VYPR

CVEs

344,989 total · page 6228 of 6,900

AllCriticalHighKEV
  • CVE-2008-5347Dec 5, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier allow untrusted applets and applications to gain privileges via vectors related to access to inner classes in the (1) JAX-WS and (2) JAXB packages.

  • CVE-2008-5346Dec 5, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 or earlier allows untrusted applets and applications to read arbitrary memory via a crafted ZIP file.

  • CVE-2008-5345Dec 5, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Java Runtime Environment (JRE) with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier allows code that is loaded from a local filesystem to read…

  • CVE-2008-5344Dec 5, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted applets to read arbitrary files and make unauthorized network connections…

  • CVE-2008-5343Dec 5, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.05

    Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows remote attackers to make unauthorized network connections and hijack HTTP sessions via a crafted file that…

  • CVE-2008-5342Dec 5, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the BasicService for Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted downloaded applications to cause local files to be…

  • CVE-2008-5341Dec 5, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier, and JDK and JRE 5.0 Update 16 and earlier, allows untrusted JWS applications to obtain the pathname of the JWS cache and the application username via unknown vectors,…

  • CVE-2008-5340Dec 5, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted JWS applications to gain privileges to access local files or applications…

  • CVE-2008-5339Dec 5, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted JWS applications to perform network connections to unauthorized hosts via…

  • CVE-2008-2086Dec 5, 2008
    Sun Corporation
    Jdk
    risk 0.01cvss —epss 0.07

    Sun Java Web Start and Java Plug-in for JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allow remote attackers to execute arbitrary code via a crafted jnlp file that modifies the (1) java.home, (2) java.ext.dirs,…

  • CVE-2008-5338Dec 5, 2008
    Bandwebsite
    Bandwebsite
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in info.php in Bandwebsite (aka Bandsite portal system) 1.5 allows remote attackers to inject arbitrary web script or HTML via the section parameter.

  • CVE-2008-5337Dec 5, 2008
    Bandwebsite
    Bandwebsite (aka Bandsite portal system)
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in lyrics.php in Bandwebsite (aka Bandsite portal system) 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-5336Dec 5, 2008
    WebStudio
    WebStudio CMS
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in WebStudio CMS allows remote attackers to execute arbitrary SQL commands via the pageid parameter.

  • CVE-2008-5335Dec 5, 2008
    PHP-Fusion
    Phpfusion
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the subject and msg_send parameters, a different vector than CVE-2005-3157, CVE-2005-3158,…

  • CVE-2008-5334Dec 5, 2008
    Nitrotech
    Nitrotech
    risk 0.04cvss —epss 0.09

    PHP remote file inclusion vulnerability in includes/common.php in NitroTech 0.0.3a allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.

  • CVE-2008-5333Dec 5, 2008
    Nitrotech
    Nitrotech
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in members.php in NitroTech 0.0.3a allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-5332Dec 5, 2008
    Pie
    Pie
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in Pie 0.5.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lib parameter to files in lib/action/ including (a) alias.php, (b) cancel.php, (c) context.php, (d) deadlinks.php, (e) delete.php, and…

  • CVE-2007-6719Dec 5, 2008
    Inspector It
    Wiz AD
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Wiz-Ad 1.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-5331Dec 5, 2008
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.02

    Adobe Acrobat 9 uses more efficient encryption than previous versions, which makes it easier for attackers to guess a document's password via a brute-force attack.

  • CVE-2008-5330Dec 5, 2008
    IBM
    Rational Clearcase
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the web interface in ClearCase RWP server in IBM Rational ClearCase 7.0.0 before 7.0.0.4, and 7.0.1.1-RATL-RCC-IFIX02 and possibly other 7.0.1 versions before 7.0.1.3, allow remote attackers to inject arbitrary web script or…

  • CVE-2008-5329Dec 5, 2008
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.02

    ClearQuest Web in IBM Rational ClearQuest MultiSite before 7.1 allows remote servers to direct a client's submissions and changes to an arbitrary database by specifying multiple comma-separated server identifiers on the JTLRMIREGISTRYSERVERS line in a jtl.properties file.

  • CVE-2008-5328Dec 5, 2008
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.01

    The ClearQuest Maintenance Tool in IBM Rational ClearQuest before 7 stores the database password in cleartext in an object in a ClearQuest connection profile or export file, which allows remote authenticated users to obtain sensitive information by locating the password object…

  • CVE-2008-5327Dec 5, 2008
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.01

    The ClearQuest Maintenance Tool in IBM Rational ClearQuest 7 before 7.1 stores the database password in cleartext in an object in a ClearQuest connection profile or export file, which allows remote authenticated users to obtain sensitive information by locating the password…

  • CVE-2008-5326Dec 5, 2008
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.00

    The ClearQuest Maintenance Tool in IBM Rational ClearQuest 7.0.0 before 7.0.0.4 and 7.0.1 before 7.0.1.3 on Windows allows local users to obtain (1) user and (2) database passwords by using a password revealer utility on a field containing a series of asterisks.

  • CVE-2008-5325Dec 5, 2008
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in CQ Web in IBM Rational ClearQuest 7.0.0 before 7.0.0.4 and 7.0.1 before 7.0.1.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-5324Dec 5, 2008
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in CQ Web in IBM Rational ClearQuest 2007 before 2007D and 2008 before 2008B allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-4416Dec 5, 2008
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the kernel in HP HP-UX B.11.31 allows local users to cause a denial of service via unknown vectors.

  • CVE-2008-2379Dec 5, 2008
    SquirrelMail
    Squirrelmail
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in SquirrelMail before 1.4.17 allows remote attackers to inject arbitrary web script or HTML via a crafted hyperlink in an HTML part of an e-mail message.

  • CVE-2008-5323Dec 3, 2008
    Wysi Wiki Wyg
    Wysi Wiki Wyg
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Wysi Wiki Wyg 1.0 allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2008-5322Dec 3, 2008
    Wysi Wiki Wyg
    Wysi Wiki Wyg
    risk 0.03cvss —epss 0.03

    Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, which calls the phpinfo function.

  • CVE-2008-5321Dec 3, 2008
    XOOPS
    GesGaleri
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in GesGaleri, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the no parameter.

  • CVE-2008-5320Dec 3, 2008
    E107
    E107
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute arbitrary SQL commands via the ue[] parameter.

  • CVE-2008-5319Dec 3, 2008
    Tiki
    Tiki
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to tiki-error.php, a different issue than CVE-2008-3653.

  • CVE-2008-5318Dec 3, 2008
    Tiki
    Tiki
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to "size of user-provided input," a different issue than CVE-2008-3653.

  • CVE-2008-5080Dec 3, 2008
    AWStats
    Awstats
    risk 0.00cvss —epss 0.01

    awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter. NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.

  • CVE-2008-5317Dec 3, 2008
    Littlecms
    Lcms
    risk 0.00cvss —epss 0.02

    Integer signedness error in the cmsAllocGamma function in src/cmsgamma.c in Little cms color engine (aka lcms) before 1.17 allows attackers to have an unknown impact via a file containing a certain "number of entries" value, which is interpreted improperly, leading to an…

  • CVE-2008-5316Dec 3, 2008
    Littlecms
    Lcms
    risk 0.00cvss —epss 0.03

    Buffer overflow in the ReadEmbeddedTextTag function in src/cmsio1.c in Little cms color engine (aka lcms) before 1.16 allows attackers to have an unknown impact via vectors related to a length parameter inconsistency involving the contents of "the input file," a different…

  • CVE-2008-5315Dec 3, 2008
    Apple Inc.
    Iphone Configuration Web Utility
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the web interface in Apple iPhone Configuration Web Utility 1.0 on Windows allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2008-5314Dec 3, 2008
    ClamAV
    Clamav
    risk 0.04cvss —epss 0.08

    Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted JPEG file, related to the cli_check_jpeg_exploit, jpeg_check_photoshop, and jpeg_check_photoshop_8bim functions.

  • CVE-2008-5313Dec 3, 2008
    Mailscanner
    Mailscanner
    risk 0.00cvss —epss 0.00

    mailscanner 4.68.8 and other versions before 4.74.16-1 might allow local users to overwrite arbitrary files via a symlink attack on certain temporary files used by the (1) f-prot-autoupdate, (2) clamav-autoupdate, (3) avast-autoupdate, and (4) f-prot-6-autoupdate scripts in…

  • CVE-2008-5312Dec 3, 2008
    Mailscanner
    Mailscanner
    risk 0.00cvss —epss 0.00

    mailscanner 4.55.10 and other versions before 4.74.16-1 might allow local users to overwrite arbitrary files via a symlink attack on certain temporary files used by the (1) f-prot-autoupdate, (2) clamav-autoupdate, (3) panda-autoupdate.new, (4) trend-autoupdate.new, and (5)…

  • CVE-2008-5276Dec 3, 2008
    VideoLAN
    VLC media player
    risk 0.01cvss —epss 0.08

    Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.

  • CVE-2008-3059Dec 3, 2008
    Octeth
    Oempro
    risk 0.00cvss —epss 0.01

    member/settings_account.php in Octeth Oempro 3.5.5.1, and possibly other versions before 4, uses cleartext to transmit a password entered in the FormValue_Password field, which makes it easier for remote attackers to obtain sensitive information by sniffing the network, related…

  • CVE-2008-3058Dec 3, 2008
    Octeth
    Oempro
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Octeth Oempro 3.5.5.1, and possibly other versions before 4, allow remote attackers to execute arbitrary SQL commands via the FormValue_Email parameter (aka Email field) to index.php in (1) member/, (2) client/, or (3) admin/; or (4) the…

  • CVE-2008-3057Dec 3, 2008
    Octeth
    Oempro
    risk 0.00cvss —epss 0.01

    Octeth Oempro 3.5.5.1, and possibly other versions before 4, does not set the secure flag for the PHPSESSID cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

  • CVE-2008-5311Dec 2, 2008
    Netartmedia
    Blog System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in image.php in NetArt Media Blog System 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-5310Dec 2, 2008
    Netartmedia
    Car Portal
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in image.php in NetArt Media Car Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-5309Dec 2, 2008
    Netartmedia
    Real Estate Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in NetArt Media Real Estate Portal 1.2 allows remote attackers to execute arbitrary SQL commands via the ad_id parameter in the re_send_email module to index.php.

  • CVE-2008-5308Dec 2, 2008
    Lovecms
    The Simple Forum
    risk 0.04cvss —epss 0.07

    The Simple Forum 3.1d module for LoveCMS 1.6.2 Final does not properly restrict access to administrator functions, which allows remote attackers to change the administrator password via a direct request to modules/simpleforum/admin/index.php.

  • CVE-2008-5307Dec 2, 2008
    Pilotgroup
    Pg Real Roommate Finder Solution
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/index.php in PG Roommate Finder Solution allows remote attackers to execute arbitrary SQL commands via the login_lg parameter. NOTE: some of these details are obtained from third party information.