VYPR

CVEs

383,885 total · page 7069 of 7,678

AllCriticalHighKEV
  • CVE-2008-2093May 6, 2008
    Community Builder
    com_comprofiler
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Profiler (com_comprofiler) component in Community Builder for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the user parameter in a userProfile action to index.php.

  • CVE-2008-2094May 6, 2008
    XOOPS
    Article Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in article.php in the Article module for XOOPS allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-2095May 6, 2008
    Joomla
    Com Flippingbook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the FlippingBook (com_flippingbook) 1.0.4 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the book_id parameter.

  • CVE-2008-2005May 6, 2008
    Aveva
    Suitelink
    risk 0.04cvss —epss 0.16

    The SuiteLink Service (aka slssvc.exe) in WonderWare SuiteLink before 2.0 Patch 01, as used in WonderWare InTouch 8.0, allows remote attackers to cause a denial of service (NULL pointer dereference and service shutdown) and possibly execute arbitrary code via a large length…

  • CVE-2008-2080May 6, 2008
    Nasa
    Common Data Format
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the Read32s_64 function in src/lib/cdfread64.c in the NASA Goddard Space Flight Center Common Data Format (CDF) library before 3.2.1 allows context-dependent attackers to execute arbitrary code via a .cdf file with crafted length tags.

  • CVE-2008-2087May 6, 2008
    Softbizscripts
    Web Hosting Directory Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in search_result.php in Softbiz Web Host Directory Script, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the host_id parameter, a different vector than CVE-2005-3817.

  • CVE-2008-2088May 6, 2008
    Phpforge
    PHP Forge
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/news.php in PHP Forge 3.0 beta 2 allows remote attackers to execute arbitrary SQL commands via the id parameter in the news module to admin.php.

  • CVE-2008-2089May 6, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the SCTP protocol implementation in Sun Solaris 10 allows remote attackers to cause a denial of service (panic) via a crafted SCTP packet.

  • CVE-2008-2090May 6, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the SCTP protocol implementation in Sun Solaris 10 allows remote attackers to cause a denial of service (CPU consumption and network traffic amplification) via a crafted SCTP packet.

  • CVE-2008-0599CriMay 5, 2008
    PHP
    PHP
    risk 0.58cvss 9.8epss 0.11

    The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.

  • CVE-2008-2050May 5, 2008
    PHP
    PHP
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in the FastCGI SAPI (fastcgi.c) in PHP before 5.2.6 has unknown impact and attack vectors.

  • CVE-2008-2051May 5, 2008
    PHP
    PHP
    risk 0.00cvss —epss 0.03

    The escapeshellcmd API function in PHP before 5.2.6 has unknown impact and context-dependent attack vectors related to "incomplete multibyte chars."

  • CVE-2008-2081May 5, 2008
    Siteman
    Siteman
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in Siteman 2.0.x2 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the module parameter.

  • CVE-2008-2082May 5, 2008
    Siteman
    Siteman
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Siteman 2.0.x2 allows remote attackers to inject arbitrary web script or HTML via the module parameter, which leaks the path in an error message.

  • CVE-2008-2083May 5, 2008
    Prozilla
    Hosting Index
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in directory.php in Prozilla Hosting Index, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.

  • CVE-2008-2084May 5, 2008
    Myarticles
    Myarticles
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in topics.php in the MyArticles 0.6 beta-1 module for RunCMS allows remote attackers to execute arbitrary SQL commands via the topic_id parameter in a listarticles action.

  • CVE-2008-2072May 5, 2008
    Virtual Design Studios
    Vlbook
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Virtual Design Studio vlbook 1.21 allows remote attackers to inject arbitrary web script or HTML via the l parameter, a different vector than CVE-2006-3260.

  • CVE-2008-2073May 5, 2008
    Virtual Design Studios
    Vlbook
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in include/global.inc.php in Virtual Design Studio vlbook 1.21 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the l parameter.

  • CVE-2008-2074May 5, 2008
    Successkid
    Harris Wap Chat
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities Harris Yusuf Arifin Harris Wap Chat 1.0, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the sysFileDir parameter to (1) eng.writeMsg.php, (2) eng.adCreate.php, (3)…

  • CVE-2008-2075May 5, 2008
    Astrocam
    Astrocam
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in pic.php in AstroCam 2.5.0 through 2.7.3 allows remote attackers to inject arbitrary web script or HTML via the picfile parameter.

  • CVE-2008-2076May 5, 2008
    Actualscripts
    Actualanalyzer Lite
    risk 0.04cvss —epss 0.06

    Directory traversal vulnerability in admin.php in ActualScripts ActualAnalyzer Lite 2.78 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the style parameter.

  • CVE-2008-2077May 5, 2008
    Plain Black
    Webgui
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Plain Black WebGUI 7.4.34 has unknown impact and attack vectors related to "data form list view."

  • CVE-2008-2078May 5, 2008
    Robocode Project
    Robocode
    risk 0.00cvss —epss 0.01

    Robocode before 1.6.0 allows user-assisted remote attackers to "access the internals of the Robocode game" via unspecified vectors related to the AWT Event Queue.

  • CVE-2008-2079May 5, 2008
    MySQL
    MySQL
    risk 0.00cvss —epss 0.03

    MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are within the MySQL…

  • CVE-2008-2063May 2, 2008
    Joovili
    Joovili
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in browse.videos.php in Joovili 3.1 allows remote attackers to execute arbitrary SQL commands via the category parameter.

  • CVE-2008-2064May 2, 2008
    Phpgedview
    Phpgedview
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in PhpGedView before 4.1.5 have unknown impact and attack vectors related to "a fundamental design flaw in the interface (API) to connect phpGedView with external programs like content management systems."

  • CVE-2008-2065May 2, 2008
    Yourfreeworld
    Jokes Site Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in jokes.php in YourFreeWorld Jokes Site Script allows remote attackers to execute arbitrary SQL commands via the catagorie parameter.

  • CVE-2008-2066May 2, 2008
    Minibb
    Minibb
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in bb_admin.php in miniBB 2.2a allows remote attackers to inject arbitrary web script or HTML via the whatus parameter in a searchusers2 action. NOTE: it was later reported that other versions before 3.0.1 are also vulnerable.

  • CVE-2008-2067May 2, 2008
    Minibb
    Minibb
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in bb_admin.php in miniBB 2.2a allows remote attackers to execute arbitrary SQL commands via the whatus parameter in a searchusers2 action. NOTE: it was later reported that other versions before 3.0.1 are also vulnerable.

  • CVE-2008-2068May 2, 2008
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in WordPress 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2069May 2, 2008
    Novell
    Groupwise
    risk 0.06cvss —epss 0.33

    Buffer overflow in Novell GroupWise 7 allows remote attackers to cause a denial of service or execute arbitrary code via a long argument in a mailto: URI.

  • CVE-2008-2052MedMay 2, 2008
    Bitrix
    Bitrix Site Manager
    risk 0.40cvss 6.1epss 0.02

    Open redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter.

  • CVE-2008-1294May 2, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Linux kernel 2.6.17, and other versions before 2.6.22, does not check when a user attempts to set RLIMIT_CPU to 0 until after the change is made, which allows local users to bypass intended resource limits.

  • CVE-2008-1375May 2, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Race condition in the directory notification subsystem (dnotify) in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1, allows local users to cause a denial of service (OOPS) and possibly gain privileges via unspecified vectors.

  • CVE-2008-1675May 2, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The bdx_ioctl_priv function in the tehuti driver (tehuti.c) in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory.

  • CVE-2007-6339May 1, 2008
    Akamai
    Download Manager
    risk 0.01cvss —epss 0.11

    The Akamai Download Manager (aka DLM or dlmanager) ActiveX control (DownloadManagerV2.ocx) before 2.2.3.5 allows remote attackers to force the download and execution of arbitrary code via unspecified "undocumented object parameters."

  • CVE-2008-1381May 1, 2008
    Zoneminder
    Zoneminder
    risk 0.00cvss —epss 0.03

    ZoneMinder before 1.23.3 allows remote authenticated users, and possibly unauthenticated attackers in some installations, to execute arbitrary commands via shell metacharacters in a crafted URL.

  • CVE-2008-2043May 1, 2008
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in cPanel, possibly 11.18.3 and 11.19.3, allow remote attackers to (1) execute arbitrary code via the command1 parameter to frontend/x2/cron/editcronsimple.html, and perform various administrative actions via (2)…

  • CVE-2008-2044May 1, 2008
    Netoffice
    Dwins
    risk 0.04cvss —epss 0.11

    includes/library.php in netOffice Dwins 1.3 p2 compares the demoSession variable to the 'true' string literal instead of the true boolean literal, which allows remote attackers to bypass authentication and execute arbitrary code by setting this variable to 1, as demonstrated by…

  • CVE-2008-2045May 1, 2008
    Sugarcrm
    Sugarcrm
    risk 0.03cvss —epss 0.05

    Absolute path traversal vulnerability in SugarCRM Sugar Community Edition 4.5.1 and 5.0.0 allows remote attackers to read arbitrary files via a full path in the URL parameter to modules/Feeds/Feed.php, which places the contents into a related cache file in the .cache/feeds…

  • CVE-2008-2046May 1, 2008
    Softpedia
    Sitexs CMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Softpedia SiteXS CMS 0.1.1 Pre-Alpha allows remote attackers to inject arbitrary web script or HTML via the user parameter.

  • CVE-2008-2047May 1, 2008
    Angelo Emlak
    Angelo-Emlak
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Angelo-Emlak 1.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) hpz/profil.asp and (2) hpz/prodetail.asp.

  • CVE-2008-2048May 1, 2008
    Angelo Emlak
    Angelo-Emlak
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in hpz/admin/Default.asp in Angelo-Emlak 1.0 allows remote attackers to inject arbitrary web script or HTML via the sayfa parameter.

  • CVE-2008-2049May 1, 2008
    E Post Corporation
    Mail Server
    risk 0.00cvss —epss 0.01

    The POP3 server (EPSTPOP3S.EXE) 4.22 in E-Post Mail Server 4.10 allows remote attackers to obtain sensitive information via multiple crafted APOP commands for a known POP3 account, which displays the password in a POP3 error message.

  • CVE-2008-2028Apr 30, 2008
    Minibb
    Minibb
    risk 0.03cvss —epss 0.02

    miniBB 2.2, and possibly earlier, when register_globals is enabled, allows remote attackers to obtain the full path via a direct request to the glang parameter in a registernew action to index.php, which leaks the path in an error message.

  • CVE-2008-2029Apr 30, 2008
    Minibb
    Minibb
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in (1) setup_mysql.php and (2) setup_options.php in miniBB 2.2 and possibly earlier, when register_globals is enabled, allow remote attackers to execute arbitrary SQL commands via the xtr parameter in a userinfo action to index.php.

  • CVE-2008-2030Apr 30, 2008
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in installControl.php3 in F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 and 6.0-6.2 allows remote attackers to inject arbitrary web script or HTML via the query string. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2008-2031Apr 30, 2008
    Vicftps
    Vicftps
    risk 0.07cvss —epss 0.46

    VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a crafted LIST command, which triggers a NULL pointer dereference. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-2032Apr 30, 2008
    Acritum
    Femitter Server
    risk 0.03cvss —epss 0.03

    The FTP service in Acritum Femitter Server 1.03 allows remote attackers to cause a denial of service (crash) by sending multiple crafted RETR commands. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-2034Apr 30, 2008
    WordPress
    Download Monitor
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in wp-download_monitor/download.php in the Download Monitor 2.0.6 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained…