VYPR

CVEs

383,336 total · page 7129 of 7,667

AllCriticalHighKEV
  • CVE-2007-4496Sep 21, 2007
    VMware
    Workstation
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build…

  • CVE-2007-4497Sep 21, 2007
    VMware
    Workstation
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build…

  • CVE-2007-4569Sep 21, 2007
    KDE
    Kde
    risk 0.00cvss —epss 0.01

    backend/session.c in KDM in KDE 3.3.0 through 3.5.7, when autologin is configured and "shutdown with password" is enabled, allows remote attackers to bypass the password requirement and login to arbitrary accounts via unspecified vectors.

  • CVE-2007-4991Sep 21, 2007
    Microsoft
    Isa Server
    risk 0.01cvss —epss 0.16

    The SOCKS4 Proxy in Microsoft Internet Security and Acceleration (ISA) Server 2004 SP1 and SP2 allows remote attackers to obtain potentially sensitive information (the destination IP address of another user's session) via an empty packet.

  • CVE-2007-5023Sep 21, 2007
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    Unquoted Windows search path vulnerability in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075, and Server before 1.0.4 Build 56528 allows local…

  • CVE-2007-5024Sep 21, 2007
    VMware
    Server
    risk 0.00cvss —epss 0.00

    EMC VMware Server before 1.0.4 Build 56528 writes passwords in cleartext to unspecified log files, which allows local users to obtain sensitive information by reading these files, a different vulnerability than CVE-2005-3620.

  • CVE-2007-5025Sep 21, 2007
    VMware
    Ace
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in EMC VMware ACE before 1.0.3 Build 54075 allows attackers to have an unknown impact via an unspecified manipulation of "images stored in virtual machines downloaded by the user."

  • CVE-2007-5026Sep 21, 2007
    Dblog
    Dblog CMS
    risk 0.03cvss —epss 0.03

    dBlog CMS, probably 2.0, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing an admin password hash via a direct request for dblog.mdb.

  • CVE-2007-5027Sep 21, 2007
    Level One
    Wbr3404tx
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/ddns in the web management panel for the WBR3404TX broadband router with firmware R1.94p0vTIG allow remote attackers to inject arbitrary web script or HTML via the (1) DD or (2) DU parameter.

  • CVE-2007-5028Sep 21, 2007
    Dibbler
    Dibbler
    risk 0.00cvss —epss 0.01

    Dibbler 0.6.0 on Linux uses weak world-writable permissions for unspecified files in /var/lib/dibbler, which has unknown impact and local attack vectors.

  • CVE-2007-5029Sep 21, 2007
    Dibbler
    Dibbler
    risk 0.00cvss —epss 0.02

    Dibbler 0.6.0 does not verify that certain length parameters are appropriate for buffer sizes, which allows remote attackers to trigger a buffer over-read and cause a denial of service (daemon crash), as demonstrated by incorrect behavior of the TSrvMsg constructor in…

  • CVE-2007-5030Sep 21, 2007
    Dibbler
    Dibbler
    risk 0.00cvss —epss 0.02

    Multiple integer overflows in Dibbler 0.6.0 allow remote attackers to cause a denial of service (daemon crash) via packets containing options with large lengths, which trigger attempts at excessive memory allocation, as demonstrated by (1) the TSrvMsg constructor in…

  • CVE-2007-5031Sep 21, 2007
    Dibbler
    Dibbler
    risk 0.00cvss —epss 0.02

    The TSrvOptIA_NA::rebind method in SrvOptions/SrvOptIA_NA.cpp in Dibbler 0.6.0 allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via an invalid IA_NA option in a REBIND message.

  • CVE-2007-5032Sep 21, 2007
    PHP-Nuke
    PHP Nuke
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin.php in Francisco Burzi PHP-Nuke allows remote attackers to add administrative accounts via an AddAuthor action with modified add_name and add_radminsuper parameters.

  • CVE-2007-5033Sep 21, 2007
    Phpbb Xs
    Phpbb Xs
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in profile.php in phpBB XS 2 allows remote attackers to inject arbitrary web script or HTML via the selfdes parameter in a profile_info editprofile action.

  • CVE-2007-5020Sep 21, 2007
    Adobe Inc.
    Acrobat
    risk 0.02cvss —epss 0.20

    Unspecified vulnerability in Adobe Acrobat and Reader 8.1 on Windows allows remote attackers to execute arbitrary code via a crafted PDF file, related to the mailto: option and Internet Explorer 7 on Windows XP. NOTE: this information is based upon a vague pre-advisory by a…

  • CVE-2007-5022Sep 21, 2007
    IBM
    Tivoli Storage Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in certain IBM Tivoli Storage Manager (TSM) clients 5.1 before 5.1.8.1, 5.2 before 5.2.5.2, 5.3 before 5.3.5.3, and 5.4 before 5.4.1.2, when using "server-initiated prompted scheduling," allows remote attackers to read a client's data, aka IC53616.

  • CVE-2007-5008Sep 20, 2007
    HP UX
    HP-UX
    risk 0.00cvss —epss 0.04

    The logins command in HP-UX B.11.31, B.11.23, and B.11.11 does not correctly report password status, which allows remote attackers to obtain privileges when certain "password issues" are not detected.

  • CVE-2007-5009Sep 20, 2007
    PhpBB
    Phpbb Plus
    risk 0.07cvss —epss 0.45

    PHP remote file inclusion vulnerability in language/lang_german/lang_main_album.php in phpBB Plus 1.53, and 1.53a before 20070922, allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2007-5010Sep 20, 2007
    WebBatch
    WebBatch
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in WebBatch allows remote attackers to inject arbitrary web script or HTML via the URL to webbatch.exe.

  • CVE-2007-5011Sep 20, 2007
    WebBatch
    WebBatch
    risk 0.03cvss —epss 0.02

    webbatch.exe in WebBatch allows remote attackers to obtain sensitive information via the dumpinputdata parameter.

  • CVE-2007-5012Sep 20, 2007
    Phpwebgallery
    Phpwebgallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in picture.php in PhpWebGallery 1.7.0, when Comments for all is enabled, allows remote attackers to inject arbitrary web script or HTML via the author parameter. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2007-5013Sep 20, 2007
    Phormer
    Phormer
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Phormer 3.31 allow remote attackers to inject arbitrary web script or HTML via the (1) u, (2) p, (3) c, and (4) s parameters, and other unspecified vectors. NOTE: the provenance of this information is unknown;…

  • CVE-2007-5014Sep 20, 2007
    Derek Leung
    Pslash
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in pSlash 0.70 allow remote attackers to execute arbitrary PHP code via a URL in (1) the lvc_admin_dir parameter to modules/visitors2/admin/view-archiver.inc.php or (2) the lvc_include_dir parameter to…

  • CVE-2007-5015Sep 20, 2007
    Streamline
    Streamline
    risk 0.06cvss —epss 0.39

    Multiple PHP remote file inclusion vulnerabilities in Streamline PHP Media Server 1.0-beta4 allow remote attackers to execute arbitrary PHP code via a URL in the sl_theme_unix_path parameter to (1) admin_footer.php, (2) info_footer.php, (3) theme_footer.php, (4)…

  • CVE-2007-5016Sep 20, 2007
    OneCMS
    OneCMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in userreviews.php in OneCMS 2.4 allows remote attackers to execute arbitrary SQL commands via the abc parameter.

  • CVE-2007-5017Sep 20, 2007
    Yahoo
    Messenger
    risk 0.03cvss —epss 0.03

    Absolute path traversal vulnerability in a certain ActiveX control in the CYFT object in ft60.dll in Yahoo! Messenger 8.1.0.421 allows remote attackers to force a download, and create or overwrite arbitrary files via a full pathname in the second argument to the GetFile method.

  • CVE-2007-5018Sep 20, 2007
    MERCURY
    Mercury/32
    risk 0.03cvss —epss 0.04

    Stack-based buffer overflow in IMAPD in Mercury/32 4.52 allows remote authenticated users to execute arbitrary code via a long argument in a SEARCH ON command. NOTE: this issue might overlap with CVE-2004-1211.

  • CVE-2007-5019Sep 20, 2007
    Sun Corporation
    Jre
    risk 0.04cvss —epss 0.10

    Buffer overflow in the Sun Java Web Start ActiveX control in Java Runtime Environment (JRE) 1.6.0_X allows remote attackers to have an unknown impact via a long argument to the dnsResolve (isInstalled.dnsResolve) method.

  • CVE-2007-4983Sep 19, 2007
    Cowon America
    Jetaudio
    risk 0.07cvss —epss 0.47

    Directory traversal vulnerability in the JetAudio.Interface.1 ActiveX control in JetFlExt.dll in jetAudio 7.0.3 Basic and 7.0.3.3016 allows remote attackers to create or overwrite arbitrary local files via a ..\ (dot dot backslash) in the second argument to the…

  • CVE-2007-4984Sep 19, 2007
    Ktauber
    Stylesdemo
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Ktauber.com StylesDemo mod for phpBB 2.0.xx allows remote attackers to execute arbitrary SQL commands via the s parameter.

  • CVE-2007-3286Sep 19, 2007
    Avaya
    IP Softphone
    risk 0.00cvss —epss 0.02

    Multiple buffer overflows in unspecified ActiveX controls in COM objects in Avaya IP Softphone R5.2 before SP3, and R6.0, allow remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2007-4827Sep 19, 2007
    Automatedsolutions
    Modbus Slave Activex Control
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the Modbus/TCP Diagnostic function in MiniHMI.exe for the Automated Solutions Modbus Slave ActiveX Control before 1.5 allows remote attackers to corrupt the heap and possibly execute arbitrary code via malformed Modbus requests to TCP port 502.

  • CVE-2007-4975Sep 19, 2007
    b1gMail-OSS
    b1gMail
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in hilfe.php in b1gMail 6.3.1 allows remote attackers to inject arbitrary web script or HTML via the chapter parameter.

  • CVE-2007-4976Sep 19, 2007
    Coppermine
    Coppermine Photo Gallery
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in viewlog.php in Coppermine Photo Gallery (CPG) 1.4.12 and earlier allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the log parameter.

  • CVE-2007-4977Sep 19, 2007
    Coppermine
    Coppermine Photo Gallery
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in mode.php in Coppermine Photo Gallery (CPG) 1.4.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the referer parameter.

  • CVE-2007-4978Sep 19, 2007
    Phpsyncml
    Phpsyncml
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in phpSyncML 0.1.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the base_dir parameter to (1) Decoder.php and (2) Encoder.php in WBXML/.

  • CVE-2007-4979Sep 19, 2007
    Kwsphp
    Kwsphp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the sondages module in KwsPHP 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a results action, a different module than CVE-2007-4956.2.

  • CVE-2007-4980Sep 19, 2007
    Gcaldaemon
    Gcaldaemon
    risk 0.03cvss —epss 0.05

    The readRequest method in org/gcaldaemon/core/http/HTTPListener.java in GCALDaemon 1.0-beta13 allows remote attackers to cause a denial of service via a large integer value in the Content-Length HTTP header, which triggers a fatal Java OutOfMemoryError.

  • CVE-2007-4981Sep 19, 2007
    Oblius
    Obedit
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the save function in Obedit 3.03 allows user-assisted remote attackers to inject arbitrary web script or HTML via unknown vectors, as demonstrated by a SCRIPT element in an unspecified context when saving a document. NOTE: because the…

  • CVE-2007-4982Sep 19, 2007
    MW6 Technologies
    Qrcode Activex
    risk 0.04cvss —epss 0.10

    Multiple absolute path traversal vulnerabilities in the MW6QRCode.QRCode.1 ActiveX control in MW6QRCode.dll in MW6 Technologies QRCode ActiveX 3.0.0.1 and earlier allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1)…

  • CVE-2007-4974Sep 19, 2007
    Libsndfile Project
    Libsndfile
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in the flac_buffer_copy function in libsndfile 1.0.17 and earlier might allow remote attackers to execute arbitrary code via a FLAC file with crafted PCM data containing a block with a size that exceeds the previous block size.

  • CVE-2007-4967Sep 19, 2007
    Online Armor
    Personal Firewall
    risk 0.00cvss —epss 0.00

    Online Armor Personal Firewall 2.0.1.215 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via unspecified kernel SSDT hooks for…

  • CVE-2007-4968Sep 19, 2007
    Privatefirewall
    Privatefirewall
    risk 0.00cvss —epss 0.00

    Privatefirewall 5.0.14.2 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via kernel SSDT hooks for (1) NtOpenProcess and (2)…

  • CVE-2007-4969Sep 19, 2007
    Sysinternals
    Process Monitor
    risk 0.00cvss —epss 0.00

    Process Monitor 1.22 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via unspecified kernel SSDT hooks for Windows Native API…

  • CVE-2007-4970Sep 19, 2007
    ProcessGuard
    ProcessGuard
    risk 0.00cvss —epss 0.00

    ProcessGuard 3.410 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via kernel SSDT hooks for Windows Native API functions…

  • CVE-2007-4971Sep 19, 2007
    ProSecurity
    ProSecurity
    risk 0.00cvss —epss 0.00

    ProSecurity 1.40 Beta 2 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via kernel SSDT hooks for Windows Native API functions…

  • CVE-2007-4972Sep 19, 2007
    RegMon
    RegMon
    risk 0.00cvss —epss 0.00

    RegMon 7.04 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via kernel SSDT hooks to the (1) NtCreateKey and (2) NtOpenKey…

  • CVE-2007-4958Sep 18, 2007
    Tinywebgallery
    Tinywebgallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) 1.6.3.4 allow remote attackers to inject arbitrary web script or HTML via the URI for (1) index.php, (2) i_frames/i_login.php, and (3) i_frames/i_top_tags.php. NOTE: the provenance of this information…

  • CVE-2007-4959Sep 18, 2007
    Oscmax
    Oscmax
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in catalog_products_with_images.php in osCMax 2.0.0-RC3-0-1 allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…