VYPR

CVEs

383,885 total · page 7064 of 7,678

AllCriticalHighKEV
  • CVE-2008-2399May 22, 2008
    Fireftp
    Fireftp
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the FireFTP add-on before 0.98.20080518 for Firefox allows remote FTP servers to create or overwrite arbitrary files via ..\ (dot dot backslash) sequences in responses to (1) MLSD and (2) LIST commands, a related issue to CVE-2002-1345. …

  • CVE-2008-2400May 22, 2008
    Stunnel
    Stunnel
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in stunnel before 4.23, when running as a service on Windows, allows local users to gain privileges via unknown attack vectors.

  • CVE-2008-2410May 22, 2008
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the servlet engine and Web container in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2411May 22, 2008
    Sazcart
    Sazcart
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in SazCart 1.5.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the prodid parameter in a details action.

  • CVE-2008-2412May 22, 2008
    Acgv News
    News
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in glossaire.php in ACGV News 0.9.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-2413May 22, 2008
    Acgv News
    News
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in glossaire.php in ACGV News 0.9.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2008-2414May 22, 2008
    ANG
    AN Guestbook
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in send_email.php in AN Guestbook (ANG) 0.4 allows remote attackers to inject arbitrary web script or HTML via the postid parameter.

  • CVE-2008-2415May 22, 2008
    Digitalhive
    Digitalhive
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in template/purpletech/base_include.php in DigitalHive (aka hive) 2.0 RC2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.

  • CVE-2008-2416May 22, 2008
    Fichive
    Fichive
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in FicHive 1.0 allows remote attackers to execute arbitrary SQL commands via the category parameter in a Fiction action, possibly related to sources/fiction.class.php.

  • CVE-2008-2417May 22, 2008
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in showQAnswer.asp in How2ASP.net Webboard 4.1 allows remote attackers to execute arbitrary SQL commands via the qNo parameter.

  • CVE-2008-1104May 21, 2008
    Foxitsoftware
    Reader
    risk 0.02cvss —epss 0.23

    Stack-based buffer overflow in Foxit Reader before 2.3 build 2912 allows user-assisted remote attackers to execute arbitrary code via a crafted PDF file, related to the util.printf JavaScript function and floating point specifiers in format strings.

  • CVE-2008-1660May 21, 2008
    HP UX
    useradd
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in useradd on HP-UX B.11.11, B.11.23, and B.11.31 allows local users to access arbitrary files and directories via unspecified vectors.

  • CVE-2008-1948May 21, 2008
    GNU
    Gnutls
    risk 0.01cvss —epss 0.12

    The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a…

  • CVE-2008-1949May 21, 2008
    GNU
    Gnutls
    risk 0.00cvss —epss 0.06

    The _gnutls_recv_client_kx_message function in lib/gnutls_kx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service…

  • CVE-2008-1950May 21, 2008
    GNU
    Gnutls
    risk 0.00cvss —epss 0.05

    Integer signedness error in the _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted…

  • CVE-2008-2241May 21, 2008
    Ca
    Brightstor ARCserve Backup
    risk 0.01cvss —epss 0.12

    Directory traversal vulnerability in caloggerd in CA BrightStor ARCServe Backup 11.0, 11.1, and 11.5 allows remote attackers to append arbitrary data to arbitrary files via directory traversal sequences in unspecified input fields, which are used in log messages. NOTE: this can…

  • CVE-2008-2242May 21, 2008
    Ca
    Brightstor ARCserve Backup
    risk 0.01cvss —epss 0.15

    Multiple buffer overflows in xdr functions in the server in CA BrightStor ARCServe Backup 11.0, 11.1, and 11.5 allow remote attackers to execute arbitrary code, as demonstrated by a stack-based buffer overflow via a long parameter to the xdr_rwsstring function.

  • CVE-2008-2357May 21, 2008
    Mtr
    Mtr
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73, when invoked with the -p (aka --split) option, allows remote attackers to execute arbitrary code via a crafted DNS PTR record. NOTE: it could be argued that this is a vulnerability in the…

  • CVE-2008-2390May 21, 2008
    Microfocus
    Software Update
    risk 0.04cvss —epss 0.07

    Hpufunction.dll 4.0.0.1 in HP Software Update exposes the unsafe (1) ExecuteAsync and (2) Execute methods, which allows remote attackers to execute arbitrary code via an absolute pathname in the first argument.

  • CVE-2008-2391May 21, 2008
    Subsonic
    Subsonic
    risk 0.00cvss —epss 0.02

    SubSonic allows remote attackers to bypass pagesize limits and cause a denial of service (CPU consumption) via a pageindex (aka data page number) of -1.

  • CVE-2008-2392May 21, 2008
    WordPress
    WordPress
    risk 0.00cvss —epss 0.04

    Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.

  • CVE-2008-2393May 21, 2008
    Entertainmentscript
    Entertainmentscript
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in play.php in EntertainmentScript 1.4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-2394May 21, 2008
    Tagworx
    Tagworx CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in TAGWORX.CMS 3.00.02 allow remote attackers to execute arbitrary SQL commands via the (1) cid parameter to contact.php and the (2) nid parameter to news.php.

  • CVE-2008-2395May 21, 2008
    Alkalinephp
    Alkalinephp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in thread.php in AlkalinePHP 0.80.00 beta and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-2396May 21, 2008
    Wajox Software
    Mircrossys CMS
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in Wajox Software microSSys CMS 1.5 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in an arbitrary element of the PAGES array parameter.

  • CVE-2008-2397May 21, 2008
    Dotcms
    Dotcms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search-results.dot in dotCMS 1.x allows remote attackers to inject arbitrary web script or HTML via the search_query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-2398May 21, 2008
    AppServ Open Project
    Appserv
    risk 0.03cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in index.php in AppServ Open Project 2.5.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the appservlang parameter.

  • CVE-2008-0957May 20, 2008
    Photostockplus
    Photostockplus Uploader Tool
    risk 0.00cvss —epss 0.03

    Multiple stack-based buffer overflows in the PhotoStockPlus Uploader Tool ActiveX control (PSPUploader.ocx) allow remote attackers to execute arbitrary code via unspecified initialization parameters.

  • CVE-2008-2346May 20, 2008
    Alkalinephp
    Alkalinephp
    risk 0.03cvss —epss 0.03

    AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creating an admin account via a direct request to adduser.php.

  • CVE-2008-2347May 20, 2008
    Mypicgallery
    Mypicgallery
    risk 0.03cvss —epss 0.03

    MyPicGallery 1.0 allows remote attackers to bypass application authentication and gain administrative access by setting the userID parameter to "admin" in a direct request to admin/addUser.php.

  • CVE-2008-2348May 20, 2008
    Meltingicefs
    Meltingice File System
    risk 0.03cvss —epss 0.03

    MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and exceed application quotas via a direct request to admin/adduser.php.

  • CVE-2008-2349May 20, 2008
    Zomplog
    Zomplog
    risk 0.03cvss —epss 0.02

    Zomplog 3.8.2 and earlier allows remote attackers to gain administrative access by creating an admin account via a direct request to install/newuser.php with the admin parameter set to 1.

  • CVE-2008-2350May 20, 2008
    Bcoos
    Bcoos
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in highlight.php in bcoos 1.0.9 through 1.0.13 allows remote attackers to read arbitrary files via (1) .. (dot dot) or (2) C: folder sequences in the file parameter.

  • CVE-2008-2351May 20, 2008
    CMS
    WebManager-Pro
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in CMS WebManager-Pro allow remote attackers to execute arbitrary SQL commands via the (1) lang_id and (2) menu_id parameters.

  • CVE-2008-2352May 20, 2008
    Smeego
    Smeego
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in Smeego 1.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie.

  • CVE-2008-2353May 20, 2008
    GNU
    Gallery
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in admin.php in GNU/Gallery 1.1.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the show parameter.

  • CVE-2008-2354May 20, 2008
    Testmaker
    Testmaker
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the data export function in testMaker before 3.0p10 allows test authors to obtain access to export data via unknown vectors.

  • CVE-2008-2355May 20, 2008
    WR Meeting
    WR-Meeting
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in WR-Meeting 1.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the msnum parameter in a coment event.

  • CVE-2008-2356May 20, 2008
    Archangel Weblog
    Archangel Weblog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Archangel Weblog 0.90.02 and earlier allows remote attackers to execute arbitrary SQL commands via the post_id parameter.

  • CVE-2008-2334May 19, 2008
    Yigit Aybuga
    Philboard
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in W1L3D4 Philboard 0.5 allow remote attackers to execute arbitrary SQL commands via the (1) forumid parameter to (a) admin/philboard_admin-forumedit.asp, (b) admin/philboard_admin-forum.asp, and (c) W1L3D4_foruma_yeni_konu_ac.asp; the (2)…

  • CVE-2008-2335May 19, 2008
    Vastal
    Phpvid
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in search_results.php in Vastal I-Tech phpVID 1.1 and 1.2 allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: some of these details are obtained from third party information. NOTE: it was later…

  • CVE-2008-2336May 19, 2008
    68 Classifieds
    68 Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in category.php in 68 Classifieds 4.0.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2008-2337May 19, 2008
    Imgallery
    Imgallery
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in IMGallery 2.5, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) kategoria parameter to (a) galeria.php and the (2) id_phot parameter to (b) popup/koment.php and (c) popup/opis.php…

  • CVE-2008-2338May 19, 2008
    Interspire
    Activekb
    risk 0.04cvss —epss 0.06

    Interspire ActiveKB 1.5 and earlier allows remote attackers to gain privileges by setting the auth cookie to true when accessing unspecified scripts in /admin.

  • CVE-2008-2339May 19, 2008
    Turnkey Web Tools
    Sunshop Shopping Cart
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Turnkey Web Tools SunShop Shopping Cart 3.5.1 allows remote attackers to execute arbitrary SQL commands via the id parameter in an item action, a different vector than CVE-2008-2038, CVE-2007-4597, and CVE-2007-2549.

  • CVE-2008-2340May 19, 2008
    News Manager
    News Manager
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in News Manager 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) lang parameter to (a) advsearch.php, (b) archive.php, and (c) index.php, and the (2) pid parameter to (d) list_tagitems.php.

  • CVE-2008-2341May 19, 2008
    News Manager
    News Manager
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in ch_readalso.php in News Manager 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the read_xml_include parameter.

  • CVE-2008-2342May 19, 2008
    News Manager
    News Manager
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in attachments.php in News Manager 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.

  • CVE-2008-2343May 19, 2008
    News Manager
    News Manager
    risk 0.03cvss —epss 0.02

    News Manager 2.0 allows remote attackers to bypass restrictions and obtain sensitive information via a direct request to (1) db/connect_str.php and (2) login/info.php.

  • CVE-2008-2344May 19, 2008
    TYPO3
    Air Filemanager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the air_filemanager 0.6.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.