VYPR

CVEs

344,989 total · page 6229 of 6,900

AllCriticalHighKEV
  • CVE-2008-5306Dec 2, 2008
    Pilotgroup
    Pg Real Estate Solution
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/index.php in PG Real Estate Solution allows remote attackers to execute arbitrary SQL commands via the login_lg parameter (username). NOTE: some of these details are obtained from third party information.

  • CVE-2008-5303Dec 1, 2008
    Perl Foundation
    File\
    risk 0.00cvss —epss 0.00

    Race condition in the rmtree function in File::Path 1.08 (lib/File/Path.pm) in Perl 5.8.8 allows local users to to delete arbitrary files via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error…

  • CVE-2008-5302Dec 1, 2008
    Perl Foundation
    File\
    risk 0.00cvss —epss 0.00

    Race condition in the rmtree function in File::Path 1.08 and 2.07 (lib/File/Path.pm) in Perl 5.8.8 and 5.10.0 allows local users to create arbitrary setuid binaries via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this…

  • CVE-2008-5301Dec 1, 2008
    Dovecot (software)
    Dovecot
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." (dot dot) in a script name.

  • CVE-2008-5300Dec 1, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Linux kernel 2.6.28 allows local users to cause a denial of service ("soft lockup" and process loss) via a large number of sendmsg function calls, which does not block during AF_UNIX garbage collection and triggers an OOM condition, a different vulnerability than CVE-2008-5029.

  • CVE-2008-5299Dec 1, 2008
    Karakas Online
    Chm2pdf
    risk 0.00cvss —epss 0.00

    chm2pdf 0.9 allows user-assisted local users to delete arbitrary files via a symlink attack on .chm files in the (1) /tmp/chm2pdf/work or (2) /tmp/chm2pdf/orig temporary directories.

  • CVE-2008-5298Dec 1, 2008
    Karakas Online
    Chm2pdf
    risk 0.00cvss —epss 0.00

    chm2pdf 0.9 uses temporary files in directories with fixed names, which allows local users to cause a denial of service (chm2pdf failure) of other users by creating those directories ahead of time.

  • CVE-2008-5297Dec 1, 2008
    Vitalwerks
    No IP Duc
    risk 0.04cvss —epss 0.18

    Buffer overflow in No-IP DUC 2.1.7 and earlier allows remote HTTP servers to execute arbitrary code via a crafted response to a DNS update request, related to a missing length check in the GetNextLine function.

  • CVE-2008-5296Dec 1, 2008
    Gallery Project
    Gallery
    risk 0.00cvss —epss 0.01

    Gallery 1.5.x before 1.5.10 and 1.6 before 1.6-RC3, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative via unspecified cookies. NOTE: some of these details are obtained from third party information.

  • CVE-2008-5295Dec 1, 2008
    Jamit
    Jamit Job Board
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Jamit Job Board 3.4.10 allows remote attackers to execute arbitrary SQL commands via the show_emp parameter.

  • CVE-2008-5294Dec 1, 2008
    WebStudio
    eCatalogue
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in WebStudio eCatalogue allows remote attackers to execute arbitrary SQL commands via the pageid parameter.

  • CVE-2008-5293Dec 1, 2008
    WebStudio
    eHotel
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in WebStudio eHotel allows remote attackers to execute arbitrary SQL commands via the pageid parameter.

  • CVE-2008-5292Dec 1, 2008
    Videogirls
    Videogirls Biz
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in view_snaps.php in VideoGirls BiZ allows remote attackers to execute arbitrary SQL commands via the type parameter.

  • CVE-2008-5291Dec 1, 2008
    Fuzzylime
    cms
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in code/track.php in FuzzyLime 3.03 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter, a different vector than CVE-2007-4805 and CVE-2008-3165.

  • CVE-2008-5290Dec 1, 2008
    Werner Hilversum
    Clean CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in full_txt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2008-5289Dec 1, 2008
    Scripts4you
    Clean CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in full_txt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-5288Dec 1, 2008
    Werner Hilversum
    FAQ Manager
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in include/header.php in Werner Hilversum FAQ Manager 1.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the config_path parameter.

  • CVE-2008-5287Dec 1, 2008
    Werner Hilversum
    FAQ Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in catagorie.php in Werner Hilversum FAQ Manager 1.2 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.

  • CVE-2008-5286Dec 1, 2008
    Apple Inc.
    Cups
    risk 0.00cvss —epss 0.04

    Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

  • CVE-2008-5285Dec 1, 2008
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    Wireshark 1.0.4 and earlier allows remote attackers to cause a denial of service via a long SMTP request, which triggers an infinite loop.

  • CVE-2008-4314Dec 1, 2008
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.04

    smbd in Samba 3.0.29 through 3.2.4 might allow remote attackers to read arbitrary memory and cause a denial of service via crafted (1) trans, (2) trans2, and (3) nttrans requests, related to a "cut&paste error" that causes an improper bounds check to be performed.

  • CVE-2008-5284Nov 29, 2008
    Iea Software
    Air Marshal
    risk 0.03cvss —epss 0.04

    The web server in IEA Software RadiusNT and RadiusX 5.1.38 and other versions before 5.1.44, Emerald 5.0.49 and other versions before 5.0.52, Air Marshal 2.0.4 and other versions before 2.0.8, and Radius test client (aka Radlogin) 4.0.20 and earlier, allows remote attackers to…

  • CVE-2008-5283Nov 29, 2008
    Ghh
    Google Hack Honeypot File Upload Manager
    risk 0.03cvss —epss 0.02

    Google Hack Honeypot (GHH) File Upload Manager 1.3 allows remote attackers to delete uploaded files via unknown vectors related to the delall action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.…

  • CVE-2008-5282Nov 29, 2008
    risk 0.04cvss —epss 0.18

    Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0.1 allow remote attackers to execute arbitrary code via (1) a link with a long HREF attribute, and (2) a DIV tag with a long id attribute.

  • CVE-2008-5281Nov 29, 2008
    Titan
    FTP Server
    risk 0.04cvss —epss 0.06

    Heap-based buffer overflow in Titan FTP Server 6.05 build 550 allows remote attackers to execute arbitrary code via a long DELE command.

  • CVE-2008-5280Nov 29, 2008
    Zilab
    Zim Server
    risk 0.04cvss —epss 0.07

    The Local ZIM Server in Zilab Chat and Instant Messaging (ZIM) Server 2.0 and 2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted requests without required parameters.

  • CVE-2008-5279Nov 29, 2008
    Zilab
    Zim Server
    risk 0.00cvss —epss 0.06

    The Local ZIM Server (zcs.exe) in Zilab Chat and Instant Messaging (ZIM) Server 2.1 and earlier allow remote attackers to execute arbitrary code via (1) heap-based buffer overflows involving multiple vectors including a long room name and a long source account, and (2) a…

  • CVE-2008-5278Nov 28, 2008
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header (HTTP_HOST variable).

  • CVE-2008-5275Nov 28, 2008
    risk 0.00cvss —epss 0.03

    Multiple directory traversal vulnerabilities in the (a) "Unzip archive" and (b) "Upload files and archives" functionality in net2ftp 0.96 stable and 0.97 beta allow remote attackers to create, read, or delete arbitrary files via a .. (dot dot) in a filename within a (1) TAR or…

  • CVE-2008-5274Nov 28, 2008
    Toddwoolums
    Asp News Management
    risk 0.03cvss —epss 0.02

    Todd Woolums ASP News Management 2.2 allows remote attackers to obtain news items via a direct request to (1) rss.asp, (2) viewheadings.asp, or (3) viewnews.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-5273Nov 28, 2008
    Toddwoolums
    Asp News Management
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in viewnews.asp in Todd Woolums ASP News Management 2.2 allows remote attackers to execute arbitrary SQL commands via the newsID parameter.

  • CVE-2008-5272Nov 28, 2008
    Syndeocms
    Syndeocms
    risk 0.03cvss —epss 0.06

    Multiple directory traversal vulnerabilities in Fred Stuurman SyndeoCMS 2.6.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the template parameter to (1) starnet/editors/fckeditor/studenteditor.php; (2) starnet/modules/sn_news/edit_content.php,…

  • CVE-2008-5271Nov 28, 2008
    Syndeocms
    Syndeocms
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Fred Stuurman SyndeoCMS 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the section parameter.

  • CVE-2008-5270Nov 28, 2008
    Yuhhu
    Superstar 2008
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in view.topics.php in Yuhhu Superstar 2008 allows remote attackers to execute arbitrary SQL commands via the board parameter.

  • CVE-2008-5269Nov 28, 2008
    PSys
    pSys
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in pSys 0.7.0 alpha allows remote attackers to execute arbitrary SQL commands via the shownews parameter.

  • CVE-2008-5268Nov 28, 2008
    Aspapps
    Aspportal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in content/forums/reply.asp in ASPPortal allows remote attackers to execute arbitrary SQL commands via the Topic_Id parameter.

  • CVE-2008-5267Nov 28, 2008
    Experts
    Experts
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in answer.php in Experts 1.0.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the question_id parameter.

  • CVE-2008-5266Nov 28, 2008
    Sun Corporation
    Java System Application Server
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build b09d-fcs and 9.1_02 build b04-fcs allows remote attackers to inject arbitrary web script or HTML via…

  • CVE-2008-5265Nov 28, 2008
    Tntforum
    Tnt Forum
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in TNT Forum 0.9.4, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the modulo parameter.

  • CVE-2008-5264Nov 28, 2008
    Tornado
    Tornado Knowledge Retrieval System
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in searcher.exe in Tornado Knowledge Retrieval System 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the p parameter in a root action.

  • CVE-2008-5257Nov 27, 2008
    IBM
    Tivoli Access Manager For E Business
    risk 0.00cvss —epss 0.01

    webseald in WebSEAL 6.0.0.17 in IBM Tivoli Access Manager for e-business allows remote attackers to cause a denial of service (crash or hang) via HTTP requests, as demonstrated by a McAfee vulnerability scan.

  • CVE-2008-5256Nov 27, 2008
    Sun Innotek
    VirtualBox
    risk 0.00cvss —epss 0.00

    The AcquireDaemonLock function in ipcdUnix.cpp in Sun Innotek VirtualBox before 2.0.6 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/.vbox-$USER-ipc/lock temporary file.

  • CVE-2008-4636Nov 27, 2008
    Novell
    yast2-backup
    risk 0.00cvss —epss 0.00

    yast2-backup 2.14.2 through 2.16.6 on SUSE Linux and Novell Linux allows local users to gain privileges via shell metacharacters in filenames used by the backup process.

  • CVE-2008-4315Nov 27, 2008
    Fedorahosted
    Fedora
    risk 0.00cvss —epss 0.03

    tog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux (RHEL) 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks.

  • CVE-2008-4313Nov 27, 2008
    Open Group
    tog-pegasus
    risk 0.00cvss —epss 0.01

    A certain Red Hat patch for tog-pegasus in OpenGroup Pegasus 2.7.0 does not properly configure the PAM tty name, which allows remote authenticated users to bypass intended access restrictions and send requests to OpenPegasus WBEM services.

  • CVE-2008-5162HigNov 26, 2008
    FreeBSD
    FreeBSD
    risk 0.46cvss 7.0epss 0.00

    The arc4random function in the kernel in FreeBSD 6.3 through 7.1 does not have a proper entropy source for a short time period immediately after boot, which makes it easier for attackers to predict the function's return values and conduct certain attacks against the GEOM…

  • CVE-2008-2378Nov 26, 2008
    Hf
    Hf
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in hfkernel in hf 0.7.3 and 0.8 allows local users to gain privileges via a Trojan horse killall program in a directory in the PATH, related to improper handling of the -k option.

  • CVE-2008-5248Nov 26, 2008
    Xine
    Xine Lib
    risk 0.00cvss —epss 0.01

    xine-lib before 1.1.15 allows remote attackers to cause a denial of service (crash) via "MP3 files with metadata consisting only of separators."

  • CVE-2008-5247Nov 26, 2008
    Xine
    Xine Lib
    risk 0.00cvss —epss 0.02

    The real_parse_audio_specific_data function in demux_real.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, uses an untrusted height (aka codec_data_length) value as a divisor, which allow remote attackers to cause a denial of service (divide-by-zero error and crash)…

  • CVE-2008-5246Nov 26, 2008
    Xine
    Xine Lib
    risk 0.00cvss —epss 0.06

    Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary code via vectors that send ID3 data to the (1) id3v22_interp_frame and (2) id3v24_interp_frame functions in src/demuxers/id3.c. NOTE: the provenance of this information is…