VYPR

CVEs

383,765 total · page 7096 of 7,676

AllCriticalHighKEV
  • CVE-2008-0583Feb 5, 2008
    Skype Technologies
    Skype
    risk 0.00cvss —epss 0.02

    Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Description and unspecified…

  • CVE-2008-0584Feb 5, 2008
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    Multiple buffer overflows in bos.rte.control in IBM AIX 5.2 and 5.3 allow local users to gain privileges via unspecified vectors related to the (1) swap, (2) swapoff, and (3) swapon programs.

  • CVE-2008-0585Feb 5, 2008
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    sysmgt.websm.webaccess in IBM AIX 5.2 and 5.3 has world writable permissions for unspecified WebSM Remote Client files, which allows local users to "alter the behavior of" this client by overwriting these files.

  • CVE-2008-0586Feb 5, 2008
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    Multiple buffer overflows in IBM AIX 5.2 and 5.3 allow local users to gain privileges via unspecified vectors related to the (1) lchangevg, (2) ldeletepv, (3) putlvodm, (4) lvaryoffvg, and (5) lvgenminor programs in bos.rte.lvm; and the (6) tellclvmd program in bos.clvm.enh.

  • CVE-2008-0587Feb 5, 2008
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    Buffer overflow in the uspchrp program in devices.chrp.base.diag in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors.

  • CVE-2008-0588Feb 5, 2008
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    Buffer overflow in the utape program in devices.scsi.tape.diag in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors.

  • CVE-2008-0589Feb 5, 2008
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    The ps program in bos.rte.control in IBM AIX 5.2, 5.3, and 6.1 allows local users to obtain sensitive information via unspecified vectors.

  • CVE-2007-6700Feb 5, 2008
    OpenBSD
    OpenBSD
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in cgi-bin/bgplg in the web interface for the BGPD daemon in OpenBSD 4.1 allows remote attackers to inject arbitrary web script or HTML via the cmd parameter.

  • CVE-2008-0564Feb 5, 2008
    Mailman
    Mailman
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.10b1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) editing templates and (2) the list's "info attribute" in the web administrator interface, a…

  • CVE-2008-0565Feb 5, 2008
    Deltascripts
    PHP Links
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in vote.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-0566Feb 5, 2008
    Deltascripts
    PHP Links
    risk 0.05cvss —epss 0.23

    PHP remote file inclusion vulnerability in includes/smarty.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the full_path_to_public_program parameter.

  • CVE-2008-0567Feb 5, 2008
    Chronoengine
    Chronoforms
    risk 0.06cvss —epss 0.34

    Multiple PHP remote file inclusion vulnerabilities in ChronoEngine ChronoForms (com_chronocontact) 2.3.5 component for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) PPS/File.php, (2) Writer.php, and (3)…

  • CVE-2008-0568Feb 5, 2008
    Drupal
    Secure Site Module
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the IP-authentication feature in the Secure Site 5.x-1.0 and 4.7.x-1.0 module for Drupal allows remote attackers to gain the privileges of a user who has authenticated from behind the same proxy server as the attacker.

  • CVE-2008-0569Feb 5, 2008
    Drupal
    Comment Upload
    risk 0.00cvss —epss 0.03

    The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass upload validation, and upload arbitrary files and possibly execute arbitrary code, via unspecified…

  • CVE-2008-0570Feb 5, 2008
    Drupal
    Openid
    risk 0.00cvss —epss 0.01

    The OpenID 5.x-1.0 and earlier module for Drupal does not properly verify the claimed_id returned by an OpenID provider, which allows remote OpenID providers to spoof OpenID authentication for domains associated with other providers.

  • CVE-2008-0571Feb 5, 2008
    Drupal
    Userpoints
    risk 0.00cvss —epss 0.01

    The point moderation form in the Userpoints 4.7.x before 4.7.x-2.3, 5.x-2 before 5.x-2.16, and 5.x-3 before 5.x-3.3 module for Drupal does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and…

  • CVE-2008-0572Feb 5, 2008
    Mindmeld
    Mindmeld
    risk 0.05cvss —epss 0.22

    Multiple PHP remote file inclusion vulnerabilities in Mindmeld 1.2.0.10 allow remote attackers to execute arbitrary PHP code via a URL in the MM_GLOBALS[home] parameter to (1) acweb/admin_index.php; and (2) ask.inc.php, (3) learn.inc.php, (4) manage.inc.php, (5) mind.inc.php,…

  • CVE-2008-0573Feb 5, 2008
    Safenet
    Safenet Highassurance Remote
    risk 0.03cvss —epss 0.01

    IPSecDrv.sys 10.4.0.12 in SafeNET HighAssurance Remote and SoftRemote allows local users to gain privileges via a crafted IPSECDRV_IOCTL IOCTL request.

  • CVE-2008-0574Feb 5, 2008
    Webspell
    Webspell
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in webSPELL 4.01.02 allows remote attackers to inject arbitrary web script or HTML via the sort parameter in a whoisonline action.

  • CVE-2008-0575Feb 5, 2008
    Webspell
    Webspell
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin/admincenter.php in webSPELL 4.01.02 allows remote attackers to assign the superadmin privilege level to arbitrary accounts as administrators via an "update member" action.

  • CVE-2008-0576Feb 5, 2008
    Drupal
    Project Issue Tracking Module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal…

  • CVE-2008-0577Feb 5, 2008
    Drupal
    Project Issue Tracking Module
    risk 0.00cvss —epss 0.01

    The Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal (1) does not restrict the extensions of…

  • CVE-2008-0578Feb 5, 2008
    Tripwire
    Tripwire Enterprise
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web management login page in Tripwire Enterprise 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-5602Feb 5, 2008
    Swiftview
    Viewer
    risk 0.01cvss —epss 0.08

    Multiple stack-based buffer overflows in SwiftView Viewer before 8.3.5, as used by SwiftView and SwiftSend, allow remote attackers to execute arbitrary code via unspecified vectors to the (1) svocx.ocx ActiveX control or the (2) npsview.dll plugin for Mozilla and Firefox.

  • CVE-2007-4130Feb 5, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The Linux kernel 2.6.9 before 2.6.9-67 in Red Hat Enterprise Linux (RHEL) 4 on Itanium (ia64) does not properly handle page faults during NUMA memory access, which allows local users to cause a denial of service (panic) via invalid arguments to set_mempolicy in an MPOL_BIND…

  • CVE-2008-0178Feb 5, 2008
    Liferay
    Liferay Enterprise Portal
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Enterprise Admin Session Monitoring component in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the User-Agent HTTP header.

  • CVE-2008-0179Feb 5, 2008
    Liferay
    Portal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header, which is used when composing Forgot Password e-mail messages in HTML format.

  • CVE-2008-0180Feb 5, 2008
    Liferay
    Liferay Enterprise Portal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in themes/_unstyled/templates/init.vm in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Greeting field in a User Profile.

  • CVE-2008-0181Feb 5, 2008
    Liferay
    Portal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Admin portlet in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Shutdown message.

  • CVE-2008-0182Feb 5, 2008
    Liferay
    Liferay Enterprise Portal
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Admin portlet in Liferay Portal before 4.4.0 allows remote authenticated users to perform unspecified actions as unspecified other authenticated users via the Shutdown message.

  • CVE-2008-0563Feb 5, 2008
    Liferay
    Portal
    risk 0.00cvss —epss 0.00

    Cross-site request forgery (CSRF) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to perform unspecified actions as unspecified authenticated users via the User-Agent HTTP header, which is used when composing Forgot…

  • CVE-2007-6699Feb 4, 2008
    AOL
    Ygp Piceditor Activex Control
    risk 0.03cvss —epss 0.04

    Multiple buffer overflows in the AIM PicEditor 9.5.1.8 ActiveX control in YGPPicEdit.dll in AOL You've Got Pictures (YGP) Picture Editor allow remote attackers to cause a denial of service (browser crash) via a long string in the (1) DisplayName, (2) FinalSavePath, (3)…

  • CVE-2008-0386Feb 4, 2008
    Xdg Utils
    xdg-open
    risk 0.00cvss —epss 0.03

    Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to (1) xdg-open or (2) xdg-email.

  • CVE-2008-0557Feb 4, 2008
    Joomla
    CatalogShop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the CatalogShop (com_catalogshop) 1.0b1 componenent for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.

  • CVE-2008-0558Feb 4, 2008
    Uniwin
    Ecart Professional
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Uniwin eCart Professional before 2.0.16 allows remote attackers to inject arbitrary web script or HTML via the rp parameter to cartView.asp and unspecified other components. NOTE: the provenance of this information is unknown; the…

  • CVE-2008-0559Feb 4, 2008
    Nilsons Blogger
    Nilsons Blogger
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in Nilson's Blogger 0.11 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the permalink parameter in core.php, accessed through index.php; and (2) the thispost parameter in comments.php.

  • CVE-2008-0560Feb 4, 2008
    WordPress
    cforms
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in cforms-css.php in Oliver Seidel cforms (contactforms), a Wordpress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the tm parameter. NOTE: CVE disputes this issue for 7.3, since there is no tm parameter, and…

  • CVE-2008-0561Feb 4, 2008
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Arthur Konze AkoGallery (com_akogallery) 2.5 beta component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.

  • CVE-2008-0562Feb 4, 2008
    Mambo (software)
    Mambo
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Restaurant (com_restaurant) 1.0 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.

  • CVE-2007-6698Feb 1, 2008
    OpenLDAP
    Openldap
    risk 0.00cvss —epss 0.02

    The BDB backend for slapd in OpenLDAP before 2.3.36 allows remote authenticated users to cause a denial of service (crash) via a potentially-successful modify operation with the NOOP control set to critical, possibly due to a double free vulnerability.

  • CVE-2007-6695Feb 1, 2008
    Drake Team
    Drake CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Drake CMS 0.4.9 allows remote attackers to inject arbitrary web script or HTML via the option parameter.

  • CVE-2007-6696Feb 1, 2008
    Webcalendar
    Webcalendar
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.1.6 allow remote attackers to inject arbitrary web script or HTML via (1) an event description, (2) the query string to pref.php, and (3) the adv parameter to search.php. NOTE: vector 1 requires user…

  • CVE-2007-6697Feb 1, 2008
    Sdl
    Sdl Image
    risk 0.00cvss —epss 0.11

    Buffer overflow in the LWZReadByte function in IMG_gif.c in SDL_image before 1.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted GIF file, a similar issue to CVE-2006-4484. NOTE: some of these details…

  • CVE-2008-0538Feb 1, 2008
    PhpIP Management
    phpIP Management
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in phpIP Management 4.3.2 allow remote attackers to execute arbitrary SQL commands via the (1) password parameter to login.php, the (2) id parameter to display.php, and unspecified other vectors. NOTE: some of these details are obtained…

  • CVE-2008-0539Feb 1, 2008
    F5, Inc.
    BIG-IP Application Security Manager
    risk 0.04cvss —epss 0.07

    Cross-site scripting (XSS) vulnerability in dms/policy/rep_request.php in F5 BIG-IP Application Security Manager (ASM) 9.4.3 allows remote attackers to inject arbitrary web script or HTML via the report_type parameter.

  • CVE-2008-0540Feb 1, 2008
    Trixbox
    Trixbox
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in trixbox 2.4.2.0 allow remote attackers to inject arbitrary web script or HTML via the query string to index.php in (1) user/ or (2) maint/.

  • CVE-2008-0541Feb 1, 2008
    Gerd Tentler
    Simple Forum
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in forum.php in Gerd Tentler Simple Forum 3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) open and (2) date_show parameters.

  • CVE-2008-0542Feb 1, 2008
    Gerd Tentler
    Simple Forum
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in thumbnail.php in Gerd Tentler Simple Forum 3.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

  • CVE-2008-0543Feb 1, 2008
    Pre Dynamic Institution
    Pre Dynamic Institution
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Pre Dynamic Institution allow remote attackers to execute arbitrary SQL commands via the (1) sloginid and (2) spass parameters to (a) login.asp and (b) siteadmin/login.asp. NOTE: some of these details are obtained from third party…

  • CVE-2008-0544Feb 1, 2008
    Sdl
    Sdl Image
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in the IMG_LoadLBM_RW function in IMG_lbm.c in SDL_image before 1.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted IFF ILBM file. NOTE: some of these details are obtained…