VYPR

CVEs

385,496 total · page 6946 of 7,710

AllCriticalHighKEV
  • CVE-2009-3083Sep 8, 2009
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.03

    The msn_slp_sip_recv function in libpurple/protocols/msn/slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an SLP invite message that lacks certain…

  • CVE-2009-3009Sep 8, 2009
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.

  • CVE-2009-2703Sep 8, 2009
    Pidgin (software)
    Pidgin
    risk 0.00cvss —epss 0.02

    libpurple/protocols/irc/msgs.c in the IRC protocol plugin in libpurple in Pidgin before 2.6.2 allows remote IRC servers to cause a denial of service (NULL pointer dereference and application crash) via a TOPIC message that lacks a topic string.

  • CVE-2009-2702Sep 8, 2009
    KDE
    Kdelibs
    risk 0.00cvss —epss 0.01

    KDE KSSL in kdelibs 3.5.4, 4.2.4, and 4.3 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a…

  • CVE-2009-2701Sep 8, 2009
    Zope
    Zodb
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or…

  • CVE-2009-2346Sep 8, 2009
    Asterisk
    Asterisk
    risk 0.00cvss —epss 0.03

    The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and C.3.x before C.3.1.1; and s800i 1.3.x before 1.3.0.3 allows…

  • CVE-2008-7182Sep 8, 2009
    Netwin
    Surgemail
    risk 0.05cvss —epss 0.24

    Buffer overflow in the IMAP service in NetWin Surgemail 3.9e, and possibly other versions before 3.9g2, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long first argument to the APPEND command, a different vector…

  • CVE-2008-7181Sep 8, 2009
    Butterfly Organizer
    Butterfly Organizer
    risk 0.03cvss —epss 0.02

    Butterfly Organizer 2.0.0 allows remote attackers to (1) delete arbitrary categories via a modified tablehere parameter to category-delete.php with the is_js_confirmed parameter set to 1, or (2) delete arbitrary accounts via the mytable parameter to delete.php.

  • CVE-2008-7180Sep 8, 2009
    Telephone
    Telephone Directory 2008
    risk 0.03cvss —epss 0.02

    del_query1.php in Telephone Directory 2008 allows remote attackers to delete arbitrary contacts via a direct request with a modified id variable.

  • CVE-2008-7179Sep 8, 2009
    Otmanager
    CMS
    risk 0.03cvss —epss 0.02

    OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMIN_Hora, ADMIN_Logado, and ADMIN_Nome cookies to certain values, as reachable in Admin/index.php.

  • CVE-2008-7178Sep 8, 2009
    XOOPS
    Uploader
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in Uploader module 1.1 for XOOPS allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a downloadfile action to index.php.

  • CVE-2008-7177Sep 8, 2009
    Nasm
    Netwide Assembler
    risk 0.00cvss —epss 0.02

    Buffer overflow in the listing module in Netwide Assembler (NASM) before 2.03.01 has unknown impact and attack vectors, a different vulnerability than CVE-2008-2719.

  • CVE-2008-7176Sep 8, 2009
    Facil CMS
    Facil CMS
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in Facil CMS 0.1RC allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) change_lang parameter to index.php or (2) modload parameter to modules.php.

  • CVE-2008-7175Sep 8, 2009
    WordPress
    Nextgen Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action.

  • CVE-2008-7174Sep 8, 2009
    Jura
    Internet Connection Kit
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in the Jura Internet Connection Kit for the Jura Impressa F90 coffee maker allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors related to improper use of the gets and sprintf functions.

  • CVE-2008-7173Sep 8, 2009
    Jura
    Internet Connection Kit
    risk 0.00cvss —epss 0.05

    The Jura Internet Connection Kit for the Jura Impressa F90 coffee maker does not properly restrict access to privileged functions, which allows remote attackers to cause a denial of service (physical damage), modify coffee settings, and possibly execute code via a crafted…

  • CVE-2008-7172Sep 8, 2009
    Lightweight news portal (LNP)
    Lightweight news portal (LNP)
    risk 0.03cvss —epss 0.02

    Lightweight news portal (LNP) 1.0b does not properly restrict access to administrator functionality, which allows remote attackers to gain administrator privileges via direct requests to admin.php with the (1) potd_delete, (2) potd, (3) vote_update, (4) vote, or (5) modifynews…

  • CVE-2008-7171Sep 8, 2009
    Lightweight news portal (LNP)
    Lightweight news portal (LNP)
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Lightweight news portal (LNP) 1.0b allow remote attackers to inject arbitrary web script or HTML via the (1) photo parameter to show_photo.php, (2) potd parameter to show_potd.php, or (3) the Current question field in a vote…

  • CVE-2008-7170Sep 8, 2009
    GSC
    GSC
    risk 0.04cvss —epss 0.10

    GSC build 2067 and earlier relies on the client to enforce administrator privileges, which allows remote attackers to execute arbitrary administrator commands via a crafted packet.

  • CVE-2008-7169Sep 8, 2009
    Joomla
    com_jabode
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Jabode horoscope extension (com_jabode) for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a sign task to index.php.

  • CVE-2008-7168Sep 8, 2009
    Uusee
    Uusee
    risk 0.03cvss —epss 0.06

    Insecure method vulnerability in the UUSee UUUpgrade ActiveX control (UUUpgrade.ocx 3.0.2.12) allows remote attackers to force the download and overwrite of arbitrary files via crafted arguments to the Update method, as exploited in the wild in June 2009.

  • CVE-2008-7167Sep 8, 2009
    Sami Ekblad
    Page Manager
    risk 0.03cvss —epss 0.04

    Unrestricted file upload vulnerability in upload.php in Page Manager 2006-02-04 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.

  • CVE-2009-3082Sep 4, 2009
    Snowhall
    Silurus System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in wcategory.php in Snow Hall Silurus System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2009-3081Sep 4, 2009
    Uiga
    Church Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Uiga Church Portal allows remote attackers to execute arbitrary SQL commands via the month parameter in a calendar action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2009-2946Sep 4, 2009
    Devscripts Devel Team
    Devscripts
    risk 0.00cvss —epss 0.03

    Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.

  • CVE-2009-2697Sep 4, 2009
    GNOME Foundation
    Gdm
    risk 0.00cvss —epss 0.02

    The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat Enterprise Linux (RHEL) 5 omits TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions via XDMCP connections, a different vulnerability than…

  • CVE-2009-3068Sep 4, 2009
    Adobe Inc.
    Robohelp
    risk 0.09cvss —epss 0.78

    Unrestricted file upload vulnerability in the RoboHelpServer Servlet (robohelp/server) in Adobe RoboHelp Server 8 allows remote attackers to execute arbitrary code by uploading a Java Archive (.jsp) file during a PUBLISH action, then accessing it via a direct request to the file…

  • CVE-2009-2521Sep 4, 2009
    Microsoft
    Internet Information Server
    risk 0.10cvss —epss 0.82

    Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service (daemon crash) via a list (ls) -R command containing a wildcard that references a subdirectory,…

  • CVE-2008-7166Sep 4, 2009
    Utorrent
    Utorrent
    risk 0.00cvss —epss 0.03

    Buffer overflow in the web interface in BitTorrent 6.0.1 (build 7859) and earlier, and uTorrent 1.7.6 (build 7859) and earlier, allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted Range header. NOTE: this is probably a different…

  • CVE-2008-7165Sep 4, 2009
    TELECOM ITALIA
    Alice Gate2 Plus Wi-Fi
    risk 0.03cvss —epss 0.01

    Cross-site request forgery in cp06_wifi_m_nocifr.cgi in the administrator panel in TELECOM ITALIA Alice Gate2 Plus Wi-Fi allows remote attackers to hijack the authentication of administrators for requests that disable Wi-Fi encryption via certain values for the wlChannel and…

  • CVE-2008-7164Sep 4, 2009
    Shareaza
    Shareaza
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Shareaza before 2.3.1.0 have unknown impact and attack vectors related to "very important security fixes," possibly involving update notifications and a domain that is no longer controlled by the vendor.

  • CVE-2008-7163Sep 4, 2009
    Sinecms
    Sinecms
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in mods/Integrated/index.php in SineCMS 2.3.5 and earlier, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the sine[config][index_main] parameter.

  • CVE-2008-7162Sep 4, 2009
    Hero
    Super Player 3000
    risk 0.03cvss —epss 0.06

    Buffer overflow in Hero Super Player 3000 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long filename in a .M3U file. NOTE: this might be related to CVE-2008-4504.

  • CVE-2008-7161Sep 4, 2009
    Fortinet
    Fortigate 1000
    risk 0.04cvss —epss 0.06

    Fortinet FortiGuard Fortinet FortiGate-1000 3.00 build 040075,070111 allows remote attackers to bypass URL filtering via fragmented GET or POST requests that use HTTP/1.0 without the Host header. NOTE: this issue might be related to CVE-2005-3058.

  • CVE-2009-3067Sep 3, 2009
    Webformatique
    Reservation Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Reservation Manager allows remote attackers to inject arbitrary web script or HTML via the resman_startdate parameter.

  • CVE-2009-3066Sep 3, 2009
    Propertywatchscript
    Property Watch
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in PropertyWatchScript.com Property Watch 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) videoid parameter to tools/email.php and (2) redirect parameter to tools/login.php.

  • CVE-2009-3065Sep 3, 2009
    Rein Velt
    Vedit
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in editor/edit_htmlarea.php in Ve-EDIT 0.1.4 allows remote attackers to execute arbitrary PHP code via a URL in the highlighter parameter.

  • CVE-2009-3064Sep 3, 2009
    Rein Velt
    Vedit
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in debugger/debug_php.php in Ve-EDIT 0.1.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _GET[filename] parameter.

  • CVE-2009-3063Sep 3, 2009
    Joomla
    Game Server
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Game Server (com_gameserver) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a gamepanel action to index.php.

  • CVE-2009-3062Sep 3, 2009
    PHP Live
    PHP Live
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in message_box.php in OSI Codes PHP Live! 3.3 allows remote attackers to execute arbitrary SQL commands via the deptid parameter.

  • CVE-2009-3061Sep 3, 2009
    Alqa6ari
    Script Q R
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in lesson.php in Alqatari Q R Script 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-3060Sep 3, 2009
    Joker Board
    JBoard
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Joker Board (aka JBoard) 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the notice parameter to editform.php, (2) the edit_user_message parameter to core/edit_user_message.php, or (3)…

  • CVE-2009-3059Sep 3, 2009
    Joker Board
    JBoard
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Joker Board (aka JBoard) 2.0 and earlier allow remote attackers to execute arbitrary SQL commands via (1) core/select.php or (2) the city parameter to top_add.inc.php, reachable through sboard.php.

  • CVE-2009-3058Sep 3, 2009
    AkPlayer
    akPlayer
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in akPlayer 1.9.0 allows remote attackers to execute arbitrary code via a long string in a .plt playlist file.

  • CVE-2009-3057Sep 3, 2009
    Aom Software
    Beex
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in AOM Software Beex 3 allow remote attackers to inject arbitrary web script or HTML via the navaction parameter to (1) news.php and (2) partneralle.php.

  • CVE-2009-3056Sep 3, 2009
    KingCMS
    KingCMS
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in include/engine/content/elements/menu.php in KingCMS 0.6.0 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[AdminPath] parameter.

  • CVE-2009-3055Sep 3, 2009
    DataLife Engine
    DataLife Engine
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in engine/api/api.class.php in DataLife Engine (DLE) 8.2 allows remote attackers to execute arbitrary PHP code via a URL in the dle_config_api parameter.

  • CVE-2009-3054Sep 3, 2009
    Artetics.com
    Art Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Artetics.com Art Portal (com_artportal) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the portalid parameter to index.php.

  • CVE-2009-3053Sep 3, 2009
    Jvitals
    Com Agora
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in the Agora (com_agora) component 3.0.0b for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action parameter to the avatars page, reachable through index.php.

  • CVE-2009-3052Sep 3, 2009
    Absoluteanime
    Prime Quick Style
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in root/includes/prime_quick_style.php in the Prime Quick Style addon before 1.2.3 for phpBB 3 allows remote authenticated users to execute arbitrary SQL commands via the prime_quick_style parameter to ucp.php.