VYPR

CVEs

383,945 total · page 7036 of 7,679

AllCriticalHighKEV
  • CVE-2008-3911Sep 4, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The proc_do_xprt function in net/sunrpc/sysctl.c in the Linux kernel 2.6.26.3 does not check the length of a certain buffer obtained from userspace, which allows local users to overflow a stack-based buffer and have unspecified other impact via a crafted read system call for the…

  • CVE-2008-1389Sep 4, 2008
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.03

    libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of service (application crash) via a malformed CHM file, related to an "invalid memory access."

  • CVE-2008-2441Sep 4, 2008
    Cisco Systems, Inc.
    Secure Acs
    risk 0.00cvss —epss 0.03

    Cisco Secure ACS 3.x before 3.3(4) Build 12 patch 7, 4.0.x, 4.1.x before 4.1(4) Build 13 Patch 11, and 4.2.x before 4.2(0) Build 124 Patch 4 does not properly handle an EAP Response packet in which the value of the length field exceeds the actual packet length, which allows…

  • CVE-2008-2732Sep 4, 2008
    Cisco Systems, Inc.
    Pix
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in the SIP inspection functionality in Cisco PIX and Adaptive Security Appliance (ASA) 5500 devices 7.0 before 7.0(7)16, 7.1 before 7.1(2)71, 7.2 before 7.2(4)7, 8.0 before 8.0(3)20, and 8.1 before 8.1(1)8 allow remote attackers to cause a…

  • CVE-2008-2733Sep 4, 2008
    Cisco Systems, Inc.
    Pix
    risk 0.00cvss —epss 0.03

    Cisco PIX and Adaptive Security Appliance (ASA) 5500 devices 7.2 before 7.2(4)2, 8.0 before 8.0(3)14, and 8.1 before 8.1(1)4, when configured as a client VPN endpoint, do not properly process IPSec client authentication, which allows remote attackers to cause a denial of service…

  • CVE-2008-2734Sep 4, 2008
    Cisco Systems, Inc.
    Adaptive Security Appliance (ASA) Software
    risk 0.00cvss —epss 0.03

    Memory leak in the crypto functionality in Cisco Adaptive Security Appliance (ASA) 5500 devices 7.2 before 7.2(4)2, 8.0 before 8.0(3)14, and 8.1 before 8.1(1)4, when configured as a clientless SSL VPN endpoint, allows remote attackers to cause a denial of service (memory…

  • CVE-2008-2735Sep 4, 2008
    Cisco Systems, Inc.
    Adaptive Security Appliance (ASA) Software
    risk 0.00cvss —epss 0.03

    The HTTP server in Cisco Adaptive Security Appliance (ASA) 5500 devices 8.0 before 8.0(3)15 and 8.1 before 8.1(1)5, when configured as a clientless SSL VPN endpoint, does not properly process URIs, which allows remote attackers to cause a denial of service (device reload) via a…

  • CVE-2008-2736Sep 4, 2008
    Cisco Systems, Inc.
    Adaptive Security Appliance (ASA) Software
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco Adaptive Security Appliance (ASA) 5500 devices 8.0(3)15, 8.0(3)16, 8.1(1)4, and 8.1(1)5, when configured as a clientless SSL VPN endpoint, allows remote attackers to obtain usernames and passwords via unknown vectors, aka Bug ID CSCsq45636.

  • CVE-2008-1739Sep 3, 2008
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.02

    Apple QuickTime before 7.4.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted ftyp atoms in a movie file, which triggers memory corruption.

  • CVE-2008-3902Sep 3, 2008
    Microfocus
    68dtt
    risk 0.00cvss —epss 0.00

    HP firmware 68DTT F.0D stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer, aka SSRT080104.

  • CVE-2008-2101Sep 3, 2008
    VMware
    Esx
    risk 0.00cvss —epss 0.00

    The VMware Consolidated Backup (VCB) command-line utilities in VMware ESX 3.0.1 through 3.0.3 and ESX 3.5 place a password on the command line, which allows local users to obtain sensitive information by listing the process.

  • CVE-2008-3101Sep 3, 2008
    Vtiger
    vTiger
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the parenttab parameter in an index action to the Products module, as reachable through index.php; (2) the user_password parameter in an…

  • CVE-2008-3525Sep 3, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The sbni_ioctl function in drivers/net/wan/sbni.c in the wan subsystem in the Linux kernel 2.6.26.3 does not check for the CAP_NET_ADMIN capability before processing a (1) SIOCDEVRESINSTATS, (2) SIOCDEVSHWSTATE, (3) SIOCDEVENSLAVE, or (4) SIOCDEVEMANSIPATE ioctl request, which…

  • CVE-2008-3536Sep 3, 2008
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to cause a denial of service via unknown vectors, a different vulnerability than CVE-2008-3537.

  • CVE-2008-3537Sep 3, 2008
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to cause a denial of service via unknown vectors, a different vulnerability than CVE-2008-3536.

  • CVE-2008-3691Sep 3, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7…

  • CVE-2008-3692Sep 3, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7…

  • CVE-2008-3693Sep 3, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7…

  • CVE-2008-3694Sep 3, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7…

  • CVE-2008-3695Sep 3, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7…

  • CVE-2008-3696Sep 3, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7…

  • CVE-2008-3697Sep 3, 2008
    VMware
    Server
    risk 0.00cvss —epss 0.03

    An unspecified ISAPI extension in VMware Server before 1.0.7 build 108231 allows remote attackers to cause a denial of service (IIS crash) via a malformed request.

  • CVE-2008-3698Sep 3, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the OpenProcess function in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7…

  • CVE-2008-3791Sep 3, 2008
    Lxde
    Lightweight X11 Desktop Environment
    risk 0.00cvss —epss 0.00

    src/main-win.c in GPicView 0.1.9 in Lightweight X11 Desktop Environment (LXDE) allows local users to overwrite arbitrary files via a symlink attack on the /tmp/rot.jpg temporary file.

  • CVE-2008-3792Sep 3, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4 does not verify that the SCTP-AUTH extension is enabled before proceeding with SCTP-AUTH API functions, which allows attackers to cause a denial of service…

  • CVE-2008-3891Sep 3, 2008
    Google
    Google Apps
    risk 0.00cvss —epss 0.01

    The SAML Single Sign-On (SSO) Service for Google Apps allows remote service providers to impersonate users at arbitrary service providers via vectors related to authentication responses that lack a request identifier and recipient field.

  • CVE-2008-3892Sep 3, 2008
    VMware
    Workstation
    risk 0.05cvss —epss 0.24

    Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before…

  • CVE-2008-3893MedSep 3, 2008
    Microsoft
    Windows
    risk 0.36cvss 5.5epss 0.01

    Microsoft Bitlocker in Windows Vista before SP1 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer during boot, which allows local users to obtain sensitive information by reading the physical memory locations associated with this…

  • CVE-2008-3894Sep 3, 2008
    IBM
    Lenovo firmware
    risk 0.00cvss —epss 0.00

    IBM Lenovo firmware 7CETB5WW 2.05 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.

  • CVE-2008-3895Sep 3, 2008
    Lilo
    Lilo
    risk 0.00cvss —epss 0.00

    LILO 22.6.1 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.

  • CVE-2008-3896Sep 3, 2008
    Grub Legacy
    Grub Legacy
    risk 0.00cvss —epss 0.00

    Grub Legacy 0.97 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.

  • CVE-2008-3897Sep 3, 2008
    DiskCryptor
    DiskCryptor
    risk 0.00cvss —epss 0.00

    DiskCryptor 0.2.6 on Windows stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.

  • CVE-2008-3898Sep 3, 2008
    Securstar
    Drivecrypt Plus Pack
    risk 0.00cvss —epss 0.00

    Secu Star DriveCrypt Plus Pack 3.9 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this…

  • CVE-2008-3899Sep 3, 2008
    Truecrypt Foundation
    Truecrypt
    risk 0.00cvss —epss 0.00

    TrueCrypt 5.0 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer. NOTE: the…

  • CVE-2008-3900Sep 3, 2008
    Intel
    BIOS
    risk 0.00cvss —epss 0.00

    Intel firmware PE94510M.86A.0050.2007.0710.1559 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this…

  • CVE-2008-3901Sep 3, 2008
    Suspend2
    Software Suspend 2
    risk 0.00cvss —epss 0.00

    Software suspend 2 2-2.2.1, when used with the Linux kernel 2.6.16, stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations…

  • CVE-2008-3877Sep 2, 2008
    Acoustica
    Mixcraft
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in Acoustica Mixcraft 4.1 Build 96 and 4.2 Build 98 allows user-assisted attackers to execute arbitrary code via a crafted .mx4 file. NOTE: it was later reported that version 3 is also affected.

  • CVE-2008-3878Sep 2, 2008
    Ultrashareware
    Ultra Office Control
    risk 0.06cvss —epss 0.36

    Stack-based buffer overflow in the Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 in Ultra Shareware Ultra Office Control allows remote attackers to execute arbitrary code via long strUrl, strFile, and strPostData parameters to the HttpUpload method.

  • CVE-2008-3879Sep 2, 2008
    Ultrashareware
    Ultra Office Control
    risk 0.03cvss —epss 0.04

    The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra Shareware Ultra Office Control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction…

  • CVE-2008-3880Sep 2, 2008
    Zoneminder
    Zoneminder
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in zm_html_view_event.php in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary SQL commands via the filter array parameter.

  • CVE-2008-3881Sep 2, 2008
    Zoneminder
    Zoneminder
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ZoneMinder 1.23.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified "zm_html_view_*.php" files.

  • CVE-2008-3882Sep 2, 2008
    Zoneminder
    Zoneminder
    risk 0.00cvss —epss 0.03

    Unspecified "Command Injection" vulnerability in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary commands via (1) the executeFilter function in zm_html_view_events.php and (2) the run_state parameter to zm_html_view_state.php.

  • CVE-2008-3883Sep 2, 2008
    Caudium
    Caudium
    risk 0.00cvss —epss 0.00

    configvar in Caudium 1.4.12 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/roken#####.pike temporary file.

  • CVE-2008-3884Sep 2, 2008
    Blogn
    Blogn
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Blogn (BURO GUN) 1.9.7 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2006-6176.

  • CVE-2008-3885Sep 2, 2008
    Blogn
    Blogn
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Blogn (BURO GUN) 1.9.7 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make content modifications. NOTE: some of these details are obtained from third party information.

  • CVE-2008-3886Sep 2, 2008
    Dotproject
    Dotproject
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in dotProject 2.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) the inactive parameter in a tasks action, (2) the date parameter in a calendar day_view action, (3) the callback parameter…

  • CVE-2008-3887Sep 2, 2008
    Dotproject
    Dotproject
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in dotProject 2.1.2 allow (1) remote authenticated users to execute arbitrary SQL commands via the tab parameter in a projects action, and (2) remote authenticated administrators to execute arbitrary SQL commands via the…

  • CVE-2008-3888Sep 2, 2008
    Mini Nuke
    Freehost
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in members.asp in Mini-NUKE Freehost 2.3 allows remote attackers to execute arbitrary SQL commands via the uid parameter in a member_details action.

  • CVE-2008-3146Sep 2, 2008
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in packet_ncp2222.inc in Wireshark (formerly Ethereal) 0.9.7 through 1.0.2 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted NCP packet that causes an invalid pointer to be used.

  • CVE-2008-3538Sep 2, 2008
    Microfocus
    Enterprise Discovery
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in HP Enterprise Discovery 2.0 through 2.52 on Windows allows remote authenticated users to execute arbitrary code via unknown vectors. NOTE: the initial description of this CVE was inadvertently associated with libxml2, but it should be for HP…