VYPR

CVEs

344,978 total · page 6272 of 6,900

AllCriticalHighKEV
  • CVE-2008-3109Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet…

  • CVE-2008-3110Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to obtain sensitive information by using an applet to read information from another applet.

  • CVE-2008-3111Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that…

  • CVE-2008-3112Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.02cvss —epss 0.26

    Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR…

  • CVE-2008-3113Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.01cvss —epss 0.06

    Unspecified vulnerability in Sun Java Web Start in JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create or delete arbitrary files via an untrusted application, aka CR 6704077.

  • CVE-2008-3114Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR…

  • CVE-2008-3115Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.01cvss —epss 0.07

    Secure Static Versioning in Sun Java JDK and JRE 6 Update 6 and earlier, and 5.0 Update 6 through 15, does not properly prevent execution of applets on older JRE releases, which might allow remote attackers to exploit vulnerabilities in these older releases.

  • CVE-2008-2244Jul 9, 2008
    Microsoft
    Office Word
    risk 0.03cvss —epss 0.32

    Microsoft Office Word 2002 SP3 allows remote attackers to execute arbitrary code via a .doc file that contains malformed data, as exploited in the wild in July 2008, and as demonstrated by attachement.doc.

  • CVE-2008-3087Jul 9, 2008
    Kasseler CMS
    Kasseler CMS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in Kasseler CMS 1.3.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to index.php, possibly related to the phpManual module.

  • CVE-2008-3088Jul 9, 2008
    Kasseler CMS
    Kasseler CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Files module in Kasseler CMS 1.3.0 and 1.3.1 Lite allows remote attackers to inject arbitrary web script or HTML via the cid parameter in a Category action to index.php.

  • CVE-2008-3089Jul 9, 2008
    Xpoze
    Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in user.html in Xpoze Pro 3.06 (aka Xpoze Pro CMS 2008) allows remote attackers to execute arbitrary SQL commands via the uid parameter.

  • CVE-2008-3090Jul 9, 2008
    Blognplus
    Blognplus
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in BlognPlus (BURO GUN +) 2.5.5 MySQL and PostgreSQL editions allow remote attackers to execute arbitrary SQL commands via the (1) p, (2) e, (3) d, and (4) m parameters, a different vulnerability than CVE-2008-2819.

  • CVE-2008-3091Jul 9, 2008
    Drupal
    Taxonomy Autotagger
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Taxonomy Autotagger module 5.x before 5.x-1.8 for Drupal allows remote authenticated users, with create or edit post permissions, to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-3092Jul 9, 2008
    Drupal
    Taxonomy Autotagger
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Taxonomy Autotagger module 5.x before 5.x-1.8 for Drupal allows remote authenticated users, with create or edit post permissions, to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-3093Jul 9, 2008
    ImperialBB
    ImperialBB
    risk 0.03cvss —epss 0.02

    Unrestricted file upload vulnerability in ImperialBB 2.3.5 and earlier allows remote authenticated users to upload and execute arbitrary PHP code by placing a .php filename in the Upload_Avatar parameter and sending the image/gif content type.

  • CVE-2008-3094Jul 9, 2008
    Drupal
    Organic Groups
    risk 0.00cvss —epss 0.02

    The Organic Groups (OG) module 5.x before 5.x-7.3 and 6.x before 6.x-1.0-RC1, a module for Drupal, allows remote attackers to obtain sensitive information (private group names) via unspecified vectors.

  • CVE-2008-3095Jul 9, 2008
    Drupal
    Organic Groups
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Organic Groups (OG) module 5.x before 5.x-7.3 and 6.x before 6.x-1.0-RC1, a module for Drupal, allows remote authenticated users, with group owner permissions, to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-3096Jul 9, 2008
    Drupal
    Outline Designer module
    risk 0.00cvss —epss 0.01

    The Outline Designer module 5.x before 5.x-1.4 for Drupal changes each content reader's authentication level to match that of the content author, which might allow remote attackers to gain privileges.

  • CVE-2008-3097Jul 9, 2008
    Drupal
    Tinytax
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Tinytax module (aka Tinytax taxonomy block) 5.x before 5.x-1.10-1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML, probably by creating a crafted taxonomy term.

  • CVE-2008-2931HigJul 9, 2008
    Linux
    Kernel
    risk 0.51cvss 7.8epss 0.00

    The do_change_type function in fs/namespace.c in the Linux kernel before 2.6.22 does not verify that the caller has the CAP_SYS_ADMIN capability, which allows local users to gain privileges or cause a denial of service by modifying the properties of a mountpoint.

  • CVE-2008-2991MedJul 9, 2008
    Adobe Inc.
    Robohelp
    risk 0.41cvss 6.1epss 0.16

    Cross-site scripting (XSS) vulnerability in Adobe RoboHelp Server 6 and 7 allows remote attackers to inject arbitrary web script or HTML via vectors related to the Help Errors log.

  • CVE-2007-1899Jul 9, 2008
    Mywebland
    Mybloggie
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in myWebland myBloggie 2.1.6 allow remote attackers to execute arbitrary SQL commands via (1) the user_id parameter in a viewuser action to index.php, and allow remote authenticated administrators to execute arbitrary SQL commands via (2)…

  • CVE-2007-3650MedJul 9, 2008
    Mywebland
    Mybloggie
    risk 0.35cvss 5.3epss 0.01

    myWebland myBloggie 2.1.6 allow remote attackers to obtain sensitive information via (1) an invalid year parameter to calendar.php, reached through index.php; (2) a direct request to common.php; and (3) a mode array parameter in the query string to login.php, which reveal the…

  • CVE-2007-3651MedJul 9, 2008
    Fascript
    Faname
    risk 0.35cvss 5.3epss 0.01

    class/page.php in Farsi Script (aka FaScript) FaName 1.0 allows remote attackers to obtain sensitive information via a '; (quote semicolon) sequence in the id parameter, which reveals the installation path in an error message.

  • CVE-2007-3652CriJul 9, 2008
    Fascript
    Faname
    risk 0.64cvss 9.8epss 0.01

    SQL injection vulnerability in class/page.php in Farsi Script (aka FaScript) FaName 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: this might be the same issue as CVE-2008-0328.

  • CVE-2007-3653Jul 9, 2008
    Fascript
    Faname
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Farsi Script (aka FaScript) FaName 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) key or (2) desc parameter to index.php, or (3) the name parameter to page.php.

  • CVE-2008-1663Jul 9, 2008
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) 2.1.10 and 2.1.11 on Linux and Windows allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2375Jul 9, 2008
    Red Hat
    Vsftpd
    risk 0.00cvss —epss 0.04

    Memory leak in a certain Red Hat deployment of vsftpd before 2.0.5 on Red Hat Enterprise Linux (RHEL) 3 and 4, when PAM is used, allows remote attackers to cause a denial of service (memory consumption) via a large number of invalid authentication attempts within the same…

  • CVE-2008-2376Jul 9, 2008
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.04

    Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact via a call to the Array#fill method with a start (aka beg) argument greater…

  • CVE-2008-2812HigJul 9, 2008
    Linux
    Kernel
    risk 0.51cvss 7.8epss 0.00

    The Linux kernel before 2.6.25.10 does not properly perform tty operations, which allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving NULL pointer dereference of function pointers in (1) hamradio/6pack.c, (2)…

  • CVE-2008-3077Jul 9, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    arch/x86/kernel/ptrace.c in the Linux kernel before 2.6.25.10 on the x86_64 platform leaks task_struct references into the sys32_ptrace function, which allows local users to cause a denial of service (system crash) or have unspecified other impact via unknown vectors, possibly a…

  • CVE-2008-3078Jul 9, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Opera before 9.51 does not properly manage memory within functions supporting the CANVAS element, which allows remote attackers to read uninitialized memory contents by using JavaScript to read a canvas image.

  • CVE-2008-3079Jul 9, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Opera before 9.51 on Windows allows attackers to execute arbitrary code via unknown vectors.

  • CVE-2008-3080Jul 9, 2008
    Mywebland
    Mybloggie
    risk 0.03cvss —epss 0.00

    Cross-site request forgery (CSRF) vulnerability in admin.php in myWebland myBloggie 2.1.6 allows remote attackers to perform edit actions as administrators. NOTE: this can be leveraged to execute SQL commands by also exploiting CVE-2007-1899.

  • CVE-2008-3081Jul 9, 2008
    Avaya
    Communication Manager
    risk 0.00cvss —epss 0.03

    Multiple unspecified "input validation" vulnerabilities in the Web management interface (aka Messaging Administration interface) in Avaya Message Storage Server (MSS) 3.x and 4.0, and possibly Communication Manager 3.1.x, allow remote authenticated administrators to execute…

  • CVE-2008-3082Jul 9, 2008
    Commtouch
    Enterprise Anti Spam Gateway
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in UPM/English/login/login.asp in Commtouch Enterprise Anti-Spam Gateway 4 and 5 allows remote attackers to inject arbitrary web script or HTML via the PARAMS parameter.

  • CVE-2008-3083Jul 9, 2008
    Brightcode
    Brightcode Weblinks Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Brightcode Weblinks (com_brightweblinks) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2008-0085Jul 8, 2008
    Microsoft
    SQL Server
    risk 0.01cvss —epss 0.11

    SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine (MSDE) 1.0 SP4; and Internal Database (WYukon) SP2 does not initialize memory pages when reallocating…

  • CVE-2008-0086Jul 8, 2008
    Microsoft
    SQL Server
    risk 0.05cvss —epss 0.62

    Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine (MSDE 2000) SP4, and 2000 Desktop Engine (WMSDE) allows remote authenticated users to execute arbitrary code via a crafted SQL expression.

  • CVE-2008-0106Jul 8, 2008
    Microsoft
    SQL Server
    risk 0.03cvss —epss 0.35

    Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute arbitrary code via a crafted insert statement.

  • CVE-2008-0107Jul 8, 2008
    Microsoft
    SQL Server
    risk 0.03cvss —epss 0.35

    Integer underflow in SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine (MSDE) 1.0 SP4; and Internal Database (WYukon) SP2 allows remote authenticated users…

  • CVE-2008-1435Jul 8, 2008
    Microsoft
    Windows
    risk 0.02cvss —epss 0.29

    Windows Explorer in Microsoft Windows Vista up to SP1, and Server 2008, allows user-assisted remote attackers to execute arbitrary code via crafted saved-search (.search-ms) files that are not properly handled when saving, aka "Windows Saved Search Vulnerability."

  • CVE-2008-1447MedJul 8, 2008
    BIND
    BIND
    risk 0.55cvss 6.8epss 0.95

    The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses…

  • CVE-2008-1454Jul 8, 2008
    Microsoft
    Windows 2000
    risk 0.03cvss —epss 0.34

    Unspecified vulnerability in Microsoft DNS in Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 allows remote attackers to conduct cache poisoning attacks via unknown vectors related to accepting "records from a response that is outside the remote server's authority,"…

  • CVE-2008-2247Jul 8, 2008
    Microsoft
    Exchange Server
    risk 0.02cvss —epss 0.25

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified e-mail fields, a different vulnerability than CVE-2008-2248.

  • CVE-2008-2248Jul 8, 2008
    Microsoft
    Exchange Server
    risk 0.02cvss —epss 0.25

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified HTML, a different vulnerability than CVE-2008-2247.

  • CVE-2008-2809Jul 8, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla 1.9 M8 and earlier, Mozilla Firefox 2 before 2.0.0.15, SeaMonkey 1.1.5 and other versions before 1.1.10, Netscape 9.0, and other Mozilla-based web browsers, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regard the…

  • CVE-2008-3069Jul 8, 2008
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in MyBB before 1.2.13 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) portal.php and (2) inc/functions_post.php.

  • CVE-2008-3070Jul 8, 2008
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in inc/datahandler/user.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $user['language'] variable, probably related to SQL injection.

  • CVE-2008-3071Jul 8, 2008
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in inc/class_language.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $language variable.