CVE Daily
← All years

Uncategorized 2008

Page 10/13.

CVEs without a recognized CWE (not present in the CWE map or marked as N/A).

CVSS ≥ 0.0
2008-03-31
Medium

CVE-2008-1563

The "decode as" feature in packet-bssap.c in the SCCP dissector in Wireshark (formerly Ethereal) 0.99.6 through 0.99.8 allows remote attackers to cause a denial of service (application crash) via a m…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2008-0070

Integer overflow in Orb Networks Orb 2.00.1014 and Winamp Remote BETA allows remote attackers to execute arbitrary code via an RPC request that specifies a large number of array dimensions, which tri…

CVSS: 4.6CWE: CWE-189
Read more
Medium

CVE-2008-1552

The silc_pkcs1_decode function in the silccrypt library (silcpkcs1.c) in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.7, SILC Client before 1.1.4, and SILC Server before 1.1.2 allows r…

CVSS: 6.8CWE: CWE-189
Read more
Critical

CVE-2008-1558

Uncontrolled array index in the sdpplin_parse function in stream/realrtsp/sdpplin.c in MPlayer 1.0 rc2 allows remote attackers to overwrite memory and execute arbitrary code via a large streamid SDP…

CVSS: 10.0CWE: CWE-189
Read more
2008-03-28
Critical

CVE-2008-0704

Unspecified vulnerability in the SSH server in HP OpenVMS TCP/IP Services on OpenVMS on the Alpha platform with 5.4 before ECO 7, and on the Integrity and Alpha platforms with 5.5 before ECO 3 and 5.…

CVSS: 10.0CWE: CWE-264
Read more
High

CVE-2008-1542

Airspan Base Station Distribution Unit (BSDU) has "topsecret" as its password for the root account, which allows remote attackers to obtain administrative access via a telnet login, a different vulne…

CVSS: 7.5CWE: CWE-255
Read more
High

CVE-2008-1543

The Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX ProST have a certain default User ID and password, which makes it easier for remote attackers to obtain pa…

CVSS: 7.5CWE: CWE-255
Read more
High

CVE-2008-1546

servlet/MIMEReceiveServlet in the web controller for Mitsubishi Electric GB-50 and GB-50A air-conditioning control systems allows remote attackers to cause a denial of service (air-conditioning outag…

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2008-1240

LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attacker…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2008-1533

Unspecified vulnerability in the XML-RPC Blogger API plugin in Joomla! 1.5 allows remote attackers to perform unauthorized article operations on articles via unknown vectors.

CVSS: 6.8CWE: N/A
Read more
2008-03-27
Medium

CVE-2008-1531

The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of service (active SSL connection loss) by trig…

CVSS: 4.3CWE: N/A
Read more
Critical

CVE-2008-1530

GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which trigg…

CVSS: 9.3CWE: CWE-399
Read more
High

CVE-2008-1150

The virtual private dial-up network (VPDN) component in Cisco IOS before 12.3 allows remote attackers to cause a denial of service (resource exhaustion) via a series of PPTP sessions, related to the…

CVSS: 7.1CWE: CWE-399
Read more
High

CVE-2008-1151

Memory leak in the virtual private dial-up network (VPDN) component in Cisco IOS before 12.3 allows remote attackers to cause a denial of service (memory consumption) via a series of PPTP sessions, r…

CVSS: 7.1CWE: CWE-399
Read more
High

CVE-2008-1152

The data-link switching (DLSw) component in Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of service (device restart or memory consumption) via crafted (1) UDP port 2067 or (2…

CVSS: 7.8CWE: CWE-399
Read more
Medium

CVE-2008-1384

Integer overflow in PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service and possibly have unspecified other impact via a printf format parameter with a large width s…

CVSS: 5.0CWE: CWE-189
Read more
High

CVE-2008-1391

Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values o…

CVSS: 7.5CWE: CWE-189
Read more
High

CVE-2008-0537

Unspecified vulnerability in the Supervisor Engine 32 (Sup32), Supervisor Engine 720 (Sup720), and Route Switch Processor 720 (RSP720) for multiple Cisco products, when using Multi Protocol Label Swi…

CVSS: 7.1CWE: N/A
Read more
High

CVE-2008-1153

Cisco IOS 12.1, 12.2, 12.3, and 12.4, with IPv4 UDP services and the IPv6 protocol enabled, allows remote attackers to cause a denial of service (device crash and possible blocked interface) via a cr…

CVSS: 7.1CWE: N/A
Read more
Medium

CVE-2008-1156

Unspecified vulnerability in the Multicast Virtual Private Network (MVPN) implementation in Cisco IOS 12.0, 12.2, 12.3, and 12.4 allows remote attackers to create "extra multicast states on the core…

CVSS: 5.1CWE: CWE-16
Read more
Critical

CVE-2008-1235

Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via unknown vectors that cause…

CVSS: 9.3CWE: N/A
Read more
Medium

CVE-2008-1236

Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service (crash) and possib…

CVSS: 6.8CWE: CWE-399
Read more
Medium

CVE-2008-1237

Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service (crash) and possib…

CVSS: 6.8CWE: CWE-399
Read more
2008-03-26
Medium

CVE-2008-1529

ZyXEL Prestige routers have a minimum password length for the admin account that is too small, which makes it easier for remote attackers to guess passwords via brute force methods.

CVSS: 5.0CWE: CWE-255
Read more
High

CVE-2008-1527

ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), support authentication over HTTP via a hash string in the hiddenPassword…

CVSS: 7.5CWE: CWE-310
Read more
Medium

CVE-2008-1525

The default SNMP configuration on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), has a Trusted Host value of 0.0.0.0, which allows remote atta…

CVSS: 5.0CWE: CWE-16
Read more
High

CVE-2008-1524

The SNMP service on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), has "public" as its default community for both (1) read and (2) write opera…

CVSS: 7.5CWE: CWE-16
Read more
Medium

CVE-2008-1521

ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to gain privileges by accessing administrative URIs, as demons…

CVSS: 6.5CWE: CWE-264
Read more
High

CVE-2008-1522

ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), have (1) "user" as their default password for the "user" account and (2) "1234" as their defaul…

CVSS: 7.5CWE: CWE-16
Read more
Medium

CVE-2008-1514

arch/s390/kernel/ptrace.c in Linux kernel 2.6.9, and other versions before 2.6.27-rc6, on s390 platforms allows local users to cause a denial of service (kernel panic) via the user-area-padding test…

CVSS: 4.9CWE: CWE-399
Read more
2008-03-25
High

CVE-2008-1507

PEEL, possibly 3.x and earlier, has (1) a default info@peel.fr account with password admin, and (2) a default contact@peel.fr account with password cinema, which allows remote attackers to gain admin…

CVSS: 7.5CWE: CWE-16
Read more
Medium

CVE-2008-1501

The send_user_mode function in s_user.c in (1) Undernet ircu 2.10.12.12 and earlier, (2) snircd 1.3.4 and earlier, and unspecified other ircu derivatives allows remote attackers to cause a denial of…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2008-1489

Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MP4 RDRF bo…

CVSS: 6.8CWE: CWE-189
Read more
2008-03-24
Critical

CVE-2007-6711

Unspecified vulnerability in customer.php in FreeWebshop.org 2.2.5, 2.2.6 and 2.2.7WIP1/2 allows remote attackers to gain administrator privileges via unknown vectors.

CVSS: 10.0CWE: CWE-264
Read more
Low

CVE-2008-1484

The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute forc…

CVSS: 3.5CWE: CWE-264
Read more
Medium

CVE-2008-1483

OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, a…

CVSS: 6.9CWE: CWE-264
Read more
Medium

CVE-2008-0073

Array index error in the sdpplin_parse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter.

CVSS: 6.8CWE: CWE-189
Read more
High

CVE-2008-1471

The cpoint.sys driver in Panda Internet Security 2008 and Antivirus+ Firewall 2008 allows local users to cause a denial of service (system crash or kernel panic), overwrite memory, or execute arbitra…

CVSS: 7.2CWE: CWE-399
Read more
High

CVE-2008-1473

The Altiris Client Service (AClient.exe) in Symantec Altiris Deployment Solution 6.8.x before 6.9.164 allows local users to gain privileges via a "Shatter" style attack.

CVSS: 7.2CWE: CWE-264
Read more
Medium

CVE-2008-1475

The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) se…

CVSS: 6.4CWE: CWE-264
Read more
Medium

CVE-2008-1480

rpc.metad in Sun Solaris 10 allows remote attackers to cause a denial of service (daemon crash) via a malformed RPC request.

CVSS: 4.3CWE: N/A
Read more
Critical

CVE-2008-1390

The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before…

CVSS: 9.3CWE: CWE-255
Read more
2008-03-20
Low

CVE-2008-1431

RaidSonic NAS-4220-B with 2.6.0-n(2007-10-11) firmware stores a partition encryption key in an unencrypted /system/.crypt file with base64 encoding, which allows local users to obtain the key.

CVSS: 2.1CWE: CWE-310
Read more
High

CVE-2008-1429

Secure Internet Live Conferencing (SILC) Server before 1.1.1 allows remote attackers to cause a denial of service (daemon crash) via a NEW_CLIENT packet without a nickname.

CVSS: 7.8CWE: N/A
Read more
High

CVE-2008-1402

MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to cause a (1) denial of service (exception and crash) via a UDP packet to the SNMP Trap Service (MgWTrap3.exe) or (2)…

CVSS: 7.1CWE: CWE-399
Read more
High

CVE-2008-0707

HP StorageWorks Library and Tape Tools (LTT) before 4.5 SR1 on HP-UX B.11.11 and B.11.23 allows local users to gain privileges via unspecified vectors.

CVSS: 7.2CWE: CWE-264
Read more
Low

CVE-2008-0889

Red Hat Directory Server 8.0, when running on Red Hat Enterprise Linux, uses insecure permissions for the redhat-idm-console script, which allows local users to execute arbitrary code by modifying th…

CVSS: 2.1CWE: CWE-264
Read more
High

CVE-2008-1332

Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before 1.4.18.1 and 1.4.19-rc3; Business Edition A.x.x, B.x.x before B.2.5.1, and C.x.x before C.1.6.2; AsteriskNOW 1.0.x…

CVSS: 8.8CWE: CWE-264
Read more
High

CVE-2008-1340

Virtual Machine Communication Interface (VMCI) in VMware Workstation 6.0.x before 6.0.3, VMware Player 2.0.x before 2.0.3, and VMware ACE 2.0.x before 2.0.1 allows attackers to cause a denial of serv…

CVSS: 7.1CWE: CWE-399
Read more
Medium

CVE-2008-1361

VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x before 2.0.1 and 1.0.x before 1.0.5, and VMware Server 1.0.x be…

CVSS: 6.8CWE: CWE-264
Read more
High

CVE-2008-1362

VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x before 2.0.1 and 1.0.x before 1.0.5, and VMware Server 1.0.x be…

CVSS: 7.2CWE: CWE-264
Read more
High

CVE-2008-1363

VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x before 2.0.1 and 1.0.x before 1.0.5, and VMware Server 1.0.x be…

CVSS: 7.2CWE: CWE-264
Read more
High

CVE-2008-1364

Unspecified vulnerability in the DHCP service in VMware Workstation 5.5.x before 5.5.6, VMware Player 1.0.x before 1.0.6, VMware ACE 1.0.x before 1.0.5, VMware Server 1.0.x before 1.0.5, and VMware F…

CVSS: 7.8CWE: CWE-399
Read more
Critical

CVE-2008-1392

The default configuration of VMware Workstation 6.0.2, VMware Player 2.0.x before 2.0.3, and VMware ACE 2.0.x before 2.0.1 makes the console of the guest OS accessible through anonymous VIX API calls…

CVSS: 10.0CWE: CWE-16
Read more
Critical

CVE-2008-1393

Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obt…

CVSS: 10.0CWE: CWE-255
Read more
High

CVE-2008-1394

Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the netw…

CVSS: 7.5CWE: CWE-255
Read more
Medium

CVE-2008-1396

Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanen…

CVSS: 4.3CWE: CWE-255
Read more
Medium

CVE-2008-1397

Check Point VPN-1 Power/UTM, with NGX R60 through R65 and NG AI R55 software, allows remote authenticated users to cause a denial of service (site-to-site VPN tunnel outage), and possibly intercept n…

CVSS: 6.5CWE: CWE-264
Read more
2008-03-18
Medium

CVE-2008-0998

Unspecified vulnerability in NetCfgTool in the System Configuration component in Apple Mac OS X 10.4.11 and 10.5.2 allows local users to bypass authorization and execute arbitrary code via crafted di…

CVSS: 6.9CWE: CWE-264
Read more
Medium

CVE-2008-0988

Off-by-one error in the Libsystem strnstr API in libc on Apple Mac OS X 10.4.11 allows context-dependent attackers to cause a denial of service (crash) via crafted arguments that trigger a buffer ove…

CVSS: 4.3CWE: CWE-189
Read more
Medium

CVE-2008-0051

Integer overflow in CoreFoundation in Apple Mac OS X 10.4.11 might allow local users to execute arbitrary code via crafted time zone data.

CVSS: 6.9CWE: CWE-189
Read more
Low

CVE-2008-1383

The docert function in ssl-cert.eclass, when used by src_compile or src_install on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from the binpkg, and cause…

CVSS: 1.9CWE: CWE-310
Read more
Medium

CVE-2008-0057

Multiple integer overflows in a "legacy serialization format" parser in AppKit in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via a crafted serialized property list.

CVSS: 6.8CWE: CWE-189
Read more
High

CVE-2008-0045

Unspecified vulnerability in AFP Server in Apple Mac OS X 10.4.11 allows remote attackers to bypass cross-realm authentication via unknown manipulations of Kerberos principal realm names.

CVSS: 7.1CWE: CWE-264
Read more
Low

CVE-2008-0049

AppKit in Apple Mac OS X 10.4.11 inadvertently makes an NSApplication mach port available for inter-process communication instead of inter-thread communication, which allows local users to execute ar…

CVSS: 1.9CWE: CWE-264
Read more
Medium

CVE-2008-0046

The Application Firewall in Apple Mac OS X 10.5.2 has an incorrect German translation for the "Set access for specific services and applications" radio button that might cause the user to believe tha…

CVSS: 5.0CWE: CWE-264
Read more
Critical

CVE-2008-1369

A certain incorrect Sun Solaris 10 image on SPARC Enterprise T5120 and T5220 servers has /etc/default/login and /etc/ssh/sshd_config files that configure root logins in a manner unintended by the ven…

CVSS: 10.0CWE: CWE-264
Read more
Critical

CVE-2008-0949

Unspecified vulnerability in IBM Informix Dynamic Server (IDS) 7.x through 11.x allows remote attackers to gain privileges via a malformed connection request packet.

CVSS: 10.0CWE: N/A
Read more
2008-03-17
High

CVE-2008-1367

gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag (DF) from being r…

CVSS: 7.5CWE: CWE-399
Read more
Medium

CVE-2008-1353

zabbix_agentd in ZABBIX 1.4.4 allows remote attackers to cause a denial of service (CPU and connection consumption) via multiple vfs.file.cksum commands with a special device node such as /dev/urando…

CVSS: 4.3CWE: N/A
Read more
2008-03-14
High

CVE-2008-1338

The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a server-DiffFile command with an integer value wit…

CVSS: 7.8CWE: CWE-189
Read more
2008-03-13
High

CVE-2007-6709

The Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.01.03 and earlier firmware has "admin" as its default password for the "admin" account, which makes it easier for remote attackers to obtain a…

CVSS: 7.5CWE: CWE-264
Read more
Critical

CVE-2008-1335

The ipsec4_get_ulp function in the kernel in NetBSD 2.0 through 3.1 and NetBSD-current before 20071028, when the fast_ipsec subsystem is enabled, allows remote attackers to bypass the IPsec policy by…

CVSS: 9.3CWE: N/A
Read more
Medium

CVE-2008-1317

Unspecified vulnerability in the Inter-Process Communication (IPC) message queue subsystem in Sun Solaris 10 allows local users to cause a denial of service (reboot) via blocked I/O message queues.

CVSS: 4.9CWE: N/A
Read more
Critical

CVE-2008-1319

Untrusted search path and argument injection vulnerability in the VersantD service in Versant Object Database 7.0.1.3 and earlier, as used in Borland CaliberRM and probably other products, allows rem…

CVSS: 9.3CWE: N/A
Read more
High

CVE-2008-1322

The File Check Utility (fcheck.exe) in ASG-Sentry Network Manager 7.0.0 and earlier allows remote attackers to cause a denial of service (CPU consumption) or overwrite arbitrary files via a query str…

CVSS: 7.8CWE: N/A
Read more
2008-03-12
Medium

CVE-2008-1312

Unspecified vulnerability in the TFTP server in PacketTrap Networks pt360 Tool Suite 1.1.33.1.0, and other versions before 2.0.3900.0, allows remote attackers to cause a denial of service (daemon cra…

CVSS: 5.0CWE: N/A
Read more
Critical

CVE-2008-1309

The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.…

CVSS: 9.3CWE: CWE-399
Read more
Medium

CVE-2008-1302

The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a (1) server-DiffFile or (2) server-ReleaseFile com…

CVSS: 5.0CWE: CWE-189
Read more
Medium

CVE-2008-0890

Red Hat Directory Server 7.1 before SP4 uses insecure permissions for certain directories, which allows local users to modify JAR files and execute arbitrary code via unknown vectors.

CVSS: 4.6CWE: CWE-264
Read more
High

CVE-2008-1203

The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without de…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2008-0644

Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism for applications via unspecified vectors related to the setEncoding functi…

CVSS: 5.0CWE: N/A
Read more
2008-03-11
Critical

CVE-2008-0117

Unspecified vulnerability in Microsoft Excel 2000 SP3 and 2002 SP2, and Office 2004 and 2008 for Mac, allows user-assisted remote attackers to execute arbitrary code via crafted conditional formattin…

CVSS: 9.3CWE: N/A
Read more
Medium

CVE-2008-0306

sdbstarter in SAP MaxDB 7.6.0.37, and possibly other versions, allows local users to execute arbitrary commands by using unspecified environment variables to modify configuration settings.

CVSS: 6.9CWE: N/A
Read more
Critical

CVE-2008-0307

Integer signedness error in vserver in SAP MaxDB 7.6.0.37, and possibly other versions, allows remote attackers to execute arbitrary code via unknown vectors that trigger heap corruption.

CVSS: 9.3CWE: CWE-189
Read more
Medium

CVE-2008-1287

IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames.

CVSS: 5.0CWE: CWE-16
Read more
High

CVE-2008-1286

Unspecified vulnerability in Sun Java Web Console 3.0.2, 3.0.3, and 3.0.4 allows remote attackers to bypass intended access restrictions and determine the existence of files or directories via unknow…

CVSS: 7.8CWE: N/A
Read more
2008-03-10
Medium

CVE-2008-1218

Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing…

CVSS: 6.8CWE: CWE-255
Read more
Medium

CVE-2008-1274

Untrusted search path vulnerability in man in IBM AIX 6.1.0 allows local users to execute arbitrary code via a malicious program in the man directory.

CVSS: 6.9CWE: N/A
Read more
High

CVE-2008-1275

Multiple unspecified vulnerabilities in the SMTP service in MailEnable Standard Edition 1.x, Professional Edition 3.x and earlier, and Enterprise Edition 3.x and earlier allow remote attackers to cau…

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2008-1263

The Linksys WRT54G router stores passwords and keys in cleartext in the Config.bin file, which might allow remote authenticated users to obtain sensitive information via an HTTP request for the top-l…

CVSS: 4.0CWE: CWE-310
Read more
Medium

CVE-2008-1261

The Zyxel P-2602HW-D1A router with 3.40(AJZ.1) firmware provides different responses to admin page requests depending on whether a user is logged in, which allows remote attackers to obtain current l…

CVSS: 5.0CWE: N/A
Read more
Critical

CVE-2008-1255

The ZyXEL P-660HW series router maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session from a source IP address of a previously…

CVSS: 10.0CWE: CWE-264
Read more
High

CVE-2008-1267

The Siemens SpeedStream 6520 router allows remote attackers to cause a denial of service (web interface crash) via an HTTP request to basehelp_English.htm with a large integer in the Content-Length f…

CVSS: 7.8CWE: CWE-189
Read more
Critical

CVE-2008-1256

The ZyXEL P-660HW series router has "admin" as its default password, which allows remote attackers to gain administrative access.

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2008-1230

Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbitrary .jsp files via an unspecified manipulation that attaches a .jsp file to a…

CVSS: 9.3CWE: CWE-264
Read more
Critical

CVE-2008-1247

The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via a…

CVSS: 10.0CWE: CWE-264
Read more
High

CVE-2008-1246

The Cisco PIX/ASA Finesse Operation System 7.1 and 7.2 allows local users to gain privileges by entering characters at the enable prompt, erasing these characters via the Backspace key, and then hold…

CVSS: 7.8CWE: CWE-264
Read more
Critical

CVE-2008-1242

The control panel on the Belkin F5D7230-4 router with firmware 9.01.10 maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session f…

CVSS: 10.0CWE: CWE-264
Read more
High

CVE-2008-1223

Unspecified vulnerability in Dokeos 1.8.4 before SP3 allows attackers to execute arbitrary code via unspecified vectors.

CVSS: 7.5CWE: N/A
Read more
2008-03-09
Low

CVE-2007-6705

The WebSphere MQ XA 5.3 before FP13 and 6.0.x before 6.0.2.1 client for Windows, when running in an MTS or a COM+ environment, grants the PROCESS_DUP_HANDLE privilege to the Everyone group upon conne…

CVSS: 3.3CWE: CWE-264
Read more
Medium

CVE-2008-1215

Stack-based buffer overflow in the command_Expand_Interpret function in command.c in ppp (aka user-ppp), as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for Ne…

CVSS: 4.6CWE: CWE-264
Read more
2008-03-08
Medium

CVE-2008-1205

Unspecified vulnerability in the ipsecah kernel module in Sun Solaris 10, when a key management daemon for IPsec security associations is running, allows local users to cause a denial of service (pan…

CVSS: 4.9CWE: N/A
Read more
2008-03-06
Critical

CVE-2008-1200

Unspecified vulnerability in Microsoft Access allows remote user-assisted attackers to execute arbitrary code via a crafted .MDB file, possibly related to Jet Engine (msjet40.dll). NOTE: this is pro…

CVSS: 9.3CWE: N/A
Read more
Medium

CVE-2008-1199

Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files…

CVSS: 4.4CWE: CWE-16
Read more
High

CVE-2008-1198

The default IPSec ifup script in Red Hat Enterprise Linux 3 through 5 configures racoon to use aggressive IKE mode instead of main IKE mode, which makes it easier for remote attackers to conduct brut…

CVSS: 7.1CWE: N/A
Read more
Critical

CVE-2008-1195

Unspecified vulnerability in Sun JDK and Java Runtime Environment (JRE) 6 Update 4 and earlier and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier; allows remote attackers to access a…

CVSS: 9.3CWE: CWE-254
Read more
Medium

CVE-2008-1194

Multiple unspecified vulnerabilities in the color management library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allows remote attackers to cause a denial of service (cr…

CVSS: 4.3CWE: N/A
Read more
Critical

CVE-2008-1193

Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allows remote attackers to gain privileges via an…

CVSS: 9.3CWE: CWE-264
Read more
Medium

CVE-2008-1192

Unspecified vulnerability in the Java Plug-in for Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier, and 1.3.1_21 and earlier; allows remote…

CVSS: 6.8CWE: CWE-254
Read more
Medium

CVE-2008-1191

Unspecified vulnerability in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier allows remote attackers to create arbitrary files via an untrusted application, a different issue than CVE-2008-1…

CVSS: 6.8CWE: N/A
Read more
Critical

CVE-2008-1190

Unspecified vulnerability in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to gain privileges via an un…

CVSS: 9.3CWE: CWE-264
Read more
Medium

CVE-2008-1187

Unspecified vulnerability in Sun Java Runtime Environment (JRE) and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to cause a denial o…

CVSS: 6.8CWE: CWE-264
Read more
Critical

CVE-2008-1186

Unspecified vulnerability in the Virtual Machine for Sun Java Runtime Environment (JRE) and JDK 5.0 Update 13 and earlier, and SDK/JRE 1.4.2_16 and earlier, allows remote attackers to gain privileges…

CVSS: 9.3CWE: CWE-264
Read more
Critical

CVE-2008-1185

Unspecified vulnerability in the Virtual Machine for Sun Java Runtime Environment (JRE) and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attac…

CVSS: 9.3CWE: CWE-264
Read more
High

CVE-2008-0986

Integer overflow in the BMP::readFromStream method in the libsgl.so library in Google Android SDK m3-rc37a and earlier, and m5-rc14, allows remote attackers to execute arbitrary code via a crafted BM…

CVSS: 7.5CWE: CWE-189
Read more
Medium

CVE-2008-1184

The DNSSEC validation library (libval) library in dnssec-tools before 1.3.1 does not properly check that the signing key is the APEX trust anchor, which might allow attackers to conduct unspecified a…

CVSS: 5.0CWE: CWE-255
Read more
2008-03-05
Medium

CVE-2008-1097

Heap-based buffer overflow in the ReadPCXImage function in the PCX coder in coders/pcx.c in (1) ImageMagick 6.2.4-5 and 6.2.8-0 and (2) GraphicsMagick (aka gm) 1.1.7 allows user-assisted remote attac…

CVSS: 6.8CWE: CWE-399
Read more
Medium

CVE-2008-1099

_macro_Getval in wikimacro.py in MoinMoin 1.5.8 and earlier does not properly enforce ACLs, which allows remote attackers to read protected pages.

CVSS: 5.0CWE: CWE-264
Read more
2008-03-04
Medium

CVE-2008-1146

A certain pseudo-random number generator (PRNG) algorithm that uses XOR and 3-bit random hops (aka "Algorithm X3"), as used in OpenBSD 2.8 through 4.2, allows remote attackers to guess sensitive valu…

CVSS: 6.8CWE: N/A
Read more
>