VYPR

CVEs

383,884 total · page 7071 of 7,678

AllCriticalHighKEV
  • CVE-2008-1994Apr 27, 2008
    Acon
    Acon
    risk 0.00cvss —epss 0.00

    Multiple stack-based buffer overflows in (a) acon.c, (b) menu.c, and (c) child.c in Acon 1.0.5-5 through 1.0.5-7 allow local users to execute arbitrary code via (1) a long HOME environment variable or (2) a large number of terminal columns.

  • CVE-2008-1976Apr 27, 2008
    Drupal
    Internationalization
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Drupal modules (1) Internationalization (i18n) 5.x before 5.x-2.3 and 5.x-1.1 and 6.x before 6.x-1.0 beta 1; and (2) Localizer 5.x before 5.x-3.4, 5.x-2.1, and 5.x-1.11; allow remote attackers to inject arbitrary web…

  • CVE-2008-1977Apr 27, 2008
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Internationalization (i18n) Drupal module 5.x before 5.x-2.3 and 5.x-1.1, and 6.x before 6.x-1.0 beta 1, allows remote attackers to change node translation relationships via unspecified vectors.

  • CVE-2008-1978Apr 27, 2008
    Drupal
    Ubercart Module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Ubercart 5.x before 5.x-1.0 rc3 module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via node titles related to unspecified product features, a different vector than CVE-2008-1428.

  • CVE-2008-1979Apr 27, 2008
    Ca
    ARCserve Backup
    risk 0.03cvss —epss 0.04

    The Discovery Service (casdscvc) in CA ARCserve Backup 12.0.5454.0 and earlier allows remote attackers to cause a denial of service (crash) via a packet with a large integer value used in an increment to TCP port 41523, which triggers a buffer over-read.

  • CVE-2008-1980Apr 27, 2008
    Drupal
    E Publish
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in E-Publish 5.x before 5.x-1.1 and 6.x before 6.x-1.0 beta1, a Drupal module, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-1981Apr 27, 2008
    Drupal
    E Publish
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in E-Publish 5.x before 5.x-1.1 and 6.x before 6.x-1.0 beta1, a Drupal module, allows remote attackers to perform unauthorized actions as other users via unspecified vectors.

  • CVE-2008-1982Apr 27, 2008
    WordPress
    Wpss
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in ss_load.php in the Spreadsheet (wpSS) 0.6 and earlier plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the ss_id parameter.

  • CVE-2008-1983Apr 27, 2008
    Advanced Electron Forum
    Advanced Electron Forum
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Advanced Electron Forum (AEF) 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the beg parameter in a members action to index.php.

  • CVE-2008-1984Apr 27, 2008
    Ca
    Etrust Secure Content Manager
    risk 0.00cvss —epss 0.03

    The eTrust Common Services (Transport) Daemon (eCSqdmn) in CA Secure Content Manager 8.0.28000.511 and earlier allows remote attackers to cause a denial of service (crash or CPU consumption) via a malformed packet to TCP port 1882.

  • CVE-2008-1974Apr 27, 2008
    Horde (software)
    Groupware
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and Groupware 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the url parameter.

  • CVE-2008-1975Apr 27, 2008
    E RESERV
    E-RESERV
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in E-RESERV 2.1 allows remote attackers to execute arbitrary SQL commands via the ID_loc parameter.

  • CVE-2008-1966Apr 27, 2008
    IBM
    Db2
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allow remote authenticated users to cause a denial of service (instance crash) via a call to the (1) RECOVERJAR or (2)…

  • CVE-2008-1967Apr 27, 2008
    Cezannesw
    Cezanne
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in CFLogon/CFLogon.asp in Cezanne 6.5.1 and 7 allows remote attackers to inject arbitrary web script or HTML via the SleUserName parameter.

  • CVE-2008-1968Apr 27, 2008
    Cezannesw
    Cezanne
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Cezanne 7 allow remote authenticated users to execute arbitrary SQL commands via the FUNID parameter to (1) CFLookup.asp and (2) CznCommon/CznCustomContainer.asp.

  • CVE-2008-1969Apr 27, 2008
    Cezannesw
    Cezanne
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Cezanne 6.5.1 and 7 allow remote attackers to inject arbitrary web script or HTML via the (1) LookUPId and (2) CbFun parameters to (a) CFLookUP.asp; (3) TitleParms, (4) WidgetsHeights, (5) WidgetsLinks, and (6) WidgetsTitles…

  • CVE-2008-1970Apr 27, 2008
    Mucommander
    Mucommander
    risk 0.00cvss —epss 0.00

    muCommander before 0.8.2 stores credentials.xml with insecure permissions, which allows local users to obtain credentials.

  • CVE-2008-1971Apr 27, 2008
    PhShoutBox
    phShoutBox
    risk 0.03cvss —epss 0.02

    phShoutBox Final 1.5 and earlier only checks passwords when specified in $_POST, which allows remote attackers to gain privileges by setting the (1) phadmin cookie to admin.php, or (2) in 1.4 and earlier, the ssbadmin cookie to shoutadmin.php.

  • CVE-2008-1972Apr 27, 2008
    Exponent
    Exponentcms
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the user account creation feature in Exponent CMS 0.96.6-GA20071003 and earlier, when the Allow Registration? configuration option is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1)…

  • CVE-2008-1973Apr 27, 2008
    SubEdit Player
    SubEdit Player
    risk 0.03cvss —epss 0.06

    Heap-based buffer overflow in SubEdit Player build 4056 and 4066 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long subtitle file.

  • CVE-2008-0712Apr 25, 2008
    Microfocus
    Software Update
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the HP HPeDiag (aka eSupportDiagnostics) ActiveX control in hpediag.dll in HP Software Update 4.000.009.002 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors. NOTE: this might…

  • CVE-2008-1953Apr 25, 2008
    Magnolia
    Site Designer
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Sitedesigner before 1.1.5 search template in Magnolia Enterprise Edition allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2008-1954Apr 25, 2008
    Webcalendar
    Web Calendar Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in one_day.php in Web Calendar Pro 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the user_id parameter.

  • CVE-2008-1955Apr 25, 2008
    Toocharger
    Myboard
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in rep.php in Martin BOUCHER MyBoard 1.0.12 allows remote attackers to inject arbitrary web script or HTML via the id parameter. information.

  • CVE-2008-1956Apr 25, 2008
    Wikepage
    Opus
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Wikepage Opus 13 2007.2 allows remote attackers to inject arbitrary web script or HTML via the wiki parameter.

  • CVE-2008-1957Apr 25, 2008
    Tr Script
    News
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.php in Tr Script News 2.1 allows remote attackers to execute arbitrary SQL commands via the nb parameter in voir mode.

  • CVE-2008-1958Apr 25, 2008
    Tr Script
    News
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in the ajout_cat mode in admin/main.php in Tr Script News 2.1 allows remote authenticated users to execute arbitrary code by uploading a file with a .php extension.

  • CVE-2008-1959Apr 25, 2008
    Sipp
    Sipp
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in the get_remote_video_port_media function in call.cpp in SIPp 3.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted SIP message. NOTE: some of these details are obtained from third party…

  • CVE-2008-1960Apr 25, 2008
    Contray
    Contray
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cgi-bin/contray/search.cgi in ContRay 3.x allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-1961Apr 25, 2008
    Voice Of Web
    AllMyGuests
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Voice Of Web AllMyGuests 0.4.1 allows remote attackers to execute arbitrary SQL commands via the AMG_id parameter in a comments action.

  • CVE-2008-1962Apr 25, 2008
    Aterr
    Aterr
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in Aterr 0.9.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) class parameter to include/functions.inc.php and the (2) file parameter to include/common.inc.php.

  • CVE-2008-1963Apr 25, 2008
    Quate
    Grape Web Statistics
    risk 0.06cvss —epss 0.39

    PHP remote file inclusion vulnerability in includes/functions.php in Quate Grape Web Statistics 0.2a allows remote attackers to execute arbitrary PHP code via a URL in the location parameter.

  • CVE-2008-1964Apr 25, 2008
    Xine
    Xine Lib
    risk 0.00cvss —epss 0.02

    Stack-based buffer overflow in the demux_nsf_send_headers function in src/demuxers/demux_nsf.c in xine-lib allows remote attackers to have an unknown impact via a long copyright field in an NSF header in an NES Sound file, a different issue than CVE-2008-1878. NOTE: a third…

  • CVE-2008-1965Apr 25, 2008
    IBM
    Lotus Symphony
    risk 0.04cvss —epss 0.11

    Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1 and 6.1.2, as used by Lotus Symphony and possibly other products, allows remote attackers to execute arbitrary code by injecting a -launcher option via a cai:…

  • CVE-2008-1768Apr 25, 2008
    VideoLAN
    Vlc
    risk 0.00cvss —epss 0.03

    Multiple integer overflows in VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via the (1) MP4 demuxer, (2) Real demuxer, and (3) Cinepak codec, which triggers a buffer overflow.

  • CVE-2008-1769Apr 25, 2008
    VideoLAN
    Vlc
    risk 0.04cvss —epss 0.07

    VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via a crafted Cinepak file that triggers an out-of-bounds array access and memory corruption.

  • CVE-2008-1931Apr 25, 2008
    Realtek
    Hd Audio Codec Drivers
    risk 0.00cvss —epss 0.00

    Realtek HD Audio Codec Drivers RTKVHDA.sys and RTKVHDA64.sys before 6.0.1.5605 on Windows Vista allow local users to create, write, and read registry keys via a crafted IOCTL request.

  • CVE-2008-1932Apr 25, 2008
    Realtek
    Hd Audio Codec Drivers
    risk 0.00cvss —epss 0.01

    Integer overflow in Realtek HD Audio Codec Drivers RTKVHDA.sys and RTKVHDA64.sys before 6.0.1.5605 on Windows Vista allows local users to execute arbitrary code via a crafted IOCTL request.

  • CVE-2008-1933Apr 25, 2008
    Zune
    Zune
    risk 0.04cvss —epss 0.14

    Absolute path traversal vulnerability in a certain ActiveX control in Zune allows user-assisted remote attackers to overwrite arbitrary files via the SaveToFile method. NOTE: the victim must explicitly allow the code to run.

  • CVE-2008-1934Apr 25, 2008
    Crazy Goomba
    Crazy Goomba
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in commentaires.php in Crazy Goomba 1.2.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-1935Apr 25, 2008
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Filiale 1.0.4 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the idFiliale parameter.

  • CVE-2008-1936Apr 25, 2008
    Classifieds Caffe
    Classifieds Caffe
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Classifieds Caffe allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in an add action. NOTE: this issue might be site-specific.

  • CVE-2008-1937Apr 25, 2008
    Moinmo
    Moinmoin
    risk 0.00cvss —epss 0.02

    The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.

  • CVE-2008-1938Apr 25, 2008
    Sony
    Mylo Com 2
    risk 0.00cvss —epss 0.01

    Sony Mylo COM-2 Japanese model firmware before 1.002 does not properly verify web server SSL certificates, which allows remote attackers to obtain sensitive information and conduct spoofing attacks.

  • CVE-2008-1939Apr 25, 2008
    Yigit Aybuga
    Philboard
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in W1L3D4 Philboard 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) topic parameters to (a) philboard_reply.asp, and the (3) forumid parameter to (b) philboard_newtopic.asp, different vectors than…

  • CVE-2008-1940Apr 25, 2008
    Grsecurity
    grsecurity
    risk 0.00cvss —epss 0.00

    The RBAC functionality in grsecurity before 2.1.11-2.6.24.5 and 2.1.11-2.4.36.2 does not enforce user_transition_deny and user_transition_allow rules for the (1) sys_setfsuid and (2) sys_setfsgid calls, which allows local users to bypass restrictions for those calls.

  • CVE-2008-1941Apr 25, 2008
    Akiva
    Webboard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the profile update feature in Akiva WebBoard 8.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in the form field. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2008-1942Apr 25, 2008
    Foxitsoftware
    Reader
    risk 0.00cvss —epss 0.04

    Foxit Reader 2.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PDF file with (1) a malformed ExtGState resource containing a /Font resource, or (2) an XObject resource with a Rotate setting, which triggers memory…

  • CVE-2008-1925Apr 24, 2008
    Inspircd
    Inspircd
    risk 0.00cvss —epss 0.02

    Buffer overflow in InspIRCd before 1.1.18, when using the namesx and uhnames modules, allows remote attackers to cause a denial of service (daemon crash) via a large number of channel users with crafted nicknames, idents, and long hostnames.

  • CVE-2008-1926Apr 24, 2008
    util-linux
    util-linux
    risk 0.00cvss —epss 0.04

    Argument injection vulnerability in login (login-utils/login.c) in util-linux-ng 2.14 and earlier makes it easier for remote attackers to hide activities by modifying portions of log events, as demonstrated by appending an "addr=" statement to the login name, aka "audit log…