VYPR

CVEs

344,070 total · page 6461 of 6,882

AllCriticalHighKEV
  • CVE-2006-6094Nov 24, 2006
    ActiveNews
    ActiveNews Manager
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in ActiveNews Manager allow remote attackers to execute arbitrary SQL commands via the (1) catID parameter to activeNews_categories.asp, the (2) articleID parameter to activeNews_comments.asp, or the (3) query parameter to…

  • CVE-2006-6095Nov 24, 2006
    ActiveNews
    ActiveNews Manager
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ActiveNews Manager allow remote attackers to execute arbitrary SQL commands via the (1) articleID parameter to activenews_view.asp or the (2) page parameter to default.asp. NOTE: the activeNews_categories.asp and activeNews_comments.asp…

  • CVE-2006-6096Nov 24, 2006
    Dotnetindex
    Active News Manager
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in activenews_search.asp in ActiveNews Manager allows remote attackers to inject arbitrary web script or HTML via the query parameter.

  • CVE-2006-6097Nov 24, 2006
    GNU
    Tar
    risk 0.04cvss —epss 0.11

    GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE_NAMES record with a symbolic link, which is not properly handled by the extract_archive function in extract.c and…

  • CVE-2006-6072Nov 24, 2006
    Bpg Infotech
    Easy Publisher
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in bpg/publications_list.asp in BPG-InfoTech Easy Publisher and Smart Publisher//Pro 2.7.7 allows remote attackers to execute arbitrary SQL commands via the vjob parameter. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2006-6073Nov 24, 2006
    Enthrallweb
    Eshopping Cart
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Enthrallweb eShopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) ProductID parameter in productdetail.asp or the (2) categoryid parameter in products.asp.

  • CVE-2006-6074Nov 24, 2006
    Enthrallweb
    Eshopping Cart
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Enthrallweb eShopping Cart allow remote attackers to execute arbitrary SQL commands via (1) the ProductID parameter in (a) reviews.asp, or the (2) cat_id or (3) sub_id parameter in (b) subProducts.asp. NOTE: the productdetail.asp vector…

  • CVE-2006-6075Nov 24, 2006
    Baalasp
    Smart Form Portal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in addpost1.asp in BaalAsp forum allows remote attackers to inject arbitrary web script or HTML via the name parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-6076Nov 24, 2006
    Ca
    Brightstor ARCserve Backup
    risk 0.09cvss —epss 0.70

    Buffer overflow in the Tape Engine (tapeeng.exe) in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 and earlier allows remote attackers to execute arbitrary code via certain RPC requests to TCP port 6502.

  • CVE-2006-6077Nov 24, 2006
    Netscape
    Netscape
    risk 0.00cvss —epss 0.02

    The (1) Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the (2) Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches the web site for which…

  • CVE-2006-6078Nov 24, 2006
    A Conman
    A Conman
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in common.inc.php in a-ConMan 3.2 beta allows remote attackers to execute arbitrary PHP code via a URL in the cm_basedir parameter.

  • CVE-2006-6079Nov 24, 2006
    Imendio Ab
    Loudmouth
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in LoudMouth 2.4 allow remote attackers to execute arbitrary PHP code via a URL in the mainframe parameter to (1) admin.loudmouth.php or (2) toolbar.loudmouth.php.

  • CVE-2006-6080Nov 24, 2006
    Gazatem Technologies
    Gnews Publisher
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in categories.asp in gNews Publisher allow remote attackers to execute arbitrary SQL commands via the (1) catID or (2) editorID parameter.

  • CVE-2006-6081Nov 24, 2006
    Telaen
    Telaen
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in Smarty_Compiler.class.php in Telaen 1.1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the plugin_file parameter.

  • CVE-2006-3973Nov 22, 2006
    Webroot Software
    My Firewall Plus
    risk 0.00cvss —epss 0.00

    My Firewall Plus 5.0 Build 1119 does not verify if explorer.exe is running before launching iexplore.exe from the "Test Your Firewall" feature, which allows local users to gain SYSTEM privileges.

  • CVE-2006-6063Nov 22, 2006
    risk 0.07cvss —epss 0.58

    Stack-based buffer overflow in Un4seen XMPlay 3.3.0.5 and earlier allows remote attackers to execute arbitrary code via a M3U file containing a long (1) FileName, and cause a crash via a long (2) DisplayName.

  • CVE-2006-6064Nov 22, 2006
    Fuzzball Muck
    Fuzzball Muck
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in the Message Parsing Interpreter (MPI) in Fuzzball MUCK before 6.07 allow remote attackers to execute arbitrary code via crafted messages.

  • CVE-2006-6065Nov 22, 2006
    Mxbb
    Calsnails Module
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/mx_common.php in the CalSnails Module for MxBB Portal 1.06 allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.

  • CVE-2006-6066Nov 22, 2006
    Dragon Internet Business Search Directory - Pro
    Events Listing
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Dragon Calendar / Events Listing 2.x allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to (a) admin_login.asp, the (3) ID parameter to (b) event_searchdetail.asp, or the (4) VenueID…

  • CVE-2006-6067Nov 22, 2006
    20/20 DataShed
    DataShed
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in 20/20 DataShed (aka Real Estate Listing System) allow remote attackers to execute arbitrary SQL commands via the (1) itemID parameter to (a) f-email.asp, or the (2) peopleID and (2) sort_order parameters to (b) listings.asp, different…

  • CVE-2006-6068Nov 22, 2006
    Malbum
    Malbum
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in the cached_album function in functions.php for mAlbum 0.3 and earlier allows remote attackers to list filenames of arbitrary images via a .. (dot dot) in the gal parameter to index.php.

  • CVE-2006-6069Nov 22, 2006
    Malbum
    Malbum
    risk 0.00cvss —epss 0.01

    index.php in mAlbum 0.3 and earlier allows remote attackers to obtain the installation path via an invalid gal parameter.

  • CVE-2006-6070Nov 22, 2006
    Asp Nuke
    Asp Nuke
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in module/account/register/register.asp in ASP Nuke 0.80 and earlier allows remote attackers to execute arbitrary SQL commands via the StateCode parameter.

  • CVE-2006-5868Nov 22, 2006
    ImageMagick
    Imagemagick
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in Imagemagick 6.0 before 6.0.6.2, and 6.2 before 6.2.4.5, has unknown impact and user-assisted attack vectors via a crafted SGI image.

  • CVE-2006-6053Nov 22, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The ext3fs_dirhash function in Linux kernel 2.6.x allows local users to cause a denial of service (crash) via an ext3 stream with malformed data structures.

  • CVE-2006-6054Nov 22, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The ext2 file system code in Linux kernel 2.6.x allows local users to cause a denial of service (crash) via an ext2 stream with malformed data structures that triggers an error in the ext2_check_page due to a length that is smaller than the minimum.

  • CVE-2006-6055Nov 22, 2006
    Dlink
    Dwl G132
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in A5AGU.SYS 1.0.1.41 for the D-Link DWL-G132 wireless adapter allows remote attackers to execute arbitrary code via a 802.11 beacon request with a long Rates information element (IE).

  • CVE-2006-6056Nov 22, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Linux kernel 2.6.x up to 2.6.18 and possibly other versions, when SELinux hooks are enabled, allows local users to cause a denial of service (crash) via a malformed file stream that triggers a NULL pointer dereference in the superblock_doinit function, as demonstrated using an…

  • CVE-2006-6057Nov 22, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The Linux kernel 2.6.x up to 2.6.18, and possibly other versions, on Fedora Core 6 and possibly other operating systems, allows local users to cause a denial of service (crash) via a malformed gfs2 file stream that triggers a NULL pointer dereference in the init_journal function.

  • CVE-2006-6058Nov 22, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The minix filesystem code in Linux kernel 2.6.x before 2.6.24, including 2.6.18, allows local users to cause a denial of service (hang) via a malformed minix file stream that triggers an infinite loop in the minix_bmap function. NOTE: this issue might be due to an integer…

  • CVE-2006-6059Nov 22, 2006
    Netgear
    MA521
    risk 0.04cvss —epss 0.19

    Buffer overflow in MA521nd5.SYS driver 5.148.724.2003 for NetGear MA521 PCMCIA adapter allows remote attackers to execute arbitrary code via (1) beacon or (2) probe 802.11 frame responses with an long supported rates information element. NOTE: this issue was reported as a…

  • CVE-2006-6060Nov 22, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The NTFS filesystem code in Linux kernel 2.6.x up to 2.6.18, and possibly other versions, allows local users to cause a denial of service (CPU consumption) via a malformed NTFS file stream that triggers an infinite loop in the __find_get_block_slow function.

  • CVE-2006-6061Nov 22, 2006
    Apple Inc.
    Mac OS X
    risk 0.01cvss —epss 0.09

    com.apple.AppleDiskImageController in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to execute arbitrary code via a malformed DMG image that triggers memory corruption. NOTE: the severity of this issue has been disputed by a third party, who states…

  • CVE-2006-6062Nov 22, 2006
    Apple Inc.
    Mac OS X
    risk 0.03cvss —epss 0.05

    Unspecified vulnerability in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a malformed UDTO HFS+ disk image, such as with "bad sectors," which triggers memory corruption.

  • CVE-2006-6035Nov 22, 2006
    F Art Agency
    BLOG:CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in list.php in BLOG:CMS 4.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the FADDR parameter.

  • CVE-2006-6036Nov 22, 2006
    Openhuman
    OpenHuman
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in OpenHuman before 1.0 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2006-6037Nov 22, 2006
    Dan Jensen
    Travelsized CMS
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Dan Jensen Travelsized CMS 0.4.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) page, (2) page_id, or (3) language parameter.

  • CVE-2006-6038Nov 22, 2006
    Powie
    Pforum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in editpoll.php in Powie's PHP Forum (pForum) 1.29a and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-6039Nov 22, 2006
    Powie
    PHP Matchmaker
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in matchdetail.php in Powie's PHP MatchMaker 4.05 and earlier allows remote attackers to execute arbitrary SQL commands via the edit parameter.

  • CVE-2006-6040Nov 22, 2006
    Jelsoft
    Vbulletin
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in admincp/index.php in Jelsoft vBulletin 3.6.x allow remote attackers to inject arbitrary web script or HTML via (1) the prefs parameter in a buildnavprefs action or (2) the navprefs parameter in a savenavprefs action.

  • CVE-2006-6041Nov 22, 2006
    Laurent Van Den Reysen
    Work System E Commerce
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in Laurent Van den Reysen WORK system e-commerce 3.0.2, and other versions before 3.0.4, allow remote attackers to execute arbitrary PHP code via a URL in the g_include parameter to (1) index.php, (2) module/forum/forum.php, (3)…

  • CVE-2006-6042Nov 22, 2006
    Phpwebthings
    Phpwebthings
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the editor_insert_bottom parameter.

  • CVE-2006-6043Nov 22, 2006
    Oliver Project
    Oliver
    risk 0.00cvss —epss 0.01

    PHP file inclusion vulnerability in loginform-inc.php in Oliver (formerly Webshare) 1.2.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the conf[motdfile] parameter, which…

  • CVE-2006-6044Nov 22, 2006
    Phpquickgallery
    Phpquickgallery
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in gallery_top.inc.php in PHPQuickGallery 1.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the textFile parameter.

  • CVE-2006-6045Nov 22, 2006
    Comdev
    Comdev One Admin Pro
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Comdev One Admin Pro 4.1 allow remote attackers to execute arbitrary PHP code via a URL in the path[skin] parameter to (1) adminfoot.php, (2) adminhead.php, or (3) adminlogin.php.

  • CVE-2006-6046Nov 22, 2006
    Eggblog
    Eggblog
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in eggblog 3.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) edit parameter to (a) admin/articles.php or (b) admin/comments.php, or the (2) add parameter to admin/users.php.

  • CVE-2006-6047Nov 22, 2006
    Etomite
    Etomite
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the f parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log…

  • CVE-2006-6048Nov 22, 2006
    Etomite
    Etomite
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Etomite CMS 0.6.1.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-6049Nov 22, 2006
    Phil Taylor
    Shambo2
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in shambo2.php in the Shambo2 (com_shambo2) component for Mambo 4.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-6050Nov 22, 2006
    Clicktech
    Texas Rankem
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ClickTech Texas Rank'em allow remote attackers to execute arbitrary SQL commands via the (1) selPlayer parameter to player.asp or the (2) tournament_id parameter to tournaments.asp.