VYPR

CVEs

385,522 total · page 6938 of 7,711

AllCriticalHighKEV
  • CVE-2009-3445Sep 28, 2009
    Code Crafters
    Ability Mail Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Code-Crafters Ability Mail Server before 2.70 allows remote attackers to cause a denial of service (daemon crash) via an IMAP4 FETCH command.

  • CVE-2009-3444Sep 28, 2009
    E107
    E107
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in email.php in e107 0.7.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header in a news.1 (aka news to email) action.

  • CVE-2009-3443Sep 28, 2009
    Joomla
    Fastball
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Fastball (com_fastball) component 1.1.0 through 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the league parameter to index.php.

  • CVE-2009-3442Sep 28, 2009
    Drupal
    Meta tags (aka Nodewords)
    risk 0.00cvss —epss 0.01

    The Meta tags (aka Nodewords) module before 6.x-1.1 for Drupal does not properly follow permissions during assignment of node meta tags, which allows remote attackers to obtain sensitive information via unspecified vectors.

  • CVE-2009-3441Sep 28, 2009
    Alienvault
    Ossim
    risk 0.00cvss —epss 0.02

    Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to bypass authentication, and read graphs or infrastructure information, via a direct request to (1) graphs/alarms_events.php or (2) host/draw_tree.php.

  • CVE-2009-3440Sep 28, 2009
    OSSIM
    OSSIM
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the option parameter to the default URI (aka the main menu).

  • CVE-2009-3439Sep 28, 2009
    Alienvault
    Ossim
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Open Source Security Information Management (OSSIM) before 2.1.2 allow remote authenticated users to execute arbitrary SQL commands via the id_document parameter to (1) repository_document.php, (2) repository_links.php, and (3)…

  • CVE-2009-3438Sep 28, 2009
    Joomla
    JoomlaFacebook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JoomlaFacebook (com_facebook) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a student action to index.php.

  • CVE-2009-3437Sep 28, 2009
    Drupal
    Markdown Preview
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the live preview feature in the Markdown Preview module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via "Markdown input."

  • CVE-2009-3436Sep 28, 2009
    Maxwebportal
    Maxwebportal
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in forum.asp in MaxWebPortal allow remote attackers to execute arbitrary SQL commands via the (1) FORUM_ID or (2) CAT_ID parameter. NOTE: this might overlap CVE-2005-1417.

  • CVE-2009-3435Sep 28, 2009
    Drupal
    Devel
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the variable editor in the Devel module 5.x before 5.x-1.2 and 6.x before 6.x-1.18, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a variable name.

  • CVE-2009-3434Sep 28, 2009
    Onestopjoomla
    Com Tupinambis
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Tupinambis (com_tupinambis) component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the proyecto parameter in a verproyecto action to index.php.

  • CVE-2009-3433Sep 28, 2009
    Sun Corporation
    Cluster
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in clsetup in the configuration utility in Sun Solaris Cluster 3.2 allows local users to gain privileges via unknown vectors.

  • CVE-2009-3432Sep 28, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in xscreensaver in Sun Solaris 10, and OpenSolaris before snv_112, when Xorg or Xnewt is used and RandR is enabled, allows physically proximate attackers to read a locked screen via unknown vectors related to XRandR resize events.

  • CVE-2009-2873Sep 28, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.0 through 12.4, when IP-based tunnels and the Cisco Express Forwarding feature are enabled, allows remote attackers to cause a denial of service (device reload) via malformed packets, aka Bug ID CSCsx70889.

  • CVE-2009-2872Sep 28, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.0 through 12.4, when IP-based tunnels and the Cisco Express Forwarding feature are enabled, allows remote attackers to cause a denial of service (device reload) via a malformed packet that is not properly handled during switching from one tunnel to a second tunnel,…

  • CVE-2009-2871Sep 28, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco IOS 12.2 and 12.4, when SSLVPN sessions, SSH sessions, or IKE encrypted nonces are enabled, allows remote attackers to cause a denial of service (device reload) via a crafted encrypted packet, aka Bug ID CSCsq24002.

  • CVE-2009-2870Sep 28, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco IOS 12.2 through 12.4, when the Cisco Unified Border Element feature is enabled, allows remote attackers to cause a denial of service (device reload) via crafted SIP messages, aka Bug ID CSCsx25880.

  • CVE-2009-2869Sep 28, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco IOS 12.2XNA, 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows remote attackers to cause a denial of service (device reload) via a crafted NTPv4 packet, aka Bug IDs CSCsu24505 and CSCsv75948.

  • CVE-2009-2868Sep 28, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Cisco IOS 12.2 through 12.4, when certificate-based authentication is enabled for IKE, allows remote attackers to cause a denial of service (Phase 1 SA exhaustion) via crafted requests, aka Bug IDs CSCsy07555 and CSCee72997.

  • CVE-2009-2867Sep 28, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco IOS 12.2XNA, 12.2XNB, 12.2XNC, 12.2XND, 12.4T, 12.4XZ, and 12.4YA, when Zone-Based Policy Firewall SIP Inspection is enabled, allows remote attackers to cause a denial of service (device reload) via a crafted SIP transit packet, aka Bug ID…

  • CVE-2009-2866Sep 28, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco IOS 12.2 through 12.4 allows remote attackers to cause a denial of service (device reload) via a crafted H.323 packet, aka Bug ID CSCsz38104.

  • CVE-2009-2865Sep 28, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.06

    Buffer overflow in the login implementation in the Extension Mobility feature in the Unified Communications Manager Express (CME) component in Cisco IOS 12.4XW, 12.4XY, 12.4XZ, and 12.4YA allows remote attackers to execute arbitrary code or cause a denial of service via crafted…

  • CVE-2009-2864Sep 28, 2009
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.03

    Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 5.x before 5.1(3g), 6.x before 6.1(4), 7.0.x before 7.0(2a)su1, and 7.1.x before 7.1(2) allows remote attackers to cause a denial of service (service restart) via malformed SIP messages, aka Bug ID CSCsz95423.

  • CVE-2009-2863Sep 28, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Race condition in the Firewall Authentication Proxy feature in Cisco IOS 12.0 through 12.4 allows remote attackers to bypass authentication, or bypass the consent web page, via a crafted request, aka Bug ID CSCsy15227.

  • CVE-2009-2862Sep 28, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    The Object Groups for Access Control Lists (ACLs) feature in Cisco IOS 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows remote attackers to bypass intended access restrictions via crafted requests, aka Bug IDs CSCsx07114, CSCsu70214, CSCsw47076, CSCsv48603,…

  • CVE-2009-3431Sep 25, 2009
    Adobe Inc.
    Acrobat
    risk 0.05cvss —epss 0.22

    Stack consumption vulnerability in Adobe Reader and Acrobat 9.1.3, 9.1.2, 9.1.1, and earlier 9.x versions; 8.1.6 and earlier 8.x versions; and possibly 7.1.4 and earlier 7.x versions allows remote attackers to cause a denial of service (application crash) via a PDF file with a…

  • CVE-2009-3430Sep 25, 2009
    Allomani
    Mobile
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.php in Allomani Mobile 2.5 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action.

  • CVE-2009-3429Sep 25, 2009
    Pirateradio
    Destiny Media Player
    risk 0.06cvss —epss 0.35

    Stack-based buffer overflow in Pirate Radio Destiny Media Player 1.61 allows remote attackers to execute arbitrary code via a long string in a .pls playlist file.

  • CVE-2009-3428Sep 25, 2009
    Otbcode
    Easy Music Player
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in Easy Music Player 1.0.0.2 allows remote attackers to execute arbitrary code via a crafted .wav file.

  • CVE-2009-3427Sep 25, 2009
    Kayako
    Supportsuite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Kayako SupportSuite 3.50.06 allows remote attackers to inject arbitrary web script or HTML via the subject field in a ticket.

  • CVE-2009-3426Sep 25, 2009
    Maxcms
    Maxcms
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in includes/file_manager/special.php in MaxCMS 3.11.20b allows remote attackers to execute arbitrary PHP code via a URL in the fm_includes_special parameter.

  • CVE-2009-3425Sep 25, 2009
    Maxcms
    Maxcms
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in includes/inc.thcms_admin_dirtree.php in MaxCMS 3.11.20b allows remote attackers to read arbitrary files via directory traversal sequences in the thCMS_root parameter.

  • CVE-2009-3424Sep 25, 2009
    Maxcms
    Maxcms
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in MaxCMS 3.11.20b, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) is_projectPath parameter to includes/InstantSite/inc.is_root.php; GLOBALS[thCMS_root] parameter to…

  • CVE-2009-3423Sep 25, 2009
    Zenas
    Paolink
    risk 0.03cvss —epss 0.03

    login.php in Zenas PaoLink 1.0, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the login_ok parameter to 1.

  • CVE-2009-3422Sep 25, 2009
    Zenas
    Paoliber
    risk 0.03cvss —epss 0.03

    login.php in Zenas PaoLiber 1.1, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the login_ok parameter to 1.

  • CVE-2009-3421CriSep 25, 2009
    Zenas
    Paobacheca Guestbook
    risk 0.67cvss 9.8epss 0.05

    login.php in Zenas PaoBacheca Guestbook 2.1, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the login_ok parameter to 1.

  • CVE-2009-3420Sep 25, 2009
    Intesync
    Miniweb
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in the Publisher module 2.0 for Miniweb allow remote attackers to inject arbitrary web script or HTML via the (1) begin parameter and the (2) PATH_INFO.

  • CVE-2009-3419Sep 25, 2009
    Intesync
    Miniweb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Publisher module 2.0 for Miniweb allows remote attackers to execute arbitrary SQL commands via the historymonth parameter.

  • CVE-2009-3418Sep 25, 2009
    Plume CMS
    CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Plume CMS 1.2.3 allow (1) remote authenticated users to execute arbitrary SQL commands via the m parameter to manager/index.php and (2) remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an…

  • CVE-2009-3417Sep 25, 2009
    Joomla
    IDoBlog
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the IDoBlog (com_idoblog) component 1.1 build 30 for Joomla! allows remote attackers to execute arbitrary SQL commands via the userid parameter in a profile action to index.php, a different vector than CVE-2008-2627.

  • CVE-2009-3390Sep 24, 2009
    Sun Corporation
    Opensolaris
    risk 0.00cvss —epss 0.00

    Multiple unspecified vulnerabilities in the (1) iscsiadm and (2) iscsitadm programs in Sun Solaris 10, and OpenSolaris snv_28 through snv_109, allow local users with certain RBAC execution profiles to gain privileges via unknown vectors related to the libima library.

  • CVE-2009-2817Sep 24, 2009
    Apple Inc.
    iTunes
    risk 0.04cvss —epss 0.09

    Buffer overflow in Apple iTunes before 9.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted .pls file.

  • CVE-2009-2682Sep 24, 2009
    HPE
    HP-UX
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Role-Based Access Control (RBAC) in HP HP-UX B.11.23 and B.11.31 allows local users to bypass intended access restrictions via unknown vectors.

  • CVE-2009-3369Sep 24, 2009
    Backuppc
    Backuppc
    risk 0.00cvss —epss 0.03

    CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive files by modifying ClientNameAlias to match another…

  • CVE-2009-3368Sep 24, 2009
    Joomlahbs
    Com Hbssearch
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Hotel Booking Reservation System (aka HBS or com_hbssearch) component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the adult parameter in a showhoteldetails action to index.php.

  • CVE-2009-3367Sep 24, 2009
    Plohni
    An Image Gallery
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in An image gallery 1.0 allow remote attackers to inject arbitrary web script or HTML via the path parameter to (1) index.php and (2) main.php, and the (3) show parameter to main.php. NOTE: the provenance of this information…

  • CVE-2009-3366Sep 24, 2009
    Plohni
    An Image Gallery
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in navigation.php in An image gallery 1.0 allows remote attackers to list arbitrary directories via a .. (dot dot) in the path parameter.

  • CVE-2009-3365Sep 24, 2009
    Aurora
    Aurora CMS
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in add-ons/modules/sysmanager/plugins/install.plugin.php in Aurora CMS 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the AURORA_MODULES_FOLDER parameter.

  • CVE-2009-3364Sep 24, 2009
    Ftpshell
    Client
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in FTPShell Client 4.1 RC2 allows remote FTP servers to execute arbitrary code via a long response to a PASV command.