VYPR

CVEs

385,408 total · page 6974 of 7,709

AllCriticalHighKEV
  • CVE-2009-0952Jun 2, 2009
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Buffer overflow in Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted compressed PSD image.

  • CVE-2009-0951Jun 2, 2009
    Apple Inc.
    Quicktime
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FLC compression file.

  • CVE-2009-0950Jun 2, 2009
    Apple Inc.
    iTunes
    risk 0.05cvss —epss 0.29

    Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an itms: URL with a long URL component after a colon.

  • CVE-2009-0894Jun 2, 2009
    Xvid
    Xvid
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in the decoder_create function in the initialization functionality in xvidcore/src/decoder.c in Xvid before 1.2.2, as used by Windows Media Player and other applications, allows remote attackers to execute arbitrary code via vectors involving the…

  • CVE-2009-0893Jun 2, 2009
    Xvid
    Xvid
    risk 0.01cvss —epss 0.07

    Multiple heap-based buffer overflows in xvidcore/src/decoder.c in the xvidcore library in Xvid before 1.2.2, as used by Windows Media Player and other applications, allow remote attackers to execute arbitrary code by providing a crafted macroblock (aka MBlock) number in a video…

  • CVE-2009-0188Jun 2, 2009
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie composed of a Sorenson 3 video file.

  • CVE-2009-0185Jun 2, 2009
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted MS ADPCM encoded audio data in an AVI movie file.

  • CVE-2009-1882Jun 2, 2009
    ImageMagick
    Imagemagick
    risk 0.01cvss —epss 0.07

    Integer overflow in the XMakeImage function in magick/xwindow.c in ImageMagick 6.5.2-8, and GraphicsMagick, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF file, which triggers a buffer overflow. NOTE: some of…

  • CVE-2009-1881Jun 2, 2009
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MT312 IMG-BBS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to model.php with a timestamp before 20090521.

  • CVE-2009-1880Jun 2, 2009
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MT312 REP-BBS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) model.php and (2) config.php with timestamps before 20090521.

  • CVE-2004-2764Jun 2, 2009
    Sun Corporation
    Jre
    risk 0.00cvss —epss 0.02

    Sun SDK and Java Runtime Environment (JRE) 1.4.2 through 1.4.2_04, 1.4.1 through 1.4.1_07, and 1.4.0 through 1.4.0_04 allows untrusted applets and unprivileged servlets to gain privileges and read data from other applets via unspecified vectors related to classes in the XSLT…

  • CVE-2004-2763Jun 1, 2009
    Sun Corporation
    iPlanet Web Server
    risk 0.00cvss —epss 0.02

    The default configuration of Sun ONE/iPlanet Web Server 4.1 SP1 through SP12 and 6.0 SP1 through SP5 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site…

  • CVE-2003-1573Jun 1, 2009
    PointBase
    PointBase
    risk 0.00cvss —epss 0.05

    The PointBase 4.6 database component in the J2EE 1.4 reference implementation (J2EE/RI) allows remote attackers to execute arbitrary programs, conduct a denial of service, and obtain sensitive information via a crafted SQL statement, related to "inadequate security settings and…

  • CVE-2003-1572Jun 1, 2009
    Sun Corporation
    Jmf
    risk 0.00cvss —epss 0.02

    Sun Java Media Framework (JMF) 2.1.1 through 2.1.1c allows unsigned applets to cause a denial of service (JVM crash) and read or write unauthorized memory locations via the ReadEnv class, as demonstrated by reading environment variables using modified .data and .size fields.

  • CVE-2009-1854Jun 1, 2009
    Cmsnx
    Million Dollar Text Links
    risk 0.03cvss —epss 0.02

    Million Dollar Text Links 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the userid cookie to 1.

  • CVE-2009-1853Jun 1, 2009
    Kenseiboard
    Kensei Board
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Kensei Board 2.0 BETA (aka 2.0.0b) and earlier allow remote attackers to execute arbitrary SQL commands via the (1) f and (2) t parameters in a showforum action.

  • CVE-2009-1852Jun 1, 2009
    Graphiks
    Myforum
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Graphiks MyForum 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.

  • CVE-2009-1851Jun 1, 2009
    Benjamin Curtis
    Phpbugtracker
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in include.php in phpBugTracker 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2009-1850Jun 1, 2009
    Benjamin Curtis
    Phpbugtracker
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in phpBugTracker 1.0.3 allows remote attackers to execute arbitrary SQL commands via the password parameter.

  • CVE-2009-1849Jun 1, 2009
    Paessler
    Prtg Traffic Grapher6.0.5.416
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Monitor_Bandwidth function in PRTG Traffic Grapher 6.2.2.977 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-1848Jun 1, 2009
    Joomlame
    Com Agoragroup
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JoomlaMe AgoraGroups (aka AG or com_agoragroup) component 0.3.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a groupdetail action to index.php.

  • CVE-2009-1847Jun 1, 2009
    Easypx41
    Easy Px 41 CMS
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in Easy PX 41 CMS 9.0 B1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the fiche parameter.

  • CVE-2009-1846Jun 1, 2009
    Bj Sintay
    Sitex
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in SiteX 0.7.4 Build 418 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the THEME_FOLDER parameter to (1) Corporate/homepage.php, (2) Fusion/homepage.php, (3) Joombo/homepage.php,…

  • CVE-2009-1845Jun 1, 2009
    Lussumo
    Vanilla
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ajax/updatecheck.php in Lussumo Vanilla 1.1.5 and 1.1.7 allows remote attackers to inject arbitrary web script or HTML via the RequestName parameter.

  • CVE-2009-1805Jun 1, 2009
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the VMware Descheduled Time Accounting driver in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, VMware Server 1.x before 1.0.9 build 156507 and 2.x before 2.0.1 build 156745, VMware Fusion 2.x…

  • CVE-2008-6819Jun 1, 2009
    Microsoft
    Windows
    risk 0.00cvss —epss 0.01

    win32k.sys in Microsoft Windows Server 2003 and Vista allows local users to cause a denial of service (system crash) via vectors related to CreateWindow, TranslateMessage, and DispatchMessage, possibly a race condition between threads, a different vulnerability than…

  • CVE-2009-1844Jun 1, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.18 and 6.x before 6.12 allow (1) remote authenticated users to inject arbitrary web script or HTML via crafted UTF-8 byte sequences that are treated as UTF-7 by Internet Explorer 6 and 7, which are not…

  • CVE-2009-1843Jun 1, 2009
    Flash Quiz
    Flash Quiz
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Flash Quiz Beta 2 allow remote attackers to execute arbitrary SQL commands via the (1) quiz parameter to (a) num_questions.php, (b) answers.php, (c) high_score.php, (d) high_score_web.php, (e) results_table_web.php, and (f) question.php;…

  • CVE-2009-1842Jun 1, 2009
    Warpspeed
    PHP Nuke
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in main/tracking/userLog.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header.

  • CVE-2008-6818Jun 1, 2009
    Mole Group
    Real Estate Script
    risk 0.00cvss —epss 0.01

    Mole Group Real Estate Script 1.1 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-6817Jun 1, 2009
    Mole Group
    Lastminute Script
    risk 0.00cvss —epss 0.01

    Mole Group Lastminute Script 4.0 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2009-1831May 29, 2009
    Nullsoft
    Winamp
    risk 0.06cvss —epss 0.36

    The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute arbitrary code via a crafted MAKI file, which triggers an incorrect sign extension, an integer overflow, and a stack-based buffer overflow.

  • CVE-2009-1830May 29, 2009
    Soulseek
    Soulseek
    risk 0.04cvss —epss 0.09

    Stack-based buffer overflow in Soulseek 156 and 157 NS allows remote attackers to execute arbitrary code via a long search query.

  • CVE-2009-1829May 29, 2009
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PCNFSD dissector in Wireshark 0.8.20 through 1.0.7 allows remote attackers to cause a denial of service (crash) via crafted PCNFSD packets.

  • CVE-2009-1828May 29, 2009
    Mozilla Corporation
    Firefox
    risk 0.04cvss —epss 0.09

    Mozilla Firefox 3.0.10 allows remote attackers to cause a denial of service (infinite loop, application hang, and memory consumption) via a KEYGEN element in conjunction with (1) a META element specifying automatic page refresh or (2) a JavaScript onLoad event handler for a BODY…

  • CVE-2009-1827May 29, 2009
    Mozilla Corporation
    Firefox
    risk 0.03cvss —epss 0.04

    The SVG component in Mozilla Firefox 3.0.4 allows remote attackers to cause a denial of service (application hang) via a large value in the r (aka Radius) attribute of a circle element, related to an "unclamped loop."

  • CVE-2009-1826May 29, 2009
    Collector
    Mygesuad
    risk 0.03cvss —epss 0.02

    modules/admuser.php in myGesuad 0.9.14 (aka 0.9) does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action.

  • CVE-2009-1825May 29, 2009
    Collector
    Mycolex
    risk 0.03cvss —epss 0.02

    modules/admuser.php in myColex 1.4.2 does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action.

  • CVE-2009-1824May 29, 2009
    Arcabit
    Arcavir 2009 Antivirus Protection
    risk 0.03cvss —epss 0.01

    The ps_drv.sys kernel driver in ArcaBit ArcaVir 2009 Antivirus Protection 9.4.3201.9 and earlier, ArcaVir 2009 Internet Security 9.4.3202.9 and earlier, ArcaVir 2009 System Protection 9.4.3203.9 and earlier, and ArcaBit 2009 Home Protection 9.4.3204.9 and earlier, allows local…

  • CVE-2009-1792May 29, 2009
    Stonetrip
    S3dplayer Standalone
    risk 0.00cvss —epss 0.04

    The system.openURL function in StoneTrip Ston3D StandalonePlayer (aka S3DPlayer StandAlone) 1.6.2.4 and 1.7.0.1 and WebPlayer (aka S3DPlayer Web) 1.6.0.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the first argument (the sURL argument).

  • CVE-2009-1537HigKEVMay 29, 2009
    Microsoft
    Windows 2000
    risk 0.73cvss 8.8epss 0.51

    Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime…

  • CVE-2009-1823May 29, 2009
    Drupal
    Print
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.7 and 6.x before 6.x-1.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML by modifying a document head, before the…

  • CVE-2009-1822May 29, 2009
    InterJoomla
    ArtForms
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) imgcaptcha.php or (2) mp3captcha.php in…

  • CVE-2009-1821May 29, 2009
    Dmxready
    Registration Manager
    risk 0.03cvss —epss 0.03

    DMXReady Registration Manager 1.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for databases/webblogmanager.mdb.

  • CVE-2009-1820May 29, 2009
    2daybiz
    Custom T Shirt Design Script
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in product.php in 2daybiz Custom T-shirt Design Script allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2009-1819May 29, 2009
    2daybiz
    Custom T Shirt Design Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in product.php in 2daybiz Custom T-shirt Design Script allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-1818May 29, 2009
    Maxcms
    Maxcms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/admin_manager.asp in MaxCMS 2.0 allows remote attackers to execute arbitrary SQL commands via an m_username cookie in an add action.

  • CVE-2009-1817May 29, 2009
    DigiMode
    Maya
    risk 0.03cvss —epss 0.06

    Multiple buffer overflows in DigiMode Maya 1.0.2 allow remote attackers to execute arbitrary code via a long string in a malformed (1) .m3u or (2) .m3l playlist file.

  • CVE-2009-1816May 29, 2009
    Mygamescript
    My Game Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin.php in My Game Script 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter (aka the username field). NOTE: some of these details are obtained from third party information.

  • CVE-2009-1815May 29, 2009
    Sonicspot
    Audioactive Player
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in Sonic Spot Audioactive Player 1.93b allows remote attackers to execute arbitrary code via a long string in a playlist file, as demonstrated by a long .mp3 URL in a .m3u file.