VYPR

CVEs

344,987 total · page 6241 of 6,900

AllCriticalHighKEV
  • CVE-2008-4692Oct 22, 2008
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    The Native Managed Provider for .NET component in IBM DB2 8 before FP17, 9.1 before FP6, and 9.5 before FP2, when a definer cannot maintain objects, preserves views and triggers without marking them inoperative or dropping them, which has unknown impact and attack vectors.

  • CVE-2008-4691Oct 22, 2008
    IBM
    Db2
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the SQLNLS_UNPADDEDCHARLEN function in the New Compiler (aka Starburst derived compiler) component in the server in IBM DB2 9.1 before FP6 allows attackers to cause a denial of service (segmentation violation and trap) via unknown vectors.

  • CVE-2008-4690Oct 22, 2008
    Lynx
    Lynx
    risk 0.00cvss —epss 0.05

    lynx 2.8.6dev.15 and earlier, when advanced mode is enabled and lynx is configured as a URL handler, allows remote attackers to execute arbitrary commands via a crafted lynxcgi: URL, a related issue to CVE-2005-2929. NOTE: this might only be a vulnerability in limited…

  • CVE-2008-4689Oct 22, 2008
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.02

    Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions.

  • CVE-2008-4688Oct 22, 2008
    Mantisbt
    Mantis
    risk 0.01cvss —epss 0.12

    core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which allows remote attackers to discover an issue's title and status via a request with a modified issue number.

  • CVE-2008-4687Oct 22, 2008
    Mantisbt
    Mantis
    risk 0.08cvss —epss 0.67

    manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the multi_sort function in core/utility_api.php.

  • CVE-2008-4686Oct 22, 2008
    VideoLAN
    VLC media player
    risk 0.04cvss —epss 0.10

    Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, might allow remote attackers to execute arbitrary code via a crafted .ty file, a different vulnerability than CVE-2008-4654.

  • CVE-2008-4685Oct 22, 2008
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the dissect_q931_cause_ie function in packet-q931.c in the Q.931 dissector in Wireshark 0.10.3 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via certain packets that trigger an exception.

  • CVE-2008-4684Oct 22, 2008
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    packet-frame in Wireshark 0.99.2 through 1.0.3 does not properly handle exceptions thrown by post dissectors, which allows remote attackers to cause a denial of service (application crash) via a certain series of packets, as demonstrated by enabling the (1) PRP or (2) MATE post…

  • CVE-2008-4683Oct 22, 2008
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The dissect_btacl function in packet-bthci_acl.c in the Bluetooth ACL dissector in Wireshark 0.99.2 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via a packet with an invalid length, related to an erroneous tvb_memcpy call.

  • CVE-2008-4682Oct 22, 2008
    Wireshark
    Wireshark
    risk 0.04cvss —epss 0.09

    wtap.c in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application abort) via a malformed Tamos CommView capture file (aka .ncf file) with an "unknown/unexpected packet type" that triggers a failed assertion.

  • CVE-2008-4681Oct 22, 2008
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Bluetooth RFCOMM dissector in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via unknown packets.

  • CVE-2008-4680Oct 22, 2008
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    packet-usb.c in the USB dissector in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via a malformed USB Request Block (URB).

  • CVE-2008-4679Oct 22, 2008
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19, when Certificate Store Collections is configured to use Certificate Revocation Lists (CRL), does not call the setRevocationEnabled method on the…

  • CVE-2008-4678Oct 22, 2008
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    The HTTP_Request_Parser method in the HTTP Transport component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 allows remote attackers to cause a denial of service (controller 0C4 abend and application hang) via a long HTTP Host header, related to "storage…

  • CVE-2008-4677Oct 22, 2008
    Vim
    Netrw
    risk 0.00cvss —epss 0.02

    autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts,…

  • CVE-2008-4676Oct 22, 2008
    Citrix Systems
    Access Essentials
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Citrix XenApp (formerly Presentation Server) 4.5 Feature Pack 1 and earlier, Presentation Server 4.0, and Access Essentials 1.0, 1.5, and 2.0 allows local users to gain privileges via unknown attack vectors related to creating an unspecified file. …

  • CVE-2008-4675Oct 22, 2008
    Phpcounter
    Phpcounter
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in PHPcounter 1.3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the name parameter.

  • CVE-2008-4674Oct 22, 2008
    Phpstore
    Real Estate
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in realestate-index.php in Conkurent Real Estate Manager 1.01 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in browse mode.

  • CVE-2008-4673Oct 22, 2008
    Webbiscuits
    Events Calendar
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in panel/common/theme/default/header_setup.php in WebBiscuits Software Events Calendar 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the (1) path[docroot] and (2) component parameters.

  • CVE-2008-4672Oct 22, 2008
    Goodlyrics
    Lyrics Script
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search_results.php in buymyscripts Lyrics Script allows remote attackers to inject arbitrary web script or HTML via the k parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-4671Oct 22, 2008
    WordPress
    WordPress
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in wp-admin/wp-blogs.php in Wordpress MU (WPMU) before 2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) s and (2) ip_address parameters.

  • CVE-2008-4670Oct 22, 2008
    Ed Putal
    Clickbank Portal
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in Ed Pudol Clickbank Portal allows remote attackers to inject arbitrary web script or HTML via the search box. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-4669Oct 22, 2008
    Recipescript
    Recipe Script
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in Dan Fletcher Recipe Script allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-4668Oct 22, 2008
    Joomla
    com_imagebrowser
    risk 0.05cvss —epss 0.21

    Directory traversal vulnerability in the Image Browser (com_imagebrowser) 0.1.5 component for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the folder parameter to index.php.

  • CVE-2008-4667Oct 22, 2008
    Arabcms
    Arabcms
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in rss.php in ArabCMS 2.0 beta 1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the rss parameter.

  • CVE-2008-4666Oct 22, 2008
    Deeserver
    Ultimate Webboard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in webboard.php in Ultimate Webboard 3.00 allows remote attackers to execute arbitrary SQL commands via the Category parameter.

  • CVE-2008-4665Oct 22, 2008
    PG Matchmaking
    PG Matchmaking
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in PG Matchmaking allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) news_read.php and (2) gifts_show.php.

  • CVE-2008-4663Oct 22, 2008
    K's CGI
    Access Log Kaiseki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in analysis.cgi 1.44, as used in K's CGI Access Log Kaiseki (1) jcode.pl and (2) Jcode.pm, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-4662Oct 22, 2008
    Lokicms
    Lokicms
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in admin.php in LokiCMS 0.3.4, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.

  • CVE-2008-4664Oct 22, 2008
    QVOD Player
    Qvod Player
    risk 0.04cvss —epss 0.06

    Heap-based buffer overflow in QvodInsert.QvodCtrl.1 ActiveX control (QvodInsert.dll) in QVOD Player before 2.1.5 build 0053 allows remote attackers to execute arbitrary code via a long URL property. NOTE: some of these details are obtained from third party information.

  • CVE-2008-4661Oct 22, 2008
    TYPO3
    sm_pageimprovements
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Page Improvements (sm_pageimprovements) 1.1.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-4660Oct 22, 2008
    TYPO3
    M1 Intern
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the M1 Intern (m1_intern) 1.0.0 extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-4659Oct 22, 2008
    TYPO3
    Mannschaftsliste
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Mannschaftsliste (kiddog_playerlist) 1.0.3 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-4658Oct 22, 2008
    TYPO3
    Jobcontrol
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the JobControl (dmmjobcontrol) 1.15.4 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-4657Oct 22, 2008
    TYPO3
    Econda Plugin
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Econda Plugin (econda) 0.0.2 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-4656Oct 22, 2008
    TYPO3
    Frontend Users View
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Frontend Users View (feusersview) 0.1.6 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-4655Oct 22, 2008
    TYPO3
    Simplesurvey
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Simple survey (simplesurvey) 1.7.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-4654Oct 22, 2008
    VLC Media Player
    VLC Media Player
    risk 0.08cvss —epss 0.58

    Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4 allows remote attackers to execute arbitrary code via a TiVo TY media file with a header containing a crafted size value.

  • CVE-2008-4653Oct 22, 2008
    XOOPS
    Makale
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in makale.php in Makale 0.26 and possibly other versions, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2008-4652Oct 22, 2008
    Dart
    Powertcp FTP For Activex
    risk 0.04cvss —epss 0.10

    Buffer overflow in the ActiveX control (DartFtp.dll) in Dart Communications PowerTCP FTP for ActiveX 2.0.2 0 allows remote attackers to execute arbitrary code via a long SecretKey property.

  • CVE-2008-4651Oct 22, 2008
    Jetbox
    Jetbox CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Jetbox CMS 2.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby parameter to admin/cms/images.php and the (2) nav_id parameter in an editrecord action to admin/cms/nav.php.

  • CVE-2008-4650Oct 22, 2008
    Mywebland
    Myevent
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in viewevent.php in myEvent 1.6 allows remote attackers to execute arbitrary SQL commands via the eventdate parameter.

  • CVE-2008-4649Oct 22, 2008
    Elxis
    CMS
    risk 0.03cvss —epss 0.02

    Session fixation vulnerability in Elxis CMS 2008.1 revision 2204 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.

  • CVE-2008-4648Oct 22, 2008
    Elxis
    CMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Elxis CMS 2008.1 revision 2204 allows remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO or the (2) option, (3) Itemid, (4) id, (5) task, (6) bid, and (7) contact_id parameters. NOTE: the error…

  • CVE-2008-4647Oct 22, 2008
    Sweetcms
    Sweetcms
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in sweetCMS 1.5.2 allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2008-4646Oct 22, 2008
    Websense
    Websense Reporter Module
    risk 0.00cvss —epss 0.00

    The Websense Reporter Module in Websense Enterprise 6.3.2 stores the SQL database system administrator password in plaintext in CreateDbInstall.log, which allows local users to gain privileges to the database.

  • CVE-2008-4645Oct 22, 2008
    Phpwebgallery
    Phpwebgallery
    risk 0.04cvss —epss 0.07

    plugins/event_tracer/event_list.php in PhpWebGallery 1.7.2 and earlier allows remote authenticated administrators to execute arbitrary PHP code via PHP sequences in the sort parameter, which is processed by create_function.

  • CVE-2008-4644Oct 22, 2008
    Mywebland
    Mystats
    risk 0.03cvss —epss 0.03

    hits.php in myWebland myStats allows remote attackers to bypass IP address restrictions via a modified X-Forwarded-For HTTP header.

  • CVE-2008-4643Oct 22, 2008
    Mywebland
    Mystats
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in hits.php in myWebland myStats allows remote attackers to execute arbitrary SQL commands via the sortby parameter.