VYPR

CVEs

344,053 total · page 6464 of 6,882

AllCriticalHighKEV
  • CVE-2006-5918Nov 15, 2006
    PHP Rapid Kill
    PHP Rapid Kill
    risk 0.03cvss —epss 0.02

    Unrestricted file upload vulnerability in RapidKill (aka PHP Rapid Kill) 5.7 Pro, and certain other versions, allows remote attackers to upload and execute arbitrary PHP scripts via the "Link to Download" field. NOTE: it is possible that the field value is restricted to files…

  • CVE-2006-5919Nov 15, 2006
    Activecampaign
    Knowledgebuilder
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin/e_data/visEdit_control.class.php in ActiveCampaign KnowledgeBuilder 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the visEdit_root parameter, a different vector than CVE-2003-1131.

  • CVE-2006-5920Nov 15, 2006
    Yuuki Yoshizawa
    Exporia
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in common.php in Yuuki Yoshizawa Exporia 0.3.0 allows remote attackers to execute arbitrary PHP code via a URL in the lan parameter. NOTE: SecurityFocus disputes this issue, saying "further analysis reveals that the application is not…

  • CVE-2006-5921Nov 15, 2006
    Wheatblog
    Wheatblog
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in add_comment.php in Wheatblog (wB) allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) WWW, and (3) Comment fields. NOTE: this issue may overlap CVE-2006-5195.

  • CVE-2006-5922Nov 15, 2006
    Wheatblog
    Wheatblog
    risk 0.00cvss —epss 0.01

    index.php in Wheatblog (wB) allows remote attackers to obtain sensitive information via certain values of the postPtr[] and next parameters, which reveals the path in an error message.

  • CVE-2006-5923Nov 15, 2006
    Chris Mac
    Gimescripts Shopping Catalog
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in Chris Mac gtcatalog (aka GimeScripts Shopping Catalog) 0.9.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the custom parameter.

  • CVE-2006-5924Nov 15, 2006
    Efficientip
    Ipmanager
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Efficient IP iPmanager (IPm) 2.3 allows remote attackers to inject arbitrary web script or HTML via the errmsg parameter. NOTE: the provenance of this information is unknown; details are obtained from third party sources.

  • CVE-2006-4688Nov 14, 2006
    Microsoft
    Windows 2000
    risk 0.09cvss —epss 0.77

    Buffer overflow in Client Service for NetWare (CSNW) in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via crafted messages, aka "Client Service for NetWare Memory Corruption Vulnerability."

  • CVE-2006-4689Nov 14, 2006
    Microsoft
    Windows 2000
    risk 0.03cvss —epss 0.34

    Unspecified vulnerability in the driver for the Client Service for NetWare (CSNW) in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1 allows remote attackers to cause a denial of service (hang and reboot) via has unknown attack vectors, aka "NetWare Driver Denial of…

  • CVE-2006-5461Nov 14, 2006
    Avahi
    Avahi
    risk 0.00cvss —epss 0.00

    Avahi before 0.6.15 does not verify the sender identity of netlink messages to ensure that they come from the kernel instead of another process, which allows local users to spoof network changes to Avahi.

  • CVE-2006-5885Nov 14, 2006
    NuStore
    NuStore
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in Products.asp in NuStore 1.0 allows remote attackers to execute arbitrary SQL commands via the SubCatagoryID parameter.

  • CVE-2006-5886Nov 14, 2006
    Dynamic Dataworx
    Nurealestate
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in propertysdetails.asp in Dynamic Dataworx NuRealestate (NuRems) 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the PropID parameter.

  • CVE-2006-5887Nov 14, 2006
    Dynamic Dataworx
    Nuschool
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in CampusNewsDetails.asp in Dynamic Dataworx NuSchool 1.0 allows remote attackers to execute arbitrary SQL commands via the NewsID parameter.

  • CVE-2006-5888Nov 14, 2006
    Superfreaker Studios
    Upublisher
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in viewarticle.asp in Superfreaker Studios UPublisher 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2006-5889Nov 14, 2006
    Brewblogger
    Brewblogger
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in printLog.php in BrewBlogger (BB) 1.3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-5890Nov 14, 2006
    Superfreaker Studios
    Usupport
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in detail.asp in Superfreaker Studios USupport 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-5891Nov 14, 2006
    Superfreaker Studios
    Ustore
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in detail.asp in Superfreaker Studios UStore 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2006-5892Nov 14, 2006
    The Net Guys
    Aspired2poll
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in MoreInfo.asp in The Net Guys ASPired2Poll 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-5893Nov 14, 2006
    Iwonder Designs
    Storystream
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in iWonder Designs Storystream 0.4.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the baseDir parameter to (1) mysql.php and (2) mysqli.php in include/classes/pear/DB/.

  • CVE-2006-5894Nov 14, 2006
    Rama
    CMS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in lang.php in Rama CMS 0.68 and earlier, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, as demonstrated by injecting PHP sequences into an Apache…

  • CVE-2006-5895Nov 14, 2006
    Encapscms
    Encapscms
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in core/core.php in EncapsCMS 0.3.6 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.

  • CVE-2006-3445Nov 14, 2006
    Microsoft
    Windows 2000
    risk 0.03cvss —epss 0.40

    Integer overflow in the ReadWideString function in agentdpv.dll in Microsoft Agent on Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via a large length value in an .ACF file, which results in a heap-based buffer…

  • CVE-2006-4687Nov 14, 2006
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.25

    Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via crafted layout combinations involving DIV tags and HTML CSS float properties that trigger memory corruption, aka "HTML Rendering Memory Corruption Vulnerability."

  • CVE-2006-4691Nov 14, 2006
    Microsoft
    Windows 2000
    risk 0.09cvss —epss 0.80

    Stack-based buffer overflow in the NetpManageIPCConnect function in the Workstation service (wkssvc.dll) in Microsoft Windows 2000 SP4 and XP SP2 allows remote attackers to execute arbitrary code via NetrJoinDomain2 RPC messages with a long hostname.

  • CVE-2006-5198Nov 14, 2006
    Winzip
    Winzip
    risk 0.08cvss —epss 0.60

    The WZFILEVIEW.FileViewCtrl.61 ActiveX control (aka Sky Software "FileView" ActiveX control) for WinZip 10.0 before build 7245 allows remote attackers to execute arbitrary code via unspecified "unsafe methods."

  • CVE-2006-5884Nov 14, 2006
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.07

    Multiple unspecified vulnerabilities in DirectAnimation ActiveX controls for Microsoft Internet Explorer 5.01 through 6 have unknown impact and remote attack vectors, possibly related to (1) Danim.dll and (2) Lmrt.dll, a different set of vulnerabilities than CVE-2006-4446 and…

  • CVE-2006-4252Nov 14, 2006
    PowerDNS
    Recursor
    risk 0.00cvss —epss 0.06

    PowerDNS Recursor 3.1.3 and earlier allows remote attackers to cause a denial of service (resource exhaustion and application crash) via a CNAME record with a zero TTL, which triggers an infinite loop.

  • CVE-2006-4251Nov 14, 2006
    PowerDNS
    Recursor
    risk 0.01cvss —epss 0.08

    Buffer overflow in PowerDNS Recursor 3.1.3 and earlier might allow remote attackers to execute arbitrary code via a malformed TCP DNS query that prevents Recursor from properly calculating the TCP DNS query length.

  • CVE-2006-5878Nov 14, 2006
    Edgewall Software
    Trac
    risk 0.00cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors.

  • CVE-2006-5879Nov 14, 2006
    Aspapps
    Aspportal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default1.asp in ASPPortal 4.0.0 beta and earlier allows remote attackers to execute arbitrary SQL commands via the Poll_ID parameter, a different vector than CVE-2006-1353.

  • CVE-2006-5880Nov 14, 2006
    Munch
    Munch Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability on the subMenu page in switch.asp in Munch Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2006-5881Nov 14, 2006
    Dynamic Dataworx
    Nucommunity
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in cl_CatListing.asp in Dynamic Dataworx NuCommunity 1.0 allows remote attackers to execute arbitrary SQL commands via the cl_cat_ID parameter.

  • CVE-2006-5882Nov 14, 2006
    Linksys
    WPC300N
    risk 0.04cvss —epss 0.13

    Stack-based buffer overflow in the Broadcom BCMWL5.SYS wireless device driver 3.50.21.10, as used in Cisco Linksys WPC300N Wireless-N Notebook Adapter before 4.100.15.5 and other products, allows remote attackers to execute arbitrary code via an 802.11 response frame containing…

  • CVE-2006-5883Nov 14, 2006
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) dir parameter in (a) seldir.html, and the (2) user and (3) dir parameters in (b) newuser.html.

  • CVE-2006-5862Nov 11, 2006
    Nav
    Network Administration Visualized
    risk 0.00cvss —epss 0.00

    Directory traversal vulnerability in the session mechanism of the web interface for Network Administration Visualized (NAV) before 3.1.1 allows attackers with filesystem write access to have an unknown impact via unknown attack vectors.

  • CVE-2006-5863Nov 11, 2006
    Otterware
    Letterit2
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in inc/session.php for LetterIt 2 allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter.

  • CVE-2006-5864Nov 11, 2006
    GNU
    Gv
    risk 0.04cvss —epss 0.15

    Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows user-assisted attackers to execute arbitrary code via a PostScript (PS) file with certain headers that contain long comments, as demonstrated using the (1)…

  • CVE-2006-5865Nov 11, 2006
    MyAlbum
    MyAlbum
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in language.inc.php in MyAlbum 3.02 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the langs_dir parameter.

  • CVE-2006-5866Nov 11, 2006
    Phpmanta
    Phpmanta
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in Mdoc/view-sourcecode.php for phpManta 1.0.2 and earlier allows remote attackers to read and include arbitrary files via ".." sequences in the file parameter.

  • CVE-2006-5821Nov 10, 2006
    Citrix Systems
    Metaframe
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in the IMA_SECURE_DecryptData1 function in ImaSystem.dll for Citrix MetaFrame XP 1.0 and 2.0, and Presentation Server 3.0 and 4.0, allows remote attackers to execute arbitrary code via requests to the Independent Management Architecture (IMA) service…

  • CVE-2006-5861Nov 10, 2006
    Citrix Systems
    Metaframe
    risk 0.00cvss —epss 0.04

    The Independent Management Architecture (IMA) service (ImaSrv.exe) in Citrix MetaFrame XP 1.0 and 2.0, and Presentation Server 3.0 and 4.0, allows remote attackers to cause a denial of service (service exit) via a crafted packet that causes the service to access an unmapped…

  • CVE-2006-5487Nov 10, 2006
    Mailmarshal
    SMTP
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in Marshal MailMarshal SMTP 5.x, 6.x, and 2006, and MailMarshal for Exchange 5.x, allows remote attackers to write arbitrary files via ".." sequences in filenames in an ARJ compressed archive.

  • CVE-2006-5839Nov 10, 2006
    Phpadventure
    Phpadventure
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in ad_main.php in PHPAdventure 1.1-Alpha and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _mygamefile parameter.

  • CVE-2006-5840Nov 10, 2006
    Abarcar
    Abarcar Realty Portal
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Abarcar Realty Portal allow remote attackers to execute arbitrary SQL commands via the (1) neid parameter to newsdetails.php, or the (2) slid parameter to slistl.php. NOTE: the cat vector is already covered by CVE-2006-2853. NOTE: the…

  • CVE-2006-5841Nov 10, 2006
    DodosMail
    DodosMail
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in dodosmail.php in DodosMail 2.0.1 and earlier, and possibly 2.1, allow remote attackers to execute arbitrary PHP code via a URL in the (1) dodosmail_header_file or (2) dodosmail_footer_file parameters.

  • CVE-2006-5842Nov 10, 2006
    Unicore
    Client
    risk 0.00cvss —epss 0.00

    The keystore file in Unicore Client before 5.6 build 5, when running on Unix systems, has insecure default permissions, which allows local users to obtain sensitive information.

  • CVE-2006-5843Nov 10, 2006
    Speedywiki
    Speedywiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Speedywiki 2.0 allows remote attackers to inject arbitrary web script or HTML via the showRevisions parameter.

  • CVE-2006-5844Nov 10, 2006
    Speedywiki
    Speedywiki
    risk 0.00cvss —epss 0.01

    Speedywiki 2.0 allows remote attackers to obtain the full path of the web server via the (1) showRevisions[] and (2) searchText[] parameters in (a) index.php, and (b) a direct request to upload.php without any parameters.

  • CVE-2006-5845Nov 10, 2006
    Speedywiki
    Speedywiki
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in index.php in Speedywiki 2.0 allows remote authenticated users to upload and execute arbitrary PHP code by setting the upload parameter to 1.

  • CVE-2006-5846Nov 10, 2006
    Freewebshop
    Freewebshop
    risk 0.04cvss —epss 0.12

    Directory traversal vulnerability in index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to read and include arbitrary files via a .. (dot dot) in the page parameter, a different vector than CVE-2006-5773.