VYPR

CVEs

344,969 total · page 6284 of 6,900

AllCriticalHighKEV
  • CVE-2008-2510May 29, 2008
    WordPress
    Upload File Plugin
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in wp-uploadfile.php in the Upload File plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the f_id parameter.

  • CVE-2008-0891May 29, 2008
    OpenSSL Project
    OpenSSL
    risk 0.00cvss —epss 0.05

    Double free vulnerability in OpenSSL 0.9.8f and 0.9.8g, when the TLS server name extensions are enabled, allows remote attackers to cause a denial of service (crash) via a malformed Client Hello packet. NOTE: some of these details are obtained from third party information.

  • CVE-2008-0955May 29, 2008
    Creative
    Creative Software Autoupdate Engine
    risk 0.06cvss —epss 0.41

    Stack-based buffer overflow in the Creative Software AutoUpdate Engine ActiveX control in CTSUEng.ocx allows remote attackers to execute arbitrary code via a long CacheFolder property value.

  • CVE-2008-0958May 29, 2008
    Nctsoft
    NCTSoft NCTAudioGrabber2 ActiveX control
    risk 0.01cvss —epss 0.08

    Multiple stack-based buffer overflows in the Online Media Technologies NCTSoft NCTAudioGrabber2 ActiveX control in NCTAudioGrabber2.dll allow remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2008-0959May 29, 2008
    Nctsoft
    NCTSoft NCTAudioInformation2 ActiveX control
    risk 0.00cvss —epss 0.06

    Multiple stack-based buffer overflows in the Online Media Technologies NCTSoft NCTAudioInformation2 ActiveX control in NCTAudioInformation2.dll, as used in (1) Power Audio CD Grabber 1.0, (2) Power Audio CD Burner 1.02, (3) CinematicMP3 1.4.0.0, (4) Alive MP3 WAV Converter…

  • CVE-2008-1105May 29, 2008
    Samba (software)
    Samba
    risk 0.09cvss —epss 0.69

    Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29 allows remote attackers to execute arbitrary code via a crafted SMB response.

  • CVE-2008-1672May 29, 2008
    OpenSSL Project
    OpenSSL
    risk 0.00cvss —epss 0.05

    OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses "particular cipher suites," which triggers a NULL pointer dereference.

  • CVE-2008-2054May 29, 2008
    Cisco Systems, Inc.
    Ciscoworks Common Services
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Cisco CiscoWorks Common Services 3.0.3 through 3.1.1 allows remote attackers to execute arbitrary code on a client machine via unknown vectors.

  • CVE-2008-2137May 29, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The (1) sparc_mmap_check function in arch/sparc/kernel/sys_sparc.c and the (2) sparc64_mmap_check function in arch/sparc64/kernel/sys_sparc.c, in the Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3, omit some virtual-address range (aka span) checks when the mmap…

  • CVE-2008-2157May 29, 2008
    EMC Corporation
    Alphastor
    risk 0.06cvss —epss 0.36

    robotd in the Library Manager in EMC AlphaStor 3.1 SP1 for Windows allows remote attackers to execute arbitrary commands via an unspecified string field in a packet to TCP port 3500.

  • CVE-2008-2158May 29, 2008
    EMC Corporation
    Alphastor
    risk 0.08cvss —epss 0.58

    Multiple stack-based buffer overflows in the Command Line Interface process in the Server Agent in EMC AlphaStor 3.1 SP1 for Windows allow remote attackers to execute arbitrary code via crafted TCP packets to port 41025.

  • CVE-2008-2499May 29, 2008
    IBM
    Sametime
    risk 0.09cvss —epss 0.77

    Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL.

  • CVE-2008-2500May 29, 2008
    Mambo (software)
    Mostlyce
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the MOStlyContent Editor (MOStlyCE) component before 3.0 for Mambo allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2477May 28, 2008
    Mxbb
    Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in MxBB (aka MX-System) Portal 2.7.3 allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2008-2478May 28, 2008
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.04

    scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field (aka Email text box). NOTE: the vendor disputes this,…

  • CVE-2008-2479May 28, 2008
    PhpFix
    phpFix
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in phpFix 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) kind parameter to fix/browse.php and the (2) account parameter to auth/00_pass.php.

  • CVE-2008-2480May 28, 2008
    Plusphp
    Plusphp Short URL Multi User Script
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in plus.php in plusPHP Short URL Multi-User Script 1.6 allows remote attackers to execute arbitrary PHP code via a URL in the _pages_dir parameter.

  • CVE-2008-2481May 28, 2008
    Phpraider
    Phpraider
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in authentication/phpbb3/phpbb3.functions.php in phpRaider 1.0.7 and 1.0.7a, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pConfig_auth[phpbb_path] parameter.

  • CVE-2008-2482May 28, 2008
    Adaptcms
    Onecms
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in install_mod.php in insanevisions OneCMS 2.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the load parameter in a go action.

  • CVE-2008-2483May 28, 2008
    Xomol
    Xomol CMS
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in Xomol CMS 1.20071213 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the op parameter.

  • CVE-2008-2484May 28, 2008
    Xomol
    Xomol CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Xomol CMS 1.20071213, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the email parameter.

  • CVE-2008-2485May 28, 2008
    Pcpin
    Chat
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the URL redirection script (inc/url_redirection.inc.php) in PCPIN Chat before 6.11 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2008-2486May 28, 2008
    Emule
    Emule Plus
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in eMule Plus before 1.2d has unknown impact and attack vectors related to "staticservers.dat processing."

  • CVE-2008-2487May 28, 2008
    Maxsite
    Maxsite
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in MAXSITE 1.10 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter in a webboard action.

  • CVE-2008-2488May 28, 2008
    RoomPHPlanning
    RoomPHPlanning
    risk 0.03cvss —epss 0.02

    admin/userform.php in RoomPHPlanning 1.5 does not require administrative credentials, which allows remote authenticated users to create new admin accounts.

  • CVE-2008-2489May 28, 2008
    TYPO3
    Library for Frontend Plugins
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Library for Frontend Plugins (aka sg_zfelib) extension 1.1.512 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified "user input."

  • CVE-2008-2490May 28, 2008
    TYPO3
    Kj Imagelightbox2
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the KJ Image Lightbox 2 (aka kj_imagelightbox2) extension 1.4.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified "user input."

  • CVE-2008-2491May 28, 2008
    AbleSpace
    AbleSpace
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in adv_cat.php in AbleSpace 1.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.

  • CVE-2008-2492May 28, 2008
    Badongo
    Campus Bulletin Board
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Campus Bulletin Board 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to post3/view.asp and the (2) review parameter to post3/book.asp.

  • CVE-2008-2493May 28, 2008
    Badongo
    Campus Bulletin Board
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in post3/Book.asp in Campus Bulletin Board 3.4 allows remote attackers to inject arbitrary web script or HTML via the review parameter.

  • CVE-2008-2494May 28, 2008
    Zina
    Zina
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Zina 1.0 RC3 allows remote attackers to inject arbitrary web script or HTML via the l parameter.

  • CVE-2008-2495May 28, 2008
    Zina
    Zina
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in index.php in Zina 1.0 RC3 allows remote attackers to have an unknown impact via a .. (dot dot) in the p parameter.

  • CVE-2008-2496May 28, 2008
    Quate
    Quate CMS
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Quate CMS 0.3.4 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) login.php, and (3) credits.php in admin/, and (4) upgrade/index.php.

  • CVE-2008-2497May 28, 2008
    Mambo (software)
    Mambo
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in Mambo before 4.6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

  • CVE-2008-2498May 28, 2008
    Mambo (software)
    Mambo
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Mambo before 4.6.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) articleid and (2) mcname parameters. NOTE: some of these details are obtained from third party…

  • CVE-2008-2443May 27, 2008
    Therealestatescript
    The Real Estate Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in dpage.php in The Real Estate Script allows remote attackers to execute arbitrary SQL commands via the docID parameter.

  • CVE-2008-2444May 27, 2008
    Calogic
    Calogic Calendars
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in userreg.php in CaLogic Calendars 1.2.2 allows remote attackers to execute arbitrary SQL commands via the langsel parameter.

  • CVE-2008-2445May 27, 2008
    Wgcc
    Web Group Communication Center
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in profile.php in Web Group Communication Center (WGCC) 1.0.3 PreRelease 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the userid parameter in a show action.

  • CVE-2008-2446May 27, 2008
    Wgcc
    Web Group Communication Center
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Web Group Communication Center (WGCC) 1.0.3 PreRelease 1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) userid parameter to (a) profile.php in a "show moreinfo" action; the (2) bildid parameter…

  • CVE-2008-2447May 27, 2008
    Mytipper
    Zogo Shop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in products.php in the Mytipper ZoGo-shop plugin 1.15.5 and 1.16 Beta 13 for e107 allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2008-2448May 27, 2008
    Meto Forum
    Meto Forum
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Meto Forum 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) admin/duzenle.asp and (b) admin_oku.asp; the (2) kid parameter to (c) kategori.asp and (d) admin_kategori.asp; and unspecified…

  • CVE-2008-2449May 27, 2008
    PhpInstantGallery
    phpInstantGallery
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Isaac McGowan phpInstantGallery 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) gallery parameter to (a) index.php and (b) image.php, and the (2) imgnum parameter to image.php. NOTE: the…

  • CVE-2008-2450May 27, 2008
    TYPO3
    ke_stats
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Statistics (aka ke_stats) extension 0.1.2 and earlier for TYPO3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2451May 27, 2008
    TYPO3
    ke_stats
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Statistics (aka ke_stats) extension 0.1.2 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-2452May 27, 2008
    TYPO3
    pbsurvey
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Questionaire (aka pbsurvey) extension 1.2.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2453May 27, 2008
    Phpclassifiedsscript
    PHP Classifieds Script
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in PHP Classifieds Script allow remote attackers to execute arbitrary SQL commands via the fatherID parameter to (1) browse.php and (2) search.php.

  • CVE-2008-2454May 27, 2008
    Joomla
    Com Xsstream Dm
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the xsstream-dm (com_xsstream-dm) component 0.01 Beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the movie parameter to index.php.

  • CVE-2008-2455May 27, 2008
    WordPress
    Macguru Blog Engine
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in comment.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the rid parameter.

  • CVE-2008-2456May 27, 2008
    Comicshout
    Comicshout
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in ComicShout 2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the comic_id parameter.

  • CVE-2008-2457May 27, 2008
    Bitmixsoft
    PHP Jokesite
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in jokes_category.php in PHP-Jokesite 2.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.