VYPR

CVEs

383,536 total · page 7109 of 7,671

AllCriticalHighKEV
  • CVE-2007-6308Dec 11, 2007
    Httplogger
    Httplogger
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in HttpLogger 0.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-6309Dec 11, 2007
    Webspell
    Webspell
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in webSPELL 4.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) the galleryID parameter in a usergallery upload action; or the (2) upID, (3) tag, (4) month, (5) userID, or (6) year parameter…

  • CVE-2007-6310Dec 11, 2007
    Falt4Extreme
    Falt4Extreme RC4
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in Falt4Extreme RC4 10.9.2007 allow remote attackers to inject arbitrary web script or HTML via the handler parameter to (1) index.php and possibly (2) admin/index.php, and (3) the topic parameter to modules/feed/feed.php (aka…

  • CVE-2007-6311Dec 11, 2007
    Falt4Extreme
    Falt4Extreme RC4
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in (1) index.php, and possibly (2) admin/index.php, in Falt4Extreme RC4 10.9.2007 allows remote attackers to execute arbitrary SQL commands via the nav_ID parameter.

  • CVE-2007-6312Dec 11, 2007
    Websense
    Reporting Tools
    risk 0.01cvss —epss 0.16

    Cross-site scripting (XSS) vulnerability in the logon page in Web Reporting Tools portal in Websense Enterprise and Web Security Suite 6.3 allows remote attackers to inject arbitrary web script or HTML via the username field.

  • CVE-2007-6205Dec 11, 2007
    Serendipity
    Serendipity
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the remote RSS sidebar plugin (serendipity_plugin_remoterss) in S9Y Serendipity before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via a link in an RSS feed.

  • CVE-2007-6303Dec 10, 2007
    MySQL
    MySQL
    risk 0.00cvss —epss 0.02

    MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4 does not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW…

  • CVE-2007-6304Dec 10, 2007
    MySQL
    MySQL
    risk 0.00cvss —epss 0.03

    The federated engine in MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4, when performing a certain SHOW TABLE STATUS query, allows remote MySQL servers to cause a denial of service (federated handler crash and daemon crash) via a response that lacks the…

  • CVE-2007-6305Dec 10, 2007
    IBM
    Hardware Management Console
    risk 0.00cvss —epss 0.00

    Multiple unspecified vulnerabilities in IBM Hardware Management Console (HMC) 7 R3.2.0 allow attackers to gain privileges via "some HMC commands."

  • CVE-2007-5969Dec 10, 2007
    MySQL
    Community Server
    risk 0.01cvss —epss 0.14

    MySQL Community Server 5.0.x before 5.0.51, Enterprise Server 5.0.x before 5.0.52, Server 5.1.x before 5.1.23, and Server 6.0.x before 6.0.4, when a table relies on symlinks created through explicit DATA DIRECTORY and INDEX DIRECTORY options, allows remote authenticated users to…

  • CVE-2007-5970Dec 10, 2007
    MySQL
    MySQL
    risk 0.00cvss —epss 0.02

    MySQL 5.1.x before 5.1.23 and 6.0.x before 6.0.4 allows remote authenticated users to gain privileges on arbitrary tables via unspecified vectors involving use of table-level DATA DIRECTORY and INDEX DIRECTORY options when creating a partitioned table with the same name as a…

  • CVE-2007-6302Dec 10, 2007
    Novell
    Netmail
    risk 0.00cvss —epss 0.06

    Multiple heap-based buffer overflows in avirus.exe in Novell NetMail 3.5.2 before Messaging Architects M+NetMail 3.52f (aka 3.5.2F) allows remote attackers to execute arbitrary code via unspecified ASCII integers used as memory allocation arguments, aka "ZDI-CAN-162."

  • CVE-2007-6287Dec 10, 2007
    Lxlabs
    Hypervm
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the login page in Lxlabs HyperVM 2.0 allows remote attackers to inject arbitrary web script or HTML via the frm_emessage parameter, a different vector than CVE-2006-6649. NOTE: the provenance of this information is unknown; the…

  • CVE-2007-6288Dec 10, 2007
    TCExam
    TCExam
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in TCExam before 5.1.000 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2007-6289Dec 10, 2007
    SerWeb
    SerWeb
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in SerWeb 2.0.0 dev1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) _SERWEB[configdir] parameter to load_lang.php, (2) _SERWEB[functionsdir] parameter to main_prepend.php, and the (3)…

  • CVE-2007-6290Dec 10, 2007
    SerWeb
    SerWeb
    risk 0.04cvss —epss 0.07

    Multiple directory traversal vulnerabilities in js/get_js.php in SERWeb 2.0.0 dev1 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) mod and (2) js parameters.

  • CVE-2007-6291Dec 10, 2007
    Xigla
    Absolute Banner Manager.net
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in abm.aspx in Xigla Absolute Banner Manager .NET 4.0 allows remote attackers to execute arbitrary SQL commands via the z parameter.

  • CVE-2007-6292Dec 10, 2007
    Mwopen
    MWOpen
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in leggi_commenti.asp in MWOpen 1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2007-6293Dec 10, 2007
    IBM
    Hardware Management Console
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in IBM Hardware Management Console (HMC) 6 R1.3 allow attackers to gain privileges via "some HMC commands."

  • CVE-2007-6294Dec 10, 2007
    IBM
    Hardware Management Console
    risk 0.00cvss —epss 0.00

    Multiple unspecified vulnerabilities in IBM Hardware Management Console (HMC) 3 R3.7 allow attackers to gain privileges via "some HMC commands."

  • CVE-2007-6295Dec 10, 2007
    IBM
    Sametime
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the WebRunMenuFrame page in the online meeting center template in IBM Lotus Sametime before 8.0 allows remote attackers to inject arbitrary web script or HTML via the URI.

  • CVE-2007-6296Dec 10, 2007
    Phpmychat
    Phpmychat
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in users_popupL.php3 in phpMyChat 0.14.5 allows remote attackers to execute arbitrary PHP code via a URL in the From parameter.

  • CVE-2007-6297Dec 10, 2007
    Phpmychat
    Phpmychat
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in PHPMyChat 0.14.5 allow remote attackers to inject arbitrary web script or HTML via the (1) LIMIT parameter to chat/deluser.php3, the (2) Link parameter to chat/edituser.php3, or the (3) LastCheck or (4) B parameter to…

  • CVE-2007-6298Dec 10, 2007
    Drupal
    Shoutbox module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Shoutbox module for Drupal 5.x before Shoutbox 5.x-1.1 allows remote authenticated users to inject arbitrary web script or HTML via Shoutbox block messages.

  • CVE-2007-6299Dec 10, 2007
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Drupal and vbDrupal 4.7.x before 4.7.9 and 5.x before 5.4 allow remote attackers to execute arbitrary SQL commands via modules that pass input to the taxonomy_select_nodes function, as demonstrated by the (1) taxonomy_menu, (2)…

  • CVE-2007-6300Dec 10, 2007
    Fusionphp
    Fusion News
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Fusion News 3.9.0 allows remote attackers to perform unauthorized actions via unspecified vectors.

  • CVE-2007-6301Dec 10, 2007
    Open Newsletter
    Open Newsletter
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in compose.php in OpenNewsletter 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter.

  • CVE-2007-5497Dec 7, 2007
    E2fsprogs Project
    E2fsprogs
    risk 0.00cvss —epss 0.04

    Multiple integer overflows in libext2fs in e2fsprogs before 1.40.3 allow user-assisted remote attackers to execute arbitrary code via a crafted filesystem image.

  • CVE-2007-6109Dec 7, 2007
    GNU
    Emacs
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in emacs allows user-assisted attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a large precision value in an integer format string specifier to the format function, as demonstrated via a certain…

  • CVE-2007-6265Dec 7, 2007
    Avast\!
    Avast Antivirus Professional
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in avast! 4 Home and Professional Editions before 4.7.1098 allows remote attackers to have an unknown impact via a crafted TAR archive.

  • CVE-2007-6266Dec 7, 2007
    Bcoos
    Bcoos
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in bcoos 1.0.10 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the gid parameter to modules/arcade/index.php in a show_stats action, or the lid parameter to (2) modules/myalbum/ratephoto.php or (3)…

  • CVE-2007-6267Dec 7, 2007
    Citrix Systems
    Edgesight For Netscaler
    risk 0.00cvss —epss 0.00

    Citrix EdgeSight 4.2 and 4.5 for Presentation Server, EdgeSight 4.2 and 4.5 for Endpoints, and EdgeSight for NetScaler 1.0 and 1.1 do not properly store database credentials in configuration files, which allows local users to obtain sensitive information.

  • CVE-2007-6268Dec 7, 2007
    Xigla
    Absolute News Manager.net
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in pages/default.aspx in Absolute News Manager.NET 5.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter.

  • CVE-2007-6269Dec 7, 2007
    Absolute News Manager.NET
    Absolute News Manager.NET
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in xlaabsolutenm.aspx in Absolute News Manager.NET 5.1 allow remote attackers to execute arbitrary SQL commands via the (1) z, (2) pz, (3) ord, and (4) sort parameters.

  • CVE-2007-6270Dec 7, 2007
    Absolute News Manager.NET
    Absolute News Manager.NET
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Absolute News Manager.NET 5.1 allow remote attackers to inject arbitrary web script or HTML via the (1) rmore parameter to xlaabsolutenm.aspx and the (2) template parameter to pages/default.aspx.

  • CVE-2007-6271Dec 7, 2007
    Absolute News Manager.NET
    Absolute News Manager.NET
    risk 0.03cvss —epss 0.03

    Absolute News Manager.NET 5.1 allows remote attackers to obtain sensitive information via a direct request to getpath.aspx, which reveals the installation path in an error message.

  • CVE-2007-6272Dec 7, 2007
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Joomla! 1.5 RC3 allow remote attackers to execute arbitrary SQL commands via (1) the view parameter to the com_content component, (2) the task parameter to the com_search component, or (3) the option parameter in a search…

  • CVE-2007-6273Dec 7, 2007
    SonicWall
    Global VPN Client
    risk 0.03cvss —epss 0.06

    Multiple format string vulnerabilities in the configuration file in SonicWALL GLobal VPN Client 3.1.556 and 4.0.0.810 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in the (1) Hostname tag or the (2) name attribute in the Connection…

  • CVE-2007-6274Dec 7, 2007
    Bcoos
    Bcoos
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) day or (2) year parameter.

  • CVE-2007-6275Dec 7, 2007
    Bcoos
    Bcoos
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in modules/adresses/ratefile.php in bcoos 1.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the lid parameter, a different vector than CVE-2007-6266.

  • CVE-2007-6276Dec 7, 2007
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.09

    The accept_connections function in the virtual private network daemon (vpnd) in Apple Mac OS X 10.5 before 10.5.4 allows remote attackers to cause a denial of service (divide-by-zero error and daemon crash) via a crafted load balancing packet to UDP port 4112.

  • CVE-2007-6277Dec 7, 2007
    Flac
    Libflac
    risk 0.01cvss —epss 0.07

    Multiple buffer overflows in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via large (1) Metadata Block Size, (2) VORBIS Comment String Size, (3) Picture Metadata MIME-TYPE Size, (4) Picture Description Size,…

  • CVE-2007-6278Dec 7, 2007
    Flac
    Libflac
    risk 0.00cvss —epss 0.02

    Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allows user-assisted remote attackers to force a client to download arbitrary files via the MIME-Type URL flag (-->) for the FLAC image file in a crafted .FLAC file.

  • CVE-2007-6279Dec 7, 2007
    Flac
    Libflac
    risk 0.00cvss —epss 0.04

    Multiple double free vulnerabilities in Free Lossless Audio Codec (FLAC) libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via malformed (1) Seektable values or (2) Seektable Data Offsets in a .FLAC file.

  • CVE-2007-5769Dec 6, 2007
    Netkit FTP
    Netkit FTP
    risk 0.00cvss —epss 0.02

    Double free vulnerability in the getreply function in ftp.c in netkit ftp (netkit-ftp) 0.17 20040614 and later allows remote FTP servers to cause a denial of service (application crash) and possibly have unspecified other impact via some types of FTP protocol behavior. NOTE: the…

  • CVE-2007-5938Dec 6, 2007
    Linux
    iwlwifi
    risk 0.00cvss —epss 0.02

    The iwl_set_rate function in compatible/iwl3945-base.c in iwlwifi 1.1.21 and earlier dereferences an iwl_get_hw_mode return value without checking for NULL, which might allow remote attackers to cause a denial of service (kernel panic) via unspecified vectors during module…

  • CVE-2007-5939Dec 6, 2007
    Heimdal
    Heimdal
    risk 0.00cvss —epss 0.04

    The gss_userok function in appl/ftp/ftpd/gss_userok.c in Heimdal 0.7.2 does not allocate memory for the ticketfile pointer before calling free, which allows remote attackers to have an unknown impact via an invalid username. NOTE: the vulnerability was originally reported for…

  • CVE-2007-6263Dec 6, 2007
    Netkit FTP
    Netkit FTP
    risk 0.00cvss —epss 0.02

    The dataconn function in ftpd.c in netkit ftpd (netkit-ftpd) 0.17, when certain modifications to support SSL have been introduced, calls fclose on an uninitialized file stream, which allows remote attackers to cause a denial of service (daemon crash) and possibly have…

  • CVE-2007-4575Dec 6, 2007
    Openoffice
    Openoffice
    risk 0.01cvss —epss 0.14

    HSQLDB before 1.8.0.9, as used in OpenOffice.org (OOo) 2 before 2.3.1, allows user-assisted remote attackers to execute arbitrary Java code via crafted database documents, related to "exposing static java methods."

  • CVE-2007-5894Dec 6, 2007
    Mit
    Kerberos 5
    risk 0.00cvss —epss 0.03

    The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors. NOTE: the original disclosure misidentifies the conditions…