VYPR

CVEs

344,950 total · page 6301 of 6,899

AllCriticalHighKEV
  • CVE-2008-1545Mar 28, 2008
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.12

    The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST…

  • CVE-2008-1546Mar 28, 2008
    Mitsubishielectric
    Gb
    risk 0.00cvss —epss 0.02

    servlet/MIMEReceiveServlet in the web controller for Mitsubishi Electric GB-50 and GB-50A air-conditioning control systems allows remote attackers to cause a denial of service (air-conditioning outage) via an XML document containing a setRequest command.

  • CVE-2008-0924Mar 28, 2008
    Novell
    Edirectory
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in the DoLBURPRequest function in libnldap in ndsd in Novell eDirectory 8.7.3.9 and earlier, and 8.8.1 and earlier in the 8.8.x series, allows remote attackers to cause a denial of service (daemon crash or CPU consumption) or execute arbitrary code…

  • CVE-2008-0926Mar 28, 2008
    Novell
    Edirectory
    risk 0.08cvss —epss 0.58

    The SOAP interface to the eMBox module in Novell eDirectory 8.7.3.9 and earlier, and 8.8.x before 8.8.2, relies on client-side authentication, which allows remote attackers to bypass authentication via requests for /SOAP URIs, and cause a denial of service (daemon shutdown) or…

  • CVE-2008-1534Mar 28, 2008
    PowerPHPBoard
    PowerPHPBoard
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in PowerPHPBoard 1.00b allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) settings[footer] parameter to footer.inc.php and the (2) settings[header] parameter to header.inc.php.

  • CVE-2008-1535Mar 28, 2008
    Joomla
    com_rekry
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Matti Kiviharju rekry (aka com_rekry or rekry!Joom) 1.0.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the op_id parameter in a view action to index.php.

  • CVE-2008-1536Mar 28, 2008
    Picturespro
    Photo Cart
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Pictures Pro (aka Tim Grissett) Photo Cart 4.1 allows remote attackers to inject arbitrary web script or HTML via the amessage parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2008-1537Mar 28, 2008
    Powerscripts
    Powerbook
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in pb_inc/admincenter/index.php in PowerScripts PowerBook 1.21 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter. NOTE: in some environments, this can be leveraged for remote file…

  • CVE-2008-1538Mar 28, 2008
    Manageengine
    EventLog Analyzer
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in searchAction.do in ManageEngine EventLog Analyzer 5 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2008-1539Mar 28, 2008
    PHP-Nuke
    PHP-Nuke Platinum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in includes/dynamic_titles.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary SQL commands via the p parameter to modules.php for the Forums module.

  • CVE-2008-1540Mar 28, 2008
    Datsogallery
    Datsogallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Datsogallery (com_datsogallery) 1.3.1 module for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php. NOTE: the provenance of this information is unknown; the details…

  • CVE-2008-1541Mar 28, 2008
    His
    Webshop
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in cgi-bin/his-webshop.pl in HIS Webshop 2.50 allows remote attackers to read arbitrary files via a .. (dot dot) in the t parameter.

  • CVE-2008-1240Mar 28, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related…

  • CVE-2008-1532Mar 28, 2008
    Perlbal
    Perlbal
    risk 0.00cvss —epss 0.02

    Perlbal before 1.70, when buffered upload is enabled, allows remote attackers to cause a denial of service (crash) via a zero-byte chunked upload.

  • CVE-2008-1533Mar 28, 2008
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the XML-RPC Blogger API plugin in Joomla! 1.5 allows remote attackers to perform unauthorized article operations on articles via unknown vectors.

  • CVE-2008-1530Mar 27, 2008
    Gnupg
    Gnupg
    risk 0.00cvss —epss 0.04

    GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers "memory corruption around deduplication of user IDs."

  • CVE-2008-1531Mar 27, 2008
    Lighttpd
    Lighttpd
    risk 0.00cvss —epss 0.03

    The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of service (active SSL connection loss) by triggering an SSL error, such as disconnecting before a download has finished, which…

  • CVE-2008-1150Mar 27, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    The virtual private dial-up network (VPDN) component in Cisco IOS before 12.3 allows remote attackers to cause a denial of service (resource exhaustion) via a series of PPTP sessions, related to the persistence of interface descriptor block (IDB) data structures after process…

  • CVE-2008-1151Mar 27, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Memory leak in the virtual private dial-up network (VPDN) component in Cisco IOS before 12.3 allows remote attackers to cause a denial of service (memory consumption) via a series of PPTP sessions, related to "dead memory" that remains allocated after process termination, aka…

  • CVE-2008-1152Mar 27, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.04

    The data-link switching (DLSw) component in Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of service (device restart or memory consumption) via crafted (1) UDP port 2067 or (2) IP protocol 91 packets.

  • CVE-2008-1384Mar 27, 2008
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    Integer overflow in PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service and possibly have unspecified other impact via a printf format parameter with a large width specifier, related to the php_sprintf_appendstring function in formatted_print.c…

  • CVE-2008-1391Mar 27, 2008
    Apple Inc.
    Mac OS 9
    risk 0.05cvss —epss 0.19

    Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in…

  • CVE-2008-0537Mar 27, 2008
    Cisco Systems, Inc.
    Route Switch Processor
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Supervisor Engine 32 (Sup32), Supervisor Engine 720 (Sup720), and Route Switch Processor 720 (RSP720) for multiple Cisco products, when using Multi Protocol Label Switching (MPLS) VPN and OSPF sham-link, allows remote attackers to cause a denial…

  • CVE-2008-1153Mar 27, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.06

    Cisco IOS 12.1, 12.2, 12.3, and 12.4, with IPv4 UDP services and the IPv6 protocol enabled, allows remote attackers to cause a denial of service (device crash and possible blocked interface) via a crafted IPv6 packet to the device.

  • CVE-2008-1156Mar 27, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Multicast Virtual Private Network (MVPN) implementation in Cisco IOS 12.0, 12.2, 12.3, and 12.4 allows remote attackers to create "extra multicast states on the core routers" via a crafted Multicast Distribution Tree (MDT) Data Join message.

  • CVE-2008-1233Mar 27, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via "XPCNativeWrapper pollution."

  • CVE-2008-1234Mar 27, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to inject arbitrary web script or HTML via event handlers, aka "Universal XSS using event handlers."

  • CVE-2008-1235Mar 27, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via unknown vectors that cause JavaScript to execute with the wrong principal, aka "Privilege escalation via…

  • CVE-2008-1236Mar 27, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the layout engine.

  • CVE-2008-1237Mar 27, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the JavaScript engine.

  • CVE-2008-1238Mar 27, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating the HTTP Referer header, does not list the entire URL when it contains Basic Authentication credentials without a username, which makes it easier for remote attackers to bypass application protection…

  • CVE-2008-1241Mar 27, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    GUI overlay vulnerability in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 allows remote attackers to spoof form elements and redirect user inputs via a borderless XUL pop-up window from a background tab.

  • CVE-2008-1521Mar 26, 2008
    Zyxel
    P-661
    risk 0.00cvss —epss 0.01

    ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to gain privileges by accessing administrative URIs, as demonstrated by rpSysAdmin.html.

  • CVE-2008-1522Mar 26, 2008
    Zyxel
    P-661
    risk 0.00cvss —epss 0.01

    ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), have (1) "user" as their default password for the "user" account and (2) "1234" as their default password for the "admin" account, which makes it easier for remote attackers…

  • CVE-2008-1523Mar 26, 2008
    Zyxel
    P-661
    risk 0.00cvss —epss 0.01

    ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to obtain ISP and Dynamic DNS credentials by sending a direct request for (1) WAN.html, (2) wzPPPOE.html, and (3) rpDyDNS.html, and…

  • CVE-2008-1524Mar 26, 2008
    Zyxel
    Prestige
    risk 0.00cvss —epss 0.01

    The SNMP service on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), has "public" as its default community for both (1) read and (2) write operations, which allows remote attackers to perform administrative actions via SNMP,…

  • CVE-2008-1525Mar 26, 2008
    Zyxel
    Prestige
    risk 0.00cvss —epss 0.01

    The default SNMP configuration on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), has a Trusted Host value of 0.0.0.0, which allows remote attackers to send SNMP requests from any source IP address.

  • CVE-2008-1526HigMar 26, 2008
    Zyxel
    P-661
    risk 0.49cvss 7.5epss 0.01

    ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculating an MD5 password hash, which makes it easier for attackers to crack passwords.

  • CVE-2008-1527Mar 26, 2008
    Zyxel
    Prestige
    risk 0.00cvss —epss 0.01

    ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), support authentication over HTTP via a hash string in the hiddenPassword field, which allows remote attackers to obtain access via a replay attack.

  • CVE-2008-1528Mar 26, 2008
    Zyxel
    Prestige
    risk 0.00cvss —epss 0.01

    ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to obtain authentication data by making direct HTTP requests and then reading the HTML source, as demonstrated by a request for (1)…

  • CVE-2008-1529Mar 26, 2008
    Zyxel
    Prestige
    risk 0.00cvss —epss 0.01

    ZyXEL Prestige routers have a minimum password length for the admin account that is too small, which makes it easier for remote attackers to guess passwords via brute force methods.

  • CVE-2008-1514Mar 26, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    arch/s390/kernel/ptrace.c in Linux kernel 2.6.9, and other versions before 2.6.27-rc6, on s390 platforms allows local users to cause a denial of service (kernel panic) via the user-area-padding test from the ptrace testsuite in 31-bit mode, which triggers an invalid dereference.

  • CVE-2008-1508Mar 25, 2008
    Efestech
    E-Kontör
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in EfesTech E-Kontör and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-1509Mar 25, 2008
    Xlportal
    Xlportal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in XLPortal 2.2.4 and earlier allows remote attackers to execute arbitrary SQL commands via the query parameter.

  • CVE-2008-1510Mar 25, 2008
    Alkacon
    Opencms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in system/workplace/admin/accounts/users_list.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the (1) searchfilter or (2) listSearchFilter parameter.

  • CVE-2008-1511CriMar 25, 2008
    Oocomments
    Oocomments
    risk 0.67cvss 9.8epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in ooComments 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the PathToComment parameter for (1) classes/class_admin.php and (2) classes/class_comments.php. NOTE: the provenance of this information is…

  • CVE-2008-1512Mar 25, 2008
    PhpBB
    eXtreme Styles module (XS-Mod)
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in admin/admin_xs.php in eXtreme Styles module (XS-Mod) 2.3.1 and 2.4.0 for phpBB allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the phpEx parameter. NOTE: some of these details are obtained from third party…

  • CVE-2008-1513Mar 25, 2008
    Danneo
    CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Danneo CMS 0.5.1 and earlier, when the Referers statistics option is enabled, allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header.

  • CVE-2008-1506Mar 25, 2008
    Peel
    Peel
    risk 0.03cvss —epss 0.02

    PEEL, possibly 3.x and earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.

  • CVE-2008-1507Mar 25, 2008
    Peel
    Peel
    risk 0.03cvss —epss 0.02

    PEEL, possibly 3.x and earlier, has (1) a default info@peel.fr account with password admin, and (2) a default contact@peel.fr account with password cinema, which allows remote attackers to gain administrative access.