VYPR

CVEs

344,562 total · page 6427 of 6,892

AllCriticalHighKEV
  • CVE-2006-7120Mar 6, 2007
    Phphtmllib
    Phphtmllib
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in lib/php/phphtmllib-2.5.4/examples/example6.php for maintain 3.0.0-RC2 allows remote attackers to execute arbitrary PHP code via a URL in the phphtmllib parameter. NOTE: this issue might be in phpHtmlLib. NOTE: CVE disputes this issue…

  • CVE-2006-7121Mar 6, 2007
    Linksys
    Spa921
    risk 0.00cvss —epss 0.02

    The HTTP server in Linksys SPA-921 VoIP Desktop Phone allows remote attackers to cause a denial of service (reboot) via (1) a long URL, or a long (2) username or (3) password during Basic Authentication.

  • CVE-2006-7122Mar 6, 2007
    Joomla
    Bsq Sitestats
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the IP Address Lookup functionality in BSQ Sitestats (component for Joomla) 1.8.0, and possibly other versions before 2.2.1, allows remote attackers to inject arbitrary web script and HTML via the ip parameter.

  • CVE-2006-7123Mar 6, 2007
    Joomla
    Bsq Sitestats
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in BSQ Sitestats (component for Joomla) 1.8.0, and possibly other versions before 2.2.1, allow remote attackers to execute arbitrary SQL commands via (1) unspecified parameters when importing the (a) ip-to-country.csv file; and the (2) HTTP…

  • CVE-2006-7124Mar 6, 2007
    Joomla
    Bsq Sitestats
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in external/rssfeeds.php in BSQ Sitestats (component for Joomla) 1.8.0, and possibly other versions before 2.2.1, allows remote attackers to execute arbitrary PHP code via the baseDir parameter.

  • CVE-2006-7125Mar 6, 2007
    Joomla
    Bsq Sitestats
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Joomla BSQ Sitestats 1.8.0 and 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header, which is not properly handled when the administrator views site statistics.

  • CVE-2006-7126Mar 6, 2007
    Joomla
    Bsq Sitestats
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Joomla BSQ Sitestats 1.8.0 and 2.2.1 allows remote attackers to execute arbitrary SQL commands via the query string, possibly PHP_SELF.

  • CVE-2006-7127Mar 6, 2007
    Jaf CMS
    Jaf CMS
    risk 0.03cvss —epss 0.06

    Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the main_dir parameter to (1) forum/main.php and (2) forum/headlines.php.

  • CVE-2006-7128Mar 6, 2007
    Jaf CMS
    Jaf CMS
    risk 0.04cvss —epss 0.07

    PHP remote file inclusion vulnerability in forum/forum.php JAF CMS 4.0 RC1 allows remote attackers to execute arbitrary PHP code via a URL in the website parameter.

  • CVE-2006-7129Mar 6, 2007
    Iss
    Blackice Pc Protection
    risk 0.03cvss —epss 0.01

    ISS BlackICE PC Protection 3.6 cpj and cpu, and possibly earlier versions, allows local users to bypass the protection scheme by using the ZwDeleteFile API function to delete the critical filelock.txt file, which stores information about protected files.

  • CVE-2006-7130Mar 6, 2007
    Jinzora
    Jinzora
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in backend/primitives/cache/media.php in Jinzora 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter, a different vector than CVE-2006-6770.

  • CVE-2006-7131Mar 6, 2007
    Jinzora
    Jinzora
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in extras/mt.php in Jinzora 2.6 allows remote attackers to execute arbitrary PHP code via the web_root parameter.

  • CVE-2006-7132Mar 6, 2007
    Cynux Softwares
    Phpmydesk
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in pmd-config.php in PHPMyDesk 1.0beta allows remote attackers to include arbitrary local files via the pmdlang parameter to viewticket.php.

  • CVE-2006-7133Mar 6, 2007
    PHP Upload Tool
    PHP Upload Tool
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in upload/bin/download.php in Upload Tool for PHP 1.0 allows remote attackers to read arbitrary files via (1) ".." sequences or (2) absolute pathnames in the filename parameter.

  • CVE-2006-7134Mar 6, 2007
    Noah Spurrier
    Upload Tool For PHP
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in main_user.php in Upload Tool for PHP 1.0 allows remote attackers to upload and execute arbitrary files with executable extensions such as .php. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2007-1281Mar 6, 2007
    Kaspersky Lab
    Kaspersky Antivirus Engine
    risk 0.00cvss —epss 0.03

    Kaspersky AntiVirus Engine 6.0.1.411 for Windows and 5.5-10 for Linux allows remote attackers to cause a denial of service (CPU consumption) via a crafted UPX compressed file with a negative offset, which triggers an infinite loop during decompression.

  • CVE-2007-0994Mar 6, 2007
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the user via an HTML mail message with a javascript: URI in an (1) img, (2) link, or…

  • CVE-2007-0711Mar 5, 2007
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.06

    Integer overflow in Apple QuickTime before 7.1.5, when installed on Windows operating systems, allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP video file.

  • CVE-2007-0712Mar 5, 2007
    Apple Inc.
    Quicktime
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MIDI file.

  • CVE-2007-0713Mar 5, 2007
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted QuickTime movie file.

  • CVE-2007-0714Mar 5, 2007
    Apple Inc.
    Quicktime
    risk 0.01cvss —epss 0.08

    Integer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted QuickTime movie with a User Data Atom (UDTA) with an Atom size field with a large value.

  • CVE-2007-0715Mar 5, 2007
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PICT file.

  • CVE-2007-0716Mar 5, 2007
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted QTIF file.

  • CVE-2007-0717Mar 5, 2007
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Integer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted QTIF file.

  • CVE-2007-0718Mar 5, 2007
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a QTIF file with a Video Sample Description containing a Color table ID of 0, which triggers memory…

  • CVE-2006-7109Mar 5, 2007
    Drupal
    IMCE
    risk 0.00cvss —epss 0.01

    Unrestricted file upload vulnerability in IMCE before 1.6, a Drupal module, allows remote authenticated users to upload arbitrary PHP code via a filename with a double extension such as .php.gif.

  • CVE-2006-7110Mar 5, 2007
    Drupal
    IMCE
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in the delete function in IMCE before 1.6, a Drupal module, allows remote authenticated users to delete arbitrary files via ".." sequences.

  • CVE-2006-7111Mar 5, 2007
    Futomi
    Kmail Cgi
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Futomi's CGI Cafe KMail CGI 1.0.3 and earlier allows remote attackers to bypass authentication and obtain unauthorized email access via unspecified vectors.

  • CVE-2007-1276Mar 5, 2007
    Webmin
    Webmin
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary web script or HTML via a crafted filename.

  • CVE-2007-1277Mar 5, 2007
    WordPress
    WordPress
    risk 0.05cvss —epss 0.27

    WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to…

  • CVE-2006-7108Mar 4, 2007
    util-linux
    util-linux
    risk 0.00cvss —epss 0.00

    login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pam_acct_mgmt and chauth_tok.

  • CVE-2007-0774Mar 4, 2007
    Apache
    Tomcat Jk Web Server Connector
    risk 0.10cvss —epss 0.82

    Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that…

  • CVE-2006-7100Mar 3, 2007
    PhpBB
    Insert User
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Insert User 0.1.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-7101Mar 3, 2007
    Phpwind
    Phpwind
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin.php in PHPWind 5.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the AdminUser cookie.

  • CVE-2006-7102Mar 3, 2007
    phpBurningPortal
    quiz-modul
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in phpBurningPortal quiz-modul 1.0.1, and possibly earlier, allow remote attackers to execute arbitrary PHP code via a URL in the lang_path parameter to (1) quest_delete.php, (2) quest_edit.php, or (3) quest_news.php.

  • CVE-2006-7103Mar 3, 2007
    Ezonlinegallery
    Ezonlinegallery
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in EZOnlineGallery 1.3 and earlier, and possibly other versions before 1.3.2 Beta, allow remote attackers to (1) determine directory existence via a ".." in the album parameter in a show_album action to (a) ezgallery.php, which…

  • CVE-2006-7104Mar 3, 2007
    Mambo (software)
    Mostlyce
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in htmltemplate.php in the Chad Auld MOStlyContent Editor (MOStlyCE) as created on May 2006, a component for Mambo 4.5.4, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-7105CriMar 3, 2007
    Smarty
    Smarty
    risk 0.64cvss 9.8epss 0.02

    PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter. NOTE: in the original disclosure, filename is used in a function definition, so this report is probably…

  • CVE-2006-7106Mar 3, 2007
    Powerphlogger
    Powerphlogger
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in config.inc.php3 in Power Phlogger 2.0.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rel_path parameter.

  • CVE-2006-7107Mar 3, 2007
    Freepbx
    Freepbx
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in upgrade.php in Coalescent Systems freePBX 2.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the amp_conf[AMPWEBROOT] parameter.

  • CVE-2007-1260Mar 3, 2007
    Webmod
    Webmod
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in the connectHandle function in server.cpp in WebMod 0.48 allows remote attackers to execute arbitrary code via a long string in the Content-Length HTTP header.

  • CVE-2007-1261Mar 3, 2007
    Openbiblio
    Openbiblio
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the reports system in OpenBiblio before 0.6.0 allows attackers to gain privileges via unspecified vectors.

  • CVE-2007-1247Mar 3, 2007
    Aweb Labs
    Awebnews
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in aWeb Labs aWebNews 1.5 allow remote attackers to execute arbitrary PHP code via a URL in the path_to_news parameter to (1) listing.php or (2) visview.php.

  • CVE-2007-1248Mar 3, 2007
    Built2go
    News Manager Blog
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in built2go News Manager Blog 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cid, (2) uid, and (3) nid parameters to (a) news.php, and the nid parameter to (b) rating.php.

  • CVE-2007-1249Mar 3, 2007
    Contelligent
    C1 Financial Services
    risk 0.00cvss —epss 0.01

    MoveSortedContentAction in C1 Financial Services Contelligent 9.1.4 does not check "the additional environment security configuration," which allows remote attackers with write permissions to reorder components.

  • CVE-2007-1250Mar 3, 2007
    ANGEL Learning
    Learning Management Suite
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in section/default.asp in ANGEL Learning Management Suite (LMS) 7.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2007-1251Mar 3, 2007
    Netrek
    Netrek Vanilla Server
    risk 0.04cvss —epss 0.06

    Format string vulnerability in the new_warning function in ntserv/warning.c for Netrek Vanilla Server 2.12.0, when EVENTLOG is enabled, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in the message handling.

  • CVE-2007-1252Mar 3, 2007
    Symantec
    Mail Security
    risk 0.01cvss —epss 0.07

    Buffer overflow in Symantec Mail Security for SMTP 5.0 before Patch 175 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted headers in an e-mail message. NOTE: some information was obtained from third party sources.

  • CVE-2007-1253Mar 3, 2007
    Blender
    Blender
    risk 0.00cvss —epss 0.03

    Eval injection vulnerability in the (a) kmz_ImportWithMesh.py Script for Blender 0.1.9h, as used in (b) Blender before 2.43, allows user-assisted remote attackers to execute arbitrary Python code by importing a crafted (1) KML or (2) KMZ file.

  • CVE-2007-1254Mar 3, 2007
    Connectix
    Boards
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in part.userprofile.php in Connectix Boards 0.7 and earlier allows remote authenticated users to execute arbitrary SQL commands and obtain privileges via the p_skin parameter to index.php.