VYPR

CVEs

383,908 total · page 7050 of 7,679

AllCriticalHighKEV
  • CVE-2008-3149Jul 11, 2008
    F5, Inc.
    FirePass 4100
    risk 0.00cvss —epss 0.02

    The SNMP daemon in the F5 FirePass 1200 6.0.2 hotfix 3 allows remote attackers to cause a denial of service (daemon crash) by walking the hrSWInstalled OID branch in HOST-RESOURCES-MIB.

  • CVE-2008-3150Jul 11, 2008
    Neutrino CMS
    Atomic Edition
    risk 0.04cvss —epss 0.06

    Directory traversal vulnerability in index.php in Neutrino Atomic Edition 0.8.4 allows remote attackers to read and modify files, as demonstrated by manipulating data/sess.php in (1) usb and (2) del_pag actions. NOTE: this can be leveraged for code execution by performing an…

  • CVE-2008-3127Jul 10, 2008
    Hiox India
    Banner Rotator
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in hioxBannerRotate.php in HIOX Banner Rotator (HBR) 1.3, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the hm parameter.

  • CVE-2008-3128Jul 10, 2008
    Pivot
    Pivot
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in search.php in Pivot 1.40.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the t parameter.

  • CVE-2008-3129Jul 10, 2008
    Joost Horward
    Catviz
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Catviz 0.4 beta 1 allow remote attackers to execute arbitrary SQL commands via the (1) foreign_key_value parameter in the news page and (2) webpage parameter in the webpage_multi_edit form.

  • CVE-2008-3130Jul 10, 2008
    Opencart
    Opencart
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in OpenCart 0.7.7 allow remote attackers to inject arbitrary web script or HTML via the (1) firstname and (2) search parameters. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2008-3131Jul 10, 2008
    PSys
    pSys
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in chatbox.php in pSys 0.7.0 Alpha, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the showid parameter.

  • CVE-2008-3132Jul 10, 2008
    Joomla
    Com Beamospetition
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the beamospetition (com_beamospetition) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the pet parameter to index.php.

  • CVE-2008-3133Jul 10, 2008
    Barenuked
    Barenuked CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/index.php in BareNuked CMS 1.1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the password parameter.

  • CVE-2008-3134Jul 10, 2008
    Graphicsmagick
    Graphicsmagick
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in GraphicsMagick before 1.2.4 allow remote attackers to cause a denial of service (crash, infinite loop, or memory consumption) via (a) unspecified vectors in the (1) AVI, (2) AVS, (3) DCM, (4) EPT, (5) FITS, (6) MTV, (7) PALM, (8) RLA, and…

  • CVE-2008-3135Jul 10, 2008
    Soldner
    Secret Wars
    risk 0.00cvss —epss 0.02

    Soldner Secret Wars 33724 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a packet with a large numeric value in a 0x80 data block.

  • CVE-2008-3136Jul 10, 2008
    Ashopsoftware
    Deluxe
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in catalogue.php in AShop Deluxe 4.x allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2008-3137Jul 10, 2008
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The GSM SMS dissector in Wireshark (formerly Ethereal) 0.99.2 through 1.0.0 allows remote attackers to cause a denial of service (application crash) via unknown vectors.

  • CVE-2008-3138Jul 10, 2008
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.02

    The (1) PANA and (2) KISMET dissectors in Wireshark (formerly Ethereal) 0.99.3 through 1.0.0 allow remote attackers to cause a denial of service (application stop) via unknown vectors.

  • CVE-2008-3139Jul 10, 2008
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The RTMPT dissector in Wireshark (formerly Ethereal) 0.99.8 through 1.0.0 allows remote attackers to cause a denial of service (crash) via unknown vectors. NOTE: this might be due to a use-after-free error.

  • CVE-2008-3140Jul 10, 2008
    Wireshark
    Wireshark
    risk 0.03cvss —epss 0.05

    The syslog dissector in Wireshark (formerly Ethereal) 1.0.0 allows remote attackers to cause a denial of service (application crash) via unknown vectors, possibly related to an "incomplete SS7 MSU syslog encapsulated packet."

  • CVE-2008-3141Jul 10, 2008
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the RMI dissector in Wireshark (formerly Ethereal) 0.9.5 through 1.0.0 allows remote attackers to read system memory via unspecified vectors.

  • CVE-2008-3119Jul 10, 2008
    Dreamlevels
    Dream Pics Builder
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in DreamPics Builder allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2008-3121Jul 10, 2008
    Xerox
    Centreware Web
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Xerox CentreWare Web (CWW) before 4.6.46 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-3122Jul 10, 2008
    Xerox
    Centreware Web
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Xerox CentreWare Web (CWW) before 4.6.46 allow remote authenticated users to execute arbitrary SQL commands via the unspecified vectors.

  • CVE-2008-3123Jul 10, 2008
    Mole Group
    Real Estate Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Mole Group Real Estate Script 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the listing_id parameter in a listings action.

  • CVE-2008-3124Jul 10, 2008
    Mole Group
    Hotel Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Mole Group Hotel Script 1.0 allows remote attackers to execute arbitrary SQL commands via the file parameter.

  • CVE-2008-3125Jul 10, 2008
    Mole Group
    Lastminute Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Mole Group Lastminute Script 4.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2008-3126Jul 10, 2008
    Fujitsu
    Serverview
    risk 0.00cvss —epss 0.02

    Multiple stack-based buffer overflows in the ServerView web interface (SnmpGetMibValues.exe) in Fujitsu Siemens Computers ServerView 04.60.07 and earlier allow remote authenticated users to execute arbitrary code via a crafted URL.

  • CVE-2008-1678Jul 10, 2008
    OpenSSL Project
    OpenSSL
    risk 0.00cvss —epss 0.05

    Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP…

  • CVE-2008-3116Jul 10, 2008
    Hanghai
    5th Street
    risk 0.03cvss —epss 0.06

    Format string vulnerability in dx8render.dll in Snail Game (aka Suzhou Snail Electronic Company) 5th street (aka Hot Step or High Street 5) allows remote attackers to execute arbitrary code via format string specifiers in a chat message.

  • CVE-2008-3117Jul 10, 2008
    Phpmotion
    Phpmotion
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in update_profile.php in PHPmotion 2.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a .php file with a content type of (1) image/gif, (2) image/jpeg, or (3) image/pjpeg, then accessing it via a direct…

  • CVE-2008-3118Jul 10, 2008
    Phpmotion
    Phpmotion
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in play.php in PHPmotion 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the vid parameter.

  • CVE-2008-3103Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the Java Management Extensions (JMX) management agent in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier, when local monitoring is enabled, allows remote attackers to "perform…

  • CVE-2008-3104Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allow remote attackers to violate the security model for an…

  • CVE-2008-3105Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the JAX-WS client and service in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to access URLs or cause a denial of service via unknown vectors involving "processing of XML data" by a trusted…

  • CVE-2008-3106Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier allows remote attackers to access URLs via unknown vectors involving processing of XML data by an untrusted (1) application or (2)…

  • CVE-2008-3107Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the Virtual Machine in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to gain privileges via an untrusted (1) application…

  • CVE-2008-3108Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.05

    Buffer overflow in Sun Java Runtime Environment (JRE) in JDK and JRE 5.0 before Update 10, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allows context-dependent attackers to gain privileges via unspecified vectors related to font processing.

  • CVE-2008-3109Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet…

  • CVE-2008-3110Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to obtain sensitive information by using an applet to read information from another applet.

  • CVE-2008-3111Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that…

  • CVE-2008-3112Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.02cvss —epss 0.26

    Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR…

  • CVE-2008-3113Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.01cvss —epss 0.06

    Unspecified vulnerability in Sun Java Web Start in JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create or delete arbitrary files via an untrusted application, aka CR 6704077.

  • CVE-2008-3114Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR…

  • CVE-2008-3115Jul 9, 2008
    Sun Corporation
    Jdk
    risk 0.01cvss —epss 0.07

    Secure Static Versioning in Sun Java JDK and JRE 6 Update 6 and earlier, and 5.0 Update 6 through 15, does not properly prevent execution of applets on older JRE releases, which might allow remote attackers to exploit vulnerabilities in these older releases.

  • CVE-2008-2244Jul 9, 2008
    Microsoft
    Office Word
    risk 0.03cvss —epss 0.32

    Microsoft Office Word 2002 SP3 allows remote attackers to execute arbitrary code via a .doc file that contains malformed data, as exploited in the wild in July 2008, and as demonstrated by attachement.doc.

  • CVE-2008-3087Jul 9, 2008
    Kasseler CMS
    Kasseler CMS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in Kasseler CMS 1.3.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to index.php, possibly related to the phpManual module.

  • CVE-2008-3088Jul 9, 2008
    Kasseler CMS
    Kasseler CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Files module in Kasseler CMS 1.3.0 and 1.3.1 Lite allows remote attackers to inject arbitrary web script or HTML via the cid parameter in a Category action to index.php.

  • CVE-2008-3089Jul 9, 2008
    Xpoze
    Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in user.html in Xpoze Pro 3.06 (aka Xpoze Pro CMS 2008) allows remote attackers to execute arbitrary SQL commands via the uid parameter.

  • CVE-2008-3090Jul 9, 2008
    Blognplus
    Blognplus
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in BlognPlus (BURO GUN +) 2.5.5 MySQL and PostgreSQL editions allow remote attackers to execute arbitrary SQL commands via the (1) p, (2) e, (3) d, and (4) m parameters, a different vulnerability than CVE-2008-2819.

  • CVE-2008-3091Jul 9, 2008
    Drupal
    Taxonomy Autotagger
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Taxonomy Autotagger module 5.x before 5.x-1.8 for Drupal allows remote authenticated users, with create or edit post permissions, to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-3092Jul 9, 2008
    Drupal
    Taxonomy Autotagger
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Taxonomy Autotagger module 5.x before 5.x-1.8 for Drupal allows remote authenticated users, with create or edit post permissions, to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-3093Jul 9, 2008
    ImperialBB
    ImperialBB
    risk 0.03cvss —epss 0.02

    Unrestricted file upload vulnerability in ImperialBB 2.3.5 and earlier allows remote authenticated users to upload and execute arbitrary PHP code by placing a .php filename in the Upload_Avatar parameter and sending the image/gif content type.

  • CVE-2008-3094Jul 9, 2008
    Drupal
    Organic Groups
    risk 0.00cvss —epss 0.02

    The Organic Groups (OG) module 5.x before 5.x-7.3 and 6.x before 6.x-1.0-RC1, a module for Drupal, allows remote attackers to obtain sensitive information (private group names) via unspecified vectors.