VYPR

CVEs

383,871 total · page 7074 of 7,678

AllCriticalHighKEV
  • CVE-2008-1850Apr 16, 2008
    Omnistar Interactive
    OSI Affiliate
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in login.php in Omnistar Interactive OSI Affiliate allow remote attackers to inject arbitrary web script or HTML via the (1) login, (2) profile, (3) profile2, and (4) ref parameters.

  • CVE-2008-1387Apr 16, 2008
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.04

    ClamAV before 0.93 allows remote attackers to cause a denial of service (CPU consumption) via a crafted ARJ archive, as demonstrated by the PROTOS GENOME test suite for Archive Formats.

  • CVE-2008-1834Apr 16, 2008
    Swfdec
    Swfdec
    risk 0.00cvss —epss 0.01

    swfdec_load_object.c in Swfdec before 0.6.4 does not properly restrict local file access from untrusted sandboxes, which allows remote attackers to read arbitrary files via a crafted Flash file.

  • CVE-2008-1835Apr 16, 2008
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.04

    ClamAV before 0.93 allows remote attackers to bypass the scanning enging via a RAR file with an invalid version number, which cannot be parsed by ClamAV but can be extracted by Winrar.

  • CVE-2008-1836Apr 16, 2008
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.04

    The rfc2231 function in message.c in libclamav in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via a crafted message that produces a string that is not null terminated, which triggers a buffer over-read.

  • CVE-2008-1837Apr 16, 2008
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.05

    libclamunrar in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via crafted RAR files that trigger "memory problems," as demonstrated by the PROTOS GENOME test suite for Archive Formats.

  • CVE-2008-0314Apr 16, 2008
    ClamAV
    Clamav
    risk 0.01cvss —epss 0.09

    Heap-based buffer overflow in spin.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary code via a crafted PeSpin packed PE binary with a modified length value.

  • CVE-2008-1771Apr 16, 2008
    Firefly Media Server
    mt-daapd
    risk 0.00cvss —epss 0.04

    Integer overflow in the ws_getpostvars function in Firefly Media Server (formerly mt-daapd) 0.2.4.1 (0.9~r1696-1.2 on Debian) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP POST request with a large Content-Length.

  • CVE-2008-1832Apr 16, 2008
    Cecilia
    Cecilia
    risk 0.00cvss —epss 0.00

    lib/prefs.tcl in Cecilia 2.0.5 allows local users to overwrite arbitrary files via a symlink attack on the csvers temporary file.

  • CVE-2008-1833Apr 16, 2008
    ClamAV
    Clamav
    risk 0.01cvss —epss 0.09

    Heap-based buffer overflow in pe.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary code via a crafted WWPack compressed PE binary.

  • CVE-2008-1811Apr 16, 2008
    Oracle Corporation
    Application Express
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Oracle Application Express 3.0.1 has unspecified impact and remote authenticated attack vectors related to flows_030000.wwv_execute_immediate, aka APEX01. NOTE: the previous information was obtained from the April 2008 CPU. Oracle has not commented…

  • CVE-2008-1812Apr 16, 2008
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Enterprise Manager component in Oracle Database 9.0.1.5 FIPS+; Application Server 1.0.2.2; and Enterprise Manager for AS 1.0.2.2 and Database 9.0.1.5 has unknown impact and local attack vectors, aka EM01.

  • CVE-2008-1813Apr 16, 2008
    Oracle Corporation
    SDO_GEOM
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 have unknown impact and remote unauthenticated or authenticated attack vectors related to (1) SYS.DBMS_AQ in the Advanced Queuing component, aka DB01; (2) Core…

  • CVE-2008-1814Apr 16, 2008
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Oracle Secure Enterprise Search or Ultrasearch component in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3; Application Server 9.0.4.3 and 10.1.2.2; and Oracle Collaboration Suite 10.1.2; has unknown impact and remote…

  • CVE-2008-1815Apr 16, 2008
    Oracle Corporation
    Database 10g
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Change Data Capture component in Oracle Database 10.1.0.5, 10.2.0.3, and 11.1.0.6 has unknown impact and remote authenticated attack vectors related to DBMS_CDC_UTILITY, aka DB02. NOTE: the previous information was obtained from the April 2008…

  • CVE-2008-1816Apr 16, 2008
    Oracle Corporation
    Spatial
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 and 10.2.0.3 have unknown impact and remote authenticated attack vectors related to (1) SDO_UTIL in the Oracle Spatial component, aka DB05; or (2) fine grained auditing in the Audit component, aka DB14. NOTE: the…

  • CVE-2008-1817Apr 16, 2008
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 have unknown impact and remote attack vectors related to (1) SDO_IDX in the Spatial component, aka DB07; and (2) Core RDBMS, aka DB10. NOTE: the previous…

  • CVE-2008-1818Apr 16, 2008
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Authentication component in Oracle Database 11.1.0.6 has unknown impact and remote attack vectors, aka DB08.

  • CVE-2008-1819Apr 16, 2008
    Oracle Corporation
    Oracle Net Services
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Oracle Net Services component in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3 has unknown impact and local attack vectors, aka DB09.

  • CVE-2008-1820Apr 16, 2008
    Oracle Corporation
    Data Pump
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Data Pump component in Oracle Database 9.2.0.8, 10.1.0.5, 10.2.0.3, and 11.1.0.6 has unknown impact and remote attack vectors related to KUPF$FILE_INT, aka DB11. NOTE: the previous information was obtained from the April 2008 CPU. Oracle has…

  • CVE-2008-1821Apr 16, 2008
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Advanced Queuing component in Oracle Database 9.0.1.5 FIPS+, and 10.1.0.5 has unknown impact and remote attack vectors related to SYS.DBMS_AQJMS_INTERNAL, aka DB15. NOTE: the previous information was obtained from the April 2008 CPU. Oracle has…

  • CVE-2008-1822Apr 16, 2008
    Oracle Corporation
    Application Express
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Application Express component in Oracle Application Express 3.0.1 has unknown impact and remote attack vectors, aka APEX02.

  • CVE-2008-1823Apr 16, 2008
    Oracle Corporation
    Jinitiator
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Jinitiator component in Oracle Application Server 1.3.1.14 has unknown impact and remote attack vectors, aka AS01.

  • CVE-2008-1824Apr 16, 2008
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Oracle Dynamic Monitoring Service component in Oracle Application Server 9.0.4.3, 10.1.2.2, and 10.1.3.3 has unknown impact and remote attack vectors, aka AS02.

  • CVE-2008-1825Apr 16, 2008
    Oracle Corporation
    Application Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 9.0.4.3 has unknown impact and remote attack vectors, aka AS03.

  • CVE-2008-1826Apr 16, 2008
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10.2 have unknown impact and attack vectors related to (a) Advanced Pricing, aka (1) APP01 and (2) APP10; and (b) Applications Framework, aka (3) APP05.

  • CVE-2008-1827Apr 16, 2008
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10.2 and 12.0.4 have unknown impact and attack vectors related to (a) Advanced Pricing component, aka (1) APP02, (2) APP03, and (3) APP09; (b) Application Object Library component, aka (4) APP04, (5) APP07, and…

  • CVE-2008-1828Apr 16, 2008
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.22.19, 8.48.16, and 8.49.09 has unknown impact and remote authenticated attack vectors, aka PSE01.

  • CVE-2008-1829Apr 16, 2008
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PeopleSoft HCM Recruiting component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.8 SP1 has unknown impact and remote attack vectors, aka PSE02.

  • CVE-2008-1830Apr 16, 2008
    Oracle Corporation
    Jd Edwards Enterpriseone
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the PeopleSoft HCM ePerformance component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9 and 9.0 has unknown impact and remote attack vectors, aka PSE03.

  • CVE-2008-1831Apr 16, 2008
    Oracle Corporation
    Siebel Enterprise
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in the Siebel SimBuilder component in Oracle Siebel Enterprise 7.8.2 and 7.8.5 have unknown impact and remote or local attack vectors, aka (1) SEBL01, (2) SEBL02, (3) SEBL03, (4) SEBL04, (5) SEBL05, and (6) SEBL06.

  • CVE-2008-1787Apr 15, 2008
    Poplar Gedcom Viewer
    Gedcom Viewer
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Poplar Gedcom Viewer 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) text and (2) ul parameters. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2008-1788Apr 15, 2008
    Prozilla
    Entertainers
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in directory.php in Prozilla Entertainers 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cat parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2008-1789Apr 15, 2008
    Prozilla
    Forum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in forum.php in Prozilla Forum allows remote attackers to execute arbitrary SQL commands via the forum parameter.

  • CVE-2008-1790Apr 15, 2008
    Iscripts
    Socialware
    risk 0.03cvss —epss 0.01

    Unrestricted file upload vulnerability in iScripts SocialWare allows remote authenticated administrators to upload arbitrary files via a crafted logo file in the "Manage Settings" functionality. NOTE: remote exploitation is facilitated by a separate SQL injection vulnerability.

  • CVE-2008-1791Apr 15, 2008
    Mygamingladder
    Mygamingladder
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ladder.php in My Gaming Ladder 7.5 and earlier allows remote attackers to execute arbitrary SQL commands via the ladderid parameter.

  • CVE-2008-1792Apr 15, 2008
    Drupal
    Flickr Drupal module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the insertion filter in the Flickr Drupal module 5.x before 5.x-1.3 and 6.x before 6.x-1.0-alpha allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-1793Apr 15, 2008
    Smart Classified ADS Professional
    Smart Classified ADS Professional
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in view.cgi in Smart Classified ADS Professional, Smart Photo ADS, and Smart Photo ADS Gold allow remote attackers to inject arbitrary web script or HTML via the (1) AdNum and (2) Department parameters. NOTE: the provenance of…

  • CVE-2008-1794Apr 15, 2008
    Drupal
    Webform Module
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Webform Drupal module 5.x before 5.x-1.10, 5.x-2.x before 5.x-2.0-beta3, and 6.x before 6.x-1.0-beta3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-1795Apr 15, 2008
    Blackboard
    Academic Suite
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Blackboard Academic Suite 7.x and earlier, and possibly some 8.0 versions, allow remote attackers to inject arbitrary web script or HTML via (1) the searchText parameter in a Course action to…

  • CVE-2008-1796Apr 15, 2008
    Comix
    Comix
    risk 0.00cvss —epss 0.00

    Comix 3.6.4 creates temporary directories with predictable names, which allows local users to cause an unspecified denial of service.

  • CVE-2008-1797Apr 15, 2008
    Secure Computing
    Webwasher
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Secure Computing Webwasher 5.30 before build 3159 and 6.3.0 before build 3150 allows remote attackers to cause a denial of service (freeze) via a crafted URL.

  • CVE-2008-1798Apr 15, 2008
    Dragoon
    Dragoon
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in forum/kietu/libs/calendrier.php in Dragoon 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cal[lng] parameter.

  • CVE-2008-1799Apr 15, 2008
    Sabros.us
    Sabros.us
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in thumbnails.php in sabros.us 1.75 allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter.

  • CVE-2008-1800Apr 15, 2008
    Divx
    Divxdb
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in DivXDB 2002 0.94b allow remote attackers to inject arbitrary web script or HTML via the (1) choice, (2) _page_, (3) zone_admin, (4) general_search, and (5) import parameters. NOTE: the provenance of this…

  • CVE-2008-1782Apr 15, 2008
    Advanced Software Engineering
    Chartdirector
    risk 0.03cvss —epss 0.02

    phpdemo/viewsource.php in Advanced Software Engineering ChartDirector 4.1 allows remote attackers to read sensitive files via the file parameter.

  • CVE-2008-1783Apr 15, 2008
    Prozilla
    Reviews
    risk 0.03cvss —epss 0.02

    Prozilla Reviews 1.0 allows remote attackers to delete arbitrary users via a modified UserID parameter in a direct request to siteadmin/DeleteUser.php.

  • CVE-2008-1784Apr 15, 2008
    Prozilla
    Topsites
    risk 0.03cvss —epss 0.03

    Prozilla Topsites 1.0 allows remote attackers to perform administrative actions via a direct request to (1) addu.php, (2) editu.php, and (3) uidx.php in siteadmin/.

  • CVE-2008-1785Apr 15, 2008
    Prozilla
    Top 100
    risk 0.03cvss —epss 0.02

    delete.php in Prozilla Top 100 1.2 allows remote authenticated users to delete statistics and accounts of arbitrary users via a modified s parameter.

  • CVE-2008-0927Apr 14, 2008
    Novell
    Edirectory
    risk 0.09cvss —epss 0.70

    dhost.exe in Novell eDirectory 8.7.3 before sp10 and 8.8.2 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with (1) multiple Connection headers or (2) a Connection header with multiple comma-separated values. NOTE: this might be…