Archive
September 2008
Vulnerabilities first published in this month (UTC), newest first.
450 results · Feed
-
Unscored —
lib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HT…
-
Unscored —CVE-2008-4323 Public exploit
Windows Explorer in Microsoft Windows XP SP3 allows user-assisted attackers to cause a denial of service (application c…
-
Unscored —CVE-2008-4324 Public exploit
The user interface event dispatcher in Mozilla Firefox 3.0.3 on Windows XP SP2 allows remote attackers to cause a denia…
-
Unscored —CVE-2008-4321 Public exploit
Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long re…
-
Unscored —
Stack-based buffer overflow in RealFlex Technologies Ltd. RealWin Server 2.0, as distributed by DATAC, allows remote at…
-
Unscored —CVE-2008-3827 EPSS 11%
Multiple integer underflows in the Real demuxer (demux_real.c) in MPlayer 1.0_rc2 and earlier allow remote attackers to…
-
Unscored —
Observer 0.3.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the quer…
-
Unscored —CVE-2008-4320 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.5.94 allow remote attackers to inject arbitrary…
-
Unscored —CVE-2008-4319 Public exploit
fileadmin.php in Libra File Manager (aka Libra PHP File Manager) 1.18 and earlier allows remote attackers to bypass aut…
-
Unscored —CVE-2008-4192 Public exploit
The pserver_shutdown function in fence_egenera in cman 2.20080629 and 2.20080801 allows local users to overwrite arbitr…
-
Unscored —CVE-2008-4210 Public exploit
fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a f…
-
Unscored —CVE-2008-4299 EPSS 16%
A certain ActiveX control in the Microsoft Internet Authentication Service (IAS) Helper COM Component in iashlpr.dll al…
-
Unscored —CVE-2008-4120 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in FlatPress 0.804 allow remote attackers to inject arbitrary web s…
-
Unscored —CVE-2008-4301 EPSS 17%
A certain ActiveX control in iisext.dll in Microsoft Internet Information Services (IIS) allows remote attackers to set…
-
Unscored —CVE-2008-4302 Public exploit
fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_t…
-
Unscored —CVE-2008-4300 EPSS 14%
A certain ActiveX control in adsiis.dll in Microsoft Internet Information Services (IIS) allows remote attackers to cau…
-
Unscored —
rc.sysinit in initscripts before 8.76.3-1 on Fedora 9 and other Linux platforms allows local users to delete arbitrary …
-
Unscored —
Buffer overflow in x87 before 3.5.5 in ABB Process Communication Unit 400 (PCU400) 4.4 through 4.6 allows remote attack…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Opera before 9.52 allows remote attackers to inject arbitrary web script or…
-
Unscored —
Opera before 9.52 does not ensure that the address field of a news feed represents the feed's actual URL, which allows …
-
Unscored —
Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in CA Service Desk 11.2 and CMDB 11.0 through 11.2 allow remote att…
-
Unscored —
Opera before 9.52 does not properly restrict the ability of a framed web page to change the address associated with a d…
-
Unscored —
Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers t…
-
Unscored —
Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown i…
-
Unscored —
IBM Tivoli Netcool/Webtop 2.1 before 2.1.0.5 preserves cached user privileges after logout, which allows physically pro…
-
Unscored —
Unspecified vulnerability in Opera before 9.52 on Windows, when registered as a protocol handler, allows remote attacke…
-
Unscored —
Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to est…
-
Unscored —
The Cisco Linksys WRT350N with firmware 1.0.3.7 has "admin" as its default password for the "admin" account, which make…
-
Unscored —
Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows …
-
Unscored —
Opera before 9.52 does not prevent use of links from web pages to feed source files on the local disk, which might allo…
-
Unscored —
Opera before 9.52, when rendering an http page that has loaded an https page into a frame, displays a padlock icon and …
-
Unscored —
Opera before 9.52 on Windows, Linux, FreeBSD, and Solaris, when processing custom shortcut and menu commands, can produ…
-
Unscored —
The error-reporting functionality in (1) fs/ext2/dir.c, (2) fs/ext3/dir.c, and possibly (3) fs/ext4/dir.c in the Linux …
-
Unscored —
Unspecified vulnerability in Cisco IOS 12.2 and 12.4, when the L2TP mgmt daemon process is enabled, allows remote attac…
-
Unscored —
Cisco IOS 12.0 through 12.4 on Gigabit Switch Router (GSR) devices (aka 12000 Series routers) allows remote attackers t…
-
Unscored —
Cisco IOS 12.2 and 12.3 on Cisco uBR10012 series devices, when linecard redundancy is configured, enables a read/write …
-
Unscored —
Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4 and Un…
-
Unscored —
Unspecified vulnerability in the Multi Protocol Label Switching (MPLS) Forwarding Infrastructure (MFI) in Cisco IOS 12.…
-
Unscored —
Cisco IOS 12.4 allows remote attackers to cause a denial of service (device crash) via a normal, properly formed SSL pa…