VYPR

CVEs

344,987 total · page 6257 of 6,900

AllCriticalHighKEV
  • CVE-2008-3525Sep 3, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The sbni_ioctl function in drivers/net/wan/sbni.c in the wan subsystem in the Linux kernel 2.6.26.3 does not check for the CAP_NET_ADMIN capability before processing a (1) SIOCDEVRESINSTATS, (2) SIOCDEVSHWSTATE, (3) SIOCDEVENSLAVE, or (4) SIOCDEVEMANSIPATE ioctl request, which…

  • CVE-2008-3536Sep 3, 2008
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to cause a denial of service via unknown vectors, a different vulnerability than CVE-2008-3537.

  • CVE-2008-3537Sep 3, 2008
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to cause a denial of service via unknown vectors, a different vulnerability than CVE-2008-3536.

  • CVE-2008-3691Sep 3, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7…

  • CVE-2008-3692Sep 3, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7…

  • CVE-2008-3693Sep 3, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7…

  • CVE-2008-3694Sep 3, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7…

  • CVE-2008-3695Sep 3, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7…

  • CVE-2008-3696Sep 3, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7…

  • CVE-2008-3697Sep 3, 2008
    VMware
    Server
    risk 0.00cvss —epss 0.03

    An unspecified ISAPI extension in VMware Server before 1.0.7 build 108231 allows remote attackers to cause a denial of service (IIS crash) via a malformed request.

  • CVE-2008-3698Sep 3, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the OpenProcess function in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7…

  • CVE-2008-3791Sep 3, 2008
    Lxde
    Lightweight X11 Desktop Environment
    risk 0.00cvss —epss 0.00

    src/main-win.c in GPicView 0.1.9 in Lightweight X11 Desktop Environment (LXDE) allows local users to overwrite arbitrary files via a symlink attack on the /tmp/rot.jpg temporary file.

  • CVE-2008-3792Sep 3, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4 does not verify that the SCTP-AUTH extension is enabled before proceeding with SCTP-AUTH API functions, which allows attackers to cause a denial of service…

  • CVE-2008-3891Sep 3, 2008
    Google
    Google Apps
    risk 0.00cvss —epss 0.01

    The SAML Single Sign-On (SSO) Service for Google Apps allows remote service providers to impersonate users at arbitrary service providers via vectors related to authentication responses that lack a request identifier and recipient field.

  • CVE-2008-3892Sep 3, 2008
    VMware
    Workstation
    risk 0.05cvss —epss 0.24

    Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before…

  • CVE-2008-3893MedSep 3, 2008
    Microsoft
    Windows
    risk 0.36cvss 5.5epss 0.01

    Microsoft Bitlocker in Windows Vista before SP1 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer during boot, which allows local users to obtain sensitive information by reading the physical memory locations associated with this…

  • CVE-2008-3894Sep 3, 2008
    IBM
    Lenovo firmware
    risk 0.00cvss —epss 0.00

    IBM Lenovo firmware 7CETB5WW 2.05 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.

  • CVE-2008-3895Sep 3, 2008
    Lilo
    Lilo
    risk 0.00cvss —epss 0.00

    LILO 22.6.1 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.

  • CVE-2008-3896Sep 3, 2008
    Grub Legacy
    Grub Legacy
    risk 0.00cvss —epss 0.00

    Grub Legacy 0.97 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.

  • CVE-2008-3897Sep 3, 2008
    DiskCryptor
    DiskCryptor
    risk 0.00cvss —epss 0.00

    DiskCryptor 0.2.6 on Windows stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.

  • CVE-2008-3898Sep 3, 2008
    Securstar
    Drivecrypt Plus Pack
    risk 0.00cvss —epss 0.00

    Secu Star DriveCrypt Plus Pack 3.9 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this…

  • CVE-2008-3899Sep 3, 2008
    Truecrypt Foundation
    Truecrypt
    risk 0.00cvss —epss 0.00

    TrueCrypt 5.0 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer. NOTE: the…

  • CVE-2008-3900Sep 3, 2008
    Intel
    BIOS
    risk 0.00cvss —epss 0.00

    Intel firmware PE94510M.86A.0050.2007.0710.1559 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this…

  • CVE-2008-3901Sep 3, 2008
    Suspend2
    Software Suspend 2
    risk 0.00cvss —epss 0.00

    Software suspend 2 2-2.2.1, when used with the Linux kernel 2.6.16, stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations…

  • CVE-2008-3877Sep 2, 2008
    Acoustica
    Mixcraft
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in Acoustica Mixcraft 4.1 Build 96 and 4.2 Build 98 allows user-assisted attackers to execute arbitrary code via a crafted .mx4 file. NOTE: it was later reported that version 3 is also affected.

  • CVE-2008-3878Sep 2, 2008
    Ultrashareware
    Ultra Office Control
    risk 0.06cvss —epss 0.36

    Stack-based buffer overflow in the Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 in Ultra Shareware Ultra Office Control allows remote attackers to execute arbitrary code via long strUrl, strFile, and strPostData parameters to the HttpUpload method.

  • CVE-2008-3879Sep 2, 2008
    Ultrashareware
    Ultra Office Control
    risk 0.03cvss —epss 0.04

    The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra Shareware Ultra Office Control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction…

  • CVE-2008-3880Sep 2, 2008
    Zoneminder
    Zoneminder
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in zm_html_view_event.php in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary SQL commands via the filter array parameter.

  • CVE-2008-3881Sep 2, 2008
    Zoneminder
    Zoneminder
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ZoneMinder 1.23.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified "zm_html_view_*.php" files.

  • CVE-2008-3882Sep 2, 2008
    Zoneminder
    Zoneminder
    risk 0.00cvss —epss 0.03

    Unspecified "Command Injection" vulnerability in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary commands via (1) the executeFilter function in zm_html_view_events.php and (2) the run_state parameter to zm_html_view_state.php.

  • CVE-2008-3883Sep 2, 2008
    Caudium
    Caudium
    risk 0.00cvss —epss 0.00

    configvar in Caudium 1.4.12 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/roken#####.pike temporary file.

  • CVE-2008-3884Sep 2, 2008
    Blogn
    Blogn
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Blogn (BURO GUN) 1.9.7 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2006-6176.

  • CVE-2008-3885Sep 2, 2008
    Blogn
    Blogn
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Blogn (BURO GUN) 1.9.7 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make content modifications. NOTE: some of these details are obtained from third party information.

  • CVE-2008-3886Sep 2, 2008
    Dotproject
    Dotproject
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in dotProject 2.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) the inactive parameter in a tasks action, (2) the date parameter in a calendar day_view action, (3) the callback parameter…

  • CVE-2008-3887Sep 2, 2008
    Dotproject
    Dotproject
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in dotProject 2.1.2 allow (1) remote authenticated users to execute arbitrary SQL commands via the tab parameter in a projects action, and (2) remote authenticated administrators to execute arbitrary SQL commands via the…

  • CVE-2008-3888Sep 2, 2008
    Mini Nuke
    Freehost
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in members.asp in Mini-NUKE Freehost 2.3 allows remote attackers to execute arbitrary SQL commands via the uid parameter in a member_details action.

  • CVE-2008-3146Sep 2, 2008
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in packet_ncp2222.inc in Wireshark (formerly Ethereal) 0.9.7 through 1.0.2 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted NCP packet that causes an invalid pointer to be used.

  • CVE-2008-3538Sep 2, 2008
    Microfocus
    Enterprise Discovery
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in HP Enterprise Discovery 2.0 through 2.52 on Windows allows remote authenticated users to execute arbitrary code via unknown vectors. NOTE: the initial description of this CVE was inadvertently associated with libxml2, but it should be for HP…

  • CVE-2008-3875Sep 2, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    The kernel in Sun Solaris 8 through 10 and OpenSolaris before snv_90 allows local users to bypass chroot, zones, and the Solaris Trusted Extensions multi-level security policy, and establish a covert communication channel, via unspecified vectors involving system calls.

  • CVE-2008-3876Sep 2, 2008
    Apple Inc.
    iPhone
    risk 0.00cvss —epss 0.00

    Apple iPhone 2.0.2, in some configurations, allows physically proximate attackers to bypass intended access restrictions, and obtain sensitive information or make arbitrary use of the device, via an Emergency Call tap and a Home double-tap, followed by a tap of any contact's…

  • CVE-2008-2928Aug 29, 2008
    Red Hat
    Directory Server
    risk 0.01cvss —epss 0.07

    Multiple buffer overflows in the adminutil library in CGI applications in Red Hat Directory Server 7.1 before SP7 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted Accept-Language HTTP header.

  • CVE-2008-2929Aug 29, 2008
    Fedorahosted
    Directory Server
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway (DSGW) web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5, and Fedora Directory Server, allow remote…

  • CVE-2008-2930Aug 29, 2008
    Fedorahosted
    Directory Server
    risk 0.04cvss —epss 0.07

    Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 allow remote attackers to cause a denial of service (CPU consumption and search outage) via crafted LDAP search requests with patterns, related to a single-threaded…

  • CVE-2008-3282HigAug 29, 2008
    Openoffice
    Openoffice
    risk 0.52cvss 7.8epss 0.11

    Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in the memory allocator in OpenOffice.org (OOo) 2.4.1, on 64-bit platforms, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a…

  • CVE-2008-3283Aug 29, 2008
    Fedorahosted
    Directory Server
    risk 0.00cvss —epss 0.03

    Multiple memory leaks in Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 and earlier allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) the authentication / bind phase and (2)…

  • CVE-2008-3480Aug 29, 2008
    Anzio
    Print Wizard
    risk 0.04cvss —epss 0.11

    Stack-based buffer overflow in the Anzio Web Print Object (WePO) ActiveX control 3.2.19 and 3.2.24, as used in Anzio Print Wizard, allows remote attackers to execute arbitrary code via a long mainurl parameter.

  • CVE-2008-3873Aug 29, 2008
    Adobe Inc.
    Flashplayer
    risk 0.00cvss —epss 0.04

    The System.setClipboard method in ActionScript in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to populate the clipboard with a URL that is difficult to delete and does not require user interaction to populate the clipboard, as exploited in the wild in August…

  • CVE-2008-3874Aug 29, 2008
    Lussumo
    Vanilla
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1, 1.1.4, and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Value field (aka Label ==> Value pairs). NOTE: some of these details are obtained from third…

  • CVE-2008-3859Aug 29, 2008
    Davlin
    Thickbox Gallery
    risk 0.03cvss —epss 0.03

    Davlin Thickbox Gallery 2 allows remote attackers to obtain the administrative username and MD5 password hash via a direct request to conf/admins.php.

  • CVE-2008-3860Aug 29, 2008
    IBM
    Lotus Quickr
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities (1) in the WYSIWYG editors, (2) during local group creation, (3) during HTML redirects, (4) in the HTML import, (5) in the Rich text editor, and (6) in link-page in IBM Lotus Quickr 8.1 services for Lotus Domino before Hotfix…