Overview 48,702 matches · 1,207 in Waratek scope · 56 protected · 404 exploited · 58 CISA KEV · 16,722 public PoC · 861 EPSS ≥ 0.5
48,702matches
1,207in Waratek scope2.5%
56protected0.1%
404exploited0.8%
58CISA KEV0.1%
16,722public PoC34.3%
861EPSS ≥ 0.51.8%
Protected by Waratek
56
0.1%
Rule in development
0
0.0%
Mitigation candidate
84
0.2%
No exploit published
1,067
2.2%
Outside Waratek scope
546
1.1%
Not applicable
46,518
95.5%
Withdrawn CVE
431
0.9%
blocked by ARMR today
56
0.1%
partly blocked
0
0.0%
not blocked
48,646
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 6,659 / year
19882
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
19893
Not applicable3
High2
Medium1
not blocked3
No public exploit3
199011
Not applicable11
High8
Medium2
Low1
not blocked11
Working exploit published1
No public exploit10
199115
Not applicable15
High11
Medium4
not blocked15
Working exploit published2
No public exploit13
199214
Not applicable13
Withdrawn CVE1
High12
Low1
Unknown1
not blocked14
No public exploit14
199313
Not applicable13
High8
Medium3
Low2
not blocked13
No public exploit13
199426
Not applicable25
Withdrawn CVE1
High14
Medium10
Low1
Unknown1
not blocked26
Working exploit published6
No public exploit20
199525
Not applicable25
Critical1
High17
Medium6
Low1
not blocked25
Working exploit published5
No public exploit20
199675
No exploit published1
Not applicable73
Withdrawn CVE1
Critical1
High43
Medium21
Low9
Unknown1
not blocked75
Working exploit published18
Forecast only1
No public exploit56
1997253
Not applicable252
Withdrawn CVE1
Critical1
High143
Medium89
Low19
Unknown1
not blocked253
Exploited2
Working exploit published73
Forecast only2
No public exploit176
1998247
Not applicable246
Withdrawn CVE1
Critical1
High137
Medium85
Low23
Unknown1
not blocked247
Exploited1
Working exploit published50
No public exploit196
1999923
No exploit published2
Outside Waratek scope1
Not applicable891
Withdrawn CVE29
Critical3
High423
Medium357
Low111
Unknown29
not blocked923
Exploited2
Working exploit published282
No public exploit639
20001,020
Mitigation candidate6
No exploit published6
Outside Waratek scope2
Not applicable1,005
Withdrawn CVE1
Critical2
High454
Medium467
Low96
Unknown1
not blocked1,020
Exploited5
Working exploit published427
Forecast only1
No public exploit587
20011,679
Protected by Waratek1
Mitigation candidate2
No exploit published10
Outside Waratek scope14
Not applicable1,649
Withdrawn CVE3
Critical12
High776
Medium706
Low182
Unknown3
blocked by ARMR today1
not blocked1,678
Exploited14
Working exploit published480
Forecast only2
No public exploit1,183
20022,170
Protected by Waratek3
Mitigation candidate8
No exploit published26
Outside Waratek scope12
Not applicable2,107
Withdrawn CVE14
Critical10
High1,023
Medium980
Low143
Unknown14
blocked by ARMR today3
not blocked2,167
Exploited12
Working exploit published545
Forecast only9
No public exploit1,604
20031,548
Protected by Waratek2
Mitigation candidate7
No exploit published30
Outside Waratek scope6
Not applicable1,482
Withdrawn CVE21
Critical9
High674
Medium747
Low97
Unknown21
blocked by ARMR today2
not blocked1,546
Exploited10
Working exploit published499
Forecast only1
No public exploit1,038
20042,479
Protected by Waratek2
Mitigation candidate1
No exploit published24
Outside Waratek scope8
Not applicable2,416
Withdrawn CVE28
Critical10
High973
Medium1,265
Low203
Unknown28
blocked by ARMR today2
not blocked2,477
Exploited21
Working exploit published755
Forecast only1
No public exploit1,702
20055,010
Protected by Waratek3
Mitigation candidate4
No exploit published75
Outside Waratek scope17
Not applicable4,833
Withdrawn CVE78
Critical13
High2,048
Medium2,430
Low441
Unknown78
blocked by ARMR today3
not blocked5,007
Exploited22
Working exploit published1,341
Forecast only11
No public exploit3,636
20066,659
Protected by Waratek8
Mitigation candidate4
No exploit published121
Outside Waratek scope67
Not applicable6,408
Withdrawn CVE51
Critical12
High2,763
Medium3,324
Low509
Unknown51
blocked by ARMR today8
not blocked6,651
Exploited37
Working exploit published2,440
Proof of concept only1
Forecast only6
No public exploit4,175
20076,596
Protected by Waratek6
Mitigation candidate10
No exploit published134
Outside Waratek scope83
Not applicable6,283
Withdrawn CVE80
Critical21
High3,162
Medium3,101
Low232
Unknown80
blocked by ARMR today6
not blocked6,590
Exploited47
Working exploit published2,495
Proof of concept only5
Forecast only5
No public exploit4,044
20085,664
Protected by Waratek7
Mitigation candidate9
No exploit published120
Outside Waratek scope74
Not applicable5,422
Withdrawn CVE32
Critical19
High2,846
Medium2,582
Low185
Unknown32
blocked by ARMR today7
not blocked5,657
Exploited42
Working exploit published2,518
Proof of concept only4
Forecast only9
No public exploit3,091
20095,778
Protected by Waratek9
Mitigation candidate13
No exploit published181
Outside Waratek scope62
Not applicable5,467
Withdrawn CVE46
Critical15
High2,734
Medium2,786
Low197
Unknown46
blocked by ARMR today9
not blocked5,769
Exploited73
Working exploit published2,591
Proof of concept only2
Forecast only3
No public exploit3,109
20104,667
Protected by Waratek9
Mitigation candidate12
No exploit published162
Outside Waratek scope86
Not applicable4,370
Withdrawn CVE28
Critical28
High2,093
Medium2,241
Low277
Unknown28
blocked by ARMR today9
not blocked4,658
Exploited73
Working exploit published1,313
Proof of concept only1
Forecast only9
No public exploit3,271
20113,825
Protected by Waratek6
Mitigation candidate8
No exploit published175
Outside Waratek scope114
Not applicable3,507
Withdrawn CVE15
Critical4
High1,637
Medium1,915
Low254
Unknown15
blocked by ARMR today6
not blocked3,819
Exploited43
Working exploit published607
Proof of concept only4
Forecast only3
No public exploit3,168
198919911993199519971999200120032005200720092011
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2011-4101 | Medium | 2011-11-03 | Not applicable | No public exploit | The dissect_infiniband_common function in epan/dissectors/packet-infiniband.c in the Infiniband dissector in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed packet. |
| CVE-2011-4100 | Medium | 2011-11-03 | Not applicable | No public exploit | The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.3 does not initialize a certain variable, which allows remote attackers to cause a denial of service (application crash) via a malformed packet. |
| CVE-2011-4078 | Medium | 2011-11-03 | Not applicable | No public exploit | include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service (resource consumption and inbox outage), via a Subject header containing only a URL, a related issue to CVE-2011-3379. |
| CVE-2011-4005 | High | 2011-11-03 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in the Services Ready Platform Configuration Utility web interface on the Cisco Small Business SRP521W, SRP526W, and SRP527W with firmware before 1.1.24 and the Small Business SRP541W, SRP546W, and SRP547W with firmware before 1.2.1 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands, aka Bug ID CSCtr45124. |
| CVE-2011-3996 | Medium | 2011-11-03 | Not applicable | No public exploit | The LiveData Service in CSWorks before 2.0.4115.1 allows remote attackers to cause a denial of service (service crash) via crafted TCP packets. |
| CVE-2011-3995 | Medium | 2011-11-03 | Not applicable | No public exploit | Unspecified vulnerability in Twilight Frontier Touhou Hisouten 1.06 and earlier allows remote attackers to cause a denial of service (daemon crash) via unknown network traffic. |
| CVE-2011-3994 | Medium | 2011-11-03 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in SKYARC MTCMS before 5.252, and the MultiFileUploader 0.44 and earlier, DuplicateEntry 1.2 and earlier, MailPack 1.741 and earlier, and AutoTagging 0.08 and earlier plugins for Movable Type, allows remote attackers to hijack the authentication of arbitrary users for requests that modify data. |
| CVE-2011-3993 | Medium | 2011-11-03 | Not applicable | No public exploit | SKYARC MTCMS before 5.252, and the MultiFileUploader 0.44 and earlier, DuplicateEntry 1.2 and earlier, MailPack 1.741 and earlier, and AutoTagging 0.08 and earlier plugins for Movable Type, uses weak permissions, which allows remote authenticated users to modify files and settings via unspecified vectors. |
| CVE-2011-3992 | High | 2011-11-03 | Not applicable | No public exploit | Buffer overflow in the SSH server functionality on the D-Link DES-3800 with firmware before 4.50B052, DWL-2100AP with firmware before 2.50RC548, and DWL-3200AP with firmware before 2.55RC549 allows remote attackers to execute arbitrary code or cause a denial of service via unspecified vectors. |
| CVE-2011-3987 | Medium | 2011-11-03 | Not applicable | No public exploit | dtsoftbus01.sys in DAEMON Tools Lite before 4.41.3, Pro Standard before 4.41.0315, and Pro Advanced before 4.41.0315 allows local users to cause a denial of service (system crash) via an invalid DeviceIoControl request to \\.\dtsoftbusctl. |
| CVE-2011-3986 | Medium | 2011-11-03 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Pligg before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2011-3379 | High | 2011-11-03 | Not applicable | No public exploit | The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders. |
| CVE-2011-2676 | Medium | 2011-11-03 | Not applicable | No public exploit | The A-Form and A-Form bamboo before 1.3.6 and 2.x before 2.0.3, and A-Form PC and PC/Mobile before 3.1, plug-ins for Movable Type do not require administrative authentication, which allows remote authenticated users to modify data via unspecified vectors. |
| CVE-2011-4075 | High | 2011-11-02 | Not applicable | Exploited | The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011. |
| CVE-2011-4074 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via an _debug command. |
| CVE-2011-3320 | Medium | 2011-11-02 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Web Administrator component in GE Intelligent Platforms Proficy Historian 4.x and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. |
| CVE-2011-3167 | High | 2011-11-02 | Not applicable | Working exploit published | Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1210. |
| CVE-2011-3166 | High | 2011-11-02 | Not applicable | No public exploit | Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1209. |
| CVE-2011-3165 | High | 2011-11-02 | Not applicable | No public exploit | Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1208. |
| CVE-2011-1919 | High | 2011-11-02 | Not applicable | No public exploit | Multiple stack-based buffer overflows in GE Intelligent Platforms Proficy Applications before 4.4.1 SIM 101 and 5.x before 5.0 SIM 43 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted TCP message traffic to (1) PRProficyMgr.exe in Proficy Server Manager, (2) PRGateway.exe in Proficy Server Gateway, (3) PRRDS.exe in Proficy Remote Data Service, or (4) PRLicenseMgr.exe in Proficy Server License Manager. |
| CVE-2011-1918 | High | 2011-11-02 | Not applicable | No public exploit | Stack-based buffer overflow in the Data Archiver service in GE Intelligent Platforms Proficy Historian before 3.5 SIM 17 and 4.x before 4.0 SIM 12 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted TCP message traffic. |
| CVE-2010-5045 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in poll/default.asp in Smart ASP Survey allows remote attackers to inject arbitrary web script or HTML via the catid parameter. |
| CVE-2010-5044 | Medium | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in models/log.php in the Search Log (com_searchlog) component 3.1.0 for Joomla! allows remote authenticated users, with Public Back-end privileges, to execute arbitrary SQL commands via the search parameter in a log action to administrator/index.php. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5043 | Medium | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in the DJ-ArtGallery (com_djartgallery) component 0.9.1 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the cid[] parameter in an editItem action to administrator/index.php. |
| CVE-2010-5042 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the DJ-ArtGallery (com_djartgallery) component 0.9.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the cid[] parameter in an editItem action to administrator/index.php. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5041 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in the NP_Gallery plugin 0.94 for Nucleus allows remote attackers to execute arbitrary SQL commands via the id parameter in a plugin action. |
| CVE-2010-5040 | Medium | 2011-11-02 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in nucleus/plugins/NP_gallery.php in the NP_Gallery plugin 0.94 for Nucleus allows remote attackers to execute arbitrary PHP code via a URL in the DIR_NUCLEUS parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5039 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in control/admin_login.php in ScriptsFeed Recipes Listing Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the loginid parameter (aka the UserName field). NOTE: some of these details are obtained from third party information. |
| CVE-2010-5038 | High | 2011-11-02 | Not applicable | No public exploit | PHP remote file inclusion vulnerability in contact/contact.php in Groone's Simple Contact Form allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter. |
| CVE-2010-5037 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in article.php in SenseSites CommonSense CMS allows remote attackers to execute arbitrary SQL commands via the article_id parameter. |
| CVE-2010-5036 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in addsale.php in iScripts eSwap 2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter. |
| CVE-2010-5035 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in search.php in iScripts eSwap 2.0 allows remote attackers to inject arbitrary web script or HTML via the txtHomeSearch parameter (aka the search field). NOTE: some of these details are obtained from third party information. |
| CVE-2010-5034 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in viewhistorydetail.php in iScripts EasyBiller 1.1 allows remote attackers to execute arbitrary SQL commands via the planid parameter. |
| CVE-2010-5033 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in ProductList.cfm in Fusebox 5.5.1 allows remote attackers to execute arbitrary SQL commands via the CatDisplay parameter. |
| CVE-2010-5032 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in the BF Quiz (com_bfquiztrial) component before 1.3.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a bfquiztrial action to index.php. |
| CVE-2010-5031 | Medium | 2011-11-02 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in index.php in fileNice 1.1 allows remote attackers to inject arbitrary web script or HTML via the sstring parameter (aka the Search Box). NOTE: some of these details are obtained from third party information. |
| CVE-2010-5030 | Medium | 2011-11-02 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in index.php in Ecomat CMS 5.0 allows remote attackers to inject arbitrary web script or HTML via the lang parameter in a web action. |
| CVE-2010-5029 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in Ecomat CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the show parameter in a web action. |
| CVE-2010-5028 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in the JExtensions JE Job (com_jejob) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in an item action to index.php. |
| CVE-2010-5027 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 allows remote attackers to inject arbitrary web script or HTML via the type parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5026 | Medium | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5025 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in manage/main.php in CuteSITE CMS 1.2.3 and 1.5.0 allows remote attackers to inject arbitrary web script or HTML via the fld_path parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5024 | Medium | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in manage/add_user.php in CuteSITE CMS 1.2.3 and 1.5.0 allows remote authenticated users, with Read privileges, to execute arbitrary SQL commands via the user_id parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5023 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in index.asp in Digital Interchange Calendar 5.8.5 allows remote attackers to execute arbitrary SQL commands via the intDivisionID parameter. |
| CVE-2010-5022 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in the JExtensions JE Story Submit (com_jesubmit) component 1.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the view parameter to index.php. |
| CVE-2010-5021 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in view_group.asp in Digital Interchange Document Library 5.8.5 allows remote attackers to execute arbitrary SQL commands via the intGroupID parameter. |
| CVE-2010-5020 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in NetArt Media iBoutique 4.0 allows remote attackers to execute arbitrary SQL commands via the page parameter. |
| CVE-2010-5019 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in view_photo.php in 2daybiz Online Classified Script allows remote attackers to execute arbitrary SQL commands via the alb parameter. |
| CVE-2010-5018 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in products/classified/headersearch.php in 2daybiz Online Classified Script allows remote attackers to inject arbitrary web script or HTML via the sid parameter. |
| CVE-2010-5017 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in stats.php in Elite Gaming Ladders 3.0 allows remote attackers to execute arbitrary SQL commands via the account parameter. |
| CVE-2010-5016 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in matchdb.php in Elite Gaming Ladders 3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the match parameter. |
| CVE-2010-5015 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in view_photo.php in 2daybiz Network Community Script allows remote attackers to execute arbitrary SQL commands via the alb parameter. |
| CVE-2010-5014 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in standings.php in Elite Gaming Ladders 3.5 allows remote attackers to execute arbitrary SQL commands via the ladder[id] parameter. |
| CVE-2010-5013 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in listing_detail.asp in Mckenzie Creations Virtual Real Estate Manager (VRM) 3.5 allows remote attackers to execute arbitrary SQL commands via the Lid parameter. |
| CVE-2010-5012 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in new.php in DaLogin 2.2 and 2.2.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5011 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers to execute arbitrary SQL commands via the session parameter. |
| CVE-2010-5010 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers to inject arbitrary web script or HTML via the session parameter. |
| CVE-2010-5009 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in UTStats Beta 4 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter in a matchp action. |
| CVE-2010-5008 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in pages/contact_list_mail_form.asp in BrightSuite Groupware 5.4 allows remote attackers to execute arbitrary SQL commands via the ContactID parameter. |
| CVE-2010-5007 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in pages/match_report.php in UTStats Beta 4 and earlier allows remote attackers to inject arbitrary web script or HTML via the mid parameter. |
| CVE-2010-5006 | High | 2011-11-02 | Not applicable | No public exploit | SQL injection vulnerability in googlemap/index.php in EMO Realty Manager allows remote attackers to execute arbitrary SQL commands via the cat1 parameter. |
| CVE-2010-5005 | Medium | 2011-11-02 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in members/profileCommentsResponse.php in Rayzz Photoz allows remote attackers to inject arbitrary web script or HTML via the profileCommentTextArea parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2010-5004 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in searchvote.php in 2daybiz Polls (aka Advanced Poll) Script allows remote attackers to execute arbitrary SQL commands via the category parameter. |
| CVE-2010-5000 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in login/login_index.php in MCLogin System 1.1 and 1.2 allows remote attackers to execute arbitrary SQL commands via the myusername parameter (aka Username field) in a do_login action. NOTE: some of these details are obtained from third party information. |
| CVE-2010-4998 | High | 2011-11-02 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in ardeaCore/lib/core/ardeaInit.php in ardeaCore PHP Framework 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the pathForArdeaCore parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-4997 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in OlyKit Swoopo Clone 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter in a product action. |
| CVE-2010-4971 | Medium | 2011-11-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in VideoWhisper PHP 2 Way Video Chat component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the r parameter to index.php. |
| CVE-2011-4223 | High | 2011-11-01 | Not applicable | No public exploit | Unspecified vulnerability in Investintech.com Absolute PDF Server allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document. |
| CVE-2011-4222 | High | 2011-11-01 | Not applicable | Working exploit published | Unspecified vulnerability in Investintech.com Able2Extract and Able2Extract Server allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document. |
| CVE-2011-4221 | High | 2011-11-01 | Not applicable | Working exploit published | Unspecified vulnerability in Investintech.com Able2Doc and Able2Doc Professional allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document. |
| CVE-2011-4220 | High | 2011-11-01 | Not applicable | Working exploit published | Investintech.com SlimPDF Reader does not properly restrict the arguments to unspecified function calls, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document. |
| CVE-2011-4219 | High | 2011-11-01 | Not applicable | No public exploit | Investintech.com SlimPDF Reader does not prevent faulting-address data from affecting branch selection, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document. |
| CVE-2011-4218 | High | 2011-11-01 | Not applicable | No public exploit | Investintech.com SlimPDF Reader does not prevent faulting-instruction data from affecting write operations, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document. |
| CVE-2011-4217 | High | 2011-11-01 | Not applicable | No public exploit | Investintech.com SlimPDF Reader does not properly restrict read operations during block data moves, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document. |
| CVE-2011-4216 | High | 2011-11-01 | Not applicable | No public exploit | Investintech.com SlimPDF Reader does not properly restrict write operations, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document. |
| CVE-2011-4215 | High | 2011-11-01 | Not applicable | No public exploit | SQL injection vulnerability in lib/ooz_access.php in OneOrZero Action & Information Management System (AIMS) 2.7.0 allows remote attackers to execute arbitrary SQL commands via the cookieName variable. |
| CVE-2011-4214 | High | 2011-11-01 | Not applicable | No public exploit | OneOrZero Action & Information Management System (AIMS) 2.7.0 allows remote attackers to bypass authentication and obtain administrator privileges via a crafted oozimsrememberme cookie. |
| CVE-2011-4064 | Medium | 2011-11-01 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the setup interface in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to inject arbitrary web script or HTML via a crafted value. |
| CVE-2011-1915 | High | 2011-11-01 | Not applicable | No public exploit | SQL injection vulnerability in eClient 7.3.2.3 in Enspire Distribution Management Solution 7.3.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2011-0941 | High | 2011-11-01 | Outside Waratek scope | No public exploit | Memory leak in Cisco Unified Communications Manager (CUCM) 6.x before 6.1(5)su2, 7.x before 7.1(5b)su3, 8.x before 8.0(3a)su1, and 8.5 before 8.5(1), and Cisco IOS 12.4 and 15.1, allows remote attackers to cause a denial of service (memory consumption and process failure or device reload) via a malformed SIP message, aka Bug IDs CSCti75128 and CSCtj09179. |
| CVE-2010-5003 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in the AutarTimonial (com_autartimonial) component 1.0.8 for Joomla! allows remote attackers to execute arbitrary SQL commands via the limit parameter in an autartimonial action to index.php. NOTE: some of these details are obtained from third party information. |
| CVE-2010-5002 | Medium | 2011-11-01 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in modules/slideshowmodule/slideshow.js.php in Exponent CMS 0.97.0 allows remote attackers to inject arbitrary web script or HTML via the u parameter. |
| CVE-2010-5001 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in view.php in esoftpro Online Contact Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-4999 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in esoftpro Online Photo Pro 2.0 allows remote attackers to execute arbitrary SQL commands via the section parameter. |
| CVE-2010-4996 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in ogp_show.php in esoftpro Online Guestbook Pro 5.1 allows remote attackers to execute arbitrary SQL commands via the search parameter. |
| CVE-2010-4995 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in the NeoRecruit (com_neorecruit) component 1.6.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in an offer_view action to index.php, a different vector than CVE-2007-4506. |
| CVE-2010-4994 | High | 2011-11-01 | Not applicable | No public exploit | SQL injection vulnerability in the Jobs Pro component 1.6.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the detailed_results parameter to search_jobs.html. |
| CVE-2010-4993 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in the eventcal (com_eventcal) component 1.6.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php. |
| CVE-2010-4992 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in the Payments Plus component 2.1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the type parameter to add.html. |
| CVE-2010-4991 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in the NinjaMonials (com_ninjamonials) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a display action to index.php. |
| CVE-2010-4990 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in the Front-edit Address Book (com_addressbook) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a contact action to index.php. |
| CVE-2010-4989 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in main.asp in Ziggurat Farsi CMS allows remote attackers to execute arbitrary SQL commands via the grp parameter. |
| CVE-2010-4988 | High | 2011-11-01 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in mod_chatting/themes/default/header.php in Family Connections Who is Chatting 2.2.3 allows remote attackers to execute arbitrary PHP code via a URL in the TMPL[path] parameter. |
| CVE-2010-4987 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in default.asp in KMSoft Guestbook (aka GBook) allows remote attackers to execute arbitrary SQL commands via the p parameter. |
| CVE-2010-4986 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in detail.php in Simple Document Management System (SDMS) allows remote attackers to execute arbitrary SQL commands via the doc_id parameter. |
| CVE-2010-4985 | Medium | 2011-11-01 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in notes.php in My Kazaam Notes Management System allows remote attackers to inject arbitrary web script or HTML via vectors involving the "Enter Reference Number Below" text box. |
| CVE-2010-4984 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in notes.php in My Kazaam Notes Management System allows remote attackers to execute arbitrary SQL commands via vectors involving the "Enter Reference Number Below" text box. |
| CVE-2010-4983 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in profile.php in iScripts CyberMatch 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-4982 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in address_book/contacts.php in My Kazaam Address & Contact Organizer allows remote attackers to execute arbitrary SQL commands via the var1 parameter. |
| CVE-2010-4981 | High | 2011-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in trackads.php in YourFreeWorld Banner Management allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information. |