VYPR

CVEs

383,953 total · page 7034 of 7,680

AllCriticalHighKEV
  • CVE-2008-4043Sep 11, 2008
    AJ Square
    Aj Hyip
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in AJ Square AJ HYIP Acme allow remote attackers to execute arbitrary SQL commands via the artid parameter to (1) acme/article/comment.php and (2) prime/article/comment.php.

  • CVE-2008-4041Sep 11, 2008
    Softalk
    Mail Server
    risk 0.03cvss —epss 0.02

    The IMAP server in Softalk Mail Server (formerly WorkgroupMail) 8.5.1.431 allows remote authenticated users to cause a denial of service (resource consumption and daemon crash) via a long IMAP APPEND command with certain repeated parameters.

  • CVE-2008-4040Sep 11, 2008
    Kyocera
    Command Center
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the Kyocera Command Center in Kyocera FS-118MFP allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

  • CVE-2008-4039Sep 11, 2008
    Spice Classifieds
    Spice Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Spice Classifieds allows remote attackers to execute arbitrary SQL commands via the cat_path parameter.

  • CVE-2008-3584Sep 11, 2008
    NetBSD
    NetBSD
    risk 0.00cvss —epss 0.03

    NetBSD 3.0, 3.1, and 4.0, when a pppoe instance exists, does not properly check the length of a PPPoE packet tag, which allows remote attackers to cause a denial of service (system crash) via a crafted PPPoE packet.

  • CVE-2008-4018Sep 11, 2008
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    swcons in bos.rte.console in IBM AIX 5.2.0 through 6.1.1 allows local users in the system group to create or overwrite an arbitrary file, and establish weak permissions and root ownership for this file, via unspecified vectors. NOTE: this can be leveraged to gain privileges.…

  • CVE-2008-3972Sep 11, 2008
    Opensc Project
    Opensc
    risk 0.00cvss —epss 0.00

    pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by…

  • CVE-2008-3971Sep 11, 2008
    Gmanedit2
    Gmanedit
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in the open_man_file function in callbacks.c in gmanedit 0.4.1 allows remote attackers to execute arbitrary code via a crafted man page, which is not properly handled during utf8 conversion. NOTE: another overflow was reported using a configuration…

  • CVE-2008-3970Sep 11, 2008
    Pam Mount
    Pam Mount
    risk 0.00cvss —epss 0.00

    pam_mount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volume, which allows local users to bypass intended access restrictions via a local mount.

  • CVE-2008-3969Sep 11, 2008
    Bitlbee
    Bitlbee
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknown vectors related to "inconsistent handling of the USTATUS_IDENTIFIED state." NOTE: this issue exists because of an incomplete fix for…

  • CVE-2008-3968Sep 11, 2008
    Punbb
    Punbb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in userlist.php in PunBB before 1.2.20 allows remote attackers to inject arbitrary web script or HTML via the p parameter.

  • CVE-2008-3967Sep 11, 2008
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    moderation.php in MyBB (aka MyBulletinBoard) before 1.4.1 does not properly check for moderator privileges, which has unknown impact and remote attack vectors.

  • CVE-2008-3966Sep 11, 2008
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via (1) a certain referrer field in usercp2.php, (2) a certain location field in inc/functions_online.php, and certain (3)…

  • CVE-2008-3965Sep 11, 2008
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.4.1 allows remote attackers to execute arbitrary SQL commands via a certain editor field.

  • CVE-2008-3964Sep 11, 2008
    Libpng
    Libpng
    risk 0.00cvss —epss 0.03

    Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a PNG image with crafted zTXt chunks, related to (1) the png_push_read_zTXt function…

  • CVE-2008-3963Sep 11, 2008
    MySQL
    MySQL
    risk 0.04cvss —epss 0.06

    MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.

  • CVE-2008-3962Sep 11, 2008
    Ssmtp
    Ssmtp
    risk 0.00cvss —epss 0.02

    The from_format function in ssmtp.c in ssmtp 2.61 and 2.62, in certain configurations, uses uninitialized memory for the From: field of an e-mail message, which might allow remote attackers to obtain sensitive information (memory contents) in opportunistic circumstances by…

  • CVE-2008-3960Sep 11, 2008
    IBM
    DB2 UDB
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the JDBC Applet Server Service (aka db2jds) in IBM DB2 UDB 8 before Fixpak 17 allows remote attackers to cause a denial of service (service crash) via "malicious packets."

  • CVE-2008-3959Sep 11, 2008
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    IBM DB2 UDB 8.1 before FixPak 16, 8.2 before FixPak 9, and 9.1 before FixPak 4a allows remote attackers to cause a denial of service (instance crash) via a crafted SQLJRA packet within a CONNECT/ATTACH data stream that simulates a V7 client connect/attach request.

  • CVE-2008-3958Sep 11, 2008
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    IBM DB2 UDB 8 before Fixpak 17 allows remote attackers to cause a denial of service (instance crash) via a crafted CONNECT/ATTACH data stream that simulates a V7 client connect/attach request. NOTE: this may overlap CVE-2008-3858. NOTE: this issue exists because of an…

  • CVE-2008-3957Sep 11, 2008
    Microsoft
    Windows Image Acquisition Logger
    risk 0.04cvss —epss 0.18

    The Microsoft Windows Image Acquisition Logger ActiveX control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destination pathname in the first argument to the…

  • CVE-2008-3956Sep 11, 2008
    Microsoft
    Organization Chart
    risk 0.04cvss —epss 0.13

    orgchart.exe in Microsoft Organization Chart 2.00 allows user-assisted attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted .opx file.

  • CVE-2008-3955Sep 11, 2008
    Masir Camp
    E Shop Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Masir Camp E-Shop Module 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the ordercode parameter in a veiworderstatus page.

  • CVE-2008-3954Sep 11, 2008
    Alstrasoft
    Forum Pay Per Post Exchange
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in AlstraSoft Forum Pay Per Post Exchange allows remote attackers to execute arbitrary SQL commands via the cat parameter in a showcat action.

  • CVE-2008-3953Sep 11, 2008
    Vastal
    Shaadi Zone
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in keyword_search_action.php in Vastal I-Tech Shaadi Zone 1.0.9 allows remote attackers to execute arbitrary SQL commands via the tage parameter.

  • CVE-2008-3952Sep 11, 2008
    Editeurscripts
    20
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in questions.php in EsFaq 2.0 allows remote attackers to execute arbitrary SQL commands via the idcat parameter.

  • CVE-2008-3951Sep 11, 2008
    Vastal
    Agent Zone
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in view_ann.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the ann_id parameter.

  • CVE-2008-3915Sep 11, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    Buffer overflow in nfsd in the Linux kernel before 2.6.26.4, when NFSv4 is enabled, allows remote attackers to have an unknown impact via vectors related to decoding an NFSv4 acl.

  • CVE-2008-3914Sep 11, 2008
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in ClamAV before 0.94 have unknown impact and attack vectors related to file descriptor leaks on the "error path" in (1) libclamav/others.c and (2) libclamav/sis.c.

  • CVE-2008-3913Sep 11, 2008
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.03

    Multiple memory leaks in freshclam/manager.c in ClamAV before 0.94 might allow attackers to cause a denial of service (memory consumption) via unspecified vectors related to "error handling logic".

  • CVE-2008-3912Sep 11, 2008
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.03

    libclamav in ClamAV before 0.94 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to an out-of-memory condition.

  • CVE-2008-3636Sep 11, 2008
    Microsoft
    Windows
    risk 0.00cvss —epss 0.00

    Integer overflow in the IopfCompleteRequest API in the kernel in Microsoft Windows 2000, XP, Server 2003, and Vista allows context-dependent attackers to gain privileges. NOTE: this issue was originally reported for GEARAspiWDM.sys 2.0.7.5 in Gear Software CD DVD Filter driver…

  • CVE-2008-3635Sep 11, 2008
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in QuickTimeInternetExtras.qtx in an unspecified third-party Indeo v3.2 (aka IV32) codec for QuickTime, when used with Apple QuickTime before 7.5.5 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (application…

  • CVE-2008-3634Sep 11, 2008
    Apple Inc.
    iTunes
    risk 0.00cvss —epss 0.02

    Apple iTunes before 8.0 on Mac OS X 10.4.11, when iTunes Music Sharing is enabled but blocked by the host-based firewall, presents misleading information about firewall security, which might allow remote attackers to leverage an exposure that would be absent if the administrator…

  • CVE-2008-3632Sep 11, 2008
    Apple Inc.
    iPhone
    risk 0.00cvss —epss 0.06

    Use-after-free vulnerability in WebKit in Apple iPod touch 1.1 through 2.0.2, and iPhone 1.0 through 2.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a web page with crafted Cascading Style Sheets (CSS) import…

  • CVE-2008-3631Sep 11, 2008
    Apple Inc.
    Ipod Touch
    risk 0.00cvss —epss 0.02

    Application Sandbox in Apple iPod touch 2.0 through 2.0.2, and iPhone 2.0 through 2.0.2, does not properly isolate third-party applications, which allows attackers to read arbitrary files in a third-party application's sandbox via a different third-party application.

  • CVE-2008-3630Sep 11, 2008
    Apple Inc.
    Bonjour
    risk 0.00cvss —epss 0.02

    mDNSResponder in Apple Bonjour for Windows before 1.0.5, when an application uses the Bonjour API for unicast DNS, does not choose random values for transaction IDs or source ports in DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different…

  • CVE-2008-3629Sep 11, 2008
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.02

    Apple QuickTime before 7.5.5 allows remote attackers to cause a denial of service (application crash) via a crafted PICT image that triggers an out-of-bounds read.

  • CVE-2008-3628Sep 11, 2008
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.04

    Apple QuickTime before 7.5.5 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image, related to an "invalid pointer issue."

  • CVE-2008-3627Sep 11, 2008
    Apple Inc.
    Quicktime
    risk 0.01cvss —epss 0.09

    Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx, (2) MDAT atoms in mov video files within QuickTimeH264.scalar, and (3) AVC1 atoms in an unknown media type within an unspecified component, which allows remote…

  • CVE-2008-3626Sep 11, 2008
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    The CallComponentFunctionWithStorage function in Apple QuickTime before 7.5.5 does not properly handle a large entry in the sample_size_table in STSZ atoms, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application…

  • CVE-2008-3625Sep 11, 2008
    Apple Inc.
    Quicktime
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in Apple QuickTime before 7.5.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a QuickTime Virtual Reality (QTVR) movie file with crafted (1) maxTilt, (2) minFieldOfView, and (3) maxFieldOfView…

  • CVE-2008-3624Sep 11, 2008
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in Apple QuickTime before 7.5.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a QuickTime Virtual Reality (QTVR) movie file with crafted panorama atoms.

  • CVE-2008-3615Sep 11, 2008
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.04

    ir50_32.qtx in an unspecified third-party Indeo v5 codec for QuickTime, when used with Apple QuickTime before 7.5.5 on Windows, accesses uninitialized memory, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted…

  • CVE-2008-3614Sep 11, 2008
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.04

    Integer overflow in Apple QuickTime before 7.5.5 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image, which triggers heap corruption.

  • CVE-2008-3612CriSep 11, 2008
    Apple Inc.
    iPhone
    risk 0.64cvss 9.8epss 0.04

    The Networking subsystem in Apple iPod touch 2.0 through 2.0.2, and iPhone 2.0 through 2.0.2, uses predictable TCP initial sequence numbers, which allows remote attackers to spoof or hijack a TCP connection.

  • CVE-2008-3539Sep 11, 2008
    Microfocus
    Hpsi Acf2 Connector
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in HP OpenView Select Identity (HPSI) Connectors on Windows, as used in HPSI Active Directory Connector 2.30 and earlier, HPSI SunOne Connector 1.14 and earlier, HPSI eDirectory Connector 1.12 and earlier, HPSI eTrust Connector 1.02 and earlier, HPSI…

  • CVE-2008-3015Sep 11, 2008
    Microsoft
    Office
    risk 0.03cvss —epss 0.39

    Integer overflow in gdiplus.dll in GDI+ in Microsoft Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report…

  • CVE-2008-3014Sep 11, 2008
    Microsoft
    Internet Explorer
    risk 0.03cvss —epss 0.37

    Buffer overflow in gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer…

  • CVE-2008-3013Sep 11, 2008
    Microsoft
    Internet Explorer
    risk 0.07cvss —epss 0.52

    gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital…