VYPR

CVEs

344,072 total · page 6454 of 6,882

AllCriticalHighKEV
  • CVE-2006-6454Dec 10, 2006
    J Owamp
    Web Interface
    risk 0.00cvss —epss 0.02

    execInBackground.php in J-OWAMP Web Interface 2.1b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters to the (1) exe and (2) args parameters, which are used in an exec function call. NOTE: the provenance of this information is unknown;…

  • CVE-2006-6455Dec 10, 2006
    Duware
    Dudirectory
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in admin/default.asp in DUware DUdirectory 3.1, and possibly DUdirectory Pro and Pro SQL 3.x, allow remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password parameter. NOTE: some of these details are obtained…

  • CVE-2006-6383Dec 10, 2006
    PHP
    PHP
    risk 0.03cvss —epss 0.01

    PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ";" in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but…

  • CVE-2006-6443Dec 10, 2006
    Novell
    Client
    risk 0.00cvss —epss 0.02

    Buffer overflow in the Novell Distributed Print Services (NDPS) Print Provider for Windows component (NDPPNT.DLL) in Novell Client 4.91 has unknown impact and remote attack vectors.

  • CVE-2006-6379Dec 10, 2006
    Broadcom Corporation
    Server Protection Suite
    risk 0.05cvss —epss 0.21

    Buffer overflow in the BrightStor Backup Discovery Service in multiple CA products, including ARCserve Backup r11.5 SP1 and earlier, ARCserve Backup 9.01 up to 11.1, Enterprise Backup 10.5, and CA Server Protection Suite r2, allows remote attackers to execute arbitrary code via…

  • CVE-2006-6332Dec 10, 2006
    Madwifi
    Madwifi
    risk 0.05cvss —epss 0.20

    Stack-based buffer overflow in net80211/ieee80211_wireless.c in MadWifi before 0.9.2.1 allows remote attackers to execute arbitrary code via unspecified vectors, related to the encode_ie and giwscan_cb functions.

  • CVE-2006-6413Dec 10, 2006
    Amateras
    Amateras Sns
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Amateras sns 3.11 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-6414Dec 10, 2006
    Dol Storye
    Dol Storye
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in dettaglio.asp in dol storye allow remote attackers to execute arbitrary SQL commands via the (1) id_doc or (2) id_aut parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-6415Dec 10, 2006
    Phpadsnew
    Phpadsnew
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in admin/lib-maintenance.inc.php in phpAdsNew 2.0.4-pr2 allows remote attackers to execute arbitrary PHP code via a URL in the phpAds_path parameter, a different component than CVE-2006-3984. NOTE: this issue is disputed by CVE, since…

  • CVE-2006-6416Dec 10, 2006
    Phpleague Univert
    Phpleague
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in PhpLeague - Univert PhpLeague 0.81 allow remote attackers to execute arbitrary PHP code via a URL in the cheminmini parameter to (1) consult/miniseul.php or (2) config.php. NOTE: The provenance of this information is…

  • CVE-2006-6417Dec 10, 2006
    B2evolution
    B2evolution
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in inc/CONTROL/import/import-mt.php in b2evolution 1.8.5 through 1.9 beta allows remote attackers to execute arbitrary PHP code via a URL in the inc_path parameter.

  • CVE-2006-6418Dec 10, 2006
    Microfocus
    Tru64
    risk 0.00cvss —epss 0.01

    Buffer overflow in the POSIX Threads library (libpthread) on HP Tru64 UNIX 4.0F PK8, 4.0G PK4, and 5.1A PK6 allows local users to gain root privileges via a long PTHREAD_CONFIG environment variable.

  • CVE-2006-6419Dec 10, 2006
    Ryan Demmer
    Joomla Content Editor
    risk 0.00cvss —epss 0.01

    jce.php in the JCE Admin Component in Ryan Demmer Joomla Content Editor (JCE) 1.1.0 beta 2 and earlier for Joomla! (com_jce) allows remote attackers to include and possibly execute arbitrary local files via the (1) plugin or (2) file parameter. NOTE: The provenance of this…

  • CVE-2006-6420Dec 10, 2006
    Ryan Demmer
    Joomla Content Editor
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in jce.php in the JCE Admin Component in Ryan Demmer Joomla Content Editor (JCE) 1.1.0 beta 2 and earlier for Joomla! (com_jce) allow remote attackers to inject arbitrary web script or HTML via the (1) img, (2) title, (3) w, or…

  • CVE-2006-6421Dec 10, 2006
    PhpBB
    phpBB
    risk 0.04cvss —epss 0.15

    Cross-site scripting (XSS) vulnerability in the private message box implementation (privmsg.php) in phpBB 2.0.x allows remote authenticated users to inject arbitrary web script or HTML via the "Message body" field in a message to a non-existent user.

  • CVE-2006-6422Dec 10, 2006
    Agileco
    Agilebill
    risk 0.00cvss —epss 0.01

    Agileco AgileBill 1.4.x and AgileVoice 1.4.x do not properly handle certain proxy requests, which allows remote attackers to disable the application by entering invalid license data on a form, possibly involving modules/core/license.inc.php. NOTE: The provenance of this…

  • CVE-2006-6426Dec 10, 2006
    Thinkedit
    Thinkedit
    risk 0.04cvss —epss 0.07

    PHP remote file inclusion vulnerability in design/thinkedit/render.php in ThinkEdit 1.9.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the template_file parameter.

  • CVE-2006-6427Dec 10, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.03

    The Web User Interface in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allows remote attackers to execute arbitrary commands via unspecified vectors involving "command injection" in (1) the TCP/IP hostname,…

  • CVE-2006-6428Dec 10, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allow remote attackers to gain access via unspecified vectors related to "browser permissions."

  • CVE-2006-6429Dec 10, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allows attackers to modify certain configuration settings via unspecified vectors involving the "TFTP/BOOTP auto configuration option."

  • CVE-2006-6430Dec 10, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Web services in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 do not require HTTPS, which allows remote attackers to obtain sensitive information by sniffing the unencrypted HTTP traffic.

  • CVE-2006-6431Dec 10, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allows attackers to modify signatures of e-mail messages via unspecified vectors.

  • CVE-2006-6432Dec 10, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Scan-to-mailbox feature in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allows remote attackers to download certain files via unspecified vectors.

  • CVE-2006-6433Dec 10, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 does not record accurate timestamps, which makes it easier for remote attackers to avoid detection when an audit tries to rely on these timestamps.

  • CVE-2006-6434Dec 10, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Web User Interface in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows remote attackers to bypass authentication controls via unknown vectors.

  • CVE-2006-6435Dec 10, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    The SNMP implementation in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 does not generate authentication failure traps, which allows remote attackers to more easily gain system access and obtain sensitive…

  • CVE-2006-6436Dec 10, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Network controller in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows remote attackers to inject arbitrary web script or HTML via HTTP TRACE messages.

  • CVE-2006-6437Dec 10, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    ops3-dmn in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows attackers to cause a denial of service (application crash and core dump) via a certain PS file.

  • CVE-2006-6438Dec 10, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.00

    Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 leaves sensitive user data in http.log after an Immediate Image Overwrite (IIO), which allows local users to obtain the data by reading the http.log file.

  • CVE-2006-6439Dec 10, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows remote attackers to download the audit log and obtain potentially sensitive information via unspecified vectors.

  • CVE-2006-6440Dec 10, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allow remote attackers to have an unspecified impact via unspecified vectors relating to "HTTP Security issues."

  • CVE-2006-6441Dec 10, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.00

    Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows local users to bypass security controls and boot Alchemy via certain alternate boot media, as demonstrated by a USB thumb drive.

  • CVE-2006-6442Dec 10, 2006
    AOL
    Aol
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in the SetClientInfo function in the CDDBControlAOL.CDDBAOLControl ActiveX control (cddbcontrol.dll), as used in America Online (AOL) 7.0 4114.563, 8.0 4129.230, and 9.0 Security Edition 4156.910, and possibly other products, allows remote attackers…

  • CVE-2006-5874Dec 10, 2006
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.03

    Clam AntiVirus (ClamAV) 0.88 and earlier allows remote attackers to cause a denial of service (crash) via a malformed base64-encoded MIME attachment that triggers a null pointer dereference.

  • CVE-2006-6221Dec 10, 2006
    risk 0.00cvss —epss 0.02

    2X ThinClientServer Enterprise Edition before 4.0.2248 allows remote attackers to create multiple privileged accounts via a replay attack using the initial account creation request.

  • CVE-2006-6400Dec 10, 2006
    Justsystems
    Hanako Viewer
    risk 0.00cvss —epss 0.03

    Buffer overflow in JustSystems Hanako 2004 through 2006, Hanako viewer 1.x, Ichitaro 2004, Ichitaro 2005, Ichitaro Lite2, Ichitaro viewer 4.x, and Sanshiro 2005 allows remote attackers to execute arbitrary code via the (1) Keyword and (2) Title fields, related to string length…

  • CVE-2006-6401Dec 10, 2006
    Mywebland
    Mystats
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in mystats.php in MyStats 1.0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) connexion, (2) by, and (3) details parameter.

  • CVE-2006-6402Dec 10, 2006
    Mywebland
    Mystats
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in mystats.php in MyStats 1.0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the details parameter.

  • CVE-2006-6403Dec 10, 2006
    Mywebland
    Mystats
    risk 0.00cvss —epss 0.01

    mystats.php in MyStats 1.0.8 and earlier allows remote attackers to obtain the installation path via (1) details and (2) by array parameters, probably resulting in a path disclosure in an error message.

  • CVE-2006-6405Dec 10, 2006
    Bitdefender
    Bitdefender Mail Protection
    risk 0.00cvss —epss 0.01

    BitDefender Mail Protection for SMB 2.0 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.

  • CVE-2006-6406Dec 10, 2006
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.03

    Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.

  • CVE-2006-6407Dec 10, 2006
    FRISK Software
    F-Prot Antivirus
    risk 0.00cvss —epss 0.02

    F-Prot Antivirus for Linux x86 Mail Servers 4.6.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.

  • CVE-2006-6408Dec 10, 2006
    Kaspersky Lab
    Anti Virus
    risk 0.00cvss —epss 0.02

    Kaspersky Anti-Virus for Linux Mail Servers 5.5.10 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.

  • CVE-2006-6409Dec 10, 2006
    F-Secure
    Anti Virus
    risk 0.00cvss —epss 0.04

    F-Secure Anti-Virus for Linux Gateways 4.65 allows remote attackers to cause a denial of service (possibly fatal scan error), and possibly bypass virus detection, by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the…

  • CVE-2006-6410Dec 10, 2006
    EMC Corporation
    Vmware
    risk 0.03cvss —epss 0.01

    Buffer overflow in an ActiveX control in VMWare 5.5.1 allows local users to execute arbitrary code via a long VmdbDb parameter to the Initialize function.

  • CVE-2006-6411Dec 10, 2006
    Linksys
    Wip 330 Wireless G IP Phone
    risk 0.00cvss —epss 0.02

    PhoneCtrl.exe in Linksys WIP 330 Wireless-G IP Phone 1.00.06A allows remote attackers to cause a denial of service (crash) via a TCP SYN scan, as demonstrated using TCP ports 1-65535 with nmap.

  • CVE-2006-6334Dec 8, 2006
    Citrix Systems
    Presentation Server Client
    risk 0.06cvss —epss 0.34

    Heap-based buffer overflow in the SendChannelData function in wfica.ocx in Citrix Presentation Server Client before 9.230 for Windows allows remote malicious web sites to execute arbitrary code via a DataSize parameter that is less than the length of the Data buffer.

  • CVE-2006-6385Dec 8, 2006
    Intel
    Intel PRO 10/100, PRO/1000, and PRO/10GbE PCI, PCI-X, and PCIe network adapter drivers
    risk 0.00cvss —epss 0.01

    Stack-based buffer overflow in Intel PRO 10/100, PRO/1000, and PRO/10GbE PCI, PCI-X, and PCIe network adapter drivers (aka NDIS miniport drivers) before 20061205 allows local users to execute arbitrary code with "kernel-level" privileges via an incorrect function call in certain…

  • CVE-2006-6386Dec 8, 2006
    Drupal
    Cvs Management And Tracker
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the CVS management/tracker 4.7.x-1.0, 4.7.x-2.0, and 4.7.0 (before the 20060807 contribution release system) for Drupal allows remote attackers to inject arbitrary web script or HTML via the motivation field in the CVS application…

  • CVE-2006-6387Dec 8, 2006
    Link Content Management Server
    Link Content Management Server
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in LINK Content Management Server (CMS) allow remote attackers to execute arbitrary SQL commands via the (1) IDMeniGlavni parameter to navigacija.php, and the (2) IDStranicaPodaci parameter to prikazInformacije.php. NOTE: The provenance of…