VYPR

CVEs

385,496 total · page 6948 of 7,710

AllCriticalHighKEV
  • CVE-2009-3022MedAug 31, 2009
    Bingo CMS
    bingo!CMS
    risk 0.42cvss 6.5epss 0.01

    Cross-site request forgery (CSRF) vulnerability in bingo!CMS 1.2 and earlier allows remote attackers to hijack the authentication of other users for requests that modify configuration or change content via unspecified vectors.

  • CVE-2009-3021Aug 31, 2009
    Geeklog
    Geeklog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Site Calendar 'mycaljp' plugin 2.0.0 through 2.0.6, as used in the Japanese extended package of Geeklog 1.5.0 through 1.5.2 and when distributed 20090629 or earlier, allows remote attackers to inject arbitrary web script or HTML via…

  • CVE-2009-2944Aug 31, 2009
    Ikiwiki
    Ikiwiki
    risk 0.00cvss —epss 0.02

    Incomplete blacklist vulnerability in the teximg plugin in ikiwiki before 3.1415926 and 2.x before 2.53.4 allows context-dependent attackers to read arbitrary files via crafted TeX commands.

  • CVE-2009-3020Aug 31, 2009
    Microsoft
    Windows Server 2003
    risk 0.04cvss —epss 0.17

    win32k.sys in Microsoft Windows Server 2003 SP2 allows remote attackers to cause a denial of service (system crash) by referencing a crafted .eot file in the src descriptor of an @font-face Cascading Style Sheets (CSS) rule in an HTML document, possibly related to the Embedded…

  • CVE-2009-3019Aug 31, 2009
    Microsoft
    Internet Explorer
    risk 0.04cvss —epss 0.17

    Microsoft Internet Explorer 6 on Windows XP SP2 and SP3, and Internet Explorer 7 on Vista, allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls createElement to create an instance of the LI element, and then calls setAttribute…

  • CVE-2009-3018Aug 31, 2009
    Maxthon
    Maxthon Browser
    risk 0.00cvss —epss 0.01

    Maxthon Browser 3.0.0.145 Alpha with Ultramode does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains…

  • CVE-2009-3017Aug 31, 2009
    Orcabrowser
    Orca Browser
    risk 0.00cvss —epss 0.01

    Orca Browser 1.2 build 5 does not properly block data: URIs in Refresh and Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains JavaScript sequences in…

  • CVE-2009-3016Aug 31, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Apple Safari 4.0.3 does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains a javascript: URI, (2)…

  • CVE-2009-3015Aug 31, 2009
    Qtweb
    Qtweb
    risk 0.00cvss —epss 0.01

    QtWeb 3.0 Builds 001 and 003 does not properly block javascript: and data: URIs in Refresh and Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains a…

  • CVE-2009-3014Aug 31, 2009
    Mozilla Corporation
    Mozilla
    risk 0.00cvss —epss 0.01

    Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly handle javascript: URIs in HTML links within 302 error documents sent from web servers, which allows user-assisted remote attackers to conduct…

  • CVE-2009-3013Aug 31, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that contains…

  • CVE-2009-3012Aug 31, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that…

  • CVE-2009-3011Aug 31, 2009
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome 1.0.154.48 and earlier, 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta does not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh…

  • CVE-2009-3010Aug 31, 2009
    Seamonkey
    Seamonkey
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors…

  • CVE-2008-7131Aug 31, 2009
    Peter Kohlmann
    Db2 Monitoring Console
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier allows remote attackers to gain access to a database via a link to a victim who is already connected to the database.

  • CVE-2008-7130Aug 31, 2009
    Peter Kohlmann
    Db2 Monitoring Console
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier allows remote attackers to upload arbitrary files via unknown vectors.

  • CVE-2008-7129Aug 31, 2009
    Xyssl
    Xyssl
    risk 0.00cvss —epss 0.01

    XySSL before 0.9 allows remote attackers to cause a denial of service (infinite loop) via an X.509 certificate that does not pass the RSA signature check during verification.

  • CVE-2008-7128Aug 31, 2009
    Xyssl
    Xyssl
    risk 0.00cvss —epss 0.01

    The ssl_parse_client_key_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen ciphertext, which allows remote attackers to recover keys via unspecified vectors.

  • CVE-2008-7127Aug 31, 2009
    Microfocus
    Visibroker
    risk 0.00cvss —epss 0.02

    osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) via a crafted packet with a large string length value to UDP port 14000, which triggers a memory allocation failure that is not properly handled.

  • CVE-2008-7126Aug 31, 2009
    Microfocus
    Visibroker
    risk 0.04cvss —epss 0.10

    Integer overflow in osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet with a large string length value to UDP port 14000, which triggers a…

  • CVE-2008-7125Aug 31, 2009
    Ariadne
    Ariadne
    risk 0.00cvss —epss 0.02

    pphoto in Ariadne before 2.6 allows remote authenticated users with certain privileges to execute arbitrary shell commands via vectors related to PINP programs and the annotate command. NOTE: some of these details are obtained from third party information.

  • CVE-2008-7124Aug 31, 2009
    Zkup
    Zkup
    risk 0.04cvss —epss 0.09

    zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote attackers to gain administrator privileges via a direct request, as demonstrated by adding a new administrator.

  • CVE-2008-7123Aug 31, 2009
    Zkup
    Zkup
    risk 0.03cvss —epss 0.04

    Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attackers to inject arbitrary PHP code into fichiers/config.php via a null byte (%00) in the login parameter in an ajout action, which bypasses the regular…

  • CVE-2008-7122Aug 31, 2009
    Evansprogramming
    Registry Pro
    risk 0.00cvss —epss 0.03

    Multiple insecure method vulnerabilities in an ActiveX control in (epRegPro.ocx) in Evans Programming Registry Pro allow remote attackers to read and modify sensitive registry keys via the (1) About, (2) CreateKey, (3) DeleteBranch, (4) DeleteKey, (5) DeleteValue, (6) EnumKeys,…

  • CVE-2009-3008Aug 28, 2009
    Christophe Thibault
    K Meleon
    risk 0.00cvss —epss 0.01

    K-Meleon 1.5.3 allows context-dependent attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary file: URL after a victim has visited any file: URL, as demonstrated by a visit to a file: document written by the attacker.

  • CVE-2009-3007Aug 28, 2009
    Flock
    Flock
    risk 0.00cvss —epss 0.01

    Mozilla Firefox 3.5.1 and SeaMonkey 1.1.17, and Flock 2.5.1, allow context-dependent attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary file: URL after a victim has visited any file: URL, as demonstrated by a visit to a file: document…

  • CVE-2009-3006Aug 28, 2009
    Maxthon
    Maxthon Browser
    risk 0.00cvss —epss 0.01

    Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login…

  • CVE-2009-3005Aug 28, 2009
    Lunascape
    Lunascape
    risk 0.00cvss —epss 0.01

    Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for…

  • CVE-2009-3004Aug 28, 2009
    Avant Browser
    Browser
    risk 0.00cvss —epss 0.01

    Avant Browser 11.7 Builds 35 and 36 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed…

  • CVE-2009-3003Aug 28, 2009
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.11

    Microsoft Internet Explorer 6 through 8 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed…

  • CVE-2009-3002Aug 28, 2009
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read the contents of some kernel memory locations by calling getsockname on (1) an AF_APPLETALK socket, related to the atalk_getname function in…

  • CVE-2009-3001Aug 28, 2009
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel 2.6.31-rc7 and earlier does not initialize a certain data structure, which allows local users to read the contents of some kernel memory locations by calling getsockname on an AF_LLC socket.

  • CVE-2009-3000Aug 28, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.02

    The sockfs module in the kernel in Sun Solaris 10 and OpenSolaris snv_41 through snv_122, when Network Cache Accelerator (NCA) logging is enabled, allows remote attackers to cause a denial of service (panic) via unspecified web-server traffic that triggers a NULL pointer…

  • CVE-2009-2695Aug 28, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the…

  • CVE-2008-7121Aug 28, 2009
    Mrcgiguy
    Hot Links SQL PHP
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Mr. CGI Guy Hot Links SQL-PHP 3 and earlier allows remote attackers to inject arbitrary web script or HTML via the search bar.

  • CVE-2008-7120Aug 28, 2009
    Mrcgiguy
    Hot Links SQL PHP
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Mr. CGI Guy Hot Links SQL-PHP 3 and earlier allows remote attackers to execute arbitrary SQL commands via the news.php parameter.

  • CVE-2008-7119Aug 28, 2009
    Webidsupport
    Webid
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in item.php in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-7118Aug 28, 2009
    Webidsupport
    Webid
    risk 0.03cvss —epss 0.02

    WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain SQL query logs via a direct request for logs/cron.log.

  • CVE-2008-7117Aug 28, 2009
    Webidsupport
    Webid
    risk 0.03cvss —epss 0.02

    eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets (CSS) files via a certain request with the file parameter set to style.css. NOTE: this can probably be leveraged for cross-site scripting (XSS) attacks.

  • CVE-2008-7116Aug 28, 2009
    Webidsupport
    Webid
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the admin panel (admin/) in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the username.

  • CVE-2008-7115Aug 28, 2009
    Belkin
    Wireless G Router
    risk 0.03cvss —epss 0.04

    The web interface to the Belkin Wireless G router and ADSL2 modem F5D7632-4V6 with firmware 6.01.08 allows remote attackers to bypass authentication and gain administrator privileges via a direct request to (1) statusprocess.exe, (2) system_all.exe, or (3) restore.exe in…

  • CVE-2008-7114Aug 28, 2009
    Ifusionservices
    Ifdate
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in members_search.php in iFusion Services iFdate 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the name field.

  • CVE-2008-7113Aug 28, 2009
    Kyoceramita
    Scanner File Utility
    risk 0.00cvss —epss 0.01

    The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 uses a small space of predictable user identification numbers for access control, which allows remote attackers to upload documents via a brute force attack.

  • CVE-2008-7112Aug 28, 2009
    Kyoceramita
    Scanner File Utility
    risk 0.00cvss —epss 0.01

    The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote attackers to cause a denial of service (hang or crash) via invalid field length values in a malformed (1) document or (2) request.

  • CVE-2008-7111Aug 28, 2009
    Kyoceramita
    Scanner File Utility
    risk 0.00cvss —epss 0.03

    The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 does not restrict the filenames or extensions of uploaded files, which makes it easier for remote attackers to execute arbitrary code or overwrite files by leveraging CVE-2008-7110 and CVE-2008-7109.

  • CVE-2008-7110Aug 28, 2009
    Kyoceramita
    Scanner File Utility
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in the Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote attackers to upload files to arbitrary locations via a .. (dot dot) in a request.

  • CVE-2008-7109CriAug 28, 2009
    Kyoceramita
    Scanner File Utility
    risk 0.64cvss 9.8epss 0.04

    The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote attackers to bypass authorization and upload arbitrary files to the client system via a modified program that does not prompt the user for a password.

  • CVE-2008-7108Aug 28, 2009
    Phpcart
    Phpcart
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Carmosa phpCart 3.4 through 4.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) quantity or (2) Add Engraving fields to the default URI; (3) Quantity field to phpcart.php; (4) Name, (5) Company,…

  • CVE-2008-7107Aug 28, 2009
    Eset
    Smart Security
    risk 0.03cvss —epss 0.01

    easdrv.sys in ESET Smart Security 3.0.667.0 allows local users to cause a denial of service (crash) via a crafted IOCTL 0x222003 request to the \\.\easdrv device interface.

  • CVE-2008-7106Aug 27, 2009
    Sophos
    Puremessage For Microsoft Exchange
    risk 0.00cvss —epss 0.03

    The installation of Sophos PureMessage for Microsoft Exchange 3.0 before 3.0.2, when both anti-virus and anti-spam are supported, does not create or launch the associated scan engines when the system is under heavy load, which has unspecified impact, probably remote bypass of…