VYPR

CVEs

344,940 total · page 6307 of 6,899

AllCriticalHighKEV
  • CVE-2008-1274Mar 10, 2008
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in man in IBM AIX 6.1.0 allows local users to execute arbitrary code via a malicious program in the man directory.

  • CVE-2008-1275Mar 10, 2008
    MailEnable
    Mailenable
    risk 0.03cvss —epss 0.04

    Multiple unspecified vulnerabilities in the SMTP service in MailEnable Standard Edition 1.x, Professional Edition 3.x and earlier, and Enterprise Edition 3.x and earlier allow remote attackers to cause a denial of service (crash) via crafted (1) EXPN or (2) VRFY commands.

  • CVE-2008-1276Mar 10, 2008
    MailEnable
    Mailenable
    risk 0.04cvss —epss 0.07

    Multiple buffer overflows in the IMAP service (MEIMAPS.EXE) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allow remote authenticated attackers to execute arbitrary code via long arguments to the (1) FETCH, (2) EXAMINE, and (3) UNSUBSCRIBE commands.

  • CVE-2008-1277Mar 10, 2008
    MailEnable
    Mailenable
    risk 0.04cvss —epss 0.08

    The IMAP service (MEIMAPS.exe) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allows remote attackers to cause a denial of service (crash) via (1) SEARCH and (2) APPEND commands without required arguments, which triggers a NULL pointer dereference.

  • CVE-2008-1278Mar 10, 2008
    Remotelyanywhere
    Remotelyanywhere
    risk 0.04cvss —epss 0.07

    The RemotelyAnywhere.exe service in the Remotely Anywhere Server and Workstation 8.0.668 and earlier allows remote attackers to cause a denial of service (crash) via an invalid Accept-Charset header, which triggers a NULL pointer dereference. NOTE: the service is automatically…

  • CVE-2008-1279Mar 10, 2008
    Acronis
    True Image
    risk 0.00cvss —epss 0.02

    Acronis True Image Group Server 1.5.19.191 and earlier, included in Acronis True Image Enterprise Server 9.5.0.8072 and the other True Image packages, allows remote attackers to cause a denial of service (crash) via a packet with an invalid length field, which causes an…

  • CVE-2008-1280Mar 10, 2008
    Acronis
    True Image
    risk 0.00cvss —epss 0.02

    Acronis True Image Windows Agent 1.0.0.54 and earlier, included in Acronis True Image Enterprise Server 9.5.0.8072 and the other True Image packages, allows remote attackers to cause a denial of service (crash) via a malformed packet to port 9876, which triggers a NULL pointer…

  • CVE-2008-1281Mar 10, 2008
    Argon Technology
    Client Management Services
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in TFTPsrvs.exe 2.5.3.1 and earlier, as used in Argon Technology Client Management Services (CMS) 1.31 and earlier, allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.

  • CVE-2008-1282Mar 10, 2008
    risk 0.00cvss —epss 0.06

    Buffer overflow in the BFup ActiveX control (BFup.dll) in B21Soft BFup before 1.0.802.29 allows remote attackers to execute arbitrary code via a long FilePath parameter.

  • CVE-2008-1161Mar 10, 2008
    Matroska Org
    Demuxer
    risk 0.01cvss —epss 0.07

    Buffer overflow in the Matroska demuxer (demuxers/demux_matroska.c) in xine-lib before 1.1.10.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Matroska file with invalid frame sizes.

  • CVE-2008-1270Mar 10, 2008
    Lighttpd
    Lighttpd
    risk 0.04cvss —epss 0.12

    mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.

  • CVE-2008-1219Mar 10, 2008
    PHP-Nuke
    Kutub-i Sitte
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Kutub-i Sitte (KutubiSitte) 1.1 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the kid parameter in a hadisgoster action to modules.php.

  • CVE-2008-1220Mar 10, 2008
    Warpspeed
    4nchat
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the 4nChat 0.91 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the roomid parameter in an index action to modules.php. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2008-1221Mar 10, 2008
    MicroWorld Technologies
    Escan
    risk 0.03cvss —epss 0.03

    Absolute path traversal vulnerability in the FTP server in MicroWorld eScan Corporate Edition 9.0.742.98 and eScan Management Console (aka eScan Server) 9.0.742.1 allows remote attackers to read arbitrary files via an absolute pathname in the RETR (get) command.

  • CVE-2008-1222Mar 10, 2008
    Dokeos
    Dokeos
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Dokeos 1.8.4 before SP3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-1223Mar 10, 2008
    Dokeos
    Dokeos
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Dokeos 1.8.4 before SP3 allows attackers to execute arbitrary code via unspecified vectors.

  • CVE-2008-1224Mar 10, 2008
    BosClassifieds
    BosClassifieds Classified Ads System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in account.php in BosClassifieds Classified Ads System 3.0 allows remote attackers to inject arbitrary web script or HTML via the returnTo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2008-1225Mar 10, 2008
    Webct
    Webct
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in WebCT Campus Edition 4.1.5.8, when "Don't wrap text" is enabled, allow remote authenticated users to inject arbitrary web script or HTML via a (1) mail message or (2) discussion board message. NOTE: this might overlap…

  • CVE-2008-1226Mar 10, 2008
    Zimbra
    Collaboration Server
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration Suite (ZCS) 4.0.3, 4.5.6, and possibly other versions before 4.5.10 allow remote attackers to inject arbitrary web script or HTML via an e-mail attachment, possibly involving a (1) .jpg or (2) .gif image…

  • CVE-2008-1227Mar 10, 2008
    Silc
    Silc Toolkit
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the silc_fingerprint function in lib/silcutil/silcutil.c in Secure Internet Live Conferencing (SILC) Toolkit 1.1.5, and unspecified earlier versions, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code…

  • CVE-2008-1228Mar 10, 2008
    Minigal
    Mg2
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin.php in MG2 (formerly Minigal) allows remote attackers to inject arbitrary web script or HTML via the list parameter in an import action.

  • CVE-2008-1229Mar 10, 2008
    Jspwiki
    Jspwiki
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to inject arbitrary web script or HTML via the editor parameter, a different vector than CVE-2007-5120.b.

  • CVE-2008-1230Mar 10, 2008
    Jspwiki
    Jspwiki
    risk 0.03cvss —epss 0.04

    Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbitrary .jsp files via an unspecified manipulation that attaches a .jsp file to an "entry page."

  • CVE-2008-1231Mar 10, 2008
    Jspwiki
    Jspwiki
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to include and execute arbitrary local .jsp files, and obtain sensitive information, via a .. (dot dot) in the editor parameter.

  • CVE-2008-1242Mar 10, 2008
    Belkin
    F5d7230 4
    risk 0.03cvss —epss 0.04

    The control panel on the Belkin F5D7230-4 router with firmware 9.01.10 maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session from a source IP address of a previously authenticated user, a different…

  • CVE-2008-1243Mar 10, 2008
    Linksys
    Wrt300n
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability on the Linksys WRT300N router with firmware 2.00.20, when Mozilla Firefox or Apple Safari is used, allows remote attackers to inject arbitrary web script or HTML via the dyndns_domain parameter to the default URI.

  • CVE-2008-1244Mar 10, 2008
    Belkin
    F5d7230 4
    risk 0.03cvss —epss 0.05

    cgi-bin/setup_dns.exe on the Belkin F5D7230-4 router with firmware 9.01.10 does not require authentication, which allows remote attackers to perform administrative actions, as demonstrated by changing a DNS server via the dns1_1, dns1_2, dns1_3, and dns1_4 parameters. NOTE: it…

  • CVE-2008-1245Mar 10, 2008
    Belkin
    F5d7230 4
    risk 0.03cvss —epss 0.03

    cgi-bin/setup_virtualserver.exe on the Belkin F5D7230-4 router with firmware 9.01.10 allows remote attackers to cause a denial of service (control center outage) via an HTTP request with invalid POST data and a "Connection: Keep-Alive" header.

  • CVE-2008-1246HigMar 10, 2008
    Cisco Systems, Inc.
    Pix Asa Finesse Operation System
    risk 0.51cvss 7.8epss 0.00

    The Cisco PIX/ASA Finesse Operation System 7.1 and 7.2 allows local users to gain privileges by entering characters at the enable prompt, erasing these characters via the Backspace key, and then holding down the Backspace key for one second after erasing the final character.…

  • CVE-2008-1247Mar 10, 2008
    Linksys
    Wrt54g
    risk 0.03cvss —epss 0.05

    The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via a direct request to (1) Advanced.tri, (2) AdvRoute.tri, (3) Basic.tri, (4)…

  • CVE-2008-1248Mar 10, 2008
    Snom
    320 Sip Phone
    risk 0.00cvss —epss 0.01

    The web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to make arbitrary phone calls via the "Call a number" field. NOTE: this might overlap CVE-2007-3440.

  • CVE-2008-1249Mar 10, 2008
    Snom
    320 Sip Phone
    risk 0.00cvss —epss 0.01

    snomControl.swf in the central phone server for the Snom 320 SIP Phone allows remote attackers to cause a denial of service (application crash and corruption of call logs) via a "'); (double quote, quote, close parenthesis, semicolon) sequence in the "Call a number" field.

  • CVE-2008-1250Mar 10, 2008
    Snom
    320 Sip Phone
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allow remote attackers to perform actions as the phone user, as demonstrated by inserting an address-book entry containing an XSS sequence.

  • CVE-2008-1251Mar 10, 2008
    Snom
    320 Sip Phone
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-1252Mar 10, 2008
    Telekom
    Speedport W500 DSL router
    risk 0.00cvss —epss 0.02

    b_banner.stm (aka the login page) on the Deutsche Telekom Speedport W500 DSL router allows remote attackers to obtain the logon password by reading the pwd field in the HTML source.

  • CVE-2008-1253Mar 10, 2008
    Dlink
    Dsl G604t
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cgi-bin/webcm on the D-Link DSL-G604T router allows remote attackers to inject arbitrary web script or HTML via the var:category parameter, as demonstrated by a request for advanced/portforw.htm on the fwan page.

  • CVE-2008-1254Mar 10, 2008
    Zyxel
    P-660HW series router
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities on the ZyXEL P-660HW series router allow remote attackers to (1) change DNS servers and (2) add keywords to the "bannedlist" via unspecified vectors.

  • CVE-2008-1255Mar 10, 2008
    Zyxel
    P-660HW series router
    risk 0.00cvss —epss 0.04

    The ZyXEL P-660HW series router maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session from a source IP address of a previously authenticated user.

  • CVE-2008-1256Mar 10, 2008
    Zyxel
    P-660HW series router
    risk 0.00cvss —epss 0.03

    The ZyXEL P-660HW series router has "admin" as its default password, which allows remote attackers to gain administrative access.

  • CVE-2008-1257Mar 10, 2008
    Zyxel
    P-660HW series router
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Forms/DiagGeneral_2 on the ZyXEL P-660HW series router allows remote attackers to inject arbitrary web script or HTML via the PingIPAddr parameter.

  • CVE-2008-1258Mar 10, 2008
    Dlink
    Di 604\+
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in prim.htm on the D-Link DI-604 router allows remote attackers to inject arbitrary web script or HTML via the rf parameter.

  • CVE-2008-1259Mar 10, 2008
    Zyxel
    P 2602hw D1a
    risk 0.00cvss —epss 0.02

    The Zyxel P-2602HW-D1A router with 3.40(AJZ.1) firmware maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session from a source IP address of a user who previously authenticated within the previous 5 minutes.

  • CVE-2008-1260Mar 10, 2008
    Zyxel
    P 2602hw D1a
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities on the Zyxel P-2602HW-D1A router with 3.40(AJZ.1) firmware allow remote attackers to (1) make the admin web server available on the Internet (WAN) interface via the WWWAccessInterface parameter to Forms/RemMagWWW_1 or…

  • CVE-2008-1261Mar 10, 2008
    Zyxel
    P 2602hw D1a
    risk 0.00cvss —epss 0.01

    The Zyxel P-2602HW-D1A router with 3.40(AJZ.1) firmware provides different responses to admin page requests depending on whether a user is logged in, which allows remote attackers to obtain current login status by requesting an arbitrary admin URI.

  • CVE-2008-1262Mar 10, 2008
    Airspan
    Wimax Prost
    risk 0.04cvss —epss 0.09

    The administration panel on the Airspan WiMax ProST 4.1 antenna with 6.5.38.0 software does not verify authentication credentials, which allows remote attackers to (1) upload malformed firmware or (2) bind the antenna to a different WiMAX base station via unspecified requests to…

  • CVE-2008-1263Mar 10, 2008
    Linksys
    Wrt54g
    risk 0.00cvss —epss 0.01

    The Linksys WRT54G router stores passwords and keys in cleartext in the Config.bin file, which might allow remote authenticated users to obtain sensitive information via an HTTP request for the top-level Config.bin URI.

  • CVE-2008-1264Mar 10, 2008
    Linksys
    Wrt54g
    risk 0.00cvss —epss 0.03

    The Linksys WRT54G router has "admin" as its default FTP password, which allows remote attackers to access sensitive files including nvram.cfg, a file that lists all HTML documents, and an ELF executable file.

  • CVE-2008-1265Mar 10, 2008
    Linksys
    Wrt54g
    risk 0.00cvss —epss 0.02

    The Linksys WRT54G router allows remote attackers to cause a denial of service (device restart) via a long username and password to the FTP interface.

  • CVE-2008-1266Mar 10, 2008
    Dlink
    Di 524
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in the web interface on the D-Link DI-524 router allow remote attackers to cause a denial of service (device crash) or possibly have unspecified other impact via (1) a long username or (2) an HTTP header with a large name and an empty value.

  • CVE-2008-1267Mar 10, 2008
    Siemens Foundation
    Speedstream 6520
    risk 0.00cvss —epss 0.02

    The Siemens SpeedStream 6520 router allows remote attackers to cause a denial of service (web interface crash) via an HTTP request to basehelp_English.htm with a large integer in the Content-Length field.