VYPR

CVEs

344,987 total · page 6233 of 6,900

AllCriticalHighKEV
  • CVE-2008-0014Nov 17, 2008
    Trend Micro
    Serverprotect
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to the product's configuration, a different vulnerability than CVE-2008-0012 and CVE-2008-0013.

  • CVE-2008-0013Nov 17, 2008
    Trend Micro
    Serverprotect
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to the product's configuration, a different vulnerability than CVE-2008-0012 and CVE-2008-0014.

  • CVE-2008-0012Nov 17, 2008
    Trend Micro
    Serverprotect
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to the product's configuration, a different vulnerability than CVE-2008-0013 and CVE-2008-0014.

  • CVE-2007-0074Nov 17, 2008
    Trend Micro
    Serverprotect
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a folder read operation over RPC.

  • CVE-2007-0073Nov 17, 2008
    Trend Micro
    Serverprotect
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a file read operation over RPC.

  • CVE-2007-0072Nov 17, 2008
    Trend Micro
    Serverprotect
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a read operation over RPC.

  • CVE-2006-5269Nov 17, 2008
    Trend Micro
    Serverprotect
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, probably related to an RPC interface.

  • CVE-2006-5268Nov 17, 2008
    Trend Micro
    Serverprotect
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via vectors related to obtaining "administrative access to the RPC interface."

  • CVE-2008-5110Nov 17, 2008
    Oneidentity
    Syslog Ng
    risk 0.00cvss —epss 0.02

    syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail. NOTE: this is only a vulnerability when a separate vulnerability is present. This flaw affects syslog-ng versions prior to and including 2.0.9.

  • CVE-2008-5108Nov 17, 2008
    Adobe Inc.
    Air
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Adobe AIR 1.1 and earlier allows context-dependent attackers to execute untrusted JavaScript in an AIR application via unknown attack vectors.

  • CVE-2008-4824Nov 17, 2008
    Adobe Inc.
    Flashplayer
    risk 0.01cvss —epss 0.13

    Multiple unspecified vulnerabilities in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0 allow remote attackers to execute arbitrary code via unknown vectors related to "input validation errors."

  • CVE-2008-5107Nov 17, 2008
    Citrix Systems
    Desktop Server
    risk 0.00cvss —epss 0.00

    The installation process for Citrix Presentation Server 4.5 and Desktop Server 1.0, when MSI logging is enabled, stores database credentials in MSI log files, which allows local users to obtain these credentials by reading the log files.

  • CVE-2008-5106Nov 17, 2008
    Karjasoft
    Sami FTP Server
    risk 0.04cvss —epss 0.13

    Buffer overflow in KarjaSoft Sami FTP Server 2.0.x allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long argument to an arbitrary command, which triggers the overflow when the SamyFtp.binlog log file is viewed in the…

  • CVE-2008-5105Nov 17, 2008
    Karjasoft
    Sami FTP Server
    risk 0.03cvss —epss 0.03

    KarjaSoft Sami FTP Server 2.0.x allows remote attackers to cause a denial of service (daemon crash or hang) via certain (1) APPE, (2) CWD, (3) DELE, (4) MKD, (5) RMD, (6) RETR, (7) RNFR, (8) RNTO, (9) SIZE, and (10) STOR commands.

  • CVE-2008-5104Nov 17, 2008
    VMBuilder
    VMBuilder
    risk 0.00cvss —epss 0.00

    Ubuntu 6.06 LTS, 7.10, 8.04 LTS, and 8.10, when installed as a virtual machine by (1) python-vm-builder or (2) ubuntu-vm-builder in VMBuilder 0.9 in Ubuntu 8.10, have ! (exclamation point) as the default root password, which allows attackers to bypass intended login restrictions.

  • CVE-2008-5103Nov 17, 2008
    Dcgrendel
    Vmbuilder
    risk 0.00cvss —epss 0.00

    The (1) python-vm-builder and (2) ubuntu-vm-builder implementations in VMBuilder 0.9 in Ubuntu 8.10 omit the -e option when invoking chpasswd with a root:! argument, which configures the root account with a cleartext password of ! (exclamation point) and allows attackers to…

  • CVE-2008-5102Nov 17, 2008
    Zope
    Zope
    risk 0.03cvss —epss 0.04

    PythonScripts in Zope 2 2.11.2 and earlier, as used in Conga and other products, allows remote authenticated users to cause a denial of service (resource consumption or application halt) via certain (1) raise or (2) import statements.

  • CVE-2008-5101Nov 17, 2008
    Optipng Project
    Optipng
    risk 0.00cvss —epss 0.04

    Buffer overflow in the BMP reader in OptiPNG 0.6 and 0.6.1 allows user-assisted attackers to execute arbitrary code via a crafted BMP image, related to an "array overflow."

  • CVE-2008-5100Nov 17, 2008
    Microsoft
    .net Framework
    risk 0.01cvss —epss 0.08

    The strong name (SN) implementation in Microsoft .NET Framework 2.0.50727 relies on the digital signature Public Key Token embedded in the pathname of a DLL file instead of the digital signature of this file itself, which makes it easier for attackers to bypass Global Assembly…

  • CVE-2008-5099Nov 17, 2008
    Sun Corporation
    Logical Domain Manager
    risk 0.00cvss —epss 0.00

    Sun Logical Domain Manager (aka LDoms Manager or ldm) 1.0 through 1.0.3 displays the value of the OpenBoot PROM (OBP) security-password variable in cleartext, which allows local users to bypass the SPARC firmware's password protection, and gain privileges or obtain data access,…

  • CVE-2008-5098Nov 17, 2008
    Sun Corporation
    Java System Messaging Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Sun Java System Messaging Server 6.2 and 6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2007-2904.

  • CVE-2008-4216Nov 17, 2008
    Apple Inc.
    Safari
    risk 0.01cvss —epss 0.09

    The plug-in interface in WebKit in Apple Safari before 3.2 does not prevent plug-ins from accessing local URLs, which allows remote attackers to obtain sensitive information via vectors that "launch local files."

  • CVE-2008-3644Nov 17, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.00

    Apple Safari before 3.2 does not properly prevent caching of form data for form fields that have autocomplete disabled, which allows local users to obtain sensitive information by reading the browser's page cache.

  • CVE-2008-3623Nov 17, 2008
    Apple Inc.
    Safari
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in CoreGraphics in Apple Safari before 3.2 on Windows, in iPhone OS 1.0 through 2.2.1, and in iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted…

  • CVE-2008-5097Nov 14, 2008
    Myfwb
    Myfwb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in MyFWB 1.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2008-5096Nov 14, 2008
    TYPO3
    File List Extension
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the TYPO3 File List (file_list) extension 0.2.1 and earlier allows remote attackers to obtain sensitive information via unknown attack vectors.

  • CVE-2008-5095Nov 14, 2008
    Novell
    Identity Manager Roles Based Provisioning Module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Novell User Application 3.0.1, 3.5.0, and 3.5.1; and Identity Manager Roles Based Provisioning Module 3.6.0 and 3.6.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2008-5094Nov 14, 2008
    Novell
    Edirectory
    risk 0.00cvss —epss 0.02

    Heap-based buffer overflow in the NDS Service in Novell eDirectory before 8.8 SP3 has unknown impact and attack vectors.

  • CVE-2008-5093Nov 14, 2008
    Novell
    Edirectory
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the HTTP Protocol Stack (HTTPSTK) in Novell eDirectory before 8.8 SP3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2008-5092Nov 14, 2008
    Novell
    Edirectory
    risk 0.00cvss —epss 0.02

    Heap-based buffer overflows in Novell eDirectory HTTP protocol stack (HTTPSTK) before 8.8 SP3 have unknown impact and attack vectors related to the (1) HTTP language header and (2) HTTP content-length header.

  • CVE-2008-5091Nov 14, 2008
    Novell
    Edirectory
    risk 0.00cvss —epss 0.02

    Buffer overflow in the LDAP Service in Novell eDirectory 8.7.3 before SP10a and 8.8 before SP3 allows attackers to cause a denial of service (application crash) via vectors involving an "invalid extensibleMatch filter."

  • CVE-2008-5090Nov 14, 2008
    Anelectron
    Advanced Electron Forum
    risk 0.03cvss —epss 0.05

    Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code embedded in bbcode in the email parameter, which is processed by the preg_replace function with the eval switch.

  • CVE-2008-5089Nov 14, 2008
    Datadynamics
    Activereports
    risk 0.00cvss —epss 0.03

    Multiple insecure method vulnerabilities in the DDActiveReportsViewer2.ARViewer2 ActiveX control (arview2.ocx) in Data Dynamics ActiveReports 2.5.0.1314 allow remote attackers to overwrite arbitrary files via a call to the (1) Pages.Save, (2) PrintReport, or (3) Canvas.Save…

  • CVE-2008-5088Nov 14, 2008
    Knowledgebase Script
    Phpkb Knowledge Base Software
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in PHPKB Knowledge Base Software 1.5 Professional allow remote attackers to execute arbitrary SQL commands via the ID parameter to (1) email.php and (2) question.php, a different vector than CVE-2008-1909.

  • CVE-2008-5087Nov 14, 2008
    TYPO3
    Another Backend Login
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in TYPO3 Another Backend Login (wrg_anotherbelogin) extension before 0.0.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-5076Nov 14, 2008
    Htop Dev
    Htop
    risk 0.00cvss —epss 0.00

    htop 0.7 writes process names to a terminal without sanitizing non-printable characters, which might allow local users to hide processes, modify arbitrary files, or have unspecified other impact via a process name with "crazy control strings."

  • CVE-2008-5075Nov 14, 2008
    E Uploader
    E-Uploader Pro
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in E-Uploader Pro 1.0 (aka Uploader PRO), when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) img.php, (b) file.php, (c) mail.php, (d) thumb.php, (e) zip.php, and (f)…

  • CVE-2008-5074Nov 14, 2008
    PHP-Fusion
    Freshlinks Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Freshlinks 1.0 RC1 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the linkid parameter.

  • CVE-2008-5073Nov 14, 2008
    Novell
    Zenworks Desktop Management
    risk 0.03cvss —epss 0.05

    Heap-based buffer overflow in an ActiveX control in Novell ZENworks Desktop Management 6.5 allows remote attackers to execute arbitrary code via a long argument to the CanUninstall method.

  • CVE-2008-5072Nov 14, 2008
    K Lite
    Mega Codec Pack
    risk 0.03cvss —epss 0.02

    vsfilter.dll in K-Lite Mega Codec Pack 3.5.7.0 allows remote attackers to cause a denial of service (application crash) via a malformed FLV file.

  • CVE-2008-5071Nov 14, 2008
    Yoxel
    Yoxel
    risk 0.04cvss —epss 0.06

    Multiple eval injection vulnerabilities in itpm_estimate.php in Yoxel 1.23beta and earlier allow remote authenticated users to execute arbitrary PHP code via the proj_id parameter.

  • CVE-2008-5070Nov 14, 2008
    Prochatrooms
    Pro Chat Rooms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Pro Chat Rooms 3.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the gud parameter to (1) profiles/index.php and (2) profiles/admin.php.

  • CVE-2008-5069Nov 14, 2008
    Panuwat PromoteWeb
    MySQL
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in go.php in Panuwat PromoteWeb MySQL, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-5068Nov 13, 2008
    Kkeim
    Kmita Gallery
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Kmita Gallery allow remote attackers to inject arbitrary web script or HTML via the (1) begin parameter to index.php and the (2) searchtext parameter to search.php. NOTE: the provenance of this information is unknown; the…

  • CVE-2008-5067Nov 13, 2008
    Kmita
    Catalogue
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in Kmita Catalogue 2.x allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-5066Nov 13, 2008
    Agares Media
    Themesitescript
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in upload/admin/frontpage_right.php in Agares Media ThemeSiteScript 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter.

  • CVE-2008-5065Nov 13, 2008
    Easy Script
    Tlguesbook
    risk 0.03cvss —epss 0.03

    TlGuestBook 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlGuestBook_login cookie to admin.

  • CVE-2008-5064Nov 13, 2008
    H\&h
    Websoccer
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in liga.php in H&H WebSoccer 2.80 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-5063Nov 13, 2008
    Otmanager
    CMS
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in Admin/ADM_Pagina.php in OTManager 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the Tipo parameter.

  • CVE-2008-5062Nov 13, 2008
    Smolinari
    Mini Web Calendar
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in php/cal_pdf.php in Mini Web Calendar (mwcal) 1.2 allows remote attackers to read arbitrary files via directory traversal sequences in the thefile parameter.