VYPR

CVEs

383,869 total · page 7082 of 7,678

AllCriticalHighKEV
  • CVE-2008-1405Mar 20, 2008
    Fuzzylime
    cms
    risk 0.06cvss —epss 0.38

    PHP remote file inclusion vulnerability in code/display.php in fuzzylime (cms) 3.01 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter.

  • CVE-2008-1406Mar 20, 2008
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in annonces-p-f.php in the MyAnnonces 1.8 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the lid parameter in an ImprAnn action.

  • CVE-2008-1407Mar 20, 2008
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the WebChat 1.60 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the roomid parameter.

  • CVE-2008-1408Mar 20, 2008
    Phpbp
    Phpbp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in includes/functions/banners-external.php in phpBP 2 RC3 (2.204) FIX 4 allows remote attackers to execute arbitrary SQL commands via the id parameter in a banner_out action.

  • CVE-2008-1409Mar 20, 2008
    Exero CMS
    CMS
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in the Default theme in Exero CMS 1.0.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the theme parameter to (1) index.php, (2) editpassword.php, and (3) avatar.php in…

  • CVE-2008-1410Mar 20, 2008
    Acronis
    Snap Deploy
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in the PXE Server (pxesrv.exe) in Acronis Snap Deploy 2.0.0.1076 and earlier allows remote attackers to read arbitrary files via directory traversal sequences to the TFTP service.

  • CVE-2008-1411Mar 20, 2008
    Acronis
    Snap Deploy
    risk 0.04cvss —epss 0.08

    The PXE Server (pxesrv.exe) in Acronis Snap Deploy 2.0.0.1076 and earlier allows remote attackers to cause a denial of service (crash) via an incomplete TFTP request, which triggers a NULL pointer dereference.

  • CVE-2008-1412Mar 20, 2008
    F-Secure
    Internet Security
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2008, and others, allows remote attackers to execute arbitrary code or cause a denial of service (hang or crash) via a malformed archive…

  • CVE-2008-1413Mar 20, 2008
    Snewscms
    Snewscms Rus
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in SNewsCMS Rus 2.1 through 2.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter.

  • CVE-2008-1414Mar 20, 2008
    Multiple Time Sheets
    MTS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the tab parameter to (1) index.php, as demonstrated using mixed case and encoded whitespace characters in the tag; or (2)…

  • CVE-2008-1415Mar 20, 2008
    Multiple Time Sheets
    Multiple Time Sheets
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to read arbitrary files via "../..//" (modified dot dot) sequences in the tab parameter.

  • CVE-2008-1416Mar 20, 2008
    Phpauction
    Phpauction
    risk 0.06cvss —epss 0.38

    Multiple PHP remote file inclusion vulnerabilities in PHPauction GPL 2.51 allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to (1) converter.inc.php, (2) messages.inc.php, and (3) settings.inc.php in includes/.

  • CVE-2007-4592Mar 20, 2008
    IBM
    Rational Clearquest
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A, 7.0.0.2_iFix01, and 7.0.1.1_iFix01 allow remote attackers to inject arbitrary web script or HTML via the (1) contextid, (2) username, (3)…

  • CVE-2007-6254Mar 20, 2008
    SAP
    Businessobjects
    risk 0.01cvss —epss 0.06

    Stack-based buffer overflow in the SAP Business Objects BusinessObjects RptViewerAX ActiveX control in RptViewerAX.dll in Business Objects 6.5 before CHF74 allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2008-0164Mar 20, 2008
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page.

  • CVE-2008-0707Mar 20, 2008
    Microfocus
    StorageWorks Library and Tape Tools
    risk 0.00cvss —epss 0.00

    HP StorageWorks Library and Tape Tools (LTT) before 4.5 SR1 on HP-UX B.11.11 and B.11.23 allows local users to gain privileges via unspecified vectors.

  • CVE-2008-0889Mar 20, 2008
    Red Hat
    Directory Server
    risk 0.00cvss —epss 0.00

    Red Hat Directory Server 8.0, when running on Red Hat Enterprise Linux, uses insecure permissions for the redhat-idm-console script, which allows local users to execute arbitrary code by modifying the script.

  • CVE-2008-1332Mar 20, 2008
    Asterisk
    Asterisk
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before 1.4.18.1 and 1.4.19-rc3; Business Edition A.x.x, B.x.x before B.2.5.1, and C.x.x before C.1.6.2; AsteriskNOW 1.0.x before 1.0.2; Appliance Developer Kit before 1.4 revision 109393; and s800i…

  • CVE-2008-1333Mar 20, 2008
    Asterisk
    Asterisk Open Source
    risk 0.00cvss —epss 0.03

    Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call, or (2) the astman_append function.

  • CVE-2008-1340Mar 20, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.02

    Virtual Machine Communication Interface (VMCI) in VMware Workstation 6.0.x before 6.0.3, VMware Player 2.0.x before 2.0.3, and VMware ACE 2.0.x before 2.0.1 allows attackers to cause a denial of service (host OS crash) via crafted VMCI calls that trigger "memory exhaustion and…

  • CVE-2008-1361Mar 20, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x before 2.0.1 and 1.0.x before 1.0.5, and VMware Server 1.0.x before 1.0.5 on Windows allow local users to gain privileges via an unspecified…

  • CVE-2008-1362Mar 20, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x before 2.0.1 and 1.0.x before 1.0.5, and VMware Server 1.0.x before 1.0.5 on Windows allow local users to gain privileges or cause a denial of…

  • CVE-2008-1363Mar 20, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x before 2.0.1 and 1.0.x before 1.0.5, and VMware Server 1.0.x before 1.0.5 on Windows allow local users to gain privileges via an unspecified…

  • CVE-2008-1364Mar 20, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the DHCP service in VMware Workstation 5.5.x before 5.5.6, VMware Player 1.0.x before 1.0.6, VMware ACE 1.0.x before 1.0.5, VMware Server 1.0.x before 1.0.5, and VMware Fusion 1.1.x before 1.1.1 allows attackers to cause a denial of service.

  • CVE-2008-1392Mar 20, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.03

    The default configuration of VMware Workstation 6.0.2, VMware Player 2.0.x before 2.0.3, and VMware ACE 2.0.x before 2.0.1 makes the console of the guest OS accessible through anonymous VIX API calls, which has unknown impact and attack vectors.

  • CVE-2008-1393Mar 20, 2008
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.03

    Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.

  • CVE-2008-1394Mar 20, 2008
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.01

    Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.

  • CVE-2008-1395Mar 20, 2008
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.01

    Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier for context-dependent attackers to reuse a logged-out session.

  • CVE-2008-1396Mar 20, 2008
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.01

    Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network.

  • CVE-2008-1397Mar 20, 2008
    Checkpoint
    VPN 1
    risk 0.00cvss —epss 0.02

    Check Point VPN-1 Power/UTM, with NGX R60 through R65 and NG AI R55 software, allows remote authenticated users to cause a denial of service (site-to-site VPN tunnel outage), and possibly intercept network traffic, by configuring the local RFC1918 IP address to be the same as…

  • CVE-2008-0062CriMar 19, 2008
    Mit
    Kerberos 5
    risk 0.65cvss 9.8epss 0.10

    KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free.

  • CVE-2008-0063HigMar 19, 2008
    Mit
    Kerberos 5
    risk 0.49cvss 7.5epss 0.03

    The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."

  • CVE-2008-0947Mar 19, 2008
    Mit
    Kerberos 5
    risk 0.01cvss —epss 0.09

    Buffer overflow in the RPC library used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.4 through 1.6.3 allows remote attackers to execute arbitrary code by triggering a large number of open file descriptors.

  • CVE-2008-0948Mar 19, 2008
    Mit
    Kerberos 5
    risk 0.01cvss —epss 0.07

    Buffer overflow in the RPC library (lib/rpc/rpc_dtablesize.c) used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.2.2, and probably other versions before 1.3, when running on systems whose unistd.h does not define the FD_SETSIZE macro, allows remote attackers to cause a…

  • CVE-2008-1001Mar 19, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Apple Safari before 3.1, when running on Windows XP or Vista, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that is not properly handled in the error page.

  • CVE-2008-1002Mar 19, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Apple Safari before 3.1 allows remote attackers to inject arbitrary web script or HTML via a crafted javascript: URL.

  • CVE-2008-1003Mar 19, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to sites that set the document.domain property or have the same document.domain.

  • CVE-2008-1004Mar 19, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the Web Inspector.

  • CVE-2008-1005Mar 19, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.00

    WebCore, as used in Apple Safari before 3.1, does not properly mask the password field when reverse conversion is used with the Kotoeri input method, which allows physically proximate attackers to read the password.

  • CVE-2008-1006Mar 19, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML by using the window.open function to change the security context of a web page.

  • CVE-2008-1007Mar 19, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebCore, as used in Apple Safari before 3.1, does not enforce the frame navigation policy for Java applets, which allows remote attackers to conduct cross-site scripting (XSS) attacks.

  • CVE-2008-1008Mar 19, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via the document.domain property.

  • CVE-2008-1009Mar 19, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary JavaScript by modifying the history object.

  • CVE-2008-1010Mar 19, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.05

    Buffer overflow in WebKit, as used in Apple Safari before 3.1, allows remote attackers to execute arbitrary code via crafted regular expressions in JavaScript.

  • CVE-2008-1011Mar 19, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via a frame that calls a method instance in another frame.

  • CVE-2008-0047Mar 18, 2008
    Openprinting
    Cups
    risk 0.00cvss —epss 0.07

    Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the version bundled with Apple Mac OS X 10.5.2, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions.

  • CVE-2008-0052Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    CoreServices in Apple Mac OS X 10.4.11 treats .ief as a safe file type, which allows remote attackers to force Safari users into opening an .ief file in AppleWorks, even when the "Open 'Safe' files" preference is set.

  • CVE-2008-0053Mar 18, 2008
    Apple Inc.
    Cups
    risk 0.00cvss —epss 0.08

    Multiple buffer overflows in the HP-GL/2-to-PostScript filter in CUPS before 1.3.6 might allow remote attackers to execute arbitrary code via a crafted HP-GL/2 file.

  • CVE-2008-0054Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.05

    Foundation in Apple Mac OS X 10.4.11 might allow context-dependent attackers to execute arbitrary code via a malformed selector name to the NSSelectorFromString API, which causes an "unexpected selector" to be used.

  • CVE-2008-0055Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Foundation in Apple Mac OS X 10.4.11 creates world-writable directories while NSFileManager copies files recursively and only modifies the permissions afterward, which allows local users to modify copied files to cause a denial of service and possibly gain privileges.