VYPR

CVEs

344,053 total · page 6463 of 6,882

AllCriticalHighKEV
  • CVE-2006-5944Nov 17, 2006
    Mginternet
    Car Site Manager
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in csm/asp/listings.asp in MGinternet Car Site Manager (CSM) allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2006-5945Nov 17, 2006
    Mginternet
    Car Site Manager
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MGinternet Car Site Manager (CSM) allow remote attackers to execute arbitrary SQL commands via the (1) p parameter to (a) csm/asp/detail.asp, or the (2) l, (3) typ, or (4) loc parameter to (b) csm/asp/listings.asp.

  • CVE-2006-5946Nov 17, 2006
    Funkyasp
    Glossary
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in demo/glossary/glossary.asp in FunkyASP Glossary 1.0 allows remote attackers to execute arbitrary SQL commands via the alpha parameter.

  • CVE-2006-5947Nov 17, 2006
    Conxint
    Conxint FTP Server
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in Conxint FTP Server 2.2.0603, and possibly earlier, allow remote attackers to read arbitrary files and list arbitrary directories via directory traversal sequences in (1) DIR (LIST or NLST) and (2) GET (RETR) commands. NOTE: the…

  • CVE-2006-5948Nov 17, 2006
    Ringsworld
    Phppeanuts
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in pntUnit/Inspect.php in phpPeanuts 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the Include parameter.

  • CVE-2006-5949Nov 17, 2006
    Altools
    Alftp FTP Server
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in ALTools ALFTP FTP Server 4.1 beta 1, and possibly earlier, allows remote attackers to create arbitrary directories via directory traversal sequences in a MKD request. NOTE: the provenance of this information is unknown; details are obtained…

  • CVE-2006-5950Nov 17, 2006
    Altools
    Alftp FTP Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in ALTools ALFTP FTP Server 4.1 beta 1, and possibly earlier, allows remote authenticated users to obtain the installation path via unknown vectors related to the REN command, probably due to response messages. NOTE: the provenance of this information…

  • CVE-2006-5951Nov 17, 2006
    Exocrew
    ExoPHPDesk
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in pipe.php in Exophpdesk 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the lang_file parameter.

  • CVE-2006-5952Nov 17, 2006
    Asp Smiley
    Asp Smiley
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/default.asp in ASP Smiley 1.0 allows remote attackers to execute arbitrary SQL commands via the Username field.

  • CVE-2006-5953Nov 17, 2006
    Evolve
    Evolve shopping cart
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in viewcart.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL commands via the zoneid parameter.

  • CVE-2006-5954Nov 17, 2006
    Netvios
    Netvios
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in page.asp in NetVIOS 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the NewsID parameter.

  • CVE-2006-5955Nov 17, 2006
    20/20 DataShed
    Real Estate Listing System
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in listings.asp in 20/20 DataShed (aka Real Estate Listing System) allows remote attackers to execute arbitrary SQL commands via the itemID parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2006-5956Nov 17, 2006
    Xlinesoft
    Phprunner
    risk 0.00cvss —epss 0.00

    XLineSoft PHPRunner 3.1 stores the (1) database server name, (2) database names, (3) usernames, and (4) passwords in plaintext in %WINDIR%\PHPRunner.ini, which allows local users to obtain sensitive information by reading the file.

  • CVE-2006-5926Nov 16, 2006
    Vallheru
    Vallheru
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in mail.php in Vallheru before 1.0.7 allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) to parameters. NOTE: some of these details are obtained from third party information.

  • CVE-2006-5927Nov 16, 2006
    Asp Scripter
    Easy Portal
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in cpLogin.asp in ASP Scripter Easy Portal 1.4 and Live Support 1.3 allows remote attackers to execute arbitrary SQL commands via the Password parameter.

  • CVE-2006-5928Nov 16, 2006
    Phpjobscheduler
    Phpjobscheduler
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in Phpjobscheduler 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the installed_config_file parameter to (1) add-modify.php, (2) delete.php, (3) modify.php, and (4) phpjobscheduler.php.

  • CVE-2006-5929Nov 16, 2006
    Phpjobscheduler
    Phpjobscheduler
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in firepjs.php in Phpjobscheduler 3.0 allows remote attackers to execute arbitrary PHP code via a URL in the installed_config_file parameter. NOTE: the provenance of this information is unknown; details are obtained from third party…

  • CVE-2006-5930Nov 16, 2006
    Aigaion
    Aigaion
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to (1) _basicfunctions.php, or (2) pageactionauthor.php.

  • CVE-2006-5931Nov 16, 2006
    Aigaion
    Aigaion
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to certain PHP scripts in (1) lib/actions/, (2)…

  • CVE-2006-5932Nov 16, 2006
    Kahua
    Kahua
    risk 0.00cvss —epss 0.02

    Kahua before 0.7, when running multiple applications under a single supervisor, grants application access on the basis of username instead of username and database name, which allows remote authenticated users to obtain unauthorized access if different databases assign the same…

  • CVE-2006-5933Nov 16, 2006
    Ultrasite
    Ultrasite
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in update.asp in UltraSite 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-5934Nov 16, 2006
    Estate Agent Manager
    Estate Agent Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/default.asp in Estate Agent Manager 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the UserName field.

  • CVE-2006-5935Nov 16, 2006
    Shopsystems
    Shopsystems
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in ShopSystems 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the sessid parameter.

  • CVE-2006-5936Nov 16, 2006
    Sitexpress
    Sitexpress E Commerce System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in dept.asp in SiteXpress E-Commerce System allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-5937Nov 16, 2006
    Avast\!
    Avg Antivirus
    risk 0.00cvss —epss 0.04

    Multiple integer overflows in Grisoft AVG Anti-Virus before 7.1.407 allow remote attackers to execute arbitrary code via crafted (1) CAB or (2) RAR archives that trigger a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.

  • CVE-2006-5938Nov 16, 2006
    Avast\!
    Avg Antivirus
    risk 0.00cvss —epss 0.02

    Grisoft AVG Anti-Virus before 7.1.407 has unknown impact and remote attack vectors involving an uninitialized variable and a crafted CAB file.

  • CVE-2006-5939Nov 16, 2006
    Avast\!
    Avg Antivirus
    risk 0.00cvss —epss 0.03

    Grisoft AVG Anti-Virus before 7.1.407 allows remote attackers to cause a denial of service (crash) via a crafted DOC file that triggers a divide-by-zero error. NOTE: some of these details are obtained from third party information.

  • CVE-2006-5940Nov 16, 2006
    Avast\!
    Avg Antivirus
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Grisoft AVG Anti-Virus before 7.1.407 has unknown impact and remote attack vectors related to "Integer Issues" and parsing of .EXE files.

  • CVE-2006-5925Nov 15, 2006
    Elinks
    Elinks
    risk 0.04cvss —epss 0.08

    Links web browser 1.00pre12 and Elinks 0.9.2 with smbclient installed allows remote attackers to execute arbitrary code via shell metacharacters in an smb:// URI, as demonstrated by using PUT and GET statements.

  • CVE-2006-5897Nov 15, 2006
    Phpmychat
    Phpmychat Plus
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in PhpMyChat Plus 1.9 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the ChatPath parameter to (1) avatar.php, (2) colorhelp_popup.php, (3) color_popup.php, (4) index.php, (5) index1.php, (6)…

  • CVE-2006-5898Nov 15, 2006
    Phpheaven
    Phpmychat
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in localization/languages.lib.php3 in PhpMyChat 0.14.5 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the ChatPath parameter.

  • CVE-2006-5899Nov 15, 2006
    @cid
    stats
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in install.php3 in @cid stats 2.3 allows remote attackers to execute arbitrary PHP code via a URL in the repertoire parameter. NOTE: this issue has been disputed by a third party, who states that install.php3 is supposed to be deleted…

  • CVE-2006-5900Nov 15, 2006
    Zend
    Zend Framework Preview
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the incubator/tests/Zend/Http/_files/testRedirections.php sample code in Zend Framework Preview 0.2.0 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters.

  • CVE-2006-5901Nov 15, 2006
    Hawking Technology
    WR254-CA
    risk 0.00cvss —epss 0.01

    Hawking Technology wireless router WR254-CA uses a hardcoded IP address among the set of DNS server IP addresses, which could allow remote attackers to cause a denial of service or hijack the router by attacking or spoofing the server at the hardcoded address. NOTE: it could be…

  • CVE-2006-5902Nov 15, 2006
    Viksoe
    Gmail Drive
    risk 0.00cvss —epss 0.01

    viksoe GMail Drive shell extension allows remote attackers to perform virtual filesystem actions via e-mail messages with certain subject lines, as demonstrated by (1) a GMAILFS: [13;a;1] message with a new filename and a file attachment, which injects a new file into the…

  • CVE-2006-5903Nov 15, 2006
    Rahul Jonna
    Gspace
    risk 0.00cvss —epss 0.01

    Rahul Jonna Gmail File Space (GSpace) allows remote attackers to perform virtual filesystem actions via e-mail messages with certain subject lines, as demonstrated by (1) a GSPACE "2174|1|1|1|gs:/ d$" message, which injects a new file into the filesystem; and (2) a GSPACE…

  • CVE-2006-5904Nov 15, 2006
    Mwchat Pro
    Mwchat Pro
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in MWChat Pro 7.0 allow remote attackers to execute arbitrary PHP code via a URL in the CONFIG[MWCHAT_Libs] parameter to (1) about.php, (2) buddy.php, (3) chat.php, (4) dialog.php, (5) head.php, (6) help.php, (7) index.php, and…

  • CVE-2006-5905Nov 15, 2006
    Web Directory Pro
    Web Directory Pro
    risk 0.00cvss —epss 0.01

    Web Directory Pro allows remote attackers to (1) backup the database and obtain the backup via a direct request to admin/backup_db.php or (2) modify configuration via a direct request to admin/options.php.

  • CVE-2006-5906Nov 15, 2006
    Jean-Christophe Ramos
    SCRIPT BANNIERES
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in modules/bannieres/bannieres.php in Jean-Christophe Ramos SCRIPT BANNIERES (aka ban 0.1 and PLS-Bannieres 1.21) allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter. NOTE: the issue is disputed by…

  • CVE-2006-5907Nov 15, 2006
    Jean-Christophe Ramos
    Ban
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in modules/bannieres/bannieres.php in Jean-Christophe Ramos SCRIPT BANNIERES (aka ban 0.1 and PLS-Bannieres 1.21) allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-5908Nov 15, 2006
    Lucas Rodriguez San Pedro
    Yet Another News System
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the login_user function in yans.func.php in Lucas Rodriguez San Pedro Yet Another News System (YANS) 0.2b allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.

  • CVE-2006-5909Nov 15, 2006
    Paul Tarjan
    Stanford Conference And Research Forum
    risk 0.00cvss —epss 0.02

    generaloptions.php in Paul Tarjan Stanford Conference And Research Forum (SCARF) before 20070227 does not require the admin privilege, which allows remote attackers to reconfigure the application or its user accounts.

  • CVE-2006-5910Nov 15, 2006
    Sourcefabric
    Campsite
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Campware Campsite before 20061110 allow remote attackers to execute arbitrary PHP code via a URL in the g_documentRoot parameter to (1) bugreporter/thankyou.php and (2) feedback/thankyou.php in implementation/management/priv/.

  • CVE-2006-5911Nov 15, 2006
    Sourcefabric
    Campsite
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in Campware Campsite before 2.6.2 allow remote attackers to execute arbitrary PHP code via a URL in the g_documentRoot parameter to (1) Alias.php, (2) Article.php, (3) ArticleAttachment.php, (4) ArticleComment.php, (5)…

  • CVE-2006-5912Nov 15, 2006
    Sourcefabric
    Campsite
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Campware Campsite before 2.6.2 has unknown impact and attack vectors, related to a "Security fix for you-know-what," possibly related to encrypted passwords.

  • CVE-2006-5913Nov 15, 2006
    Microsoft
    Ie
    risk 0.00cvss —epss 0.05

    Microsoft Internet Explorer 7 allows remote attackers to (1) cause a security certificate from a secure web site to appear invalid via a link to res://ieframe.dll/sslnavcancel.htm with the target site in the anchor identifier, which displays the site's URL in the address bar but…

  • CVE-2006-5914Nov 15, 2006
    Samedia
    Landshop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ls.php in SAMEDIA LandShop allows remote attackers to execute arbitrary SQL commands via the infield parameter. NOTE: the start, search_order, search_type, and search_area parameters are already covered by CVE-2005-4018.

  • CVE-2006-5915Nov 15, 2006
    Samedia
    Landshop
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ls.php in SAMEDIA LandShop allow remote attackers to inject arbitrary web script or HTML via the (1) start, (2) CAT_ID, (3) keyword, (4) search_area, (5) search_type, (6) infield, or (7) search_order parameter.

  • CVE-2006-5916Nov 15, 2006
    Intego
    Virusbarrier
    risk 0.00cvss —epss 0.01

    Intego VirusBarrier X4 allows context-dependent attackers to bypass virus protection by quickly injecting many infected files into the filesystem, which prevents VirusBarrier from processing all the files.

  • CVE-2006-5917Nov 15, 2006
    Omnistar
    Article Manager
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in OmniStar Article Manager allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter in (a) articles/comments.php and (b) articles/article.php, and the (2) page_id parameter in (c) articles/pages.php.