VYPR

CVEs

383,790 total · page 7090 of 7,676

AllCriticalHighKEV
  • CVE-2008-0870Feb 21, 2008
    Bea
    WebLogic Portal
    risk 0.00cvss —epss 0.01

    BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session.

  • CVE-2007-6426Feb 21, 2008
    EMC Corporation
    Replistor
    risk 0.00cvss —epss 0.03

    Multiple heap-based buffer overflows in EMC RepliStor 6.2 SP2, and possibly earlier versions, allow remote attackers to execute arbitrary code via crafted compressed data.

  • CVE-2008-0847Feb 21, 2008
    XOOPS
    Mytopics
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in print.php in the myTopics module for XOOPS allows remote attackers to execute arbitrary SQL commands via the articleid parameter.

  • CVE-2008-0848Feb 21, 2008
    Crafty Syntax Live Help
    Crafty Syntax Live Help
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in lostsheep.php in Crafty Syntax Live Help (CSLH) before 2.14.16, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the versions claimed by the original researcher are probably incorrect.

  • CVE-2008-0849Feb 21, 2008
    Joomla
    Com Downloads
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in the Downloads (com_downloads) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in a selectcat function, a different vector than CVE-2008-0652.

  • CVE-2008-0850Feb 21, 2008
    Dokeos
    Dokeos
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to whoisonline.php, (2) tracking_list_coaches_column parameter to main/mySpace/index.php, (3) tutor_name parameter to…

  • CVE-2008-0851Feb 21, 2008
    Dokeos
    Dokeos
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter to inscription.php, (2) courseCode parameter to main/calendar/myagenda.php, (3) category parameter to…

  • CVE-2008-0852Feb 21, 2008
    Freesshd
    Freesshd
    risk 0.03cvss —epss 0.06

    freeSSHd 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a SSH2_MSG_NEWKEYS packet to TCP port 22, which triggers a NULL pointer dereference.

  • CVE-2008-0853Feb 21, 2008
    Joomla
    Com Detail
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the com_detail component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. NOTE: this issue might be site-specific. If so, it should not be included in CVE.

  • CVE-2008-0854Feb 21, 2008
    Joomla
    Com Salesrep
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the com_salesrep component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the rid parameter in a showrep action to index.php.

  • CVE-2008-0855Feb 21, 2008
    Joomla
    Facileforms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Facile Forms (com_facileforms) component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.

  • CVE-2008-0856Feb 21, 2008
    E Vision
    CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in e-Vision CMS 2.02 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) iframe.php and (2) print.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-0857Feb 21, 2008
    Woltlab
    Burning Board
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in WoltLab Burning Board 3.0.3 PL 1 allows remote attackers to execute arbitrary SQL commands via the sortOrder parameter to the PMList page.

  • CVE-2008-0858Feb 21, 2008
    Kerio Technologies
    Kerio Mailserver
    risk 0.00cvss —epss 0.04

    Buffer overflow in the Visnetic anti-virus plugin in Kerio MailServer before 6.5.0 might allow remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2008-0859Feb 21, 2008
    Kerio Technologies
    Kerio Mailserver
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Kerio MailServer before 6.5.0 allows remote attackers to cause a denial of service (crash) via unspecified vectors related to decoding of uuencoded input, which triggers memory corruption.

  • CVE-2008-0860Feb 21, 2008
    Kerio Technologies
    Kerio Mailserver
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the AVG plugin in Kerio MailServer before 6.5.0 has unspecified impact via unknown remote attack vectors related to null DACLs.

  • CVE-2008-0834Feb 20, 2008
    IBM
    Lotus Quickr
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Lotus Quickr for i5/OS before 8.0.0.2 Hotfix 11, when anonymous access is disabled on HTTP ports, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-0835Feb 20, 2008
    Simple CMS
    Simple CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in indexen.php in Simple CMS 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the area parameter.

  • CVE-2008-0836Feb 20, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the vuidmice STREAMS modules in Sun Solaris 9 and 10 on x86 architectures allows local users to cause a denial of service (panic) via unspecified vectors that trigger a NULL pointer dereference in the vuid3ps2 module, a different issue than…

  • CVE-2008-0837Feb 20, 2008
    WordPress
    Search Unleashed
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the log feature in the John Godley Search Unleashed 0.2.10 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, which is not properly handled when the administrator views the log file.

  • CVE-2008-0838Feb 20, 2008
    Sophos
    Es1000
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface in Sophos ES1000 and ES4000 Email Security Appliance 2.1.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) error and (2) go parameters to the login page.

  • CVE-2008-0839Feb 20, 2008
    Astats
    Astatspro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in refer.php in the astatsPRO (com_astatspro) 1.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-0840Feb 20, 2008
    Lightblog
    Lightblog
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in view_member.php in Public Warehouse LightBlog 9.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the username parameter.

  • CVE-2008-0841Feb 20, 2008
    Joomla
    com_ricette
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Giorgio Nordo Ricette (com_ricette) 1.0 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-0842Feb 20, 2008
    Joomla
    Com Clasifier
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Classifier (com_clasifier) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.

  • CVE-2008-0843Feb 20, 2008
    Statcountex
    Statcountex
    risk 0.03cvss —epss 0.03

    StatCounteX 3.0 and 3.1 allows remote attackers to obtain sensitive information and edit configuration scripts via a direct request to admin.asp.

  • CVE-2008-0844Feb 20, 2008
    Joomla
    PccookBook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the PccookBook (com_pccookbook) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter.

  • CVE-2008-0845Feb 20, 2008
    WordPress
    WP-People
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the person parameter.

  • CVE-2008-0846Feb 20, 2008
    Joomla
    Com Profile
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the com_profile component for Joomla! allows remote attackers to execute arbitrary SQL commands via the oid parameter.

  • CVE-2008-0831Feb 20, 2008
    Joomla
    Rapid Recipe
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Rapid Recipe (com_rapidrecipe) 1.6.5 and earlier component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) user_id or (2) category_id parameter. NOTE: this might overlap CVE-2008-0754.

  • CVE-2008-0832Feb 20, 2008
    Joomla
    com_quran
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Kemas Antonius com_quran 1.1 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the surano parameter in a viewayat action.

  • CVE-2008-0833Feb 20, 2008
    Joomla
    Com Galeria
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the com_galeria component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.

  • CVE-2007-6319Feb 19, 2008
    Lyris
    Listmanager
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in Lyris ListManager 8.x before 8.95d, 9.2 before 9.2c, and 9.3 before 9.3b allow remote attackers to (1) gain list administrator privileges or (2) access arbitrary mailing lists via unknown vectors related to modification of client-side…

  • CVE-2008-0830Feb 19, 2008
    Apple Inc.
    Iphoto
    risk 0.03cvss —epss 0.02

    The Digital Photo Access Protocol (DPAP) server for iPhoto 4.0.3 allows remote attackers to cause a denial of service (crash) via a malformed dpap: URI, a different vulnerability than CVE-2008-0043.

  • CVE-2008-0827Feb 19, 2008
    PHP-Nuke
    Books module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Books module of PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2008-0828Feb 19, 2008
    Atutor
    Atutor
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) attributes such as style and onmouseover in (a) forum post or (b) mail; or (2) the website field of the profile.

  • CVE-2008-0829Feb 19, 2008
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (com_jooget) 2.6.8 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail task.

  • CVE-2008-0818Feb 19, 2008
    Freephpgallery
    Freephpgallery
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in freePHPgallery 0.6 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie to (1) comment.php, (2) index.php, and (3) show.php.

  • CVE-2008-0819Feb 19, 2008
    Plutostatus
    Locator
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in PlutoStatus Locator 1.0 pre alpha allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.

  • CVE-2008-0820Feb 19, 2008
    Etomite
    Etomite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Etomite 0.6.1.4 Final allows remote attackers to inject arbitrary web script or HTML via $_SERVER['PHP_INFO']. NOTE: the vendor disputes this issue in a followup, stating that the affected variable is…

  • CVE-2008-0821Feb 19, 2008
    OSI Codes Inc.
    Phplive
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/traffic/knowledge_searchm.php in OSI Codes Inc. PHP Live! 3.2.2 allows remote attackers to execute arbitrary SQL commands via the questid parameter in an expand_question action.

  • CVE-2008-0822Feb 19, 2008
    Scribe
    Scribe
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in Scribe 0.2 allows remote attackers to read arbitrary local files via a .. (dot dot) in the page parameter.

  • CVE-2008-0823Feb 19, 2008
    Drupal
    Header Image Module
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Header Image Module before 5.x-1.1 for Drupal allows remote attackers to access the administration pages via unknown attack vectors.

  • CVE-2008-0824Feb 19, 2008
    Claroline
    Claroline
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the php2phps function in Claroline before 1.8.9 has unknown impact and attack vectors.

  • CVE-2008-0825Feb 19, 2008
    Claroline
    Claroline
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Claroline before 1.8.9 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-0826Feb 19, 2008
    Claroline
    Claroline
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Claroline before 1.8.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-0810Feb 19, 2008
    Joomla
    com_scheduling
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the com_scheduling module for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-0811Feb 19, 2008
    Auracms
    Auracms
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in AuraCMS 1.62 allow remote attackers to execute arbitrary SQL commands via (1) the kid parameter to (a) mod/dl.php or (b) mod/links.php, and (2) the query parameter to search.php.

  • CVE-2008-0812Feb 19, 2008
    Banpro
    DMS
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in DMS/index.php in BanPro DMS 1.0 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the action parameter.

  • CVE-2008-0813Feb 19, 2008
    Xpweb
    Xpweb
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in Download.php in XPWeb 3.0.1, 3.3.2, and possibly other versions, allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter.