VYPR

CVEs

344,053 total · page 6462 of 6,882

AllCriticalHighKEV
  • CVE-2006-6022Nov 21, 2006
    Bestwebapp
    Dating Site
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in login_form.asp in BestWebApp Dating Site allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2006-6023Nov 21, 2006
    Bloofoxcms
    Bloo
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in phoo.base.php in Bill Roberts Bloo 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the descriptorFileList parameter. NOTE: this issue is disputed by CVE since $descriptorFileList is used in a function definition…

  • CVE-2006-6024CriNov 21, 2006
    Eudora
    Worldmail
    risk 0.64cvss 9.8epss 0.01

    Multiple buffer overflows in Eudora Worldmail, possibly Worldmail 3 version 6.1.22.0, have unknown impact and attack vectors, as demonstrated by the (1) "Eudora WorldMail stack overflow" and (2) "Eudora WorldMail heap overflow" modules in VulnDisco Pack. NOTE: Some of these…

  • CVE-2006-6025HigNov 21, 2006
    Qualcomm
    Eudora Worldmail
    risk 0.49cvss 7.5epss 0.01

    QUALCOMM Eudora WorldMail 4.0 allows remote attackers to cause a denial of service, as demonstrated by a certain module in VulnDisco Pack. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. As of 20061118, this…

  • CVE-2006-6026Nov 21, 2006
    RealNetworks
    Helix Mobile Server
    risk 0.04cvss —epss 0.10

    Heap-based buffer overflow in Real Networks Helix Server and Helix Mobile Server before 11.1.3, and Helix DNA Server 11.0 and 11.1, allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a DESCRIBE request that contains an invalid…

  • CVE-2006-6027Nov 21, 2006
    Adobe Inc.
    Acrobat
    risk 0.06cvss —epss 0.43

    Adobe Reader (Adobe Acrobat Reader) 7.0 through 7.0.8 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long argument string to the LoadFile method in an AcroPDF ActiveX control.

  • CVE-2006-6028Nov 21, 2006
    Anton Vlasov
    Dosepa
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in textview.php in Anton Vlasov DoSePa 1.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) sequence or absolute file path in the file parameter.

  • CVE-2006-6029Nov 21, 2006
    Property Pro
    Property Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in vir_Login.asp in Property Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the UserName field.

  • CVE-2006-6030Nov 21, 2006
    Futuretec
    E Calendar Pro
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in E-Calendar Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd (Password) fields in (a) admin/default.asp; or the (3) Event Title, (4) Location, or (5) Description field when making a…

  • CVE-2006-6031Nov 21, 2006
    Greater Cincinnati Internet Solutions (GCIS)
    ASPCart
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Greater Cincinnati Internet Solutions (GCIS) ASPCart allow remote attackers to execute arbitrary SQL commands via (1) the prodid parameter in (a) prodetails.asp; (2) the page parameter in (b) display.asp; the (3) custid, (4) item, (5)…

  • CVE-2006-6032Nov 21, 2006
    Sphpblog
    Sphpblog
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog (SPHPBlog), probably 0.4.8, allow remote attackers to inject arbitrary web script or HTML via (1) the action parameter in add_block.php or (2) the entry parameter in index.php, different vectors than…

  • CVE-2006-6033Nov 21, 2006
    Sphpblog
    Sphpblog
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in Simple PHP Blog (SPHPBlog), probably 0.4.8, allow remote attackers to read arbitrary files and possibly include arbitrary PHP code via a .. (dot dot) sequence in the blog_theme parameter in (1) index.php, (2) add_cgi.php, (3)…

  • CVE-2006-6034Nov 21, 2006
    Sitesoutlet
    E-commerce Kit-1 PayPal Edition
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in SitesOutlet E-commerce Kit-1 PayPal Edition allow remote attackers to execute arbitrary SQL commands via the (1) keyword or (2) cid parameter in (a) catalogue.asp, or the (3) pid parameter in (b) viewDetail.asp.

  • CVE-2006-3890Nov 21, 2006
    Winzip
    Winzip
    risk 0.04cvss —epss 0.14

    Stack-based buffer overflow in the Sky Software FileView ActiveX control, as used in WinZip 10 before build 7245 and in certain other applications, allows remote attackers to execute arbitrary code via a long FilePattern attribute in a WZFILEVIEW object, a different…

  • CVE-2006-5991Nov 21, 2006
    Wwweb Concepts
    CactuShop
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in wwweb concepts CactuShop allow remote attackers to execute arbitrary SQL commands via the (1) prodtype parameter in prodtype.asp and the (2) product parameter in product.asp.

  • CVE-2006-5990Nov 21, 2006
    VMware
    Virtualcenter
    risk 0.00cvss —epss 0.01

    VMWare VirtualCenter client 2.x before 2.0.1 Patch 1 (Build 33643) and 1.4.x before 1.4.1 Patch 1 (Build 33425), when server certificate verification is enabled, does not verify the server's X.509 certificate when creating an SSL session, which allows remote malicious servers to…

  • CVE-2006-5975Nov 20, 2006
    BlogMe
    BlogMe
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in comments.asp in BlogMe 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) URL, or (3) Comments field.

  • CVE-2006-5976Nov 20, 2006
    BlogMe
    BlogMe
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in admin_login.asp in BlogMe 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password field. NOTE: some of these details are obtained from third party information.

  • CVE-2006-5977Nov 20, 2006
    Expinion.net
    Multicalendars
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MultiCalendars allow remote attackers to execute arbitrary SQL commands via the (1) M or (2) Y parameter to rss_out.asp, or the (3) cate parameter to all_calendars.asp. NOTE: the all_calendars.asp/calsids vector is already covered by…

  • CVE-2006-5978Nov 20, 2006
    E Xoopport
    E Xoopport
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in E-Xoopport before 2.2.0 has unknown impact and attack vectors, as addressed by "Some security fix."

  • CVE-2006-5979Nov 20, 2006
    Renasoft
    Netjetserver
    risk 0.00cvss —epss 0.01

    Renasoft NetJetServer 2.5.3.939, and possibly earlier, uses insecure permissions for Global.asa, which allows remote attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; details are obtained from third party sources.

  • CVE-2006-5980Nov 20, 2006
    Renasoft
    Netjetserver
    risk 0.00cvss —epss 0.03

    adm_lgn_admin.asp in Renasoft NetJetServer 2.5.3.939, and possibly earlier, does not properly perform login authentication, which allows remote attackers to obtain administrative privileges. NOTE: the provenance of this information is unknown; details are obtained from third…

  • CVE-2006-5981Nov 20, 2006
    SeleniumServer
    FTP Server
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in SeleniumServer FTP Server 1.0, and possibly earlier, allow remote attackers to list arbitrary directories, read arbitrary files, and upload arbitrary files via directory traversal sequences in the (1) DIR (LIST or NLST), (2) GET…

  • CVE-2006-5982Nov 20, 2006
    SeleniumServer
    FTP Server
    risk 0.00cvss —epss 0.02

    SeleniumServer FTP Server 1.0, and possibly earlier, stores user passwords in plaintext in the Servers directory, which allows attackers to obtain passwords by reading the file. NOTE: the provenance of this information is unknown; details are obtained from third party sources.

  • CVE-2006-5983Nov 20, 2006
    Directadmin
    Directadmin
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user parameter to (a) CMD_SHOW_RESELLER or (b) CMD_SHOW_USER in the Admin level; the (2) TYPE parameter to…

  • CVE-2006-5984Nov 20, 2006
    Helm
    Web Hosting Control Panel
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) txtCompanyName, (2) txtEmail, or (3) txtUserAccNum parameter to (a) users.asp, or the (4)…

  • CVE-2006-5985Nov 20, 2006
    Extreme CMS
    Extreme CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in admin/options.php in Extreme CMS 0.9, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) bg1, (2) bg2, (3) text, or (4) size parameters. NOTE: the provenance of this information…

  • CVE-2006-5986Nov 20, 2006
    Extreme CMS
    Extreme CMS
    risk 0.00cvss —epss 0.01

    admin/options.php in Extreme CMS 0.9, and possibly earlier, does not require authentication, which might allow remote attackers to conduct unauthorized activities. NOTE: this issue can be combined with another vulnerability to expand the scope of a cross-site scripting (XSS)…

  • CVE-2006-5987Nov 20, 2006
    Aspintranet
    Aspintranet
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.asp in ASPintranet, possibly 1.2, allows remote attackers to execute arbitrary SQL commands via the a parameter.

  • CVE-2006-5988Nov 20, 2006
    Microsoft
    Windows 2000
    risk 0.01cvss —epss 0.13

    Unspecified vulnerability in Windows 2000 Advanced Server SP4 running Active Directory allows remote attackers to cause a denial of service via unknown vectors, as demonstrated by a certain VulnDisco Pack module. NOTE: the provenance of this information is unknown; the details…

  • CVE-2006-5989Nov 20, 2006
    Mod Auth Kerb
    Mod Auth Kerb
    risk 0.00cvss —epss 0.04

    Off-by-one error in the der_get_oid function in mod_auth_kerb 5.0 allows remote attackers to cause a denial of service (crash) via a crafted Kerberos message that triggers a heap-based buffer overflow in the component array.

  • CVE-2006-5973Nov 20, 2006
    Timo Sirainen
    Dovecot
    risk 0.00cvss —epss 0.03

    Off-by-one buffer overflow in Dovecot 1.0test53 through 1.0.rc14, and possibly other versions, when index files are used and mmap_disable is set to "yes," allows remote authenticated IMAP or POP3 users to cause a denial of service (crash) via unspecified vectors involving the…

  • CVE-2006-4413Nov 18, 2006
    Apple Inc.
    Remote Desktop
    risk 0.00cvss —epss 0.00

    Apple Remote Desktop before 3.1 uses insecure permissions for certain built-in packages, which allows local users on an Apple Remote Desktop administration system to modify the packages and gain root privileges on client systems that use the packages.

  • CVE-2006-5972Nov 18, 2006
    Netgear
    Wg111v2
    risk 0.05cvss —epss 0.19

    Stack-based buffer overflow in WG111v2.SYS in NetGear WG111v2 wireless adapter (USB) allows remote attackers to execute arbitrary code via a long 802.11 beacon request.

  • CVE-2006-5819Nov 18, 2006
    Verity
    Ultraseek
    risk 0.01cvss —epss 0.06

    Verity Ultraseek before 5.7 allows remote attackers to use the server as a proxy for web attacks and host scanning via a direct request to the highlight/index.html script.

  • CVE-2006-5970Nov 18, 2006
    Verity
    Ultraseek
    risk 0.00cvss —epss 0.02

    Verity Ultraseek before 5.7 allows remote attackers to obtain sensitive information via direct requests with (1) a null ("%00") terminated url parameter to help/urlstatusgo.html; or missing parameters to (2) help/header.html, (3) help/footer.html, (4) spell.html, (5)…

  • CVE-2006-5971Nov 18, 2006
    Verity
    Ultraseek
    risk 0.00cvss —epss 0.02

    Absolute path traversal vulnerability in admin/logfile.txt in Verity Ultraseek before 5.6.2 allows remote attackers to read arbitrary files via the name variable.

  • CVE-2006-5793Nov 17, 2006
    Libpng
    Libpng
    risk 0.00cvss —epss 0.02

    The sPLT chunk handling code (png_set_sPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type, which allows context-dependent attackers to cause a denial of service (crash) via malformed sPLT chunks that trigger an out-of-bounds…

  • CVE-2006-5969Nov 17, 2006
    Fvwm
    Fvwm
    risk 0.00cvss —epss 0.00

    CRLF injection vulnerability in the evalFolderLine function in fvwm 2.5.18 and earlier allows local users to execute arbitrary commands via carriage returns in a directory name, which is not properly handled by fvwm-menu-directory, a variant of CVE-2003-1308.

  • CVE-2006-5966Nov 17, 2006
    Panda Project
    Activescan
    risk 0.00cvss —epss 0.02

    Panda ActiveScan 5.53.00, and other versions before 5.54.01, allows remote attackers to (1) reboot the system using the Reinicializar method in the ActiveScan.1 ActiveX control, or (2) determine arbitrary file existence and size via the ObtenerTamano method in the PAVPZ.SOS.1…

  • CVE-2006-5967Nov 17, 2006
    Panda Project
    Activescan
    risk 0.00cvss —epss 0.02

    Race condition in Panda ActiveScan 5.53.00, and other versions before 5.54.01, allows remote attackers to cause memory corruption and execute arbitrary code via unknown vectors related to multiple invocations of the Analizar method in the ActiveScan.1 ActiveX control, which is…

  • CVE-2006-5968Nov 17, 2006
    Alt N
    Mdaemon
    risk 0.00cvss —epss 0.00

    MDaemon 9.0.5, 9.0.6, 9.51, and 9.53, and possibly other versions, installs the MDaemon application folder with insecure permissions (Users create files/directories), which allows local users to execute arbitrary code by creating malicious RASAPI32.DLL or MPRAPI.DLL libraries in…

  • CVE-2006-5957Nov 17, 2006
    Infinicart
    Infinicart
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in INFINICART allow remote attackers to execute arbitrary SQL commands via the (1) groupid parameter in (a) browse_group.asp, (2) productid parameter in (b) added_to_cart.asp, and (3) catid and (4) subid parameter in (c) browsesubcat.asp. …

  • CVE-2006-5958Nov 17, 2006
    Infinicart
    Infinicart
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in INFINICART allow remote attackers to inject arbitrary web script or HTML via the (1) username and (2) password fields in (a) login.asp, (3) search field in (b) search.asp, and (4) email field in (c) sendpassword.asp.

  • CVE-2006-5959Nov 17, 2006
    A+ Store E Commerce
    A+ Store E-Commerce
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in browse.asp in A+ Store E-Commerce allows remote attackers to execute arbitrary SQL commands via the ParentID parameter.

  • CVE-2006-5960Nov 17, 2006
    Web Inhabit
    A\+ Store E Commerce
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in account_login.asp in A+ Store E-Commerce allow remote attackers to inject arbitrary web script or HTML via the (1) username (txtUserName) and (2) password (txtPassword) parameters. NOTE: portions of these details are…

  • CVE-2006-5961Nov 17, 2006
    MERCURY
    Mail Transport System
    risk 0.03cvss —epss 0.02

    Buffer overflow in Mercury Mail Transport System 4.01b for Windows has unknown impact and attack vectors, as originally reported in a GLEG VulnDisco pack. NOTE: the provenance of this information is unknown; the details are obtained from third party information. The original…

  • CVE-2006-5962Nov 17, 2006
    Hpecs
    Shopping Cart
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Hpecs Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields in the (a) login screen, and (3) searchstring parameter in (b) insearch_list.asp.

  • CVE-2006-5942Nov 17, 2006
    Website Designs For Less
    Inventory Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in inventory/display/display_results.asp in Website Designs For Less Inventory Manager allows remote attackers to inject arbitrary web script or HTML via the category parameter.

  • CVE-2006-5943Nov 17, 2006
    Website Designs For Less
    Inventory Manager
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in inventory/display/imager.asp in Website Designs for Less Inventory Manager allow remote attackers to execute arbitrary SQL commands via the (1) pictable, (2) picfield, or (3) where parameter.