VYPR

CVEs

344,072 total · page 6455 of 6,882

AllCriticalHighKEV
  • CVE-2006-6388Dec 8, 2006
    Link
    Content Management Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in naprednaPretraga.php in LINK Content Management Server (CMS) allows remote attackers to inject arbitrary web script or HTML via the txtPretraga parameter. NOTE: The provenance of this information is unknown; the details are obtained…

  • CVE-2006-6389Dec 8, 2006
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ac4p Mobile allow remote attackers to inject arbitrary web script or HTML via the (1) Taaa parameter to (a) up.php, or the (2) pollhtml and (3) Bloks parameters to (b) polls.php, different vectors than CVE-2006-5770.

  • CVE-2006-6390Dec 8, 2006
    Open Solution
    Quick.cart
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the config[db_type] parameter to (1)…

  • CVE-2006-6391Dec 8, 2006
    Open Solution
    Quick.cart
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to include arbitrary files via a .. (dot dot) in the config[db_type] parameter to (1) actions_admin/other.php…

  • CVE-2006-6392Dec 8, 2006
    Plx Web Studio
    Plx Pay
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in index.php in plx Web Studio (aka plxWebDev) plx Pay 3.2 and earlier allows remote attackers to include and execute arbitrary local files, or obtain user credentials and other sensitive information, via a .. (dot dot) in the read parameter.…

  • CVE-2006-6393Dec 8, 2006
    Jonas Gauffin
    Publicera
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Jonas Gauffin Publicera 1.0-rc2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the InputFilter::getString function.

  • CVE-2006-6394Dec 8, 2006
    Jonas Gauffin
    Publicera
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in certain database classes in Jonas Gauffin Publicera 1.0-rc2 and earlier might allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2006-6395Dec 8, 2006
    Ulrik Petersen
    Emdros Database Engine
    risk 0.00cvss —epss 0.01

    Multiple memory leaks in Ulrik Petersen Emdros Database Engine before 1.2.0.pre231 allow local users to cause a denial of service (memory consumption) via unspecified vectors, a different issue than CVE-2005-0415.

  • CVE-2006-6396Dec 8, 2006
    Blazevideo
    Hdtv Player
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in BlazeVideo HDTV Player 2.1, and possibly earlier, allows remote attackers to execute arbitrary code via a long filename in a PLF playlist, a different product than CVE-2006-6199. NOTE: it was later reported that 3.5 is also affected.

  • CVE-2006-6397Dec 8, 2006
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.00

    Integer overflow in banner/banner.c in FreeBSD, NetBSD, and OpenBSD might allow local users to modify memory via a long banner. NOTE: CVE and multiple third parties dispute this issue. Since banner is not setuid, an exploit would not cross privilege boundaries in normal…

  • CVE-2006-6398Dec 8, 2006
    Superfreaker Studios
    Upublisher
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Superfreaker Studios UPublisher 1.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors in (a) sendarticle.asp and (b) printarticle.asp, and the ID parameter to (c) index.asp and (d) preferences.asp,…

  • CVE-2006-6399Dec 8, 2006
    Superfreaker Studios
    Upublisher
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Superfreaker Studios UPublisher 1.0 allows remote attackers to execute arbitrary SQL commands via the Username parameter in login.asp. NOTE: the provenance of this information is unknown; details are obtained from third party sources.

  • CVE-2006-4249Dec 7, 2006
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to "masquerade as a group."

  • CVE-2006-6384Dec 7, 2006
    Unverse.net
    Abitwhizzy
    risk 0.00cvss —epss 0.01

    Absolute path traversal vulnerability in abitwhizzy.php before 20061204 allows remote attackers to read arbitrary files via an absolute pathname in the Filename text window (f parameter), a variant of CVE-2006-6084.

  • CVE-2006-6380Dec 7, 2006
    Ultimate Helpdesk
    Ultimate Helpdesk
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.

  • CVE-2006-6381Dec 7, 2006
    Ultimate Helpdesk
    Ultimate Helpdesk
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in getfile.asp in Ultimate HelpDesk allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.

  • CVE-2006-6382Dec 7, 2006
    Positive Software
    H Sphere
    risk 0.00cvss —epss 0.00

    The control panel for Positive Software H-Sphere before 2.5.0 RC3 creates log files in a user's directory with insecure permissions, which allows local users to append log data to arbitrary files via a symlink attack. NOTE: The provenance of this information is unknown; the…

  • CVE-2006-6369Dec 7, 2006
    Invision Power Services
    Community Blog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in lib/entry_reply_entry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the eid parameter, when accessed through the "Preview message" functionality.

  • CVE-2006-6370Dec 7, 2006
    Invision Power Services
    Gallery
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in forum/modules/gallery/post.php in Invision Gallery 2.0.7 allows remote attackers to cause a denial of service and possibly have other impacts, as demonstrated using a "SELECT BENCHMARK" statement in the img parameter in a doaddcomment operation in…

  • CVE-2006-6371Dec 7, 2006
    JAB
    JAB Guest Book
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in pbguestbook.php in JAB Guest Book allows remote attackers to inject arbitrary web script or HTML via the author parameter.

  • CVE-2006-6372Dec 7, 2006
    James Barnsley
    Jab Guest Book
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in pbguestbook.php in JAB Guest Book 20061205 allow remote attackers to inject arbitrary web script or HTML via the (1) topic or (2) message parameter. NOTE: The provenance of this information is unknown; the details are…

  • CVE-2006-6373Dec 7, 2006
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via a direct request for libraries/common.lib.php, which reveals the path in an error message.

  • CVE-2006-6374Dec 7, 2006
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-pl2 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a phpMyAdmin cookie in (1) css/phpmyadmin.css.php, (2) db_create.php, (3) index.php, (4)…

  • CVE-2006-6375Dec 7, 2006
    Simple Machines
    Smf
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in display.php in Simple Machines Forum (SMF) 1.1 Final and earlier allows remote attackers to inject arbitrary web script or HTML via the contents of a file that is uploaded with the image parameter set, which can be interpreted as…

  • CVE-2006-6376Dec 7, 2006
    Onedotoh
    Simple File Manager
    risk 0.03cvss —epss 0.04

    Multiple directory traversal vulnerabilities in fm.php in Simple File Manager (SFM) 0.24a allow remote attackers to use ".." sequences to (1) read arbitrary files via the filename parameter in a download action, (2) delete arbitrary files via the delete parameter, and (3) modify…

  • CVE-2006-6377Dec 7, 2006
    Uploadscript
    Uploadscript
    risk 0.03cvss —epss 0.03

    Uploadscript 1.2 and earlier stores sensitive data under the web root with insufficient access control, which allows remote attackers to obtain the admin password hash via a direct request for /password.txt.

  • CVE-2006-6378Dec 7, 2006
    Widcomm
    Btsavemysql
    risk 0.00cvss —epss 0.01

    BTSaveMySql 1.2 stores sensitive data under the web root with insufficient access control, which allows remote attackers to obtain configuration and save files via direct requests.

  • CVE-2006-6235Dec 7, 2006
    Gnupg
    Gnupg
    risk 0.00cvss —epss 0.06

    A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.

  • CVE-2006-6358Dec 7, 2006
    Stefan Frech
    Online Bookmarks
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the login function in auth.inc in Stefan Frech online-bookmarks 0.6.12 allows remote attackers to execute arbitrary SQL commands via the (1) username and possibly the (2) password parameter. NOTE: some of these details are obtained from third…

  • CVE-2006-6359Dec 7, 2006
    Stefan Frech
    Online Bookmarks
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Stefan Frech online-bookmarks 0.6.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-6360Dec 7, 2006
    Sergey Korostel
    PHP Upload Center
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in activate.php in PHP Upload Center 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the footerpage parameter.

  • CVE-2006-6361Dec 7, 2006
    Bitflux
    Upload Progress Meter
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in the uploadprogress_php_rfc1867_file function in uploadprogress.c in Bitflux Upload Progress Meter before 8276 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via crafted HTTP POST fileupload requests.

  • CVE-2006-6363Dec 7, 2006
    Bluesocket
    Secure Controller (BSC)
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin.pl in BlueSocket Secure Controller (BSC) before 5.2, or without 5.1.1-BluePatch, allows remote attackers to inject arbitrary web script or HTML via the ad_name parameter.

  • CVE-2006-6364Dec 7, 2006
    Inside Systems
    Inside Systems
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in error.php in Inside Systems Mail (ISMail) 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter.

  • CVE-2006-6365Dec 7, 2006
    Duware
    Dupaypal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in detail.asp in DUware DUpaypal 3.1, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the iType parameter. NOTE: the iState parameter is already covered by CVE-2005-3976 and the iPro parameter is already covered by…

  • CVE-2006-6366Dec 7, 2006
    Cerberus
    Helpdesk
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in includes/elements/spellcheck/spellwin.php in Cerberus Helpdesk 0.97.3, 2.0 through 2.7, 3.2.1, and 3.3 allows remote attackers to inject arbitrary web script or HTML via the js parameter. NOTE: The provenance of this information is…

  • CVE-2006-6367Dec 7, 2006
    Duware
    Dudownload
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter. NOTE: the iType parameter is already covered by CVE-2005-3976.

  • CVE-2006-6368Dec 7, 2006
    Awrate
    Awrate
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in login.php.inc in awrate 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the toroot parameter to search.php.

  • CVE-2006-6337Dec 7, 2006
    Lebisoft
    Ziyaretci Defteri
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in giris.asp in Aspee and Dogantepe Ziyaretci Defteri allow remote attackers to execute arbitrary SQL commands via the (1) kullanici or (2) parola parameter.

  • CVE-2006-6338Dec 7, 2006
    Devilz Clanportal
    Devilz Clanportal
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in upload/index.php in deV!L`z Clanportal (DZCP) before 1.3.6.1 allows remote attackers to upload and execute arbitrary .php files by embedding PHP code in a JPEG or GIF file that is uploaded to inc/images/uploads/userpics/.

  • CVE-2006-6339Dec 7, 2006
    Devilz Clanportal
    Devilz Clanportal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in sites/index.php in deV!L`z Clanportal (DZCP) before 1.3.6.1 allows remote attackers to execute arbitrary SQL commands via the show element in a GET request.

  • CVE-2006-6340Dec 7, 2006
    Nvidia
    Nview
    risk 0.03cvss —epss 0.02

    keystone.exe in nVIDIA nView allows attackers to cause a denial of service via a long command line argument. NOTE: it is not clear whether this issue crosses security boundaries. If not, then this is not a vulnerability.

  • CVE-2006-6341Dec 7, 2006
    mg.applanix
    mg.applanix
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in mg.applanix 1.3.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the apx_root_path parameter to (1) act/act_check_access.php, (2) dsp/dsp_form_booking_ctl.php, and (3) dsp/dsp_bookings.php.

  • CVE-2006-6342Dec 7, 2006
    Klf Design
    Klf Realty
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) agent parameters in (a) search_listing.asp, and the (3) property_id parameter in (b) detail.asp.

  • CVE-2006-6343Dec 7, 2006
    Neocrome
    Seditio
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in polls.php in Neocrome Seditio 1.10 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-6344Dec 7, 2006
    Neocrome
    Seditio
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Neocrome Seditio 1.10 and earlier have unknown impact and attack vectors related to (1) plugins/ipsearch/ipsearch.admin.php, and (2) pfs/pfs.edit.inc.php, (3) users/users.register.inc.php in system/core. NOTE: the users.profile.inc.php…

  • CVE-2006-6345Dec 7, 2006
    SAP
    Internet Graphics Server
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in SAP Internet Graphics Service (IGS) 6.40 Patchlevel 16 and earlier, and 7.00 Patchlevel 6 and earlier, allows remote attackers to delete arbitrary files via directory traversal sequences in an HTTP request. NOTE: This information is based…

  • CVE-2006-6346Dec 7, 2006
    SAP
    Internet Graphics Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in SAP Internet Graphics Service (IGS) 6.40 Patchlevel 15 and earlier, and 7.00 Patchlevel 3 and earlier, allows remote attackers to cause a denial of service (service shutdown), obtain sensitive information (configuration files), and conduct certain…

  • CVE-2006-6347Dec 7, 2006
    Tftgallery
    Tftgallery
    risk 0.00cvss —epss 0.01

    Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php. NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector.

  • CVE-2006-6348Dec 7, 2006
    Mowdbb
    Mowdbb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in board.php in mowdBB RC-6 allows remote attackers to inject arbitrary web script or HTML via the forum_name[] parameter.