VYPR

CVEs

344,908 total · page 6320 of 6,899

AllCriticalHighKEV
  • CVE-2008-0503Jan 31, 2008
    Netwerk
    Smart Publisher
    risk 0.05cvss —epss 0.23

    Eval injection vulnerability in admin/op/disp.php in Netwerk Smart Publisher 1.0.1 allows remote attackers to execute arbitrary PHP code via the filedata parameter.

  • CVE-2008-0504Jan 31, 2008
    Coppermine
    Coppermine Photo Gallery
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Coppermine Photo Gallery (CPG) before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) albumid, (2) startpic, and (3) numpics parameters to util.php; and (4) cid_array parameter to…

  • CVE-2008-0505Jan 31, 2008
    Coppermine
    Coppermine Photo Gallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in docs/showdoc.php in Coppermine Photo Gallery (CPG) before 1.4.15 allow remote attackers to inject arbitrary web script or HTML via the (1) h and (2) t parameters.

  • CVE-2008-0506Jan 31, 2008
    Coppermine
    Coppermine Photo Gallery
    risk 0.08cvss —epss 0.59

    include/imageObjectIM.class.php in Coppermine Photo Gallery (CPG) before 1.4.15, when the ImageMagick picture processing method is configured, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) quality, (2) angle, or (3) clipval parameter…

  • CVE-2008-0507Jan 31, 2008
    WordPress
    AdServe 0.2
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in adclick.php in the AdServe 0.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-0508Jan 31, 2008
    WordPress
    Dean's Permalinks Migration
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in deans_permalinks_migration.php in the Dean's Permalinks Migration 1.0 plugin for WordPress allows remote attackers to modify the oldstructure (aka dean_pm_config[oldstructure]) configuration setting as administrators via the…

  • CVE-2008-0509Jan 31, 2008
    IBM
    Aix
    risk 0.00cvss —epss 0.01

    Multiple buffer overflows in IBM AIX 4.3 allow remote attackers to cause a denial of service (crash) or possibly gain privileges via a long argument to (1) piox25, related to piox25.c; or (2) piox25remote, related to piox25remote.sh.

  • CVE-2008-0510Jan 31, 2008
    Mambo (software)
    Mambo
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Newsletter (com_newsletter) component for Mambo 4.5 and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter.

  • CVE-2008-0511Jan 31, 2008
    Joomla
    Com Mamml
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the MaMML (com_mamml) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter.

  • CVE-2008-0512Jan 31, 2008
    Mambo (software)
    com_fq
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the fq (com_fq) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter.

  • CVE-2008-0513Jan 31, 2008
    Phpcms
    Phpcms
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS 1.2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to parser/parser.php, as demonstrated by a filename ending with %00.gif, a different vector than…

  • CVE-2008-0514Jan 31, 2008
    Joomla
    Glossary
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Glossary (com_glossary) 2.0 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a display action.

  • CVE-2008-0515Jan 31, 2008
    Joomla
    com_musepoes
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the musepoes (com_musepoes) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in an answer action.

  • CVE-2008-0516Jan 31, 2008
    Sqlitemanager
    Sqlitemanager
    risk 0.00cvss —epss 0.03

    PHP remote file inclusion vulnerability in spaw/dialogs/confirm.php in SQLiteManager 1.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third…

  • CVE-2008-0517Jan 31, 2008
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Darko Selesi EstateAgent (com_estateagent) 0.1 component for Mambo 4.5.x and Joomla! allows remote attackers to execute arbitrary SQL commands via the objid parameter in a contact showObject action.

  • CVE-2008-0518Jan 31, 2008
    Joomla
    Recipes
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Recipes (com_recipes) 1.00 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.

  • CVE-2008-0519Jan 31, 2008
    Joomla
    Com Jokes
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Atapin Jokes (com_jokes) 1.0 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in a CatView action.

  • CVE-2008-0520Jan 31, 2008
    WordPress
    Wassup Plugin
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) from_date or (2) to_date parameter to spy.php.

  • CVE-2008-0521Jan 31, 2008
    Bubbling Library
    Bubbling Library
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in Bubbling Library 1.32 allow remote attackers to read arbitrary files via a .. (dot dot) in the uri parameter to dispatcher.php in (1) examples/dispatcher/framework/, (2) examples/dispatcher/, (3) examples/wizard/, and (4) PHP/,…

  • CVE-2008-0522Jan 31, 2008
    Hal Networks
    shopping-cart products
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in multiple Hal Networks shopping-cart products allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-0523Jan 31, 2008
    Softcart
    Softcart
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in SoftCart.exe in SoftCart 5.1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) License_Plate, (2) License_State, (3) Ticket_Date, and (4) Ticket_Number parameters. NOTE: the provenance of this…

  • CVE-2008-0524Jan 31, 2008
    Yamaha
    RT series routers
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the management interface in multiple Yamaha RT series routers allows remote attackers to change password settings and probably other configuration settings as administrators via unspecified vectors.

  • CVE-2008-0525Jan 31, 2008
    Novell
    ZENworks Patch Management Update Agent for Linux/Unix/Mac
    risk 0.00cvss —epss 0.01

    PatchLink Update client for Unix, as used by Novell ZENworks Patch Management Update Agent for Linux/Unix/Mac (LUM) 6.2094 through 6.4102 and other products, allows local users to (1) truncate arbitrary files via a symlink attack on the /tmp/patchlink.tmp file used by the…

  • CVE-2008-0487Jan 30, 2008
    ASPIRED2PROTECT
    login.asp
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.asp in ASPired2Protect allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters. NOTE: some of these details are obtained from third party information.

  • CVE-2008-0488Jan 30, 2008
    Vb Marketing
    Vb Marketing
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in tseekdir.cgi in VB Marketing allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the location parameter.

  • CVE-2008-0489Jan 30, 2008
    Clansphere
    Clansphere
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in install.php in Clansphere 2007.4.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.

  • CVE-2008-0490Jan 30, 2008
    WordPress
    Wp Cal Plugin
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in functions/editevent.php in the WP-Cal 0.3 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-0491Jan 30, 2008
    WordPress
    fGallery
    risk 0.03cvss —epss 0.06

    SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the album parameter.

  • CVE-2008-0492Jan 30, 2008
    Persits
    Xupload
    risk 0.05cvss —epss 0.30

    Stack-based buffer overflow in the Persits.XUpload.2 ActiveX control in XUpload.ocx 3.0.0.4 and earlier in Persits XUpload 3.0 allows remote attackers to execute arbitrary code via a long argument to the AddFile method. NOTE: some of these details are obtained from third party…

  • CVE-2008-0493Jan 30, 2008
    IrfanView
    Irfanview
    risk 0.04cvss —epss 0.09

    fpx.dll 3.9.8.0 in the FlashPix plugin for IrfanView 4.10 allows remote attackers to execute arbitrary code via a crafted FlashPix (.FPX) file, which triggers heap corruption. NOTE: some of these details are obtained from third party information.

  • CVE-2008-0494Jan 30, 2008
    Endian
    Firewall
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in vpnum/userslist.php in Endian Firewall 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the psearch parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third…

  • CVE-2008-0495Jan 30, 2008
    IBM
    Hardware Management Console
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Pegasus CIM Server in IBM Hardware Management Console (HMC) 7 R3.2.0 allows remote attackers to cause a denial of service via unspecified vectors.

  • CVE-2008-0496Jan 30, 2008
    Ampjuke
    Ampjuke
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in AmpJuke 0.7.0 allows remote attackers to inject arbitrary web script or HTML via the limit parameter in a search action.

  • CVE-2008-0497Jan 30, 2008
    Nucleus CMS
    Nucleus CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in action.php in Nucleus CMS 3.31 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO, which is not quoted when processing PHP_SELF.

  • CVE-2008-0498Jan 30, 2008
    Bigware
    Shop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in main_bigware_53.tpl.php in Bigware Shop 2.0 allows remote attackers to execute arbitrary SQL commands via the pollid parameter in a results action to main_bigware_53.php.

  • CVE-2008-0499Jan 30, 2008
    Mikedeboer
    Laithai
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Mambo LaiThai 4.5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-0500Jan 30, 2008
    Mikedeboer
    Laithai
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Mambo LaiThai 4.5.5 have unknown impact and attack vectors related to (1) mod_login and (2) mod_template_chooser.

  • CVE-2008-0501Jan 30, 2008
    PhpMyClub
    phpMyClub
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in phpMyClub 0.0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page_courante parameter to the top-level URI.

  • CVE-2007-6694Jan 29, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    The chrp_show_cpuinfo function (chrp/setup.c) in Linux kernel 2.4.21 through 2.6.18-53, when running on PowerPC, might allow local users to cause a denial of service (crash) via unknown vectors that cause the of_get_property function to fail, which triggers a NULL pointer…

  • CVE-2008-0468Jan 29, 2008
    Flinx
    Flinx
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in category.php in Flinx 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-0469Jan 29, 2008
    Tiger PHP News System
    Tiger PHP News System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Tiger Php News System (TPNS) 1.0b and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter in a newscat action.

  • CVE-2008-0470Jan 29, 2008
    Comodo
    Comodo Antivirus
    risk 0.05cvss —epss 0.31

    A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method.

  • CVE-2008-0471Jan 29, 2008
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in privmsg.php in phpBB 2.0.22 allows remote attackers to delete private messages (PM) as arbitrary users via a deleteall action.

  • CVE-2008-0472Jan 29, 2008
    Woltlab
    Burning Board
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in modcp.php in Woltlab Burning Board (wBB) 2.3.6 PL2 allows remote attackers to delete threads as moderators or administrators via a thread_del action.

  • CVE-2008-0473Jan 29, 2008
    Webwiz
    Rich Text Editor
    risk 0.03cvss —epss 0.03

    RTE_popup_save_file.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to upload (1) .html and (2) .htm files via unspecified vectors.

  • CVE-2008-0474Jan 29, 2008
    Manageengine
    Applications Manager
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 8.1 build 8100 allow remote attackers to inject arbitrary web script or HTML via the (1) showlink parameter to jsp/DiscoveryProfiles.jsp; the (2) attributeIDs, (3) attributeToSelect, (4)…

  • CVE-2008-0475Jan 29, 2008
    Manageengine
    Applications Manager
    risk 0.00cvss —epss 0.01

    ManageEngine Applications Manager 8.1 build 8100 allows remote attackers to obtain sensitive information ( Home->Summary) via an invalid URI, as demonstrated by the "/-" URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-0476Jan 29, 2008
    Manageengine
    Applications Manager
    risk 0.00cvss —epss 0.01

    ManageEngine Applications Manager 8.1 build 8100 does not check authentication for monitorType.do and unspecified other pages, which allows remote attackers to obtain sensitive information and change settings via unspecified vectors. NOTE: the provenance of this information is…

  • CVE-2008-0477Jan 29, 2008
    Move Networks Inc
    Upgrade Manager
    risk 0.04cvss —epss 0.15

    Stack-based buffer overflow in the QMPUpgrade.Upgrade.1 ActiveX control in QMPUpgrade.dll 1.0.0.1 in Move Networks Upgrade Manager allows remote attackers to execute arbitrary code via a long first argument to the Upgrade method. NOTE: some of these details are obtained from…

  • CVE-2008-0478Jan 29, 2008
    Setcms
    Setcms
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in SetCMS 3.6.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the set parameter, as demonstrated by sending a certain CLIENT_IP HTTP header in an enter action to index.php, and injecting…