VYPR

CVEs

383,893 total · page 7060 of 7,678

AllCriticalHighKEV
  • CVE-2008-2545Jun 6, 2008
    Skype Technologies
    Skype
    risk 0.00cvss —epss 0.04

    Skype 3.6.0.248, and other versions before 3.8.0.139, uses a case-sensitive comparison when checking for dangerous extensions, which allows user-assisted remote attackers to bypass warning dialogs and possibly execute arbitrary code via a file: URI with a dangerous extension…

  • CVE-2008-2574Jun 6, 2008
    Flashblog
    Flashblog
    risk 0.03cvss —epss 0.05

    Unrestricted file upload vulnerability in admin/Editor/imgupload.php in FlashBlog 0.31 beta allows remote attackers to execute arbitrary code by uploading a .php file, then accessing it via a direct request to the file in tus_imagenes/.

  • CVE-2008-2575Jun 6, 2008
    Jcoppens
    Cbrpager
    risk 0.00cvss —epss 0.03

    cbrPager before 0.9.17 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a (1) ZIP (aka .cbz) or (2) RAR (aka .cbr) archive filename.

  • CVE-2008-2560Jun 6, 2008
    Fourtwosevenbb
    427bb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in showpost.php in 427BB 2.3.1 allows remote attackers to execute arbitrary SQL commands via the post parameter.

  • CVE-2008-2561Jun 6, 2008
    Fourtwosevenbb
    427bb
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in 427BB 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to (a) register.php, (b) reminder.php, and (c) search.php; the (2) uname, (3) email, and (4) email2 parameters to register.php;…

  • CVE-2008-2562Jun 6, 2008
    Powerphlogger
    Powerphlogger
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in edCss.php in PowerPhlogger 2.2.5 and earlier allows remote authenticated users to execute arbitrary SQL commands via the css_str parameter in an edit action.

  • CVE-2008-2563Jun 6, 2008
    Samtodo
    Samtodo
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in (1) dsp_main.php and (2) dsp_task_editor.php in SamTodo 1.1 allow remote attackers to inject arbitrary web script or HTML via the (a) tid parameter in a main.taskeditor edit action, and the (b) completed parameter in a…

  • CVE-2008-2564Jun 6, 2008
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the JotLoader (com_jotloader) component 1.2.1.a and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter to index.php.

  • CVE-2008-2565Jun 6, 2008
    PHP Address
    PHP Address
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) view.php and (2) edit.php. NOTE: it was later reported that 4.0.x is also affected.

  • CVE-2008-2566Jun 6, 2008
    PHP Address
    PHP Address
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the group parameter to (1) index.php or (2) the default URI.

  • CVE-2008-2567Jun 6, 2008
    Fenriru
    Sleipnir
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Fenriru Sleipnir 2.7.1 Release2 and earlier, Portable Sleipnir 2.7.1 Release2 and earlier, and Grani 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a history mechanism…

  • CVE-2008-2568Jun 6, 2008
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Simple Shop Galore (com_simpleshop) component 3.4 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a browse action to index.php.

  • CVE-2008-2569Jun 6, 2008
    Joomla
    EasyBook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the EasyBook (com_easybook) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gbid parameter in a deleteentry action to index.php.

  • CVE-2008-2570Jun 6, 2008
    Limesurvey
    Limesurvey
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in LimeSurvey (formerly PHPSurveyor) before 1.71 have unknown impact and attack vectors.

  • CVE-2008-2571Jun 6, 2008
    Limesurvey
    Limesurvey
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in LimeSurvey (formerly PHPSurveyor) before 1.71 allows remote attackers to change arbitrary quotas as administrators via a "modify quota" action.

  • CVE-2008-2572Jun 6, 2008
    Flashblog
    Flashblog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in php/leer_comentarios.php in FlashBlog allows remote attackers to execute arbitrary SQL commands via the articulo_id parameter.

  • CVE-2008-2573Jun 6, 2008
    Freesshd
    Freesshd
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in SFTP in freeSSHd 1.2.1 allows remote authenticated users to execute arbitrary code via a long directory name in an SSH_FXP_OPENDIR (aka opendir) command.

  • CVE-2008-2559Jun 5, 2008
    Damian Frizza
    Borland Interbase
    risk 0.00cvss —epss 0.04

    Integer overflow in Borland Interbase 2007 SP2 (8.1.0.256) allows remote attackers to execute arbitrary code via a malformed packet to TCP port 3050, which triggers a stack-based buffer overflow. NOTE: this issue might be related to CVE-2008-0467.

  • CVE-2008-2554Jun 5, 2008
    Bp Blog
    Bp Blog
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in BP Blog 6.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to template_permalink.asp and (2) cat parameter to template_archives_cat.asp.

  • CVE-2008-2555Jun 5, 2008
    EasyWay CMS
    CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in EasyWay CMS allows remote attackers to execute arbitrary SQL commands via the mid parameter.

  • CVE-2008-2556Jun 5, 2008
    Hessel Brouwer
    PHP Visit Counter
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in read.php in PHP Visit Counter 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the datespan parameter in a read action.

  • CVE-2008-2557Jun 5, 2008
    Cre Loaded
    Cre Loaded
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in CRE Loaded 6.2.13.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) Links and (2) Links Submit pages.

  • CVE-2008-2558Jun 5, 2008
    Cre Loaded
    Cre Loaded
    risk 0.00cvss —epss 0.01

    CRE Loaded 6.2.13.1 and earlier does not set the "Secure" attribute for cookies that are sent over HTTPS, which might allow remote attackers to sniff the cookies if they are sent over HTTP.

  • CVE-2007-5671Jun 5, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware Player before 1.0.6 build 80404, VMware ACE before 1.0.5 build 79846, VMware Server before 1.0.5 build 80187, and VMware ESX 2.5.4 through 3.0.2 does not properly validate arguments…

  • CVE-2008-0967Jun 5, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in vmware-authd in VMware Workstation 5.x before 5.5.7 build 91707 and 6.x before 6.0.4 build 93057, VMware Player 1.x before 1.0.7 build 91707 and 2.x before 2.0.4 build 93057, and VMware Server before 1.0.6 build 91891 on Linux, and VMware…

  • CVE-2008-1518Jun 5, 2008
    Kaspersky Lab
    Internet Security
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in kl1.sys in Kaspersky Anti-Virus 6.0 and 7.0 and Internet Security 6.0 and 7.0 allows local users to gain privileges via an IOCTL 0x800520e8 call.

  • CVE-2008-2097Jun 5, 2008
    VMware
    Esx
    risk 0.00cvss —epss 0.04

    Buffer overflow in the openwsman management service in VMware ESXi 3.5 and ESX 3.5 allows remote authenticated users to gain privileges via an "invalid Content-Length."

  • CVE-2008-2100Jun 5, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.01

    Multiple buffer overflows in VIX API 1.1.x before 1.1.4 build 93057 on VMware Workstation 5.x and 6.x, VMware Player 1.x and 2.x, VMware ACE 2.x, VMware Server 1.x, VMware Fusion 1.x, VMware ESXi 3.5, and VMware ESX 3.0.1 through 3.5 allow guest OS users to execute arbitrary…

  • CVE-2008-2231Jun 5, 2008
    Slashdot
    Slash
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Slashdot Like Automated Storytelling Homepage (Slash) (aka Slashcode) R_2_5_0_94 and earlier allows remote attackers to execute SQL commands and read table information via the id parameter.

  • CVE-2008-2542Jun 5, 2008
    Nasa Ames Research Center
    Bigview
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in the getline function in Ppm/ppm.C in NASA Ames Research Center BigView 1.8 allows user-assisted remote attackers to execute arbitrary code via a crafted PNM file.

  • CVE-2008-2543Jun 5, 2008
    Asterisk
    Asterisk Addons
    risk 0.00cvss —epss 0.04

    The ooh323 channel driver in Asterisk Addons 1.2.x before 1.2.9 and Asterisk-Addons 1.4.x before 1.4.7 creates a remotely accessible TCP port that is intended solely for localhost communication, and interprets some TCP application-data fields as addresses of memory to free,…

  • CVE-2008-2552Jun 5, 2008
    Sun Corporation
    Service Tag
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Service Tag Registry on Sun Solaris 10, and Sun Service Tag before 1.1.3, allows local users to cause a denial of service (disk consumption) via unspecified vectors.

  • CVE-2008-2553Jun 5, 2008
    Slashcode.com
    Slash
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Slashdot Like Automated Storytelling Homepage (Slash) (aka Slashcode) R_2_5_0_94 and earlier allows remote attackers to inject arbitrary web script or HTML via the userfield parameter.

  • CVE-2008-2551Jun 4, 2008
    Icona
    Instant Messenger
    risk 0.07cvss —epss 0.47

    The DownloaderActiveX Control (DownloaderActiveX.ocx) in Icona SpA C6 Messenger 1.0.0.1 allows remote attackers to force the download and execution of arbitrary files via a URL in the propDownloadUrl parameter with the propPostDownloadAction parameter set to "run."

  • CVE-2008-1770Jun 4, 2008
    Akamai
    Download Manager
    risk 0.04cvss —epss 0.10

    CRLF injection vulnerability in Akamai Download Manager ActiveX control before 2.2.3.6 allows remote attackers to force the download and execution of arbitrary files via a URL parameter containing an encoded LF followed by a malicious target line.

  • CVE-2008-2055Jun 4, 2008
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    Cisco Adaptive Security Appliance (ASA) and Cisco PIX security appliance 7.1.x before 7.1(2)70, 7.2.x before 7.2(4), and 8.0.x before 8.0(3)10 allows remote attackers to cause a denial of service via a crafted TCP ACK packet to the device interface.

  • CVE-2008-2056Jun 4, 2008
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    Cisco Adaptive Security Appliance (ASA) and Cisco PIX security appliance 8.0.x before 8.0(3)9 and 8.1.x before 8.1(1)1 allows remote attackers to cause a denial of service (device reload) via a crafted Transport Layer Security (TLS) packet to the device interface.

  • CVE-2008-2057Jun 4, 2008
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.03

    The Instant Messenger (IM) inspection engine in Cisco Adaptive Security Appliance (ASA) and Cisco PIX security appliance 7.2.x before 7.2(4), 8.0.x before 8.0(3)10, and 8.1.x before 8.1(1)2 allows remote attackers to cause a denial of service via a crafted packet.

  • CVE-2008-2058Jun 4, 2008
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.03

    Cisco Adaptive Security Appliance (ASA) and Cisco PIX security appliance 7.2.x before 7.2(3)2 and 8.0.x before 8.0(2)17 allows remote attackers to cause a denial of service (device reload) via a port scan against TCP port 443 on the device.

  • CVE-2008-2059Jun 4, 2008
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.03

    Cisco Adaptive Security Appliance (ASA) and Cisco PIX security appliance 8.0.x before 8.0(3)9 allows remote attackers to bypass control-plane ACLs for the device via unknown vectors.

  • CVE-2007-5604Jun 4, 2008
    Microfocus
    Instant Support
    risk 0.04cvss —epss 0.12

    Buffer overflow in the ExtractCab function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows remote attackers to execute arbitrary code via a long first argument, a different vulnerability than CVE-2007-5605,…

  • CVE-2007-5605Jun 4, 2008
    Microfocus
    Instant Support
    risk 0.01cvss —epss 0.09

    Buffer overflow in the GetFileTime function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows remote attackers to execute arbitrary code via a long argument, a different vulnerability than CVE-2007-5604,…

  • CVE-2007-5606Jun 4, 2008
    Microfocus
    Instant Support
    risk 0.01cvss —epss 0.13

    Buffer overflow in the MoveFile function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows remote attackers to execute arbitrary code via a long argument, a different vulnerability than CVE-2007-5604,…

  • CVE-2007-5607Jun 4, 2008
    Microfocus
    Instant Support
    risk 0.04cvss —epss 0.13

    Buffer overflow in the RegistryString function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows remote attackers to execute arbitrary code via a long first argument, a different vulnerability than…

  • CVE-2007-5608Jun 4, 2008
    Microfocus
    Instant Support
    risk 0.00cvss —epss 0.04

    The DownloadFile function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows remote attackers to force a download of an arbitrary file onto a client machine via a URL in the first argument and a destination…

  • CVE-2007-5610Jun 4, 2008
    Microfocus
    Instant Support
    risk 0.04cvss —epss 0.09

    The DeleteSingleFile function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows remote attackers to delete an arbitrary file via a full pathname in the argument.

  • CVE-2008-0952Jun 4, 2008
    Microfocus
    Instant Support
    risk 0.03cvss —epss 0.06

    The AppendStringToFile function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows remote attackers to create files with arbitrary content via a full pathname in the first argument and the content in the second…

  • CVE-2008-0953Jun 4, 2008
    Microfocus
    Instant Support
    risk 0.04cvss —epss 0.09

    The StartApp function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows remote attackers to execute arbitrary programs via a .exe filename in the argument, a different vulnerability than CVE-2007-5608 and…

  • CVE-2008-1108Jun 4, 2008
    Evolution
    Evolution
    risk 0.00cvss —epss 0.06

    Buffer overflow in Evolution 2.22.1, when the ITip Formatter plugin is disabled, allows remote attackers to execute arbitrary code via a long timezone string in an iCalendar attachment.

  • CVE-2008-1109Jun 4, 2008
    Evolution
    Evolution
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar attachment, which is not properly handled during a reply in the calendar view (aka the Calendars window).