VYPR

CVEs

385,472 total · page 6955 of 7,710

AllCriticalHighKEV
  • CVE-2008-6953Aug 12, 2009
    Oovoo
    Oovoo
    risk 0.04cvss —epss 0.09

    Buffer overflow in oovoo.exe in ooVoo 1.7.1.35, and possibly other versions before 1.7.1.59, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long oovoo: URI.

  • CVE-2008-6952Aug 12, 2009
    Cms.maury91
    Maurycms
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in Rss.php in MauryCMS 0.53.2 and earlier allows remote attackers to execute arbitrary SQL commands via the c parameter.

  • CVE-2008-6951Aug 12, 2009
    Cms.maury91
    Maurycms
    risk 0.00cvss —epss 0.02

    MauryCMS 0.53.2 and earlier does not require administrative authentication for Editors/fckeditor/editor/filemanager/browser/default/browser.html, which allows remote attackers to upload arbitrary files via a direct request.

  • CVE-2008-6950Aug 12, 2009
    Bankoi
    WebHosting Control Panel
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.asp in Bankoi WebHosting Control Panel 1.20 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.

  • CVE-2008-6949Aug 12, 2009
    Collabtive
    Collabtive
    risk 0.03cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in Collabtive 0.4.8 allow remote attackers to hijack the authentication of administrators for requests that (1) submit or edit a new project, or (2) upload files to a project, or (3) attach files to messages via unknown…

  • CVE-2008-6948Aug 12, 2009
    Collabtive
    Collabtive
    risk 0.04cvss —epss 0.08

    Unrestricted file upload vulnerability in Collabtive 0.4.8 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and using a text/plain MIME type, then accessing it via a direct request to the file in files/, related to (1)…

  • CVE-2008-6947Aug 12, 2009
    Collabtive
    Collabtive
    risk 0.04cvss —epss 0.08

    Collabtive 0.4.8 allows remote attackers to bypass authentication and create new users, including administrators, via unspecified vectors associated with the added mode in a users action to admin.php.

  • CVE-2008-6946Aug 12, 2009
    Collabtive
    Collabtive
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in manageproject.php in Collabtive 0.4.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via the project Name, which is not properly handled when the administrator performs an editform action, related to…

  • CVE-2008-6945Aug 12, 2009
    Interchange Development Group
    Interchange
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Interchange 5.7 before 5.7.1, 5.6 before 5.6.1, and 5.4 before 5.4.3 allow remote attackers to inject arbitrary web script or HTML via (1) the mv_order_item CGI variable parameter in Core, (2) the country-select widget, or…

  • CVE-2008-6944Aug 12, 2009
    Scriptsfeed
    Auto Classifieds
    risk 0.03cvss —epss 0.04

    Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo, then accessing it via a direct request to the file in cars_images/.

  • CVE-2008-6943Aug 12, 2009
    Scriptsfeed
    Recipes Listing Portal
    risk 0.03cvss —epss 0.04

    Unrestricted file upload vulnerability in ScriptsFeed Recipes Listing Portal allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a recipe photo, then accessing it via a direct request to the file in pictures/.

  • CVE-2008-6942Aug 12, 2009
    Scriptsfeed
    Realtor Classifieds System
    risk 0.03cvss —epss 0.04

    Unrestricted file upload vulnerability in ScriptsFeed Realtor Classifieds System (aka Real Estate Classifieds) allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo, then accessing it via a direct request…

  • CVE-2008-6941Aug 12, 2009
    Turnkeyforms
    Web Hosting Directory
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the login functionality in TurnkeyForms Web Hosting Directory allows remote attackers to execute arbitrary SQL commands via the password field.

  • CVE-2008-6940Aug 12, 2009
    Turnkeyforms
    Web Hosting Directory
    risk 0.03cvss —epss 0.03

    TurnkeyForms Web Hosting Directory stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain a database backup via a direct request to admin/backup/db.

  • CVE-2008-6939Aug 12, 2009
    Turnkeyforms
    Web Hosting Directory
    risk 0.03cvss —epss 0.03

    TurnkeyForms Web Hosting Directory allows remote attackers to bypass authentication and (1) gain administrative privileges by setting the adm cookie to 1 or (2) gain privileges as another user by setting the logged cookie to the target username.

  • CVE-2008-6938Aug 11, 2009
    Holger Zimmermann
    Pi3web
    risk 0.05cvss —epss 0.26

    Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI…

  • CVE-2008-6937Aug 11, 2009
    Exodus
    Exodus
    risk 0.03cvss —epss 0.03

    Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary files, and cause a denial of service via encoded spaces in an xmpp:// URI, a different vector than CVE-2008-6935 and CVE-2008-6936. NOTE: the…

  • CVE-2008-6936Aug 11, 2009
    Exodus
    Exodus
    risk 0.03cvss —epss 0.03

    Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary files, and cause a denial of service via encoded spaces in a pres:// URI, a different vector than CVE-2008-6935.

  • CVE-2008-6935Aug 11, 2009
    Exodus
    Exodus
    risk 0.03cvss —epss 0.05

    Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary files, and cause a denial of service via encoded spaces in an im:// URI.

  • CVE-2008-6934Aug 11, 2009
    Sanusart
    Free Simple Guestbook PHP Script
    risk 0.03cvss —epss 0.03

    Static code injection vulnerability in Sanus|artificium (aka Sanusart) Free simple guestbook PHP script, when downloaded before 20081111, allows remote attackers to inject arbitrary PHP code into messages.txt via the message parameter to act.php, which is executed when…

  • CVE-2008-6933Aug 11, 2009
    Minigal
    Minigal
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in MiniGal b13 (aka MG2) allows remote attackers to read the source code of .php files, and possibly the content of other files, via a .. (dot dot) in the list parameter.

  • CVE-2008-6932Aug 11, 2009
    Alstrasoft
    Sendit
    risk 0.03cvss —epss 0.05

    Unrestricted file upload vulnerability in submit_file.php in AlstraSoft SendIt Pro allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in send/files/.

  • CVE-2008-6931Aug 11, 2009
    Phpstore
    Phpcareers
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in PHPStore Job Search (aka PHPCareers) allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a resume photo, then accessing it via a direct request to the file in…

  • CVE-2008-6930Aug 11, 2009
    Phpstore
    Real Estate
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in PHPStore Real Estate allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a logo, then accessing it via a direct request to the file in realty/re_images/.

  • CVE-2008-6929Aug 11, 2009
    Phpstore
    Auto Classifieds
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in PHPStore Auto Classifieds allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a logo, then accessing it via a direct request to the file in cars/cars_images/.

  • CVE-2008-6928Aug 11, 2009
    Phpstore
    Complete Classifieds
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in PHPStore Complete Classifieds allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a logo, then accessing it via a direct request to the file in classifieds1/yellow_images/.

  • CVE-2009-2739Aug 11, 2009
    Freenas
    Freenas
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in FreeNAS before 0.69.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2009-2738Aug 11, 2009
    Freenas
    Freenas
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the WebGUI in FreeNAS before 0.7RC1 allows remote attackers to hijack the authentication of users for unspecified requests via unknown vectors.

  • CVE-2009-2416MedAug 11, 2009
    Xmlsoft
    Libxml2
    risk 0.42cvss 6.5epss 0.02

    Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as…

  • CVE-2009-2414Aug 11, 2009
    Xmlsoft
    Libxml2
    risk 0.00cvss —epss 0.03

    Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD, related to a function recursion, as…

  • CVE-2009-1885Aug 11, 2009
    Apache
    Xerces C\+\+
    risk 0.00cvss —epss 0.05

    Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD…

  • CVE-2009-2737Aug 11, 2009
    Toni Mueller
    Roundup
    risk 0.00cvss —epss 0.02

    The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that…

  • CVE-2009-2736Aug 11, 2009
    Sun Jester
    Opennews
    risk 0.03cvss —epss 0.05

    Static code injection vulnerability in admin.php in sun-jester OpenNews 1.0 allows remote authenticated administrators to inject arbitrary PHP code into config.php via the "Overall Width" field in a setconfig action.

  • CVE-2009-2735Aug 11, 2009
    Sun Jester
    Opennews
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin.php in sun-jester OpenNews 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2009-2705Aug 11, 2009
    Ca
    Siteminder
    risk 0.03cvss —epss 0.04

    CA SiteMinder allows remote attackers to bypass cross-site scripting (XSS) protections for J2EE applications via a request containing non-canonical, "overlong Unicode" in place of blacklisted characters.

  • CVE-2009-2704Aug 11, 2009
    Ca
    Siteminder
    risk 0.03cvss —epss 0.04

    CA SiteMinder allows remote attackers to bypass cross-site scripting (XSS) protections for J2EE applications via a request containing a %00 (encoded null byte).

  • CVE-2009-0687Aug 11, 2009
    Midnightbsd
    Midnightbsd
    risk 0.04cvss —epss 0.10

    The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer…

  • CVE-2009-2727Aug 10, 2009
    IBM
    Aix
    risk 0.05cvss —epss 0.27

    Stack-based buffer overflow in the _tt_internal_realpath function in the ToolTalk library (libtt.a) in IBM AIX 5.2.0, 5.3.0, 5.3.7 through 5.3.10, and 6.1.0 through 6.1.3, when the rpc.ttdbserver daemon is enabled in /etc/inetd.conf, allows remote attackers to execute arbitrary…

  • CVE-2009-2724Aug 10, 2009
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.02

    Race condition in the java.lang package in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, related to a "3Y Race condition in reflection checks."

  • CVE-2009-2723Aug 10, 2009
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in deserialization in the Provider class in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, aka BugId 6444262.

  • CVE-2009-2722Aug 10, 2009
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6429594. NOTE: this issue exists because of an incorrect fix for BugId 6406003.

  • CVE-2009-2721Aug 10, 2009
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6406003.

  • CVE-2009-2720Aug 10, 2009
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the javax.swing.plaf.synth.SynthContext.isSubregion method in the Swing implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a denial of service (NullPointerException in the Jemmy library) via unknown vectors.

  • CVE-2009-2719Aug 10, 2009
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.02

    The Java Web Start implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a denial of service (NullPointerException) via a crafted .jnlp file, as demonstrated by the jnlp_file/appletDesc/index.html#misc test in the Technology Compatibility…

  • CVE-2009-2718Aug 10, 2009
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.02

    The Abstract Window Toolkit (AWT) implementation in Sun Java SE 6 before Update 15 on X11 does not impose the intended constraint on distance from the window border to the Security Warning Icon, which makes it easier for context-dependent attackers to trick a user into…

  • CVE-2009-2717Aug 10, 2009
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.01

    The Abstract Window Toolkit (AWT) implementation in Sun Java SE 6 before Update 15 on Windows 2000 Professional does not provide a Security Warning Icon, which makes it easier for context-dependent attackers to trick a user into interacting unsafely with an untrusted applet.

  • CVE-2009-2716Aug 10, 2009
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.01

    The plugin functionality in Sun Java SE 6 before Update 15 does not properly implement version selection, which allows context-dependent attackers to leverage vulnerabilities in "old zip and certificate handling" and have unspecified other impact via unknown vectors.

  • CVE-2008-6927Aug 10, 2009
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allow remote attackers to inject arbitrary web script or HTML via the (1) localapp, (2) updatedir, (3) scriptpath_show, (4) domain_show, (5)…

  • CVE-2008-6926Aug 10, 2009
    CPanel
    Fantastico De Luxe
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the scriptpath_show parameter in a GoAhead action. …

  • CVE-2008-6925Aug 10, 2009
    Zenphoto
    Zenphoto
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in function.php in Zenphoto 1.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the "request logging" feature. NOTE: the provenance of this information is unknown; the details are obtained…