Archive
May 2010
Vulnerabilities first published in this month (UTC), newest first.
402 results · Feed
-
Unscored —
The npb_protocol_error function in sna V5router64 in IBM Communications Server for Windows 6.1.3 and Communications Ser…
-
Unscored —
Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properl…
-
Unscored —
The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte string lengt…
-
Unscored —
Buffer underflow in the rgbimg module in Python 2.5 allows remote attackers to cause a denial of service (application c…
-
Medium —
Mono ASP.NET View State Cross-Site Scripting (XSS) vulnerability
The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.asp…
-
Unscored —
The default configuration of ASP.NET in Microsoft .NET before 1.1 has a value of FALSE for the EnableViewStateMac prope…
-
Medium —
Apache MyFaces Cross-site Scripting vulnerability
Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression…
-
Unscored —
Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, doe…
-
Unscored —CVE-2010-2084 EPSS 13%
Microsoft ASP.NET 2.0 does not prevent setting the InnerHtml property on a control that inherits from HtmlContainerCont…
-
Unscored —
ASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attackers to cond…
-
Unscored —
Multiple integer overflows in src/image.c in Ziproxy before 3.0.1 allow remote attackers to execute arbitrary code via …
-
Unscored —
Microsoft Dynamics GP has a default value of ACCESS for the system password, which might make it easier for remote auth…
-
Unscored —CVE-2010-2025 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the Cisco Scientific Atlanta WebSTAR…
-
Unscored —
The web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 allows …
-
Unscored —
The web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 has a d…
-
Unscored —
The cli_pdf function in libclamav/pdf.c in ClamAV before 0.96.1 allows remote attackers to cause a denial of service (c…
-
Unscored —
Off-by-one error in the parseicon function in libclamav/pe_icons.c in ClamAV 0.96 allows remote attackers to cause a de…
-
Unscored —
The Identity Server in Novell Access Manager before 3.1 SP1 allows attackers with disabled Active Directory accounts to…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in WebGUI before 7.7.14 allow remote attackers to hijack the…
-
Unscored —
Stack-based buffer overflow in the HTTP server in Rhino Software Serv-U Web Client 9.0.0.5 allows remote attackers to c…
-
Unscored —CVE-2009-4874 Public exploit
TalkBack 2.3.14 does not properly restrict access to the edit comment feature (comments.php), which allows remote attac…
-
Unscored —
Unspecified vulnerability in the Administration Console in Novell Access Manager before 3.1 SP1 allows attackers to acc…
-
Unscored —CVE-2009-4876 Public exploit
admin/cikkform.php in Netrix CMS 1.0 allows remote attackers to modify arbitrary pages via a direct request using the c…
-
Unscored —
FCKeditor.Java 2.4 allows remote attackers to cause a denial of service (infinite loop) via a malformed request paramet…
-
Unscored —
DataTrack System 3.5 allows remote attackers to list the root directory via a (1) /%u0085/ or (2) /%u00A0/ URI.
-
Unscored —
DataTrack System 3.5 allows remote attackers to bypass intended restrictions on file extensions, and read arbitrary fil…
-
Unscored —
Directory traversal vulnerability in the Dione Form Wizard (aka FDione or com_dioneformwizard) component 1.0.2 for Joom…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the Heartbeat module 6.x before 6.x-4.9 for Drupal allow remote …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the ActiveHelper LiveHelp (com_activehelper_livehelp) component …
-
Unscored —CVE-2010-2044 Public exploit
SQL injection vulnerability in the Konsultasi (com_konsultasi) component 1.0.0 for Joomla! allows remote attackers to e…
-
Unscored —CVE-2010-2047 Public exploit
SQL injection vulnerability in index.php in JE CMS 1.0.0 and 1.1 allows remote attackers to execute arbitrary SQL comma…
-
Unscored —
Directory traversal vulnerability in the Moron Solutions MS Comment (com_mscomment) component 0.8.0b for Joomla! allows…
-
Unscored —CVE-2010-2051 Public exploit
SQL injection vulnerability in article.php in Debliteck DBCart allows remote attackers to execute arbitrary SQL command…
-
Unscored —
Cross-site scripting (XSS) vulnerability in jsp/audit/reports/ExportReport.jsp in ManageEngine ADAudit Plus 4.0.0 build…
-
Unscored —
Directory traversal vulnerability in the Percha Downloads Attach (com_perchadownloadsattach) component 1.1 for Joomla! …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in index.php in PHP-Calendar before 2.0 Beta7 allow remote attacker…
-
Unscored —
Directory traversal vulnerability in the Percha Fields Attach (com_perchafieldsattach) component 1.x for Joomla! allows…
-
Unscored —
Directory traversal vulnerability in the Percha Multicategory Article (com_perchacategoriestree) component 0.6 for Joom…
-
Unscored —CVE-2010-2042 Public exploit
SQL injection vulnerability in search.php in ECShop 2.7.2 allows remote attackers to execute arbitrary SQL commands via…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Home.aspx in DataTrack System 3.5 and 3.5.8019.4 allows remote attackers to…