VYPR

CVEs

383,387 total · page 7124 of 7,668

AllCriticalHighKEV
  • CVE-2007-3897Oct 9, 2007
    Microsoft
    Outlook Express
    risk 0.04cvss —epss 0.55

    Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption.

  • CVE-2007-3899Oct 9, 2007
    Microsoft
    Word
    risk 0.02cvss —epss 0.29

    Unspecified vulnerability in Microsoft Word 2000 SP3, Word 2002 SP3, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a malformed string in a Word file, aka "Word Memory Corruption Vulnerability."

  • CVE-2007-4466Oct 9, 2007
    Electronic Arts
    Snoopyctrl
    risk 0.05cvss —epss 0.31

    Multiple stack-based buffer overflows in Electronic Arts (EA) SnoopyCtrl ActiveX control (NPSnpy.dll) allow remote attackers to execute arbitrary code via unspecified methods and parameters.

  • CVE-2007-5319Oct 9, 2007
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the vuidmice STREAMS modules in Sun Solaris 8, 9, and 10 allows local users with console (/dev/console) access to cause a denial of service ("unusable" system console) via unspecified vectors.

  • CVE-2007-5320Oct 9, 2007
    Pegasus Imaging
    Imagxpress
    risk 0.04cvss —epss 0.07

    Multiple absolute path traversal vulnerabilities in Pegasus Imaging ImagXpress 8.0 allow remote attackers to (1) delete arbitrary files via the CacheFile attribute in the ThumbnailXpres.1 ActiveX control (PegasusImaging.ActiveX.ThumnailXpress1.dll) or (2) overwrite arbitrary…

  • CVE-2007-5321Oct 9, 2007
    Verlihub Project
    Verlihub Control Panel
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in Verlihub Control Panel (VHCP) 1.7 and earlier allows remote attackers to include arbitrary files via a .. (dot dot) in the page parameter.

  • CVE-2007-5322Oct 9, 2007
    Microsoft
    Visual Foxpro
    risk 0.04cvss —epss 0.19

    Insecure method vulnerability in the FPOLE.OCX 6.0.8450.0 ActiveX control in Microsoft Visual FoxPro 6.0 allows remote attackers to execute arbitrary programs by specifying them as an argument to the FoxDoCmd function.

  • CVE-2007-5309Oct 9, 2007
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in admin.wmtgallery.php in the webmaster-tips.net Flash Image Gallery (com_wmtgallery) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.

  • CVE-2007-5310Oct 9, 2007
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in admin.wmtportfolio.php in the webmaster-tips.net wmtportfolio 1.0 (com_wmtportfolio) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2007-5311Oct 9, 2007
    Torrenttrader
    Torrenttrader
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic Edition 1.07 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ss_uri parameter.

  • CVE-2007-5312Oct 9, 2007
    Torrenttrader
    Torrenttrader
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in TorrentTrader Classic 1.07 allows remote attackers to inject arbitrary web script or HTML via the (1) color parameter to pjirc/css.php and the (2) cat parameter to browse.php.

  • CVE-2007-5313Oct 9, 2007
    Script Solution.de
    Picturesolution
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in install/config.php in Picturesolution 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.

  • CVE-2007-5314Oct 9, 2007
    Xkiosk
    WEB
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in system/funcs/xkurl.php in xKiosk WEB 3.0.1i, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the PEARPATH parameter.

  • CVE-2007-5315Oct 9, 2007
    Softpedia
    Livealbum
    risk 0.06cvss —epss 0.39

    PHP remote file inclusion vulnerability in common.php in LiveAlbum 0.9.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the livealbum_dir parameter.

  • CVE-2007-5316Oct 9, 2007
    Softbizscripts
    Jobs and Recruitment Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in browsecats.php in Softbiz Jobs and Recruitment Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2007-5318Oct 9, 2007
    Typolight
    Typolight Webcms
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in preview.php in TYPOlight webCMS 2.4.6 allows remote attackers to download arbitrary files via the src parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2007-5290Oct 9, 2007
    MailBee
    WebMail Lite ASP
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMail Lite ASP before 4.0.11, and WebMail Lite PHP before 4.0.22; allow remote attackers to inject arbitrary web script or HTML via…

  • CVE-2007-5291Oct 9, 2007
    Daniel Broadbent
    Db Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Edit.asp in DB Manager 2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2007-5292Oct 9, 2007
    Splitside
    Directory Image Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in photos.cfm in Directory Image Gallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the backwardDirectory parameter.

  • CVE-2007-5293Oct 9, 2007
    Idmos
    Idmos
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in IDMOS 1.0-beta (aka Phoenix) allow remote attackers to inject arbitrary web script or HTML via the (1) err_msg parameter to error.php and the (2) content parameter to templates/simple/ia.php.

  • CVE-2007-5294Oct 9, 2007
    Idmos
    Idmos
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in core/aural.php in IDMOS 1.0-beta (aka Phoenix) allows remote attackers to execute arbitrary PHP code via a URL in the site_absolute_path parameter.

  • CVE-2007-5295Oct 9, 2007
    Wikepage
    Opus
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in (a) Wikepage Opus 13 2007.2 and (b) TipiWiki 2 allow remote attackers to inject arbitrary web script or HTML via the (1) PageContent and (2) PageName parameters.

  • CVE-2007-5296Oct 9, 2007
    Livio Siri
    Dblist
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in dblisttest.asp in dbList 8.1 allow remote attackers to inject arbitrary web script or HTML via the (1) db, (2) pagesize, (3) sort, (4) strKeyWords, and (5) table parameters. NOTE: some of these details are obtained from…

  • CVE-2007-5297Oct 9, 2007
    Minki
    Minki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Minki 1.30 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2007-5298Oct 9, 2007
    Creamotion
    Creamotion
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in CMS Creamotion allow remote attackers to execute arbitrary PHP code via a URL in the cfg[document_uri] parameter to (1) _administration/securite.php and (2) _administration/gestion_configurations/save_config.php.

  • CVE-2007-5299Oct 9, 2007
    Skadate
    Skadate Online Dating Software
    risk 0.04cvss —epss 0.08

    Multiple directory traversal vulnerabilities in SkaDate 5.0 and 6.0, and possibly later versions such as 6.482, allow remote attackers to read arbitrary files via a .. (dot dot) in the view_mode parameter to (1) featured_list.php and (2) online_list.php in member/.

  • CVE-2007-5300Oct 9, 2007
    Wzdftpd
    Wzdftpd
    risk 0.03cvss —epss 0.05

    Off-by-one error in the do_login_loop function in libwzd-core/wzd_login.c in wzdftpd 0.8.0, 0.8.2, and possibly other versions allows remote attackers to cause a denial of service (daemon crash) via a long USER command that triggers a stack-based buffer overflow. NOTE: some of…

  • CVE-2007-5301Oct 9, 2007
    Alsaplayer
    Alsaplayer
    risk 0.04cvss —epss 0.10

    Buffer overflow in the vorbis_stream_info function in input/vorbis/vorbis_engine.c (aka the vorbis input plugin) in AlsaPlayer before 0.99.80-rc3 allows remote attackers to execute arbitrary code via a .OGG file with long comments.

  • CVE-2007-5302Oct 9, 2007
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in HP System Management Homepage (SMH) in HP-UX B.11.11, B.11.23, and B.11.31, and SMH before 2.1.10 for Linux and Windows, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-5303Oct 9, 2007
    Snewscms
    Snewscms Rus
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in news_page.php in SnewsCMS Rus 2.1 allows remote attackers to inject arbitrary web script or HTML via the page_id parameter.

  • CVE-2007-5304Oct 9, 2007
    ELSEIF
    CMS
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) repertimage parameter to utilisateurs/vousetesbannis.php, the (2) elseifvotetxtresultatduvote parameter to…

  • CVE-2007-5305Oct 9, 2007
    ELSEIF
    CMS
    risk 0.04cvss —epss 0.09

    Multiple PHP remote file inclusion vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the (1) contenus parameter to (a) contenus.php; the (2) tpelseifportalrepertoire parameter to (b) votes.php, (c) espaceperso.php, (d)…

  • CVE-2007-5306Oct 9, 2007
    ELSEIF
    CMS
    risk 0.03cvss —epss 0.03

    ELSEIF CMS Beta 0.6 allows remote attackers to obtain sensitive information (full path) via unspecified vectors to utilisateurs/votesresultats.php.

  • CVE-2007-5307Oct 9, 2007
    ELSEIF
    CMS
    risk 0.03cvss —epss 0.02

    ELSEIF CMS Beta 0.6 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a .php file via…

  • CVE-2007-5308Oct 9, 2007
    PHP Homepage M
    PHP Homepage M
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in galerie.php in PHP Homepage M (phpHPm) 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action.

  • CVE-2007-5279Oct 9, 2007
    Conexware
    Powerarchiver
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in ConeXware PowerArchiver before 10.20.21 might allow remote attackers to execute arbitrary code via a long filename in a BlackHole archive.

  • CVE-2007-5280Oct 9, 2007
    Appfuse
    Appfuse
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in messages.jsp in AppFuse before 2.0 Final allow remote attackers to inject arbitrary web script or HTML via unspecified input that is recorded in (1) success or (2) error messages.

  • CVE-2007-5281Oct 9, 2007
    Hitachi
    Cosminexus Developer's Kit for Java
    risk 0.00cvss —epss 0.02

    The Java Secure Socket Extension (JSSE) in the Hitachi Cosminexus Developer's Kit for Java in various Hitachi Cosminexus 7.5 products before 07-50-01, when using JSSE for SSL/TLS support, allows remote attackers to cause a denial of service via certain SSL/TLS handshake…

  • CVE-2007-5282Oct 9, 2007
    Hitachi
    Cosminexus Agent
    risk 0.00cvss —epss 0.01

    Hitachi Cosminexus Agent 03-00 through 03-05, and Cosminexus Library Standard and Web Edition 04-00 and 04-01, might allow remote attackers to cause a denial of service (agent process crash) via invalid data from clients other than Cosminexus Manager.

  • CVE-2007-5283Oct 9, 2007
    Hitachi
    Tpbroker Object Transaction Monitor
    risk 0.00cvss —epss 0.01

    The TSC Domain Manager in Hitachi TPBroker Object Transaction Monitor and Cosminexus TPBroker Object Transaction Monitor 01-00 through 03-00 might allow attackers to cause a denial of service (crash) via invalid messages.

  • CVE-2007-5270Oct 8, 2007
    Drupal
    Boost
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Boost module before 4.7.x-1.0, and 5.x before 5.x-1.0, for Drupal allows remote attackers to create or overwrite arbitrary files, and conduct cross-site scripting attacks (XSS) via unspecified vectors.

  • CVE-2007-5271Oct 8, 2007
    Trionic
    Cite CMS
    risk 0.05cvss —epss 0.29

    Multiple PHP remote file inclusion vulnerabilities in Trionic Cite CMS 1.2 rev9 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the bField[bf_data] parameter to (1) interface/editors/-custom.php or (2) interface/editors/custom.php.

  • CVE-2007-5272Oct 8, 2007
    Furkan Tastan Blog
    Furkan Tastan Blog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in kategori.asp in Furkan Tastan Blog allows remote attackers to execute arbitrary SQL commands via the id parameter in a goster kat action.

  • CVE-2007-5273Oct 8, 2007
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when an HTTP proxy server is used, allows remote attackers to violate the security model for…

  • CVE-2007-5274Oct 8, 2007
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when Firefox or Opera is used, allows remote attackers to violate the security model for…

  • CVE-2007-5275Oct 8, 2007
    Adobe Inc.
    Flash
    risk 0.00cvss —epss 0.06

    The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a…

  • CVE-2007-5276Oct 8, 2007
    Opera
    Opera
    risk 0.00cvss —epss 0.01

    Opera 9 drops DNS pins based on failed connections to irrelevant TCP ports, which makes it easier for remote attackers to conduct DNS rebinding attacks, as demonstrated by a port 81 URL in an IMG SRC, when the DNS pin had been established for a session on port 80.

  • CVE-2007-5277Oct 8, 2007
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.10

    Microsoft Internet Explorer 6 drops DNS pins based on failed connections to irrelevant TCP ports, which makes it easier for remote attackers to conduct DNS rebinding attacks, as demonstrated by a port 81 URL in an IMG SRC, when the DNS pin had been established for a session on…

  • CVE-2007-5278Oct 8, 2007
    Zomplog
    Zomplog
    risk 0.03cvss —epss 0.02

    Zomplog 3.8.1 and earlier stores potentially sensitive information under the web root with insufficient access control, which allows remote attackers to download files that were uploaded by users, as demonstrated by obtaining a directory listing via a direct request to /upload…

  • CVE-2007-4924Oct 8, 2007
    Ekiga
    Ekiga
    risk 0.04cvss —epss 0.11

    The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remote attackers to cause a denial of service (crash) via an invalid Content-Length header field in Session Initiation Protocol (SIP) packets, which causes a \0…