VYPR

CVEs

383,885 total · page 7067 of 7,678

AllCriticalHighKEV
  • CVE-2007-5803May 13, 2008
    Nagios
    Nagios
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in CGI programs in Nagios before 2.12 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2007-5624 and CVE-2008-1360.

  • CVE-2008-1922May 13, 2008
    Sarg
    Sarg
    risk 0.00cvss —epss 0.04

    Multiple stack-based buffer overflows in Sarg might allow attackers to execute arbitrary code via unknown vectors, probably a crafted Squid log file.

  • CVE-2008-0119May 13, 2008
    Microsoft
    Office
    risk 0.02cvss —epss 0.31

    Unspecified vulnerability in Microsoft Publisher in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 SP1 and earlier allows remote attackers to execute arbitrary code via a Publisher file with crafted object header data that triggers memory corruption, aka "Publisher Object…

  • CVE-2008-1091May 13, 2008
    Microsoft
    Office
    risk 0.03cvss —epss 0.41

    Unspecified vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows remote attackers to execute arbitrary code via a Rich Text Format (.rtf) file with a malformed string that triggers a "memory calculation error"…

  • CVE-2008-1434May 13, 2008
    Microsoft
    Office
    risk 0.02cvss —epss 0.31

    Use-after-free vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows remote attackers to execute arbitrary code via an HTML document with a large number of Cascading Style Sheets (CSS) selectors, related to a…

  • CVE-2008-1437May 13, 2008
    Microsoft
    Malware Protection Engine
    risk 0.01cvss —epss 0.13

    Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (engine hang and restart) via a crafted file, a different…

  • CVE-2008-1438May 13, 2008
    Microsoft
    Malware Protection Engine
    risk 0.01cvss —epss 0.13

    Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (disk space exhaustion) via a file with "crafted data structures"…

  • CVE-2008-2169HigMay 13, 2008
    Avici
    Router
    risk 0.49cvss 7.5epss 0.01

    Unspecified vulnerability in Avici routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.

  • CVE-2008-2170HigMay 13, 2008
    Century
    routers
    risk 0.49cvss 7.5epss 0.01

    Unspecified vulnerability in Century routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.

  • CVE-2008-2171May 13, 2008
    Alaxala
    Ax Router
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in AlaxalA AX routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.

  • CVE-2008-2172May 13, 2008
    Hitachi
    GR routers
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Hitachi GR routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.

  • CVE-2008-2173HigMay 13, 2008
    Yamaha
    Router
    risk 0.49cvss 7.5epss 0.01

    Unspecified vulnerability in Yamaha routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.

  • CVE-2008-2174May 13, 2008
    Robin Rawson-Tetley
    Animal Shelter Manager
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Robin Rawson-Tetley Animal Shelter Manager (ASM) before 2.2.2 have unknown impact and attack vectors, related to "various areas where security was missing."

  • CVE-2008-2175May 13, 2008
    Gamma Scripts
    Blogme PHP
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in comments.php in Gamma Scripts BlogMe PHP 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-2176May 13, 2008
    Zomplog
    Zomplog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin/category.php in Zomplog 3.8.2 allows remote attackers to inject arbitrary web script or HTML via the catname parameter.

  • CVE-2008-2177May 13, 2008
    Phpdirectorysource
    Phpdirectorysource
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in phpDirectorySource 1.1.06, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) lid parameter to show.php and the (2) login parameter to admin.php.

  • CVE-2008-2178May 13, 2008
    Lifetype
    Lifetype
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin.php in LifeType 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the searchTerms parameter in an editArticleCategories operation (aka an admin category search).

  • CVE-2008-2179May 13, 2008
    Sysaid
    Sysaid
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in SystemList.jsp in SysAid 5.1.08 allows remote attackers to inject arbitrary web script or HTML via the searchField parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-2180May 13, 2008
    Cplinks
    Cplinks
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in cpLinks 1.03, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) admin_username parameter (aka the username field) to admin/index.php and the (2) search_text and (3) search_category…

  • CVE-2008-2181May 13, 2008
    Cplinks
    Cplinks
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in search.php in cpLinks 1.03 allow remote attackers to inject arbitrary web script or HTML via the (1) search_text and (2) search_category parameters. NOTE: the XSS reportedly occurs in a forced SQL error message. NOTE: some…

  • CVE-2008-2182May 13, 2008
    TYPO3
    powermail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the powermail extension before 1.1.10 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2183May 13, 2008
    Smartblog
    Smartblog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to execute arbitrary SQL commands via the idt parameter.

  • CVE-2008-2184May 13, 2008
    Smartblog
    Smartblog
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in SMartBlog (aka SMBlog) 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) mois, (2) an, (3) jour, and (4) id parameters to index.php, and the (5) login parameter to gestion/logon.php, different vectors than…

  • CVE-2008-2185May 13, 2008
    Smartblog
    Smartblog
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to include arbitrary local files via directory traversal sequences in the page parameter. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2008-2186May 13, 2008
    Chilkat Software
    Chicomas
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in index.php in Chilek Content Management System (aka ChiCoMaS) 2.0.4 allows remote attackers to inject arbitrary web script or HTML via the q parameter.

  • CVE-2008-2187May 13, 2008
    MJGuest
    MJGuest
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in mjguest.php in Mjguest 6.7 GT Rev.01 allows remote attackers to inject arbitrary web script or HTML via the level parameter in a redirect action, possibly involving interface/redirect.htm.php.

  • CVE-2008-2188May 13, 2008
    Eejj33
    Blackbook
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in EJ3 BlackBook 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) bookCopyright and (2) ver parameters to (a) footer.php, and the (3) bookName, (4) bookMetaTags, and (5) estiloCSS parameters to (b)…

  • CVE-2008-2168May 13, 2008
    Apache
    Apache
    risk 0.07cvss —epss 0.55

    Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.

  • CVE-2008-0322HigMay 13, 2008
    Microsoft
    Windows Xp
    risk 0.51cvss 7.8epss 0.02

    The I2O Utility Filter driver (i2omgmt.sys) 5.1.2600.2180 for Microsoft Windows XP sets Everyone/Write permissions for the "\\.\I2OExc" device interface, which allows local users to gain privileges. NOTE: this issue can be leveraged to overwrite arbitrary memory and execute…

  • CVE-2008-0713May 13, 2008
    HP UX
    FTP server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the FTP server for HP-UX B.11.11, B.11.23, and B.11.31 allows remote authenticated users to cause a denial of service (FTP server outage) via unknown attack vectors.

  • CVE-2008-2166May 13, 2008
    Sun Corporation
    Java System Web Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the search module in Sun Java System Web Server 6.1 before SP9 and 7.0 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unknown parameters in index.jsp.

  • CVE-2008-2167May 13, 2008
    Zyxel
    Zywall 100
    risk 0.04cvss —epss 0.17

    Cross-site scripting (XSS) vulnerability in ZyXEL ZyWALL 100 allows remote attackers to inject arbitrary web script or HTML via the Referer header, which is not properly handled in a 404 Error page.

  • CVE-2008-0166HigMay 13, 2008
    OpenSSL Project
    OpenSSL
    risk 0.50cvss 7.5epss 0.71

    OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.

  • CVE-2008-2163May 13, 2008
    IBM
    Lotus Quickr
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Lotus Quickr 8.1 before Hotfix 5 for Windows and AIX, and before Hotfix 3 for i5/OS, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to "WYSIWYG editors."

  • CVE-2008-1803May 12, 2008
    Rdesktop
    Rdesktop
    risk 0.01cvss —epss 0.07

    Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original…

  • CVE-2008-2004May 12, 2008
    QEMU
    Qemu
    risk 0.00cvss —epss 0.01

    The drive_init function in QEMU 0.9.1 determines the format of a raw disk image based on the header, which allows local guest users to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted.

  • CVE-2008-2159May 12, 2008
    Microsoft
    Internet Explorer
    risk 0.00cvss —epss 0.02

    Microsoft Internet Explorer 7 can save encrypted pages in the cache even when the DisableCachingOfSSLPages registry setting is enabled, which might allow local users to obtain sensitive information.

  • CVE-2008-2160May 12, 2008
    Microsoft
    Windows CE
    risk 0.01cvss —epss 0.18

    Multiple unspecified vulnerabilities in the JPEG (GDI+) and GIF image processing in Microsoft Windows CE 5.0 allow remote attackers to execute arbitrary code via crafted (1) JPEG and (2) GIF images.

  • CVE-2008-2161May 12, 2008
    TFTP
    TFTP Server Sp
    risk 0.08cvss —epss 0.65

    Buffer overflow in TFTP Server SP 1.4 and 1.5 on Windows, and possibly other versions, allows remote attackers to execute arbitrary code via a long TFTP error packet. NOTE: some of these details are obtained from third party information.

  • CVE-2008-2162May 12, 2008
    SonicWall
    Email Security
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in SonicWall Email Security 6.1.1 allows remote attackers to inject arbitrary web script or HTML via the Host header in a request to a non-existent web page, which is not properly sanitized in an error page.

  • CVE-2008-2148May 12, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The utimensat system call (sys_utimensat) in Linux kernel 2.6.22 and other versions before 2.6.25.3 does not check file permissions when certain UTIME_NOW and UTIME_OMIT combinations are used, which allows local users to modify file times of arbitrary files, possibly leading to…

  • CVE-2008-2149May 12, 2008
    Wordnet
    Wordnet
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the searchwn function in Wordnet 2.0, 2.1, and 3.0 might allow context-dependent attackers to execute arbitrary code via a long command line option. NOTE: this issue probably does not cross privilege boundaries except in cases in which Wordnet is…

  • CVE-2008-2146May 12, 2008
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access restrictions for certain pages.

  • CVE-2008-2147May 12, 2008
    VideoLAN
    Vlc
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in VideoLAN VLC before 0.9.0 allows local users to execute arbitrary code via a malicious library under the modules/ or plugins/ subdirectories of the current working directory.

  • CVE-2008-2142May 12, 2008
    GNU
    Emacs
    risk 0.00cvss —epss 0.04

    Emacs 21 and XEmacs automatically load and execute .flc (fast lock) files that are associated with other files that are edited within Emacs, which allows user-assisted attackers to execute arbitrary code.

  • CVE-2008-2143May 12, 2008
    Microsoft
    Outlook Web Access
    risk 0.00cvss —epss 0.02

    Unspecified versions of Microsoft Outlook Web Access (OWA) use the Cache-Control: no-cache HTTP directive instead of no-store, which might cause web browsers that follow RFC-2616 to cache sensitive information.

  • CVE-2008-2144May 12, 2008
    Sun Corporation
    Solaris
    risk 0.01cvss —epss 0.16

    Multiple unspecified vulnerabilities in Solaris print service for Sun Solaris 8, 9, and 10 allow remote attackers to cause a denial of service or execute arbitrary code via unknown vectors.

  • CVE-2008-2145May 12, 2008
    Novell
    Client
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in Novell Client 4.91 SP4 and earlier allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long username in the "forgotten password" dialog.

  • CVE-2008-2139May 12, 2008
    Rpath
    Appliance Platform Agent
    risk 0.00cvss —epss 0.00

    The rootpw plugin in rPath Appliance Platform Agent 2 and 3 does not re-validate requests from a browser with a valid administrator session, including requests to change the password, which makes it easier for physically proximate attackers to gain privileges and maintain…

  • CVE-2008-2140May 12, 2008
    Rpath
    Appliance Platform Agent
    risk 0.00cvss —epss 0.00

    Cross-site request forgery (CSRF) vulnerability in the rootpw plugin in rPath Appliance Platform Agent 2 and 3 allows remote attackers to reset the root password as the administrator via a crafted URL.