VYPR

CVEs

384,009 total · page 7029 of 7,681

AllCriticalHighKEV
  • CVE-2008-3522Oct 2, 2008
    Jasper
    JasPer
    risk 0.00cvss —epss 0.05

    Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf.

  • CVE-2008-3521Oct 2, 2008
    Jasper
    JasPer
    risk 0.00cvss —epss 0.00

    Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file, which causes Jasper to exit. NOTE: this was originally…

  • CVE-2008-3520Oct 2, 2008
    Jasper
    JasPer
    risk 0.00cvss —epss 0.03

    Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.

  • CVE-2008-2831Oct 2, 2008
    Mailmarshal
    SMTP
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the delegated spam management feature in the Spam Quarantine Management (SQM) component in MailMarshal SMTP 6.0.3.8 through 6.3.0.0 allow user-assisted remote authenticated users to inject arbitrary web script or HTML via…

  • CVE-2008-4380Oct 1, 2008
    Samsung Mobile
    SHR2040
    risk 0.03cvss —epss 0.04

    The web interface in Samsung DVR SHR2040 allows remote attackers to cause a denial of service (crash) via a malformed HTTP request, related to the filter for configuration properties and "/x" characters.

  • CVE-2008-4379Oct 1, 2008
    Mrcgiguy
    Hot Links SQL PHP
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in report.php in Mr. CGI Guy Hot Links SQL-PHP 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2008-4378Oct 1, 2008
    Mrcgiguy
    Hot Links SQL PHP
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in report.php in Mr. CGI Guy Hot Links SQL-PHP 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-4377Oct 1, 2008
    Creative Mind
    Creator CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.asp in Creative Mind Creator CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the sideid parameter.

  • CVE-2008-4376Oct 1, 2008
    Livetvscript
    Live Tv Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Live TV Script allows remote attackers to execute arbitrary SQL commands via the mid parameter.

  • CVE-2008-4375Oct 1, 2008
    Availscript
    Availscript Classmate Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in viewprofile.php in Availscript Classmate Script allows remote attackers to execute arbitrary SQL commands via the p parameter.

  • CVE-2008-4374Oct 1, 2008
    Cmsbuzz
    CMS Buzz
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in CMS Buzz allows remote attackers to execute arbitrary SQL commands via the id parameter in a playgame action.

  • CVE-2008-4373Oct 1, 2008
    Availscript
    Jobs Portal Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in job_seeker/applynow.php in AvailScript Job Portal Script allows remote attackers to execute arbitrary SQL commands via the jid parameter.

  • CVE-2008-4372Oct 1, 2008
    Availscript
    Availscript Article Script
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in articles.php in AvailScript Article Script allows remote attackers to inject arbitrary web script or HTML via the aIDS parameter.

  • CVE-2008-4371Oct 1, 2008
    Availscript
    Availscript Article Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in articles.php in AvailScript Article Script allows remote attackers to execute arbitrary SQL commands via the aIDS parameter.

  • CVE-2008-4370Oct 1, 2008
    Availscript
    Photo Album
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Availscript Photo Album allow remote attackers to inject arbitrary web script or HTML via the (1) sid parameter to pics.php and the (2) a parameter to view.php.

  • CVE-2008-4369Oct 1, 2008
    Availscript
    Photo Album
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pics.php in Availscript Photo Album allows remote attackers to execute arbitrary SQL commands via the sid parameter.

  • CVE-2008-4368Oct 1, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    The default configuration of Java 1.5 on Apple Mac OS X 10.5.4 and 10.5.5 contains a jurisdiction policy that limits Java Cryptography Extension (JCE) key sizes to 128 bits, which makes it easier for attackers to decrypt ciphertext produced by JCE.

  • CVE-2008-4366Sep 30, 2008
    Camera Life
    Camera Life
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in the image upload component in Camera Life 2.6.2b4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a user directory under…

  • CVE-2008-4365Sep 30, 2008
    Siteman
    Siteman
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in Siteman 1.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-4364Sep 30, 2008
    Parsagostar
    Parsaweb CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.aspx in ParsaGostar ParsaWeb CMS allows remote attackers to execute arbitrary SQL commands via the (1) id parameter in the "page" page and (2) txtSearch parameter in the "Search" page.

  • CVE-2008-4363Sep 30, 2008
    Deslock
    Deslock\+
    risk 0.03cvss —epss 0.01

    DLMFENC.sys 1.0.0.28 in DESlock+ 3.2.7 allows local users to cause a denial of service (system crash) or potentially execute arbitrary code via a certain DLMFENC_IOCTL request to \\.\DLKPFSD_Device that overwrites a pointer, probably related to use of the ProbeForRead function…

  • CVE-2008-4362Sep 30, 2008
    Deslock
    Deslock\+
    risk 0.03cvss —epss 0.01

    The Virtual Token driver (vdlptokn.sys) 1.0.2.43 in DESlock+ 3.2.7 allows local users to cause a denial of service (system crash) via a crafted IOCTL request to \Device\DLPTokenWalter0.

  • CVE-2008-4361Sep 30, 2008
    Powerportal
    Powerportal
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in PowerPortal 2.0.13 allows remote attackers to list and possibly read arbitrary files via a .. (dot dot) in the path parameter to the default URI.

  • CVE-2008-4358Sep 30, 2008
    Spaw
    SPAW Editor PHP Edition
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in class/theme.class.php in SPAW Editor PHP Edition before 2.0.8.1 has unknown impact and attack vectors, probably related to directory traversal sequences in the theme name.

  • CVE-2008-4357Sep 30, 2008
    Powie
    Plink
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in linkto.php in Powie pLink 2.07 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-4356Sep 30, 2008
    Kasseler CMS
    Kasseler CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Kasseler CMS 1.1.0 and 1.2.0 allow remote attackers to execute arbitrary SQL commands via (1) the nid parameter to index.php in a View action to the News module; (2) the vid parameter to index.php in a Result action to the Voting module;…

  • CVE-2008-4355Sep 30, 2008
    Powie
    Pforum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in showprofil.php in Powie PSCRIPT Forum (aka PHP Forum or pForum) 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-4354Sep 30, 2008
    Netartmedia
    Iboutique
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the products module in NetArt Media iBoutique 4.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter to index.php.

  • CVE-2008-4353Sep 30, 2008
    Linkarity
    Linkarity
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in link.php in Linkarity allows remote attackers to execute arbitrary SQL commands via the cat_id parameter. NOTE: although one component of Linkarity is distributable PHP code, this issue might be site-specific. If so, it should not be included in…

  • CVE-2008-4352Sep 30, 2008
    Phpsmartcom
    Phpsmartcom
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in inc/pages/viewprofile.php in phpSmartCom 0.2 allows remote attackers to execute arbitrary SQL commands via the uid parameter in a viewprofile action to index.php.

  • CVE-2008-4351Sep 30, 2008
    Phpsmartcom
    Phpsmartcom
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in phpSmartCom 0.2 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the p parameter.

  • CVE-2008-4350Sep 30, 2008
    Vblogix
    Tutorial Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in main.php in vbLOGIX Tutorial Script 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.

  • CVE-2008-4349Sep 30, 2008
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in news.php in s0nic Paranews 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) page parameter in a details action.

  • CVE-2008-4348Sep 30, 2008
    Outshine
    Phportfolio
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in photo.php in PHPortfolio, possibly 1.3, allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-4347Sep 30, 2008
    Powie
    Pnews
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in newskom.php in Powie pNews 2.03 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.

  • CVE-2008-4346Sep 30, 2008
    Talkback
    Talkback
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in TalkBack 2.3.6 and 2.3.6.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter to comments.php, a different vector than CVE-2008-3371.

  • CVE-2008-4345Sep 30, 2008
    Webportal
    Webportal CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in download.php in WebPortal CMS 0.7.4 and earlier allows remote attackers to execute arbitrary SQL commands via the aid parameter.

  • CVE-2008-4344Sep 30, 2008
    6rbscript
    6rbscript
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in cat.php in 6rbScript allows remote attackers to execute arbitrary SQL commands via the CatID parameter.

  • CVE-2008-4343Sep 30, 2008
    Chilkatsoft
    ChilkatUtil.CkData.1
    risk 0.04cvss —epss 0.09

    The Chilkat XML ChilkatUtil.CkData.1 ActiveX control (ChilkatUtil.dll) 3.0.3.0 and earlier allows remote attackers to create, overwrite, and modify arbitrary files for execution via a call to the (1) SaveToFile, (2) SaveToTempFile, or (3) AppendBinary method. NOTE: this issue…

  • CVE-2008-4342Sep 30, 2008
    NuMedia Soft
    NMS DVD Burning SDK ActiveX NMSDVDX.DVDEngineX.1 ActiveX control
    risk 0.04cvss —epss 0.17

    NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1.976, BurnAware 2.1.3, Blaze Media Pro 8.02 Special Edition, and possibly other products, allows remote attackers to overwrite and create…

  • CVE-2008-4341Sep 30, 2008
    Myblog
    Myblog
    risk 0.03cvss —epss 0.03

    add.php in MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication and gain administrative access by setting a cookie with admin=yes and login=admin.

  • CVE-2008-4340Sep 30, 2008
    Google
    Chrome
    risk 0.03cvss —epss 0.04

    Google Chrome 0.2.149.29 and 0.2.149.30 allows remote attackers to cause a denial of service (memory consumption) via an HTML document containing a carriage return ("\r\n\r\n") argument to the window.open function.

  • CVE-2008-4339Sep 30, 2008
    Symantec
    Netbackup
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Java Administration GUI (jnbSA) in Symantec Veritas NetBackup Server and NetBackup Enterprise Server 5.1 before MP7, 6.0 before MP7, and 6.5 before 6.5.2 allows remote authenticated users to gain privileges via unknown attack vectors related to…

  • CVE-2008-4338Sep 30, 2008
    Drupal
    Brilliant Gallery
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the brilliant_gallery_checklist_save function in the bgchecklist/save script in Brilliant Gallery 5.x and 6.x, a module for Drupal, allows remote authenticated users with "access brilliant_gallery" permissions to execute arbitrary SQL commands via…

  • CVE-2008-4337Sep 30, 2008
    Bitweaver
    Bitweaver
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Bitweaver 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to (1) edit.php and (2) list.php in articles/; (3) list_blogs.php and (4) rankings.php in blogs/; (5) calendar/index.php; (6)…

  • CVE-2008-4336Sep 30, 2008
    Atomic Photo Album
    Atomic Photo Album
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in album.php in Atomic Photo Album (APA) 1.1.0pre4 allows remote attackers to inject arbitrary web script or HTML via the apa_album_ID parameter.

  • CVE-2008-4335Sep 30, 2008
    Atomic Photo Album
    Atomic Photo Album
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in album.php in Atomic Photo Album (APA) 1.1.0pre4 allows remote attackers to execute arbitrary SQL commands via the apa_album_ID parameter.

  • CVE-2008-4334Sep 30, 2008
    PHP
    infoBoard
    risk 0.03cvss —epss 0.02

    PHP infoBoard V.7 Plus allows remote attackers to bypass authentication and gain administrative access by setting the infouser cookie to 1.

  • CVE-2008-4333Sep 30, 2008
    PHP InfoBoard
    PHP infoBoard
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in PHP infoBoard V.7 Plus allows remote attackers to inject arbitrary web script or HTML via the isname parameter in a newtopic action.

  • CVE-2008-4332Sep 30, 2008
    PHP InfoBoard
    PHP infoBoard
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the showjavatopic function in func.php in PHP infoBoard V.7 Plus allows remote attackers to execute arbitrary SQL commands via the idcat parameter to showtopic.php.