VYPR

CVEs

383,871 total · page 7075 of 7,678

AllCriticalHighKEV
  • CVE-2008-0961CriApr 14, 2008
    EMV
    DiskXtender
    risk 0.64cvss 9.8epss 0.05

    EMV DiskXtender 6.20.060 has a hard-coded login and password, which allows remote attackers to bypass authentication via the RPC interface.

  • CVE-2008-0962Apr 14, 2008
    EMC Corporation
    Diskxtender
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the File System Manager for EMC DiskXtender 6.20.060 allows remote authenticated users to execute arbitrary code via a crafted request to the RPC interface.

  • CVE-2008-0963Apr 14, 2008
    EMC Corporation
    Diskxtender
    risk 0.00cvss —epss 0.03

    Format string vulnerability in EMC DiskXtender MediaStor 6.20.060 allows remote authenticated users to execute arbitrary code via a crafted message to the RPC interface.

  • CVE-2008-1100Apr 14, 2008
    ClamAV
    Clamav
    risk 0.01cvss —epss 0.11

    Buffer overflow in the cli_scanpe function in libclamav (libclamav/pe.c) for ClamAV 0.92 and 0.92.1 allows remote attackers to execute arbitrary code via a crafted Upack PE file.

  • CVE-2008-1382Apr 14, 2008
    Libpng
    Libpng
    risk 0.00cvss —epss 0.06

    libpng 1.0.6 through 1.0.32, 1.2.0 through 1.2.26, and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG file with zero length "unknown" chunks, which trigger an access of…

  • CVE-2008-1772Apr 14, 2008
    Iscripts
    Socialware
    risk 0.03cvss —epss 0.02

    iScripts SocialWare stores passwords in cleartext in a database, which allows context-dependent attackers to obtain sensitive information.

  • CVE-2008-1773Apr 14, 2008
    Dragoon
    Dragoon
    risk 0.05cvss —epss 0.27

    PHP remote file inclusion vulnerability in includes/header.inc.php in Dragoon 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.

  • CVE-2008-1774Apr 14, 2008
    Pligg
    CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in editlink.php in Pligg 9.9.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-1775Apr 14, 2008
    Manageengine
    Firewallanalyzer
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in mindex.do in ManageEngine Firewall Analyzer 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the displayName parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2008-1776Apr 14, 2008
    Phpblock
    Phpblock
    risk 0.05cvss —epss 0.27

    PHP remote file inclusion vulnerability in modules/basicfog/basicfogfactory.class.php in PhpBlock A8.4 allows remote attackers to execute arbitrary PHP code via a URL in the PATH_TO_CODE parameter.

  • CVE-2008-1777Apr 14, 2008
    Novell
    Edirectory
    risk 0.00cvss —epss 0.02

    The eDirectory Host Environment service (dhost.exe) in Novell eDirectory 8.8.2 allows remote attackers to cause a denial of service (CPU consumption) via a long HTTP HEAD request to TCP port 8028.

  • CVE-2008-1778Apr 14, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the floating point context switch implementation in Sun Solaris 9 and 10 on x86 platforms might allow local users to cause a denial of service (application exit), corrupt data, or trigger incorrect calculations via unknown vectors.

  • CVE-2008-1779Apr 14, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.02

    Sun Solaris 8, 9, and 10 allows "remote privileged" users to cause a denial of service (panic) via unknown vectors related to self encapsulated IP packets.

  • CVE-2008-1780Apr 14, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the labeled networking functionality in Solaris 10 Trusted Extensions allows applications in separate labeling zones to bypass labeling restrictions via unknown vectors.

  • CVE-2008-1757Apr 12, 2008
    Kwsphp
    Kwsphp
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in the ConcoursPhoto module for KwsPHP 1.0 allows remote attackers to inject arbitrary web script or HTML via the VIEW parameter.

  • CVE-2008-1758Apr 12, 2008
    Kwsphp
    Kwsphp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the ConcoursPhoto module for KwsPHP allows remote attackers to execute arbitrary SQL commands via the C_ID parameter to index.php.

  • CVE-2008-1759Apr 12, 2008
    Jeuxflash
    Jeuxflash Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the jeuxflash module for KwsPHP allows remote attackers to execute arbitrary SQL commands via the cat parameter to index.php, a different vector than CVE-2007-4922.

  • CVE-2008-1760Apr 12, 2008
    Blogator Script
    Blogator Script
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Blogator-script before 1.01 allow remote attackers to execute arbitrary PHP code via a URL in the incl_page parameter in (1) struct_admin.php, (2) struct_admin_blog.php, and (3) struct_main.php in _blogadata/include.

  • CVE-2008-1761Apr 12, 2008
    Opera
    Opera
    risk 0.01cvss —epss 0.08

    Opera before 9.27 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted newsfeed source, which triggers an invalid memory access.

  • CVE-2008-1762Apr 12, 2008
    Opera
    Opera
    risk 0.04cvss —epss 0.08

    Opera before 9.27 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted scaled image pattern in an HTML CANVAS element, which triggers memory corruption.

  • CVE-2008-1763Apr 12, 2008
    Blogator Script
    Blogator Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in _blogadata/include/sond_result.php in Blogator-script 0.95 allows remote attackers to execute arbitrary SQL commands via the id_art parameter.

  • CVE-2008-1764Apr 12, 2008
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Opera before 9.27 has unknown impact and attack vectors related to "keyboard handling of password inputs."

  • CVE-2008-1766Apr 12, 2008
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two minor security-related bugs."

  • CVE-2007-6712Apr 12, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Integer overflow in the hrtimer_forward function (hrtimer.c) in Linux kernel 2.6.21-rc4, when running on 64-bit systems, allows local users to cause a denial of service (infinite loop) via a timer with a large expiry value, which causes the timer to always be expired.

  • CVE-2008-1750Apr 11, 2008
    Integry Systems
    Livecart
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Integry Systems LiveCart 1.1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to the /category URI.

  • CVE-2008-1751Apr 11, 2008
    Ksemail
    Ksemail
    risk 0.03cvss —epss 0.04

    Multiple directory traversal vulnerabilities in index.php in Ksemail allow remote attackers to read arbitrary local files via a .. (dot dot) in the (1) language and (2) lang parameters.

  • CVE-2008-1752Apr 11, 2008
    Achmad Zaenuri
    Ezradius
    risk 0.00cvss —epss 0.01

    ezRADIUS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain credentials via a direct request for (1) config.ini or (2) database.ini. NOTE: some of these details are obtained from third party information.

  • CVE-2008-1753Apr 11, 2008
    Alkacon
    Opencms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in system/workplace/admin/workplace/sessions.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the searchfilter parameter, a different vector than CVE-2008-1510.

  • CVE-2008-1754Apr 11, 2008
    Symantec
    Deployment Solution
    risk 0.00cvss —epss 0.00

    Symantec Altiris Deployment Solution before 6.9.164 stores the Deployment Solution Agent (aka AClient) password in cleartext in memory, which allows local users to obtain sensitive information by dumping the AClient.exe process memory.

  • CVE-2008-1755Apr 11, 2008
    World Of Phaos
    World of Phaos
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in the showSource function in showSource.php in World of Phaos 4.0.1 allows remote attackers to read arbitrary files via directory traversal sequences in the file parameter.

  • CVE-2008-1756Apr 11, 2008
    Sun Corporation
    N1 Grid Engine
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Qmaster daemon in Sun N1 Grid Engine 6.1 allows local users to cause a denial of service (daemon crash) via unspecified vectors.

  • CVE-2008-1724Apr 11, 2008
    Axway
    Securetransport
    risk 0.06cvss —epss 0.35

    Stack-based buffer overflow in the IActiveXTransfer.FileTransfer method in the SecureTransport FileTransfer ActiveX control in vcst_en.dll 1.0.0.5 in Tumbleweed SecureTransport Server before 4.6.1 Hotfix 20 allows remote attackers to execute arbitrary code via a long remoteFile…

  • CVE-2008-1725Apr 11, 2008
    IBiz
    E-Banking Integrator
    risk 0.03cvss —epss 0.03

    The IBizEBank.FIProfile.1 ActiveX control in fiprofile20.ocx in IBiz E-Banking Integrator (formerly IBiz OFX Integrator) 2.0.2932 exposes the unsafe WriteOFXDataFile method, which allows remote attackers to overwrite arbitrary files via a full pathname in the argument. NOTE:…

  • CVE-2008-1726Apr 11, 2008
    Myknowledgequest
    Knowledgequest
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in KnowledgeQuest 2.6, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) kqid parameter to (a) articletext.php and (b) articletextonly.php and the (2) username parameter to (c)…

  • CVE-2008-1727Apr 11, 2008
    Myknowledgequest
    Knowledgequest
    risk 0.04cvss —epss 0.07

    KnowledgeQuest 2.5 and 2.6 does not require authentication for access to admincheck.php, which allows remote attackers to create arbitrary admin accounts.

  • CVE-2008-1728Apr 11, 2008
    Igniterealtime
    Openfire
    risk 0.00cvss —epss 0.02

    ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon outage) by triggering large outgoing queues without reading messages.

  • CVE-2008-1729Apr 11, 2008
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to (1) edit the profile pages of arbitrary users, and obtain sensitive information from (2) tracker and (3) blog pages, related to a missing check for the "access content"…

  • CVE-2008-1730Apr 11, 2008
    Arwscripts
    Gallery Script Lite
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in download.html in ARWScripts Gallery Script Lite (aka gallery-script-lite or Free Photo Gallery Site Script), as of 20080411, allows remote attackers to read arbitrary local files via directory traversal sequences in the path parameter.

  • CVE-2008-1731Apr 11, 2008
    Drupal
    Simple Access
    risk 0.00cvss —epss 0.02

    The Simple Access module for Drupal 5.x through 5.x-1.2-2 does not properly handle the privacy information for nodes, which might allow remote attackers to bypass intended access restrictions, and read or modify nodes, in opportunistic circumstances related to interaction…

  • CVE-2008-1732Apr 11, 2008
    Predictionfootball
    Predictionfootball
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in showpredictionsformatch.php in Prediction Football 1.x allows remote attackers to execute arbitrary SQL commands via the matchid parameter in a dupa action.

  • CVE-2008-1733Apr 11, 2008
    Joomla
    com_puarcade
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in puarcade.class.php 2.2 and earlier in the Pragmatic Utopia PU Arcade (com_puarcade) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the gid parameter to index.php.

  • CVE-2008-1658Apr 11, 2008
    PolicyKit
    PolicyKit
    risk 0.00cvss —epss 0.01

    Format string vulnerability in the grant helper (polkit-grant-helper.c) in PolicyKit 0.7 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in a password.

  • CVE-2008-1703Apr 11, 2008
    TIBCO Software
    Rendezvous
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in TIBCO Software Rendezvous before 8.1.0, as used in multiple TIBCO products, allow remote attackers to execute arbitrary code via a crafted message.

  • CVE-2008-1704Apr 11, 2008
    TIBCO Software
    Enterprise Message Service
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in TIBCO Software Enterprise Message Service (EMS) before 4.4.3, and iProcess Engine 10.6.0 through 10.6.1, allow remote attackers to execute arbitrary code via a crafted message to the EMS server.

  • CVE-2008-1719Apr 10, 2008
    Nuke ET
    Nuke ET
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Nuke ET 3.2 and 3.4 allow remote attackers to perform actions as administrators, as demonstrated by inserting an XSS sequence into a document.

  • CVE-2008-1720Apr 10, 2008
    Rsync
    Rsync
    risk 0.00cvss —epss 0.05

    Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allow remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2008-1721Apr 10, 2008
    Python (programming language)
    Python
    risk 0.00cvss —epss 0.23

    Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a negative signed integer, which triggers insufficient memory allocation and a buffer overflow.

  • CVE-2008-1722Apr 10, 2008
    Openprinting
    Cups
    risk 0.00cvss —epss 0.02

    Multiple integer overflows in (1) filter/image-png.c and (2) filter/image-zoom.c in CUPS 1.3 allow attackers to cause a denial of service (crash) and trigger memory corruption, as demonstrated via a crafted PNG image.

  • CVE-2007-5399Apr 10, 2008
    IBM
    Lotus Notes
    risk 0.00cvss —epss 0.06

    Multiple heap-based buffer overflows in emlsr.dll in the EML reader in Autonomy (formerly Verity) KeyView 10.3.0.0, as used by IBM Lotus Notes, allow remote attackers to execute arbitrary code via a long (1) To, (2) Cc, (3) Bcc, (4) From, (5) Date, (6) Subject, (7) Priority, (8)…

  • CVE-2007-5405Apr 10, 2008
    IBM
    Lotus Notes
    risk 0.00cvss —epss 0.06

    Multiple buffer overflows in kpagrdr.dll 2.0.0.2 and 10.3.0.0 in the Applix Presents reader in Autonomy (formerly Verity) KeyView, as used by IBM Lotus Notes, Symantec Mail Security, and activePDF DocConverter, allow remote attackers to execute arbitrary code via a .ag file with…