VYPR

CVEs

383,838 total · page 7086 of 7,677

AllCriticalHighKEV
  • CVE-2008-1266Mar 10, 2008
    Dlink
    Di 524
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in the web interface on the D-Link DI-524 router allow remote attackers to cause a denial of service (device crash) or possibly have unspecified other impact via (1) a long username or (2) an HTTP header with a large name and an empty value.

  • CVE-2008-1267Mar 10, 2008
    Siemens Foundation
    Speedstream 6520
    risk 0.00cvss —epss 0.02

    The Siemens SpeedStream 6520 router allows remote attackers to cause a denial of service (web interface crash) via an HTTP request to basehelp_English.htm with a large integer in the Content-Length field.

  • CVE-2008-1268Mar 10, 2008
    Linksys
    Wrt54g
    risk 0.00cvss —epss 0.02

    The FTP server on the Linksys WRT54G 7 router with 7.00.1 firmware does not verify authentication credentials, which allows remote attackers to establish an FTP session by sending an arbitrary username and password.

  • CVE-2008-1269Mar 10, 2008
    Alice
    Gate2 Plus Wi Fi
    risk 0.00cvss —epss 0.01

    cp06_wifi_m_nocifr.cgi in the admin panel on the Alice Gate 2 Plus Wi-Fi router does not verify authentication credentials, which allows remote attackers to disable Wi-Fi encryption via a certain request.

  • CVE-2007-6705Mar 9, 2008
    IBM
    Websphere Mq
    risk 0.00cvss —epss 0.00

    The WebSphere MQ XA 5.3 before FP13 and 6.0.x before 6.0.2.1 client for Windows, when running in an MTS or a COM+ environment, grants the PROCESS_DUP_HANDLE privilege to the Everyone group upon connection to a queue manager, which allows local users to duplicate an arbitrary…

  • CVE-2007-6706Mar 9, 2008
    IBM
    Lotus Notes
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in nlnotes.dll in the client in IBM Lotus Notes 6.5, 7.0.x before 7.0.2 CCH or 7.0.3, and possibly 8.0 allows remote attackers to execute arbitrary code via crafted text in an e-mail message sent over SMTP.

  • CVE-2008-1215Mar 9, 2008
    FreeBSD
    FreeBSD
    risk 0.03cvss —epss 0.01

    Stack-based buffer overflow in the command_Expand_Interpret function in command.c in ppp (aka user-ppp), as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "~"…

  • CVE-2008-1216Mar 9, 2008
    IBM
    Lotus Quickr
    risk 0.00cvss —epss 0.02

    IBM Lotus Quickr 8.0 server, and possibly QuickPlace 7.x, does not properly identify URIs containing cross-site scripting (XSS) attack strings, which allows remote attackers to inject arbitrary web script or HTML via a Calendar OpenDocument action to main.nsf with a Count…

  • CVE-2008-1217Mar 9, 2008
    IBM
    Lotus Notes
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in nlnotes.dll in the client in IBM Lotus Notes 6.5, 7.0.x before 7.0.2 CCH, and 8.0.x before 8.0.1 allows remote attackers to execute arbitrary code via a crafted attachment in an e-mail message sent over SMTP, a variant of CVE-2007-6706.

  • CVE-2008-1204Mar 8, 2008
    Sun Corporation
    Java System Access Manager
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Administration Console in Sun Java System Access Manager 7.1 and 7 2005Q4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the (1) Help and (2) Version windows.

  • CVE-2008-1205Mar 8, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the ipsecah kernel module in Sun Solaris 10, when a key management daemon for IPsec security associations is running, allows local users to cause a denial of service (panic) via unspecified vectors.

  • CVE-2008-1206Mar 8, 2008
    Linux Kiss Server
    Linux Kiss Server
    risk 0.00cvss —epss 0.04

    Format string vulnerability in the log_message function in lks.c in Linux Kiss Server 1.2, when background (daemon) mode is disabled, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in an invalid command.

  • CVE-2008-1207Mar 8, 2008
    Fujitsu
    Interstage Smart Repository
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Fujitsu Interstage Smart Repository, as used in multiple Fujitsu Interstage products, allow remote attackers to cause a denial of service (daemon crash) via (1) an invalid request or (2) a large amount of data sent to the registered…

  • CVE-2008-1208Mar 8, 2008
    Checkpoint
    VPN 1 Utm Edge
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the login page in Check Point VPN-1 UTM Edge W Embedded NGX 7.0.48x allows remote attackers to inject arbitrary web script or HTML via the user parameter.

  • CVE-2008-1209Mar 8, 2008
    Xitex
    Xitex Webcontent M1
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in redirect.do in Xitex WebContent M1 allows remote attackers to inject arbitrary web script or HTML via the sid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2008-1210Mar 8, 2008
    Programmer's Notepad
    Programmer's Notepad
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the ctags parsing code in Programmer's Notepad before 2.0.8.718 allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted .c file, when the victim selects the Jump To dialog. …

  • CVE-2008-1211Mar 8, 2008
    BosDates
    BosDates
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in BosDates 3.x and 4.x allows remote attackers to inject arbitrary web script or HTML via (1) the type parameter in calendar.php and (2) the category parameter in calendar_search.php. NOTE: the provenance of this information is unknown;…

  • CVE-2008-1212Mar 8, 2008
    Podcast Generator
    Podcast Generator
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in set_permissions.php in Podcast Generator 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the scriptlang parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2008-1213Mar 8, 2008
    Numara
    Footprints
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Numara FootPrints for Linux 8.1 allows remote attackers to inject arbitrary web script or HTML via the Title form field when setting an appointment. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2008-1214Mar 8, 2008
    Numara
    Footprints
    risk 0.00cvss —epss 0.03

    MRcgi/MRProcessIncomingForms.pl in Numara FootPrints 8.1 on Linux allows remote attackers to execute arbitrary code via shell metacharacters in the PROJECTNUM parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-1185Mar 6, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in the Virtual Machine for Sun Java Runtime Environment (JRE) and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to gain privileges via an untrusted application or applet, a different…

  • CVE-2008-1186Mar 6, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in the Virtual Machine for Sun Java Runtime Environment (JRE) and JDK 5.0 Update 13 and earlier, and SDK/JRE 1.4.2_16 and earlier, allows remote attackers to gain privileges via an untrusted application or applet, a different issue than CVE-2008-1185,…

  • CVE-2008-1187Mar 6, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Sun Java Runtime Environment (JRE) and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to cause a denial of service (JRE crash) and possibly execute arbitrary code via unknown vectors…

  • CVE-2008-1188Mar 6, 2008
    Sun Corporation
    Jdk
    risk 0.01cvss —epss 0.12

    Multiple buffer overflows in the useEncodingDecl function in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allow remote attackers to execute arbitrary code via a JNLP file with (1) a long key name in the xml header or (2) a long charset…

  • CVE-2008-1189Mar 6, 2008
    Sun Corporation
    Jdk
    risk 0.01cvss —epss 0.07

    Buffer overflow in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to execute arbitrary code via unknown vectors, a different issue than CVE-2008-1188, aka the "third" issue.

  • CVE-2008-1190Mar 6, 2008
    Sun Corporation
    Jdk
    risk 0.01cvss —epss 0.17

    Unspecified vulnerability in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to gain privileges via an untrusted application, a different issue than CVE-2008-1191, aka the "fourth"…

  • CVE-2008-1191Mar 6, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier allows remote attackers to create arbitrary files via an untrusted application, a different issue than CVE-2008-1190, aka "The fifth issue."

  • CVE-2008-1192Mar 6, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the Java Plug-in for Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier, and 1.3.1_21 and earlier; allows remote attackers to bypass the same origin policy and "execute local applications" via…

  • CVE-2008-1193Mar 6, 2008
    Sun Corporation
    Jdk
    risk 0.04cvss —epss 0.13

    Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allows remote attackers to gain privileges via an untrusted application.

  • CVE-2008-1194Mar 6, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in the color management library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allows remote attackers to cause a denial of service (crash) via unknown vectors.

  • CVE-2008-1195Mar 6, 2008
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.06

    Unspecified vulnerability in Sun JDK and Java Runtime Environment (JRE) 6 Update 4 and earlier and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier; allows remote attackers to access arbitrary network services on the local host via unspecified vectors related to…

  • CVE-2008-1196Mar 6, 2008
    Sun Corporation
    Jdk
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in Java Web Start (javaws.exe) in Sun JDK and JRE 6 Update 4 and earlier and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier; allows remote attackers to execute arbitrary code via a crafted JNLP file.

  • CVE-2008-1198Mar 6, 2008
    Red Hat
    Enterprise Linux Server
    risk 0.00cvss —epss 0.02

    The default IPSec ifup script in Red Hat Enterprise Linux 3 through 5 configures racoon to use aggressive IKE mode instead of main IKE mode, which makes it easier for remote attackers to conduct brute force attacks by sniffing an unencrypted preshared key (PSK) hash.

  • CVE-2008-1199Mar 6, 2008
    Dovecot (software)
    Dovecot
    risk 0.00cvss —epss 0.00

    Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack.

  • CVE-2008-1200Mar 6, 2008
    Microsoft
    Access
    risk 0.01cvss —epss 0.12

    Unspecified vulnerability in Microsoft Access allows remote user-assisted attackers to execute arbitrary code via a crafted .MDB file, possibly related to Jet Engine (msjet40.dll). NOTE: this is probably a different issue than CVE-2007-6026.

  • CVE-2008-0072Mar 6, 2008
    Evolution
    Evolution
    risk 0.00cvss —epss 0.06

    Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.

  • CVE-2008-0883Mar 6, 2008
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.01

    acroread in Adobe Acrobat Reader 8.1.2 allows local users to overwrite arbitrary files via a symlink attack on temporary files related to SSL certificate handling.

  • CVE-2008-0985Mar 6, 2008
    Google
    Android SDK
    risk 0.03cvss —epss 0.05

    Heap-based buffer overflow in the GIF library in the WebKit framework for Google Android SDK m3-rc37a and earlier allows remote attackers to execute arbitrary code via a crafted GIF file whose logical screen height and width are different than the actual height and width.

  • CVE-2008-0986Mar 6, 2008
    Google
    Android SDK
    risk 0.03cvss —epss 0.05

    Integer overflow in the BMP::readFromStream method in the libsgl.so library in Google Android SDK m3-rc37a and earlier, and m5-rc14, allows remote attackers to execute arbitrary code via a crafted BMP file with a header containing a negative offset field.

  • CVE-2008-1172Mar 6, 2008
    Torrenttrader
    Torrenttrader
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerabilities in account-inbox.php in TorrentTrader Classic 1.08 allow remote attackers to perform certain actions as other users, as demonstrated by sending messages.

  • CVE-2008-1173Mar 6, 2008
    Torrenttrader
    Torrenttrader
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in account-inbox.php in TorrentTrader Classic 1.08 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2008-1174Mar 6, 2008
    Flicks Software
    Authentix
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in editUser.asp in AuthentiX 6.3b1 Trial allows remote attackers to inject arbitrary web script or HTML via the username parameter.

  • CVE-2008-1175Mar 6, 2008
    Flicks Software
    Authentix
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in AuthentiX 6.3b1 Trial allows remote attackers to inject arbitrary web script or HTML via the username parameter to aspAdmin/deleteUser.asp, a different vector than CVE-2008-1174. NOTE: the provenance of this information is unknown;…

  • CVE-2008-1176Mar 6, 2008
    Affiliate Market
    Affiliate Market
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in function/sideblock.php in Affiliate Market (affmarket) 0.1 BETA allows remote attackers to inject arbitrary web script or HTML via the sideblock4 parameter.

  • CVE-2008-1177Mar 6, 2008
    Affiliate Market
    Affiliate Market
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in shop/detail.php in Affiliate Market (affmarket) 0.1 BETA allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-1178Mar 6, 2008
    Centreon
    Centreon
    risk 0.03cvss —epss 0.05

    Directory traversal vulnerability in include/doc/index.php in Centreon 1.4.2.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter, a different vector than CVE-2008-1119.

  • CVE-2008-1179Mar 6, 2008
    Centreon
    Centreon
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in include/common/javascript/color_picker.php in Centreon 1.4.2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) title parameters. NOTE: some of these details are obtained…

  • CVE-2008-1180Mar 6, 2008
    Juniper Networks
    Secure Access 2000
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in dana-na/auth/rdremediate.cgi in Juniper Networks Secure Access 2000 5.5 R1 build 11711 allows remote attackers to inject arbitrary web script or HTML via the delivery_mode parameter.

  • CVE-2008-1181Mar 6, 2008
    Juniper Networks
    Secure Access 2000
    risk 0.03cvss —epss 0.02

    Juniper Networks Secure Access 2000 5.5 R1 (build 11711) allows remote attackers to obtain sensitive information via a direct request for remediate.cgi without certain parameters, which reveals the path in an "Execute failed" error message.

  • CVE-2008-1182Mar 6, 2008
    Bsdperimeter
    Pfsense
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in BSD Perimeter pfSense before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.