VYPR

CVEs

383,797 total · page 7088 of 7,676

AllCriticalHighKEV
  • CVE-2008-1058Feb 28, 2008
    OpenBSD
    OpenBSD
    risk 0.00cvss —epss 0.02

    The tcp_respond function in netinet/tcp_subr.c in OpenBSD 4.1 and 4.2 allows attackers to cause a denial of service (panic) via crafted TCP packets. NOTE: some of these details are obtained from third party information.

  • CVE-2008-1059Feb 28, 2008
    WordPress
    Sniplets
    risk 0.07cvss —epss 0.48

    PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter.

  • CVE-2008-1060Feb 28, 2008
    WordPress
    Sniplets
    risk 0.07cvss —epss 0.44

    Eval injection vulnerability in modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via the text parameter.

  • CVE-2008-1061Feb 28, 2008
    WordPress
    Sniplets
    risk 0.04cvss —epss 0.07

    Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to (a) warning.php, (b) notice.php, and (c) inset.php in view/sniplets/, and possibly…

  • CVE-2008-1062Feb 28, 2008
    Intervideo
    Windvd Media Center
    risk 0.00cvss —epss 0.01

    InterVideo IMC Server (aka IMCSvr.exe) and InterVideo Home Theater (aka IHT.exe) in InterVideo WinDVD Media Center 2.11.15.0 allow remote attackers to cause a denial of service (NULL dereference and application crash) via a crafted packet with two CRLF sequences. NOTE: the…

  • CVE-2008-1037Feb 27, 2008
    Packeteer
    Packetshaper
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the file listing function in the web management interface in Packeteer PacketShaper and PolicyCenter 8.2.2 allows remote attackers to inject arbitrary web script or HTML via the FILELIST parameter to an arbitrary component, which…

  • CVE-2008-1038Feb 27, 2008
    DBHcms
    DBHcms
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in mod/mod.extmanager.php in DBHcms 1.1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the extmanager_install parameter.

  • CVE-2008-1039Feb 27, 2008
    Porar
    Webboard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in question.asp in PORAR WEBBOARD allows remote attackers to execute arbitrary SQL commands via the QID parameter.

  • CVE-2008-1040Feb 27, 2008
    Fujitsu
    Interstage Application Server
    risk 0.00cvss —epss 0.05

    Buffer overflow in the Single Sign-On function in Fujitsu Interstage Application Server 8.0.0 through 8.0.3 and 9.0.0, Interstage Studio 8.0.1 and 9.0.0, and Interstage Apworks 8.0.0 allows remote attackers to execute arbitrary code via a long URI.

  • CVE-2008-1041Feb 27, 2008
    Matts Whois
    Matt's Whois
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in mwhois.php in Matt Wilson Matt's Whois (MWhois) allows remote attackers to inject arbitrary web script or HTML via the domain parameter.

  • CVE-2008-1042Feb 27, 2008
    Linux Web Shop
    PHP Download Manager
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in include/body.inc.php in Linux Web Shop (LWS) php Download Manager 1.0 and 1.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the content parameter.

  • CVE-2008-1043Feb 27, 2008
    Linux Web Shop
    PHP User Base
    risk 0.07cvss —epss 0.49

    PHP remote file inclusion vulnerability in templates/default/header.inc.php in Linux Web Shop (LWS) php User Base 1.3 BETA allows remote attackers to execute arbitrary PHP code via a URL in the menu parameter.

  • CVE-2008-1044Feb 27, 2008
    Move Media Player
    Quantum Streaming Player
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in the Quantum Streaming Player (Quantum Streaming IE Player) ActiveX control (aka QSP2IE.QSP2IE) in qsp2ie07076007.dll 7.7.6.7 and qsp2ie07074039.dll 7.7.4.39 in Move Media Player allows remote attackers to execute arbitrary code via a long argument…

  • CVE-2008-1045Feb 27, 2008
    Alkacon
    Opencms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the file tree navigation function in system/workplace/views/explorer/tree_files.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the resource parameter.

  • CVE-2008-1046Feb 27, 2008
    Quinsonnas
    Mail Checker
    risk 0.05cvss —epss 0.21

    PHP remote file inclusion vulnerability in footer.php in Quinsonnas Mail Checker 1.55 allows remote attackers to execute arbitrary PHP code via a URL in the op[footer_body] parameter.

  • CVE-2008-1047Feb 27, 2008
    Tiki
    Tiki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in tiki-edit_article.php in TikiWiki before 1.9.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-1048Feb 27, 2008
    Plume CMS
    CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in manager/xmedia.php in Plume CMS 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the dir parameter.

  • CVE-2008-1049Feb 27, 2008
    Parallels
    SiteStudio
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Parallels SiteStudio before 1.7.2, and 1.8.x before 1.8b, as used in Parallels H-Sphere 3.0 before Patch 9 and 2.5 before Patch 11, has unknown impact and attack vectors.

  • CVE-2008-1050Feb 27, 2008
    Softbizscripts
    Jokes & Funny Pics Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Softbiz Jokes & Funny Pics Script allows remote attackers to execute arbitrary SQL commands via the sbcat_id parameter.

  • CVE-2008-1051Feb 27, 2008
    Phpprofiles
    Phpprofiles
    risk 0.05cvss —epss 0.21

    PHP remote file inclusion vulnerability in include/body_comm.inc.php in phpProfiles 4.5.2 BETA allows remote attackers to execute arbitrary PHP code via a URL in the content parameter.

  • CVE-2008-1052Feb 27, 2008
    Netwin
    Surgeftp
    risk 0.04cvss —epss 0.07

    The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service (daemon crash) via a large integer in the Content-Length HTTP header, which triggers a NULL pointer dereference when memory allocation fails.

  • CVE-2008-1053Feb 27, 2008
    PHP-Nuke
    PHP Nuke
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Kose_Yazilari module for PHP-Nuke allow remote attackers to execute arbitrary SQL commands via the artid parameter in a (1) viewarticle or (2) printpage action to modules.php.

  • CVE-2008-1054Feb 27, 2008
    Netwin
    Surgemail
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in the _lib_spawn_user_getpid function in (1) swatch.exe and (2) surgemail.exe in NetWin SurgeMail 38k4 and earlier, and beta 39a, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via an HTTP…

  • CVE-2008-1055Feb 27, 2008
    Netwin
    Surgemail
    risk 0.04cvss —epss 0.08

    Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and earlier and beta 39a, and WebMail 3.1s and earlier, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in the page parameter.

  • CVE-2008-0984Feb 26, 2008
    Miro
    Miro Player
    risk 0.04cvss —epss 0.15

    The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.

  • CVE-2008-0983Feb 26, 2008
    Lighttpd
    Lighttpd
    risk 0.00cvss —epss 0.02

    lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large number of connections, which triggers an out-of-bounds access.

  • CVE-2008-0596Feb 26, 2008
    Easy Software Products
    Cups
    risk 0.00cvss —epss 0.02

    Memory leak in CUPS before 1.1.22, and possibly other versions, allows remote attackers to cause a denial of service (memory consumption and daemon crash) via a large number of requests to add and remove shared printers.

  • CVE-2008-0597Feb 26, 2008
    Easy Software Products
    Cups
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in CUPS before 1.1.22, and possibly other versions, allows remote attackers to cause a denial of service (crash) via crafted IPP packets.

  • CVE-2008-0923Feb 26, 2008
    VMware
    Workstation
    risk 0.00cvss —epss 0.00

    Directory traversal vulnerability in the Shared Folders feature for VMWare ACE 1.0.2 and 2.0.2, Player 1.0.4 and 2.0.2, and Workstation 5.5.4 and 6.0.2 allows guest OS users to read and write arbitrary files on the host OS via a multibyte string that produces a wide character…

  • CVE-2008-0973Feb 25, 2008
    Microfocus
    StorageWorks Storage Mirroring
    risk 0.00cvss —epss 0.02

    Buffer overflow in Double-Take (aka HP StorageWorks Storage Mirroring) 4.5.0.1629, and other 4.5.0.x versions, allows remote attackers to have an unknown impact via a packet with a long string in the username field.

  • CVE-2008-0974Feb 25, 2008
    Double Take Software
    Double Take
    risk 0.00cvss —epss 0.03

    Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to cause a denial of service (daemon termination) via (1) a large vector value, which raises a "vector too long" exception; or (2) a…

  • CVE-2008-0975Feb 25, 2008
    Double Take Software
    Double Take
    risk 0.00cvss —epss 0.02

    Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to cause a denial of service (CPU consumption) via a -1 value in the field that specifies the size of the vector value.

  • CVE-2008-0976Feb 25, 2008
    Double Take Software
    Double Take
    risk 0.00cvss —epss 0.04

    Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed packet, as demonstrated by a packet of type (1)…

  • CVE-2008-0977Feb 25, 2008
    Double Take Software
    Double Take
    risk 0.00cvss —epss 0.02

    Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to cause a denial of service (daemon crash) via a certain long packet that triggers an attempt to allocate a large amount of memory.

  • CVE-2008-0978Feb 25, 2008
    Double Take Software
    Double Take
    risk 0.00cvss —epss 0.01

    Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to obtain sensitive information via a packet of type (1) 0x2728, which provides operating system and path information; (2) 0x274e, which…

  • CVE-2008-0979Feb 25, 2008
    Double Take Software
    Double Take
    risk 0.00cvss —epss 0.03

    Stack consumption vulnerability in Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to cause a denial of service (daemon crash) via a certain packet that triggers the recursive calling of a…

  • CVE-2008-0980Feb 25, 2008
    Spyce
    Spyce
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Spyce - Python Server Pages (PSP) 2.1.3 allow remote attackers to inject arbitrary web script or HTML via (1) the url or type parameter to docs/examples/redirect.spy; (2) the x parameter to docs/examples/handlervalidate.spy;…

  • CVE-2008-0981Feb 25, 2008
    Spyce
    Spyce
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in spyce/examples/redirect.spy in Spyce - Python Server Pages (PSP) 2.1.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.

  • CVE-2008-0982Feb 25, 2008
    Spyce
    Spyce
    risk 0.03cvss —epss 0.02

    Spyce - Python Server Pages (PSP) 2.1.3 allows remote attackers to obtain sensitive information via a direct request for spyce/examples/automaton.spy, which reveals the path in an error message.

  • CVE-2008-0932Feb 25, 2008
    The Sword Project
    Sword
    risk 0.00cvss —epss 0.03

    diatheke.pl in The SWORD Project Diatheke 1.5.9 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the range parameter.

  • CVE-2008-0941Feb 25, 2008
    Eagle Software
    Aeries Browser Interface
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Eagle Software Aeries Browser Interface (ABI) 3.8.2.8 allows remote authenticated users to inject arbitrary web script or HTML via an event.

  • CVE-2008-0942Feb 25, 2008
    Eagle Software
    Aeries Browser Interface
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in GradebookStuScores.asp in Eagle Software Aeries Browser Interface (ABI) 3.8.2.8 allows remote attackers to execute arbitrary SQL commands via the GrdBk parameter.

  • CVE-2008-0943Feb 25, 2008
    Eagle Software
    Aeries Browser Interface
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Eagle Software Aeries Browser Interface (ABI) 3.7.2.2 allow remote attackers to execute arbitrary SQL commands via the (1) FC parameter to Comments.asp, or the Term parameter to (2) Labels.asp or (3) ClassList.asp.

  • CVE-2008-0944Feb 25, 2008
    Ipswitch, Inc.
    Instant Messaging
    risk 0.04cvss —epss 0.12

    Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote attackers to cause a denial of service (NULL dereference and application crash) via a version field containing zero.

  • CVE-2008-0945Feb 25, 2008
    Ipswitch, Inc.
    Imserver
    risk 0.01cvss —epss 0.07

    Format string vulnerability in the logging function in the IM Server (aka IMserve or IMserver) in Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via…

  • CVE-2008-0946Feb 25, 2008
    Ipswitch, Inc.
    Imserver
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in the IM Server (aka IMserve or IMserver) in Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote authenticated users to create arbitrary empty files via a .. (dot dot) in the recipient field.

  • CVE-2008-0939Feb 25, 2008
    WordPress
    Wp Photo Album Plus
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in wppa.php in the WP Photo Album (WPPA) before 1.1 plugin for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the photo parameter to index.php, used by the wppa_photo_name function; or (2) the album parameter to…

  • CVE-2008-0940Feb 25, 2008
    Webgui
    Webgui
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Plain Black WebGUI before 7.4.24 allows remote attackers to inject arbitrary web script or HTML when creating a username, a different vulnerability than CVE-2007-0407.

  • CVE-2008-0933Feb 25, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Multiple race conditions in the CPU Performance Counters (cpc) subsystem in the kernel in Sun Solaris 10 allow local users to cause a denial of service (panic) via unspecified vectors related to kcpc_unbind and kcpc_restore.

  • CVE-2008-0934Feb 25, 2008
    Nukec
    Nukec
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in modules.php in the NukeC 2.1 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id_catg parameter in a ViewCatg action.