Overview 16,603 matches · 103 in Waratek scope · 20 protected · 259 exploited · 40 CISA KEV · 782 EPSS ≥ 0.5
16,603matches
103in Waratek scope0.6%
20protected0.1%
259exploited1.6%
40CISA KEV0.2%
782EPSS ≥ 0.54.7%
Protected by Waratek
20
0.1%
Rule in development
0
0.0%
Mitigation candidate
83
0.5%
No exploit published
0
0.0%
Outside Waratek scope
71
0.4%
Not applicable
16,400
98.8%
Withdrawn CVE
29
0.2%
blocked by ARMR today
20
0.1%
partly blocked
0
0.0%
not blocked
16,583
99.9%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
259
1.6%
Working exploit published
16,332
98.4%
Proof of concept only
12
0.1%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 2,638 / year
19881
Not applicable1
High1
not blocked1
Working exploit published1
19890
19901
Not applicable1
Medium1
not blocked1
Working exploit published1
19912
Not applicable2
High2
not blocked2
Working exploit published2
19920
19930
19946
Not applicable6
High3
Medium2
Low1
not blocked6
Working exploit published6
19955
Not applicable5
Critical1
High2
Medium2
not blocked5
Working exploit published5
199618
Not applicable17
Withdrawn CVE1
High12
Medium5
Unknown1
not blocked18
Working exploit published18
199775
Not applicable75
High53
Medium18
Low4
not blocked75
Exploited2
Working exploit published73
199851
Not applicable51
Critical1
High34
Medium11
Low5
not blocked51
Exploited1
Working exploit published50
1999283
Outside Waratek scope1
Not applicable281
Withdrawn CVE1
Critical2
High133
Medium119
Low28
Unknown1
not blocked283
Exploited1
Working exploit published282
2000431
Mitigation candidate6
Outside Waratek scope1
Not applicable424
Critical1
High200
Medium196
Low34
not blocked431
Exploited4
Working exploit published427
2001490
Mitigation candidate2
Outside Waratek scope4
Not applicable484
Critical4
High229
Medium219
Low38
not blocked490
Exploited10
Working exploit published480
2002551
Mitigation candidate8
Outside Waratek scope4
Not applicable537
Withdrawn CVE2
Critical3
High282
Medium246
Low18
Unknown2
not blocked551
Exploited6
Working exploit published545
2003508
Protected by Waratek1
Mitigation candidate7
Outside Waratek scope2
Not applicable497
Withdrawn CVE1
Critical3
High245
Medium243
Low16
Unknown1
blocked by ARMR today1
not blocked507
Exploited9
Working exploit published499
2004768
Mitigation candidate1
Outside Waratek scope1
Not applicable766
Critical4
High311
Medium417
Low36
not blocked768
Exploited13
Working exploit published755
20051,361
Protected by Waratek1
Mitigation candidate4
Outside Waratek scope4
Not applicable1,347
Withdrawn CVE5
Critical5
High669
Medium628
Low54
Unknown5
blocked by ARMR today1
not blocked1,360
Exploited20
Working exploit published1,341
20062,462
Protected by Waratek1
Mitigation candidate4
Outside Waratek scope7
Not applicable2,447
Withdrawn CVE3
Critical4
High1,214
Medium1,142
Low99
Unknown3
blocked by ARMR today1
not blocked2,461
Exploited21
Working exploit published2,440
Proof of concept only1
20072,528
Protected by Waratek1
Mitigation candidate10
Outside Waratek scope12
Not applicable2,502
Withdrawn CVE3
Critical8
High1,430
Medium1,057
Low30
Unknown3
blocked by ARMR today1
not blocked2,527
Exploited31
Working exploit published2,495
Proof of concept only2
20082,546
Protected by Waratek4
Mitigation candidate9
Outside Waratek scope6
Not applicable2,522
Withdrawn CVE5
Critical6
High1,514
Medium991
Low30
Unknown5
blocked by ARMR today4
not blocked2,542
Exploited25
Working exploit published2,518
Proof of concept only3
20092,638
Protected by Waratek4
Mitigation candidate13
Outside Waratek scope9
Not applicable2,606
Withdrawn CVE6
Critical7
High1,457
Medium1,135
Low33
Unknown6
blocked by ARMR today4
not blocked2,634
Exploited46
Working exploit published2,591
Proof of concept only1
20101,367
Protected by Waratek5
Mitigation candidate11
Outside Waratek scope13
Not applicable1,336
Withdrawn CVE2
Critical10
High770
Medium557
Low28
Unknown2
blocked by ARMR today5
not blocked1,362
Exploited53
Working exploit published1,313
Proof of concept only1
2011511
Protected by Waratek3
Mitigation candidate8
Outside Waratek scope7
Not applicable493
Critical1
High275
Medium224
Low11
blocked by ARMR today3
not blocked508
Exploited17
Working exploit published490
Proof of concept only4
198919911993199519971999200120032005200720092011
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2011-3872 | Low | 2011-10-27 | Not applicable | Proof of concept only | Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability." |
| CVE-2011-3315 | High | 2011-10-27 | Outside Waratek scope | Exploited | Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified Contact Center Express (aka Unified CCX or UCCX) and Cisco Unified IP Interactive Voice Response (Unified IP-IVR) before 6.0(1)SR1ES8, 7.0(x) before 7.0(2)ES1, 8.0(x) through 8.0(2)SU3, and 8.5(x) before 8.5(1)SU2, allows remote attackers to read arbitrary files via a crafted URL, aka Bug IDs CSCth09343 and CSCts44049. |
| CVE-2011-4026 | High | 2011-10-21 | Not applicable | Working exploit published | SQL injection vulnerability in thanks.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2011-4024 | Medium | 2011-10-21 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in ocsinventory in OCS Inventory NG 2.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2011-3340 | High | 2011-10-21 | Not applicable | Working exploit published | SQL injection vulnerability in ATCOM Netvolution 2.5.8 ASP allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header. |
| CVE-2010-4967 | High | 2011-10-21 | Not applicable | Working exploit published | SQL injection vulnerability in default.asp in ATCOM Netvolution 2.5.6 allows remote attackers to execute arbitrary SQL commands via the artID parameter. |
| CVE-2009-5103 | Medium | 2011-10-21 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in ATCOM Netvolution 1.0 ASP allows remote attackers to inject arbitrary web script or HTML via the email variable. |
| CVE-2009-5102 | High | 2011-10-21 | Not applicable | Working exploit published | SQL injection vulnerability in default.asp in ATCOM Netvolution 1.0 ASP allows remote attackers to execute arbitrary SQL commands via the bpe_nid parameter. |
| CVE-2011-3556 | High | 2011-10-19 | Protected by Waratek | Working exploit published | Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557. |
| CVE-2011-3544 | Critical | 2011-10-19 | Outside Waratek scope | Exploited | Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting. |
| CVE-2011-4062 | High | 2011-10-18 | Not applicable | Working exploit published | Buffer overflow in the kernel in FreeBSD 7.3 through 9.0-RC1 allows local users to cause a denial of service (panic) or possibly gain privileges via a bind system call with a long pathname for a UNIX socket. |
| CVE-2011-3230 | Medium | 2011-10-14 | Not applicable | Working exploit published | Apple Safari before 5.1.1 on Mac OS X does not enforce an intended policy for file: URLs, which allows remote attackers to execute arbitrary code via a crafted web site. |
| CVE-2011-2007 | Medium | 2011-10-12 | Not applicable | Working exploit published | Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009, and 2010 allows remote attackers to cause a denial of service (SNA Server service outage) via crafted TCP or UDP traffic, aka "Endless Loop DoS in snabase.exe Vulnerability." |
| CVE-2011-2005 | High | 2011-10-12 | Not applicable | Exploited | afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability." |
| CVE-2011-2003 | High | 2011-10-12 | Not applicable | Working exploit published | Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted .fon file, aka "Font Library File Buffer Overrun Vulnerability." |
| CVE-2011-1999 | High | 2011-10-12 | Not applicable | Working exploit published | Microsoft Internet Explorer 8 does not properly allocate and access memory, which allows remote attackers to execute arbitrary code via vectors involving a "dereferenced memory address," aka "Select Element Remote Code Execution Vulnerability." |
| CVE-2011-1996 | High | 2011-10-12 | Not applicable | Working exploit published | Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Option Element Remote Code Execution Vulnerability." |
| CVE-2011-1985 | High | 2011-10-12 | Not applicable | Working exploit published | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate user-mode input, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a crafted application, aka "Win32k Null Pointer De-reference Vulnerability." |
| CVE-2011-3587 | High | 2011-10-10 | Not applicable | Exploited | Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules. |
| CVE-2011-2189 | High | 2011-10-10 | Not applicable | Working exploit published | net/core/net_namespace.c in the Linux kernel 2.6.32 and earlier does not properly handle a high rate of creation and cleanup of network namespaces, which makes it easier for remote attackers to cause a denial of service (memory consumption) via requests to a daemon that requires a separate namespace per connection, as demonstrated by vsftpd. |
| CVE-2010-4963 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in folder/list in Hulihan BXR 0.6.8 allows remote attackers to execute arbitrary SQL commands via the order_by parameter. |
| CVE-2010-4959 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in the login feature in Pre Projects Pre Podcast Portal allows remote attackers to execute arbitrary SQL commands via the password parameter. |
| CVE-2010-4955 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in board/board.php in APBoard Developers APBoard 2.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2006-3078. |
| CVE-2010-4954 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in product_reviews_info.php in xt:Commerce Gambio 2008 allows remote attackers to execute arbitrary SQL commands via the products_id parameter. |
| CVE-2010-4949 | Medium | 2011-10-09 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the (1) FreiChat component before 2.1.2 for Joomla! and the (2) FreiChatPure component before 1.2.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML by entering it in an unspecified window. |
| CVE-2010-4948 | High | 2011-10-09 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in libs/adodb/adodb.inc.php in PHP Free Photo Gallery script allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. |
| CVE-2010-4947 | Medium | 2011-10-09 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in advanced_search_result.php in ALLPC 2.5 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter. |
| CVE-2010-4946 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in product_info.php in ALLPC 2.5 allows remote attackers to execute arbitrary SQL commands via the products_id parameter. |
| CVE-2010-4945 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in the CamelcityDB (com_camelcitydb2) component 2.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. |
| CVE-2010-4944 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in the Elite Experts (com_elite_experts) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a showExpertProfileDetailed action to index.php. |
| CVE-2010-4943 | High | 2011-10-09 | Not applicable | Working exploit published | Multiple PHP remote file inclusion vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to execute arbitrary PHP code via a URL in the class_path parameter to (1) file.php or (2) com_del.php. |
| CVE-2010-4942 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in location.php in the eCal module in E-Xoopport Samsara 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the lid parameter. |
| CVE-2010-4941 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in the Teams (com_teams) component 1_1028_100809_1711 for Joomla! allows remote attackers to execute arbitrary SQL commands via the PlayerID parameter in a player save action to index.php. |
| CVE-2010-4940 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in WAnewsletter 2.1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-4939 | High | 2011-10-09 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in index.php in MailForm 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the theme parameter. |
| CVE-2010-4938 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in the Weblinks (com_weblinks) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a categories action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2010-4937 | High | 2011-10-09 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in the Amblog (com_amblog) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) articleid or (2) catid parameter to index.php. |
| CVE-2010-4935 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in poll.php in Entrans 0.3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the sid parameter. |
| CVE-2010-4934 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in video.php in Get Tube 4.51 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-4933 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in filemgmt/singlefile.php in Geeklog 1.3.8 allows remote attackers to execute arbitrary SQL commands via the lid parameter. |
| CVE-2010-4931 | High | 2011-10-09 | Not applicable | Working exploit published | Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder_level parameter. NOTE: this issue has been disputed by a reliable third party |
| CVE-2010-4930 | Medium | 2011-10-09 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in index.php in @mail Webmail before 6.2.0 allows remote attackers to inject arbitrary web script or HTML via the MailType parameter in a mail/auth/processlogin action. |
| CVE-2010-4929 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in the Joostina (com_ezautos) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the firstCode parameter in a helpers action to index.php. |
| CVE-2010-4928 | Medium | 2011-10-09 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the Restaurant Guide (com_restaurantguide) component 1.0.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML by placing it after a > (greater than) character. |
| CVE-2010-4927 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in the Restaurant Guide (com_restaurantguide) component 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a country action to index.php. |
| CVE-2010-4926 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in the TimeTrack (com_timetrack) component 1.2.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the ct_id parameter in a timetrack action to index.php. |
| CVE-2010-4925 | High | 2011-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in clic.php in the Partenaires module 1.5 for Nuked-Klan allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-4924 | High | 2011-10-09 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in logic/controller.class.php in clearBudget 0.9.8 allows remote attackers to execute arbitrary PHP code via a URL in the actionPath parameter. NOTE: this issue has been disputed by a reliable third party |
| CVE-2010-4922 | High | 2011-10-09 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in Allinta CMS 22.07.2010 allow remote attackers to execute arbitrary SQL commands via the i parameter in an edit action to (1) contentAE.asp or (2) templatesAE.asp. |
| CVE-2010-4921 | High | 2011-10-08 | Not applicable | Working exploit published | SQL injection vulnerability in inc_pollingboothmanager.asp in DMXReady Polling Booth Manager allows remote attackers to execute arbitrary SQL commands via the QuestionID parameter in a results action. |
| CVE-2010-4920 | High | 2011-10-08 | Not applicable | Working exploit published | SQL injection vulnerability in detail.asp in Micronetsoft Rental Property Management Website 1.0 allows remote attackers to execute arbitrary SQL commands via the ad_ID parameter. |
| CVE-2010-4919 | High | 2011-10-08 | Not applicable | Working exploit published | SQL injection vulnerability in detail.asp in Micronetsoft RV Dealer Website 1.0 allows remote attackers to execute arbitrary SQL commands via the vehicletypeID parameter. |
| CVE-2010-4918 | High | 2011-10-08 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in iJoomla Magazine (com_magazine) component 3.0.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the config parameter to magazine.functions.php. |
| CVE-2010-4917 | High | 2011-10-08 | Not applicable | Working exploit published | SQL injection vulnerability in sources/search.php in A-Blog 2.0 allows remote attackers to execute arbitrary SQL commands via the words parameter. |
| CVE-2010-4916 | High | 2011-10-08 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in index.cfm in ColdGen ColdUserGroup 1.06 allow remote attackers to execute arbitrary SQL commands via the (1) ArticleID or (2) LibraryID parameter. |
| CVE-2010-4915 | High | 2011-10-08 | Not applicable | Working exploit published | SQL injection vulnerability in index.cfm in ColdGen ColdBookmarks 1.22 allows remote attackers to execute arbitrary SQL commands via the BookmarkID parameter in an EditBookmark action. |
| CVE-2010-4914 | High | 2011-10-08 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in tools/phpmailer/class.phpmailer.php in PHP Classifieds 7.3 allows remote attackers to execute arbitrary PHP code via a URL in the lang_path parameter. |
| CVE-2010-4913 | Medium | 2011-10-08 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the search feature in ColdGen ColdUserGroup 1.06 allows remote attackers to inject arbitrary web script or HTML via the Keywords parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-4912 | High | 2011-10-08 | Not applicable | Working exploit published | SQL injection vulnerability in shop.php in UCenter Home 2.0 allows remote attackers to execute arbitrary SQL commands via the shopid parameter in a view action. |
| CVE-2010-4911 | High | 2011-10-08 | Not applicable | Working exploit published | SQL injection vulnerability in classi/detail.php in PHP Classifieds Ads allows remote attackers to execute arbitrary SQL commands via the sid parameter. |
| CVE-2010-4910 | High | 2011-10-08 | Not applicable | Working exploit published | SQL injection vulnerability in index.cfm in ColdGen ColdCalendar 2.06 allows remote attackers to execute arbitrary SQL commands via the EventID parameter in a ViewEventDetails action. |
| CVE-2010-4909 | Medium | 2011-10-08 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in PaysiteReviewCMS 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to search.php or the (2) image parameter to image.php. |
| CVE-2010-4907 | Medium | 2011-10-08 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in zp-core/admin.php in Zenphoto 1.3 allows remote attackers to inject arbitrary web script or HTML via the user parameter. NOTE: the from parameter is already covered by CVE-2009-4562. |
| CVE-2010-4906 | High | 2011-10-08 | Not applicable | Working exploit published | SQL injection vulnerability in zp-core/full-image.php in Zenphoto 1.3 and 1.3.1.2 allows remote attackers to execute arbitrary SQL commands via the a parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-4905 | High | 2011-10-08 | Not applicable | Working exploit published | SQL injection vulnerability in article_details.php in Softbiz Article Directory Script allows remote attackers to execute arbitrary SQL commands via the sbiz_id parameter. |
| CVE-2010-4904 | High | 2011-10-08 | Not applicable | Working exploit published | SQL injection vulnerability in the Aardvertiser (com_aardvertiser) component 2.1 and 2.1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat_name parameter in a view action to index.php. NOTE: some of these details are obtained from third party information. |
| CVE-2010-4902 | High | 2011-10-08 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in the Clantools (com_clantools) component 1.2.3 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) squad or (2) showgame parameter to index.php. |
| CVE-2010-4901 | Medium | 2011-10-08 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in char_map.php in MySource Matrix 3.28.3 allow remote attackers to inject arbitrary web script or HTML via the (1) height or (2) width parameter. |
| CVE-2010-4899 | High | 2011-10-08 | Not applicable | Working exploit published | SQL injection vulnerability in c.php in CMS WebManager-Pro before 8.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-4898 | High | 2011-10-08 | Not applicable | Working exploit published | SQL injection vulnerability in the Gantry (com_gantry) component 3.0.10 for Joomla! allows remote attackers to execute arbitrary SQL commands via the moduleid parameter to index.php. |
| CVE-2010-4895 | Medium | 2011-10-08 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in core/showsite.php in chillyCMS 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the username field). NOTE: some of these details are obtained from third party information. |
| CVE-2010-4894 | High | 2011-10-08 | Not applicable | Working exploit published | SQL injection vulnerability in core/showsite.php in chillyCMS 1.1.3 allows remote attackers to execute arbitrary SQL commands via the name parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-4893 | Medium | 2011-10-08 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in foodvendors.php in FestOS 2.3b allows remote attackers to inject arbitrary web script or HTML via the category parameter in a details action. |
| CVE-2010-4884 | High | 2011-10-07 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in guestbook/gbook.php in Gaestebuch 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the script_pfad parameter. |
| CVE-2010-4883 | Low | 2011-10-07 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter. |
| CVE-2010-4882 | Medium | 2011-10-07 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in autocms.php in Auto CMS 1.6 allows remote attackers to inject arbitrary web script or HTML via the sitetitle parameter. |
| CVE-2010-4879 | High | 2011-10-07 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the input_file parameter. |
| CVE-2010-4878 | High | 2011-10-07 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in formmailer.php in Kontakt Formular 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the script_pfad parameter. |
| CVE-2010-4877 | Medium | 2011-10-07 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in index.php in OneCMS 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the view parameter. |
| CVE-2010-4876 | High | 2011-10-07 | Not applicable | Working exploit published | SQL injection vulnerability in viewpost.php in mBlogger 1.0.04 allows remote attackers to execute arbitrary SQL commands via the postID parameter. |
| CVE-2010-4875 | Medium | 2011-10-07 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gid parameter. |
| CVE-2010-4874 | Medium | 2011-10-07 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in users.php in NinkoBB 1.3 RC5 allow remote attackers to inject arbitrary web script or HTML via the (1) first_name, (2) last_name, (3) msn, or (4) aim parameter. |
| CVE-2010-4873 | Medium | 2011-10-07 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in confirm.php in WeBid 0.8.5 P1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. |
| CVE-2010-4872 | High | 2011-10-07 | Not applicable | Working exploit published | SQL injection vulnerability in newsroom.asp in ASPilot Pilot Cart 7.3 allows remote attackers to execute arbitrary SQL commands via the specific parameter. |
| CVE-2010-4870 | High | 2011-10-07 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands via the gender parameter. |
| CVE-2011-3368 | Medium | 2011-10-05 | Not applicable | Working exploit published | The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character. |
| CVE-2011-1159 | Low | 2011-10-05 | Not applicable | Working exploit published | acpid.c in acpid before 2.0.9 does not properly handle a situation in which a process has connected to acpid.socket but is not reading any data, which allows local users to cause a denial of service (daemon hang) via a crafted application that performs a connect system call but no read system calls. |
| CVE-2010-4869 | High | 2011-10-05 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in DBHcms 1.1.4 allows remote attackers to execute arbitrary SQL commands via the editmenu parameter. |
| CVE-2010-4868 | Medium | 2011-10-05 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in search.php3 (aka search.php) in W-Agora 4.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the bn parameter. |
| CVE-2010-4867 | High | 2011-10-05 | Not applicable | Working exploit published | Directory traversal vulnerability in search.php3 (aka search.php) in W-Agora 4.2.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the bn parameter. |
| CVE-2010-4866 | High | 2011-10-05 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in Chipmunk Board 1.3 allows remote attackers to execute arbitrary SQL commands via the forumID parameter. |
| CVE-2010-4865 | High | 2011-10-05 | Not applicable | Working exploit published | SQL injection vulnerability in the JE Guestbook (com_jeguestbook) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the d_itemid parameter in an item_detail action to index.php. |
| CVE-2010-4864 | High | 2011-10-05 | Not applicable | Working exploit published | SQL injection vulnerability in the Club Manager (com_clubmanager) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cm_id parameter in an equip presenta action to index.php. |
| CVE-2010-4863 | Medium | 2011-10-05 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in admin/changedata.php in GetSimple CMS 2.01 allows remote attackers to inject arbitrary web script or HTML via the post-title parameter. |
| CVE-2010-4862 | High | 2011-10-05 | Not applicable | Working exploit published | SQL injection vulnerability in the JExtensions JE Directory (com_jedirectory) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in an item action to index.php. |
| CVE-2010-4861 | High | 2011-10-05 | Not applicable | Working exploit published | SQL injection vulnerability in asearch.php in webSPELL 4.2.1 allows remote attackers to execute arbitrary SQL commands via the search parameter. |
| CVE-2010-4860 | High | 2011-10-05 | Not applicable | Working exploit published | SQL injection vulnerability in product_desc.php in MyPhpAuction 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-4858 | Medium | 2011-10-05 | Not applicable | Working exploit published | Directory traversal vulnerability in team.rc5-72.php in DNET Live-Stats 0.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the showlang parameter. |
| CVE-2010-4857 | High | 2011-10-05 | Not applicable | Working exploit published | SQL injection vulnerability in click.php in CAG CMS 0.2 Beta allows remote attackers to execute arbitrary SQL commands via the itemid parameter. |
| CVE-2010-4856 | High | 2011-10-05 | Not applicable | Working exploit published | SQL injection vulnerability in arsiv.asp in xWeblog 2.2 allows remote attackers to execute arbitrary SQL commands via the tarih parameter. |