VYPR

CVEs

382,641 total · page 7168 of 7,653

AllCriticalHighKEV
  • CVE-2007-2289Apr 26, 2007
    Alexscriptengine
    Download Engine
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in admin/includes/spaw/dialogs/insert_link.php in download engine (Download-Engine) 1.4.1 allows remote authenticated users to execute arbitrary PHP code via a URL in the spaw_root parameter, a different vector than CVE-2007-2255. NOTE:…

  • CVE-2007-2290Apr 26, 2007
    Cafelog
    B2
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in B2 Weblog and News Publishing Tool 0.6.1 allow remote attackers to execute arbitrary PHP code via a URL in the b2inc parameter to (1) b2archives.php, (2) b2categories.php, or (3) b2mail.php. NOTE: this may overlap…

  • CVE-2006-7197Apr 25, 2007
    Apache
    Tomcat
    risk 0.01cvss —epss 0.08

    The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory.

  • CVE-2007-2139Apr 25, 2007
    Ca
    Brightstor ARCserve Backup
    risk 0.09cvss —epss 0.78

    Multiple stack-based buffer overflows in the SUN RPC service in CA (formerly Computer Associates) BrightStor ARCserve Media Server, as used in BrightStor ARCserve Backup 9.01 through 11.5 SP2, BrightStor Enterprise Backup 10.5, Server Protection Suite 2, and Business Protection…

  • CVE-2007-2265Apr 25, 2007
    Phpee
    Ya Book
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in YA Book 0.98-alpha allows remote attackers to inject arbitrary web script or HTML via the City field in a sign action in index.php.

  • CVE-2007-2266Apr 25, 2007
    Progress (organisation)
    Webspeed Messenger
    risk 0.00cvss —epss 0.02

    Progress Webspeed Messenger allows remote attackers to read, create, modify, and execute arbitrary files by invoking webutil/_cpyfile.p in the WService parameter to (1) cgiip.exe or (2) wsisa.dll in scripts/, as demonstrated by using the save,editor options to create a new file…

  • CVE-2007-2267Apr 25, 2007
    Sun Corporation
    Cluster
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Sun Cluster 3.1 and Solaris Cluster 3.2 before 20070424 allows remote authenticated users, operating from a different cluster node, to cause a denial of service (data corruption or send_mondo panic) via unspecified vectors, as demonstrated by EMC…

  • CVE-2007-2268Apr 25, 2007
    Swsoft
    Plesk
    risk 0.03cvss —epss 0.04

    Multiple directory traversal vulnerabilities in SWsoft Plesk for Windows 7.6.1, 8.1.0, and 8.1.1 allow remote attackers to read arbitrary files via a .. (dot dot) in the locale_id parameter to (1) login.php3 or (2) login_up.php3.

  • CVE-2007-2269Apr 25, 2007
    Swsoft
    Plesk
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in top.php3 in SWsoft Plesk for Windows 8.1 and 8.1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the locale_id parameter.

  • CVE-2007-2270Apr 25, 2007
    Linksys
    Spa941
    risk 0.04cvss —epss 0.09

    The Linksys SPA941 VoIP Phone allows remote attackers to cause a denial of service (device reboot) via a 0377 (0xff) character in the From header, and possibly certain other locations, in a SIP INVITE request.

  • CVE-2007-2271Apr 25, 2007
    Rajneel Lal Totaram
    Usp Foss Distribution
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in Rajneel Lal TotaRam USP FOSS Distribution 1.01 allows remote attackers to read arbitrary files via a .. (dot dot) in the dnld parameter.

  • CVE-2007-2272Apr 25, 2007
    Advanced Webhost Billing System
    Advanced Webhost Billing System
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in docs/front-end-demo/cart2.php in Advanced Webhost Billing System (AWBS) 2.4.0 allows remote attackers to execute arbitrary PHP code via a URL in the workdir parameter.

  • CVE-2007-2273Apr 25, 2007
    Alessandro Lulli
    Wavewoo
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in include/loading.php in Alessandro Lulli wavewoo 0.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_include parameter.

  • CVE-2007-2274Apr 25, 2007
    Opera
    Opera
    risk 0.04cvss —epss 0.08

    The BitTorrent implementation in Opera 9.2 allows remote attackers to cause a denial of service (CPU consumption and application crash) via a malformed torrent file. NOTE: the original disclosure refers to this as a memory leak, but it is not certain.

  • CVE-2007-2275Apr 25, 2007
    Microfocus
    Storageworks Command View
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in HP StorageWorks Command View Advanced Edition for XP before 5.6.0-01, XP Replication Monitor before 5.6.0-01, and XP Tiered Storage Manager before 5.5.0-02 allows local users to access other accounts via unspecified vectors during registration or…

  • CVE-2007-2276Apr 25, 2007
    risk 0.00cvss —epss 0.02

    3Com TippingPoint IPS allows remote attackers to cause a denial of service (device hang) via a flood of packets on TCP port 80 with sequentially increasing source ports, related to a "badly written loop." NOTE: the vendor disputes this issue, stating that the product has…

  • CVE-2007-2277Apr 25, 2007
    Plogger
    Plogger
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in Plogger allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.

  • CVE-2007-2278Apr 25, 2007
    Dcp Portal
    Dcp Portal
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in DCP-Portal 6.1.1 allow remote attackers to execute arbitrary PHP code via a URL in (1) the path parameter to library/adodb/adodb.inc.php, (2) the abs_path_editor parameter to library/editor/editor.php, or (3) the…

  • CVE-2007-2252Apr 25, 2007
    Exponent
    Exponentcms
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in iconspopup.php in Exponent CMS 0.96.6 Alpha and earlier allows remote attackers to obtain sensitive information via a .. (dot dot) in the icodir parameter.

  • CVE-2007-2253Apr 25, 2007
    Exponent
    Exponentcms
    risk 0.00cvss —epss 0.01

    Exponent CMS 0.96.6 Alpha and earlier allows remote attackers to obtain path information via a direct request for (1) sdk/blanks/formcontrol.php and (2) sdk/blanks/file_modules.php.

  • CVE-2007-2254Apr 25, 2007
    Deltascripts
    PHP Classifieds
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in admin/setup/level2.php in PHP Classifieds 6.04, and probably earlier versions, allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: this product was referred to as "Allfaclassfieds" in the…

  • CVE-2007-2255Apr 25, 2007
    Alexscriptengine
    Download Engine
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) eng_dir parameter to addmember.php, (2) lang_path parameter to admin/enginelib/class.phpmailer.php, and the (3) spaw_root…

  • CVE-2007-2256Apr 25, 2007
    Tjschat
    Tjschat
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in you.php in TJSChat 0.95 allows remote attackers to inject arbitrary web script or HTML via the user parameter.

  • CVE-2007-2257Apr 25, 2007
    Fully Modded Phpbb
    Fully Modded Phpbb2
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in subscp.php in Fully Modded phpBB2 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2007-2258Apr 25, 2007
    Phpmybibli
    Phpmybibli
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in includes/init.inc.php in PHPMyBibli allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter.

  • CVE-2007-2259Apr 25, 2007
    Esforum
    Esforum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in forum.php in EsForum 3.0 allows remote attackers to execute arbitrary SQL commands via the idsalon parameter.

  • CVE-2007-2260Apr 25, 2007
    Bibtex
    Mase
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in bibtex mase beta 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the bibtexrootrel parameter to (1) unavailable.php, (2) source.php, (3) log.php, (4) latex.php, (5) indexinfo.php, (6) index.php, (7)…

  • CVE-2007-2261Apr 25, 2007
    Realink
    C Arbre
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in espaces/communiques/annotations.php in C-Arbre 0.6PR7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter, a different vector than CVE-2007-1721.

  • CVE-2007-2262Apr 25, 2007
    Sinato
    Jmuffin
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in html/php/detail.php in Sinato jmuffin allow remote attackers to execute arbitrary PHP code via a URL in the (1) relPath and (2) folder parameters. NOTE: this product was originally reported as "File117".

  • CVE-2007-2242Apr 25, 2007
    Ietf
    Ipv6
    risk 0.00cvss —epss 0.05

    The IPv6 protocol allows remote attackers to cause a denial of service via crafted IPv6 type 0 route headers (IPV6_RTHDR_TYPE_0) that create network amplification between two routers.

  • CVE-2007-2243Apr 25, 2007
    OpenSSL Project
    OpenSSL
    risk 0.00cvss —epss 0.02

    OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483.

  • CVE-2007-2244Apr 25, 2007
    Adobe Inc.
    Photoshop
    risk 0.06cvss —epss 0.32

    Multiple buffer overflows in Adobe Photoshop CS2 and CS3, Illustrator CS3, and GoLive 9 allow user-assisted remote attackers to execute arbitrary code via a crafted (1) BMP, (2) DIB, or (3) RLE file.

  • CVE-2007-2245Apr 25, 2007
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.10.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the fieldkey parameter to browse_foreigners.php or (2) certain input to the PMA_sanitize function.

  • CVE-2007-2246Apr 25, 2007
    Sendmail, Inc.
    Sendmail
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in HP-UX B.11.00 and B.11.11, when running sendmail 8.9.3 or 8.11.1; and HP-UX B.11.23 when running sendmail 8.11.1; allows remote attackers to cause a denial of service via unknown attack vectors. NOTE: due to the lack of details from HP, it is not…

  • CVE-2007-2247Apr 25, 2007
    Phpmyspace
    Phpmyspace
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in modules/news/article.php in phpMySpace Gold 8.10 allows remote attackers to execute arbitrary SQL commands via the item_id parameter.

  • CVE-2007-2248Apr 25, 2007
    Phorum
    Phorum
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the (1) group_id parameter in the groups module or (2) the smiley_id parameter in the smileys modsettings module.

  • CVE-2007-2249Apr 25, 2007
    Phorum
    Phorum
    risk 0.04cvss —epss 0.07

    include/controlcenter/users.php in Phorum before 5.1.22 allows remote authenticated moderators to gain privileges via a modified (1) user_ids POST parameter or (2) userdata array.

  • CVE-2007-2250Apr 25, 2007
    Phorum
    Phorum
    risk 0.03cvss —epss 0.04

    admin.php in Phorum before 5.1.22 allows remote attackers to obtain the full path via the module[] parameter.

  • CVE-2007-2251Apr 25, 2007
    Xaraya
    Xaraya
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Roles module in Xaraya 1.1.2 and earlier allows attackers to gain privileges via unspecified vectors, probably related to incorrect permission checking in xartemplates/user-view.xd.

  • CVE-2007-2230Apr 25, 2007
    Ca
    CleverPath Portal
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in CA Clever Path Portal allows remote authenticated users to execute limited SQL commands and retrieve arbitrary database contents via (1) the ofinterest parameter in a light search query, (2) description parameter in the advanced search query, and…

  • CVE-2007-2231Apr 25, 2007
    Dovecot (software)
    Dovecot
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.

  • CVE-2007-2232Apr 25, 2007
    Sigstore
    Cosign
    risk 0.03cvss —epss 0.02

    The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR (\r) sequences in the cosign cookie parameter.

  • CVE-2007-2233Apr 25, 2007
    Sigstore
    Cosign
    risk 0.03cvss —epss 0.02

    cosign-bin/cosign.cgi in Cosign 2.0.2 and earlier allows remote authenticated users to perform unauthorized actions as an arbitrary user by using CR (\r) sequences in the service parameter to inject LOGIN and REGISTER commands with the desired username.

  • CVE-2007-2234Apr 25, 2007
    Punbb
    Punbb
    risk 0.00cvss —epss 0.01

    include/common.php in PunBB 1.2.14 and earlier does not properly handle a disabled ini_get function when checking the register_globals setting, which allows remote attackers to register global parameters, as demonstrated by an SQL injection attack on the search_id parameter to…

  • CVE-2007-2235Apr 25, 2007
    Punbb
    Punbb
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in PunBB 1.2.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Referer HTTP header to misc.php or the (2) category name when deleting a category in admin_categories.php.

  • CVE-2007-2236Apr 25, 2007
    Punbb
    Punbb
    risk 0.00cvss —epss 0.01

    footer.php in PunBB 1.2.14 and earlier allows remote attackers to include local files in include/user/ via a cross-site scripting (XSS) attack, or via the pun_include tag, as demonstrated by use of admin_options.php to execute PHP code from an uploaded avatar file.

  • CVE-2007-2135Apr 24, 2007
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.02

    The ADI_BINARY component in the Oracle E-Business Suite allows remote attackers to download arbitrary documents from the APPS.FND_DOCUMENTS table via the ADI_DISPLAY_REPORT function, when passed a certain parameter. NOTE: due to lack of details from Oracle, it is not clear…

  • CVE-2007-2138Apr 24, 2007
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.04

    Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted to call a SECURITY DEFINER function, to gain the privileges of the function…

  • CVE-2007-2170Apr 24, 2007
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.04

    The APPLSYS.FND_DM_NODES package in Oracle E-Business Suite does not check for valid sessions, which allows remote attackers to delete arbitrary nodes. NOTE: due to lack of details from Oracle, it is not clear whether this issue is related to other CVE identifiers such as…

  • CVE-2007-2171Apr 24, 2007
    Novell
    Groupwise
    risk 0.02cvss —epss 0.24

    Stack-based buffer overflow in the base64_decode function in GWINTER.exe in Novell GroupWise (GW) WebAccess before 7.0 SP2 allows remote attackers to execute arbitrary code via long base64 content in an HTTP Basic Authentication request.