VYPR

CVEs

383,069 total · page 7142 of 7,662

AllCriticalHighKEV
  • CVE-2007-4046Jul 27, 2007
    Joomla
    Pony Gallery
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in the Pony Gallery (com_ponygallery) 1.5 and earlier component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2007-4047Jul 27, 2007
    Bitdamaged
    Geoblog
    risk 0.03cvss —epss 0.03

    geoBlog (aka BitDamaged) 1 does not require authentication for (1) deletecomment.php, (2) deleteblog.php, and (3) listcomment.php in admin/, which allows remote attackers to delete arbitrary comments, delete arbitrary blogs, and have other unspecified impact via a request with a…

  • CVE-2007-1354Jul 27, 2007
    JBoss
    Jboss Application Server
    risk 0.00cvss —epss 0.01

    The Access Control functionality (JMXOpsAccessControlFilter) in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and…

  • CVE-2007-2874Jul 27, 2007
    Fedorahosted
    NetworkManager
    risk 0.00cvss —epss 0.03

    Buffer overflow in the wpa_printf function in the debugging code in wpa_supplicant in the Fedora NetworkManager package before 0.6.5-3.fc7 allows user-assisted remote attackers to execute arbitrary code via malformed frames on a WPA2 network. NOTE: some of these details are…

  • CVE-2007-3105Jul 27, 2007
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size,…

  • CVE-2007-3333Jul 26, 2007
    IBM
    Aix
    risk 0.03cvss —epss 0.04

    Stack-based buffer overflow in capture in IBM AIX 5.3 SP6 and 5.2.0 allows remote attackers to execute arbitrary code via a large number of terminal control sequences.

  • CVE-2007-4003Jul 26, 2007
    IBM
    Aix
    risk 0.03cvss —epss 0.02

    pioout in IBM AIX 5.3 SP6 allows local users to execute arbitrary code by specifying a malicious library with the -R (ParseRoutine) command line argument.

  • CVE-2007-4004Jul 26, 2007
    IBM
    Aix
    risk 0.03cvss —epss 0.01

    Buffer overflow in the ftp client in IBM AIX 5.3 SP6 and 5.2.0 allows local users to execute arbitrary code via unspecified vectors that trigger the overflow in a gets function call. NOTE: the client is setuid root on AIX, so this issue crosses privilege boundaries.

  • CVE-2007-4029Jul 26, 2007
    Xiph.Org
    Libvorbis
    risk 0.00cvss —epss 0.02

    libvorbis 1.1.2, and possibly other versions before 1.2.0, allows context-dependent attackers to cause a denial of service via (1) an invalid mapping type, which triggers an out-of-bounds read in the vorbis_info_clear function in info.c, and (2) invalid blocksize values that…

  • CVE-2007-3106Jul 26, 2007
    Xiph.Org
    Libvorbis
    risk 0.00cvss —epss 0.03

    lib/info.c in libvorbis 1.1.2, and possibly other versions before 1.2.0, allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via invalid (1) blocksize_0 and (2) blocksize_1 values, which trigger a "heap overwrite" in the _01inverse…

  • CVE-2007-4020Jul 26, 2007
    AdMan
    AdMan
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in login.php in AdMan 1.0.20051202 FF 3 patch and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user and (2) pwd parameters.

  • CVE-2007-4021Jul 26, 2007
    Brain Book Software
    Software Secure
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in login.php in Brain Book Software Secure 1.0.20070629 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user and (2) pwd parameters.

  • CVE-2007-4022Jul 26, 2007
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in frontend/x/htaccess/changepro.html in cPanel 10.9.1 allows remote attackers to inject arbitrary web script or HTML via the resname parameter.

  • CVE-2007-4023Jul 26, 2007
    Arubanetworks
    Mobility Controller
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the login CGI program in Aruba Mobility Controller 2.5.4.18 and earlier, and 2.4.8.6-FIPS and earlier FIPS versions, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-4024Jul 26, 2007
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in W1L3D4_aramasonuc.asp in W1L3D4 Philboard 0.3 allows remote attackers to inject arbitrary web script or HTML via the searchterms parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2007-4025Jul 26, 2007
    Sun Corporation
    Java System Application Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Sun Java System (SJS) Application Server 8.1 through 9.0 before 20070724 on Windows allows remote attackers to obtain JSP source code via unspecified vectors.

  • CVE-2007-4026Jul 26, 2007
    Telaxius
    Epesi
    risk 0.00cvss —epss 0.01

    epesi framework before 0.8.6 does not properly verify file extensions, which allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors involving the gallery images upload feature. NOTE: some of these details are obtained from third party…

  • CVE-2007-4027Jul 26, 2007
    Areca
    CLI
    risk 0.00cvss —epss 0.00

    Buffer overflow in cli32 in Areca CLI 1.72.250 and earlier might allow local users to gain privileges via a long argument. NOTE: this program is not setuid by default, but there are some usage scenarios in which an administrator might make it setuid.

  • CVE-2007-4028Jul 26, 2007
    Webspell
    Webspell
    risk 0.00cvss —epss 0.02

    Absolute path traversal vulnerability in index.php in Webspell 4.01.02 allows remote attackers to include and execute arbitrary local files via a full pathname in the site parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2007-3566Jul 26, 2007
    Borland Software
    Interbase
    risk 0.08cvss —epss 0.66

    Stack-based buffer overflow in the database service (ibserver.exe) in Borland InterBase 2007 before SP2 allows remote attackers to execute arbitrary code via a long size value in a create request to port 3050/tcp.

  • CVE-2007-4013Jul 26, 2007
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in (1) Net6Helper.DLL (aka Net6Launcher Class) 4.5.2 and earlier, (2) npCtxCAO.dll (aka Citrix Endpoint Analysis Client) in a Firefox plugin directory, and (3) a second npCtxCAO.dll (aka CCAOControl Object) before 4.5.0.0 in Citrix Access…

  • CVE-2007-4014Jul 26, 2007
    WordPress
    Blix
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in a certain index.php installation script related to the (1) Blix 0.9.1, (2) Blixed 1.0, and (3) BlixKrieg (Blix Krieg) 2.2 themes for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly…

  • CVE-2007-4016Jul 26, 2007
    Citrix Systems
    Access Gateway
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the client components in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 allows attackers to execute arbitrary code via unspecified vectors.

  • CVE-2007-4017Jul 26, 2007
    Citrix Systems
    Access Gateway
    risk 0.00cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in the web-based administration console in Citrix Access Gateway before firmware 4.5.5 allows remote attackers to perform certain configuration changes as administrators.

  • CVE-2007-4018Jul 26, 2007
    Citrix Systems
    Access Gateway
    risk 0.00cvss —epss 0.01

    Citrix Access Gateway Advanced Edition before firmware 4.5.5 allows attackers to redirect users to arbitrary web sites and conduct phishing attacks via unknown vectors.

  • CVE-2007-0060Jul 26, 2007
    Ca
    Etrust Admin
    risk 0.02cvss —epss 0.24

    Stack-based buffer overflow in the Message Queuing Server (Cam.exe) in CA (formerly Computer Associates) Message Queuing (CAM / CAFT) software before 1.11 Build 54_4 on Windows and NetWare, as used in CA Advantage Data Transport, eTrust Admin, certain BrightStor products,…

  • CVE-2007-3302Jul 26, 2007
    Ca
    eTrust Intrusion Detection
    risk 0.01cvss —epss 0.11

    The CallCode ActiveX control in caller.dll 3.0 before 20070713, and 3.0 SP1 before 3.0.5.81, in CA (formerly Computer Associates) eTrust Intrusion Detection allows remote attackers to load arbitrary DLLs on a client system, and execute code from these DLLs, via unspecified…

  • CVE-2007-3875Jul 26, 2007
    Broadcom Corporation
    Etrust Antivirus
    risk 0.00cvss —epss 0.04

    arclib.dll before 7.3.0.9 in CA Anti-Virus (formerly eTrust Antivirus) 8 and certain other CA products allows remote attackers to cause a denial of service (infinite loop and loss of antivirus functionality) via an invalid "previous listing chunk number" field in a CHM file.

  • CVE-2007-4005Jul 26, 2007
    Mike Dubman
    Windows Rsh Daemon
    risk 0.04cvss —epss 0.11

    Stack-based buffer overflow in Mike Dubman Windows RSH daemon (rshd) 1.7 allows remote attackers to execute arbitrary code via a long string to the shell port (514/tcp). NOTE: this might overlap CVE-2007-4006.

  • CVE-2007-4006Jul 26, 2007
    Mike Dubman
    Windows Rsh Daemon
    risk 0.06cvss —epss 0.34

    Buffer overflow in Mike Dubman Windows RSH daemon (rshd) 1.7 has unknown impact and remote attack vectors, aka ZD-00000034. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release…

  • CVE-2007-4007Jul 26, 2007
    Article Directory
    Article Directory
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in Article Directory (Article Site Directory) allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

  • CVE-2007-4008Jul 26, 2007
    Entertainment CMS
    Entertainment CMS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in custom.php in Entertainment Media Sharing CMS allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pagename parameter.

  • CVE-2007-4009Jul 26, 2007
    Swsoft
    Confixx
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in admin/business_inc/saveserver.php in SWSoft Confixx Pro 2.0.12 through 3.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the thisdir parameter.

  • CVE-2007-4010Jul 26, 2007
    PHP
    PHP
    risk 0.03cvss —epss 0.06

    The win32std extension in PHP 5.2.3 does not follow safe_mode and disable_functions restrictions, which allows remote attackers to execute arbitrary commands via the win_shell_execute function.

  • CVE-2007-4011Jul 26, 2007
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.00cvss —epss 0.02

    Cisco 4100 and 4400, Airespace 4000, and Catalyst 6500 and 3750 Wireless LAN Controller (WLC) software before 3.2 20070727, 4.0 before 20070727, and 4.1 before 4.1.180.0 allows remote attackers to cause a denial of service (traffic amplification or ARP storm) via a crafted…

  • CVE-2007-4012Jul 26, 2007
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.00cvss —epss 0.02

    Cisco 4100 and 4400, Airespace 4000, and Catalyst 6500 and 3750 Wireless LAN Controller (WLC) software 4.1 before 4.1.180.0 allows remote attackers to cause a denial of service (ARP storm) via a broadcast ARP packet that "targets the IP address of a known client context", aka…

  • CVE-2007-3985Jul 25, 2007
    Securecomputing
    Securityreporter
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in file.cgi in Secure Computing SecurityReporter (aka Network Security Analyzer) 4.6.3 allows remote attackers to download arbitrary files via a .. (dot dot) in the name parameter.

  • CVE-2007-3986Jul 25, 2007
    Securecomputing
    Securityreporter
    risk 0.00cvss —epss 0.02

    file.cgi in Secure Computing SecurityReporter (aka Network Security Analyzer) 4.6.3 allows remote attackers to bypass authentication via a name parameter that specifies the eventcache directory and a non-GIF file, which causes the $dontvalidate variable to be set to true. NOTE:…

  • CVE-2007-3987Jul 25, 2007
    ImageRacer
    ImageRacer
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in SearchResults.asp in ImageRacer 1.0, when WordSearchCrit is enabled, allows remote attackers to execute arbitrary SQL commands via the SearchWord parameter.

  • CVE-2007-3988Jul 25, 2007
    Virtual Hosting Control System
    Virtual Hosting Control System
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.

  • CVE-2007-3989Jul 25, 2007
    Dora Emlak
    Dora Emlak
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in default.asp in Dora Emlak 1.0, when the goster parameter is set to iletisim, allow remote attackers to inject arbitrary web script or HTML via the (1) Adiniz and (2) Soyadiniz parameters; and possibly other unspecified…

  • CVE-2007-3990Jul 25, 2007
    Dora Emlak
    Dora Emlak
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in default.asp in Dora Emlak 1.0, when the goster parameter is set to emlakdetay, allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2007-3991Jul 25, 2007
    Asp Cvmatik
    cv.asp
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in cv.asp in Asp cvmatik 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Adiniz (Ady), (2) Soyadiniz (Soyady), (3) Ehliyet, (4) Askerlik, and (5) GSM parameters; and possibly other…

  • CVE-2007-3992Jul 25, 2007
    Iexpress
    Property Pro
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in vir_login.asp in iExpress Property Pro allows remote attackers to execute arbitrary SQL commands via the Password parameter. NOTE: the Username parameter is covered by CVE-2006-6029. NOTE: the provenance of this information is unknown; the…

  • CVE-2007-3993Jul 25, 2007
    Kerio Technologies
    Kerio Mailserver
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the attachment filter in Kerio MailServer before 6.4.1 has unknown impact and remote attack vectors.

  • CVE-2006-7221HigJul 25, 2007
    Fsp
    fsplib
    risk 0.49cvss 7.5epss 0.01

    Multiple off-by-one errors in fsplib.c in fsplib before 0.8 allow attackers to cause a denial of service via unspecified vectors involving the (1) name and (2) d_name entry attributes.

  • CVE-2007-3026Jul 25, 2007
    Panda Project
    Adminsecure
    risk 0.01cvss —epss 0.09

    Integer overflow in Panda Software AdminSecure allows remote attackers to execute arbitrary code via crafted packets with modified length values to TCP ports 19226 or 19227, resulting in a heap-based buffer overflow.

  • CVE-2007-3383Jul 25, 2007
    Apache
    Tomcat
    risk 0.01cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and…

  • CVE-2007-3531Jul 25, 2007
    Nvidia
    NVClock
    risk 0.00cvss —epss 0.00

    The set_default_speeds function in backend/backend.c in NVidia NVClock before 0.8b2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/nvclock temporary file.

  • CVE-2007-3679Jul 25, 2007
    Citrix Systems
    Access Gateway
    risk 0.00cvss —epss 0.02

    The Citrix EPA ActiveX control (aka the "endpoint checking control" or CCAOControl Object) before 4.5.0.0 in npCtxCAO.dll in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 allows remote attackers to download and execute arbitrary programs…