VYPR

CVEs

383,724 total · page 7101 of 7,675

AllCriticalHighKEV
  • CVE-2008-0296Jan 16, 2008
    VideoLAN
    VLC media player
    risk 0.00cvss —epss 0.15

    Heap-based buffer overflow in the libaccess_realrtsp plugin in VideoLAN VLC Media Player 0.8.6d and earlier on Windows might allow remote RTSP servers to cause a denial of service (application crash) or execute arbitrary code via a long string.

  • CVE-2007-5655Jan 16, 2008
    TIBCO Software
    Rtworks
    risk 0.00cvss —epss 0.06

    TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted requests containing values that are used as pointers.

  • CVE-2007-5656Jan 16, 2008
    TIBCO Software
    Rtworks
    risk 0.00cvss —epss 0.05

    TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted requests that control loop operations…

  • CVE-2007-5657Jan 16, 2008
    TIBCO Software
    Rtworks
    risk 0.00cvss —epss 0.06

    TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted requests containing values that are used as pointer offsets.

  • CVE-2007-5658Jan 16, 2008
    TIBCO Software
    Rtworks
    risk 0.01cvss —epss 0.06

    Heap-based buffer overflow in TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted requests containing size and copy-length values that trigger…

  • CVE-2008-0032Jan 16, 2008
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.04

    Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a movie file containing a Macintosh Resource record with a modified length value in the resource header, which triggers heap corruption.

  • CVE-2008-0033Jan 16, 2008
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Apple QuickTime before 7.4 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a movie file with Image Descriptor (IDSC) atoms containing an invalid atom size, which triggers memory corruption.

  • CVE-2008-0036Jan 16, 2008
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Buffer overflow in Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a crafted compressed PICT image, which triggers the overflow during decoding.

  • CVE-2008-0031Jan 16, 2008
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Apple QuickTime before 7.4 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted Sorenson 3 video file, which triggers memory corruption.

  • CVE-2008-0034Jan 16, 2008
    Apple Inc.
    iPhone
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Passcode Lock in Apple iPhone 1.0 through 1.1.2 allows users with physical access to execute applications without entering the passcode via vectors related to emergency calls.

  • CVE-2008-0035Jan 16, 2008
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Foundation, as used in Apple iPhone 1.0 through 1.1.2, iPod touch 1.1 through 1.1.2, and Mac OS X 10.5 through 10.5.1, allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted URL that…

  • CVE-2008-0122Jan 16, 2008
    Isc
    Bind
    risk 0.01cvss —epss 0.12

    Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted input that…

  • CVE-2008-0216Jan 16, 2008
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.00

    The ptsname function in FreeBSD 6.0 through 7.0-PRERELEASE does not properly verify that a certain portion of a device name is associated with a pty of a user who is calling the pt_chown function, which might allow local users to read data from the pty from another user.

  • CVE-2008-0217Jan 16, 2008
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.00

    The script program in FreeBSD 5.0 through 7.0-PRERELEASE invokes openpty, which creates a pseudo-terminal with world-readable and world-writable permissions when it is not run as root, which allows local users to read data from the terminal of the user running script.

  • CVE-2008-0287Jan 16, 2008
    Visionburst
    Vcart
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in VisionBurst vcart 3.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the abs_path parameter to (1) index.php and (2) checkout.php.

  • CVE-2008-0288Jan 16, 2008
    Imagealbum
    Imagealbum
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ImageAlbum 2.0.0b2 allow remote attackers to execute arbitrary SQL commands via the id, which is not properly handled in (1) classes/IADomain.php, (2) classes/IACollection.php, and (3) classes/IAUser.php, as demonstrated via the id…

  • CVE-2008-0289Jan 16, 2008
    Member Area System
    Member Area System
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in view_func.php in Member Area System (MAS) 1.7 and possibly others allows remote attackers to execute arbitrary PHP code via a URL in the i parameter. NOTE: a second vector might exist via the l parameter. NOTE: as of 20080118, the…

  • CVE-2008-0290Jan 16, 2008
    Digitalhive
    Digitalhive
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Digital Hive 2.0 RC2 and earlier allow (1) remote attackers to execute arbitrary SQL commands via the selectskin parameter to an unspecified program, or (2) remote authenticated administrators to execute arbitrary SQL commands via the…

  • CVE-2008-0286Jan 16, 2008
    Article Dashboard
    Article Dashboard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/login.php in Article Dashboard allows remote attackers to execute arbitrary SQL commands via the (1) user or (2) password fields.

  • CVE-2008-0285Jan 16, 2008
    Ngircd
    Ngircd
    risk 0.00cvss —epss 0.02

    ngIRCd 0.10.x before 0.10.4 and 0.11.0 before 0.11.0-pre2 allows remote attackers to cause a denial of service (crash) via crafted IRC PART message, which triggers an invalid dereference.

  • CVE-2008-0280Jan 15, 2008
    Mtcms
    Mtcms
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in MTCMS 2.0 and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via the (1) a or (2) cid parameter.

  • CVE-2008-0281Jan 15, 2008
    ID Commerce
    ID Commerce
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in liste.php in ID-Commerce 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the idFamille parameter.

  • CVE-2008-0282Jan 15, 2008
    Domphp
    Domphp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in welcome/inscription.php in DomPHP 0.81 and earlier allows remote attackers to execute arbitrary SQL commands via the mail parameter.

  • CVE-2008-0283Jan 15, 2008
    Domphp
    Domphp
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in /aides/index.php in DomPHP 0.81 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

  • CVE-2008-0284Jan 15, 2008
    Simple Machines
    Smf
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 1.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) Itemid or (2) topic arguments.

  • CVE-2008-0001Jan 15, 2008
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    VFS in the Linux kernel before 2.6.22.16, and 2.6.23.x before 2.6.23.14, performs tests of access mode by using the flag variable instead of the acc_mode variable, which might allow local users to bypass intended permissions and remove directories.

  • CVE-2008-0173Jan 15, 2008
    GForge
    Gforge
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Gforge 4.6.99 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified parameters, related to RSS exports.

  • CVE-2008-0253Jan 15, 2008
    Binn
    Sbuilder
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in full_text.php in Binn SBuilder allows remote attackers to execute arbitrary SQL commands via the nid parameter.

  • CVE-2008-0254Jan 15, 2008
    TutorialCMS
    TutorialCMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in activate.php in TutorialCMS (aka Photoshop Tutorials) 1.02, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the userName parameter.

  • CVE-2008-0255Jan 15, 2008
    Igaming
    iGaming
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in archive.php in iGaming 1.5, and 1.3.1 and earlier, allows remote attackers to execute arbitrary SQL commands via the section parameter.

  • CVE-2008-0256Jan 15, 2008
    Matteo Binda
    Asp Photo Gallery
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Matteo Binda ASP Photo Gallery 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) Imgbig.asp, (b) thumb.asp, and (c) thumbricerca.asp and the (2) ricerca parameter to (d) thumbricerca.asp.

  • CVE-2008-0257Jan 15, 2008
    Dansie
    Search Engine
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.pl in Dansie Search Engine 2.7 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-0258Jan 15, 2008
    PHP Running Management
    Phprunman
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in PHP Running Management (phpRunMan) before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the message parameter.

  • CVE-2008-0259Jan 15, 2008
    Minimal Gallery
    minimal Gallery
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in _mg/php/mg_thumbs.php in minimal Gallery 0.8 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) thumbcat and (2) thumb parameters.

  • CVE-2008-0260Jan 15, 2008
    Minimal Gallery
    minimal Gallery
    risk 0.03cvss —epss 0.02

    minimal Gallery 0.8 allows remote attackers to obtain configuration information via a direct request to php_info.php, which calls the phpinfo function.

  • CVE-2008-0261Jan 15, 2008
    Mambo (software)
    Mambo
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the search component and module in Mambo 4.5.x and 4.6.x allows remote attackers to cause a denial of service (query flood) via unspecified vectors.

  • CVE-2008-0262Jan 15, 2008
    Agares Media
    Phpautovideo
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in includes/articleblock.php in Agares PhpAutoVideo 2.21 allows remote attackers to execute arbitrary SQL commands via the articlecat parameter.

  • CVE-2008-0263Jan 15, 2008
    Ingate
    Firewall
    risk 0.00cvss —epss 0.02

    The SIP module in Ingate Firewall before 4.6.1 and SIParator before 4.6.1 does not reuse SIP media ports in unspecified call hold and send-only stream scenarios, which allows remote attackers to cause a denial of service (port exhaustion) via unspecified vectors.

  • CVE-2008-0264Jan 15, 2008
    Drupal
    Meta Tags
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Meta Tags (aka Nodewords) 5.x-1.6 module for Drupal, when images are permitted in node bodies, allows remote authenticated users to execute arbitrary code via unspecified vectors involving creation of a node.

  • CVE-2008-0265Jan 15, 2008
    F5, Inc.
    Big IP
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in the Search function in the web management interface in F5 BIG-IP 9.4.3 allow remote attackers to inject arbitrary web script or HTML via the SearchString parameter to (1) list_system.jsp, (2) list_pktfilter.jsp, (3)…

  • CVE-2008-0266Jan 15, 2008
    Eticket
    Eticket
    risk 0.03cvss —epss 0.00

    Cross-site request forgery (CSRF) vulnerability in admin.php in eTicket 1.5.5.2 allows remote attackers to change the administrative password and possibly perform other administrative tasks. NOTE: either the old password must be known, or the attacker must leverage a separate…

  • CVE-2008-0267Jan 15, 2008
    Eticket
    Eticket
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in eTicket 1.5.5.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) status, (2) sort, and (3) way parameters to search.php; and allow remote authenticated administrators to execute arbitrary SQL commands via…

  • CVE-2008-0268Jan 15, 2008
    Eticket
    Eticket
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in view.php in eTicket 1.5.5.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2008-0269Jan 15, 2008
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the dotoprocs function in Sun Solaris 10 allows local users to cause a denial of service (panic) via unspecified vectors.

  • CVE-2008-0270Jan 15, 2008
    Taskfreak
    Taskfreak\!
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in TaskFreak! 0.6.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the sContext parameter.

  • CVE-2008-0271Jan 15, 2008
    Drupal
    Bueditor
    risk 0.00cvss —epss 0.01

    The editor deletion form in BUEditor 4.7.x before 4.7.x-1.0 and 5.x before 5.x-1.1, a module for Drupal, does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete custom editor interfaces.

  • CVE-2008-0272Jan 15, 2008
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote attackers to delete items from a feed as privileged users.

  • CVE-2008-0273Jan 15, 2008
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Interpretation conflict in Drupal 4.7.x before 4.7.11 and 5.x before 5.6, when Internet Explorer 6 is used, allows remote attackers to conduct cross-site scripting (XSS) attacks via invalid UTF-8 byte sequences, which are not processed as UTF-8 by Drupal's HTML filtering, but…

  • CVE-2008-0274Jan 15, 2008
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files.

  • CVE-2008-0275Jan 15, 2008
    Drupal
    Atom
    risk 0.00cvss —epss 0.01

    The Atom 4.7 before 4.7.x-1.0 and 5.x before 5.x-1.0 module for Drupal does not properly manage permissions for node (1) titles, (2) teasers, and (3) bodies, which might allow remote attackers to gain access to syndicated content.