VYPR

CVEs

344,040 total · page 6467 of 6,881

AllCriticalHighKEV
  • CVE-2006-5746Nov 6, 2006
    Airmagnet
    Enterprise
    risk 0.00cvss —epss 0.01

    The console in AirMagnet Enterprise before 7.5 build 6307 does not properly validate the Enterprise Server certificate, which allows remote attackers to read network traffic via a man-in-the-middle (MITM) attack, possibly related to the use of self-signed certificates.

  • CVE-2006-5466Nov 6, 2006
    Rpm
    Package Manager
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in the showQueryPackage function in librpm in RPM Package Manager 4.4.8, when the LANG environment variable is set to ru_RU.UTF-8, might allow user-assisted attackers to execute arbitrary code via crafted RPM packages.

  • CVE-2006-5726Nov 6, 2006
    Sun Corporation
    Solaris
    risk 0.03cvss —epss 0.01

    alloccgblk in the UFS filesystem in Solaris 10 allows local users to cause a denial of service (memory corruption) by mounting crafted UFS filesystems with malformed data structures.

  • CVE-2006-5727Nov 6, 2006
    Sazcart
    Sazcart
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin/controls/cart.php in sazcart 1.5 allows remote attackers to execute arbitrary PHP code via the (1) _saz[settings][shippingfolder] and (2) _saz[settings][taxfolder] parameters.

  • CVE-2006-5728Nov 6, 2006
    XM
    Easy Personal FTP Server
    risk 0.03cvss —epss 0.02

    XM Easy Personal FTP Server 5.2.1 and earlier allows remote authenticated users to cause a denial of service via a long argument to the NLST command, possibly involving the -al flags.

  • CVE-2006-5702Nov 4, 2006
    Tiki
    Tiki
    risk 0.07cvss —epss 0.53

    Tikiwiki 1.9.5 allows remote attackers to obtain sensitive information (MySQL username and password) via an empty sort_mode parameter in (1) tiki-listpages.php, (2) tiki-lastchanges.php, (3) messu-archive.php, (4) messu-mailbox.php, (5) messu-sent.php, (6)…

  • CVE-2006-5703Nov 4, 2006
    Tiki
    Tiki
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in tiki-featured_link.php in Tikiwiki 1.9.5 allows remote attackers to inject arbitrary web script or HTML via a url parameter that evades filtering, as demonstrated by a parameter value containing malformed, nested SCRIPT elements.

  • CVE-2006-5704Nov 4, 2006
    Microfocus
    NonStop Server
    risk 0.00cvss —epss 0.00

    HP NonStop Server G06.29, when running Standard Security T6533G06 before T6533G06^ABK, does not properly evaluate access permissions to OSS directories when no optional ACL entry exists, which allows local users to read arbitrary files.

  • CVE-2006-5705Nov 4, 2006
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    Multiple directory traversal vulnerabilities in plugins/wp-db-backup.php in WordPress before 2.0.5 allow remote authenticated users to read or overwrite arbitrary files via directory traversal sequences in the (1) backup and (2) fragment parameters in a GET request.

  • CVE-2006-5706Nov 4, 2006
    PHP
    PHP
    risk 0.00cvss —epss 0.00

    Unspecified vulnerabilities in PHP, probably before 5.2.0, allow local users to bypass open_basedir restrictions and perform unspecified actions via unspecified vectors involving the (1) chdir and (2) tempnam functions. NOTE: the tempnam vector might overlap CVE-2006-1494.

  • CVE-2006-5707Nov 4, 2006
    Phpeasydata
    Phpeasydata
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in PHPEasyData Pro 1.4.1 and 2.2.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2006-5708HigNov 4, 2006
    Alt N
    Mdaemon
    risk 0.49cvss 7.5epss 0.01

    Multiple unspecified vulnerabilities in MDaemon and WorldClient in Alt-N Technologies MDaemon before 9.50 allow attackers to cause a denial of service (memory consumption) via unspecified vectors resulting in memory leaks.

  • CVE-2006-5709Nov 4, 2006
    Alt N
    Mdaemon
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in WorldClient in Alt-N Technologies MDaemon before 9.50 has unknown impact and attack vectors related to a "JavaScript exploit."

  • CVE-2006-5710Nov 4, 2006
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.18

    The Airport driver for certain Orinoco based Airport cards in Darwin kernel 8.8.0 in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to execute arbitrary code via an 802.11 probe response frame without any valid information element (IE) fields after…

  • CVE-2006-5711Nov 4, 2006
    ECI Telecom
    B-FOCuS
    risk 0.03cvss —epss 0.03

    ECI Telecom B-FOCuS Wireless 802.11b/g ADSL2+ Router allows remote attackers to read arbitrary files via a certain HTTP request, as demonstrated by a request for a router configuration file, related to the /html/defs/ URI.

  • CVE-2006-5712Nov 4, 2006
    Mirapoint
    WebMail
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Mirapoint WebMail allows remote attackers to inject arbitrary web script via the expression Cascading Style Sheets (CSS) function, as demonstrated using the width style for an IMG element.

  • CVE-2006-5713Nov 4, 2006
    EFS Software
    Efs Web Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Easy File Sharing (EFS) Web Server 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) author, (2) content, or (3) title parameters when posting a forum thread. NOTE: the provenance of this information is…

  • CVE-2006-5714Nov 4, 2006
    Easy File Sharing
    Web Server
    risk 0.03cvss —epss 0.06

    Easy File Sharing (EFS) Web Server 4.0, when running on an NTFS file system, allows remote attackers to read arbitrary files under the web root by appending "::$DATA" to the end of a HTTP GET request, which accesses the alternate data stream.

  • CVE-2006-5715Nov 4, 2006
    Easy File Sharing
    Easy Address Book
    risk 0.03cvss —epss 0.06

    Easy File Sharing (EFS) Easy Address Book 1.2, when run on an NTFS file system, allows remote attackers to read arbitrary files under the web root by appending "::$DATA" to the end of an HTTP GET request, which accesses the alternate data stream.

  • CVE-2006-5716Nov 4, 2006
    Freenews
    Freenews
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in aff_news.php in FreeNews 2.1 allows remote attackers to include local files via a .. (dot dot) sequence in the chemin parameter, when the aff_news parameter is not set to "1."

  • CVE-2006-5717Nov 4, 2006
    Zend
    ZendGData
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Zend Google Data Client Library (ZendGData) Preview 0.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) basedemo.php and (2) calenderdemo.php in samples/, and other…

  • CVE-2006-5718Nov 4, 2006
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in error.php in phpMyAdmin 2.6.4 through 2.9.0.2 allows remote attackers to inject arbitrary web script or HTML via UTF-7 or US-ASCII encoded characters, which are injected into an error message, as demonstrated by a request with a utf7…

  • CVE-2006-5719Nov 4, 2006
    Bytesfall Explorer
    Bytesfall Explorer
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in libs/sessions.lib.php in BytesFall Explorer (bfExplorer) 0.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified parameters, a different issue than CVE-2006-5606.

  • CVE-2006-5720Nov 4, 2006
    PHP-Nuke
    PHP Nuke
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in modules/journal/search.php in the Journal module in Francisco Burzi PHP-Nuke 7.9 and earlier allows remote attackers to execute arbitrary SQL commands via the forwhat parameter.

  • CVE-2006-5721Nov 4, 2006
    Outpost
    Firewall PRO
    risk 0.03cvss —epss 0.01

    The \Device\SandBox driver in Outpost Firewall PRO 4.0 (964.582.059) allows local users to cause a denial of service (system crash) via an invalid argument to the DeviceIoControl function that triggers an invalid memory operation.

  • CVE-2006-5722Nov 4, 2006
    Segue CMS
    CMS
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Segue CMS 1.5.9 and earlier, when magic_quotes_gpc is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the theme parameter to (1) themesettings.php or (2) index.php, a different vector than…

  • CVE-2006-5723Nov 4, 2006
    Dataparksearch
    Dataparksearch
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in DataparkSearch Engine 4.42 and earlier allows remote attackers to execute arbitrary SQL commands via a malformed hostname in a URL.

  • CVE-2006-5724Nov 4, 2006
    Icq
    ICQ 2003b
    risk 0.00cvss —epss 0.00

    Heap-based buffer overflow the "Answering Service" function in ICQ 2003b Build 3916 allows local users to cause a denial of service (application crash) via a long string in the "AwayMsg Presets" value in the ICQ\ICQPro\DefaultPrefs\Presets registry key.

  • CVE-2006-5725Nov 4, 2006
    AEP
    Smartgate
    risk 0.03cvss —epss 0.03

    The SSL server in AEP Smartgate 4.3b allows remote attackers to determine existence of directories via a direct request for a directory URI, which returns different HTTP status codes for existing and non-existing directories.

  • CVE-2006-4521Nov 4, 2006
    Novell
    Edirectory
    risk 0.00cvss —epss 0.02

    The BerDecodeLoginDataRequest function in the libnmasldap.so NMAS module in Novell eDirectory 8.8 and 8.8.1 before the Security Services 2.0.3 patch does not properly increment a pointer when handling certain input, which allows remote attackers to cause a denial of service…

  • CVE-2006-5465Nov 4, 2006
    PHP
    PHP
    risk 0.01cvss —epss 0.08

    Buffer overflow in PHP before 5.2.0 allows remote attackers to execute arbitrary code via crafted UTF-8 inputs to the (1) htmlentities or (2) htmlspecialchars functions.

  • CVE-2006-5701Nov 3, 2006
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    Double free vulnerability in squashfs module in the Linux kernel 2.6.x, as used in Fedora Core 5 and possibly other distributions, allows local users to cause a denial of service by mounting a crafted squashfs filesystem.

  • CVE-2006-5679Nov 3, 2006
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.01

    Integer overflow in the ffs_mountfs function in FreeBSD 6.1 allows local users to cause a denial of service (panic) and possibly execute arbitrary code via a crafted UFS filesystem that causes invalid or large size parameters to be provided to the kmem_alloc function. NOTE: a…

  • CVE-2006-5677Nov 3, 2006
    TORQUE Resource Manager
    TORQUE Resource Manager
    risk 0.00cvss —epss 0.00

    resmom/start_exec.c in pbs_mom in TORQUE Resource Manager 2.0.0p8 and earlier allows local users to create arbitrary files via a symlink attack on (1) a job output file in /usr/spool/PBS/spool and possibly (2) a job file in /usr/spool/PBS/mom_priv/jobs.

  • CVE-2006-5678CriNov 3, 2006
    Phpmyconferences
    Phpmyconferences
    risk 0.64cvss 9.8epss 0.02

    PHP remote file inclusion vulnerability in common/visiteurs/include/library.inc.php in J-Pierre DEZELUS Les Visiteurs 2.0.1, as used in phpMyConferences (phpMyConference) 8.0.2 and possibly other products, allows remote attackers to execute arbitrary PHP code via a URL in the…

  • CVE-2006-5675Nov 3, 2006
    Pentaho
    Business Intelligence Suite
    risk 0.03cvss —epss 0.01

    Multiple unspecified vulnerabilities in Pentaho Business Intelligence (BI) Suite before 1.2 RC3 (1.2.0.470-RC3) have unknown impact and attack vectors, related to "MySQL Scripts need changes for security," possibly SQL injection vulnerabilities associated with these scripts.

  • CVE-2006-5676Nov 3, 2006
    Uni Vert
    Phpleague
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in consult/classement.php in Uni-Vert PhpLeague 0.82 and earlier allows remote attackers to execute arbitrary SQL commands via the champ parameter.

  • CVE-2006-5663Nov 3, 2006
    IBM
    Informix Dynamic Server
    risk 0.00cvss —epss 0.00

    IBM Informix Dynamic Server 10.00, Informix Client Software Development Kit (CSDK) 2.90, and Informix I-Connect 2.90 use insecure permissions for installation scripts, which allows local users to gain privileges by modifying the scripts.

  • CVE-2006-5664Nov 3, 2006
    IBM
    Informix Dynamic Server
    risk 0.00cvss —epss 0.00

    The installation script in IBM Informix Dynamic Server 10.00, Informix Client Software Development Kit (CSDK) 2.90, and Informix I-Connect 2.90 allows local users to "compromise security" via a symlink attack on temporary files.

  • CVE-2006-5665Nov 3, 2006
    Spider Friendly
    Spider Friendly
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin/modules_data.php in the phpBB module Spider Friendly 1.3.10 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5666Nov 3, 2006
    E Annu
    E Annu
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in includes/menu.inc.php in E-Annu 1.0 allows remote attackers to execute arbitrary SQL commands via the login parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2006-5667Nov 3, 2006
    P Book
    P Book
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in P-Book 1.17 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pb_lang parameter to (1) admin.php and (2) pbook.php.

  • CVE-2006-5668Nov 3, 2006
    Ampache
    Ampache
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Ampache 3.3.2 and earlier, when register_globals is enabled, allows remote attackers to bypass security restrictions and gain guest access.

  • CVE-2006-5669Nov 3, 2006
    Gepi
    Gepi
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in gestion/savebackup.php in Gepi 1.4.0 and earlier, and possibly other versions before 1.4.4, allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter.

  • CVE-2006-5670Nov 3, 2006
    Free PHP Scripts
    Free Image Hosting
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in forgot_pass.php in Free Image Hosting 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AD_BODY_TEMP parameter.

  • CVE-2006-5671Nov 3, 2006
    Free PHP Scripts
    Free Image Hosting
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in contact.php in Free Image Hosting 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AD_BODY_TEMP parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2006-5672Nov 3, 2006
    Mysource
    Mysource CMS
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in web/init_mysource.php in MySource CMS 2.16.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the INCLUDE_PATH parameter.

  • CVE-2006-5673Nov 3, 2006
    Minibb
    Minibb
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in bb_func_txt.php in miniBB 2.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pathToFiles parameter.

  • CVE-2006-5674Nov 3, 2006
    Minibb
    Minibb
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in miniBB 2.0.2 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the pathToFiles parameter to (1) bb_func_forums.php, (2) bb_functions.php, or (3) the RSS plugin.

  • CVE-2006-5397Nov 3, 2006
    Xorg
    Libx11
    risk 0.00cvss —epss 0.00

    The Xinput module (modules/im/ximcp/imLcIm.c) in X.Org libX11 1.0.2 and 1.0.3 opens a file for reading twice using the same file descriptor, which causes a file descriptor leak that allows local users to read files specified by the XCOMPOSEFILE environment variable via the…