VYPR

CVEs

383,869 total · page 7081 of 7,678

AllCriticalHighKEV
  • CVE-2008-0125Mar 24, 2008
    PHP Stats
    Phpstats
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in phpstats.php in Michael Wagner phpstats 0.1 alpha allows remote attackers to inject arbitrary web script or HTML via the baseDir parameter.

  • CVE-2008-0951Mar 24, 2008
    Microsoft
    Windows
    risk 0.02cvss —epss 0.30

    Microsoft Windows Vista does not properly enforce the NoDriveTypeAutoRun registry value, which allows user-assisted remote attackers, and possibly physically proximate attackers, to execute arbitrary code by inserting a (1) CD-ROM device or (2) U3-enabled USB device containing a…

  • CVE-2008-1470Mar 24, 2008
    Rsa
    Webid
    risk 0.03cvss —epss 0.02

    Incomplete blacklist vulnerability in IISWebAgentIF.dll in the WebID RSA Authentication Agent 5.3, and possibly earlier, allows remote attackers to conduct cross-site scripting (XSS) attacks via the postdata parameter, due to an incomplete fix for CVE-2005-1118.

  • CVE-2008-1471Mar 24, 2008
    Panda Project
    Panda Internet Security
    risk 0.03cvss —epss 0.01

    The cpoint.sys driver in Panda Internet Security 2008 and Antivirus+ Firewall 2008 allows local users to cause a denial of service (system crash or kernel panic), overwrite memory, or execute arbitrary code via a crafted IOCTL request that triggers an out-of-bounds write of…

  • CVE-2008-1472Mar 24, 2008
    Ca
    Desktop Management Suite
    risk 0.06cvss —epss 0.39

    Stack-based buffer overflow in the ListCtrl ActiveX Control (ListCtrl.ocx), as used in multiple CA products including BrightStor ARCserve Backup R11.5, Desktop Management Suite r11.1 through r11.2, and Unicenter products r11.1 through r11.2, allows remote attackers to execute…

  • CVE-2008-1473Mar 24, 2008
    Symantec
    Deployment Solution
    risk 0.00cvss —epss 0.00

    The Altiris Client Service (AClient.exe) in Symantec Altiris Deployment Solution 6.8.x before 6.9.164 allows local users to gain privileges via a "Shatter" style attack.

  • CVE-2008-1474Mar 24, 2008
    Roundup Tracker
    Roundup
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Roundup before 1.4.4 have unknown impact and attack vectors, some of which may be related to cross-site scripting (XSS).

  • CVE-2008-1475Mar 24, 2008
    Roundup Tracker
    Roundup
    risk 0.00cvss —epss 0.02

    The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.

  • CVE-2008-1476Mar 24, 2008
    Serendipity
    Serendipity
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to received trackbacks.

  • CVE-2008-1477Mar 24, 2008
    EForum
    eForum
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in busca.php in eForum 0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) busca and (2) link parameters.

  • CVE-2008-1478Mar 24, 2008
    Home FTP Server Project
    Home Ftp Server
    risk 0.03cvss —epss 0.03

    Home FTP Server 1.4.5.89 allows remote attackers to cause a denial of service (crash) by opening a FTP passive mode connection, then closing the original FTP connection. NOTE: some of these details are obtained from third party information.

  • CVE-2008-1479Mar 24, 2008
    Cyberfrogs
    Cfnetgs
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in cyberfrogs.net cfnetgs 0.24 allows remote attackers to inject arbitrary web script or HTML via the directory parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-1480Mar 24, 2008
    Sun Corporation
    Solaris
    risk 0.03cvss —epss 0.06

    rpc.metad in Sun Solaris 10 allows remote attackers to cause a denial of service (daemon crash) via a malformed RPC request.

  • CVE-2008-1481Mar 24, 2008
    Webspell
    Webspell
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in webSPELL 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the board parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-1482Mar 24, 2008
    Xine
    Xine Lib
    risk 0.04cvss —epss 0.10

    Multiple integer overflows in xine-lib 1.1.11 and earlier allow remote attackers to trigger heap-based buffer overflows and possibly execute arbitrary code via (1) a crafted .FLV file, which triggers an overflow in demuxers/demux_flv.c; (2) a crafted .MOV file, which triggers an…

  • CVE-2008-1462Mar 24, 2008
    Runcms
    Runcms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the sections (Section) module in RunCMS allows remote attackers to execute arbitrary SQL commands via the artid parameter in a viewarticle action.

  • CVE-2008-1463Mar 24, 2008
    Imperva
    Securesphere
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the management GUI in Imperva SecureSphere MX Management Server 5.0 allows remote attackers to inject arbitrary web script or HTML via an invalid or prohibited request to a web server protected by SecureSphere, which triggers injection…

  • CVE-2008-1464Mar 24, 2008
    Gallarific
    Gallarific
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Gallarific Free Edition 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) query parameter to (a) search.php; (2) gusername and (3) gpassword parameters to (b) login.php; and the (4) username and (5) password…

  • CVE-2008-1465Mar 24, 2008
    Joomla
    Restaurante
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Detodas Restaurante (com_restaurante) 1.0 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php, a different product than CVE-2008-0562.

  • CVE-2008-1466Mar 24, 2008
    W Agora
    W Agora
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in W-Agora 4.0 allow remote attackers to execute arbitrary PHP code via a URL in the bn_dir_default parameter to (1) add_user.php, (2) create_forum.php, (3) create_user.php, (4) delete_notes.php, (5) delete_user.php, (6)…

  • CVE-2008-1467Mar 24, 2008
    Centerim
    Centerim
    risk 0.03cvss —epss 0.04

    CenterIM 4.22.3 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URI, related to "received URLs in the message window." NOTE: this issue has been disputed due to the user-assisted nature, since the URL must be…

  • CVE-2008-1468Mar 24, 2008
    Namazu
    Namazu
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in namazu.cgi in Namazu before 2.0.18 allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded input, related to failure to set the charset, a different vector than CVE-2004-1318 and CVE-2001-1350. NOTE: some of…

  • CVE-2008-1469Mar 24, 2008
    Gallarific
    Gallarific
    risk 0.00cvss —epss 0.01

    Gallarific Free Edition 1.1 does not require authentication for (1) photos.php, (2) comments.php, and (3) gallery.php in gadmin/, which allows remote attackers to edit objects via a direct request, different vectors than CVE-2008-1327. NOTE: the provenance of this information…

  • CVE-2008-1458Mar 24, 2008
    Office Ocx
    Cs Cart
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in CS-Cart 1.3.2 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a products search action. NOTE: it was also reported that 1.3.5-SP2 trial edition is also affected.

  • CVE-2008-1459Mar 24, 2008
    Joomla
    com_alberghi
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Alberghi (com_alberghi) 2.1.3 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.

  • CVE-2008-1460Mar 24, 2008
    Joovideo
    com_joovideo
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the Joovideo (com_joovideo) 1.0 and 1.2.2 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.

  • CVE-2008-1461Mar 24, 2008
    Xnview
    Xnview
    risk 0.04cvss —epss 0.11

    Buffer overflow in XnView 1.92.1 allows user-assisted remote attackers to execute arbitrary code via a long filename argument on the command line. NOTE: it is unclear whether there are common handler configurations in which this argument is controlled by an attacker.

  • CVE-2008-1201Mar 24, 2008
    Adobe Inc.
    Flash
    risk 0.02cvss —epss 0.20

    Multiple unspecified vulnerabilities in FLA file parsing in Adobe Flash CS3 Professional, Flash Professional 8, and Flash Basic 8 on Windows allow user-assisted remote attackers to execute arbitrary code via a crafted .FLA file.

  • CVE-2008-1289Mar 24, 2008
    Asterisk
    Asterisknow
    risk 0.00cvss —epss 0.12

    Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit before 1.4 revision 109386, and s800i 1.1.x before 1.1.0.2…

  • CVE-2008-1290Mar 24, 2008
    Viewvc
    Viewvc
    risk 0.00cvss —epss 0.01

    ViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion (SVN) commits, which allows remote attackers to obtain sensitive information.

  • CVE-2008-1291Mar 24, 2008
    Viewvc
    Viewvc
    risk 0.00cvss —epss 0.01

    ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder.

  • CVE-2008-1292Mar 24, 2008
    Viewvc
    Viewvc
    risk 0.00cvss —epss 0.01

    ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only be reached by traversing a…

  • CVE-2008-1390Mar 24, 2008
    Asterisk
    Asterisk
    risk 0.00cvss —epss 0.04

    The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random…

  • CVE-2008-1425Mar 20, 2008
    Easy Clanpage
    gallery module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the gallery module in Easy-Clanpage 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a kate action.

  • CVE-2008-1426Mar 20, 2008
    Kaphotoservice
    Kaphotoservice
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in album.asp in KAPhotoservice allows remote attackers to execute arbitrary SQL commands via the albumid parameter.

  • CVE-2008-1427Mar 20, 2008
    Joobi
    Acajoom
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the Joobi Acajoom (com_acajoom) 1.1.5 and 1.2.5 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mailingid parameter in a mailing view action to index.php.

  • CVE-2008-1428Mar 20, 2008
    Drupal
    Ubercart Module
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart 5.x before 5.x-1.0-beta7 module for Drupal allow remote attackers to inject arbitrary web script or HTML via a text attribute value for a product.

  • CVE-2008-1429Mar 20, 2008
    Silc
    Silc Server
    risk 0.00cvss —epss 0.02

    Secure Internet Live Conferencing (SILC) Server before 1.1.1 allows remote attackers to cause a denial of service (daemon crash) via a NEW_CLIENT packet without a nickname.

  • CVE-2008-1430Mar 20, 2008
    Aspapp
    ASPapp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in links.asp in ASPapp allows remote attackers to execute arbitrary SQL commands via the CatId parameter.

  • CVE-2008-1431Mar 20, 2008
    Raidsonic
    Firmware
    risk 0.00cvss —epss 0.00

    RaidSonic NAS-4220-B with 2.6.0-n(2007-10-11) firmware stores a partition encryption key in an unencrypted /system/.crypt file with base64 encoding, which allows local users to obtain the key.

  • CVE-2008-1432Mar 20, 2008
    Manageengine
    Supportcenter Plus
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine SupportCenter Plus 7.0.0 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter, a related issue to CVE-2008-1299. NOTE: the provenance of this information is…

  • CVE-2008-1417Mar 20, 2008
    Axyl
    Axyl
    risk 0.00cvss —epss 0.00

    The prerm script in axyl 2.1.7 allows local users to overwrite arbitrary files via a symlink attack on the axyl.conf temporary file.

  • CVE-2008-1012Mar 20, 2008
    Apple Inc.
    Airport Extreme Base Station Firmware
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Apple AirPort Extreme Base Station Firmware 7.3.1 allows remote attackers to cause a denial of service (file sharing hang) via a crafted AFP request, related to "input validation."

  • CVE-2008-1398Mar 20, 2008
    Auracms
    Auracms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in online.php in AuraCMS 2.0 through 2.2.1 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For field (HTTP_X_FORWARDED_FOR environment variable) in an HTTP header.

  • CVE-2008-1399Mar 20, 2008
    Clansphere
    Clansphere
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Clansphere 2008 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-1400Mar 20, 2008
    Mg Soft
    Net Inspector
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in the Net Inspector HTTP Server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) or "../" (dot dot slash) in the URI.

  • CVE-2008-1401Mar 20, 2008
    Mg Soft
    Net Inspector
    risk 0.03cvss —epss 0.03

    Format string vulnerability in the Net Inspector HTTP server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to execute arbitrary code via format string specifiers in the URI, which is recorded in a log file.

  • CVE-2008-1402Mar 20, 2008
    Mg Soft
    Net Inspector
    risk 0.03cvss —epss 0.03

    MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to cause a (1) denial of service (exception and crash) via a UDP packet to the SNMP Trap Service (MgWTrap3.exe) or (2) denial of service (device freeze or memory consumption) via a malformed request…

  • CVE-2008-1403Mar 20, 2008
    Bootmanage
    Administrator
    risk 0.03cvss —epss 0.04

    Stack-based buffer overflow in the TFTP server in BootManage TFTPD 1.99 and earlier in BootManage Administrator 7.1 and earlier allows remote attackers to execute arbitrary code via a request with a long filename.

  • CVE-2008-1404Mar 20, 2008
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Viso (Industry Book) 2.04 and 2.03 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the kid parameter.