VYPR

CVEs

383,908 total · page 7049 of 7,679

AllCriticalHighKEV
  • CVE-2008-2615Jul 15, 2008
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.48.17 and 8.49.11 has unknown impact and remote authenticated attack vectors, a different vulnerability than CVE-2008-2616, CVE-2008-2617,…

  • CVE-2008-2616Jul 15, 2008
    Oracle Corporation
    Peopletools
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.48.17 and 8.49.11 has unknown impact and remote authenticated attack vectors, a different vulnerability than CVE-2008-2615, CVE-2008-2617,…

  • CVE-2008-2617Jul 15, 2008
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.48.17 and 8.49.11 has unknown impact and remote authenticated attack vectors, a different vulnerability than CVE-2008-2615, CVE-2008-2616,…

  • CVE-2008-2618Jul 15, 2008
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.48.17 and 8.49.11 has unknown impact and remote authenticated attack vectors, a different vulnerability than CVE-2008-2615, CVE-2008-2616,…

  • CVE-2008-2620Jul 15, 2008
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.48.17 and 8.49.11 has unknown impact and remote authenticated attack vectors, a different vulnerability than CVE-2008-2615, CVE-2008-2616,…

  • CVE-2008-2621Jul 15, 2008
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.48.17 and 8.49.11 has unknown impact and remote authenticated attack vectors, a different vulnerability than CVE-2008-2615, CVE-2008-2616,…

  • CVE-2008-2622Jul 15, 2008
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.48.17 and 8.49.11 has unknown impact and remote authenticated attack vectors, a different vulnerability than CVE-2008-2615, CVE-2008-2616,…

  • CVE-2008-3185Jul 15, 2008
    Vclcomponents
    Relative Real Estate Systems
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Relative Real Estate Systems 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the listing_id parameter in a listings action.

  • CVE-2008-3186Jul 15, 2008
    Chipmunk Blog
    Chipmunk Blog
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Chipmunk Blog (Blogger) allow remote attackers to inject arbitrary web script or HTML via the membername parameter to (1) members.php, (2) comments.php, (3) photos.php, (4) archive.php, or (5) cat.php. NOTE: the provenance…

  • CVE-2008-3177Jul 15, 2008
    Sophos
    Sophos Anti-Virus Interface (SAVI)
    risk 0.00cvss —epss 0.05

    Sophos virus detection engine 2.75 on Linux and Unix, as used in Sophos Email Appliance, Pure Message for Unix, and Sophos Anti-Virus Interface (SAVI), allows remote attackers to cause a denial of service (engine crash) via zero-length MIME attachments.

  • CVE-2008-3178Jul 15, 2008
    Webxell
    Editor
    risk 0.03cvss —epss 0.05

    Unrestricted file upload vulnerability in upload_pictures.php in WebXell Editor 0.1.3 allows remote attackers to execute arbitrary code by uploading a .php file with a jpeg content type, then accessing it via a direct request to the file in upload/.

  • CVE-2008-3179Jul 15, 2008
    Web 2 Business
    phpDatingClub
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in website.php in Web 2 Business (W2B) phpDatingClub (aka Dating Club) 3.7 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.

  • CVE-2008-3180Jul 15, 2008
    ContentNow
    CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in upload/file/language_menu.php in ContentNow CMS 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) pageid parameter or (2) PATH_INFO.

  • CVE-2008-3181Jul 15, 2008
    ContentNow
    CMS
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in upload.php in ContentNow CMS 1.4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in upload/.

  • CVE-2008-3182Jul 15, 2008
    DAP
    Download Accelerator Plus
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in DAP.exe in Download Accelerator Plus (DAP) 7.0.1.3, 8.6.6.3, and other 8.x versions allows user-assisted remote attackers to execute arbitrary code via an M3U (.m3u) file containing a long MP3 URL.

  • CVE-2008-3183Jul 15, 2008
    Gapi CMS
    Gapicms
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in ktmlpro/includes/ktedit/toolbar.php in gapicms 9.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the dirDepth parameter.

  • CVE-2008-3184Jul 15, 2008
    Jelsoft
    Vbulletin
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.10 PL2 and earlier, and 3.7.2 and earlier 3.7.x versions, allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO (PHP_SELF) or (2) the do parameter, as demonstrated by requests to…

  • CVE-2008-3162Jul 14, 2008
    FFmpeg
    Ffmpeg
    risk 0.04cvss —epss 0.09

    Stack-based buffer overflow in the str_read_packet function in libavformat/psxstr.c in FFmpeg before r13993 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted STR file that interleaves audio and video sectors.

  • CVE-2008-3163Jul 14, 2008
    DodosMail
    DodosMail
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in dodosmail.php in DodosMail 2.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the dodosmail_header_file parameter. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2008-3164Jul 14, 2008
    Fuzzylime
    cms
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in blog.php in fuzzylime (cms) 3.01, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter. NOTE: it was later reported that 3.01a is also affected.

  • CVE-2008-3165Jul 14, 2008
    Fuzzylime
    cms
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in rss.php in fuzzylime (cms) 3.01a and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p parameter, as demonstrated using content.php, a different vector…

  • CVE-2008-3166Jul 14, 2008
    Boonex
    Ray
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in modules/global/inc/content.inc.php in BoonEx Ray 3.5, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the sIncPath parameter.

  • CVE-2008-3167Jul 14, 2008
    Boonex
    Dolphin
    risk 0.04cvss —epss 0.06

    Multiple PHP remote file inclusion vulnerabilities in BoonEx Dolphin 6.1.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) dir[plugins] parameter to (a) HTMLSax3.php and (b) safehtml.php in plugins/safehtml/ and the…

  • CVE-2008-3168Jul 14, 2008
    Empire Server
    Empire Server
    risk 0.00cvss —epss 0.01

    The files utility in Empire Server before 4.3.15 discloses the world creation time, which makes it easier for attackers to determine the PRNG seed.

  • CVE-2008-3169Jul 14, 2008
    Empire Server
    Empire Server
    risk 0.00cvss —epss 0.05

    Multiple heap-based buffer overflows in Empire Server before 4.3.15 allow remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors, related to a "coordinate normalization bug." NOTE: some of these details are obtained from third…

  • CVE-2008-3170Jul 14, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Apple Safari allows web sites to set cookies for country-specific top-level domains, such as co.uk and com.au, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking," a related issue to CVE-2004-0746,…

  • CVE-2008-3171Jul 14, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Apple Safari sends Referer headers containing https URLs to different https web sites, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.

  • CVE-2008-3172Jul 14, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.01

    Opera allows web sites to set cookies for country-specific top-level domains that have DNS A records, such as co.tv, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking."

  • CVE-2008-3173Jul 14, 2008
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.11

    Microsoft Internet Explorer allows web sites to set cookies for domains that have a public suffix with more than one dot character, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking." NOTE: this…

  • CVE-2008-1588Jul 14, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Safari on Apple iPhone before 2.0 and iPod touch before 2.0 allows remote attackers to spoof the address bar via Unicode ideographic spaces in the URL.

  • CVE-2008-1589Jul 14, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Safari on Apple iPhone before 2.0 and iPod touch before 2.0 misinterprets a menu button press as user confirmation for visiting a web site with a (1) self-signed or (2) invalid certificate, which makes it easier for remote attackers to spoof web sites.

  • CVE-2008-1590Jul 14, 2008
    Wpewebkit
    Javascriptcore
    risk 0.00cvss —epss 0.03

    JavaScriptCore in WebKit on Apple iPhone before 2.0 and iPod touch before 2.0 does not properly perform runtime garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors that trigger…

  • CVE-2008-1809Jul 14, 2008
    Novell
    Edirectory
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in Novell eDirectory 8.7.3 before 8.7.3.10b, and 8.8 before 8.8.2 FTF2, allows remote attackers to execute arbitrary code via an LDAP search request containing "NULL search parameters."

  • CVE-2008-2303Jul 14, 2008
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.13

    Integer signedness error in Safari on Apple iPhone before 2.0 and iPod touch before 2.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript array indices that trigger an out-of-bounds access, a…

  • CVE-2008-2304Jul 14, 2008
    Apple Inc.
    Core Image Fun House
    risk 0.03cvss —epss 0.06

    Buffer overflow in Apple Core Image Fun House 2.0 and earlier in CoreImage Examples in Xcode tools before 3.1 allows user-assisted attackers to execute arbitrary code or cause a denial of service (application crash) via a .funhouse file with a string XML element that contains…

  • CVE-2008-2317Jul 14, 2008
    Apple Inc.
    Safari
    risk 0.01cvss —epss 0.08

    WebCore in Apple Safari does not properly perform garbage collection of JavaScript document elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a reference to the ownerNode property of a…

  • CVE-2008-2318Jul 14, 2008
    Apple Inc.
    Xcode
    risk 0.00cvss —epss 0.01

    The WOHyperlink implementation in WebObjects in Apple Xcode tools before 3.1 appends local session IDs to generated non-local URLs, which allows remote attackers to obtain potentially sensitive information by reading the requests for these URLs.

  • CVE-2008-3159Jul 14, 2008
    Novell
    Edirectory
    risk 0.01cvss —epss 0.09

    Integer overflow in ds.dlm, as used by dhost.exe, in Novell eDirectory 8.7.3.10 before 8.7.3 SP10b and 8.8 before 8.8.2 ftf2 allows remote attackers to execute arbitrary code via unspecified vectors that trigger a stack-based buffer overflow, related to "flawed arithmetic."

  • CVE-2008-3160Jul 14, 2008
    IBM
    Data Ontap
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in IBM Data ONTAP 7.1 before 7.1.3, as used by IBM System Storage N series Filer and IBM System Storage N series Gateway, have unknown impact and attack vectors.

  • CVE-2008-3161Jul 14, 2008
    IBM
    Maximo
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in jsp/common/system/debug.jsp in IBM Maximo 4.1 and 5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Accept, (2) Accept-Language, (3) UA-CPU, (4) Accept-Encoding, (5) User-Agent, or (6) Cookie HTTP…

  • CVE-2008-3151Jul 11, 2008
    PHP-Nuke
    4ndvddb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the 4ndvddb 0.91 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id parameter in a show_dvd action.

  • CVE-2008-3152Jul 11, 2008
    SmartPPC
    SmartPPC
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in directory.php in SmartPPC and SmartPPC Pro allows remote attackers to execute arbitrary SQL commands via the idDirectory parameter.

  • CVE-2008-3153Jul 11, 2008
    Tritoncms
    Triton CMS Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Triton CMS Pro allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header.

  • CVE-2008-3154Jul 11, 2008
    Webblizzard
    CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in WebBlizzard CMS allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2008-3155Jul 11, 2008
    Panda Project
    Activescan
    risk 0.04cvss —epss 0.08

    Stack-based buffer overflow in the ActiveX control (as2guiie.dll) in Panda ActiveScan before 1.02.00 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long argument to the Update method.

  • CVE-2008-3156Jul 11, 2008
    Panda Project
    Activescan
    risk 0.03cvss —epss 0.04

    The ActiveScan ActiveX Control (as2guiie.dll) in Panda ActiveScan before 1.02.00 allows remote attackers to download and execute arbitrary cabinet (CAB) files via unspecified URLs passed to the Update method.

  • CVE-2008-3157Jul 11, 2008
    Nortel
    Sip Multimedia Pc Client
    risk 0.00cvss —epss 0.01

    Nortel SIP Multimedia PC Client 4.x MCS5100 and MCS5200 does not limit the number of concurrent sessions, which allows attackers to cause a denial of service (resource consumption) via a large number of sessions.

  • CVE-2008-3158Jul 11, 2008
    Novell
    Client for Windows
    risk 0.03cvss —epss 0.05

    Unspecified vulnerability in NWFS.SYS in Novell Client for Windows 4.91 SP4 has unknown impact and attack vectors, possibly related to IOCTL requests that overwrite arbitrary memory.

  • CVE-2008-3147Jul 11, 2008
    Wefi
    Wefi
    risk 0.00cvss —epss 0.00

    WeFi 3.2.1.4.1, when diagnostic mode is enabled, stores (1) WEP, (2) WPA, and (3) WPA2 access-point keys in (a) ClientWeFiLog.dat, (b) ClientWeFiLog.bak, and possibly (c) a certain .inf file under %PROGRAMFILES%\WeFi\Users\, and uses cleartext for the ClientWeFiLog files, which…

  • CVE-2008-3148Jul 11, 2008
    Ollydbg
    Ollydbg
    risk 0.03cvss —epss 0.03

    Stack-based buffer overflow in (1) OllyDBG 1.10 and (2) ImpREC 1.7f allows user-assisted attackers to execute arbitrary code via a crafted DLL file that contains a long string.