Overview 319 matches · 14 in Waratek scope · 3 protected · 3 exploited · 0 CISA KEV · 37 public PoC · 6 EPSS ≥ 0.5
319matches
14in Waratek scope4.4%
3protected0.9%
3exploited0.9%
0CISA KEV0.0%
37public PoC11.6%
6EPSS ≥ 0.51.9%
Protected by Waratek
3
0.9%
Rule in development
0
0.0%
Mitigation candidate
1
0.3%
No exploit published
10
3.1%
Outside Waratek scope
6
1.9%
Not applicable
299
93.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
3
0.9%
partly blocked
0
0.0%
not blocked
316
99.1%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 49 / year
19996
Not applicable6
High4
Medium2
not blocked6
Working exploit published3
No public exploit3
20001
Not applicable1
High1
not blocked1
No public exploit1
20010
20029
Not applicable9
High1
Medium7
Low1
not blocked9
Working exploit published3
No public exploit6
200311
Not applicable11
High7
Medium2
Low2
not blocked11
Working exploit published2
No public exploit9
20044
Not applicable4
High2
Medium2
not blocked4
Working exploit published3
No public exploit1
20053
Not applicable3
High1
Medium2
not blocked3
No public exploit3
20065
Not applicable5
High2
Medium3
not blocked5
Exploited1
Working exploit published3
No public exploit1
200732
No exploit published1
Not applicable31
High12
Medium15
Low5
not blocked32
Working exploit published4
No public exploit28
200834
No exploit published3
Not applicable31
High16
Medium18
not blocked34
Working exploit published1
Proof of concept only1
No public exploit32
200949
Protected by Waratek1
No exploit published3
Outside Waratek scope1
Not applicable44
High17
Medium28
Low4
blocked by ARMR today1
not blocked48
Exploited1
Working exploit published6
No public exploit42
201024
Protected by Waratek1
Mitigation candidate1
No exploit published1
Not applicable21
High11
Medium11
Low2
blocked by ARMR today1
not blocked23
Exploited1
Working exploit published1
No public exploit22
201129
Not applicable29
High10
Medium14
Low5
not blocked29
Working exploit published1
No public exploit28
201219
No exploit published1
Not applicable18
High2
Medium14
Low3
not blocked19
Working exploit published3
No public exploit16
201320
Protected by Waratek1
No exploit published1
Outside Waratek scope3
Not applicable15
High5
Medium15
blocked by ARMR today1
not blocked19
Working exploit published1
No public exploit19
20145
Not applicable5
Medium3
Low2
not blocked5
Working exploit published2
No public exploit3
20150
20160
20174
Not applicable4
Critical3
Medium1
not blocked4
No public exploit4
20188
Outside Waratek scope1
Not applicable7
Critical2
High5
Medium1
not blocked8
No public exploit8
20198
Outside Waratek scope1
Not applicable7
Critical2
High3
Medium3
not blocked8
No public exploit8
202016
Not applicable16
High4
Medium10
Low2
not blocked16
Working exploit published1
No public exploit15
20217
Not applicable7
Critical2
High2
Medium3
not blocked7
No public exploit7
20226
Not applicable6
Critical3
High3
not blocked6
Proof of concept only1
No public exploit5
20234
Not applicable4
Critical1
High3
not blocked4
No public exploit4
20249
Not applicable9
Critical3
High5
Medium1
not blocked9
No public exploit9
20252
Not applicable2
Medium1
Low1
not blocked2
No public exploit2
20264
Not applicable4
Critical1
High1
Medium1
Low1
not blocked4
No public exploit4
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2009-1093 | Medium | 2009-03-25 | No exploit published | No public exploit | LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not close the connection when initialization fails, which allows remote attackers to cause a denial of service (LDAP service hang). |
| CVE-2009-1072 | Medium | 2009-03-25 | Not applicable | No public exploit | nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option. |
| CVE-2009-0621 | High | 2009-02-26 | Not applicable | No public exploit | Cisco ACE 4710 Application Control Engine Appliance before A1(8a) uses default (1) usernames and (2) passwords for (a) the administrator, (b) web management, and (c) device management, which makes it easier for remote attackers to perform configuration changes to the Device Manager and other components, or obtain operating-system access. |
| CVE-2009-0507 | Medium | 2009-02-26 | Not applicable | No public exploit | IBM WebSphere Process Server (WPS) 6.1.2 before 6.1.2.3 and 6.2 before 6.2.0.1 does not properly restrict configuration data during an export of the cluster configuration file from the administrative console, which allows remote authenticated users to obtain the (1) JMSAPI, (2) ESCALATION, and (3) MAILSESSION (aka mail session) cleartext passwords via vectors involving access to a cluster member. |
| CVE-2009-0641 | High | 2009-02-20 | Not applicable | Working exploit published | sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x versions deletes dangerous environment variables with a method that was valid only in older FreeBSD distributions, which might allow remote attackers to execute arbitrary code by passing a crafted environment variable from a telnet client, as demonstrated by an LD_PRELOAD value that references a malicious library. |
| CVE-2008-6171 | High | 2009-02-19 | Not applicable | No public exploit | includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header. |
| CVE-2009-0432 | Medium | 2009-02-10 | No exploit published | No public exploit | The installation process for the File Transfer servlet in the System Management/Repository component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.19 does not enable the secure version, which allows remote attackers to obtain sensitive information via unspecified vectors. |
| CVE-2009-0489 | Low | 2009-02-09 | Not applicable | No public exploit | The DBus configuration file for Wicd before 1.5.9 allows arbitrary users to own org.wicd.daemon, which allows local users to receive messages that were intended for the Wicd daemon, possibly including credentials. |
| CVE-2009-0399 | High | 2009-02-03 | Not applicable | Working exploit published | Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.php. NOTE: this is only a vulnerability when the administrator does not properly follow installation directions. |
| CVE-2009-0243 | High | 2009-01-21 | Not applicable | No public exploit | Microsoft Windows does not properly enforce the Autorun and NoDriveTypeAutoRun registry values, which allows physically proximate attackers to execute arbitrary code by (1) inserting CD-ROM media, (2) inserting DVD media, (3) connecting a USB device, and (4) connecting a Firewire device; (5) allows user-assisted remote attackers to execute arbitrary code by mapping a network drive; and allows user-assisted attackers to execute arbitrary code by clicking on (6) an icon under My Computer\Devices with Removable Storage and (7) an option in an AutoPlay dialog, related to the Autorun.inf file. NOTE: vectors 1 and 3 on Vista are already covered by CVE-2008-0951. |
| CVE-2003-1566 | Medium | 2009-01-15 | Not applicable | Working exploit published | Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain sensitive information without detection. |
| CVE-2008-5844 | High | 2009-01-05 | Not applicable | No public exploit | PHP 5.2.7 contains an incorrect change to the FILTER_UNSAFE_RAW functionality, and unintentionally disables magic_quotes_gpc regardless of the actual magic_quotes_gpc setting, which might make it easier for context-dependent attackers to conduct SQL injection attacks and unspecified other attacks. |
| CVE-2008-5827 | High | 2009-01-02 | Not applicable | No public exploit | The Nokia 6131 Near Field Communication (NFC) phone with 05.12 firmware automatically installs software upon completing the download of a JAR file, which makes it easier for remote attackers to execute arbitrary code via a crafted URI record in an NDEF tag. |
| CVE-2006-7236 | High | 2009-01-02 | Not applicable | Working exploit published | The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences. |
| CVE-2008-5710 | Medium | 2008-12-24 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in the web management interface in Avaya Communication Manager (CM) 3.1.x, 4.0.3, and 5.x allow remote attackers to read (1) configuration files, (2) log files, (3) binary image files, and (4) help files via unknown vectors. |
| CVE-2008-4311 | Medium | 2008-12-10 | Not applicable | No public exploit | The default configuration of system.conf in D-Bus (aka DBus) before 1.2.6 omits the send_type attribute in certain rules, which allows local users to bypass intended access restrictions by (1) sending messages, related to send_requested_reply; and possibly (2) receiving messages, related to receive_requested_reply. |
| CVE-2008-5277 | Medium | 2008-12-09 | Not applicable | No public exploit | PowerDNS before 2.9.21.2 allows remote attackers to cause a denial of service (daemon crash) via a CH HINFO query. |
| CVE-2008-5109 | Medium | 2008-11-25 | Not applicable | No public exploit | The default configuration of Adobe Flash Media Server (FMS) 3.0 does not enable SWF Verification for (1) RTMPE and (2) RTMPTE sessions, which makes it easier for remote attackers to make copies of video content via stream-capture software. |
| CVE-2008-4609 | High | 2008-10-20 | Not applicable | Proof of concept only | The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress. |
| CVE-2008-4212 | High | 2008-10-10 | Not applicable | No public exploit | Unspecified vulnerability in rlogind in the rlogin component in Mac OS X 10.4.11 and 10.5.5 applies hosts.equiv entries to root despite what is stated in documentation, which might allow remote attackers to bypass intended access restrictions. |
| CVE-2008-3519 | Medium | 2008-09-23 | No exploit published | No public exploit | The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform (aka JBossEAP or EAP), possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain sensitive information (non-EJB classes) via a download request, a different vulnerability than CVE-2008-3273. |
| CVE-2008-4126 | Medium | 2008-09-18 | Not applicable | No public exploit | PyDNS (aka python-dns) before 2.3.1-5 in Debian GNU/Linux does not use random source ports for DNS requests and does not use random transaction IDs for DNS retries, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4099. |
| CVE-2008-4100 | Medium | 2008-09-18 | Not applicable | No public exploit | GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment. |
| CVE-2008-4099 | Medium | 2008-09-18 | Not applicable | No public exploit | PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux does not use random source ports or transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. |
| CVE-2008-3459 | High | 2008-08-04 | Not applicable | No public exploit | Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows systems, allows remote servers to execute arbitrary commands via crafted (1) lladdr and (2) iproute configuration directives, probably related to shell metacharacters. |
| CVE-2008-1662 | High | 2008-08-01 | Not applicable | No public exploit | Unspecified vulnerability in the HP System Administration Manager (SAM) on HP-UX B.11.11 and B.11.23, when used to configure NFS, might allow remote attackers to read or modify arbitrary files, related to an "empty systems list." |
| CVE-2008-3228 | High | 2008-07-18 | Not applicable | No public exploit | Joomla! before 1.5.4 does not configure .htaccess to apply certain security checks that "block common exploits" to SEF URLs, which has unknown impact and remote attack vectors. |
| CVE-2008-3177 | Medium | 2008-07-15 | Not applicable | No public exploit | Sophos virus detection engine 2.75 on Linux and Unix, as used in Sophos Email Appliance, Pure Message for Unix, and Sophos Anti-Virus Interface (SAVI), allows remote attackers to cause a denial of service (engine crash) via zero-length MIME attachments. |
| CVE-2008-3115 | High | 2008-07-09 | No exploit published | No public exploit | Secure Static Versioning in Sun Java JDK and JRE 6 Update 6 and earlier, and 5.0 Update 6 through 15, does not properly prevent execution of applets on older JRE releases, which might allow remote attackers to exploit vulnerabilities in these older releases. |
| CVE-2008-2060 | High | 2008-06-18 | Not applicable | No public exploit | Unspecified vulnerability in Cisco Intrusion Prevention System (IPS) 5.x before 5.1(8)E2 and 6.x before 6.0(5)E2, when inline mode and jumbo Ethernet support are enabled, allows remote attackers to cause a denial of service (panic), and possibly bypass intended restrictions on network traffic, via a "specific series of jumbo Ethernet frames." |
| CVE-2008-2366 | Medium | 2008-06-16 | Not applicable | No public exploit | Untrusted search path vulnerability in a certain Red Hat build script for OpenOffice.org (OOo) 1.1.x on Red Hat Enterprise Linux (RHEL) 3 and 4 allows local users to gain privileges via a malicious library in the current working directory, related to incorrect quoting of the ORIGIN symbol for use in the RPATH library path. |
| CVE-2008-2359 | High | 2008-06-02 | Not applicable | No public exploit | The default configuration of consolehelper in system-config-network before 1.5.10-1 on Fedora 8 lacks the USER=root directive, which allows local users of the workstation console to gain privileges and change the network configuration. |
| CVE-2008-2121 | High | 2008-05-09 | Not applicable | No public exploit | The TCP implementation in Sun Solaris 8, 9, and 10 allows remote attackers to cause a denial of service (CPU consumption and new connection timeouts) via a TCP SYN flood attack. |
| CVE-2007-6282 | High | 2008-05-08 | Not applicable | No public exploit | The IPsec implementation in Linux kernel before 2.6.25 allows remote routers to cause a denial of service (crash) via a fragmented ESP packet in which the first fragment does not contain the entire ESP header and IV. |
| CVE-2008-2089 | High | 2008-05-06 | Not applicable | No public exploit | Unspecified vulnerability in the SCTP protocol implementation in Sun Solaris 10 allows remote attackers to cause a denial of service (panic) via a crafted SCTP packet. |
| CVE-2008-1671 | Medium | 2008-04-28 | Not applicable | No public exploit | start_kdeinit in KDE 3.5.5 through 3.5.9, when installed setuid root, allows local users to cause a denial of service and possibly execute arbitrary code via "user-influenceable input" (probably command-line arguments) that cause start_kdeinit to send SIGUSR1 signals to other processes. |
| CVE-2008-1923 | High | 2008-04-23 | Not applicable | No public exploit | The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "early audio" to an unverified source IP address of a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed NEW message. |
| CVE-2008-1778 | Medium | 2008-04-14 | Not applicable | No public exploit | Unspecified vulnerability in the floating point context switch implementation in Sun Solaris 9 and 10 on x86 platforms might allow local users to cause a denial of service (application exit), corrupt data, or trigger incorrect calculations via unknown vectors. |
| CVE-2008-1156 | Medium | 2008-03-27 | Not applicable | No public exploit | Unspecified vulnerability in the Multicast Virtual Private Network (MVPN) implementation in Cisco IOS 12.0, 12.2, 12.3, and 12.4 allows remote attackers to create "extra multicast states on the core routers" via a crafted Multicast Distribution Tree (MDT) Data Join message. |
| CVE-2008-1525 | Medium | 2008-03-26 | Not applicable | No public exploit | The default SNMP configuration on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), has a Trusted Host value of 0.0.0.0, which allows remote attackers to send SNMP requests from any source IP address. |
| CVE-2008-1524 | High | 2008-03-26 | Not applicable | No public exploit | The SNMP service on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), has "public" as its default community for both (1) read and (2) write operations, which allows remote attackers to perform administrative actions via SNMP, as demonstrated by reading the Dynamic DNS service password or inserting an XSS sequence into the system.sysName.0 variable, which is displayed on the System Status page. |
| CVE-2008-1522 | High | 2008-03-26 | Not applicable | No public exploit | ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), have (1) "user" as their default password for the "user" account and (2) "1234" as their default password for the "admin" account, which makes it easier for remote attackers to obtain access. |
| CVE-2008-1507 | High | 2008-03-25 | Not applicable | Working exploit published | PEEL, possibly 3.x and earlier, has (1) a default info@peel.fr account with password admin, and (2) a default contact@peel.fr account with password cinema, which allows remote attackers to gain administrative access. |
| CVE-2008-1392 | High | 2008-03-20 | Not applicable | No public exploit | The default configuration of VMware Workstation 6.0.2, VMware Player 2.0.x before 2.0.3, and VMware ACE 2.0.x before 2.0.1 makes the console of the guest OS accessible through anonymous VIX API calls, which has unknown impact and attack vectors. |
| CVE-2008-1287 | Medium | 2008-03-11 | Not applicable | No public exploit | IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames. |
| CVE-2008-1199 | Medium | 2008-03-06 | Not applicable | No public exploit | Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack. |
| CVE-2008-0128 | Medium | 2008-01-23 | No exploit published | No public exploit | The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie. |
| CVE-2007-6676 | Medium | 2008-01-08 | Not applicable | No public exploit | The default configuration of Uber Uploader (UU) 5.3.6 and earlier does not block uploads of (1) .html, (2) .asp, and other possibly dangerous extensions, which allows remote attackers to use these extensions in uploads via (a) uu_file_upload.php, related to uu_file_upload.js and (b) uber_uploader_file.php, related to uber_uploader_file.js, a different issue than CVE-2007-0123. NOTE: the vendor disputes the severity of the issue, noting that it is the administrator's responsibility to "add file extensions that you may or may not want uploaded." |
| CVE-2007-6505 | Low | 2007-12-20 | Not applicable | No public exploit | Solaris 9, with Solaris Auditing enabled and certain patches for sshd installed, can generate audit records with an audit-ID of 0 even when the user logging into ssh is not root, which makes it easier for attackers to avoid detection and can make it more difficult to conduct forensics activities. |
| CVE-2007-6285 | Medium | 2007-12-20 | Not applicable | No public exploit | The default configuration for autofs 5 (autofs5) in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 4 and 5, does not specify the nodev mount option for the -hosts map, which allows local users to access "important devices" by operating a remote NFS server and creating special device files on that server, as demonstrated by the /dev/mem device. |
| CVE-2007-5856 | High | 2007-12-19 | Not applicable | No public exploit | Quick Look Apple Mac OS X 10.5.1, when previewing an HTML file, does not prevent plug-ins from making network requests, which might allow remote attackers to obtain sensitive information. |
| CVE-2007-6409 | Medium | 2007-12-17 | Not applicable | No public exploit | The gg protocol handler in Gadu-Gadu, when this product is installed but not running, does not properly handle the skin attribute, which allows remote attackers to cause a denial of service (resource consumption) via unspecified network traffic. |
| CVE-2007-6379 | Medium | 2007-12-15 | Not applicable | Working exploit published | BadBlue 2.72b and earlier allows remote attackers to obtain sensitive information via an invalid browse parameter, which reveals the installation path in an error message. |
| CVE-2007-5964 | Medium | 2007-12-13 | Not applicable | No public exploit | The default configuration of autofs 5 in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 5, omits the nosuid option for the hosts (/net filesystem) map, which allows local users to gain privileges via a setuid program on a remote NFS server. |
| CVE-2007-6210 | Low | 2007-12-04 | Not applicable | Working exploit published | zabbix_agentd 1.1.4 in ZABBIX before 1.4.3 runs "UserParameter" scripts with gid 0, which might allow local users to gain privileges. |
| CVE-2007-6199 | High | 2007-12-01 | Not applicable | No public exploit | rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows remote attackers to access restricted files via unknown vectors that cause rsync to create a symlink that points outside of the module's hierarchy. |
| CVE-2007-6131 | Low | 2007-11-26 | Not applicable | No public exploit | buttonpressed.sh in scanbuttond 0.2.3 allows local users to overwrite arbitrary files via a symlink attack on the (1) scan.pnm and (2) scan.jpg temporary files. |
| CVE-2007-4687 | High | 2007-11-15 | Not applicable | No public exploit | The remote_cmds component in Apple Mac OS X 10.4 through 10.4.10 contains a symbolic link from the tftpboot private directory to the root directory, which allows tftpd users to escape the private directory and access arbitrary files. |
| CVE-2007-5943 | Medium | 2007-11-14 | Not applicable | No public exploit | Simple Machines Forum (SMF) 1.1.4 allows remote attackers to read a message in private forums by using the advanced search module with the "show results as messages" option, then searching for possible keywords contained in that message. |
| CVE-2007-3898 | Medium | 2007-11-14 | Not applicable | Working exploit published | The DNS server in Microsoft Windows 2000 Server SP4, and Server 2003 SP1 and SP2, uses predictable transaction IDs when querying other DNS servers, which allows remote attackers to spoof DNS replies, poison the DNS cache, and facilitate further attack vectors. |
| CVE-2007-5838 | High | 2007-11-06 | Not applicable | No public exploit | Aclient in Symantec Altiris Deployment Solution 6.x before 6.8.380.0 allows local users to gain local System privileges via the "Enable key-based authentication to Deployment server" browser option, a different issue than CVE-2007-4380. |
| CVE-2007-5715 | Medium | 2007-10-30 | Not applicable | No public exploit | DenyHosts 2.6 processes OpenSSH sshd "not listed in AllowUsers" log messages with an incorrect regular expression that does not match an IP address, which might allow remote attackers to avoid detection and blocking when making invalid login attempts with a username not present in AllowUsers, as demonstrated by the root username, a different vulnerability than CVE-2007-4323. |
| CVE-2007-5338 | High | 2007-10-21 | Not applicable | No public exploit | Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allow remote attackers to execute arbitrary Javascript with user privileges by using the Script object to modify XPCNativeWrappers in a way that causes the script to be executed when a chrome action is performed. |
| CVE-2007-5334 | Medium | 2007-10-21 | Not applicable | No public exploit | Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 can hide the window's titlebar when displaying XUL markup language documents, which makes it easier for remote attackers to conduct phishing and spoofing attacks by setting the hidechrome attribute. |
| CVE-2007-5422 | Medium | 2007-10-12 | Not applicable | No public exploit | Unspecified vulnerability in "Solaris Auditing" in the Basic Security Module (BSM) in Sun Solaris 10, when configured for auditing of networking (nt) events, allows local users to cause a denial of service (panic) via unspecified vectors. |
| CVE-2007-5420 | Low | 2007-10-12 | Not applicable | No public exploit | The 3Com 3CRWER100-75 router with 1.2.10ww software, when remote management is disabled but a web server has been configured, serves a web page to external clients, which might allow remote attackers to obtain information about the router's existence and product details. |
| CVE-2007-5419 | High | 2007-10-12 | Not applicable | No public exploit | The 3Com 3CRWER100-75 router with 1.2.10ww software, when enabling an optional virtual server, configures this server to accept all source IP addresses on the external (Internet) interface unless the user selects other options, which might expose the router to unintended incoming traffic from remote attackers, as demonstrated by setting up a virtual server on port 80, which allows remote attackers to access the web management interface. |
| CVE-2007-5375 | Low | 2007-10-11 | No exploit published | No public exploit | Interpretation conflict in the Sun Java Virtual Machine (JVM) allows user-assisted remote attackers to conduct a multi-pin DNS rebinding attack and execute arbitrary JavaScript in an intranet context, when an intranet web server has an HTML document that references a "mayscript=true" Java applet through a local relative URI, which may be associated with different IP addresses by the browser and the JVM. |
| CVE-2007-3759 | Medium | 2007-09-27 | Not applicable | No public exploit | Safari in Apple iPhone 1.1.1, when requested to disable Javascript, does not disable it until Safari is restarted, which might leave Safari open to attacks that the user does not expect. |
| CVE-2007-5071 | High | 2007-09-24 | Not applicable | No public exploit | Incomplete blacklist vulnerability in upload_img_cgi.php in Simple PHP Blog before 0.5.1 allows remote attackers to upload dangerous files and execute arbitrary code, as demonstrated by a filename ending in .php. or a .htaccess file, a different vector than CVE-2005-2733. NOTE: the vulnerability was also present in a 0.5.1 download available in the early morning of 20070923. NOTE: the original 20070920 disclosure provided an incorrect filename, img_upload_cgi.php. |
| CVE-2007-4749 | Medium | 2007-09-14 | Not applicable | No public exploit | The cmdjob utility in Autodesk Backburner 3.0.2 allows remote attackers to execute arbitrary commands on render servers by queueing jobs that contain these commands. NOTE: this is only a vulnerability in environments in which the administrator has not followed documentation that outlines the security risks of operating Backburner on untrusted networks. |
| CVE-2007-4789 | High | 2007-09-10 | Not applicable | No public exploit | Cisco Content Switching Modules (CSM) 4.2 before 4.2.7, and Cisco Content Switching Module with SSL (CSM-S) 2.1 before 2.1.6, when service termination is enabled, allow remote attackers to cause a denial of service (reboot) via unspecified vectors related to high network utilization, aka CSCsh57876. |
| CVE-2007-2216 | High | 2007-08-14 | Not applicable | Working exploit published | The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which allows remote attackers to execute arbitrary code by requesting the HelpString property, involving a crafted DLL file argument to the TypeLibInfoFromFile function, which overwrites the HelpStringDll property to call the DLLGetDocumentation function in another DLL file, aka "ActiveX Object Vulnerability." |
| CVE-2007-3742 | Medium | 2007-08-03 | Not applicable | No public exploit | WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, does not properly handle the interaction between International Domain Name (IDN) support and Unicode fonts, which allows remote attackers to create a URL containing "look-alike characters" (homographs) and possibly perform phishing attacks. |
| CVE-2007-4074 | High | 2007-07-30 | Not applicable | No public exploit | The default configuration of Centre for Speech Technology Research (CSTR) Festival 1.95 beta (aka 2.0 beta) on Gentoo Linux, SUSE Linux, and possibly other distributions, is run locally with elevated privileges without requiring authentication, which allows local and remote attackers to execute arbitrary commands via the local daemon on port 1314, a different vulnerability than CVE-2001-0956. NOTE: this issue is local in some environments, but remote on others. |
| CVE-2007-3380 | Medium | 2007-07-20 | Not applicable | No public exploit | The Distributed Lock Manager (DLM) in the cluster manager for Linux kernel 2.6.15 allows remote attackers to cause a denial of service (loss of lock services) by connecting to the DLM port, which probably prevents other processes from accessing the service. |
| CVE-2007-1692 | High | 2007-03-26 | Not applicable | No public exploit | The default configuration of Microsoft Windows uses the Web Proxy Autodiscovery Protocol (WPAD) without static WPAD entries, which might allow remote attackers to intercept web traffic by registering a proxy server using WINS or DNS, then responding to WPAD requests, as demonstrated using Internet Explorer. NOTE: it could be argued that if an attacker already has control over WINS/DNS, then web traffic could already be intercepted by modifying WINS or DNS records, so this would not cross privilege boundaries and would not be a vulnerability. It has also been reported that DHCP is an alternate attack vector. |
| CVE-2007-1507 | High | 2007-03-20 | Not applicable | No public exploit | The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might allow attackers to gain privileges by spoofing a response to an AFS cache manager FetchStatus request, and setting setuid and root ownership for files in the cache. |
| CVE-2007-1184 | Medium | 2007-03-02 | Not applicable | No public exploit | The default configuration of WebAPP before 0.9.9.5 has a CAPTCHA setting of "no," which makes it easier for automated programs to submit false data. |
| CVE-2007-1084 | Medium | 2007-02-23 | Not applicable | No public exploit | Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme, which is executed in the context of the last visited web page. |
| CVE-2006-6899 | Medium | 2006-12-31 | Not applicable | Working exploit published | hidd in BlueZ (bluez-utils) before 2.25 allows remote attackers to obtain control of the (1) Mouse and (2) Keyboard Human Interface Device (HID) via a certain configuration of two HID (PSM) endpoints, operating as a server, aka HidAttack. |
| CVE-2006-3677 | High | 2006-07-27 | Not applicable | Exploited | Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properties of the window navigator object (window.navigator) that are accessed when Java starts up, which causes a crash that leads to code execution. |
| CVE-2006-3291 | High | 2006-06-28 | Not applicable | No public exploit | The web interface on Cisco IOS 12.3(8)JA and 12.3(8)JA1, as used on the Cisco Wireless Access Point and Wireless Bridge, reconfigures itself when it is changed to use the "Local User List Only (Individual Passwords)" setting, which removes all security and password configurations and allows remote attackers to access the system. |
| CVE-2006-2363 | Medium | 2006-05-15 | Not applicable | Working exploit published | SQL injection vulnerability in the weblinks option (weblinks.html.php) in Limbo CMS allows remote attackers to execute arbitrary SQL commands via the catid parameter. |
| CVE-2006-0848 | Medium | 2006-02-22 | Not applicable | Working exploit published | The "Open 'safe' files after downloading" option in Safari on Apple Mac OS X allows remote user-assisted attackers to execute arbitrary commands by tricking a user into downloading a __MACOSX folder that contains metadata (resource fork) that invokes the Terminal, which automatically interprets the script using bash, as demonstrated using a ZIP file that contains a script with a safe file extension. |
| CVE-2005-4845 | Medium | 2005-12-31 | Not applicable | No public exploit | The Java Plug-in 1.4.2_03 and 1.4.2_04 controls, and the 1.4.2_03 and 1.4.2_04 <applet> redirector controls, allow remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer. |
| CVE-2005-4837 | High | 2005-12-31 | Not applicable | No public exploit | snmp_api.c in snmpd in Net-SNMP 5.2.x before 5.2.2, 5.1.x before 5.1.3, and 5.0.x before 5.0.10.2, when running in master agentx mode, allows remote attackers to cause a denial of service (crash) by causing a particular TCP disconnect, which triggers a free of an incorrect variable, a different vulnerability than CVE-2005-2177. |
| CVE-2005-0197 | Medium | 2005-05-02 | Not applicable | No public exploit | Cisco IOS 12.1T, 12.2, 12.2T, 12.3 and 12.3T, with Multi Protocol Label Switching (MPLS) installed but disabled, allows remote attackers to cause a denial of service (device reload) via a crafted packet sent to the disabled interface. |
| CVE-2004-2760 | Medium | 2004-12-31 | Not applicable | No public exploit | sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess the password by observing the connection state, a different vulnerability than CVE-2003-0190. NOTE: it could be argued that in most environments, this does not cross privilege boundaries without requiring leverage of a separate vulnerability. |
| CVE-2004-2692 | High | 2004-12-31 | Not applicable | Working exploit published | The exec_dir PHP patch (php-exec-dir) 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers to bypass restrictions and execute arbitrary commands via a backtick operator, which is not handled using the php_escape_shell_cmd function. |
| CVE-2004-2687 | High | 2004-12-31 | Not applicable | Working exploit published | distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks. |
| CVE-2004-0605 | Medium | 2004-12-06 | Not applicable | Working exploit published | Non-registered IRC users using (1) ircd-hybrid 7.0.1 and earlier, (2) ircd-ratbox 1.5.1 and earlier, or (3) ircd-ratbox 2.0rc6 and earlier do not have a rate-limit imposed, which could allow remote attackers to cause a denial of service by repeatedly making requests, which are slowly dequeued. |
| CVE-2003-1491 | High | 2003-12-31 | Not applicable | No public exploit | Kerio Personal Firewall (KPF) 2.1.4 has a default rule to accept incoming packets from DNS (UDP port 53), which allows remote attackers to bypass the firewall filters via packets with a source port of 53. |
| CVE-2003-1457 | Medium | 2003-12-31 | Not applicable | No public exploit | Auerswald COMsuite CTI ControlCenter 3.1 creates a default "runasositron" user account with an easily guessable password, which allows local users or remote attackers to gain access. |
| CVE-2003-1452 | Low | 2003-12-31 | Not applicable | Working exploit published | Untrusted search path vulnerability in Qualcomm qpopper 4.0 through 4.05 allows local users to execute arbitrary code by modifying the PATH environment variable to reference a malicious smbpasswd program. |
| CVE-2003-1449 | High | 2003-12-31 | Not applicable | No public exploit | Aladdin Knowlege Systems eSafe Gateway 3.5.126.0 does not check the entire stream of Content Vectoring Protocol (CVP) data, which allows remote attackers to bypass virus protection. |
| CVE-2003-1426 | Low | 2003-12-31 | Not applicable | No public exploit | Openwebmail in cPanel 5.0, when run using suid Perl, adds the directory in the SCRIPT_FILENAME environment variable to Perl's @INC include array, which allows local users to execute arbitrary code by modifying SCRIPT_FILENAME to reference a directory containing a malicious openwebmail-shared.pl executable. |
| CVE-2003-1422 | High | 2003-12-31 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in the installer for SYSLINUX 2.01, when running setuid root, allow local users to gain privileges via unknown vectors. |
| CVE-2003-1367 | High | 2003-12-31 | Not applicable | No public exploit | The which_access variable for Majordomo 2.0 through 1.94.4, and possibly earlier versions, is set to "open" by default, which allows remote attackers to identify the email addresses of members of mailing lists via a "which" command. |
| CVE-2003-1362 | High | 2003-12-31 | Not applicable | No public exploit | Bastille B.02.00.00 of HP-UX 11.00 and 11.11 does not properly configure the (1) NOVRFY and (2) NOEXPN options in the sendmail.cf file, which could allow remote attackers to verify the existence of system users and expand defined sendmail aliases. |