VYPR

CVEs

382,020 total · page 7198 of 7,641

AllCriticalHighKEV
  • CVE-2007-0293Jan 17, 2007
    Oracle Corporation
    Enterprise Manager
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Oracle Enterprise Manager 10.1.0.5 and 10.2.0.1 have unknown impact and attack vectors related to (1) Oracle Agent (EM03) and (2) EM04 and (3) EM05 in Enterprise Manager Console. NOTE: EM05 might be related to CVE-2007-0222.

  • CVE-2007-0294Jan 17, 2007
    Oracle Corporation
    Enterprise Manager
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Oracle Enterprise Manager 10.2.0.1 has unknown impact and attack vectors related to Database Cloning & Data Guard Management, aka EM06.

  • CVE-2007-0295Jan 17, 2007
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.22.13 and 8.47.11 has unknown impact and attack vectors in PeopleTools, aka PSE01.

  • CVE-2007-0296Jan 17, 2007
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.22.13, 8.47.11, and 8.48.06 has unknown impact and attack vectors in PeopleTools, aka PSE02.

  • CVE-2007-0297Jan 17, 2007
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.03cvss —epss 0.03

    Unspecified vulnerability in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.47.11 and 8.48.06 has unknown impact and attack vectors in PeopleTools, aka PSE03.

  • CVE-2007-0222Jan 17, 2007
    Oracle Corporation
    Application Server
    risk 0.01cvss —epss 0.11

    Directory traversal vulnerability in the EmChartBean server side component for Oracle Application Server 10g allows remote attackers to read arbitrary files via unknown vectors, probably "\.." sequences in the beanId parameter. NOTE: this is likely a duplicate of another CVE…

  • CVE-2006-6936Jan 17, 2007
    Pensacola Web Designs
    Xtremeasp Photogallery
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Xtreme ASP Photo Gallery allows remote attackers to inject arbitrary HTML or web script via (1) the catname parameter to displaypic.asp or (2) the search field. NOTE: vector 1 likely overlaps CVE-2006-3032.

  • CVE-2006-6937Jan 17, 2007
    Pensacola Web Designs
    Xtremeasp Photogallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in displaypic.asp in Xtreme ASP Photo Gallery allows remote attackers to inject arbitrary SQL commands via the sortorder parameter.

  • CVE-2006-6938Jan 17, 2007
    Nitrotech
    Nitrotech
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in includes/common.php in NitroTech 0.0.3a, as distributed before 2006, allows remote attackers to include arbitrary files via ".." sequences in the root parameter.

  • CVE-2006-6939Jan 17, 2007
    GNU
    Ed
    risk 0.00cvss —epss 0.00

    GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function.

  • CVE-2007-0014Jan 17, 2007
    ChainKey
    Java Code Protection
    risk 0.00cvss —epss 0.00

    ChainKey Java Code Protection allows attackers to decompile Java class files via a Java class loader with a modified defineClass method that saves the bytecode to a file before it is passed to the JVM.

  • CVE-2007-0267Jan 17, 2007
    Apple Inc.
    Mac OS X
    risk 0.03cvss —epss 0.01

    The ufs_lookup function in the Mac OS X 10.4.8 and FreeBSD 6.1 kernels allows local users to cause a denial of service (kernel panic) and possibly corrupt other filesystems by mounting a crafted UNIX File System (UFS) DMG image that contains a corrupted directory entry (struct…

  • CVE-2006-6931Jan 16, 2007
    Snort
    Snort
    risk 0.00cvss —epss 0.02

    Algorithmic complexity vulnerability in Snort before 2.6.1, during predicate evaluation in rule matching for certain rules, allows remote attackers to cause a denial of service (CPU consumption and detection outage) via crafted network traffic, aka a "backtracking attack."

  • CVE-2006-6932Jan 16, 2007
    Image Gallery With Access Database
    Image Gallery With Access Database
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Image Gallery with Access Database allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to (a) dispimage.asp, or the (2) order or (3) page parameter to (b) default.asp.

  • CVE-2006-6933Jan 16, 2007
    Easy Chat Server
    Easy Chat Server
    risk 0.00cvss —epss 0.02

    Easy Chat Server 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download certain files via direct requests to files such as (1) ServerKey.pem and (2) AcceptIP.txt. NOTE: The provenance of this information…

  • CVE-2006-6934Jan 16, 2007
    Portix PHP
    Portix PHP
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Portix-PHP 0.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) titre or (2) auteur field in a forum post.

  • CVE-2006-6935Jan 16, 2007
    Portix PHP
    Portix PHP
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the login component in Portix-PHP 0.4.2 allows remote attackers to execute arbitrary SQL commands via the username and passwd (password) fields.

  • CVE-2007-0249Jan 16, 2007
    Nwom
    Nwom Topsites
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Nwom topsites 3.0 allows remote attackers to inject arbitrary web script or HTML via the o parameter.

  • CVE-2007-0250Jan 16, 2007
    Nwom
    Nwom Topsites
    risk 0.00cvss —epss 0.01

    index.php in Nwom topsites 3.0 allows remote attackers to obtain potentially sensitive information via a ' (quote) character in the o parameter, which forces a SQL error.

  • CVE-2007-0251Jan 16, 2007
    Snort
    Snort
    risk 0.00cvss —epss 0.02

    Integer underflow in the DecodeGRE function in src/decode.c in Snort 2.6.1.2 allows remote attackers to trigger dereferencing of certain memory locations via crafted GRE packets, which may cause corruption of log files or writing of sensitive information into log files.

  • CVE-2007-0252Jan 16, 2007
    Easy Content Filemanager
    Easy Content Filemanager
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in easy-content filemanager allows remote attackers to upload or modify arbitrary files via unspecified vectors.

  • CVE-2007-0253Jan 16, 2007
    Grsecurity
    Grsecurity Kernel Patch
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the grsecurity patch has unspecified impact and remote attack vectors, a different vulnerability than the expand_stack vulnerability from the Digital Armaments 20070110 pre-advisory. NOTE: the grsecurity developer has disputed this issue, stating…

  • CVE-2007-0254Jan 16, 2007
    Xine
    Xine UI
    risk 0.00cvss —epss 0.04

    Format string vulnerability in the errors_create_window function in errors.c in xine-ui allows attackers to execute arbitrary code via unknown vectors.

  • CVE-2007-0255Jan 16, 2007
    Xine
    Xine Lib
    risk 0.00cvss —epss 0.04

    XINE 0.99.4 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain M3U file that contains a long #EXTINF line and contains format string specifiers in an invalid udp:// URI, possibly a variant of…

  • CVE-2007-0256Jan 16, 2007
    VideoLAN
    Vlc
    risk 0.04cvss —epss 0.12

    VideoLAN VLC 0.8.6a allows remote attackers to cause a denial of service (application crash) via a crafted .wmv file.

  • CVE-2007-0257HigJan 16, 2007
    Pax Project
    Pax
    risk 0.54cvss 7.8epss 0.01

    Unspecified vulnerability in the expand_stack function in grsecurity PaX allows local users to gain privileges via unspecified vectors. NOTE: the grsecurity developer has disputed this issue, stating that "the function they claim the vulnerability to be in is a trivial function,…

  • CVE-2007-0258Jan 16, 2007
    Open Solution
    Quick.cart
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in (1) Fastilo 2.0 and (2) Open Solution Quick.Cart 2.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2007-0259Jan 16, 2007
    Ezboxx
    Ezboxx Portal System
    risk 0.00cvss —epss 0.02

    Ezboxx Portal System Beta 0.7.6 and earlier allows remote attackers to obtain sensitive information via an invalid cat parameter to boxx/knowledgebase.asp, which reveals the path in an error message.

  • CVE-2007-0260Jan 16, 2007
    Naig
    Naig
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in Naig 0.5.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the this_path parameter. NOTE: a reliable third party disputes this vulnerability because this_path is defined before use

  • CVE-2007-0261Jan 16, 2007
    Snewscms
    Snews
    risk 0.03cvss —epss 0.05

    snews.php in sNews 1.5.30 and earlier does not properly exit when authentication fails, which allows remote attackers to perform unauthorized administrative actions, as demonstrated by changing an administrative password via the changeup task, and by uploading PHP code via the…

  • CVE-2007-0262Jan 16, 2007
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    WordPress 2.0.6, and 2.1Alpha 3 (SVN:4662), does not properly verify that the m parameter value has the string data type, which allows remote attackers to obtain sensitive information via an invalid m[] parameter, as demonstrated by obtaining the path, and obtaining certain SQL…

  • CVE-2007-0263Jan 16, 2007
    Ghisler
    Total Commander
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Total Commander before 6.5.6 allows user-assisted remote attackers to delete arbitrary files and corrupt a filesystem via a crafted RAR file. NOTE: The provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2007-0264Jan 16, 2007
    Winzip
    Winzip
    risk 0.03cvss —epss 0.01

    Buffer overflow in Winzip32.exe in WinZip 9.0 allows local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long command line argument. NOTE: this issue may cross privilege boundaries if an application automatically invokes…

  • CVE-2007-0265Jan 16, 2007
    Ezboxx
    Ezboxx Portal System
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Ezboxx Portal System Beta 0.7.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the pic parameter to custom/piczoom.asp, (2) the nocatname parameter to boxx/user-upload.asp, or (3) the iid…

  • CVE-2007-0266Jan 16, 2007
    Ezboxx
    Ezboxx Portal System
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in boxx/ShowAppendix.asp in Ezboxx Portal System Beta 0.7.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the iid parameter.

  • CVE-2006-5171Jan 16, 2007
    Ca
    Protection Suites
    risk 0.01cvss —epss 0.17

    Stack-based buffer overflow in the RPC interface in Mediasvr.exe in Computer Associates (CA) Brightstor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Protection Suites r2 allows remote attackers to execute arbitrary code via crafted SUNRPC packets, aka the…

  • CVE-2006-5172Jan 16, 2007
    Ca
    Protection Suites
    risk 0.01cvss —epss 0.15

    Stack-based buffer overflow in the RPC interface in Mediasvr.exe in Computer Associates (CA) Brightstor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Protection Suites r2 allows remote attackers to execute arbitrary code via crafted SUNRPC packets, aka the…

  • CVE-2006-5876Jan 16, 2007
    Libsoup
    Libsoup
    risk 0.00cvss —epss 0.03

    The soup_headers_parse function in soup-headers.c for libsoup HTTP library before 2.2.99 allows remote attackers to cause a denial of service (crash) via malformed HTTP headers, probably involving missing fields or values.

  • CVE-2006-6487Jan 16, 2007
    Dt Guestbook
    Dt Guestbook
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in DT Guestbook (dt_guestbook) 1.0f, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the error[] parameter.

  • CVE-2006-6767HigJan 16, 2007
    Oftpd
    Oftpd
    risk 0.52cvss 7.5epss 0.07

    oftpd before 0.3.7 allows remote attackers to cause a denial of service (daemon abort) via a (1) LPRT or (2) LPASV command with an unsupported address family, which triggers an assertion failure.

  • CVE-2007-0235Jan 16, 2007
    Libgtop
    Libgtop
    risk 0.03cvss —epss 0.01

    Stack-based buffer overflow in the glibtop_get_proc_map_s function in libgtop before 2.14.6 (libgtop2) allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a process with a long filename that is mapped in its address space, which…

  • CVE-2007-0236Jan 16, 2007
    Apple Inc.
    Mac OS X
    risk 0.05cvss —epss 0.21

    Double free vulnerability in the _ATPsndrsp function in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to cause a denial of service (kernel panic) and possibly execute arbitrary code via a crafted AppleTalk request that triggers a heap-based buffer…

  • CVE-2007-0247Jan 16, 2007
    Squid Cache
    Squid
    risk 0.05cvss —epss 0.20

    squid/src/ftp.c in Squid before 2.6.STABLE7 allows remote FTP servers to cause a denial of service (core dump) via crafted FTP directory listing responses, possibly related to the (1) ftpListingFinish and (2) ftpHtmlifyListEntry functions.

  • CVE-2007-0248Jan 16, 2007
    Squid Cache
    Squid
    risk 0.01cvss —epss 0.07

    The aclMatchExternal function in Squid before 2.6.STABLE7 allows remote attackers to cause a denial of service (crash) by causing an external_acl queue overload, which triggers an infinite loop.

  • CVE-2006-6922Jan 13, 2007
    Phpdeadlock
    Deadlock User Management System
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Deadlock User Management System (phpdeadlock) 0.64 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2006-6923Jan 13, 2007
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in newsletters/edition.php in bitweaver 1.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the tk parameter.

  • CVE-2006-6924Jan 13, 2007
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.03

    bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to (1) blogs/list_blogs.php, (2) fisheye/index.php, (3) wiki/orphan_pages.php, or (4) wiki/list_pages.php, which forces a SQL error. NOTE: the…

  • CVE-2006-6925Jan 13, 2007
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the message title field when submitting an article to articles/edit.php, (2) the message title field when submitting a blog…

  • CVE-2006-6926Jan 13, 2007
    Extremail
    Extremail
    risk 0.00cvss —epss 0.01

    Buffer overflow in eXtremail 2.1 has unknown impact and attack vectors, as demonstrated by VulnDisco Pack. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-6927Jan 13, 2007
    Grandora
    Rialto
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Rialto 1.6 allow remote attackers to execute arbitrary SQL commands via (1) the uname (username) and (2) pword (passwd) fields in (a) admin/default.asp; the (3) ID parameter to (b) listfull.asp or (c) printmain.asp; the (4) cat parameter…