VYPR

CVEs

383,869 total · page 7080 of 7,678

AllCriticalHighKEV
  • CVE-2008-1235Mar 27, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via unknown vectors that cause JavaScript to execute with the wrong principal, aka "Privilege escalation via…

  • CVE-2008-1236Mar 27, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the layout engine.

  • CVE-2008-1237Mar 27, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the JavaScript engine.

  • CVE-2008-1238Mar 27, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating the HTTP Referer header, does not list the entire URL when it contains Basic Authentication credentials without a username, which makes it easier for remote attackers to bypass application protection…

  • CVE-2008-1241Mar 27, 2008
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    GUI overlay vulnerability in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 allows remote attackers to spoof form elements and redirect user inputs via a borderless XUL pop-up window from a background tab.

  • CVE-2008-1521Mar 26, 2008
    Zyxel
    P-661
    risk 0.00cvss —epss 0.01

    ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to gain privileges by accessing administrative URIs, as demonstrated by rpSysAdmin.html.

  • CVE-2008-1522Mar 26, 2008
    Zyxel
    P-661
    risk 0.00cvss —epss 0.01

    ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), have (1) "user" as their default password for the "user" account and (2) "1234" as their default password for the "admin" account, which makes it easier for remote attackers…

  • CVE-2008-1523Mar 26, 2008
    Zyxel
    P-661
    risk 0.00cvss —epss 0.01

    ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to obtain ISP and Dynamic DNS credentials by sending a direct request for (1) WAN.html, (2) wzPPPOE.html, and (3) rpDyDNS.html, and…

  • CVE-2008-1524Mar 26, 2008
    Zyxel
    Prestige
    risk 0.00cvss —epss 0.01

    The SNMP service on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), has "public" as its default community for both (1) read and (2) write operations, which allows remote attackers to perform administrative actions via SNMP,…

  • CVE-2008-1525Mar 26, 2008
    Zyxel
    Prestige
    risk 0.00cvss —epss 0.01

    The default SNMP configuration on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), has a Trusted Host value of 0.0.0.0, which allows remote attackers to send SNMP requests from any source IP address.

  • CVE-2008-1526HigMar 26, 2008
    Zyxel
    P-661
    risk 0.49cvss 7.5epss 0.01

    ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculating an MD5 password hash, which makes it easier for attackers to crack passwords.

  • CVE-2008-1527Mar 26, 2008
    Zyxel
    Prestige
    risk 0.00cvss —epss 0.01

    ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), support authentication over HTTP via a hash string in the hiddenPassword field, which allows remote attackers to obtain access via a replay attack.

  • CVE-2008-1528Mar 26, 2008
    Zyxel
    Prestige
    risk 0.00cvss —epss 0.01

    ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to obtain authentication data by making direct HTTP requests and then reading the HTML source, as demonstrated by a request for (1)…

  • CVE-2008-1529Mar 26, 2008
    Zyxel
    Prestige
    risk 0.00cvss —epss 0.01

    ZyXEL Prestige routers have a minimum password length for the admin account that is too small, which makes it easier for remote attackers to guess passwords via brute force methods.

  • CVE-2008-1514Mar 26, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    arch/s390/kernel/ptrace.c in Linux kernel 2.6.9, and other versions before 2.6.27-rc6, on s390 platforms allows local users to cause a denial of service (kernel panic) via the user-area-padding test from the ptrace testsuite in 31-bit mode, which triggers an invalid dereference.

  • CVE-2008-1508Mar 25, 2008
    Efestech
    E-Kontör
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in EfesTech E-Kontör and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-1509Mar 25, 2008
    Xlportal
    Xlportal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in XLPortal 2.2.4 and earlier allows remote attackers to execute arbitrary SQL commands via the query parameter.

  • CVE-2008-1510Mar 25, 2008
    Alkacon
    Opencms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in system/workplace/admin/accounts/users_list.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the (1) searchfilter or (2) listSearchFilter parameter.

  • CVE-2008-1511CriMar 25, 2008
    Oocomments
    Oocomments
    risk 0.67cvss 9.8epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in ooComments 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the PathToComment parameter for (1) classes/class_admin.php and (2) classes/class_comments.php. NOTE: the provenance of this information is…

  • CVE-2008-1512Mar 25, 2008
    PhpBB
    eXtreme Styles module (XS-Mod)
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in admin/admin_xs.php in eXtreme Styles module (XS-Mod) 2.3.1 and 2.4.0 for phpBB allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the phpEx parameter. NOTE: some of these details are obtained from third party…

  • CVE-2008-1513Mar 25, 2008
    Danneo
    CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Danneo CMS 0.5.1 and earlier, when the Referers statistics option is enabled, allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header.

  • CVE-2008-1506Mar 25, 2008
    Peel
    Peel
    risk 0.03cvss —epss 0.02

    PEEL, possibly 3.x and earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.

  • CVE-2008-1507Mar 25, 2008
    Peel
    Peel
    risk 0.03cvss —epss 0.02

    PEEL, possibly 3.x and earlier, has (1) a default [email protected] account with password admin, and (2) a default [email protected] account with password cinema, which allows remote attackers to gain administrative access.

  • CVE-2008-1490Mar 25, 2008
    Piczo
    Imageuploader4
    risk 0.00cvss —epss 0.04

    Buffer overflow in a certain Aurigma ActiveX control in ImageUploader4.ocx 4.1.36.0, as used with Piczo (aka Pizco) and possibly other online services, allows remote attackers to execute arbitrary code via unspecified vectors, possibly involving a long Action property, a…

  • CVE-2008-1491Mar 25, 2008
    Asus
    Remote Console
    risk 0.09cvss —epss 0.70

    Stack-based buffer overflow in the DPC Proxy server (DpcProxy.exe) in ASUS Remote Console (aka ARC or ASMB3) 2.0.0.19 and 2.0.0.24 allows remote attackers to execute arbitrary code via a long string to TCP port 623.

  • CVE-2008-1492Mar 25, 2008
    Coronamatrix
    Phpaddressbook
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in CoronaMatrix phpAddressBook 2.11 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin parameter to (1) index.php and (2) install.php. NOTE: it was later reported that vector 1 is also…

  • CVE-2008-1493Mar 25, 2008
    Cuteflow
    Cuteflow Bin
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in login.php in Cuteflow Bin 1.5.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.

  • CVE-2008-1494Mar 25, 2008
    Easy Clanpage
    Easy Clanpage
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in inc/module/online.php in Easy-Clanpage 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a user details action, a different vector than CVE-2008-1425.

  • CVE-2008-1495Mar 25, 2008
    Peel
    Peel
    risk 0.03cvss —epss 0.02

    Unrestricted file upload vulnerability in administrer/produits.php in PEEL, possibly 3.x and earlier, allows remote authenticated administrators to upload and execute arbitrary PHP files via a modified content type in an ajout action, as demonstrated by (1) image/gif and (2)…

  • CVE-2008-1496Mar 25, 2008
    Peel
    Peel
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in PEEL, possibly 3.x and earlier, allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to (a) membre.php, and the (2) timestamp parameter to (b) the details action in achat/historique_commandes.php and (c)…

  • CVE-2008-1497Mar 25, 2008
    Netwin
    Surgemail
    risk 0.01cvss —epss 0.06

    Stack-based buffer overflow in the IMAP service in NetWin SurgeMail 38k4-4 and earlier allows remote authenticated users to execute arbitrary code via long arguments to the LSUB command.

  • CVE-2008-1498Mar 25, 2008
    Netwin
    Surgemail
    risk 0.04cvss —epss 0.08

    Stack-based buffer overflow in the IMAP service in NetWin Surgemail 3.8k4-4 and earlier allows remote authenticated users to execute arbitrary code via a long first argument to the LIST command.

  • CVE-2008-1499Mar 25, 2008
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in frontend/x/manpage.html in cPanel 11.18.3 and 11.21.0-BETA allows remote attackers to inject arbitrary web script or HTML via the query string.

  • CVE-2008-1500Mar 25, 2008
    Tinyportal
    Tinyportal
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in TinyPortal 0.8.6 and 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-1501Mar 25, 2008
    Ircu
    Ircu
    risk 0.03cvss —epss 0.05

    The send_user_mode function in s_user.c in (1) Undernet ircu 2.10.12.12 and earlier, (2) snircd 1.3.4 and earlier, and unspecified other ircu derivatives allows remote attackers to cause a denial of service (daemon crash) via a malformed MODE command.

  • CVE-2008-1502Mar 25, 2008
    Moodle
    Moodle
    risk 0.01cvss —epss 0.10

    The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing…

  • CVE-2008-1503Mar 25, 2008
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web management interface in F5 BIG-IP 9.4.3 allows remote attackers to inject arbitrary web script or HTML via (1) the name of a node object, or the (2) sysContact or (3) sysLocation SNMP configuration field, aka "Audit Log XSS."…

  • CVE-2008-1504Mar 25, 2008
    Phpheaven
    Phpmychat
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in setup.php3 in phpHeaven phpMyChat 0.14.5 allows remote attackers to inject arbitrary web script or HTML via the Lang parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-1505Mar 25, 2008
    Sstreamtv
    Custompages
    risk 0.07cvss —epss 0.46

    PHP remote file inclusion vulnerability in the SSTREAMTV custompages (com_custompages) 1.1 and earlier component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the cpage parameter to index.php.

  • CVE-2008-1092Mar 25, 2008
    Microsoft
    Word
    risk 0.02cvss —epss 0.26

    Buffer overflow in msjet40.dll before 4.0.9505.0 in Microsoft Jet Database Engine allows remote attackers to execute arbitrary code via a crafted Word file, as exploited in the wild in March 2008. NOTE: as of 20080513, Microsoft has stated that this is the same issue as…

  • CVE-2008-1160CriMar 25, 2008
    Zyxel
    ZyWALL 1050
    risk 0.68cvss 9.8epss 0.15

    ZyXEL ZyWALL 1050 has a hard-coded password for the Quagga and Zebra processes that is not changed when it is set by a user, which allows remote attackers to gain privileges.

  • CVE-2008-1489Mar 25, 2008
    VideoLAN
    Vlc
    risk 0.04cvss —epss 0.12

    Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MP4 RDRF box that triggers a heap-based buffer overflow, a different vulnerability than…

  • CVE-2007-6711Mar 24, 2008
    Freewebshop
    Freewebshop
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in customer.php in FreeWebshop.org 2.2.5, 2.2.6 and 2.2.7WIP1/2 allows remote attackers to gain administrator privileges via unknown vectors.

  • CVE-2008-1483Mar 24, 2008
    OpenSSH
    OpenSSH
    risk 0.00cvss —epss 0.00

    OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by…

  • CVE-2008-1484Mar 24, 2008
    Punbb
    Punbb
    risk 0.03cvss —epss 0.05

    The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the…

  • CVE-2008-1485Mar 24, 2008
    Punbb
    Punbb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in PunBB 1.2.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the get_host parameter to moderate.php.

  • CVE-2008-1486Mar 24, 2008
    Phorum
    Phorum
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Phorum before 5.2.6, when mysql_use_ft is disabled, allows remote attackers to execute arbitrary SQL commands via the non-fulltext search.

  • CVE-2008-1487Mar 24, 2008
    Linpha
    Linpha
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.3 allow remote attackers to inject arbitrary web script or HTML via (1) ftp/index.php, (2) viewer.php, (3) functions/other.php, (4) include/left_menu.class.php, and (5) plugins/stats/stats_view.php.

  • CVE-2008-1488Mar 24, 2008
    Alternative PHP Cache
    Alternative PHP Cache
    risk 0.04cvss —epss 0.08

    Stack-based buffer overflow in apc.c in Alternative PHP Cache (APC) 3.0.11 through 3.0.16 allows remote attackers to execute arbitrary code via a long filename.

  • CVE-2008-0073Mar 24, 2008
    Xine
    Xine Lib
    risk 0.04cvss —epss 0.09

    Array index error in the sdpplin_parse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter.