss —epss 0.02

    misc.php in DeluxeBB 1.3 allows remote attackers to register accounts without a valid email address via a valemail action with the valmem set to a pre-assigned user ID, which is visible from a memberlist action.

  • CVE-2009-4466Dec 30, 2009
    Deluxebb
    Deluxebb
    risk 0.03cvss —epss 0.02

    DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a crafted page parameter to misc.php, which reveals the installation path in an error message. NOTE: this issue might be resultant from improperly controlled computation in tools.php that leads to a denial…

  • CVE-2009-4465Dec 30, 2009
    Deluxebb
    Deluxebb
    risk 0.03cvss —epss 0.02

    DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and configuration information, log data, and gain administrative access via a direct request to scripts in (1) templates/ including (2)…

  • CVE-2009-4464Dec 30, 2009
    Activewebsoftwares
    Active Business Directory
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in searchadvance.asp in Active Business Directory 2 allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2009-4463Dec 30, 2009
    Intellicom
    Netbiter Webscada Ws100
    risk 0.00cvss —epss 0.03

    Intellicom NetBiter WebSCADA devices use default passwords for the HICP network configuration service, which makes it easier for remote attackers to modify network settings and cause a denial of service. NOTE: this is only a vulnerability when the administrator does not follow…

  • CVE-2009-4462Dec 30, 2009
    Intellicom
    Netbiterconfig
    risk 0.05cvss —epss 0.20

    Stack-based buffer overflow in the NetBiterConfig utility (NetBiterConfig.exe) 1.3.0 for Intellicom NetBiter WebSCADA allows remote attackers to execute arbitrary code via a long hn (hostname) parameter in a crafted HICP-protocol UDP packet.

  • CVE-2009-4461Dec 30, 2009
    Flatpress
    Flatpress
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in FlatPress 0.909 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) contact.php, (2) login.php, and (3) search.php.

  • CVE-2009-4460Dec 30, 2009
    Ljscripts
    Auto Surf Traffic Exchange Script
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Auto-Surf Traffic Exchange Script 1.1 allow remote attackers to inject arbitrary web script or HTML via the rid parameter to (1) index.php, (2) faq.php, and (3) register.php.

  • CVE-2009-4459Dec 30, 2009
    Redmine
    Redmine
    risk 0.00cvss —epss 0.01

    Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which…

  • CVE-2009-4458Dec 30, 2009
    Freepbx
    Freepbx
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the (1) tech parameter to admin/admin/config.php during a trunks display action, the (2) description…

  • CVE-2009-4457Dec 30, 2009
    Provider4u
    Vsftpd Webmin Module
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in the Vsftpd Webmin module before 1.3b for the Vsftpd server have unknown impact and attack vectors related to "Some security issues."

  • CVE-2009-4456Dec 30, 2009
    Greendesktiny
    Green Desktiny
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news_detail.php in Green Desktiny 2.3.1, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-4455Dec 29, 2009
    Cisco Systems, Inc.
    5500 Series Adaptive Security Appliance
    risk 0.00cvss —epss 0.01

    The default configuration of Cisco ASA 5500 Series Adaptive Security Appliance (Cisco ASA) 7.0, 7.1, 7.2, 8.0, 8.1, and 8.2 allows portal traffic to access arbitrary backend servers, which might allow remote authenticated users to bypass intended access restrictions and access…

  • CVE-2009-4454Dec 29, 2009
    VideoCache
    VideoCache
    risk 0.03cvss —epss 0.01

    vccleaner in VideoCache 1.9.2 allows local users with Squid proxy user privileges to overwrite arbitrary files via a symlink attack on /var/log/videocache/vccleaner.log.

  • CVE-2009-4445Dec 29, 2009
    Microsoft
    Internet Information Server
    risk 0.01cvss —epss 0.13

    Microsoft Internet Information Services (IIS), when used in conjunction with unspecified third-party upload applications, allows remote attackers to create empty files with arbitrary extensions via a filename containing an initial extension followed by a : (colon) and a safe…

  • CVE-2009-4444Dec 29, 2009
    Microsoft
    Internet Information Server
    risk 0.05cvss —epss 0.64

    Microsoft Internet Information Services (IIS) 5.x and 6.x uses only the portion of a filename before a ; (semicolon) character to determine the file extension, which allows remote attackers to bypass intended extension restrictions of third-party upload applications via a…

  • CVE-2009-4453Dec 29, 2009
    Softcab
    Sound Converter Activex
    risk 0.03cvss —epss 0.05

    Insecure method vulnerability in SoftCab Sound Converter ActiveX control (sndConverter.ocx) 1.2 allows remote attackers to create or overwrite arbitrary files via the SaveFormat method. NOTE: some of these details are obtained from third party information.