VYPR

CVEs

383,885 total · page 7066 of 7,678

AllCriticalHighKEV
  • CVE-2008-2274May 16, 2008
    TYPO3
    sr_feuser_register
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the sr_feuser_register 1.4.0, 1.6.0, 2.2.1 to 2.2.7, 2.3.0 to 2.3.6, 2.4.0, and 2.5.0 to 2.5.9 extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2275May 16, 2008
    TYPO3
    sr_feuser_register
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in sr_feuser_register 1.4.0, 1.6.0, 2.2.1 to 2.2.7, 2.3.0 to 2.3.6, 2.4.0, and 2.5.0 to 2.5.9 extension for TYPO3 allows remote attackers to execute arbitrary code and delete arbitrary files via unspecified attack vectors.

  • CVE-2008-2276May 16, 2008
    Mantisbt
    Mantis
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in manage_user_create.php in Mantis 1.1.1 allows remote attackers to create new administrative users via a crafted link.

  • CVE-2008-2277May 16, 2008
    Cmsnx
    Feedback and Rating Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in detail.php in Feedback and Rating Script 1.0 allows remote attackers to execute arbitrary SQL commands via the listingid parameter.

  • CVE-2008-2278May 16, 2008
    Freelanceauction
    Freelance Auction Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in browseproject.php in Freelance Auction Script 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a pdetails action.

  • CVE-2008-2279May 16, 2008
    Freelanceauction
    Freelance Auction Script
    risk 0.03cvss —epss 0.02

    Freelance Auction Script 1.0 stores user passwords in plaintext in the tbl_users table, which allows attackers to gain privileges by reading the table.

  • CVE-2008-2280May 16, 2008
    Scriptphp
    Picengine
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin/index.php in Script PHP PicEngine 1.0 allows remote attackers to inject arbitrary web script or HTML via the l parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-1749May 14, 2008
    Cisco Systems, Inc.
    Content Switching Module with SSL
    risk 0.00cvss —epss 0.02

    Memory leak in Cisco Content Switching Module (CSM) 4.2(3) up to 4.2(8) and Cisco Content Switching Module with SSL (CSM-S) 2.1(2) up to 2.1(7) allows remote attackers to cause a denial of service (memory consumption) via TCP segments with an unspecified combination of TCP flags.

  • CVE-2008-1943May 14, 2008
    Xen
    Xen
    risk 0.00cvss —epss 0.00

    Buffer overflow in the backend of XenSource Xen Para Virtualized Frame Buffer (PVFB) 3.0 through 3.1.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted description of a shared framebuffer.

  • CVE-2008-1944May 14, 2008
    Xen
    Xen
    risk 0.00cvss —epss 0.00

    Buffer overflow in the backend framebuffer of XenSource Xen Para-Virtualized Framebuffer (PVFB) Message 3.0 through 3.0.3 allows local users to cause a denial of service (SDL crash) and possibly execute arbitrary code via "bogus screen updates," related to missing validation of…

  • CVE-2008-2214May 14, 2008
    Castlerock
    Snmpc
    risk 0.04cvss —epss 0.09

    Stack-based buffer overflow in the Network Manager in Castle Rock Computing SNMPc 7.1 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long community string in an SNMP TRAP packet.

  • CVE-2008-2215May 14, 2008
    Project Based Calendaring System
    PBCS
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in Project-Based Calendaring System (PBCS) 0.7.1-1 allow remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to (1) src/yopy_sync.php and (2) system-logger/print_logs.php.

  • CVE-2008-2216May 14, 2008
    Project Based Calendaring System
    PBCS
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in src/yopy_upload.php in Project-Based Calendaring System (PBCS) 0.7.1 allows remote authenticated users to upload arbitrary files to tmp/uploads.

  • CVE-2008-2217May 14, 2008
    Phprojekt
    Content Management System
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in cm/graphie.php in Content Management System 0.6.1 for Phprojekt allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cm_imgpath parameter.

  • CVE-2008-2218May 14, 2008
    Nortel
    Multimedia Communication Server 5100
    risk 0.00cvss —epss 0.02

    Buffer overflow in the Multimedia PC Client in Nortel Multimedia Communication Server (MCS) before Maintenance Release 3.5.8.3 and 4.0.25.3 allows remote attackers to cause a denial of service (crash) via a flood of "extraneous" messages, as demonstrated by the Nessus "Generic…

  • CVE-2008-2219May 14, 2008
    C News.fr
    C News
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in install.php in C-News.fr C-News 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the etape parameter.

  • CVE-2008-2220May 14, 2008
    Interact
    Interact
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Interact Learning Community Environment Interact 2.4.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) CONFIG[LANGUAGE_CPATH] parameter to…

  • CVE-2008-2221May 14, 2008
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Java plugin in IBM WebSphere Application Server 5.0.2 allows untrusted applets to gain privileges via unknown attack vectors.

  • CVE-2008-2222May 14, 2008
    Eqdkp
    Eqdkp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in login.php in EQdkp 1.3.2f allows remote attackers to bypass EQdkp user authentication via the user_id parameter.

  • CVE-2008-2223May 14, 2008
    VShare
    YouTube Clone
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in group_posts.php in vShare YouTube Clone 2.6 allows remote attackers to execute arbitrary SQL commands via the tid parameter.

  • CVE-2008-2224May 14, 2008
    Sazcart
    Sazcart
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in SazCart 1.5.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) _saz[settings][site_dir] parameter to layouts/default/header.saz.php and the (2)…

  • CVE-2008-2225May 14, 2008
    Gamecms
    Gamecms Lite
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in gameCMS Lite 1.0 allows remote attackers to execute arbitrary SQL commands via the systemId parameter.

  • CVE-2008-2226May 14, 2008
    Openkm
    Openkm
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the export feature in OpenKM before 2.0 allows remote attackers to export arbitrary documents via unspecified vectors. NOTE: some of these details are obtained from third party information.

  • CVE-2008-2227May 14, 2008
    PHP-Fusion
    Forum Rank System
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in PHP-Fusion Forum Rank System 6 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the settings[locale] parameter to (1) forum.php and (2) profile.php in infusions/rank_system/. NOTE: the…

  • CVE-2008-2228May 14, 2008
    Cyberfolio
    Cyberfolio
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in portfolio/commentaires/derniers_commentaires.php in Cyberfolio 7.12, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the rep parameter.

  • CVE-2008-2189May 14, 2008
    Anserv
    Auction Xl
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in viewfaqs.php in AnServ Auction XL allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2008-2190May 14, 2008
    Online Rent
    Online Rent
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in Online Rent (aka Online Rental Property Script) 4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter. NOTE: it was later reported that 5.0 and earlier are also affected.

  • CVE-2008-2191May 14, 2008
    Postnuke
    pnEncyclopedia
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the pnEncyclopedia module 0.2.0 and earlier for PostNuke allows remote attackers to execute arbitrary SQL commands via the id parameter in a display_term action to index.php.

  • CVE-2008-2192May 14, 2008
    CMS
    狮子鱼CMS
    risk 0.03cvss —epss 0.04

    Static code injection vulnerability in box/minichat/boxpop.php in IT!CMS (aka itcms) 1.9 allows remote attackers to inject arbitrary PHP code into box/MiniChat/data/shouts.php via the shout parameter.

  • CVE-2008-2193May 14, 2008
    Scorpnews
    Scorpnews
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in example.php in Thomas Gossmann ScorpNews 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the site parameter.

  • CVE-2008-2194May 14, 2008
    Deluxebb
    Deluxebb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in forums.php in DeluxeBB 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the sort parameter.

  • CVE-2008-2195May 14, 2008
    Deluxebb
    Deluxebb
    risk 0.03cvss —epss 0.02

    Static code injection vulnerability in admincp.php in DeluxeBB 1.2 and earlier allows remote authenticated administrators to inject arbitrary PHP code into logs/cp.php via the URI.

  • CVE-2008-2196May 14, 2008
    Lifetype
    Lifetype
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin.php in LifeType 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the newBlogUserName parameter in an addBlogUser action, a different vector than CVE-2008-2178.

  • CVE-2008-2197May 14, 2008
    Miniweb HTTP Server
    blogwriter
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the blogwriter module 2.0 for Miniweb allows remote attackers to execute arbitrary SQL commands via the historymonth parameter to index.php.

  • CVE-2008-2198May 14, 2008
    Kmita
    Tellfriend
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in kmitaadmin/kmitat/htmlcode.php in Kmita Tellfriend 2.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file parameter.

  • CVE-2008-2199May 14, 2008
    Kmita
    Kmita Mail
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in kmitaadmin/kmitam/htmlcode.php in Kmita Mail 3.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file parameter.

  • CVE-2008-2200May 14, 2008
    Maianscriptworld
    Weblog
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Maian Weblog 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter to admin/index.php in a blogs search action, the (2) msg_charset and (3) msg_header9 parameters to…

  • CVE-2008-2201May 14, 2008
    Maianscriptworld
    Recipe
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in admin/inc/header.php in Maian Recipe 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) header, (2) header2, (3) header3, (4) header4, (5) header5, (6) header6, (7) header7, (8) header8, and (9)…

  • CVE-2008-2202May 14, 2008
    Maianscriptworld
    Uploader
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Maian Uploader 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter to upload/admin/index.php in a search action, the (2) msg_charset and (3) msg_header9 parameters to…

  • CVE-2008-2203May 14, 2008
    Maianscriptworld
    Search
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in search.php in Maian Search 1.1 allows remote attackers to execute arbitrary SQL commands via the keywords parameter in a search action.

  • CVE-2008-2204May 14, 2008
    Maianscriptworld
    Search
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in admin/inc/header.php in Maian Search 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) header, (2) header2, (3) header3, (4) header4, (5) header5, (6) header6, (7) header7, (8) header8, and (9)…

  • CVE-2008-2205May 14, 2008
    Maianscriptworld
    Music
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Maian Music 1.1 allows remote attackers to execute arbitrary SQL commands via the album parameter in an album action.

  • CVE-2008-2206May 14, 2008
    Maianscriptworld
    Music
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Maian Music 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter in a search action to index.php, and the (2) msg_script parameter to admin/inc/footer.php.

  • CVE-2008-2207May 14, 2008
    Maian Gallery
    Maian Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin/index.php in Maian Gallery 2.0 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a search action.

  • CVE-2008-2208May 14, 2008
    Maianscriptworld
    Greeting
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Maian Greeting 2.1 allows remote attackers to execute arbitrary SQL commands via the keywords parameter in a search action.

  • CVE-2008-2209May 14, 2008
    Maianscriptworld
    Greeting
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in admin/inc/header.php in Maian Greeting 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_script and (2) msg_script2 parameters.

  • CVE-2008-2210May 14, 2008
    Maianscriptworld
    Support
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Maian Support 1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_script, (2) msg_script2, and (3) msg_script3 parameters to admin/inc/footer.php; and the (4) msg_script2 parameter to…

  • CVE-2008-2211May 14, 2008
    Maianscriptworld
    Guestbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in admin/inc/footer.php in Maian Guestbook 3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_script2 and (2) msg_script3 parameters.

  • CVE-2008-2212May 14, 2008
    Maian Cart
    Maian Cart
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Maian Cart 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_adminheader, (2) msg_adminheader2, (3) msg_adminheader3, (4) msg_adminheader4, and unspecified other parameters to…

  • CVE-2008-2213May 14, 2008
    Maian Links
    Maian Links
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in admin/inc/footer.php in Maian Links 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_script2 and (2) msg_script3 parameters.