VYPR

CVEs

344,984 total · page 6265 of 6,900

AllCriticalHighKEV
  • CVE-2008-3439Aug 1, 2008
    Speedbit
    Video Acceleration
    risk 0.00cvss —epss 0.02

    SpeedBit Video Acceleration before 2.2.1.8 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.

  • CVE-2008-3440Aug 1, 2008
    Sun Corporation
    Java SE
    risk 0.00cvss —epss 0.02

    Sun Java 1.6.0_03 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.

  • CVE-2008-3441Aug 1, 2008
    Nullsoft
    Winamp
    risk 0.00cvss —epss 0.03

    Nullsoft Winamp before 5.24 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.

  • CVE-2008-3442Aug 1, 2008
    Winzip
    Winzip
    risk 0.00cvss —epss 0.04

    WinZip before 11.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.

  • CVE-2008-3424Jul 31, 2008
    Condor Project
    Condor
    risk 0.00cvss —epss 0.03

    Condor before 7.0.4 does not properly handle wildcards in the ALLOW_WRITE, DENY_WRITE, HOSTALLOW_WRITE, or HOSTDENY_WRITE configuration variables in authorization policy lists, which might allow remote attackers to bypass intended access restrictions.

  • CVE-2008-3425Jul 31, 2008
    Sun Corporation
    N1 Service Provisioning System
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Sun Java System Web Server 7.0 plugin in Sun N1 Service Provisioning System (SPS) 5.2 and 6.0 allows remote authenticated SPS users to gain administrative access to the web server via unknown attack vectors.

  • CVE-2008-3426Jul 31, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Solaris Platform Information and Control Library daemon (picld) in Sun Solaris 8 through 10, and OpenSolaris builds snv_01 through snv_95, allows local users to cause a denial of service via unknown vectors that prevent operation of utilities…

  • CVE-2008-3428Jul 31, 2008
    Phpfreechat
    Phpfreechat
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in phpFreeChat 1.1 allows remote authenticated users to hijack web sessions by setting the session_id parameter to match the victim's nickid parameter.

  • CVE-2008-3429Jul 31, 2008
    Httrack
    Httrack
    risk 0.00cvss —epss 0.04

    Buffer overflow in URI processing in HTTrack and WinHTTrack before 3.42-3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long URL.

  • CVE-2008-3430Jul 31, 2008
    Eyeball
    MessengerSDK
    risk 0.03cvss —epss 0.06

    Buffer overflow in the CoVideoWindow.ocx ActiveX control 5.0.907.1 in Eyeball MessengerSDK, as used in products such as SiOL Komunikator 1.3, allows remote attackers to execute arbitrary code via a large argument supplied to the BGColor method. NOTE: this might only be a…

  • CVE-2008-3422Jul 31, 2008
    Mono
    Mono
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to (1) HtmlControl.cs (PreProcessRelativeReference), (2) HtmlForm.cs…

  • CVE-2008-3408Jul 31, 2008
    Coolplayer
    Coolplayer
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in CoolPlayer 2.18, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via a crafted m3u file.

  • CVE-2008-3409Jul 31, 2008
    Unreal Tournament
    Unreal Tournament 3
    risk 0.04cvss —epss 0.11

    Buffer overflow in Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a UDP packet containing a large value in a certain size field, followed by a data string…

  • CVE-2008-3410Jul 31, 2008
    Unreal Tournament
    Unreal Tournament 3
    risk 0.00cvss —epss 0.03

    Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a UDP packet in which the value of a certain size field is greater than the total packet length, aka attack 2 in ut3mendo.c.

  • CVE-2008-3411Jul 31, 2008
    Axesstel
    AXW-D800
    risk 0.00cvss —epss 0.03

    The Axesstel AXW-D800 modem with D2_ETH_109_01_VEBR Jun-14-2006 software does not require authentication for (1) etc/config/System.html, (2) etc/config/Network.html, (3) etc/config/Security.html, (4) cgi-bin/sysconf.cgi, and (5) cgi-bin/route.cgi, which allows remote attackers…

  • CVE-2008-3412Jul 31, 2008
    Ecshop
    Epshop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Comsenz EPShop (aka ECShop) before 3.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a (1) pro_show or (2) disppro action to the default URI.

  • CVE-2008-3413Jul 31, 2008
    Greatclone
    Auction Platinum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in category.php in Greatclone GC Auction Platinum allows remote attackers to execute arbitrary SQL commands via the cate_id parameter.

  • CVE-2008-3414Jul 31, 2008
    Siteadmin
    SiteAdmin
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in line2.php in SiteAdmin allows remote attackers to execute arbitrary SQL commands via the art parameter.

  • CVE-2008-3415Jul 31, 2008
    Cmscout
    Cmscout
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file…

  • CVE-2008-3416Jul 31, 2008
    Icebb
    Icebb
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in modules/members.php in IceBB before 1.0-rc9.3 allows remote attackers to execute arbitrary SQL commands via the username parameter in a members action to index.php, related to an incorrect protection mechanism in the clean_string function in…

  • CVE-2008-3417Jul 31, 2008
    FipsCMS
    fipsCMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in home/index.asp in fipsCMS light 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the r parameter, a different vector than CVE-2006-6115 and CVE-2007-2561.

  • CVE-2008-3418Jul 31, 2008
    Willo
    Trio
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in browse.php in TriO 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-3419Jul 31, 2008
    Greatclone
    Youtuber Clone
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ugroups.php in Youtuber Clone allows remote attackers to execute arbitrary SQL commands via the UID parameter.

  • CVE-2008-3420Jul 31, 2008
    Willo
    Mobius Web Publishing Software
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Mobius for Mimsy XG 1 1.4.4.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to browse.php or (2) the s parameter in an exhibitions action to detail.php.

  • CVE-2008-3421Jul 31, 2008
    Blackboard
    Academic Suite
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Blackboard Academic Suite 8.0.260.7 allow remote attackers to hijack the authentication of student users for requests that change configuration and enrollments via unspecified input to (1) update_module.jsp, (2)…

  • CVE-2008-3390Jul 31, 2008
    Minishowcase
    Image Gallery
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in libraries/general.init.php in Minishowcase Image Gallery 09b136, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.

  • CVE-2008-3391Jul 31, 2008
    Webwiz
    Forums
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Web Wiz Forum 9.5 allow remote attackers to inject arbitrary web script or HTML via the mode parameter to (1) admin_group_details.asp and (2) admin_category_details.asp.

  • CVE-2008-3392Jul 31, 2008
    Webwiz
    Forums
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Web Wiz Forum 9.5 allows remote attackers to log out a user via a link or IMG tag to log_off_user.asp.

  • CVE-2008-3393Jul 31, 2008
    BookMine
    BookMine
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in events.cfm in BookMine allows remote attackers to execute arbitrary SQL commands via the events_id parameter.

  • CVE-2008-3394Jul 31, 2008
    BookMine
    BookMine
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in search.cfm in BookMine allow remote attackers to inject arbitrary web script or HTML via the (1) gallery and (2) search_string parameters.

  • CVE-2008-3395Jul 31, 2008
    Atmail
    Atmail
    risk 0.00cvss —epss 0.01

    Calacode @Mail 5.41 on Linux uses weak world-readable permissions for (1) webmail/libs/Atmail/Config.php and (2) webmail/webadmin/.htpasswd, which allows local users to obtain sensitive information by reading these files. NOTE: the provenance of this information is unknown; the…

  • CVE-2008-3396Jul 31, 2008
    Epic Games
    Unreal Tournament 2004
    risk 0.04cvss —epss 0.08

    Unreal Tournament 2004 (UT2004) 3369 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a certain sequence of malformed packets.

  • CVE-2008-3397MedJul 31, 2008
    Runesoft
    Cerberus CMS
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Runesoft Cerberus CMS before 3_1.4_0.9 allows remote attackers to inject arbitrary web script or HTML via a cerberus_user cookie.

  • CVE-2008-3398Jul 31, 2008
    Xrms
    CRM
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in XRMS CRM 1.99.2 allow remote attackers to inject arbitrary web script or HTML via the msg parameter to unspecified components, possibly including login.php. NOTE: this may overlap CVE-2008-1129.

  • CVE-2008-3399Jul 31, 2008
    Xrms
    CRM
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in activities/workflow-activities.php in XRMS CRM 1.99.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the include_directory parameter.

  • CVE-2008-3400Jul 31, 2008
    Xrms
    CRM
    risk 0.03cvss —epss 0.02

    XRMS CRM 1.99.2 allows remote attackers to obtain configuration information via a direct request to tests/info.php, which calls the phpinfo function.

  • CVE-2008-3401Jul 31, 2008
    Hscripts
    Hiox Random AD
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in hioxRandomAd.php in HIOX Random Ad (HRA) 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the hm parameter.

  • CVE-2008-3402Jul 31, 2008
    Hiox India
    Browser Statistics
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in HIOX Browser Statistics (HBS) 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the hm parameter to (1) hioxupdate.php and (2) hioxstats.php.

  • CVE-2008-3403Jul 31, 2008
    Mojoscripts
    Mojopersonals
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in mojoClassified.cgi in MojoPersonals allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2008-3404Jul 31, 2008
    MJGuest
    MJGuest
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in guestbook.js.php in MJGuest 6.8 GT allows remote attackers to inject arbitrary web script or HTML via the link parameter.

  • CVE-2008-3405Jul 31, 2008
    Nazgulled
    Nzfotolog
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in Ricardo Amaral nzFotolog 0.4.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action_file parameter.

  • CVE-2008-3406Jul 31, 2008
    Phplinkat
    Phplinkat
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in showcat.php in phpLinkat 0.1 allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2008-3407Jul 31, 2008
    Phplinkat
    Phplinkat
    risk 0.03cvss —epss 0.03

    phpLinkat 0.1 allows remote attackers to bypass authentication and access unspecified pages under admin/ by sending a login=right cookie.

  • CVE-2008-3380Jul 30, 2008
    Myiosoft
    Easybookmarker
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ajaxp_backend.php in MyioSoft EasyBookMarker 4.0 trial edition (tr) allows remote attackers to inject arbitrary web script or HTML via the rs parameter.

  • CVE-2008-3381Jul 30, 2008
    Moinmo
    Moinmoin
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in macro/AdvancedSearch.py in moin (and MoinMoin) 1.6.3 and 1.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-3382Jul 30, 2008
    Mojoscripts
    Mojoclassifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in mojoClassified.cgi in MojoClassifieds 2.0 allows remote attackers to execute arbitrary SQL commands via the cat_a parameter.

  • CVE-2008-3383Jul 30, 2008
    Mojoscripts
    Mojoauto
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in mojoAuto.cgi in MojoAuto allows remote attackers to execute arbitrary SQL commands via the cat_a parameter in a browse action.

  • CVE-2008-3384Jul 30, 2008
    Interact
    Interact
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in help/help.php in Interact Learning Community Environment Interact 2.4.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) module and (2) file parameters.

  • CVE-2008-3385Jul 30, 2008
    Linux Web Shop
    PHP Help Agent
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in include/head_chat.inc.php in php Help Agent 1.0 and 1.1 Full allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the content parameter. NOTE: in some environments, this can be leveraged for remote file…

  • CVE-2008-3386Jul 30, 2008
    Alstrasoft
    Video Share Enterprise
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in album.php in AlstraSoft Video Share Enterprise 4.51 allows remote attackers to execute arbitrary SQL commands via the UID parameter, a different vector than CVE-2007-4086.