VYPR

CVEs

385,537 total · page 6935 of 7,711

AllCriticalHighKEV
  • CVE-2009-3695Oct 13, 2009
    Djangoproject
    Django
    risk 0.00cvss —epss 0.04

    Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of…

  • CVE-2009-3694Oct 13, 2009
    EzRecipe Zee
    ezRecipe-Zee
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in config/config.php in ezRecipe-Zee 91, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cfg[prePath] parameter.

  • CVE-2009-3693Oct 13, 2009
    Persits
    Xupload
    risk 0.06cvss —epss 0.42

    Directory traversal vulnerability in the Persits.XUpload.2 ActiveX control (XUpload.ocx) in HP LoadRunner 9.5 allows remote attackers to create arbitrary files via \.. (backwards slash dot dot) sequences in the third argument to the MakeHttpRequest method.

  • CVE-2009-3692Oct 13, 2009
    Sun Corporation
    Virtualbox
    risk 0.03cvss —epss 0.01

    Unspecified vulnerability in the VBoxNetAdpCtl configuration tool in Sun VirtualBox 3.0.x before 3.0.8 on Solaris x86, Linux, and Mac OS X allows local users to gain privileges via unknown vectors.

  • CVE-2009-3691Oct 13, 2009
    IBM
    Informix Client SDK
    risk 0.04cvss —epss 0.07

    Multiple integer overflows in setnet32.exe 3.50.0.13752 in IBM Informix Client SDK 3.0 and 3.50 and Informix Connect Runtime 3.x allow remote attackers to execute arbitrary code via a .nfx file with a crafted (1) HostSize, and possibly (2) ProtoSize and (3) ServerSize, field…

  • CVE-2009-3602Oct 13, 2009
    Unbound
    Unbound
    risk 0.00cvss —epss 0.03

    Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.

  • CVE-2009-3588Oct 13, 2009
    Ca
    eTrust Antivirus
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and…

  • CVE-2009-3587Oct 13, 2009
    Ca
    eTrust Antivirus
    risk 0.01cvss —epss 0.08

    Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and…

  • CVE-2009-3459HigKEVOct 13, 2009
    Adobe Inc.
    Acrobat
    risk 0.79cvss 8.8epss 0.87

    Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these…

  • CVE-2009-2908Oct 13, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The d_delete function in fs/ecryptfs/inode.c in eCryptfs in the Linux kernel 2.6.31 allows local users to cause a denial of service (kernel OOPS) and possibly execute arbitrary code via unspecified vectors that cause a "negative dentry" and trigger a NULL pointer dereference, as…

  • CVE-2009-2898Oct 13, 2009
    Gopivotal
    Application Management Suite
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote…

  • CVE-2009-2897Oct 13, 2009
    Gopivotal
    Application Management Suite
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite…

  • CVE-2009-2699HigOct 13, 2009
    Apache
    HTTP Server
    risk 0.43cvss 7.5epss 0.14

    The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a…

  • CVE-2009-2684Oct 13, 2009
    Microfocus
    Jetdirect
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL…

  • CVE-2009-3670Oct 11, 2009
    KSP
    Sound Player 2009
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in KSP Sound Player 2009 R2 and R2.1 allows remote attackers to execute arbitrary code via a long string in a .m3u playlist file.

  • CVE-2009-3669Oct 11, 2009
    Foobla
    Com Foobla Suggestions
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the foobla Suggestions (com_foobla_suggestions) component 1.5.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the idea_id parameter to index.php.

  • CVE-2009-3668Oct 11, 2009
    Ardguest
    Ardguest
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in ardguest.php in Ardguest 1.8 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2009-3667Oct 11, 2009
    Adsdx
    Adsdx
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/index.php in AdsDX 3.05 allows remote attackers to execute arbitrary SQL commands via the Username.

  • CVE-2009-3666Oct 11, 2009
    Nullam
    Blog
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in index.php in Nullam Blog 0.1.2 allows remote attackers to inject arbitrary web script or HTML via the e parameter in an error action.

  • CVE-2009-3665Oct 11, 2009
    Nullam
    Blog
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in index.php in Nullam Blog 0.1.2 allow remote attackers to execute arbitrary SQL commands via the (1) i parameter or (2) v parameters in a register action.

  • CVE-2009-3664Oct 11, 2009
    Nullam
    Blog
    risk 0.03cvss —epss 0.06

    Multiple directory traversal vulnerabilities in index.php in Nullam Blog 0.1.2 allow remote attackers to include or execute arbitrary files via a .. (dot dot) in the (1) p and (2) s parameters.

  • CVE-2009-3663Oct 11, 2009
    Httpdx
    httpdx
    risk 0.04cvss —epss 0.15

    Format string vulnerability in the h_readrequest function in http.c in httpdx Web Server 1.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in the Host header.

  • CVE-2009-3662Oct 11, 2009
    Filecopa Ftpserver
    FTP Server
    risk 0.03cvss —epss 0.03

    FileCopa FTP Server 5.01 allows remote attackers to cause a denial of service (server hang) via a large number of crafted NOOP commands.

  • CVE-2009-3661Oct 11, 2009
    Joomla
    DJ-Catalog
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the DJ-Catalog (com_djcatalog) component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a showItem action and (2) cid parameter in a show action to index.php.

  • CVE-2009-3660Oct 11, 2009
    Epignosis
    Efront
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: this is only a vulnerability when the administrator does…

  • CVE-2009-3659Oct 11, 2009
    BS Counter
    BS Counter
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in file/stats.php in BS Counter 2.5.3 allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2009-3658HigOct 9, 2009
    AOL
    SuperBuddy
    risk 0.61cvss 8.8epss 0.09

    Use-after-free vulnerability in the Sb.SuperBuddy.1 ActiveX control (sb.dll) in America Online (AOL) 9.5.0.1 allows remote attackers to trigger memory corruption or possibly execute arbitrary code via a malformed argument to the SetSuperBuddy method.

  • CVE-2009-3657Oct 9, 2009
    Drupal
    Shared Sign-On
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in Shared Sign-On 5.x and 6.x, a module for Drupal, allows remote attackers to hijack web sessions via unspecified vectors.

  • CVE-2009-3656Oct 9, 2009
    Drupal
    Shared Sign-On
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Shared Sign-On 5.x and 6.x, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users via unknown vectors.

  • CVE-2009-3655Oct 9, 2009
    Rhino Software, Inc.
    Serv-U
    risk 0.00cvss —epss 0.04

    Rhino Software Serv-U 7.0.0.1 through 8.2.0.3 allows remote attackers to cause a denial of service (server crash) via unspecified vectors related to the "SITE SET TRANSFERPROGRESS ON" FTP command.

  • CVE-2009-3654Oct 9, 2009
    Drupal
    Boost
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Boost before 6.x-1.03, a module for Drupal, allows remote attackers to create new webroot directories via unknown attack vectors.

  • CVE-2009-3653Oct 9, 2009
    Drupal
    XML Sitemap
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the additional links interface in XML Sitemap 5.x-1.6, a module for Drupal, allows remote authenticated users, with "administer site configuration" permission, to inject arbitrary web script or HTML via unspecified vectors, related to…

  • CVE-2009-3652Oct 9, 2009
    Drupal
    Organic Groups
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Organic Groups (OG) 5.x-7.x before 5.x-7.4, 5.x-8.x before 5.x-8.1, and 6.x-1.x before 6.x-1.4, a module for Drupal, allows remote authenticated users, with create or edit group nodes permissions, to inject arbitrary web script or HTML…

  • CVE-2009-3651Oct 9, 2009
    Drupal
    Browscap
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the "Monitor browsers' feature in Browscap before 5.x-1.1 and 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.

  • CVE-2009-3650Oct 9, 2009
    Drupal
    Dex
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Dex 5.x-1.0 and earlier and 6.x-1.0-rc1 and earlier, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-3649Oct 9, 2009
    Pbboard
    Pbboard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in forums/index.php in Power Bulletin Board (PBBoard) 2.0.2 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter in a new_topic action.

  • CVE-2009-3648Oct 9, 2009
    Drupal
    Service Links
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Service Links 6.x-1.0, a module for Drupal, allows remote authenticated users, with 'administer content types' permissions, to inject arbitrary web script or HTML via unspecified vectors when displaying content type names.

  • CVE-2009-3647Oct 9, 2009
    Yabsoft
    Mega File Hosting Script
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in emaullinks.php in YABSoft Mega File Hosting Script (aka MFH or MFHS) 1.2 allows remote attackers to inject arbitrary web script or HTML via the moudi parameter. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2009-3646Oct 9, 2009
    Intervations
    Navicopa Web Server
    risk 0.03cvss —epss 0.06

    InterVations NaviCOPA Web Server 3.01 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition of ::$DATA after the HTML file name.

  • CVE-2009-3645Oct 9, 2009
    Joomlacache
    CB Resume Builder
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JoomlaCache CB Resume Builder (com_cbresumebuilder) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the group_id parameter in a group_members action to index.php.

  • CVE-2009-3644Oct 9, 2009
    Joomla
    com_soundset
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Soundset (com_soundset) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to index.php.

  • CVE-2009-3643Oct 9, 2009
    Dxmsoft
    Xm Easy Personal FTP Server
    risk 0.04cvss —epss 0.06

    Dxmsoft XM Easy Personal FTP Server 5.8.0 allows remote attackers to cause a denial of service via a long argument to the (1) LIST and (2) NLST commands, a differnt issue than CVE-2008-5626 and CVE-2006-5728.

  • CVE-2009-3642Oct 9, 2009
    Frontrange
    Heat
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Call Logging feature in FrontRange HEAT 8.01 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

  • CVE-2009-3601Oct 8, 2009
    Scriptsez
    Ultimate Poll
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in demo_page.php in Scriptsez Ultimate Poll allows remote attackers to inject arbitrary web script or HTML via the clr parameter in a vote action.

  • CVE-2009-3600Oct 8, 2009
    Freewebscriptz
    Hubscript
    risk 0.00cvss —epss 0.01

    HUBScript 1.0 allows remote attackers to obtain configuration information via a direct request to manage/phpinfo.php, which calls the phpinfo function.

  • CVE-2009-3599Oct 8, 2009
    HUBScript
    HUBScript
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in single_winner1.php in HUBScript 1.0 allows remote attackers to inject arbitrary web script or HTML via the bid_id parameter.

  • CVE-2009-3598Oct 8, 2009
    Ecardmax.com
    Formxp
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in survey_result.php in eCardMAX FormXP 2007 allows remote attackers to inject arbitrary web script or HTML via the sid parameter.

  • CVE-2009-3597Oct 8, 2009
    Digitaldesign
    CMS
    risk 0.03cvss —epss 0.03

    Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for autoconfig.dd.

  • CVE-2009-3596Oct 8, 2009
    Joxtechnology
    Ajox Poll
    risk 0.03cvss —epss 0.02

    JoxTechnology Ajox Poll does not properly restrict access to admin/managepoll.php, which allows remote attackers to bypass authentication and gain administrative access via a direct request.

  • CVE-2009-3595Oct 8, 2009
    Vspanel
    Vs Panel
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in results.php in VS PANEL 7.5.5 allows remote attackers to execute arbitrary SQL commands via the Cat_ID parameter, a different vector than CVE-2009-3590.