CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2013-3536 89 1 Exec Code Sql 2013-05-13 2013-05-14
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and earlier for WHMCS allows remote attackers to execute arbitrary SQL commands via the hash parameter.
2 CVE-2013-3529 79 1 XSS 2013-05-10 2013-05-13
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in user/obits.php in the WP FuneralPress plugin before 1.1.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) message, (2) photo-message, or (3) youtube-message parameter.
3 CVE-2013-3527 89 1 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL commands via the parameter name in the Form/Email array to (1) entry/signin or (2) entry/passwordrequest.
4 CVE-2013-3524 89 1 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in popupnewsitem/ in the Pop Up News module 2.0 and possibly earlier for phpVMS allows remote attackers to execute arbitrary SQL commands via the itemid parameter. NOTE: this was originally reported as a problem in phpVMS.
5 CVE-2013-3522 89 1 Exec Code Sql 2013-05-10 2013-05-13
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authenticated users to execute arbitrary SQL commands via the nodeid parameter.
6 CVE-2013-3075 119 1 Exec Code Overflow 2013-04-19 2013-05-15
10.0
 None Remote Low Not required Complete Complete Complete
Multiple buffer overflows in ActUWzd.dll 1.0.0.1 in Mitsubishi MX Component 3, as distributed in Citect CitectFacilities 7.10 and CitectScada 7.10r1, allow remote attackers to execute arbitrary code via a long string, as demonstrated by a long WzTitle property value to a certain ActiveX control.
7 CVE-2013-3050 89 1 Exec Code Sql 2013-04-12 2013-04-15
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in ZAPms 1.41 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter to product.
8 CVE-2013-2760 119 1 Exec Code Overflow 2013-04-16 2013-04-18
6.8
 None Remote Medium Not required Partial Partial Partial
Buffer overflow in Groovy Media Player 3.2.0 allows remote attackers to execute arbitrary code via a long string in a .m3u file.
9 CVE-2013-2690 89 1 Exec Code Sql 2013-03-28 2013-05-14
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Synchroweb Technology SynConnect 2.0 allows remote attackers to execute arbitrary SQL commands via the loginid parameter in a logoff action.
10 CVE-2013-1814 200 1 +Info 2013-03-13 2013-03-19
4.0
 None Remote Low Single system Partial None None
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
11 CVE-2013-1773 119 1 DoS Overflow +Priv 2013-02-28 2013-03-01
6.2
 None Local High Not required Complete Complete Complete
Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service (system crash) via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversion.
12 CVE-2013-1469 22 1 Dir. Trav. 2013-03-13 2013-03-19
4.0
 None Remote High Not required Partial None Partial
Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the dl parameter.
13 CVE-2013-1468 352 1 CSRF 2013-03-13 2013-03-20
7.6
 None Remote High Not required Complete Complete Complete
Cross-site request forgery (CSRF) vulnerability in the LocalFiles Editor plugin in Piwigo before 2.4.7 allows remote attackers to hijack the authentication of administrators for requests that create arbitrary PHP files via unspecified vectors.
14 CVE-2013-1465 20 1 2013-02-08 2013-03-26
7.5
 None Remote Low Not required Partial Partial Partial
The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping parameter, as demonstrated by modifying the application configuration using the Config object.
15 CVE-2013-0722 119 1 Overflow +Priv 2013-01-11 2013-01-29
4.4
 None Local Medium Not required Partial Partial Partial
Stack-based buffer overflow in the scan_load_hosts function in ec_scan.c in Ettercap 0.7.5.1 and earlier might allow local users to gain privileges via a Trojan horse hosts list containing a long line.
16 CVE-2013-0249 119 1 DoS Exec Code Overflow 2013-03-08 2013-05-07
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.
17 CVE-2013-0233 399 1 Bypass 2013-04-25 2013-05-01
6.8
 None Remote Medium Not required Partial Partial Partial
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
18 CVE-2013-0232 1 Exec Code 2013-03-20 2013-03-21
7.5
 None Remote Low Not required Partial Partial Partial
includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.
19 CVE-2013-0126 352 1 CSRF 2013-03-21 2013-03-22
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in index.cgi on the Verizon FIOS Actiontec MI424WR-GEN3I router with firmware 40.19.36 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via the username and user_level parameters or (2) enable remote administration via the is_telnet_primary and is_telnet_secondary parameters.
20 CVE-2012-6530 119 2 Exec Code Overflow 2013-01-31 2013-01-31
7.1
 None Remote High Single system Complete Complete Complete
Stack-based buffer overflow in Sysax Multi Server before 5.52, when HTTP is enabled, allows remote authenticated users with the create folder permission to execute arbitrary code via a crafted request.
21 CVE-2012-6529 89 1 Exec Code Sql 2013-01-31 2013-01-31
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Marinet CMS allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) galleryphoto.php or (2) gallery.php; or the roomid parameter to (3) room.php or (4) room2.php.
22 CVE-2012-6526 89 1 Exec Code Sql 2013-01-31 2013-01-31
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in show_code.php in Vastal I-Tech Freelance Zone allows remote attackers to execute arbitrary SQL commands via the code_id parameter.
23 CVE-2012-6525 89 1 Exec Code Sql 2013-01-31 2013-01-31
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in members.php in PHPBridges allows remote attackers to execute arbitrary SQL commands via the id parameter.
24 CVE-2012-6524 89 1 Exec Code Sql 2013-01-31 2013-01-31
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in kommentar.php in pGB 2.12 allows remote attackers to execute arbitrary SQL commands via the id parameter.
25 CVE-2012-6523 79 1 XSS 2013-01-31 2013-01-31
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in w-CMS 2.01 allow remote attackers to inject arbitrary web script or HTML via (1) the p parameter in the getMenus function in codes/wcms.php; or the COMMENT parameter in (2) blog.php, (3) guestbook.php, or (4) forum.php in codes/. NOTE: some of these details are obtained from third party information.
26 CVE-2012-6522 22 2 Dir. Trav. 2013-01-31 2013-01-31
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in the getContent function in codes/wcms.php in w-CMS 2.01 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter. NOTE: some of these details are obtained from third party information.
27 CVE-2012-6521 79 1 XSS 2013-01-23 2013-01-24
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in apps/admin/handlers/versions.php in Elefant CMS 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter to admin/versions.
28 CVE-2012-6519 89 2 Exec Code Sql 2013-01-23 2013-01-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the start parameter to mod.php.
29 CVE-2012-6518 352 2 CSRF 2013-01-23 2013-01-29
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authentication of administrators for requests that create a poll via an add action to the poll module.
30 CVE-2012-6517 79 2 XSS 2013-01-23 2013-01-29
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in DiY-CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) question parameter to in /modules/poll/add.php or (2) question or (3) answer parameter to modules/poll/edit.php.
31 CVE-2012-6516 89 1 Exec Code Sql 2013-01-23 2013-01-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in PHP Ticket System Beta 1 allows remote attackers to execute arbitrary SQL commands via the q parameter to index.php.
32 CVE-2012-6514 79 1 XSS 2013-01-23 2013-01-29
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the nBill (com_netinvoice) component 2.3.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the message parameter in an income action to administrator/index.php.
33 CVE-2012-6512 200 1 +Info 2013-01-23 2013-01-29
5.0
 None Remote Low Not required Partial None None
The Organizer plugin 1.2.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors to (1) plugin_hook.php, (2) page/index.php, (3) page/dir.php (4) page/options.php, (5) page/resize.php, (6) page/upload.php, (7) page/users.php, or (8) page/view.php.
34 CVE-2012-6511 79 1 XSS 2013-01-23 2013-01-29
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) delete_id parameter or (2) extension parameter in an "Update Setting" action to wp-admin/admin.php.
35 CVE-2012-6510 79 1 XSS 2013-01-23 2013-01-29
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) PWRS or (2) Description field when posting a new vehicle; (3) news title when creating news; (4) Name when creating a sub user; (5) group name when creating a group; or (6) dealer name, (7) first name, or (8) last name when changing a profile.
36 CVE-2012-6509 1 Exec Code 2013-01-23 2013-01-29
7.5
 None Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in NetArt Media Car Portal 3.0 allows remote attackers to execute arbitrary PHP code by uploading a file a double extension, as demonstrated by .php%00.jpg.
37 CVE-2012-6508 352 1 CSRF 2013-01-23 2013-01-29
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hijack the authentication of administrators for requests that (1) change arbitrary user passwords via a nouveau action in the security module to cars/ADMIN/index.php; (2) create a user or (3) create a sub user via a sub_accounts action in the home module to USERS/index.php; or (4) change profile information via an edit action in the profile module to USERS/index.php.
38 CVE-2012-6507 89 1 Exec Code Sql 2013-01-23 2013-01-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in admin.php in ChurchCMS 0.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) uname or (2) pass parameters in a login action.
39 CVE-2012-6506 79 1 XSS 2013-01-23 2013-01-29
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in he Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in zing.inc.php or (2) notes parameter in fws/pages-front/onecheckout.php.
40 CVE-2012-6505 79 1 XSS 2013-01-23 2013-01-29
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in mods/hours/data/get_hours.php in PHP Volunteer Management 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
41 CVE-2012-6504 89 1 Exec Code Sql 2013-01-23 2013-01-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in mods/hours/data/get_hours.php in PHP Volunteer Management 1.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
42 CVE-2012-6500 22 1 Dir. Trav. 2013-01-11 2013-01-23
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in download.lib.php in Pragyan CMS 3.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the fileget parameter in a profile action to index.php.
43 CVE-2012-6499 20 1 2013-01-11 2013-01-14
5.8
 None Remote Medium Not required Partial Partial None
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_to parameter.
44 CVE-2012-6434 352 1 Sql CSRF 2013-01-03 2013-01-07
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) download_url, (2) download_url_extended, (3) download_author_email, (4) download_author_website, (5) download_image, (6) download_thumb, (7) download_visible, or (8) download_class parameter.
45 CVE-2012-6433 352 1 XSS CSRF 2013-01-03 2013-01-07
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that conduct XSS attacks via the news_title parameter in a create action.
46 CVE-2012-6369 79 1 XSS 2012-12-28 2013-01-08
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Troubleshooting Reporting System feature in AgileBits 1Password 3.9.9 might allow remote attackers to inject arbitrary web script or HTML via a crafted User-Agent HTTP header that is not properly handled in a View Troubleshooting Report action.
47 CVE-2012-6301 20 1 DoS 2012-12-10 2012-12-11
5.0
 None Remote Low Not required None None Partial
The Browser application in Android 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted market: URI in the SRC attribute of an IFRAME element.
48 CVE-2012-6096 119 2 Exec Code Overflow 2013-01-22 2013-02-07
7.5
 None Remote Low Not required Partial Partial Partial
Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to execute arbitrary code via a long (1) host_name variable (host parameter) or (2) svc_description variable.
49 CVE-2012-6064 22 1 Dir. Trav. CSRF 2012-12-03 2012-12-04
3.5
 None Remote Medium Single system None Partial None
Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files.
50 CVE-2012-6050 16 1 DoS 2012-11-26 2012-11-28
6.4
 None Remote Low Not required Partial None Partial
The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consumption), read the router version, and possibly have other impacts via a request to download the router's DLLs or plugins, as demonstrated by roteros.dll.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.