VYPR

CVEs

385,452 total · page 6965 of 7,710

AllCriticalHighKEV
  • CVE-2009-2330Jul 5, 2009
    CMS Chainuk
    Chainuk
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/admin_menu.php in CMS Chainuk 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the menu parameter.

  • CVE-2009-2329Jul 5, 2009
    KerviNet
    Forum
    risk 0.03cvss —epss 0.02

    KerviNet Forum 1.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) admin/head.php, or (2) voting_diagram.php, (3) voting.php, (4) topics_search.php, (5) topics_list.php, (6) top_part.php, (7) quick_search.php, (8) quick_reply.php,…

  • CVE-2009-2328Jul 5, 2009
    KerviNet
    Forum
    risk 0.03cvss —epss 0.01

    admin/edit_user.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remote attackers to delete arbitrary accounts and conduct SQL injection attacks via the del_user_id parameter.

  • CVE-2009-2327Jul 5, 2009
    KerviNet
    Forum
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in add_voting.php in KerviNet Forum 1.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the v_variant1 parameter.

  • CVE-2009-2326Jul 5, 2009
    KerviNet
    Forum
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in KerviNet Forum 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) an enter_parol cookie to index.php in an auto action or (2) the topic parameter to message.php. NOTE: vector 2 can be leveraged for a…

  • CVE-2009-2325Jul 5, 2009
    Clicknet
    Clicknet CMS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in Clicknet CMS 2.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the side parameter.

  • CVE-2009-2324Jul 5, 2009
    Fckeditor
    Fckeditor
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to inject arbitrary web script or HTML via components in the samples (aka _samples) directory.

  • CVE-2009-2323Jul 5, 2009
    Axesstel
    Mv 410r
    risk 0.00cvss —epss 0.01

    The web interface on the Axesstel MV 410R redirects users back to the referring page after execution of some CGI scripts, which makes it easier for remote attackers to avoid detection of cross-site request forgery (CSRF) attacks, as demonstrated by a redirect from the…

  • CVE-2009-2322Jul 5, 2009
    Axesstel
    Mv 410r
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-2321Jul 5, 2009
    Axesstel
    Mv 410r
    risk 0.00cvss —epss 0.02

    cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to cause a denial of service (configuration reset) via a RESTORE=RESTORE query string.

  • CVE-2009-2320Jul 5, 2009
    Axesstel
    Mv 410r
    risk 0.00cvss —epss 0.01

    The web interface on the Axesstel MV 410R relies on client-side JavaScript code to validate input, which allows remote attackers to send crafted data, and possibly have unspecified other impact, via a client that does not process JavaScript.

  • CVE-2009-2319Jul 5, 2009
    Axesstel
    Mv 410r
    risk 0.00cvss —epss 0.01

    The default configuration of the Wi-Fi component on the Axesstel MV 410R does not use encryption, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2009-2318Jul 5, 2009
    Axesstel
    Mv 410r
    risk 0.00cvss —epss 0.01

    The Axesstel MV 410R allows remote attackers to cause a denial of service via a flood of SYN packets, a related issue to CVE-1999-0116.

  • CVE-2009-2317Jul 5, 2009
    Axesstel
    Mv 410r
    risk 0.00cvss —epss 0.02

    The Axesstel MV 410R has a certain default administrator password, and does not force a password change, which makes it easier for remote attackers to obtain access.

  • CVE-2009-2316Jul 5, 2009
    IBM
    Tivoli Identity Manager
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Identity Manager (ITIM) 5.0 allow remote attackers to inject arbitrary web script or HTML by entering an unspecified URL in (1) the self-service UI interface or (2) the console interface. NOTE: it was later…

  • CVE-2009-2314Jul 5, 2009
    Sun Corporation
    Lightweight Availability Collection Tool
    risk 0.00cvss —epss 0.00

    Race condition in the Sun Lightweight Availability Collection Tool 3.0 on Solaris 7 through 10 allows local users to overwrite arbitrary files via unspecified vectors.

  • CVE-2009-2295Jul 5, 2009
    CamlImages
    CamlImages
    risk 0.00cvss —epss 0.03

    Multiple integer overflows in CamlImages 2.2 and earlier might allow context-dependent attackers to execute arbitrary code via a crafted PNG image with large width and height values that trigger a heap-based buffer overflow in the (1) read_png_file or (2) read_png_file_as_rgb24…

  • CVE-2009-2294Jul 5, 2009
    Dillo
    Dillo
    risk 0.00cvss —epss 0.03

    Integer overflow in the Png_datainfo_callback function in Dillo 2.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG image with crafted (1) width or (2) height values.

  • CVE-2009-2265Jul 5, 2009
    Fckeditor
    Fckeditor
    risk 0.10cvss —epss 0.84

    Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution…

  • CVE-2009-1890Jul 5, 2009
    Apache
    HTTP Server
    risk 0.01cvss —epss 0.16

    The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to…

  • CVE-2009-1648Jul 5, 2009
    SUSE S.A.
    Linux
    risk 0.00cvss —epss 0.02

    The YaST2 LDAP module in yast2-ldap-server on SUSE Linux Enterprise Server 11 (aka SLE11) does not enable the firewall in certain circumstances involving reboots during online updates, which makes it easier for remote attackers to access network services.

  • CVE-2009-1388MedJul 5, 2009
    Linux
    Kernel
    risk 0.36cvss 5.5epss 0.00

    The ptrace_start function in kernel/ptrace.c in the Linux kernel 2.6.18 does not properly handle simultaneous execution of the do_coredump function, which allows local users to cause a denial of service (deadlock) via vectors involving the ptrace system call and a coredumping…

  • CVE-2009-0904Jul 5, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    The IBM Stax XMLStreamWriter in the Web Services component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 does not properly process XML encoding, which allows remote attackers to bypass intended access restrictions and possibly modify data via "XML fuzzing…

  • CVE-2007-6728Jul 5, 2009
    XMB
    XMB
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in XMB 1.5 allows remote attackers to inject arbitrary web script or HTML via the MSN field during user registration.

  • CVE-2007-6727Jul 5, 2009
    KerviNet
    Forum
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in topic.php in KerviNet Forum 1.1 allows remote attackers to execute arbitrary SQL commands via the forum parameter.

  • CVE-2009-2313Jul 2, 2009
    Jinzora
    Jinzora
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in Jinzora Media Jukebox 2.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter.

  • CVE-2009-2312Jul 2, 2009
    SmartFilter
    Web Gateway Security
    risk 0.00cvss —epss 0.00

    SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in config.txt and uses insecure permissions for this file, which allows local users to gain privileges.

  • CVE-2009-2311Jul 2, 2009
    Rgallery
    Rgallery Plugin
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the rGallery plugin 1.2.3 for WoltLab Burning Board (WBB3) allows remote attackers to execute arbitrary SQL commands via the userID parameter in the RGalleryUserGallery page to index.php, a different vector than CVE-2008-4627.

  • CVE-2009-2310Jul 2, 2009
    Extensible BioLawCom
    X-BLC
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in include/get_read.php in Extensible-BioLawCom CMS (X-BLC) 0.2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the section parameter.

  • CVE-2009-2309Jul 2, 2009
    Codice CMS
    Codice CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Codice CMS 2 allows remote attackers to execute arbitrary SQL commands via the tag parameter.

  • CVE-2009-2308Jul 2, 2009
    Punres
    Affiliates Mod
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier for PunBB allow remote attackers to execute arbitrary SQL commands via the (1) in or (2) out parameter.

  • CVE-2009-2307Jul 2, 2009
    Maxdev
    Cwguestbook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the CWGuestBook module 2.1 and earlier for MAXdev MDPro (aka MD-Pro) allows remote attackers to execute arbitrary SQL commands via the rid parameter in a viewrecords action to modules.php.

  • CVE-2009-2306Jul 2, 2009
    Armassa
    Ard 9808
    risk 0.03cvss —epss 0.02

    The ARD-9808 DVR card security camera stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing usernames and passwords via a direct request for dvr.ini.

  • CVE-2009-2305Jul 2, 2009
    ARD
    ARD-9808 DVR card
    risk 0.03cvss —epss 0.02

    The ARD-9808 DVR card security camera allows remote attackers to cause a denial of service via a long URI composed of //.\ (slash slash dot backslash) sequences.

  • CVE-2009-2304Jul 2, 2009
    Aardvark
    Topsites
    risk 0.00cvss —epss 0.01

    index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to obtain sensitive information via a nonexistent account name in the u parameter in a rate action, which reveals the installation path in an error message.

  • CVE-2009-2303Jul 2, 2009
    Aardvark
    Aardvark Topsites PHP
    risk 0.00cvss —epss 0.01

    index.php in Aardvark Topsites PHP 5.2.1 and earlier allows remote attackers to obtain sensitive information via a negative integer value for the start parameter in a search action, which reveals the installation path in an error message.

  • CVE-2009-2302Jul 2, 2009
    Avatic
    Aardvark Topsites PHP
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action. NOTE: it was later reported that 5.2.1 is also affected.

  • CVE-2009-2301Jul 2, 2009
    Radware
    Gateway
    risk 0.00cvss —epss 0.01

    The radware AppWall Web Application Firewall (WAF) 1.0.2.6, with Gateway 4.6.0.2, allows remote attackers to read source code via a direct request to (1) funcs.inc, (2) defines.inc, or (3) msg.inc in Management/.

  • CVE-2009-2300Jul 2, 2009
    Phion
    Airlock Web Application Firewall
    risk 0.00cvss —epss 0.03

    The management interface in the phion airlock Web Application Firewall (WAF) 4.1-10.41 does not properly handle CGI requests that specify large width and height parameters for an image, which allows remote attackers to execute arbitrary commands or cause a denial of service…

  • CVE-2009-2299Jul 2, 2009
    Artofdefence
    Hyperguard
    risk 0.00cvss —epss 0.04

    The Artofdefence Hyperguard Web Application Firewall (WAF) module before 2.5.5-11635, 3.0 before 3.0.3-11636, and 3.1 before 3.1.1-11637, a module for the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via an HTTP request with a…

  • CVE-2009-2298Jul 2, 2009
    Microfocus
    OpenView Network Node Manager
    risk 0.01cvss —epss 0.06

    Stack-based buffer overflow in rping in HP OpenView Network Node Manager (OV NNM) 7.53 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, possibly involving a CGI request to webappmon.exe. NOTE: this may overlap CVE-2009-1420.

  • CVE-2009-2297Jul 2, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the udp subsystem in the kernel in Sun Solaris 10, and OpenSolaris snv_90 through snv_108, when Solaris Trusted Extensions is enabled, allows remote attackers to cause a denial of service (panic) via unspecified vectors involving the crgetlabel…

  • CVE-2009-2296Jul 2, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.04

    The NFSv4 server kernel module in Sun Solaris 10, and OpenSolaris before snv_119, does not properly implement the nfs_portmon setting, which allows remote attackers to access shares, and read, create, and modify arbitrary files, via unspecified vectors.

  • CVE-2009-1421Jul 2, 2009
    Microfocus
    Oncplus
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in NFS / ONCplus B.11.31_06 and B.11.31_07 on HP HP-UX B.11.31 allows local users to cause a denial of service via unknown attack vectors.

  • CVE-2008-6847Jul 2, 2009
    Pre ASP
    Job Board
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Employee/emp_login.asp in Pre ASP Job Board allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2008-6846Jul 2, 2009
    Avast\!
    Linux Home Edition
    risk 0.00cvss —epss 0.04

    Multiple stack-based buffer overflows in avast! Linux Home Edition 1.0.5, 1.0.5-1, and 1.0.8 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via a malformed (1) ISO or (2) RPM file.

  • CVE-2008-6845Jul 2, 2009
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.02

    The unpack feature in ClamAV 0.93.3 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a corrupted LZH file.

  • CVE-2008-6844Jul 2, 2009
    Ez
    Ez Publish
    risk 0.03cvss —epss 0.03

    The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before 3.9.5, 3.10.1, and 4.0.1, allows remote attackers to gain privileges as other users via modified ContentObjectAttribute_data_user_login_30,…

  • CVE-2008-6843Jul 2, 2009
    CPanel
    Cpanel
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in index.php in Fantastico, as used with cPanel 11.x, allows remote attackers to read arbitrary files via a .. (dot dot) in the sup3r parameter.

  • CVE-2008-6842Jul 2, 2009
    Pluck
    Pluck
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in data/modules/blog/module_pages_site.php in Pluck 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the post parameter.