VYPR

CVEs

382,983 total · page 7153 of 7,660

AllCriticalHighKEV
  • CVE-2007-2401Jun 25, 2007
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.07

    CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the…

  • CVE-2007-3373Jun 25, 2007
    Red Hat
    Cluster Suite
    risk 0.00cvss —epss 0.01

    daemon.c in cman (redhat-cluster-suite) before 20070622 does not clear a buffer for reading requests, which might allow local users to obtain sensitive information from previous requests.

  • CVE-2007-3372Jun 22, 2007
    Avahi
    Avahi
    risk 0.00cvss —epss 0.00

    The Avahi daemon in Avahi before 0.6.20 allows attackers to cause a denial of service (exit) via empty TXT data over D-Bus, which triggers an assert error.

  • CVE-2006-7207Jun 22, 2007
    Ageet
    Agephone
    risk 0.00cvss —epss 0.02

    Buffer overflow in ageet AGEphone before 1.4.0 might allow remote attackers to have an unknown impact via unspecified vectors.

  • CVE-2007-3336Jun 22, 2007
    Ca
    Ingres
    risk 0.04cvss —epss 0.09

    Multiple "pointer overwrite" vulnerabilities in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (formerly Computer Associates) products, allow remote attackers to execute arbitrary code by sending certain TCP data at different times to the Ingres…

  • CVE-2007-3337Jun 22, 2007
    CA (Computer Associates)
    Ingres database server
    risk 0.00cvss —epss 0.00

    wakeup in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (Computer Associates) products, allows local users to truncate arbitrary files via a symlink attack on the alarmwkp.def file.

  • CVE-2007-3338Jun 22, 2007
    Ca
    Ingres database server
    risk 0.01cvss —epss 0.07

    Multiple stack-based buffer overflows in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (Computer Associates) products, allow remote attackers to execute arbitrary code via the (1) uuid_from_char or (2) duve_get_args functions.

  • CVE-2007-3343Jun 22, 2007
    Raidenhttpd
    Raidenhttpd
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in RaidenHTTPD before 2.0.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-3344Jun 22, 2007
    Netjukebox
    Netjukebox
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in netjukebox 4.01b allow remote attackers to inject arbitrary web script or HTML via the (1) album_id, (2) order, (3) sort, (4) filter, and (5) genre_id parameters to (a) index.php; and the (6) url parameter to (b)…

  • CVE-2007-3345Jun 22, 2007
    PHP Accounts
    PHP Accounts
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in PHPAccounts 0.5 allow remote attackers to execute arbitrary SQL commands via the (1) Outgoing_Type_ID, (2) Outgoing_ID, (3) Project_ID, (4) Client_ID, (5) Invoice_ID, or (6) Vendor_ID parameter.

  • CVE-2007-3346Jun 22, 2007
    PHP Accounts
    PHP Accounts
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in PHPAccounts 0.5 allows remote attackers to include arbitrary local files via unspecified manipulations of the page parameter.

  • CVE-2007-3347Jun 22, 2007
    Dlink
    DPH-540/DPH-541
    risk 0.00cvss —epss 0.01

    The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's IP address, which allows remote attackers to engage in arbitrary SIP communication with the phone, as demonstrated by communication with forged caller ID.

  • CVE-2007-3348Jun 22, 2007
    Dlink
    DPH-540/DPH-541
    risk 0.00cvss —epss 0.02

    The D-Link DPH-540/DPH-541 phone allows remote attackers to cause a denial of service (device outage) via a malformed SDP header in a SIP INVITE message.

  • CVE-2007-3349Jun 22, 2007
    Aastra
    9112i SIP Phone
    risk 0.00cvss —epss 0.02

    The Aastra 9112i SIP Phone with firmware 1.4.0.1048 and boot version 1.1.0.10 allows remote attackers to (1) cause a denial of service (device freeze) via a malformed SIP message of a certain length or (2) cause a denial of service (continuous ring) via a malformed SIP message…

  • CVE-2007-3350Jun 22, 2007
    AOL
    Instant Messenger
    risk 0.00cvss —epss 0.02

    AOL Instant Messenger (AIM) 6.1.32.1 on Windows XP allows remote attackers to cause a denial of service (application hang) via a flood of spoofed SIP INVITE requests.

  • CVE-2007-3351Jun 22, 2007
    SJPhone
    SJPhone
    risk 0.00cvss —epss 0.02

    The SJPhone SIP soft phone 1.60.303c, when installed on the Dell Axim X3 running Windows Mobile 2003, allows remote attackers to cause a denial of service (device hang and traffic amplification) via a direct crafted INVITE transaction, which causes the phone to transmit many RTP…

  • CVE-2007-3352Jun 22, 2007
    Stephen Ostermiller
    Contact Form
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the preview form in Stephen Ostermiller Contact Form before 2.00.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that contain an apostrophe.

  • CVE-2007-3353Jun 22, 2007
    Mywebland
    Myevent
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in includes/template.php in MyEvent 1.6 allows remote attackers to execute arbitrary PHP code via a URL in the myevent_path parameter. NOTE: a reliable third party disputes this issue, saying "the entire file is a class.

  • CVE-2007-3354Jun 22, 2007
    Scriptdevelopers.net
    Netclassifieds
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition allow remote attackers to execute arbitrary SQL commands via the s_user_id parameter to ViewCat.php and other unspecified vectors. NOTE: the CatID/ViewCat.php, CatID/gallery.php, and ItemNum/ViewItem.php…

  • CVE-2007-3355Jun 22, 2007
    Scriptdevelopers.net
    Netclassifieds
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in NetClassifieds Premium Edition allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-3356Jun 22, 2007
    Scriptdevelopers.net
    Netclassifieds
    risk 0.00cvss —epss 0.02

    NetClassifieds Premium Edition allows remote attackers to obtain sensitive information via certain requests that reveal the path in an error message, related to the display_errors setting in (1) Common.php and (2) imageresizer.php, and (3) the use of __FILE__ in error reporting…

  • CVE-2007-3357Jun 22, 2007
    Scriptdevelopers.net
    Netclassifieds
    risk 0.00cvss —epss 0.01

    NetClassifieds Premium Edition does not use encryption for (1) stored passwords or (2) sensitive data, which might allow attackers to obtain information via certain vectors.

  • CVE-2007-3358Jun 22, 2007
    SerWeb
    SerWeb
    risk 0.08cvss —epss 0.68

    PHP remote file inclusion vulnerability in html/load_lang.php in SerWeb 0.9.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _SERWEB[serwebdir] parameter.

  • CVE-2007-3359Jun 22, 2007
    SerWeb
    SerWeb
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in SerWeb 0.9.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the _SERWEB[serwebdir] parameter to (1) html/load_apu.php or (2) html/mail_prepend.php. NOTE: the provenance of this information is…

  • CVE-2007-3360Jun 22, 2007
    Bitchx
    Bitchx
    risk 0.04cvss —epss 0.07

    hook.c in BitchX 1.1-final allows remote IRC servers to execute arbitrary commands by sending a client certain data containing NICK and EXEC strings, which exceeds the bounds of a hash table, and injects an EXEC hook function that receives and executes shell commands.

  • CVE-2007-3361Jun 22, 2007
    Nortel
    Pc Client Soft Phone Sip
    risk 0.00cvss —epss 0.02

    The Nortel PC Client SIP Soft Phone 4.1 3.5.208[20051015] allows remote attackers to cause a denial of service (device crash) via a SIP message with a malformed header.

  • CVE-2007-3362Jun 22, 2007
    Ageet
    Agephone
    risk 0.00cvss —epss 0.02

    ageet AGEphone before 1.6.2, running on Windows Mobile 5 on the HTC HyTN Pocket PC device, allows remote attackers to (1) cause a denial of service (call disruption and device hang) via a SIP message with a malformed header and (2) cause a denial of service (call disruption,…

  • CVE-2007-3363Jun 22, 2007
    Ageet
    Agephone
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in ageet AGEphone before 1.6.3 allow remote attackers to have an unknown impact via malformed SIP packets.

  • CVE-2007-3364Jun 22, 2007
    Caddy Project
    Myserver
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the cgi-bin/post.mscgi sample page in MyServer 0.8.9 allows remote attackers to inject arbitrary web script or HTML via the body content.

  • CVE-2007-3365HigJun 22, 2007
    Myserverproject
    Myserver
    risk 0.52cvss 7.5epss 0.06

    MyServer 0.8.9 and earlier does not properly handle uppercase characters in filename extensions, which allows remote attackers to obtain sensitive information (script source code) via a modified extension, as demonstrated by post.mscgI.

  • CVE-2007-3366Jun 22, 2007
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Simple CGI Wrapper (scgiwrap) in cPanel before 10.9.1, and 11.x before 11.4.19-R14378, allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2007-3367Jun 22, 2007
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.01

    Simple CGI Wrapper (scgiwrap) in cPanel before 10.9.1, and 11.x before 11.4.19-R14378, allows remote attackers to obtain sensitive information via a direct request, which reveals the path in an error message. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2007-3368Jun 22, 2007
    Polycom
    Soundpoint IP 601
    risk 0.00cvss —epss 0.02

    Buffer overflow in the HTTP server on the Polycom SoundPoint IP 601 SIP phone with BootROM 3.0.x+ allows remote attackers to cause a denial of service (device reboot) via a malformed CGI parameter.

  • CVE-2007-3369Jun 22, 2007
    Polycom
    Soundpoint IP 601
    risk 0.00cvss —epss 0.02

    Buffer overflow in the Polycom SoundPoint IP 601 SIP phone with BootROM 3.0.x+ and SIP version 1.6.3.0067 allows remote attackers to cause a denial of service (device hang or reboot) via an INVITE message with a long Via header.

  • CVE-2007-3370Jun 22, 2007
    Kim Kyoung Min
    Sun Board
    risk 0.09cvss —epss 0.75

    Multiple PHP remote file inclusion vulnerabilities in Sun Board 1.00.00 Alpha allow remote attackers to execute arbitrary PHP code via a URL in (1) the sunPath parameter to include.php or (2) the dir parameter to skin/board/default/doctype.php.

  • CVE-2007-3371Jun 22, 2007
    Powl
    Powl
    risk 0.09cvss —epss 0.71

    PHP remote file inclusion vulnerability in plugins/widgets/htmledit/htmledit.php in Powl 0.94 allows remote attackers to execute arbitrary PHP code via a URL in the _POWL[installPath] parameter.

  • CVE-2006-7206Jun 22, 2007
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.22

    Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by creating a ADODB.Recordset object and making a series of calls to the NextRecordset method with a long string argument, which causes an "invalid memory access" in the…

  • CVE-2007-3341Jun 21, 2007
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.11

    Unspecified vulnerability in the FTP implementation in Microsoft Internet Explorer allows remote attackers to "see a valid memory address" via unspecified vectors, a different issue than CVE-2007-0217.

  • CVE-2007-3342Jun 21, 2007
    Movabletype
    Movabletype
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Movable Type (MT) before 3.34 allow remote attackers to inject arbitrary web script or HTML via comments that have (1) a malformed SGML numeric character reference with a '\0' (0x00) character in a javascript: URI or (2) an…

  • CVE-2007-3334Jun 21, 2007
    Ca
    Etrust Secure Content Manager
    risk 0.04cvss —epss 0.10

    Multiple heap-based buffer overflows in the (1) Communications Server (iigcc.exe) and (2) Data Access Server (iigcd.exe) components for Ingres Database Server 3.0.3, as used in CA (Computer Associates) products including eTrust Secure Content Manager r8 on Windows, allow remote…

  • CVE-2007-3340Jun 21, 2007
    Bughunter
    HTTP Server
    risk 0.03cvss —epss 0.04

    BugHunter HTTP SERVER (httpsv.exe) 1.6.2 allows remote attackers to cause a denial of service (application crash) via a large number of requests for nonexistent pages.

  • CVE-2007-3339Jun 21, 2007
    Fusetalk.
    Fusetalk
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, Enterprise, and ColdFusion allow remote attackers to inject arbitrary web script or HTML via the (1) FTVAR_LINKP and (2) FTVAR_URLP parameters to (a)…

  • CVE-2007-2833Jun 21, 2007
    GNU
    Emacs
    risk 0.00cvss —epss 0.02

    Emacs 21 allows user-assisted attackers to cause a denial of service (crash) via certain crafted images, as demonstrated via a GIF image in vm mode, related to image size calculation.

  • CVE-2007-3332Jun 21, 2007
    PHP-Nuke
    Satel Lite
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in Satellite.php in Satel Lite for PhpNuke allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the name parameter in a modload action.

  • CVE-2007-3335Jun 21, 2007
    Phpecho CMS
    CMS
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the admin panel in PHPEcho CMS before 1.6 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2007-3312Jun 21, 2007
    Jasmine
    CMS
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in admin/plugin_manager.php in Jasmine CMS 1.0 allows remote authenticated administrators to include and execute arbitrary local files a .. (dot dot) in the u parameter. NOTE: a separate vulnerability could be leveraged to make this issue…

  • CVE-2007-3313Jun 21, 2007
    Efstratios Geroulis
    Jasmine CMS
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Jasmine CMS 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the login_username parameter to login.php or (2) the item parameter to news.php.

  • CVE-2007-3314Jun 21, 2007
    Altap
    Portable Executable Viewer
    risk 0.06cvss —epss 0.43

    Stack-based buffer overflow in peviewer.spl in Altap Servant Salamander 2.5 with Portable Executable Viewer 2.02 (English Trial), and 2.0 with Portable Executable Viewer 1.00 (English Trial), allows remote attackers to execute arbitrary code via a long PDB debug filename in a PE…

  • CVE-2007-3315Jun 21, 2007
    Yourfreescreamer
    Yourfreescreamer
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in YourFreeScreamer 1.0, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the serverPath parameter to bodyTemplate.php in (1) templates/Classic/, (2) templates/Classic…

  • CVE-2007-3316Jun 21, 2007
    VideoLAN
    VLC media player
    risk 0.01cvss —epss 0.17

    Multiple format string vulnerabilities in plugins in VideoLAN VLC Media Player before 0.8.6c allow remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in (1) an Ogg/Vorbis file, (2) an Ogg/Theora file, (3) a CDDB entry for…