VYPR

CVEs

383,893 total · page 7061 of 7,678

AllCriticalHighKEV
  • CVE-2008-2401Jun 4, 2008
    Sun Corporation
    Java Active Server Pages
    risk 0.00cvss —epss 0.02

    The Admin Server in Sun Java Active Server Pages (ASP) Server before 4.0.3 allows remote attackers to append to arbitrary new or existing files via the first argument to a certain file that is included by multiple unspecified ASP applications.

  • CVE-2008-2402Jun 4, 2008
    Sun Corporation
    Java Asp Server
    risk 0.01cvss —epss 0.11

    The Admin Server in Sun Java Active Server Pages (ASP) Server before 4.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read password hashes and configuration data via direct requests for unspecified documents.

  • CVE-2008-2403Jun 4, 2008
    Sun Corporation
    Java Asp Server
    risk 0.02cvss —epss 0.19

    Multiple directory traversal vulnerabilities in unspecified ASP applications in Sun Java Active Server Pages (ASP) Server before 4.0.3 allow remote attackers to read or delete arbitrary files via a .. (dot dot) in the Path parameter to the MapPath method.

  • CVE-2008-2404Jun 4, 2008
    Sun Corporation
    Java Active Server Pages
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in the request handling implementation in Sun Java Active Server Pages (ASP) Server before 4.0.3 allows remote attackers to execute arbitrary code via an unspecified string field.

  • CVE-2008-2405Jun 4, 2008
    Sun Corporation
    Java Active Server Pages
    risk 0.00cvss —epss 0.03

    Sun Java Active Server Pages (ASP) Server before 4.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in HTTP requests to unspecified ASP applications.

  • CVE-2008-2406Jun 4, 2008
    Sun Corporation
    Java Active Server Pages
    risk 0.00cvss —epss 0.03

    The administration application server in Sun Java Active Server Pages (ASP) Server before 4.0.3 allows remote attackers to bypass authentication via direct requests on TCP port 5102.

  • CVE-2008-2541Jun 4, 2008
    Ca
    Etrust Secure Content Manager
    risk 0.01cvss —epss 0.10

    Multiple stack-based buffer overflows in the HTTP Gateway Service (icihttp.exe) in CA eTrust Secure Content Manager 8.0 allow remote attackers to execute arbitrary code or cause a denial of service via long FTP responses, related to (1) the file month field in a LIST command;…

  • CVE-2008-2550Jun 4, 2008
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Web Services Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.17 has unknown impact and attack vectors related to an attribute in the SOAP security header.

  • CVE-2008-1661Jun 4, 2008
    Microfocus
    StorageWorks Storage Mirroring
    risk 0.09cvss —epss 0.69

    Stack-based buffer overflow in DoubleTake.exe in HP StorageWorks Storage Mirroring (SWSM) before 4.5 SP2 allows remote attackers to execute arbitrary code via a crafted encoded authentication request.

  • CVE-2008-1947Jun 4, 2008
    Apache
    Tomcat
    risk 0.00cvss —epss 0.10

    Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.

  • CVE-2008-2119Jun 4, 2008
    Asterisk
    Business Edition
    risk 0.04cvss —epss 0.07

    Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From…

  • CVE-2008-2547Jun 4, 2008
    Microsoft
    Windows Installer
    risk 0.01cvss —epss 0.08

    Stack-based buffer overflow in msiexec.exe 3.1.4000.1823 and 4.5.6001.22159 in Microsoft Windows Installer allows context-dependent attackers to execute arbitrary code via a long GUID value for the /x (aka /uninstall) option. NOTE: this issue might cross privilege boundaries if…

  • CVE-2008-2548Jun 4, 2008
    Motorola
    Razr
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in the JPEG thumbprint component in the EXIF parser on Motorola cell phones with RAZR firmware allows user-assisted remote attackers to execute arbitrary code via an MMS transmission of a malformed JPEG image, which triggers memory corruption.

  • CVE-2008-2549Jun 4, 2008
    Adobe Inc.
    Acrobat
    risk 0.07cvss —epss 0.53

    Adobe Acrobat Reader 8.1.2 and earlier, and before 7.1.1, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed PDF document, as demonstrated by 2008-HI2.pdf.

  • CVE-2008-1035Jun 3, 2008
    Apple Inc.
    Ical
    risk 0.04cvss —epss 0.10

    Use-after-free vulnerability in Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to trigger memory corruption or possibly execute arbitrary code via an "ATTACH;VALUE=URI:S=osumi" line in a .ics file, which triggers a "resource…

  • CVE-2008-0169Jun 3, 2008
    Ikiwiki
    Ikiwiki
    risk 0.00cvss —epss 0.02

    Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the…

  • CVE-2008-2520Jun 3, 2008
    Bigace
    Bigace
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in BigACE 2.4, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[_BIGACE][DIR][addon] parameter to (a) addon/smarty/plugins/function.captcha.php and (b)…

  • CVE-2008-2521Jun 3, 2008
    Yabsoft
    Mega File Hosting Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in members.php in YABSoft Mega File Hosting Script (aka MFH or MFHS) 1.2 allows remote authenticated users to execute arbitrary SQL commands via the fid parameter.

  • CVE-2008-2522Jun 3, 2008
    Haudenschilt
    Battlenet Clan Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in members.php in Battle.net Clan Script for PHP 1.5.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the showmember parameter in a members action.

  • CVE-2008-2523Jun 3, 2008
    Raknet
    Autopatcher Server
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Autopatcher server plugin in RakNet before 3.23 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-2524Jun 3, 2008
    Blogphp
    Blogphp
    risk 0.00cvss —epss 0.01

    BlogPHP 2.0 allows remote attackers to bypass authentication, and post (1) messages or (2) comments as an arbitrary user, via a modified blogphp_username field in a cookie.

  • CVE-2008-2525Jun 3, 2008
    TYPO3
    rlmp_eventdb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Event Database (aka rlmp_eventdb) extension before 1.1.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2526Jun 3, 2008
    TYPO3
    Wt Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the WT Gallery (aka wt_gallery) extension 2.6.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2527Jun 3, 2008
    Actualscripts
    Actualanalyzer Lite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in view.php in ActualScripts ActualAnalyzer Server 8.37 and earlier, ActualAnalyzer Gold 7.74 and earlier, ActualAnalyzer Pro 6.95 and earlier, and ActualAnalyzer Lite 2.78 and earlier allows remote attackers to inject arbitrary web…

  • CVE-2008-2528Jun 3, 2008
    Citrix Systems
    Access Gateway
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Citrix Access Gateway Standard Edition 4.5.7 and earlier and Advanced Edition 4.5 HF2 and earlier allows attackers to bypass authentication and gain "access to network resources" via unspecified vectors.

  • CVE-2008-2529Jun 3, 2008
    Advanced Links Management
    Advanced Links Management
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in read.php in Advanced Links Management (ALM) 1.5.2 allows remote attackers to execute arbitrary SQL commands via the catId parameter.

  • CVE-2008-2530Jun 3, 2008
    Quickupcms
    Quickupcms
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Concepts & Solutions QuickUpCMS allow remote attackers to execute arbitrary SQL commands via the (1) nr parameter to (a) frontend/news.php, the (2) id parameter to (b) events3.php and (c) videos2.php in frontend/, the (3) y parameter to…

  • CVE-2008-2531Jun 3, 2008
    Buildanichestore3
    Bans
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the search script in Build A Niche Store (BANS) 3.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter.

  • CVE-2008-2532Jun 3, 2008
    AJ Square
    Aj Hyip
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in forum/topic_detail.php in AJ Square aj-hyip (aka AJ HYIP Acme) allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-2533Jun 3, 2008
    Phoenix View CMS
    Phoenix View CMS
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Phoenix View CMS Pre Alpha2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ltarget parameter to (a) admin/admin_frame.php and the (2) conf parameter to (b) gbuch.admin.php, (c)…

  • CVE-2008-2534Jun 3, 2008
    Phoenix View CMS
    Phoenix View CMS
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in admin/admin_frame.php in Phoenix View CMS Pre Alpha2 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ltarget parameter.

  • CVE-2008-2535Jun 3, 2008
    Phoenix View CMS
    Phoenix View CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Phoenix View CMS Pre Alpha2 and earlier allow remote attackers to execute arbitrary SQL commands via the del parameter to (1) gbuch.admin.php, (2) links.admin.php, (3) menue.admin.php, (4) news.admin.php, and (5) todo.admin.php in…

  • CVE-2008-2536Jun 3, 2008
    Yabsoft
    Advanced Image Hosting Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in out.php in YABSoft Advanced Image Hosting (AIH) Script 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the t parameter.

  • CVE-2008-2537Jun 3, 2008
    Hispah
    Model Search
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in cat.php in HispaH Model Search allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2008-2538Jun 3, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in crontab on Sun Solaris 8 through 10, and OpenSolaris before snv_93, allows local users to insert cron jobs into the crontab files of arbitrary users via unspecified vectors.

  • CVE-2008-2539Jun 3, 2008
    Sun Corporation
    Cluster
    risk 0.00cvss —epss 0.00

    The Sun Cluster Global File System in Sun Cluster 3.1 on Sun Solaris 8 through 10, when an underlying ufs filesystem is used, might allow local users to read data from arbitrary deleted files, or corrupt files in global filesystems, via unspecified vectors.

  • CVE-2008-2540Jun 3, 2008
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.08

    Apple Safari on Mac OS X, and before 3.1.2 on Windows, does not prompt the user before downloading an object that has an unrecognized content type, which allows remote attackers to place malware into the (1) Desktop directory on Windows or (2) Downloads directory on Mac OS X,…

  • CVE-2008-2516Jun 3, 2008
    Libpam Pgsql
    Libpam Pgsql
    risk 0.00cvss —epss 0.00

    pam_sm_authenticate in pam_pgsql.c in libpam-pgsql 0.6.3 does not properly consider operator precedence when evaluating the success of a pam_get_pass function call, which allows local users to gain privileges via a SIGINT signal when this function is executing, as demonstrated…

  • CVE-2008-2517Jun 3, 2008
    Sarab
    Sarab
    risk 0.00cvss —epss 0.00

    The sarab.sh script in SaraB before 0.2.4 places the dar program's encryption key on the command line, which allows local users to obtain sensitive information by listing the process.

  • CVE-2008-2518Jun 3, 2008
    Sun Corporation
    Java System Web Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the advanced search mechanism (webapps/search/advanced.jsp) in Sun Java System Web Server 6.1 before SP9 and 7.0 before Update 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably related…

  • CVE-2008-2519Jun 3, 2008
    Coreftp
    Core FTP client
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Core FTP client 2.1 Build 1565 allows remote FTP servers to create or overwrite arbitrary files via .. (dot dot) sequences in responses to LIST commands, a related issue to CVE-2002-1345. NOTE: this can be leveraged for code execution by…

  • CVE-2008-1027Jun 2, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Apple Filing Protocol (AFP) Server in Apple Mac OS X before 10.5.3 does not verify that requested files and directories are inside shared folders, which allows remote attackers to read arbitrary files via unspecified AFP traffic.

  • CVE-2008-1028Jun 2, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in AppKit in Apple Mac OS X before 10.5 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted document file, as demonstrated by opening the document with TextEdit.

  • CVE-2008-1030Jun 2, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.05

    Integer overflow in the CFDataReplaceBytes function in the CFData API in CoreFoundation in Apple Mac OS X before 10.5.3 allows context-dependent attackers to execute arbitrary code or cause a denial of service (crash) via an invalid length argument, which triggers a heap-based…

  • CVE-2008-1031Jun 2, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.06

    CoreGraphics in Apple Mac OS X before 10.5.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document, related to an uninitialized variable.

  • CVE-2008-1032Jun 2, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.5.3 allows user-assisted remote attackers to execute arbitrary code via an (1) Automator, (2) Help, (3) Safari, or (4) Terminal content type for a downloadable object, which does not trigger a…

  • CVE-2008-1033Jun 2, 2008
    Apple Inc.
    Cups
    risk 0.00cvss —epss 0.02

    The scheduler in CUPS in Apple Mac OS X 10.5 before 10.5.3, when debug logging is enabled and a printer requires a password, allows attackers to obtain sensitive information (credentials) by reading the log data, related to "authentication environment variables."

  • CVE-2008-1034Jun 2, 2008
    Apple Inc.
    Mac OS X
    risk 0.01cvss —epss 0.08

    Integer underflow in Help Viewer in Apple Mac OS X before 10.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted help:topic URL that triggers a buffer overflow.

  • CVE-2008-1036Jun 2, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct…

  • CVE-2008-1571Jun 2, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in the embedded web server in Image Capture in Apple Mac OS X before 10.5 allows remote attackers to read arbitrary files via directory traversal sequences in the URI.