VYPR

CVEs

384,785 total · page 6991 of 7,696

AllCriticalHighKEV
  • CVE-2008-6388Mar 2, 2009
    Rapid Classified
    Rapid Classified
    risk 0.03cvss —epss 0.02

    Rapid Classified 3.1 and 3.15 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request to cldb.mdb.

  • CVE-2008-6387Mar 2, 2009
    Quick Tree View
    Quick Tree View .NET
    risk 0.03cvss —epss 0.03

    Quick Tree View .NET 3.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request to qtv.mdb.

  • CVE-2008-6386Mar 2, 2009
    1scripts
    Z1exchange
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in showads.php in Z1Exchange 1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2008-6385Mar 2, 2009
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in W3matter RevSense 1.0 allows remote attackers to inject arbitrary web script or HTML via the section parameter.

  • CVE-2008-6384Mar 2, 2009
    Drupal
    Comment Mail
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Comment Mail 5.x before 5.x-1.1, a module for Drupal, allow remote attackers to hijack the authentication of administrators.

  • CVE-2008-6383Mar 2, 2009
    Drupal
    Storm
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in SpeedTech Organization and Resource Manager (Storm) 5.x before 5.x-1.14 and 6.x before 6.x-1.18, a module for Drupal, allows remote authenticated users with storm project access to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-6382Mar 2, 2009
    ASP Portal
    ASP Portal
    risk 0.03cvss —epss 0.03

    ASP Portal 3.2.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request to ASPPortal.mdb.

  • CVE-2008-6381Mar 2, 2009
    Bcoos
    Bcoos
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in modules/adresses/viewcat.php in bcoos 1.0.13, and possibly earlier, allows remote authenticated users with Addresses module permissions to execute arbitrary SQL commands via the cid parameter.

  • CVE-2008-6380Mar 2, 2009
    Active Web
    Helpdesk
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.aspx in Active Web Helpdesk 2.0 allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter.

  • CVE-2008-6379Mar 2, 2009
    Mxmania
    Gallery Mx
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pics_pre.asp in Gallery MX 2.0.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2008-6378Mar 2, 2009
    Calendar Mx
    Calendar Mx Professional
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in calendar_Eventupdate.asp in Calendar Mx Professional 2.0.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2008-6377Mar 2, 2009
    Phpbb Seo
    Multi Seo Phpbb
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in include/global.php in Multi SEO phpBB 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the pfad parameter.

  • CVE-2008-6376Mar 2, 2009
    Jbook
    Jbook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in main.asp in Jbook allows remote attackers to execute arbitrary SQL commands via the password (pass parameter).

  • CVE-2008-6375Mar 2, 2009
    Jbook
    Jbook
    risk 0.00cvss —epss 0.01

    JBook stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request to userids.mdb.

  • CVE-2008-6374Mar 2, 2009
    Codefixer
    Mailinglistpro
    risk 0.03cvss —epss 0.03

    CodefixerSoftware MailingListPro Free Edition stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to db/MailingList.mdb.

  • CVE-2008-6373Mar 2, 2009
    Nagios
    Nagios
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Nagios before 3.0.6 has unspecified impact and remote attack vectors related to CGI programs, "adaptive external commands," and "writing newlines and submitting service comments."

  • CVE-2008-6372Mar 2, 2009
    Ocean12
    FAQ Manager Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.asp in Ocean12 FAQ Manager Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in a Cat action. NOTE: some of these details are obtained from third party information.

  • CVE-2008-6371Mar 2, 2009
    Ocean12
    Membership Manager Pro
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in login.asp in Ocean12 Membership Manager Pro allows remote attackers to execute arbitrary SQL commands via the username (Username parameter).

  • CVE-2008-6370Mar 2, 2009
    Ocean12
    Contact Manager Pro
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in default.asp in Ocean12 Contact Manager Pro 1.02 allows remote attackers to inject arbitrary web script or HTML via the DisplayFormat parameter.

  • CVE-2008-6369Mar 2, 2009
    Ocean12
    Contact Manager Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.asp in Ocean12 Contact Manager Pro 1.02 allows remote attackers to execute arbitrary SQL commands via the Sort parameter.

  • CVE-2008-6368Mar 2, 2009
    Chipmunk Guestbook
    Chipmunk Guestbook
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Chipmunk Guestbook 1.4m allows remote attackers to execute arbitrary SQL commands via the start parameter.

  • CVE-2008-6367Mar 2, 2009
    Socialgroupie
    Social Groupie
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in Photos/create_album.php in Social Groupie allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in Member_images/.

  • CVE-2008-6366Mar 2, 2009
    Adserversolutions
    Affiliate Software Java
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in logon.jsp in Ad Server Solutions Affiliate Software Java 4.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password, possibly related to the uname and pass parameters to logon_process.jsp. NOTE: some of…

  • CVE-2008-6365Mar 2, 2009
    Adserversolutions
    AD Management Software
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in logon.jsp in Ad Server Solutions Ad Management Software Java allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password, related to the uname or pass parameters to logon.jsp or logon_processing.jsp. NOTE: some…

  • CVE-2008-6364Mar 2, 2009
    Adserversolutions
    Banner Exchange Solution Java
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in logon_process.jsp in Ad Server Solutions Banner Exchange Solution Java allows remote attackers to execute arbitrary SQL commands via the (1) username (uname parameter) and (2) password (pass parameter). NOTE: some of these details are obtained…

  • CVE-2008-6363Mar 2, 2009
    DesignWorks
    DesignWorks Professional
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in DesignWorks Professional 4.3.1 and 5.0.7 allows remote attackers to execute arbitrary code via a crafted .cct file. NOTE: some of these details are obtained from third party information.

  • CVE-2008-6362Mar 2, 2009
    Multiple Membership Script
    Multiple Membership Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in sitepage.php in Multiple Membership Script 2.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-6361Mar 2, 2009
    InSun
    Feedcms
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in InSun Feed CMS 1.7.3 19Beta allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the lang parameter.

  • CVE-2008-6360Mar 2, 2009
    Impresscms
    Impresscms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the userranks feature in modules/system/admin.php in ImpressCMS 1.0.2 final allows remote attackers to inject arbitrary web script or HTML via the rank_title parameter. NOTE: some of these details are obtained from third party…

  • CVE-2008-6359Mar 2, 2009
    Max's Guestbook
    Max's Guestbook
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Max's Guestbook allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) email, and (3) message parameters.

  • CVE-2008-6358Mar 2, 2009
    Socialgroupie
    Social Groupie
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in group_index.php in Social Groupie allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-6357Mar 2, 2009
    MyCal
    Personal Events Calendar
    risk 0.03cvss —epss 0.03

    MyCal Personal Events Calendar stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct request to mycal.mdb.

  • CVE-2008-6356Mar 2, 2009
    EvCal
    evCal Events Calendar
    risk 0.03cvss —epss 0.03

    evCal Events Calendar stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct request to (1) evcal.mdb and (2) evcal97.mdb.

  • CVE-2008-6355Mar 2, 2009
    The Net Guys
    Aspired2protect
    risk 0.03cvss —epss 0.02

    The Net Guys ASPired2Protect stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct request to ASPired2Protect.mdb.

  • CVE-2008-6354Mar 2, 2009
    The Net Guys
    Aspired2poll
    risk 0.03cvss —epss 0.02

    The Net Guys ASPired2poll stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct request to ASPired2poll.mdb.

  • CVE-2008-6353Mar 2, 2009
    Asp CMS
    Asp CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.asp in ASP-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the cha parameter.

  • CVE-2008-6352Mar 2, 2009
    Xpoze
    Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in home.html in Xpoze Pro 4.10 allows remote attackers to execute arbitrary SQL commands via the menu parameter.

  • CVE-2008-6351Mar 2, 2009
    Turnkeyforms
    Local Classifieds
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in listtest.php in TurnkeyForms Local Classifieds allows remote attackers to inject arbitrary web script or HTML via the r parameter.

  • CVE-2008-6350Mar 2, 2009
    Turnkeyforms
    Local Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in listtest.php in TurnkeyForms Local Classifieds allows remote attackers to execute arbitrary SQL commands via the r parameter.

  • CVE-2008-6349Mar 2, 2009
    Turnkeyforms
    Business Survey Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in survey_results_text.php in TurnkeyForms Business Survey Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-6348Mar 2, 2009
    Developiteasy
    Photo Gallery
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in DevelopItEasy Photo Gallery 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) cat_id parameter to gallery_category.php, (2) photo_id parameter to gallery_photo.php, and the (3) user_name and (4) user_pass…

  • CVE-2008-6347Mar 2, 2009
    Joomla
    com_ongumatimesheet20
    risk 0.05cvss —epss 0.20

    PHP remote file inclusion vulnerability in lib/onguma.class.php in the Onguma Time Sheet (com_ongumatimesheet20) 2.0 4b component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2009-0748Feb 27, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The ext4_fill_super function in fs/ext4/super.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not validate the superblock configuration, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) by attempting to mount…

  • CVE-2009-0747Feb 27, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The ext4_isize function in fs/ext4/ext4.h in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 uses the i_size_high structure member during operations on arbitrary types of files, which allows local users to cause a denial of service (CPU consumption and…

  • CVE-2009-0746Feb 27, 2009
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    The make_indexed_dir function in fs/ext4/namei.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not validate a certain rec_len field, which allows local users to cause a denial of service (OOPS) by attempting to mount a crafted ext4 filesystem.

  • CVE-2009-0745Feb 27, 2009
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The ext4_group_add function in fs/ext4/resize.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not properly initialize the group descriptor during a resize (aka resize2fs) operation, which might allow local users to cause a denial of service (OOPS)…

  • CVE-2009-0744Feb 27, 2009
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.07

    Apple Safari 4 Beta build 528.16 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a feeds: URI beginning with a (1) % (percent), (2) { (open curly bracket), (3) } (close curly bracket), (4) ^ (caret), (5) ` (backquote), or…

  • CVE-2009-0743Feb 27, 2009
    Cisco Systems, Inc.
    Unified Meetingplace
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the edit account page in the Web Server in Cisco Unified MeetingPlace Web Conferencing 6.0 before 6.0(517.0) (aka 6.0 MR4) and 7.0 before 7.0(2) (aka 7.0 MR1) allows remote authenticated users to inject arbitrary web script or HTML via…

  • CVE-2009-0028Feb 27, 2009
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    The clone system call in the Linux kernel 2.6.28 and earlier allows local users to send arbitrary signals to a parent process from an unprivileged child process by launching an additional child process with the CLONE_PARENT flag, and then letting this new process exit.

  • CVE-2008-6346Feb 27, 2009
    TYPO3
    DR Wiki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the DR Wiki (dr_wiki) extension 1.7.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.