VYPR

CVEs

385,472 total · page 6954 of 7,710

AllCriticalHighKEV
  • CVE-2009-2091Aug 13, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    The System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 on z/OS uses weak file permissions for new applications, which allows remote attackers to obtain sensitive information via unspecified vectors.

  • CVE-2009-2090Aug 13, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in wsadmin in the System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 allows remote attackers to bypass intended Java Management Extensions (JMX) Management Beans (aka MBeans) access restrictions, and…

  • CVE-2009-2089Aug 13, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    The Migration component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when tracing is enabled and a 6.1 to 7.0 migration has occurred, allows remote authenticated users to obtain sensitive information by reading a Migration Trace file.

  • CVE-2009-2088Aug 13, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when SPNEGO Single Sign-on (SSO) and disableSecurityPreInvokeOnFilters are configured, allows remote attackers to bypass authentication via a request…

  • CVE-2009-2087Aug 13, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.00

    The Web Services functionality in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, in certain circumstances involving the ibm-webservicesclient-bind.xmi file and custom password encryption, uses weak password obfuscation, which allows local…

  • CVE-2009-2085Aug 13, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    The Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 does not properly handle use of Identity Assertion with CSIv2 Security, which allows remote attackers to bypass intended CSIv2 access restrictions via vectors involving…

  • CVE-2009-0906Aug 13, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    The Service Component Architecture (SCA) feature pack for IBM WebSphere Application Server (WAS) SCA 1.0 before 1.0.0.3 allows remote authenticated users to bypass intended authentication.transport access restrictions and obtain unspecified access via unknown vectors.

  • CVE-2008-6973Aug 13, 2009
    IBM
    Websphere Commerce
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in IBM WebSphere Commerce 6.0 before 6.0.0.7 have unknown impact and attack vectors.

  • CVE-2009-2762Aug 13, 2009
    WordPress
    WordPress
    risk 0.00cvss —epss 0.20

    wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.

  • CVE-2009-2761Aug 13, 2009
    Avira
    Antivir
    risk 0.00cvss —epss 0.00

    Unquoted Windows search path vulnerability in the scheduler (sched.exe) in Avira AntiVir, AntiVir Premium, Premium Security Suite, and AntiVir Professional might allow local users to gain privileges via a malicious antivir.exe file in the "C:\Program Files\avira\" directory.

  • CVE-2008-6972Aug 13, 2009
    Drupal
    Content Construction Kit
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via the (1) "field label," (2) "help text," or (3)…

  • CVE-2008-6971Aug 13, 2009
    Simple Machines
    Smf
    risk 0.04cvss —epss 0.07

    The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes clues about the random number generator state within a hidden form field and generates predictable validation codes, which allows remote…

  • CVE-2008-6970Aug 13, 2009
    Ubbcentral
    Ubb.threads
    risk 0.04cvss —epss 0.07

    SQL injection vulnerability in dosearch.inc.php in UBB.threads 7.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the Forum[] array parameter.

  • CVE-2008-6969Aug 13, 2009
    Pentasoft Corp.
    Shopping Cart
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in checkout.php in Avactis Shopping Cart 1.8.0 and 1.8.1 allow remote attackers to inject arbitrary web script or HTML via the (1) step_id and (2) CHECKOUT_CZ_BLOWFISH_KEY parameters.

  • CVE-2008-6968Aug 13, 2009
    Pligg
    CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in submit.php in Pligg CMS 9.9.5 allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) id parameters.

  • CVE-2008-6967Aug 13, 2009
    Alt N
    Mdaemon
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in WorldClient in Alt-N MDaemon before 10.02 have unknown impact and attack vectors, probably related to cross-site scripting (XSS) and WorldClient DLL 10.0.1, a different vulnerability than CVE-2008-6893.

  • CVE-2008-6966Aug 13, 2009
    AJ Square
    AJ Auction Pro Platinum Skin #1
    risk 0.03cvss —epss 0.03

    AJ Square AJ Auction Pro Platinum Skin #1 sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass authentication via a direct request to admin/user.php.

  • CVE-2008-6965Aug 13, 2009
    AJ Square
    Web 2.0
    risk 0.03cvss —epss 0.03

    AJ Square AJ Auction OOPD, Pro Platinum Skin #1, Pro Platinum Skin #2, and Web 2.0 send a redirect but do not exit when certain scripts are called directly, which allows remote attackers to bypass authentication via a direct request to (1) site.php, (2) auction.php, (3)…

  • CVE-2008-6964Aug 13, 2009
    X7 Chat
    X7 Chat
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the login page in X7 Chat 2.0.5 allows remote attackers to execute arbitrary SQL commands via the password field.

  • CVE-2008-6963Aug 13, 2009
    Turnkeyforms
    Text Link Sales
    risk 0.03cvss —epss 0.02

    admin.php in TurnkeyForms Text Link Sales allows remote attackers to bypass authentication and gain administrative privileges via a direct request.

  • CVE-2008-6962Aug 13, 2009
    Avira
    Antivir Personal
    risk 0.00cvss —epss 0.01

    Avira AntiVir Premium, Premium Security Suite, AntiVir Professional, and AntiVir Personal - FREE allows local users to execute arbitrary code via a crafted IOCTL request that overwrites a kernel pointer.

  • CVE-2008-6961Aug 13, 2009
    Mozilla Corporation
    Thunderbird
    risk 0.00cvss —epss 0.02

    mailnews in Mozilla Thunderbird before 2.0.0.18 and SeaMonkey before 1.1.13, when JavaScript is enabled in mail, allows remote attackers to obtain sensitive information about the recipient, or comments in forwarded mail, via script that reads the (1) .documentURI or (2)…

  • CVE-2009-2200Aug 12, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit in Apple Safari before 4.0.3 does not properly restrict the URL scheme of the pluginspage attribute of an EMBED element, which allows user-assisted remote attackers to launch arbitrary file: URLs and obtain sensitive information via a crafted HTML document.

  • CVE-2009-2199Aug 12, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    Incomplete blacklist vulnerability in WebKit in Apple Safari before 4.0.3, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to spoof domain names in URLs, and possibly conduct phishing attacks, via unspecified…

  • CVE-2009-2196Aug 12, 2009
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Apple Safari 4 before 4.0.3 allows remote web servers to place an arbitrary web site in the Top Sites view, and possibly conduct phishing attacks, via unknown vectors.

  • CVE-2009-2195Aug 12, 2009
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.13

    Buffer overflow in WebKit in Apple Safari before 4.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted floating-point numbers.

  • CVE-2009-2496Aug 12, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.29

    Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and…

  • CVE-2009-2494CriAug 12, 2009
    Microsoft
    Windows 2000
    risk 0.67cvss 9.8epss 0.42

    The Active Template Library (ATL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via vectors related to erroneous free operations after reading a variant…

  • CVE-2009-1930Aug 12, 2009
    Microsoft
    Windows 2000
    risk 0.03cvss —epss 0.41

    The Telnet service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote Telnet servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, aka "Telnet…

  • CVE-2009-1929Aug 12, 2009
    Microsoft
    Windows
    risk 0.03cvss —epss 0.35

    Heap-based buffer overflow in the Microsoft Terminal Services Client ActiveX control running RDP 6.1 on Windows XP SP2, Vista SP1 or SP2, or Server 2008 Gold or SP2; or 5.2 or 6.1 on Windows XP SP3; allows remote attackers to execute arbitrary code via unspecified parameters to…

  • CVE-2009-1924Aug 12, 2009
    Microsoft
    Windows 2000
    risk 0.01cvss —epss 0.09

    Integer overflow in the Windows Internet Name Service (WINS) component for Microsoft Windows 2000 SP4 allows remote WINS replication partners to execute arbitrary code via crafted data structures in a packet, aka "WINS Integer Overflow Vulnerability."

  • CVE-2009-1923Aug 12, 2009
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.25

    Heap-based buffer overflow in the Windows Internet Name Service (WINS) component for Microsoft Windows 2000 SP4 and Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted WINS replication packet that triggers an incorrect buffer-length calculation, aka…

  • CVE-2009-1922Aug 12, 2009
    Microsoft
    Windows 2000
    risk 0.00cvss —epss 0.01

    The Message Queuing (aka MSMQ) service for Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP2, and Vista Gold does not properly validate unspecified IOCTL request data from user mode before passing this data to kernel mode, which allows local users to gain privileges via a…

  • CVE-2009-1546Aug 12, 2009
    Microsoft
    Windows
    risk 0.02cvss —epss 0.22

    Integer overflow in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows allows remote attackers to execute arbitrary code on a Windows 2000 SP4 system via a crafted AVI file, or cause a denial of service on a Windows XP SP2 or SP3, Server 2003 SP2,…

  • CVE-2009-1545Aug 12, 2009
    Microsoft
    Windows
    risk 0.02cvss —epss 0.29

    Unspecified vulnerability in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a malformed…

  • CVE-2009-1544HigAug 12, 2009
    Microsoft
    Windows
    risk 0.59cvss 8.8epss 0.21

    Double free vulnerability in the Workstation service in Microsoft Windows allows remote authenticated users to gain privileges via a crafted RPC message to a Windows XP SP2 or SP3 or Server 2003 SP2 system, or cause a denial of service via a crafted RPC message to a Vista Gold,…

  • CVE-2009-1536Aug 12, 2009
    Microsoft
    .net Framework
    risk 0.04cvss —epss 0.51

    ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP…

  • CVE-2009-1534Aug 12, 2009
    Microsoft
    Office
    risk 0.07cvss —epss 0.52

    Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property…

  • CVE-2009-1133Aug 12, 2009
    Microsoft
    Windows
    risk 0.02cvss —epss 0.30

    Heap-based buffer overflow in Microsoft Remote Desktop Connection (formerly Terminal Services Client) running RDP 5.0 through 6.1 on Windows, and Remote Desktop Connection Client for Mac 2.0, allows remote attackers to execute arbitrary code via unspecified parameters, aka…

  • CVE-2009-0562Aug 12, 2009
    Microsoft
    Office
    risk 0.02cvss —epss 0.26

    The Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and…

  • CVE-2009-2730Aug 12, 2009
    GNU
    Gnutls
    risk 0.00cvss —epss 0.02

    libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a…

  • CVE-2009-2726Aug 12, 2009
    Digium
    Asterisk
    risk 0.01cvss —epss 0.07

    The SIP channel driver in Asterisk Open Source 1.2.x before 1.2.34, 1.4.x before 1.4.26.1, 1.6.0.x before 1.6.0.12, and 1.6.1.x before 1.6.1.4; Asterisk Business Edition A.x.x, B.x.x before B.2.5.9, C.2.x before C.2.4.1, and C.3.x before C.3.1; and Asterisk Appliance s800i 1.2.x…

  • CVE-2009-1427Aug 12, 2009
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in HP-UX B.11.31 allows local users to cause a denial of service (system crash) via unknown vectors related to the ttrace system call.

  • CVE-2008-6960Aug 12, 2009
    risk 0.04cvss —epss 0.07

    download.php in X10media x10 Automatic Mp3 Search Engine Script 1.5.5 through 1.6 allows remote attackers to read arbitrary files via an encoded url parameter, as demonstrated by obtaining database credentials from includes/constants.php.

  • CVE-2008-6959Aug 12, 2009
    Chilkatsoft
    Chilkat Socket
    risk 0.03cvss —epss 0.06

    Insecure method vulnerability in the Chilkat Socket ActiveX control (ChilkatSocket.ChilkatSocket.1) in ChilkatSocket.dll 2.3.1.1 allows remote attackers to overwrite arbitrary files via the SaveLastError method. NOTE: this might be related to CVE-2008-1647.

  • CVE-2008-6958Aug 12, 2009
    Discuz
    Crossday Discuz\! Board
    risk 0.03cvss —epss 0.06

    wap/index.php in Crossday Discuz! Board 6.x and 7.x allows remote authenticated users to execute arbitrary PHP code via the creditsformula parameter.

  • CVE-2008-6957Aug 12, 2009
    Crossday
    Discuz! Board
    risk 0.03cvss —epss 0.03

    member.php in Crossday Discuz! Board allows remote attackers to reset passwords of arbitrary users via crafted (1) lostpasswd and (2) getpasswd actions, possibly involving predictable generation of the id parameter.

  • CVE-2008-6956Aug 12, 2009
    MxCamArchive
    mxCamArchive
    risk 0.03cvss —epss 0.05

    Static code injection vulnerability in admin/admin.php in mxCamArchive 2.2 allows remote authenticated administrators to inject arbitrary PHP code into an unspecified program via the description parameter, which is executed by invocation of index.php. NOTE: some of these…

  • CVE-2008-6955Aug 12, 2009
    MxCamArchive
    mxCamArchive
    risk 0.04cvss —epss 0.06

    mxCamArchive 2.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain configuration details and passwords via a direct request for archive/config.ini.

  • CVE-2008-6954Aug 12, 2009
    Cobbler Project
    Cobbler
    risk 0.00cvss —epss 0.02

    The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.