VYPR

CVEs

344,072 total · page 6452 of 6,882

AllCriticalHighKEV
  • CVE-2006-6558Dec 14, 2006
    Crob
    Crob FTP Server
    risk 0.03cvss —epss 0.06

    Crob FTP Server 3.6.1 b.263 allows remote attackers to cause a denial of service via a long series of "?A" sequences in the (1) LIST and possibly (2) NLST command.

  • CVE-2006-6559Dec 14, 2006
    Lotfian
    Request For Travel
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ProductDetails.asp in Lotfian Request For Travel 1.0 allows remote attackers to execute arbitrary SQL commands via the PID parameter.

  • CVE-2006-6560Dec 14, 2006
    Mxbb
    Modsdb
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in includes/common.php in the mx_modsdb 1.0.0 module for MxBB (aka MX-System) Portal allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.

  • CVE-2006-6561Dec 14, 2006
    Microsoft
    Word
    risk 0.06cvss —epss 0.40

    Unspecified vulnerability in Microsoft Word 2000, 2002, and Word Viewer 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted DOC file that triggers memory corruption, as demonstrated via the 12122006-djtest.doc file, a different issue than…

  • CVE-2006-6536Dec 14, 2006
    Cilem
    Cilem Haber
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in hata.asp in Cilem Haber Free Edition allows remote attackers to inject arbitrary web script or HTML via the hata parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-6537Dec 14, 2006
    IBM
    Websphere Host On Demand
    risk 0.00cvss —epss 0.01

    IBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html.

  • CVE-2006-6538Dec 14, 2006
    Dlink
    DWL-2000AP+
    risk 0.03cvss —epss 0.03

    D-LINK DWL-2000AP+ firmware 2.11 allows remote attackers to cause (1) a denial of service (device reset) via a flood of ARP replies on the wired or wireless (radio) link and (2) a denial of service (device crash) via a flood of ARP requests on the wireless link.

  • CVE-2006-6539Dec 14, 2006
    Flippet.org
    Winamp Web Interface
    risk 0.01cvss —epss 0.08

    Multiple buffer overflows in Winamp Web Interface (Wawi) 7.5.13 and earlier (1) allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an (a) long username or a (b) crafted packet to the FindBasicAuth function in…

  • CVE-2006-6540Dec 14, 2006
    Bluetrait
    Bluetrait
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in bt-trackback.php in Bluetrait before 1.2.0, when trackback is enabled, allows remote attackers to execute arbitrary SQL commands via unspecified parameters. NOTE: some of these details are obtained from third party information.

  • CVE-2006-6541Dec 14, 2006
    PHP
    Animated Smiley Generator
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in signer/final.php in warez distributions of Animated Smiley Generator allows remote attackers to execute arbitrary PHP code via a URL in the smiley parameter. NOTE: the vendor disputes this issue, stating that only Warez versions of…

  • CVE-2006-6542Dec 14, 2006
    Fscripts
    Fantastic News
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.php in Fantastic News 2.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-6543Dec 14, 2006
    Appintellect
    Spotlight CRM
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.asp in AppIntellect SpotLight CRM 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) login (UserName) and possibly (2) password parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2006-6544Dec 14, 2006
    Cm68 News
    Cm68 News
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in CM68 News allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-6545Dec 14, 2006
    PHP
    Errordocs
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in includes/common.php in the ErrorDocs 1.0.0 and earlier module for mxBB (mx_errordocs) allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.

  • CVE-2006-6546Dec 14, 2006
    CuteNews
    aj-fork
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in inc/shows.inc.php in cutenews aj-fork (CN:AJ) 167f and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter.

  • CVE-2006-6512Dec 14, 2006
    Winamp
    Winamp Web Interface (Wawi)
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in the Browse function (/browse URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to list arbitrary directories via URL encoded backslashes ("%2F") in the path parameter.

  • CVE-2006-6513Dec 14, 2006
    Winamp
    Winamp Web Interface (Wawi)
    risk 0.00cvss —epss 0.01

    The CControl::Download function (/dl URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to download arbitrary file types under the root via a trailing "." (dot) in a filename in the file parameter, related to erroneous behavior of the…

  • CVE-2006-6514Dec 14, 2006
    Flippet.org
    Winamp Web Interface
    risk 0.00cvss —epss 0.01

    Winamp Web Interface (Wawi) 7.5.13 and earlier uses an insufficient comparison to determine whether a directory is located below the application's root directory, which allows remote authenticated users to access certain other directories if the name of the root directory is a…

  • CVE-2006-6515Dec 14, 2006
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.01

    Mantis before 1.1.0a2 sets the default value of $g_bug_reminder_threshold to "reporter" instead of a more privileged role, which has unknown impact and attack vectors, possibly related to frequency of reminders.

  • CVE-2006-6516Dec 14, 2006
    Kdpics
    Kdpics
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in KDPics 1.16 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) page parameter to (a) index.php3, or the (2) lib_path parameter to (b) authenticate.inc.php3 or (c) lib/exifer/exif.php.

  • CVE-2006-6517Dec 14, 2006
    Kdpics
    Kdpics
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in KDPics 1.16 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) categories parameter to (a) index.php3 or (b) galeries.inc.php3.

  • CVE-2006-6518Dec 14, 2006
    Scriptphp
    Pronews
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ProNews 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo, (2) email, (3) date, (4) sujet, (5) message, (6) site, and (7) lien parameters to (a) admin/change.php, and the (8) aa parameter…

  • CVE-2006-6519Dec 14, 2006
    ProNews
    ProNews
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in lire-avis.php in ProNews 1.5 allows remote attackers to execute arbitrary SQL commands via the aa parameter.

  • CVE-2006-6520Dec 14, 2006
    Scriptphp
    Messageriescripthp
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Messageriescripthp 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo parameter to (a) existepseudo.php, the (2) email parameter to (b) existeemail.php, or the (3) pageName or (4) cssform…

  • CVE-2006-6521Dec 14, 2006
    Messageriescripthp
    Messageriescripthp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in lire-avis.php in Messageriescripthp 2.0 allows remote attackers to execute arbitrary SQL commands via the aa parameter.

  • CVE-2006-6522Dec 14, 2006
    Wikitimescale
    Twozero
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in WikiTimeScale TwoZero before 2.31 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in the (1) forum module and (2) event descriptions. NOTE: some of these details are obtained from third…

  • CVE-2006-6523Dec 14, 2006
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in mail/manage.html in BoxTrapper in cPanel 11 allows remote attackers to inject arbitrary web script or HTML via the account parameter.

  • CVE-2006-6524Dec 14, 2006
    Ezhrs
    Hr Assist
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the Uname (UserName) parameter.

  • CVE-2006-6525Dec 14, 2006
    Ezhrs
    Hr Assist
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-6526Dec 14, 2006
    Gizzar
    Gizzar
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter.

  • CVE-2006-6527Dec 14, 2006
    Gizzar
    Gizzar
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in guest.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-6528Dec 14, 2006
    Drupal
    Chatroom Module
    risk 0.00cvss —epss 0.01

    The Chatroom Module before 4.7.x.-1.0 for Drupal broadcasts Chatroom visitors' session IDs to all participants, which allows remote attackers to hijack sessions and gain privileges.

  • CVE-2006-6529Dec 14, 2006
    Drupal
    Chatroom Module
    risk 0.00cvss —epss 0.01

    The Chatroom Module before 4.7.x.-1.0 for Drupal displays private messages in a chatroom's last messages overview, which allows remote attackers to obtain sensitive information by reading the overview.

  • CVE-2006-6530Dec 14, 2006
    Drupal
    Help Tip
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2006-6531Dec 14, 2006
    Drupal
    Help Tip
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to inject arbitrary web script or HTML, and possibly obtain administrative access, via node titles.

  • CVE-2006-6532Dec 14, 2006
    Vt Forum
    Vt Forum Lite
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Vt-Forum Lite 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) StrMsg or (2) Topic_ID parameter to (a) vf_info.asp, (b) vf_newtopic.asp, (c) vf_settings.asp, and (d)…

  • CVE-2006-6533Dec 14, 2006
    OsCommerce
    Oscommerce
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in admin/templates_boxes_layout.php in osCommerce 3.0a3 allows remote attackers to include and execute arbitrary PHP files via a .. (dot dot) in the filter parameter. NOTE: this issue can be leveraged to obtain full path information in error…

  • CVE-2006-6534Dec 14, 2006
    OsCommerce
    Oscommerce
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 3.0a3 allow remote attackers to inject arbitrary web script or HTML via the (1) set parameter to admin/modules.php, the (2) selected_box parameter to definitiva/admin/customers.php, the (3) lID parameter to…

  • CVE-2006-5648MedDec 14, 2006
    Ubuntu
    Linux
    risk 0.36cvss 5.5epss 0.00

    Ubuntu Linux 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (resource consumption) by using the (1) sys_get_robust_list and (2) sys_set_robust_list functions to create processes that cannot be killed.

  • CVE-2006-5649MedDec 14, 2006
    Ubuntu
    Linux
    risk 0.36cvss 5.5epss 0.00

    Unspecified vulnerability in the "alignment check exception handling" in Ubuntu 5.10, 6.06 LTS, and 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (kernel panic) via unspecified vectors.

  • CVE-2006-5875Dec 14, 2006
    Enemies Of Carlotta
    Enemies Of Carlotta
    risk 0.00cvss —epss 0.02

    eoc.py in Enemies of Carlotta (EoC) before 1.2.4 allows remote attackers to execute arbitrary commands via shell metacharacters in an "SMTP level e-mail address".

  • CVE-2006-6107Dec 14, 2006
    D Bus Project
    dbus
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match rules for other applications and cause a denial of service (lost process messages).

  • CVE-2006-6508Dec 14, 2006
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.21 allows remote authenticated users to send unauthorized messages as an arbitrary user via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-6509Dec 14, 2006
    Sitekiosk
    Sitekiosk
    risk 0.00cvss —epss 0.00

    Cross-site scripting (XSS) vulnerability in the skinning feature in SiteKiosk before 6.5.150 allows local users to bypass security protections and inject arbitrary web script or HTML via an ABOUT: URI, which is displayed in the title bar of the browser.

  • CVE-2006-6510Dec 14, 2006
    Sitekiosk
    Sitekiosk
    risk 0.00cvss —epss 0.00

    An unspecified ActiveX control in SiteKiosk before 6.5.150 is installed "safe for scripting", which allows local users to bypass security protections and read arbitrary files via certain functions.

  • CVE-2006-6511Dec 14, 2006
    Dadaimc
    Dadaimc
    risk 0.00cvss —epss 0.01

    dadaIMC .99.3 uses an insufficiently restrictive FilesMatch directive in the installed .htaccess file, which allows remote attackers to execute arbitrary PHP code by uploading files whose names contain (1) feature, (2) editor, (3) newswire, (4) otherpress, (5) admin, (6) pbook,…

  • CVE-2006-6496Dec 13, 2006
    Ca
    Anti-Virus 2007
    risk 0.00cvss —epss 0.00

    The (1) VetMONNT.sys and (2) VetFDDNT.sys drivers in CA Anti-Virus 2007 8.1, Anti-Virus for Vista Beta 8.2, and CA Internet Security Suite 2007 v3.0 do not properly handle NULL buffers, which allows local users with administrative access to cause a denial of service (system…

  • CVE-2006-2386Dec 13, 2006
    Microsoft
    Outlook Express
    risk 0.02cvss —epss 0.29

    Unspecified vulnerability in Microsoft Outlook Express 6 and earlier allows remote attackers to execute arbitrary code via a crafted contact record in a Windows Address Book (WAB) file.

  • CVE-2006-4702Dec 13, 2006
    Microsoft
    Windows Media Player
    risk 0.02cvss —epss 0.27

    Buffer overflow in the Windows Media Format Runtime in Microsoft Windows Media Player (WMP) 6.4 and Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file.

  • CVE-2006-5584Dec 13, 2006
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.30

    The Remote Installation Service (RIS) in Microsoft Windows 2000 SP4 uses a TFTP server that allows anonymous access, which allows remote attackers to upload and overwrite arbitrary files to gain privileges on systems that use RIS.