VYPR

CVEs

344,940 total · page 6305 of 6,899

AllCriticalHighKEV
  • CVE-2008-1368Mar 18, 2008
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.11

    CRLF injection vulnerability in Microsoft Internet Explorer 5 and 6 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded CRLF (%0D%0A) before the FTP command, which causes the commands to be inserted into an authenticated FTP…

  • CVE-2008-1367Mar 17, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag (DF) from being reset in violation of ABI conventions and cause data to be copied in the wrong…

  • CVE-2008-1365Mar 17, 2008
    Trend Micro
    Officescan Corporate Edition
    risk 0.07cvss —epss 0.51

    Stack-based buffer overflow in Trend Micro OfficeScan Corporate Edition 8.0 Patch 2 build 1189 and earlier, and 7.3 Patch 3 build 1314 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a long encrypted password, which…

  • CVE-2008-1366Mar 17, 2008
    Trend Micro
    Officescan Corporate Edition
    risk 0.00cvss —epss 0.02

    Trend Micro OfficeScan Corporate Edition 8.0 Patch 2 build 1189 and earlier, and 7.3 Patch 3 build 1314 and earlier, allows remote attackers to cause a denial of service (process consumption) via (1) an HTTP request without a Content-Length header or (2) invalid characters in…

  • CVE-2008-0888Mar 17, 2008
    Unzip Project
    Unzip
    risk 0.01cvss —epss 0.06

    The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or…

  • CVE-2008-1353Mar 17, 2008
    Zabbix
    Zabbix
    risk 0.03cvss —epss 0.06

    zabbix_agentd in ZABBIX 1.4.4 allows remote attackers to cause a denial of service (CPU and connection consumption) via multiple vfs.file.cksum commands with a special device node such as /dev/urandom or /dev/zero.

  • CVE-2008-1354Mar 17, 2008
    Advanced Data Solutions
    Virtual Support Office Xp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in MyIssuesView.asp in Advanced Data Solutions Virtual Support Office-XP (VSO-XP) allows remote attackers to execute arbitrary SQL commands via the Issue_ID parameter.

  • CVE-2008-1355Mar 17, 2008
    Jeeblestechnology
    Directory
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Jeebles Technology Jeebles Directory 2.9.60 allows remote attackers to inject arbitrary web script or HTML via the path parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2008-1356Mar 17, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in xscreensaver in Sun Solaris 10 Java Desktop System (JDS), when using the GNOME On-Screen Keyboard (GOK), allows local users to bypass authentication via unknown vectors that cause the screen saver to crash.

  • CVE-2008-1357Mar 17, 2008
    McAfee
    Epolicy Orchestrator
    risk 0.03cvss —epss 0.06

    Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code…

  • CVE-2008-1358Mar 17, 2008
    Alt N
    Mdaemon
    risk 0.08cvss —epss 0.57

    Stack-based buffer overflow in the IMAP server in Alt-N Technologies MDaemon 9.6.4 allows remote authenticated users to execute arbitrary code via a FETCH command with a long BODY.

  • CVE-2008-1359Mar 17, 2008
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB or IP.Board) 2.3.4 before 2008-03-13 allows remote attackers to inject arbitrary web script or HTML via nested BBCodes, a different vector than CVE-2008-0913.

  • CVE-2008-1360Mar 17, 2008
    Nagios
    Nagios
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Nagios before 2.11 allows remote attackers to inject arbitrary web script or HTML via unknown vectors to unspecified CGI scripts, a different issue than CVE-2007-5624.

  • CVE-2008-1341Mar 17, 2008
    Lagarde
    Storefront
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in SearchResults.aspx in LaGarde StoreFront 6 before SP8 allows remote attackers to execute arbitrary SQL commands via the CategoryId parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-1342Mar 17, 2008
    Polymita Technologies
    Collageportal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the search feature in Polymita BPM-Suite and CollagePortal allow remote attackers to inject arbitrary web script or HTML via the (1) _q and (2) lucene_index_field_value parameters. NOTE: the provenance of this information…

  • CVE-2008-1343Mar 17, 2008
    SCO Group
    Unixware
    risk 0.03cvss —epss 0.01

    Directory traversal vulnerability in (1) pkgadd and (2) pkgrm in SCO UnixWare 7.1.4 allows local users to gain privileges via unknown vectors.

  • CVE-2008-1344Mar 17, 2008
    Myiosoft
    Easycalendar
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MyioSoft EasyCalendar 4.0tr and earlier allow remote attackers to execute arbitrary SQL commands via the (1) year parameter in a dayview action to plugins/calendar/calendar_backend.php and the (2) page parameter to ajaxp_backend.php.

  • CVE-2008-1345Mar 17, 2008
    Myiosoft
    Easycalendar
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in plugins/calendar/calendar_backend.php in MyioSoft EasyCalendar 4.0tr and earlier allows remote attackers to inject arbitrary web script or HTML via the day parameter in a dayview action.

  • CVE-2008-1346Mar 17, 2008
    Myiosoft
    EasyGallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in staticpages/easygallery/index.php in MyioSoft EasyGallery 5.0tr and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter in a category action.

  • CVE-2008-1347Mar 17, 2008
    Myiosoft
    EasyGallery
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in staticpages/easygallery/index.php in MyioSoft EasyGallery 5.0tr and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO or (2) the q parameter in an about action to the help system.

  • CVE-2008-1348Mar 17, 2008
    Ewebsite
    Eweather
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in the eWebsite eWeather (Weather) module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the chart parameter to modules.php.

  • CVE-2008-1349Mar 17, 2008
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in viewcat.php in the bamaGalerie (Bama Galerie) 3.03 and 3.041 module for eXV2 2.0.6 allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2008-1350Mar 17, 2008
    Fully Modded Phpbb
    Fully Modded Phpbb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in kb.php in Fully Modded phpBB (phpbbfm) 80220 allows remote attackers to execute arbitrary SQL commands via the k parameter in an article action.

  • CVE-2008-1351Mar 17, 2008
    XOOPS
    Tutoriais Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Tutorials 2.1b module for XOOPS allows remote attackers to execute arbitrary SQL commands via the tid parameter to printpage.php, which is accessible directly or through a printpage action to index.php.

  • CVE-2008-1352Mar 17, 2008
    EdiorCMS
    ecms
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in search.php in EdiorCMS (ecms) 3.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the _SearchTemplate parameter during a Title search.

  • CVE-2008-0532Mar 14, 2008
    Cisco Systems, Inc.
    Secure Access Control Server
    risk 0.08cvss —epss 0.57

    Multiple buffer overflows in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to execute arbitrary code via a long argument located immediately after…

  • CVE-2008-0533Mar 14, 2008
    Cisco Systems, Inc.
    Secure Access Control Server
    risk 0.05cvss —epss 0.29

    Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to inject arbitrary web script or HTML via an…

  • CVE-2008-1117Mar 14, 2008
    Timbuktu
    Pro
    risk 0.09cvss —epss 0.69

    Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \…

  • CVE-2008-1118Mar 14, 2008
    Timbuktu
    Pro
    risk 0.03cvss —epss 0.03

    Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, does not perform input validation before logging information fields taken from packets from a remote peer, which allows remote attackers to generate crafted log entries, and possibly avoid detection of attacks, via…

  • CVE-2008-1157Mar 14, 2008
    Cisco Systems, Inc.
    Ciscoworks Internetwork Performance Monitor
    risk 0.02cvss —epss 0.21

    Cisco CiscoWorks Internetwork Performance Monitor (IPM) 2.6 creates a process that executes a command shell and listens on a randomly chosen TCP port, which allows remote attackers to execute arbitrary commands.

  • CVE-2008-1337Mar 14, 2008
    Timbuktu
    Pro
    risk 0.00cvss —epss 0.02

    The instant message service in Timbuktu Pro 8.6.5 RC 229 and earlier for Windows allows remote attackers to cause (1) a denial of service (daemon crash) via an invalid Version field or (2) a denial of service (CPU consumption and daemon termination) via an invalid or partial…

  • CVE-2008-1338Mar 14, 2008
    Rogue Wave
    Perforce Server
    risk 0.00cvss —epss 0.02

    The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a server-DiffFile command with an integer value within a certain range, which causes a loop until all memory is exhausted.

  • CVE-2007-6707Mar 13, 2008
    Linksys
    Wag54gs
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.01.03 and earlier firmware allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2007-3574.

  • CVE-2007-6708Mar 13, 2008
    Linksys
    Wag54gs
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.01.03 and earlier firmware allow remote attackers to perform actions as administrators via an arbitrary valid request to an administrative URI, as demonstrated…

  • CVE-2007-6709Mar 13, 2008
    Linksys
    Wag54gs
    risk 0.00cvss —epss 0.02

    The Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.01.03 and earlier firmware has "admin" as its default password for the "admin" account, which makes it easier for remote attackers to obtain access.

  • CVE-2008-1334Mar 13, 2008
    Bt
    Home Hub
    risk 0.00cvss —epss 0.02

    cgi/b on the BT Home Hub router allows remote attackers to bypass authentication, and read or modify administrative settings or make arbitrary VoIP telephone calls, by placing a character at the end of the PATH_INFO, as demonstrated by (1) %5C (encoded backslash), (2) '%'…

  • CVE-2008-1335Mar 13, 2008
    NetBSD
    NetBSD
    risk 0.00cvss —epss 0.02

    The ipsec4_get_ulp function in the kernel in NetBSD 2.0 through 3.1 and NetBSD-current before 20071028, when the fast_ipsec subsystem is enabled, allows remote attackers to bypass the IPsec policy by sending packets from a source machine with a different endianness than the…

  • CVE-2008-1336Mar 13, 2008
    Koobi CMS
    Koobi CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Koobi CMS 4.2.3 through 4.3.0 allows remote attackers to execute arbitrary SQL commands via the categ parameter in a links action to index.php, a different vector than CVE-2008-1122.

  • CVE-2008-1315Mar 13, 2008
    PHP-Nuke
    Zclassifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the ZClassifieds module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the cat parameter to modules.php.

  • CVE-2008-1316Mar 13, 2008
    Qt Cute
    Quicktalk Forum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in qtf_ind_search_ov.php in QT-cute QuickTalk Forum 1.6 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-1317Mar 13, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Inter-Process Communication (IPC) message queue subsystem in Sun Solaris 10 allows local users to cause a denial of service (reboot) via blocked I/O message queues.

  • CVE-2008-1318Mar 13, 2008
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in MediaWiki 1.11 before 1.11.2 allows remote attackers to obtain sensitive "cross-site" information via the callback parameter in an API call for JavaScript Object Notation (JSON) formatted results.

  • CVE-2008-1319Mar 13, 2008
    Versant
    Versant Object Database
    risk 0.03cvss —epss 0.05

    Untrusted search path and argument injection vulnerability in the VersantD service in Versant Object Database 7.0.1.3 and earlier, as used in Borland CaliberRM and probably other products, allows remote attackers to execute arbitrary commands via a request to TCP port 5019 with…

  • CVE-2008-1320Mar 13, 2008
    Asg Sentry
    Sentry Network Manager
    risk 0.04cvss —epss 0.16

    Multiple buffer overflows in ASG-Sentry Network Manager 7.0.0 and earlier allow remote attackers to execute arbitrary code or cause a denial of service (crash) via (1) a long request to FxIAList on TCP port 6162, or (2) an SNMP request with a long community string to FxAgent on…

  • CVE-2008-1321Mar 13, 2008
    Asg Sentry
    Sentry Network Manager
    risk 0.04cvss —epss 0.08

    The FxIAList service in ASG-Sentry Network Manager 7.0.0 and earlier does require authentication, which allows remote attackers to cause a denial of service (service termination) via the exit command to TCP port 6162, or have other impacts via other commands.

  • CVE-2008-1322Mar 13, 2008
    Asg Sentry
    Sentry Network Manager
    risk 0.04cvss —epss 0.10

    The File Check Utility (fcheck.exe) in ASG-Sentry Network Manager 7.0.0 and earlier allows remote attackers to cause a denial of service (CPU consumption) or overwrite arbitrary files via a query string that specifies the -b option, probably due to an argument injection…

  • CVE-2008-1323Mar 13, 2008
    Woltlab
    Burning Board Lite
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in index.php in WoltLab Burning Board Lite (wBB) 2 Beta 1 allows remote attackers to delete threads as other users via the ThreadDelete action.

  • CVE-2008-1324Mar 13, 2008
    Travelsized
    Travelsized CMS
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in index.php in Travelsized CMS 0.4.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) page_id and (2) language parameters. NOTE: this might be the same issue as CVE-2008-1325.

  • CVE-2008-1325Mar 13, 2008
    Uberghey CMS
    CMS
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in index.php in Uberghey CMS 0.3.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) page_id and (2) language parameters. NOTE: this might be the same issue as CVE-2008-1324.

  • CVE-2008-1326Mar 13, 2008
    Gallarific
    Gallarific
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in Gallarific allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.