VYPR

CVEs

385,563 total · page 6931 of 7,712

AllCriticalHighKEV
  • CVE-2009-3626Oct 29, 2009
    Perl Foundation
    Perl
    risk 0.00cvss —epss 0.02

    Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.

  • CVE-2009-3383Oct 29, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox 3.5.x before 3.5.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

  • CVE-2009-3382Oct 29, 2009
    Mozilla Corporation
    Firefox
    risk 0.04cvss —epss 0.11

    layout/base/nsCSSFrameConstructor.cpp in the browser engine in Mozilla Firefox 3.0.x before 3.0.15 does not properly handle first-letter frames, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary…

  • CVE-2009-3381Oct 29, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x before 3.5.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

  • CVE-2009-3380Oct 29, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

  • CVE-2009-3379Oct 29, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in libvorbis, as used in Mozilla Firefox 3.5.x before 3.5.4, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors. NOTE: this might overlap CVE-2009-2663.

  • CVE-2009-3378Oct 29, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The oggplay_data_handle_theora_frame function in media/liboggplay/src/liboggplay/oggplay_data.c in liboggplay, as used in Mozilla Firefox 3.5.x before 3.5.4, attempts to reuse an earlier frame data structure upon encountering a decoding error for the first frame, which allows…

  • CVE-2009-3377Oct 29, 2009
    liboggz
    liboggz
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in liboggz before cf5feeaab69b05e24, as used in Mozilla Firefox 3.5.x before 3.5.4, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.

  • CVE-2009-3376Oct 29, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as…

  • CVE-2009-3375Oct 29, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    content/html/document/src/nsHTMLDocument.cpp in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 allows user-assisted remote attackers to bypass the Same Origin Policy and read an arbitrary content selection via the document.getSelection function.

  • CVE-2009-3374Oct 29, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The XPCVariant::VariantDataToJS function in the XPCOM implementation in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 does not enforce intended restrictions on interaction between chrome privileged code and objects obtained from remote web sites, which allows remote…

  • CVE-2009-3373Oct 29, 2009
    Mozilla Corporation
    Firefox
    risk 0.04cvss —epss 0.16

    Heap-based buffer overflow in the GIF image parser in Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2009-3372Oct 29, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, allows remote attackers to execute arbitrary code via a crafted regular expression in a Proxy Auto-configuration (PAC) file.

  • CVE-2009-3371Oct 29, 2009
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.07

    Use-after-free vulnerability in Mozilla Firefox 3.5.x before 3.5.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by creating JavaScript web-workers recursively.

  • CVE-2009-3370Oct 29, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 3.0.15, and 3.5.x before 3.5.4, allows remote attackers to read form history by forging mouse and keyboard events that leverage the auto-fill feature to populate form fields, in an attacker-readable form, with history entries.

  • CVE-2009-3826Oct 28, 2009
    Squid Cache
    Squidguard
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in squidGuard 1.4 allow remote attackers to bypass intended URL blocking via a long URL, related to (1) the relationship between a certain buffer size in squidGuard and a certain buffer size in Squid and (2) a redirect URL that contains information…

  • CVE-2009-3700Oct 28, 2009
    Squid Cache
    Squidguard
    risk 0.00cvss —epss 0.04

    Buffer overflow in sgLog.c in squidGuard 1.3 and 1.4 allows remote attackers to cause a denial of service (application hang or loss of blocking functionality) via a long URL with many / (slash) characters, related to "emergency mode."

  • CVE-2009-3641Oct 28, 2009
    Snort
    Snort
    risk 0.06cvss —epss 0.39

    Snort before 2.8.5.1, when the -v option is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted IPv6 packet that uses the (1) TCP or (2) ICMP protocol.

  • CVE-2009-3639Oct 28, 2009
    Proftpd
    Proftpd
    risk 0.00cvss —epss 0.06

    The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers…

  • CVE-2009-3825Oct 28, 2009
    GenCMS
    GenCMS
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in GenCMS 2006 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) p parameter to show.php and the (2) Template parameter to admin/pages/SiteNew.php.

  • CVE-2009-3824Oct 28, 2009
    Michael J Greenwood
    PHP Content Manager
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in include/processor.php in Greenwood PHP Content Manager 0.3.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the content_path parameter.

  • CVE-2009-3823Oct 28, 2009
    Mobilelib
    GOLD
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in myhtml.php in Mobilelib GOLD 3.0, when magic_quotes_gpc is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the GLOBALS[page] parameter.

  • CVE-2009-3822Oct 28, 2009
    Fiji Web Design
    Ajax Chat
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in Fiji Web Design Ajax Chat (com_ajaxchat) component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path] parameter to tests/ajcuser.php.

  • CVE-2009-3821Oct 28, 2009
    Apache
    Solr
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Apache Solr Search (solr) extension 1.0.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-3820Oct 28, 2009
    TYPO3
    Flagbit Filebase (fb_filebase)
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Flagbit Filebase (fb_filebase) extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-3819Oct 28, 2009
    TYPO3
    Random Images (maag_randomimage)
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Random Images (maag_randomimage) extension 1.6.4 and earlier for TYPO3 allows remote attackers to execute arbitrary shell commands via unspecified vectors.

  • CVE-2009-3818Oct 28, 2009
    Stanislas Rolland
    Sr Freecap
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the session handling feature in freeCap CAPTCHA (sr_freecap) extension 1.2.0 and earlier for TYPO3 has unknown impact and attack vectors.

  • CVE-2009-3817Oct 28, 2009
    Joomla
    BookLibrary
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in doc/releasenote.php in the BookLibrary (com_booklibrary) component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter, a different vector than CVE-2009-2637. NOTE:…

  • CVE-2009-3816Oct 28, 2009
    IBM
    Connections
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Activities pages in the Mobile subsystem in IBM Lotus Connections 2.5.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-3815Oct 27, 2009
    Runcms
    Runcms
    risk 0.00cvss —epss 0.01

    RunCMS 2M1, when running with certain error_reporting levels, allows remote attackers to obtain sensitive information via (1) the op[] parameter to modules/contact/index.php or (2) uid[] parameter to userinfo.php, which leaks the installation path in an error message when these…

  • CVE-2009-3814Oct 27, 2009
    Runcms
    Runcms
    risk 0.00cvss —epss 0.01

    Static code injection vulnerability in RunCMS 2M1 allows remote authenticated administrators to execute arbitrary PHP code via the "Filter/Banning" feature, as demonstrated by modifying modules/system/cache/bademails.php using the "Prohibited: Emails" action, and other…

  • CVE-2009-3813Oct 27, 2009
    Runcms
    Runcms
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in RunCMS 2M1 allow remote authenticated users to execute arbitrary SQL commands via the (1) forum parameter to modules/forum/post.php and possibly (2) forum_id variable to modules/forum/class/class.permissions.php.

  • CVE-2009-3812Oct 27, 2009
    OtsAV
    OtsAV
    risk 0.04cvss —epss 0.07

    Heap-based buffer overflow in OtsAV DJ trial version 1.85.64.0, Radio trial version 1.85.64.0, TV trial version 1.85.64.0, and Free version 1.77.001 allows remote attackers to execute arbitrary code via a long playlist in an Ots File List (.ofl) file.

  • CVE-2009-3811Oct 27, 2009
    Music Tag Editor
    Music Tag Editor
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in Music Tag Editor 1.61 build 212 allows remote attackers to execute arbitrary code via an MP3 file with a long ID3 tag. NOTE: some of these details are obtained from third party information.

  • CVE-2009-3810Oct 27, 2009
    Acoustica
    Mp3 Audio Mixer
    risk 0.03cvss —epss 0.06

    Heap-based buffer overflow in Acoustica MP3 Audio Mixer 2.471 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long string in a .M3U playlist file.

  • CVE-2009-3809Oct 27, 2009
    Acoustica
    Mp3 Audio Mixer
    risk 0.03cvss —epss 0.02

    Acoustica MP3 Audio Mixer 1.0 and possibly 2.471 allows remote attackers to cause a denial of service (crash) via a long string in a .sgp playlist file.

  • CVE-2009-3808Oct 27, 2009
    MixSense
    DJ Studio
    risk 0.03cvss —epss 0.04

    MixSense DJ Studio 1.0.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string in an .mp3 playlist file.

  • CVE-2009-3807Oct 27, 2009
    Mixvibes
    Mixvibes
    risk 0.03cvss —epss 0.03

    Stack-based buffer overflow in MixVibes 7.043 Pro allows remote attackers to cause a denial of service (crash) via a long string in a .vib file.

  • CVE-2009-3806Oct 27, 2009
    Dedecms
    Dedecms
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in feedback_js.php in DedeCMS 5.1 allows remote attackers to execute arbitrary SQL commands via the arcurl parameter.

  • CVE-2009-3805Oct 27, 2009
    risk 0.03cvss —epss 0.01

    gpg2.exe in Gpg4win 2.0.1, as used in KDE Kleopatra 2.0.11, allows remote attackers to cause a denial of service (application crash) via a long certificate signature.

  • CVE-2009-3804Oct 27, 2009
    Runcms
    Runcms
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in modules/forum/post.php in RunCMS 2M1 allow remote authenticated users to execute arbitrary SQL commands via (1) the pid parameter, which is not properly handled by the store function in modules/forum/class/class.forumposts.php, or (2)…

  • CVE-2009-3803Oct 27, 2009
    Amirocms
    Amiro.CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Amiro.CMS 5.4.0.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the status_message parameter to (1) /news, (2) /comment, (3) /forum, (4) /blog, and (5) /tags; the status_message parameter to…

  • CVE-2009-3802Oct 27, 2009
    Amirocms
    Amiro.CMS
    risk 0.03cvss —epss 0.03

    Amiro.CMS 5.4.0.0 and earlier allows remote attackers to obtain sensitive information via an invalid loginname ("%%%") to _admin/index.php, which reveals the installation path and other information in an error message.

  • CVE-2009-3801Oct 27, 2009
    Opendocman
    Opendocman
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in OpenDocMan 1.2.5 allows remote attackers to execute arbitrary SQL commands via the frmpass (aka Password) parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2009-3790Oct 26, 2009
    Cutepdf
    Formmax
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in FormMax (formerly AcroForm) evaluation 3.5 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted FormMax import (.aim) file. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2009-3789Oct 26, 2009
    Opendocman
    Opendocman
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in OpenDocMan 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the last_message parameter to (1) add.php, (2) toBePublished.php, (3) index.php, and (4) admin.php; the PATH_INFO to the default URI to (5)…

  • CVE-2009-3788Oct 26, 2009
    Opendocman
    Opendocman
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in OpenDocMan 1.2.5 allows remote attackers to execute arbitrary SQL commands via the frmuser (aka Username) parameter.

  • CVE-2009-3787Oct 26, 2009
    Vivvo
    Vivvo
    risk 0.04cvss —epss 0.07

    files.php in Vivvo CMS 4.1.5.1 allows remote attackers to conduct directory traversal attacks and read arbitrary files via the file parameter with "logs/" in between two . (dot) characters, which is filtered into a "../" sequence.

  • CVE-2009-3786Oct 26, 2009
    Drupal
    Organic Groups OG Vocabulary
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Organic Groups (OG) Vocabulary 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the group title.

  • CVE-2009-3785Oct 26, 2009
    Drupal
    Simplenews Statistics
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allow remote attackers to hijack the authentication of arbitrary users via unknown vectors.