VYPR

CVEs

344,987 total · page 6234 of 6,900

AllCriticalHighKEV
  • CVE-2008-5061Nov 13, 2008
    Smolinari
    Mini Web Calendar
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in php/cal_default.php in Mini Web Calendar (mwcal) 1.2 allows remote attackers to inject arbitrary web script or HTML via the URL.

  • CVE-2008-5060Nov 13, 2008
    Moderngigabyte
    Modernbill
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in ModernBill 4.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to (1) export_batch.inc.php, (2) run_auto_suspend.cron.php, and (3) send_email_cache.php in include/scripts/; (4)…

  • CVE-2008-5059Nov 13, 2008
    Moderngigabyte
    Modernbill
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in ModernBill 4.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a Javascript event in the new_language parameter in a login action.

  • CVE-2008-5058Nov 13, 2008
    Simple CMS
    Simple CMS
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in siteadmin/loginsucess.php in Pre Simple CMS allows remote attackers to execute arbitrary SQL commands via the user parameter, as reachable from siteadmin/adminlogin.php. NOTE: some of these details are obtained from third party information.

  • CVE-2008-5057Nov 13, 2008
    Yigit Aybuga
    Dizi Portali
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in film.asp in Yigit Aybuga Dizi Portali allows remote attackers to execute arbitrary SQL commands via the film parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-5056Nov 13, 2008
    Activecampaign
    Triolive
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in department_offline_context.php in ActiveCampaign TrioLive before 1.58.7 allows remote attackers to inject arbitrary web script or HTML via the department_id parameter to index.php.

  • CVE-2008-5055Nov 13, 2008
    Activecampaign
    Triolive
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in department_offline_context.php in ActiveCampaign TrioLive before 1.58.7 allows remote attackers to execute arbitrary SQL commands via the department_id parameter to index.php.

  • CVE-2008-5054Nov 13, 2008
    Developiteasy
    Membership System
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Develop It Easy Membership System 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameters to customer_login.php and the (3) user_name and (4) user_pass parameters to admin/index.php.…

  • CVE-2008-5053Nov 13, 2008
    Joomla
    Simple RSS Reader
    risk 0.08cvss —epss 0.63

    PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader (com_rssreader) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.

  • CVE-2008-5052Nov 13, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as…

  • CVE-2008-5024Nov 13, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attackers to conduct XML injection attacks via the default…

  • CVE-2008-5023Nov 13, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the protection mechanism for codebase principals and execute arbitrary script via the -moz-binding CSS property in a signed JAR file.

  • CVE-2008-5022Nov 13, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple…

  • CVE-2008-5021Nov 13, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying properties of a file input…

  • CVE-2008-5019Nov 13, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The session restore feature in Mozilla Firefox 3.x before 3.0.4 and 2.x before 2.0.0.18 allows remote attackers to violate the same origin policy to conduct cross-site scripting (XSS) attacks and execute arbitrary JavaScript with chrome privileges via unknown vectors.

  • CVE-2008-5018Nov 13, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via vectors related to "insufficient class checking" in the Date…

  • CVE-2008-5017Nov 13, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors.

  • CVE-2008-5016Nov 13, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via multiple vectors that trigger an assertion failure or other consequences.

  • CVE-2008-5015Nov 13, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 3.x before 3.0.4 assigns chrome privileges to a file: URI when it is accessed in the same tab from a chrome or privileged about: page, which makes it easier for user-assisted attackers to execute arbitrary JavaScript with chrome privileges via malicious code in a…

  • CVE-2008-5014Nov 13, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying the…

  • CVE-2008-5013Nov 13, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that "dynamically unloads itself from an outside…

  • CVE-2008-5012Nov 13, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary…

  • CVE-2008-0017Nov 13, 2008
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.08

    The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 does not check for an allocation failure, which allows remote attackers to cause a denial of service (crash) and possibly execute…

  • CVE-2008-5051Nov 13, 2008
    Jooblog
    Jooblog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JooBlog (com_jb2) component 0.1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the PostID parameter to index.php.

  • CVE-2008-5050Nov 13, 2008
    ClamAV
    Clamav
    risk 0.01cvss —epss 0.08

    Off-by-one error in the get_unicode_name function (libclamav/vba_extract.c) in Clam Anti-Virus (ClamAV) before 0.94.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted VBA project file, which triggers a heap-based…

  • CVE-2008-5049Nov 13, 2008
    Isecsoft
    Anti Keylogger Elite
    risk 0.03cvss —epss 0.01

    Buffer overflow in AKEProtect.sys 3.3.3.0 in ISecSoft Anti-Keylogger Elite 3.3.0 and earlier, and possibly other versions including 3.3.3, allows local users to gain privileges via long inputs to the (1) 0x002224A4, (2) 0x002224C0, and (3) 0x002224CC IOCTL.

  • CVE-2008-5048Nov 13, 2008
    Isecsoft
    Anti Trojan Elite
    risk 0.03cvss —epss 0.01

    Buffer overflow in Atepmon.sys in ISecSoft Anti-Trojan Elite 4.2.1 and earlier, and possibly 4.2.2, allows local users to cause a denial of service (crash) and possibly execute arbitrary code via long inputs to the 0x00222494 IOCTL.

  • CVE-2008-5047Nov 13, 2008
    Mole Group
    Rental Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/index.php in Mole Group Rental Script allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2008-5046Nov 13, 2008
    Mole Group
    Pizza Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Mole Group Pizza Script allows remote attackers to execute arbitrary SQL commands via the manufacturers_id parameter.

  • CVE-2008-5045Nov 13, 2008
    Network Client.com
    FTP Now
    risk 0.03cvss —epss 0.03

    Heap-based buffer overflow in Network-Client FTP Now 2.6, and possibly other versions, allows remote FTP servers to cause a denial of service (crash) via a 200 server response that is exactly 1024 characters long.

  • CVE-2008-4989MedNov 13, 2008
    GNU
    Gnutls
    risk 0.39cvss 5.9epss 0.02

    The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed…

  • CVE-2008-5044Nov 12, 2008
    Microsoft
    Windows
    risk 0.03cvss —epss 0.02

    Race condition in Microsoft Windows Server 2003 and Vista allows local users to cause a denial of service (crash or hang) via a multi-threaded application that makes many calls to UnhookWindowsHookEx while certain other desktop activity is occurring.

  • CVE-2008-5043Nov 12, 2008
    IBM
    Metrica Service Assurance Framework
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the web-based interface in IBM Metrica Service Assurance Framework allow remote authenticated users to inject arbitrary web script or HTML via (1) the elementid parameter in a generatedreportresults action to the ReportTree…

  • CVE-2008-4037Nov 12, 2008
    Microsoft
    Windows 2000
    risk 0.08cvss —epss 0.59

    Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as demonstrated by backrush, aka…

  • CVE-2008-4033Nov 12, 2008
    Microsoft
    XML Core Services
    risk 0.05cvss —epss 0.28

    Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP…

  • CVE-2008-4029Nov 12, 2008
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.27

    Cross-domain vulnerability in Microsoft XML Core Services 3.0 and 4.0, as used in Internet Explorer, allows remote attackers to obtain sensitive information from another domain via a crafted XML document, related to improper error checks for external DTDs, aka "MSXML DTD…

  • CVE-2008-5042Nov 12, 2008
    Zeeways
    Photovideotube
    risk 0.03cvss —epss 0.03

    Zeeways PhotoVideoTube 1.1 and earlier allows remote attackers to bypass authentication and perform administrative tasks via a direct request to admin/home.php.

  • CVE-2008-5041Nov 12, 2008
    Sweex
    Ro002 Router
    risk 0.00cvss —epss 0.01

    Sweex RO002 Router with firmware Ts03-072 has "rdc123" as its default password for the "rdc123" account, which makes it easier for remote attackers to obtain access. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-5040Nov 12, 2008
    Graphiks
    Myforum
    risk 0.03cvss —epss 0.03

    Graphiks MyForum 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the (1) myforum_login and (2) myforum_pass cookies to 1.

  • CVE-2008-5039Nov 12, 2008
    PHP-Nuke
    League Module
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the League module for PHP-Nuke, possibly 2.4, allows remote attackers to inject arbitrary web script or HTML via the tid parameter in a team action to modules.php.

  • CVE-2008-5038CriNov 12, 2008
    Novell
    Edirectory
    risk 0.64cvss 9.8epss 0.06

    Use-after-free vulnerability in the NetWare Core Protocol (NCP) feature in Novell eDirectory 8.7.3 SP10 before 8.7.3 SP10 FTF1 and 8.8 SP2 for Windows allows remote attackers to cause a denial of service and possibly execute arbitrary code via a sequence of "Get NCP Extension…

  • CVE-2008-5037Nov 12, 2008
    Elkagroup
    Image Gallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in view.php in ElkaGroup Image Gallery 1.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2008-5036Nov 10, 2008
    VideoLAN
    VLC media player
    risk 0.06cvss —epss 0.41

    Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the ParseRealText function in modules/demux/subtitle.c. NOTE: this issue was SPLIT…

  • CVE-2008-5035Nov 10, 2008
    IBM
    Hardware Management Console
    risk 0.00cvss —epss 0.02

    The Resource Monitoring and Control (RMC) daemon in IBM Hardware Management Console (HMC) 7 release 3.2.0 SP1 and 3.3.0 SP2 allows remote attackers to cause a denial of service (daemon crash or hang) via a packet with an invalid length.

  • CVE-2008-5034Nov 10, 2008
    A Mennucc1
    Printfilters Ppd
    risk 0.00cvss —epss 0.00

    master-filter in printfilters-ppd 2.13 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/filter.debug temporary file. NOTE: the vendor disputes this vulnerability, stating 'this package does not have " possibility of attack with the help of…

  • CVE-2008-5033Nov 10, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    The chip_command function in drivers/media/video/tvaudio.c in the Linux kernel 2.6.25.x before 2.6.25.19, 2.6.26.x before 2.6.26.7, and 2.6.27.x before 2.6.27.3 allows attackers to cause a denial of service (NULL function pointer dereference and OOPS) via unknown vectors.

  • CVE-2008-5032Nov 10, 2008
    VideoLAN
    VLC media player
    risk 0.04cvss —epss 0.11

    Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the header of an invalid CUE image file, related to modules/access/vcd/cdrom.c. NOTE: this identifier originally included an issue…

  • CVE-2008-5031Nov 10, 2008
    Python (programming language)
    Python
    risk 0.00cvss —epss 0.03

    Multiple integer overflows in Python 2.2.3 through 2.5.1, and 2.6, allow context-dependent attackers to have an unknown impact via a large integer value in the tabsize argument to the expandtabs method, as implemented by (1) the string_expandtabs function in…

  • CVE-2008-5030Nov 10, 2008
    Libcaudio
    Libcaudio
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in the cddb_read_disc_data function in cddb.c in libcdaudio 0.99.12p2 allows remote CDDB servers to execute arbitrary code via long CDDB data.

  • CVE-2008-5029Nov 10, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The __scm_destroy function in net/core/scm.c in the Linux kernel 2.6.27.4, 2.6.26, and earlier makes indirect recursive calls to itself through calls to the fput function, which allows local users to cause a denial of service (panic) via vectors related to sending an SCM_RIGHTS…