VYPR

CVEs

385,503 total · page 6940 of 7,711

AllCriticalHighKEV
  • CVE-2009-3283Sep 22, 2009
    Phpspot
    PHP Bbs Ce
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in phpspot PHP BBS, PHP Image Capture BBS, PHP & CSS BBS, PHP BBS CE, PHP_RSS_Builder, and webshot, dated before 20090914, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to cookies.

  • CVE-2009-3280Sep 21, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    Integer signedness error in the find_ie function in net/wireless/scan.c in the cfg80211 subsystem in the Linux kernel before 2.6.31.1-rc1 allows remote attackers to cause a denial of service (soft lockup) via malformed packets.

  • CVE-2009-3279Sep 21, 2009
    Qnap
    Ts 239 Pro Turbo Nas
    risk 0.00cvss —epss 0.00

    The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create a LUKS partition by using the AES-256 cipher in plain CBC mode, which allows local users to obtain sensitive information via a watermark attack.

  • CVE-2009-3278MedSep 21, 2009
    Qnap
    Ts 239 Pro Firmware
    risk 0.36cvss 5.5epss 0.00

    The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 use the rand library function to generate a certain recovery key, which makes it easier for local users to determine this key via a brute-force attack.

  • CVE-2009-3277Sep 21, 2009
    Xenu By
    Datavault
    risk 0.00cvss —epss 0.01

    DataVault.Tesla/Impl/TypeSystem/AssociationHelper.cs in datavault allows context-dependent attackers to cause a denial of service (CPU consumption) via an input string composed of an [ (open bracket) followed by many commas, related to a certain regular expression, aka a "ReDoS"…

  • CVE-2009-3276Sep 21, 2009
    NASD CORE.NET Terelik
    Corenet1
    risk 0.00cvss —epss 0.01

    Zoran/WinFormsAdvansed/RegeularDataToXML/Form1.cs in WinFormsAdvansed in NASD CORE.NET Terelik (aka corenet1) allows context-dependent attackers to cause a denial of service (CPU consumption) via an input string composed of many alphabetic characters followed by a ! (exclamation…

  • CVE-2009-3275Sep 21, 2009
    Microsoft
    Enterprise Library
    risk 0.00cvss —epss 0.04

    Blocks/Common/Src/Configuration/Manageability/Adm/AdmContentBuilder.cs in Microsoft patterns & practices Enterprise Library (aka EntLib) allows context-dependent attackers to cause a denial of service (CPU consumption) via an input string composed of many \ (backslash)…

  • CVE-2009-3274Sep 21, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.00

    Mozilla Firefox 3.6a1, 3.5.3, 3.5.2, and earlier 3.5.x versions, and 3.0.14 and earlier 2.x and 3.x versions, on Linux uses a predictable /tmp pathname for files selected from the Downloads window, which allows local users to replace an arbitrary downloaded file by placing a…

  • CVE-2009-3273Sep 21, 2009
    Apple Inc.
    Iphone OS
    risk 0.00cvss —epss 0.01

    iPhone Mail in Apple iPhone OS, and iPhone OS for iPod touch, does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL e-mail servers via a crafted certificate.

  • CVE-2009-3272Sep 21, 2009
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.06

    Stack consumption vulnerability in WebKit.dll in WebKit in Apple Safari 3.2.3, and possibly other versions before 4.1.2, allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls eval on a long string composed of A/ sequences.

  • CVE-2009-3271Sep 21, 2009
    Apple Inc.
    Safari
    risk 0.03cvss —epss 0.04

    Apple Safari on iPhone OS 3.0.1 allows remote attackers to cause a denial of service (application crash) via a long tel: URL in the SRC attribute of an IFRAME element.

  • CVE-2009-3200Sep 21, 2009
    Qnap
    Ts 239 Pro Turbo Nas
    risk 0.00cvss —epss 0.00

    The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create an undocumented recovery key and store it in the ENCK variable in flash memory, which allows local users to bypass the passphrase requirement and decrypt the hard drive by reading this…

  • CVE-2009-2939Sep 21, 2009
    Postfix
    Postfix
    risk 0.00cvss —epss 0.01

    The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, which might allow local users to conduct symlink attacks that overwrite arbitrary files.

  • CVE-2009-2744Sep 21, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27 allows remote attackers to cause a denial of service via unknown vectors, related to "an error in fixpacks 6.1.0.23 and 6.1.0.25."

  • CVE-2009-2743Sep 21, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.00

    IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27, and 7.0 before 7.0.0.7, does not properly handle an exception occurring after use of wsadmin scripts and configuration of JAAS-J2C Authentication Data, which allows local users to obtain sensitive information by reading…

  • CVE-2009-2742Sep 21, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Eclipse Help in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27 allows remote attackers to inject arbitrary web script or HTML via unspecified input.

  • CVE-2009-2140Sep 21, 2009
    Go Oo
    Go Oo
    risk 0.00cvss —epss 0.06

    Multiple heap-based buffer overflows in cppcanvas/source/mtfrenderer/emfplus.cxx in Go-oo 2.x and 3.x before 3.0.1, previously named ooo-build and related to OpenOffice.org (OOo), allow remote attackers to execute arbitrary code via a crafted EMF+ file, a similar issue to…

  • CVE-2009-3270Sep 18, 2009
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.28

    Microsoft Internet Explorer 7 through 7.0.6000.16711 allows remote attackers to cause a denial of service (unusable browser) by calling the window.print function in a loop, aka a "printing DoS attack," possibly a related issue to CVE-2009-0821.

  • CVE-2009-3269Sep 18, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera 9.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a series of automatic submissions of a form containing a KEYGEN element, a related issue to CVE-2009-1828.

  • CVE-2009-3268Sep 18, 2009
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome 1.0.154.48 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an automatically submitted form containing a KEYGEN element, a related issue to CVE-2009-1828.

  • CVE-2009-3267Sep 18, 2009
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.16

    Microsoft Internet Explorer 6 through 6.0.2900.2180, and 7.0.6000.16711, allows remote attackers to cause a denial of service (CPU consumption) via an automatically submitted form containing a KEYGEN element, a related issue to CVE-2009-1828.

  • CVE-2009-3266Sep 18, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Opera before 10.01 does not properly restrict HTML in a (1) RSS or (2) Atom feed, which allows remote attackers to conduct cross-site scripting (XSS) attacks, and conduct cross-zone scripting attacks involving the Feed Subscription Page to read feeds or create feed…

  • CVE-2009-3265Sep 18, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Opera 9 and 10 allows remote attackers to inject arbitrary web script or HTML via a (1) RSS or (2) Atom feed, related to the rendering of the application/rss+xml content type as "scripted content." NOTE: the vendor reportedly considers…

  • CVE-2009-3264Sep 18, 2009
    Google
    Chrome
    risk 0.00cvss —epss 0.04

    The getSVGDocument method in Google Chrome before 3.0.195.21 omits an unspecified "access check," which allows remote web servers to bypass the Same Origin Policy and conduct cross-site scripting attacks via unknown vectors, related to a user's visit to a different web server…

  • CVE-2009-3263Sep 18, 2009
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a (1) RSS or (2) Atom feed, related to the rendering of the application/rss+xml content type as XML "active content."

  • CVE-2009-2793Sep 18, 2009
    NetBSD
    NetBSD
    risk 0.03cvss —epss 0.01

    The kernel in NetBSD, probably 5.0.1 and earlier, on x86 platforms does not properly handle a pre-commit failure of the iret instruction, which might allow local users to gain privileges via vectors related to a tempEIP pseudocode variable that is outside of the code-segment…

  • CVE-2009-2741Sep 18, 2009
    IBM
    Websphere Business Events
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the wberuntimeear application in the test servlet in IBM WebSphere Business Events 6.1 and 6.2 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2008-7246Sep 18, 2009
    Google
    Chrome
    risk 0.03cvss —epss 0.02

    Google Chrome 0.2.149.29 and earlier allows remote attackers to cause a denial of service (unusable browser) by calling the window.print function in a loop, aka a "printing DoS attack," possibly a related issue to CVE-2009-0821.

  • CVE-2008-7245Sep 18, 2009
    Opera
    Opera
    risk 0.04cvss —epss 0.06

    Opera 9.52 and earlier allows remote attackers to cause a denial of service (unusable browser) by calling the window.print function in a loop, aka a "printing DoS attack," possibly a related issue to CVE-2009-0821.

  • CVE-2008-7244Sep 18, 2009
    Mozilla Corporation
    Firefox
    risk 0.03cvss —epss 0.04

    Mozilla Firefox 3.0.1 and earlier allows remote attackers to cause a denial of service (browser hang) by calling the window.print function in a loop, aka a "printing DoS attack," possibly a related issue to CVE-2009-0821.

  • CVE-2009-3262Sep 18, 2009
    IBM
    Tivoli Identity Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Self Service UI (SSUI) in IBM Tivoli Identity Manager (ITIM) 5.0.0.5 allows remote authenticated users to inject arbitrary web script or HTML via the last name field in a profile.

  • CVE-2009-3261Sep 18, 2009
    Livestreet
    Livestreet
    risk 0.00cvss —epss 0.01

    update/update_0.1.2_to_0.2.php in LiveStreet 0.2 does not require administrative authentication, which allows remote attackers to perform DROP TABLE operations via unspecified vectors.

  • CVE-2009-3260Sep 18, 2009
    Livestreet
    Livestreet
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in LiveStreet 0.2 allows remote attackers to inject arbitrary web script or HTML via the header of the topic in a comment.

  • CVE-2009-3259Sep 18, 2009
    RASH Quote Management System
    Quote Management System
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in RASH Quote Management System (RQMS) 1.2.2 allow remote attackers to execute arbitrary SQL commands via (1) the search parameter in a search action, (2) the quote parameter in a quote addition, or (3) a User_Name cookie in unspecified…

  • CVE-2009-3258Sep 18, 2009
    Vtiger
    CRM
    risk 0.00cvss —epss 0.02

    vtiger CRM before 5.1.0 allows remote authenticated users, with certain View privileges, to delete (1) attachments, (2) reports, (3) filters, (4) views, and (5) tickets; insert (6) attachments, (7) reports, (8) filters, (9) views, and (10) tickets; and edit (11) reports, (12)…

  • CVE-2009-3257Sep 18, 2009
    Vtiger
    vTiger
    risk 0.00cvss —epss 0.01

    vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the (1) Account Billing Address and (2) Shipping Address fields in a profile by creating a Sales Order (SO) associated with that profile.

  • CVE-2009-3256Sep 18, 2009
    Livestreet
    Livestreet
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in include/ajax/blogInfo.php in LiveStreet 0.2 allows remote attackers to inject arbitrary web script or HTML via the URI, as demonstrated by a SCRIPT element in an arbitrary parameter such as the asd parameter.

  • CVE-2009-3255Sep 18, 2009
    RASH Quote Management System
    RQMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in RASH Quote Management System (RQMS) 1.2.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an admin action to the default URI.

  • CVE-2009-3254Sep 18, 2009
    Ultimatevideosite
    Ultimate Player
    risk 0.03cvss —epss 0.05

    Multiple stack-based buffer overflows in Ultimate Player 1.56 beta allow remote attackers to execute arbitrary code via a long string in a (1) .m3u or (2) .upl playlist file.

  • CVE-2009-3253Sep 18, 2009
    Tricerasoft
    Swift Ultralite
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in TriceraSoft Swift Ultralite 1.032 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long string in a .M3U playlist file.

  • CVE-2009-3252Sep 18, 2009
    Rock Band CMS
    Rock Band CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in news.php in Rock Band CMS 0.10 allow remote attackers to execute arbitrary SQL commands via the (1) year and (2) id parameters.

  • CVE-2009-3251Sep 18, 2009
    Vtiger
    CRM
    risk 0.00cvss —epss 0.01

    include/utils/ListViewUtils.php in vtiger CRM before 5.1.0 allows remote authenticated users to bypass intended access restrictions and read the (1) visibility, (2) location, and (3) recurrence fields of a calendar via a custom view.

  • CVE-2009-3250Sep 18, 2009
    Vtiger
    vTiger
    risk 0.04cvss —epss 0.11

    The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code by composing an e-mail message with an attachment filename ending in (1) .php in installations based on certain Apache HTTP…

  • CVE-2009-3249Sep 18, 2009
    Vtiger
    CRM
    risk 0.04cvss —epss 0.10

    Multiple directory traversal vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the module parameter to graph.php; or the (2) module or (3) file parameter to include/Ajax/CommonAjax.php, reachable…

  • CVE-2009-3248Sep 18, 2009
    Vtiger
    vTiger
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for requests that modify the news feed system via the rssurl parameter in a Save action to index.php.

  • CVE-2009-3247Sep 18, 2009
    Vtiger
    vTiger
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Activities module in vtiger CRM 5.0.4 allows remote attackers to inject arbitrary web script or HTML via the action parameter to phprint.php. NOTE: the query_string vector is already covered by CVE-2008-3101.3.

  • CVE-2009-3246Sep 18, 2009
    Mybuxscript
    Pts Bux
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in spnews.php in MyBuxScript PTC-BUX allows remote attackers to execute arbitrary SQL commands via the id parameter in an spnews action to the default URI. NOTE: some of these details are obtained from third party information.

  • CVE-2009-3244Sep 18, 2009
    Adobe Inc.
    Shockwave Player
    risk 0.05cvss —epss 0.20

    Heap-based buffer overflow in the SwDir.dll ActiveX control in Adobe Shockwave Player 11.5.1.601 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long PlayerVersion property value.

  • CVE-2009-3243Sep 18, 2009
    Wireshark
    Wireshark
    risk 0.04cvss —epss 0.07

    Unspecified vulnerability in the TLS dissector in Wireshark 1.2.0 and 1.2.1, when running on Windows, allows remote attackers to cause a denial of service (application crash) via unknown vectors related to TLS 1.2 conversations.

  • CVE-2009-3242Sep 18, 2009
    Wireshark
    Wireshark
    risk 0.04cvss —epss 0.08

    Unspecified vulnerability in packet.c in the GSM A RR dissector in Wireshark 1.2.0 and 1.2.1 allows remote attackers to cause a denial of service (application crash) via unknown vectors related to "an uninitialized dissector handle," which triggers an assertion failure.