VYPR

CVEs

382,181 total · page 7195 of 7,644

AllCriticalHighKEV
  • CVE-2007-0464Jan 30, 2007
    Cfnetwork
    Cfnetwork
    risk 0.04cvss —epss 0.15

    The _CFNetConnectionWillEnqueueRequests function in CFNetwork 129.19 on Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to cause a denial of service (application crash) via a crafted HTTP 301 response, which results in a NULL pointer dereference.

  • CVE-2007-0567Jan 30, 2007
    Interactive Scripts.com
    PHP Membership Manager
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin.php in Interactive-Scripts.Com PHP Membership Manager 1.5 allows remote attackers to inject arbitrary web script or HTML via the _p parameter.

  • CVE-2007-0568Jan 30, 2007
    Myphpcommander
    Myphpcommander
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in system/lib/package.php in MyPHPCommander 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the gl_root parameter.

  • CVE-2007-0569Jan 30, 2007
    X Dev
    Xnews
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in xNews.php in xNews 1.3 allows remote attackers to execute arbitrary SQL commands via the id parameter in a shownews action.

  • CVE-2007-0570Jan 30, 2007
    Johannes Gijsbers
    AD Fundum Integratable News Script
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in ains_main.php in Johannes Gijsbers (aka Taradino) Ad Fundum Integratable News Script (AINS) 0.02b allows remote attackers to execute arbitrary PHP code via a URL in the ains_path parameter.

  • CVE-2007-0571Jan 30, 2007
    Phpmyreports
    Phpmyreports
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in include/lib/lib_head.php in phpMyReports 3.0.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cfgPathModule parameter.

  • CVE-2007-0572Jan 30, 2007
    Drunken:Golem
    Gaming Portal
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in include/irc/phpIRC.php in Drunken:Golem Gaming Portal 0.5.1 Alpha 2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2007-0573Jan 30, 2007
    Nsgalphp
    Nsgalphp
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/config.inc.php in nsGalPHP 0.41 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the racineTBS parameter.

  • CVE-2007-0574Jan 30, 2007
    Spoonlabs
    Vivvo Article Management CMS
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.40 allows remote attackers to execute arbitrary SQL commands via the wcHeadlines parameter, a different vector than CVE-2006-4715. NOTE: The provenance of this…

  • CVE-2007-0575Jan 30, 2007
    ASPCode.net
    AdMentor
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the administrative login page (admin/login.asp) in ASPCode.net AdMentor allow remote attackers to execute arbitrary SQL commands via the (1) Userid and (2) Password fields.

  • CVE-2007-0576Jan 30, 2007
    Xt Scripts
    Xt-Stats
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in xt_counter.php in Xt-Stats 2.3.x up to 2.4.0.b3 allows remote attackers to execute arbitrary PHP code via a URL in the server_base_dir parameter.

  • CVE-2007-0577Jan 30, 2007
    Acgvclick
    Acgvclick
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in function.inc.php in ACGVclick 0.2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.

  • CVE-2007-0578Jan 30, 2007
    risk 0.00cvss —epss 0.01

    The http_open function in httpget.c in mpg123 before 0.64 allows remote attackers to cause a denial of service (infinite loop) by closing the HTTP connection early.

  • CVE-2007-0579Jan 30, 2007
    Horde (software)
    Groupware
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the calendar component in Horde Groupware Webmail Edition before 1.0, and Groupware before 1.0, allows remote attackers to include certain files via unspecified vectors. NOTE: some of these details are obtained from third party information.

  • CVE-2007-0580Jan 30, 2007
    Javier Suarez Sanz
    Foro Domus
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in menu.php in Foro Domus 2.10 allows remote attackers to execute arbitrary PHP code via a URL in the sesion_idioma parameter.

  • CVE-2007-0581Jan 30, 2007
    Eclipsebb
    Eclipsebb
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in functions.php in EclipseBB 0.5.0 Lite allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2007-0582Jan 30, 2007
    Chernobile
    Chernobile
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.asp in ChernobiLe 1.0 allows remote attackers to execute arbitrary SQL commands via the User (username) field.

  • CVE-2007-0583Jan 30, 2007
    HTTP Commander
    HTTP Commander
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in HTTP Commander 6.0, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) LogoffMessage parameter to logofflast.aspx or the (2) txtUsername parameter to Default.aspx. NOTE: The…

  • CVE-2007-0584Jan 30, 2007
    G Neric
    g-neric
    risk 0.09cvss —epss 0.70

    PHP remote file inclusion vulnerability in membres/membreManager.php in PhP Generic Library & Framework for comm (g-neric) allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.

  • CVE-2007-0585Jan 30, 2007
    Webfwlog
    Webfwlog
    risk 0.03cvss —epss 0.04

    include/debug.php in Webfwlog 0.92 and earlier, when register_globals is enabled, allows remote attackers to obtain source code of files via the conffile parameter. NOTE: some of these details are obtained from third party information. It is likely that this issue can be…

  • CVE-2007-0558Jan 30, 2007
    Double Precision Incorporated
    Vhostadmin
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in modules/mail/main.php in Inter7 vHostAdmin 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the MODULES_DIR parameter.

  • CVE-2007-0559Jan 30, 2007
    Rp World
    Rp World
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in config.php in RPW 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the sql_language parameter.

  • CVE-2007-0560Jan 30, 2007
    Asp Edge
    Asp Edge
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in user.asp in ASP EDGE 1.2b and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter.

  • CVE-2007-0561Jan 30, 2007
    Xero Portal
    Xero Portal
    risk 0.04cvss —epss 0.10

    Multiple PHP remote file inclusion vulnerabilities in Xero Portal 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) admin_linkdb.php, (2) admin_forum_prune.php, (3) admin_extensions.php, (4) admin_board.php, (5)…

  • CVE-2007-0562Jan 30, 2007
    Microsoft
    Windows Explorer
    risk 0.04cvss —epss 0.14

    Windows Explorer (explorer.exe) 6.0.2900.2180 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted .avi file, which triggers the crash when the user right clicks on the file.

  • CVE-2007-0563Jan 30, 2007
    Symantec
    Web Security
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Symantec Web Security (SWS) before 3.0.1.85 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) error messages and (2) blocked page messages produced by SWS.

  • CVE-2007-0564Jan 30, 2007
    Symantec
    Web Security
    risk 0.00cvss —epss 0.01

    The license registering interface in Symantec Web Security (SWS) before 3.0.1.85 allows attackers to cause a denial of service (CPU consumption) by submitting a large file.

  • CVE-2007-0565Jan 30, 2007
    Cgi Rescue
    Shopping Basket Professional
    risk 0.00cvss —epss 0.01

    CGI-Rescue Shopping Basket Professional 7.50 and earlier allows remote attackers to inject arbitrary operating system commands via unspecified vectors.

  • CVE-2007-0566Jan 30, 2007
    Asp News
    Asp News
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news_detail.asp in ASP NEWS 3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2007-0557Jan 29, 2007
    Rmake
    Rmake
    risk 0.00cvss —epss 0.00

    rMake before 1.0.4 drops root privileges in a way that retains the original supplemental groups, which might allow attackers to gain privileges via a crafted recipe file, a different vulnerability than CVE-2007-0536.

  • CVE-2007-0347Jan 29, 2007
    Cvstrac
    Cvstrac
    risk 0.03cvss —epss 0.04

    The is_eow function in format.c in CVSTrac before 2.0.1 does not properly check for the "'" (quote) character, which allows remote authenticated users to execute limited SQL injection attacks and cause a denial of service (database error) via a ' character in certain messages,…

  • CVE-2006-6965Jan 29, 2007
    Dokuwiki
    Dokuwiki
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in lib/exe/fetch.php in DokuWiki 2006-03-09e, and possibly earlier, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the media parameter. NOTE: this issue can be leveraged for…

  • CVE-2007-0538Jan 29, 2007
    Telligent Systems
    Community Server Forums
    risk 0.00cvss —epss 0.02

    Telligent Community Server 2.1 and earlier allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to (1) a large file, which triggers a long download session without a timeout…

  • CVE-2007-0539Jan 29, 2007
    WordPress
    WordPress
    risk 0.00cvss —epss 0.04

    The wp_remote_fopen function in WordPress before 2.1 allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to a large file, which triggers a long download session without a timeout…

  • CVE-2007-0540Jan 29, 2007
    WordPress
    WordPress
    risk 0.00cvss —epss 0.08

    WordPress allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to a file with a binary content type, which is downloaded even though it cannot contain usable pingback data.

  • CVE-2007-0541Jan 29, 2007
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that corresponds to a local pathname, which triggers different fault codes for existing and non-existing…

  • CVE-2007-0542Jan 29, 2007
    212cafe
    Guestbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in show.php in 212cafe Guestbook 4.00 beta allows remote attackers to inject arbitrary web script or HTML via the user parameter.

  • CVE-2007-0543Jan 29, 2007
    Zixforum
    Zixforum
    risk 0.00cvss —epss 0.02

    ZixForum 1.14 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for Zixforum.mdb. NOTE: a followup post suggests that this issue only…

  • CVE-2007-0544Jan 29, 2007
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in private.php in MyBB (aka MyBulletinBoard) allows remote authenticated users to inject arbitrary web script or HTML via the Subject field, a different vector than CVE-2006-2949.

  • CVE-2007-0545Jan 29, 2007
    Maxtricity
    Tagger
    risk 0.00cvss —epss 0.01

    Maxtricity Tagger 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for tagger.mdb.

  • CVE-2007-0546Jan 29, 2007
    Toxiclab
    Shoutbox
    risk 0.00cvss —epss 0.01

    Toxiclab Shoutbox 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db.mdb.

  • CVE-2007-0547Jan 29, 2007
    Cgi Rescue
    Webform
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in CGI-RESCUE WebFORM 4.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-0548Jan 29, 2007
    Karjasoft
    Sami HTTP Server
    risk 0.03cvss —epss 0.03

    KarjaSoft Sami HTTP Server 2.0.1 allows remote attackers to cause a denial of service (daemon hang) via a large number of requests for nonexistent objects.

  • CVE-2007-0549Jan 29, 2007
    212cafe
    212cafeboard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in list3.php in 212cafeBoard 6.30 Beta allows remote attackers to inject arbitrary web script or HTML via the user parameter.

  • CVE-2007-0550Jan 29, 2007
    212cafe
    212cafeboard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in 212cafeBoard 0.08 Beta allows remote attackers to inject arbitrary web script or HTML via keyword parameter.

  • CVE-2007-0551Jan 29, 2007
    Cmsimple
    Cmsimple
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pth[file][config] and (2) pth[file][image] parameters.

  • CVE-2007-0552Jan 29, 2007
    Onnac
    Oh no! Not another CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in install/default/error404.html in Oh no! Not another CMS (Onnac) 0.0.8.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the error_url parameter.

  • CVE-2007-0553Jan 29, 2007
    Phproxy
    Phproxy
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.inc.php in PHProxy before 0.5 beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) data[realm] and (2) _url parameters, different vectors than CVE-2004-2604. NOTE: some of these details are…

  • CVE-2007-0554Jan 29, 2007
    Guo Xu Guos Posting System
    Guos Posting System
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in print.asp in Guo Xu Guos Posting System (GPS) 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-6953Jan 29, 2007
    Globetrotter
    Mobility Manager
    risk 0.00cvss —epss 0.00

    The virtual keyboard implementation in GlobeTrotter Mobility Manager changes the color of a key as it is pressed, which allows local users to capture arbitrary keystrokes, such as for passwords, by shoulder surfing or grabbing periodic screenshots.