VYPR

CVEs

383,870 total · page 7079 of 7,678

AllCriticalHighKEV
  • CVE-2008-1564Mar 31, 2008
    Dan Costin
    File Transfer
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in Dan Costin File Transfer before 1.2f allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) in the filename.

  • CVE-2008-1565Mar 31, 2008
    PhpBB
    PJIRC
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in forum/irc/irc.php in the PJIRC 0.5 module for phpBB allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter.

  • CVE-2008-1566Mar 31, 2008
    Manageengine
    Applications Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Search.do in ManageEngine Applications Manager 8.x allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third…

  • CVE-2008-1567MedMar 31, 2008
    PhpMyAdmin
    phpMyAdmin
    risk 0.36cvss 5.5epss 0.00

    phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to obtain sensitive information.

  • CVE-2008-1568Mar 31, 2008
    Comix
    Comix
    risk 0.00cvss —epss 0.02

    comix 3.6.4 allows attackers to execute arbitrary commands via a filename containing shell metacharacters that are not properly sanitized when executing the rar, unrar, or jpegtran programs.

  • CVE-2008-1569Mar 31, 2008
    Policyd Weight
    Policyd Weight
    risk 0.00cvss —epss 0.00

    policyd-weight 0.1.14 beta-16 and earlier allows local users to modify or delete arbitrary files via a symlink attack on temporary files that are used when creating a socket.

  • CVE-2008-1570Mar 31, 2008
    Policyd Weight
    Policyd Weight
    risk 0.00cvss —epss 0.00

    Race condition in the create_lockpath function in policyd-weight 0.1.14 beta-16 allows local users to modify or delete arbitrary files by creating the LOCKPATH directory, then modifying it after the symbolic link check occurs. NOTE: this is due to an incomplete fix for…

  • CVE-2008-0070Mar 31, 2008
    Orb Networks
    Orb
    risk 0.00cvss —epss 0.01

    Integer overflow in Orb Networks Orb 2.00.1014 and Winamp Remote BETA allows remote attackers to execute arbitrary code via an RPC request that specifies a large number of array dimensions, which triggers a heap-based buffer overflow.

  • CVE-2008-1548Mar 31, 2008
    Eagle Software
    Aeries Browser Interface
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Aeries Browser Interface (ABI) 3.8.3.14 in Eagle Software Aries Student Information System allow remote attackers to inject arbitrary web script or HTML via the (1) UserName parameter to loginproc.asp and the (2) usr…

  • CVE-2008-1549Mar 31, 2008
    Eagle Software
    Aeries Browser Interface
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Aeries Browser Interface (ABI) 3.8.3.14 in Eagle Software Aries Student Information System allow remote attackers to execute arbitrary SQL commands via the (1) GrdBk parameter to GradebookOptions.asp and the (2) SchlCode variable to…

  • CVE-2008-1550Mar 31, 2008
    Cubecart
    Cubecart
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in CubeCart 4.2.1 allow remote attackers to inject arbitrary web script or HTML via (1) the _a parameter in a searchStr action and the (2) Submit parameter.

  • CVE-2008-1551Mar 31, 2008
    Runcms
    Runcms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in viewcat.php in the Photo 3.02 module for RunCMS allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2008-1552Mar 31, 2008
    Silc
    Silc Server
    risk 0.00cvss —epss 0.04

    The silc_pkcs1_decode function in the silccrypt library (silcpkcs1.c) in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.7, SILC Client before 1.1.4, and SILC Server before 1.1.2 allows remote attackers to execute arbitrary code via a crafted PKCS#1 message, which…

  • CVE-2008-1553Mar 31, 2008
    Topper
    Toppermod
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in mod.php in TopperMod 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the to parameter.

  • CVE-2008-1554Mar 31, 2008
    Topper
    Toppermod
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in account/index.php in TopperMod 2.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via a non-alphanumeric first character the localita parameter, which bypasses a protection mechanism.

  • CVE-2008-1555Mar 31, 2008
    Bolinos
    Bolinos
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in system/_b/contentFiles/gbincluder.php in BolinOS 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _bFileToInclude parameter.

  • CVE-2008-1556Mar 31, 2008
    Bolinos
    Bolinos
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in BolinOS 4.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) system/actionspages/_b/contentFiles/gBImageViewer.php, (2) ForEditor parameter to (b)…

  • CVE-2008-1557Mar 31, 2008
    Bolinos
    Bolinos
    risk 0.03cvss —epss 0.03

    BolinOS 4.6.1 allows remote attackers to obtain sensitive information via a direct request to system/actionspages/_b/contentFiles/gBphpInfo.php, which calls the phpinfo function.

  • CVE-2008-1558Mar 31, 2008
    MPlayer
    Mplayer
    risk 0.04cvss —epss 0.17

    Uncontrolled array index in the sdpplin_parse function in stream/realrtsp/sdpplin.c in MPlayer 1.0 rc2 allows remote attackers to overwrite memory and execute arbitrary code via a large streamid SDP parameter. NOTE: this issue has been referred to as an integer overflow.

  • CVE-2008-1559Mar 31, 2008
    Joomla
    AlphaContent
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Bernard Gilly AlphaContent (com_alphacontent) 2.5.8 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.

  • CVE-2008-0704Mar 28, 2008
    Microfocus
    Openvms
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the SSH server in HP OpenVMS TCP/IP Services on OpenVMS on the Alpha platform with 5.4 before ECO 7, and on the Integrity and Alpha platforms with 5.5 before ECO 3 and 5.6 before ECO 2, allows remote attackers to obtain unspecified access via unknown…

  • CVE-2008-1542Mar 28, 2008
    Airspan
    Base Station Distribution Unit
    risk 0.00cvss —epss 0.02

    Airspan Base Station Distribution Unit (BSDU) has "topsecret" as its password for the root account, which allows remote attackers to obtain administrative access via a telnet login, a different vulnerability than CVE-2008-1262.

  • CVE-2008-1543Mar 28, 2008
    Airspan
    Prost Web Management
    risk 0.00cvss —epss 0.01

    The Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX ProST have a certain default User ID and password, which makes it easier for remote attackers to obtain partial administrative access, a different vulnerability than CVE-2008-1262.

  • CVE-2008-1544Mar 28, 2008
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.26

    The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request…

  • CVE-2008-1545Mar 28, 2008
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.12

    The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST…

  • CVE-2008-1546Mar 28, 2008
    Mitsubishielectric
    Gb
    risk 0.00cvss —epss 0.02

    servlet/MIMEReceiveServlet in the web controller for Mitsubishi Electric GB-50 and GB-50A air-conditioning control systems allows remote attackers to cause a denial of service (air-conditioning outage) via an XML document containing a setRequest command.

  • CVE-2008-0924Mar 28, 2008
    Novell
    Edirectory
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in the DoLBURPRequest function in libnldap in ndsd in Novell eDirectory 8.7.3.9 and earlier, and 8.8.1 and earlier in the 8.8.x series, allows remote attackers to cause a denial of service (daemon crash or CPU consumption) or execute arbitrary code…

  • CVE-2008-0926Mar 28, 2008
    Novell
    Edirectory
    risk 0.08cvss —epss 0.58

    The SOAP interface to the eMBox module in Novell eDirectory 8.7.3.9 and earlier, and 8.8.x before 8.8.2, relies on client-side authentication, which allows remote attackers to bypass authentication via requests for /SOAP URIs, and cause a denial of service (daemon shutdown) or…

  • CVE-2008-1534Mar 28, 2008
    PowerPHPBoard
    PowerPHPBoard
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in PowerPHPBoard 1.00b allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) settings[footer] parameter to footer.inc.php and the (2) settings[header] parameter to header.inc.php.

  • CVE-2008-1535Mar 28, 2008
    Joomla
    com_rekry
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Matti Kiviharju rekry (aka com_rekry or rekry!Joom) 1.0.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the op_id parameter in a view action to index.php.

  • CVE-2008-1536Mar 28, 2008
    Picturespro
    Photo Cart
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Pictures Pro (aka Tim Grissett) Photo Cart 4.1 allows remote attackers to inject arbitrary web script or HTML via the amessage parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2008-1537Mar 28, 2008
    Powerscripts
    Powerbook
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in pb_inc/admincenter/index.php in PowerScripts PowerBook 1.21 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter. NOTE: in some environments, this can be leveraged for remote file…

  • CVE-2008-1538Mar 28, 2008
    Manageengine
    EventLog Analyzer
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in searchAction.do in ManageEngine EventLog Analyzer 5 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2008-1539Mar 28, 2008
    PHP-Nuke
    PHP-Nuke Platinum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in includes/dynamic_titles.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary SQL commands via the p parameter to modules.php for the Forums module.

  • CVE-2008-1540Mar 28, 2008
    Datsogallery
    Datsogallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Datsogallery (com_datsogallery) 1.3.1 module for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php. NOTE: the provenance of this information is unknown; the details…

  • CVE-2008-1541Mar 28, 2008
    His
    Webshop
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in cgi-bin/his-webshop.pl in HIS Webshop 2.50 allows remote attackers to read arbitrary files via a .. (dot dot) in the t parameter.

  • CVE-2008-1240Mar 28, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related…

  • CVE-2008-1532Mar 28, 2008
    Perlbal
    Perlbal
    risk 0.00cvss —epss 0.02

    Perlbal before 1.70, when buffered upload is enabled, allows remote attackers to cause a denial of service (crash) via a zero-byte chunked upload.

  • CVE-2008-1533Mar 28, 2008
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the XML-RPC Blogger API plugin in Joomla! 1.5 allows remote attackers to perform unauthorized article operations on articles via unknown vectors.

  • CVE-2008-1530Mar 27, 2008
    Gnupg
    Gnupg
    risk 0.00cvss —epss 0.04

    GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers "memory corruption around deduplication of user IDs."

  • CVE-2008-1531Mar 27, 2008
    Lighttpd
    Lighttpd
    risk 0.00cvss —epss 0.03

    The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of service (active SSL connection loss) by triggering an SSL error, such as disconnecting before a download has finished, which…

  • CVE-2008-1150Mar 27, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    The virtual private dial-up network (VPDN) component in Cisco IOS before 12.3 allows remote attackers to cause a denial of service (resource exhaustion) via a series of PPTP sessions, related to the persistence of interface descriptor block (IDB) data structures after process…

  • CVE-2008-1151Mar 27, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Memory leak in the virtual private dial-up network (VPDN) component in Cisco IOS before 12.3 allows remote attackers to cause a denial of service (memory consumption) via a series of PPTP sessions, related to "dead memory" that remains allocated after process termination, aka…

  • CVE-2008-1152Mar 27, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.04

    The data-link switching (DLSw) component in Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of service (device restart or memory consumption) via crafted (1) UDP port 2067 or (2) IP protocol 91 packets.

  • CVE-2008-1384Mar 27, 2008
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    Integer overflow in PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service and possibly have unspecified other impact via a printf format parameter with a large width specifier, related to the php_sprintf_appendstring function in formatted_print.c…

  • CVE-2008-1391Mar 27, 2008
    Apple Inc.
    Mac OS 9
    risk 0.05cvss —epss 0.19

    Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in…

  • CVE-2008-0537Mar 27, 2008
    Cisco Systems, Inc.
    Route Switch Processor
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Supervisor Engine 32 (Sup32), Supervisor Engine 720 (Sup720), and Route Switch Processor 720 (RSP720) for multiple Cisco products, when using Multi Protocol Label Switching (MPLS) VPN and OSPF sham-link, allows remote attackers to cause a denial…

  • CVE-2008-1153Mar 27, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.06

    Cisco IOS 12.1, 12.2, 12.3, and 12.4, with IPv4 UDP services and the IPv6 protocol enabled, allows remote attackers to cause a denial of service (device crash and possible blocked interface) via a crafted IPv6 packet to the device.

  • CVE-2008-1156Mar 27, 2008
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Multicast Virtual Private Network (MVPN) implementation in Cisco IOS 12.0, 12.2, 12.3, and 12.4 allows remote attackers to create "extra multicast states on the core routers" via a crafted Multicast Distribution Tree (MDT) Data Join message.

  • CVE-2008-1233Mar 27, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via "XPCNativeWrapper pollution."