VYPR

CVEs

382,819 total · page 7164 of 7,657

AllCriticalHighKEV
  • CVE-2007-2648May 14, 2007
    Clever
    Database Comparer
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in the Clever Database Comparer 2.2 ActiveX control (comparerax.ocx) allows remote attackers to execute arbitrary code via a long argument to the ConnectToDatabase function.

  • CVE-2007-2649May 14, 2007
    Telekom
    Speedport W 700v
    risk 0.00cvss —epss 0.02

    Deutsche Telekom (T-com) Speedport W 700v uses JavaScript delays for invalid authentication attempts to the CGI script, which allows remote attackers to bypass the delays and conduct brute-force attacks via direct calls to the authentication CGI script.

  • CVE-2007-2650May 14, 2007
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.03

    The OLE2 parser in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service (resource consumption) via an OLE2 file with (1) a large property size or (2) a loop in the FAT file block chain that triggers an infinite loop, as demonstrated via a crafted DOC file.

  • CVE-2007-2651May 14, 2007
    VooDoo
    cIRCle
    risk 0.00cvss —epss 0.03

    Multiple off-by-one errors in VooDoo cIRCle before 1.1.beta27 allow remote attackers to cause a denial of service (connection loss) or possibly execute arbitrary code via a (1) DNS name response of the exact length as a buffer; or a long (2) channel name, (3) partyline channel…

  • CVE-2007-2652May 14, 2007
    Freebox
    Free Sa
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in Free-SA before 1.2.2 allow remote attackers to execute arbitrary code via unspecified vectors involving certain (1) sprintf and (2) vsprintf calls in (a) r_index.c, (b) r_reports.c, (c) r_topsites.c, (d) r_topuser.c, (e) r_typical.c, (f)…

  • CVE-2007-2654May 14, 2007
    Xfsdump
    Xfsdump
    risk 0.00cvss —epss 0.00

    xfs_fsr in xfsdump creates a .fsr temporary directory with insecure permissions, which allows local users to read or overwrite arbitrary files on xfs filesystems.

  • CVE-2007-2655May 14, 2007
    Netwin
    Surgemail
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in NetWin Webmail 3.1s-1 in SurgeMail before 3.8i2 has unknown impact and remote attack vectors, possibly a format string vulnerability that allows remote code execution.

  • CVE-2006-7203May 14, 2007
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The compat_sys_mount function in fs/compat.c in Linux kernel 2.6.20 and earlier allows local users to cause a denial of service (NULL pointer dereference and oops) by mounting a smbfs file system in compatibility mode ("mount -t smbfs").

  • CVE-2007-2631May 13, 2007
    SquirrelMail
    Squirrelmail
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in SquirrelMail 1.4.8-4.fc6 and earlier allows remote attackers to perform unspecified actions as arbitrary users via unspecified vectors. NOTE: this issue might overlap CVE-2007-2589 or CVE-2002-1648.

  • CVE-2007-2632May 13, 2007
    PHP Multi User Randomizer
    PHP Multi User Randomizer
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in PHP Multi User Randomizer (phpMUR) 2006.09.13 allow remote attackers to inject arbitrary web script or HTML via (1) the edit_plugin parameter to configure_plugin.tpl.php, or (2) certain array parameters to web/phpinfo.php,…

  • CVE-2007-2633May 13, 2007
    Positive Software
    Sitestudio
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in H-Sphere SiteStudio 1.6 allows remote attackers to read, or include and execute, arbitrary local files via a .. (dot dot) in the template parameter.

  • CVE-2007-2634May 13, 2007
    Agner Fog
    Aforum
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in common/errormsg.php in aForum 1.32 and possibly earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the header parameter. NOTE: the provenance of this information is unknown;…

  • CVE-2007-2635May 13, 2007
    Interchange Development Group
    Interchange
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Interchange before 5.4.2 allows remote attackers to cause an unspecified denial of service (possibly server hang) via crafted HTTP requests.

  • CVE-2007-2636May 13, 2007
    Jason Frisvold
    Phptodo
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in phpTodo before 0.8.1 allows remote attackers to have an unknown impact via newlines in regular expressions to (1) index.php, (2) feed.php, (3) prefs.php, and (4) todolist.php; and (5) classTodoItem.php and (6) phpTodoUser.php in libs/. NOTE: some of…

  • CVE-2007-2637May 13, 2007
    Moinmo
    Moinmoin
    risk 0.00cvss —epss 0.01

    MoinMoin before 20070507 does not properly enforce ACLs for calendars and includes, which allows remote attackers to read certain pages via unspecified vectors.

  • CVE-2007-2638May 13, 2007
    Efilecabinet
    Efilecabinet
    risk 0.00cvss —epss 0.03

    eFileCabinet 3.3 allows remote attackers to bypass authentication and access restricted portions of the interface via an invalid filecabinetnumber, which can be leveraged to obtain sensitive information or create new data structures.

  • CVE-2007-2639May 13, 2007
    TFTPdWin
    TFTPdWin
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in TFTPdWin 0.4.2 allows remote attackers to read or modify arbitrary files outside the TFTP root via unspecified vectors.

  • CVE-2007-2640May 13, 2007
    LibTMCG
    LibTMCG
    risk 0.00cvss —epss 0.01

    LibTMCG before 1.1.1 does not perform a range check to avoid "trivial group generators," which allows attackers to obtain sensitive information about private cards.

  • CVE-2007-2641May 13, 2007
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in W1L3D4_bolum.asp in W1L3D4 Philboard 0.2 allows remote attackers to execute arbitrary SQL commands via the forumid parameter, a different vector than CVE-2007-0920.

  • CVE-2007-2642May 13, 2007
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in galeria.php in R2K Gallery 1.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the lang2 parameter.

  • CVE-2007-2643May 13, 2007
    Pinkcrow Designs
    Designs Gallery Magazin
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in phpThumb.php in PinkCrow Designs Gallery or maGAZIn 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the src parameter.

  • CVE-2007-2644May 13, 2007
    Barcodewiz
    Barcode ActiveX Professional
    risk 0.03cvss —epss 0.05

    A certain ActiveX control in Morovia Barcode ActiveX Professional 3.3.1304 allows remote attackers to overwrite arbitrary files by calling the Save method with an arbitrary filename.

  • CVE-2007-0748May 13, 2007
    Apple Inc.
    Darwin Streaming Server
    risk 0.01cvss —epss 0.06

    Heap-based buffer overflow in Apple Darwin Streaming Proxy, when using Darwin Streaming Server before 5.5.5, allows remote attackers to execute arbitrary code via multiple trackID values in a SETUP RTSP request.

  • CVE-2007-0749May 13, 2007
    Apple Inc.
    Darwin Streaming Server
    risk 0.01cvss —epss 0.06

    Multiple stack-based buffer overflows in the is_command function in proxy.c in Apple Darwin Streaming Proxy, when using Darwin Streaming Server before 5.5.5, allow remote attackers to execute arbitrary code via a long (1) cmd or (2) server value in an RTSP request.

  • CVE-2007-2624May 11, 2007
    Tecnick
    Aiocp
    risk 0.00cvss —epss 0.01

    Dynamic variable evaluation vulnerability in shared/config/cp_config.php in All In One Control Panel (AIOCP) before 1.3.016 allows remote attackers to conduct cross-site scripting (XSS) and possibly other attacks via the SERVER superglobal array. NOTE: some of these details are…

  • CVE-2007-2625May 11, 2007
    Tecnick
    Aiocp
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in shared/code/cp_authorization.php in All In One Control Panel (AIOCP) before 1.3.016 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. NOTE: some of these details are obtained from third party…

  • CVE-2007-2626May 11, 2007
    Free PHP Scripts
    Schoolboard
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in admin.php in SchoolBoard allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters. NOTE: CVE disputes this issue, because 'username' does not exist, and the password is not used in any queries

  • CVE-2007-2627May 11, 2007
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in sidebar.php in WordPress, when custom 404 pages that call get_sidebar are used, allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF), a different vulnerability than CVE-2007-1622.

  • CVE-2007-2628May 11, 2007
    Justin Koivisto
    Phpsecurityadmin
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in include/logout.php in Justin Koivisto SecurityAdmin for PHP (aka PHPSecurityAdmin, PSA) 4.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the PSA_PATH parameter.

  • CVE-2007-2629May 11, 2007
    Bradfordnetworks
    CampusManager Network Control Application Server
    risk 0.00cvss —epss 0.02

    Bradford CampusManager Network Control Application Server 3.1(6) allows remote attackers to obtain sensitive information (backup, log, and configuration files) via direct request for certain files in (1) /runTime/ or (2) /remediationReports/.

  • CVE-2007-2630May 11, 2007
    Activecampaign
    1 2 All Broadcast Email
    risk 0.00cvss —epss 0.01

    Incomplete blacklist vulnerability in filemanager/browser/default/connectors/php/config.php in the FCKeditor module, as used in ActiveCampaign 1-2-All (aka 12All) 4.50 through 4.53.13, and possibly other products, allows remote authenticated administrators to upload and possibly…

  • CVE-2007-2616May 11, 2007
    Novell
    Netmail
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in the SSL version of the NMDMC.EXE service in Novell NetMail 3.52e FTF2 and probably earlier allows remote attackers to execute arbitrary code via a crafted request.

  • CVE-2007-2617May 11, 2007
    Sun Corporation
    Net Connect Software
    risk 0.03cvss —epss 0.04

    srsexec in Sun Remote Services (SRS) Net Connect Software Proxy Core package in Sun Solaris 10 does not enforce file permissions when opening files, which allows local users to read the first line of arbitrary files via the -d and -v options.

  • CVE-2007-2618May 11, 2007
    Drake Team
    Drake CMS
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in index.php in Drake CMS 0.4.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the lang parameter. NOTE: Drake CMS has only a beta version available, and the vendor has…

  • CVE-2007-2619May 11, 2007
    Symantec
    Pcanywhere
    risk 0.00cvss —epss 0.00

    Symantec pcAnywhere 11.5.x and 12.0.x retains unencrypted login credentials for the most recent login within process memory, which allows local administrators to obtain the credentials by reading process memory, a different vulnerability than CVE-2006-3785.

  • CVE-2007-2620May 11, 2007
    Jakub Steiner
    Original
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in inc/config.inc.php in Jakub Steiner (aka jimmac) original 0.11 allows remote attackers to execute arbitrary PHP code via a URL in the x[1] parameter.

  • CVE-2007-2621May 11, 2007
    Thyme
    Thyme Calendar
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in event_view.php in Thyme Calendar 1.3 allows remote attackers to execute arbitrary SQL commands via the eid parameter.

  • CVE-2007-2622May 11, 2007
    Taskdriver
    Taskdriver
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in TaskDriver 1.2 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the username parameter to login.php or (2) the taskid parameter to notes.php.

  • CVE-2007-2623May 11, 2007
    Remote Display Dev kit
    RControl.dll
    risk 0.03cvss —epss 0.04

    Multiple buffer overflows in RControl.dll in Remote Display Dev kit 1.2.1.0 allow remote attackers to cause a denial of service (Internet Explorer 7 crash) via (1) a long first argument to the connect function or (2) a long InternalServer property value, possibly involving…

  • CVE-2006-3456May 11, 2007
    Symantec
    Norton Antivirus
    risk 0.00cvss —epss 0.04

    The Symantec NAVOPTS.DLL ActiveX control (aka Symantec.Norton.AntiVirus.NAVOptions) 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to "crash…

  • CVE-2007-2594May 11, 2007
    Phpmyportal
    Phpmyportal
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in inc/articles.inc.php in phpMyPortal 3.0.0 RC3 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[CHEMINMODULES] parameter.

  • CVE-2007-2595May 11, 2007
    Rscript
    Rsauction
    risk 0.00cvss —epss 0.01

    RSAuction 2.73.1.3 allows remote authenticated users to move their own account status from Suspended to Active via a direct request for the activation URL that is provided at the time of account registration. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2007-2596May 11, 2007
    Agner Fog
    Aforum
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in common/func.php in aForum 1.32 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CommonAbsDir parameter.

  • CVE-2007-2597May 11, 2007
    Telltargetcms
    Telltarget CMS
    risk 0.04cvss —epss 0.10

    Multiple PHP remote file inclusion vulnerabilities in telltarget CMS 1.3.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) ordnertiefe parameter to site_conf.php; or the (2) tt_docroot parameter to (a) class.csv.php, (b) produkte_nach_serie.php, or (c)…

  • CVE-2007-2598May 11, 2007
    Simplenews
    Simplenews
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execute arbitrary SQL commands via the news_id parameter.

  • CVE-2007-2599May 11, 2007
    TutorialCMS
    TutorialCMS
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) catFile parameter to (a) browseCat.php or (b) browseSubCat.php; the (2) id parameter to (c) openTutorial.php, (d)…

  • CVE-2007-2600May 11, 2007
    Wavelink Media
    Tutorialcms
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) catFile parameter to (a) browseCat.php or (b) browseSubCat.php; the (2) id parameter to (c)…

  • CVE-2007-2601May 11, 2007
    Divx
    Zenith Player
    risk 0.00cvss —epss 0.05

    Buffer overflow in a certain ActiveX control in the GDivX Zenith Player AviFixer class in fix.dll 1.0.0.1 allows remote attackers to execute arbitrary code via a long SetInputFile property value.

  • CVE-2007-2602May 11, 2007
    Ipswitch, Inc.
    Whatsup
    risk 0.00cvss —epss 0.03

    Buffer overflow in MIBEXTRA.EXE in Ipswitch WhatsUp Gold 11 allows attackers to cause a denial of service (application crash) or execute arbitrary code via a long MIB filename argument. NOTE: If there is not a common scenario under which MIBEXTRA.EXE is called with…

  • CVE-2007-2603May 11, 2007
    Audio Cd Tools
    Audio Cd Ripper Ocx
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Init function in the Audio CD Ripper OCX (AudioCDRipperOCX.ocx) 1.0 ActiveX control allows remote attackers to cause a denial of service (NULL dereference and Internet Explorer crash) via unspecified vectors.