VYPR

CVEs

385,522 total · page 6937 of 7,711

AllCriticalHighKEV
  • CVE-2009-3503Sep 30, 2009
    Bpowerhouse
    Bpholidaylettings
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in search.aspx in BPowerHouse BPHolidayLettings 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) rid and (2) tid parameters.

  • CVE-2009-3502Sep 30, 2009
    Bpowerhouse
    Bpmusic
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in music.php in BPowerHouse BPMusic 1.0 allows remote attackers to execute arbitrary SQL commands via the music_id parameter.

  • CVE-2009-3501Sep 30, 2009
    Bpowerhouse
    Bpstudents
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in students.php in BPowerHouse BPStudents 1.0 allows remote attackers to execute arbitrary SQL commands via the test parameter in a preview action.

  • CVE-2009-3500Sep 30, 2009
    Bpowerhouse
    Bpgames
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in BPowerHouse BPGames 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) cat_id parameter to main.php and (2) game_id parameter to game.php.

  • CVE-2009-3499Sep 30, 2009
    Bpowerhouse
    Bplawyercasedocuments
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in employee.aspx in BPowerHouse BPLawyerCaseDocuments 1.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2009-3498Sep 30, 2009
    Hbcms
    Hbcms
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in php/update_article_hits.php in HBcms 1.7 allows remote attackers to execute arbitrary SQL commands via the article_id parameter.

  • CVE-2009-3497Sep 30, 2009
    Vastal
    Agent Zone
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in view_listing.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-3496Sep 30, 2009
    Vastal
    Dvd Zone
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in view_mag.php in Vastal I-Tech DVD Zone allows remote attackers to inject arbitrary web script or HTML via the mag_id parameter.

  • CVE-2009-3495Sep 30, 2009
    Vastal
    Dvd Zone
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in view_mag.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the mag_id parameter, a different vector than CVE-2008-4465.

  • CVE-2009-3494Sep 30, 2009
    Todor Lazarov
    T Htb Manager
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in T-HTB Manager 0.5, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in a delete_category action, (2) the name parameter in an update_category action, and…

  • CVE-2009-3493Sep 30, 2009
    Zenas
    Paobacheca Guestbook
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Zenas PaoBacheca Guestbook 2.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) scrivi.php and (2) index.php.

  • CVE-2009-3492Sep 30, 2009
    Loggix Project
    Loggix
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Loggix Project 9.4.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pathToIndex parameter to (1) Calendar.php, (2) Comment.php, (3) Rss.php and (4) Trackback.php in lib/Loggix/Module/; and…

  • CVE-2009-3491Sep 30, 2009
    Kinfusion
    Com Sportfusion
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Kinfusion SportFusion (com_sportfusion) component 0.2.2 through 0.2.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[0] parameter in a teamdetail action to index.php.

  • CVE-2009-3490Sep 30, 2009
    GNU
    Wget
    risk 0.00cvss —epss 0.04

    GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification…

  • CVE-2009-3489HigSep 30, 2009
    Adobe Inc.
    Photoshop Elements
    risk 0.54cvss 7.8epss 0.02

    Adobe Photoshop Elements 8.0 installs the Adobe Active File Monitor V8 service with an insecure security descriptor, which allows local users to (1) stop the service via the stop command, (2) execute arbitrary commands as SYSTEM by using the config command to modify the binPath…

  • CVE-2009-3488Sep 30, 2009
    Drupal
    Biblio
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Bibliography (aka Biblio) module 6.x-1.6 for Drupal allows remote authenticated users, with certain content-creation privileges, to inject arbitrary web script or HTML via the Title field, probably a different vulnerability than…

  • CVE-2009-3487Sep 30, 2009
    Juniper Networks
    Junos
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the J-Web interface in Juniper JUNOS 8.5R1.14 allow remote authenticated users to inject arbitrary web script or HTML via (1) the JEXEC_OUTID parameter in a JEXEC_MODE_RELAY_OUTPUT action to the jexec program; the (2) act,…

  • CVE-2009-3486Sep 30, 2009
    Juniper Networks
    Junos
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the J-Web interface in Juniper JUNOS 8.5R1.14 allow remote authenticated users to inject arbitrary web script or HTML via the host parameter to (1) the pinghost program, reachable through the diagnose program; or (2) the…

  • CVE-2009-3485Sep 30, 2009
    Juniper Networks
    Junos
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the J-Web interface in Juniper JUNOS 8.5R1.14 and 9.0R1.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI.

  • CVE-2009-3484Sep 30, 2009
    Coreftp
    Coreftp
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in Core FTP 2.1 build 1612 allows user-assisted remote attackers to execute arbitrary code via a long hostname in an FTP server entry in a site backup file. NOTE: some of these details are obtained from third party information.

  • CVE-2009-3483Sep 30, 2009
    Globalscape
    Cuteftp
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in the Create New Site feature in GlobalSCAPE CuteFTP Professional, Home, and Lite 8.3.3 and 8.3.3.0054 allows user-assisted remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a site list containing…

  • CVE-2009-3482HigSep 30, 2009
    Trustport
    Antivirus
    risk 0.51cvss 7.8epss 0.00

    TrustPort Antivirus before 2.8.0.2266 and PC Security before 2.0.0.1291 use weak permissions (Everyone: Full Control) for files under %PROGRAMFILES%, which allows local users to gain privileges by replacing executables with Trojan horse programs.

  • CVE-2009-3481Sep 30, 2009
    Isygen
    Com Icrmbasic
    risk 0.00cvss —epss 0.01

    A certain interface in the iCRM Basic (com_icrmbasic) component 1.4.2.31 for Joomla! does not require administrative authentication, which has unspecified impact and remote attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2009-3480Sep 30, 2009
    Joomla
    iCRM Basic
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the iCRM Basic (com_icrmbasic) component 1.4.2.31 for Joomla! allows remote attackers to execute arbitrary SQL commands via the p3 parameter to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2009-3479Sep 30, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Bibliography (Biblio) 5.x before 5.x-1.17 and 6.x before 6.x-1.6, a module for Drupal, allows remote attackers, with "create content displayed by the Bibliography module" permissions, to inject arbitrary web script or HTML via a title.

  • CVE-2009-3478Sep 29, 2009
    Fireftp
    Fireftp
    risk 0.00cvss —epss 0.01

    Argument injection vulnerability in (1) src/content/js/connection/sftp.js and (2) src/content/js/connection/controlSocket.js.in in FireFTP Extension 1.0.5 for Firefox allows remote authenticated SFTP users to cause victims to alter permissions, delete, download, or move the…

  • CVE-2009-3477Sep 29, 2009
    Rim
    Blackberry Device Software
    risk 0.00cvss —epss 0.01

    The Blackberry Browser in RIM BlackBerry Device Software 4.5.0 before 4.5.0.173, 4.6.0 before 4.6.0.303, 4.6.1 before 4.6.1.309, 4.7.0 before 4.7.0.179, and 4.7.1 before 4.7.1.57 does not properly handle "hidden" characters including a '\0' character in a domain name in the…

  • CVE-2009-3476Sep 29, 2009
    Internet2
    Opensaml
    risk 0.00cvss —epss 0.04

    Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and…

  • CVE-2009-3475Sep 29, 2009
    Internet2
    Service Provider
    risk 0.00cvss —epss 0.01

    Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof…

  • CVE-2009-3474Sep 29, 2009
    Internet2
    Opensaml
    risk 0.00cvss —epss 0.02

    OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is…

  • CVE-2009-3473Sep 29, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    IBM DB2 9.1 before FP8 does not require the SETSESSIONUSER privilege for the SET SESSION AUTHORIZATION statement, which has unspecified impact and remote attack vectors.

  • CVE-2009-3472Sep 29, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    IBM DB2 8 before FP18, 9.1 before FP8, and 9.5 before FP4 allows remote authenticated users to bypass intended access restrictions, and update, insert, or delete table rows, via unspecified vectors.

  • CVE-2009-3471Sep 29, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    IBM DB2 8 before FP18, 9.1 before FP8, 9.5 before FP4, and 9.7 before FP2 does not perform the expected drops of certain table functions upon a loss of privileges by the functions' definers, which has unspecified impact and remote attack vectors.

  • CVE-2009-3470Sep 29, 2009
    IBM
    Informix Dynamic Server
    risk 0.00cvss —epss 0.02

    IBM Informix Dynamic Server (IDS) 10.00 before 10.00.xC11, 11.10 before 11.10.xC4, and 11.50 before 11.50.xC5 allows remote attackers to cause a denial of service (memory corruption, assertion failure, and daemon crash) by sending a long password over a JDBC connection.

  • CVE-2009-3469Sep 29, 2009
    IBM
    Connections
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in profiles/html/simpleSearch.do in IBM Lotus Connections 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.

  • CVE-2009-3468Sep 29, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Multiple unspecified vulnerabilities in Common Desktop Environment (CDE) in Sun Solaris 10, when Trusted Extensions is enabled, allow local users to execute arbitrary commands or bypass the Mandatory Access Control (MAC) policy via unknown vectors, related to a menu typo and the…

  • CVE-2009-2905Sep 29, 2009
    newt
    newt
    risk 0.00cvss —epss 0.01

    Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to cause a denial of service (application crash) or possibly execute arbitrary code via a request to display a crafted text dialog box.

  • CVE-2009-3457Sep 29, 2009
    Cisco Systems, Inc.
    Ace Web Application Firewall
    risk 0.03cvss —epss 0.04

    Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling…

  • CVE-2009-3456Sep 29, 2009
    Google
    Chrome
    risk 0.00cvss —epss 0.00

    Google Chrome, possibly 3.0.195.21 and earlier, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by…

  • CVE-2009-3455Sep 29, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Apple Safari, possibly before 4.0.3, on Mac OS X does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued…

  • CVE-2009-3453Sep 29, 2009
    IBM
    Lotus Quickr
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Quickr 8.1.0 services for WebSphere Portal allow remote attackers to inject arbitrary web script or HTML via the filename of a .odt file in a Lotus Quickr place, related to the Library template.

  • CVE-2009-2683Sep 29, 2009
    Microfocus
    Remote Graphics Software
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Sender module in HP Remote Graphics Software (RGS) 5.1.3 through 5.2.6 allows remote authenticated users to execute arbitrary code via unknown vectors.

  • CVE-2009-2681Sep 29, 2009
    Microfocus
    Identity Driven Manager
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in HP ProCurve Identity Driven Manager (IDM) A.02.x through A.02.03 and A.03.x through A.03.00, on Windows Server 2003 with IAS and Windows Server 2008 with NPS, allows local users to gain privileges via unknown vectors.

  • CVE-2009-3452Sep 29, 2009
    Radactive
    I Load
    risk 0.00cvss —epss 0.01

    WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 allows remote attackers to obtain sensitive information via unspecified requests that trigger responses containing the saved-image folder pathname.

  • CVE-2009-3451Sep 29, 2009
    Radactive
    I Load
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2009-3450Sep 29, 2009
    Radactive
    I Load
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 allow remote attackers to inject arbitrary web script or HTML via parameters with names beginning with __ (underscore underscore) sequences, which are incompatible…

  • CVE-2009-3449Sep 29, 2009
    Collectorz
    Mp3 Collector
    risk 0.03cvss —epss 0.02

    MP3 Collector 2.3 allows remote attackers to cause a denial of service (application crash) via a long URL in a .m3u playlist file.

  • CVE-2009-3448Sep 29, 2009
    Bakbone
    Netvault
    risk 0.00cvss —epss 0.02

    npvmgr.exe in BakBone NetVault Backup 8.22 Build 29 allows remote attackers to cause a denial of service (daemon crash) via a packet to (1) TCP or (2) UDP port 20031 with a large value in an unspecified size field, which is not properly handled in a malloc operation. NOTE: some…

  • CVE-2009-3447Sep 29, 2009
    Radactive
    I Load
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in RADactive I-Load before 2008.2.5.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, and then sending a request for a predictable filename during a short time window.

  • CVE-2009-3446Sep 28, 2009
    Joomla
    MyRemote Video Gallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the MyRemote Video Gallery (com_mytube) component 1.0 Beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter in a videos action to index.php.