VYPR

CVEs

344,940 total · page 6303 of 6,899

AllCriticalHighKEV
  • CVE-2008-1425Mar 20, 2008
    Easy Clanpage
    gallery module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the gallery module in Easy-Clanpage 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a kate action.

  • CVE-2008-1426Mar 20, 2008
    Kaphotoservice
    Kaphotoservice
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in album.asp in KAPhotoservice allows remote attackers to execute arbitrary SQL commands via the albumid parameter.

  • CVE-2008-1427Mar 20, 2008
    Joobi
    Acajoom
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the Joobi Acajoom (com_acajoom) 1.1.5 and 1.2.5 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mailingid parameter in a mailing view action to index.php.

  • CVE-2008-1428Mar 20, 2008
    Drupal
    Ubercart Module
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart 5.x before 5.x-1.0-beta7 module for Drupal allow remote attackers to inject arbitrary web script or HTML via a text attribute value for a product.

  • CVE-2008-1429Mar 20, 2008
    Silc
    Silc Server
    risk 0.00cvss —epss 0.02

    Secure Internet Live Conferencing (SILC) Server before 1.1.1 allows remote attackers to cause a denial of service (daemon crash) via a NEW_CLIENT packet without a nickname.

  • CVE-2008-1430Mar 20, 2008
    Aspapp
    ASPapp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in links.asp in ASPapp allows remote attackers to execute arbitrary SQL commands via the CatId parameter.

  • CVE-2008-1431Mar 20, 2008
    Raidsonic
    Firmware
    risk 0.00cvss —epss 0.00

    RaidSonic NAS-4220-B with 2.6.0-n(2007-10-11) firmware stores a partition encryption key in an unencrypted /system/.crypt file with base64 encoding, which allows local users to obtain the key.

  • CVE-2008-1432Mar 20, 2008
    Manageengine
    Supportcenter Plus
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine SupportCenter Plus 7.0.0 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter, a related issue to CVE-2008-1299. NOTE: the provenance of this information is…

  • CVE-2008-1417Mar 20, 2008
    Axyl
    Axyl
    risk 0.00cvss —epss 0.00

    The prerm script in axyl 2.1.7 allows local users to overwrite arbitrary files via a symlink attack on the axyl.conf temporary file.

  • CVE-2008-1012Mar 20, 2008
    Apple Inc.
    Airport Extreme Base Station Firmware
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Apple AirPort Extreme Base Station Firmware 7.3.1 allows remote attackers to cause a denial of service (file sharing hang) via a crafted AFP request, related to "input validation."

  • CVE-2008-1398Mar 20, 2008
    Auracms
    Auracms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in online.php in AuraCMS 2.0 through 2.2.1 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For field (HTTP_X_FORWARDED_FOR environment variable) in an HTTP header.

  • CVE-2008-1399Mar 20, 2008
    Clansphere
    Clansphere
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Clansphere 2008 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-1400Mar 20, 2008
    Mg Soft
    Net Inspector
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in the Net Inspector HTTP Server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) or "../" (dot dot slash) in the URI.

  • CVE-2008-1401Mar 20, 2008
    Mg Soft
    Net Inspector
    risk 0.03cvss —epss 0.03

    Format string vulnerability in the Net Inspector HTTP server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to execute arbitrary code via format string specifiers in the URI, which is recorded in a log file.

  • CVE-2008-1402Mar 20, 2008
    Mg Soft
    Net Inspector
    risk 0.03cvss —epss 0.03

    MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to cause a (1) denial of service (exception and crash) via a UDP packet to the SNMP Trap Service (MgWTrap3.exe) or (2) denial of service (device freeze or memory consumption) via a malformed request…

  • CVE-2008-1403Mar 20, 2008
    Bootmanage
    Administrator
    risk 0.03cvss —epss 0.04

    Stack-based buffer overflow in the TFTP server in BootManage TFTPD 1.99 and earlier in BootManage Administrator 7.1 and earlier allows remote attackers to execute arbitrary code via a request with a long filename.

  • CVE-2008-1404Mar 20, 2008
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Viso (Industry Book) 2.04 and 2.03 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the kid parameter.

  • CVE-2008-1405Mar 20, 2008
    Fuzzylime
    cms
    risk 0.06cvss —epss 0.35

    PHP remote file inclusion vulnerability in code/display.php in fuzzylime (cms) 3.01 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter.

  • CVE-2008-1406Mar 20, 2008
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in annonces-p-f.php in the MyAnnonces 1.8 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the lid parameter in an ImprAnn action.

  • CVE-2008-1407Mar 20, 2008
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the WebChat 1.60 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the roomid parameter.

  • CVE-2008-1408Mar 20, 2008
    Phpbp
    Phpbp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in includes/functions/banners-external.php in phpBP 2 RC3 (2.204) FIX 4 allows remote attackers to execute arbitrary SQL commands via the id parameter in a banner_out action.

  • CVE-2008-1409Mar 20, 2008
    Exero CMS
    CMS
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in the Default theme in Exero CMS 1.0.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the theme parameter to (1) index.php, (2) editpassword.php, and (3) avatar.php in…

  • CVE-2008-1410Mar 20, 2008
    Acronis
    Snap Deploy
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in the PXE Server (pxesrv.exe) in Acronis Snap Deploy 2.0.0.1076 and earlier allows remote attackers to read arbitrary files via directory traversal sequences to the TFTP service.

  • CVE-2008-1411Mar 20, 2008
    Acronis
    Snap Deploy
    risk 0.04cvss —epss 0.08

    The PXE Server (pxesrv.exe) in Acronis Snap Deploy 2.0.0.1076 and earlier allows remote attackers to cause a denial of service (crash) via an incomplete TFTP request, which triggers a NULL pointer dereference.

  • CVE-2008-1412Mar 20, 2008
    F-Secure
    Internet Security
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2008, and others, allows remote attackers to execute arbitrary code or cause a denial of service (hang or crash) via a malformed archive…

  • CVE-2008-1413Mar 20, 2008
    Snewscms
    Snewscms Rus
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in SNewsCMS Rus 2.1 through 2.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter.

  • CVE-2008-1414Mar 20, 2008
    Multiple Time Sheets
    MTS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the tab parameter to (1) index.php, as demonstrated using mixed case and encoded whitespace characters in the tag; or (2)…

  • CVE-2008-1415Mar 20, 2008
    Multiple Time Sheets
    Multiple Time Sheets
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to read arbitrary files via "../..//" (modified dot dot) sequences in the tab parameter.

  • CVE-2008-1416Mar 20, 2008
    Phpauction
    Phpauction
    risk 0.06cvss —epss 0.35

    Multiple PHP remote file inclusion vulnerabilities in PHPauction GPL 2.51 allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to (1) converter.inc.php, (2) messages.inc.php, and (3) settings.inc.php in includes/.

  • CVE-2007-4592Mar 20, 2008
    IBM
    Rational Clearquest
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A, 7.0.0.2_iFix01, and 7.0.1.1_iFix01 allow remote attackers to inject arbitrary web script or HTML via the (1) contextid, (2) username, (3)…

  • CVE-2007-6254Mar 20, 2008
    SAP
    Businessobjects
    risk 0.01cvss —epss 0.06

    Stack-based buffer overflow in the SAP Business Objects BusinessObjects RptViewerAX ActiveX control in RptViewerAX.dll in Business Objects 6.5 before CHF74 allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2008-0164Mar 20, 2008
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page.

  • CVE-2008-0707Mar 20, 2008
    Microfocus
    StorageWorks Library and Tape Tools
    risk 0.00cvss —epss 0.00

    HP StorageWorks Library and Tape Tools (LTT) before 4.5 SR1 on HP-UX B.11.11 and B.11.23 allows local users to gain privileges via unspecified vectors.

  • CVE-2008-0889Mar 20, 2008
    Red Hat
    Directory Server
    risk 0.00cvss —epss 0.00

    Red Hat Directory Server 8.0, when running on Red Hat Enterprise Linux, uses insecure permissions for the redhat-idm-console script, which allows local users to execute arbitrary code by modifying the script.

  • CVE-2008-1332Mar 20, 2008
    Asterisk
    Asterisk
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before 1.4.18.1 and 1.4.19-rc3; Business Edition A.x.x, B.x.x before B.2.5.1, and C.x.x before C.1.6.2; AsteriskNOW 1.0.x before 1.0.2; Appliance Developer Kit before 1.4 revision 109393; and s800i…

  • CVE-2008-1333Mar 20, 2008
    Asterisk
    Asterisk Open Source
    risk 0.00cvss —epss 0.03

    Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call, or (2) the astman_append function.

  • CVE-2008-1340Mar 20, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.02

    Virtual Machine Communication Interface (VMCI) in VMware Workstation 6.0.x before 6.0.3, VMware Player 2.0.x before 2.0.3, and VMware ACE 2.0.x before 2.0.1 allows attackers to cause a denial of service (host OS crash) via crafted VMCI calls that trigger "memory exhaustion and…

  • CVE-2008-1361Mar 20, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x before 2.0.1 and 1.0.x before 1.0.5, and VMware Server 1.0.x before 1.0.5 on Windows allow local users to gain privileges via an unspecified…

  • CVE-2008-1362Mar 20, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x before 2.0.1 and 1.0.x before 1.0.5, and VMware Server 1.0.x before 1.0.5 on Windows allow local users to gain privileges or cause a denial of…

  • CVE-2008-1363Mar 20, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x before 2.0.1 and 1.0.x before 1.0.5, and VMware Server 1.0.x before 1.0.5 on Windows allow local users to gain privileges via an unspecified…

  • CVE-2008-1364Mar 20, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the DHCP service in VMware Workstation 5.5.x before 5.5.6, VMware Player 1.0.x before 1.0.6, VMware ACE 1.0.x before 1.0.5, VMware Server 1.0.x before 1.0.5, and VMware Fusion 1.1.x before 1.1.1 allows attackers to cause a denial of service.

  • CVE-2008-1392Mar 20, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.03

    The default configuration of VMware Workstation 6.0.2, VMware Player 2.0.x before 2.0.3, and VMware ACE 2.0.x before 2.0.1 makes the console of the guest OS accessible through anonymous VIX API calls, which has unknown impact and attack vectors.

  • CVE-2008-1393Mar 20, 2008
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.03

    Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.

  • CVE-2008-1394Mar 20, 2008
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.01

    Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.

  • CVE-2008-1395Mar 20, 2008
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.01

    Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier for context-dependent attackers to reuse a logged-out session.

  • CVE-2008-1396Mar 20, 2008
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.01

    Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network.

  • CVE-2008-1397Mar 20, 2008
    Checkpoint
    VPN 1
    risk 0.00cvss —epss 0.02

    Check Point VPN-1 Power/UTM, with NGX R60 through R65 and NG AI R55 software, allows remote authenticated users to cause a denial of service (site-to-site VPN tunnel outage), and possibly intercept network traffic, by configuring the local RFC1918 IP address to be the same as…

  • CVE-2008-0062CriMar 19, 2008
    Mit
    Kerberos 5
    risk 0.65cvss 9.8epss 0.10

    KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free.

  • CVE-2008-0063HigMar 19, 2008
    Mit
    Kerberos 5
    risk 0.49cvss 7.5epss 0.03

    The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."

  • CVE-2008-0947Mar 19, 2008
    Mit
    Kerberos 5
    risk 0.01cvss —epss 0.09

    Buffer overflow in the RPC library used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.4 through 1.6.3 allows remote attackers to execute arbitrary code by triggering a large number of open file descriptors.