VYPR

CVEs

382,834 total · page 7163 of 7,657

AllCriticalHighKEV
  • CVE-2007-2707May 16, 2007
    Linksnet
    Newsfeed
    risk 0.08cvss —epss 0.68

    PHP remote file inclusion vulnerability in linksnet_linkslog_rss.php in Linksnet Newsfeed 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the dirpath_linksnet_newsfeed parameter.

  • CVE-2007-2708May 16, 2007
    Feindt Computerservice
    News Script
    risk 0.08cvss —epss 0.63

    PHP remote file inclusion vulnerability in newsadmin.php in Feindt Computerservice News (News-Script) 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the action parameter.

  • CVE-2007-2709May 16, 2007
    Nagiosql
    Nagiosql
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in functions/prepend_adm.php in NagiosQL 2005 2.00 allows remote attackers to execute arbitrary PHP code via a URL in the SETS[path][physical] parameter.

  • CVE-2007-2710May 16, 2007
    Nagiosql
    Nagiosql
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in functions/prepend_adm.php in NagiosQL 2.00-P00 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the SETS[path][IT] parameter. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2007-2711May 16, 2007
    TinyIdentD
    TinyIdentD
    risk 0.08cvss —epss 0.63

    Stack-based buffer overflow in TinyIdentD 2.2 and earlier allows remote attackers to execute arbitrary code via a long string to TCP port 113.

  • CVE-2007-2712May 16, 2007
    MH Software
    Connect Daily
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in MH Software Connect Daily before 3.3.3 has unknown impact and attack vectors.

  • CVE-2007-2713May 16, 2007
    IFdate
    iFdate
    risk 0.00cvss —epss 0.03

    ifdate 2.x sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to obtain administrative access via a direct request for the admin/ URI.

  • CVE-2007-2714May 16, 2007
    Matt Mullenweg
    Akismet
    risk 0.04cvss —epss 0.11

    Unspecified vulnerability in akismet.php in Matt Mullenweg Akismet before 2.0.2, a WordPress plugin, has unknown impact and attack vectors.

  • CVE-2007-2715May 16, 2007
    Snaps Gallery
    Snaps Gallery
    risk 0.04cvss —epss 0.10

    Admin/users.php in Snaps! Gallery 1.4.4 allows remote attackers to change arbitrary usernames and passwords via the (1) username, or the (2) password and password2 parameters in an edit action.

  • CVE-2007-2688May 16, 2007
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    The Cisco Intrusion Prevention System (IPS) and IOS with Firewall/IPS Feature Set do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic.

  • CVE-2007-2689May 16, 2007
    Checkpoint
    Web Intelligence
    risk 0.00cvss —epss 0.02

    Check Point Web Intelligence does not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic.

  • CVE-2007-2690May 16, 2007
    IBM
    Proventia Series
    risk 0.00cvss —epss 0.02

    Multiple IBM ISS Proventia Series products, including the A, G, and M series, do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic.

  • CVE-2007-2691May 16, 2007
    MySQL
    MySQL
    risk 0.00cvss —epss 0.03

    MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables.

  • CVE-2007-2692May 16, 2007
    MySQL
    MySQL
    risk 0.00cvss —epss 0.02

    The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.

  • CVE-2007-2693May 16, 2007
    MySQL
    MySQL
    risk 0.00cvss —epss 0.02

    MySQL before 5.1.18 allows remote authenticated users without SELECT privileges to obtain sensitive information from partitioned tables via an ALTER TABLE statement.

  • CVE-2007-2694May 16, 2007
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-2695May 16, 2007
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.03

    The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to…

  • CVE-2007-2696May 16, 2007
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.02

    The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server.

  • CVE-2007-2697May 16, 2007
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.02

    The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks…

  • CVE-2007-2698May 16, 2007
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.02

    The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information.

  • CVE-2007-2699May 16, 2007
    Bea
    WebLogic Server
    risk 0.02cvss —epss 0.29

    The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files.

  • CVE-2007-2700May 16, 2007
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.02

    The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information.

  • CVE-2007-2701May 16, 2007
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.02

    The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and "send unauthorized messages…

  • CVE-2007-2702May 16, 2007
    Bea
    WebLogic Portal
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the GroupSpace application in BEA WebLogic Portal 9.2 GA allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the rich text editor.

  • CVE-2007-2703May 16, 2007
    Bea
    WebLogic Portal
    risk 0.00cvss —epss 0.02

    BEA WebLogic Portal 9.2 GA can corrupt a visitor entitlements role if an administrator provides a long role description, which might allow remote authenticated users to access privileged resources.

  • CVE-2007-2704May 16, 2007
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.02

    BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailability) by accessing a half-closed SSL socket.

  • CVE-2007-2705May 16, 2007
    Bea
    Weblogic Integration
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the Test View Console in BEA WebLogic Integration 9.2 before SP1 and WebLogic Workshop 8.1 SP2 through SP6, when "deployed in an exploded format," allows remote attackers to list a WebLogic Workshop Directory (wlwdir) parent directory via…

  • CVE-2007-2683May 15, 2007
    Mutt
    Mutt
    risk 0.03cvss —epss 0.01

    Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code via "&" characters in the GECOS field, which triggers the overflow during alias expansion.

  • CVE-2007-2678May 15, 2007
    Netsprint
    Netsprint Toolbar
    risk 0.03cvss —epss 0.04

    Buffer overflow in the isChecked function in toolbar.dll in Netsprint Toolbar 1.1 might allow remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2007-2679May 15, 2007
    Simplephpscripts
    Gallery
    risk 0.00cvss —epss 0.01

    PHP file inclusion vulnerability in index.php in Ivan Peevski gallery 0.3 in Simple PHP Scripts (sphp) allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the gallery parameter, which is accessed by the file_exists function.…

  • CVE-2007-2680May 15, 2007
    Canon
    Network Camera Server Vb100
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the management interface in Canon Network Camera Server VB100 and VB101 with firmware 3.0 R69 and earlier, and VB150 with firmware 1.1 R39 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified…

  • CVE-2007-2681May 15, 2007
    B2evolution
    B2evolution
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in blogs/index.php in b2evolution 1.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the core_subdir parameter.

  • CVE-2007-2656May 14, 2007
    Hewlett-Packard
    Magview ActiveX Control
    risk 0.03cvss —epss 0.04

    Stack-based buffer overflow in the Hewlett-Packard (HP) Magview ActiveX control in hpqvwocx.dll 1.0.0.309 allows remote attackers to cause a denial of service (application crash) and possibly have other impact via a long argument to the DeleteProfile method.

  • CVE-2007-2657May 14, 2007
    Precisionid Barcode
    Precisionid Barcode
    risk 0.03cvss —epss 0.04

    Unspecified vulnerability in the PrecisionID Barcode 1.3 ActiveX control in PrecisionID_DataMatrix.DLL allows remote attackers to cause a denial of service via a long argument to the SaveBarCode method.

  • CVE-2007-2658May 14, 2007
    ID Automation
    Linear Barcode
    risk 0.03cvss —epss 0.04

    Unspecified vulnerability in the ID Automation Linear Barcode 1.6.0.5 ActiveX control in IDAutomationLinear6.dll allows remote attackers to cause a denial of service via a long argument to the SaveEnhWMF method.

  • CVE-2007-2659May 14, 2007
    phpATM
    phpATM
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in index.php in PHP Advanced Transfer Manager (phpATM) 1.30 allows remote attackers to read arbitrary files and obtain script source code via a .. (dot dot) in the directory parameter in a downloadfile action.

  • CVE-2007-2660May 14, 2007
    Cjg Explorer Pro
    Cjg Explorer Pro
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir…

  • CVE-2007-2661May 14, 2007
    BlogMe
    BlogMe
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in archshow.asp in BlogMe 3.0 allows remote attackers to execute arbitrary SQL commands via the var parameter, a different vector than CVE-2006-5976.

  • CVE-2007-2662May 14, 2007
    Efestech
    Efestech Haber
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in EfesTECH Haber 5.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to the top-level URI.

  • CVE-2007-2663May 14, 2007
    Beacon
    Beacon
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in language/1/splash.lang.php in Beacon 0.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the languagePath parameter.

  • CVE-2007-2664May 14, 2007
    Yaap
    Yaap
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/common.php in Yaap 1.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter, possibly related to the __autoload function.

  • CVE-2007-2665May 14, 2007
    PHP Firstpost
    PHP Firstpost
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in block.php in PhpFirstPost 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the Include parameter.

  • CVE-2007-2666May 14, 2007
    Scintilla
    Scintilla
    risk 0.04cvss —epss 0.16

    Stack-based buffer overflow in LexRuby.cxx (SciLexer.dll) in Scintilla 1.73, as used by notepad++ 4.1.1 and earlier, allows user-assisted remote attackers to execute arbitrary code via certain Ruby (.rb) files with long lines. NOTE: this was originally reported as a…

  • CVE-2007-2667May 14, 2007
    Db Soft Lab
    Vimpx
    risk 0.03cvss —epss 0.06

    Buffer overflow in the DB Software Laboratory VImpX ActiveX control in VImpX.ocx 4.7.3 allows remote attackers to execute arbitrary code via a long LogFile parameter.

  • CVE-2007-2668May 14, 2007
    Webdesproxy
    Webdesproxy
    risk 0.03cvss —epss 0.04

    Buffer overflow in webdesproxy 0.0.1 allows remote attackers to execute arbitrary code via a long URL, possibly involving the process_connection_request function in webdesproxy.c.

  • CVE-2007-2669May 14, 2007
    PHPChain
    PHPChain
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in PHPChain 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the catid parameter to (1) settings.php or (2) cat.php. NOTE: certain parameter values also trigger path disclosure.

  • CVE-2007-2670May 14, 2007
    PHPChain
    PHPChain
    risk 0.00cvss —epss 0.01

    PHPChain 1.0 and earlier allows remote attackers to obtain the installation path via invalid values of the catid parameter to (1) settings.php or (2) cat.php, as demonstrated by XSS manipulations.

  • CVE-2007-2671May 14, 2007
    Mozilla Corporation
    Firefox
    risk 0.03cvss —epss 0.03

    Mozilla Firefox 2.0.0.3 allows remote attackers to cause a denial of service (application crash) via a long hostname in an HREF attribute in an A element, which triggers an out-of-bounds memory access.

  • CVE-2007-2672May 14, 2007
    Thinc4orce Marketing Group
    PHP Coupon Script
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in index.php in PHP Coupon Script 3.0 allows remote attackers to execute arbitrary SQL commands via the bus parameter in a viewbus page.

  • CVE-2007-2673May 14, 2007
    Censura
    Censura
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in includes/funcs_vendors.php in Censura 1.15.04, and other versions before 1.16.04, allows remote attackers to execute arbitrary SQL commands via the vendorid parameter in a vendor_info cmd action to censura.php.