VYPR

CVEs

384,910 total · page 6983 of 7,699

AllCriticalHighKEV
  • CVE-2008-3871Apr 1, 2009
    Ezbsystems
    Ultraiso
    risk 0.00cvss —epss 0.03

    Multiple format string vulnerabilities in UltraISO 9.3.1.2633, and possibly other versions before 9.3.3.2685, allow user-assisted attackers to execute arbitrary code via format string specifiers in the filename of a (1) DAA or (2) ISZ file.

  • CVE-2009-1215Apr 1, 2009
    GNU
    Screen
    risk 0.00cvss —epss 0.00

    Race condition in GNU screen 4.0.3 allows local users to create or overwrite arbitrary files via a symlink attack on the /tmp/screen-exchange temporary file.

  • CVE-2009-1214Apr 1, 2009
    GNU
    Screen
    risk 0.00cvss —epss 0.00

    GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with world-readable permissions, which might allow local users to obtain sensitive session information.

  • CVE-2009-1213Apr 1, 2009
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authentication of arbitrary users for requests that use attachment editing.

  • CVE-2009-1212Apr 1, 2009
    Precisionid Barcode
    Data Matrix Barcode Activex Control
    risk 0.03cvss —epss 0.06

    Multiple insecure method vulnerabilities in PRECIS~2.DLL in the PrecisionID Datamatrix ActiveX control (DMATRIXLib.Datamatrix) allow remote attackers to overwrite arbitrary files via the (1) SaveBarCode and (2) SaveEnhWMF methods.

  • CVE-2009-1211Apr 1, 2009
    Bluecoat
    Proxysg
    risk 0.00cvss —epss 0.01

    Blue Coat ProxySG, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with…

  • CVE-2009-1210Apr 1, 2009
    Wireshark
    Wireshark
    risk 0.04cvss —epss 0.15

    Format string vulnerability in the PROFINET/DCP (PN-DCP) dissector in Wireshark 1.0.6 and earlier allows remote attackers to execute arbitrary code via a PN-DCP packet with format string specifiers in the station name. NOTE: some of these details are obtained from third party…

  • CVE-2009-1209Apr 1, 2009
    risk 0.04cvss —epss 0.12

    Stack-based buffer overflow in W3C Amaya Web Browser 11.1 allows remote attackers to execute arbitrary code via a script tag with a long defer attribute.

  • CVE-2009-1208Apr 1, 2009
    Auth2dbauth2db
    Auth2db
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in auth2db 0.2.5, and possibly other versions before 0.2.7, uses the addslashes function instead of the mysql_real_escape_string function, which allows remote attackers to conduct SQL injection attacks using multibyte character encodings.

  • CVE-2009-1207Apr 1, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Race condition in the dircmp script in Sun Solaris 8 through 10, and OpenSolaris snv_01 through snv_111, allows local users to overwrite arbitrary files, probably involving a symlink attack on temporary files.

  • CVE-2009-1206Apr 1, 2009
    Futomi
    Cgi Cafe Access Analyzer Cgi
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in futomi's CGI Cafe Access Analyzer CGI Professional Version 4.11.5 and earlier allows remote attackers to gain administrative privileges via unknown vectors.

  • CVE-2009-0790Apr 1, 2009
    Strongswan
    Strongswan
    risk 0.00cvss —epss 0.03

    The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted (1) R_U_THERE or (2) R_U_THERE_ACK…

  • CVE-2009-0686Apr 1, 2009
    Trend Micro
    Internet Pro
    risk 0.03cvss —epss 0.01

    The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro 2008 and 2009, and Security Pro 2008 and 2009, allows local users to gain privileges via a crafted IRP in a METHOD_NEITHER IOCTL request to \Device\tmactmon that overwrites memory.

  • CVE-2009-1204Apr 1, 2009
    Tiki
    Tiki
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in TikiWiki (Tiki) CMS/Groupware 2.2 allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF portion of a URI to (1) tiki-galleries.php, (2) tiki-list_file_gallery.php, (3) tiki-listpages.php, and (4)…

  • CVE-2008-6572Mar 31, 2009
    Abledating
    Abledating
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in search_results.php in ABK-Soft AbleDating 2.4 allows remote attackers to execute arbitrary SQL commands via the keyword parameter.

  • CVE-2009-1178Mar 31, 2009
    IBM
    Tivoli Storage Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the server in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.2 and 6.x before 6.1 has unknown impact and attack vectors related to the "admin command line."

  • CVE-2009-1177Mar 31, 2009
    MapServer
    Mapserver
    risk 0.00cvss —epss 0.03

    Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact and remote attack vectors.

  • CVE-2009-1176Mar 31, 2009
    MapServer
    Mapserver
    risk 0.00cvss —epss 0.04

    mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote attackers to conduct buffer-overflow attacks or have unspecified other impact via a long id parameter…

  • CVE-2009-1073MedMar 31, 2009
    Padl Software
    Nss LDAP
    risk 0.36cvss 5.5epss 0.01

    nss-ldapd before 0.6.8 uses world-readable permissions for the /etc/nss-ldapd.conf file, which allows local users to obtain a cleartext password for the LDAP server by reading the bindpw field.

  • CVE-2009-0843Mar 31, 2009
    MapServer
    Mapserver
    risk 0.00cvss —epss 0.03

    The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this…

  • CVE-2009-0842Mar 31, 2009
    MapServer
    Mapserver
    risk 0.00cvss —epss 0.03

    mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map…

  • CVE-2009-0841Mar 31, 2009
    MapServer
    Mapserver
    risk 0.00cvss —epss 0.05

    Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to create arbitrary files via a .. (dot dot) in the id parameter.

  • CVE-2009-0840Mar 31, 2009
    MapServer
    Mapserver
    risk 0.00cvss —epss 0.05

    Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impact via a negative value in the Content-Length HTTP header.

  • CVE-2009-0839Mar 31, 2009
    MapServer
    Mapserver
    risk 0.01cvss —epss 0.09

    Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when the server has a map with a long IMAGEPATH or NAME attribute, allows remote attackers to execute arbitrary code via a crafted id parameter in a query action.

  • CVE-2004-2762Mar 31, 2009
    IBM
    Tivoli Storage Manager
    risk 0.00cvss —epss 0.02

    The server in IBM Tivoli Storage Manager (TSM) 4.2.x on MVS, 5.1.9.x before 5.1.9.1, 5.1.x before 5.1.10, 5.2.2.x before 5.2.2.3, 5.2.x before 5.2.3, 5.3.x before 5.3.0, and 6.x before 6.1, when the HTTP communication method is enabled, allows remote attackers to cause a denial…

  • CVE-2003-1570Mar 31, 2009
    IBM
    Tivoli Storage Manager
    risk 0.00cvss —epss 0.01

    The server in IBM Tivoli Storage Manager (TSM) 5.1.x, 5.2.x before 5.2.1.2, and 6.x before 6.1 does not require credentials to observe the server console in some circumstances, which allows remote authenticated administrators to monitor server operations by establishing a…

  • CVE-2008-6571Mar 31, 2009
    Linpha
    Linpha
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.4 might allow remote attackers to inject arbitrary web script or HTML via (1) new_images.php, (2) login.php, and unspecified vectors.

  • CVE-2008-6570Mar 31, 2009
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the RSS reader in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via a crafted RSS feed.

  • CVE-2008-6569Mar 31, 2009
    Cybozu
    Garoon
    risk 0.00cvss —epss 0.02

    Session fixation vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack web sessions via the session ID in the login page.

  • CVE-2008-6568Mar 31, 2009
    Yehe
    Yehe
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in Yehe 2.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the envoyer feature. NOTE: the provenance of this information is unknown;…

  • CVE-2008-6567Mar 31, 2009
    Gallarific
    Gallarific
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Gallarific Free Edition allow remote attackers to inject arbitrary web script or HTML via (1) the e-mail address, (2) a comment, which is not properly handled during moderation, and (3) the tag parameter to gallery/tags.php.

  • CVE-2008-6566Mar 31, 2009
    Octopussy
    Octopussy
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Octopussy before 0.9.5.8 has unknown impact and attack vectors related to a "major security" vulnerability.

  • CVE-2008-6565Mar 31, 2009
    Invision Power Services
    Power Board
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Invision Power Board 2.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via an IFRAME tag in the signature.

  • CVE-2008-6564Mar 31, 2009
    Nortel
    Unistim Protocol
    risk 0.00cvss —epss 0.02

    Nortel UNIStim protocol, as used in Communication Server 1000 and other products, uses predictable sequence numbers, which allows remote attackers to hijack sessions via sniffing or brute force attacks.

  • CVE-2008-6563Mar 31, 2009
    Trillian
    Trillian
    risk 0.03cvss —epss 0.06

    Buffer overflow in the XML parser in Trillian 3.1.9.0, and possibly earlier, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DTD file.

  • CVE-2008-6562Mar 31, 2009
    Jack (tR) Jax LinkLists
    jax_linklists.php
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in jax_linklists.php in Jack (tR) Jax LinkLists 1.00 allows remote attackers to inject arbitrary web script or HTML via the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third…

  • CVE-2008-6561Mar 31, 2009
    Citrix Systems
    Presentation Server Client
    risk 0.00cvss —epss 0.00

    Citrix Presentation Server Client for Windows before 10.200 does not clear "credential information" from process memory in unspecified circumstances, which might allow local users to gain privileges.

  • CVE-2007-6724Mar 31, 2009
    Vidalia Project
    Vidalia Bundle
    risk 0.00cvss —epss 0.01

    Vidalia bundle before 0.1.2.18, when running on Windows, installs Privoxy with a configuration file (config.txt or config) that contains an insecure enable-remote-http-toggle setting, which allows remote attackers to bypass intended access restrictions and modify configuration.

  • CVE-2007-6723Mar 31, 2009
    TorK
    TorK
    risk 0.00cvss —epss 0.01

    TorK before 0.22, when running on Windows and Mac OS X, installs Privoxy with a configuration file (config.txt or config) that contains insecure (1) enable-remote-toggle and (2) enable-edit-actions settings, which allows remote attackers to bypass intended access restrictions…

  • CVE-2007-6722Mar 31, 2009
    Vidalia Project
    Vidalia Bundle
    risk 0.00cvss —epss 0.01

    Vidalia bundle before 0.1.2.18, when running on Windows and Mac OS X, installs Privoxy with a configuration file (config.txt or config) that contains insecure (1) enable-remote-toggle and (2) enable-edit-actions settings, which allows remote attackers to bypass intended access…

  • CVE-2006-7237Mar 31, 2009
    Ixprim
    Ixprim
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in mod/nc_phpmyadmin/core/libraries/Theme_Manager.class.php in Ixprim 2.0 allows remote attackers to execute arbitrary PHP code via a URL in an unspecified parameter. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2005-4880Mar 31, 2009
    Jax Scripts
    Jax Guestbook
    risk 0.03cvss —epss 0.02

    Jax Guestbook 3.1 and 3.31 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain IP addresses of users via a direct request to (1) guestbook, (2) guestbook_ips2block, (3) ips2block, and (4)…

  • CVE-2005-4879Mar 31, 2009
    Jax Guestbook
    jax_guestbook.php
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in jax_guestbook.php in Jax Guestbook 3.1 and 3.31 allow remote attackers to inject arbitrary web script or HTML via the (1) gmt_ofs and (2) language parameters. NOTE: the page parameter is already covered by CVE-2006-1913. …

  • CVE-2009-1175Mar 31, 2009
    Banshee Project
    Banshee
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in apps/web/vs_diag.cgi in the DAAP extension in Banshee 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the server parameter, which is not properly handled in an error message.

  • CVE-2009-1174Mar 31, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 and 7.0 before 7.0.0.3 has an unspecified "security problem" in the XML digital-signature specification, which has unknown impact and attack vectors.

  • CVE-2009-1173Mar 31, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.00

    IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3 uses weak permissions (777) for files associated with unspecified "interim fixes," which allows attackers to modify files that would not have been accessible if the intended 755 permissions were used.

  • CVE-2009-1172Mar 31, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    The JAX-RPC WS-Security runtime in the Web Services Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3, when APAR PK41002 is installed, does not properly validate UsernameToken objects, which has unknown impact and attack…

  • CVE-2009-0892Mar 31, 2009
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    The administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3 allows attackers to hijack user sessions in "specific scenarios" related to a forced logout.

  • CVE-2008-6560Mar 31, 2009
    Fedorahosted
    Cluster Manager
    risk 0.00cvss —epss 0.02

    Buffer overflow in CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9 and Red Hat Enterprise Linux (RHEL) 5 allows attackers to cause a denial of service (CPU consumption and memory corruption) via a cluster.conf file with many lines. NOTE: it is not clear whether this…

  • CVE-2009-1171Mar 30, 2009
    Moodle
    Moodle
    risk 0.03cvss —epss 0.06

    The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assisted attackers to read arbitrary files via an input command in a "$$" sequence, which causes LaTeX to include the contents of the file.