VYPR

CVEs

385,503 total · page 6942 of 7,711

AllCriticalHighKEV
  • CVE-2009-2903Sep 15, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    Memory leak in the appletalk subsystem in the Linux kernel 2.4.x through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and ipddp modules are loaded but the ipddp"N" device is not found, allows remote attackers to cause a denial of service (memory consumption) via IP-DDP…

  • CVE-2009-2629Sep 15, 2009
    Nginx
    Nginx
    risk 0.09cvss —epss 0.75

    Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests.

  • CVE-2009-2201Sep 15, 2009
    Apple Inc.
    Xsan
    risk 0.00cvss —epss 0.00

    The screensharing feature in the Admin application in Apple Xsan before 2.2 places a cleartext username and password in a URL within an error dialog, which allows physically proximate attackers to obtain credentials by reading this dialog.

  • CVE-2009-3199Sep 15, 2009
    Uebimiau
    Uebimiau
    risk 0.03cvss —epss 0.02

    Uebimiau Webmail 3.2.0-2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database with usernames and password hashes via a direct request for system_admin/admin.ucf.

  • CVE-2009-3198Sep 15, 2009
    Jce Tech
    Affiliate Master Datafeed Parser
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in JCE-Tech Affiliate Master Datafeed Parser Script 2.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2009-3197Sep 15, 2009
    Jce Tech
    PHP Calendars Script
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in JCE-Tech PHP Calendars Script allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2009-3196Sep 15, 2009
    Jce Tech
    Video Niche Script
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in JCE-Tech PHP Video Script allows remote attackers to inject arbitrary web script or HTML via the key parameter.

  • CVE-2009-3195Sep 15, 2009
    Jce Tech
    Auction Rss Content Script
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in JCE-Tech Auction RSS Content Script 3.0 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) rss.php and (2) search.php.

  • CVE-2009-3194Sep 15, 2009
    Jce Tech
    Searchfeed Script
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in JCE-Tech SearchFeed Script allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2009-3193Sep 15, 2009
    Joomla
    DigiFolio
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the DigiFolio (com_digifolio) component 1.52 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a project action to index.php.

  • CVE-2009-3192Sep 15, 2009
    Linkorcms
    Linkorcms
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in LinkorCMS 1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the searchstr parameter in a search action; or the (2) nikname, (3) realname, (4) homepage, or (5) city parameter…

  • CVE-2009-3191Sep 15, 2009
    Pad Site Scripts
    Pad Site Scripts
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in PAD Site Scripts 3.6 allow remote attackers to inject arbitrary web script or HTML via the cat parameter to (1) rss.php and (2) opml.php.

  • CVE-2009-3190Sep 15, 2009
    Pad Site Scripts
    Pad Site Scripts
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in PAD Site Scripts 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to list.php and (2) cat parameter to rss.php.

  • CVE-2009-3189Sep 15, 2009
    Digioz
    Digioz Guestbook
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in DigiOz Guestbook 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the search_term parameter.

  • CVE-2009-3188Sep 15, 2009
    PhpSANE
    phpSANE
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in save.php in phpSANE 0.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the file_save parameter.

  • CVE-2009-3187Sep 15, 2009
    Stand Alone Arcade
    Saa
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in gamelist.php in Stand Alone Arcade 1.1 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.

  • CVE-2009-3186Sep 15, 2009
    Videogirls
    Videogirls Biz
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in VideoGirls BiZ allow remote attackers to inject arbitrary web script or HTML via the (1) t parameter to forum.php, (2) profile_name parameter to profile.php, and (3) p parameter to view.php.

  • CVE-2009-3185Sep 15, 2009
    Discuz
    Crazy Star Plugin
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in plugin.php in the Crazy Star plugin 2.0 for Discuz! allows remote authenticated users to execute arbitrary SQL commands via the fmid parameter in a view action.

  • CVE-2009-3184Sep 15, 2009
    E-Gold Game Series
    Pirates of The Caribbean
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Pirates of The Caribbean in the E-Gold Game Series allow remote attackers to execute arbitrary SQL commands via the (1) x and (2) y parameters.

  • CVE-2009-3183Sep 14, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Heap-based buffer overflow in w in Sun Solaris 8 through 10, and OpenSolaris before snv_124, allows local users to gain privileges via unspecified vectors.

  • CVE-2009-2947Sep 14, 2009
    Xapian
    Omega
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages.

  • CVE-2009-2814Sep 14, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Wiki Server in Apple Mac OS X 10.5.8 allows remote attackers to inject arbitrary web script or HTML via a search request containing data that does not use UTF-8 encoding.

  • CVE-2009-2813Sep 14, 2009
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.03

    Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames,…

  • CVE-2009-2812Sep 14, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Launch Services in Apple Mac OS X 10.5.8 does not properly recognize an unsafe Uniform Type Identifier (UTI) in an exported document type in a downloaded application, which allows remote attackers to trigger the automatic opening of a file, and execute arbitrary code, via a…

  • CVE-2009-2811Sep 14, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Incomplete blacklist vulnerability in Launch Services in Apple Mac OS X 10.5.8 allows user-assisted remote attackers to execute arbitrary code via a .fileloc file, which does not trigger a "potentially unsafe" warning message in the Quarantine feature.

  • CVE-2009-2809Sep 14, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    ImageIO in Apple Mac OS X 10.4.11 and 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PixarFilm encoded TIFF image, related to "multiple memory corruption issues."

  • CVE-2009-2807Sep 14, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Heap-based buffer overflow in the USB backend in CUPS in Apple Mac OS X 10.5.8 allows local users to gain privileges via unspecified vectors.

  • CVE-2009-2805Sep 14, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Integer overflow in CoreGraphics in Apple Mac OS X 10.4.11 and 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JBIG2 stream in a PDF file, leading to a heap-based buffer overflow.

  • CVE-2009-2804Sep 14, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    Integer overflow in ColorSync in Apple Mac OS X 10.4.11 and 10.5.8, and Safari before 4.0.4 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ColorSync profile embedded in an image, leading to a…

  • CVE-2009-2803Sep 14, 2009
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    CarbonCore in Apple Mac OS X 10.4.11 and 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a file with a crafted resource fork.

  • CVE-2008-7239Sep 14, 2009
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10.2 allow remote attackers to affect confidentiality via unknown vectors related to the (1) Oracle Application Object Library (APP02) and (2) Oracle Applications Manager (APP04).

  • CVE-2008-7238Sep 14, 2009
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.3 allow (1) local users to affect confidentiality and integrity via unknown vectors related to the Mobile Application Server component (APP01); (2) remote attackers to affect confidentiality via unknown vectors…

  • CVE-2008-7237Sep 14, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the Oracle Internet Directory component in Oracle Application Server 9.0.4.3 and 10.1.2.2 allows remote authenticated users to affect confidentiality via unknown vectors, aka AS06.

  • CVE-2008-7236Sep 14, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the Oracle JDeveloper component in Oracle Application Server 10.1.2.2 and 10.1.3.1 allows remote attackers to affect integrity via unknown vectors, aka AS05.

  • CVE-2008-7235Sep 14, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the Oracle Forms component in Oracle Application Server 10.1.2.2 and E-Business Suite 12.0.3 allows remote attackers to affect integrity via unknown vectors, aka AS04.

  • CVE-2008-7234Sep 14, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in the Oracle BPEL Worklist Application component in Oracle Application Server 10.1.2.2 and 10.1.3.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, aka AS03.

  • CVE-2008-7233Sep 14, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the E-Business Application client, as used in Oracle Application Server 1.1.8.26 and E-Business Suite 11.5.10.2, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Oracle Jinitiator…

  • CVE-2008-7232Sep 14, 2009
    xtacacsd
    xtacacsd
    risk 0.05cvss —epss 0.25

    Buffer overflow in the report function in xtacacsd 4.1.2 and earlier allows remote attackers to execute arbitrary code via a crafted CONNECT TACACS command.

  • CVE-2008-7231Sep 14, 2009
    Meridio
    Document And Records Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Meridio Document and Records Management before 4.3 SR1 allows remote authenticated users to inject arbitrary web script or HTML via the Title field in a (1) document (subGeneralProps:dmpvDocTitle:PROP_W_title) or (2) container…

  • CVE-2008-7230Sep 14, 2009
    Small Footprint CIM Broker
    Small Footprint CIM Broker
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Small Footprint CIM Broker (SFCB) before 1.2.5 has unknown impact and attack vectors.

  • CVE-2008-7229Sep 14, 2009
    Greensql
    Greensql Firewall
    risk 0.00cvss —epss 0.01

    GreenSQL Firewall (greensql-fw) before 0.9.2 allows remote attackers to bypass SQL injection protection via a crafted string, possibly involving an encoded space character (%20).

  • CVE-2008-7228Sep 14, 2009
    White Dune
    White Dune
    risk 0.00cvss —epss 0.01

    Multiple format string vulnerabilities in White_Dune before 0.29beta851 have unspecified impact and attack vectors, a different vulnerability than CVE-2008-0101.

  • CVE-2008-7227Sep 14, 2009
    Geoserver
    Geoserver
    risk 0.00cvss —epss 0.01

    PartialBufferOutputStream2 in GeoServer before 1.6.1 and 1.7.0-beta1 attempts to flush buffer contents even when it is handling an "in memory buffer," which prevents the reporting of a service exception, with unknown impact and attack vectors.

  • CVE-2008-7226Sep 14, 2009
    PHP-Nuke
    Recipe Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Recipes module 1.3, 1.4, and possibly other versions for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the recipeid parameter.

  • CVE-2008-7225Sep 14, 2009
    Foxitsoftware
    WAC Server
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in Foxit Remote Access Server (aka WAC Server) 2.0 Build 3503 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long SSH packets, a different vulnerability than CVE-2008-0151.

  • CVE-2008-7224Sep 14, 2009
    Elinks
    Elinks
    risk 0.00cvss —epss 0.03

    Buffer overflow in entity_cache in ELinks before 0.11.4rc0 allows remote attackers to cause a denial of service (crash) via a crafted link.

  • CVE-2008-7223Sep 14, 2009
    Linpha
    Linpha
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.3 allow remote attackers to inject arbitrary web script or HTML via (1) ftp/index.php, (2) viewer.php, (3) functions/other.php, (4) include/left_menu.class.php, or (5) plugins/stats/stats_view.php.

  • CVE-2008-7222Sep 14, 2009
    Runcms
    Runcms
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in system/admin.php in RunCMS 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the rank_title parameter in a RankForumAdd action.

  • CVE-2008-7221Sep 14, 2009
    Runcms
    Runcms
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in RunCMS 1.6.1 allows remote attackers to hijack the authentication of administrators for requests that (1) add new administrators or (2) modify user profiles via a crafted request to system/admin.php.

  • CVE-2008-7220Sep 13, 2009
    Prototypejs
    Prototype
    risk 0.00cvss —epss 0.13

    Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests" via unknown vectors.