VYPR

CVEs

344,908 total · page 6319 of 6,899

AllCriticalHighKEV
  • CVE-2008-0567Feb 5, 2008
    Chronoengine
    Chronoforms
    risk 0.06cvss —epss 0.34

    Multiple PHP remote file inclusion vulnerabilities in ChronoEngine ChronoForms (com_chronocontact) 2.3.5 component for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) PPS/File.php, (2) Writer.php, and (3)…

  • CVE-2008-0568Feb 5, 2008
    Drupal
    Secure Site Module
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the IP-authentication feature in the Secure Site 5.x-1.0 and 4.7.x-1.0 module for Drupal allows remote attackers to gain the privileges of a user who has authenticated from behind the same proxy server as the attacker.

  • CVE-2008-0569Feb 5, 2008
    Drupal
    Comment Upload
    risk 0.00cvss —epss 0.03

    The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass upload validation, and upload arbitrary files and possibly execute arbitrary code, via unspecified…

  • CVE-2008-0570Feb 5, 2008
    Drupal
    Openid
    risk 0.00cvss —epss 0.01

    The OpenID 5.x-1.0 and earlier module for Drupal does not properly verify the claimed_id returned by an OpenID provider, which allows remote OpenID providers to spoof OpenID authentication for domains associated with other providers.

  • CVE-2008-0571Feb 5, 2008
    Drupal
    Userpoints
    risk 0.00cvss —epss 0.01

    The point moderation form in the Userpoints 4.7.x before 4.7.x-2.3, 5.x-2 before 5.x-2.16, and 5.x-3 before 5.x-3.3 module for Drupal does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and…

  • CVE-2008-0572Feb 5, 2008
    Mindmeld
    Mindmeld
    risk 0.05cvss —epss 0.20

    Multiple PHP remote file inclusion vulnerabilities in Mindmeld 1.2.0.10 allow remote attackers to execute arbitrary PHP code via a URL in the MM_GLOBALS[home] parameter to (1) acweb/admin_index.php; and (2) ask.inc.php, (3) learn.inc.php, (4) manage.inc.php, (5) mind.inc.php,…

  • CVE-2008-0573Feb 5, 2008
    Safenet
    Safenet Highassurance Remote
    risk 0.03cvss —epss 0.01

    IPSecDrv.sys 10.4.0.12 in SafeNET HighAssurance Remote and SoftRemote allows local users to gain privileges via a crafted IPSECDRV_IOCTL IOCTL request.

  • CVE-2008-0574Feb 5, 2008
    Webspell
    Webspell
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in webSPELL 4.01.02 allows remote attackers to inject arbitrary web script or HTML via the sort parameter in a whoisonline action.

  • CVE-2008-0575Feb 5, 2008
    Webspell
    Webspell
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin/admincenter.php in webSPELL 4.01.02 allows remote attackers to assign the superadmin privilege level to arbitrary accounts as administrators via an "update member" action.

  • CVE-2008-0576Feb 5, 2008
    Drupal
    Project Issue Tracking Module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal…

  • CVE-2008-0577Feb 5, 2008
    Drupal
    Project Issue Tracking Module
    risk 0.00cvss —epss 0.01

    The Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal (1) does not restrict the extensions of…

  • CVE-2008-0578Feb 5, 2008
    Tripwire
    Tripwire Enterprise
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web management login page in Tripwire Enterprise 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-5602Feb 5, 2008
    Swiftview
    Viewer
    risk 0.01cvss —epss 0.08

    Multiple stack-based buffer overflows in SwiftView Viewer before 8.3.5, as used by SwiftView and SwiftSend, allow remote attackers to execute arbitrary code via unspecified vectors to the (1) svocx.ocx ActiveX control or the (2) npsview.dll plugin for Mozilla and Firefox.

  • CVE-2007-4130Feb 5, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The Linux kernel 2.6.9 before 2.6.9-67 in Red Hat Enterprise Linux (RHEL) 4 on Itanium (ia64) does not properly handle page faults during NUMA memory access, which allows local users to cause a denial of service (panic) via invalid arguments to set_mempolicy in an MPOL_BIND…

  • CVE-2008-0178Feb 5, 2008
    Liferay
    Liferay Enterprise Portal
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Enterprise Admin Session Monitoring component in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the User-Agent HTTP header.

  • CVE-2008-0179Feb 5, 2008
    Liferay
    Portal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header, which is used when composing Forgot Password e-mail messages in HTML format.

  • CVE-2008-0180Feb 5, 2008
    Liferay
    Liferay Enterprise Portal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in themes/_unstyled/templates/init.vm in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Greeting field in a User Profile.

  • CVE-2008-0181Feb 5, 2008
    Liferay
    Portal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Admin portlet in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Shutdown message.

  • CVE-2008-0182Feb 5, 2008
    Liferay
    Liferay Enterprise Portal
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Admin portlet in Liferay Portal before 4.4.0 allows remote authenticated users to perform unspecified actions as unspecified other authenticated users via the Shutdown message.

  • CVE-2008-0563Feb 5, 2008
    Liferay
    Portal
    risk 0.00cvss —epss 0.00

    Cross-site request forgery (CSRF) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to perform unspecified actions as unspecified authenticated users via the User-Agent HTTP header, which is used when composing Forgot…

  • CVE-2007-6699Feb 4, 2008
    AOL
    Ygp Piceditor Activex Control
    risk 0.03cvss —epss 0.04

    Multiple buffer overflows in the AIM PicEditor 9.5.1.8 ActiveX control in YGPPicEdit.dll in AOL You've Got Pictures (YGP) Picture Editor allow remote attackers to cause a denial of service (browser crash) via a long string in the (1) DisplayName, (2) FinalSavePath, (3)…

  • CVE-2008-0386Feb 4, 2008
    Xdg Utils
    xdg-open
    risk 0.00cvss —epss 0.03

    Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to (1) xdg-open or (2) xdg-email.

  • CVE-2008-0557Feb 4, 2008
    Joomla
    CatalogShop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the CatalogShop (com_catalogshop) 1.0b1 componenent for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.

  • CVE-2008-0558Feb 4, 2008
    Uniwin
    Ecart Professional
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Uniwin eCart Professional before 2.0.16 allows remote attackers to inject arbitrary web script or HTML via the rp parameter to cartView.asp and unspecified other components. NOTE: the provenance of this information is unknown; the…

  • CVE-2008-0559Feb 4, 2008
    Nilsons Blogger
    Nilsons Blogger
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in Nilson's Blogger 0.11 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the permalink parameter in core.php, accessed through index.php; and (2) the thispost parameter in comments.php.

  • CVE-2008-0560Feb 4, 2008
    WordPress
    cforms
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in cforms-css.php in Oliver Seidel cforms (contactforms), a Wordpress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the tm parameter. NOTE: CVE disputes this issue for 7.3, since there is no tm parameter, and…

  • CVE-2008-0561Feb 4, 2008
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Arthur Konze AkoGallery (com_akogallery) 2.5 beta component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.

  • CVE-2008-0562Feb 4, 2008
    Mambo (software)
    Mambo
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Restaurant (com_restaurant) 1.0 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.

  • CVE-2007-6698Feb 1, 2008
    OpenLDAP
    Openldap
    risk 0.00cvss —epss 0.02

    The BDB backend for slapd in OpenLDAP before 2.3.36 allows remote authenticated users to cause a denial of service (crash) via a potentially-successful modify operation with the NOOP control set to critical, possibly due to a double free vulnerability.

  • CVE-2007-6695Feb 1, 2008
    Drake Team
    Drake CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Drake CMS 0.4.9 allows remote attackers to inject arbitrary web script or HTML via the option parameter.

  • CVE-2007-6696Feb 1, 2008
    Webcalendar
    Webcalendar
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.1.6 allow remote attackers to inject arbitrary web script or HTML via (1) an event description, (2) the query string to pref.php, and (3) the adv parameter to search.php. NOTE: vector 1 requires user…

  • CVE-2007-6697Feb 1, 2008
    Sdl
    Sdl Image
    risk 0.04cvss —epss 0.11

    Buffer overflow in the LWZReadByte function in IMG_gif.c in SDL_image before 1.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted GIF file, a similar issue to CVE-2006-4484. NOTE: some of these details…

  • CVE-2008-0538Feb 1, 2008
    PhpIP Management
    phpIP Management
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in phpIP Management 4.3.2 allow remote attackers to execute arbitrary SQL commands via the (1) password parameter to login.php, the (2) id parameter to display.php, and unspecified other vectors. NOTE: some of these details are obtained…

  • CVE-2008-0539Feb 1, 2008
    F5, Inc.
    BIG-IP Application Security Manager
    risk 0.04cvss —epss 0.07

    Cross-site scripting (XSS) vulnerability in dms/policy/rep_request.php in F5 BIG-IP Application Security Manager (ASM) 9.4.3 allows remote attackers to inject arbitrary web script or HTML via the report_type parameter.

  • CVE-2008-0540Feb 1, 2008
    Trixbox
    Trixbox
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in trixbox 2.4.2.0 allow remote attackers to inject arbitrary web script or HTML via the query string to index.php in (1) user/ or (2) maint/.

  • CVE-2008-0541Feb 1, 2008
    Gerd Tentler
    Simple Forum
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in forum.php in Gerd Tentler Simple Forum 3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) open and (2) date_show parameters.

  • CVE-2008-0542Feb 1, 2008
    Gerd Tentler
    Simple Forum
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in thumbnail.php in Gerd Tentler Simple Forum 3.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

  • CVE-2008-0543Feb 1, 2008
    Pre Dynamic Institution
    Pre Dynamic Institution
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Pre Dynamic Institution allow remote attackers to execute arbitrary SQL commands via the (1) sloginid and (2) spass parameters to (a) login.asp and (b) siteadmin/login.asp. NOTE: some of these details are obtained from third party…

  • CVE-2008-0544Feb 1, 2008
    Sdl
    Sdl Image
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in the IMG_LoadLBM_RW function in IMG_lbm.c in SDL_image before 1.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted IFF ILBM file. NOTE: some of these details are obtained…

  • CVE-2008-0545Feb 1, 2008
    Bubbling Library
    Bubbling Library
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in Bubbling Library 1.32 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) uri parameter to (a) yui-menu.tpl.php, (b) simple.tpl.php, and (c) advanced.tpl.php in dispatcher/framework/;…

  • CVE-2008-0546Feb 1, 2008
    Shoppingtree
    CandyPress
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in CandyPress (CP) 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the (1) idProduct and (2) options parameters to (a) ajax/ajax_optInventory.asp, or the (2) recid parameter to (b)…

  • CVE-2008-0547Feb 1, 2008
    Shoppingtree
    CandyPress
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in admin/utilities_ConfigHelp.asp in CandyPress (CP) 4.1.1.26, and probably earlier 4.x and 3.x versions, allows remote attackers to inject arbitrary web script or HTML via the helpfield parameter.

  • CVE-2008-0548Feb 1, 2008
    Steamcast
    Steamcast
    risk 0.00cvss —epss 0.01

    Steamcast 0.9.75 and earlier allows remote attackers to cause a denial of service (daemon crash) via a large integer in the Content-Length HTTP header, which triggers a NULL dereference when malloc fails.

  • CVE-2008-0549Feb 1, 2008
    Steamcast
    Steamcast
    risk 0.00cvss —epss 0.01

    Integer overflow in the OggHeaderParse function in Steamcast 0.9.75 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via a long Ogg tag.

  • CVE-2008-0550Feb 1, 2008
    Steamcast
    Steamcast
    risk 0.07cvss —epss 0.54

    Off-by-one error in Steamcast 0.9.75 and earlier allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a certain HTTP request that leads to a buffer overflow, as demonstrated by a long User-Agent header.

  • CVE-2008-0551Feb 1, 2008
    Sejoong Namo
    Activesquare
    risk 0.05cvss —epss 0.30

    The NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1 and earlier in Namo Web Editor in Sejoong Namo ActiveSquare 6 allows remote attackers to execute arbitrary code via a URL in the argument to the Install method. NOTE: some of these details are obtained…

  • CVE-2008-0552Feb 1, 2008
    Eticket
    Eticket
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in eTicket 1.5.6-RC4 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  • CVE-2007-4998Jan 31, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    cp, when running with an option to preserve symlinks on multiple OSes, allows local, user-assisted attackers to overwrite arbitrary files via a symlink attack using crafted directories containing multiple source files that are copied to the same destination.

  • CVE-2008-0064Jan 31, 2008
    Pierreegougelet
    Gfl SDK
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in Pierre-emmanuel Gougelet (1) XnView 1.91 and 1.92, (2) NConvert 4.85, and (3) libgfl280.dll in GFL SDK 2.870 for Windows allows user-assisted remote attackers to execute arbitrary code via a crafted Radiance RGBE (.hdr) file.

  • CVE-2008-0502Jan 31, 2008
    Connectix
    Boards
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in templates/Official/part_userprofile.php in Connectix Boards 0.8.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the template_path parameter.