VYPR

CVEs

384,396 total · page 7000 of 7,688

AllCriticalHighKEV
  • CVE-2009-0280Jan 27, 2009
    Asp Project
    Asp Project
    risk 0.03cvss —epss 0.03

    Asp Project Management 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the crypt cookie to 1.

  • CVE-2009-0279Jan 27, 2009
    Pardalcms
    Pardalcms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in comentar.php in Pardal CMS 0.2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-0278Jan 27, 2009
    Sun Corporation
    Java System Application Server
    risk 0.00cvss —epss 0.02

    Sun Java System Application Server (AS) 8.1 and 8.2 allows remote attackers to read the Web Application configuration files in the (1) WEB-INF or (2) META-INF directory via a malformed request.

  • CVE-2009-0277Jan 27, 2009
    Solaris
    kernel
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the kernel in OpenSolaris snv_100 through snv_102 on the Sun UltraSPARC T2 and T2+ sun4v platforms allows local users to cause a denial of service (panic) via unknown vectors.

  • CVE-2008-5981Jan 27, 2009
    PacPoll
    PacPoll
    risk 0.03cvss —epss 0.02

    PacPoll 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) poll.mdb or (2) poll97.mdb.

  • CVE-2008-5980Jan 27, 2009
    Ocean12
    Mailing List Manager
    risk 0.03cvss —epss 0.03

    Ocean12 Mailing List Manager Gold stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for o12mail.mdb.

  • CVE-2008-5979Jan 27, 2009
    Ocean12
    Mailing List Manager
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in default.asp in Ocean12 Mailing List Manager Gold allows remote attackers to inject arbitrary web script or HTML via the Email parameter.

  • CVE-2008-5978Jan 27, 2009
    Ocean12
    Mailing List Manager
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Ocean12 Mailing List Manager Gold allow remote attackers to execute arbitrary SQL commands via the Email parameter to (1) default.asp and (2) s_edit.asp.

  • CVE-2008-5977Jan 27, 2009
    PHP JOBWEBSITE PRO
    PHP JOBWEBSITE PRO
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in siteadmin/forgot.php in PHP JOBWEBSITE PRO allows remote attackers to execute arbitrary SQL commands via the adname parameter in a Submit action.

  • CVE-2008-5976Jan 27, 2009
    PHP JOBWEBSITE PRO
    PHP JOBWEBSITE PRO
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in siteadmin/forgot.php in PHP JOBWEBSITE PRO allow remote attackers to inject arbitrary web script or HTML via (1) the adname parameter in a Submit action or (2) the UserName field.

  • CVE-2008-5975Jan 27, 2009
    Active Price Comparison
    Active Price Comparison
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in links.asp in Active Price Comparison 4.0 allows remote attackers to execute arbitrary SQL commands via the linkid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-5974Jan 27, 2009
    Active Price Comparison
    Active Price Comparison
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.aspx in Active Price Comparison 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) password and (2) username fields.

  • CVE-2008-5973Jan 27, 2009
    Active Web Mail
    Active Web Mail
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.aspx in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the password parameter.

  • CVE-2008-5972Jan 27, 2009
    Activewebsoftwares
    Active Business Directory
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.asp in Active Business Directory 2 allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2008-5971Jan 27, 2009
    I Netsolution
    Orkut Clone
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in profile_social.php in i-Net Solution Orkut Clone allows remote authenticated users to inject arbitrary web script or HTML via the id parameter.

  • CVE-2008-5970Jan 27, 2009
    I Netsolution
    Orkut Clone
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in profile_social.php in i-Net Solution Orkut Clone allows remote authenticated users to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-5969Jan 27, 2009
    Sunbyte
    E Flower
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in popupproduct.php in Sunbyte e-Flower allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-0275Jan 26, 2009
    Ryneezy
    Phosheezy
    risk 0.03cvss —epss 0.05

    Static code injection vulnerability in admin.php in Ryneezy phoSheezy 0.2 allows remote authenticated administrators to inject arbitrary PHP code into config/header via the header parameter. NOTE: this can be exploited by unauthenticated attackers by leveraging CVE-2009-0250.…

  • CVE-2008-5968Jan 26, 2009
    PHP Icalendar
    Phpicalendar
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in print.php in PHP iCalendar 2.24 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cookie_language parameter in a phpicalendar_* cookie, a different vector than CVE-2006-1292.

  • CVE-2008-5967Jan 26, 2009
    PHP Icalendar
    Phpicalendar
    risk 0.03cvss —epss 0.03

    admin/index.php in PHP iCalendar 2.3.4, 2.24, and earlier does not require administrative authentication for an addupdate action, which allows remote attackers to upload a calendar (aka .ics) file with arbitrary content to the calendars/ directory outside the web root.

  • CVE-2008-5966Jan 26, 2009
    Globsy
    Globsy
    risk 0.03cvss —epss 0.02

    globsy_edit.php in Globsy 1.0 and earlier allows remote attackers to create or overwrite arbitrary files via a filename in the file parameter and file contents in the data parameter.

  • CVE-2008-5965Jan 26, 2009
    Lokicms
    Lokicms
    risk 0.04cvss —epss 0.06

    Directory traversal vulnerability in index.php in LokiCMS 0.3.4 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to check for the existence of arbitrary files via a .. (dot dot) in the page parameter.

  • CVE-2009-0271Jan 26, 2009
    Fujitsu
    Systemcastwizard Lite
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the TFTP service in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier allows remote attackers to read arbitrary files via directory traversal sequences in unspecified vectors.

  • CVE-2009-0270Jan 26, 2009
    Fujitsu
    Systemcastwizard Lite
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in PXEService.exe in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier allows remote attackers to execute arbitrary code via a large PXE protocol request in a UDP packet.

  • CVE-2009-0269Jan 26, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel before 2.6.28.1 allows local users to cause a denial of service (fault or memory corruption), or possibly have unspecified other impact, via a readlink call that results in an error, leading to use of a -1 return…

  • CVE-2009-0268Jan 26, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Race condition in the pseudo-terminal (aka pty) driver module in Sun Solaris 8 through 10, and OpenSolaris before snv_103, allows local users to cause a denial of service (panic) via unspecified vectors related to lack of "properly sequenced code" in ptc and ptsl.

  • CVE-2009-0267Jan 26, 2009
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.03

    libike in Sun Solaris 9 and 10, and OpenSolaris before snv_100, does not properly check packets, which allows remote attackers to cause a denial of service (in.iked daemon crash) via an unspecified IKE packet, a different vulnerability than CVE-2007-2989.

  • CVE-2009-0266Jan 26, 2009
    Trilogic
    Media Player
    risk 0.03cvss —epss 0.04

    Stack-based buffer overflow in Triologic Media Player 8.0.0.0 allows user-assisted remote attackers to execute arbitrary code via a long string in a .m3l playlist file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2009-0265HigJan 26, 2009
    Isc
    Bind
    risk 0.49cvss 7.5epss 0.02

    Internet Systems Consortium (ISC) BIND 9.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to…

  • CVE-2009-0264Jan 26, 2009
    Fujitsu
    Systemcastwizard Lite
    risk 0.00cvss —epss 0.02

    Buffer overflow in the Registry Setting Tool in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier has unknown impact and attack vectors.

  • CVE-2008-5260Jan 26, 2009
    Axis
    Axis Camera Control
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in the CamImage.CamImage.1 ActiveX control in AxisCamControl.ocx in AXIS Camera Control 2.40.0.0 allows remote attackers to execute arbitrary code via a long image_pan_tilt property value.

  • CVE-2009-0263Jan 23, 2009
    Winamp
    Winamp
    risk 0.04cvss —epss 0.17

    Multiple buffer overflows in Winamp 5.541 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a large Common Chunk (COMM) header value in an AIFF file and (2) a large invalid value in an MP3 file.

  • CVE-2009-0262Jan 23, 2009
    Trilogic
    Media Player
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in Triologic Media Player 7 and 8.0.0.0 allows user-assisted remote attackers to execute arbitrary code via a long string in a .m3u playlist file. NOTE: some of these details are obtained from third party information.

  • CVE-2009-0261Jan 23, 2009
    Effectmatrix
    Total Video Player
    risk 0.04cvss —epss 0.13

    Stack-based buffer overflow in EffectMatrix Total Video Player 1.31 allows user-assisted attackers to execute arbitrary code via a Skins\DefaultSkin\DefaultSkin.ini file with a large ColumnHeaderSpan value.

  • CVE-2009-0260Jan 23, 2009
    Moinmo
    Moinmoin
    risk 0.00cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter…

  • CVE-2008-5964Jan 23, 2009
    Impresscms
    Impresscms
    risk 0.00cvss —epss 0.02

    Session fixation vulnerability in Social ImpressCMS before 1.1.1 RC1 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.

  • CVE-2008-5963Jan 23, 2009
    Gravity Gtd
    Gravity Gtd
    risk 0.03cvss —epss 0.03

    Eval injection vulnerability in library/setup/rpc.php in Gravity Getting Things Done (GTD) 0.4.5 and earlier allows remote attackers to execute arbitrary PHP code via the objectname parameter.

  • CVE-2008-5962Jan 23, 2009
    Gravity Gtd
    Gravity Gtd
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in library/setup/rpc.php in Gravity Getting Things Done (GTD) 0.4.5 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the objectname parameter.

  • CVE-2008-5961Jan 23, 2009
    Tribiq
    CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Tribiq CMS Community 5.0.10B and 5.0.11E allows remote attackers to inject arbitrary web script or HTML via the cID parameter in a document action. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2008-5960Jan 23, 2009
    Tribiq
    CMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Tribiq CMS Community 5.0.10B and 5.0.11E allows remote attackers to execute arbitrary SQL commands via the cID parameter in a document action. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2008-5959Jan 23, 2009
    Active Test
    Active Test
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in start.asp in Active Test 2.1 allow remote attackers to execute arbitrary SQL commands via the (1) useremail parameter (aka username field) or (2) password parameter (aka password field). NOTE: some of these details are obtained from…

  • CVE-2008-5958Jan 23, 2009
    Active Test
    Active Test
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Active Test 2.1 allow remote attackers to execute arbitrary SQL commands via the QuizID parameter to (1) questions.asp, (2) importquestions.asp, and (3) quiztakers.asp.

  • CVE-2008-5957Jan 23, 2009
    Mydyngallery
    Mydyngallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Mydyngallery (com_mydyngallery) component 1.4.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the directory parameter to index.php.

  • CVE-2008-5956Jan 23, 2009
    Phpstreet
    Webboard
    risk 0.03cvss —epss 0.03

    Wbstreet (aka PHPSTREET Webboard) 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database credentials via a direct request to connect.inc.

  • CVE-2008-5955Jan 23, 2009
    Phpstreet
    Webboard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in show.php in Wbstreet (aka PHPSTREET Webboard) 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-5954Jan 23, 2009
    KTP Computer
    Ktp Computer Customer Database
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the lname parameter in a login action to an unspecified component. NOTE: the provenance of this…

  • CVE-2008-5953Jan 23, 2009
    KTP Computer
    Ktp Computer Customer Database
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p parameter to the default URI.

  • CVE-2008-5952Jan 23, 2009
    KTP Computer
    Ktp Computer Customer Database
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the tid parameter in a vtech action to the default URI.

  • CVE-2008-5951Jan 23, 2009
    ASP Template Creature
    ASP Template Creature
    risk 0.03cvss —epss 0.02

    ASP Template Creature stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for workDB/templatemonster.mdb.

  • CVE-2008-5950Jan 23, 2009
    ASP Template Creature
    ASP Template Creature
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in media/media_level.asp in ASP Template Creature allows remote attackers to execute arbitrary SQL commands via the mcatid parameter.