Archive
January 2008
Vulnerabilities first published in this month (UTC), newest first.
498 results · Feed
-
Unscored —CVE-2008-0260 Public exploit
minimal Gallery 0.8 allows remote attackers to obtain configuration information via a direct request to php_info.php, w…
-
Unscored —CVE-2008-0266 Public exploit
Cross-site request forgery (CSRF) vulnerability in admin.php in eTicket 1.5.5.2 allows remote attackers to change the a…
-
Unscored —CVE-2008-0267 Public exploit
Multiple SQL injection vulnerabilities in eTicket 1.5.5.2 allow remote authenticated users to execute arbitrary SQL com…
-
Unscored —
The editor deletion form in BUEditor 4.7.x before 4.7.x-1.0 and 5.x before 5.x-1.1, a module for Drupal, does not follo…
-
Unscored —CVE-2008-0279 Public exploit
SQL injection vulnerability in liretopic.php in Xforum 1.4 and possibly others allows remote attackers to execute arbit…
-
Unscored —CVE-2008-0254 Public exploit
SQL injection vulnerability in activate.php in TutorialCMS (aka Photoshop Tutorials) 1.02, when magic_quotes_gpc is dis…
-
Unscored —
The SIP module in Ingate Firewall before 4.6.1 and SIParator before 4.6.1 does not reuse SIP media ports in unspecified…
-
Unscored —CVE-2008-0245 Public exploit
admin.php in UploadImage 1.0 does not check for the original password before making a change to a new password, which a…
-
Unscored —
Heap-based buffer overflow in the Express Backup Server service (dsmsvc.exe) in IBM Tivoli Storage Manager (TSM) Expres…
-
Unscored —CVE-2008-0249 Public exploit
PHP Webquest 2.6 allows remote attackers to retrieve database credentials via a direct request to admin/backup_phpwebqu…
-
High 7.5
CherryPy Malicious cookies allow access to files outside the session directory
Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arb…
-
Unscored —
SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell m…
-
Unscored —
Buffer overflow in an ActiveX control in ccpm_0237.dll for StreamAudio ChainCast ProxyManager allows remote attackers t…
-
Unscored —
Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a S…
-
Unscored —
Unspecified vulnerability in libdevinfo in Sun Solaris 10 allows local users to access files and gain privileges via un…
-
Unscored —CVE-2008-0251 Public exploit
Unrestricted file upload vulnerability in PhotoPost vBGallery before 2.4.2 allows remote attackers to upload and execut…
-
Unscored —
Unspecified vulnerability in Lotus Domino 7.0.2 before Fix Pack 3 allows attackers to cause a denial of service via unk…
-
Unscored —CVE-2008-0246 Public exploit
admin.php in UploadScript 1.0 does not check for the original password before making a change to a new password, which …
-
Unscored —
The xmlCurrentChar function in libxml2 before 2.6.31 allows context-dependent attackers to cause a denial of service (i…
-
Unscored —CVE-2008-0123 Public exploit
Cross-site scripting (XSS) vulnerability in install.php for Moodle 1.8.3, and possibly other versions before 1.8.4, all…
-
Unscored —CVE-2008-0005 EPSS 15%
mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a …
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.…
-
Unscored —
Unspecified vulnerability in mod_proxy_balancer for Apache HTTP Server 2.2.x before 2.2.7-dev, when running on Windows,…
-
Unscored —
Open redirect vulnerability in /idm/user/login.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.…
-
Unscored —CVE-2008-0239 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7…
-
Unscored —CVE-2008-0240 Public exploit
/idm/help/index.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allows remote attackers to in…
-
Unscored —
Multiple heap-based buffer overflows in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 allow rem…
-
Unscored —CVE-2008-0233 Public exploit
Unrestricted file upload vulnerability in Zero CMS 1.0 Alpha and earlier allows remote attackers to bypass intended acc…
-
Unscored —
The Microsoft Rich Textbox ActiveX Control (RICHTX32.OCX) 6.1.97.82 allows remote attackers to execute arbitrary comman…
-
Unscored —CVE-2008-0235 EPSS 29%
The Microsoft VFP_OLE_Server ActiveX control allows remote attackers to execute arbitrary code by invoking the foxcomma…
-
Unscored —
Buffer overflow in Apple Quicktime Player 7.3.1.70 and other versions before 7.4.1, when RTSP tunneling is enabled, all…
-
Unscored —
An ActiveX control for Microsoft Visual FoxPro (vfp6r.dll 6.0.8862.0) allows remote attackers to execute arbitrary comm…
-
Unscored —
IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validat…
-
Unscored —CVE-2008-0232 Public exploit
Multiple SQL injection vulnerabilities in Zero CMS 1.0 Alpha allow remote attackers to execute arbitrary SQL commands v…
-
Unscored —CVE-2008-0231 Public exploit
Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange …
-
Unscored —CVE-2008-0230 Public exploit
PHP remote file inclusion vulnerability in php121db.php in osDate 2.0.8 and possibly earlier versions allows remote att…
-
Unscored —
yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allows remote attackers to cause a denial of ser…
-
Unscored —CVE-2008-0222 Public exploit
Unrestricted file upload vulnerability in ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for WordPress allows rem…
-
Unscored —
Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows …
-
Unscored —CVE-2008-0228 Public exploit
Cross-site request forgery (CSRF) vulnerability in apply.cgi in the Linksys WRT54GL Wireless-G Broadband Router with fi…