VYPR

CVEs

383,488 total · page 7111 of 7,670

AllCriticalHighKEV
  • CVE-2007-6164Nov 29, 2007
    Eurologon
    Eurologon CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Eurologon CMS allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) reviews.php, (2) links.php and (3) articles.php.

  • CVE-2007-6165Nov 29, 2007
    Apple Inc.
    Mac OS X
    risk 0.07cvss —epss 0.45

    Mail in Apple Mac OS X Leopard (10.5.1) allows user-assisted remote attackers to execute arbitrary code via an AppleDouble attachment containing an apparently-safe file type and script in a resource fork, which does not warn the user that a separate program is going to be…

  • CVE-2007-6166Nov 29, 2007
    Apple Inc.
    Quicktime
    risk 0.06cvss —epss 0.42

    Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.

  • CVE-2007-6167Nov 29, 2007
    SUSE S.A.
    Linux
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in yast2-core in SUSE Linux might allow local users to execute arbitrary code by creating a malicious yast2 module in the current working directory.

  • CVE-2007-6168Nov 29, 2007
    Vu
    Case Manager
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in default.asp in VU Case Manager allows remote attackers to execute arbitrary SQL commands via the username parameter, a different vector than CVE-2007-6143. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2007-6169Nov 29, 2007
    Gouae
    Dwd Realty
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in admin/index2.asp in GOUAE DWD Realty allows remote attackers to execute arbitrary SQL commands via the uname parameter, a different vector than CVE-2007-6163. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2007-4674Nov 27, 2007
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.04

    An "integer arithmetic" error in Apple QuickTime 7.2 allows remote attackers to execute arbitrary code via a crafted movie file containing a movie atom with a large size value, which triggers a stack-based buffer overflow.

  • CVE-2007-6133Nov 27, 2007
    Devmass
    Shopping Cart
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin/kfm/initialise.php in DevMass Shopping Cart 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the kfm_base_path parameter.

  • CVE-2007-6134Nov 27, 2007
    Phpkit
    Phpkit
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pkinc/public/article.php in PHPKIT 1.6.4pl1 allows remote attackers to execute arbitrary SQL commands via the contentid parameter in an article action to include.php, a different vector than CVE-2006-1773.

  • CVE-2007-6135Nov 27, 2007
    Phpslideshow
    Phpslideshow
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in phpslideshow.php in PHPSlideShow 0.9.9.2, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the directory parameter. NOTE: this issue was originally reported for toonchapter8.php, but this is…

  • CVE-2007-6136Nov 27, 2007
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in M2Scripts MySpace Scripts Poll Creator allow remote attackers to inject arbitrary web script or HTML via the (1) title, (2) intro, and (3) question parameters, and (4) unspecified answer parameters, in a…

  • CVE-2007-6137Nov 27, 2007
    Content Injector
    Content Injector
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.php in Content Injector 1.52 allows remote attackers to execute arbitrary SQL commands via the cat parameter to index.php. NOTE: some of these details are obtained from third party information.

  • CVE-2007-6138Nov 27, 2007
    Vu
    Mass Mailer
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in redir.asp in VU Mass Mailer allows remote attackers to execute arbitrary SQL commands via the password parameter to Default.asp (aka the Login Page). NOTE: some of these details are obtained from third party information.

  • CVE-2007-6139Nov 27, 2007
    Mp3 ToolBox
    Mp3 ToolBox
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in Mp3 ToolBox 1.0 beta 5 allows remote attackers to execute arbitrary PHP code via a URL in the skin_file parameter.

  • CVE-2007-6140Nov 27, 2007
    Dora Emlak
    Dora Emlak
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Dora Emlak 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) emlak_detay.asp and (b) haber_detay.asp, the (2) kategori parameter to (c) kategorisirala.asp, and the (3) tip parameter to (d)…

  • CVE-2007-6141Nov 27, 2007
    Vbtube
    Vbtube
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in vBTube.php in vBTube 1.1 Beta allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2007-6142Nov 27, 2007
    Jaf CMS
    Jaf CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC2 allow remote attackers to inject arbitrary web script or HTML via the (1) show parameter to index.php and the (2) print parameter to print.php. NOTE: the provenance of this…

  • CVE-2007-6143Nov 27, 2007
    Vu
    Case Manager
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in default.asp (aka the Login Page) in VU Case Manager allows remote attackers to execute arbitrary SQL commands via the password parameter.

  • CVE-2007-6144Nov 27, 2007
    Xunlei
    Thunder
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in the PPlayer.XPPlayer.1 ActiveX control in pplayer.dll_1_work in Xunlei Thunder 5.7.4.401 allows remote attackers to execute arbitrary code via a long string in a FlvPlayerUrl property value. NOTE: some of these details are obtained from third party…

  • CVE-2007-6145Nov 27, 2007
    Hitachi
    Jp1 File Transmission Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Hitachi JP1/File Transmission Server/FTP 01-00 through 08-10-01 allows remote attackers to bypass authentication and "view files" via unspecified vectors.

  • CVE-2007-6146Nov 27, 2007
    Hitachi
    Jp1 File Transmission Server
    risk 0.00cvss —epss 0.02

    Hitachi JP1/File Transmission Server/FTP 01-00 through 08-10-02 on Windows might allow remote attackers to cause a denial of service (service stop) via a "specific file" argument to an FTP command.

  • CVE-2007-6147Nov 27, 2007
    Iaprcommence
    Iapr Commence
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in IAPR COMMENCE 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the (a) php_root_path and sometimes the (b) privilege_root_path parameter to various PHP scripts under (1) admin/includes/, (2) admin/phase/,…

  • CVE-2007-5959Nov 26, 2007
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger memory corruption.

  • CVE-2007-5960Nov 26, 2007
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass…

  • CVE-2007-6122Nov 26, 2007
    Irc Services
    Irc Services
    risk 0.00cvss —epss 0.02

    The default_encrypt function in encrypt.c in IRC Services before 5.0.63, and 5.1.x before 5.1.7, allows remote attackers to cause a denial of service (daemon crash) via a long password. NOTE: some of these details are obtained from third party information.

  • CVE-2007-6123Nov 26, 2007
    Irc Services
    Irc Services
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in IRC Services 5.1.8 has unknown impact and attack vectors.

  • CVE-2007-6124Nov 26, 2007
    Softbizscripts
    Freelancers Script
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in signin.php in Softbiz Freelancers Script 1 allows remote attackers to inject arbitrary web script or HTML via the errmsg parameter.

  • CVE-2007-6125Nov 26, 2007
    Softbizscripts
    Freelancers Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in search_form.php in Softbiz Freelancers Script 1 allows remote attackers to execute arbitrary SQL commands via the sb_protype parameter.

  • CVE-2007-6126Nov 26, 2007
    Project Alumni
    Project Alumni
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the year parameter to (1) xml/index.php; or (2) the year parameter to view.page.inc.php, which is reachable through a view…

  • CVE-2007-6127Nov 26, 2007
    Project Alumni
    Project Alumni
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the year parameter to (1) view.page.inc.php, which is reachable through a view action to index.php; or (2) the year parameter to…

  • CVE-2007-6128Nov 26, 2007
    Flor De Utopia
    Workingonweb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in events.php in WorkingOnWeb 2.0.1400 allows remote attackers to execute arbitrary SQL commands via the idevent parameter.

  • CVE-2007-6129Nov 26, 2007
    Amber Script
    Amber Script
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in scripts/include/show_content.php in Amber Script 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by…

  • CVE-2007-6130Nov 26, 2007
    GNU
    Gnump3d
    risk 0.00cvss —epss 0.01

    gnump3d 2.9final does not apply password protection to its plugins, which might allow remote attackers to bypass intended access restrictions.

  • CVE-2007-6131Nov 26, 2007
    scanbuttond
    scanbuttond
    risk 0.00cvss —epss 0.00

    buttonpressed.sh in scanbuttond 0.2.3 allows local users to overwrite arbitrary files via a symlink attack on the (1) scan.pnm and (2) scan.jpg temporary files.

  • CVE-2007-6100Nov 23, 2007
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in libraries/auth/cookie.auth.lib.php in phpMyAdmin before 2.11.2.2, when logins are authenticated with the cookie auth_type, allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter to index.php, a…

  • CVE-2007-6101Nov 23, 2007
    Ability
    Mail Server
    risk 0.00cvss —epss 0.01

    Ability Mail Server before 2.61 allows remote authenticated users to cause a denial of service (daemon crash) via (1) malformed number list ranges in unspecified IMAP commands, and possibly (2) a blank string in unspecified messages.

  • CVE-2007-6102Nov 23, 2007
    Feed2js
    Feed2js
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Feed to JavaScript (Feed2JS) 1.91 allows remote attackers to inject arbitrary web script or HTML via a URL in a feed.

  • CVE-2007-6103Nov 23, 2007
    I Hear U
    I Hear U
    risk 0.03cvss —epss 0.05

    I Hear U (IHU) 0.5.6 and earlier allows remote attackers to cause (1) a denial of service (infinite loop) via a packet that contains zero in the size field in its header, which is improperly handled by the Receiver::processPacket function; and (2) a denial of service (daemon…

  • CVE-2007-6104Nov 23, 2007
    Filemaker
    Filemaker
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Instant Web Publishing feature in FileMaker Pro 7 and 8, Server 7 and 8, and Developer 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-6105Nov 23, 2007
    Talkback
    Talkback
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in TalkBack 2.2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) language_file parameter to (a) comments-display-tpl.php and (b) addons/separate-comments-mod/my-comments-display-tpl.php and the (2)…

  • CVE-2007-6106Nov 23, 2007
    Alstrasoft
    E Friends
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in AlstraSoft E-Friends 4.98 and earlier allows remote attackers to execute arbitrary SQL commands via the seid parameter in a viewevent action.

  • CVE-2007-6110Nov 23, 2007
    Htdig
    Htdig
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in htsearch in htdig 3.2.0b6 allows remote attackers to inject arbitrary web script or HTML via the sort parameter.

  • CVE-2007-6111Nov 23, 2007
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Wireshark (formerly Ethereal) allow remote attackers to cause a denial of service (crash) via (1) a crafted MP3 file or (2) unspecified vectors to the NCP dissector.

  • CVE-2007-6112Nov 23, 2007
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.06

    Buffer overflow in the PPP dissector Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.

  • CVE-2007-6113Nov 23, 2007
    Wireshark
    Wireshark
    risk 0.04cvss —epss 0.07

    Integer signedness error in the DNP3 dissector in Wireshark (formerly Ethereal) 0.10.12 to 0.99.6 allows remote attackers to cause a denial of service (long loop) via a malformed DNP3 packet.

  • CVE-2007-6114Nov 23, 2007
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.06

    Multiple buffer overflows in Wireshark (formerly Ethereal) 0.99.0 through 0.99.6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) the SSL dissector or (2) the iSeries (OS/400) Communication trace file parser.

  • CVE-2007-6115Nov 23, 2007
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.06

    Buffer overflow in the ANSI MAP dissector for Wireshark (formerly Ethereal) 0.99.5 to 0.99.6, when running on unspecified platforms, allows remote attackers to cause a denial of service and possibly execute arbitrary code via unknown vectors.

  • CVE-2007-6116Nov 23, 2007
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The Firebird/Interbase dissector in Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (infinite loop or crash) via unknown vectors.

  • CVE-2007-6117Nov 23, 2007
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the HTTP dissector for Wireshark (formerly Ethereal) 0.10.14 to 0.99.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted chunked messages.

  • CVE-2007-6118Nov 23, 2007
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The MEGACO dissector in Wireshark (formerly Ethereal) 0.9.14 to 0.99.6 allows remote attackers to cause a denial of service (long loop and resource consumption) via unknown vectors.