VYPR

CVEs

384,002 total · page 7032 of 7,681

AllCriticalHighKEV
  • CVE-2008-4144Sep 24, 2008
    Discountedscripts
    E Gold Script Shop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in ACG-ScriptShop E-Gold Script Shop allows remote attackers to execute arbitrary SQL commands via the cid parameter in a showcat action.

  • CVE-2008-4143Sep 24, 2008
    Razorecommerce
    Shopping Cart
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in category_search.php in RazorCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-4142Sep 24, 2008
    E PHP
    CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in article.php in E-Php CMS allows remote attackers to execute arbitrary SQL commands via the es_id parameter.

  • CVE-2008-4141Sep 24, 2008
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in x10Media x10 Automatic MP3 Script 1.5.5 allow remote attackers to execute arbitrary PHP code via a URL in the web_root parameter to (1) includes/function_core.php and (2) templates/layout_lyrics.php.

  • CVE-2008-4140Sep 24, 2008
    Open Solution
    Quick.cart
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin.php in Quick.Cart 3.1 allows remote attackers to inject arbitrary web script or HTML via the query string.

  • CVE-2008-4139Sep 24, 2008
    Open Solution
    Quick.CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin.php in OpenSolution Quick.Cms.Lite 2.1 allows remote attackers to inject arbitrary web script or HTML via the query string.

  • CVE-2008-4138Sep 24, 2008
    Technote
    Technote
    risk 0.04cvss —epss 0.10

    PHP remote file inclusion vulnerability in skin_shop/standard/3_plugin_twindow/twindow_notice.php in TECHNOTE 7 allows remote attackers to execute arbitrary PHP code via a URL in the shop_this_skin_path parameter.

  • CVE-2008-4137Sep 24, 2008
    PHP Crawler
    PHP Crawler
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in footer.php in PHP-Crawler 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the footer_file parameter.

  • CVE-2008-4136Sep 24, 2008
    Michael Roth Software
    Personal FTP Server
    risk 0.03cvss —epss 0.03

    Michael Roth Software Personal FTP Server (PFT) 6.0f allows remote attackers to cause a denial of service (service crash) via multiple RETR commands, possibly involving long filenames.

  • CVE-2008-4188Sep 23, 2008
    TYPO3
    Secure Directory
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before 1.0.2 allows remote attackers to execute arbitrary code via unknown vectors related to "injection of control characters."

  • CVE-2008-4187Sep 23, 2008
    Proactive CMS
    Proactive CMS
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in ProActive CMS allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter.

  • CVE-2008-4186Sep 23, 2008
    Webcms
    Webcms Portal Edition
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in webCMS Portal Edition allows remote attackers to execute arbitrary SQL commands via the id_doc parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-4185Sep 23, 2008
    Webcms
    Webcms Portal Edition
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in webCMS Portal Edition allows remote attackers to execute arbitrary SQL commands via the id parameter in a documentos action, a different vector than CVE-2008-3213.

  • CVE-2008-4184Sep 23, 2008
    Webcms
    Webcms Portal Edition
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in webCMS Portal Edition allows remote attackers to inject arbitrary web script or HTML via the patron parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-4183Sep 23, 2008
    Integramod
    Integramod
    risk 0.03cvss —epss 0.03

    IntegraMOD 1.4.x stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a backup via a direct request to a backup/backup-yyyy-dd-mm.sql filename.

  • CVE-2008-4182Sep 23, 2008
    Horde (software)
    Turba Contact Manager H3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in imp/test.php in Horde Turba Contact Manager H3 2.2.1 and other versions before 2.3.1, and possibly other Horde Project products, allows remote attackers to inject arbitrary web script or HTML via the User field in an IMAP session.

  • CVE-2008-4181Sep 23, 2008
    Netenberg
    Fantastico De Luxe
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in includes/xml.php in the Netenberg Fantastico De Luxe module before 2.10.4 r19 for cPanel, when cPanel PHP Register Globals is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) or…

  • CVE-2008-4180Sep 23, 2008
    Nooms
    Nooms
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in db.php in NooMS 1.1 allows remote attackers to conduct brute force attacks against passwords via a username in the g_dbuser parameter and a password in the g_dbpwd parameter, and possibly a "localhost" g_dbhost parameter value, related to a "Mysql…

  • CVE-2008-4179Sep 23, 2008
    Nooms
    Nooms
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in NooMS 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) page_id parameter to smileys.php and the (2) q parameter to search.php.

  • CVE-2008-4178Sep 23, 2008
    Downline Goldmine
    Builder
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and Downline Goldmine Builder allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third…

  • CVE-2008-4177Sep 23, 2008
    Preprojects
    Pre Real Estate Listings
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in search.php in Pre Real Estate Listings allows remote attackers to execute arbitrary SQL commands via the c parameter.

  • CVE-2008-4176Sep 23, 2008
    Dora Emlak
    Fot Video Scripti
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in izle.asp in FoT Video scripti 1.1 beta allows remote attackers to execute arbitrary SQL commands via the oyun parameter.

  • CVE-2008-4175Sep 23, 2008
    Linkbidscript
    Linkbidscript
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Link Bid Script 1.5 allow remote attackers to execute arbitrary SQL commands via the (1) ucat parameter to upgrade.php and the (2) id parameter to linkadmin/edit.php.

  • CVE-2008-4174Sep 23, 2008
    Benjamin Kuz
    Dynamic Mp3 Lister
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Dynamic MP3 Lister 2.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) currentpath, (2) invert, (3) search, and (4) sort parameters.

  • CVE-2008-3661Sep 23, 2008
    Drupal
    Drupal
    risk 0.00cvss —epss 0.03

    Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

  • CVE-2008-3519Sep 23, 2008
    Red Hat
    Jboss Enterprise Application Platform
    risk 0.00cvss —epss 0.02

    The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform (aka JBossEAP or EAP), possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote…

  • CVE-2008-4164Sep 22, 2008
    Memht
    Portal
    risk 0.03cvss —epss 0.02

    cron.php in MemHT Portal 3.9.0 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message.

  • CVE-2008-4163Sep 22, 2008
    Isc
    Bind
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in ISC BIND 9.3.5-P2-W1, 9.4.2-P2-W1, and 9.5.0-P2-W1 on Windows allows remote attackers to cause a denial of service (UDP client handler termination) via unknown vectors.

  • CVE-2008-4162Sep 22, 2008
    Nooms
    Nooms
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in admin/auth.php in NooMS 1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the g_site_url parameter.

  • CVE-2008-4161Sep 22, 2008
    Assetman
    Assetman
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in search_inv.php in Assetman 2.5b allows remote attackers to execute arbitrary SQL commands and conduct session fixation attacks via a combination of crafted order and order_by parameters in a search_all action.

  • CVE-2008-4160Sep 22, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the UFS module in Sun Solaris 8 through 10 and OpenSolaris allows local users to cause a denial of service (NULL pointer dereference and kernel panic) via unknown vectors related to the Solaris Access Control List (ACL) implementation.

  • CVE-2008-3949Sep 22, 2008
    GNU
    Emacs
    risk 0.00cvss —epss 0.01

    emacs/lisp/progmodes/python.el in Emacs 22.1 and 22.2 imports Python script from the current working directory during editing of a Python file, which allows local users to execute arbitrary code via a Trojan horse Python file.

  • CVE-2008-4173Sep 22, 2008
    Proarcadescript
    Proarcadescript
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ProArcadeScript 1.3 allows remote attackers to execute arbitrary SQL commands via the random parameter to the default URI.

  • CVE-2008-4172Sep 22, 2008
    Cars & Vehicle
    Cars-Vehicle Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in page.php in Cars & Vehicle (aka Cars-Vehicle Script) allows remote attackers to execute arbitrary SQL commands via the lnkid parameter.

  • CVE-2008-4171Sep 22, 2008
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in xmlout.php in Invision Power Board (IP.Board or IPB) 2.2.x and 2.3.x allows remote attackers to execute arbitrary SQL commands via the name parameter.

  • CVE-2008-4170Sep 22, 2008
    OsCommerce
    Oscommerce
    risk 0.00cvss —epss 0.02

    create_account.php in osCommerce 2.2 RC 2a allows remote attackers to obtain sensitive information via an invalid dob parameter, which reveals the installation path in an error message.

  • CVE-2008-4169Sep 22, 2008
    Iscripts
    Easyindex
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in detaillist.php in iScripts EasyIndex, possibly 1.0, allows remote attackers to execute arbitrary SQL commands via the produid parameter.

  • CVE-2008-4168Sep 22, 2008
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in verify_login.jsp in Pro2col Stingray FTS allows remote attackers to inject arbitrary web script or HTML via the form_username parameter (aka user name field).

  • CVE-2008-4167Sep 22, 2008
    Ezphotogallery
    Ezphotogallery
    risk 0.03cvss —epss 0.03

    useradmin.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 does not require administrative authentication, which allows remote attackers to (1) add or (2) remove an Administrator account.

  • CVE-2008-4166Sep 22, 2008
    Avant Browser
    Browser
    risk 0.03cvss —epss 0.02

    Integer overflow in the JavaScript engine in Avant Browser 11.7 Build 9 and earlier allows remote attackers to cause a denial of service (application crash) by attempting to URL encode a string containing many instances of an invalid character.

  • CVE-2008-4165Sep 22, 2008
    Kolab
    Kolab Groupware Server
    risk 0.00cvss —epss 0.01

    admin/user/create_user.php in Kolab Groupware Server 1.0.0 places a user password in an HTTP GET request, which allows local administrators, and possibly remote attackers, to obtain cleartext passwords by reading the ssl_access_log file or the referer string.

  • CVE-2008-4159Sep 22, 2008
    Zanfi CMS
    Zanfi CMS lite
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Jaw Portal and Zanfi CMS lite and allows remote attackers to execute arbitrary SQL commands via the page (pageid) parameter.

  • CVE-2008-4158Sep 22, 2008
    Zanfi Solutions
    CMS lite
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in index.php in Zanfi CMS lite 1.2 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) flag and (2) inc parameters.

  • CVE-2008-4157Sep 22, 2008
    Vastal
    Phpvid
    risk 0.03cvss —epss 0.06

    SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 1.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter, a different vector than CVE-2007-3610. NOTE: it was later reported that 1.2.3 is also affected.

  • CVE-2008-4156Sep 19, 2008
    Customcms
    Gaming Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in print.php in CustomCms (CCMS) Gaming Portal 4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-4155Sep 19, 2008
    Easysitecms
    Easysite
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in EasySite 2.3 allow remote attackers to read arbitrary files or list directories via a .. (dot dot) in the (1) module or (2) action parameter in (a) www/index.php; the (3) module, (4) ss_module, or (5) ss_action parameter in (b)…

  • CVE-2008-4154Sep 19, 2008
    Living E
    Webedition CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in living-e webEdition CMS allows remote attackers to execute arbitrary SQL commands via the we_objectID parameter.

  • CVE-2008-4135Sep 19, 2008
    Nokia
    Nseries N82
    risk 0.03cvss —epss 0.04

    Symbian OS S60 3rd edition on the Nokia E90 Communicator 07.40.1.2 Ra-6 and Nseries N82 allows remote attackers to cause a denial of service (device crash) via multiple deauthentication (DeAuth) frames.

  • CVE-2008-4134Sep 19, 2008
    Phprealty
    Phprealty
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in manager/static/view.php in phpRealty 0.03 and earlier, and possibly other versions before 0.05, allows remote attackers to execute arbitrary PHP code via a URL in the INC parameter.

  • CVE-2008-4133Sep 19, 2008
    Dlink
    Dir 100
    risk 0.03cvss —epss 0.04

    The web proxy service on the D-Link DIR-100 with firmware 1.12 and earlier does not properly filter web requests with large URLs, which allows remote attackers to bypass web restriction filters.