VYPR

CVEs

344,072 total · page 6453 of 6,882

AllCriticalHighKEV
  • CVE-2006-5585Dec 13, 2006
    Microsoft
    Windows Xp
    risk 0.00cvss —epss 0.02

    The Client-Server Run-time Subsystem in Microsoft Windows XP SP2 and Server 2003 allows local users to gain privileges via a crafted file manifest within an application, aka "File Manifest Corruption Vulnerability."

  • CVE-2006-6494Dec 13, 2006
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Directory traversal vulnerability in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via a .. (dot dot) sequence in the LANG environment variable that points to a locale file containing attacker-controlled format string specifiers.

  • CVE-2006-6495Dec 13, 2006
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via large precision padding values in a format string specifier in the format parameter of the doprf function. NOTE: this issue normally does not cross privilege…

  • CVE-2006-6493Dec 13, 2006
    OpenLDAP
    Openldap
    risk 0.04cvss —epss 0.09

    Buffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos.c in OpenLDAP 2.4.3 and earlier, when OpenLDAP is compiled with the --enable-kbind (Kerberos KBIND) option, allows remote attackers to execute arbitrary code via an LDAP bind request using the…

  • CVE-2006-5577Dec 12, 2006
    Microsoft
    Ie
    risk 0.02cvss —epss 0.25

    Microsoft Internet Explorer 6 and earlier allows remote attackers to obtain sensitive information via unspecified uses of the OBJECT HTML tag, which discloses the absolute path of the corresponding TIF folder, aka "TIF Folder Information Disclosure Vulnerability," and a…

  • CVE-2006-5578Dec 12, 2006
    Microsoft
    Ie
    risk 0.02cvss —epss 0.21

    Microsoft Internet Explorer 6 and earlier allows remote attackers to read Temporary Internet Files (TIF) and obtain sensitive information via unspecified vectors involving certain drag and drop operations, aka "TIF Folder Information Disclosure Vulnerability," and a different…

  • CVE-2006-5579Dec 12, 2006
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.31

    Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code by using JavaScript to cause certain errors simultaneously, which results in the access of previously freed memory, aka "Script Error Handling Memory Corruption Vulnerability."

  • CVE-2006-5581Dec 12, 2006
    Microsoft
    Internet Explorer
    risk 0.03cvss —epss 0.35

    Unspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via certain DHTML script functions, such as normalize, and "incorrectly created elements" that trigger memory corruption, aka "DHTML Script Function Memory Corruption…

  • CVE-2006-5583Dec 12, 2006
    Microsoft
    Windows
    risk 0.04cvss —epss 0.53

    Buffer overflow in the SNMP Service in Microsoft Windows 2000 SP4, XP SP2, Server 2003, Server 2003 SP1, and possibly other versions allows remote attackers to execute arbitrary code via a crafted SNMP packet, aka "SNMP Memory Corruption Vulnerability."

  • CVE-2006-6335Dec 12, 2006
    Sophos
    Scanning Engine
    risk 0.01cvss —epss 0.12

    Multiple buffer overflows in Sophos Anti-Virus scanning engine before 2.40 allow remote attackers to execute arbitrary code via (1) a SIT archive with a long filename that is not null-terminated, which triggers a heap-based overflow in veex.dll due to improper length…

  • CVE-2006-6482Dec 12, 2006
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.02

    Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request (1) for a non-existent (a) JWS, (b) CFM, (c) CFML, or (d) CFC file, which displays the installation path in the resulting error message; or (2) to /CFIDE/administrator/login.cfm…

  • CVE-2006-6483Dec 12, 2006
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.02

    Adobe ColdFusion MX 7.x before 7.0.2 does not properly filter HTML tags when protecting against cross-site scripting (XSS) attacks, which allows remote attackers to inject arbitrary web script or HTML via a NULL byte (%00) in certain HTML tags, as demonstrated using "%00script"…

  • CVE-2006-6484Dec 12, 2006
    MailEnable
    Mailenable
    risk 0.00cvss —epss 0.03

    The IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.34, Professional Edition 1.6 through 1.83, and Enterprise Edition 1.1 through 1.40 allows remote attackers to cause a denial of service (crash) via unspecified vectors that trigger a null pointer…

  • CVE-2006-6485Dec 12, 2006
    Shopsite
    Shopsite
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ShopSite 8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the prevlocation parameter in shopper/sc/registration.cgi and other unspecified vectors.

  • CVE-2006-6486Dec 12, 2006
    Easypagecms
    Easypage
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in EasyPage allows remote attackers to execute arbitrary SQL commands via unspecified vectors in sptrees/default.aspx, possibly involving the docId parameter. NOTE: this issue appears to have been disputed by a third party researcher, stating that…

  • CVE-2006-6423Dec 12, 2006
    MailEnable
    Mailenable
    risk 0.08cvss —epss 0.67

    Stack-based buffer overflow in the IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.35, Professional Edition 1.6 through 1.84, and Enterprise Edition 1.1 through 1.41 allows remote attackers to execute arbitrary code via a pre-authentication command…

  • CVE-2006-6481Dec 12, 2006
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.04

    Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.

  • CVE-2006-5873Dec 12, 2006
    Debian
    linux
    risk 0.00cvss —epss 0.02

    Buffer overflow in the cluster_process_heartbeat function in cluster.c in layer 2 tunneling protocol network server (l2tpns) before 2.1.21 allows remote attackers to cause a denial of service via a large heartbeat packet.

  • CVE-2006-6478Dec 12, 2006
    Scriptphp
    Annoncescripthp
    risk 0.04cvss —epss 0.09

    Multiple SQL injection vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a) email.php, the (2) no parameter in (b) voirannonce.php, the (3) idmembre parameter in (c) admin/admin_membre/fiche_membre.php,…

  • CVE-2006-6479Dec 12, 2006
    AnnonceScriptHP
    AnnonceScriptHP
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the email parameter in (1) erreurinscription.php, (2) Templates/admin.dwt.php, (3) Templates/commun.dwt.php, (4) membre.dwt.php, and (5)…

  • CVE-2006-6480Dec 12, 2006
    AnnonceScriptHP
    AnnonceScriptHP
    risk 0.00cvss —epss 0.01

    admin/admin_membre/fiche_membre.php in AnnonceScriptHP 2.0 allows remote attackers to obtain sensitive information via the idmembre parameter, which discloses the passwords for arbitrary users.

  • CVE-2006-5871Dec 11, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    smbfs in Linux kernel 2.6.8 and other versions, and 2.4.x before 2.4.34, when UNIX extensions are enabled, ignores certain mount options, which could cause clients to use server-specified uid, gid and mode settings.

  • CVE-2006-6462Dec 11, 2006
    Cm68 News
    Cm68 News
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in engine/oldnews.inc.php in CM68 News 12.02.06 allows remote attackers to execute arbitrary PHP code via a URL in the addpath parameter.

  • CVE-2006-6463Dec 11, 2006
    Midicart Software
    Midicart PHP Shopping Cart
    risk 0.00cvss —epss 0.01

    Unrestricted file upload vulnerability in admin/add.php in Midicart allows remote authenticated users to upload arbitrary .php files, and possibly other files, to the images/ directory under the web root.

  • CVE-2006-6464Dec 11, 2006
    Midicart Software
    Midicart
    risk 0.00cvss —epss 0.01

    viewcart in Midicart accepts negative numbers in the Qty (quantity) field, which allows remote attackers to obtain a smaller total price for a shopping cart.

  • CVE-2006-6465Dec 11, 2006
    Wikyblog
    Wikyblog
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in WBmap.php in WikyBlog 1.3.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter. NOTE: CVE disputes this vulnerability because l is validated by ctype_alpha…

  • CVE-2006-6466Dec 11, 2006
    Wikyblog
    Wikyblog
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in WBmap.php in WikyBlog 1.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) key, (2) d, (3) l, or (4) v parameter. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2006-6467Dec 11, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 do not properly restrict access to SMB file resources, which allows remote attackers to gain unspecified file or directory access via vectors related to (1)…

  • CVE-2006-6468Dec 11, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.00

    Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 do not check the Fully Qualified Domain Name (FQDN) during a "Validate Repository SSL Certificate" scan, which has unknown impact and attack vectors, possibly…

  • CVE-2006-6469Dec 11, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.00

    Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 do not block the postgres port (5432/tcp), which has unknown impact and remote attack vectors, probably related to unauthorized connections to a PostgreSQL daemon.

  • CVE-2006-6470Dec 11, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    The SNMP Agent in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 returns no error for a non-writable object, which has unknown impact and attack vectors. NOTE: due to the vagueness of the advisory, it is not…

  • CVE-2006-6471Dec 11, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 use weak permissions for certain files, which allows unspecified file access.

  • CVE-2006-6472Dec 11, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    The httpd.conf file in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 configures port 443 to be always active, which has unknown impact and remote attack vectors.

  • CVE-2006-6473Dec 11, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 have unknown impact and attack vectors, related to (1) an Immediate Image Overwrite (IIO) error message at the Local User…

  • CVE-2006-6456Dec 11, 2006
    Microsoft
    Word
    risk 0.03cvss —epss 0.31

    Unspecified vulnerability in Microsoft Word 2000, 2002, and 2003 and Word Viewer 2003 allows remote attackers to execute code via unspecified vectors related to malformed data structures that trigger memory corruption, a different vulnerability than CVE-2006-5994.

  • CVE-2006-6457Dec 11, 2006
    Tiki
    Tiki
    risk 0.00cvss —epss 0.01

    tiki-wiki_rss.php in Tikiwiki 1.9.5, 1.9.2, and possibly other versions allows remote attackers to obtain sensitive information (MySQL username and password) via an invalid (large or negative) ver parameter, which leaks the information in an error message.

  • CVE-2006-6458Dec 11, 2006
    Trend Micro
    Internet Security
    risk 0.00cvss —epss 0.03

    The Trend Micro scan engine before 8.320 for Windows and before 8.150 on HP-UX and AIX, as used in Trend Micro PC Cillin - Internet Security 2006, Office Scan 7.3, and Server Protect 5.58, allows remote attackers to cause a denial of service (CPU consumption and system hang) via…

  • CVE-2006-6459Dec 11, 2006
    PhpBB
    Toplist
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in toplist.php in PhpBB Toplist 1.3.7 allows remote attackers to inject arbitrary HTML or web script via the (1) Name and (2) Information fields when adding a new site (toplistnew action).

  • CVE-2006-6460Dec 11, 2006
    Short URL
    Short URL
    risk 0.00cvss —epss 0.02

    Yourfreeworld.com Short Url & Url Tracker Script allows remote attackers to obtain sensitive information via an invalid id parameter to login.php, which leaks the path in an error message. NOTE: this issue might be resultant from CVE-2006-2509.

  • CVE-2006-6461Dec 11, 2006
    Yourfreeworld
    Stylish Text Ads Script
    risk 0.00cvss —epss 0.01

    tr1.php in Yourfreeworld Stylish Text Ads Script allows remote attackers to obtain the installation path via an invalid id parameter, which leaks the path in an error message. NOTE: this issue might be resultant from CVE-2006-2508.

  • CVE-2006-6444Dec 10, 2006
    Divx
    Player
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in Nostra DivX Player 2.1, 2.2.00.0, and possibly earlier, allows remote attackers to execute arbitrary code via a long string in an M3U file. NOTE: The provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-6445Dec 10, 2006
    Envolution
    Envolution
    risk 0.04cvss —epss 0.06

    Directory traversal vulnerability in error.php in Envolution 1.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log…

  • CVE-2006-6446Dec 10, 2006
    Iware
    Iware Professional
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in iWare Professional 5.0.4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the D parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from…

  • CVE-2006-6447Dec 10, 2006
    Vt Forum
    Vt Forum Lite
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Vt-Forum Lite 1.3 and 1.5 allow remote attackers to inject arbitrary web script or HTML via (1) the StrMes parameter in vf_info.asp and possibly (2) a URL in the SRC attribute of an IFRAME element that is submitted to…

  • CVE-2006-6448Dec 10, 2006
    Vt Forum
    Vt Forum Lite
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Vt-Forum Lite 1.3 and earlier allow remote attackers to execute arbitrary SQL commands via the user parameter to vf_memberdetail.asp, and other unspecified vectors. NOTE: The provenance of this information is unknown; the details are…

  • CVE-2006-6449Dec 10, 2006
    Vt Forum
    Vt Forum Lite
    risk 0.00cvss —epss 0.01

    Vt-Forum Lite 1.3 and earlier store sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/forum.mdb. NOTE: The provenance of this information is unknown; the details are…

  • CVE-2006-6450Dec 10, 2006
    Novell
    Zenworks Patch Management Server
    risk 0.01cvss —epss 0.18

    Multiple SQL injection vulnerabilities in dagent/downloadreport.asp in Novell ZENworks Patch Management (ZPM) before 6.3.2.700 allow remote attackers to execute arbitrary SQL commands via the (1) agentid and (2) pass parameters.

  • CVE-2006-6451Dec 10, 2006
    Swsoft
    Plesk
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in SWsoft Plesk 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) get_password.php or (2) login_up.php3.

  • CVE-2006-6452Dec 10, 2006
    Myarticles
    Myarticles
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the MyArticles module before 0.6 beta 1, for RunCMS, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) topics.php, (2) submit.php, and (3) class/calendar.class.php.

  • CVE-2006-6453Dec 10, 2006
    J Owamp
    Web Interface
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in JOWAMP_ShowPage.php in J-OWAMP Web Interface 2.1 allows remote authenticated users to execute arbitrary PHP code via a URL in the link parameter.