VYPR

CVEs

385,453 total · page 6959 of 7,710

AllCriticalHighKEV
  • CVE-2009-2607Jul 27, 2009
    Joomla
    com_pinboard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the com_pinboard component for Joomla! allows remote attackers to execute arbitrary SQL commands via the task parameter in a showpic action to index.php.

  • CVE-2009-2606Jul 27, 2009
    Brainjar
    Asp Football Pool
    risk 0.03cvss —epss 0.02

    ASP Football Pool 2.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for NFL.mdb.

  • CVE-2009-2605Jul 27, 2009
    Traidnt
    Traidnt Up
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in adminquery.php in Traidnt Up 2.0 allow remote attackers to execute arbitrary SQL commands via (1) trupuser and (2) truppassword cookies to uploadcp/index.php.

  • CVE-2009-2604Jul 27, 2009
    Zenhelpdesk
    Zen Help Desk
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in adminlogin.asp in Zen Help Desk 2.1 allow remote attackers to execute arbitrary SQL commands via the (1) userid (aka username) and (2) PassWord parameters to admin.asp.

  • CVE-2009-2603Jul 27, 2009
    Escon
    SupportPortal Pro
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Escon SupportPortal Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) cat and (2) tid parameters.

  • CVE-2009-2602Jul 27, 2009
    WordPress
    R2 Newsletter
    risk 0.03cvss —epss 0.02

    R2 Newsletter Lite, Pro, and Stats stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for admin.mdb.

  • CVE-2009-2601Jul 27, 2009
    Joomlaequipment
    Juser
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Joomlaequipment (aka JUser or com_juser) component 2.0.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a show_profile action to index.php.

  • CVE-2009-2600Jul 27, 2009
    Webboa
    Webboa
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in view.php in Webboard 2.90 beta and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the topic parameter.

  • CVE-2009-2599Jul 27, 2009
    RadCLASSIFIEDS
    RadCLASSIFIEDS Gold
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in RadCLASSIFIEDS Gold 2.0 allows remote attackers to execute arbitrary SQL commands via the seller parameter in a search action.

  • CVE-2009-2598Jul 27, 2009
    Online Grades & Attendance
    Online Grades & Attendance
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Online Grades & Attendance 3.2.6 and earlier allow (1) remote attackers to execute arbitrary SQL commands via the key parameter in a resetpass action to index.php and (2) remote authenticated users to execute arbitrary SQL commands via…

  • CVE-2009-2597Jul 27, 2009
    Sun Corporation
    Access Manager Policy Agent
    risk 0.00cvss —epss 0.03

    The Sun Java System (SJS) Access Manager Policy Agent module 2.2 for SJS Web Proxy Server 4.0 allows remote attackers to cause a denial of service (daemon crash) via a GET request.

  • CVE-2009-2596Jul 27, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Solaris Auditing subsystem in Sun Solaris 9 and 10 and OpenSolaris before snv_121, when extended file attributes are used, allows local users to cause a denial of service (panic) via vectors related to fad_aupath structure members.

  • CVE-2008-6878Jul 27, 2009
    Zen Cart
    ZenCart
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _SESSION[language] parameter. NOTE:…

  • CVE-2008-6877Jul 27, 2009
    Zen Cart
    ZenCart
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the loader_file parameter. NOTE: the vendor disputes this…

  • CVE-2008-6876Jul 24, 2009
    EsPartenaires
    EsPartenaires
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in login.php in EsPartenaires 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: the EsContacts 1.0 issue is covered in CVE-2008-2037.

  • CVE-2009-2595Jul 24, 2009
    Censura
    Censura
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in productSearch.html in Censura 2.0.4 and 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a ProductSearch action.

  • CVE-2009-2594Jul 24, 2009
    Censura
    Censura
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in censura.php in Censura 1.16.04 allows remote attackers to inject arbitrary web script or HTML via the itemid parameter in a details action.

  • CVE-2009-2593Jul 24, 2009
    Censura
    Censura
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in censura.php in Censura 1.16.04 allows remote attackers to execute arbitrary SQL commands via the itemid parameter in a details action.

  • CVE-2009-2592Jul 24, 2009
    Phpjunkyard
    Gbook
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in guestbook.php in PHPJunkYard GBook 1.6 allows remote attackers to execute arbitrary SQL commands via the mes_id parameter.

  • CVE-2009-2591Jul 24, 2009
    Runcms
    Myannonces
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the MyAnnonces module for E-Xoopport 3.1 allows remote attackers to execute arbitrary SQL commands via the lid parameter in a viewannonces action to index.php.

  • CVE-2009-2590Jul 24, 2009
    Hutscripts
    PHP Website Script
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in showcategory.php in Hutscripts PHP Website Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2009-2589Jul 24, 2009
    Hutscripts
    PHP Website Script
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Hutscripts PHP Website Script allow remote attackers to inject arbitrary web script or HTML via the msg parameter to (1) feedback.php, (2) index.php, and (3) lostpassword.php.

  • CVE-2009-2588Jul 24, 2009
    Resalecode
    Hotscripts Type PHP Clone Script
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Hotscripts Type PHP Clone Script allow remote attackers to inject arbitrary web script or HTML via the msg parameter to (1) feedback.php, (2) index.php, and (3) lostpassword.php.

  • CVE-2009-2587Jul 24, 2009
    Dragdropcart
    Dragdropcart
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in DragDropCart allow remote attackers to inject arbitrary web script or HTML via the (1) sid parameter to assets/js/ddcart.php, the (2) prefix parameter to includes/ajax/getstate.php, the search parameter to (3) index.php and…

  • CVE-2009-2586Jul 24, 2009
    Edgephp
    Ezarticles
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in articles.php in EDGEPHP EZArticles allows remote attackers to inject arbitrary web script or HTML via the title parameter.

  • CVE-2009-2585Jul 24, 2009
    Mlffat
    Mlffat
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Mlffat 2.2 allows remote attackers to execute arbitrary SQL commands via a member cookie in an account editprofile action, a different vector than CVE-2009-1731.

  • CVE-2008-6875Jul 24, 2009
    Humayun Shabbir Bhutta
    Asp Product Catalog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.asp in ASP Product Catalog allows remote attackers to execute arbitrary SQL commands via the cid parameter, a different vector than CVE-2007-5220.

  • CVE-2008-6874Jul 24, 2009
    Aspsiteware
    Autodealer
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ASP SiteWare autoDealer 1 and 2 allow remote attackers to execute arbitrary SQL commands via the iType parameter in (1) Auto1/type.asp or (2) auto2/type.asp.

  • CVE-2009-2584Jul 23, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Off-by-one error in the options_write function in drivers/misc/sgi-gru/gruprocfs.c in the SGI GRU driver in the Linux kernel 2.6.30.2 and earlier on ia64 and x86 platforms might allow local users to overwrite arbitrary memory locations and gain privileges via a crafted count…

  • CVE-2009-2583Jul 23, 2009
    IBM
    Tivoli Identity Manager
    risk 0.00cvss —epss 0.01

    Multiple session fixation vulnerabilities in IBM Tivoli Identity Manager (ITIM) 5.0.0.6 allow remote attackers to hijack web sessions via unspecified vectors involving the (1) console and (2) self service interfaces.

  • CVE-2009-2582Jul 23, 2009
    Akamai
    Download Manager
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in manager.exe in Akamai Download Manager (aka DLM or dlmanager) before 2.2.4.8 allows remote web servers to execute arbitrary code via a malformed HTTP response during a Redswoosh download, a different vulnerability than CVE-2007-1891 and…

  • CVE-2009-1862HigKEVJul 23, 2009
    Adobe Inc.
    Acrobat
    risk 0.64cvss 7.8epss 0.21

    Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash…

  • CVE-2009-2581Jul 23, 2009
    Editeurscripts
    Esnews
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in modifier.php in EditeurScripts EsNews 1.2 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2008-6873Jul 23, 2009
    Active Web Mail
    Active Web Mail
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the TabOpenQuickTab1 parameter to (1) popaccounts.aspx, (2) addressbook.aspx, and (3) emails.aspx.

  • CVE-2008-6872Jul 23, 2009
    ASPThai.Net
    Aspthai Forums
    risk 0.03cvss —epss 0.06

    ASPThai.NET ASPThai Forums 8.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/aspthaiForum.mdb.

  • CVE-2008-6871Jul 23, 2009
    Merlix
    Educate Server
    risk 0.03cvss —epss 0.02

    Merlix Educate Server stores db.mdb under the web root with insufficient access control, which allows remote attackers to obtain unspecified sensitive information via a direct request.

  • CVE-2008-6870Jul 23, 2009
    Merlix
    Educate Server
    risk 0.03cvss —epss 0.03

    Merlix Educate Server allows remote attackers to bypass intended security restrictions and obtain sensitive information via a direct request to (1) config.asp and (2) users.asp.

  • CVE-2008-6869Jul 23, 2009
    Oramon
    Oramon
    risk 0.03cvss —epss 0.06

    Oramon Oracle Database Monitoring Tool 2.0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for config/oramon.ini.

  • CVE-2008-6868Jul 23, 2009
    Editeurscripts
    Esbaseadmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in default/login.php in EditeurScripts EsBaseAdmin 2.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: the EsContacts 1.0 issue is covered in CVE-2008-2037.

  • CVE-2009-2578Jul 22, 2009
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome 2.x through 2.0.172 allows remote attackers to cause a denial of service (application crash) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479.

  • CVE-2009-2577Jul 22, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera 9.52 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption, and application hang) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479.

  • CVE-2009-2576Jul 22, 2009
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.15

    Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479. NOTE: it was later reported that 7.0.6000.16473 and…

  • CVE-2009-2575Jul 22, 2009
    Rim
    Blackberry 8800
    risk 0.00cvss —epss 0.02

    The Research In Motion (RIM) BlackBerry 8800 allows remote attackers to cause a denial of service (memory consumption and browser crash) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.

  • CVE-2009-2472Jul 22, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document, related to a "cross origin…

  • CVE-2009-2471Jul 22, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The setTimeout function in Mozilla Firefox before 3.0.12 does not properly preserve object wrapping, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted call, related to XPCNativeWrapper.

  • CVE-2009-2469Jul 22, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Mozilla Firefox before 3.0.12 does not properly handle an SVG element that has a property with a watch function and an __defineSetter__ function, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary…

  • CVE-2009-2468Jul 22, 2009
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.06

    Integer overflow in Apple CoreGraphics, as used in Safari before 4.0.3, Mozilla Firefox before 3.0.12, and Mac OS X 10.4.11 and 10.5.8, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long text run that triggers a…

  • CVE-2009-2467Jul 22, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Mozilla Firefox before 3.0.12 and 3.5 before 3.5.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving a Flash object, a slow script dialog, and the unloading of the Flash plugin, which triggers…

  • CVE-2009-2466Jul 22, 2009
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.07

    The JavaScript engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) nsDOMClassInfo.cpp, (2) JS_HashTableRawLookup, and…

  • CVE-2009-2465Jul 22, 2009
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Mozilla Firefox before 3.0.12 and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via vectors involving double frame construction, related to (1) nsHTMLContentSink.cpp, (2) nsXMLContentSink.cpp,…