VYPR

CVEs

344,940 total · page 6306 of 6,899

AllCriticalHighKEV
  • CVE-2008-1327Mar 13, 2008
    Gallarific
    Gallarific
    risk 0.03cvss —epss 0.03

    Gallarific does not require authentication for (1) users.php and (2) index.php, which allows remote attackers to add and edit tasks via a direct request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-1295Mar 12, 2008
    Gregory Kokanosky
    Phpmynewsletter
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in archives.php in Gregory Kokanosky (aka Greg's Place) phpMyNewsletter 0.8 beta 5 and earlier allows remote attackers to execute arbitrary SQL commands via the msg_id parameter.

  • CVE-2008-1296Mar 12, 2008
    EncapsGallery
    EncapsGallery
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in EncapsGallery 1.11.2 allow remote attackers to inject arbitrary web script or HTML via the file parameter to (1) watermark.php and (2) catalog_watermark.php in core/. NOTE: the provenance of this information is unknown; the…

  • CVE-2008-1297Mar 12, 2008
    Ewriting
    Ewriting
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the eWriting (com_ewriting) 1.2.1 module for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in a selectcat action.

  • CVE-2008-1298Mar 12, 2008
    PHP-Nuke
    Hadith Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Hadith module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the cat parameter in a viewcat action to modules.php.

  • CVE-2008-1299MedMar 12, 2008
    Manageengine
    Servicedesk Plus
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the…

  • CVE-2008-1300Mar 12, 2008
    Alkacon
    Opencms
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the filePath.0 parameter…

  • CVE-2008-1301Mar 12, 2008
    Alkacon
    Opencms
    risk 0.00cvss —epss 0.02

    Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote authenticated administrators to read arbitrary files via a full pathname in the filePath.0 parameter.

  • CVE-2008-1302Mar 12, 2008
    Rogue Wave
    Perforce Server
    risk 0.00cvss —epss 0.02

    The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a (1) server-DiffFile or (2) server-ReleaseFile command with a large integer value, which is used in an array initialization…

  • CVE-2008-1303Mar 12, 2008
    Rogue Wave
    Perforce Server
    risk 0.04cvss —epss 0.08

    The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a missing parameter to the (1) dm-FaultFile, (2) dm-LazyCheck, (3) dm-ResolvedFile, (4) dm-OpenFile, (5) crypto, and possibly…

  • CVE-2008-1304Mar 12, 2008
    WordPress
    WordPress
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) inviteemail parameter in an invite action to wp-admin/users.php and the (2) to parameter in a sent action to wp-admin/invites.php.

  • CVE-2008-1305Mar 12, 2008
    PhpBB
    Filebase mod
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in filebase.php in the Filebase mod for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-1306Mar 12, 2008
    Savvy
    Content Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Savvy Content Manager (CM) allow remote attackers to inject arbitrary web script or HTML via the searchterms parameter to (1) searchresults.cfm, (2) search_results.cfm, and (3) search_results/index.cfm. NOTE: the provenance…

  • CVE-2008-1307Mar 12, 2008
    Kingsoft
    Antivirus Online Update Module
    risk 0.04cvss —epss 0.15

    Heap-based buffer overflow in the KUpdateObj2 Class ActiveX control in UpdateOcx2.dll in Beijing KingSoft Antivirus Online Update Module 2007.12.29.29 allows remote attackers to execute arbitrary code via a long argument to the SetUninstallName method.

  • CVE-2008-1308Mar 12, 2008
    Sudirman Angriawan
    Nukec30
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Sudirman Angriawan NukeC30 3.0 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id_catg parameter in a ViewCatg action to modules.php.

  • CVE-2008-1309Mar 12, 2008
    RealNetworks
    Realplayer
    risk 0.07cvss —epss 0.46

    The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the (1) Console or (2) Controls…

  • CVE-2008-1310Mar 12, 2008
    Packettrap
    Pt360 Tool Suite
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the TFTP server in PacketTrap Networks pt360 Tool Suite 1.1.33.1.0, and other versions before 2.0.3900.0, allows remote attackers to read and overwrite arbitrary files via directory traversal sequences in the pathname.

  • CVE-2008-1311Mar 12, 2008
    Packettrap
    Pt360 Tool Suite Pro
    risk 0.07cvss —epss 0.49

    The TFTP server in PacketTrap pt360 Tool Suite PRO 2.0.3901.0 and earlier allows remote attackers to cause a denial of service (daemon hang) by uploading a file named (1) '|' (pipe), (2) '"' (quotation mark), or (3) "<>" (less than, greater than); or (4) a file with a long name.…

  • CVE-2008-1312Mar 12, 2008
    Packettrap
    Pt360 Tool Suite
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the TFTP server in PacketTrap Networks pt360 Tool Suite 1.1.33.1.0, and other versions before 2.0.3900.0, allows remote attackers to cause a denial of service (daemon crash) via a long TFTP packet, a different vulnerability than CVE-2008-1311.

  • CVE-2008-1313Mar 12, 2008
    Bloofoxcms
    Bloo
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Bloo 1.00 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) post_id, (2) post_category_id, (3) post_year_month, and (4) static_page_id parameters; and unspecified other vectors.

  • CVE-2008-1314Mar 12, 2008
    PHP-Nuke
    gaestebuch
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Johannes Hass gaestebuch 2.2 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to modules.php.

  • CVE-2007-6253Mar 12, 2008
    Adobe Inc.
    Form Client
    risk 0.01cvss —epss 0.07

    Multiple buffer overflows in Adobe Form Designer 5.0 and Form Client 5.0 allow remote attackers to execute arbitrary code via unknown vectors in the (1) Adobe File Dialog Button (FileDlg.dll) and the (2) Adobe Copy to Server Object (SvrCopy.dll) ActiveX controls.

  • CVE-2008-0643Mar 12, 2008
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-0644Mar 12, 2008
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.03

    Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism for applications via unspecified vectors related to the setEncoding function.

  • CVE-2008-0890Mar 12, 2008
    Red Hat
    Directory Server
    risk 0.00cvss —epss 0.00

    Red Hat Directory Server 7.1 before SP4 uses insecure permissions for certain directories, which allows local users to modify JAR files and execute arbitrary code via unknown vectors.

  • CVE-2008-1202Mar 12, 2008
    Adobe Inc.
    Livecycle Workflow
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the web management interface in Adobe LiveCycle Workflow 6.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2008-1203Mar 12, 2008
    Adobe Inc.
    Coldfusion
    risk 0.01cvss —epss 0.15

    The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection.

  • CVE-2007-1201Mar 11, 2008
    Microsoft
    Office
    risk 0.02cvss —epss 0.29

    Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary code via vectors related to DataSource that trigger memory corruption, aka "Office Web Components DataSource Vulnerability."

  • CVE-2008-0110Mar 11, 2008
    Microsoft
    Office
    risk 0.03cvss —epss 0.32

    Unspecified vulnerability in Microsoft Outlook in Office 2000 SP3, XP SP3, 2003 SP2 and Sp3, and Office System allows user-assisted remote attackers to execute arbitrary code via a crafted mailto URI.

  • CVE-2008-0111Mar 11, 2008
    Microsoft
    Office
    risk 0.07cvss —epss 0.51

    Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2007, Viewer 2003, Compatibility Pack, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via crafted data validation records, aka "Excel Data Validation Record Vulnerability."

  • CVE-2008-0112Mar 11, 2008
    Microsoft
    Office
    risk 0.06cvss —epss 0.32

    Unspecified vulnerability in Microsoft Excel 2000 SP3, and Office for Mac 2004 and 2008 allows user-assisted remote attackers to execute arbitrary code via a crafted .SLK file that is not properly handled when importing the file, aka "Excel File Import Vulnerability."

  • CVE-2008-0113Mar 11, 2008
    Microsoft
    Excel Viewer
    risk 0.06cvss —epss 0.42

    Unspecified vulnerability in Microsoft Office Excel Viewer 2003 up to SP3 allows user-assisted remote attackers to execute arbitrary code via an Excel document with malformed cell comments that trigger memory corruption from an "allocation error," aka "Microsoft Office Cell…

  • CVE-2008-0114Mar 11, 2008
    Microsoft
    Office
    risk 0.06cvss —epss 0.39

    Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office for Mac 2004 allows user-assisted remote attackers to execute arbitrary code via crafted Style records that trigger memory corruption.

  • CVE-2008-0115Mar 11, 2008
    Microsoft
    Office
    risk 0.06cvss —epss 0.39

    Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2007, Viewer 2003, Compatibility Pack, and Office for Mac 2004 allows user-assisted remote attackers to execute arbitrary code via malformed formulas, aka "Excel Formula Parsing Vulnerability."

  • CVE-2008-0116Mar 11, 2008
    Microsoft
    Office
    risk 0.07cvss —epss 0.48

    Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004 and 2008 for Mac allows user-assisted remote attackers to execute arbitrary code via malformed tags in rich text, aka "Excel Rich Text Validation Vulnerability."

  • CVE-2008-0117Mar 11, 2008
    Microsoft
    Office
    risk 0.06cvss —epss 0.33

    Unspecified vulnerability in Microsoft Excel 2000 SP3 and 2002 SP2, and Office 2004 and 2008 for Mac, allows user-assisted remote attackers to execute arbitrary code via crafted conditional formatting values, aka "Excel Conditional Formatting Vulnerability."

  • CVE-2008-0118Mar 11, 2008
    Microsoft
    Office
    risk 0.06cvss —epss 0.35

    Unspecified vulnerability in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, Excel Viewer 2003 up to SP3, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption from an "allocation…

  • CVE-2008-0300Mar 11, 2008
    Mapbender
    Mapbender
    risk 0.03cvss —epss 0.02

    mapFiler.php in Mapbender 2.4 to 2.4.4 allows remote attackers to execute arbitrary PHP code via PHP code sequences in the factor parameter, which are not properly handled when accessing a filename that contains those sequences.

  • CVE-2008-0301Mar 11, 2008
    Mapbender
    Mapbender
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Mapbender 2.4.4 allow remote attackers to execute arbitrary SQL commands via the gaz parameter to mod_gazetteer_edit.php and other unspecified vectors.

  • CVE-2008-0306Mar 11, 2008
    SAP
    Maxdb
    risk 0.00cvss —epss 0.00

    sdbstarter in SAP MaxDB 7.6.0.37, and possibly other versions, allows local users to execute arbitrary commands by using unspecified environment variables to modify configuration settings.

  • CVE-2008-0307Mar 11, 2008
    SAP
    Maxdb
    risk 0.00cvss —epss 0.04

    Integer signedness error in vserver in SAP MaxDB 7.6.0.37, and possibly other versions, allows remote attackers to execute arbitrary code via unknown vectors that trigger heap corruption.

  • CVE-2008-1285Mar 11, 2008
    Sun Corporation
    Jsf
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2008-1286Mar 11, 2008
    Sun Corporation
    Java Web Console
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Sun Java Web Console 3.0.2, 3.0.3, and 3.0.4 allows remote attackers to bypass intended access restrictions and determine the existence of files or directories via unknown vectors.

  • CVE-2008-1287Mar 11, 2008
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.01

    IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames.

  • CVE-2008-1288Mar 11, 2008
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.01

    IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 might allow local or remote attackers to obtain sensitive information about users by reading user cookies.

  • CVE-2008-1283Mar 11, 2008
    Neptune
    Neptune Web Server
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Neptune Web Server 3.0 allows remote attackers to inject arbitrary web script or HTML via the URI, which is not properly handled in the 404 error page.

  • CVE-2008-1284Mar 11, 2008
    Horde (software)
    Horde
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain configurations, allows remote authenticated users to read and execute arbitrary files via ".." sequences and a null byte in the theme…

  • CVE-2008-1218Mar 10, 2008
    Dovecot (software)
    Dovecot
    risk 0.04cvss —epss 0.07

    Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the…

  • CVE-2008-1272Mar 10, 2008
    Bmscripts
    Bm Classifieds
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in BM Classifieds 20080309 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to showad.php and the (2) ad parameter to pfriendly.php.

  • CVE-2008-1273Mar 10, 2008
    Imagevue
    Imagevue
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in imageVue 1.7 allow remote attackers to inject arbitrary web script or HTML via the path parameter to (1) popup.php, (2) test/dir2.php, (3) admin/upload.php, and (4) dirxml.php in upload/. NOTE: the provenance of this…