VYPR

CVEs

385,605 total · page 6926 of 7,713

AllCriticalHighKEV
  • CVE-2009-4025Nov 29, 2009
    Pear
    Pear
    risk 0.00cvss —epss 0.06

    Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: some of these details are obtained from third party…

  • CVE-2009-4024Nov 29, 2009
    Pear
    Pear
    risk 0.00cvss —epss 0.06

    Argument injection vulnerability in the ping function in Ping.php in the Net_Ping package before 2.4.5 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: this has also been reported as a shell metacharacter problem.

  • CVE-2009-4023Nov 29, 2009
    Pear
    Pear
    risk 0.00cvss —epss 0.02

    Argument injection vulnerability in the sendmail implementation of the Mail::Send method (Mail/sendmail.php) in the Mail package 1.1.14 for PEAR allows remote attackers to read and write arbitrary files via a crafted $from parameter, a different vector than CVE-2009-4111.

  • CVE-2009-4095Nov 29, 2009
    Companionway
    Myphile
    risk 0.00cvss —epss 0.01

    myPhile 1.2.1 allows remote attackers to bypass authentication via an empty password. NOTE: some of these details are obtained from third party information.

  • CVE-2009-4094Nov 29, 2009
    DesignForJoomla.com
    Com Ezine
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in class/php/d4m_ajax_pagenav.php in the D4J eZine (com_ezine) component 2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path parameter.

  • CVE-2009-4093Nov 29, 2009
    Simplog
    Simplog
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in comments.php in Simplog 0.9.3.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) cname (Name) or (2) email parameters.

  • CVE-2009-4092Nov 29, 2009
    Simplog
    Simplog
    risk 0.03cvss —epss 0.05

    Cross-site request forgery (CSRF) vulnerability in user.php in Simplog 0.9.3.2, and possibly earlier, allows remote attackers to hijack the authentication of administrators and users for requests that change passwords.

  • CVE-2009-4091Nov 29, 2009
    Simplog
    Simplog
    risk 0.04cvss —epss 0.06

    comments.php in Simplog 0.9.3.2, and possibly earlier, does not properly restrict access, which allows remote attackers to edit or delete comments via the (1) edit or (2) del action.

  • CVE-2009-4090Nov 29, 2009
    Telepark
    Telepark.wiki
    risk 0.00cvss —epss 0.03

    Unrestricted file upload vulnerability in ajax/addComment.php in telepark.wiki 2.4.23 and earlier script allows remote attackers to execute arbitrary code by uploading a file with a name containing a NULL byte.

  • CVE-2009-4089Nov 29, 2009
    Telepark
    Telepark.wiki
    risk 0.04cvss —epss 0.07

    telepark.wiki 2.4.23 and earlier allows remote attackers to bypass authorization and (1) delete arbitrary pages via a modified pageID parameter to ajax/deletePage.php or (2) delete arbitrary comments via a modified pageID parameter to ajax/deleteComment.php.

  • CVE-2009-4088Nov 29, 2009
    Telepark
    Telepark.wiki
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in telepark.wiki 2.4.23 and earlier allow remote attackers to read arbitrary files via directory traversal sequences in the css parameter to (1) getjs.php and (2) getcsslocal.php; and include and execute arbitrary local files via the…

  • CVE-2009-4087Nov 29, 2009
    Telepark
    Telepark.wiki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in telepark.wiki 2.4.23 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  • CVE-2009-4086Nov 29, 2009
    Xerver
    HTTP Server
    risk 0.03cvss —epss 0.05

    CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via certain byte sequences at the end of a URL. NOTE: some of these details are obtained from third party…

  • CVE-2009-4085Nov 29, 2009
    PHP Traverser
    PHP Traverser
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in assets/plugins/mp3_id/mp3_id.php in PHP Traverser 0.8.0 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[BASE] parameter. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2009-4084Nov 29, 2009
    E107
    E107
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the search feature in e107 0.7.16 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-4083Nov 29, 2009
    E107
    E107
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in (1) submitnews.php, (2) usersettings.php; and (3) newpost.php, (4) banlist.php, (5) banner.php, (6) cpage.php,…

  • CVE-2009-4082Nov 29, 2009
    Lanifex
    Outreach Project Tool
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in forums/Forum_Include/index.php in Outreach Project Tool (OPT) 1.2.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CRM_path parameter.

  • CVE-2009-4032Nov 29, 2009
    Cacti (software)
    Cacti
    risk 0.03cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) graph.php, (2) include/top_graph_header.php, (3) lib/html_form.php, and (4) lib/timespan_settings.php, as demonstrated by…

  • CVE-2009-4031Nov 29, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    The do_insn_fetch function in arch/x86/kvm/emulate.c in the x86 emulator in the KVM subsystem in the Linux kernel before 2.6.32-rc8-next-20091125 tries to interpret instructions that contain too many bytes to be valid, which allows guest OS users to cause a denial of service…

  • CVE-2009-4018Nov 29, 2009
    PHP
    PHP
    risk 0.04cvss —epss 0.11

    The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_vars directives, which allows context-dependent attackers to execute programs with an arbitrary…

  • CVE-2009-4079Nov 25, 2009
    Redmine
    Redmine
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Redmine 0.8.5 and earlier allows remote attackers to hijack the authentication of users for requests that delete a ticket via unspecified vectors.

  • CVE-2009-4078Nov 25, 2009
    Redmine
    Redmine
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Redmine 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4077Nov 25, 2009
    Roundcube
    Webmail
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that send arbitrary emails via unspecified vectors, a different vulnerability than CVE-2009-4076.

  • CVE-2009-4076Nov 25, 2009
    Roundcube
    Webmail
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that modify user information via unspecified vectors, a different vulnerability than CVE-2009-4077.

  • CVE-2009-4075Nov 25, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the timeout mechanism in sshd in Sun Solaris 10, and OpenSolaris snv_99 through snv_123, allows remote attackers to cause a denial of service (daemon outage) via unknown vectors that trigger a "dangling sshd authentication thread."

  • CVE-2009-4074Nov 25, 2009
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.15

    The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to leverage the "response-changing mechanism" to conduct cross-site scripting (XSS) attacks against web sites that have no inherent XSS vulnerabilities, related to the details of output encoding and improper…

  • CVE-2009-4022Nov 25, 2009
    Isc
    Bind
    risk 0.01cvss —epss 0.08

    Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by…

  • CVE-2009-4021Nov 25, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The fuse_direct_io function in fs/fuse/file.c in the fuse subsystem in the Linux kernel before 2.6.32-rc7 might allow attackers to cause a denial of service (invalid pointer dereference and OOPS) via vectors possibly related to a memory-consumption attack.

  • CVE-2009-3033Nov 25, 2009
    Symantec
    Management Platform
    risk 0.06cvss —epss 0.40

    Buffer overflow in the RunCmd method in the Altiris eXpress NS Console Utilities ActiveX control in AeXNSConsoleUtilities.dll in the web console in Symantec Altiris Deployment Solution 6.9.x, Altiris Notification Server 6.0.x, and Management Platform 7.0.x allows remote…

  • CVE-2009-4073Nov 24, 2009
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    The printing functionality in Microsoft Internet Explorer 8 allows remote attackers to discover a local pathname, and possibly a local username, by reading the dc:title element of a PDF document that was generated from a local web page.

  • CVE-2009-4072Nov 24, 2009
    Opera
    Opera Browser
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Opera before 10.10 has unknown impact and attack vectors, related to a "moderately severe issue."

  • CVE-2009-4071Nov 24, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 10.10, when exception stacktraces are enabled, places scripting error messages from a web site into variables that can be read by a different web site, which allows remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via…

  • CVE-2009-4070Nov 24, 2009
    GForge
    Gforge
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in GForge 4.5.14, 4.7.3, and possibly other versions allows remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2009-4069Nov 24, 2009
    GForge
    Gforge
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in GForge 4.5.14, 4.7.3, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-3898Nov 24, 2009
    Nginx
    Nginx
    risk 0.04cvss —epss 0.16

    Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV…

  • CVE-2009-3897MedNov 24, 2009
    Dovecot (software)
    Dovecot
    risk 0.36cvss 5.5epss 0.00

    Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the…

  • CVE-2009-3896Nov 24, 2009
    Nginx
    Nginx
    risk 0.01cvss —epss 0.10

    src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.

  • CVE-2009-3578Nov 24, 2009
    Autodesk
    Alias Wavefront Maya
    risk 0.03cvss —epss 0.04

    Autodesk Maya 8.0, 8.5, 2008, 2009, and 2010 and Alias Wavefront Maya 6.5 and 7.0 allow remote attackers to execute arbitrary code via a (1) .ma or (2) .mb file that uses the Maya Embedded Language (MEL) python command or unspecified other MEL commands, related to "Script Nodes."

  • CVE-2009-3577Nov 24, 2009
    Autodesk
    3D Studio Max
    risk 0.03cvss —epss 0.05

    Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method, related to "application callbacks."

  • CVE-2009-3576Nov 24, 2009
    Autodesk
    Softimage
    risk 0.03cvss —epss 0.03

    Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the WScript.Shell ActiveX…

  • CVE-2009-3303Nov 24, 2009
    GForge
    Gforge
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in www/help/tracker.php in GForge 4.5.14, 4.7 rc2, and 4.8.1 allows remote attackers to inject arbitrary web script or HTML via the helpname parameter.

  • CVE-2009-4066Nov 24, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the "My Account" feature in PHPList Integration module 5 before 5.x-1.2 and 6 before 6.x-1.1 for Drupal allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) subscribing or…

  • CVE-2009-4065Nov 24, 2009
    Drupal
    Strongarm
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the settings page in the Strongarm module 6.x before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via the value field when viewing overridden variables.

  • CVE-2009-4064Nov 24, 2009
    Drupal
    Gallery Assist
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Gallery Assist module 6.x before 6.x-1.7 for Drupal allows remote attackers to inject arbitrary web script or HTML via node titles.

  • CVE-2009-4063Nov 24, 2009
    Drupal
    Subgroups for Organic Groups (OG)
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Subgroups for Organic Groups (OG) module 5.x before 5.x-4.0 and 5.x before 5.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified node titles.

  • CVE-2009-4062Nov 24, 2009
    Drupal
    Printfriendly
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Printfriendly module 6.x before 6.x-1.6 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4061Nov 24, 2009
    Drupal
    Agreement
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Agreement module 6.x before 6.x-1.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4060Nov 24, 2009
    Cubecart
    Cubecart
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in includes/content/viewProd.inc.php in CubeCart before 4.3.7 remote attackers to execute arbitrary SQL commands via the productId parameter.

  • CVE-2009-4059Nov 24, 2009
    Joomclan
    Com Joomclip
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JoomClip (com_joomclip) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in a thumbs action to index.php.

  • CVE-2009-4058Nov 24, 2009
    Telebid
    Auction Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in allauctions.php in Telebid Auction Script allows remote attackers to execute arbitrary SQL commands via the aid parameter.