VYPR

CVEs

383,885 total · page 7065 of 7,678

AllCriticalHighKEV
  • CVE-2008-2345May 19, 2008
    TYPO3
    Air Filemanager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the air_filemanager 0.6.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary PHP code via unspecified vectors related to "insufficient file filtering."

  • CVE-2008-0167May 18, 2008
    GForge
    Gforge
    risk 0.03cvss —epss 0.01

    The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic…

  • CVE-2008-2281May 18, 2008
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.23

    Cross-zone scripting vulnerability in the Print Table of Links feature in Internet Explorer 6.0, 7.0, and 8.0b allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via an HTML document with a link containing JavaScript sequences,…

  • CVE-2008-2282May 18, 2008
    Internet Photoshow
    Internet Photoshow Special Edition
    risk 0.03cvss —epss 0.03

    admin.php in Internet Photoshow and Internet Photoshow Special Edition (SE) allows remote attackers to bypass authentication by setting the login_admin cookie to true.

  • CVE-2008-2283May 18, 2008
    ID Automation
    Linear Barcode
    risk 0.03cvss —epss 0.06

    IDAutomation allows remote attackers to overwrite arbitrary files via the argument to the (1) SaveBarCode and (2) SaveEnhWMF methods in (a) the IDAuto.BarCode.1 ActiveX control in IDAutomationLinear6.dll (aka IDAutomation Linear BarCode) 1.6.0.6, (b) the IDAuto.Datamatrix.1…

  • CVE-2008-2284May 18, 2008
    Fusebox
    Fusebox
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in fusebox5.php in Fusebox 5.5.1 allows remote attackers to execute arbitrary PHP code via a URL in the FUSEBOX_APPLICATION_PATH parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third…

  • CVE-2008-2285May 18, 2008
    Ubuntu
    Linux
    risk 0.00cvss —epss 0.02

    The ssh-vulnkey tool on Ubuntu Linux 7.04, 7.10, and 8.04 LTS does not recognize authorized_keys lines that contain options, which makes it easier for remote attackers to exploit CVE-2008-0166 by guessing a key that was not identified by this tool.

  • CVE-2008-2286May 18, 2008
    Symantec
    Deployment Solution
    risk 0.06cvss —epss 0.33

    SQL injection vulnerability in axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allows remote attackers to execute arbitrary SQL commands via unspecified string fields in a notification packet.

  • CVE-2008-2287May 18, 2008
    Symantec
    Deployment Solution
    risk 0.00cvss —epss 0.00

    Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 does not properly protect the install directory, which might allow local users to gain privileges by replacing an application component with a Trojan horse.

  • CVE-2008-2288May 18, 2008
    Symantec
    Deployment Solution
    risk 0.00cvss —epss 0.00

    Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 has insufficient access control for deletion and modification of registry keys, which allows local users to cause a denial of service or obtain sensitive information.

  • CVE-2008-2289May 18, 2008
    Symantec
    Deployment Solution
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in a tooltip element in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allows local users to gain privileges via unknown attack vectors.

  • CVE-2008-2290May 18, 2008
    Symantec
    Deployment Solution
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Agent user interface in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allows local users to gain privileges via unknown attack vectors.

  • CVE-2008-2291May 18, 2008
    Symantec
    Deployment Solution
    risk 0.00cvss —epss 0.04

    axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 generates credentials with a fixed salt or without any salt, which makes it easier for remote attackers to guess encrypted domain credentials.

  • CVE-2008-2292May 18, 2008
    Net SNMP
    Net SNMP
    risk 0.04cvss —epss 0.08

    Buffer overflow in the __snprint_value function in snmp_get in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in SNMP.xs for Perl, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large OCTETSTRING in an attribute value pair (AVP).

  • CVE-2008-2293May 18, 2008
    Tpvgames
    Mpcs
    risk 0.03cvss —epss 0.03

    admin.php in Multi-Page Comment System (MPCS) 1.0 and 1.1 allows remote attackers to bypass authentication and gain privileges by setting the CommentSystemAdmin cookie to 1.

  • CVE-2008-2294May 18, 2008
    Mreaves
    Pet Grooming Management System
    risk 0.03cvss —epss 0.03

    Pet Grooming Management System 2.0 allows remote attackers to gain privileges via a direct request to useradded.php with a modified user name for "admin."

  • CVE-2008-2295May 18, 2008
    Rgboard
    Rgboard
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in rg_search.php in Rgboard 3.0.12, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the s_text parameter and other unspecified vectors.

  • CVE-2008-2296May 18, 2008
    Rgboard
    Rgboard
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in include/bbs.lib.inc.php in Rgboard 3.0.12 allows remote attackers to execute arbitrary PHP code via a URL in the site_path parameter.

  • CVE-2008-2297May 18, 2008
    Rantx
    Rantx
    risk 0.03cvss —epss 0.02

    The admin.php file in Rantx allows remote attackers to bypass authentication and gain privileges by setting the logininfo cookie to "<?php" or "?>", which is present in the password file and probably passes an insufficient comparison.

  • CVE-2008-2298May 18, 2008
    EMule X Ray
    Web Slider
    risk 0.03cvss —epss 0.03

    Admin.php in Web Slider 0.6 allows remote attackers to bypass authentication and gain privileges by setting the admin cookie to 1.

  • CVE-2008-2299May 18, 2008
    Citrix Systems
    Access Essentials
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in SecureICA and ICA Basic encryption of Citrix Presentation Server 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop Server 1.0 can cause clients to use weaker encryption settings than configured by the administrator, which might allow…

  • CVE-2008-2300May 18, 2008
    Citrix Systems
    Access Essentials
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Citrix Presentation Server 4.5 and earlier, Citrix Access Essentials 2.0 and earlier, and Citrix Desktop Server 1.0 allows remote authenticated users to access unauthorized desktops via unknown attack vectors.

  • CVE-2008-2301May 18, 2008
    Phpway
    Kostenloses Linkmanagementscript
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Kostenloses Linkmanagementscript allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) view.php and (2) top_view.php.

  • CVE-2008-1158May 16, 2008
    Cisco Systems, Inc.
    Unified Presence Server
    risk 0.00cvss —epss 0.02

    The Presence Engine (PE) service in Cisco Unified Presence before 6.0(1) allows remote attackers to cause a denial of service (core dump and service interruption) via malformed packets, aka Bug ID CSCsh50164.

  • CVE-2008-1419May 16, 2008
    Xiph.Org
    Libvorbis
    risk 0.00cvss —epss 0.04

    Xiph.org libvorbis 1.2.0 and earlier does not properly handle a zero value for codebook.dim, which allows remote attackers to cause a denial of service (crash or infinite loop) or trigger an integer overflow.

  • CVE-2008-1420May 16, 2008
    Xiph.Org
    Libvorbis
    risk 0.01cvss —epss 0.06

    Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.

  • CVE-2008-1423May 16, 2008
    Xiph.Org
    Libvorbis
    risk 0.01cvss —epss 0.08

    Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a…

  • CVE-2008-1740May 16, 2008
    Cisco Systems, Inc.
    Unified Presence Server
    risk 0.00cvss —epss 0.02

    The Presence Engine (PE) service in Cisco Unified Presence before 6.0(1) allows remote attackers to cause a denial of service (core dump and service interruption) via an unspecified "stress test," aka Bug ID CSCsh20972.

  • CVE-2008-1741May 16, 2008
    Cisco Systems, Inc.
    Unified Presence Server
    risk 0.00cvss —epss 0.02

    The SIP Proxy (SIPD) service in Cisco Unified Presence before 6.0(3) allows remote attackers to cause a denial of service (core dump and service interruption) via a TCP port scan, aka Bug ID CSCsj64533.

  • CVE-2008-1742May 16, 2008
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    Memory leak in the Certificate Trust List (CTL) Provider service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3) allows remote attackers to cause a denial of service (memory consumption and service interruption) via a series of malformed TCP packets, as…

  • CVE-2008-1743May 16, 2008
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    Memory leak in the Certificate Trust List (CTL) Provider service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3) and 6.x before 6.1(1) allows remote attackers to cause a denial of service (memory consumption and service interruption) via a series of malformed…

  • CVE-2008-1744May 16, 2008
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.01

    The Certificate Authority Proxy Function (CAPF) service in Cisco Unified Communications Manager (CUCM) 4.1 before 4.1(3)SR7, 4.2 before 4.2(3)SR4, and 4.3 before 4.3(2) allows remote attackers to cause a denial of service (service crash) via malformed network traffic, aka Bug ID…

  • CVE-2008-1745May 16, 2008
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.02

    Cisco Unified Communications Manager (CUCM) 5.x before 5.1(2) and 6.x before 6.1(1) allows remote attackers to cause a denial of service (service interruption) via a SIP JOIN message with a malformed header, aka Bug ID CSCsi48115.

  • CVE-2008-1746May 16, 2008
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.02

    The SNMP Trap Agent service in Cisco Unified Communications Manager (CUCM) 4.1 before 4.1(3)SR6, 4.2 before 4.2(3)SR3, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) allows remote attackers to cause a denial of service (core dump and service restart) via a series of…

  • CVE-2008-1747May 16, 2008
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Cisco Unified Communications Manager 4.1 before 4.1(3)SR6, 4.2 before 4.2(3)SR3, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) allows remote attackers to cause a denial of service (CCM service restart) via an unspecified SIP INVITE…

  • CVE-2008-1748May 16, 2008
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.02

    Cisco Unified Communications Manager 4.1 before 4.1(3)SR7, 4.2 before 4.2(3)SR4, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) does not properly validate SIP URLs, which allows remote attackers to cause a denial of service (service interruption) via a SIP INVITE…

  • CVE-2008-2009May 16, 2008
    Xiph.Org
    Libvorbis
    risk 0.00cvss —epss 0.04

    Xiph.org libvorbis before 1.0 does not properly check for underpopulated Huffman trees, which allows remote attackers to cause a denial of service (crash) via a crafted OGG file that triggers memory corruption during execution of the _make_decode_tree function.

  • CVE-2008-2136May 16, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.05

    Memory leak in the ipip6_rcv function in net/ipv6/sit.c in the Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3 allows remote attackers to cause a denial of service (memory consumption) via network traffic to a Simple Internet Transition (SIT) tunnel interface, related…

  • CVE-2008-2165May 16, 2008
    Cisco Systems, Inc.
    Building Broadband Service Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in AccessCodeStart.asp in Cisco Building Broadband Service Manager (BBSM) Captive Portal 5.3 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2008-2263May 16, 2008
    Cmsnx
    Automated Link Exchange Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in linking.page.php in Automated Link Exchange Portal allows remote attackers to execute arbitrary SQL commands via the cat_id parameter. NOTE: linking.page.php is commonly renamed to link.php, links.php, etc.

  • CVE-2008-2264May 16, 2008
    CyrixMED
    CyrixMED
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in CyrixMED 1.4 allows remote attackers to inject arbitrary web script or HTML via the msg_erreur parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-2265May 16, 2008
    Emophp
    Emo Realty Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.php in EMO Realty Manager allows remote attackers to execute arbitrary SQL commands via the ida parameter.

  • CVE-2008-2266May 16, 2008
    Uudeview
    Uudeview
    risk 0.00cvss —epss 0.00

    uulib/uunconc.c in UUDeview 0.5.20, as used in nzbget before 0.3.0 and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on a temporary filename generated by the tempnam function. NOTE: this may be a CVE-2004-2265 regression.

  • CVE-2008-2267May 16, 2008
    Cmsmadesimple
    FileManager
    risk 0.03cvss —epss 0.05

    Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6)…

  • CVE-2008-2268May 16, 2008
    MJGuest
    MJGuest
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in interface/redirect.htm.php in Mjguest 6.7 GT Rev.01 allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter in a redirect action to mjguest.php. NOTE: this is…

  • CVE-2008-2269May 16, 2008
    AustinSmoke
    GasTracker
    risk 0.03cvss —epss 0.03

    AustinSmoke GasTracker (AS-GasTracker) 1.0.0 allows remote attackers to bypass authentication and gain privileges by setting the gastracker_admin cookie to TRUE.

  • CVE-2008-2270May 16, 2008
    Phpway
    Kostenloses Linkmanagementscript
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in PHPWAY Kostenloses Linkmanagementscript allow remote attackers to execute arbitrary PHP code via a URL in the (1) main_page_directory and (2) page_to_include parameters in template\index.php.

  • CVE-2008-2271May 16, 2008
    Drupal
    Site Documentation Drupal module
    risk 0.00cvss —epss 0.02

    The Site Documentation Drupal module 5.x before 5.x-1.8 and 6.x before 6.x-1.1 allows remote authenticated users to gain privileges of other users by leveraging the "access content" permission to list tables and obtain session IDs from the database.

  • CVE-2008-2272May 16, 2008
    Arubanetworks
    Mobility Controller
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Aruba Mobility Controller 2.4.8.x-FIPS, 2.5.5.x, 2.5.6.x, 3.1.1.x, 3.2.0.x, and 3.3.1.x allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2273May 16, 2008
    Arubanetworks
    Mobility Controller
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the TACACS authentication component in Aruba Mobility Controller 3.1.x, 3.2.x, and 3.3.x allows remote authenticated users to gain privileges via unknown vectors.