CVE Daily
← All years

All CVEs — 2008

Page 2/35.

Browse all CVEs by publication year. Use filters to refine.

CVSS ≥ 0.0
2008-12-19
High

CVE-2008-5665

SQL injection vulnerability in index.php in the xhresim module in XOOPS allows remote attackers to execute arbitrary SQL commands via the no parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Critical

CVE-2008-5664

Stack-based buffer overflow in Realtek Media Player (aka Realtek Sound Manager, RtlRack, or rtlrack.exe) 1.15.0.0 allows remote attackers to execute arbitrary code via a crafted playlist (PLA) file.

CVSS: 9.3 CWE: CWE-119
Read more
Critical

CVE-2008-5663

Multiple unrestricted file upload vulnerabilities in Kusaba 1.0.4 and earlier allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) loa…

CVSS: 9.0 CWE: CWE-20
Read more
2008-12-18
Critical

CVE-2008-5499

Unspecified vulnerability in Adobe Flash Player for Linux 10.0.12.36, and 9.0.151.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file.

CVSS: 9.3 CWE: CWE-94
Read more
2008-12-17
Medium

CVE-2008-5513

Unspecified vulnerability in the session-restore feature in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19 allows remote attackers to bypass the same origin policy, inject content into docu…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2008-5511

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy and conduct cross-s…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2008-5508

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters,…

CVSS: 4.3 CWE: CWE-20
Read more
Medium

CVE-2008-5507

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to bypass the same origin policy and access portions…

CVSS: 6.0 CWE: CWE-200
Read more
Critical

CVE-2008-5662

Multiple buffer overflows in Sun Java Wireless Toolkit (WTK) for CLDC 2.5.2 and earlier allow downloaded programs to execute arbitrary code via unknown vectors.

CVSS: 9.3 CWE: CWE-119
Read more
Medium

CVE-2008-5660

Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might allow remote attackers to execute arbitrary code v…

CVSS: 6.8 CWE: CWE-134
Read more
High

CVE-2008-5658

Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier allows context-dependent attackers to write arbitrary files via a ZIP file with a file whose name cont…

CVSS: 7.5 CWE: CWE-22
Read more
High

CVE-2008-5657

CRLF injection vulnerability in Quassel Core before 0.3.0.3 allows remote attackers to spoof IRC messages as other users via a crafted CTCP message.

CVSS: 7.5 CWE: CWE-20
Read more
Medium

CVE-2008-5656

Cross-site scripting (XSS) vulnerability in the frontend plugin for the felogin system extension in TYPO3 4.2.0, 4.2.1 and 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unk…

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2008-5655

Multiple SQL injection vulnerabilities in MyioSoft EasyBookMarker 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) delete_folder and (2) delete_link parameters to unspecified…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5654

SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyCalendar 4.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5653

SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through t…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5652

SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyBookMarker 4.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable throu…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5651

SQL injection vulnerability in plugins/bookmarker/bookmarker_backend.php in MyioSoft EasyBookMarker 4.0 allows remote attackers to execute arbitrary SQL commands via the Parent parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5650

SQL injection vulnerability in the login directory in AlstraSoft Web Host Directory allows remote attackers to execute arbitrary SQL commands via the pwd parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Critical

CVE-2008-5649

SQL injection vulnerability in admin/admin.php in AlstraSoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via the username parameter.

CVSS: 10.0 CWE: CWE-89
Read more
High

CVE-2008-5648

SQL injection vulnerability in admin/login.php in DeltaScripts PHP Shop 1.0 allows remote attackers to execute arbitrary SQL commands via the admin_username parameter. NOTE: some of these details ar…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5645

Directory traversal vulnerability in the media server in Orb Networks Orb before 2.01.0022 allows remote attackers to read arbitrary files via directory traversal sequences in an HTTP GET request.

CVSS: 7.8 CWE: CWE-22
Read more
Medium

CVE-2008-5644

Cross-site scripting (XSS) vulnerability in the file backend module in TYPO3 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2008-5643

SQL injection vulnerability in the Books (com_books) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the book_id parameter in a book_details action to index.php.

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5642

Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a cms_language cookie.

CVSS: 5.0 CWE: CWE-22
Read more
High

CVE-2008-5641

SQL injection vulnerability in account.asp in Active Photo Gallery 6.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5640

SQL injection vulnerability in bidhistory.asp in Active Bids 3.5 allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5639

Directory traversal vulnerability in index.php in TxtBlog 1.0 Alpha allows remote attackers to read arbitrary files via a .. (dot dot) in the m parameter.

CVSS: 4.3 CWE: CWE-22
Read more
High

CVE-2008-5638

Multiple SQL injection vulnerabilities in Active Price Comparison 4 allow remote attackers to execute arbitrary SQL commands via the (1) ProductID parameter to reviews.aspx or the (2) linkid paramete…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5637

SQL injection vulnerability in blog.asp in ParsBlogger (Pb) allows remote attackers to execute arbitrary SQL commands via the wr parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5636

SQL injection vulnerability in cate.php in Lito Lite CMS, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cid parameter.

CVSS: 6.8 CWE: CWE-89
Read more
High

CVE-2008-5635

SQL injection vulnerability in account.asp in Active Membership 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to sta…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5634

SQL injection vulnerability in account.asp in Active Force Matrix 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to s…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5633

SQL injection vulnerability in register.asp in ActiveVotes 2.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to start.as…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5632

SQL injection vulnerability in Account.asp in Active Time Billing 3.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to s…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5631

SQL injection vulnerability in start.asp in Active eWebquiz 8.0 allows remote attackers to execute arbitrary SQL commands via the (1) useremail parameter (aka username field) or the (2) password para…

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5630

SQL injection vulnerability in merchants/index.php in Post Affiliate Pro 3 and 3.1.4 allows remote attackers to execute arbitrary SQL commands via the umprof_status parameter.

CVSS: 6.8 CWE: CWE-89
Read more
High

CVE-2008-5629

SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL commands via the id parameter in a play action.

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5628

SQL injection vulnerability in index.php in CMS little 0.0.1 allows remote attackers to execute arbitrary SQL commands via the term parameter.

CVSS: 6.8 CWE: CWE-89
Read more
High

CVE-2008-5627

SQL injection vulnerability in account.asp in Active Trade 2 allows remote attackers to execute arbitrary SQL commands via the (1) username parameter (aka Email field) or the (2) password parameter.…

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5558

Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service (crash) via authe…

CVSS: 4.3 CWE: CWE-287
Read more
Medium

CVE-2008-5621

Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or…

CVSS: 6.0 CWE: CWE-352
Read more
Critical

CVE-2008-5619

html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attack…

CVSS: 10.0 CWE: CWE-94
Read more
Critical

CVE-2008-5616

Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attackers to execute arbitrary code via a malformed TwinVQ file.

CVSS: 10.0 CWE: CWE-119
Read more
High

CVE-2008-5609

SQL injection vulnerability in the Commerce extension 0.9.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-4224

UDF in Apple Mac OS X before 10.5.6 allows user-assisted attackers to cause a denial of service (system crash) via a malformed UDF volume in a crafted ISO file.

CVSS: 7.1 CWE: CWE-20
Read more
Critical

CVE-2008-4223

Podcast Producer in Apple Mac OS X 10.5 before 10.5.6 allows remote attackers to bypass authentication and gain administrative access via unspecified vectors.

CVSS: 10.0 CWE: CWE-287
Read more
2008-12-16
High

CVE-2008-5607

SQL injection vulnerability in the JMovies (aka JM or com_jmovies) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5605

Multiple SQL injection vulnerabilities in ASP Portal allow remote attackers to execute arbitrary SQL commands via the (1) ItemID parameter to classifieds.asp and the (2) ID parameter to Events.asp.

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5604

Directory traversal vulnerability in index.php in My Simple Forum 3.0 and 4.1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot do…

CVSS: 6.8 CWE: CWE-22
Read more
High

CVE-2008-5599

SQL injection vulnerability in default.asp in Merlix Teamworx Server allows remote attackers to execute arbitrary SQL commands via the password parameter (aka passwd field) in a login action. NOTE:…

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5598

Directory traversal vulnerability in index.php in PHPmyGallery 1.51 gold allows remote attackers to list arbitrary directories via a .. (dot dot) in the group parameter.

CVSS: 5.0 CWE: CWE-22
Read more
High

CVE-2008-5595

SQL injection vulnerability in detail.asp in ASP AutoDealer allows remote attackers to execute arbitrary SQL commands via the ID parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5594

Multiple directory traversal vulnerabilities in index.php in Mini Blog 1.0.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) page and (2) admin param…

CVSS: 7.5 CWE: CWE-22
Read more
High

CVE-2008-5593

Multiple directory traversal vulnerabilities in index.php in Mini CMS 1.0.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) page and (2) admin parame…

CVSS: 7.5 CWE: CWE-22
Read more
Medium

CVE-2008-5591

Cross-site scripting (XSS) vulnerability in login.asp in Nightfall Personal Diary 1.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter and possibly other "log…

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2008-5590

SQL injection vulnerability in customer.forumtopic.php in Kalptaru Infotech Product Sale Framework 0.1 beta allows remote attackers to execute arbitrary SQL commands via the forum_topic_id parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5589

SQL injection vulnerability in processlogin.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the (1) txtusername parameter (aka username field) or the (2) txtp…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5588

SQL injection vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the siteID parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5587

Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the…

CVSS: 4.3 CWE: CWE-22
Read more
Medium

CVE-2008-5586

SQL injection vulnerability in findoffice.php in Check Up New Generation (aka Check New) 4.52, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the sea…

CVSS: 6.8 CWE: CWE-89
Read more
High

CVE-2008-5585

Multiple PHP remote file inclusion vulnerabilities in lcxBBportal 0.1 Alpha 2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) portal/includes/po…

CVSS: 7.5 CWE: CWE-94
Read more
2008-12-15
Medium

CVE-2008-5584

Multiple cross-site scripting (XSS) vulnerabilities in ProjectPier 0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) a message, (2) a milestone, or (3) a display n…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2008-5583

Cross-site request forgery (CSRF) vulnerability in index.php in ProjectPier 0.8 and earlier allows remote attackers to perform actions as an administrator via the query string, as demonstrated by a d…

CVSS: 6.8 CWE: CWE-352
Read more
High

CVE-2008-5582

SQL injection vulnerability in utilities/login.asp in Nukedit 4.9.x, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the email parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5581

PHP remote file inclusion vulnerability in mini-pub.php/front-end/img.php in mini-pub 0.3 allows remote attackers to execute arbitrary PHP code via a URL in the sFileName parameter.

CVSS: 7.5 CWE: CWE-20
Read more
High

CVE-2008-5580

mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the sFileName argument.

CVSS: 7.5 CWE: CWE-20
Read more
Medium

CVE-2008-5579

Absolute path traversal vulnerability in mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to read arbitrary files via a full pathname in the sFileName parameter.

CVSS: 5.0 CWE: CWE-22
Read more
High

CVE-2008-5578

Multiple SQL injection vulnerabilities in index.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allow remote attackers to execute arbitrary SQL commands via (1) the f parameter in a showforum action, (2) t…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5577

PHP remote file inclusion vulnerability in index.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allows remote attackers to execute arbitrary PHP code via a URL in the inc_function parameter.

CVSS: 7.5 CWE: CWE-94
Read more
High

CVE-2008-5576

admin/forums.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allows remote attackers to bypass authentication and gain administrative access via a large value of the current_user[users_level] parameter.

CVSS: 7.5 CWE: CWE-287
Read more
High

CVE-2008-5575

Session fixation vulnerability in Pro Clan Manager 0.4.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.

CVSS: 7.5 CWE: CWE-287
Read more
High

CVE-2008-5574

SQL injection vulnerability in member.php in Webmaster Marketplace allows remote attackers to execute arbitrary SQL commands via the u parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5573

SQL injection vulnerability in the login feature in Poll Pro 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) Password and (2) username parameters.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5571

SQL injection vulnerability in admin/login.asp in Professional Download Assistant 0.1 allows remote attackers to execute arbitrary SQL commands via the (1) uname parameter (aka user field) or the (2)…

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5570

Directory traversal vulnerability in index.php in PHP Multiple Newsletters 2.7, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot d…

CVSS: 6.8 CWE: CWE-22
Read more
Medium

CVE-2008-5569

Multiple cross-site scripting (XSS) vulnerabilities in PHPepperShop 1.4 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php or (2) shop/kontakt.php, or (3…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2008-5568

Cross-site request forgery (CSRF) vulnerability in admin/settings.php in IPN Pro 3 1.44 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the ad…

CVSS: 6.8 CWE: CWE-352
Read more
Medium

CVE-2008-5567

Cross-site request forgery (CSRF) vulnerability in admin/ad_settings.php in Bonza Cart 1.10 and earlier allows remote attackers to change the admin password via a logout action in conjunction with th…

CVSS: 6.8 CWE: CWE-352
Read more
Medium

CVE-2008-5566

Cross-site scripting (XSS) vulnerability in index.php in Triangle Solutions PHP Multiple Newsletters 2.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2008-5565

Cross-site request forgery (CSRF) vulnerability in admin/settings.php in DL PayCart 1.34 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the N…

CVSS: 6.8 CWE: CWE-352
Read more
High

CVE-2008-5561

SQL injection vulnerability in Netref 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) fiche_product.php and (2) presentation.php.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5559

SQL injection vulnerability in sendcard.cfm in PostEcards allows remote attackers to execute arbitrary SQL commands via the cid parameter.

CVSS: 7.5 CWE: CWE-89
Read more
2008-12-12
Medium

CVE-2008-5556

The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not recognize attack patterns designed to operate against web pages that are encoded with utf-7, which allows remote attackers to bypass…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2008-5555

Microsoft Internet Explorer 8.0 Beta 2 relies on the XDomainRequestAllowed HTTP header to authorize data exchange between domains, which allows remote attackers to bypass the product's XSS Filter pro…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2008-5554

The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not properly handle some HTTP headers that appear after a CRLF sequence in a URI, which allows remote attackers to bypass the XSS protect…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2008-5553

The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 disables itself upon encountering a certain X-XSS-Protection HTTP header, which allows remote attackers to bypass the XSS protection mechanism…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2008-5552

The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks via a CRLF sequence in conjunction with a crafted Conte…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2008-5551

The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks by injecting data at two different positions within an…

CVSS: 4.3 CWE: CWE-79
Read more
Critical

CVE-2008-5548

VirusBuster 4.5.11.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5547

HAURI ViRobot 2008.12.4.1499 and possibly 2008.9.12.1375, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (ak…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5546

VirusBlokAda VBA32 3.12.8.5, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginnin…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5545

Trend Micro VSAPI 8.700.0.1004 in Trend Micro AntiVirus, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5544

Hacksoft The Hacker 6.3.1.2.174 and possibly 6.3.0.9.081, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (ak…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5543

Symantec AntiVirus (SAV) 10, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginnin…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5542

Sunbelt VIPRE 3.1.1832.2 and possibly 3.1.1633.1, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE i…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5541

Sophos Anti-Virus 4.33.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning,…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5540

Secure Computing Secure Web Gateway (aka Webwasher), when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EX…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5539

RISING Antivirus 21.06.31.00 and possibly 20.61.42.00, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5538

Prevx Prevx1 2, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modify…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5537

PC Tools AntiVirus 4.4.2.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5536

Panda Antivirus 9.0.0.4, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, a…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5535

Norman Antivirus 5.80.02, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning,…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5534

ESET NOD32 Antivirus 3662 and possibly 3440, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info")…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5533

K7AntiVirus 7.10.541 and possibly 7.10.454, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info")…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5532

Ikarus Virus Utilities T3.1.1.45.0 and possibly T3.1.1.34.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5531

Fortinet Antivirus 3.113.0.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginni…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5530

Ewido Security Suite 4.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning,…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5529

CA eTrust Antivirus 31.6.6086, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginn…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5528

Aladdin eSafe 7.0.17.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, an…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5527

ESET Smart Security, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and m…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5526

DrWeb Anti-virus 4.44.0.09170, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginn…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5525

ClamAV 0.94.1 and possibly 0.93.1, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the be…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5524

CAT-QuickHeal 10.00 and possibly 9.50, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at th…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5523

avast! antivirus 4.8.1281.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginnin…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5522

AVG Anti-Virus 8.0.0.161, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning,…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5521

Avira AntiVir 7.9.0.36 and possibly 7.8.1.28, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info"…

CVSS: 9.3 CWE: CWE-20
Read more
Critical

CVE-2008-5520

AhnLab V3 2008.12.4.1 and possibly 2008.9.13.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE inf…

CVSS: 9.3 CWE: CWE-20
Read more
High

CVE-2008-5497

BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the login_auth cookie to true.

CVSS: 7.5 CWE: CWE-287
Read more
High

CVE-2008-5496

SQL injection vulnerability in showcategory.php in PozScripts Business Directory Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.

CVSS: 7.5 CWE: CWE-89
Read more