VYPR

CVEs

383,882 total · page 7073 of 7,678

AllCriticalHighKEV
  • CVE-2008-1885Apr 18, 2008
    Cdnetworks
    Nefficient Download
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in the NeffyLauncher 1.0.5 ActiveX control (NeffyLauncher.dll) in CDNetworks Nefficient Download allows remote attackers to download arbitrary code onto a client system via a .. (dot dot) in the SkinPath parameter and a .zip URL in the HttpSkin…

  • CVE-2008-1886Apr 18, 2008
    Cdnetworks
    NeffyLauncher
    risk 0.04cvss —epss 0.07

    The NeffyLauncher 1.0.5 ActiveX control (NeffyLauncher.dll) in CDNetworks Nefficient Download uses weak cryptography for a KeyCode that blocks unauthorized use of the control, which allows remote attackers to bypass this protection mechanism by calculating the required KeyCode. …

  • CVE-2008-1881Apr 17, 2008
    VideoLAN
    Vlc
    risk 0.04cvss —epss 0.12

    Stack-based buffer overflow in the ParseSSA function (modules/demux/subtitle.c) in VLC 0.8.6e allows remote attackers to execute arbitrary code via a long subtitle in an SSA file. NOTE: this issue is due to an incomplete fix for CVE-2007-6681.

  • CVE-2007-6714Apr 17, 2008
    Dbmail
    Dbmail
    risk 0.00cvss —epss 0.02

    DBMail before 2.2.9, when using authldap with an LDAP server that supports anonymous login such as Active Directory, allows remote attackers to bypass authentication via an empty password, which causes the LDAP bind to indicate success based on anonymous authentication.

  • CVE-2007-6715Apr 17, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla Firefox allows remote attackers to cause a denial of service (crash) via crafted image, as demonstrated by the zzuf lol-firefox.gif test case.

  • CVE-2008-1878Apr 17, 2008
    Xine
    Xine Lib
    risk 0.04cvss —epss 0.15

    Stack-based buffer overflow in the demux_nsf_send_chunk function in src/demuxers/demux_nsf.c in xine-lib 1.1.12 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long NSF title.

  • CVE-2007-5745Apr 17, 2008
    Openoffice
    Openoffice
    risk 0.00cvss —epss 0.04

    Multiple heap-based buffer overflows in OpenOffice.org before 2.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Quattro Pro (QPRO) file with crafted (1) Attribute and (2) Font Description records.

  • CVE-2007-5746Apr 17, 2008
    Openoffice
    Openoffice
    risk 0.00cvss —epss 0.05

    Integer overflow in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an EMF file with a crafted EMR_STRETCHBLT record, which triggers a heap-based buffer overflow.

  • CVE-2007-5747Apr 17, 2008
    Openoffice
    Openoffice
    risk 0.00cvss —epss 0.04

    Integer underflow in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Quattro Pro (QPRO) file with crafted values that trigger an excessive loop and a stack-based buffer overflow.

  • CVE-2008-0320Apr 17, 2008
    Openoffice
    Openoffice
    risk 0.08cvss —epss 0.57

    Heap-based buffer overflow in the OLE importer in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an OLE file with a crafted DocumentSummaryInformation stream.

  • CVE-2008-1024Apr 17, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    Apple Safari before 3.1.1, when running on Windows XP or Vista, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file download with a crafted file name, which triggers memory corruption.

  • CVE-2008-1025Apr 17, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Apple WebKit, as used in Safari before 3.1.1, allows remote attackers to inject arbitrary web script or HTML via a crafted URL with a colon in the hostname portion.

  • CVE-2008-1026Apr 17, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.05

    Integer overflow in the PCRE regular expression compiler (JavaScriptCore/pcre/pcre_compile.cpp) in Apple WebKit, as used in Safari before 3.1.1, allows remote attackers to execute arbitrary code via a regular expression with large, nested repetition counts, which triggers a…

  • CVE-2008-1380Apr 17, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The JavaScript engine in Mozilla Firefox before 2.0.0.14, Thunderbird before 2.0.0.14, and SeaMonkey before 1.1.10 allows remote attackers to cause a denial of service (garbage collector crash) and possibly have other impacts via a crafted web page. NOTE: this is due to an…

  • CVE-2008-1860Apr 17, 2008
    Lokicms
    Lokicms
    risk 0.03cvss —epss 0.03

    Static code injection vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to inject arbitrary PHP code into includes/Config.php via the default parameter.

  • CVE-2008-1861Apr 17, 2008
    Exbb
    Exbb Italia
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in modules/threadstop/threadstop.php in ExBB Italia 0.22 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the…

  • CVE-2008-1862Apr 17, 2008
    Exbb
    Exbb Italia
    risk 0.03cvss —epss 0.03

    ExBB Italia 0.22 and earlier only checks GET requests that use the QUERY_STRING for certain path manipulations, which allows remote attackers to bypass this check via (1) POST or (2) COOKIE variables, a different vector than CVE-2006-4488. NOTE: this can be leveraged to conduct…

  • CVE-2008-1863Apr 17, 2008
    Prozilla
    Cheats
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in view_reviews.php in Prozilla Cheat Script (aka Cheats) 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-1864Apr 17, 2008
    Prozilla
    Prozilla Freelancers
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in project.php in Prozilla Freelancers allows remote attackers to execute arbitrary SQL commands via the project parameter.

  • CVE-2008-1865Apr 17, 2008
    Openmosix Project
    Openmosix
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in the msx_readnode function in libmosix.c in openmosix-tools (aka userspace-tools) in openMosix might allow local users to cause a denial of service (application crash) via a third-party program that calls this function with a long item argument. …

  • CVE-2008-1866Apr 17, 2008
    Pixel Motion
    Blog
    risk 0.03cvss —epss 0.05

    admin/modif_config.php in Blog Pixel Motion (aka PixelMotion) does not require admin authentication, which allows remote authenticated users to upload arbitrary PHP scripts in a ZIP archive, which is written to templateZip/ and then automatically extracted under templates/ for…

  • CVE-2008-1867Apr 17, 2008
    Pixel Motion
    Blog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Blog Pixel Motion (aka Blog PixelMotion) allows remote attackers to execute arbitrary SQL commands via the categorie parameter to index.php, possibly related to include/requetesIndex.php.

  • CVE-2008-1868Apr 17, 2008
    Pixel Motion
    Blog
    risk 0.03cvss —epss 0.03

    admin/sauvBase.php in Blog Pixel Motion (aka Blog PixelMotion) does not require authentication, which allows remote attackers to trigger a database backup dump, and obtain the resulting blogPM.sql file that contains sensitive information.

  • CVE-2008-1869Apr 17, 2008
    Site Sift
    Listings
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Site Sift Listings allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php. NOTE: this issue might be site-specific.

  • CVE-2008-1870Apr 17, 2008
    PIGMy-SQL
    PIGMy-SQL
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in getdata.php in PIGMy-SQL 1.4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-1871Apr 17, 2008
    Scriptsagent
    Links Directory
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in links.php in Scriptsagent.com Links Directory 1.1 allows remote authenticated users to execute arbitrary SQL commands via the cat_id parameter in a list action.

  • CVE-2008-1872Apr 17, 2008
    Comdev
    Comdev News Publisher
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in home.news.php in Comdev News Publisher 4.1.2 allows remote attackers to execute arbitrary SQL commands via the arcmonth parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2008-1873Apr 17, 2008
    Nuke ET
    Nuke ET
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the private message feature in Nuke ET 3.2 and 3.4, when using Internet Explorer, allows remote authenticated users to inject arbitrary web script or HTML via a CSS property in the STYLE attribute of a DIV element in the mensaje…

  • CVE-2008-1874Apr 17, 2008
    Xpoze
    Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in account/user/mail.html in Xpoze Pro 3.05 and earlier allows remote authenticated users to execute arbitrary SQL commands via the reed parameter.

  • CVE-2008-1875Apr 17, 2008
    Terong
    Advanced Web Photo Gallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Terong PHP Photo Gallery (aka Advanced Web Photo Gallery) 1.0 allows remote attackers to execute arbitrary SQL commands via the photo_id parameter.

  • CVE-2008-1876Apr 17, 2008
    VisualPic
    VisualPic
    risk 0.05cvss —epss 0.28

    PHP remote file inclusion vulnerability in index.php in VisualPic 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the _CONFIG[files][functions_page] parameter.

  • CVE-2008-1877Apr 17, 2008
    Tss
    tss
    risk 0.00cvss —epss 0.00

    tss 0.8.1 allows local users to read arbitrary files via the -a parameter, which is processed while tss is running with privileges.

  • CVE-2007-6713Apr 16, 2008
    Flip4mac
    Flip4mac Wmv
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Flip4Mac WMV before 2.2.0.49 has unknown impact and attack vectors related to malformed WMV files.

  • CVE-2008-1854Apr 16, 2008
    SmarterMail
    SmarterMail
    risk 0.03cvss —epss 0.03

    Unspecified vulnerability in SmarterMail Web Server (SMWebSvr.exe) in SmarterMail 5.0.2999 allows remote attackers to cause a denial of service (service termination) via a long HTTP (1) GET, (2) HEAD, (3) PUT, (4) POST, or (5) TRACE request. NOTE: the provenance of this…

  • CVE-2008-1855Apr 16, 2008
    McAfee
    Cma
    risk 0.04cvss —epss 0.08

    FrameworkService.exe in McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 and earlier, as used by ePolicy Orchestrator (ePO) and ProtectionPilot (PrP), allows remote attackers to corrupt memory and cause a denial of service (CMA Framework service crash) via a long invalid…

  • CVE-2008-1856Apr 16, 2008
    Linpha
    Linpha
    risk 0.03cvss —epss 0.03

    plugins/maps/db_handler.php in LinPHA 1.3.3 and earlier does not require authentication for a settings action that modifies the configuration file, which allows remote attackers to conduct directory traversal attacks and execute arbitrary local files by placing directory…

  • CVE-2008-1857Apr 16, 2008
    Mole
    Make Our Life Easy
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in viewsource.php in Make our Life Easy (Mole) 2.1.0 allow remote attackers to read arbitrary files via directory traversal sequences in the (1) dirn and (2) fname parameters.

  • CVE-2008-1858Apr 16, 2008
    724networks
    724cms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in 724Networks 724CMS 4.01 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2008-1859Apr 16, 2008
    Iscripts
    Socialware
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in events.php in iScripts SocialWare allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action.

  • CVE-2007-5664Apr 16, 2008
    IBM
    Db2 Universal Database
    risk 0.00cvss —epss 0.00

    db2dasrrm in the DB2 Administration Server (DAS) in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to overwrite arbitrary files via a symlink attack on files used for initialization.

  • CVE-2007-5758Apr 16, 2008
    IBM
    Db2 Universal Database
    risk 0.00cvss —epss 0.01

    Stack-based buffer overflow in db2dasrrm in the DB2 Administration Server (DAS) in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to execute arbitrary code via a long DASPROF environment variable.

  • CVE-2008-0068Apr 16, 2008
    Microfocus
    OpenView Network Node Manager
    risk 0.03cvss —epss 0.05

    Directory traversal vulnerability in OpenView5.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to read arbitrary files via directory traversal sequences in the Action parameter.

  • CVE-2008-0892Apr 16, 2008
    Red Hat
    Directory Server
    risk 0.01cvss —epss 0.14

    The replication monitor CGI script (repl-monitor-cgi.pl) in Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, allows remote attackers to execute arbitrary commands.

  • CVE-2008-0893Apr 16, 2008
    Red Hat
    Directory Server
    risk 0.00cvss —epss 0.02

    Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, does not properly restrict access to CGI scripts, which allows remote attackers to perform administrative actions.

  • CVE-2008-1851Apr 16, 2008
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.03

    ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, 7.53, and possibly other versions allows remote attackers to cause a denial of service (hang) via certain requests that do not provide all required arguments.

  • CVE-2008-1852Apr 16, 2008
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.05

    ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, 7.53, and possibly other versions allows remote attackers to cause a denial of service (crash) via certain requests that specify a large number of sub-arguments, which triggers a NULL pointer dereference due to memory…

  • CVE-2008-1853Apr 16, 2008
    Microfocus
    OpenView Network Node Manager
    risk 0.00cvss —epss 0.02

    The ovtopmd service in HP OpenView Network Node Manager (OV NNM) 7.51, 7.53, and possibly other versions allows remote attackers to cause a denial of service (exit) by sending a 0x36 packet (exit request).

  • CVE-2008-1155Apr 16, 2008
    Cisco Systems, Inc.
    Network Admission Control
    risk 0.00cvss —epss 0.03

    Cisco Network Admission Control (NAC) Appliance 3.5.x, 3.6.x before 3.6.4.4, 4.0.x before 4.0.6, and 4.1.x before 4.1.2 allows remote attackers to obtain the shared secret for the Clean Access Server (CAS) and Clean Access Manager (CAM) by sniffing error logs.

  • CVE-2008-1786Apr 16, 2008
    Ca
    Desktop Management Suite
    risk 0.01cvss —epss 0.07

    The DSM gui_cm_ctrls ActiveX control (gui_cm_ctrls.ocx), as used in multiple CA products including BrightStor ARCServe Backup for Laptops and Desktops r11.5, Desktop Management Suite r11.1 through r11.2 C2; Unicenter r11.1 through r11.2 C2; and Desktop and Server Management…

  • CVE-2008-1838Apr 16, 2008
    BosClassifieds
    Classified Ads
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in BosClassifieds Classified Ads System 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter to index.php.