VYPR

CVEs

344,987 total · page 6254 of 6,900

AllCriticalHighKEV
  • CVE-2008-4080Sep 15, 2008
    Stash
    Stash
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in Stash 1.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the (1) username parameter to admin/library/authenticate.php and the (2) download parameter to downloadmp3.php. NOTE: some of these…

  • CVE-2008-4079Sep 15, 2008
    Movabletype
    Movable Type Enterprise
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Movable Type (MT) 4.x through 4.20, and 3.36 and earlier; Movable Type Enterprise 4.x through 4.20, and 1.54 and earlier; and Movable Type Community Solution allows remote attackers to inject arbitrary web script or HTML via…

  • CVE-2008-4078Sep 15, 2008
    Ledgersmb
    Ledgersmb
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the AR/AP transaction report in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-4077Sep 15, 2008
    Ledgersmb
    Ledgersmb
    risk 0.00cvss —epss 0.03

    The CGI scripts in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allow remote attackers to cause a denial of service (resource exhaustion) via an HTTP POST request with a large Content-Length.

  • CVE-2008-4076Sep 15, 2008
    Tor World
    Interactive Bbs
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in (1) Tor World Tor Board 1.3 and earlier, (2) Topics BBS 1.11 and earlier, (3) Simple BBS 1.86 and earlier, and (4) Interactive BBS 1.57 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors,…

  • CVE-2008-4075Sep 15, 2008
    Dino
    D Iscussion Board
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in D-iscussion Board 3.01 allows remote attackers to read arbitrary files via a .. (dot dot) in the topic parameter.

  • CVE-2008-4074Sep 15, 2008
    Zanfi Solutions
    Autodealers CMS Autonline
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Zanfi Autodealers CMS AutOnline allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.

  • CVE-2008-4073Sep 15, 2008
    Zanfi Solutions
    Autodealers CMS Autonline
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Zanfi Autodealers CMS AutOnline allows remote attackers to execute arbitrary SQL commands via the pageid parameter in a DBpAGE action.

  • CVE-2008-4072Sep 15, 2008
    Phsblog
    Phsblog
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in phsBlog 0.2 allow remote attackers to execute arbitrary SQL commands via (1) the sid parameter in a pickup action or (2) the sql_cid parameter, different vectors than CVE-2008-3588.

  • CVE-2008-4071Sep 15, 2008
    Adobe Inc.
    Acrobat
    risk 0.04cvss —epss 0.12

    A certain ActiveX control in Adobe Acrobat 9, when used with Microsoft Windows Vista and Internet Explorer 7, allows remote attackers to cause a denial of service (browser crash) via an src property value with an invalid acroie:// URL.

  • CVE-2008-3889Sep 12, 2008
    Postfix
    Postfix
    risk 0.00cvss —epss 0.01

    Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6 kernel, leaks epoll file descriptors during execution of "non-Postfix" commands, which allows local users to cause a denial of service (application slowdown or exit) via a…

  • CVE-2008-3824Sep 12, 2008
    Popoon
    Popoon
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in (1) Text_Filter/Filter/xss.php in Horde 3.1.x before 3.1.9 and 3.2.x before 3.2.2 and (2) externalinput.php in Popoon r22196 and earlier allows remote attackers to inject arbitrary web script or HTML by using / (slash) characters as…

  • CVE-2008-3823Sep 12, 2008
    Horde (software)
    Horde
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in MIME/MIME/Contents.php in the MIME library in Horde 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via the filename of a MIME attachment in an e-mail message.

  • CVE-2008-3529Sep 12, 2008
    Xmlsoft
    Libxml2
    risk 0.05cvss —epss 0.23

    Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.

  • CVE-2008-3274Sep 12, 2008
    Freeipa
    Freeipa
    risk 0.00cvss —epss 0.02

    The default configuration of Red Hat Enterprise IPA 1.0.0 and FreeIPA before 1.1.1 places ldap:///anyone on the read ACL for the krbMKey attribute, which allows remote attackers to obtain the Kerberos master key via an anonymous LDAP query.

  • CVE-2008-2932Sep 12, 2008
    Red Hat
    Adminutil
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in Red Hat adminutil 1.1.6 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via % (percent) encoded HTTP input to unspecified CGI scripts in Fedora Directory Server. NOTE: this vulnerability exists…

  • CVE-2008-4057Sep 11, 2008
    Objective Development
    Sharity
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Objective Development Sharity 3 before 3.5 has unknown impact and attack vectors, related to a "serious security problem."

  • CVE-2008-4056Sep 11, 2008
    Matterdaddy
    Market
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin/login.php in Matterdaddy Market 1.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-4055Sep 11, 2008
    Texmedia
    Million Pixel Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in tops_top.php in Million Pixel Ad Script (Million Pixel Script) allows remote attackers to execute arbitrary SQL commands via the id_cat parameter.

  • CVE-2008-4054Sep 11, 2008
    Kolifa
    Download Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in indir.php in Kolifa.net Download Script 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-4053Sep 11, 2008
    Bluemoon
    Popnupblog
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in the Bluemoon PopnupBLOG module 3.20 and 3.30 for XOOPS allow remote attackers to inject arbitrary web script or HTML via the (1) param, (2) cat_id, and (3) view parameters.

  • CVE-2008-4052Sep 11, 2008
    OpenVMS
    OpenVMS
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in SMGSHR.EXE in OpenVMS for Integrity Servers 8.2-1, 8.3, and 8.3-1H1 and OpenVMS ALPHA 7.3-2, 8.2, and 8.3 allows local users to cause a denial of service (crash) or gain privileges via unspecified vectors.

  • CVE-2008-4051Sep 11, 2008
    Jandus Technologies
    Smart Survey
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in surveyresults.asp in Smart Survey 1.0 allows remote attackers to inject arbitrary web script or HTML via the sid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-4050Sep 11, 2008
    Friendly Technologies
    Friendly Pppoe Client
    risk 0.04cvss —epss 0.07

    A certain ActiveX control in fwRemoteCfg.dll 3.3.3.1 in Friendly Technologies FriendlyPPPoE Client 3.0.0.57 allows remote attackers to (1) create and read arbitrary registry values via the RegistryValue method, and (2) read arbitrary files via the GetTextFile method.

  • CVE-2008-4049Sep 11, 2008
    Friendly Technologies
    Friendly Pppoe Client
    risk 0.03cvss —epss 0.04

    A certain ActiveX control in fwRemoteCfg.dll 3.3.3.1 in Friendly Technologies FriendlyPPPoE Client 3.0.0.57 allows remote attackers to execute arbitrary programs via arguments to the RunApp method.

  • CVE-2008-4048Sep 11, 2008
    Friendly Technologies
    Friendly Pppoe Client
    risk 0.04cvss —epss 0.07

    Heap-based buffer overflow in a certain ActiveX control in fwRemoteCfg.dll 3.3.3.1 in Friendly Technologies FriendlyPPPoE Client 3.0.0.57 allows remote attackers to execute arbitrary code via a long third argument to the CreateURLShortcut method.

  • CVE-2008-4047Sep 11, 2008
    Novell
    Forum
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Novell Forum (formerly SiteScape Forum) 7.0, 7.1, 7.2, 7.3, and 8.0 allows remote attackers to execute arbitrary TCL code via a modified URL. NOTE: this might overlap CVE-2007-6515.

  • CVE-2008-4046Sep 11, 2008
    Elitecms
    Elitecms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in eliteCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2008-4045Sep 11, 2008
    Mail
    Mail
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in @Mail 5.42 allow remote attackers to inject arbitrary web script or HTML via the (1) file and (2) HelpFile parameters to parse.php, the (3) Folder and (4) start parameters to showmail.php, and the (5) abookview parameter to…

  • CVE-2008-4044Sep 11, 2008
    AJ Square
    Aj Hyip
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in article/readarticle.php in AJ Square aj-hyip (aka AJ HYIP Acme) allows remote attackers to execute arbitrary SQL commands via the artid parameter.

  • CVE-2008-4043Sep 11, 2008
    AJ Square
    Aj Hyip
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in AJ Square AJ HYIP Acme allow remote attackers to execute arbitrary SQL commands via the artid parameter to (1) acme/article/comment.php and (2) prime/article/comment.php.

  • CVE-2008-4041Sep 11, 2008
    Softalk
    Mail Server
    risk 0.03cvss —epss 0.02

    The IMAP server in Softalk Mail Server (formerly WorkgroupMail) 8.5.1.431 allows remote authenticated users to cause a denial of service (resource consumption and daemon crash) via a long IMAP APPEND command with certain repeated parameters.

  • CVE-2008-4040Sep 11, 2008
    Kyocera
    Command Center
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the Kyocera Command Center in Kyocera FS-118MFP allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

  • CVE-2008-4039Sep 11, 2008
    Spice Classifieds
    Spice Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Spice Classifieds allows remote attackers to execute arbitrary SQL commands via the cat_path parameter.

  • CVE-2008-3584Sep 11, 2008
    NetBSD
    NetBSD
    risk 0.00cvss —epss 0.03

    NetBSD 3.0, 3.1, and 4.0, when a pppoe instance exists, does not properly check the length of a PPPoE packet tag, which allows remote attackers to cause a denial of service (system crash) via a crafted PPPoE packet.

  • CVE-2008-4018Sep 11, 2008
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    swcons in bos.rte.console in IBM AIX 5.2.0 through 6.1.1 allows local users in the system group to create or overwrite an arbitrary file, and establish weak permissions and root ownership for this file, via unspecified vectors. NOTE: this can be leveraged to gain privileges.…

  • CVE-2008-3972Sep 11, 2008
    Opensc Project
    Opensc
    risk 0.00cvss —epss 0.00

    pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by…

  • CVE-2008-3971Sep 11, 2008
    Gmanedit2
    Gmanedit
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in the open_man_file function in callbacks.c in gmanedit 0.4.1 allows remote attackers to execute arbitrary code via a crafted man page, which is not properly handled during utf8 conversion. NOTE: another overflow was reported using a configuration…

  • CVE-2008-3970Sep 11, 2008
    Pam Mount
    Pam Mount
    risk 0.00cvss —epss 0.00

    pam_mount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volume, which allows local users to bypass intended access restrictions via a local mount.

  • CVE-2008-3969Sep 11, 2008
    Bitlbee
    Bitlbee
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknown vectors related to "inconsistent handling of the USTATUS_IDENTIFIED state." NOTE: this issue exists because of an incomplete fix for…

  • CVE-2008-3968Sep 11, 2008
    Punbb
    Punbb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in userlist.php in PunBB before 1.2.20 allows remote attackers to inject arbitrary web script or HTML via the p parameter.

  • CVE-2008-3967Sep 11, 2008
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    moderation.php in MyBB (aka MyBulletinBoard) before 1.4.1 does not properly check for moderator privileges, which has unknown impact and remote attack vectors.

  • CVE-2008-3966Sep 11, 2008
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via (1) a certain referrer field in usercp2.php, (2) a certain location field in inc/functions_online.php, and certain (3)…

  • CVE-2008-3965Sep 11, 2008
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.4.1 allows remote attackers to execute arbitrary SQL commands via a certain editor field.

  • CVE-2008-3964Sep 11, 2008
    Libpng
    Libpng
    risk 0.00cvss —epss 0.03

    Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a PNG image with crafted zTXt chunks, related to (1) the png_push_read_zTXt function…

  • CVE-2008-3963Sep 11, 2008
    MySQL
    MySQL
    risk 0.04cvss —epss 0.06

    MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.

  • CVE-2008-3962Sep 11, 2008
    Ssmtp
    Ssmtp
    risk 0.00cvss —epss 0.02

    The from_format function in ssmtp.c in ssmtp 2.61 and 2.62, in certain configurations, uses uninitialized memory for the From: field of an e-mail message, which might allow remote attackers to obtain sensitive information (memory contents) in opportunistic circumstances by…

  • CVE-2008-3960Sep 11, 2008
    IBM
    DB2 UDB
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the JDBC Applet Server Service (aka db2jds) in IBM DB2 UDB 8 before Fixpak 17 allows remote attackers to cause a denial of service (service crash) via "malicious packets."

  • CVE-2008-3959Sep 11, 2008
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    IBM DB2 UDB 8.1 before FixPak 16, 8.2 before FixPak 9, and 9.1 before FixPak 4a allows remote attackers to cause a denial of service (instance crash) via a crafted SQLJRA packet within a CONNECT/ATTACH data stream that simulates a V7 client connect/attach request.

  • CVE-2008-3958Sep 11, 2008
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    IBM DB2 UDB 8 before Fixpak 17 allows remote attackers to cause a denial of service (instance crash) via a crafted CONNECT/ATTACH data stream that simulates a V7 client connect/attach request. NOTE: this may overlap CVE-2008-3858. NOTE: this issue exists because of an…