VYPR

CVEs

344,987 total · page 6240 of 6,900

AllCriticalHighKEV
  • CVE-2008-4734Oct 24, 2008
    WordPress
    WP Comment Remix
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to perform unauthorized actions as administrators via a request that sets the wpcr_hidden_form_input parameter.

  • CVE-2008-4733Oct 24, 2008
    WordPress
    WP Comment Remix
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the (1) replytotext, (2) quotetext, (3) originallypostedby, (4) sep, (5) maxtags, (6) tagsep,…

  • CVE-2008-4732Oct 24, 2008
    WordPress
    WP Comment Remix
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in ajax_comments.php in the WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the p parameter.

  • CVE-2008-4731Oct 24, 2008
    Yacy
    YaCy
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in YaCy before 0.61 have unknown impact and attack vectors.

  • CVE-2008-4730Oct 24, 2008
    Phpmyid
    Phpmyid
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MyID.php in phpMyID 0.9 allows remote attackers to inject arbitrary web script or HTML via the openid_trust_root parameter and an inconsistent openid_return_to parameter, which is not properly handled in an error message.

  • CVE-2008-4729Oct 24, 2008
    Hummingbird
    Xweb ActiveX Control
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in Hummingbird.XWebHostCtrl.1 ActiveX control (hclxweb.dll) in Hummingbird Xweb ActiveX Control 13.0 and earlier allows remote attackers to execute arbitrary code via a long PlainTextPassword property. NOTE: code execution might not be possible in…

  • CVE-2008-4728Oct 24, 2008
    Hummingbird
    Deployment Wizard
    risk 0.06cvss —epss 0.32

    Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in Hummingbird Deployment Wizard 2008 allow remote attackers to execute arbitrary programs via the (1) Run and (2) PerformUpdateAsync methods, and (3) modify…

  • CVE-2008-4727Oct 24, 2008
    Ellucian
    Banner Student
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the contact update page (ss/bwgkoemr.P_UpdateEmrgContacts) in SunGard Banner Student 7.3 allows remote attackers to inject arbitrary web script or HTML via the addr1 parameter. NOTE: this might be resultant from a CSRF vulnerability,…

  • CVE-2008-4726Oct 24, 2008
    Goodtech Systems
    SSH
    risk 0.07cvss —epss 0.44

    Stack-based buffer overflow in the SFTP subsystem in GoodTech SSH 6.4 allows remote authenticated users to execute arbitrary code via a long string to the (1) open (aka SSH_FXP_OPEN), (2) unlink, (3) opendir, and other unspecified parameters.

  • CVE-2008-4725Oct 23, 2008
    Opera
    Opera
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly escaped before storage in the History Search database (aka md.dat), a different vector than…

  • CVE-2008-4724Oct 23, 2008
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Google Chrome 0.2.149.30 allow remote attackers to inject arbitrary web script or HTML via an ftp:// URL for an HTML document within a (1) JPG, (2) PDF, or (3) TXT file. NOTE: the provenance of this information is unknown;…

  • CVE-2008-4723Oct 23, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 3.0.1 through 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an ftp:// URL for an HTML document within a (1) JPG, (2) PDF, or (3) TXT file. NOTE: the provenance of this information…

  • CVE-2008-4722Oct 23, 2008
    Sun Corporation
    Integrated Lights Out Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Sun Integrated Lights-Out Manager (ILOM) 2.0.1.5 through 2.0.4.26 allows remote authenticated users to (1) access the service processor (SP) and cause a denial of service (shutdown or reboot), or (2) access the host operating system and have an…

  • CVE-2008-4698Oct 23, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 9.61 does not properly block scripts during preview of a news feed, which allows remote attackers to create arbitrary new feed subscriptions and read the contents of arbitrary feeds.

  • CVE-2008-4697Oct 23, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    The Fast Forward feature in Opera before 9.61, when a page is located in a frame, executes a javascript: URL in the context of the outermost page instead of the page that contains this URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks.

  • CVE-2008-4696Oct 23, 2008
    Opera
    Opera
    risk 0.07cvss —epss 0.46

    Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML via the anchor identifier (aka the "optional fragment"), which is not properly escaped before storage in the History Search database (aka…

  • CVE-2008-4695Oct 23, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.06

    Opera before 9.60 allows remote attackers to obtain sensitive information and have unspecified other impact by predicting the cache pathname of a cached Java applet and then launching this applet from the cache, leading to applet execution within the local-machine context.

  • CVE-2008-4694Oct 23, 2008
    Opera
    Opera
    risk 0.04cvss —epss 0.10

    Unspecified vulnerability in Opera before 9.60 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a redirect that specifies a crafted URL.

  • CVE-2008-4250CriKEVOct 23, 2008
    Microsoft
    Windows 2000
    risk 0.87cvss 9.8epss 0.99

    The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as…

  • CVE-2008-3863Oct 23, 2008
    GNU
    Enscript
    risk 0.01cvss —epss 0.08

    Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related…

  • CVE-2008-3862Oct 23, 2008
    Trend Micro
    Officescan
    risk 0.01cvss —epss 0.18

    Stack-based buffer overflow in CGI programs in the server in Trend Micro OfficeScan 7.3 Patch 4 build 1367 and other builds before 1374, and 8.0 SP1 Patch 1 before build 3110, allows remote attackers to execute arbitrary code via an HTTP POST request containing crafted form…

  • CVE-2008-3817Oct 23, 2008
    Cisco Systems, Inc.
    Pix Security Appliance
    risk 0.00cvss —epss 0.02

    Memory leak in Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 8.0 before 8.0(4) and 8.1 before 8.1(2) allows remote attackers to cause a denial of service (memory consumption) via an unspecified sequence of packets, related to the…

  • CVE-2008-3816Oct 23, 2008
    Cisco Systems, Inc.
    Pix Security Appliance
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.2(4)9 and 7.2(4)10 allows remote attackers to cause a denial of service (device reload) via a crafted IPv6 packet.

  • CVE-2008-3815Oct 23, 2008
    Cisco Systems, Inc.
    Pix
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.0 before 7.0(8)3, 7.1 before 7.1(2)78, 7.2 before 7.2(4)16, 8.0 before 8.0(4)6, and 8.1 before 8.1(1)13, when configured as a VPN using Microsoft Windows NT Domain…

  • CVE-2008-2469Oct 23, 2008
    Libspf
    Libspf2
    risk 0.05cvss —epss 0.22

    Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to execute arbitrary code via a long DNS TXT record with a modified length field.

  • CVE-2007-4349Oct 23, 2008
    Microfocus
    OpenView Performance Agent
    risk 0.00cvss —epss 0.03

    The Shared Trace Service (aka OVTrace) in HP Performance Agent C.04.70 (aka 4.70), HP OpenView Performance Agent C.04.60 and C.04.61, HP Reporter 3.8, and HP OpenView Reporter 3.7 (aka Report 3.70) allows remote attackers to cause a denial of service via an unspecified series of…

  • CVE-2008-4721Oct 23, 2008
    Phpjabbers
    Post Comment
    risk 0.03cvss —epss 0.03

    PHP Jabbers Post Comment 3.0 allows remote attackers to bypass authentication and gain administrative access by setting the PostCommentsAdmin cookie to "logged."

  • CVE-2008-4720Oct 23, 2008
    Arzdev
    Gemini Portal
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in The Gemini Portal 4.7 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to (1) page/forums/bottom.php and (2) page/forums/category.php.

  • CVE-2008-4719Oct 23, 2008
    Openengine
    Openengine
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in cms/classes/openengine/filepool.php in openEngine 2.0 beta2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the oe_classpath parameter, a different vector than CVE-2008-4329.

  • CVE-2008-4718Oct 23, 2008
    X7 Chat
    X7 Chat
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in help/mini.php in X7 Chat 2.0.1 A1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the help_file parameter, a different vector than CVE-2006-2156.

  • CVE-2008-4717Oct 23, 2008
    Zeeways
    Zeelyrics
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in bannerclick.php in ZEELYRICS 2.0 allows remote attackers to execute arbitrary SQL commands via the adid parameter.

  • CVE-2008-4716Oct 23, 2008
    Bitmixsoft
    PHP Lance
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in show.php in BitmixSoft PHP-Lance 1.52 allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2008-4715Oct 23, 2008
    Joomla
    com_jpad
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Jpad (com_jpad) 1.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter to index.php.

  • CVE-2008-4714Oct 23, 2008
    Atomic Photo Album
    Atomic Photo Album
    risk 0.03cvss —epss 0.03

    Atomic Photo Album 1.1.0 pre4 does not properly handle the apa_cookie_login and apa_cookie_password cookies, which probably allows remote attackers to bypass authentication and gain administrative access via modified cookies.

  • CVE-2008-4713Oct 23, 2008
    212cafe
    Board
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in view.php in 212cafe Board 0.07 allows remote attackers to execute arbitrary SQL commands via the qID parameter.

  • CVE-2008-4712Oct 23, 2008
    Lnblog
    Lnblog
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in pages/showblog.php in LnBlog 0.9.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the plugin parameter.

  • CVE-2008-4711Oct 23, 2008
    Joovili
    Joovili
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Joovili 3.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) view.blog.php, (2) view.event.php, (3) view.group.php, (4) view.music.php, (5) view.picture.php, and…

  • CVE-2008-4710Oct 23, 2008
    Drupal
    Stock 6.x
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the stock quotes page in Stock 6.x before 6.x-1.0, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-4709Oct 23, 2008
    Pilotgroup
    Etraining
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news_read.php in Pilot Group (PG) eTraining allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-4708Oct 23, 2008
    BbZL.PhP
    BbZL.PhP
    risk 0.03cvss —epss 0.03

    BbZL.PhP 0.92 allows remote attackers to bypass authentication and gain administrative access by setting the phorum_admin_session cookie to 1.

  • CVE-2008-4707Oct 23, 2008
    BbZL.PhP
    BbZL.PhP
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in BbZL.PhP 0.92 allows remote attackers to access unauthorized directories via a .. (dot dot) in the lien_2 parameter.

  • CVE-2008-4706Oct 23, 2008
    Jelsoft
    Vbgooglemap
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in VBGooglemap Hotspot Edition 1.0.3, a vBulletin module, allows remote attackers to execute arbitrary SQL commands via the mapid parameter in a showdetails action to (1) vbgooglemaphse.php and (2) mapa.php.

  • CVE-2008-4705Oct 23, 2008
    MyPHPDating
    MyPHPDating
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in success_story.php in php Online Dating Software MyPHPDating allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-4704Oct 23, 2008
    Mitre
    Sezhoo
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in SezHooTabsAndActions.php in SezHoo 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the IP parameter.

  • CVE-2008-4703Oct 23, 2008
    Bosdev
    Bosnews
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.php in BosDev BosNews 4.0 allows remote attackers to execute arbitrary SQL commands via the article parameter.

  • CVE-2008-4702Oct 22, 2008
    Phpwebgallery
    Phpwebgallery
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in PhpWebGallery 1.3.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) user[language] and (2) user[template] parameters to (a) init.inc.php, and (b) the user[language] parameter to…

  • CVE-2008-4701Oct 22, 2008
    Libera
    Libera CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin.php in Libera CMS 1.12, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the libera_staff_user cookie parameter, a different vector than CVE-2008-4700. NOTE: the provenance of this information…

  • CVE-2008-4700Oct 22, 2008
    Libera
    Libera CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin.php in Libera CMS 1.12 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the libera_staff_pass cookie parameter.

  • CVE-2008-4699Oct 22, 2008
    Microsoft
    Peachtree Accounting
    risk 0.05cvss —epss 0.27

    Insecure method vulnerability in the ActiveX control (PAWWeb11.ocx) in Peachtree Accounting 2004 allows remote attackers to execute arbitrary programs via the ExecutePreferredApplication method.

  • CVE-2008-4693Oct 22, 2008
    IBM
    Db2
    risk 0.00cvss —epss 0.01

    The SORT/LIST SERVICES component in IBM DB2 9.1 before FP6 and 9.5 before FP2 writes sensitive information to the trace output, which allows attackers to obtain sensitive information by reading "PASSWORD-RELATED CONNECTION STRING KEYWORD VALUES."