VYPR

CVEs

344,987 total · page 6250 of 6,900

AllCriticalHighKEV
  • CVE-2008-4297Sep 27, 2008
    Mercurial
    Mercurial
    risk 0.00cvss —epss 0.03

    Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request.

  • CVE-2008-4296Sep 27, 2008
    Linksys
    Wrt350n
    risk 0.00cvss —epss 0.02

    The Cisco Linksys WRT350N with firmware 1.0.3.7 has "admin" as its default password for the "admin" account, which makes it easier for remote attackers to obtain access.

  • CVE-2008-4295Sep 27, 2008
    Microsoft
    Windows Mobile
    risk 0.05cvss —epss 0.30

    Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to establish a Bluetooth connection to a peer with a long name, which allows remote attackers to cause a denial of service (device reboot) by configuring a Bluetooth…

  • CVE-2008-4294Sep 27, 2008
    IBM
    Tivoli Netcool Webtop
    risk 0.00cvss —epss 0.00

    IBM Tivoli Netcool/Webtop 2.1 before 2.1.0.5 preserves cached user privileges after logout, which allows physically proximate attackers to hijack a session by visiting an unattended workstation, as demonstrated by a root session that is still valid after a subsequent read-only…

  • CVE-2008-4293Sep 27, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Opera before 9.52 on Windows, when registered as a protocol handler, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors in which Opera is launched by other applications.

  • CVE-2008-4292Sep 27, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown impact and attack vectors. NOTE: it is not clear whether this is a vulnerability, but the vendor included it in a security section of the advisory.

  • CVE-2008-4200Sep 27, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Opera before 9.52 does not ensure that the address field of a news feed represents the feed's actual URL, which allows remote attackers to change this field to display the URL of a page containing web script controlled by the attacker.

  • CVE-2008-4199Sep 27, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Opera before 9.52 does not prevent use of links from web pages to feed source files on the local disk, which might allow remote attackers to determine the validity of local filenames via vectors involving "detection of JavaScript events and appropriate manipulation."

  • CVE-2008-4198Sep 27, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Opera before 9.52, when rendering an http page that has loaded an https page into a frame, displays a padlock icon and offers a security information dialog reporting a secure connection, which might allow remote attackers to trick a user into performing unsafe actions on the…

  • CVE-2008-4197HigSep 27, 2008
    Opera
    Opera
    risk 0.58cvss 8.8epss 0.06

    Opera before 9.52 on Windows, Linux, FreeBSD, and Solaris, when processing custom shortcut and menu commands, can produce argument strings that contain uninitialized memory, which might allow user-assisted remote attackers to execute arbitrary code or conduct other attacks via…

  • CVE-2008-4196Sep 27, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Opera before 9.52 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-4195Sep 27, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 9.52 does not properly restrict the ability of a framed web page to change the address associated with a different frame, which allows remote attackers to trigger the display of an arbitrary address in a frame via unspecified use of web script.

  • CVE-2008-4119Sep 27, 2008
    Ca
    Cmdb
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in CA Service Desk 11.2 and CMDB 11.0 through 11.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "multiple web forms."

  • CVE-2008-4070Sep 27, 2008
    Mozilla Corporation
    Thunderbird
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long header in a news article, related to "canceling [a] newsgroup…

  • CVE-2008-3528Sep 27, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The error-reporting functionality in (1) fs/ext2/dir.c, (2) fs/ext3/dir.c, and possibly (3) fs/ext4/dir.c in the Linux kernel 2.6.26.5 does not limit the number of printk console messages that report directory corruption, which allows physically proximate attackers to cause a…

  • CVE-2008-3813Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco IOS 12.2 and 12.4, when the L2TP mgmt daemon process is enabled, allows remote attackers to cause a denial of service (device reload) via a crafted L2TP packet.

  • CVE-2008-3812Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Cisco IOS 12.4, when IOS firewall Application Inspection Control (AIC) with HTTP Deep Packet Inspection is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed HTTP transit packet.

  • CVE-2008-3811Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.2 and 12.4, when NAT Skinny Call Control Protocol (SCCP) Fragmentation Support is enabled, allows remote attackers to cause a denial of service (device reload) via segmented SCCP messages, aka Cisco Bug ID CSCsi17020, a different vulnerability than CVE-2008-3810.

  • CVE-2008-3810Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.2 and 12.4, when NAT Skinny Call Control Protocol (SCCP) Fragmentation Support is enabled, allows remote attackers to cause a denial of service (device reload) via segmented SCCP messages, aka CSCsg22426, a different vulnerability than CVE-2008-3811.

  • CVE-2008-3809Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Cisco IOS 12.0 through 12.4 on Gigabit Switch Router (GSR) devices (aka 12000 Series routers) allows remote attackers to cause a denial of service (device crash) via a malformed Protocol Independent Multicast (PIM) packet.

  • CVE-2008-3808Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of service (device reload) via a crafted Protocol Independent Multicast (PIM) packet.

  • CVE-2008-3807Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.04

    Cisco IOS 12.2 and 12.3 on Cisco uBR10012 series devices, when linecard redundancy is configured, enables a read/write SNMP service with "private" as the community, which allows remote attackers to obtain administrative access by guessing this community and sending SNMP requests.

  • CVE-2008-3806Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Cisco IOS 12.0 through 12.4 on Cisco 10000, uBR10012 and uBR7200 series devices handles external UDP packets that are sent to 127.0.0.0/8 addresses intended for IPC communication within the device, which allows remote attackers to cause a denial of service (device or linecard…

  • CVE-2008-3805Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Cisco IOS 12.0 through 12.4 on Cisco 10000, uBR10012 and uBR7200 series devices handles external UDP packets that are sent to 127.0.0.0/8 addresses intended for IPC communication within the device, which allows remote attackers to cause a denial of service (device or linecard…

  • CVE-2008-3804Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the Multi Protocol Label Switching (MPLS) Forwarding Infrastructure (MFI) in Cisco IOS 12.2 and 12.4 allows remote attackers to cause a denial of service (memory corruption) via crafted packets for which the software path is used.

  • CVE-2008-3803Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    A "logic error" in Cisco IOS 12.0 through 12.4, when a Multiprotocol Label Switching (MPLS) VPN with extended communities is configured, sometimes causes a corrupted route target (RT) to be used, which allows remote attackers to read traffic from other VPNs in opportunistic…

  • CVE-2008-3802Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4, when VoIP is configured, allows remote attackers to cause a denial of service (device reload) via unspecified valid SIP messages, aka Cisco bug ID CSCsk42759, a…

  • CVE-2008-3801Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows remote attackers to cause a denial of service (device or process reload) via…

  • CVE-2008-3800Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows remote attackers to cause a denial of service (device or process reload) via…

  • CVE-2008-3799Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Memory leak in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4, when VoIP is configured, allows remote attackers to cause a denial of service (memory consumption and voice-service outage) via unspecified valid SIP messages.

  • CVE-2008-3798Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Cisco IOS 12.4 allows remote attackers to cause a denial of service (device crash) via a normal, properly formed SSL packet that occurs during termination of an SSL session.

  • CVE-2008-3638Sep 26, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Java on Apple Mac OS X 10.5.4 and 10.5.5 does not prevent applets from accessing file:// URLs, which allows remote attackers to execute arbitrary programs.

  • CVE-2008-3637HigSep 26, 2008
    Apple Inc.
    Mac OS X
    risk 0.58cvss 8.8epss 0.06

    The Hash-based Message Authentication Code (HMAC) provider in Java on Apple Mac OS X 10.4.11, 10.5.4, and 10.5.5 uses an uninitialized variable, which allows remote attackers to execute arbitrary code via a crafted applet, related to an "error checking issue."

  • CVE-2008-2739Sep 26, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    The SERVICE.DNS signature engine in the Intrusion Prevention System (IPS) in Cisco IOS 12.3 and 12.4 allows remote attackers to cause a denial of service (device crash or hang) via network traffic that triggers unspecified IPS signatures, a different vulnerability than…

  • CVE-2008-4247Sep 25, 2008
    FreeBSD
    FreeBSD
    risk 0.03cvss —epss 0.04

    ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via…

  • CVE-2008-4246Sep 25, 2008
    Denora Irc Stats
    Denora Irc Stats
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Denora IRC Stats Server before 1.4.1 allows remote IRC servers to cause a denial of service (application crash) via a crafted CTCP response.

  • CVE-2008-4245Sep 25, 2008
    Rianxosencabos CMS
    CMS
    risk 0.03cvss —epss 0.02

    The Admin Control Panel in Rianxosencabos CMS 0.9 does not require administrator privileges, which allows remote authenticated users to (1) change a user's privileges, (2) delete a user account, or perform unspecified other administrative actions via vectors involving an admin…

  • CVE-2008-4244Sep 25, 2008
    Rianxosencabos CMS
    CMS
    risk 0.03cvss —epss 0.03

    Rianxosencabos CMS 0.9 allows remote attackers to bypass authentication and gain administrative access by setting the usuario and pass cookies to 1.

  • CVE-2008-4243Sep 25, 2008
    Epic Games
    Unreal Tournament 3
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in ImageServer (aka UTImageServer) in WebAdmin before 1.7 for Epic Games Unreal Tournament 3 (UT3) 1.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

  • CVE-2008-4242Sep 25, 2008
    Proftpd
    Proftpd
    risk 0.01cvss —epss 0.07

    ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client…

  • CVE-2008-4241Sep 25, 2008
    Cj
    Ultra Plus
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in CJ Ultra Plus 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via an SID cookie.

  • CVE-2008-4069Sep 24, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The XBM decoder in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to read uninitialized memory, and possibly obtain sensitive information in opportunistic circumstances, via a crafted XBM image file.

  • CVE-2008-4068Sep 24, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass "restrictions imposed on local HTML files," and obtain sensitive information and prompt users to…

  • CVE-2008-4067Sep 24, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a .. (dot dot) and URL-encoded / (slash) characters in a resource: URI.

  • CVE-2008-4066Sep 24, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are ignored by the HTML parser, as demonstrated by a…

  • CVE-2008-4065Sep 24, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via byte order mark (BOM) characters that are removed from…

  • CVE-2008-4064Sep 24, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to graphics rendering and (1) handling of a long alert…

  • CVE-2008-4063Sep 24, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the layout engine and (1) a zero value of the "this"…

  • CVE-2008-4062Sep 24, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code…

  • CVE-2008-4061Sep 24, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Integer overflow in the MathML component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary…