VYPR

CVEs

383,919 total · page 7044 of 7,679

AllCriticalHighKEV
  • CVE-2008-3408Jul 31, 2008
    Coolplayer
    Coolplayer
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in CoolPlayer 2.18, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via a crafted m3u file.

  • CVE-2008-3409Jul 31, 2008
    Unreal Tournament
    Unreal Tournament 3
    risk 0.04cvss —epss 0.11

    Buffer overflow in Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a UDP packet containing a large value in a certain size field, followed by a data string…

  • CVE-2008-3410Jul 31, 2008
    Unreal Tournament
    Unreal Tournament 3
    risk 0.00cvss —epss 0.03

    Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a UDP packet in which the value of a certain size field is greater than the total packet length, aka attack 2 in ut3mendo.c.

  • CVE-2008-3411Jul 31, 2008
    Axesstel
    AXW-D800
    risk 0.00cvss —epss 0.03

    The Axesstel AXW-D800 modem with D2_ETH_109_01_VEBR Jun-14-2006 software does not require authentication for (1) etc/config/System.html, (2) etc/config/Network.html, (3) etc/config/Security.html, (4) cgi-bin/sysconf.cgi, and (5) cgi-bin/route.cgi, which allows remote attackers…

  • CVE-2008-3412Jul 31, 2008
    Ecshop
    Epshop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Comsenz EPShop (aka ECShop) before 3.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a (1) pro_show or (2) disppro action to the default URI.

  • CVE-2008-3413Jul 31, 2008
    Greatclone
    Auction Platinum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in category.php in Greatclone GC Auction Platinum allows remote attackers to execute arbitrary SQL commands via the cate_id parameter.

  • CVE-2008-3414Jul 31, 2008
    Siteadmin
    SiteAdmin
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in line2.php in SiteAdmin allows remote attackers to execute arbitrary SQL commands via the art parameter.

  • CVE-2008-3415Jul 31, 2008
    Cmscout
    Cmscout
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file…

  • CVE-2008-3416Jul 31, 2008
    Icebb
    Icebb
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in modules/members.php in IceBB before 1.0-rc9.3 allows remote attackers to execute arbitrary SQL commands via the username parameter in a members action to index.php, related to an incorrect protection mechanism in the clean_string function in…

  • CVE-2008-3417Jul 31, 2008
    FipsCMS
    fipsCMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in home/index.asp in fipsCMS light 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the r parameter, a different vector than CVE-2006-6115 and CVE-2007-2561.

  • CVE-2008-3418Jul 31, 2008
    Willo
    Trio
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in browse.php in TriO 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-3419Jul 31, 2008
    Greatclone
    Youtuber Clone
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ugroups.php in Youtuber Clone allows remote attackers to execute arbitrary SQL commands via the UID parameter.

  • CVE-2008-3420Jul 31, 2008
    Willo
    Mobius Web Publishing Software
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Mobius for Mimsy XG 1 1.4.4.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to browse.php or (2) the s parameter in an exhibitions action to detail.php.

  • CVE-2008-3421Jul 31, 2008
    Blackboard
    Academic Suite
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Blackboard Academic Suite 8.0.260.7 allow remote attackers to hijack the authentication of student users for requests that change configuration and enrollments via unspecified input to (1) update_module.jsp, (2)…

  • CVE-2008-3390Jul 31, 2008
    Minishowcase
    Image Gallery
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in libraries/general.init.php in Minishowcase Image Gallery 09b136, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.

  • CVE-2008-3391Jul 31, 2008
    Webwiz
    Forums
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Web Wiz Forum 9.5 allow remote attackers to inject arbitrary web script or HTML via the mode parameter to (1) admin_group_details.asp and (2) admin_category_details.asp.

  • CVE-2008-3392Jul 31, 2008
    Webwiz
    Forums
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Web Wiz Forum 9.5 allows remote attackers to log out a user via a link or IMG tag to log_off_user.asp.

  • CVE-2008-3393Jul 31, 2008
    BookMine
    BookMine
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in events.cfm in BookMine allows remote attackers to execute arbitrary SQL commands via the events_id parameter.

  • CVE-2008-3394Jul 31, 2008
    BookMine
    BookMine
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in search.cfm in BookMine allow remote attackers to inject arbitrary web script or HTML via the (1) gallery and (2) search_string parameters.

  • CVE-2008-3395Jul 31, 2008
    Atmail
    Atmail
    risk 0.00cvss —epss 0.01

    Calacode @Mail 5.41 on Linux uses weak world-readable permissions for (1) webmail/libs/Atmail/Config.php and (2) webmail/webadmin/.htpasswd, which allows local users to obtain sensitive information by reading these files. NOTE: the provenance of this information is unknown; the…

  • CVE-2008-3396Jul 31, 2008
    Epic Games
    Unreal Tournament 2004
    risk 0.04cvss —epss 0.08

    Unreal Tournament 2004 (UT2004) 3369 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a certain sequence of malformed packets.

  • CVE-2008-3397MedJul 31, 2008
    Runesoft
    Cerberus CMS
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Runesoft Cerberus CMS before 3_1.4_0.9 allows remote attackers to inject arbitrary web script or HTML via a cerberus_user cookie.

  • CVE-2008-3398Jul 31, 2008
    Xrms
    CRM
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in XRMS CRM 1.99.2 allow remote attackers to inject arbitrary web script or HTML via the msg parameter to unspecified components, possibly including login.php. NOTE: this may overlap CVE-2008-1129.

  • CVE-2008-3399Jul 31, 2008
    Xrms
    CRM
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in activities/workflow-activities.php in XRMS CRM 1.99.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the include_directory parameter.

  • CVE-2008-3400Jul 31, 2008
    Xrms
    CRM
    risk 0.03cvss —epss 0.02

    XRMS CRM 1.99.2 allows remote attackers to obtain configuration information via a direct request to tests/info.php, which calls the phpinfo function.

  • CVE-2008-3401Jul 31, 2008
    Hscripts
    Hiox Random AD
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in hioxRandomAd.php in HIOX Random Ad (HRA) 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the hm parameter.

  • CVE-2008-3402Jul 31, 2008
    Hiox India
    Browser Statistics
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in HIOX Browser Statistics (HBS) 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the hm parameter to (1) hioxupdate.php and (2) hioxstats.php.

  • CVE-2008-3403Jul 31, 2008
    Mojoscripts
    Mojopersonals
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in mojoClassified.cgi in MojoPersonals allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2008-3404Jul 31, 2008
    MJGuest
    MJGuest
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in guestbook.js.php in MJGuest 6.8 GT allows remote attackers to inject arbitrary web script or HTML via the link parameter.

  • CVE-2008-3405Jul 31, 2008
    Nazgulled
    Nzfotolog
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in Ricardo Amaral nzFotolog 0.4.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action_file parameter.

  • CVE-2008-3406Jul 31, 2008
    Phplinkat
    Phplinkat
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in showcat.php in phpLinkat 0.1 allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2008-3407Jul 31, 2008
    Phplinkat
    Phplinkat
    risk 0.03cvss —epss 0.03

    phpLinkat 0.1 allows remote attackers to bypass authentication and access unspecified pages under admin/ by sending a login=right cookie.

  • CVE-2008-3380Jul 30, 2008
    Myiosoft
    Easybookmarker
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ajaxp_backend.php in MyioSoft EasyBookMarker 4.0 trial edition (tr) allows remote attackers to inject arbitrary web script or HTML via the rs parameter.

  • CVE-2008-3381Jul 30, 2008
    Moinmo
    Moinmoin
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in macro/AdvancedSearch.py in moin (and MoinMoin) 1.6.3 and 1.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-3382Jul 30, 2008
    Mojoscripts
    Mojoclassifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in mojoClassified.cgi in MojoClassifieds 2.0 allows remote attackers to execute arbitrary SQL commands via the cat_a parameter.

  • CVE-2008-3383Jul 30, 2008
    Mojoscripts
    Mojoauto
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in mojoAuto.cgi in MojoAuto allows remote attackers to execute arbitrary SQL commands via the cat_a parameter in a browse action.

  • CVE-2008-3384Jul 30, 2008
    Interact
    Interact
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in help/help.php in Interact Learning Community Environment Interact 2.4.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) module and (2) file parameters.

  • CVE-2008-3385Jul 30, 2008
    Linux Web Shop
    PHP Help Agent
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in include/head_chat.inc.php in php Help Agent 1.0 and 1.1 Full allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the content parameter. NOTE: in some environments, this can be leveraged for remote file…

  • CVE-2008-3386Jul 30, 2008
    Alstrasoft
    Video Share Enterprise
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in album.php in AlstraSoft Video Share Enterprise 4.51 allows remote attackers to execute arbitrary SQL commands via the UID parameter, a different vector than CVE-2007-4086.

  • CVE-2008-3387Jul 30, 2008
    Phpfootball
    Phpfootball
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in show.php in PHPFootball 1.6 allows remote attackers to execute arbitrary SQL commands via the dbtable parameter.

  • CVE-2008-3388Jul 30, 2008
    Easy Script
    Def Blog
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Def-Blog 1.0.3 allow remote attackers to execute arbitrary SQL commands via the article parameter to (1) comaddok.php and (2) comlook.php.

  • CVE-2008-3365Jul 30, 2008
    Pixelpost
    Pixelpost
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in index.php in Pixelpost 1.7.1 on Windows, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language_full parameter.

  • CVE-2008-3366Jul 30, 2008
    Pligg
    CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in story.php in Pligg CMS Beta 9.9.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: this might overlap CVE-2008-1774.

  • CVE-2008-3367Jul 30, 2008
    Webwiz
    Rich Text Editor
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in RTE_popup_link.asp in Web Wiz Rich Text Editor (RTE) 3.x and 4.x before 4.03 allows remote attackers to inject arbitrary web script or HTML via the email parameter.

  • CVE-2008-3368Jul 30, 2008
    Atutor
    Atutor
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in tools/packages/import.php in ATutor 1.6.1 pl1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via a URL in the type parameter.

  • CVE-2008-3369Jul 30, 2008
    Viart
    Shop
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in products_rss.php in ViArt Shop 3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the category_id parameter.

  • CVE-2008-3370Jul 30, 2008
    EMC Corporation
    Centera Universal Access
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the CUA Login Module in EMC Centera Universal Access (CUA) 4.0_4735.p4 allows remote attackers to execute arbitrary SQL commands via the user (user name) field.

  • CVE-2008-3371Jul 30, 2008
    Talkback
    Talkback
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in install/help.php in TalkBack 2.3.5, and other versions before 2.3.6.2, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language parameter.

  • CVE-2008-3372Jul 30, 2008
    Greatclone
    Getacoder Clone
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in search_form.php in Getacoder Clone allows remote attackers to execute arbitrary SQL commands via the sb_protype parameter.

  • CVE-2008-3373Jul 30, 2008
    AVG Technologies
    AVG Anti-Virus
    risk 0.00cvss —epss 0.03

    The files parsing engine in Grisoft AVG Anti-Virus before 8.0.156 allows remote attackers to cause a denial of service (engine crash) via a crafted UPX compressed file, which triggers a divide-by-zero error.