VYPR

CVEs

344,846 total · page 6328 of 6,897

AllCriticalHighKEV
  • CVE-2008-0091Jan 4, 2008
    Agency4net
    Webftp
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in download2.php in AGENCY4NET WEBFTP 1 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the file parameter.

  • CVE-2008-0092Jan 4, 2008
    Phpwebsite
    Phpwebsite
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in the search module in Appalachian State University phpWebSite 1.4.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2007-6620Jan 4, 2008
    Joovili
    Joovili
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in include/images.inc.php in Joovili 2.x allows remote attackers to read arbitrary files via a .. (dot dot) in the picture parameter.

  • CVE-2007-6621Jan 4, 2008
    Joovili
    Joovili
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in joovili.images.php in Joovili 3.0.0 through 3.0.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the picture parameter.

  • CVE-2007-6622Jan 4, 2008
    Zeuscms
    Zeuscms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in security.php in ZeusCMS 0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header.

  • CVE-2007-6623Jan 4, 2008
    Zeuscms
    Zeuscms
    risk 0.03cvss —epss 0.05

    Absolute path traversal vulnerability in ZeusCMS 0.3 and earlier might allow remote attackers to list arbitrary directories via a full pathname in the dir parameter.

  • CVE-2007-6624Jan 4, 2008
    Pnphpbb
    Pnphpbb2
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in printview.php in PNphpBB2 1.2i and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter.

  • CVE-2007-6625Jan 4, 2008
    Novell
    Identity Manager
    risk 0.00cvss —epss 0.02

    The Platform Service Process (asampsp) in Fan-Out Driver Platform Services for Novell Identity Manager (IDM) 3.5.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified network traffic that triggers a syslog message containing invalid format string…

  • CVE-2007-6626Jan 4, 2008
    Feng
    Feng
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in the RTSP_valid_response_msg function in RTSP_state_machine.c in LScube Feng 0.1.15 and earlier allow remote attackers to execute arbitrary code via (1) a long first line of a response, as demonstrated by a long VER line; or (2) a long second line of…

  • CVE-2007-6627Jan 4, 2008
    Feng
    Feng
    risk 0.00cvss —epss 0.04

    Integer overflow in the RTSP_remove_msg function in RTSP_lowlevel.c in LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an RTP packet with a size value of 0xffff.

  • CVE-2007-6628Jan 4, 2008
    Feng
    Feng
    risk 0.00cvss —epss 0.02

    LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via (1) a malformed Transport header, which triggers misparsing in parse_transport_header in RTSP_setup.c, as demonstrated by a Transport header that contains…

  • CVE-2007-6629Jan 4, 2008
    Feng
    Feng
    risk 0.00cvss —epss 0.02

    Interpretation conflict in LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a User-Agent header line that contains a carriage-return character, which is considered a line delimiter when the header is…

  • CVE-2007-6630Jan 4, 2008
    Feng
    Feng
    risk 0.03cvss —epss 0.03

    The Url_init function in utils/url.c in Netembryo 0.0.4, when used by LScube Feng, allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a malformed URI containing a "/:" sequence, as demonstrated by a "DESCRIBE /: RTSP/1.0" request.

  • CVE-2007-6631Jan 4, 2008
    Lscube
    Libnemesi
    risk 0.04cvss —epss 0.09

    Multiple buffer overflows in LScube libnemesi 0.6.4-rc1 and earlier allow remote attackers to execute arbitrary code via (1) a reply that begins with a long version string, which triggers an overflow in handle_rtsp_pkt in rtsp_handlers.c; long headers that trigger overflows in…

  • CVE-2007-6632Jan 4, 2008
    risk 0.03cvss —epss 0.02

    showCode.php in xml2owl 0.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter.

  • CVE-2007-6633Jan 4, 2008
    Netbizcity
    Faqmasterflexplus
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to inject arbitrary web script or HTML via (1) the cat_name parameter to faq.php; and unspecified parameters to the (2) add categories, (3) edit categories, (4)…

  • CVE-2007-6634Jan 4, 2008
    Netbizcity
    Faqmasterflexplus
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to execute arbitrary SQL commands via the category_id parameter to faq.php, and unspecified other vectors involving additional scripts.

  • CVE-2007-6635Jan 4, 2008
    Netbizcity
    Faqmasterflexplus
    risk 0.00cvss —epss 0.01

    FAQMasterFlexPlus, possibly 1.5 or 1.52, stores the admin password in cleartext in a database, which might allow context-dependent attackers to obtain the password via unspecified database access.

  • CVE-2007-6636Jan 4, 2008
    Bitflu
    Bitflu
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the StorageFarabDb module in Bitflu before 0.42 allows user-assisted remote attackers to create or append data to arbitrary files via a crafted .torrent file.

  • CVE-2007-6637Jan 4, 2008
    Adobe Inc.
    Acrobat Connect
    risk 0.00cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector…

  • CVE-2007-6638Jan 4, 2008
    March Networks
    3204 Dvr
    risk 0.04cvss —epss 0.12

    March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, passwords, device names, and IP addresses via a direct request for scripts/logfiles.tar.gz.

  • CVE-2007-6614Jan 3, 2008
    Agares Media
    Phpautovideo
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in admin/frontpage_right.php in Agares Media phpAutoVideo 2.21 allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter, a related issue to CVE-2007-6542.

  • CVE-2007-6615Jan 3, 2008
    Agares Media
    Phpautovideo
    risk 0.03cvss —epss 0.05

    Directory traversal vulnerability in includes/block.php in Agares Media phpAutoVideo 2.21 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the selected_provider parameter.

  • CVE-2007-6616Jan 3, 2008
    Simpleforum
    Simpleforum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in simpleforum.cgi in SimpleForum 4.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchkey parameter in a search action. NOTE: some of these details are obtained from third party information.

  • CVE-2007-6617Jan 3, 2008
    Atlassian
    Jira
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in 500page.jsp in JIRA Enterprise Edition before 3.12.1 allows remote attackers to inject arbitrary web script or HTML, which is not properly handled when generating error messages, as demonstrated by input originally sent in the URI to…

  • CVE-2007-6618Jan 3, 2008
    Atlassian
    Jira
    risk 0.00cvss —epss 0.01

    JIRA Enterprise Edition before 3.12.1 allows remote attackers to delete another user's shared filter via a modified filter ID.

  • CVE-2007-6619Jan 3, 2008
    Atlassian
    Jira
    risk 0.00cvss —epss 0.01

    The Setup Wizard in Atlassian JIRA Enterprise Edition before 3.12.1 does not properly restrict setup attempts after setup is complete, which allows remote attackers to change the default language.

  • CVE-2007-6611Jan 3, 2008
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in view.php in Mantis before 1.1.0 allows remote attackers to inject arbitrary web script or HTML via a filename, related to bug_report.php.

  • CVE-2007-6612Jan 3, 2008
    Mongrel
    Mongrel
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (".%252e").

  • CVE-2007-6613Jan 3, 2008
    GNU
    Libcdio
    risk 0.04cvss —epss 0.13

    Stack-based buffer overflow in the print_iso9660_recurse function in iso-info (src/iso-info.c) in GNU Compact Disc Input and Control Library (libcdio) 0.79 and earlier allows context-dependent attackers to cause a denial of service (core dump) and possibly execute arbitrary code…

  • CVE-2008-0061Jan 3, 2008
    Maradns
    Maradns
    risk 0.00cvss —epss 0.02

    MaraDNS 1.0 before 1.0.41, 1.2 before 1.2.12.08, and 1.3 before 1.3.07.04 allows remote attackers to cause a denial of service via a crafted DNS packet that prevents an authoritative name (CNAME) record from resolving, aka "improper rotation of resource records."

  • CVE-2007-6610Jan 3, 2008
    Debian
    Unp
    risk 0.00cvss —epss 0.02

    unp 1.0.12, and other versions before 1.0.14, does not properly escape file names, which might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument. NOTE: this might only be a vulnerability when unp is invoked by a third…

  • CVE-2007-6602Dec 31, 2007
    Noserub
    Noserub
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in app/models/identity.php in NoseRub 0.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the username field to the login script.

  • CVE-2007-6603Dec 31, 2007
    Cyboards
    Hot Or Not Clone
    risk 0.03cvss —epss 0.03

    Hot or Not Clone has insufficient access control for producing and reading database backups, which allows remote attackers to obtain the administrator username and password via a direct request to control/backup/backup.php, which generates a backup/dump/backup.sql file that can…

  • CVE-2007-6604Dec 31, 2007
    Xcms
    Xcms
    risk 0.03cvss —epss 0.04

    Multiple directory traversal vulnerabilities in index.php in XCMS 1.82 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the s parameter to the admin page or (2) the pg parameter to an arbitrary module, as demonstrated by reading a password…

  • CVE-2007-6605Dec 31, 2007
    Skyfex
    Skyfex Client
    risk 0.03cvss —epss 0.04

    Buffer overflow in a certain ActiveX control in SkyFexClient.ocx 1.0.2.77 in SkyFex Client 1.0 allows remote attackers to execute arbitrary code via long strings in the first four arguments to the Start method.

  • CVE-2007-6606Dec 31, 2007
    Openbiblio
    Openbiblio
    risk 0.00cvss —epss 0.02

    OpenBiblio 0.5.2-pre4 and earlier allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.

  • CVE-2007-6607Dec 31, 2007
    Openbiblio
    Openbiblio
    risk 0.00cvss —epss 0.02

    OpenBiblio 0.5.2-pre4 and earlier allows remote attackers to obtain sensitive information via a direct request for (1) shared/footer.php, (2) circ/mbr_fields.php, or (3) admin/custom_marc_form_fields.php, which reveals the path in various error messages.

  • CVE-2007-6608Dec 31, 2007
    Openbiblio
    Openbiblio
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in OpenBiblio 0.5.2-pre4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) LAST and (2) FIRST parameters to admin/staff_del_confirm.php, (3) the name parameter to admin/theme_del_confirm.php,…

  • CVE-2007-6609Dec 31, 2007
    Coolplayer
    Coolplayer
    risk 0.03cvss —epss 0.05

    Multiple stack-based buffer overflows in the CPLI_ReadTag_OGG function in CPI_PlaylistItem.c in CoolPlayer 217 and earlier allow user-assisted remote attackers to execute arbitrary code via a long (1) cTag or (2) cValue field in an OGG Vorbis file.

  • CVE-2007-6337Dec 31, 2007
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the bzip2 decompression algorithm in nsis/bzlib_private.h in ClamAV before 0.92 has unknown impact and remote attack vectors.

  • CVE-2007-6595Dec 31, 2007
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.00

    ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files used by the cli_gentempfd function in libclamav/others.c or on (2) .ascii files used by sigtool, when utf16-decode is enabled.

  • CVE-2007-6596Dec 31, 2007
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.02

    ClamAV 0.92 does not recognize Base64 UUEncoded archives, which allows remote attackers to bypass the scanner via a Base64-UUEncoded file.

  • CVE-2007-6597Dec 31, 2007
    Iportalx
    Iportalx
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in IPortalX before Build 033 allow remote attackers to inject arbitrary web script or HTML via the (1) KW and (2) SF parameters to forum/login_user.asp, and (3) the Date parameter to blogs.asp.

  • CVE-2007-6565Dec 28, 2007
    Blakord
    Portal
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Blakord Portal 1.3.A Beta and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter to an arbitrary component.

  • CVE-2007-6566Dec 28, 2007
    Xzero Scripts
    Community Classifieds
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary SQL commands via the subcatid parameter to index.php.

  • CVE-2007-6567Dec 28, 2007
    Xzero Scripts
    Community Classifieds
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in index.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pagename parameter in a page view action.

  • CVE-2007-6568Dec 28, 2007
    Xzero Scripts
    Community Classifieds
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path_escape parameter.

  • CVE-2007-6569Dec 28, 2007
    Sun Corporation
    Java System Web Proxy Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the View Error Log functionality in Sun Java System Web Proxy Server 4.x before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6566246.

  • CVE-2007-6570Dec 28, 2007
    Sun Corporation
    Java System Web Proxy Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the View URL Database functionality in Sun Java System Web Proxy Server 4.x before 4.0.6 and 3.x before 3.6 SP11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6566309.