VYPR

CVEs

344,562 total · page 6426 of 6,892

AllCriticalHighKEV
  • CVE-2006-7156Mar 7, 2007
    Minibb
    Keyword Replacer
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in addon_keywords.php in Keyword Replacer (keyword_replacer) 1.0 and earlier, a module for miniBB, allows remote attackers to execute arbitrary PHP code via a URL in the pathToFiles parameter.

  • CVE-2006-7157Mar 7, 2007
    Google
    Earth
    risk 0.04cvss —epss 0.07

    Buffer overflow in Google Earth v4.0.2091 (beta) allows remote user-assisted attackers to cause a denial of service (crash) via a KML or KMZ file with a long href element.

  • CVE-2006-7158Mar 7, 2007
    Oracle Corporation
    Apex
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Oracle Application Express (APEX) before 2.2.1, aka Oracle HTML DB, allows remote attackers to inject arbitrary web script or HTML via the NOTIFICATION_MSG parameter. NOTE: it is likely that this issue overlaps one of the identifiers…

  • CVE-2006-7159Mar 7, 2007
    Bti Tracker
    Btitracker
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in include/prune_torrents.php in BTI-Tracker 1.3.2 (aka btitracker) allows remote attackers to delete arbitrary files via ".." sequences in the TORRENTSDIR parameter in a prune action.

  • CVE-2006-7160Mar 7, 2007
    Outpost
    Firewall PRO
    risk 0.00cvss —epss 0.00

    The Sandbox.sys driver in Outpost Firewall PRO 4.0, and possibly earlier versions, does not validate arguments to hooked SSDT functions, which allows local users to cause a denial of service (crash) via invalid arguments to the (1) NtAssignProcessToJobObject,, (2) NtCreateKey,…

  • CVE-2006-7161Mar 7, 2007
    Hazir Site
    Hazir Site
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in giris_yap.asp in Hazir Site 2.0 allows remote attackers to bypass authentication via the (1) k_a class or (2) sifre parameter.

  • CVE-2006-7135Mar 7, 2007
    PHP Poll Creator
    PHP Poll Creator
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in lib/functions.inc.php in PHP Poll Creator (phpPC) 1.04 allows remote attackers to execute arbitrary PHP code via a URL in the relativer_pfad parameter, a different vector and version than CVE-2005-1755. NOTE: the provenance of this…

  • CVE-2006-7136Mar 7, 2007
    Phppc
    PHP Poll Creator
    risk 0.04cvss —epss 0.09

    Multiple PHP remote file inclusion vulnerabilities in PHP Poll Creator (phpPC) 1.04 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the relativer_pfad parameter to (1) poll.php, (2) poll_kommentar.php, and (3) poll_sm.php, different vectors and…

  • CVE-2006-7137Mar 7, 2007
    Tinyportal
    Tinyportal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in TinyPortal before 0.8.6 allows remote attackers to inject arbitrary web script or HTML via the shoutbox.

  • CVE-2007-1288Mar 7, 2007
    Webmobo
    Wbnews
    risk 0.00cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Webmobo WB News 1.4.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the config[installdir] parameter to (1) comment.php, (2) themes.php, (3) directory.php, and (4) sendmsg.php in admin/.

  • CVE-2007-1289Mar 7, 2007
    Tyger
    Bug Tracking System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ViewBugs.php in Tyger Bug Tracking System (TygerBT) 1.1.3 allows remote attackers to execute arbitrary SQL commands via the s parameter.

  • CVE-2007-1290Mar 7, 2007
    Tyger
    Bug Tracking System
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in ViewReport.php in Tyger Bug Tracking System (TygerBT) 1.1.3 allows remote attackers to execute arbitrary SQL commands via the bug parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2007-1291Mar 7, 2007
    Tyger
    Bug Tracking System
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Tyger Bug Tracking System (TygerBT) 1.1.3 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) Login.php and (2) Register.php.

  • CVE-2007-1292Mar 7, 2007
    Jelsoft
    Vbulletin
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter. NOTE: the vendor states that the attack is feasible only in…

  • CVE-2007-1293Mar 7, 2007
    Rigter Portal System
    Rigter Portal System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Rigter Portal System (RPS) 6.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the categoria parameter to the top-level URI (index.php), possibly related to ver_descarga.php.

  • CVE-2007-1294Mar 7, 2007
    Divx
    Web Player
    risk 0.03cvss —epss 0.03

    A certain ActiveX control in the DivXBrowserPlugin (npdivx32.dll) in DivX Web Player, as distributed with DivX Player 1.3.0, allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via large values to DivxWP.Resize, related to resizing images.

  • CVE-2007-1295Mar 7, 2007
    Aj Forum
    Aj Forum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in topic_title.php in AJ Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the td_id parameter.

  • CVE-2007-1296Mar 7, 2007
    AJ Square
    Aj Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in postingdetails.php in AJ Classifieds 1.0 allows remote attackers to execute arbitrary SQL commands via the postingid parameter.

  • CVE-2007-1297Mar 7, 2007
    AJ Square
    Ajdating
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in view_profile.php in AJDating 1.0 allows remote attackers to execute arbitrary SQL commands via the user_id parameter.

  • CVE-2007-1298Mar 7, 2007
    AJ Auction
    AJ Auction
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in subcat.php in AJ Auction 1.0 allows remote attackers to execute arbitrary SQL commands via the cate_id parameter.

  • CVE-2007-1299Mar 7, 2007
    Mani Stats Reader
    Mani Stats Reader
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in Mani Stats Reader 1.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ipath parameter.

  • CVE-2007-1300Mar 7, 2007
    Douran
    Isputil
    risk 0.00cvss —epss 0.01

    DOURAN Software Technologies ISPUtil 3.32.84.1, and possibly earlier versions, stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and reseller data via a direct request for scripts/activesessions.ini. …

  • CVE-2007-1301Mar 7, 2007
    MailEnable
    Mailenable
    risk 0.04cvss —epss 0.12

    Stack-based buffer overflow in the IMAP service in MailEnable Enterprise and Professional Editions 2.37 and earlier allows remote authenticated users to execute arbitrary code via a long argument to the APPEND command. NOTE: this is probably different than CVE-2006-6423.

  • CVE-2007-1302Mar 7, 2007
    Li Scripts
    Li Guestbook
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in guestbook.php in LI-Guestbook 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the country parameter. NOTE: it was later reported that 1.2 is also affected.

  • CVE-2007-1303Mar 7, 2007
    Rrdbrowse
    Rrdbrowse
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in rb.cgi in RRDBrowse 1.6 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

  • CVE-2007-1304Mar 7, 2007
    Savas Place
    Guestbook
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in add2.php in Sava's Guestbook 23.11.2006, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) country, (3) email, (4) website, and (5) message parameters.

  • CVE-2007-1305Mar 7, 2007
    Savas Place
    Guestbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in add2.php in Sava's Guestbook 23.11.2006 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) country, (3) email, and (4) website parameters.

  • CVE-2007-1306Mar 7, 2007
    Asterisk
    Asterisk
    risk 0.05cvss —epss 0.20

    Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol (SIP) packet without a URI and SIP-version header, which results in a NULL pointer dereference.

  • CVE-2007-1307Mar 7, 2007
    Lenovo
    Thinkpad
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Lenovo Intel PRO/1000 LAN adapter before Build 135400, as used on IBM Lenovo ThinkPad systems, has unknown impact and attack vectors.

  • CVE-2007-1308Mar 7, 2007
    KDE
    Konqueror
    risk 0.04cvss —epss 0.08

    ecma/kjs_html.cpp in KDE JavaScript (KJS), as used in Konqueror in KDE 3.5.5, allows remote attackers to cause a denial of service (crash) by accessing the content of an iframe with an ftp:// URI in the src attribute, probably due to a NULL pointer dereference.

  • CVE-2007-1309Mar 7, 2007
    Novell
    Access Management 3 SSLVPN Server
    risk 0.00cvss —epss 0.02

    Novell Access Management 3 SSLVPN Server allows remote authenticated users to bypass VPN restrictions by making policy.txt read-only, disconnecting, then manually modifying policy.txt.

  • CVE-2007-1263Mar 6, 2007
    Gnupg
    Gnupg
    risk 0.03cvss —epss 0.05

    GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.

  • CVE-2007-1264Mar 6, 2007
    Enigmail
    Enigmail
    risk 0.03cvss —epss 0.05

    Enigmail 0.94.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Enigmail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the…

  • CVE-2007-1265Mar 6, 2007
    KDE
    Kmail
    risk 0.00cvss —epss 0.02

    KMail 1.9.5 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents KMail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of…

  • CVE-2007-1266Mar 6, 2007
    GNOME Foundation
    Evolution
    risk 0.03cvss —epss 0.05

    Evolution 2.8.1 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Evolution from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the…

  • CVE-2007-1267Mar 6, 2007
    Sylpheed
    Sylpheed
    risk 0.00cvss —epss 0.02

    Sylpheed 2.2.7 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Sylpheed from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the…

  • CVE-2007-1268Mar 6, 2007
    Mutt
    Mutt
    risk 0.00cvss —epss 0.03

    Mutt 1.5.13 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Mutt from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of…

  • CVE-2007-1269Mar 6, 2007
    GNU
    Gnumail
    risk 0.00cvss —epss 0.03

    GNUMail 1.1.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents GNUMail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the…

  • CVE-2007-1285HigMar 6, 2007
    PHP
    PHP
    risk 0.53cvss 7.5epss 0.18

    The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays, which trigger deep recursion in the variable destruction routines.

  • CVE-2007-1286Mar 6, 2007
    PHP
    PHP
    risk 0.06cvss —epss 0.40

    Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter.

  • CVE-2007-1287Mar 6, 2007
    PHP
    PHP
    risk 0.03cvss —epss 0.03

    A regression error in the phpinfo function in PHP 4.4.3 to 4.4.6, and PHP 6.0 in CVS, allows remote attackers to conduct cross-site scripting (XSS) attacks via GET, POST, or COOKIE array values, which are not escaped in the phpinfo output, as originally fixed for CVE-2005-3388.

  • CVE-2007-1282Mar 6, 2007
    Seamonkey
    Seamonkey
    risk 0.00cvss —epss 0.05

    Integer overflow in Mozilla Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8 allows remote attackers to trigger a buffer overflow and possibly execute arbitrary code via a text/enhanced or text/richtext e-mail message with an extremely long line.

  • CVE-2006-7112Mar 6, 2007
    MD-Pro
    MD-Pro
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in error.php in MD-Pro 1.0.76 and earlier allows remote authenticated users to read and include arbitrary files via the PNSVlang cookie, as demonstrated by uploading a GIF image using AddDownload or injecting PHP code into a log file, then…

  • CVE-2006-7113Mar 6, 2007
    P News
    P News
    risk 0.00cvss —epss 0.01

    Unrestricted file upload vulnerability in P-News 2.0 allows remote attackers to upload and execute arbitrary files via an avatar file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-7114Mar 6, 2007
    P News
    P News
    risk 0.03cvss —epss 0.02

    P-News 2.0 stores db/user.txt under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames and password hashes via a direct request. NOTE: this might be the same issue as CVE-2006-6888.

  • CVE-2006-7115Mar 6, 2007
    Phpkit
    Phpkit
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in PHPKit 1.6.1 RC2 allows remote attackers to inject arbitrary SQL commands via the catid parameter to include.php when the path parameter is set to faq/faq.php, and other unspecified vectors involving guestbook/print.php.

  • CVE-2006-7116Mar 6, 2007
    Kubix
    Kubix
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in includes/functions.php in Kubix 0.7 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the member_id parameter ($id variable) to index.php.

  • CVE-2006-7117Mar 6, 2007
    Kubix
    Kubix
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in Kubix 0.7 and earlier allow remote attackers to (1) include and execute arbitrary local files via ".." sequences in the theme cookie to index.php, which is not properly handled by includes/head.php; and (2) read arbitrary files via…

  • CVE-2006-7118Mar 6, 2007
    Dmxready
    Site Engine Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.asp in DMXReady Site Engine Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the mid parameter.

  • CVE-2006-7119Mar 6, 2007
    Phpgiggle
    Phpgiggle
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in kernel/system/startup.php in J. He PHPGiggle 12.08 and earlier, as distributed on comscripts.com, allows remote attackers to execute arbitrary PHP code via a URL in the CFG_PHPGIGGLE_ROOT parameter.