VYPR

CVEs

385,564 total · page 6929 of 7,712

AllCriticalHighKEV
  • CVE-2009-3882Nov 9, 2009
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and remote attack vectors, related to "information leaks in mutable variables," aka Bug Id 6657026.

  • CVE-2009-3881Nov 9, 2009
    Openjdk
    OpenJDK
    risk 0.00cvss —epss 0.03

    Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not prevent the existence of children of a resurrected ClassLoader, which allows remote attackers to gain privileges via unspecified vectors, related to an "information leak vulnerability," aka Bug Id…

  • CVE-2009-3880Nov 9, 2009
    Sun Corporation
    Jre
    risk 0.00cvss —epss 0.02

    The Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not properly restrict the objects that may be sent to loggers, which allows attackers to obtain sensitive information via vectors…

  • CVE-2009-3879Nov 9, 2009
    Sun Corporation
    Openjdk
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in the (1) X11 and (2) Win32GraphicsDevice subsystems in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and attack vectors, related to failure to clone arrays that are returned by the…

  • CVE-2009-3729Nov 9, 2009
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the TrueType font parsing functionality in Sun Java SE 5.0 before Update 22 and 6 before Update 17 allows remote attackers to cause a denial of service (application crash) via a certain test suite, aka Bug Id 6815780.

  • CVE-2009-3728Nov 9, 2009
    Openjdk
    OpenJDK
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in the ICC_Profile.getInstance method in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local International Color Consortium (ICC)…

  • CVE-2009-3726Nov 9, 2009
    Linux
    Kernel
    risk 0.04cvss —epss 0.12

    The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes, which…

  • CVE-2009-3922Nov 9, 2009
    Drupal
    User Protect
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the User Protect module 5.x before 5.x-1.4 and 6.x before 6.x-1.3, a module for Drupal, allow remote attackers to hijack the authentication of administrators for requests that (1) delete the editing protection of a…

  • CVE-2009-3921Nov 9, 2009
    Ezra Barnett Gildesgame
    Smartqueue Og
    risk 0.00cvss —epss 0.01

    The Smartqueue_og module 5.x before 5.x-1.3 and 6.x before 6.x-1.0-rc3, a module for Drupal, does not verify group-node privileges in certain circumstances involving subqueue creation, which allows remote authenticated users to discover arbitrary organic group names by reading…

  • CVE-2009-3920Nov 9, 2009
    Drupal
    NGP COO/CWP Integration (crmngp)
    risk 0.00cvss —epss 0.01

    An administration page in the NGP COO/CWP Integration (crmngp) module 6.x before 6.x-1.12 for Drupal does not perform the expected access control, which allows remote attackers to read log information via unspecified vectors.

  • CVE-2009-3919Nov 9, 2009
    Drupal
    crmngp
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the NGP COO/CWP Integration (crmngp) module 6.x before 6.x-1.12 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified "user-supplied information."

  • CVE-2009-3918Nov 9, 2009
    Karim Ratib
    Zoomify
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Zoomify module 5.x before 5.x-2.2 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the node title.

  • CVE-2009-3917Nov 9, 2009
    Drupal
    S5 Presentation Player
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the S5 Presentation Player module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via an unspecified field that is copied to the HTML HEAD element.

  • CVE-2009-3916Nov 9, 2009
    Drupal
    Node Hierarchy
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Node Hierarchy module 5.x before 5.x-1.3 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a child node title.

  • CVE-2009-3915Nov 9, 2009
    Drupal
    Link Module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the "Separate title and URL" formatter in the Link module 5.x before 5.x-2.6 and 6.x before 6.x-2.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the link title field.

  • CVE-2009-3914Nov 9, 2009
    Drupal
    Temporary Invitation
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Temporary Invitation module 5.x before 5.x-2.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the Name field in an invitation.

  • CVE-2009-3913Nov 9, 2009
    Xerox
    Fiery Webtools
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in summary.php in Xerox Fiery Webtools allows remote attackers to execute arbitrary SQL commands via the select parameter.

  • CVE-2009-3912Nov 9, 2009
    Tftgallery
    Tftgallery
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in TFTgallery 0.13 allows remote attackers to read arbitrary files via a ..%2F (encoded dot dot slash) in the album parameter.

  • CVE-2009-3911Nov 9, 2009
    Tftgallery
    Tftgallery
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in settings.php in TFTgallery 0.13 allows remote attackers to inject arbitrary web script or HTML via the sample parameter.

  • CVE-2009-3555CriNov 9, 2009
    Apache
    HTTP Server
    risk 0.67cvss 9.8epss 0.87

    The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4…

  • CVE-2009-3905Nov 6, 2009
    Ecouriersoftware
    E Courirer CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in e-Courier CMS allow remote attackers to inject arbitrary web script or HTML via the UserGUID parameter to (1) Wizard_tracking.asp, (2) wizard_oe2.asp, (3) your-register.asp, (4) main-whyregister.asp, and (5) your.asp in…

  • CVE-2009-3904Nov 6, 2009
    Cubecart
    Cubecart
    risk 0.04cvss —epss 0.09

    classes/session/cc_admin_session.php in CubeCart 4.3.4 does not properly restrict administrative access permissions, which allows remote attackers to bypass restrictions and gain administrative access via a HTTP request that contains an empty (1) sessID (ccAdmin cookie), (2)…

  • CVE-2009-3903Nov 6, 2009
    Manageengine
    Netflow Analyzer
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in jspui/index.jsp in ManageEngine Netflow Analyzer 7.5 build 7500 allow remote attackers to inject arbitrary web script or HTML via the (1) view and (2) section parameters. NOTE: the provenance of this information is unknown;…

  • CVE-2009-3902Nov 6, 2009
    Cherokee
    Cherokee Httpd
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in Cherokee Web Server 0.5.4 and earlier for Windows allows remote attackers to read arbitrary files via a /\.. (slash backslash dot dot) in the URL.

  • CVE-2009-3901Nov 6, 2009
    E Courier
    e-Courier CMS
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in e-Courier CMS allow remote attackers to inject arbitrary web script or HTML via the UserGUID parameter to home/index.asp and other unspecified vectors.

  • CVE-2009-3900Nov 6, 2009
    IBM
    Powerha
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Cluster Management component in IBM PowerHA 5.4, 5.4.1, 5.5, and 6.1 on AIX allows remote attackers to modify the operating-system configuration via packets to the godm port (6177/tcp).

  • CVE-2009-3899Nov 6, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.03

    Memory leak in the Sockets Direct Protocol (SDP) driver in Sun Solaris 10, and OpenSolaris snv_57 through snv_94, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.

  • CVE-2009-3850Nov 6, 2009
    Blender
    Blender
    risk 0.04cvss —epss 0.09

    Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code via a .blend file that contains Python statements in the onLoad action of a ScriptLink SDNA.

  • CVE-2009-3725Nov 6, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The connector layer in the Linux kernel before 2.6.31.5 does not require the CAP_SYS_ADMIN capability for certain interaction with the (1) uvesafb, (2) pohmelfs, (3) dst, or (4) dm subsystem, which allows local users to bypass intended access restrictions and gain privileges via…

  • CVE-2009-3300Nov 6, 2009
    Internet2
    Identity Provider
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service Provider 1.3.x before 1.3.5 and 2.x before 2.3, in Internet2 Middleware Initiative Shibboleth allow remote attackers to inject arbitrary…

  • CVE-2009-2685Nov 6, 2009
    Microfocus
    Power Manager
    risk 0.09cvss —epss 0.77

    Stack-based buffer overflow in the login form in the management web server in HP Power Manager allows remote attackers to execute arbitrary code via the Login variable.

  • CVE-2009-3878Nov 5, 2009
    Sun Corporation
    Java System Web Server
    risk 0.00cvss —epss 0.02

    Buffer overflow in Sun Java System Web Server 7.0 Update 6 has unspecified impact and remote attack vectors, as demonstrated by the vd_sjws module in VulnDisco Pack Professional 8.12. NOTE: as of 20091105, this disclosure has no actionable information. However, because the…

  • CVE-2009-3877Nov 5, 2009
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP…

  • CVE-2009-3876Nov 5, 2009
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted DER…

  • CVE-2009-3875Nov 5, 2009
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    The MessageDigest.isEqual function in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to spoof HMAC-based digital…

  • CVE-2009-3874Nov 5, 2009
    Sun Corporation
    Jdk
    risk 0.01cvss —epss 0.10

    Integer overflow in the JPEGImageReader implementation in the ImageI/O component in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via large subsample…

  • CVE-2009-3873Nov 5, 2009
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.04

    The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file, related to a "quantization problem," aka Bug Id 6862968.

  • CVE-2009-3872Nov 5, 2009
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the JPEG JFIF Decoder in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file,…

  • CVE-2009-3871Nov 5, 2009
    Sun Corporation
    Jdk
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in the setBytePixels function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before…

  • CVE-2009-3869Nov 5, 2009
    Sun Corporation
    Jdk
    risk 0.08cvss —epss 0.65

    Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before…

  • CVE-2009-3868Nov 5, 2009
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.04

    Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 does not properly parse color profiles, which allows remote attackers to gain privileges via a crafted image file, aka Bug Id…

  • CVE-2009-3867Nov 5, 2009
    Sun Corporation
    Jdk
    risk 0.09cvss —epss 0.73

    Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a…

  • CVE-2009-3866Nov 5, 2009
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.06

    The Java Web Start Installer in Sun Java SE in JDK and JRE 6 before Update 17 does not properly use security model permissions when removing installer extensions, which allows remote attackers to execute arbitrary code by modifying a certain JNLP file to have a URL field that…

  • CVE-2009-3865Nov 5, 2009
    Sun Corporation
    Jdk
    risk 0.01cvss —epss 0.09

    The launch method in the Deployment Toolkit plugin in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 6 before Update 17 allows remote attackers to execute arbitrary commands via a crafted web page, aka Bug Id 6869752.

  • CVE-2009-3864Nov 5, 2009
    Microsoft
    Windows
    risk 0.02cvss —epss 0.22

    The Java Update functionality in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22 and JDK and JRE 6 before Update 17, when a non-English version of Windows is used, does not retrieve available new JRE versions, which allows remote attackers to…

  • CVE-2009-3863Nov 4, 2009
    Novell
    Groupwise
    risk 0.03cvss —epss 0.05

    Buffer overflow in the gxmim1.dll ActiveX control in Novell Groupwise Client 7.0.3.1294 allows remote attackers to cause a denial of service (application crash) via a long argument to the SetFontFace method.

  • CVE-2009-3862Nov 4, 2009
    Novell
    Edirectory
    risk 0.00cvss —epss 0.02

    The NDSD process in Novell eDirectory 8.7.3 before 8.7.3.10 ftf2 and eDirectory 8.8 before 8.8.5 ftf1 does not properly handle certain LDAP search requests, which allows remote attackers to cause a denial of service (application hang) via a search request with a NULL BaseDN…

  • CVE-2009-3861Nov 4, 2009
    Safenet
    Softremote
    risk 0.03cvss —epss 0.04

    Stack-based buffer overflow in SafeNet SoftRemote 10.8.5 (Build 2) and 10.3.5 (Build 6), and possibly other versions before 10.8.9, allows local users to execute arbitrary code via a long string in a (1) TREENAME or (2) GROUPNAME Policy file (spd).

  • CVE-2009-3860Nov 4, 2009
    Idefense
    Comraider
    risk 0.03cvss —epss 0.02

    Multiple insecure method vulnerabilities in Idefense Labs COMRaider allow remote attackers to create or overwrite arbitrary files via the (1) CreateFolder and (2) Copy methods. NOTE: this might only be a vulnerability in certain insecure configurations of Internet Explorer.

  • CVE-2009-3859Nov 4, 2009
    Eeye
    Retina WiFi Scanner
    risk 0.04cvss —epss 0.12

    Buffer overflow in eEye Retina WiFi Scanner 1.0.8.68, as used in Retina Network Security Scanner 5.10.14, allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a .rws file with a long RWS010 entry.