VYPR

CVEs

385,489 total · page 6952 of 7,710

AllCriticalHighKEV
  • CVE-2009-2890Aug 20, 2009
    Phpscriptsnow
    Riddles
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in results.php in PHP Scripts Now Riddles allows remote attackers to inject arbitrary web script or HTML via the searchquery parameter.

  • CVE-2009-2889Aug 20, 2009
    Phpscriptsnow
    Hangman
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in PHP Scripts Now Hangman allows remote attackers to inject arbitrary web script or HTML via the letters parameter.

  • CVE-2009-2888Aug 20, 2009
    Phpscriptsnow
    Hangman
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in PHP Scripts Now Hangman allows remote attackers to execute arbitrary SQL commands via the n parameter.

  • CVE-2009-2887Aug 20, 2009
    Phpscriptsnow
    President BIOS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in bios.php in PHP Scripts Now President Bios allows remote attackers to inject arbitrary web script or HTML via the rank parameter.

  • CVE-2009-2886Aug 20, 2009
    Phpscriptsnow
    President BIOS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in bios.php in PHP Scripts Now President Bios allows remote attackers to execute arbitrary SQL commands via the rank parameter.

  • CVE-2009-2885Aug 20, 2009
    Phpscriptsnow
    World\'s Tallest Buildings
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in bios.php in PHP Scripts Now World's Tallest Buildings allows remote attackers to execute arbitrary SQL commands via the rank parameter.

  • CVE-2009-2884Aug 20, 2009
    Phpscriptsnow
    World\'s Tallest Buildings
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in bios.php in PHP Scripts Now World's Tallest Buildings allows remote attackers to inject arbitrary web script or HTML via the rank parameter.

  • CVE-2009-2883Aug 20, 2009
    Saphplesson
    Saphplesson
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/login.php in SaphpLesson 4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cp_username parameter, related to an error in the CleanVar function in includes/functions.php.

  • CVE-2009-2882Aug 20, 2009
    Datingpro
    Matchmaking
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in PG MatchMaking allow remote attackers to inject arbitrary web script or HTML via the show parameter to (1) browse_ladies.php and (2) browse_men.php, the (3) gender parameter to search.php, and the (4) id parameter to…

  • CVE-2009-2881Aug 20, 2009
    Artis.imag
    Basilic
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Basilic 1.5.13 allow remote attackers to execute arbitrary SQL commands via the idAuthor parameter to (1) index.php and possibly (2) allpubs.php in publications/.

  • CVE-2009-2860Aug 19, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in db2jds in IBM DB2 8.1 before FP18 allows remote attackers to cause a denial of service (service crash) via "malicious packets."

  • CVE-2009-2859Aug 19, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.00

    IBM DB2 8.1 before FP18 allows attackers to obtain unspecified access via a das command.

  • CVE-2009-2858Aug 19, 2009
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    Memory leak in the Security component in IBM DB2 8.1 before FP18 on Unix platforms allows attackers to cause a denial of service (memory consumption) via unspecified vectors, related to private memory within the DB2 memory structure.

  • CVE-2009-2857MedAug 19, 2009
    Sun Corporation
    Solaris
    risk 0.36cvss 5.5epss 0.00

    The kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_103, does not properly handle interaction between the filesystem and virtual-memory implementations, which allows local users to cause a denial of service (deadlock and system halt) via vectors involving mmap and…

  • CVE-2009-2740Aug 19, 2009
    Ca
    Host Based Intrusion Prevention System
    risk 0.00cvss —epss 0.02

    kmxIds.sys before 7.3.1.18 in CA Host-Based Intrusion Prevention System (HIPS) 8.1 allows remote attackers to cause a denial of service (system crash) via a malformed packet.

  • CVE-2009-2627Aug 19, 2009
    Acer
    Lunchapp.aplunch
    risk 0.00cvss —epss 0.05

    Insecure method vulnerability in the Acer LunchApp (aka AcerCtrls.APlunch) ActiveX control in acerctrl.ocx allows remote attackers to execute arbitrary commands via the Run method, a different vulnerability than CVE-2006-6121.

  • CVE-2009-2055MedKEVAug 19, 2009
    Cisco Systems, Inc.
    iOS Xr
    risk 0.51cvss 5.9epss 0.03

    Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.

  • CVE-2009-1884Aug 19, 2009
    Perl Foundation
    Compress-Raw-Bzip2
    risk 0.00cvss —epss 0.03

    Off-by-one error in the bzinflate function in Bzip2.xs in the Compress-Raw-Bzip2 module before 2.018 for Perl allows context-dependent attackers to cause a denial of service (application hang or crash) via a crafted bzip2 compressed stream that triggers a buffer overflow, a…

  • CVE-2009-0682Aug 19, 2009
    Ca
    Internet Security Suite Plus 2008
    risk 0.00cvss —epss 0.00

    vetmonnt.sys in CA Internet Security Suite r3, vetmonnt.sys before 9.0.0.184 in Internet Security Suite r4, and vetmonnt.sys before 10.0.0.217 in Internet Security Suite r5 do not properly verify IOCTL calls, which allows local users to cause a denial of service (system crash)…

  • CVE-2008-7015Aug 19, 2009
    Frontlines: Fuel of War
    Fuel Of War
    risk 0.03cvss —epss 0.03

    Unreal engine 3, as used in Unreal Tournament 3 1.3, Frontlines: Fuel of War 1.1.1, and other products, allows remote attackers to cause a denial of service (server exit) via a packet with a large length value that triggers a memory allocation failure.

  • CVE-2008-7014Aug 19, 2009
    Fhttpd
    Fhttpd
    risk 0.03cvss —epss 0.03

    fhttpd 0.4.2 allows remote attackers to cause a denial of service (crash) via an Authorization HTTP header with an invalid character after the Basic value.

  • CVE-2008-7013Aug 19, 2009
    Baidu
    Hi IM
    risk 0.00cvss —epss 0.01

    NetService.dll in Baidu Hi IM allows remote servers to cause a denial of service (client crash) via a crafted login response that triggers a divide-by-zero error.

  • CVE-2008-7012Aug 19, 2009
    Accellion
    File Transfer Appliance
    risk 0.04cvss —epss 0.07

    courier/1000@/api_error_email.html (aka "error reporting page") in Accellion File Transfer Appliance FTA_7_0_178, and possibly other versions before FTA_7_0_189, allows remote attackers to send spam e-mail via modified description and client_email parameters.

  • CVE-2008-7011Aug 19, 2009
    Epic Games
    Unreal Tournament
    risk 0.03cvss —epss 0.02

    The Unreal engine, as used in Unreal Tournament 3 1.3, Unreal Tournament 2003 and 2004, Dead Man's Hand, Pariah, WarPath, Postal2, and Shadow Ops, allows remote authenticated users to cause a denial of service (server exit) via multiple file downloads from the server, which…

  • CVE-2008-7010Aug 19, 2009
    Skalinks
    Exchange Script
    risk 0.03cvss —epss 0.04

    Skalfa Software SkaLinks Exchange Script 1.5 allows remote attackers to add new administrators and gain privileges via a direct request to admin/register.php.

  • CVE-2008-7009Aug 19, 2009
    Checkpoint
    Zonealarm
    risk 0.03cvss —epss 0.01

    Buffer overflow in multiscan.exe in Check Point ZoneAlarm Security Suite 7.0.483.000 and 8.0.020.000 allows local users to execute arbitrary code via a file or directory with a long path. NOTE: some of these details are obtained from third party information.

  • CVE-2008-7008Aug 19, 2009
    Hyperstop
    Web Host Directory
    risk 0.03cvss —epss 0.03

    HyperStop Web Host Directory 1.2 allows remote attackers to bypass authentication and download a database backup via a direct request to admin/backup/db.

  • CVE-2008-7007Aug 19, 2009
    Free PHP VX Guestbook
    VX Guestbook
    risk 0.03cvss —epss 0.03

    Free PHP VX Guestbook 1.06 allows remote attackers to bypass authentication and gain administrative access by setting the (1) admin_name and (2) admin_pass cookie values to 1.

  • CVE-2008-7006Aug 19, 2009
    Free PHP VX Guestbook
    VX Guestbook
    risk 0.04cvss —epss 0.07

    Free PHP VX Guestbook 1.06 allows remote attackers to bypass authentication and download a backup of the database via a direct request to admin/backupdb.php.

  • CVE-2008-7005Aug 19, 2009
    Minb Is Not A Blog
    Minb Is Not a Blog
    risk 0.04cvss —epss 0.09

    include/modules/top/1-random_quote.php in Minb Is Not a Blog (minb) 0.1.0 allows remote attackers to execute arbitrary PHP code via the quotes_to_edit parameter. NOTE: this issue has been reported as an unrestricted file upload by some sources, but that is a potential…

  • CVE-2008-7004Aug 19, 2009
    Elog
    Elog
    risk 0.00cvss —epss 0.02

    Buffer overflow in Electronic Logbook (ELOG) before 2.7.1 has unknown impact and attack vectors, possibly related to elog.c.

  • CVE-2008-7003Aug 19, 2009
    The Rat CMS
    The Rat CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.php in The Rat CMS Alpha 2 allow remote attackers to execute arbitrary SQL commands via the (1) user_id and (2) password parameter.

  • CVE-2008-7002Aug 19, 2009
    PHP
    PHP
    risk 0.03cvss —epss 0.01

    PHP 5.2.5 does not enforce (a) open_basedir and (b) safe_mode_exec_dir restrictions for certain functions, which might allow local users to bypass intended access restrictions and call programs outside of the intended directory via the (1) exec, (2) system, (3) shell_exec, (4)…

  • CVE-2008-7001Aug 19, 2009
    Creative Mind
    Creator CMS
    risk 0.03cvss —epss 0.04

    Unrestricted file upload vulnerability in the file manager in Creative Mind Creator CMS 5.0 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2008-7000Aug 19, 2009
    Phpauction
    Phpauction
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in PHPAuction 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the lan parameter. NOTE: this might be related to CVE-2005-2255.1.

  • CVE-2008-6999Aug 19, 2009
    Phpauction
    Phpauction
    risk 0.00cvss —epss 0.01

    phpAuction 3.2, and possibly 3.3.0 GPL Basic edition, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.

  • CVE-2008-6998Aug 19, 2009
    Google
    Chrome
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in chrome/common/gfx/url_elider.cc in Google Chrome 0.2.149.27 and other versions before 0.2.149.29 might allow user-assisted remote attackers to execute arbitrary code via a link target (href attribute) with a large number of path elements, which…

  • CVE-2008-6997Aug 19, 2009
    Google
    Chrome
    risk 0.03cvss —epss 0.04

    Google Chrome 0.2.149.27 allows user-assisted remote attackers to cause a denial of service (browser crash) via an IMG tag with a long src attribute, which triggers the crash when the victim performs an "Inspect Element" action.

  • CVE-2008-6996Aug 19, 2009
    Google
    Chrome
    risk 0.04cvss —epss 0.06

    Google Chrome BETA (0.2.149.27) does not prompt the user before saving an executable file, which makes it easier for remote attackers or malware to cause a denial of service (disk consumption) or exploit other vulnerabilities via a URL that references an executable file,…

  • CVE-2008-6995Aug 19, 2009
    Google
    Chrome
    risk 0.03cvss —epss 0.05

    Integer underflow in net/base/escape.cc in chrome.dll in Google Chrome 0.2.149.27 allows remote attackers to cause a denial of service (browser crash) via a URI with an invalid handler followed by a "%" (percent) character, which triggers a buffer over-read, as demonstrated…

  • CVE-2008-6994Aug 19, 2009
    Google
    Chrome
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in the SaveAs feature (SaveFileAsWithFilter function) in win_util.cc in Google Chrome 0.2.149.27 allows user-assisted remote attackers to execute arbitrary code via a web page with a long TITLE element, which triggers the overflow when the user saves…

  • CVE-2008-6993Aug 19, 2009
    Siemens Foundation
    Gigaset Wlan Camera
    risk 0.00cvss —epss 0.02

    Siemens Gigaset WLAN Camera 1.27 has an insecure default password, which allows remote attackers to conduct unauthorized activities. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-6992Aug 19, 2009
    Greensql
    Greensql Firewall
    risk 0.03cvss —epss 0.01

    GreenSQL Firewall (greensql-fw), possibly before 0.9.2 or 0.9.4, allows remote attackers to bypass the SQL injection protection mechanism via a WHERE clause containing an expression such as "x=y=z", which is successfully parsed by MySQL.

  • CVE-2008-6991Aug 19, 2009
    Cmsbright
    Cmsbright
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in public/page.php in Websens CMSbright allows remote attackers to execute arbitrary SQL commands via the id_rub_page parameter.

  • CVE-2008-6990Aug 19, 2009
    Ezphotogallery
    Ezphotogallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in gallery.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-6989Aug 19, 2009
    Ezphotogallery
    Ezphotogallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in gallery.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2008-6988Aug 19, 2009
    Ezphotogallery
    Ezphotogallery
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Easy Photo Gallery (aka Ezphotogallery) 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) galleryid parameter to gallery.php, and the (2) size or (3) imageid parameters to show.php.

  • CVE-2008-6987Aug 19, 2009
    Ezonescripts
    Dating Website Script
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in eZoneScripts Dating Website script allows remote attackers to execute arbitrary code via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-6986Aug 19, 2009
    Zen Cart
    ZenCart
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a…

  • CVE-2008-6985Aug 19, 2009
    Zen Cart
    ZenCart
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when (1) adding or (2) updating the shopping cart.