VYPR

CVEs

344,950 total · page 6302 of 6,899

AllCriticalHighKEV
  • CVE-2008-1490Mar 25, 2008
    Piczo
    Imageuploader4
    risk 0.00cvss —epss 0.04

    Buffer overflow in a certain Aurigma ActiveX control in ImageUploader4.ocx 4.1.36.0, as used with Piczo (aka Pizco) and possibly other online services, allows remote attackers to execute arbitrary code via unspecified vectors, possibly involving a long Action property, a…

  • CVE-2008-1491Mar 25, 2008
    Asus
    Remote Console
    risk 0.09cvss —epss 0.70

    Stack-based buffer overflow in the DPC Proxy server (DpcProxy.exe) in ASUS Remote Console (aka ARC or ASMB3) 2.0.0.19 and 2.0.0.24 allows remote attackers to execute arbitrary code via a long string to TCP port 623.

  • CVE-2008-1492Mar 25, 2008
    Coronamatrix
    Phpaddressbook
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in CoronaMatrix phpAddressBook 2.11 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin parameter to (1) index.php and (2) install.php. NOTE: it was later reported that vector 1 is also…

  • CVE-2008-1493Mar 25, 2008
    Cuteflow
    Cuteflow Bin
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in login.php in Cuteflow Bin 1.5.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.

  • CVE-2008-1494Mar 25, 2008
    Easy Clanpage
    Easy Clanpage
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in inc/module/online.php in Easy-Clanpage 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a user details action, a different vector than CVE-2008-1425.

  • CVE-2008-1495Mar 25, 2008
    Peel
    Peel
    risk 0.03cvss —epss 0.02

    Unrestricted file upload vulnerability in administrer/produits.php in PEEL, possibly 3.x and earlier, allows remote authenticated administrators to upload and execute arbitrary PHP files via a modified content type in an ajout action, as demonstrated by (1) image/gif and (2)…

  • CVE-2008-1496Mar 25, 2008
    Peel
    Peel
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in PEEL, possibly 3.x and earlier, allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to (a) membre.php, and the (2) timestamp parameter to (b) the details action in achat/historique_commandes.php and (c)…

  • CVE-2008-1497Mar 25, 2008
    Netwin
    Surgemail
    risk 0.01cvss —epss 0.06

    Stack-based buffer overflow in the IMAP service in NetWin SurgeMail 38k4-4 and earlier allows remote authenticated users to execute arbitrary code via long arguments to the LSUB command.

  • CVE-2008-1498Mar 25, 2008
    Netwin
    Surgemail
    risk 0.04cvss —epss 0.08

    Stack-based buffer overflow in the IMAP service in NetWin Surgemail 3.8k4-4 and earlier allows remote authenticated users to execute arbitrary code via a long first argument to the LIST command.

  • CVE-2008-1499Mar 25, 2008
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in frontend/x/manpage.html in cPanel 11.18.3 and 11.21.0-BETA allows remote attackers to inject arbitrary web script or HTML via the query string.

  • CVE-2008-1500Mar 25, 2008
    Tinyportal
    Tinyportal
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in TinyPortal 0.8.6 and 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-1501Mar 25, 2008
    Ircu
    Ircu
    risk 0.03cvss —epss 0.05

    The send_user_mode function in s_user.c in (1) Undernet ircu 2.10.12.12 and earlier, (2) snircd 1.3.4 and earlier, and unspecified other ircu derivatives allows remote attackers to cause a denial of service (daemon crash) via a malformed MODE command.

  • CVE-2008-1502Mar 25, 2008
    Moodle
    Moodle
    risk 0.01cvss —epss 0.10

    The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing…

  • CVE-2008-1503Mar 25, 2008
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web management interface in F5 BIG-IP 9.4.3 allows remote attackers to inject arbitrary web script or HTML via (1) the name of a node object, or the (2) sysContact or (3) sysLocation SNMP configuration field, aka "Audit Log XSS."…

  • CVE-2008-1504Mar 25, 2008
    Phpheaven
    Phpmychat
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in setup.php3 in phpHeaven phpMyChat 0.14.5 allows remote attackers to inject arbitrary web script or HTML via the Lang parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-1505Mar 25, 2008
    Sstreamtv
    Custompages
    risk 0.07cvss —epss 0.46

    PHP remote file inclusion vulnerability in the SSTREAMTV custompages (com_custompages) 1.1 and earlier component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the cpage parameter to index.php.

  • CVE-2008-1092Mar 25, 2008
    Microsoft
    Word
    risk 0.02cvss —epss 0.26

    Buffer overflow in msjet40.dll before 4.0.9505.0 in Microsoft Jet Database Engine allows remote attackers to execute arbitrary code via a crafted Word file, as exploited in the wild in March 2008. NOTE: as of 20080513, Microsoft has stated that this is the same issue as…

  • CVE-2008-1160CriMar 25, 2008
    Zyxel
    ZyWALL 1050
    risk 0.68cvss 9.8epss 0.15

    ZyXEL ZyWALL 1050 has a hard-coded password for the Quagga and Zebra processes that is not changed when it is set by a user, which allows remote attackers to gain privileges.

  • CVE-2008-1489Mar 25, 2008
    VideoLAN
    Vlc
    risk 0.04cvss —epss 0.12

    Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MP4 RDRF box that triggers a heap-based buffer overflow, a different vulnerability than…

  • CVE-2007-6711Mar 24, 2008
    Freewebshop
    Freewebshop
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in customer.php in FreeWebshop.org 2.2.5, 2.2.6 and 2.2.7WIP1/2 allows remote attackers to gain administrator privileges via unknown vectors.

  • CVE-2008-1483Mar 24, 2008
    OpenSSH
    OpenSSH
    risk 0.00cvss —epss 0.00

    OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by…

  • CVE-2008-1484Mar 24, 2008
    Punbb
    Punbb
    risk 0.03cvss —epss 0.05

    The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the…

  • CVE-2008-1485Mar 24, 2008
    Punbb
    Punbb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in PunBB 1.2.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the get_host parameter to moderate.php.

  • CVE-2008-1486Mar 24, 2008
    Phorum
    Phorum
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Phorum before 5.2.6, when mysql_use_ft is disabled, allows remote attackers to execute arbitrary SQL commands via the non-fulltext search.

  • CVE-2008-1487Mar 24, 2008
    Linpha
    Linpha
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.3 allow remote attackers to inject arbitrary web script or HTML via (1) ftp/index.php, (2) viewer.php, (3) functions/other.php, (4) include/left_menu.class.php, and (5) plugins/stats/stats_view.php.

  • CVE-2008-1488Mar 24, 2008
    Alternative PHP Cache
    Alternative PHP Cache
    risk 0.04cvss —epss 0.08

    Stack-based buffer overflow in apc.c in Alternative PHP Cache (APC) 3.0.11 through 3.0.16 allows remote attackers to execute arbitrary code via a long filename.

  • CVE-2008-0073Mar 24, 2008
    Xine
    Xine Lib
    risk 0.04cvss —epss 0.09

    Array index error in the sdpplin_parse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter.

  • CVE-2008-0125Mar 24, 2008
    PHP Stats
    Phpstats
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in phpstats.php in Michael Wagner phpstats 0.1 alpha allows remote attackers to inject arbitrary web script or HTML via the baseDir parameter.

  • CVE-2008-0951Mar 24, 2008
    Microsoft
    Windows
    risk 0.02cvss —epss 0.30

    Microsoft Windows Vista does not properly enforce the NoDriveTypeAutoRun registry value, which allows user-assisted remote attackers, and possibly physically proximate attackers, to execute arbitrary code by inserting a (1) CD-ROM device or (2) U3-enabled USB device containing a…

  • CVE-2008-1470Mar 24, 2008
    Rsa
    Webid
    risk 0.03cvss —epss 0.02

    Incomplete blacklist vulnerability in IISWebAgentIF.dll in the WebID RSA Authentication Agent 5.3, and possibly earlier, allows remote attackers to conduct cross-site scripting (XSS) attacks via the postdata parameter, due to an incomplete fix for CVE-2005-1118.

  • CVE-2008-1471Mar 24, 2008
    Panda Project
    Panda Internet Security
    risk 0.03cvss —epss 0.01

    The cpoint.sys driver in Panda Internet Security 2008 and Antivirus+ Firewall 2008 allows local users to cause a denial of service (system crash or kernel panic), overwrite memory, or execute arbitrary code via a crafted IOCTL request that triggers an out-of-bounds write of…

  • CVE-2008-1472Mar 24, 2008
    Ca
    Desktop Management Suite
    risk 0.06cvss —epss 0.39

    Stack-based buffer overflow in the ListCtrl ActiveX Control (ListCtrl.ocx), as used in multiple CA products including BrightStor ARCserve Backup R11.5, Desktop Management Suite r11.1 through r11.2, and Unicenter products r11.1 through r11.2, allows remote attackers to execute…

  • CVE-2008-1473Mar 24, 2008
    Symantec
    Deployment Solution
    risk 0.00cvss —epss 0.00

    The Altiris Client Service (AClient.exe) in Symantec Altiris Deployment Solution 6.8.x before 6.9.164 allows local users to gain privileges via a "Shatter" style attack.

  • CVE-2008-1474Mar 24, 2008
    Roundup Tracker
    Roundup
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Roundup before 1.4.4 have unknown impact and attack vectors, some of which may be related to cross-site scripting (XSS).

  • CVE-2008-1475Mar 24, 2008
    Roundup Tracker
    Roundup
    risk 0.00cvss —epss 0.02

    The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.

  • CVE-2008-1476Mar 24, 2008
    Serendipity
    Serendipity
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to received trackbacks.

  • CVE-2008-1477Mar 24, 2008
    EForum
    eForum
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in busca.php in eForum 0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) busca and (2) link parameters.

  • CVE-2008-1478Mar 24, 2008
    Home FTP Server Project
    Home Ftp Server
    risk 0.03cvss —epss 0.03

    Home FTP Server 1.4.5.89 allows remote attackers to cause a denial of service (crash) by opening a FTP passive mode connection, then closing the original FTP connection. NOTE: some of these details are obtained from third party information.

  • CVE-2008-1479Mar 24, 2008
    Cyberfrogs
    Cfnetgs
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in cyberfrogs.net cfnetgs 0.24 allows remote attackers to inject arbitrary web script or HTML via the directory parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-1480Mar 24, 2008
    Sun Corporation
    Solaris
    risk 0.03cvss —epss 0.06

    rpc.metad in Sun Solaris 10 allows remote attackers to cause a denial of service (daemon crash) via a malformed RPC request.

  • CVE-2008-1481Mar 24, 2008
    Webspell
    Webspell
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in webSPELL 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the board parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-1482Mar 24, 2008
    Xine
    Xine Lib
    risk 0.04cvss —epss 0.10

    Multiple integer overflows in xine-lib 1.1.11 and earlier allow remote attackers to trigger heap-based buffer overflows and possibly execute arbitrary code via (1) a crafted .FLV file, which triggers an overflow in demuxers/demux_flv.c; (2) a crafted .MOV file, which triggers an…

  • CVE-2008-1462Mar 24, 2008
    Runcms
    Runcms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the sections (Section) module in RunCMS allows remote attackers to execute arbitrary SQL commands via the artid parameter in a viewarticle action.

  • CVE-2008-1463Mar 24, 2008
    Imperva
    Securesphere
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the management GUI in Imperva SecureSphere MX Management Server 5.0 allows remote attackers to inject arbitrary web script or HTML via an invalid or prohibited request to a web server protected by SecureSphere, which triggers injection…

  • CVE-2008-1464Mar 24, 2008
    Gallarific
    Gallarific
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Gallarific Free Edition 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) query parameter to (a) search.php; (2) gusername and (3) gpassword parameters to (b) login.php; and the (4) username and (5) password…

  • CVE-2008-1465Mar 24, 2008
    Joomla
    Restaurante
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Detodas Restaurante (com_restaurante) 1.0 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php, a different product than CVE-2008-0562.

  • CVE-2008-1466Mar 24, 2008
    W Agora
    W Agora
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in W-Agora 4.0 allow remote attackers to execute arbitrary PHP code via a URL in the bn_dir_default parameter to (1) add_user.php, (2) create_forum.php, (3) create_user.php, (4) delete_notes.php, (5) delete_user.php, (6)…

  • CVE-2008-1467Mar 24, 2008
    Centerim
    Centerim
    risk 0.03cvss —epss 0.04

    CenterIM 4.22.3 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URI, related to "received URLs in the message window." NOTE: this issue has been disputed due to the user-assisted nature, since the URL must be…

  • CVE-2008-1468Mar 24, 2008
    Namazu
    Namazu
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in namazu.cgi in Namazu before 2.0.18 allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded input, related to failure to set the charset, a different vector than CVE-2004-1318 and CVE-2001-1350. NOTE: some of…

  • CVE-2008-1469Mar 24, 2008
    Gallarific
    Gallarific
    risk 0.00cvss —epss 0.01

    Gallarific Free Edition 1.1 does not require authentication for (1) photos.php, (2) comments.php, and (3) gallery.php in gadmin/, which allows remote attackers to edit objects via a direct request, different vectors than CVE-2008-1327. NOTE: the provenance of this information…