VYPR

CVEs

344,846 total · page 6327 of 6,897

AllCriticalHighKEV
  • CVE-2008-0129Jan 8, 2008
    Siteatschool
    Siteatschool
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in starnet/addons/slideshow_full.php in Site@School 2.3.10 and earlier allows remote attackers to execute arbitrary SQL commands via the album_name parameter.

  • CVE-2008-0130Jan 8, 2008
    Instantsoftwares
    Dating Site
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in login_form.asp in Instant Softwares Dating Site allows remote attackers to execute arbitrary SQL commands via the Username parameter, a different vulnerability than CVE-2007-6671. NOTE: the provenance of this information is unknown; the details…

  • CVE-2008-0131Jan 8, 2008
    Instantsoftwares
    Dating Site
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in login_form.asp in Instant Softwares Dating Site allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different product than CVE-2006-6022. NOTE: the provenance of this information is unknown; the…

  • CVE-2008-0132Jan 8, 2008
    Pragma Systems
    Fortressssh
    risk 0.04cvss —epss 0.09

    Pragma FortressSSH 5.0 Build 4 Revision 293 and earlier handles long input to sshd.exe by creating an error-message window and waiting for the administrator to click in this window before terminating the sshd.exe process, which allows remote attackers to cause a denial of…

  • CVE-2007-6668Jan 8, 2008
    Myspace
    Content Zone
    risk 0.04cvss —epss 0.06

    admin/uploadgames.php in MySpace Content Zone (MCZ) 3.x does not require administrative privileges, which allows remote attackers to perform unrestricted file uploads, as demonstrated by uploading (1) a .php file and (2) a .php%00.jpeg file.

  • CVE-2007-6669Jan 8, 2008
    PHCDownload
    PHCDownload
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in PHCDownload 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the string parameter.

  • CVE-2007-6670Jan 8, 2008
    PHCDownload
    PHCDownload
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in search.php in PHCDownload 1.1.0 allows remote attackers to execute arbitrary SQL commands via the string parameter.

  • CVE-2008-0094Jan 8, 2008
    Modx
    MODx Content Management System
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in MODx Content Management System 0.9.6.1 allow remote attackers to (1) include and execute arbitrary local files via a .. (dot dot) in the as_language parameter to assets/snippets/AjaxSearch/AjaxSearch.php, reached through…

  • CVE-2008-0095Jan 8, 2008
    Asterisk
    Asterisknow
    risk 0.05cvss —epss 0.25

    The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit before Asterisk 1.4 revision 95946, and Appliance s800i 1.0.x before 1.0.3.4 allows remote attackers to cause a denial of…

  • CVE-2008-0096Jan 8, 2008
    Georgia SoftWorks
    Ssh2 Server
    risk 0.04cvss —epss 0.09

    Multiple buffer overflows in Georgia SoftWorks SSH2 Server (GSW_SSHD) 7.01.0003 and earlier allow remote attackers to execute arbitrary code via a (1) a long username, which triggers an overflow in the log function; or (2) a long password.

  • CVE-2008-0097Jan 8, 2008
    Georgia SoftWorks
    Ssh2 Server
    risk 0.00cvss —epss 0.02

    Format string vulnerability in the log function in Georgia SoftWorks SSH2 Server (GSW_SSHD) 7.01.0003 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the username field, as demonstrated by a certain LoginPassword message.

  • CVE-2008-0098Jan 8, 2008
    RealPlayer
    RealPlayer
    risk 0.00cvss —epss 0.06

    Buffer overflow in RealPlayer 11 build 6.0.14.748 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: As of 20080103, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is…

  • CVE-2008-0099Jan 8, 2008
    Myphp Forum
    Myphp Forum
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the searchtext parameter to search.php, and unspecified other vectors.

  • CVE-2008-0100Jan 8, 2008
    White Dune
    White Dune
    risk 0.04cvss —epss 0.08

    Stack-based buffer overflow in the Scene::errorf function in Scene.cpp in White_Dune 0.29 beta791 and earlier allows remote attackers to execute arbitrary code via a long string in a .WRL file.

  • CVE-2008-0101Jan 8, 2008
    White Dune
    White Dune
    risk 0.00cvss —epss 0.04

    Format string vulnerability in the swDebugf function in DuneApp.cpp in White_Dune 0.29 beta791 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a .WRL file.

  • CVE-2007-5965Jan 8, 2008
    Trolltech
    Qsslsocket
    risk 0.00cvss —epss 0.01

    QSslSocket in Trolltech Qt 4.3.0 through 4.3.2 does not properly verify SSL certificates, which might make it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service, or trick a service into accepting an invalid client…

  • CVE-2008-0093Jan 8, 2008
    Eticket
    Eticket
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in newticket.php in eTicket 1.5.5.2, and 1.5.6 RC2 and RC3, allow remote attackers to inject arbitrary web script or HTML via the (1) Name and (2) Subject parameters.

  • CVE-2007-6647Jan 4, 2008
    W Agora
    W Agora
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in w-Agora 4.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2007-6648Jan 4, 2008
    Sanybee Gallery
    Sanybee Gallery
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter.

  • CVE-2007-6649Jan 4, 2008
    Matpo Bilder Galerie
    Matpo Bilder Galerie
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in includes/tumbnail.php in MatPo Bilder Galerie 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter.

  • CVE-2007-6650Jan 4, 2008
    Bitweaver
    R2 CMS
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in fisheye/upload.php in Bitweaver R2 CMS allows remote attackers to upload arbitrary files by using the image/gif content type, and possibly other image and PDF content types, as demonstrated by uploading a .htaccess file.

  • CVE-2007-6651Jan 4, 2008
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in wiki/edit.php in Bitweaver R2 CMS allows remote attackers to obtain sensitive information (script source code) via a .. (dot dot) in the suck_url parameter.

  • CVE-2007-6652Jan 4, 2008
    Xcms
    Xcms
    risk 0.03cvss —epss 0.04

    cpie.php in XCMS 1.83 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct direct static code injection attacks and execute arbitrary code via the testo_0 parameter in a cpie admin action to index.php, which writes to…

  • CVE-2007-6653Jan 4, 2008
    Mihalism
    Multi Host
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in download.php in Mihalism Multi Host 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

  • CVE-2007-6654Jan 4, 2008
    Macrovision
    Update Service
    risk 0.03cvss —epss 0.06

    Buffer overflow in a certain ActiveX control in Macrovision InstallShield Update Service Web Agent 5.1.100.47363 allows remote attackers to execute arbitrary code via a long string in the ProductCode argument (second argument) to the DownloadAndExecute method, a different…

  • CVE-2007-6655Jan 4, 2008
    Matpo Bilder Galerie
    Kontakt Formular
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/function.php in Kontakt Formular 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.

  • CVE-2007-6656Jan 4, 2008
    Cmsmadesimple
    Cmsmadesimple
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.

  • CVE-2007-6657Jan 4, 2008
    Mihalism
    Multi Host
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in source/includes/load_forum.php in Mihalism Multi Forum Host 3.0.x and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mfh_root_path parameter.

  • CVE-2007-6658Jan 4, 2008
    Customcms
    Ccms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin.php/vars.php in CustomCMS (CCMS) 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in the Console page.

  • CVE-2007-6659Jan 4, 2008
    2z Project
    2z Project
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in 2z project 0.9.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) contentshort or (2) contentfull parameter in an addnews action to the default URI; (3) the content parameter in a pm write action…

  • CVE-2007-6660Jan 4, 2008
    2z Project
    2z Project
    risk 0.00cvss —epss 0.01

    2z project 0.9.6.1 allows remote attackers to obtain sensitive information via (1) a request to index.php with an invalid template or (2) a request to the default URI with certain year and month parameters, which reveals the path in various error messages.

  • CVE-2007-6661Jan 4, 2008
    2z Project
    2z Project
    risk 0.00cvss —epss 0.01

    2z project 0.9.6.1 allows attackers to change the password without supplying the old password.

  • CVE-2007-6662Jan 4, 2008
    CuteNews
    CuteNews
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in file.php in CuteNews 2.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading the admin username and password hash in data/users.db.php.

  • CVE-2007-6663Jan 4, 2008
    Pragmatic Utopia
    Pu Arcade
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in (1) Puarcade.php and (2) PUarcade.html.php in Pragmatic Utopia PU Arcade (com_puarcade) 2.0.3, 2.1.2, and 2.1.3 Beta component for Joomla! allows remote attackers to execute arbitrary SQL commands via the fid parameter to index.php.

  • CVE-2007-6664Jan 4, 2008
    Webportal
    Webportal CMS
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in WebPortal CMS 0.6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter.

  • CVE-2007-6665Jan 4, 2008
    Netchemia
    Oneschool
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in admin/login.asp in Netchemia oneSCHOOL allows remote attackers to execute arbitrary SQL commands via the txtLoginID parameter.

  • CVE-2007-6666Jan 4, 2008
    Zenphoto
    Zenphoto
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in rss.php in Zenphoto 1.1 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the albumnr parameter.

  • CVE-2007-6667Jan 4, 2008
    Myphp Forum
    Myphp Forum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the member.php vector is already covered by CVE-2005-0413.

  • CVE-2007-6598Jan 4, 2008
    Dovecot (software)
    Dovecot
    risk 0.00cvss —epss 0.02

    Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password.

  • CVE-2007-6599Jan 4, 2008
    Openafs
    Openafs
    risk 0.00cvss —epss 0.02

    Race condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service (daemon crash) by simultaneously acquiring and giving back file callbacks, which causes the handler for the GiveUpAllCallBacks RPC to…

  • CVE-2007-6639Jan 4, 2008
    Iptbb Team
    Iptbb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in IPTBB 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewdir action.

  • CVE-2007-6640Jan 4, 2008
    GreaseKit
    GreaseKit
    risk 0.00cvss —epss 0.01

    Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attackers to read the configuration, modify the configuration, or send an HTTP request via the (1) GM_addStyle, (2) GM_log, (3) GM_openInTab,…

  • CVE-2007-6641Jan 4, 2008
    Milliscripts
    Milliscripts
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in dir.php in milliscripts Redirection allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a browse action.

  • CVE-2007-6642Jan 4, 2008
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Joomla! before 1.5 RC4 allow remote attackers to (1) add a Super Admin, (2) upload an extension containing arbitrary PHP code, and (3) modify the configuration as administrators via unspecified vectors.

  • CVE-2007-6643Jan 4, 2008
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the com_poll component in Joomla! before 1.5 RC4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-6644Jan 4, 2008
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.02

    Joomla! before 1.5 RC4 allows remote authenticated administrators to promote arbitrary users to the administrator group, in violation of the intended security model.

  • CVE-2007-6645Jan 4, 2008
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Joomla! before 1.5 RC4 allows remote authenticated users to gain privileges via unspecified vectors, aka "registered user privilege escalation vulnerability."

  • CVE-2007-6646Jan 4, 2008
    Integry Systems
    Livecart
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in LiveCart 1.0.1, and possibly other versions before 1.1.0, allow remote attackers to inject arbitrary web script or HTML via (1) the return parameter to user/remindPassword, (2) the q parameter to the category script, (3) the…

  • CVE-2008-0089Jan 4, 2008
    Clip Share
    Clipshare
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in uprofile.php in ClipShare allows remote attackers to execute arbitrary SQL commands via the UID parameter.

  • CVE-2008-0090Jan 4, 2008
    Divx
    Player
    risk 0.05cvss —epss 0.23

    A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long argument to the SetPassword method.