VYPR

CVEs

344,846 total · page 6324 of 6,897

AllCriticalHighKEV
  • CVE-2008-0258Jan 15, 2008
    PHP Running Management
    Phprunman
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in PHP Running Management (phpRunMan) before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the message parameter.

  • CVE-2008-0259Jan 15, 2008
    Minimal Gallery
    minimal Gallery
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in _mg/php/mg_thumbs.php in minimal Gallery 0.8 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) thumbcat and (2) thumb parameters.

  • CVE-2008-0260Jan 15, 2008
    Minimal Gallery
    minimal Gallery
    risk 0.03cvss —epss 0.02

    minimal Gallery 0.8 allows remote attackers to obtain configuration information via a direct request to php_info.php, which calls the phpinfo function.

  • CVE-2008-0261Jan 15, 2008
    Mambo (software)
    Mambo
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the search component and module in Mambo 4.5.x and 4.6.x allows remote attackers to cause a denial of service (query flood) via unspecified vectors.

  • CVE-2008-0262Jan 15, 2008
    Agares Media
    Phpautovideo
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in includes/articleblock.php in Agares PhpAutoVideo 2.21 allows remote attackers to execute arbitrary SQL commands via the articlecat parameter.

  • CVE-2008-0263Jan 15, 2008
    Ingate
    Firewall
    risk 0.00cvss —epss 0.02

    The SIP module in Ingate Firewall before 4.6.1 and SIParator before 4.6.1 does not reuse SIP media ports in unspecified call hold and send-only stream scenarios, which allows remote attackers to cause a denial of service (port exhaustion) via unspecified vectors.

  • CVE-2008-0264Jan 15, 2008
    Drupal
    Meta Tags
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Meta Tags (aka Nodewords) 5.x-1.6 module for Drupal, when images are permitted in node bodies, allows remote authenticated users to execute arbitrary code via unspecified vectors involving creation of a node.

  • CVE-2008-0265Jan 15, 2008
    F5, Inc.
    Big IP
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in the Search function in the web management interface in F5 BIG-IP 9.4.3 allow remote attackers to inject arbitrary web script or HTML via the SearchString parameter to (1) list_system.jsp, (2) list_pktfilter.jsp, (3)…

  • CVE-2008-0266Jan 15, 2008
    Eticket
    Eticket
    risk 0.03cvss —epss 0.00

    Cross-site request forgery (CSRF) vulnerability in admin.php in eTicket 1.5.5.2 allows remote attackers to change the administrative password and possibly perform other administrative tasks. NOTE: either the old password must be known, or the attacker must leverage a separate…

  • CVE-2008-0267Jan 15, 2008
    Eticket
    Eticket
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in eTicket 1.5.5.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) status, (2) sort, and (3) way parameters to search.php; and allow remote authenticated administrators to execute arbitrary SQL commands via…

  • CVE-2008-0268Jan 15, 2008
    Eticket
    Eticket
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in view.php in eTicket 1.5.5.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2008-0269Jan 15, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the dotoprocs function in Sun Solaris 10 allows local users to cause a denial of service (panic) via unspecified vectors.

  • CVE-2008-0270Jan 15, 2008
    Taskfreak
    Taskfreak\!
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in TaskFreak! 0.6.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the sContext parameter.

  • CVE-2008-0271Jan 15, 2008
    Drupal
    Bueditor
    risk 0.00cvss —epss 0.01

    The editor deletion form in BUEditor 4.7.x before 4.7.x-1.0 and 5.x before 5.x-1.1, a module for Drupal, does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete custom editor interfaces.

  • CVE-2008-0272Jan 15, 2008
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote attackers to delete items from a feed as privileged users.

  • CVE-2008-0273Jan 15, 2008
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Interpretation conflict in Drupal 4.7.x before 4.7.11 and 5.x before 5.6, when Internet Explorer 6 is used, allows remote attackers to conduct cross-site scripting (XSS) attacks via invalid UTF-8 byte sequences, which are not processed as UTF-8 by Drupal's HTML filtering, but…

  • CVE-2008-0274Jan 15, 2008
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files.

  • CVE-2008-0275Jan 15, 2008
    Drupal
    Atom
    risk 0.00cvss —epss 0.01

    The Atom 4.7 before 4.7.x-1.0 and 5.x before 5.x-1.0 module for Drupal does not properly manage permissions for node (1) titles, (2) teasers, and (3) bodies, which might allow remote attackers to gain access to syndicated content.

  • CVE-2008-0276Jan 15, 2008
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Devel module before 5.x-0.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via a site variable, related to lack of escaping of the variable table.

  • CVE-2008-0277Jan 15, 2008
    Drupal
    Fileshare Module
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Fileshare module for Drupal allows remote authenticated users with node-creation privileges to execute arbitrary code via unspecified vectors.

  • CVE-2008-0278Jan 15, 2008
    X7 Chat
    X7 Chat
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in X7 Chat 2.0.5 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the day parameter in a sm_window action.

  • CVE-2008-0279Jan 15, 2008
    Xforum
    Xforum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in liretopic.php in Xforum 1.4 and possibly others allows remote attackers to execute arbitrary SQL commands via the topic parameter. NOTE: the categorie parameter might also be affected.

  • CVE-2007-6284Jan 12, 2008
    Xmlsoft
    Libxml2
    risk 0.00cvss —epss 0.03

    The xmlCurrentChar function in libxml2 before 2.6.31 allows context-dependent attackers to cause a denial of service (infinite loop) via XML containing invalid UTF-8 sequences.

  • CVE-2008-0242Jan 12, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in libdevinfo in Sun Solaris 10 allows local users to access files and gain privileges via unknown vectors, related to login device permissions.

  • CVE-2008-0243Jan 12, 2008
    Lotus
    Domino
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Lotus Domino 7.0.2 before Fix Pack 3 allows attackers to cause a denial of service via unknown vectors.

  • CVE-2008-0244Jan 12, 2008
    SAP
    Maxdb
    risk 0.09cvss —epss 0.80

    SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in exec_sdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe.

  • CVE-2008-0245Jan 12, 2008
    UploadImage
    UploadImage
    risk 0.03cvss —epss 0.02

    admin.php in UploadImage 1.0 does not check for the original password before making a change to a new password, which allows remote attackers to gain administrator privileges via the pass parameter in a nopass (Set Password) action.

  • CVE-2008-0246Jan 12, 2008
    Uploadscript
    Uploadscript
    risk 0.03cvss —epss 0.04

    admin.php in UploadScript 1.0 does not check for the original password before making a change to a new password, which allows remote attackers to gain administrator privileges via the pass parameter in a nopass (Set Password) action.

  • CVE-2008-0247Jan 12, 2008
    IBM
    Tivoli Storage Manager Express
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in the Express Backup Server service (dsmsvc.exe) in IBM Tivoli Storage Manager (TSM) Express 5.3 before 5.3.7.3 allows remote attackers to execute arbitrary code via a packet with a large length value.

  • CVE-2008-0248Jan 12, 2008
    Streamaudio
    Chaincast Proxymanager Activex Control
    risk 0.04cvss —epss 0.11

    Buffer overflow in an ActiveX control in ccpm_0237.dll for StreamAudio ChainCast ProxyManager allows remote attackers to execute arbitrary code via a long URL argument to the InternalTuneIn method.

  • CVE-2008-0249Jan 12, 2008
    PHP Webquest
    Phpwebquest
    risk 0.03cvss —epss 0.03

    PHP Webquest 2.6 allows remote attackers to retrieve database credentials via a direct request to admin/backup_phpwebquest.php, which leaks the credentials in an error message if a call to /usr/bin/mysqldump fails. NOTE: this might only be an issue in limited environments.

  • CVE-2008-0250Jan 12, 2008
    Microsoft
    Visual Interdev
    risk 0.04cvss —epss 0.17

    Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a Studio Solution (.SLN) file with a long Project line.

  • CVE-2008-0251Jan 12, 2008
    Photopost
    vBGallery
    risk 0.03cvss —epss 0.04

    Unrestricted file upload vulnerability in PhotoPost vBGallery before 2.4.2 allows remote attackers to upload and execute arbitrary files via unknown vectors.

  • CVE-2008-0252Jan 12, 2008
    Cherrypy
    Cherrypy
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and…

  • CVE-2008-0123Jan 12, 2008
    Moodle
    Moodle
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in install.php for Moodle 1.8.3, and possibly other versions before 1.8.4, allows remote attackers to inject arbitrary web script or HTML via the dbname parameter. NOTE: this issue only exists until the installation is complete.

  • CVE-2007-6420Jan 12, 2008
    Apache
    HTTP Server
    risk 0.01cvss —epss 0.09

    Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.

  • CVE-2007-6423Jan 12, 2008
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in mod_proxy_balancer for Apache HTTP Server 2.2.x before 2.2.7-dev, when running on Windows, allows remote attackers to trigger memory corruption via a long URL. NOTE: the vendor could not reproduce this issue

  • CVE-2008-0005Jan 12, 2008
    Apache
    mod_proxy_ftp
    risk 0.01cvss —epss 0.15

    mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.

  • CVE-2008-0239Jan 11, 2008
    Sun Corporation
    Java System Identity Manager
    risk 0.03cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allow remote attackers to inject arbitrary HTML or web script via the (1) cntry or lang parameters to /idm/login.jsp, (2) resultsForm parameter to…

  • CVE-2008-0240Jan 11, 2008
    Sun Corporation
    Java System Identity Manager
    risk 0.03cvss —epss 0.06

    /idm/help/index.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allows remote attackers to inject frames from arbitrary web sites and conduct phishing attacks via the helpUrl parameter, aka "frame injection."

  • CVE-2008-0241Jan 11, 2008
    Sun Corporation
    Java System Identity Manager
    risk 0.00cvss —epss 0.03

    Open redirect vulnerability in /idm/user/login.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the nextPage parameter.

  • CVE-2008-0238Jan 11, 2008
    Xine
    Xine Lib
    risk 0.00cvss —epss 0.04

    Multiple heap-based buffer overflows in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 allow remote attackers to execute arbitrary code via the SDP (1) Title, (2) Author, or (3) Copyright attribute, related to the rmff_dump_header function, different…

  • CVE-2007-6018Jan 11, 2008
    Horde (software)
    Horde
    risk 0.00cvss —epss 0.02

    IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) "purge" deleted emails via a…

  • CVE-2008-0233Jan 11, 2008
    Zero CMS
    Zerocms
    risk 0.03cvss —epss 0.02

    Unrestricted file upload vulnerability in Zero CMS 1.0 Alpha and earlier allows remote attackers to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg.

  • CVE-2008-0234Jan 11, 2008
    Apple Inc.
    Quicktime
    risk 0.04cvss —epss 0.12

    Buffer overflow in Apple Quicktime Player 7.3.1.70 and other versions before 7.4.1, when RTSP tunneling is enabled, allows remote attackers to execute arbitrary code via a long Reason-Phrase response to an rtsp:// request, as demonstrated using a 404 error message.

  • CVE-2008-0235Jan 11, 2008
    Microsoft
    VFP_OLE_Server
    risk 0.02cvss —epss 0.29

    The Microsoft VFP_OLE_Server ActiveX control allows remote attackers to execute arbitrary code by invoking the foxcommand method.

  • CVE-2008-0236Jan 11, 2008
    Microsoft
    Visual Foxpro
    risk 0.04cvss —epss 0.17

    An ActiveX control for Microsoft Visual FoxPro (vfp6r.dll 6.0.8862.0) allows remote attackers to execute arbitrary commands by invoking the DoCmd method.

  • CVE-2008-0237Jan 11, 2008
    Microsoft
    Rich Textbox ActiveX Control
    risk 0.05cvss —epss 0.20

    The Microsoft Rich Textbox ActiveX Control (RICHTX32.OCX) 6.1.97.82 allows remote attackers to execute arbitrary commands by invoking the insecure SaveFile method.

  • CVE-2008-0230Jan 11, 2008
    Osdate
    Osdate
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in php121db.php in osDate 2.0.8 and possibly earlier versions allows remote attackers to execute arbitrary PHP code via a URL in the php121dir parameter.

  • CVE-2008-0231Jan 11, 2008
    Tuned Studios
    Classic Theme
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange Cutout, (4) Lonely Maple, (5) Endless, (6) Classic Theme, and (7) Music Theme webpage templates allow remote attackers to include and execute arbitrary files…