CVEs

344,969 total · page 6287 of 6,900

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2008-2299	Citrix Systems Access Essentials	0.00	—	0.01	May 18, 2008	Unspecified vulnerability in SecureICA and ICA Basic encryption of Citrix Presentation Server 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop Server 1.0 can cause clients to use weaker encryption settings than configured by the administrator, which might allow…
CVE-2008-2300	Citrix Systems Access Essentials	0.00	—	0.01	May 18, 2008	Unspecified vulnerability in Citrix Presentation Server 4.5 and earlier, Citrix Access Essentials 2.0 and earlier, and Citrix Desktop Server 1.0 allows remote authenticated users to access unauthorized desktops via unknown attack vectors.
CVE-2008-2301	Phpway Kostenloses Linkmanagementscript	0.03	—	0.01	May 18, 2008	SQL injection vulnerability in Kostenloses Linkmanagementscript allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) view.php and (2) top_view.php.
CVE-2008-1158	Cisco Systems, Inc. Unified Presence Server	0.00	—	0.02	May 16, 2008	The Presence Engine (PE) service in Cisco Unified Presence before 6.0(1) allows remote attackers to cause a denial of service (core dump and service interruption) via malformed packets, aka Bug ID CSCsh50164.
CVE-2008-1419	Xiph.Org Libvorbis	0.00	—	0.04	May 16, 2008	Xiph.org libvorbis 1.2.0 and earlier does not properly handle a zero value for codebook.dim, which allows remote attackers to cause a denial of service (crash or infinite loop) or trigger an integer overflow.
CVE-2008-1420	Xiph.Org Libvorbis	0.01	—	0.06	May 16, 2008	Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
CVE-2008-1423	Xiph.Org Libvorbis	0.01	—	0.08	May 16, 2008	Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a…
CVE-2008-1740	Cisco Systems, Inc. Unified Presence Server	0.00	—	0.02	May 16, 2008	The Presence Engine (PE) service in Cisco Unified Presence before 6.0(1) allows remote attackers to cause a denial of service (core dump and service interruption) via an unspecified "stress test," aka Bug ID CSCsh20972.
CVE-2008-1741	Cisco Systems, Inc. Unified Presence Server	0.00	—	0.02	May 16, 2008	The SIP Proxy (SIPD) service in Cisco Unified Presence before 6.0(3) allows remote attackers to cause a denial of service (core dump and service interruption) via a TCP port scan, aka Bug ID CSCsj64533.
CVE-2008-1742	Cisco Systems, Inc. Unified Communications Manager	0.00	—	0.01	May 16, 2008	Memory leak in the Certificate Trust List (CTL) Provider service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3) allows remote attackers to cause a denial of service (memory consumption and service interruption) via a series of malformed TCP packets, as…
CVE-2008-1743	Cisco Systems, Inc. Unified Communications Manager	0.00	—	0.01	May 16, 2008	Memory leak in the Certificate Trust List (CTL) Provider service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3) and 6.x before 6.1(1) allows remote attackers to cause a denial of service (memory consumption and service interruption) via a series of malformed…
CVE-2008-1744	Cisco Systems, Inc. Unified Communications Manager	0.00	—	0.01	May 16, 2008	The Certificate Authority Proxy Function (CAPF) service in Cisco Unified Communications Manager (CUCM) 4.1 before 4.1(3)SR7, 4.2 before 4.2(3)SR4, and 4.3 before 4.3(2) allows remote attackers to cause a denial of service (service crash) via malformed network traffic, aka Bug ID…
CVE-2008-1745	Cisco Systems, Inc. Unified Communications Manager	0.00	—	0.02	May 16, 2008	Cisco Unified Communications Manager (CUCM) 5.x before 5.1(2) and 6.x before 6.1(1) allows remote attackers to cause a denial of service (service interruption) via a SIP JOIN message with a malformed header, aka Bug ID CSCsi48115.
CVE-2008-1746	Cisco Systems, Inc. Unified Communications Manager	0.00	—	0.02	May 16, 2008	The SNMP Trap Agent service in Cisco Unified Communications Manager (CUCM) 4.1 before 4.1(3)SR6, 4.2 before 4.2(3)SR3, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) allows remote attackers to cause a denial of service (core dump and service restart) via a series of…
CVE-2008-1747	Cisco Systems, Inc. Unified Communications Manager	0.00	—	0.02	May 16, 2008	Unspecified vulnerability in Cisco Unified Communications Manager 4.1 before 4.1(3)SR6, 4.2 before 4.2(3)SR3, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) allows remote attackers to cause a denial of service (CCM service restart) via an unspecified SIP INVITE…
CVE-2008-1748	Cisco Systems, Inc. Unified Communications Manager	0.00	—	0.02	May 16, 2008	Cisco Unified Communications Manager 4.1 before 4.1(3)SR7, 4.2 before 4.2(3)SR4, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) does not properly validate SIP URLs, which allows remote attackers to cause a denial of service (service interruption) via a SIP INVITE…
CVE-2008-2009	Xiph.Org Libvorbis	0.00	—	0.04	May 16, 2008	Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via a crafted OGG file that triggers memory corruption during execution of the _make_decode_tree function.
CVE-2008-2136	Linux Kernel	0.00	—	0.05	May 16, 2008	Memory leak in the ipip6_rcv function in net/ipv6/sit.c in the Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3 allows remote attackers to cause a denial of service (memory consumption) via network traffic to a Simple Internet Transition (SIT) tunnel interface, related…
CVE-2008-2165	Cisco Systems, Inc. Building Broadband Service Manager	0.00	—	0.01	May 16, 2008	Cross-site scripting (XSS) vulnerability in AccessCodeStart.asp in Cisco Building Broadband Service Manager (BBSM) Captive Portal 5.3 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVE-2008-2263	Cmsnx Automated Link Exchange Portal	0.03	—	0.01	May 16, 2008	SQL injection vulnerability in linking.page.php in Automated Link Exchange Portal allows remote attackers to execute arbitrary SQL commands via the cat_id parameter. NOTE: linking.page.php is commonly renamed to link.php, links.php, etc.
CVE-2008-2264	CyrixMED CyrixMED	0.03	—	0.01	May 16, 2008	Cross-site scripting (XSS) vulnerability in index.php in CyrixMED 1.4 allows remote attackers to inject arbitrary web script or HTML via the msg_erreur parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2008-2265	Emophp Emo Realty Manager	0.03	—	0.01	May 16, 2008	SQL injection vulnerability in news.php in EMO Realty Manager allows remote attackers to execute arbitrary SQL commands via the ida parameter.
CVE-2008-2266	Uudeview Uudeview	0.00	—	0.00	May 16, 2008	uulib/uunconc.c in UUDeview 0.5.20, as used in nzbget before 0.3.0 and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on a temporary filename generated by the tempnam function. NOTE: this may be a CVE-2004-2265 regression.
CVE-2008-2267	Cmsmadesimple FileManager	0.03	—	0.05	May 16, 2008	Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6)…
CVE-2008-2268	MJGuest MJGuest	0.00	—	0.01	May 16, 2008	Open redirect vulnerability in interface/redirect.htm.php in Mjguest 6.7 GT Rev.01 allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter in a redirect action to mjguest.php. NOTE: this is…
CVE-2008-2269	AustinSmoke GasTracker	0.03	—	0.03	May 16, 2008	AustinSmoke GasTracker (AS-GasTracker) 1.0.0 allows remote attackers to bypass authentication and gain privileges by setting the gastracker_admin cookie to TRUE.
CVE-2008-2270	Phpway Kostenloses Linkmanagementscript	0.03	—	0.02	May 16, 2008	Multiple PHP remote file inclusion vulnerabilities in PHPWAY Kostenloses Linkmanagementscript allow remote attackers to execute arbitrary PHP code via a URL in the (1) main_page_directory and (2) page_to_include parameters in template\index.php.
CVE-2008-2271	Drupal Site Documentation Drupal module	0.00	—	0.02	May 16, 2008	The Site Documentation Drupal module 5.x before 5.x-1.8 and 6.x before 6.x-1.1 allows remote authenticated users to gain privileges of other users by leveraging the "access content" permission to list tables and obtain session IDs from the database.
CVE-2008-2272	Arubanetworks Mobility Controller	0.00	—	0.01	May 16, 2008	Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Aruba Mobility Controller 2.4.8.x-FIPS, 2.5.5.x, 2.5.6.x, 3.1.1.x, 3.2.0.x, and 3.3.1.x allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2008-2273	Arubanetworks Mobility Controller	0.00	—	0.02	May 16, 2008	Unspecified vulnerability in the TACACS authentication component in Aruba Mobility Controller 3.1.x, 3.2.x, and 3.3.x allows remote authenticated users to gain privileges via unknown vectors.
CVE-2008-2274	TYPO3 sr_feuser_register	0.00	—	0.01	May 16, 2008	Cross-site scripting (XSS) vulnerability in the sr_feuser_register 1.4.0, 1.6.0, 2.2.1 to 2.2.7, 2.3.0 to 2.3.6, 2.4.0, and 2.5.0 to 2.5.9 extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2008-2275	TYPO3 sr_feuser_register	0.00	—	0.03	May 16, 2008	Unspecified vulnerability in sr_feuser_register 1.4.0, 1.6.0, 2.2.1 to 2.2.7, 2.3.0 to 2.3.6, 2.4.0, and 2.5.0 to 2.5.9 extension for TYPO3 allows remote attackers to execute arbitrary code and delete arbitrary files via unspecified attack vectors.
CVE-2008-2276	Mantisbt Mantis	0.03	—	0.03	May 16, 2008	Cross-site request forgery (CSRF) vulnerability in manage_user_create.php in Mantis 1.1.1 allows remote attackers to create new administrative users via a crafted link.
CVE-2008-2277	Cmsnx Feedback and Rating Script	0.03	—	0.01	May 16, 2008	SQL injection vulnerability in detail.php in Feedback and Rating Script 1.0 allows remote attackers to execute arbitrary SQL commands via the listingid parameter.
CVE-2008-2278	Freelanceauction Freelance Auction Script	0.03	—	0.01	May 16, 2008	SQL injection vulnerability in browseproject.php in Freelance Auction Script 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a pdetails action.
CVE-2008-2279	Freelanceauction Freelance Auction Script	0.03	—	0.02	May 16, 2008	Freelance Auction Script 1.0 stores user passwords in plaintext in the tbl_users table, which allows attackers to gain privileges by reading the table.
CVE-2008-2280	Scriptphp Picengine	0.00	—	0.01	May 16, 2008	Cross-site scripting (XSS) vulnerability in admin/index.php in Script PHP PicEngine 1.0 allows remote attackers to inject arbitrary web script or HTML via the l parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…
CVE-2008-1749	Cisco Systems, Inc. Content Switching Module with SSL	0.00	—	0.02	May 14, 2008	Memory leak in Cisco Content Switching Module (CSM) 4.2(3) up to 4.2(8) and Cisco Content Switching Module with SSL (CSM-S) 2.1(2) up to 2.1(7) allows remote attackers to cause a denial of service (memory consumption) via TCP segments with an unspecified combination of TCP flags.
CVE-2008-1943	Xen Xen	0.00	—	0.00	May 14, 2008	Buffer overflow in the backend of XenSource Xen Para Virtualized Frame Buffer (PVFB) 3.0 through 3.1.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted description of a shared framebuffer.
CVE-2008-1944	Xen Xen	0.00	—	0.00	May 14, 2008	Buffer overflow in the backend framebuffer of XenSource Xen Para-Virtualized Framebuffer (PVFB) Message 3.0 through 3.0.3 allows local users to cause a denial of service (SDL crash) and possibly execute arbitrary code via "bogus screen updates," related to missing validation of…
CVE-2008-2214	Castlerock Snmpc	0.04	—	0.09	May 14, 2008	Stack-based buffer overflow in the Network Manager in Castle Rock Computing SNMPc 7.1 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long community string in an SNMP TRAP packet.
CVE-2008-2215	Project Based Calendaring System PBCS	0.03	—	0.03	May 14, 2008	Multiple directory traversal vulnerabilities in Project-Based Calendaring System (PBCS) 0.7.1-1 allow remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to (1) src/yopy_sync.php and (2) system-logger/print_logs.php.
CVE-2008-2216	Project Based Calendaring System PBCS	0.03	—	0.03	May 14, 2008	Unrestricted file upload vulnerability in src/yopy_upload.php in Project-Based Calendaring System (PBCS) 0.7.1 allows remote authenticated users to upload arbitrary files to tmp/uploads.
CVE-2008-2217	Phprojekt Content Management System	0.03	—	0.02	May 14, 2008	Directory traversal vulnerability in cm/graphie.php in Content Management System 0.6.1 for Phprojekt allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cm_imgpath parameter.
CVE-2008-2218	Nortel Multimedia Communication Server 5100	0.00	—	0.02	May 14, 2008	Buffer overflow in the Multimedia PC Client in Nortel Multimedia Communication Server (MCS) before Maintenance Release 3.5.8.3 and 4.0.25.3 allows remote attackers to cause a denial of service (crash) via a flood of "extraneous" messages, as demonstrated by the Nessus "Generic…
CVE-2008-2219	C News.fr C News	0.03	—	0.01	May 14, 2008	Cross-site scripting (XSS) vulnerability in install.php in C-News.fr C-News 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the etape parameter.
CVE-2008-2220	Interact Interact	0.03	—	0.02	May 14, 2008	Multiple PHP remote file inclusion vulnerabilities in Interact Learning Community Environment Interact 2.4.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) CONFIG[LANGUAGE_CPATH] parameter to…
CVE-2008-2221	IBM Websphere Application Server	0.00	—	0.02	May 14, 2008	Unspecified vulnerability in the Java plugin in IBM WebSphere Application Server 5.0.2 allows untrusted applets to gain privileges via unknown attack vectors.
CVE-2008-2222	Eqdkp Eqdkp	0.03	—	0.01	May 14, 2008	SQL injection vulnerability in login.php in EQdkp 1.3.2f allows remote attackers to bypass EQdkp user authentication via the user_id parameter.
CVE-2008-2223	VShare YouTube Clone	0.03	—	0.01	May 14, 2008	SQL injection vulnerability in group_posts.php in vShare YouTube Clone 2.6 allows remote attackers to execute arbitrary SQL commands via the tid parameter.

CVE-2008-2299May 18, 2008
Citrix Systems
Access Essentials
risk 0.00cvss —epss 0.01
Unspecified vulnerability in SecureICA and ICA Basic encryption of Citrix Presentation Server 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop Server 1.0 can cause clients to use weaker encryption settings than configured by the administrator, which might allow…
CVE-2008-2300May 18, 2008
Citrix Systems
Access Essentials
risk 0.00cvss —epss 0.01
Unspecified vulnerability in Citrix Presentation Server 4.5 and earlier, Citrix Access Essentials 2.0 and earlier, and Citrix Desktop Server 1.0 allows remote authenticated users to access unauthorized desktops via unknown attack vectors.
CVE-2008-2301May 18, 2008
Phpway
Kostenloses Linkmanagementscript
risk 0.03cvss —epss 0.01
SQL injection vulnerability in Kostenloses Linkmanagementscript allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) view.php and (2) top_view.php.
CVE-2008-1158May 16, 2008
Cisco Systems, Inc.
Unified Presence Server
risk 0.00cvss —epss 0.02
The Presence Engine (PE) service in Cisco Unified Presence before 6.0(1) allows remote attackers to cause a denial of service (core dump and service interruption) via malformed packets, aka Bug ID CSCsh50164.
CVE-2008-1419May 16, 2008
Xiph.Org
Libvorbis
risk 0.00cvss —epss 0.04
Xiph.org libvorbis 1.2.0 and earlier does not properly handle a zero value for codebook.dim, which allows remote attackers to cause a denial of service (crash or infinite loop) or trigger an integer overflow.
CVE-2008-1420May 16, 2008
Xiph.Org
Libvorbis
risk 0.01cvss —epss 0.06
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
CVE-2008-1423May 16, 2008
Xiph.Org
Libvorbis
risk 0.01cvss —epss 0.08
Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a…
CVE-2008-1740May 16, 2008
Cisco Systems, Inc.
Unified Presence Server
risk 0.00cvss —epss 0.02
The Presence Engine (PE) service in Cisco Unified Presence before 6.0(1) allows remote attackers to cause a denial of service (core dump and service interruption) via an unspecified "stress test," aka Bug ID CSCsh20972.
CVE-2008-1741May 16, 2008
Cisco Systems, Inc.
Unified Presence Server
risk 0.00cvss —epss 0.02
The SIP Proxy (SIPD) service in Cisco Unified Presence before 6.0(3) allows remote attackers to cause a denial of service (core dump and service interruption) via a TCP port scan, aka Bug ID CSCsj64533.
CVE-2008-1742May 16, 2008
Cisco Systems, Inc.
Unified Communications Manager
risk 0.00cvss —epss 0.01
Memory leak in the Certificate Trust List (CTL) Provider service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3) allows remote attackers to cause a denial of service (memory consumption and service interruption) via a series of malformed TCP packets, as…
CVE-2008-1743May 16, 2008
Cisco Systems, Inc.
Unified Communications Manager
risk 0.00cvss —epss 0.01
Memory leak in the Certificate Trust List (CTL) Provider service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3) and 6.x before 6.1(1) allows remote attackers to cause a denial of service (memory consumption and service interruption) via a series of malformed…
CVE-2008-1744May 16, 2008
Cisco Systems, Inc.
Unified Communications Manager
risk 0.00cvss —epss 0.01
The Certificate Authority Proxy Function (CAPF) service in Cisco Unified Communications Manager (CUCM) 4.1 before 4.1(3)SR7, 4.2 before 4.2(3)SR4, and 4.3 before 4.3(2) allows remote attackers to cause a denial of service (service crash) via malformed network traffic, aka Bug ID…
CVE-2008-1745May 16, 2008
Cisco Systems, Inc.
Unified Communications Manager
risk 0.00cvss —epss 0.02
Cisco Unified Communications Manager (CUCM) 5.x before 5.1(2) and 6.x before 6.1(1) allows remote attackers to cause a denial of service (service interruption) via a SIP JOIN message with a malformed header, aka Bug ID CSCsi48115.
CVE-2008-1746May 16, 2008
Cisco Systems, Inc.
Unified Communications Manager
risk 0.00cvss —epss 0.02
The SNMP Trap Agent service in Cisco Unified Communications Manager (CUCM) 4.1 before 4.1(3)SR6, 4.2 before 4.2(3)SR3, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) allows remote attackers to cause a denial of service (core dump and service restart) via a series of…
CVE-2008-1747May 16, 2008
Cisco Systems, Inc.
Unified Communications Manager
risk 0.00cvss —epss 0.02
Unspecified vulnerability in Cisco Unified Communications Manager 4.1 before 4.1(3)SR6, 4.2 before 4.2(3)SR3, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) allows remote attackers to cause a denial of service (CCM service restart) via an unspecified SIP INVITE…
CVE-2008-1748May 16, 2008
Cisco Systems, Inc.
Unified Communications Manager
risk 0.00cvss —epss 0.02
Cisco Unified Communications Manager 4.1 before 4.1(3)SR7, 4.2 before 4.2(3)SR4, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) does not properly validate SIP URLs, which allows remote attackers to cause a denial of service (service interruption) via a SIP INVITE…
CVE-2008-2009May 16, 2008
Xiph.Org
Libvorbis
risk 0.00cvss —epss 0.04
Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via a crafted OGG file that triggers memory corruption during execution of the _make_decode_tree function.
CVE-2008-2136May 16, 2008
Linux
Kernel
risk 0.00cvss —epss 0.05
Memory leak in the ipip6_rcv function in net/ipv6/sit.c in the Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3 allows remote attackers to cause a denial of service (memory consumption) via network traffic to a Simple Internet Transition (SIT) tunnel interface, related…
CVE-2008-2165May 16, 2008
Cisco Systems, Inc.
Building Broadband Service Manager
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in AccessCodeStart.asp in Cisco Building Broadband Service Manager (BBSM) Captive Portal 5.3 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVE-2008-2263May 16, 2008
Cmsnx
Automated Link Exchange Portal
risk 0.03cvss —epss 0.01
SQL injection vulnerability in linking.page.php in Automated Link Exchange Portal allows remote attackers to execute arbitrary SQL commands via the cat_id parameter. NOTE: linking.page.php is commonly renamed to link.php, links.php, etc.
CVE-2008-2264May 16, 2008
CyrixMED
CyrixMED
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in index.php in CyrixMED 1.4 allows remote attackers to inject arbitrary web script or HTML via the msg_erreur parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2008-2265May 16, 2008
Emophp
Emo Realty Manager
risk 0.03cvss —epss 0.01
SQL injection vulnerability in news.php in EMO Realty Manager allows remote attackers to execute arbitrary SQL commands via the ida parameter.
CVE-2008-2266May 16, 2008
Uudeview
Uudeview
risk 0.00cvss —epss 0.00
uulib/uunconc.c in UUDeview 0.5.20, as used in nzbget before 0.3.0 and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on a temporary filename generated by the tempnam function. NOTE: this may be a CVE-2004-2265 regression.
CVE-2008-2267May 16, 2008
Cmsmadesimple
FileManager
risk 0.03cvss —epss 0.05
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6)…
CVE-2008-2268May 16, 2008
MJGuest
MJGuest
risk 0.00cvss —epss 0.01
Open redirect vulnerability in interface/redirect.htm.php in Mjguest 6.7 GT Rev.01 allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter in a redirect action to mjguest.php. NOTE: this is…
CVE-2008-2269May 16, 2008
AustinSmoke
GasTracker
risk 0.03cvss —epss 0.03
AustinSmoke GasTracker (AS-GasTracker) 1.0.0 allows remote attackers to bypass authentication and gain privileges by setting the gastracker_admin cookie to TRUE.
CVE-2008-2270May 16, 2008
Phpway
Kostenloses Linkmanagementscript
risk 0.03cvss —epss 0.02
Multiple PHP remote file inclusion vulnerabilities in PHPWAY Kostenloses Linkmanagementscript allow remote attackers to execute arbitrary PHP code via a URL in the (1) main_page_directory and (2) page_to_include parameters in template\index.php.
CVE-2008-2271May 16, 2008
Drupal
Site Documentation Drupal module
risk 0.00cvss —epss 0.02
The Site Documentation Drupal module 5.x before 5.x-1.8 and 6.x before 6.x-1.1 allows remote authenticated users to gain privileges of other users by leveraging the "access content" permission to list tables and obtain session IDs from the database.
CVE-2008-2272May 16, 2008
Arubanetworks
Mobility Controller
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Aruba Mobility Controller 2.4.8.x-FIPS, 2.5.5.x, 2.5.6.x, 3.1.1.x, 3.2.0.x, and 3.3.1.x allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2008-2273May 16, 2008
Arubanetworks
Mobility Controller
risk 0.00cvss —epss 0.02
Unspecified vulnerability in the TACACS authentication component in Aruba Mobility Controller 3.1.x, 3.2.x, and 3.3.x allows remote authenticated users to gain privileges via unknown vectors.
CVE-2008-2274May 16, 2008
TYPO3
sr_feuser_register
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the sr_feuser_register 1.4.0, 1.6.0, 2.2.1 to 2.2.7, 2.3.0 to 2.3.6, 2.4.0, and 2.5.0 to 2.5.9 extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2008-2275May 16, 2008
TYPO3
sr_feuser_register
risk 0.00cvss —epss 0.03
Unspecified vulnerability in sr_feuser_register 1.4.0, 1.6.0, 2.2.1 to 2.2.7, 2.3.0 to 2.3.6, 2.4.0, and 2.5.0 to 2.5.9 extension for TYPO3 allows remote attackers to execute arbitrary code and delete arbitrary files via unspecified attack vectors.
CVE-2008-2276May 16, 2008
Mantisbt
Mantis
risk 0.03cvss —epss 0.03
Cross-site request forgery (CSRF) vulnerability in manage_user_create.php in Mantis 1.1.1 allows remote attackers to create new administrative users via a crafted link.
CVE-2008-2277May 16, 2008
Cmsnx
Feedback and Rating Script
risk 0.03cvss —epss 0.01
SQL injection vulnerability in detail.php in Feedback and Rating Script 1.0 allows remote attackers to execute arbitrary SQL commands via the listingid parameter.
CVE-2008-2278May 16, 2008
Freelanceauction
Freelance Auction Script
risk 0.03cvss —epss 0.01
SQL injection vulnerability in browseproject.php in Freelance Auction Script 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a pdetails action.
CVE-2008-2279May 16, 2008
Freelanceauction
Freelance Auction Script
risk 0.03cvss —epss 0.02
Freelance Auction Script 1.0 stores user passwords in plaintext in the tbl_users table, which allows attackers to gain privileges by reading the table.
CVE-2008-2280May 16, 2008
Scriptphp
Picengine
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in admin/index.php in Script PHP PicEngine 1.0 allows remote attackers to inject arbitrary web script or HTML via the l parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…
CVE-2008-1749May 14, 2008
Cisco Systems, Inc.
Content Switching Module with SSL
risk 0.00cvss —epss 0.02
Memory leak in Cisco Content Switching Module (CSM) 4.2(3) up to 4.2(8) and Cisco Content Switching Module with SSL (CSM-S) 2.1(2) up to 2.1(7) allows remote attackers to cause a denial of service (memory consumption) via TCP segments with an unspecified combination of TCP flags.
CVE-2008-1943May 14, 2008
Xen
Xen
risk 0.00cvss —epss 0.00
Buffer overflow in the backend of XenSource Xen Para Virtualized Frame Buffer (PVFB) 3.0 through 3.1.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted description of a shared framebuffer.
CVE-2008-1944May 14, 2008
Xen
Xen
risk 0.00cvss —epss 0.00
Buffer overflow in the backend framebuffer of XenSource Xen Para-Virtualized Framebuffer (PVFB) Message 3.0 through 3.0.3 allows local users to cause a denial of service (SDL crash) and possibly execute arbitrary code via "bogus screen updates," related to missing validation of…
CVE-2008-2214May 14, 2008
Castlerock
Snmpc
risk 0.04cvss —epss 0.09
Stack-based buffer overflow in the Network Manager in Castle Rock Computing SNMPc 7.1 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long community string in an SNMP TRAP packet.
CVE-2008-2215May 14, 2008
Project Based Calendaring System
PBCS
risk 0.03cvss —epss 0.03
Multiple directory traversal vulnerabilities in Project-Based Calendaring System (PBCS) 0.7.1-1 allow remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to (1) src/yopy_sync.php and (2) system-logger/print_logs.php.
CVE-2008-2216May 14, 2008
Project Based Calendaring System
PBCS
risk 0.03cvss —epss 0.03
Unrestricted file upload vulnerability in src/yopy_upload.php in Project-Based Calendaring System (PBCS) 0.7.1 allows remote authenticated users to upload arbitrary files to tmp/uploads.
CVE-2008-2217May 14, 2008
Phprojekt
Content Management System
risk 0.03cvss —epss 0.02
Directory traversal vulnerability in cm/graphie.php in Content Management System 0.6.1 for Phprojekt allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cm_imgpath parameter.
CVE-2008-2218May 14, 2008
Nortel
Multimedia Communication Server 5100
risk 0.00cvss —epss 0.02
Buffer overflow in the Multimedia PC Client in Nortel Multimedia Communication Server (MCS) before Maintenance Release 3.5.8.3 and 4.0.25.3 allows remote attackers to cause a denial of service (crash) via a flood of "extraneous" messages, as demonstrated by the Nessus "Generic…
CVE-2008-2219May 14, 2008
C News.fr
C News
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in install.php in C-News.fr C-News 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the etape parameter.
CVE-2008-2220May 14, 2008
Interact
Interact
risk 0.03cvss —epss 0.02
Multiple PHP remote file inclusion vulnerabilities in Interact Learning Community Environment Interact 2.4.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) CONFIG[LANGUAGE_CPATH] parameter to…
CVE-2008-2221May 14, 2008
IBM
Websphere Application Server
risk 0.00cvss —epss 0.02
Unspecified vulnerability in the Java plugin in IBM WebSphere Application Server 5.0.2 allows untrusted applets to gain privileges via unknown attack vectors.
CVE-2008-2222May 14, 2008
Eqdkp
Eqdkp
risk 0.03cvss —epss 0.01
SQL injection vulnerability in login.php in EQdkp 1.3.2f allows remote attackers to bypass EQdkp user authentication via the user_id parameter.
CVE-2008-2223May 14, 2008
VShare
YouTube Clone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in group_posts.php in vShare YouTube Clone 2.6 allows remote attackers to execute arbitrary SQL commands via the tid parameter.