CVE-2008-1423

Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service crash or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow...

CVE-2008-2185

Directory traversal vulnerability in index.php in SMartBlog aka SMBlog 1.3 allows remote attackers to include arbitrary local files via directory traversal sequences in the page parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

DEBIAN-CVE-2008-0166

OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys...

PT-2008-1041 · Openssl · Openssl

Name of the Vulnerable Software and Affected Versions: OpenSSL versions 0.9.8c-1 through 0.9.8g-9 Description: The issue concerns a random number generator in OpenSSL that generates predictable numbers, making it easier for remote attackers to conduct brute force guessing attacks against...

Debian DSA-1564-1 : wordpress - multiple vulnerabilities

Several remote vulnerabilities have been discovered in WordPress, a weblog manager. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-3639 Insufficient input sanitising allowed for remote attackers to redirect visitors to external websites. -...

Cross site scripting

The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" aka Editor Security or Secure Editing parameter, which allows remote attackers to conduct cross-site scripting XSS attacks by entering feedback for a file...

Design/Logic Flaw

Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 have unknown impact and remote unauthenticated or authenticated attack vectors related to 1 SYS.DBMSAQ in the Advanced Queuing component, aka DB01; 2 Core RDBMS, aka DB03; 3 SDOGEOM i...

CVE-2008-1800

Multiple cross-site scripting XSS vulnerabilities in index.php in DivXDB 2002 0.94b allow remote attackers to inject arbitrary web script or HTML via the 1 choice, 2 page, 3 zoneadmin, 4 generalsearch, and 5 import parameters. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-1562

CVE-2008-1562 affects Wireshark’s LDAP dissector (versions 0.99.2–0.99.8). The vulnerability allows a remote attacker to cause a DoS by sending a malformed LDAP packet, triggering an application crash. The issue is described as a separate vulnerability from CVE-2006-5740, with public references i...

CVE-2008-1531

The connectionstatemachine function connections.c in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of service active SSL connection loss by triggering an SSL error, such as disconnecting before a download has finished, which causes all active SSL...

Directory traversal

Directory traversal vulnerability in index.php in Multiple Time Sheets MTS 5.0 and earlier allows remote attackers to read arbitrary files via "../..//" modified dot dot sequences in the tab parameter...

CVE-2008-1337

The instant message service in Timbuktu Pro 8.6.5 RC 229 and earlier for Windows allows remote attackers to cause 1 a denial of service daemon crash via an invalid Version field or 2 a denial of service CPU consumption and daemon termination via an invalid or partial message...

CVE-2008-1203

The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection...

CVE-2008-1203

The CVE-2008-1203 issue affects Adobe ColdFusion 8 and ColdFusion MX7 where the administrator interface does not log failed authentication attempts, potentially enabling brute‑force attacks without detection. Connected sources also document related issues in the same family (e.g., other CVEs in C...

CVE-2008-0115

Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2007, Viewer 2003, Compatibility Pack, and Office for Mac 2004 allows user-assisted remote attackers to execute arbitrary code via malformed formulas, aka "Excel Formula Parsing Vulnerability."...

CVE-2008-1250

Multiple cross-site request forgery CSRF vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allow remote attackers to perform actions as the phone user, as demonstrated by inserting an address-book entry containing an XSS sequence...

CVE-2008-1185

Unspecified vulnerability in the Virtual Machine for Sun Java Runtime Environment JRE and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.216 and earlier allows remote attackers to gain privileges via an untrusted application or applet, a different issue than CVE-2008-1186,...

CVE-2008-1147

A certain pseudo-random number generator PRNG algorithm that uses XOR and 2-bit random hops aka "Algorithm X2", as used in OpenBSD 2.6 through 3.4, Mac OS X 10 through 10.5.1, FreeBSD 4.4 through 7.0, and DragonFlyBSD 1.0 through 1.10.1, allows remote attackers to guess sensitive values such as I...

CVE-2008-1125

Multiple directory traversal vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier allow remote attackers to read arbitrary files via a .. dot dot in the 1 themepath parameter to core/themes.php and the 2 filename parameter to download.php...

CVE-2008-0983

lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service crash via a large number of connections, which triggers an out-of-bounds access...