VYPR

CVEs

383,895 total · page 7057 of 7,678

AllCriticalHighKEV
  • CVE-2008-2754Jun 18, 2008
    Efiction
    Efiction
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in toplists.php in eFiction 3.0 and 3.4.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the list parameter.

  • CVE-2008-2755Jun 18, 2008
    JAMM CMS
    JAMM CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in JAMM CMS allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-2756Jun 18, 2008
    Xigla
    Absolute Control Panel Xe
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin/users.asp in Xigla Absolute Control Panel XE 1.0 allows remote attackers to inject arbitrary web script or HTML via the name parameter and other unspecified parameters. NOTE: some of these details are obtained from third party…

  • CVE-2008-2757Jun 18, 2008
    Xigla
    Absolute News Manager Xe
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in search.asp in Xigla Absolute News Manager XE 3.2 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter.

  • CVE-2008-2758Jun 18, 2008
    Xigla
    Absolute News Manager Xe
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Xigla Absolute News Manager XE 3.2 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) pblname and (2) text parameters to (a) admin/search.asp, (3) name parameter to (b)…

  • CVE-2008-2759Jun 18, 2008
    Xigla
    Absolute Form Processor Xe
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Xigla Absolute Form Processor XE 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) showfields, (2) text, and (3) submissions parameters to search.asp and the (4) name parameter to users.asp. NOTE:…

  • CVE-2008-2760Jun 18, 2008
    Xigla
    Absolute Banner Manager
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in searchbanners.asp in Xigla Absolute Banner Manager XE 2.0 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter.

  • CVE-2008-2761Jun 18, 2008
    Xigla
    Absolute Banner Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Xigla Absolute Banner Manager XE 2.0 allow remote authenticated administrators to inject arbitrary web script or HTML via the text parameter in (1) searchbanners.asp and (2) listadvertisers.asp, and other unspecified fields.…

  • CVE-2008-2762Jun 18, 2008
    Xigla
    Absolute Form Processor Xe
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in search.asp in Xigla Absolute Form Processor XE 4.0 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter.

  • CVE-2008-2763Jun 18, 2008
    Xigla
    Absolute Live Support Xe
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in search.asp in Xigla Absolute Live Support XE 5.1 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter.

  • CVE-2008-2764Jun 18, 2008
    Xigla
    Absolute Live Support Xe
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin/search.asp in Xigla Absolute Live Support XE 5.1 allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors ("all fields").

  • CVE-2008-2765Jun 18, 2008
    Xigla
    Absolute Image Gallery Xe
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in gallery.asp in Xigla Absolute Image Gallery XE allows remote attackers to execute arbitrary SQL commands via the categoryid parameter in a viewimage action.

  • CVE-2008-2766Jun 18, 2008
    Xigla
    Absolute Image Gallery Xe
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Xigla Absolute Image Gallery XE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in (1) admin/search.asp and (2) gallery.asp.

  • CVE-2008-2767Jun 18, 2008
    Xigla
    Absolute Poll Manager Xe
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in search.asp in Xigla Poll Manager XE allows remote authenticated users with administrator role privileges to execute arbitrary SQL commands via the orderby parameter.

  • CVE-2008-2768Jun 18, 2008
    Xigla
    Absolute Poll Manager Xe
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin/search.asp in Xigla Poll Manager XE allows remote authenticated users with administrator role privileges to inject arbitrary web script or HTML via unspecified vectors ("all fields").

  • CVE-2008-2769Jun 18, 2008
    Phpraider
    Phpraider
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in authentication/smf/smf.functions.php in Simple Machines phpRaider 1.0.6 and 1.0.7 allows remote attackers to execute arbitrary PHP code via a URL in the pConfig_auth[smf_path] parameter.

  • CVE-2008-2770Jun 18, 2008
    Mycrocms
    Mycrocms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in MycroCMS 0.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the entry_id parameter.

  • CVE-2008-2771Jun 18, 2008
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    The Node Hierarchy module 5.x before 5.x-1.1 and 6.x before 6.x-1.0 for Drupal does not properly implement access checks, which allows remote attackers with "access content" permissions to bypass restrictions and modify the node hierarchy via unspecified attack vectors.

  • CVE-2008-2772Jun 18, 2008
    Drupal
    Magic Tabs module
    risk 0.00cvss —epss 0.01

    The Magic Tabs module 5.x before 5.x-1.1 for Drupal allows remote attackers to execute arbitrary PHP code via unspecified URL arguments, possibly related to a missing "whitelist of callbacks."

  • CVE-2008-2773Jun 18, 2008
    Drupal
    Taxonomy Image module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Taxonomy Image module 5.x before 5.x-1.3 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-0925Jun 18, 2008
    Novell
    Edirectory
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the iMonitor interface in Novell eDirectory 8.7.3.x before 8.7.3 sp10, and 8.8.x before 8.8.2 ftf2, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters that are used within "error messages of the…

  • CVE-2008-2060Jun 18, 2008
    Cisco Systems, Inc.
    Intrusion Prevention System
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Cisco Intrusion Prevention System (IPS) 5.x before 5.1(8)E2 and 6.x before 6.0(5)E2, when inline mode and jumbo Ethernet support are enabled, allows remote attackers to cause a denial of service (panic), and possibly bypass intended restrictions on…

  • CVE-2008-2428Jun 18, 2008
    Torrenttrader
    Torrenttrader
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in TorrentTrader 1.08 Classic allow remote attackers to execute arbitrary SQL commands via the (1) email or (2) wantusername parameter to account-signup.php, or the (3) receiver parameter to account-inbox.php in a msg action.

  • CVE-2008-2640Jun 18, 2008
    Adobe Inc.
    Flex
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in the Flex 3 History Management feature in Adobe Flex 3.0.1 SDK and Flex Builder 3, and generated applications, allow remote attackers to inject arbitrary web script or HTML via the anchor identifier to (1)…

  • CVE-2008-2747Jun 18, 2008
    Vitalwerks
    Dynamic Update Client
    risk 0.00cvss —epss 0.00

    No-IP Dynamic Update Client (DUC) 2.2.1 on Windows uses weak permissions for the HKLM\SOFTWARE\Vitalwerks\DUC registry key, which allows local users to obtain obfuscated passwords and other sensitive information by reading the (1) TrayPassword, (2) Username, (3) Password, and…

  • CVE-2008-2748Jun 18, 2008
    Skulltag Team
    Skulltag
    risk 0.03cvss —epss 0.03

    Skulltag 0.97d2-RC2 and earlier allows remote attackers to cause a denial of service (daemon hang) via a series of long, malformed connect packets, related to these packets being "parsed multiple times."

  • CVE-2008-2749Jun 18, 2008
    Sun Corporation
    Java System Calendar Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in cshttpd in Sun Java System Calendar Server 6 and 6.3, and Sun ONE Calendar Server 6.0, when access logging (aka service.http.commandlog.all) is enabled, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.

  • CVE-2008-2750Jun 18, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    The pppol2tp_recvmsg function in drivers/net/pppol2tp.c in the Linux kernel 2.6 before 2.6.26-rc6 allows remote attackers to cause a denial of service (kernel heap memory corruption and system crash) and possibly have unspecified other impact via a crafted PPPOL2TP packet that…

  • CVE-2008-2751Jun 18, 2008
    Sun Corporation
    Java System Application Server
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.1_01 allow remote attackers to inject arbitrary web script or HTML via the (1) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jn…

  • CVE-2008-2752Jun 18, 2008
    Microsoft
    Word
    risk 0.05cvss —epss 0.28

    Microsoft Word 2000 9.0.2812 and 2003 11.8106.8172 does not properly handle unordered lists, which allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .doc file. NOTE: some…

  • CVE-2008-2742Jun 17, 2008
    Achievo
    Achievo
    risk 0.03cvss —epss 0.05

    Unrestricted file upload in the mcpuk file editor (atk/attributes/fck/editor/filemanager/browser/mcpuk/connectors/php/config.php) in Achievo 1.2.0 through 1.3.2 allows remote attackers to execute arbitrary code by uploading a file with .php followed by a safe extension, then…

  • CVE-2008-2743Jun 17, 2008
    Xerox
    Xerox 4110
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the embedded web server in Xerox 4110, 4590, and 4595 Copier/Printers allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  • CVE-2008-2744Jun 17, 2008
    Jelsoft
    Vbulletin
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in vBulletin 3.6.10 and 3.7.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors and an "obscure method." NOTE: the vector is probably in the redirect parameter to the Admin Control Panel…

  • CVE-2008-2745Jun 17, 2008
    Black Ice
    Annotation Plugin
    risk 0.04cvss —epss 0.11

    Stack-based buffer overflow in BiAnno ActiveX Control (BiAnno.ocx) in Black Ice Software Annotation Plugin 10.95 allows remote attackers to execute arbitrary code via a long parameter to the AnnoSaveToTiff method.

  • CVE-2008-2746Jun 17, 2008
    Gryphonllc
    Gllcts2
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL commands via the detail parameter.

  • CVE-2008-2719Jun 16, 2008
    Nasm
    Netwide Assembler
    risk 0.04cvss —epss 0.10

    Off-by-one error in the ppscan function (preproc.c) in Netwide Assembler (NASM) 2.02 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted file that triggers a stack-based buffer overflow.

  • CVE-2008-2720Jun 16, 2008
    Menalto
    Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Menalto Gallery before 2.2.5 allows remote attackers to inject arbitrary web script or HTML via the (1) host and (2) path components of a URL.

  • CVE-2008-2721Jun 16, 2008
    Menalto
    Gallery
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the album-select module in Menalto Gallery before 2.2.5 allows remote attackers to obtain titles of hidden albums by attempting to add a new album to a hidden album.

  • CVE-2008-2722Jun 16, 2008
    Menalto
    Gallery
    risk 0.00cvss —epss 0.02

    Menalto Gallery before 2.2.5 allows remote attackers to bypass permissions for sub-albums via a ZIP archive.

  • CVE-2008-2723Jun 16, 2008
    Menalto
    Gallery
    risk 0.00cvss —epss 0.02

    embed.php in Menalto Gallery before 2.2.5 allows remote attackers to obtain the full path via unknown vectors related to "spoofing the remote address."

  • CVE-2008-2724Jun 16, 2008
    Menalto
    Gallery
    risk 0.00cvss —epss 0.02

    Menalto Gallery before 2.2.5 does not enforce permissions for non-album items that have been protected by a password, which might allow remote attackers to bypass intended access restrictions.

  • CVE-2008-2714Jun 16, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Opera before 9.26 allows remote attackers to misrepresent web page addresses using "certain characters" that "cause the page address text to be misplaced."

  • CVE-2008-2715Jun 16, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Opera before 9.5 allows remote attackers to read cross-domain images via HTML CANVAS elements that use the images as patterns.

  • CVE-2008-2716Jun 16, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Opera before 9.5 allows remote attackers to spoof the contents of trusted frames on the same parent page by modifying the location, which can facilitate phishing attacks.

  • CVE-2008-2717Jun 16, 2008
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.03

    TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload…

  • CVE-2008-2718Jun 16, 2008
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in fe_adminlib.inc in TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, as used in extensions such as (1) direct_mail_subscription, (2) feuser_admin, and (3) kb_md5fepw, allows remote attackers to inject arbitrary web…

  • CVE-2008-2711Jun 16, 2008
    Fetchmail
    Fetchmail
    risk 0.00cvss —epss 0.03

    fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format…

  • CVE-2008-2712Jun 16, 2008
    Vim
    Vim
    risk 0.04cvss —epss 0.15

    Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzip_vim, and…

  • CVE-2008-2713Jun 16, 2008
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.05

    libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read.

  • CVE-2008-2708Jun 16, 2008
    Sun Corporation
    Opensolaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Sun (1) UltraSPARC T2 and (2) UltraSPARC T2+ kernel modules in Sun Solaris 10, and OpenSolaris before snv_93, allows local users to cause a denial of service (panic) via unspecified vectors, probably related to core files.