VYPR

CVEs

382,314 total · page 7148 of 7,647

AllCriticalHighKEV
  • CVE-2007-2963May 31, 2007
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board (IPB or IP.Board) 2.2.2, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via (1) module_bbcodeloader.php, (2) module_div.php, (3) module_email.php, (4)…

  • CVE-2007-2964May 31, 2007
    F-Secure
    Policy Manager
    risk 0.03cvss —epss 0.04

    The fsmsh.dll host module in F-Secure Policy Manager Server 7.00 and earlier allows remote attackers to cause a denial of service (application crash) via NTFS reserved words in filenames in URLs.

  • CVE-2007-2965May 31, 2007
    F-Secure
    Internet Security
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Real-time Scanning component in multiple F-Secure products, including Internet Security 2005, 2006 and 2007; Anti-Virus 2005, 2006 and 2007; and Solutions based on F-Secure Protection Service for Consumers 6.40 and earlier allows local users to…

  • CVE-2007-2966May 31, 2007
    F-Secure
    Internet Gatekeeper
    risk 0.00cvss —epss 0.05

    Buffer overflow in the LHA decompression component in F-Secure anti-virus products for Microsoft Windows and Linux before 20070529 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted LHA archive, related to an integer…

  • CVE-2007-2967May 31, 2007
    F-Secure
    Internet Gatekeeper
    risk 0.00cvss —epss 0.05

    Multiple F-Secure anti-virus products for Microsoft Windows and Linux before 20070522 allow remote attackers to cause a denial of service (file scanning infinite loop) via certain crafted (1) ARJ archives or (2) FSG packed files.

  • CVE-2007-2932May 31, 2007
    Kailash Nadh
    Boastmachine
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in index.php in BoastMachine allows remote attackers to inject arbitrary web script or HTML via the blog parameter in a content search action.

  • CVE-2007-2933May 31, 2007
    Joomla
    Phil-a-Form
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Phil-a-Form (com_philaform) 1.2.0.0 and earlier component for Joomla! allows remote attackers to execute arbitrary SQL commands via the form_id parameter.

  • CVE-2007-2934May 31, 2007
    Windy Road
    Vistered Little
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in skins/common.css.php in Vistered Little 1.6a allows remote attackers to read arbitrary files via a .. (dot dot) in the skin parameter.

  • CVE-2007-2935May 31, 2007
    Fundanemt
    Fundanemt
    risk 0.04cvss —epss 0.10

    core/spellcheck/spellcheck.php in Fundanemt before 2.2.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the dict parameter.

  • CVE-2007-2936May 31, 2007
    Frequency Clock
    Frequency Clock
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in Frequency Clock 0.1b (Beta 0.1) allow remote attackers to execute arbitrary PHP code via a URL in the securelib parameter to (1) conf.php or (2) cp2.php.

  • CVE-2007-2937May 31, 2007
    Troforum
    Troforum
    risk 0.08cvss —epss 0.64

    PHP remote file inclusion vulnerability in admin/admin.php in TROforum 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the site_url parameter.

  • CVE-2007-2938May 31, 2007
    Ademco
    ATNBaseLoader100
    risk 0.06cvss —epss 0.41

    Buffer overflow in the BaseRunner ActiveX control in the Ademco ATNBaseLoader100 Module (ATNBaseLoader100.dll) 5.4.0.6, when Internet Explorer 6 is used, allows remote attackers to execute arbitrary code via a long argument to the (1) Send485CMD method, and possibly the (2)…

  • CVE-2007-2939May 31, 2007
    Mazen
    PHP Chat
    risk 0.08cvss —epss 0.64

    Multiple PHP remote file inclusion vulnerabilities in Mazen's PHP Chat 3.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the basepath parameter to (1) ITX.php, (2) IT_Error.php, or (3) IT.php in include/pear/.

  • CVE-2007-2940May 31, 2007
    Flap
    Flap
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in FlaP 1.0b (1.0 Beta) allow remote attackers to execute arbitrary PHP code via a URL in the pachtofile parameter to (1) skin/html/table.php or (2) login.php.

  • CVE-2007-2941May 31, 2007
    Michael Brandon
    Vbgsitemap
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in the creator in vBulletin Google Yahoo Site Map (vBGSiteMap) 2.41 for vBulletin allow remote attackers to execute arbitrary PHP code via a URL in the base parameter to (1) vbgsitemap/vbgsitemap-config.php or (2)…

  • CVE-2007-2942May 31, 2007
    My Little Forum
    Mylittleforum
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in user.php in My Little Forum 1.7 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2007-2943May 31, 2007
    Webavis
    Webavis
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in class/class.php in Webavis 0.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.

  • CVE-2007-2944May 31, 2007
    Wabcms
    Wabcms
    risk 0.00cvss —epss 0.01

    WabCMS 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/wabcmsn.mdb. NOTE: this issue was originally reported for "webCMS," but this was an error by an…

  • CVE-2007-2945May 31, 2007
    Rmforum
    Rmforum
    risk 0.00cvss —epss 0.01

    RMForum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for rmforum.mdb.

  • CVE-2007-2946May 31, 2007
    Leadtools
    Raster Dialog File Object
    risk 0.04cvss —epss 0.09

    Buffer overflow in a certain ActiveX control in LeadTools Raster Dialog File_D Object (LTRDFD14e.DLL) 14.5.0.44 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) or execute arbitrary code via a long DestinationPath property value.

  • CVE-2007-2947May 31, 2007
    David Branco
    Openbase
    risk 0.04cvss —epss 0.09

    Multiple PHP remote file inclusion vulnerabilities in OpenBASE Alpha 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the root_prefix parameter to (1) index.php, (2) email_subscribe.php, (3) download.php, or (4) development.php.

  • CVE-2007-0690May 30, 2007
    Mywebland
    Myevent
    risk 0.00cvss —epss 0.01

    myEvent 1.6 allows remote attackers to obtain sensitive information via (1) a Log In action without a password to login.php, or an invalid (2) view[] or (3) monthno[] parameter to myevent.php, which reveals the path in various error messages.

  • CVE-2007-0692May 30, 2007
    Dian Gemilang
    Dgnews
    risk 0.00cvss —epss 0.01

    DGNews 2.1 allows remote attackers to obtain sensitive information via a fullnews request to news.php with an invalid newsid parameter, and other unspecified vectors, which reveal the path in various error messages.

  • CVE-2007-0693May 30, 2007
    Dian Gemilang
    Dgnews
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in news.php in DGNews 2.1 allows remote attackers to execute arbitrary SQL commands via the catid parameter in a newslist action. NOTE: this issue can produce resultant cross-site scripting (XSS).

  • CVE-2007-0694May 30, 2007
    Dian Gemilang
    Dgnews
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in footer.php in DGNews 2.1 allows remote attackers to inject arbitrary web script or HTML via the copyright parameter.

  • CVE-2007-2897May 30, 2007
    Microsoft
    Internet Information Server
    risk 0.06cvss —epss 0.74

    Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang), and possibly obtain sensitive information (device communication traffic); and might allow attackers with physical access to execute…

  • CVE-2007-2898May 30, 2007
    2z Project
    2z Project
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in includes/rating.php in 2z Project 0.9.5 allows remote attackers to execute arbitrary SQL commands via the rating parameter to index.php.

  • CVE-2007-2899May 30, 2007
    Navboard
    Navboard
    risk 0.03cvss —epss 0.02

    Direct static code injection vulnerability in admin_config.php in NavBoard 2.6.0 allows remote attackers to inject arbitrary PHP code into data/config.php via multiple parameters, as demonstrated via the threadperpage parameter in an editconfig action.

  • CVE-2007-2900May 30, 2007
    Scallywag.org
    Scallywag
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Scallywag 2005-04-25 allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to template.php in (1) skin/dark/, (2) skin/gold/, or (3) skin/original/.

  • CVE-2007-2901May 30, 2007
    Dokeos
    Dokeos
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the img parameter to main/inc/lib/fckeditor/editor/plugins/ImageManager/editor.php and other unspecified vectors.

  • CVE-2007-2902May 30, 2007
    Dokeos
    Dokeos
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in main/auth/my_progress.php in Dokeos 1.8.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the course parameter.

  • CVE-2007-2903May 30, 2007
    Microsoft
    Office
    risk 0.05cvss —epss 0.29

    Buffer overflow in the HelpPopup method in the Microsoft Office 2000 Controllo UA di Microsoft Office ActiveX control (OUACTRL.OCX) 1.0.1.9 allows remote attackers to cause a denial of service (probably winhlp32.exe crash) via a long first argument. NOTE: it is not clear…

  • CVE-2007-2904May 30, 2007
    Sun Corporation
    Java System Messaging Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Sun Java System Messaging Server 6.0 through 6.3, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly a related issue to CVE-2006-5653.

  • CVE-2007-2905May 30, 2007
    2z Project
    2z Project
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in includes/rating.php in 2z Project 0.9.5 allows remote attackers to execute arbitrary SQL commands via the post_id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2007-2906May 30, 2007
    Sun Corporation
    Java Embedding Plugin
    risk 0.00cvss —epss 0.02

    Java Embedding Plugin 0.9.6.1 allows remote attackers to cause a denial of service (browser crash) via a Thread subclass that calls super.run from its run method.

  • CVE-2007-2907May 30, 2007
    SSL Explorer
    SSL Explorer
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in SSL-Explorer before 0.2.13 allows remote authenticated users to enter redirect URLs containing (1) JavaScript or (2) HTTP headers via an unspecified vector, possibly the forwardTo parameter to redirect.do. NOTE: the impact might be cross-site…

  • CVE-2007-2908May 30, 2007
    Jelsoft
    Vbulletin
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in calendar.php in Jelsoft vBulletin before 3.6.6 allows remote attackers to inject arbitrary web script or HTML via the title field in a single add action.

  • CVE-2007-2909May 30, 2007
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in calendar.php in Jelsoft vBulletin 3.6.x before 3.6.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the vb_calendar366_xss_fix_plugin.xml update.

  • CVE-2007-2910May 30, 2007
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin before 3.6.7 PL1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the vb_367_xss_fix_plugin.xml update, a related issue to CVE-2007-2909.

  • CVE-2007-2911May 30, 2007
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin before 3.6.6 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached After" field (GPC['search']['datelineafter'] variable), a related issue to CVE-2007-1573.

  • CVE-2007-2912May 30, 2007
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Jelsoft vBulletin before 3.6.6, when unauthenticated User Infraction Permissions is disabled, allows remote attackers to see the infraction "red flag" for a deleted user.

  • CVE-2007-2913May 30, 2007
    Clonuswiki
    Clonuswiki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in ClonusWiki .5 allows remote attackers to inject arbitrary web script or HTML via the query parameter.

  • CVE-2007-2914May 30, 2007
    Psychostats
    Psychostats
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in PsychoStats 3.0.6b allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) awards.php, (2) login.php, (3) register.php, (4) weapons.php, and possibly other unspecified files.

  • CVE-2007-2915May 30, 2007
    RM EasyMail Plus
    RM EasyMail Plus
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in RM EasyMail Plus allows remote attackers to inject arbitrary web script or HTML via the title field in an email.

  • CVE-2007-2916May 30, 2007
    GMTT Music Distro
    Music Distro
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in showown.php in GMTT Music Distro 1.2 allows remote attackers to inject arbitrary web script or HTML via the st parameter.

  • CVE-2007-2882May 30, 2007
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the NFS client module in Sun Solaris 8 through 10 before 20070524, when operating as an NFS server, allows remote attackers to cause a denial of service (crash) via certain Access Control List (acl) packets.

  • CVE-2007-2883May 30, 2007
    Credant
    Credant Mobile Guardian Shield Windows
    risk 0.00cvss —epss 0.00

    Credant Mobile Guardian Shield for Windows 5.2.1.105 and earlier stores account names and passwords in plaintext in memory, which allows local users to obtain sensitive information by (1) reading the paging file or (2) dumping and searching the memory image. NOTE: This issue…

  • CVE-2007-2884May 30, 2007
    Microsoft
    Visual Basic
    risk 0.06cvss —epss 0.36

    Multiple stack-based buffer overflows in Microsoft Visual Basic 6 allow user-assisted remote attackers to cause a denial of service (CPU consumption) or execute arbitrary code via a Visual Basic Project (vbp) file with a long (1) Description or (2) Company Name…

  • CVE-2007-2885May 30, 2007
    Microsoft
    Visual Database Tools Database Designer
    risk 0.01cvss —epss 0.09

    The NotSafe function in the MSVDTDatabaseDesigner7 ActiveX control in VDT70.DLL in Microsoft Visual Database Tools (MSVDT) Database Designer 7.0 allows remote attackers to cause a denial of service (Internet Explorer 6 crash) via a long argument.

  • CVE-2007-2886May 30, 2007
    Nortel
    Meridian/CS 1000
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Nortel CS 1000 M media card in Enterprise VoIP-Core-CS 1000E, 1000M, and 1000S 04.50W before 20070523 in Meridian/CS 1000 allows remote attackers to cause a denial of service (card hang) via unspecified vectors.