VYPR

CVEs

383,857 total · page 7084 of 7,678

AllCriticalHighKEV
  • CVE-2008-1157Mar 14, 2008
    Cisco Systems, Inc.
    Ciscoworks Internetwork Performance Monitor
    risk 0.02cvss —epss 0.21

    Cisco CiscoWorks Internetwork Performance Monitor (IPM) 2.6 creates a process that executes a command shell and listens on a randomly chosen TCP port, which allows remote attackers to execute arbitrary commands.

  • CVE-2008-1337Mar 14, 2008
    Timbuktu
    Pro
    risk 0.00cvss —epss 0.02

    The instant message service in Timbuktu Pro 8.6.5 RC 229 and earlier for Windows allows remote attackers to cause (1) a denial of service (daemon crash) via an invalid Version field or (2) a denial of service (CPU consumption and daemon termination) via an invalid or partial…

  • CVE-2008-1338Mar 14, 2008
    Rogue Wave
    Perforce Server
    risk 0.00cvss —epss 0.02

    The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a server-DiffFile command with an integer value within a certain range, which causes a loop until all memory is exhausted.

  • CVE-2007-6707Mar 13, 2008
    Linksys
    Wag54gs
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.01.03 and earlier firmware allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2007-3574.

  • CVE-2007-6708Mar 13, 2008
    Linksys
    Wag54gs
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.01.03 and earlier firmware allow remote attackers to perform actions as administrators via an arbitrary valid request to an administrative URI, as demonstrated…

  • CVE-2007-6709Mar 13, 2008
    Linksys
    Wag54gs
    risk 0.00cvss —epss 0.02

    The Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.01.03 and earlier firmware has "admin" as its default password for the "admin" account, which makes it easier for remote attackers to obtain access.

  • CVE-2008-1334Mar 13, 2008
    Bt
    Home Hub
    risk 0.00cvss —epss 0.02

    cgi/b on the BT Home Hub router allows remote attackers to bypass authentication, and read or modify administrative settings or make arbitrary VoIP telephone calls, by placing a character at the end of the PATH_INFO, as demonstrated by (1) %5C (encoded backslash), (2) '%'…

  • CVE-2008-1335Mar 13, 2008
    NetBSD
    NetBSD
    risk 0.00cvss —epss 0.02

    The ipsec4_get_ulp function in the kernel in NetBSD 2.0 through 3.1 and NetBSD-current before 20071028, when the fast_ipsec subsystem is enabled, allows remote attackers to bypass the IPsec policy by sending packets from a source machine with a different endianness than the…

  • CVE-2008-1336Mar 13, 2008
    Koobi CMS
    Koobi CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Koobi CMS 4.2.3 through 4.3.0 allows remote attackers to execute arbitrary SQL commands via the categ parameter in a links action to index.php, a different vector than CVE-2008-1122.

  • CVE-2008-1315Mar 13, 2008
    PHP-Nuke
    Zclassifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the ZClassifieds module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the cat parameter to modules.php.

  • CVE-2008-1316Mar 13, 2008
    Qt Cute
    Quicktalk Forum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in qtf_ind_search_ov.php in QT-cute QuickTalk Forum 1.6 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-1317Mar 13, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Inter-Process Communication (IPC) message queue subsystem in Sun Solaris 10 allows local users to cause a denial of service (reboot) via blocked I/O message queues.

  • CVE-2008-1318Mar 13, 2008
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in MediaWiki 1.11 before 1.11.2 allows remote attackers to obtain sensitive "cross-site" information via the callback parameter in an API call for JavaScript Object Notation (JSON) formatted results.

  • CVE-2008-1319Mar 13, 2008
    Versant
    Versant Object Database
    risk 0.03cvss —epss 0.05

    Untrusted search path and argument injection vulnerability in the VersantD service in Versant Object Database 7.0.1.3 and earlier, as used in Borland CaliberRM and probably other products, allows remote attackers to execute arbitrary commands via a request to TCP port 5019 with…

  • CVE-2008-1320Mar 13, 2008
    Asg Sentry
    Sentry Network Manager
    risk 0.04cvss —epss 0.16

    Multiple buffer overflows in ASG-Sentry Network Manager 7.0.0 and earlier allow remote attackers to execute arbitrary code or cause a denial of service (crash) via (1) a long request to FxIAList on TCP port 6162, or (2) an SNMP request with a long community string to FxAgent on…

  • CVE-2008-1321Mar 13, 2008
    Asg Sentry
    Sentry Network Manager
    risk 0.04cvss —epss 0.08

    The FxIAList service in ASG-Sentry Network Manager 7.0.0 and earlier does require authentication, which allows remote attackers to cause a denial of service (service termination) via the exit command to TCP port 6162, or have other impacts via other commands.

  • CVE-2008-1322Mar 13, 2008
    Asg Sentry
    Sentry Network Manager
    risk 0.04cvss —epss 0.10

    The File Check Utility (fcheck.exe) in ASG-Sentry Network Manager 7.0.0 and earlier allows remote attackers to cause a denial of service (CPU consumption) or overwrite arbitrary files via a query string that specifies the -b option, probably due to an argument injection…

  • CVE-2008-1323Mar 13, 2008
    Woltlab
    Burning Board Lite
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in index.php in WoltLab Burning Board Lite (wBB) 2 Beta 1 allows remote attackers to delete threads as other users via the ThreadDelete action.

  • CVE-2008-1324Mar 13, 2008
    Travelsized
    Travelsized CMS
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in index.php in Travelsized CMS 0.4.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) page_id and (2) language parameters. NOTE: this might be the same issue as CVE-2008-1325.

  • CVE-2008-1325Mar 13, 2008
    Uberghey CMS
    CMS
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in index.php in Uberghey CMS 0.3.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) page_id and (2) language parameters. NOTE: this might be the same issue as CVE-2008-1324.

  • CVE-2008-1326Mar 13, 2008
    Gallarific
    Gallarific
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in Gallarific allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-1327Mar 13, 2008
    Gallarific
    Gallarific
    risk 0.03cvss —epss 0.03

    Gallarific does not require authentication for (1) users.php and (2) index.php, which allows remote attackers to add and edit tasks via a direct request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-1295Mar 12, 2008
    Gregory Kokanosky
    Phpmynewsletter
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in archives.php in Gregory Kokanosky (aka Greg's Place) phpMyNewsletter 0.8 beta 5 and earlier allows remote attackers to execute arbitrary SQL commands via the msg_id parameter.

  • CVE-2008-1296Mar 12, 2008
    EncapsGallery
    EncapsGallery
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in EncapsGallery 1.11.2 allow remote attackers to inject arbitrary web script or HTML via the file parameter to (1) watermark.php and (2) catalog_watermark.php in core/. NOTE: the provenance of this information is unknown; the…

  • CVE-2008-1297Mar 12, 2008
    Ewriting
    Ewriting
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the eWriting (com_ewriting) 1.2.1 module for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in a selectcat action.

  • CVE-2008-1298Mar 12, 2008
    PHP-Nuke
    Hadith Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Hadith module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the cat parameter in a viewcat action to modules.php.

  • CVE-2008-1299MedMar 12, 2008
    Manageengine
    Servicedesk Plus
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the…

  • CVE-2008-1300Mar 12, 2008
    Alkacon
    Opencms
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the filePath.0 parameter…

  • CVE-2008-1301Mar 12, 2008
    Alkacon
    Opencms
    risk 0.00cvss —epss 0.02

    Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote authenticated administrators to read arbitrary files via a full pathname in the filePath.0 parameter.

  • CVE-2008-1302Mar 12, 2008
    Rogue Wave
    Perforce Server
    risk 0.00cvss —epss 0.02

    The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a (1) server-DiffFile or (2) server-ReleaseFile command with a large integer value, which is used in an array initialization…

  • CVE-2008-1303Mar 12, 2008
    Rogue Wave
    Perforce Server
    risk 0.04cvss —epss 0.08

    The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a missing parameter to the (1) dm-FaultFile, (2) dm-LazyCheck, (3) dm-ResolvedFile, (4) dm-OpenFile, (5) crypto, and possibly…

  • CVE-2008-1304Mar 12, 2008
    WordPress
    WordPress
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) inviteemail parameter in an invite action to wp-admin/users.php and the (2) to parameter in a sent action to wp-admin/invites.php.

  • CVE-2008-1305Mar 12, 2008
    PhpBB
    Filebase mod
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in filebase.php in the Filebase mod for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-1306Mar 12, 2008
    Savvy
    Content Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Savvy Content Manager (CM) allow remote attackers to inject arbitrary web script or HTML via the searchterms parameter to (1) searchresults.cfm, (2) search_results.cfm, and (3) search_results/index.cfm. NOTE: the provenance…

  • CVE-2008-1307Mar 12, 2008
    Kingsoft
    Antivirus Online Update Module
    risk 0.04cvss —epss 0.15

    Heap-based buffer overflow in the KUpdateObj2 Class ActiveX control in UpdateOcx2.dll in Beijing KingSoft Antivirus Online Update Module 2007.12.29.29 allows remote attackers to execute arbitrary code via a long argument to the SetUninstallName method.

  • CVE-2008-1308Mar 12, 2008
    Sudirman Angriawan
    Nukec30
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Sudirman Angriawan NukeC30 3.0 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id_catg parameter in a ViewCatg action to modules.php.

  • CVE-2008-1309Mar 12, 2008
    RealNetworks
    Realplayer
    risk 0.07cvss —epss 0.46

    The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the (1) Console or (2) Controls…

  • CVE-2008-1310Mar 12, 2008
    Packettrap
    Pt360 Tool Suite
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the TFTP server in PacketTrap Networks pt360 Tool Suite 1.1.33.1.0, and other versions before 2.0.3900.0, allows remote attackers to read and overwrite arbitrary files via directory traversal sequences in the pathname.

  • CVE-2008-1311Mar 12, 2008
    Packettrap
    Pt360 Tool Suite Pro
    risk 0.07cvss —epss 0.49

    The TFTP server in PacketTrap pt360 Tool Suite PRO 2.0.3901.0 and earlier allows remote attackers to cause a denial of service (daemon hang) by uploading a file named (1) '|' (pipe), (2) '"' (quotation mark), or (3) "<>" (less than, greater than); or (4) a file with a long name.…

  • CVE-2008-1312Mar 12, 2008
    Packettrap
    Pt360 Tool Suite
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the TFTP server in PacketTrap Networks pt360 Tool Suite 1.1.33.1.0, and other versions before 2.0.3900.0, allows remote attackers to cause a denial of service (daemon crash) via a long TFTP packet, a different vulnerability than CVE-2008-1311.

  • CVE-2008-1313Mar 12, 2008
    Bloofoxcms
    Bloo
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Bloo 1.00 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) post_id, (2) post_category_id, (3) post_year_month, and (4) static_page_id parameters; and unspecified other vectors.

  • CVE-2008-1314Mar 12, 2008
    PHP-Nuke
    gaestebuch
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Johannes Hass gaestebuch 2.2 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to modules.php.

  • CVE-2007-6253Mar 12, 2008
    Adobe Inc.
    Form Client
    risk 0.01cvss —epss 0.07

    Multiple buffer overflows in Adobe Form Designer 5.0 and Form Client 5.0 allow remote attackers to execute arbitrary code via unknown vectors in the (1) Adobe File Dialog Button (FileDlg.dll) and the (2) Adobe Copy to Server Object (SvrCopy.dll) ActiveX controls.

  • CVE-2008-0643Mar 12, 2008
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-0644Mar 12, 2008
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.03

    Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism for applications via unspecified vectors related to the setEncoding function.

  • CVE-2008-0890Mar 12, 2008
    Red Hat
    Directory Server
    risk 0.00cvss —epss 0.00

    Red Hat Directory Server 7.1 before SP4 uses insecure permissions for certain directories, which allows local users to modify JAR files and execute arbitrary code via unknown vectors.

  • CVE-2008-1202Mar 12, 2008
    Adobe Inc.
    Livecycle Workflow
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the web management interface in Adobe LiveCycle Workflow 6.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2008-1203Mar 12, 2008
    Adobe Inc.
    Coldfusion
    risk 0.01cvss —epss 0.15

    The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection.

  • CVE-2007-1201Mar 11, 2008
    Microsoft
    Office
    risk 0.02cvss —epss 0.29

    Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary code via vectors related to DataSource that trigger memory corruption, aka "Office Web Components DataSource Vulnerability."

  • CVE-2008-0110Mar 11, 2008
    Microsoft
    Office
    risk 0.03cvss —epss 0.32

    Unspecified vulnerability in Microsoft Outlook in Office 2000 SP3, XP SP3, 2003 SP2 and Sp3, and Office System allows user-assisted remote attackers to execute arbitrary code via a crafted mailto URI.