VYPR

CVEs

344,987 total · page 6249 of 6,900

AllCriticalHighKEV
  • CVE-2008-4355Sep 30, 2008
    Powie
    Pforum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in showprofil.php in Powie PSCRIPT Forum (aka PHP Forum or pForum) 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-4354Sep 30, 2008
    Netartmedia
    Iboutique
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the products module in NetArt Media iBoutique 4.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter to index.php.

  • CVE-2008-4353Sep 30, 2008
    Linkarity
    Linkarity
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in link.php in Linkarity allows remote attackers to execute arbitrary SQL commands via the cat_id parameter. NOTE: although one component of Linkarity is distributable PHP code, this issue might be site-specific. If so, it should not be included in…

  • CVE-2008-4352Sep 30, 2008
    Phpsmartcom
    Phpsmartcom
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in inc/pages/viewprofile.php in phpSmartCom 0.2 allows remote attackers to execute arbitrary SQL commands via the uid parameter in a viewprofile action to index.php.

  • CVE-2008-4351Sep 30, 2008
    Phpsmartcom
    Phpsmartcom
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in phpSmartCom 0.2 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the p parameter.

  • CVE-2008-4350Sep 30, 2008
    Vblogix
    Tutorial Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in main.php in vbLOGIX Tutorial Script 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.

  • CVE-2008-4349Sep 30, 2008
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in news.php in s0nic Paranews 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) page parameter in a details action.

  • CVE-2008-4348Sep 30, 2008
    Outshine
    Phportfolio
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in photo.php in PHPortfolio, possibly 1.3, allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-4347Sep 30, 2008
    Powie
    Pnews
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in newskom.php in Powie pNews 2.03 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.

  • CVE-2008-4346Sep 30, 2008
    Talkback
    Talkback
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in TalkBack 2.3.6 and 2.3.6.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter to comments.php, a different vector than CVE-2008-3371.

  • CVE-2008-4345Sep 30, 2008
    Webportal
    Webportal CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in download.php in WebPortal CMS 0.7.4 and earlier allows remote attackers to execute arbitrary SQL commands via the aid parameter.

  • CVE-2008-4344Sep 30, 2008
    6rbscript
    6rbscript
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in cat.php in 6rbScript allows remote attackers to execute arbitrary SQL commands via the CatID parameter.

  • CVE-2008-4343Sep 30, 2008
    Chilkatsoft
    ChilkatUtil.CkData.1
    risk 0.04cvss —epss 0.09

    The Chilkat XML ChilkatUtil.CkData.1 ActiveX control (ChilkatUtil.dll) 3.0.3.0 and earlier allows remote attackers to create, overwrite, and modify arbitrary files for execution via a call to the (1) SaveToFile, (2) SaveToTempFile, or (3) AppendBinary method. NOTE: this issue…

  • CVE-2008-4342Sep 30, 2008
    NuMedia Soft
    NMS DVD Burning SDK ActiveX NMSDVDX.DVDEngineX.1 ActiveX control
    risk 0.04cvss —epss 0.17

    NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1.976, BurnAware 2.1.3, Blaze Media Pro 8.02 Special Edition, and possibly other products, allows remote attackers to overwrite and create…

  • CVE-2008-4341Sep 30, 2008
    Myblog
    Myblog
    risk 0.03cvss —epss 0.03

    add.php in MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication and gain administrative access by setting a cookie with admin=yes and login=admin.

  • CVE-2008-4340Sep 30, 2008
    Google
    Chrome
    risk 0.03cvss —epss 0.04

    Google Chrome 0.2.149.29 and 0.2.149.30 allows remote attackers to cause a denial of service (memory consumption) via an HTML document containing a carriage return ("\r\n\r\n") argument to the window.open function.

  • CVE-2008-4339Sep 30, 2008
    Symantec
    Netbackup
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Java Administration GUI (jnbSA) in Symantec Veritas NetBackup Server and NetBackup Enterprise Server 5.1 before MP7, 6.0 before MP7, and 6.5 before 6.5.2 allows remote authenticated users to gain privileges via unknown attack vectors related to…

  • CVE-2008-4338Sep 30, 2008
    Drupal
    Brilliant Gallery
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the brilliant_gallery_checklist_save function in the bgchecklist/save script in Brilliant Gallery 5.x and 6.x, a module for Drupal, allows remote authenticated users with "access brilliant_gallery" permissions to execute arbitrary SQL commands via…

  • CVE-2008-4337Sep 30, 2008
    Bitweaver
    Bitweaver
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Bitweaver 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to (1) edit.php and (2) list.php in articles/; (3) list_blogs.php and (4) rankings.php in blogs/; (5) calendar/index.php; (6)…

  • CVE-2008-4336Sep 30, 2008
    Atomic Photo Album
    Atomic Photo Album
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in album.php in Atomic Photo Album (APA) 1.1.0pre4 allows remote attackers to inject arbitrary web script or HTML via the apa_album_ID parameter.

  • CVE-2008-4335Sep 30, 2008
    Atomic Photo Album
    Atomic Photo Album
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in album.php in Atomic Photo Album (APA) 1.1.0pre4 allows remote attackers to execute arbitrary SQL commands via the apa_album_ID parameter.

  • CVE-2008-4334Sep 30, 2008
    PHP
    infoBoard
    risk 0.03cvss —epss 0.02

    PHP infoBoard V.7 Plus allows remote attackers to bypass authentication and gain administrative access by setting the infouser cookie to 1.

  • CVE-2008-4333Sep 30, 2008
    PHP InfoBoard
    PHP infoBoard
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in PHP infoBoard V.7 Plus allows remote attackers to inject arbitrary web script or HTML via the isname parameter in a newtopic action.

  • CVE-2008-4332Sep 30, 2008
    PHP InfoBoard
    PHP infoBoard
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the showjavatopic function in func.php in PHP infoBoard V.7 Plus allows remote attackers to execute arbitrary SQL commands via the idcat parameter to showtopic.php.

  • CVE-2008-4331Sep 30, 2008
    Phpocs
    Phpocs
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in library/pagefunctions.inc.php in phpOCS 0.1 beta3 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to index.php.

  • CVE-2008-4330Sep 30, 2008
    Lansuite
    Lansuite
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in LanSuite 3.3.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the design parameter.

  • CVE-2008-4329Sep 30, 2008
    Openengine
    Openengine
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in cms/system/openengine.php in openEngine 2.0 beta4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the oe_classpath parameter.

  • CVE-2008-4328Sep 30, 2008
    Easyrealtorpro
    Easyrealtorpro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in site_search.php in EasyRealtorPRO 2008 allows remote attackers to execute arbitrary SQL commands via the (1) item, (2) search_ordermethod, and (3) search_order parameters.

  • CVE-2008-4094Sep 30, 2008
    Rubyonrails
    Rails
    risk 0.00cvss —epss 0.03

    Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.

  • CVE-2008-4327Sep 30, 2008
    Microsoft
    Windows Xp
    risk 0.04cvss —epss 0.16

    gdiplus.dll in GDI+ in Microsoft Windows XP SP3 does not properly handle crafted .ico files, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a certain crash.ico file on a web site, and allows user-assisted attackers to…

  • CVE-2008-4326Sep 30, 2008
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a "</script" sequence.

  • CVE-2008-4325Sep 30, 2008
    Viewvc
    Viewvc
    risk 0.00cvss —epss 0.01

    lib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HTTP response, which allows remote attackers to cause content to be misinterpreted by the browser via a content-type parameter that is inconsistent with the…

  • CVE-2008-4324Sep 29, 2008
    Mozilla Corporation
    Firefox
    risk 0.04cvss —epss 0.09

    The user interface event dispatcher in Mozilla Firefox 3.0.3 on Windows XP SP2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a series of keypress, click, onkeydown, onkeyup, onmousedown, and onmouseup events. NOTE: it…

  • CVE-2008-4323Sep 29, 2008
    Microsoft
    Windows Xp
    risk 0.04cvss —epss 0.09

    Windows Explorer in Microsoft Windows XP SP3 allows user-assisted attackers to cause a denial of service (application crash) via a crafted .ZIP file.

  • CVE-2008-4322Sep 29, 2008
    Realflex
    RealWin Server
    risk 0.08cvss —epss 0.65

    Stack-based buffer overflow in RealFlex Technologies Ltd. RealWin Server 2.0, as distributed by DATAC, allows remote attackers to execute arbitrary code via a crafted FC_INFOTAG/SET_CONTROL packet.

  • CVE-2008-4321Sep 29, 2008
    Flashget
    Flashget FTP
    risk 0.03cvss —epss 0.06

    Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long response to the PWD command.

  • CVE-2008-3827Sep 29, 2008
    MPlayer
    Mplayer
    risk 0.01cvss —epss 0.11

    Multiple integer underflows in the Real demuxer (demux_real.c) in MPlayer 1.0_rc2 and earlier allow remote attackers to cause a denial of service (process termination) and possibly execute arbitrary code via a crafted video file that causes the stream_read function to read or…

  • CVE-2008-4320Sep 29, 2008
    Opennms
    Opennms
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.5.94 allow remote attackers to inject arbitrary web script or HTML via (1) the j_username parameter to j_acegi_security_check, (2) the username parameter to notification/list.jsp, and (3) the filter…

  • CVE-2008-4319Sep 29, 2008
    Libra File Manager
    Libra File Manager
    risk 0.03cvss —epss 0.02

    fileadmin.php in Libra File Manager (aka Libra PHP File Manager) 1.18 and earlier allows remote attackers to bypass authentication, and read arbitrary files, modify arbitrary files, and list arbitrary directories, by inserting certain user and isadmin parameters in the query…

  • CVE-2008-4318Sep 29, 2008
    Project Observer
    Observer
    risk 0.04cvss —epss 0.14

    Observer 0.3.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter to (1) whois.php or (2) netcmd.php.

  • CVE-2008-4302MedSep 29, 2008
    Linux
    Kernel
    risk 0.39cvss 5.5epss 0.01

    fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru function, and subsequently attempts to unlock a page that was not locked, which allows local users to cause a denial of service (kernel BUG and…

  • CVE-2008-4301Sep 29, 2008
    Microsoft
    Internet Information Server
    risk 0.01cvss —epss 0.17

    A certain ActiveX control in iisext.dll in Microsoft Internet Information Services (IIS) allows remote attackers to set a password via a string argument to the SetPassword method. NOTE: this issue could not be reproduced by a reliable third party. In addition, the original…

  • CVE-2008-4300Sep 29, 2008
    Microsoft
    Internet Information Server
    risk 0.01cvss —epss 0.14

    A certain ActiveX control in adsiis.dll in Microsoft Internet Information Services (IIS) allows remote attackers to cause a denial of service (browser crash) via a long string in the second argument to the GetObject method. NOTE: this issue was disclosed by an unreliable…

  • CVE-2008-4299Sep 29, 2008
    Microsoft
    Internet Authentication Service Helper Com Component
    risk 0.01cvss —epss 0.16

    A certain ActiveX control in the Microsoft Internet Authentication Service (IAS) Helper COM Component in iashlpr.dll allows remote attackers to cause a denial of service (browser crash) via a large integer value in the first argument to the PutProperty method. NOTE: this issue…

  • CVE-2008-4210Sep 29, 2008
    Linux
    Kernel
    risk 0.03cvss —epss 0.02

    fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by…

  • CVE-2008-4192Sep 29, 2008
    Red Hat
    Cman
    risk 0.03cvss —epss 0.01

    The pserver_shutdown function in fence_egenera in cman 2.20080629 and 2.20080801 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/eglog temporary file.

  • CVE-2008-4120Sep 29, 2008
    Flatpress
    Flatpress
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in FlatPress 0.804 allow remote attackers to inject arbitrary web script or HTML via the (1) user or (2) pass parameter to login.php, or the (3) name parameter to contact.php.

  • CVE-2008-3524Sep 29, 2008
    Red Hat
    Initscripts
    risk 0.00cvss —epss 0.00

    rc.sysinit in initscripts before 8.76.3-1 on Fedora 9 and other Linux platforms allows local users to delete arbitrary files via a symlink attack on a file or directory under (1) /var/lock or (2) /var/run.

  • CVE-2008-2474Sep 29, 2008
    Abb
    Pcu400
    risk 0.01cvss —epss 0.08

    Buffer overflow in x87 before 3.5.5 in ABB Process Communication Unit 400 (PCU400) 4.4 through 4.6 allows remote attackers to execute arbitrary code via a crafted packet using the (1) IEC60870-5-101 or (2) IEC60870-5-104 communication protocol to the X87 web interface.

  • CVE-2008-4298Sep 27, 2008
    Lighttpd
    Lighttpd
    risk 0.00cvss —epss 0.04

    Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers.