VYPR

CVEs

344,960 total · page 6288 of 6,900

AllCriticalHighKEV
  • CVE-2008-2193May 14, 2008
    Scorpnews
    Scorpnews
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in example.php in Thomas Gossmann ScorpNews 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the site parameter.

  • CVE-2008-2194May 14, 2008
    Deluxebb
    Deluxebb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in forums.php in DeluxeBB 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the sort parameter.

  • CVE-2008-2195May 14, 2008
    Deluxebb
    Deluxebb
    risk 0.03cvss —epss 0.02

    Static code injection vulnerability in admincp.php in DeluxeBB 1.2 and earlier allows remote authenticated administrators to inject arbitrary PHP code into logs/cp.php via the URI.

  • CVE-2008-2196May 14, 2008
    Lifetype
    Lifetype
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin.php in LifeType 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the newBlogUserName parameter in an addBlogUser action, a different vector than CVE-2008-2178.

  • CVE-2008-2197May 14, 2008
    Miniweb HTTP Server
    blogwriter
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the blogwriter module 2.0 for Miniweb allows remote attackers to execute arbitrary SQL commands via the historymonth parameter to index.php.

  • CVE-2008-2198May 14, 2008
    Kmita
    Tellfriend
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in kmitaadmin/kmitat/htmlcode.php in Kmita Tellfriend 2.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file parameter.

  • CVE-2008-2199May 14, 2008
    Kmita
    Kmita Mail
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in kmitaadmin/kmitam/htmlcode.php in Kmita Mail 3.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file parameter.

  • CVE-2008-2200May 14, 2008
    Maianscriptworld
    Weblog
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Maian Weblog 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter to admin/index.php in a blogs search action, the (2) msg_charset and (3) msg_header9 parameters to…

  • CVE-2008-2201May 14, 2008
    Maianscriptworld
    Recipe
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in admin/inc/header.php in Maian Recipe 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) header, (2) header2, (3) header3, (4) header4, (5) header5, (6) header6, (7) header7, (8) header8, and (9)…

  • CVE-2008-2202May 14, 2008
    Maianscriptworld
    Uploader
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter to upload/admin/index.php in a search action, the (2) msg_charset and (3) msg_header9 parameters to…

  • CVE-2008-2203May 14, 2008
    Maianscriptworld
    Search
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in search.php in Maian Search 1.1 allows remote attackers to execute arbitrary SQL commands via the keywords parameter in a search action.

  • CVE-2008-2204May 14, 2008
    Maianscriptworld
    Search
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in admin/inc/header.php in Maian Search 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) header, (2) header2, (3) header3, (4) header4, (5) header5, (6) header6, (7) header7, (8) header8, and (9)…

  • CVE-2008-2205May 14, 2008
    Maianscriptworld
    Music
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Maian Music 1.1 allows remote attackers to execute arbitrary SQL commands via the album parameter in an album action.

  • CVE-2008-2206May 14, 2008
    Maianscriptworld
    Music
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Maian Music 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter in a search action to index.php, and the (2) msg_script parameter to admin/inc/footer.php.

  • CVE-2008-2207May 14, 2008
    Maian Gallery
    Maian Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin/index.php in Maian Gallery 2.0 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a search action.

  • CVE-2008-2208May 14, 2008
    Maianscriptworld
    Greeting
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Maian Greeting 2.1 allows remote attackers to execute arbitrary SQL commands via the keywords parameter in a search action.

  • CVE-2008-2209May 14, 2008
    Maianscriptworld
    Greeting
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in admin/inc/header.php in Maian Greeting 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_script and (2) msg_script2 parameters.

  • CVE-2008-2210May 14, 2008
    Maianscriptworld
    Support
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Maian Support 1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_script, (2) msg_script2, and (3) msg_script3 parameters to admin/inc/footer.php; and the (4) msg_script2 parameter to…

  • CVE-2008-2211May 14, 2008
    Maianscriptworld
    Guestbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in admin/inc/footer.php in Maian Guestbook 3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_script2 and (2) msg_script3 parameters.

  • CVE-2008-2212May 14, 2008
    Maian Cart
    Maian Cart
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Maian Cart 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_adminheader, (2) msg_adminheader2, (3) msg_adminheader3, (4) msg_adminheader4, and unspecified other parameters to…

  • CVE-2008-2213May 14, 2008
    Maian Links
    Maian Links
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in admin/inc/footer.php in Maian Links 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_script2 and (2) msg_script3 parameters.

  • CVE-2007-5803May 13, 2008
    Nagios
    Nagios
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in CGI programs in Nagios before 2.12 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2007-5624 and CVE-2008-1360.

  • CVE-2008-1922May 13, 2008
    Sarg
    Sarg
    risk 0.00cvss —epss 0.04

    Multiple stack-based buffer overflows in Sarg might allow attackers to execute arbitrary code via unknown vectors, probably a crafted Squid log file.

  • CVE-2008-0119May 13, 2008
    Microsoft
    Office
    risk 0.02cvss —epss 0.31

    Unspecified vulnerability in Microsoft Publisher in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 SP1 and earlier allows remote attackers to execute arbitrary code via a Publisher file with crafted object header data that triggers memory corruption, aka "Publisher Object…

  • CVE-2008-1091May 13, 2008
    Microsoft
    Office
    risk 0.03cvss —epss 0.41

    Unspecified vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows remote attackers to execute arbitrary code via a Rich Text Format (.rtf) file with a malformed string that triggers a "memory calculation error"…

  • CVE-2008-1434May 13, 2008
    Microsoft
    Office
    risk 0.02cvss —epss 0.31

    Use-after-free vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows remote attackers to execute arbitrary code via an HTML document with a large number of Cascading Style Sheets (CSS) selectors, related to a…

  • CVE-2008-1437May 13, 2008
    Microsoft
    Malware Protection Engine
    risk 0.01cvss —epss 0.13

    Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (engine hang and restart) via a crafted file, a different…

  • CVE-2008-1438May 13, 2008
    Microsoft
    Malware Protection Engine
    risk 0.01cvss —epss 0.13

    Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (disk space exhaustion) via a file with "crafted data structures"…

  • CVE-2008-2169HigMay 13, 2008
    Avici
    Router
    risk 0.49cvss 7.5epss 0.01

    Unspecified vulnerability in Avici routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.

  • CVE-2008-2170HigMay 13, 2008
    Century
    routers
    risk 0.49cvss 7.5epss 0.01

    Unspecified vulnerability in Century routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.

  • CVE-2008-2171May 13, 2008
    Alaxala
    Ax Router
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in AlaxalA AX routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.

  • CVE-2008-2172May 13, 2008
    Hitachi
    GR routers
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Hitachi GR routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.

  • CVE-2008-2173HigMay 13, 2008
    Yamaha
    Router
    risk 0.49cvss 7.5epss 0.01

    Unspecified vulnerability in Yamaha routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.

  • CVE-2008-2174May 13, 2008
    Robin Rawson-Tetley
    Animal Shelter Manager
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Robin Rawson-Tetley Animal Shelter Manager (ASM) before 2.2.2 have unknown impact and attack vectors, related to "various areas where security was missing."

  • CVE-2008-2175May 13, 2008
    Gamma Scripts
    Blogme PHP
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in comments.php in Gamma Scripts BlogMe PHP 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-2176May 13, 2008
    Zomplog
    Zomplog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin/category.php in Zomplog 3.8.2 allows remote attackers to inject arbitrary web script or HTML via the catname parameter.

  • CVE-2008-2177May 13, 2008
    Phpdirectorysource
    Phpdirectorysource
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in phpDirectorySource 1.1.06, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) lid parameter to show.php and the (2) login parameter to admin.php.

  • CVE-2008-2178May 13, 2008
    Lifetype
    Lifetype
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin.php in LifeType 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the searchTerms parameter in an editArticleCategories operation (aka an admin category search).

  • CVE-2008-2179May 13, 2008
    Sysaid
    Sysaid
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in SystemList.jsp in SysAid 5.1.08 allows remote attackers to inject arbitrary web script or HTML via the searchField parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-2180May 13, 2008
    Cplinks
    Cplinks
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in cpLinks 1.03, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) admin_username parameter (aka the username field) to admin/index.php and the (2) search_text and (3) search_category…

  • CVE-2008-2181May 13, 2008
    Cplinks
    Cplinks
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in search.php in cpLinks 1.03 allow remote attackers to inject arbitrary web script or HTML via the (1) search_text and (2) search_category parameters. NOTE: the XSS reportedly occurs in a forced SQL error message. NOTE: some…

  • CVE-2008-2182May 13, 2008
    TYPO3
    powermail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the powermail extension before 1.1.10 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2183May 13, 2008
    Smartblog
    Smartblog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to execute arbitrary SQL commands via the idt parameter.

  • CVE-2008-2184May 13, 2008
    Smartblog
    Smartblog
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in SMartBlog (aka SMBlog) 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) mois, (2) an, (3) jour, and (4) id parameters to index.php, and the (5) login parameter to gestion/logon.php, different vectors than…

  • CVE-2008-2185May 13, 2008
    Smartblog
    Smartblog
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to include arbitrary local files via directory traversal sequences in the page parameter. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2008-2186May 13, 2008
    Chilkat Software
    Chicomas
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in index.php in Chilek Content Management System (aka ChiCoMaS) 2.0.4 allows remote attackers to inject arbitrary web script or HTML via the q parameter.

  • CVE-2008-2187May 13, 2008
    MJGuest
    MJGuest
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in mjguest.php in Mjguest 6.7 GT Rev.01 allows remote attackers to inject arbitrary web script or HTML via the level parameter in a redirect action, possibly involving interface/redirect.htm.php.

  • CVE-2008-2188May 13, 2008
    Eejj33
    Blackbook
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in EJ3 BlackBook 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) bookCopyright and (2) ver parameters to (a) footer.php, and the (3) bookName, (4) bookMetaTags, and (5) estiloCSS parameters to (b)…

  • CVE-2008-2168May 13, 2008
    Apache
    Apache
    risk 0.07cvss —epss 0.55

    Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.

  • CVE-2008-0322HigMay 13, 2008
    Microsoft
    Windows Xp
    risk 0.51cvss 7.8epss 0.02

    The I2O Utility Filter driver (i2omgmt.sys) 5.1.2600.2180 for Microsoft Windows XP sets Everyone/Write permissions for the "\\.\I2OExc" device interface, which allows local users to gain privileges. NOTE: this issue can be leveraged to overwrite arbitrary memory and execute…