VYPR

CVEs

385,605 total · page 6927 of 7,713

AllCriticalHighKEV
  • CVE-2009-4057Nov 24, 2009
    Inertialfate
    iF Portfolio Nexus
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an item action to index.php.

  • CVE-2009-4056Nov 24, 2009
    Betsy
    Betsy CMS
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in admin/popup.php in Betsy CMS 3.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the popup parameter.

  • CVE-2009-4017Nov 24, 2009
    PHP
    PHP
    risk 0.04cvss —epss 0.12

    PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to…

  • CVE-2009-3843Nov 24, 2009
    Microfocus
    Operations Manager
    risk 0.09cvss —epss 0.79

    HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby execute arbitrary code, by using the org.apache.catalina.manager.HTMLManagerServle…

  • CVE-2009-4053MedNov 23, 2009
    Home FTP Server Project
    Home Ftp Server
    risk 0.46cvss 6.5epss 0.04

    Multiple directory traversal vulnerabilities in Home FTP Server 1.10.1.139 allow remote authenticated users to (1) create arbitrary directories via directory traversal sequences in an MKD command or (2) create files with any contents in arbitrary directories via directory…

  • CVE-2009-4052Nov 23, 2009
    IBM
    Rational Application Developer For Websphere
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the JSF Widget Library Runtime in IBM Rational Application Developer for WebSphere Software before 7.0.0.10 and Rational Software Architect before 7.0.0.10 allow remote attackers to inject arbitrary web script or HTML via…

  • CVE-2009-4051Nov 23, 2009
    Home FTP Server Project
    Home Ftp Server
    risk 0.03cvss —epss 0.06

    Home FTP Server 1.10.1.139 allows remote attackers to cause a denial of service (daemon outage) via multiple invalid SITE INDEX commands.

  • CVE-2009-4050Nov 23, 2009
    Phpmybackuppro
    Phpmybackuppro
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2009-4049Nov 23, 2009
    Avast\!
    aswRdr.sys
    risk 0.03cvss —epss 0.01

    Heap-based buffer overflow in aswRdr.sys (aka the TDI RDR driver) in avast! Home and Professional 4.8.1356.0 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via crafted arguments to IOCTL 0x80002024.

  • CVE-2009-4048Nov 23, 2009
    Dxmsoft
    Xm Easy Personal FTP Server
    risk 0.03cvss —epss 0.02

    Dxmsoft XM Easy Personal FTP Server 5.8.0 allows remote authenticated users to cause a denial of service (daemon outage) via an APPE command to one socket in conjunction with a DELE command to a second socket.

  • CVE-2009-4047Nov 23, 2009
    P Hd
    Phd Help Desk
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in PHD Help Desk 1.43 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to area.php; the (2) pagina, (3) sentido, (4) q_registros, and (5) orden parameters to area.php; (6) the q_registros…

  • CVE-2009-3559Nov 23, 2009
    PHP
    PHP
    risk 0.00cvss —epss 0.03

    main/streams/plain_wrapper.c in PHP 5.3.x before 5.3.1 does not recognize the safe_mode_include_dir directive, which allows context-dependent attackers to have an unknown impact by triggering the failure of PHP scripts that perform include or require operations, as demonstrated…

  • CVE-2009-3558Nov 23, 2009
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The posix_mkfifo function in ext/posix/posix.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass open_basedir restrictions, and create FIFO files, via the pathname and mode arguments, as demonstrated by creating a .htaccess file.

  • CVE-2009-3557Nov 23, 2009
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The tempnam function in ext/standard/file.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass safe_mode restrictions, and create files in group-writable or world-writable directories, via the dir and prefix arguments.

  • CVE-2009-4046Nov 20, 2009
    Frontaccounting
    Frontaccounting
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) bank_accounts.php, (2) currencies.php, (3) exchange_rates.php, (4) gl_account_types.php, and (5)…

  • CVE-2009-4045Nov 20, 2009
    Frontaccounting
    Frontaccounting
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to various .inc and .php files in (1) reporting/, (2) sales/, (3) sales/includes/, (4) sales/includes/db/, (5)…

  • CVE-2009-4044Nov 20, 2009
    Drupal
    Web Services
    risk 0.00cvss —epss 0.01

    The Web Services module 6.x for Drupal does not perform the expected access control, which allows remote attackers to make unspecified use of an API via unknown vectors.

  • CVE-2009-4043Nov 20, 2009
    Drupal
    AddToAny
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the AddToAny module 5.x before 5.x-2.4 and 6.x before 6.x-2.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via a node title.

  • CVE-2009-4042Nov 20, 2009
    Drupal
    RootCandy
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the RootCandy theme 6.x before 6.x-1.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via the URI.

  • CVE-2009-4041Nov 20, 2009
    Usebb
    Usebb
    risk 0.00cvss —epss 0.02

    UseBB 1.0.9 before 1.0.10 allows remote attackers to cause a denial of service (infinite loop) via crafted BBCode tags.

  • CVE-2009-4040Nov 20, 2009
    PhpMyAdmin
    Phpmyfaq
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.0.17 and 2.5.x before 2.5.2, when used with Internet Explorer 6 or 7, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to the search page.

  • CVE-2009-4039Nov 20, 2009
    Piwigo
    Piwigo
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Piwigo before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4038Nov 20, 2009
    Nch
    Axon Virtual Pbx
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in NCH Software Axon Virtual PBX 2.10 and 2.11 allow remote attackers to inject arbitrary web script or HTML via the (1) onok or (2) oncancel parameter to the logon program. NOTE: the provenance of this information is unknown;…

  • CVE-2009-4037Nov 20, 2009
    Frontaccounting
    Frontaccounting
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7, and 2.2.x before 2.2 RC, allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) admin/db/users_db.inc, and various other .inc and .php files under (2) admin/, (3)…

  • CVE-2005-4883Nov 20, 2009
    Philippe Jounin
    Tftpd32
    risk 0.00cvss —epss 0.01

    Race condition in Philippe Jounin Tftpd32 before 2.80 allows remote attackers to cause a denial of service (daemon crash) via invalid "connect frames."

  • CVE-2005-4882Nov 20, 2009
    Philippe Jounin
    Tftpd32
    risk 0.00cvss —epss 0.02

    tftpd in Philippe Jounin Tftpd32 2.74 and earlier, as used in Wyse Simple Imager (WSI) and other products, allows remote attackers to cause a denial of service (daemon crash) via a long filename in a TFTP read (aka RRQ or get) request, a different vulnerability than…

  • CVE-2009-3895Nov 20, 2009
    Libexif Project
    Libexif
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in the exif_entry_fix function (aka the tag fixup routine) in libexif/exif-entry.c in libexif 0.6.18 allows remote attackers to cause a denial of service or possibly execute arbitrary code via an invalid EXIF image. NOTE: some of these details are…

  • CVE-2009-3842Nov 20, 2009
    Microfocus
    Color Laserjet Cp3525
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability on the HP Color LaserJet M3530 Multifunction Printer with firmware 05.058.4 and the Color LaserJet CP3525 Printer with firmware 53.021.2 allows remote attackers to obtain "access to data" or cause a denial of service via unknown vectors.

  • CVE-2009-3386Nov 20, 2009
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Template.pm in Bugzilla 3.3.2 through 3.4.3 and 3.5 through 3.5.1 allows remote attackers to discover the alias of a private bug by reading the (1) Depends On or (2) Blocks field of a related bug.

  • CVE-2009-3080Nov 20, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Array index error in the gdth_read_event function in drivers/scsi/gdth.c in the Linux kernel before 2.6.32-rc8 allows local users to cause a denial of service or possibly gain privileges via a negative event index in an IOCTL request.

  • CVE-2009-4006Nov 20, 2009
    Rhinosoft
    Serv U
    risk 0.10cvss —epss 0.83

    Stack-based buffer overflow in the TEA decoding algorithm in RhinoSoft Serv-U FTP server 7.0.0.1, 9.0.0.5, and other versions before 9.1.0.0 allows remote attackers to execute arbitrary code via a long hexadecimal string.

  • CVE-2009-4005Nov 20, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The collect_rx_frame function in drivers/isdn/hisax/hfc_usb.c in the Linux kernel before 2.6.32-rc7 allows attackers to have an unspecified impact via a crafted HDLC packet that arrives over ISDN and triggers a buffer under-read.

  • CVE-2009-4004HigNov 20, 2009
    Linux
    Kernel
    risk 0.51cvss 7.8epss 0.00

    Buffer overflow in the kvm_vcpu_ioctl_x86_setup_mce function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.32-rc7 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a KVM_X86_SETUP_MCE IOCTL request…

  • CVE-2009-3553HigNov 20, 2009
    Apple Inc.
    Cups
    risk 0.49cvss 7.5epss 0.04

    Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote attackers to cause a denial of service (daemon crash or hang) via a client…

  • CVE-2009-3978Nov 19, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The nsGIFDecoder2::GifWrite function in decoders/gif/nsGIFDecoder2.cpp in libpr0n in Mozilla Firefox before 3.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an animated GIF file with a large image size, a different…

  • CVE-2009-3977Nov 19, 2009
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.02

    Multiple buffer overflows in a certain ActiveX control in ActiveDom.ocx in HP OpenView Network Node Manager (OV NNM) 7.53 might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via a long string argument to the (1)…

  • CVE-2009-3909Nov 19, 2009
    GIMP
    Gimp
    risk 0.01cvss —epss 0.09

    Integer overflow in the read_channel_data function in plug-ins/file-psd/psd-load.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a crafted PSD file that triggers a heap-based buffer overflow.

  • CVE-2009-3840Nov 19, 2009
    Microfocus
    OpenView Network Node Manager
    risk 0.04cvss —epss 0.09

    The embedded database engine service (aka ovdbrun.exe) in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to cause a denial of service (daemon crash) via an invalid Error Code field in a packet.

  • CVE-2009-3976Nov 18, 2009
    Labtam Inc
    Proftp
    risk 0.05cvss —epss 0.28

    Buffer overflow in Labtam ProFTP 2.9 allows remote FTP servers to cause a denial of service (application crash) or execute arbitrary code via a long 220 reply (aka connection greeting or welcome message).

  • CVE-2009-3975Nov 18, 2009
    Moagallery
    Moa
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Moa Gallery 1.1.0 and 1.2.0 allows remote attackers to execute arbitrary SQL commands via the gallery_id parameter in a gallery_view action.

  • CVE-2009-3974Nov 18, 2009
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Invision Power Board (IPB or IP.Board) 3.0.0, 3.0.1, and 3.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) search_term parameter to admin/applications/core/modules_public/search/search.php and (2) aid parameter…

  • CVE-2009-3973Nov 18, 2009
    Turnkey
    Arcade Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL commands via the id parameter in a browse action, a different vector than CVE-2008-5629.

  • CVE-2009-3972Nov 18, 2009
    Joomla
    com_siirler
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Q-Proje Siirler Bileseni (com_siirler) component 1.2 RC for Joomla! allows remote attackers to execute arbitrary SQL commands via the sid parameter in an sdetay action to index.php.

  • CVE-2009-3971Nov 18, 2009
    Joomla
    jTips
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the jTips (com_jtips) component 1.0.7 and 1.0.9 for Joomla! allows remote attackers to execute arbitrary SQL commands via the season parameter in a ladder action to index.php.

  • CVE-2009-3970Nov 18, 2009
    Phpdirsubmit
    PHP Dir Submit
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in PHP Dir Submit (aka WebsiteSubmitter or Submitter Script) allows remote authenticated users to execute arbitrary SQL commands via the aid parameter in a showarticle action.

  • CVE-2009-3969Nov 18, 2009
    Faslo
    Faslo Player
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in Faslo Player 7.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .m3u playlist file.

  • CVE-2009-3968Nov 18, 2009
    ITechBids
    ITechBids
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ITechBids 8.0 allow remote attackers to execute arbitrary SQL commands via the (1) user_id parameter to feedback.php, (2) cate_id parameter to category.php, (3) id parameter to news.php, and (4) productid parameter to itechd.php. NOTE:…

  • CVE-2009-3967Nov 18, 2009
    Ed Charkow
    Supercharged Linking
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in browse.php in Ed Charkow SuperCharged Linking allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-3966Nov 18, 2009
    Arcadetradescript
    Arcade Trade Script
    risk 0.03cvss —epss 0.02

    Arcade Trade Script 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the adminLoggedIn cookie to true.

  • CVE-2009-3965Nov 18, 2009
    Maniacomputer
    New5starrating
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in rating.php in New 5 star Rating 1.0 allows remote attackers to execute arbitrary SQL commands via the det parameter.