VYPR

CVEs

383,885 total · page 7063 of 7,678

AllCriticalHighKEV
  • CVE-2008-2494May 28, 2008
    Zina
    Zina
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Zina 1.0 RC3 allows remote attackers to inject arbitrary web script or HTML via the l parameter.

  • CVE-2008-2495May 28, 2008
    Zina
    Zina
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in index.php in Zina 1.0 RC3 allows remote attackers to have an unknown impact via a .. (dot dot) in the p parameter.

  • CVE-2008-2496May 28, 2008
    Quate
    Quate CMS
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Quate CMS 0.3.4 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) login.php, and (3) credits.php in admin/, and (4) upgrade/index.php.

  • CVE-2008-2497May 28, 2008
    Mambo (software)
    Mambo
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in Mambo before 4.6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

  • CVE-2008-2498May 28, 2008
    Mambo (software)
    Mambo
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Mambo before 4.6.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) articleid and (2) mcname parameters. NOTE: some of these details are obtained from third party…

  • CVE-2008-2443May 27, 2008
    Therealestatescript
    The Real Estate Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in dpage.php in The Real Estate Script allows remote attackers to execute arbitrary SQL commands via the docID parameter.

  • CVE-2008-2444May 27, 2008
    Calogic
    Calogic Calendars
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in userreg.php in CaLogic Calendars 1.2.2 allows remote attackers to execute arbitrary SQL commands via the langsel parameter.

  • CVE-2008-2445May 27, 2008
    Wgcc
    Web Group Communication Center
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in profile.php in Web Group Communication Center (WGCC) 1.0.3 PreRelease 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the userid parameter in a show action.

  • CVE-2008-2446May 27, 2008
    Wgcc
    Web Group Communication Center
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Web Group Communication Center (WGCC) 1.0.3 PreRelease 1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) userid parameter to (a) profile.php in a "show moreinfo" action; the (2) bildid parameter…

  • CVE-2008-2447May 27, 2008
    Mytipper
    Zogo Shop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in products.php in the Mytipper ZoGo-shop plugin 1.15.5 and 1.16 Beta 13 for e107 allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2008-2448May 27, 2008
    Meto Forum
    Meto Forum
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Meto Forum 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) admin/duzenle.asp and (b) admin_oku.asp; the (2) kid parameter to (c) kategori.asp and (d) admin_kategori.asp; and unspecified…

  • CVE-2008-2449May 27, 2008
    PhpInstantGallery
    phpInstantGallery
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Isaac McGowan phpInstantGallery 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) gallery parameter to (a) index.php and (b) image.php, and the (2) imgnum parameter to image.php. NOTE: the…

  • CVE-2008-2450May 27, 2008
    TYPO3
    ke_stats
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Statistics (aka ke_stats) extension 0.1.2 and earlier for TYPO3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2451May 27, 2008
    TYPO3
    ke_stats
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Statistics (aka ke_stats) extension 0.1.2 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-2452May 27, 2008
    TYPO3
    pbsurvey
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Questionaire (aka pbsurvey) extension 1.2.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2453May 27, 2008
    Phpclassifiedsscript
    PHP Classifieds Script
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in PHP Classifieds Script allow remote attackers to execute arbitrary SQL commands via the fatherID parameter to (1) browse.php and (2) search.php.

  • CVE-2008-2454May 27, 2008
    Joomla
    Com Xsstream Dm
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the xsstream-dm (com_xsstream-dm) component 0.01 Beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the movie parameter to index.php.

  • CVE-2008-2455May 27, 2008
    WordPress
    Macguru Blog Engine
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in comment.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the rid parameter.

  • CVE-2008-2456May 27, 2008
    Comicshout
    Comicshout
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in ComicShout 2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the comic_id parameter.

  • CVE-2008-2457May 27, 2008
    Bitmixsoft
    PHP Jokesite
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in jokes_category.php in PHP-Jokesite 2.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.

  • CVE-2008-2458May 27, 2008
    4shared
    Starsgames Control Panel
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Starsgames Control Panel 4.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the st parameter.

  • CVE-2008-2459May 27, 2008
    Entertainmentscript
    Entertainmentscript
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in page.php in EntertainmentScript 1.4.0 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page parameter.

  • CVE-2008-2460May 27, 2008
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in faq.php in vBulletin 3.7.0 Gold allows remote attackers to execute arbitrary SQL commands via the q parameter in a search action.

  • CVE-2008-2461May 27, 2008
    Netious CMS
    CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Netious CMS 0.4 allows remote attackers to execute arbitrary SQL commands via the pageid parameter, a different vector than CVE-2006-4047.

  • CVE-2008-2422May 23, 2008
    Webslider
    Webslider
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Web Slider 0.6 allows remote attackers to execute arbitrary SQL commands via the slide parameter in a slides action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-2423May 23, 2008
    Interchange Development Group
    Interchange
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Interchange before 5.6.0 and before 5.5.2 allows remote attackers to cause a denial of service via crafted HTTP requests. NOTE: this might overlap CVE-2007-2635.

  • CVE-2008-2424May 23, 2008
    Interchange Development Group
    Interchange
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the 404 error page for the "Standard demo" in Interchange before 5.6.0 and before 5.5.2 has unknown impact and attack vectors.

  • CVE-2008-2425May 23, 2008
    Fichive
    Fichive
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in FicHive 1.0 allows remote attackers to execute arbitrary SQL commands via the letter parameter in a Search action, a different vector than CVE-2008-2416. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2007-5495May 23, 2008
    Selinux
    Setroubleshoot
    risk 0.00cvss —epss 0.00

    sealert in setroubleshoot 2.0.5 allows local users to overwrite arbitrary files via a symlink attack on the sealert.log temporary file.

  • CVE-2007-5496May 23, 2008
    Selinux
    Setroubleshoot
    risk 0.00cvss —epss 0.00

    Cross-site scripting (XSS) vulnerability in setroubleshoot 2.0.5 allows local users to inject arbitrary web script or HTML via a crafted (1) file or (2) process name, which triggers an Access Vector Cache (AVC) log entry in a log file used during composition of HTML documents…

  • CVE-2007-5961May 23, 2008
    Red Hat
    Satellite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Red Hat Network channel search feature, as used in RHN and Red Hat Network Satellite before 5.0.2, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2008-1767May 23, 2008
    Libxslt
    libxslt
    risk 0.04cvss —epss 0.13

    Buffer overflow in pattern.c in libxslt before 1.1.24 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XSL style sheet file with a long XSLT "transformation match" condition that triggers a large number of steps.

  • CVE-2008-2302May 23, 2008
    Djangoproject
    Django
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.

  • CVE-2008-2333May 23, 2008
    Barracuda Networks
    Barracuda Spam Firewall
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in ldap_test.cgi in Barracuda Spam Firewall (BSF) before 3.5.11.025 allows remote attackers to inject arbitrary web script or HTML via the email parameter.

  • CVE-2008-2407May 23, 2008
    Cerulean Studios
    Trillian
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in AIM.DLL in Cerulean Studios Trillian before 3.1.10.0 allows user-assisted remote attackers to execute arbitrary code via a long attribute value in a FONT tag in a message.

  • CVE-2008-2408May 23, 2008
    Cerulean Studios
    Trillian
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in the XML parsing functionality in talk.dll in Cerulean Studios Trillian Pro before 3.1.10.0 allows remote attackers to execute arbitrary code via a malformed attribute in an IMG tag.

  • CVE-2008-2409May 23, 2008
    Cerulean Studios
    Trillian
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in Cerulean Studios Trillian before 3.1.10.0 allows remote attackers to execute arbitrary code via unspecified attributes in the X-MMS-IM-FORMAT header in an MSN message.

  • CVE-2008-2418May 23, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Race condition in the STREAMS Administrative Driver (sad) in Sun Solaris 10 allows local users to cause a denial of service (panic) via unknown vectors.

  • CVE-2008-2419May 23, 2008
    Mozilla Corporation
    Firefox
    risk 0.04cvss —epss 0.07

    Mozilla Firefox 2.0.0.14 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly execute arbitrary code by triggering an error condition during certain Iframe operations between a JSframe write and a JSframe close, as demonstrated…

  • CVE-2008-2420May 23, 2008
    Stunnel
    Stunnel
    risk 0.00cvss —epss 0.01

    The OCSP functionality in stunnel before 4.24 does not properly search certificate revocation lists (CRL), which allows remote attackers to bypass intended access restrictions by using revoked certificates.

  • CVE-2008-2421May 23, 2008
    SAP
    Sap Web Application Server
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under…

  • CVE-2007-5962May 22, 2008
    Foresight Linux
    Appliances
    risk 0.04cvss —epss 0.12

    Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux (RHEL) 5 and Fedora 6 through 8, and on Foresight Linux and rPath appliances, allows remote attackers to cause a denial of service (memory consumption) via a large number of CWD commands,…

  • CVE-2008-0534May 22, 2008
    Icon Labs
    Iconfidant SSH
    risk 0.00cvss —epss 0.04

    The SSH server in (1) Cisco Service Control Engine (SCE) before 3.1.6, and (2) Icon Labs Iconfidant SSH before 2.3.8, allows remote attackers to cause a denial of service (device restart or daemon outage) via a high rate of login attempts, aka Bug ID CSCsi68582.

  • CVE-2008-0535May 22, 2008
    Icon Labs
    Iconfidant SSH
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the SSH server in (1) Cisco Service Control Engine (SCE) before 3.1.6, and (2) Icon Labs Iconfidant SSH before 2.3.8, allows remote attackers to cause a denial of service (device instability) via "SSH credentials that attempt to change the…

  • CVE-2008-0536May 22, 2008
    Icon Labs
    Iconfidant SSH
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the SSH server in (1) Cisco Service Control Engine (SCE) 3.0.x before 3.0.7 and 3.1.x before 3.1.0, and (2) Icon Labs Iconfidant SSH before 2.3.8, allows remote attackers to cause a denial of service (management interface outage) via SSH traffic that…

  • CVE-2008-1159May 22, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in the SSH server in Cisco IOS 12.4 allow remote attackers to cause a denial of service (device restart) via unknown vectors, aka Bug ID (1) CSCsk42419, (2) CSCsk60020, and (3) CSCsh51293.

  • CVE-2008-1804May 22, 2008
    Snort
    Snort
    risk 0.00cvss —epss 0.02

    preprocessors/spp_frag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment.

  • CVE-2008-2006May 22, 2008
    Apple Inc.
    Ical
    risk 0.04cvss —epss 0.10

    Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a .ics file containing (1) a large 16-bit integer on a TRIGGER…

  • CVE-2008-2053May 22, 2008
    Cisco Systems, Inc.
    Unified Customer Voice Portal
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Cisco Unified Customer Voice Portal (CVP) 4.0.x before 4.0(2)_ES14, 4.1.x before 4.1(1)_ES11, and 7.x before 7.0(1) allows remote authenticated users with administrator role privileges to create, modify, or delete a superuser account.

  • CVE-2008-2240May 22, 2008
    IBM
    Lotus Domino
    risk 0.08cvss —epss 0.65

    Stack-based buffer overflow in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long Accept-Language HTTP header.