VYPR

CVEs

344,969 total · page 6285 of 6,900

AllCriticalHighKEV
  • CVE-2008-2458May 27, 2008
    4shared
    Starsgames Control Panel
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Starsgames Control Panel 4.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the st parameter.

  • CVE-2008-2459May 27, 2008
    Entertainmentscript
    Entertainmentscript
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in page.php in EntertainmentScript 1.4.0 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page parameter.

  • CVE-2008-2460May 27, 2008
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in faq.php in vBulletin 3.7.0 Gold allows remote attackers to execute arbitrary SQL commands via the q parameter in a search action.

  • CVE-2008-2461May 27, 2008
    Netious CMS
    CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Netious CMS 0.4 allows remote attackers to execute arbitrary SQL commands via the pageid parameter, a different vector than CVE-2006-4047.

  • CVE-2008-2422May 23, 2008
    Webslider
    Webslider
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Web Slider 0.6 allows remote attackers to execute arbitrary SQL commands via the slide parameter in a slides action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-2423May 23, 2008
    Interchange Development Group
    Interchange
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Interchange before 5.6.0 and before 5.5.2 allows remote attackers to cause a denial of service via crafted HTTP requests. NOTE: this might overlap CVE-2007-2635.

  • CVE-2008-2424May 23, 2008
    Interchange Development Group
    Interchange
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the 404 error page for the "Standard demo" in Interchange before 5.6.0 and before 5.5.2 has unknown impact and attack vectors.

  • CVE-2008-2425May 23, 2008
    Fichive
    Fichive
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in FicHive 1.0 allows remote attackers to execute arbitrary SQL commands via the letter parameter in a Search action, a different vector than CVE-2008-2416. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2007-5495May 23, 2008
    Selinux
    Setroubleshoot
    risk 0.00cvss —epss 0.00

    sealert in setroubleshoot 2.0.5 allows local users to overwrite arbitrary files via a symlink attack on the sealert.log temporary file.

  • CVE-2007-5496May 23, 2008
    Selinux
    Setroubleshoot
    risk 0.00cvss —epss 0.00

    Cross-site scripting (XSS) vulnerability in setroubleshoot 2.0.5 allows local users to inject arbitrary web script or HTML via a crafted (1) file or (2) process name, which triggers an Access Vector Cache (AVC) log entry in a log file used during composition of HTML documents…

  • CVE-2007-5961May 23, 2008
    Red Hat
    Satellite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Red Hat Network channel search feature, as used in RHN and Red Hat Network Satellite before 5.0.2, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2008-1767May 23, 2008
    Libxslt
    libxslt
    risk 0.04cvss —epss 0.13

    Buffer overflow in pattern.c in libxslt before 1.1.24 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XSL style sheet file with a long XSLT "transformation match" condition that triggers a large number of steps.

  • CVE-2008-2302May 23, 2008
    Djangoproject
    Django
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.

  • CVE-2008-2333May 23, 2008
    Barracuda Networks
    Barracuda Spam Firewall
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in ldap_test.cgi in Barracuda Spam Firewall (BSF) before 3.5.11.025 allows remote attackers to inject arbitrary web script or HTML via the email parameter.

  • CVE-2008-2407May 23, 2008
    Cerulean Studios
    Trillian
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in AIM.DLL in Cerulean Studios Trillian before 3.1.10.0 allows user-assisted remote attackers to execute arbitrary code via a long attribute value in a FONT tag in a message.

  • CVE-2008-2408May 23, 2008
    Cerulean Studios
    Trillian
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in the XML parsing functionality in talk.dll in Cerulean Studios Trillian Pro before 3.1.10.0 allows remote attackers to execute arbitrary code via a malformed attribute in an IMG tag.

  • CVE-2008-2409May 23, 2008
    Cerulean Studios
    Trillian
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in Cerulean Studios Trillian before 3.1.10.0 allows remote attackers to execute arbitrary code via unspecified attributes in the X-MMS-IM-FORMAT header in an MSN message.

  • CVE-2008-2418May 23, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Race condition in the STREAMS Administrative Driver (sad) in Sun Solaris 10 allows local users to cause a denial of service (panic) via unknown vectors.

  • CVE-2008-2419May 23, 2008
    Mozilla Corporation
    Firefox
    risk 0.04cvss —epss 0.07

    Mozilla Firefox 2.0.0.14 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly execute arbitrary code by triggering an error condition during certain Iframe operations between a JSframe write and a JSframe close, as demonstrated…

  • CVE-2008-2420May 23, 2008
    Stunnel
    Stunnel
    risk 0.00cvss —epss 0.01

    The OCSP functionality in stunnel before 4.24 does not properly search certificate revocation lists (CRL), which allows remote attackers to bypass intended access restrictions by using revoked certificates.

  • CVE-2008-2421May 23, 2008
    SAP
    Sap Web Application Server
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under…

  • CVE-2007-5962May 22, 2008
    Foresight Linux
    Appliances
    risk 0.04cvss —epss 0.12

    Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux (RHEL) 5 and Fedora 6 through 8, and on Foresight Linux and rPath appliances, allows remote attackers to cause a denial of service (memory consumption) via a large number of CWD commands,…

  • CVE-2008-0534May 22, 2008
    Icon Labs
    Iconfidant SSH
    risk 0.00cvss —epss 0.04

    The SSH server in (1) Cisco Service Control Engine (SCE) before 3.1.6, and (2) Icon Labs Iconfidant SSH before 2.3.8, allows remote attackers to cause a denial of service (device restart or daemon outage) via a high rate of login attempts, aka Bug ID CSCsi68582.

  • CVE-2008-0535May 22, 2008
    Icon Labs
    Iconfidant SSH
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the SSH server in (1) Cisco Service Control Engine (SCE) before 3.1.6, and (2) Icon Labs Iconfidant SSH before 2.3.8, allows remote attackers to cause a denial of service (device instability) via "SSH credentials that attempt to change the…

  • CVE-2008-0536May 22, 2008
    Icon Labs
    Iconfidant SSH
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the SSH server in (1) Cisco Service Control Engine (SCE) 3.0.x before 3.0.7 and 3.1.x before 3.1.0, and (2) Icon Labs Iconfidant SSH before 2.3.8, allows remote attackers to cause a denial of service (management interface outage) via SSH traffic that…

  • CVE-2008-1159May 22, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in the SSH server in Cisco IOS 12.4 allow remote attackers to cause a denial of service (device restart) via unknown vectors, aka Bug ID (1) CSCsk42419, (2) CSCsk60020, and (3) CSCsh51293.

  • CVE-2008-1804May 22, 2008
    Snort
    Snort
    risk 0.00cvss —epss 0.02

    preprocessors/spp_frag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment.

  • CVE-2008-2006May 22, 2008
    Apple Inc.
    Ical
    risk 0.04cvss —epss 0.10

    Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a .ics file containing (1) a large 16-bit integer on a TRIGGER…

  • CVE-2008-2053May 22, 2008
    Cisco Systems, Inc.
    Unified Customer Voice Portal
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco Unified Customer Voice Portal (CVP) 4.0.x before 4.0(2)_ES14, 4.1.x before 4.1(1)_ES11, and 7.x before 7.0(1) allows remote authenticated users with administrator role privileges to create, modify, or delete a superuser account.

  • CVE-2008-2240May 22, 2008
    IBM
    Lotus Domino
    risk 0.08cvss —epss 0.65

    Stack-based buffer overflow in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long Accept-Language HTTP header.

  • CVE-2008-2399May 22, 2008
    Fireftp
    Fireftp
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the FireFTP add-on before 0.98.20080518 for Firefox allows remote FTP servers to create or overwrite arbitrary files via ..\ (dot dot backslash) sequences in responses to (1) MLSD and (2) LIST commands, a related issue to CVE-2002-1345. …

  • CVE-2008-2400May 22, 2008
    Stunnel
    Stunnel
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in stunnel before 4.23, when running as a service on Windows, allows local users to gain privileges via unknown attack vectors.

  • CVE-2008-2410May 22, 2008
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the servlet engine and Web container in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2411May 22, 2008
    Sazcart
    Sazcart
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in SazCart 1.5.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the prodid parameter in a details action.

  • CVE-2008-2412May 22, 2008
    Acgv News
    News
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in glossaire.php in ACGV News 0.9.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-2413May 22, 2008
    Acgv News
    News
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in glossaire.php in ACGV News 0.9.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2008-2414May 22, 2008
    ANG
    AN Guestbook
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in send_email.php in AN Guestbook (ANG) 0.4 allows remote attackers to inject arbitrary web script or HTML via the postid parameter.

  • CVE-2008-2415May 22, 2008
    Digitalhive
    Digitalhive
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in template/purpletech/base_include.php in DigitalHive (aka hive) 2.0 RC2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.

  • CVE-2008-2416May 22, 2008
    Fichive
    Fichive
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in FicHive 1.0 allows remote attackers to execute arbitrary SQL commands via the category parameter in a Fiction action, possibly related to sources/fiction.class.php.

  • CVE-2008-2417May 22, 2008
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in showQAnswer.asp in How2ASP.net Webboard 4.1 allows remote attackers to execute arbitrary SQL commands via the qNo parameter.

  • CVE-2008-1104May 21, 2008
    Foxitsoftware
    Reader
    risk 0.02cvss —epss 0.23

    Stack-based buffer overflow in Foxit Reader before 2.3 build 2912 allows user-assisted remote attackers to execute arbitrary code via a crafted PDF file, related to the util.printf JavaScript function and floating point specifiers in format strings.

  • CVE-2008-1660May 21, 2008
    HP UX
    useradd
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in useradd on HP-UX B.11.11, B.11.23, and B.11.31 allows local users to access arbitrary files and directories via unspecified vectors.

  • CVE-2008-1948May 21, 2008
    GNU
    Gnutls
    risk 0.01cvss —epss 0.12

    The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a…

  • CVE-2008-1949May 21, 2008
    GNU
    Gnutls
    risk 0.00cvss —epss 0.06

    The _gnutls_recv_client_kx_message function in lib/gnutls_kx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service…

  • CVE-2008-1950May 21, 2008
    GNU
    Gnutls
    risk 0.00cvss —epss 0.05

    Integer signedness error in the _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted…

  • CVE-2008-2241May 21, 2008
    Ca
    Brightstor ARCserve Backup
    risk 0.01cvss —epss 0.12

    Directory traversal vulnerability in caloggerd in CA BrightStor ARCServe Backup 11.0, 11.1, and 11.5 allows remote attackers to append arbitrary data to arbitrary files via directory traversal sequences in unspecified input fields, which are used in log messages. NOTE: this can…

  • CVE-2008-2242May 21, 2008
    Ca
    Brightstor ARCserve Backup
    risk 0.01cvss —epss 0.15

    Multiple buffer overflows in xdr functions in the server in CA BrightStor ARCServe Backup 11.0, 11.1, and 11.5 allow remote attackers to execute arbitrary code, as demonstrated by a stack-based buffer overflow via a long parameter to the xdr_rwsstring function.

  • CVE-2008-2357May 21, 2008
    Mtr
    Mtr
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73, when invoked with the -p (aka --split) option, allows remote attackers to execute arbitrary code via a crafted DNS PTR record. NOTE: it could be argued that this is a vulnerability in the…

  • CVE-2008-2390May 21, 2008
    Microfocus
    Software Update
    risk 0.04cvss —epss 0.07

    Hpufunction.dll 4.0.0.1 in HP Software Update exposes the unsafe (1) ExecuteAsync and (2) Execute methods, which allows remote attackers to execute arbitrary code via an absolute pathname in the first argument.

  • CVE-2008-2391May 21, 2008
    Subsonic
    Subsonic
    risk 0.00cvss —epss 0.02

    SubSonic allows remote attackers to bypass pagesize limits and cause a denial of service (CPU consumption) via a pageindex (aka data page number) of -1.