VYPR

CVEs

383,348 total · page 7128 of 7,667

AllCriticalHighKEV
  • CVE-2007-5106Sep 26, 2007
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 allows remote attackers to inject arbitrary web script or HTML via the user_login parameter.

  • CVE-2007-5093Sep 26, 2007
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The disconnect method in the Philips USB Webcam (pwc) driver in Linux kernel 2.6.x before 2.6.22.6 "relies on user space to close the device," which allows user-assisted local attackers to cause a denial of service (USB subsystem hang and CPU consumption in khubd) by not closing…

  • CVE-2007-4874Sep 26, 2007
    Boesch It
    Simpnews
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in SimpNews 2.41.03 allow remote attackers to inject arbitrary web script or HTML via the (1) l_username parameter to admin/layout2b.php, and the (2) backurl parameter to comment.php.

  • CVE-2007-5088Sep 26, 2007
    Freeside
    Freeside
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search/cust_bill_event.cgi in Freeside 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the failed parameter.

  • CVE-2007-5089Sep 26, 2007
    Sk.log
    Sk.log
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in php-inc/log.inc.php in sk.log 0.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the SKIN_URL parameter.

  • CVE-2007-5090Sep 26, 2007
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in IBM Rational ClearQuest (CQ), when a Microsoft SQL Server or an IBM DB2 database is used, allows attackers to corrupt data via unspecified vectors.

  • CVE-2007-5091Sep 26, 2007
    Egroupware
    Egroupware
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in eGroupWare 1.4.001 allow remote attackers to inject arbitrary web script or HTML via the cat_data[color] parameter to (1) preferences/inc/class.uicategories.inc.php and (2) admin/inc/class.uicategories.inc.php.

  • CVE-2007-5092Sep 26, 2007
    Multimedia
    Dance Music Module For Phpnuke
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in the Dance Music module for phpNuke, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in an ACCEPT_FILE array parameter to modules.php.

  • CVE-2007-4571Sep 26, 2007
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The snd_mem_proc_read function in sound/core/memalloc.c in the Advanced Linux Sound Architecture (ALSA) in the Linux kernel before 2.6.22.8 does not return the correct write size, which allows local users to obtain sensitive information (kernel memory contents) via a small count…

  • CVE-2007-5085Sep 26, 2007
    Apache
    Geronimo
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the management EJB (MEJB) in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors.

  • CVE-2007-5086Sep 26, 2007
    Kaspersky Lab
    Internet Security
    risk 0.00cvss —epss 0.00

    Kaspersky Anti-Virus (KAV) and Internet Security 7.0 build 125 do not properly validate certain parameters to System Service Descriptor Table (SSDT) and Shadow SSDT function handlers, which allows local users to cause a denial of service (crash) via the (1) NtUserSendInput, (2)…

  • CVE-2007-5087Sep 26, 2007
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The ATM module in the Linux kernel before 2.4.35.3, when CLIP support is enabled, allows local users to cause a denial of service (kernel panic) by reading /proc/net/atm/arp before the CLIP module has been loaded.

  • CVE-2007-5079Sep 25, 2007
    Red Hat
    Linux
    risk 0.00cvss —epss 0.01

    Red Hat Enterprise Linux 4 does not properly compile and link gdm with tcp_wrappers on x86_64 platforms, which might allow remote attackers to bypass intended access restrictions.

  • CVE-2007-5066Sep 24, 2007
    Webmin
    Webmin
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Webmin before 1.370 on Windows allows remote authenticated users to execute arbitrary commands via a crafted URL.

  • CVE-2007-5067Sep 24, 2007
    Imatix
    Xitami
    risk 0.09cvss —epss 0.73

    Multiple buffer overflows in iMatix Xitami Web Server 2.5c2 allow remote attackers to execute arbitrary code via a long If-Modified-Since header to (1) xigui32.exe or (2) xitami.exe.

  • CVE-2007-5068Sep 24, 2007
    Phpfullannu
    Phpfullannu
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in phpFullAnnu (PFA) 6.0 allows remote attackers to execute arbitrary SQL commands via the mod parameter.

  • CVE-2007-5069Sep 24, 2007
    PHP-Nuke
    Nuke Mobile Entertainment 1
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in data/compatible.php in the Nuke Mobile Entertainment 1 addon for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module_name parameter.

  • CVE-2007-5070Sep 24, 2007
    Quiksoft
    Easymail Messageprinter Object
    risk 0.04cvss —epss 0.07

    Heap-based buffer overflow in the EasyMailMessagePrinter ActiveX control in emprint.DLL 6.0.1.0 in the Quiksoft EasyMail MessagePrinter Object allows remote attackers to execute arbitrary code via a long string in the first argument to the SetFont method.

  • CVE-2007-5071Sep 24, 2007
    Alexander Palmo
    Simple PHP Blog
    risk 0.00cvss —epss 0.03

    Incomplete blacklist vulnerability in upload_img_cgi.php in Simple PHP Blog before 0.5.1 allows remote attackers to upload dangerous files and execute arbitrary code, as demonstrated by a filename ending in .php. or a .htaccess file, a different vector than CVE-2005-2733. NOTE:…

  • CVE-2007-5072Sep 24, 2007
    Alexander Palmo
    Simple PHP Blog
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog (SPHPBlog) before 0.5.1, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via certain user_colors array parameters to certain user_style.php files under themes/,…

  • CVE-2007-4573Sep 24, 2007
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The IA32 system call emulation functionality in Linux kernel 2.4.x and 2.6.x before 2.6.22.7, when running on the x86_64 architecture, does not zero extend the eax register after the 32bit entry path to ptrace is used, which might allow local users to gain privileges by…

  • CVE-2007-4985Sep 24, 2007
    ImageMagick
    Imagemagick
    risk 0.00cvss —epss 0.02

    ImageMagick before 6.3.5-9 allows context-dependent attackers to cause a denial of service via a crafted image file that triggers (1) an infinite loop in the ReadDCMImage function, related to ReadBlobByte function calls; or (2) an infinite loop in the ReadXCFImage function,…

  • CVE-2007-4986Sep 24, 2007
    ImageMagick
    Imagemagick
    risk 0.00cvss —epss 0.03

    Multiple integer overflows in ImageMagick before 6.3.5-9 allow context-dependent attackers to execute arbitrary code via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5) .xwd image file, which triggers a heap-based buffer overflow.

  • CVE-2007-4987Sep 24, 2007
    ImageMagick
    Imagemagick
    risk 0.00cvss —epss 0.04

    Off-by-one error in the ReadBlobString function in blob.c in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted image file, which triggers the writing of a '\0' character to an out-of-bounds address.

  • CVE-2007-4988HigSep 24, 2007
    ImageMagick
    Imagemagick
    risk 0.51cvss 7.8epss 0.03

    Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow.

  • CVE-2007-5053Sep 24, 2007
    Izicontents
    Izicontents
    risk 0.03cvss —epss 0.02

    Multiple incomplete blacklist vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in (1) the admin_home parameter to modules/poll/poll_summary.php or (2) the rootdp parameter to include/db.php; or a URL in the…

  • CVE-2007-5054Sep 24, 2007
    Izicontents
    Izicontents
    risk 0.06cvss —epss 0.42

    Multiple PHP remote file inclusion vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the gsLanguage parameter to (1) search/search.php, (2) poll/inlinepoll.php, (3) poll/showpoll.php, (4) links/showlinks.php, or…

  • CVE-2007-5055Sep 24, 2007
    Izicontents
    Izicontents
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the admin_home parameter to modules/poll/poll_summary.php or (2) the rootdp parameter to include/db.php.

  • CVE-2007-5056Sep 24, 2007
    Adodb Lite
    Adodb Lite
    risk 0.05cvss —epss 0.28

    Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP sequences in the last_module…

  • CVE-2007-5057Sep 24, 2007
    Netsupport
    Netsupport Manager Client
    risk 0.00cvss —epss 0.05

    NetSupport Manager Client before 10.20.0004 allows remote attackers to bypass the (1) basic and (2) authentication schemes by spoofing the NetSupport Manager.

  • CVE-2007-5058Sep 24, 2007
    Barracuda Networks
    Barracuda Spam Firewall
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Web administration interface in Barracuda Spam Firewall before firmware 3.5.10.016 allows remote attackers to inject arbitrary web script or HTML via the username field in a login attempt, which is not properly handled when the…

  • CVE-2007-5059Sep 24, 2007
    Greensql
    Greensql
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in GreenSQL allow remote attackers to inject arbitrary web script or HTML via several vectors, as demonstrated by the (1) uname and (2) pass parameters in a login form, and (3) an unspecified "url value," leading to storage of…

  • CVE-2007-5060Sep 24, 2007
    Xcms
    Xcms
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the cpass functionality in an admin action in index.php in XCMS allows remote attackers to change arbitrary passwords via certain password_ and rpassword_ parameters, possibly related to timestamp values.

  • CVE-2007-5061Sep 24, 2007
    Clansphere
    Clansphere
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in mods/banners/navlist.php in Clansphere 2007.4 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to index.php in a banners action.

  • CVE-2007-5062Sep 24, 2007
    Adam Scheinberg
    Flip
    risk 0.03cvss —epss 0.02

    account.php in Adam Scheinberg Flip 3.0 and earlier allows remote attackers to create administrative accounts via the un parameter in a register action.

  • CVE-2007-5063Sep 24, 2007
    Adam Scheinberg
    Flip
    risk 0.03cvss —epss 0.06

    Adam Scheinberg Flip 3.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing login credentials via a direct request for var/users.txt.

  • CVE-2007-5064Sep 24, 2007
    Xunlei
    Web Thunder
    risk 0.03cvss —epss 0.04

    Buffer overflow in a certain ActiveX control in Xunlei Web Thunder 5.6.9.344, possibly the DapPlayer ActiveX control in DapPlayer_Now.dll, allows remote attackers to execute arbitrary code via a long first argument to the DownURL2 method. NOTE: some of these details are…

  • CVE-2007-5065Sep 24, 2007
    Joomla
    Joomla!
    risk 0.06cvss —epss 0.42

    PHP remote file inclusion vulnerability in admin.slideshow1.php in the Flash Slide Show (com_slideshow) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.

  • CVE-2007-3916Sep 24, 2007
    SKK Tools
    SKK Tools
    risk 0.00cvss —epss 0.00

    The main function in skkdic-expr.c in SKK Tools 1.2 allows local users to overwrite or delete arbitrary files via a symlink attack on a skkdic$PID temporary file.

  • CVE-2007-5035Sep 24, 2007
    Openengine
    Openengine
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in html/modules/extranet_profile/main.php in openEngine 1.9 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the this_module_path parameter. NOTE: this issue is disputed by CVE because PHP encounters a fatal…

  • CVE-2007-5036Sep 24, 2007
    Airdefense
    Airsensor
    risk 0.04cvss —epss 0.10

    Multiple buffer overflows in the AirDefense Airsensor M520 with firmware 4.3.1.1 and 4.4.1.4 allow remote authenticated users to cause a denial of service (HTTPS service outage) via a crafted query string in an HTTPS request to (1) adLog.cgi, (2) post.cgi, or (3) ad.cgi, related…

  • CVE-2007-5037Sep 24, 2007
    Inotify
    Inotify Tools
    risk 0.00cvss —epss 0.03

    Buffer overflow in the inotifytools_snprintf function in src/inotifytools.c in the inotify-tools library before 3.11 allows context-dependent attackers to execute arbitrary code via a long filename.

  • CVE-2007-5038Sep 24, 2007
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    The offer_account_by_email function in User.pm in the WebService for Bugzilla before 3.0.2, and 3.1.x before 3.1.2, does not check the value of the createemailregexp parameter, which allows remote attackers to bypass intended restrictions on account creation.

  • CVE-2007-5039Sep 24, 2007
    Ghostsecurity
    Ghost Security Suite
    risk 0.00cvss —epss 0.00

    Ghost Security Suite beta 1.110 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via the (1) NtCreateKey, (2) NtDeleteValueKey,…

  • CVE-2007-5040Sep 24, 2007
    Ghostsecurity
    Ghost Security Suite
    risk 0.00cvss —epss 0.00

    Ghost Security Suite alpha 1.200 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via the (1) NtCreateKey, (2) NtCreateThread, (3)…

  • CVE-2007-5041Sep 24, 2007
    Gdata
    Internetsecurity 2007
    risk 0.00cvss —epss 0.00

    G DATA InternetSecurity 2007 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via the (1) NtCreateKey and (2) NtOpenProcess kernel…

  • CVE-2007-5042Sep 24, 2007
    Agnitum
    Outpost Firewall
    risk 0.00cvss —epss 0.00

    Outpost Firewall Pro 4.0.1025.7828 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via the (1) NtCreateKey, (2) NtDeleteFile, (3)…

  • CVE-2007-5043Sep 24, 2007
    Kaspersky Lab
    Internet Security
    risk 0.00cvss —epss 0.00

    Kaspersky Internet Security 7.0.0.125 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to (1) cause a denial of service (crash) and possibly gain privileges via the NtCreateSection kernel SSDT…

  • CVE-2007-5044Sep 24, 2007
    ZoneAlarm
    ZoneAlarm
    risk 0.00cvss —epss 0.00

    ZoneAlarm Pro 7.0.362.000 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via the (1) NtCreatePort and (2) NtDeleteFile kernel…

  • CVE-2007-5045Sep 24, 2007
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.03

    Argument injection vulnerability in Apple QuickTime 7.1.5 and earlier, when running on systems with Mozilla Firefox before 2.0.0.7 installed, allows remote attackers to execute arbitrary commands via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext…