CVEs

385,503 total · page 6943 of 7,711

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2008-7219	Horde (software) Groupware		0.00	—	0.03	Sep 13, 2009	Horde Kronolith H3 2.1 before 2.1.7 and 2.2 before 2.2-RC2; Nag H3 2.1 before 2.1.4 and 2.2 before 2.2-RC2; Mnemo H3 2.1 before 2.1.2 and H3 2.2 before 2.2-RC2; Groupware 1.0 before 1.0.3 and 1.1 before 1.1-RC2; and Groupware Webmail Edition 1.0 before 1.0.4 and 1.1 before…
CVE-2008-7218	Horde (software) Horde		0.00	—	0.02	Sep 13, 2009	Unspecified vulnerability in the Horde API in Horde 3.1 before 3.1.6 and 3.2 before 3.2 before 3.2-RC2; Turba H3 2.1 before 2.1.6 and 2.2 before 2.2-RC2; Kronolith H3 2.1 before 2.1.7 and H3 2.2 before 2.2-RC2; Nag H3 2.1 before 2.1.4 and 2.2 before 2.2-RC2; Mnemo H3 2.1 before…
CVE-2008-7217	Microsoft Office		0.00	—	0.01	Sep 13, 2009	Microsoft Office 2008 for Mac, when running on Macintosh systems that restrict Office access to administrators, does not enforce this restriction for user ID 502, which allows local users with that ID to bypass intended security policy and access Office programs, related to…
CVE-2007-6732	Extended Module Player Extended Module Player		0.00	—	0.06	Sep 13, 2009	Multiple buffer overflows in the dtt_load function in loaders/dtt_load.c Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via unspecified vectors related to an untrusted length value and the (1) pofs and (2) plen arrays.
CVE-2007-6731	Extended Module Player Extended Module Player		0.04	—	0.14	Sep 13, 2009	Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via an OXM file with a negative value, which bypasses a check in (1) test_oxm and (2) decrunch_oxm functions in misc/oxm.c, leading to a buffer overflow.
CVE-2009-3182	Anantasoft Gazelle CMS		0.03	—	0.03	Sep 11, 2009	Unrestricted file upload vulnerability in admin/editor/filemanager/browser.html in Anantasoft Gazelle CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in user/File/.
CVE-2009-3181	Anantasoft Gazelle CMS		0.03	—	0.02	Sep 11, 2009	Directory traversal vulnerability in Anantasoft Gazelle CMS 1.0 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the customizetemplate parameter in a direct request to admin/settemplate.php.
CVE-2009-3180	Anantasoft Gazelle CMS		0.03	—	0.02	Sep 11, 2009	Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user parameter to renew.php.
CVE-2009-3179	Symantec Deployment Solution		0.00	—	0.05	Sep 11, 2009	Multiple unspecified vulnerabilities in Symantec Altiris Deployment Solution 6.9 might allow remote attackers to execute arbitrary code via unknown client-side attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.17, as identified by (1) "Symantec…
CVE-2009-3178	Symantec Deployment Solution		0.00	—	0.03	Sep 11, 2009	Unspecified vulnerability in mm.exe in Symantec Altiris Deployment Solution 6.9 allows remote attackers to cause a denial of service via unknown attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.18, "Symantec Altiris Deployment Solution 6.9…
CVE-2009-3177	Kaspersky Lab Online Scanner		0.00	—	0.02	Sep 11, 2009	Unspecified vulnerability in Kaspersky Online Scanner 7.0 has unknown impact and attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.8, (1) "Kaspersky Online Antivirus Scanner 7.0 exploit (Linux)" and (2) "Kaspersky Online Antivirus Scanner 7.0…
CVE-2009-3176	Novell Iprint		0.00	—	0.04	Sep 11, 2009	Buffer overflow in the ActiveX control in Novell iPrint Client 4.38 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.1, "Novell iPrint…
CVE-2009-3175	Boldfx Model Agency Manager Pro		0.03	—	0.01	Sep 11, 2009	Multiple SQL injection vulnerabilities in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allow remote attackers to execute arbitrary SQL commands via the user_id parameter to (1) view.php, (2) photos.php, and (3) motm.php; and the (4) id parameter…
CVE-2009-3174	Odelao Obophix		0.03	—	0.02	Sep 11, 2009	PHP remote file inclusion vulnerability in fonctions_racine.php in OBOphiX 2.7.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the chemin_lib parameter.
CVE-2009-3173	The Rat CMS The Rat CMS		0.03	—	0.03	Sep 11, 2009	Unrestricted file upload vulnerability in admin/add_album.php in The Rat CMS Alpha 2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/.
CVE-2009-3172	Hitachi Groupmax Groupware Server		0.00	—	0.01	Sep 11, 2009	Unspecified vulnerability in Hitachi Groupmax Groupware Server 07-00 through 07-50-/A, Groupmax Server Set 03-00 through 06-52, Groupware Server Set 03-00 through 06-52, and Scheduler Server Set 03-00 through 06-52 has unknown impact and attack vectors related to invalid access…
CVE-2009-3171	Anantasoft Gazelle CMS		0.03	—	0.02	Sep 11, 2009	Multiple cross-site scripting (XSS) vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user parameter to user.php or (2) lookup parameter to search.php.
CVE-2009-3170	Aimp Aimp2 Audio Converter		0.04	—	0.15	Sep 11, 2009	Stack-based buffer overflow in AIMP2 Audio Converter 2.53 (build 330) and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long File1 argument in a (1) .pls or (2) .m3u playlist file.
CVE-2009-3169	Hitachi Jp1 File Transmission Server		0.00	—	0.04	Sep 11, 2009	Multiple unspecified vulnerabilities in Hitachi JP1/File Transmission Server/FTP before 09-00 allow remote attackers to execute arbitrary code via unknown attack vectors.
CVE-2009-3168	Mevin Basic PHP Events Lister	Hig	0.47	7.2	0.03	Sep 11, 2009	Mevin Productions Basic PHP Events Lister 2.0 does not properly restrict access to (1) admin/reset.php and (2) admin/user_add.php, which allows remote authenticated users to reset administrative passwords or add administrators via a direct request.
CVE-2009-3167	Anantasoft Gazelle CMS		0.03	—	0.02	Sep 11, 2009	Directory traversal vulnerability in index.php in Anantasoft Gazelle CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter.
CVE-2009-2800	Apple Inc. Mac OS X		0.00	—	0.03	Sep 11, 2009	Buffer overflow in Alias Manager in Apple Mac OS X 10.4.11 and 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted alias file.
CVE-2008-7216	WordPress Peter's Math Anti-Spam Spinoff		0.03	—	0.06	Sep 11, 2009	Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortion, which allows remote attackers to bypass CAPTCHA protection by reading certain bytes from the generated clip.
CVE-2008-7215	Mambo (software) Mambo		0.00	—	0.02	Sep 11, 2009	The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified file[NewFile][name], file[NewFile][tmp_name], and file[NewFile][size] parameters in a FileUpload command,…
CVE-2008-7214	Mambo (software) Mambo		0.00	—	0.01	Sep 11, 2009	Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a…
CVE-2008-7213	Mambo (software) Mambo		0.03	—	0.02	Sep 11, 2009	Cross-site scripting (XSS) vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to inject arbitrary web script or HTML via the Command parameter.
CVE-2008-7212	Mambo (software) Mambo		0.00	—	0.02	Sep 11, 2009	MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message.
CVE-2008-7211	CreativeLabs es1371mp.sys		0.03	—	0.01	Sep 11, 2009	CreativeLabs es1371mp.sys 5.1.3612.0 WDM audio driver, as used in Ensoniq PCI 1371 sound cards and when running on Windows Vista, does not create a Functional Device Object (FDO) to prevent user-moade access to the Physical Device Object (PDO), which allows local users to gain…
CVE-2008-7210	AJchat AJchat		0.03	—	0.01	Sep 11, 2009	directory.php in AJchat 0.10 allows remote attackers to bypass input validation and conduct SQL injection attacks via a numeric parameter with a value matching the s parameter's hash value, which prevents the associated $_GET["s"] variable from being unset. NOTE: it could be…
CVE-2008-7209	OneCMS OneCMS		0.03	—	0.06	Sep 11, 2009	Unrestricted file upload vulnerability in the add2 action in a_upload.php in OneCMS 2.4, and possibly earlier, allows remote attackers to execute arbitrary code by uploading a file with an executable extension and using a safe content type such as image/gif, then accessing it…
CVE-2008-7208	OneCMS OneCMS		0.03	—	0.02	Sep 11, 2009	Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username parameter ($usernameb variable) to a_login.php or (2) user parameter to staff.php.
CVE-2008-7207	RivetTracker RivetTracker		0.00	—	0.00	Sep 11, 2009	RivetTracker before 1.0 stores passwords in cleartext in config.php, which allows local users to discover passwords by reading config.php.
CVE-2008-7206	Electronic Logbook Electronic Logbook		0.00	—	0.01	Sep 11, 2009	Unspecified vulnerability in Electronic Logbook (ELOG) before 2.7.2 has unknown impact and attack vectors when the "logbook contains HTML code," probably cross-site scripting (XSS).
CVE-2008-7205	Virtuemart Virtuemart		0.00	—	0.01	Sep 11, 2009	Unspecified vulnerability in the product view functionality in VirtueMart 1.0.13a and earlier allows remote attackers to read arbitrary files via vectors related to a template file.
CVE-2008-7204	Virtuemart Virtuemart		0.00	—	0.01	Sep 11, 2009	Cross-site request forgery (CSRF) vulnerability in VirtueMart 1.0.13a and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVE-2008-7203	Valve Software Half-Life Counter-Strike 1.6		0.03	—	0.03	Sep 11, 2009	Valve Software Half-Life Counter-Strike 1.6 allows remote attackers to cause a denial of service (crash) via multiple crafted login packets.
CVE-2009-3164	Sun Corporation Solaris		0.00	—	0.02	Sep 10, 2009	Unspecified vulnerability in the IPv6 networking stack in Sun Solaris 10, and OpenSolaris snv_01 through snv_82 and snv_111 through snv_122, when a Cassini GigaSwift Ethernet Adapter (aka CE) interface is used, allows remote attackers to cause a denial of service (panic) via…
CVE-2009-3163	Silc Silc Client		0.00	—	0.05	Sep 10, 2009	Multiple format string vulnerabilities in lib/silcclient/command.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, and SILC Client 1.1.8 and earlier, allow remote attackers to execute arbitrary code via format string specifiers in a channel name, related to…
CVE-2009-3079	Mozilla Corporation Firefox		0.00	—	0.04	Sep 10, 2009	Unspecified vulnerability in Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, allows remote attackers to execute arbitrary JavaScript with chrome privileges via vectors involving an object, the FeedWriter, and the BrowserFeedWriter.
CVE-2009-3078	Mozilla Corporation Firefox		0.00	—	0.02	Sep 10, 2009	Visual truncation vulnerability in Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, allows remote attackers to trigger a vertical scroll and spoof URLs via unspecified Unicode characters with a tall line-height property.
CVE-2009-3077	Mozilla Corporation Firefox		0.00	—	0.05	Sep 10, 2009	Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, does not properly manage pointers for the columns (aka TreeColumns) of a XUL tree element, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to a "dangling pointer vulnerability."
CVE-2009-3076	Mozilla Corporation Firefox		0.04	—	0.07	Sep 10, 2009	Mozilla Firefox before 3.0.14 does not properly implement certain dialogs associated with the (1) pkcs11.addmodule and (2) pkcs11.deletemodule operations, which makes it easier for remote attackers to trick a user into installing or removing an arbitrary PKCS11 module.
CVE-2009-3075	Mozilla Corporation Firefox		0.00	—	0.05	Sep 10, 2009	Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 3.0.14 and 3.5.x before 3.5.2, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or…
CVE-2009-3074	Mozilla Corporation Firefox		0.00	—	0.05	Sep 10, 2009	Unspecified vulnerability in the JavaScript engine in Mozilla Firefox before 3.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2009-3073	Mozilla Corporation Firefox		0.00	—	0.05	Sep 10, 2009	Unspecified vulnerability in the JavaScript engine in Mozilla Firefox 3.5.x before 3.5.3 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2009-3072	Mozilla Corporation Firefox		0.00	—	0.05	Sep 10, 2009	Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14 and 3.5.x before 3.5.3, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly…
CVE-2009-3071	Mozilla Corporation Firefox		0.00	—	0.05	Sep 10, 2009	Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.2, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2009-3070	Mozilla Corporation Firefox		0.00	—	0.05	Sep 10, 2009	Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2009-3069	Mozilla Corporation Firefox		0.00	—	0.04	Sep 10, 2009	Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.3 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2009-2815	Apple Inc. Iphone OS		0.00	—	0.02	Sep 10, 2009	The Telephony component in Apple iPhone OS before 3.1 does not properly handle SMS arrival notifications, which allows remote attackers to cause a denial of service (NULL pointer dereference and service interruption) via a crafted SMS message.

CVE-2008-7219Sep 13, 2009
Horde (software)
Groupware
risk 0.00cvss —epss 0.03
Horde Kronolith H3 2.1 before 2.1.7 and 2.2 before 2.2-RC2; Nag H3 2.1 before 2.1.4 and 2.2 before 2.2-RC2; Mnemo H3 2.1 before 2.1.2 and H3 2.2 before 2.2-RC2; Groupware 1.0 before 1.0.3 and 1.1 before 1.1-RC2; and Groupware Webmail Edition 1.0 before 1.0.4 and 1.1 before…
CVE-2008-7218Sep 13, 2009
Horde (software)
Horde
risk 0.00cvss —epss 0.02
Unspecified vulnerability in the Horde API in Horde 3.1 before 3.1.6 and 3.2 before 3.2 before 3.2-RC2; Turba H3 2.1 before 2.1.6 and 2.2 before 2.2-RC2; Kronolith H3 2.1 before 2.1.7 and H3 2.2 before 2.2-RC2; Nag H3 2.1 before 2.1.4 and 2.2 before 2.2-RC2; Mnemo H3 2.1 before…
CVE-2008-7217Sep 13, 2009
Microsoft
Office
risk 0.00cvss —epss 0.01
Microsoft Office 2008 for Mac, when running on Macintosh systems that restrict Office access to administrators, does not enforce this restriction for user ID 502, which allows local users with that ID to bypass intended security policy and access Office programs, related to…
CVE-2007-6732Sep 13, 2009
Extended Module Player
Extended Module Player
risk 0.00cvss —epss 0.06
Multiple buffer overflows in the dtt_load function in loaders/dtt_load.c Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via unspecified vectors related to an untrusted length value and the (1) pofs and (2) plen arrays.
CVE-2007-6731Sep 13, 2009
Extended Module Player
Extended Module Player
risk 0.04cvss —epss 0.14
Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via an OXM file with a negative value, which bypasses a check in (1) test_oxm and (2) decrunch_oxm functions in misc/oxm.c, leading to a buffer overflow.
CVE-2009-3182Sep 11, 2009
Anantasoft
Gazelle CMS
risk 0.03cvss —epss 0.03
Unrestricted file upload vulnerability in admin/editor/filemanager/browser.html in Anantasoft Gazelle CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in user/File/.
CVE-2009-3181Sep 11, 2009
Anantasoft
Gazelle CMS
risk 0.03cvss —epss 0.02
Directory traversal vulnerability in Anantasoft Gazelle CMS 1.0 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the customizetemplate parameter in a direct request to admin/settemplate.php.
CVE-2009-3180Sep 11, 2009
Anantasoft
Gazelle CMS
risk 0.03cvss —epss 0.02
Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user parameter to renew.php.
CVE-2009-3179Sep 11, 2009
Symantec
Deployment Solution
risk 0.00cvss —epss 0.05
Multiple unspecified vulnerabilities in Symantec Altiris Deployment Solution 6.9 might allow remote attackers to execute arbitrary code via unknown client-side attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.17, as identified by (1) "Symantec…
CVE-2009-3178Sep 11, 2009
Symantec
Deployment Solution
risk 0.00cvss —epss 0.03
Unspecified vulnerability in mm.exe in Symantec Altiris Deployment Solution 6.9 allows remote attackers to cause a denial of service via unknown attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.18, "Symantec Altiris Deployment Solution 6.9…
CVE-2009-3177Sep 11, 2009
Kaspersky Lab
Online Scanner
risk 0.00cvss —epss 0.02
Unspecified vulnerability in Kaspersky Online Scanner 7.0 has unknown impact and attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.8, (1) "Kaspersky Online Antivirus Scanner 7.0 exploit (Linux)" and (2) "Kaspersky Online Antivirus Scanner 7.0…
CVE-2009-3176Sep 11, 2009
Novell
Iprint
risk 0.00cvss —epss 0.04
Buffer overflow in the ActiveX control in Novell iPrint Client 4.38 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.1, "Novell iPrint…
CVE-2009-3175Sep 11, 2009
Boldfx
Model Agency Manager Pro
risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allow remote attackers to execute arbitrary SQL commands via the user_id parameter to (1) view.php, (2) photos.php, and (3) motm.php; and the (4) id parameter…
CVE-2009-3174Sep 11, 2009
Odelao
Obophix
risk 0.03cvss —epss 0.02
PHP remote file inclusion vulnerability in fonctions_racine.php in OBOphiX 2.7.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the chemin_lib parameter.
CVE-2009-3173Sep 11, 2009
The Rat CMS
The Rat CMS
risk 0.03cvss —epss 0.03
Unrestricted file upload vulnerability in admin/add_album.php in The Rat CMS Alpha 2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/.
CVE-2009-3172Sep 11, 2009
Hitachi
Groupmax Groupware Server
risk 0.00cvss —epss 0.01
Unspecified vulnerability in Hitachi Groupmax Groupware Server 07-00 through 07-50-/A, Groupmax Server Set 03-00 through 06-52, Groupware Server Set 03-00 through 06-52, and Scheduler Server Set 03-00 through 06-52 has unknown impact and attack vectors related to invalid access…
CVE-2009-3171Sep 11, 2009
Anantasoft
Gazelle CMS
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user parameter to user.php or (2) lookup parameter to search.php.
CVE-2009-3170Sep 11, 2009
Aimp
Aimp2 Audio Converter
risk 0.04cvss —epss 0.15
Stack-based buffer overflow in AIMP2 Audio Converter 2.53 (build 330) and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long File1 argument in a (1) .pls or (2) .m3u playlist file.
CVE-2009-3169Sep 11, 2009
Hitachi
Jp1 File Transmission Server
risk 0.00cvss —epss 0.04
Multiple unspecified vulnerabilities in Hitachi JP1/File Transmission Server/FTP before 09-00 allow remote attackers to execute arbitrary code via unknown attack vectors.
CVE-2009-3168HigSep 11, 2009
Mevin
Basic PHP Events Lister
risk 0.47cvss 7.2epss 0.03
Mevin Productions Basic PHP Events Lister 2.0 does not properly restrict access to (1) admin/reset.php and (2) admin/user_add.php, which allows remote authenticated users to reset administrative passwords or add administrators via a direct request.
CVE-2009-3167Sep 11, 2009
Anantasoft
Gazelle CMS
risk 0.03cvss —epss 0.02
Directory traversal vulnerability in index.php in Anantasoft Gazelle CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter.
CVE-2009-2800Sep 11, 2009
Apple Inc.
Mac OS X
risk 0.00cvss —epss 0.03
Buffer overflow in Alias Manager in Apple Mac OS X 10.4.11 and 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted alias file.
CVE-2008-7216Sep 11, 2009
WordPress
Peter's Math Anti-Spam Spinoff
risk 0.03cvss —epss 0.06
Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortion, which allows remote attackers to bypass CAPTCHA protection by reading certain bytes from the generated clip.
CVE-2008-7215Sep 11, 2009
Mambo (software)
Mambo
risk 0.00cvss —epss 0.02
The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified file[NewFile][name], file[NewFile][tmp_name], and file[NewFile][size] parameters in a FileUpload command,…
CVE-2008-7214Sep 11, 2009
Mambo (software)
Mambo
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a…
CVE-2008-7213Sep 11, 2009
Mambo (software)
Mambo
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to inject arbitrary web script or HTML via the Command parameter.
CVE-2008-7212Sep 11, 2009
Mambo (software)
Mambo
risk 0.00cvss —epss 0.02
MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message.
CVE-2008-7211Sep 11, 2009
CreativeLabs
es1371mp.sys
risk 0.03cvss —epss 0.01
CreativeLabs es1371mp.sys 5.1.3612.0 WDM audio driver, as used in Ensoniq PCI 1371 sound cards and when running on Windows Vista, does not create a Functional Device Object (FDO) to prevent user-moade access to the Physical Device Object (PDO), which allows local users to gain…
CVE-2008-7210Sep 11, 2009
AJchat
AJchat
risk 0.03cvss —epss 0.01
directory.php in AJchat 0.10 allows remote attackers to bypass input validation and conduct SQL injection attacks via a numeric parameter with a value matching the s parameter's hash value, which prevents the associated $_GET["s"] variable from being unset. NOTE: it could be…
CVE-2008-7209Sep 11, 2009
OneCMS
OneCMS
risk 0.03cvss —epss 0.06
Unrestricted file upload vulnerability in the add2 action in a_upload.php in OneCMS 2.4, and possibly earlier, allows remote attackers to execute arbitrary code by uploading a file with an executable extension and using a safe content type such as image/gif, then accessing it…
CVE-2008-7208Sep 11, 2009
OneCMS
OneCMS
risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username parameter ($usernameb variable) to a_login.php or (2) user parameter to staff.php.
CVE-2008-7207Sep 11, 2009
RivetTracker
RivetTracker
risk 0.00cvss —epss 0.00
RivetTracker before 1.0 stores passwords in cleartext in config.php, which allows local users to discover passwords by reading config.php.
CVE-2008-7206Sep 11, 2009
Electronic Logbook
Electronic Logbook
risk 0.00cvss —epss 0.01
Unspecified vulnerability in Electronic Logbook (ELOG) before 2.7.2 has unknown impact and attack vectors when the "logbook contains HTML code," probably cross-site scripting (XSS).
CVE-2008-7205Sep 11, 2009
Virtuemart
Virtuemart
risk 0.00cvss —epss 0.01
Unspecified vulnerability in the product view functionality in VirtueMart 1.0.13a and earlier allows remote attackers to read arbitrary files via vectors related to a template file.
CVE-2008-7204Sep 11, 2009
Virtuemart
Virtuemart
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in VirtueMart 1.0.13a and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVE-2008-7203Sep 11, 2009
Valve Software
Half-Life Counter-Strike 1.6
risk 0.03cvss —epss 0.03
Valve Software Half-Life Counter-Strike 1.6 allows remote attackers to cause a denial of service (crash) via multiple crafted login packets.
CVE-2009-3164Sep 10, 2009
Sun Corporation
Solaris
risk 0.00cvss —epss 0.02
Unspecified vulnerability in the IPv6 networking stack in Sun Solaris 10, and OpenSolaris snv_01 through snv_82 and snv_111 through snv_122, when a Cassini GigaSwift Ethernet Adapter (aka CE) interface is used, allows remote attackers to cause a denial of service (panic) via…
CVE-2009-3163Sep 10, 2009
Silc
Silc Client
risk 0.00cvss —epss 0.05
Multiple format string vulnerabilities in lib/silcclient/command.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, and SILC Client 1.1.8 and earlier, allow remote attackers to execute arbitrary code via format string specifiers in a channel name, related to…
CVE-2009-3079Sep 10, 2009
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.04
Unspecified vulnerability in Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, allows remote attackers to execute arbitrary JavaScript with chrome privileges via vectors involving an object, the FeedWriter, and the BrowserFeedWriter.
CVE-2009-3078Sep 10, 2009
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.02
Visual truncation vulnerability in Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, allows remote attackers to trigger a vertical scroll and spoof URLs via unspecified Unicode characters with a tall line-height property.
CVE-2009-3077Sep 10, 2009
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.05
Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, does not properly manage pointers for the columns (aka TreeColumns) of a XUL tree element, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to a "dangling pointer vulnerability."
CVE-2009-3076Sep 10, 2009
Mozilla Corporation
Firefox
risk 0.04cvss —epss 0.07
Mozilla Firefox before 3.0.14 does not properly implement certain dialogs associated with the (1) pkcs11.addmodule and (2) pkcs11.deletemodule operations, which makes it easier for remote attackers to trick a user into installing or removing an arbitrary PKCS11 module.
CVE-2009-3075Sep 10, 2009
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.05
Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 3.0.14 and 3.5.x before 3.5.2, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or…
CVE-2009-3074Sep 10, 2009
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.05
Unspecified vulnerability in the JavaScript engine in Mozilla Firefox before 3.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2009-3073Sep 10, 2009
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.05
Unspecified vulnerability in the JavaScript engine in Mozilla Firefox 3.5.x before 3.5.3 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2009-3072Sep 10, 2009
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.05
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14 and 3.5.x before 3.5.3, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly…
CVE-2009-3071Sep 10, 2009
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.05
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.2, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2009-3070Sep 10, 2009
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.05
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2009-3069Sep 10, 2009
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.04
Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.3 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2009-2815Sep 10, 2009
Apple Inc.
Iphone OS
risk 0.00cvss —epss 0.02
The Telephony component in Apple iPhone OS before 3.1 does not properly handle SMS arrival notifications, which allows remote attackers to cause a denial of service (NULL pointer dereference and service interruption) via a crafted SMS message.