VYPR

CVEs

384,194 total · page 7013 of 7,684

AllCriticalHighKEV
  • CVE-2008-5276Dec 3, 2008
    VideoLAN
    VLC media player
    risk 0.01cvss —epss 0.08

    Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.

  • CVE-2008-3059Dec 3, 2008
    Octeth
    Oempro
    risk 0.00cvss —epss 0.01

    member/settings_account.php in Octeth Oempro 3.5.5.1, and possibly other versions before 4, uses cleartext to transmit a password entered in the FormValue_Password field, which makes it easier for remote attackers to obtain sensitive information by sniffing the network, related…

  • CVE-2008-3058Dec 3, 2008
    Octeth
    Oempro
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Octeth Oempro 3.5.5.1, and possibly other versions before 4, allow remote attackers to execute arbitrary SQL commands via the FormValue_Email parameter (aka Email field) to index.php in (1) member/, (2) client/, or (3) admin/; or (4) the…

  • CVE-2008-3057Dec 3, 2008
    Octeth
    Oempro
    risk 0.00cvss —epss 0.01

    Octeth Oempro 3.5.5.1, and possibly other versions before 4, does not set the secure flag for the PHPSESSID cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

  • CVE-2008-5311Dec 2, 2008
    Netartmedia
    Blog System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in image.php in NetArt Media Blog System 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-5310Dec 2, 2008
    Netartmedia
    Car Portal
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in image.php in NetArt Media Car Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-5309Dec 2, 2008
    Netartmedia
    Real Estate Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in NetArt Media Real Estate Portal 1.2 allows remote attackers to execute arbitrary SQL commands via the ad_id parameter in the re_send_email module to index.php.

  • CVE-2008-5308Dec 2, 2008
    Lovecms
    The Simple Forum
    risk 0.04cvss —epss 0.07

    The Simple Forum 3.1d module for LoveCMS 1.6.2 Final does not properly restrict access to administrator functions, which allows remote attackers to change the administrator password via a direct request to modules/simpleforum/admin/index.php.

  • CVE-2008-5307Dec 2, 2008
    Pilotgroup
    Pg Real Roommate Finder Solution
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/index.php in PG Roommate Finder Solution allows remote attackers to execute arbitrary SQL commands via the login_lg parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2008-5306Dec 2, 2008
    Pilotgroup
    Pg Real Estate Solution
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/index.php in PG Real Estate Solution allows remote attackers to execute arbitrary SQL commands via the login_lg parameter (username). NOTE: some of these details are obtained from third party information.

  • CVE-2008-5303Dec 1, 2008
    Perl Foundation
    File\
    risk 0.00cvss —epss 0.00

    Race condition in the rmtree function in File::Path 1.08 (lib/File/Path.pm) in Perl 5.8.8 allows local users to to delete arbitrary files via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error…

  • CVE-2008-5302Dec 1, 2008
    Perl Foundation
    File\
    risk 0.00cvss —epss 0.00

    Race condition in the rmtree function in File::Path 1.08 and 2.07 (lib/File/Path.pm) in Perl 5.8.8 and 5.10.0 allows local users to create arbitrary setuid binaries via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this…

  • CVE-2008-5301Dec 1, 2008
    Dovecot (software)
    Dovecot
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." (dot dot) in a script name.

  • CVE-2008-5300Dec 1, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Linux kernel 2.6.28 allows local users to cause a denial of service ("soft lockup" and process loss) via a large number of sendmsg function calls, which does not block during AF_UNIX garbage collection and triggers an OOM condition, a different vulnerability than CVE-2008-5029.

  • CVE-2008-5299Dec 1, 2008
    Karakas Online
    Chm2pdf
    risk 0.00cvss —epss 0.00

    chm2pdf 0.9 allows user-assisted local users to delete arbitrary files via a symlink attack on .chm files in the (1) /tmp/chm2pdf/work or (2) /tmp/chm2pdf/orig temporary directories.

  • CVE-2008-5298Dec 1, 2008
    Karakas Online
    Chm2pdf
    risk 0.00cvss —epss 0.00

    chm2pdf 0.9 uses temporary files in directories with fixed names, which allows local users to cause a denial of service (chm2pdf failure) of other users by creating those directories ahead of time.

  • CVE-2008-5297Dec 1, 2008
    Vitalwerks
    No IP Duc
    risk 0.04cvss —epss 0.18

    Buffer overflow in No-IP DUC 2.1.7 and earlier allows remote HTTP servers to execute arbitrary code via a crafted response to a DNS update request, related to a missing length check in the GetNextLine function.

  • CVE-2008-5296Dec 1, 2008
    Gallery Project
    Gallery
    risk 0.00cvss —epss 0.01

    Gallery 1.5.x before 1.5.10 and 1.6 before 1.6-RC3, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative via unspecified cookies. NOTE: some of these details are obtained from third party information.

  • CVE-2008-5295Dec 1, 2008
    Jamit
    Jamit Job Board
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Jamit Job Board 3.4.10 allows remote attackers to execute arbitrary SQL commands via the show_emp parameter.

  • CVE-2008-5294Dec 1, 2008
    WebStudio
    eCatalogue
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in WebStudio eCatalogue allows remote attackers to execute arbitrary SQL commands via the pageid parameter.

  • CVE-2008-5293Dec 1, 2008
    WebStudio
    eHotel
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in WebStudio eHotel allows remote attackers to execute arbitrary SQL commands via the pageid parameter.

  • CVE-2008-5292Dec 1, 2008
    Videogirls
    Videogirls Biz
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in view_snaps.php in VideoGirls BiZ allows remote attackers to execute arbitrary SQL commands via the type parameter.

  • CVE-2008-5291Dec 1, 2008
    Fuzzylime
    cms
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in code/track.php in FuzzyLime 3.03 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter, a different vector than CVE-2007-4805 and CVE-2008-3165.

  • CVE-2008-5290Dec 1, 2008
    Werner Hilversum
    Clean CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in full_txt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2008-5289Dec 1, 2008
    Scripts4you
    Clean CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in full_txt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-5288Dec 1, 2008
    Werner Hilversum
    FAQ Manager
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in include/header.php in Werner Hilversum FAQ Manager 1.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the config_path parameter.

  • CVE-2008-5287Dec 1, 2008
    Werner Hilversum
    FAQ Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in catagorie.php in Werner Hilversum FAQ Manager 1.2 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.

  • CVE-2008-5286Dec 1, 2008
    Apple Inc.
    Cups
    risk 0.00cvss —epss 0.04

    Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.

  • CVE-2008-5285Dec 1, 2008
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    Wireshark 1.0.4 and earlier allows remote attackers to cause a denial of service via a long SMTP request, which triggers an infinite loop.

  • CVE-2008-4314Dec 1, 2008
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.04

    smbd in Samba 3.0.29 through 3.2.4 might allow remote attackers to read arbitrary memory and cause a denial of service via crafted (1) trans, (2) trans2, and (3) nttrans requests, related to a "cut&paste error" that causes an improper bounds check to be performed.

  • CVE-2008-5284Nov 29, 2008
    Iea Software
    Air Marshal
    risk 0.03cvss —epss 0.04

    The web server in IEA Software RadiusNT and RadiusX 5.1.38 and other versions before 5.1.44, Emerald 5.0.49 and other versions before 5.0.52, Air Marshal 2.0.4 and other versions before 2.0.8, and Radius test client (aka Radlogin) 4.0.20 and earlier, allows remote attackers to…

  • CVE-2008-5283Nov 29, 2008
    Ghh
    Google Hack Honeypot File Upload Manager
    risk 0.03cvss —epss 0.02

    Google Hack Honeypot (GHH) File Upload Manager 1.3 allows remote attackers to delete uploaded files via unknown vectors related to the delall action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.…

  • CVE-2008-5282Nov 29, 2008
    risk 0.04cvss —epss 0.18

    Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0.1 allow remote attackers to execute arbitrary code via (1) a link with a long HREF attribute, and (2) a DIV tag with a long id attribute.

  • CVE-2008-5281Nov 29, 2008
    Titan
    FTP Server
    risk 0.04cvss —epss 0.06

    Heap-based buffer overflow in Titan FTP Server 6.05 build 550 allows remote attackers to execute arbitrary code via a long DELE command.

  • CVE-2008-5280Nov 29, 2008
    Zilab
    Zim Server
    risk 0.04cvss —epss 0.07

    The Local ZIM Server in Zilab Chat and Instant Messaging (ZIM) Server 2.0 and 2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted requests without required parameters.

  • CVE-2008-5279Nov 29, 2008
    Zilab
    Zim Server
    risk 0.00cvss —epss 0.06

    The Local ZIM Server (zcs.exe) in Zilab Chat and Instant Messaging (ZIM) Server 2.1 and earlier allow remote attackers to execute arbitrary code via (1) heap-based buffer overflows involving multiple vectors including a long room name and a long source account, and (2) a…

  • CVE-2008-5278Nov 28, 2008
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header (HTTP_HOST variable).

  • CVE-2008-5275Nov 28, 2008
    risk 0.00cvss —epss 0.03

    Multiple directory traversal vulnerabilities in the (a) "Unzip archive" and (b) "Upload files and archives" functionality in net2ftp 0.96 stable and 0.97 beta allow remote attackers to create, read, or delete arbitrary files via a .. (dot dot) in a filename within a (1) TAR or…

  • CVE-2008-5274Nov 28, 2008
    Toddwoolums
    Asp News Management
    risk 0.03cvss —epss 0.02

    Todd Woolums ASP News Management 2.2 allows remote attackers to obtain news items via a direct request to (1) rss.asp, (2) viewheadings.asp, or (3) viewnews.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-5273Nov 28, 2008
    Toddwoolums
    Asp News Management
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in viewnews.asp in Todd Woolums ASP News Management 2.2 allows remote attackers to execute arbitrary SQL commands via the newsID parameter.

  • CVE-2008-5272Nov 28, 2008
    Syndeocms
    Syndeocms
    risk 0.03cvss —epss 0.06

    Multiple directory traversal vulnerabilities in Fred Stuurman SyndeoCMS 2.6.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the template parameter to (1) starnet/editors/fckeditor/studenteditor.php; (2) starnet/modules/sn_news/edit_content.php,…

  • CVE-2008-5271Nov 28, 2008
    Syndeocms
    Syndeocms
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Fred Stuurman SyndeoCMS 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the section parameter.

  • CVE-2008-5270Nov 28, 2008
    Yuhhu
    Superstar 2008
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in view.topics.php in Yuhhu Superstar 2008 allows remote attackers to execute arbitrary SQL commands via the board parameter.

  • CVE-2008-5269Nov 28, 2008
    PSys
    pSys
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in pSys 0.7.0 alpha allows remote attackers to execute arbitrary SQL commands via the shownews parameter.

  • CVE-2008-5268Nov 28, 2008
    Aspapps
    Aspportal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in content/forums/reply.asp in ASPPortal allows remote attackers to execute arbitrary SQL commands via the Topic_Id parameter.

  • CVE-2008-5267Nov 28, 2008
    Experts
    Experts
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in answer.php in Experts 1.0.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the question_id parameter.

  • CVE-2008-5266Nov 28, 2008
    Sun Corporation
    Java System Application Server
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build b09d-fcs and 9.1_02 build b04-fcs allows remote attackers to inject arbitrary web script or HTML via…

  • CVE-2008-5265Nov 28, 2008
    Tntforum
    Tnt Forum
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in TNT Forum 0.9.4, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the modulo parameter.

  • CVE-2008-5264Nov 28, 2008
    Tornado
    Tornado Knowledge Retrieval System
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in searcher.exe in Tornado Knowledge Retrieval System 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the p parameter in a root action.

  • CVE-2008-5257Nov 27, 2008
    IBM
    Tivoli Access Manager For E Business
    risk 0.00cvss —epss 0.01

    webseald in WebSEAL 6.0.0.17 in IBM Tivoli Access Manager for e-business allows remote attackers to cause a denial of service (crash or hang) via HTTP requests, as demonstrated by a McAfee vulnerability scan.