VYPR

CVEs

385,538 total · page 6934 of 7,711

AllCriticalHighKEV
  • CVE-2009-3716Oct 16, 2009
    MCshoutbox
    MCshoutbox
    risk 0.03cvss —epss 0.04

    Unrestricted file upload vulnerability in admin.php in MCshoutbox 1.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in smilies/.

  • CVE-2009-3715Oct 16, 2009
    MCshoutbox
    MCshoutbox
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in scr_login.php in MCshoutbox 1.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

  • CVE-2009-3714Oct 16, 2009
    Maniacomputer
    Mcshoutbox
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin_login.php in MCshoutbox 1.1 allows remote attackers to inject arbitrary web script or HTML via the loginerror parameter.

  • CVE-2009-3713Oct 16, 2009
    Morcego
    Morcegocms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in fichero.php in MorcegoCMS 1.7.6 and earlier allows remote attackers to execute arbitrary SQL commands via the query string.

  • CVE-2009-3712Oct 16, 2009
    Ebay Clone 2009
    Ebay Clone 2009
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Ebay Clone 2009 allow remote attackers to execute arbitrary SQL commands via the (1) user_id parameter to feedback.php; and the item_id parameter to (2) view_full_size.php, (3) classifide_ad.php, and (4) crosspromoteitems.php.

  • CVE-2009-3711Oct 16, 2009
    Httpdx
    httpdx
    risk 0.08cvss —epss 0.64

    Stack-based buffer overflow in the h_handlepeer function in http.cpp in httpdx 1.4, and possibly 1.4.3, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.

  • CVE-2009-3710Oct 16, 2009
    Riorey
    Rios
    risk 0.04cvss —epss 0.09

    RioRey RIOS 4.6.6 and 4.7.0 uses an undocumented, hard-coded username (dbadmin) and password (sq!us3r) for an SSH tunnel, which allows remote attackers to gain privileges via port 8022.

  • CVE-2009-3709Oct 16, 2009
    Konae
    Alleycode HTML Editor
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in the Meta Content Optimizer in Konae Technologies Alleycode HTML Editor 2.21 allows user-assisted remote attackers to execute arbitrary code via a long value in a TITLE tag.

  • CVE-2009-3708Oct 16, 2009
    Konae
    Alleycode HTML Editor
    risk 0.03cvss —epss 0.04

    Stack-based buffer overflow in the Meta Content Optimizer in Konae Technologies Alleycode HTML Editor 2.21 allows user-assisted remote attackers to execute arbitrary code via a long value in a (1) description or (2) keyword META tag. NOTE: the provenance of this information is…

  • CVE-2009-3707Oct 16, 2009
    VMware
    Workstation
    risk 0.04cvss —epss 0.11

    VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459, VMware Player 3.0 before 3.0.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware ACE 2.6…

  • CVE-2009-3706Oct 16, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the ZFS filesystem in Sun Solaris 10, and OpenSolaris snv_100 through snv_117, allows local users to bypass intended limitations of the file_chown_self privilege via certain uses of the chown system call.

  • CVE-2009-3705Oct 16, 2009
    Achievo
    Achievo
    risk 0.04cvss —epss 0.10

    PHP remote file inclusion vulnerability in debugger.php in Achievo before 1.4.0 allows remote attackers to execute arbitrary PHP code via a URL in the config_atkroot parameter.

  • CVE-2009-3697Oct 16, 2009
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in the PDF schema generator functionality in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified interface parameters.

  • CVE-2009-3696Oct 16, 2009
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name for a MySQL table.

  • CVE-2009-3282Oct 16, 2009
    VMware
    Fusion
    risk 0.00cvss —epss 0.02

    Integer overflow in the vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 allows host OS users to cause a denial of service to the host OS via unspecified vectors.

  • CVE-2009-3281Oct 16, 2009
    VMware
    Fusion
    risk 0.03cvss —epss 0.01

    The vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 does not use correct file permissions, which allows host OS users to gain privileges on the host OS via unspecified vectors.

  • CVE-2009-2874Oct 16, 2009
    Cisco Systems, Inc.
    Unified Presence Server
    risk 0.00cvss —epss 0.04

    The TimesTenD process in Cisco Unified Presence 1.x, 6.x before 6.0(6), and 7.x before 7.0(4) allows remote attackers to cause a denial of service (process crash) via a large number of TCP connections to ports 16200 and 22794, aka Bug ID CSCsy17662.

  • CVE-2009-2734Oct 16, 2009
    Achievo
    Achievo
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the get_employee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter (aka user_id variable) to dispatch.php.

  • CVE-2009-2733Oct 16, 2009
    Achievo
    Achievo
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the scheduler title in the scheduler module, and the (2) atksearch[contractnumber], (3) atksearch_AE_customer[customer], (4)…

  • CVE-2009-3699Oct 15, 2009
    IBM
    Aix
    risk 0.08cvss —epss 0.62

    Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 and earlier, allows remote attackers to execute arbitrary code via a long XDR string in the first argument to procedure 21 of rpc.cmsd.

  • CVE-2009-3030Oct 15, 2009
    Symantec
    Securityexpressions Audit And Compliance Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Symantec SecurityExpressions Audit and Compliance Server 4.1.1, 4.1, and earlier allows remote attackers to inject arbitrary web script or HTML via vectors that trigger an error message in a response, related to an "HTML Injection…

  • CVE-2009-3029Oct 15, 2009
    Symantec
    Securityexpressions Audit And Compliance Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the console in Symantec SecurityExpressions Audit and Compliance Server 4.1.1, 4.1, and earlier allows remote authenticated users to inject arbitrary web script or HTML via "external client input" that triggers crafted error messages.

  • CVE-2009-3698Oct 14, 2009
    Google
    Android
    risk 0.00cvss —epss 0.01

    An unspecified function in the Dalvik API in Android 1.5 and earlier allows remote attackers to cause a denial of service (system process restart) via a crafted application, possibly a related issue to CVE-2009-2656.

  • CVE-2009-3126Oct 14, 2009
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.23

    Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003…

  • CVE-2009-2999Oct 14, 2009
    Google
    Android
    risk 0.00cvss —epss 0.01

    The com.android.phone process in Android 1.5 CRBxx allows remote attackers to cause a denial of service (application restart and network disconnection) via an SMS message containing a malformed WAP Push message that triggers an ArrayIndexOutOfBoundsException exception, possibly…

  • CVE-2009-2532Oct 14, 2009
    Microsoft
    Windows
    risk 0.08cvss —epss 0.62

    Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC do not properly process the command value in an SMB Multi-Protocol Negotiate Request packet, which allows remote attackers to execute arbitrary code via a crafted SMBv2 packet to the…

  • CVE-2009-2531Oct 14, 2009
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.23

    Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized…

  • CVE-2009-2530Oct 14, 2009
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.23

    Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized…

  • CVE-2009-2529HigOct 14, 2009
    Microsoft
    Internet Explorer
    risk 0.54cvss 8.1epss 0.20

    Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not properly handle argument validation for unspecified variables, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "HTML Component Handling Vulnerability."

  • CVE-2009-2528Oct 14, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.20

    GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption, aka "Memory Corruption Vulnerability."

  • CVE-2009-2527Oct 14, 2009
    Microsoft
    Windows Media Player
    risk 0.02cvss —epss 0.27

    Heap-based buffer overflow in Microsoft Windows Media Player 6.4 allows remote attackers to execute arbitrary code via (1) a crafted ASF file or (2) crafted streaming content, aka "WMP Heap Overflow Vulnerability."

  • CVE-2009-2526Oct 14, 2009
    Microsoft
    Windows
    risk 0.10cvss —epss 0.82

    Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remote attackers to cause a denial of service (infinite loop and system hang) via a crafted packet to the Server service, aka "SMBv2 Infinite…

  • CVE-2009-2525Oct 14, 2009
    Microsoft
    Windows
    risk 0.02cvss —epss 0.23

    Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (ACM), does not properly initialize unspecified functions within compressed audio files, which allows remote attackers to execute arbitrary…

  • CVE-2009-2524Oct 14, 2009
    Microsoft
    Windows
    risk 0.02cvss —epss 0.28

    Integer underflow in the NTLM authentication feature in the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows remote…

  • CVE-2009-2518Oct 14, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.23

    Integer overflow in GDI+ in Microsoft Office XP SP3 allows remote attackers to execute arbitrary code via an Office document with a bitmap (aka BMP) image that triggers memory corruption, aka "Office BMP Integer Overflow Vulnerability."

  • CVE-2009-2517Oct 14, 2009
    Microsoft
    Windows Server 2003
    risk 0.00cvss —epss 0.02

    The kernel in Microsoft Windows Server 2003 SP2 does not properly handle unspecified exceptions when an error condition occurs, which allows local users to cause a denial of service (reboot) via a crafted application, aka "Windows Kernel Exception Handler Vulnerability."

  • CVE-2009-2516HigOct 14, 2009
    Microsoft
    Windows 2000
    risk 0.46cvss 7.1epss 0.01

    The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly validate data sent from user mode, which allows local users to gain privileges via a crafted PE .exe file that triggers a NULL pointer…

  • CVE-2009-2515Oct 14, 2009
    Microsoft
    Windows 2000
    risk 0.00cvss —epss 0.02

    Integer underflow in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows local users to gain privileges via a crafted application that triggers an incorrect truncation of a 64-bit integer to a…

  • CVE-2009-2511Oct 14, 2009
    Microsoft
    Windows 2000
    risk 0.04cvss —epss 0.13

    Integer overflow in the CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows man-in-the-middle attackers to spoof arbitrary SSL servers…

  • CVE-2009-2510Oct 14, 2009
    Microsoft
    Windows 2000
    risk 0.00cvss —epss 0.05

    The CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, as used by Internet Explorer and other applications, does not properly handle a '\0'…

  • CVE-2009-2507Oct 14, 2009
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.19

    A certain ActiveX control in the Indexing Service in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly process URLs, which allows remote attackers to execute arbitrary programs via unspecified vectors that cause a "vulnerable binary" to load and…

  • CVE-2009-2504Oct 14, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.21

    Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1 and SP2, Windows XP SP2 and SP3, Windows Server 2003 SP2, Vista Gold and SP1, Server 2008 Gold, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and…

  • CVE-2009-2503Oct 14, 2009
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.22

    GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer…

  • CVE-2009-2502HigOct 14, 2009
    Microsoft
    Internet Explorer
    risk 0.54cvss 8.1epss 0.22

    Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003…

  • CVE-2009-2501Oct 14, 2009
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.27

    Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel…

  • CVE-2009-2500Oct 14, 2009
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.24

    Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003…

  • CVE-2009-2497Oct 14, 2009
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.23

    The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0, 2.0 SP1, 2.0 SP2, 3.5, and 3.5 SP1, and Silverlight 2, does not properly handle interfaces, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP), (2) a crafted…

  • CVE-2009-1547HigOct 14, 2009
    Microsoft
    Internet Explorer
    risk 0.63cvss 8.8epss 0.37

    Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted data stream header that triggers memory corruption, aka "Data Stream Header Corruption Vulnerability."

  • CVE-2009-0555Oct 14, 2009
    Microsoft
    Windows
    risk 0.02cvss —epss 0.27

    Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (ACM), does not properly process Advanced Systems Format (ASF) files, which allows remote attackers to execute arbitrary code via a crafted…

  • CVE-2009-0091Oct 14, 2009
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.26

    Microsoft .NET Framework 2.0, 2.0 SP1, and 3.5 does not properly enforce a certain type-equality constraint in .NET verifiable code, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP), (2) a crafted ASP.NET application, or…