VYPR

CVEs

385,452 total · page 6964 of 7,710

AllCriticalHighKEV
  • CVE-2009-2379Jul 8, 2009
    Bigace
    Bigace
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in public/index.php in BIGACE Web CMS 2.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cmd parameter.

  • CVE-2009-2378Jul 8, 2009
    Jax
    FormMailer
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in formmailer.admin.inc.php in Jax FormMailer 3.0.0 allows remote attackers to execute arbitrary PHP code via a URL in the BASE_DIR[jax_formmailer] parameter.

  • CVE-2009-2377Jul 8, 2009
    Avax Software
    Avax Vector Activex
    risk 0.03cvss —epss 0.02

    Buffer overflow in the Avax Vector ActiveX control in avPreview.ocx in AVAX-software Avax Vector ActiveX 1.3 allows remote attackers to cause a denial of service (application crash) via a long PrinterName property.

  • CVE-2009-2376Jul 8, 2009
    Tangocms
    Tangocms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Html::textarea function in application/libraries/Html.php in TangoCMS 2.x before 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the value parameter, related to the Contact module.

  • CVE-2009-2375Jul 8, 2009
    Photo Dvd Maker
    Photo Dvd Maker
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in Photo DVD Maker 8.02, and possibly earlier versions, allows remote attackers to execute arbitrary code via a long File_Name parameter in a .pdm file. NOTE: some of these details are obtained from third party information.

  • CVE-2009-2374Jul 8, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Drupal 5.x before 5.19 and 6.x before 6.13 does not properly sanitize failed login attempts for pages that contain a sortable table, which includes the username and password in links that can be read from (1) the HTTP referer header of external web sites that are visited from…

  • CVE-2009-2373Jul 8, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-2372Jul 8, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via…

  • CVE-2009-2371Jul 8, 2009
    Drupal
    Advanced Forum
    risk 0.00cvss —epss 0.01

    Advanced Forum 6.x before 6.x-1.1, a module for Drupal, does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script,…

  • CVE-2009-2370Jul 8, 2009
    Drupal
    Advanced Forum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Advanced Forum 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-2369Jul 8, 2009
    Wxwidgets
    Wxwidgets
    risk 0.00cvss —epss 0.03

    Integer overflow in the wxImage::Create function in src/common/image.cpp in wxWidgets 2.8.10 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted JPEG file, which triggers a heap-based buffer overflow. NOTE: the provenance of…

  • CVE-2009-2368Jul 8, 2009
    Socks Server 5
    Socks Server 5
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Socks Server 5 before 3.7.8-8 has unknown impact and attack vectors.

  • CVE-2009-2367CriJul 8, 2009
    Iomega
    Storcenter
    risk 0.69cvss 9.8epss 0.23

    cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and gain privileges via brute force guessing attacks on the session_id parameter.

  • CVE-2009-2366Jul 8, 2009
    DataCheck Solutions
    ForumPal FE
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.asp in DataCheck Solutions ForumPal FE 1.1 and ForumPal 1.5 allows remote attackers to execute arbitrary SQL commands via the (1) password parameter in 1.1 and (2) p_password parameter in 1.5. NOTE: some of these details are obtained from…

  • CVE-2009-2365Jul 8, 2009
    Datachecknh
    Gallerypal Fe
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.asp in DataCheck Solutions GalleryPal FE 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2009-2364Jul 8, 2009
    Mp3 Nator
    Mp3 Nator
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in Mp3-Nator 2.0 allows remote attackers to execute arbitrary code via (1) a long string in a .plf file and (2) a long string in the listdata.dat file, possibly related to a track entry.

  • CVE-2009-2363Jul 8, 2009
    Yukudr
    Audioplus
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.00.215 allows remote attackers to execute arbitrary code via a .pls playlist file with a playlist entry containing a long File1 argument.

  • CVE-2009-2362Jul 8, 2009
    Yukudr
    Audioplus
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.0.0.215 allows remote attackers to execute arbitrary code via a long string in a (1) .lst or (2) .m3u playlist file.

  • CVE-2009-2361Jul 8, 2009
    Osticket
    Osticket
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in include/class.staff.php in osTicket before 1.6 RC5 allows remote attackers to execute arbitrary SQL commands via the staff username parameter.

  • CVE-2009-2360Jul 8, 2009
    Horde (software)
    Passwd
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in passwd/main.php in the Passwd module before 3.1.1 for Horde allows remote attackers to inject arbitrary web script or HTML via the backend parameter.

  • CVE-2009-2359Jul 7, 2009
    TekRADIUS
    TekRADIUS
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in TekRADIUS 3.0 allow context-dependent attackers to execute arbitrary SQL commands via (1) the GUI client, as demonstrated by input to the Browse Users text box in the Users tab; or (2) the command-line client, as demonstrated by a…

  • CVE-2009-2358Jul 7, 2009
    TekRADIUS
    TekRADIUS
    risk 0.00cvss —epss 0.00

    TekRADIUS 3.0 uses BUILTIN\Users:R permissions for the TekRADIUS.ini file, which allows local users to obtain obfuscated database credentials by reading this file.

  • CVE-2009-2357Jul 7, 2009
    TekRADIUS
    TekRADIUS
    risk 0.00cvss —epss 0.02

    The default configuration of TekRADIUS 3.0 uses the sa account to communicate with Microsoft SQL Server, which makes it easier for remote attackers to obtain privileged access to the database and the underlying Windows operating system.

  • CVE-2009-2356Jul 7, 2009
    Nulllogic
    Groupware
    risk 0.00cvss —epss 0.04

    Multiple stack-based buffer overflows in the pgsqlQuery function in NullLogic Groupware 1.2.7, when PostgreSQL is used, might allow remote attackers to execute arbitrary code via input to the (1) POP3, (2) SMTP, or (3) web component that triggers a long SQL query.

  • CVE-2009-2355Jul 7, 2009
    Nulllogic
    Groupware
    risk 0.00cvss —epss 0.01

    The forum module in NullLogic Groupware 1.2.7 allows remote authenticated users to cause a denial of service (application crash) by specifying (1) an empty string or (2) a non-numeric string when selecting a forum, related to the fmessagelist function.

  • CVE-2009-2354Jul 7, 2009
    Nulllogic
    Groupware
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the auth_checkpass function in the login page in NullLogic Groupware 1.2.7 allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2009-2353Jul 7, 2009
    Eaccelerator
    Eaccelerator
    risk 0.00cvss —epss 0.02

    encoder.php in eAccelerator allows remote attackers to execute arbitrary code by copying a local executable file to a location under the web root via the -o option, and then making a direct request to this file, related to upload of image files.

  • CVE-2009-2352Jul 7, 2009
    Google
    Chrome
    risk 0.03cvss —epss 0.02

    Google Chrome 1.0.154.48 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh…

  • CVE-2009-2351Jul 7, 2009
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera 9.52 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a…

  • CVE-2009-2350Jul 7, 2009
    Microsoft
    Internet Explorer
    risk 0.04cvss —epss 0.14

    Microsoft Internet Explorer 6.0.2900.2180 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the…

  • CVE-2008-0020Jul 7, 2009
    Microsoft
    Windows
    risk 0.02cvss —epss 0.31

    Unspecified vulnerability in the Load method in the IPersistStreamInit interface in the Active Template Library (ATL), as used in the Microsoft Video ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1,…

  • CVE-2008-0015HigKEVJul 7, 2009
    Microsoft
    Windows
    risk 0.78cvss 8.8epss 0.77

    Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2,…

  • CVE-2009-2345Jul 7, 2009
    Clansphere
    Clansphere
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ClanSphere before 2009.0.1 allow remote attackers to execute arbitrary SQL commands via unknown parameters to the gbook module and unspecified other components.

  • CVE-2009-2344Jul 7, 2009
    Sourcefire
    3d Sensor
    risk 0.04cvss —epss 0.09

    The web-based management interfaces in Sourcefire Defense Center (DC) and 3D Sensor before 4.8.2 allow remote authenticated users to gain privileges via a $admin value for the admin parameter in an edit action to admin/user/user.cgi and unspecified other components.

  • CVE-2009-2343Jul 7, 2009
    Zoph
    Zoph
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in people.php in Zoph before 0.7.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information.

  • CVE-2009-2342Jul 7, 2009
    CMME
    Content Management Made Easy
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin.php (aka the login page) in Content Management Made Easy (CMME) before 1.22 allows remote attackers to inject arbitrary web script or HTML via the username field.

  • CVE-2009-2341Jul 7, 2009
    Opial
    Opial
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in albumdetail.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the albumid parameter.

  • CVE-2009-2340Jul 7, 2009
    Opial
    Opial
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtUserName (aka User Name) parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-2339Jul 7, 2009
    Rentventory
    Rentventory
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Rentventory allows remote attackers to execute arbitrary SQL commands via the product parameter.

  • CVE-2009-2338Jul 7, 2009
    Freewebshop
    Freewebshop
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in includes/startmodules.inc.php in FreeWebshop.org 2.2.9 R2, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang_file parameter.

  • CVE-2009-2337Jul 7, 2009
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in includes/module/book/index.inc.php in w3b|cms Gaestebuch Guestbook Module 3.0.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the spam_id parameter.

  • CVE-2008-6853Jul 7, 2009
    Netcat
    Netcat
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in modules/poll/index.php in AIST NetCat 3.0 and 3.12 allows remote attackers to execute arbitrary SQL commands via the PollID parameter.

  • CVE-2008-6852Jul 7, 2009
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.

  • CVE-2008-6851Jul 7, 2009
    PHP Link Directory
    PHP Link Directory
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in page.php in PHP Link Directory (phpLD) 3.3, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the name parameter.

  • CVE-2008-6850Jul 7, 2009
    PHP-Fusion
    Phpfusion
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in messages.php in PHP-Fusion 6.01.17 and 7.00.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-6849Jul 7, 2009
    phpGreetCards
    phpGreetCards
    risk 0.03cvss —epss 0.02

    Unrestricted file upload vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a via a link that is listed by userfiles/number_shell.php.

  • CVE-2008-6848Jul 7, 2009
    phpGreetCards
    phpGreetCards
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to inject arbitrary web script or HTML via the category parameter in a select action.

  • CVE-2009-2333Jul 5, 2009
    CMS Chainuk
    Chainuk
    risk 0.03cvss —epss 0.06

    Multiple directory traversal vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the menu parameter to admin/admin_menu.php, and the id parameter to (2) index.php and (3)…

  • CVE-2009-2332Jul 5, 2009
    Cms.tut.su
    CMS Chainuk
    risk 0.03cvss —epss 0.02

    CMS Chainuk 1.2 and earlier allows remote attackers to obtain sensitive information via (1) a crafted id parameter to index.php or (2) a nonexistent folder name in the id parameter to admin/admin_delete.php, which reveals the installation path in an error message.

  • CVE-2009-2331Jul 5, 2009
    CMS Chainuk
    Chainuk
    risk 0.03cvss —epss 0.02

    Multiple static code injection vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to inject arbitrary PHP code (1) into settings.php via the menu parameter to admin_settings.php or (2) into a content/=NUMBER.php file via the title parameter to admin_new.php.