VYPR

CVEs

385,195 total · page 6982 of 7,704

AllCriticalHighKEV
  • CVE-2009-1316Apr 17, 2009
    AbleSpace
    AbleSpace
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in AbleSpace 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to events_view.php and the (2) id parameter to events_clndr_view.php.

  • CVE-2009-1315Apr 17, 2009
    AbleSpace
    AbleSpace
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in AbleSpace 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) gid parameter to groups_profile.php, (2) cat_id and (3) razd_id parameters to adv_cat.php, and the (4) URL to blogs_full.php.

  • CVE-2008-6726Apr 17, 2009
    Cmscout
    Cmscout
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in CMScout 2.06, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the bit parameter to (1) admin.php and (2) index.php, different vectors than CVE-2008-3415.

  • CVE-2008-6725Apr 17, 2009
    Cmscout
    Cmscout
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) index.php in a mythings page (mythings.php) and (2) the users page in admin.php.

  • CVE-2008-6724Apr 17, 2009
    Perl Nopaste
    Perl Nopaste
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.pl in Perl Nopaste 1.0 allows remote attackers to inject arbitrary web script or HTML via the language parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2009-1314Apr 17, 2009
    Webfileexplorer
    Web File Explorer
    risk 0.04cvss —epss 0.10

    body.asp in Web File Explorer 3.1 allows remote attackers to create arbitrary files and execute arbitrary code via the savefile action with a file parameter containing a filename that has an executable extension.

  • CVE-2009-0946Apr 17, 2009
    FreeType
    Freetype
    risk 0.01cvss —epss 0.09

    Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.

  • CVE-2008-1107Apr 17, 2009
    Danske Bank
    Danskesikker.ocx
    risk 0.00cvss —epss 0.05

    Multiple stack-based buffer overflows in the Danske Bank e-Sec Control Module ActiveX control (DanskeSikker.ocx) 3.1.0.48, and possibly earlier versions, allow remote attackers to execute arbitrary code via long arguments to unspecified methods, which are not properly handled by…

  • CVE-2009-1301Apr 16, 2009
    risk 0.00cvss —epss 0.05

    Integer signedness error in the store_id3_text function in the ID3v2 code in mpg123 before 1.7.2 allows remote attackers to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via an ID3 tag with a negative encoding value. NOTE: some of…

  • CVE-2009-1300Apr 16, 2009
    Debian
    Apt
    risk 0.00cvss —epss 0.02

    apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.

  • CVE-2009-1294Apr 16, 2009
    Novell
    Teaming
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in web/guest/home in the Liferay 4.3.0 portal in Novell Teaming 1.0 through SP3 (1.0.3) allow remote attackers to inject arbitrary web script or HTML via the (1) p_p_state or (2) p_p_mode parameters.

  • CVE-2009-1293Apr 16, 2009
    Novell
    Teaming
    risk 0.00cvss —epss 0.02

    The web login functionality (c/portal/login) in Novell Teaming 1.0 through SP3 (1.0.3) generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames.

  • CVE-2009-1285Apr 16, 2009
    PhpMyAdmin
    phpMyAdmin
    risk 0.04cvss —epss 0.11

    Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files.

  • CVE-2009-0579Apr 16, 2009
    Linux Pam
    Linux Pam
    risk 0.00cvss —epss 0.00

    Linux-PAM before 1.0.4 does not enforce the minimum password age (MINDAYS) as specified in /etc/shadow, which allows local users to bypass intended security policy and change their passwords sooner than specified.

  • CVE-2009-0196Apr 16, 2009
    Artifex
    Ghostscript
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2 decoding library (jbig2dec) in Ghostscript 8.64, and probably earlier versions, allows remote attackers to execute arbitrary code via a PDF file with a JBIG2 symbol dictionary…

  • CVE-2008-5259Apr 16, 2009
    Divx
    Web Player
    risk 0.00cvss —epss 0.06

    Integer signedness error in DivX Web Player 1.4.2.7, and possibly earlier versions, allows remote attackers to execute arbitrary code via a DivX file containing a crafted Stream Format (STRF) chunk, which triggers a heap-based buffer overflow.

  • CVE-2008-4830Apr 16, 2009
    SAP
    KWEdit ActiveX control
    risk 0.05cvss —epss 0.28

    Insecure method vulnerability in the KWEdit ActiveX control in SAP GUI 6.40 Patch 29 (KWEDIT.DLL 6400.1.1.41) and 7.10 Patch 5 (KWEDIT.DLL 7100.1.1.43) allows remote attackers to (1) overwrite arbitrary files via the SaveDocumentAs method or (2) read or execute arbitrary files…

  • CVE-2007-2238Apr 16, 2009
    Microsoft
    Whale Client Components ActiveX control
    risk 0.07cvss —epss 0.46

    Multiple stack-based buffer overflows in the Whale Client Components ActiveX control (WhlMgr.dll), as used in Microsoft Intelligent Application Gateway (IAG) before 3.7 SP2, allow remote attackers to execute arbitrary code via long arguments to the (1) CheckForUpdates or (2)…

  • CVE-2009-1119Apr 15, 2009
    EMC Corporation
    Replistor
    risk 0.00cvss —epss 0.05

    Multiple heap-based buffer overflows in EMC RepliStor 6.2 before SP5 and 6.3 before SP2 allow remote attackers to execute arbitrary code via a crafted message to (1) ctrlservice.exe or (2) rep_srv.exe, possibly related to an integer overflow.

  • CVE-2009-1017Apr 15, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, 10.1.3.3.3, and 10.1.3.4 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2009-0994.

  • CVE-2009-1016Apr 15, 2009
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote authenticated users to affect confidentiality, integrity, and availability, related to IIS. NOTE: the previous information was…

  • CVE-2009-1014Apr 15, 2009
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.19 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-1013.

  • CVE-2009-1013Apr 15, 2009
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.19 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-1014.

  • CVE-2009-1012Apr 15, 2009
    Oracle Corporation
    BEA WebLogic Server
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the plug-ins for Apache and IIS web servers in Oracle BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP3, 10.0 Gold through MP1, and 10.3 allows remote attackers to affect confidentiality, integrity, and…

  • CVE-2009-1011Apr 15, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML. NOTE: the previous information was obtained from the April 2009 CPU. Oracle…

  • CVE-2009-1010Apr 15, 2009
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML, a different vulnerability than CVE-2009-1008.

  • CVE-2009-1009Apr 15, 2009
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.1.9 allows local users to affect confidentiality, integrity, and availability, related to HTML.

  • CVE-2009-1008Apr 15, 2009
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML, a different vulnerability than CVE-2009-1010.

  • CVE-2009-1006Apr 15, 2009
    Bea
    BEA Product Suite
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the JRockit component in BEA Product Suite R27.6.2 and earlier, with SDK/JRE 1.4.2, JRE/JDK 5, and JRE/JDK 6, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

  • CVE-2009-1005Apr 15, 2009
    Oracle Corporation
    Bea Product Suite
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Oracle Data Service Integrator (AquaLogic Data Services Platform) component in BEA Product Suite 10.3.0, 3.2, 3.0.1, and 3.0 allows local users to affect confidentiality, integrity, and availability via unknown vectors.

  • CVE-2009-1004Apr 15, 2009
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3 allows remote attackers to affect confidentiality and integrity via unknown vectors.

  • CVE-2009-1003Apr 15, 2009
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, and 9.0 allows remote attackers to affect integrity via unknown vectors related to "access to source code of web pages."

  • CVE-2009-1002Apr 15, 2009
    Oracle Corporation
    BEA WebLogic Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Oracle BEA WebLogic Server 10.3, 10.0 Gold through MP1, 9.2 Gold through MP3, 9.1, 9.0, 8.1 Gold through SP6, and 7.0 Gold through SP7 allows remote attackers to gain privileges via unknown vectors.

  • CVE-2009-1001Apr 15, 2009
    Oracle Corporation
    Weblogic Portal
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Oracle BEA WebLogic Portal 8.1 Gold through SP6 allows remote authenticated users to gain privileges via unknown vectors.

  • CVE-2009-1000Apr 15, 2009
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.02

    The Oracle Applications Framework component in Oracle E-Business Suite 12.0.6 and 11i10CU2 uses default passwords for unspecified "FND Applications Users (not DB users)," which has unknown impact and attack vectors.

  • CVE-2009-0999Apr 15, 2009
    Oracle Corporation
    Application Object Library
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

  • CVE-2009-0998Apr 15, 2009
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the PeopleSoft Enterprise HRMS - eBenefits component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9.18 and 9.0.8 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

  • CVE-2009-0997Apr 15, 2009
    Oracle Corporation
    Database Vault
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Database Vault component in Oracle Database 11.1.0.6 allows remote authenticated users to affect confidentiality, related to DBMS_SYS_SQL.

  • CVE-2009-0996Apr 15, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the BI Publisher component in Oracle Application Server 10.1.3.2.1, 10.1.3.3.3, and 10.1.3.4 allows remote authenticated users to affect confidentiality via unknown vectors.

  • CVE-2009-0995Apr 15, 2009
    Oracle Corporation
    Applications Framework
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.0.6 and 11i10CU2 allows remote attackers to affect integrity via unknown vectors.

  • CVE-2009-0994Apr 15, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, 10.1.3.3.3, and 10.1.3.4 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2009-1017.

  • CVE-2009-0993Apr 15, 2009
    Oracle Corporation
    Application Server
    risk 0.01cvss —epss 0.08

    Unspecified vulnerability in the OPMN component in Oracle Application Server 10.1.2.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not…

  • CVE-2009-0992Apr 15, 2009
    Oracle Corporation
    Database 10g
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Advanced Queuing component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote authenticated users to affect confidentiality and integrity, related to DBMS_AQIN. NOTE: the previous information was obtained from the April 2009 CPU.…

  • CVE-2009-0991Apr 15, 2009
    Oracle Corporation
    Database 9i
    risk 0.04cvss —epss 0.16

    Unspecified vulnerability in the Listener component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote attackers to affect availability via unknown vectors, a different vulnerability than CVE-2009-1970.

  • CVE-2009-0990Apr 15, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, and 10.1.3.3.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-0989.

  • CVE-2009-0989Apr 15, 2009
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, and 10.1.3.3.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-0990.

  • CVE-2009-0988Apr 15, 2009
    Oracle Corporation
    Password Policy
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Password Policy component in Oracle Database 11.1.0.6 allows remote authenticated users to affect confidentiality via unknown vectors.

  • CVE-2009-0986Apr 15, 2009
    Oracle Corporation
    Database 10g
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 and 11.1.0.6 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.

  • CVE-2009-0985Apr 15, 2009
    Oracle Corporation
    Core Rdbms
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Core RDBMS component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.6 allows remote authenticated users with the IMP_FULL_DATABASE role to affect confidentiality, integrity, and availability.

  • CVE-2009-0984Apr 15, 2009
    Oracle Corporation
    Database Vault
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Database Vault component in Oracle Database 9.2.0.8DV, 10.2.0.4, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to DBMS_SYS_SQL.