VYPR

CVEs

384,443 total · page 6995 of 7,689

AllCriticalHighKEV
  • CVE-2009-0489Feb 9, 2009
    Wicd
    Wicd
    risk 0.00cvss —epss 0.00

    The DBus configuration file for Wicd before 1.5.9 allows arbitrary users to own org.wicd.daemon, which allows local users to receive messages that were intended for the Wicd daemon, possibly including credentials.

  • CVE-2009-0488Feb 9, 2009
    Phorum
    Phorum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-0487Feb 9, 2009
    Mahara (software)
    Mahara
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Mahara before 1.0.9 allows remote attackers to inject arbitrary web script or HTML via a crafted forum post.

  • CVE-2008-6098Feb 9, 2009
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Bugzilla 3.2 before 3.2 RC2, 3.0 before 3.0.6, 2.22 before 2.22.6, 2.20 before 2.20.7, and other versions after 2.17.4 allows remote authenticated users to bypass moderation to approve and disapprove quips via a direct request to quips.cgi with the action parameter set to…

  • CVE-2009-0486Feb 9, 2009
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficiently random numbers for random tokens, which allows remote attackers to bypass cross-site request…

  • CVE-2009-0485Feb 9, 2009
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.17 to 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete unused flag types via a link or IMG tag to editflagtypes.cgi.

  • CVE-2009-0484Feb 9, 2009
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Bugzilla 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete shared or saved searches via a link or IMG tag to buglist.cgi.

  • CVE-2009-0483Feb 9, 2009
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.22 before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete keywords and user preferences via a link or IMG tag to (1) editkeywords.cgi or (2) userprefs.cgi.

  • CVE-2009-0482Feb 9, 2009
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Bugzilla before 3.2 before 3.2.1, 3.3 before 3.3.2, and other versions before 3.2 allows remote attackers to perform bug updating activities as other users via a link or IMG tag to process_bug.cgi.

  • CVE-2009-0481Feb 9, 2009
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Bugzilla 2.x before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote authenticated users to conduct cross-site scripting (XSS) and related attacks by uploading HTML and JavaScript attachments that are rendered by web browsers.

  • CVE-2008-6097Feb 9, 2009
    Wikyblog
    Wikyblog
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in WikyBlog before 1.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) key parameter to index.php/Special/Main/keywordSearch, (2) revNum parameter to index.php/Edit/Main/Home, (3) to parameter to…

  • CVE-2008-6096Feb 9, 2009
    Juniper Networks
    Screenos
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Juniper NetScreen ScreenOS before 5.4r10, 6.0r6, and 6.1r2 allows remote attackers to inject arbitrary web script or HTML via the user name parameter to the (1) web interface login page or the (2) telnet login page.

  • CVE-2008-6095Feb 9, 2009
    Opennms
    Opennms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in surveillanceView.htm in OpenNMS 1.5.94 allows remote attackers to inject arbitrary web script or HTML via the viewName parameter.

  • CVE-2008-6094Feb 9, 2009
    Celoxis Technologies
    Celoxis
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in user.do in Celoxis Technologies Celoxis allows remote attackers to inject arbitrary web script or HTML via the ni.smessage parameter.

  • CVE-2008-6093Feb 9, 2009
    Noname CMS
    Noname CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Noname CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the (1) file_id parameter in a detailansicht action and the (2) kategorie parameter in a kategorien action.

  • CVE-2008-6092Feb 9, 2009
    Phpscripts
    Ranking Script
    risk 0.03cvss —epss 0.03

    phpscripts Ranking Script allows remote attackers to bypass authentication and gain administrative access by sending an admin=ja cookie.

  • CVE-2008-6091Feb 9, 2009
    Bmforum
    Bmforum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in plugins.php in BMForum 5.6, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the tagname parameter.

  • CVE-2009-0480Feb 9, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    The IP implementation in Sun Solaris 8 through 10, and OpenSolaris before snv_82, uses an improper arena when allocating minor numbers for sockets, which allows local users to cause a denial of service (32-bit application failure and login outage) by opening a large number of…

  • CVE-2009-0479Feb 9, 2009
    Onlinegrades
    Online Grades
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in admin/admin_login.php in Online Grades 3.2.4 allow remote attackers to execute arbitrary SQL commands via the (1) uname or (2) pword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2009-0478Feb 8, 2009
    Squid Cache
    Squid
    risk 0.09cvss —epss 0.72

    Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which triggers a reachable assertion in (1) HttpMsg.c and (2) HttpStatusLine.c.

  • CVE-2009-0214Feb 8, 2009
    Areva
    E Terrahabitat
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the WebFGServer application in AREVA e-terrahabitat 5.7 and earlier allows remote authenticated users to gain privileges via unknown vectors, aka PD32022.

  • CVE-2009-0213Feb 8, 2009
    Areva
    E Terrahabitat
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the NETIO application in AREVA e-terrahabitat 5.7 and earlier allows remote attackers to cause a denial of service (system crash) via unknown vectors, aka PD32021.

  • CVE-2009-0212Feb 8, 2009
    Areva
    E Terrahabitat
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the WebFGServer application in AREVA e-terrahabitat 5.7 and earlier allows remote attackers to cause a denial of service (system crash) via unknown vectors, aka PD32020.

  • CVE-2009-0211Feb 8, 2009
    Areva
    E Terrahabitat
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the WebFGServer application in AREVA e-terrahabitat 5.7 and earlier allows remote attackers to cause a denial of service (system crash) via unknown vectors, aka PD32018.

  • CVE-2009-0210Feb 8, 2009
    Areva
    E Terrahabitat
    risk 0.00cvss —epss 0.04

    Buffer overflow in the MLF application in AREVA e-terrahabitat 5.7 and earlier allows remote attackers to execute arbitrary commands or cause a denial of service (system crash) via unspecified vectors, aka PD28578.

  • CVE-2009-0477Feb 8, 2009
    Sun Corporation
    Opensolaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the process (aka proc) filesystem in Sun OpenSolaris snv_85 through snv_100 allows local users to gain privileges via vectors related to the contract filesystem.

  • CVE-2009-0476Feb 8, 2009
    MultiMedia Soft
    AdjMmsEng.dll
    risk 0.06cvss —epss 0.37

    Stack-based buffer overflow in MultiMedia Soft AdjMmsEng.dll 7.11.1.0 and 7.11.2.7, as distributed in multiple MultiMedia Soft audio components for .NET, allows remote attackers to execute arbitrary code via a long string in a playlist (.pls) file, as originally reported for…

  • CVE-2009-0376Feb 8, 2009
    RealNetworks
    Realplayer
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in a DLL file in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to…

  • CVE-2009-0375Feb 8, 2009
    RealNetworks
    Realplayer
    risk 0.00cvss —epss 0.06

    Buffer overflow in a DLL file in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to execute…

  • CVE-2009-0206Feb 8, 2009
    Microfocus
    Oncplus
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in NFS in HP ONCplus B.11.31.05 and earlier for HP-UX B.11.31 allows local users to cause a denial of service via unknown vectors.

  • CVE-2008-4562Feb 8, 2009
    Microfocus
    OpenView Network Node Manager
    risk 0.01cvss —epss 0.08

    Buffer overflow in the ovlaunch CGI program in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 on Windows allows remote attackers to execute arbitrary code via a crafted Host parameter. NOTE: this issue may be partially covered by CVE-2009-0205.

  • CVE-2008-4560Feb 8, 2009
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.03

    HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to obtain sensitive information via (1) a crafted request to the nnmRptConfig.exe CGI program, which reveals the pathname of log directories; or (2) a crafted parameter in a request to the…

  • CVE-2008-4559Feb 8, 2009
    Microfocus
    OpenView Network Node Manager
    risk 0.02cvss —epss 0.24

    HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via shell metacharacters in argument fields to the (1) webappmon.exe or (2) OpenView5.exe CGI program. NOTE: this issue may be partially covered by CVE-2009-0205.

  • CVE-2009-0474Feb 6, 2009
    Rockwellautomation
    Controllogix
    risk 0.00cvss —epss 0.06

    The web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allows remote attackers to obtain "internal web page information" and "internal information about the module" via unspecified vectors. NOTE: this may overlap CVE-2002-1603.

  • CVE-2009-0473Feb 6, 2009
    Rockwellautomation
    Controllogix 1756 Enbt\/a Ethernet\/ Ip Bridge
    risk 0.01cvss —epss 0.13

    Open redirect vulnerability in the web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2009-0472Feb 6, 2009
    Rockwellautomation
    Controllogix 1756 Enbt\/a Ethernet\/ Ip Bridge
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in the web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-0471Feb 6, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the HTTP server in Cisco IOS 12.4(23) allows remote attackers to execute arbitrary commands, as demonstrated by executing the hostname command with a level/15/configure/-/hostname request.

  • CVE-2009-0470Feb 6, 2009
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 12.4(23) allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) level/15/exec/-/ or (2) exec/, a different vulnerability than CVE-2008-3821.

  • CVE-2008-6090Feb 6, 2009
    Scriptsez
    Mini Hosting Panel
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in members.php in ScriptsEz Mini Hosting Panel allows remote attackers to read arbitrary local files via a .. (dot dot) in the dir parameter in a view action.

  • CVE-2008-6089Feb 6, 2009
    Scriptsez
    Easy Image Downloader
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in main.php in ScriptsEz Easy Image Downloader allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter in a download action.

  • CVE-2008-6088Feb 6, 2009
    Joomla
    com_joomtracker
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Joomtracker (com_joomtracker) 1.01 module for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a tordetails action to index.php.

  • CVE-2008-6087Feb 6, 2009
    Camera Life
    Camera Life
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in topic.php in Camera Life 2.6.2b4 allows remote attackers to inject arbitrary web script or HTML via the name parameter.

  • CVE-2008-6086Feb 6, 2009
    Camera Life
    Camera Life
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in album.php in Camera Life 2.6.2b4 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2008-3355.

  • CVE-2003-1569Feb 6, 2009
    Goahead
    Goahead Webserver
    risk 0.00cvss —epss 0.01

    GoAhead WebServer before 2.1.5 on Windows 95, 98, and ME allows remote attackers to cause a denial of service (daemon crash) via an HTTP request with a (1) con, (2) nul, (3) clock$, or (4) config$ device name in a path component, different vectors than CVE-2001-0385.

  • CVE-2003-1568Feb 6, 2009
    Goahead
    Goahead Webserver
    risk 0.00cvss —epss 0.02

    GoAhead WebServer before 2.1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an invalid URL, related to the websSafeUrl function.

  • CVE-2002-2431Feb 6, 2009
    Goahead
    Goahead Webserver
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in GoAhead WebServer before 2.1.4 allows remote attackers to cause "incorrect behavior" via unknown "malicious code," related to incorrect use of the socketInputBuffered function by sockGen.c.

  • CVE-2002-2430Feb 6, 2009
    Goahead
    Goahead Webserver
    risk 0.00cvss —epss 0.01

    GoAhead WebServer before 2.1.1 allows remote attackers to cause a denial of service (CPU consumption) by performing a socket disconnect to terminate a request before it has been fully processed by the server.

  • CVE-2002-2429Feb 6, 2009
    Goahead
    Goahead Webserver
    risk 0.00cvss —epss 0.01

    webs.c in GoAhead WebServer before 2.1.4 allows remote attackers to cause a denial of service (daemon crash) via an HTTP POST request that contains a negative integer in the Content-Length header.

  • CVE-2002-2428Feb 6, 2009
    Goahead
    Goahead Webserver
    risk 0.00cvss —epss 0.02

    webs.c in GoAhead WebServer before 2.1.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an HTTP POST request that contains a Content-Length header but no body data.

  • CVE-2002-2427Feb 6, 2009
    Goahead
    Goahead Webserver
    risk 0.00cvss —epss 0.01

    The security handler in GoAhead WebServer before 2.1.1 allows remote attackers to bypass authentication and obtain access to protected web content via "an extra slash in a URL," a different vulnerability than CVE-2002-1603.