VYPR

CVEs

344,996 total · page 6222 of 6,900

AllCriticalHighKEV
  • CVE-2008-5674Dec 19, 2008
    Darkwet
    Webcam Xp
    risk 0.03cvss —epss 0.05

    Multiple array index errors in the HTTP server in Darkwet Network webcamXP 3.72.440.0 and earlier and beta 4.05.280 and earlier allow remote attackers to cause a denial of service (device crash) and read portions of memory via (1) an invalid camnum parameter to the pocketpc…

  • CVE-2008-5673Dec 19, 2008
    Phparanoid
    Phparanoid
    risk 0.00cvss —epss 0.01

    PHParanoid before 0.4 does not properly restrict access to the members area by unauthenticated users, which has unknown impact and remote attack vectors.

  • CVE-2008-5672Dec 19, 2008
    Phparanoid
    Phparanoid
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in PHParanoid before 0.4 allow remote attackers to hijack the authentication of arbitrary users for requests that use (1) admin.php or (2) private messages.

  • CVE-2008-5671Dec 19, 2008
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in Joomla! 1.0.11 through 1.0.14, when RG_EMULATION is enabled in configuration.php, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2008-5670Dec 19, 2008
    Textpattern
    Textpattern
    risk 0.00cvss —epss 0.01

    Textpattern (aka Txp CMS) 4.0.5 does not ask for the old password during a password reset, which makes it easier for remote attackers to change a password after hijacking a session.

  • CVE-2008-5669Dec 19, 2008
    Textpattern
    Textpattern
    risk 0.00cvss —epss 0.02

    index.php in the comments preview section in Textpattern (aka Txp CMS) 4.0.5 allows remote attackers to cause a denial of service via a long message parameter.

  • CVE-2008-5668Dec 19, 2008
    Textpattern
    Textpattern
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Textpattern (aka Txp CMS) 4.0.5 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to setup/index.php or (2) the name parameter to index.php in the comments preview section.

  • CVE-2008-5667Dec 19, 2008
    Virusblokada
    Vba32 Antivirus
    risk 0.04cvss —epss 0.06

    The scanning engine in VirusBlokAda VBA32 Personal Antivirus 3.12.8.x allows remote attackers to cause a denial of service (memory corruption and application crash) via a malformed RAR archive.

  • CVE-2008-5666Dec 19, 2008
    WinFTP
    FTP Server
    risk 0.05cvss —epss 0.21

    WinFTP FTP Server 2.3.0, when passive (aka PASV) mode is used, allows remote authenticated users to cause a denial of service via a sequence of FTP sessions that include an invalid "NLST -1" command.

  • CVE-2008-5665Dec 19, 2008
    XOOPS
    Xoops
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the xhresim module in XOOPS allows remote attackers to execute arbitrary SQL commands via the no parameter.

  • CVE-2008-5664Dec 19, 2008
    Realtek
    Realtek Media Player
    risk 0.06cvss —epss 0.36

    Stack-based buffer overflow in Realtek Media Player (aka Realtek Sound Manager, RtlRack, or rtlrack.exe) 1.15.0.0 allows remote attackers to execute arbitrary code via a crafted playlist (PLA) file.

  • CVE-2008-5663Dec 19, 2008
    Kusaba
    Kusaba
    risk 0.04cvss —epss 0.06

    Multiple unrestricted file upload vulnerabilities in Kusaba 1.0.4 and earlier allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) load_receiver.php or (2) a shipainter action to paint_save.php, then accessing the…

  • CVE-2008-5499Dec 18, 2008
    Adobe Inc.
    Flash Player For Linux
    risk 0.09cvss —epss 0.79

    Unspecified vulnerability in Adobe Flash Player for Linux 10.0.12.36, and 9.0.151.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file.

  • CVE-2008-5513Dec 17, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the session-restore feature in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19 allows remote attackers to bypass the same origin policy, inject content into documents associated with other domains, and conduct cross-site scripting (XSS)…

  • CVE-2008-5512Dec 17, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to run arbitrary JavaScript with chrome privileges via unknown vectors in which "page content…

  • CVE-2008-5511Dec 17, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy and conduct cross-site scripting (XSS) attacks via an XBL binding to an "unloaded document."

  • CVE-2008-5510Dec 17, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The CSS parser in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 ignores the '\0' escaped null character, which might allow remote attackers to bypass protection mechanisms such as sanitization routines.

  • CVE-2008-5508Dec 17, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote attackers to misrepresent URLs and simplify phishing…

  • CVE-2008-5507Dec 17, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to bypass the same origin policy and access portions of data from another domain via a JavaScript URL that redirects to the target…

  • CVE-2008-5506Dec 17, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy by causing the browser to issue an XMLHttpRequest to an attacker-controlled resource that uses a…

  • CVE-2008-5505Dec 17, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.x before 3.0.5 allows remote attackers to bypass intended privacy restrictions by using the persist attribute in an XUL element to create and access data entities that are similar to cookies.

  • CVE-2008-5504Dec 17, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Mozilla Firefox 2.x before 2.0.0.19 allows remote attackers to run arbitrary JavaScript with chrome privileges via vectors related to the feed preview, a different vulnerability than CVE-2008-3836.

  • CVE-2008-5503Dec 17, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The loadBindingDocument function in Mozilla Firefox 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not perform any security checks related to the same-domain policy, which allows remote attackers to read or access data from other…

  • CVE-2008-5502Dec 17, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service (crash) via vectors that trigger memory corruption, related to the GetXMLEntity and FastAppendChar…

  • CVE-2008-5501Dec 17, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service via vectors that trigger an assertion failure.

  • CVE-2008-5500Dec 17, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The layout engine in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via vectors related to (1) a…

  • CVE-2008-5662Dec 17, 2008
    Sun Corporation
    Java Wireless Toolkit For Cldc
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in Sun Java Wireless Toolkit (WTK) for CLDC 2.5.2 and earlier allow downloaded programs to execute arbitrary code via unknown vectors.

  • CVE-2008-5661Dec 17, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.02

    The IPv4 Forwarding feature in Sun Solaris 10 and OpenSolaris snv_47 through snv_82, with certain patches installed, allows remote attackers to cause a denial of service (panic) via unknown vectors that trigger a NULL pointer dereference.

  • CVE-2008-5660Dec 17, 2008
    Vinagre
    Vinagre
    risk 0.04cvss —epss 0.09

    Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might allow remote attackers to execute arbitrary code via format string specifiers in a crafted URI or VNC server response.

  • CVE-2008-5659Dec 17, 2008
    GNU
    Classpath
    risk 0.03cvss —epss 0.03

    The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as…

  • CVE-2008-5658Dec 17, 2008
    PHP
    PHP
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier allows context-dependent attackers to write arbitrary files via a ZIP file with a file whose name contains .. (dot dot) sequences.

  • CVE-2008-5657Dec 17, 2008
    Quassel Irc
    Quassel Core
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in Quassel Core before 0.3.0.3 allows remote attackers to spoof IRC messages as other users via a crafted CTCP message.

  • CVE-2008-5656Dec 17, 2008
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the frontend plugin for the felogin system extension in TYPO3 4.2.0, 4.2.1 and 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2008-5655Dec 17, 2008
    Myiosoft
    Easybookmarker
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MyioSoft EasyBookMarker 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) delete_folder and (2) delete_link parameters to unspecified vectors, possibly to (a) plugins/bookmarker/bookmarker_backend.php or (b)…

  • CVE-2008-5654Dec 17, 2008
    Myiosoft
    Easycalendar
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyCalendar 4.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username parameter, a different vector than CVE-2008-1344. NOTE: some of…

  • CVE-2008-5653Dec 17, 2008
    Myiosoft
    Ajaxportal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username parameter. NOTE: some of these details are obtained from third…

  • CVE-2008-5652Dec 17, 2008
    Myiosoft
    Easybookmarker
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyBookMarker 4.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username parameter. NOTE: some of these details are obtained from third…

  • CVE-2008-5651Dec 17, 2008
    Myiosoft
    Easybookmarker
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in plugins/bookmarker/bookmarker_backend.php in MyioSoft EasyBookMarker 4.0 allows remote attackers to execute arbitrary SQL commands via the Parent parameter.

  • CVE-2008-5650Dec 17, 2008
    Alstrasoft
    Webhost Directory
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the login directory in AlstraSoft Web Host Directory allows remote attackers to execute arbitrary SQL commands via the pwd parameter.

  • CVE-2008-5649Dec 17, 2008
    Alstrasoft
    Article Manager Pro
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in admin/admin.php in AlstraSoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2008-5648Dec 17, 2008
    Deltascripts
    PHP Shop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/login.php in DeltaScripts PHP Shop 1.0 allows remote attackers to execute arbitrary SQL commands via the admin_username parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2008-5647Dec 17, 2008
    Trac
    Trac
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the HTML sanitizer filter in Trac before 0.11.2 allows attackers to conduct phishing attacks via unknown attack vectors.

  • CVE-2008-5646Dec 17, 2008
    Trac
    Trac
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Trac before 0.11.2 allows attackers to cause a denial of service via unknown attack vectors related to "certain wiki markup."

  • CVE-2008-5645Dec 17, 2008
    Orb Networks
    Orb
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the media server in Orb Networks Orb before 2.01.0022 allows remote attackers to read arbitrary files via directory traversal sequences in an HTTP GET request.

  • CVE-2008-5644Dec 17, 2008
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the file backend module in TYPO3 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2008-5643Dec 17, 2008
    Joomla
    Books
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Books (com_books) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the book_id parameter in a book_details action to index.php.

  • CVE-2008-5642Dec 17, 2008
    Cmsmadesimple
    Cmsmadesimple
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a cms_language cookie.

  • CVE-2008-5641Dec 17, 2008
    Activewebsoftwares
    Active Photo Gallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in account.asp in Active Photo Gallery 6.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

  • CVE-2008-5640Dec 17, 2008
    Active Bids
    Active Bids
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in bidhistory.asp in Active Bids 3.5 allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.

  • CVE-2008-5639Dec 17, 2008
    Txtblogcms
    Txtblog
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in TxtBlog 1.0 Alpha allows remote attackers to read arbitrary files via a .. (dot dot) in the m parameter.