VYPR

CVEs

344,960 total · page 6295 of 6,900

AllCriticalHighKEV
  • CVE-2008-1872Apr 17, 2008
    Comdev
    Comdev News Publisher
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in home.news.php in Comdev News Publisher 4.1.2 allows remote attackers to execute arbitrary SQL commands via the arcmonth parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2008-1873Apr 17, 2008
    Nuke ET
    Nuke ET
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the private message feature in Nuke ET 3.2 and 3.4, when using Internet Explorer, allows remote authenticated users to inject arbitrary web script or HTML via a CSS property in the STYLE attribute of a DIV element in the mensaje…

  • CVE-2008-1874Apr 17, 2008
    Xpoze
    Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in account/user/mail.html in Xpoze Pro 3.05 and earlier allows remote authenticated users to execute arbitrary SQL commands via the reed parameter.

  • CVE-2008-1875Apr 17, 2008
    Terong
    Advanced Web Photo Gallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Terong PHP Photo Gallery (aka Advanced Web Photo Gallery) 1.0 allows remote attackers to execute arbitrary SQL commands via the photo_id parameter.

  • CVE-2008-1876Apr 17, 2008
    VisualPic
    VisualPic
    risk 0.05cvss —epss 0.25

    PHP remote file inclusion vulnerability in index.php in VisualPic 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the _CONFIG[files][functions_page] parameter.

  • CVE-2008-1877Apr 17, 2008
    Tss
    tss
    risk 0.00cvss —epss 0.00

    tss 0.8.1 allows local users to read arbitrary files via the -a parameter, which is processed while tss is running with privileges.

  • CVE-2007-6713Apr 16, 2008
    Flip4mac
    Flip4mac Wmv
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Flip4Mac WMV before 2.2.0.49 has unknown impact and attack vectors related to malformed WMV files.

  • CVE-2008-1854Apr 16, 2008
    SmarterMail
    SmarterMail
    risk 0.03cvss —epss 0.03

    Unspecified vulnerability in SmarterMail Web Server (SMWebSvr.exe) in SmarterMail 5.0.2999 allows remote attackers to cause a denial of service (service termination) via a long HTTP (1) GET, (2) HEAD, (3) PUT, (4) POST, or (5) TRACE request. NOTE: the provenance of this…

  • CVE-2008-1855Apr 16, 2008
    McAfee
    Cma
    risk 0.04cvss —epss 0.08

    FrameworkService.exe in McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 and earlier, as used by ePolicy Orchestrator (ePO) and ProtectionPilot (PrP), allows remote attackers to corrupt memory and cause a denial of service (CMA Framework service crash) via a long invalid…

  • CVE-2008-1856Apr 16, 2008
    Linpha
    Linpha
    risk 0.03cvss —epss 0.03

    plugins/maps/db_handler.php in LinPHA 1.3.3 and earlier does not require authentication for a settings action that modifies the configuration file, which allows remote attackers to conduct directory traversal attacks and execute arbitrary local files by placing directory…

  • CVE-2008-1857Apr 16, 2008
    Mole
    Make Our Life Easy
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in viewsource.php in Make our Life Easy (Mole) 2.1.0 allow remote attackers to read arbitrary files via directory traversal sequences in the (1) dirn and (2) fname parameters.

  • CVE-2008-1858Apr 16, 2008
    724networks
    724cms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in 724Networks 724CMS 4.01 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2008-1859Apr 16, 2008
    Iscripts
    Socialware
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in events.php in iScripts SocialWare allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action.

  • CVE-2007-5664Apr 16, 2008
    IBM
    Db2 Universal Database
    risk 0.00cvss —epss 0.00

    db2dasrrm in the DB2 Administration Server (DAS) in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to overwrite arbitrary files via a symlink attack on files used for initialization.

  • CVE-2007-5758Apr 16, 2008
    IBM
    Db2 Universal Database
    risk 0.00cvss —epss 0.01

    Stack-based buffer overflow in db2dasrrm in the DB2 Administration Server (DAS) in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to execute arbitrary code via a long DASPROF environment variable.

  • CVE-2008-0068Apr 16, 2008
    Microfocus
    OpenView Network Node Manager
    risk 0.03cvss —epss 0.05

    Directory traversal vulnerability in OpenView5.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to read arbitrary files via directory traversal sequences in the Action parameter.

  • CVE-2008-0892Apr 16, 2008
    Red Hat
    Directory Server
    risk 0.01cvss —epss 0.14

    The replication monitor CGI script (repl-monitor-cgi.pl) in Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, allows remote attackers to execute arbitrary commands.

  • CVE-2008-0893Apr 16, 2008
    Red Hat
    Directory Server
    risk 0.00cvss —epss 0.02

    Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, does not properly restrict access to CGI scripts, which allows remote attackers to perform administrative actions.

  • CVE-2008-1851Apr 16, 2008
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.03

    ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, 7.53, and possibly other versions allows remote attackers to cause a denial of service (hang) via certain requests that do not provide all required arguments.

  • CVE-2008-1852Apr 16, 2008
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.05

    ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, 7.53, and possibly other versions allows remote attackers to cause a denial of service (crash) via certain requests that specify a large number of sub-arguments, which triggers a NULL pointer dereference due to memory…

  • CVE-2008-1853Apr 16, 2008
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.02

    The ovtopmd service in HP OpenView Network Node Manager (OV NNM) 7.51, 7.53, and possibly other versions allows remote attackers to cause a denial of service (exit) by sending a 0x36 packet (exit request).

  • CVE-2008-1155Apr 16, 2008
    Cisco Systems, Inc.
    Network Admission Control
    risk 0.00cvss —epss 0.03

    Cisco Network Admission Control (NAC) Appliance 3.5.x, 3.6.x before 3.6.4.4, 4.0.x before 4.0.6, and 4.1.x before 4.1.2 allows remote attackers to obtain the shared secret for the Clean Access Server (CAS) and Clean Access Manager (CAM) by sniffing error logs.

  • CVE-2008-1786Apr 16, 2008
    Ca
    Desktop Management Suite
    risk 0.01cvss —epss 0.07

    The DSM gui_cm_ctrls ActiveX control (gui_cm_ctrls.ocx), as used in multiple CA products including BrightStor ARCServe Backup for Laptops and Desktops r11.5, Desktop Management Suite r11.1 through r11.2 C2; Unicenter r11.1 through r11.2 C2; and Desktop and Server Management…

  • CVE-2008-1838Apr 16, 2008
    BosClassifieds
    Classified Ads
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in BosClassifieds Classified Ads System 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter to index.php.

  • CVE-2008-1839Apr 16, 2008
    Work System E Commerce
    system e-commerce
    risk 0.00cvss —epss 0.01

    Multgiple cross-site scripting (XSS) vulnerabilities in module/main.php in WORK system e-commerce 4.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) day, (2) month, and (3) year parameters. NOTE: the provenance of this information is unknown; the…

  • CVE-2008-1840Apr 16, 2008
    Coppermine
    Coppermine Photo Gallery
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in upload.php in Coppermine Photo Gallery (CPG) 1.4.16 and earlier allows remote authenticated users or user-assisted remote HTTP servers to execute arbitrary SQL commands via the Content-Type HTTP response header provided by the HTTP server that is…

  • CVE-2008-1841Apr 16, 2008
    Coppermine
    Coppermine Photo Gallery
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the session handling functionality in bridge/coppermine.inc.php in Coppermine Photo Gallery (CPG) 1.4.17 and earlier allows remote attackers to execute arbitrary SQL commands via an input field associated with the session_id variable, as exploited…

  • CVE-2008-1842Apr 16, 2008
    Microfocus
    OpenView Network Node Manager
    risk 0.04cvss —epss 0.12

    Integer signedness error in ovspmd.exe in HP OpenView Network Node Manager (OV NNM) 8.01, and 7.53 and earlier, allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a long request to TCP port 8886 that begins with a certain negative…

  • CVE-2008-1843Apr 16, 2008
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in browse.php in W2B DatingClub (aka Dating Club) allows remote attackers to execute arbitrary SQL commands via the age_to parameter in a browsebyCat action.

  • CVE-2008-1844Apr 16, 2008
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in cat.php in W2B phpHotResources allows remote attackers to execute arbitrary SQL commands via the kind parameter.

  • CVE-2008-1845Apr 16, 2008
    Mirbsd
    Miros
    risk 0.00cvss —epss 0.00

    The Korn shell (aka mksh) before R33d on MirOS (aka MirBSD) does not flush the tty's I/O when invoking mksh in a new terminal, which allows local users to gain privileges by opening a virtual terminal and entering command sequences, which might later be executed in opportunistic…

  • CVE-2008-1846Apr 16, 2008
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.

  • CVE-2008-1847Apr 16, 2008
    Coronamatrix
    Phpaddressbook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in view.php in CoronaMatrix phpAddressBook 2.11 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-1848Apr 16, 2008
    Joomla
    joomlaXplorer
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the joomlaXplorer (com_joomlaxplorer) Mambo/Joomla! component 1.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter in a show_error action to index.php.

  • CVE-2008-1849Apr 16, 2008
    JoomlaXplorer
    joomlaXplorer
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in the joomlaXplorer (com_joomlaxplorer) Mambo/Joomla! component 1.6.2 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in the dir parameter in a show_error action.

  • CVE-2008-1850Apr 16, 2008
    Omnistar Interactive
    OSI Affiliate
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in login.php in Omnistar Interactive OSI Affiliate allow remote attackers to inject arbitrary web script or HTML via the (1) login, (2) profile, (3) profile2, and (4) ref parameters.

  • CVE-2008-1387Apr 16, 2008
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.04

    ClamAV before 0.93 allows remote attackers to cause a denial of service (CPU consumption) via a crafted ARJ archive, as demonstrated by the PROTOS GENOME test suite for Archive Formats.

  • CVE-2008-1834Apr 16, 2008
    Swfdec
    Swfdec
    risk 0.00cvss —epss 0.01

    swfdec_load_object.c in Swfdec before 0.6.4 does not properly restrict local file access from untrusted sandboxes, which allows remote attackers to read arbitrary files via a crafted Flash file.

  • CVE-2008-1835Apr 16, 2008
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.04

    ClamAV before 0.93 allows remote attackers to bypass the scanning enging via a RAR file with an invalid version number, which cannot be parsed by ClamAV but can be extracted by Winrar.

  • CVE-2008-1836Apr 16, 2008
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.04

    The rfc2231 function in message.c in libclamav in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via a crafted message that produces a string that is not null terminated, which triggers a buffer over-read.

  • CVE-2008-1837Apr 16, 2008
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.05

    libclamunrar in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via crafted RAR files that trigger "memory problems," as demonstrated by the PROTOS GENOME test suite for Archive Formats.

  • CVE-2008-0314Apr 16, 2008
    ClamAV
    Clamav
    risk 0.01cvss —epss 0.09

    Heap-based buffer overflow in spin.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary code via a crafted PeSpin packed PE binary with a modified length value.

  • CVE-2008-1771Apr 16, 2008
    Firefly Media Server
    mt-daapd
    risk 0.00cvss —epss 0.04

    Integer overflow in the ws_getpostvars function in Firefly Media Server (formerly mt-daapd) 0.2.4.1 (0.9~r1696-1.2 on Debian) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP POST request with a large Content-Length.

  • CVE-2008-1832Apr 16, 2008
    Cecilia
    Cecilia
    risk 0.00cvss —epss 0.00

    lib/prefs.tcl in Cecilia 2.0.5 allows local users to overwrite arbitrary files via a symlink attack on the csvers temporary file.

  • CVE-2008-1833Apr 16, 2008
    ClamAV
    Clamav
    risk 0.01cvss —epss 0.09

    Heap-based buffer overflow in pe.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary code via a crafted WWPack compressed PE binary.

  • CVE-2008-1811Apr 16, 2008
    Oracle Corporation
    Application Express
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Oracle Application Express 3.0.1 has unspecified impact and remote authenticated attack vectors related to flows_030000.wwv_execute_immediate, aka APEX01. NOTE: the previous information was obtained from the April 2008 CPU. Oracle has not commented…

  • CVE-2008-1812Apr 16, 2008
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Enterprise Manager component in Oracle Database 9.0.1.5 FIPS+; Application Server 1.0.2.2; and Enterprise Manager for AS 1.0.2.2 and Database 9.0.1.5 has unknown impact and local attack vectors, aka EM01.

  • CVE-2008-1813Apr 16, 2008
    Oracle Corporation
    SDO_GEOM
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 have unknown impact and remote unauthenticated or authenticated attack vectors related to (1) SYS.DBMS_AQ in the Advanced Queuing component, aka DB01; (2) Core…

  • CVE-2008-1814Apr 16, 2008
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Oracle Secure Enterprise Search or Ultrasearch component in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3; Application Server 9.0.4.3 and 10.1.2.2; and Oracle Collaboration Suite 10.1.2; has unknown impact and remote…

  • CVE-2008-1815Apr 16, 2008
    Oracle Corporation
    Database 10g
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Change Data Capture component in Oracle Database 10.1.0.5, 10.2.0.3, and 11.1.0.6 has unknown impact and remote authenticated attack vectors related to DBMS_CDC_UTILITY, aka DB02. NOTE: the previous information was obtained from the April 2008…