VYPR

CVEs

383,896 total · page 7055 of 7,678

AllCriticalHighKEV
  • CVE-2008-2873Jun 26, 2008
    SHibby SHop
    sHibby sHop
    risk 0.03cvss —epss 0.03

    sHibby sHop 2.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request to Db/urun.mdb.

  • CVE-2008-2874Jun 26, 2008
    Softbizscripts
    Jokes & Funny Pics Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Softbiz Jokes & Funny Pics Script allows remote attackers to execute arbitrary SQL commands via the sbjoke_id parameter, a different vector than CVE-2008-1050.

  • CVE-2008-2875Jun 26, 2008
    Webdevindo CMS
    Webdevindo CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Webdevindo-CMS 1.0.0 allows remote attackers to execute arbitrary SQL commands via the hal parameter.

  • CVE-2008-2876Jun 26, 2008
    Munky
    Munky
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in mUnky 0.0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the zone parameter.

  • CVE-2008-2877Jun 26, 2008
    Cmsworks
    Cmsworks
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in admin/include/lib.module.php in cmsWorks 2.2 RC4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mod_root parameter.

  • CVE-2008-2878Jun 26, 2008
    Academic Web Tools
    Academic Web Tools
    risk 0.03cvss —epss 0.03

    Open redirect vulnerability in rss_getfile.php in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the file parameter.

  • CVE-2008-2879Jun 26, 2008
    Benjacms
    Benja CMS
    risk 0.00cvss —epss 0.02

    Benja CMS 0.1 does not require authentication for access to admin/, which allows remote attackers to add or delete a menu.

  • CVE-2008-2880Jun 26, 2008
    IBM
    Afp Viewer Plug In
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in the IBM AFP Viewer Plug-in 2.0.7.1 and 3.2.1.1 allows remote attackers to execute arbitrary code via a long SRC property value. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-2881Jun 26, 2008
    Vclcomponents
    Relative Real Estate Systems
    risk 0.03cvss —epss 0.02

    Relative Real Estate Systems 3.0 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information.

  • CVE-2008-2882Jun 26, 2008
    SHibby SHop
    sHibby sHop
    risk 0.03cvss —epss 0.03

    upgrade.asp in sHibby sHop 2.2 and earlier does not require administrative authentication, which allows remote attackers to update a file or have unspecified other impact via a direct request.

  • CVE-2008-2883Jun 26, 2008
    Jamroom
    Jamroom
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in include/plugins/jrBrowser/payment.php in Jamroom 3.3.0 through 3.3.5 allows remote attackers to execute arbitrary PHP code via a URL in the jamroom[jm_dir] parameter. NOTE: some of these details are obtained from third party…

  • CVE-2008-1951Jun 25, 2008
    Red Hat
    Enterprise Linux Server
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in a certain Red Hat build script for Standards Based Linux Instrumentation for Manageability (sblim) libraries before 1-13a.el4_6.1 in Red Hat Enterprise Linux (RHEL) 4, and before 1-31.el5_2.1 in RHEL 5, allows local users to gain privileges…

  • CVE-2008-2641Jun 25, 2008
    Adobe Inc.
    Acrobat
    risk 0.02cvss —epss 0.24

    Unspecified vulnerability in Adobe Reader and Acrobat 7.0.9 and earlier, and 8.0 through 8.1.2, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors, related to an "input validation issue in a JavaScript…

  • CVE-2008-2842Jun 25, 2008
    Doitlive
    CMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in edit/showmedia.asp in doITLive CMS 2.50 and earlier allows remote attackers to inject arbitrary web script or HTML via the FILE parameter.

  • CVE-2008-2843Jun 25, 2008
    Doitlive
    CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in doITLive CMS 2.50 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter in an USUB action to default.asp and the (2) Licence[SpecialLicenseNumber] (aka LicenceId) cookie to edit/default.asp.

  • CVE-2008-2844Jun 25, 2008
    Carscripts
    Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Carscripts Classifieds allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2008-2845Jun 25, 2008
    Mybizz Classifieds
    Mybizz Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in MyBizz-Classifieds allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2008-2846Jun 25, 2008
    Boatscripts
    Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in BoatScripts Classifieds allows remote attackers to execute arbitrary SQL commands via the type parameter.

  • CVE-2008-2847Jun 25, 2008
    Maxtrade
    AIO
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Trade module in Maxtrade AIO 1.3.23 allows remote attackers to execute arbitrary SQL commands via the categori parameter in a pocategorisell action to modules.php.

  • CVE-2008-2848Jun 25, 2008
    Mindtouch
    Dekiwiki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the search functionality in MindTouch DekiWiki before 8.05.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2849Jun 25, 2008
    Drupal
    TrailScout
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the TrailScout module 5.x before 5.x-1.4 for Drupal allows remote authenticated users, with create post permissions, to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2850Jun 25, 2008
    Drupal
    TrailScout
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the TrailScout module 5.x before 5.x-1.4 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified cookies, related to improper use of the Drupal database API.

  • CVE-2008-2851Jun 25, 2008
    OFF System
    Offsystem
    risk 0.00cvss —epss 0.02

    Multiple buffer overflows in OFF System before 0.19.14 allow remote attackers to have an unknown impact via unspecified vectors related to "parsing of http headers."

  • CVE-2008-2852Jun 25, 2008
    Nathan Neulinger
    Cgiwrap
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in CGIWrap before 4.1, when an Internet Explorer based browser is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to failure to set the charset in error messages.

  • CVE-2008-2853Jun 25, 2008
    Easy Webstore
    Easy Webstore
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Easy Webstore 1.2 allows remote attackers to execute arbitrary SQL commands via the cat_path parameter.

  • CVE-2008-2854Jun 25, 2008
    Orlando CMS
    Orlando CMS
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Orlando CMS 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[preloc] parameter to (1) modules/core/logger/init.php and (2) AJAX/newscat.php.

  • CVE-2008-2855Jun 25, 2008
    Ownrs
    Ownrs
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in clanek.php in OwnRS Beta 3 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2008-2856Jun 25, 2008
    Ownrs
    Ownrs
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in clanek.php in OwnRS Beta 3 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-2857Jun 25, 2008
    Alstrasoft
    Askme Pro
    risk 0.03cvss —epss 0.02

    AlstraSoft AskMe Pro 2.1 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information.

  • CVE-2008-2858Jun 25, 2008
    Webchamado
    Webchamado
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in WebChamado 1.1 allows remote attackers to execute arbitrary SQL commands via the eml parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-2859Jun 25, 2008
    Netwin
    Surgemail
    risk 0.03cvss —epss 0.03

    Unspecified vulnerability in the IMAP service in NetWin SurgeMail before 3.9g2 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors related to an "imap command."

  • CVE-2008-2860Jun 25, 2008
    AJ Square
    AJ Auction Pro web 2.0
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in category.php in AJSquare AJ Auction Pro web 2.0 allows remote attackers to execute arbitrary SQL commands via the cate_id parameter.

  • CVE-2008-2861Jun 25, 2008
    Elinestudio
    Site Composer
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) topic and (2) button parameters to ansFAQ.asp and the (3) id and (4) txtEmail parameters to login.asp.

  • CVE-2008-2862Jun 25, 2008
    Elinestudio
    Site Composer
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to ansFAQ.asp and the (2) template_id parameter to preview.asp.

  • CVE-2008-2863Jun 25, 2008
    Elinestudio
    Site Composer
    risk 0.03cvss —epss 0.03

    Multiple absolute path traversal vulnerabilities in eLineStudio Site Composer (ESC) 2.6 allow remote attackers to create or delete arbitrary directories via a full pathname in the inpCurrFolder parameter to (1) folderdel_.asp or (2) foldernew.asp in cms/assetmanager/.

  • CVE-2008-2864Jun 25, 2008
    Elinestudio
    Site Composer
    risk 0.03cvss —epss 0.03

    eLineStudio Site Composer (ESC) 2.6 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) trigger.asp or (2) common2.asp in cms/include/, which reveals the database path.

  • CVE-2008-2865Jun 25, 2008
    Kalptaru Infotech
    PHP Site Lock
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Kalptaru Infotech PHP Site Lock 2.0 allows remote attackers to execute arbitrary SQL commands via the articleid parameter in a show_article action.

  • CVE-2008-2866Jun 25, 2008
    Caupo
    Cauposhop Classic
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in csc_article_details.php in Caupo.net CaupoShop Classic 1.3 allows remote attackers to execute arbitrary SQL commands via the saArticle[ID] parameter.

  • CVE-2008-2427Jun 24, 2008
    Xnview
    Xnview
    risk 0.04cvss —epss 0.16

    Stack-based buffer overflow in NConvert 4.92, GFL SDK 2.82, and XnView 1.93.6 on Windows and 1.70 on Linux and FreeBSD allows user-assisted remote attackers to execute arbitrary code via a crafted format keyword in a Sun TAAC file.

  • CVE-2008-2662Jun 24, 2008
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.04

    Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allow context-dependent attackers to execute arbitrary code or cause a denial of service via…

  • CVE-2008-2663Jun 24, 2008
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.04

    Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors, a…

  • CVE-2008-2664Jun 24, 2008
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.04

    The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca, a different issue…

  • CVE-2008-2725Jun 24, 2008
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.04

    Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22; and (2) the rb_ary_replace function in 1.6.x allows context-dependent attackers to trigger memory corruption via…

  • CVE-2008-2726Jun 24, 2008
    Ruby Lang
    Ruby
    risk 0.00cvss —epss 0.04

    Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2; and (2) the rb_ary_replace function in 1.6.x allows context-dependent attackers to trigger memory…

  • CVE-2008-2832Jun 24, 2008
    Fullrevolution
    Aspwebcalendar
    risk 0.04cvss —epss 0.12

    Unrestricted file upload vulnerability in calendar_admin.asp in Full Revolution aspWebCalendar 2008 allows remote attackers to upload and execute arbitrary code via the FILE1 parameter in an uploadfileprocess action, probably followed by a direct request to the file in…

  • CVE-2008-2833Jun 24, 2008
    dazhouda
    lecms
    risk 0.03cvss —epss 0.04

    admin/upload.php in le.cms 1.4 and earlier allows remote attackers to bypass administrative authentication, and upload and execute arbitrary files in images/, via a nonzero value for the submit0 parameter in conjunction with filenames in the filename and upload parameters.

  • CVE-2008-2834Jun 24, 2008
    Sidb
    Scientific Image Database
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in projects.php in Scientific Image DataBase 0.41 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-2835Jun 24, 2008
    Igsuite
    Igsuite
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in cgi-bin/igsuite in IGSuite 3.2.4 allows remote attackers to execute arbitrary SQL commands via the formid parameter.

  • CVE-2008-2836Jun 24, 2008
    Webcalendar
    Webcalendar
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in send_reminders.php in WebCalendar 1.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter and a 0 value for the noSet parameter, a different vector than CVE-2007-1483.

  • CVE-2008-2837Jun 24, 2008
    CMS BRD
    CMS-BRD
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in CMS-BRD allows remote attackers to execute arbitrary SQL commands via the menuclick parameter.