VYPR

CVEs

385,503 total · page 6941 of 7,711

AllCriticalHighKEV
  • CVE-2009-3241Sep 18, 2009
    Wireshark
    Wireshark
    risk 0.04cvss —epss 0.10

    Unspecified vulnerability in the OpcUa (OPC UA) dissector in Wireshark 0.99.6 through 1.0.8 and 1.2.0 through 1.2.1 allows remote attackers to cause a denial of service (memory and CPU consumption) via malformed OPCUA Service CallRequest packets.

  • CVE-2009-3240Sep 18, 2009
    Happy Linux
    XF-Section
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Happy Linux XF-Section module 1.12a for XOOPS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-3238MedSep 18, 2009
    Linux
    Kernel
    risk 0.36cvss 5.5epss 0.02

    The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the…

  • CVE-2009-2937Sep 18, 2009
    Intertwingly
    Planet Venus
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in Planet 2.0 and Planet Venus allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IMG element in a feed.

  • CVE-2009-2707Sep 18, 2009
    Novell
    Suse Linux Enterprise Server
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in ia32el (aka the IA 32 emulation functionality) before 7042_7022-0.4.2 in SUSE Linux Enterprise (SLE) 10 SP2 on Itanium IA64 machines allows local users to cause a denial of service (system crash) via a 32-bit x86 application.

  • CVE-2009-1883Sep 18, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The z90crypt_unlocked_ioctl function in the z90crypt driver in the Linux kernel 2.6.9 does not perform a capability check for the Z90QUIESCE operation, which allows local users to leverage euid 0 privileges to force a driver outage.

  • CVE-2008-7243Sep 17, 2009
    Modx
    MODX
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in page 34 in MODx CMS 0.9.6.1 and 0.9.6.1p1 allows remote attackers to hijack the authentication of other users for requests that modify passwords via manager/index.php. NOTE: due to the lack of details, it is not clear whether…

  • CVE-2008-7242Sep 17, 2009
    Modx
    MODX
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the (1) search, (2) "a," (3) messagesubject, and (4) messagebody parameters to certain pages as reachable from…

  • CVE-2008-7241Sep 17, 2009
    Punbb
    Punbb
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in PunBB before 1.2.17 allows remote attackers to hijack the authentication of unspecified users for requests related to a logout, probably a forced logout.

  • CVE-2008-7240Sep 17, 2009
    Linux Web Shop
    PHP User Base
    risk 0.04cvss —epss 0.06

    Directory traversal vulnerability in include/unverified.inc.php in Linux Web Shop (LWS) php User Base 1.3beta allows remote attackers to include and execute arbitrary local files via the template parameter.

  • CVE-2009-3237Sep 17, 2009
    Horde (software)
    Application Framework
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; allow remote attackers to inject…

  • CVE-2009-3236Sep 17, 2009
    Horde (software)
    Application Framework
    risk 0.00cvss —epss 0.02

    The form library in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; reuses temporary filenames during the upload process which allows remote…

  • CVE-2009-3235Sep 17, 2009
    Dovecot (software)
    Dovecot
    risk 0.00cvss —epss 0.04

    Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as…

  • CVE-2009-3234Sep 17, 2009
    Linux
    Kernel
    risk 0.03cvss —epss 0.02

    Buffer overflow in the perf_copy_attr function in kernel/perf_counter.c in the Linux kernel 2.6.31-rc1 allows local users to cause a denial of service (crash) and execute arbitrary code via a "big size data" to the perf_counter_open system call.

  • CVE-2009-3233Sep 17, 2009
    Changetrack
    changetrack
    risk 0.03cvss —epss 0.01

    changetrack 4.3 allows local users to execute arbitrary commands via CRLF sequences and shell metacharacters in a filename in a directory that is checked by changetrack.

  • CVE-2009-3232Sep 17, 2009
    Ubuntu
    pam-auth-update
    risk 0.00cvss —epss 0.05

    pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass…

  • CVE-2009-3231Sep 17, 2009
    PostgreSQL
    PostgreSQL
    risk 0.01cvss —epss 0.08

    The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.

  • CVE-2009-3230Sep 17, 2009
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.03

    The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows…

  • CVE-2009-3229Sep 17, 2009
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.03

    The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, and 8.2 before 8.2.14 allows remote authenticated users to cause a denial of service (backend shutdown) by "re-LOAD-ing" libraries from a certain plugins directory.

  • CVE-2009-3227Sep 16, 2009
    Almondsoft
    Almond Classifieds
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in AlmondSoft Almond Classifieds Ads Enterprise and Almond Affiliate Network Classifieds allows remote attackers to inject arbitrary web script or HTML via the city parameter in a search action. NOTE: some of these details…

  • CVE-2009-3226Sep 16, 2009
    Almondsoft
    Almond Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in AlmondSoft Almond Classifieds Ads Enterprise and Almond Affiliate Network Classifieds allows remote attackers to execute arbitrary SQL commands via the replid parameter in a manw_repl add_form action. NOTE: some of these details are…

  • CVE-2009-3225Sep 16, 2009
    Almondsoft
    Almond Classifieds
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in AlmondSoft Almond Classifieds Wap and Pro, and possibly Almond Affiliate Network Classifieds, allow remote attackers to inject arbitrary web script or HTML via (1) the page parameter in a browse action to index.php or (2)…

  • CVE-2009-3224Sep 16, 2009
    Classified Software
    Super Mod System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Super Mod System, when using the 68 Classifieds 3.1 Core System, allows remote attackers to execute arbitrary SQL commands via the s parameter.

  • CVE-2009-3223Sep 16, 2009
    Inout
    Adserver
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ppc-add-keywords.php in Inout Adserver allows remote authenticated users to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-3222Sep 16, 2009
    Freewebscriptz
    Honest Traffic
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in FreeWebScriptz Honest Traffic (FWSHT) 1.x allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2009-3221Sep 16, 2009
    Basicunivers.free.fr
    Audio Lib Player
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in Audio Lib Player (ALP) allows remote attackers to execute arbitrary code via a long URL in a .m3u playlist file.

  • CVE-2009-3220Sep 16, 2009
    Tecnick
    Aiocp
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in cp_html2txt.php in All In One Control Panel (AIOCP) 1.4.001 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

  • CVE-2009-3219Sep 16, 2009
    AR
    AR Web Content Manager
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in a.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the a parameter.

  • CVE-2009-3218Sep 16, 2009
    AR Web Content Manager
    AWCM
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in control/login.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2009-3217Sep 16, 2009
    Wiccle
    Iwiccle
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the admin module in iWiccle 1.01 allows remote attackers to execute arbitrary SQL commands via the member_id parameter in an edit_user action to index.php.

  • CVE-2009-3216Sep 16, 2009
    Wiccle
    Iwiccle
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in iWiccle 1.01, when magic_quotes_gpc is disabled, allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the show parameter to the admin module, reachable through index.php; or (2) the module parameter to index.php.

  • CVE-2009-3215Sep 16, 2009
    IXXO
    Cart Standalone
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in IXXO Cart Standalone before 3.9.6.1, and the IXXO Cart component for Joomla! 1.0.x, allows remote attackers to execute arbitrary SQL commands via the parent parameter.

  • CVE-2009-3214Sep 16, 2009
    Photodex
    Proshow Gold
    risk 0.05cvss —epss 0.31

    Multiple stack-based buffer overflows in Photodex ProShow Gold 4.0.2549 allow remote attackers to execute arbitrary code via a crafted Slideshow project (.psh) file, related to the (1) cell[n].images[m].image and (2) cell[n].sound.file fields.

  • CVE-2009-3213Sep 16, 2009
    Broid
    Broid
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in broid 1.0 Beta 3a allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .mp3 file.

  • CVE-2009-3212Sep 16, 2009
    Dimofinf
    Infinity Script
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in VivaPrograms Infinity Script 2.x.x, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username field.

  • CVE-2009-3211Sep 16, 2009
    Dimofinf
    Infinity Script
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in VivaPrograms Infinity Script 2.x.x, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the options[style_dir] parameter to the default URI.

  • CVE-2009-3210Sep 16, 2009
    Drupal
    Print
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.8 and 6.x before 6.x-1.8, a module for Drupal, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-3209Sep 16, 2009
    PHP EMail Manager
    PHP eMail Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in remove.php in PHP eMail Manager 3.3.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2009-3208Sep 16, 2009
    PhpfreeBB
    phpfreeBB
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in phpfreeBB 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to permalink.php and (2) year parameter to index.php.

  • CVE-2009-3207Sep 16, 2009
    Drupal
    ImageCache
    risk 0.00cvss —epss 0.02

    The ImageCache module 5.x before 5.x-2.5 and 6.x before 6.x-2.0-beta10, a module for Drupal, when the private file system is used, does not properly perform access control for derivative images, which allows remote attackers to view arbitrary images via a request that specifies…

  • CVE-2009-3206Sep 16, 2009
    Drupal
    ImageCache
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the ImageCache module 5.x before 5.x-2.5 and 6.x before 6.x-2.0-beta10, a module for Drupal, allow remote authenticated users, with "administer imagecache" permissions, to inject arbitrary web script or HTML via unspecified…

  • CVE-2009-3205Sep 16, 2009
    Cbauthority
    Cbauthority
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in main.php in CBAuthority allows remote attackers to execute arbitrary SQL commands via the id parameter in a view_product action.

  • CVE-2009-3204Sep 16, 2009
    Stiva
    Stiva Forum
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Stiva Forum 1.0 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) demo.php and (2) forum.php, and the PATH_INFO to (3) include_forum.php.

  • CVE-2009-3203Sep 16, 2009
    AJ Square
    Aj Auction Pro Oopd
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in store.php in AJ Auction Pro OOPD 2.x allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-3202Sep 16, 2009
    Uloki
    Uloki PHP Forum
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in ULoKI PHP Forum 2.1 allows remote attackers to inject arbitrary web script or HTML via the term parameter.

  • CVE-2009-3201Sep 15, 2009
    Media Player Classic
    Media Player Classic
    risk 0.03cvss —epss 0.02

    Integer overflow in Media Player Classic 6.4.9 allows user-assisted remote attackers to cause a denial of service (application crash) via a MIDI file (.mid) with a malformed header, which triggers a buffer overflow, a different vulnerability than CVE-2007-4940.

  • CVE-2009-3166Sep 15, 2009
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login session that occurs immediately after a password reset, which allows context-dependent attackers to discover passwords by reading (1) web-server access logs, (2) web-server Referer…

  • CVE-2009-3165Sep 15, 2009
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Bug.create WebService function in Bugzilla 2.23.4 through 3.0.8, 3.1.1 through 3.2.4, and 3.3.1 through 3.4.1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters.

  • CVE-2009-3125Sep 15, 2009
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Bug.search WebService function in Bugzilla 3.3.2 through 3.4.1, and 3.5, allows remote attackers to execute arbitrary SQL commands via unspecified parameters.

  • CVE-2009-2945Sep 15, 2009
    Stanford
    Webauth
    risk 0.00cvss —epss 0.01

    weblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certain circumstances involving conversion of a POST request to a GET request, which allows context-dependent attackers to discover passwords by…