VYPR

CVEs

383,159 total · page 7139 of 7,664

AllCriticalHighKEV
  • CVE-2007-4289Aug 9, 2007
    Sun Corporation
    Java System Portal Server
    risk 0.00cvss —epss 0.02

    Sun Java System Portal Server 7.0 does not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute an arbitrary Java method via a crafted stylesheet, a related issue to CVE-2007-3715.

  • CVE-2007-4290CriAug 9, 2007
    Guestbook Script
    Guestbook Script
    risk 0.64cvss 9.8epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Guestbook Script 1.9 allow remote attackers to execute arbitrary PHP code via a URL in the script_root parameter to (1) delete.php, (2) edit.php, or (3) inc/common.inc.php; or (4) database.php, (5) entries.php, (6) index.php,…

  • CVE-2007-4291Aug 9, 2007
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of service via (1) a malformed MGCP packet, which causes a device hang, aka CSCsf08998; a malformed H.323 packet, which causes a device crash, as identified by (2) CSCsi60004 with Proxy Unregistration and (3)…

  • CVE-2007-4292Aug 9, 2007
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Multiple memory leaks in Cisco IOS 12.0 through 12.4 allow remote attackers to cause a denial of service (device crash) via a malformed SIP packet, aka (1) CSCsf11855, (2) CSCeb21064, (3) CSCse40276, (4) CSCse68355, (5) CSCsf30058, (6) CSCsb24007, and (7) CSCsc60249.

  • CVE-2007-4293Aug 9, 2007
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of service (device crash) via (1) "abnormal" MGCP messages, aka CSCsd81407; and (2) a large facsimile packet, aka CSCej20505.

  • CVE-2007-4294Aug 9, 2007
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco Unified Communications Manager (CUCM) 5.0, 5.1, and 6.0, and IOS 12.0 through 12.4, allows remote attackers to execute arbitrary code via a malformed SIP packet, aka CSCsi80102.

  • CVE-2007-4295Aug 9, 2007
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco IOS 12.0 through 12.4 allows remote attackers to execute arbitrary code via a malformed SIP packet, aka CSCsi80749.

  • CVE-2007-3872Aug 9, 2007
    Microfocus
    OpenView Operations
    risk 0.05cvss —epss 0.30

    Multiple stack-based buffer overflows in the Shared Trace Service (OVTrace) service for HP OpenView Operations A.07.50 for Windows, and possibly earlier versions, allow remote attackers to execute arbitrary code via certain crafted requests.

  • CVE-2007-4264Aug 9, 2007
    Kai Blankenhorn Bitfolge
    Simple And Nice Index File
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kai Blankenhorn Bitfolge simple and nice index file (aka snif) 1.5.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) path and (2) download parameters.

  • CVE-2007-4265Aug 9, 2007
    VisionProject
    VisionProject
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in VisionProject 3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) projectIssueId parameter in EditProjectIssue.do, the (2) projectId parameter in ProjectSelected.do, the (3) folderId…

  • CVE-2007-4244Aug 8, 2007
    Joomla
    com_jreactions
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in langset.php in J! Reactions (com_jreactions) 1.8.1 and earlier, a Joomla! component, allows remote attackers to execute arbitrary PHP code via a URL in the comPath parameter.

  • CVE-2007-4245Aug 8, 2007
    Dimema
    Contentdm
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Search.php in DiMeMa CONTENTdm (CDM) allows remote attackers to inject arbitrary web script or HTML via a search, probably related to the CISOBOX1 parameter to results.php in CDM 4.2.

  • CVE-2007-4246Aug 8, 2007
    Justsystems
    Ichitaro
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability, possibly a buffer overflow, in Justsystem Ichitaro 2007 and earlier allows remote attackers to execute arbitrary code via a modified document, as actively exploited in August 2007 by malware such as Tarodrop.D (Tarodrop.Q), a different vulnerability…

  • CVE-2007-4247Aug 8, 2007
    Microsoft
    Windows
    risk 0.01cvss —epss 0.15

    Windows Calendar on Microsoft Windows Vista allows remote attackers to cause a denial of service (NULL dereference and persistent application crash) via a malformed ICS file.

  • CVE-2007-4248Aug 8, 2007
    Toolbar Gaming
    Toolbar Gaming
    risk 0.00cvss —epss 0.01

    The CallCmd function in toolbar_gaming.dll in the Toolbar Gaming toolbar for Internet Explorer allows remote attackers to cause a denial of service (NULL dereference and browser crash) via unspecified vectors.

  • CVE-2007-4249Aug 8, 2007
    Exportnation
    Exportnation Toolbar
    risk 0.00cvss —epss 0.01

    The isChecked function in Toolbar.DLL in the ExportNation toolbar for Internet Explorer allows remote attackers to cause a denial of service (NULL dereference and browser crash) via unspecified vectors.

  • CVE-2007-4250Aug 8, 2007
    Advanced Searchbar
    Advanced Searchbar
    risk 0.00cvss —epss 0.01

    The isChecked function in Toolbar.DLL in Advanced Searchbar before 3.33 allows remote attackers to cause a denial of service (NULL dereference and browser crash) via unspecified vectors.

  • CVE-2007-4251Aug 8, 2007
    Openoffice
    Openoffice
    risk 0.00cvss —epss 0.01

    OpenOffice.org (OOo) 2.2 does not properly handle files with multiple extensions, which allows user-assisted remote attackers to cause a denial of service.

  • CVE-2007-4252Aug 8, 2007
    Chilkat Software
    Asp String
    risk 0.03cvss —epss 0.02

    Absolute path traversal vulnerability in a certain ActiveX control in CkString.dll 1.1 and earlier in CHILKAT ASP String allows remote attackers to create or overwrite arbitrary files via a full pathname in the first argument to the SaveToFile method, a different vulnerability…

  • CVE-2007-4253Aug 8, 2007
    Envolution
    Envolution
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the News module in modules.php in Envolution 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter, a different vector than CVE-2005-4263.

  • CVE-2007-4254Aug 8, 2007
    Microsoft
    Visual Studio
    risk 0.04cvss —epss 0.12

    Stack-based buffer overflow in a certain ActiveX control in VDT70.DLL in Microsoft Visual Database Tools Database Designer 7.0 for Microsoft Visual Studio 6 allows remote attackers to execute arbitrary code via a long argument to the NotSafe method. NOTE: this may overlap…

  • CVE-2007-4255Aug 8, 2007
    PHP
    PHP
    risk 0.04cvss —epss 0.09

    Buffer overflow in the mSQL extension in PHP 5.2.3 allows context-dependent attackers to execute arbitrary code via a long first argument to the msql_connect function.

  • CVE-2007-4256Aug 8, 2007
    Ynp
    Portal Systems
    risk 0.04cvss —epss 0.06

    Directory traversal vulnerability in showpage.cgi in YNP Portal System 2.2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter.

  • CVE-2007-4257Aug 8, 2007
    Live For Speed
    Live For Speed
    risk 0.03cvss —epss 0.05

    Multiple buffer overflows in Live for Speed (LFS) S1 and S2 allow user-assisted remote attackers to execute arbitrary code via (1) a .spr file (single player replay file) containing a long user name or (2) a .ply file containing a long number plate string, different vectors than…

  • CVE-2007-4258Aug 8, 2007
    Prozilla
    Prozilla Pub Site Directory
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in directory.php in Prozilla Pub Site Directory allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2007-4259Aug 8, 2007
    EZPhotoSales
    EZPhotoSales
    risk 0.00cvss —epss 0.02

    EZPhotoSales 1.9.3 and earlier allows remote attackers to download arbitrary image files via (1) a direct request for a URL under OnlineViewing/galleries/ or (2) navigation of the gallery user interface with JavaScript disabled.

  • CVE-2007-4260Aug 8, 2007
    EZPhotoSales
    EZPhotoSales
    risk 0.00cvss —epss 0.01

    EZPhotoSales 1.9.3 and earlier has a default "admin" account for galleries, which allows remote attackers to access arbitrary galleries by specifying this username.

  • CVE-2007-4261Aug 8, 2007
    EZPhotoSales
    EZPhotoSales
    risk 0.00cvss —epss 0.02

    EZPhotoSales 1.9.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (1) a file containing cleartext passwords via a direct request for OnlineViewing/data/galleries.txt, or (2) a file…

  • CVE-2007-4262Aug 8, 2007
    EZPhotoSales
    EZPhotoSales
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in EZPhotoSales 1.9.3 and earlier allows remote authenticated administrators to upload and execute arbitrary PHP code under OnlineViewing/galleries/.

  • CVE-2007-4263Aug 8, 2007
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the server side of the Secure Copy (SCP) implementation in Cisco 12.2-based IOS allows remote authenticated users to read, write or overwrite any file on the device's filesystem via unknown vectors.

  • CVE-2007-4226Aug 8, 2007
    BlueCat Networks
    Adonis
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in the BlueCat Networks Proteus IPAM appliance 2.0.2.0 (Adonis DNS/DHCP appliance 5.0.2.8) allows remote authenticated administrators, with certain TFTP privileges, to create and overwrite arbitrary files via a .. (dot dot) in a pathname. NOTE:…

  • CVE-2007-4227Aug 8, 2007
    Microsoft
    Windows Explorer
    risk 0.01cvss —epss 0.13

    Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service via a certain JPG file, as demonstrated by something.jpg. NOTE: this issue might be related to CVE-2007-3958.

  • CVE-2007-4228Aug 8, 2007
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    rmpvc on IBM AIX 4.3 allows local users to cause a denial of service (system crash) via long port logical name (-l) argument.

  • CVE-2007-4229Aug 8, 2007
    KDE
    Konqueror
    risk 0.03cvss —epss 0.02

    Unspecified vulnerability in KDE Konqueror 3.5.7 and earlier allows remote attackers to cause a denial of service (failed assertion and application crash) via certain malformed HTML, as demonstrated by a document containing TEXTAREA, BUTTON, BR, BDO, PRE, FRAMESET, and A tags. …

  • CVE-2007-4230Aug 8, 2007
    BellaBiblio
    BellaBiblio
    risk 0.00cvss —epss 0.02

    BellaBiblio allows remote attackers to gain administrative privileges via a bellabiblio cookie with the value "administrator." NOTE: this issue is disputed by CVE and multiple third parties because the cookie value must be an MD5 hash

  • CVE-2007-4231Aug 8, 2007
    Idevspot
    Phphostbot
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in order/login.php in IDevSpot PhpHostBot 1.06 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the svr_rootscript parameter, a different vector than CVE-2007-4094 and CVE-2006-3776.

  • CVE-2007-4232Aug 8, 2007
    Andreas Robertz
    Phpnews
    risk 0.07cvss —epss 0.52

    PHP remote file inclusion vulnerability in admin/inc/change_action.php in Andreas Robertz PHPNews 0.93 allows remote attackers to execute arbitrary PHP code via a URL in the format_menue parameter.

  • CVE-2007-4233Aug 8, 2007
    Camera Life
    Camera Life
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Camera Life before 2.6 allow attackers to cause a denial of service via unknown vectors.

  • CVE-2007-4234Aug 8, 2007
    Camera Life
    Camera Life
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Camera Life before 2.6 allows remote attackers to download private photos via unspecified vectors associated with the names of the photos. NOTE: some of these details are obtained from third party information.

  • CVE-2007-4235Aug 8, 2007
    Vietphp
    Vietphp
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in VietPHP allow remote attackers to execute arbitrary PHP code via a URL in (1) the dirpath parameter to (a) _functions.php, or (2) the language parameter to (b) admin/index.php or (c) index.php.

  • CVE-2007-4236Aug 8, 2007
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    Buffer overflow in lpd in bos.rte.printers in AIX 5.2 and 5.3 allows local users with printq group privileges to gain root privileges.

  • CVE-2007-4237Aug 8, 2007
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    Buffer overflow in the atm subset in arp in devices.common.IBM.atm.rte in AIX 5.2 and 5.3 allows local users to gain root privileges.

  • CVE-2007-4238Aug 8, 2007
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    AIX 5.2 and 5.3 install pioinit with user and group ownership of bin, which allows local users with bin or possibly printq privileges to gain root privileges by modifying pioinit.

  • CVE-2007-4239Aug 8, 2007
    C Sam
    Onewallet
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in user/forgotPassStep2.jsp in the admin interface in C-SAM oneWallet 210_07062007;1.0 allows remote attackers to inject arbitrary web script or HTML via the loginID parameter.

  • CVE-2007-4240Aug 8, 2007
    Helpcenterlive
    Hcl
    risk 0.00cvss —epss 0.01

    The check_logout function in class/auth.php in Help Center Live (hcl) 2.1.3a sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to delete administrative users and have other unspecified impact via…

  • CVE-2007-4241Aug 8, 2007
    Hewlett-Packard
    Controller for Cisco Local Director
    risk 0.01cvss —epss 0.11

    Buffer overflow in ldcconn in Hewlett-Packard (HP) Controller for Cisco Local Director on HP-UX 11.11i allows remote attackers to execute arbitrary code via a long string to TCP port 17781.

  • CVE-2007-4242Aug 8, 2007
    Astaro
    Security Gateway
    risk 0.00cvss —epss 0.02

    The pop3 Proxy in Astaro Security Gateway (ASG) 7 does not perform virus scanning of attachments that exceed the maximum attachment size, and passes these attachments, which allows remote attackers to bypass this scanning via a large attachment.

  • CVE-2007-4243Aug 8, 2007
    Astaro
    Security Gateway
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in pfilter-reporter.pl in Astaro Security Gateway (ASG) 7 allows remote attackers to cause a denial of service (CPU consumption) via certain network traffic, as demonstrated by P2P and iTunes applications that download large amounts of data.

  • CVE-2007-4224Aug 8, 2007
    KDE
    Konqueror
    risk 0.00cvss —epss 0.02

    KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval with a small interval and changing the window.location property.

  • CVE-2007-4225Aug 8, 2007
    KDE
    Konqueror
    risk 0.00cvss —epss 0.02

    Visual truncation vulnerability in KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar via an http URI with a large amount of whitespace in the user/password portion.