VYPR

CVEs

383,857 total · page 7083 of 7,678

AllCriticalHighKEV
  • CVE-2008-0996Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    The Printing component in Apple Mac OS X 10.5.2 might save authentication credentials to disk when starting a job on an authenticated print queue, which might allow local users to obtain the credentials.

  • CVE-2008-0998Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in NetCfgTool in the System Configuration component in Apple Mac OS X 10.4.11 and 10.5.2 allows local users to bypass authorization and execute arbitrary code via crafted distributed objects.

  • CVE-2008-0999Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Apple Mac OS X 10.5.2 allows user-assisted attackers to cause a denial of service (crash) via a crafted Universal Disc Format (UDF) disk image, which triggers a NULL pointer dereference.

  • CVE-2008-1000Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in ContentServer.py in the Wiki Server in Apple Mac OS X 10.5.2 (aka Leopard) allows remote authenticated users to write arbitrary files via ".." sequences in file attachments.

  • CVE-2008-0044Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in AFP Client in Apple Mac OS X 10.4.11 and 10.5.2 allow remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted afp:// URL.

  • CVE-2008-0045Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in AFP Server in Apple Mac OS X 10.4.11 allows remote attackers to bypass cross-realm authentication via unknown manipulations of Kerberos principal realm names.

  • CVE-2008-0046Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    The Application Firewall in Apple Mac OS X 10.5.2 has an incorrect German translation for the "Set access for specific services and applications" radio button that might cause the user to believe that the button is used to restrict access only to specific services and…

  • CVE-2008-0048Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in AppKit in Apple Mac OS X 10.4.11 allows context-dependent attackers to execute arbitrary code via the a long file name to the NSDocument API.

  • CVE-2008-0049Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    AppKit in Apple Mac OS X 10.4.11 inadvertently makes an NSApplication mach port available for inter-process communication instead of inter-thread communication, which allows local users to execute arbitrary code via crafted messages to privileged applications.

  • CVE-2008-0050Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    CFNetwork in Apple Mac OS X 10.4.11 allows remote HTTPS proxy servers to spoof secure websites via data in a 502 Bad Gateway error.

  • CVE-2008-0051Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Integer overflow in CoreFoundation in Apple Mac OS X 10.4.11 might allow local users to execute arbitrary code via crafted time zone data.

  • CVE-2008-0057Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Multiple integer overflows in a "legacy serialization format" parser in AppKit in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via a crafted serialized property list.

  • CVE-2008-0997Mar 18, 2008
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in AppKit in Apple Mac OS X 10.4.11 allows user-assisted remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted PostScript Printer Description (PPD) file that is not properly handled when…

  • CVE-2008-1383Mar 18, 2008
    File Project
    Linux
    risk 0.00cvss —epss 0.00

    The docert function in ssl-cert.eclass, when used by src_compile or src_install on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from the binpkg, and causes multiple systems that use this binpkg to have the same SSL key and certificate.

  • CVE-2008-1372Mar 18, 2008
    Bzip
    Bzip2
    risk 0.00cvss —epss 0.05

    bzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats.

  • CVE-2008-1330Mar 18, 2008
    Novell
    Groupwise
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Windows client API in Novell GroupWise 7 before SP3 and 6.5 before SP6 Update 3 allows remote authenticated users to access the non-shared stored e-mail messages of another user who has shared at least one folder with the attacker.

  • CVE-2008-1369Mar 18, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.03

    A certain incorrect Sun Solaris 10 image on SPARC Enterprise T5120 and T5220 servers has /etc/default/login and /etc/ssh/sshd_config files that configure root logins in a manner unintended by the vendor, which allows remote attackers to gain privileges via unspecified vectors.

  • CVE-2008-1370Mar 18, 2008
    Wildmary
    Yap Blog
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in wildmary Yap Blog 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-1371Mar 18, 2008
    Drake Team
    Drake CMS
    risk 0.03cvss —epss 0.02

    Absolute path traversal vulnerability in install/index.php in Drake CMS 0.4.11 RC8 allows remote attackers to read and execute arbitrary files via a full pathname in the d_root parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2008-0727Mar 18, 2008
    IBM
    Informix Dynamic Server
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in oninit.exe in IBM Informix Dynamic Server (IDS) 7.x through 11.x allow (1) remote attackers to execute arbitrary code via a long password and (2) remote authenticated users to execute arbitrary code via a long DBPATH value.

  • CVE-2008-0949Mar 18, 2008
    IBM
    Informix Dynamic Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in IBM Informix Dynamic Server (IDS) 7.x through 11.x allows remote attackers to gain privileges via a malformed connection request packet.

  • CVE-2008-1368Mar 18, 2008
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.11

    CRLF injection vulnerability in Microsoft Internet Explorer 5 and 6 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded CRLF (%0D%0A) before the FTP command, which causes the commands to be inserted into an authenticated FTP…

  • CVE-2008-1367Mar 17, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag (DF) from being reset in violation of ABI conventions and cause data to be copied in the wrong…

  • CVE-2008-1365Mar 17, 2008
    Trend Micro
    Officescan Corporate Edition
    risk 0.07cvss —epss 0.51

    Stack-based buffer overflow in Trend Micro OfficeScan Corporate Edition 8.0 Patch 2 build 1189 and earlier, and 7.3 Patch 3 build 1314 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a long encrypted password, which…

  • CVE-2008-1366Mar 17, 2008
    Trend Micro
    Officescan Corporate Edition
    risk 0.00cvss —epss 0.02

    Trend Micro OfficeScan Corporate Edition 8.0 Patch 2 build 1189 and earlier, and 7.3 Patch 3 build 1314 and earlier, allows remote attackers to cause a denial of service (process consumption) via (1) an HTTP request without a Content-Length header or (2) invalid characters in…

  • CVE-2008-0888Mar 17, 2008
    Unzip Project
    Unzip
    risk 0.01cvss —epss 0.06

    The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or…

  • CVE-2008-1353Mar 17, 2008
    Zabbix
    Zabbix
    risk 0.03cvss —epss 0.06

    zabbix_agentd in ZABBIX 1.4.4 allows remote attackers to cause a denial of service (CPU and connection consumption) via multiple vfs.file.cksum commands with a special device node such as /dev/urandom or /dev/zero.

  • CVE-2008-1354Mar 17, 2008
    Advanced Data Solutions
    Virtual Support Office Xp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in MyIssuesView.asp in Advanced Data Solutions Virtual Support Office-XP (VSO-XP) allows remote attackers to execute arbitrary SQL commands via the Issue_ID parameter.

  • CVE-2008-1355Mar 17, 2008
    Jeeblestechnology
    Directory
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Jeebles Technology Jeebles Directory 2.9.60 allows remote attackers to inject arbitrary web script or HTML via the path parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2008-1356Mar 17, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in xscreensaver in Sun Solaris 10 Java Desktop System (JDS), when using the GNOME On-Screen Keyboard (GOK), allows local users to bypass authentication via unknown vectors that cause the screen saver to crash.

  • CVE-2008-1357Mar 17, 2008
    McAfee
    Epolicy Orchestrator
    risk 0.03cvss —epss 0.06

    Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code…

  • CVE-2008-1358Mar 17, 2008
    Alt N
    Mdaemon
    risk 0.08cvss —epss 0.57

    Stack-based buffer overflow in the IMAP server in Alt-N Technologies MDaemon 9.6.4 allows remote authenticated users to execute arbitrary code via a FETCH command with a long BODY.

  • CVE-2008-1359Mar 17, 2008
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB or IP.Board) 2.3.4 before 2008-03-13 allows remote attackers to inject arbitrary web script or HTML via nested BBCodes, a different vector than CVE-2008-0913.

  • CVE-2008-1360Mar 17, 2008
    Nagios
    Nagios
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Nagios before 2.11 allows remote attackers to inject arbitrary web script or HTML via unknown vectors to unspecified CGI scripts, a different issue than CVE-2007-5624.

  • CVE-2008-1341Mar 17, 2008
    Lagarde
    Storefront
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in SearchResults.aspx in LaGarde StoreFront 6 before SP8 allows remote attackers to execute arbitrary SQL commands via the CategoryId parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-1342Mar 17, 2008
    Polymita Technologies
    Collageportal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the search feature in Polymita BPM-Suite and CollagePortal allow remote attackers to inject arbitrary web script or HTML via the (1) _q and (2) lucene_index_field_value parameters. NOTE: the provenance of this information…

  • CVE-2008-1343Mar 17, 2008
    SCO Group
    Unixware
    risk 0.03cvss —epss 0.01

    Directory traversal vulnerability in (1) pkgadd and (2) pkgrm in SCO UnixWare 7.1.4 allows local users to gain privileges via unknown vectors.

  • CVE-2008-1344Mar 17, 2008
    Myiosoft
    Easycalendar
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MyioSoft EasyCalendar 4.0tr and earlier allow remote attackers to execute arbitrary SQL commands via the (1) year parameter in a dayview action to plugins/calendar/calendar_backend.php and the (2) page parameter to ajaxp_backend.php.

  • CVE-2008-1345Mar 17, 2008
    Myiosoft
    Easycalendar
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in plugins/calendar/calendar_backend.php in MyioSoft EasyCalendar 4.0tr and earlier allows remote attackers to inject arbitrary web script or HTML via the day parameter in a dayview action.

  • CVE-2008-1346Mar 17, 2008
    Myiosoft
    EasyGallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in staticpages/easygallery/index.php in MyioSoft EasyGallery 5.0tr and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter in a category action.

  • CVE-2008-1347Mar 17, 2008
    Myiosoft
    EasyGallery
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in staticpages/easygallery/index.php in MyioSoft EasyGallery 5.0tr and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO or (2) the q parameter in an about action to the help system.

  • CVE-2008-1348Mar 17, 2008
    Ewebsite
    Eweather
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in the eWebsite eWeather (Weather) module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the chart parameter to modules.php.

  • CVE-2008-1349Mar 17, 2008
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in viewcat.php in the bamaGalerie (Bama Galerie) 3.03 and 3.041 module for eXV2 2.0.6 allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2008-1350Mar 17, 2008
    Fully Modded Phpbb
    Fully Modded Phpbb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in kb.php in Fully Modded phpBB (phpbbfm) 80220 allows remote attackers to execute arbitrary SQL commands via the k parameter in an article action.

  • CVE-2008-1351Mar 17, 2008
    XOOPS
    Tutoriais Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Tutorials 2.1b module for XOOPS allows remote attackers to execute arbitrary SQL commands via the tid parameter to printpage.php, which is accessible directly or through a printpage action to index.php.

  • CVE-2008-1352Mar 17, 2008
    EdiorCMS
    ecms
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in search.php in EdiorCMS (ecms) 3.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the _SearchTemplate parameter during a Title search.

  • CVE-2008-0532Mar 14, 2008
    Cisco Systems, Inc.
    Secure Access Control Server
    risk 0.08cvss —epss 0.57

    Multiple buffer overflows in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to execute arbitrary code via a long argument located immediately after…

  • CVE-2008-0533Mar 14, 2008
    Cisco Systems, Inc.
    Secure Access Control Server
    risk 0.05cvss —epss 0.29

    Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to inject arbitrary web script or HTML via an…

  • CVE-2008-1117Mar 14, 2008
    Timbuktu
    Pro
    risk 0.09cvss —epss 0.69

    Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \…

  • CVE-2008-1118Mar 14, 2008
    Timbuktu
    Pro
    risk 0.03cvss —epss 0.03

    Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, does not perform input validation before logging information fields taken from packets from a remote peer, which allows remote attackers to generate crafted log entries, and possibly avoid detection of attacks, via…