VYPR

CVEs

344,976 total · page 6279 of 6,900

AllCriticalHighKEV
  • CVE-2008-2640Jun 18, 2008
    Adobe Inc.
    Flex
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in the Flex 3 History Management feature in Adobe Flex 3.0.1 SDK and Flex Builder 3, and generated applications, allow remote attackers to inject arbitrary web script or HTML via the anchor identifier to (1)…

  • CVE-2008-2747Jun 18, 2008
    Vitalwerks
    Dynamic Update Client
    risk 0.00cvss —epss 0.00

    No-IP Dynamic Update Client (DUC) 2.2.1 on Windows uses weak permissions for the HKLM\SOFTWARE\Vitalwerks\DUC registry key, which allows local users to obtain obfuscated passwords and other sensitive information by reading the (1) TrayPassword, (2) Username, (3) Password, and…

  • CVE-2008-2748Jun 18, 2008
    Skulltag Team
    Skulltag
    risk 0.03cvss —epss 0.03

    Skulltag 0.97d2-RC2 and earlier allows remote attackers to cause a denial of service (daemon hang) via a series of long, malformed connect packets, related to these packets being "parsed multiple times."

  • CVE-2008-2749Jun 18, 2008
    Sun Corporation
    Java System Calendar Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in cshttpd in Sun Java System Calendar Server 6 and 6.3, and Sun ONE Calendar Server 6.0, when access logging (aka service.http.commandlog.all) is enabled, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.

  • CVE-2008-2750Jun 18, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    The pppol2tp_recvmsg function in drivers/net/pppol2tp.c in the Linux kernel 2.6 before 2.6.26-rc6 allows remote attackers to cause a denial of service (kernel heap memory corruption and system crash) and possibly have unspecified other impact via a crafted PPPOL2TP packet that…

  • CVE-2008-2751Jun 18, 2008
    Sun Corporation
    Java System Application Server
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.1_01 allow remote attackers to inject arbitrary web script or HTML via the (1) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jn…

  • CVE-2008-2752Jun 18, 2008
    Microsoft
    Word
    risk 0.05cvss —epss 0.28

    Microsoft Word 2000 9.0.2812 and 2003 11.8106.8172 does not properly handle unordered lists, which allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .doc file. NOTE: some…

  • CVE-2008-2742Jun 17, 2008
    Achievo
    Achievo
    risk 0.03cvss —epss 0.05

    Unrestricted file upload in the mcpuk file editor (atk/attributes/fck/editor/filemanager/browser/mcpuk/connectors/php/config.php) in Achievo 1.2.0 through 1.3.2 allows remote attackers to execute arbitrary code by uploading a file with .php followed by a safe extension, then…

  • CVE-2008-2743Jun 17, 2008
    Xerox
    Xerox 4110
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the embedded web server in Xerox 4110, 4590, and 4595 Copier/Printers allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  • CVE-2008-2744Jun 17, 2008
    Jelsoft
    Vbulletin
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in vBulletin 3.6.10 and 3.7.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors and an "obscure method." NOTE: the vector is probably in the redirect parameter to the Admin Control Panel…

  • CVE-2008-2745Jun 17, 2008
    Black Ice
    Annotation Plugin
    risk 0.04cvss —epss 0.11

    Stack-based buffer overflow in BiAnno ActiveX Control (BiAnno.ocx) in Black Ice Software Annotation Plugin 10.95 allows remote attackers to execute arbitrary code via a long parameter to the AnnoSaveToTiff method.

  • CVE-2008-2746Jun 17, 2008
    Gryphonllc
    Gllcts2
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL commands via the detail parameter.

  • CVE-2008-2719Jun 16, 2008
    Nasm
    Netwide Assembler
    risk 0.04cvss —epss 0.10

    Off-by-one error in the ppscan function (preproc.c) in Netwide Assembler (NASM) 2.02 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted file that triggers a stack-based buffer overflow.

  • CVE-2008-2720Jun 16, 2008
    Menalto
    Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Menalto Gallery before 2.2.5 allows remote attackers to inject arbitrary web script or HTML via the (1) host and (2) path components of a URL.

  • CVE-2008-2721Jun 16, 2008
    Menalto
    Gallery
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the album-select module in Menalto Gallery before 2.2.5 allows remote attackers to obtain titles of hidden albums by attempting to add a new album to a hidden album.

  • CVE-2008-2722Jun 16, 2008
    Menalto
    Gallery
    risk 0.00cvss —epss 0.02

    Menalto Gallery before 2.2.5 allows remote attackers to bypass permissions for sub-albums via a ZIP archive.

  • CVE-2008-2723Jun 16, 2008
    Menalto
    Gallery
    risk 0.00cvss —epss 0.02

    embed.php in Menalto Gallery before 2.2.5 allows remote attackers to obtain the full path via unknown vectors related to "spoofing the remote address."

  • CVE-2008-2724Jun 16, 2008
    Menalto
    Gallery
    risk 0.00cvss —epss 0.02

    Menalto Gallery before 2.2.5 does not enforce permissions for non-album items that have been protected by a password, which might allow remote attackers to bypass intended access restrictions.

  • CVE-2008-2714Jun 16, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 9.26 allows remote attackers to misrepresent web page addresses using "certain characters" that "cause the page address text to be misplaced."

  • CVE-2008-2715Jun 16, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Opera before 9.5 allows remote attackers to read cross-domain images via HTML CANVAS elements that use the images as patterns.

  • CVE-2008-2716Jun 16, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Opera before 9.5 allows remote attackers to spoof the contents of trusted frames on the same parent page by modifying the location, which can facilitate phishing attacks.

  • CVE-2008-2717Jun 16, 2008
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.03

    TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload…

  • CVE-2008-2718Jun 16, 2008
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in fe_adminlib.inc in TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, as used in extensions such as (1) direct_mail_subscription, (2) feuser_admin, and (3) kb_md5fepw, allows remote attackers to inject arbitrary web…

  • CVE-2008-2711Jun 16, 2008
    Fetchmail
    Fetchmail
    risk 0.00cvss —epss 0.03

    fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format…

  • CVE-2008-2712Jun 16, 2008
    Vim
    Vim
    risk 0.04cvss —epss 0.15

    Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzip_vim, and…

  • CVE-2008-2713Jun 16, 2008
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.05

    libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read.

  • CVE-2008-2708Jun 16, 2008
    Sun Corporation
    Opensolaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Sun (1) UltraSPARC T2 and (2) UltraSPARC T2+ kernel modules in Sun Solaris 10, and OpenSolaris before snv_93, allows local users to cause a denial of service (panic) via unspecified vectors, probably related to core files.

  • CVE-2008-2709Jun 16, 2008
    IBM
    Os\/400
    risk 0.00cvss —epss 0.00

    Buffer overflow in the BrSmRcvAndCheck function in the RCHMGR module on IBM OS/400 V5R4M0, V5R4M5, and V6R1M0 allows local users to cause a denial of service (task halt and main storage dump) via unspecified vectors involving the running of diagnostics on a modem port. NOTE:…

  • CVE-2008-2710Jun 16, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.01

    Integer signedness error in the ip_set_srcfilter function in the IP Multicast Filter in uts/common/inet/ip/ip_multi.c in the kernel in Sun Solaris 10 and OpenSolaris before snv_92 allows local users to execute arbitrary code in other Solaris Zones via an SIOCSIPMSFILTER IOCTL…

  • CVE-2008-1377Jun 16, 2008
    Xorg
    X11R7.3
    risk 0.00cvss —epss 0.03

    The (1) SProcRecordCreateContext and (2) SProcRecordRegisterClients functions in the Record extension and the (3) SProcSecurityGenerateAuthorization function in the Security extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary…

  • CVE-2008-1379Jun 16, 2008
    Xorg
    X11R7.3
    risk 0.00cvss —epss 0.01

    Integer overflow in the fbShmPutImage function in the MIT-SHM extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to read arbitrary process memory via crafted values for a Pixmap width and height.

  • CVE-2008-1806Jun 16, 2008
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    Integer overflow in FreeType2 before 2.3.6 allows context-dependent attackers to execute arbitrary code via a crafted set of 16-bit length values within the Private dictionary table in a Printer Font Binary (PFB) file, which triggers a heap-based buffer overflow.

  • CVE-2008-1807Jun 16, 2008
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid "number of axes" field in a Printer Font Binary (PFB) file, which triggers a free of arbitrary memory locations, leading to memory corruption.

  • CVE-2008-1808Jun 16, 2008
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    Multiple off-by-one errors in FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via (1) a crafted table in a Printer Font Binary (PFB) file or (2) a crafted SHC instruction in a TrueType Font (TTF) file, which triggers a heap-based buffer…

  • CVE-2008-2360Jun 16, 2008
    Xorg
    X11R7.3
    risk 0.00cvss —epss 0.03

    Integer overflow in the AllocateGlyph function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to execute arbitrary code via unspecified request fields that are used to calculate a heap buffer size, which triggers a heap-based…

  • CVE-2008-2361Jun 16, 2008
    Xorg
    X11
    risk 0.00cvss —epss 0.02

    Integer overflow in the ProcRenderCreateCursor function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to cause a denial of service (daemon crash) via unspecified request fields that are used to calculate a glyph buffer size,…

  • CVE-2008-2362Jun 16, 2008
    Xorg
    X11R7.3
    risk 0.00cvss —epss 0.04

    Multiple integer overflows in the Render extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via a (1) SProcRenderCreateLinearGradient, (2) SProcRenderCreateRadialGradient, or (3) SProcRenderCreateConicalGradient request…

  • CVE-2008-0071Jun 16, 2008
    Utorrent
    Utorrent
    risk 0.04cvss —epss 0.07

    The Web UI interface in (1) BitTorrent before 6.0.3 build 8642 and (2) uTorrent before 1.8beta build 10524 allows remote attackers to cause a denial of service (application crash) via an HTTP request with a malformed Range header.

  • CVE-2008-2366Jun 16, 2008
    Openoffice
    Openoffice
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in a certain Red Hat build script for OpenOffice.org (OOo) 1.1.x on Red Hat Enterprise Linux (RHEL) 3 and 4 allows local users to gain privileges via a malicious library in the current working directory, related to incorrect quoting of the…

  • CVE-2008-2639Jun 16, 2008
    Citect
    Citectfacilities
    risk 0.09cvss —epss 0.78

    Stack-based buffer overflow in the ODBC server service in Citect CitectSCADA 6 and 7, and CitectFacilities 7, allows remote attackers to execute arbitrary code via a long string in the second application packet in a TCP session on port 20222.

  • CVE-2008-2705Jun 16, 2008
    Sun Corporation
    Java System Access Manager
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Sun Java System Access Manager (AM) 7.1, when used with certain versions and configurations of Sun Directory Server Enterprise Edition (DSEE), allows remote attackers to bypass authentication via unspecified vectors.

  • CVE-2008-2706Jun 16, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the event port implementation in Sun Solaris 10 allows local users to cause a denial of service (panic) by submitting and retrieving user-defined events, probably related to a NULL dereference.

  • CVE-2008-2707Jun 16, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the e1000g driver in Sun Solaris 10 and OpenSolaris before snv_93 allows remote attackers to cause a denial of service (network connectivity loss) via unknown vectors.

  • CVE-2008-2689Jun 13, 2008
    Browsercrm
    Browsercrm
    risk 0.07cvss —epss 0.46

    PHP remote file inclusion vulnerability in pub/clients.php in BrowserCRM 5.002.00 allows remote attackers to execute arbitrary PHP code via a URL in the bcrm_pub_root parameter.

  • CVE-2008-2690Jun 13, 2008
    Browsercrm
    Browsercrm
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in BrowserCRM 5.002.00, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the bcrm_pub_root parameter to (1) kb.php, (2) login.php, (3) index.php, (4) contact_view.php, and (5)…

  • CVE-2008-2691Jun 13, 2008
    Jiros
    FAQ Manager eXperience
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in read.asp in JiRo's FAQ Manager eXperience 1.0 allows remote attackers to execute arbitrary SQL commands via the fID parameter.

  • CVE-2008-2692Jun 13, 2008
    Joomla
    Com Yvcomment
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the yvComment (com_yvcomment) component 1.16.0 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the ArticleID parameter in a comment action to index.php.

  • CVE-2008-2693Jun 13, 2008
    Black Ice
    Barcode SDK
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in the BITIFF.BITiffCtrl.1 ActiveX control in BITiff.ocx 10.9.3.0 in Black Ice Barcode SDK 5.01 allows remote attackers to execute arbitrary code via a long first argument to the SetByteOrder method.

  • CVE-2008-2694Jun 13, 2008
    Phpinv
    Phpinv
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in phpInv 0.8.0 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.

  • CVE-2008-2695Jun 13, 2008
    Phpinv
    Phpinv
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in entry.php in phpInv 0.8.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter.