VYPR

CVEs

344,072 total · page 6458 of 6,882

AllCriticalHighKEV
  • CVE-2006-6071Dec 2, 2006
    TWiki
    Twiki
    risk 0.00cvss —epss 0.02

    TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed login attempts, which allows remote attackers to read arbitrary content by cancelling out of a failed…

  • CVE-2006-6223Dec 2, 2006
    Google
    Search Appliance
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Google Search Appliance and Google Mini allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded q parameter.

  • CVE-2006-6224Dec 2, 2006
    Puntal
    Puntal
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in the installation scripts in Puntal before 1.8.5 allows remote attackers to execute arbitrary PHP code via the GLOBALS array.

  • CVE-2006-6225Dec 2, 2006
    Geeklog
    Geeklog
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in GeekLog 1.4 allow remote attackers to execute arbitrary code via a URL in the _CONF[path] parameter to (1) links/functions.inc, (2) polls/functions.inc, (3) spamx/BlackList.Examine.class.php, (4)…

  • CVE-2006-6226Dec 2, 2006
    Neoengine
    Neoengine
    risk 0.00cvss —epss 0.02

    Multiple format string vulnerabilities in NeoEngine 0.8.2 and earlier, and CVS 3422, allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) Console::Render in neoengine/console.cpp and (2) TextArea::Render in neowtk/textarea.cpp.

  • CVE-2006-6227Dec 2, 2006
    Neoengine
    Neoengine
    risk 0.00cvss —epss 0.02

    The Core::Receive function in neonet/core.cpp for NeoEngine 0.8.2 and earlier, and CVS 3422, allow remote attackers to cause a denial of service (engine crash) via a message with a large uiMessageLength that produces a failed memory allocation and a null pointer dereference.

  • CVE-2006-6228Dec 2, 2006
    Codewalkers
    Ltwcalendar
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Codewalkers ltwCalendar (aka PHP Event Calendar) before 4.2.1 allows remote attackers to inject arbitrary HTML or web script via unknown vectors.

  • CVE-2006-6229Dec 2, 2006
    Codewalkers
    Ltwcalendar
    risk 0.00cvss —epss 0.01

    Codewalkers ltwCalendar (aka PHP Event Calendar) before 4.2.1 logs failed passwords, which might allow attackers to infer correct passwords from the log file.

  • CVE-2006-6230Dec 2, 2006
    Vubb
    Vubb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in vuBB 0.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter in a register action to index.php, a different vulnerability than CVE-2006-0962.

  • CVE-2006-6231Dec 2, 2006
    Vubb
    Vubb
    risk 0.00cvss —epss 0.01

    vuBB 0.2.1 and earlier allows remote attackers to obtain sensitive information via a direct request to includes/vubb.php, which leaks the path in an error message.

  • CVE-2006-6232Dec 2, 2006
    Dreamcost
    Dreamaccount
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin/index.php in DreamAccount 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.

  • CVE-2006-6197Dec 1, 2006
    B2evolution
    B2evolution
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in b2evolution 1.8.2 through 1.9 beta allow remote attackers to inject arbitrary web script or HTML via the (1) app_name parameter in (a) _404_not_found.page.php, (b) _410_stats_gone.page.php, and (c) _referer_spam.page.php in…

  • CVE-2006-6198Dec 1, 2006
    CPanel
    Webhost Manager
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) email parameter to (a) scripts2/dochangeemail, the (2) supporturl parameter to (b)…

  • CVE-2006-6199Dec 1, 2006
    Blazevideo
    Blaze Dvd
    risk 0.08cvss —epss 0.65

    Stack-based buffer overflow in BlazeVideo BlazeDVD Standard and Professional 5.0, and possibly earlier, allows remote attackers to execute arbitrary code via a long filename in a PLF playlist.

  • CVE-2006-6200Dec 1, 2006
    PHP-Nuke
    PHP Nuke
    risk 0.00cvss —epss 0.03

    Multiple SQL injection vulnerabilities in the (1) rate_article and (2) rate_complete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands…

  • CVE-2006-6201Dec 1, 2006
    Borland Software
    Developer Studio
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in Borland idsql32.dll 5.1.0.4, as used by RevilloC MailServer; 5.2.0.2 as used by Borland Developer Studio 2006; and possibly other versions allows remote attackers to execute arbitrary code via a long SQL statement, related to use of the DbiQExec…

  • CVE-2006-6202Dec 1, 2006
    Nukeai
    Nukeai
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in modules/NukeAI/util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Program E is an AIML chatterbot, allows remote attackers to execute arbitrary PHP code via a URL in the AIbasedir parameter.

  • CVE-2006-6203Dec 1, 2006
    Flyspray
    Flyspray
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in startdown.php in the Flyspray ME 1.0.1 (com_flyspray) component for Mambo allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

  • CVE-2006-6204Dec 1, 2006
    Enthrallweb
    Ehomes
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Enthrallweb eHomes allow remote attackers to execute arbitrary SQL commands via the (1) cid parameter to (a) dircat.asp; the (2) sid parameter to (b) dirSub.asp; the (3) TYPE_ID parameter to (c) types.asp; the (4) AD_ID parameter to (d)…

  • CVE-2006-6205Dec 1, 2006
    Enthrallweb
    Ehomes
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in result.asp in Enthrallweb eHomes allow remote attackers to inject arbitrary web script or HTML via the (1) city or (2) State parameter.

  • CVE-2006-6206Dec 1, 2006
    Warhound
    Warhound General Shopping Cart
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in item.asp in WarHound General Shopping Cart allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.

  • CVE-2006-6207Dec 1, 2006
    Lynx Internet Solutions
    Evolve Merchant
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in products.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL commands via the partno parameter. NOTE: the vendor disputes this issue, stating that it is a forced SQL error

  • CVE-2006-6208Dec 1, 2006
    Enthrallweb
    Eclassifieds
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Enthrallweb eClassifieds allow remote attackers to execute arbitrary SQL commands via the (1) AD_ID, (2) cat_id, (3) sub_id, and (4) ad_id parameters to (a) ad.asp, the (5) cid parameter to (b) dircat.asp, and the (6) sid parameter to…

  • CVE-2006-6209Dec 1, 2006
    Midicart Software
    Midicart Asp Shopping Cart
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MidiCart ASP Shopping Cart and ASP Plus Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) id2006quant parameter to (a) item_show.asp, or the (2) maingroup or (3) secondgroup parameter to (b)…

  • CVE-2006-6210Dec 1, 2006
    Iisworks
    Listpics
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in listpics.asp in ASP ListPics 5.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2006-6211Dec 1, 2006
    Birdblog
    Birdblog
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in BirdBlog 1.4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter to (a) admin/admincore.php, the (2) month parameter to (b) admin/comments.php or (c) admin/entries.php, or the (3) page…

  • CVE-2006-6212Dec 1, 2006
    Webwiz
    Site News
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in centre.php in Site News (site_news) 2.00, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: The provenance of this information is unknown; the details are obtained solely…

  • CVE-2006-6213Dec 1, 2006
    Pegames
    Pegames
    risk 0.03cvss —epss 0.03

    index.php in PEGames uses the extract function to overwrite critical variables, which allows remote attackers to conduct PHP remote file inclusion attacks via the abs_url parameter, which is later extracted to overwrite a previously uncontrolled value.

  • CVE-2006-6214Dec 1, 2006
    Wallpaper
    Wallpaper Complete Website
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in wallpaper.php in Wallpaper Website (Wallpaper Complete Website) 1.0.09 allows remote attackers to execute arbitrary SQL commands via the wallpaperid parameter.

  • CVE-2006-6215Dec 1, 2006
    Wallpaper
    Wallpaper Complete Website
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Wallpaper Website (Wallpaper Complete Website) 1.0.09 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login or (2) password parameter to (a) process.php, or the (3) wallpaperid parameter to (b)…

  • CVE-2006-6216Dec 1, 2006
    Nivisec
    Hacks List
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin_hacks_list.php in the Nivisec Hacks List 1.21 and earlier phpBB module allows remote attackers to execute arbitrary SQL commands via the hack_id parameter.

  • CVE-2006-6217Dec 1, 2006
    PHP-Nuke
    Mermaid Module
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in formdisp.php in the Mermaid 1.2 module for PHP-Nuke allows remote attackers to execute arbitrary PHP code via a URL in the module_name parameter.

  • CVE-2006-6218Dec 1, 2006
    dev4u CMS
    dev4u CMS
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in dev4u CMS allow remote attackers to execute arbitrary SQL commands via the (1) seite_id, (2) gruppe_id.php, and (3) go_target parameters.

  • CVE-2006-6219Dec 1, 2006
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in dev4u CMS allow remote attackers to inject arbitrary web script or HTML via the (1) user_name, (2) passwort, and (3) go_target parameters.

  • CVE-2006-6220Dec 1, 2006
    Recipes Complete Website
    Recipes Complete Website
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Recipes Website (Recipes Complete Website) 1.1.14 allow remote attackers to execute arbitrary SQL commands via the (1) recipeid parameter to recipe.php or the (2) categoryid parameter to list.php.

  • CVE-2006-6180Dec 1, 2006
    Expinion.net
    Inews Publisher
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in articles.asp in Expinion.net iNews Publisher (iNP) 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the hl parameter. NOTE: The provenance of this information is unknown; the details are obtained…

  • CVE-2006-6181Dec 1, 2006
    Clicktech
    Clickcontact
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in default.asp in ClickTech ClickContact allow remote attackers to execute arbitrary SQL commands via the (1) AlphaSort, (2) In, and (3) orderby parameters.

  • CVE-2006-6182Dec 1, 2006
    Gabriele Teotino
    Gnotebook
    risk 0.00cvss —epss 0.00

    The Gabriele Teotino GNotebook 0.7.0.1 gadget for Google Desktop stores Gmail passwords in plaintext in the %SYSTEMDRIVE%\temp\Gnotebook.txt log file, which allows local users to obtain passwords by reading the file.

  • CVE-2006-6183Dec 1, 2006
    risk 0.09cvss —epss 0.71

    Multiple stack-based buffer overflows in 3Com 3CTftpSvc 2.0.1, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long mode field (aka transporting mode) in a (1) GET or (2) PUT command.

  • CVE-2006-6184Dec 1, 2006
    Alliedtelesyn
    At TFTP
    risk 0.08cvss —epss 0.66

    Multiple stack-based buffer overflows in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long filename in a (1) GET or (2) PUT command.

  • CVE-2006-6185Dec 1, 2006
    Wabbit
    Wabbit PHP Gallery
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in script.php in Wabbit PHP Gallery 0.9 allows remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter to index.php.

  • CVE-2006-6186Dec 1, 2006
    Enomphp
    Enomphp
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in enomphp 4.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter to (1) config.php, (2) ranklv_inside.php, (3) rankml_inside.php, and (4) admin/Restore/config.php.

  • CVE-2006-6187Dec 1, 2006
    Clicktech
    Clickgallery
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ClickTech Click Gallery allow remote attackers to execute arbitrary SQL commands via the (1) currentpage or (2) gallery_id parameter to (a) view_gallery.asp, the (3) image_id parameter to (b) download_image.asp, the currentpage or (5)…

  • CVE-2006-6188Dec 1, 2006
    Clicktech
    Clickgallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in view_search.asp in ClickTech Click Gallery allows remote attackers to inject arbitrary web script or HTML via the txtKeyWord parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2006-6189Dec 1, 2006
    Clicktech
    Clickblog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in displayCalendar.asp in ClickTech Click Blog allows remote attackers to execute arbitrary SQL commands via the date parameter.

  • CVE-2006-6190Dec 1, 2006
    Anna
    Anna^ IRC Bot
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in anna.pl in Anna^ IRC Bot before 0.30 (aka caprice) allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: it is possible that there are multiple issues.

  • CVE-2006-6191Dec 1, 2006
    8pixel.net
    Simple Blog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/edit.asp in 8pixel.net simpleblog 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-6192Dec 1, 2006
    8pixel.net
    Simple Blog
    risk 0.00cvss —epss 0.01

    Unspecified scripts in the admin directory in 8pixel.net SimpleBlog 3.0 and earlier do not properly perform authentication, which allows remote attackers to add users and perform certain other unauthorized privileged actions. NOTE: The provenance of this information is unknown;…

  • CVE-2006-6193Dec 1, 2006
    Basicforum
    Basicforum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in edit.asp in BasicForum 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-6194Dec 1, 2006
    Fisasp.com
    Ultimate Survey Pro
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.asp in Ultimate Survey Pro allow remote attackers to execute arbitrary SQL commands via the (1) cat or (2) did parameter.