VYPR

CVEs

344,040 total · page 6470 of 6,881

AllCriticalHighKEV
  • CVE-2006-5528Oct 26, 2006
    Schoolalumni Portal
    Schoolalumni Portal
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in mod.php in SchoolAlumni Portal 2.26 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2006-5529Oct 26, 2006
    Schoolalumni Portal
    Schoolalumni Portal
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in smumdadotcom_ascyb_alumni/mod.php in SchoolAlumni Portal 2.26 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search operation in the katalog module. NOTE: some of these details are obtained…

  • CVE-2006-5530Oct 26, 2006
    Boesch It
    Simpnews
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Boesch SimpNews before 2.34.01 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) admin/index.php, (2) admin/pwlost.php, and unspecified other files. NOTE: the provenance of this…

  • CVE-2006-5531Oct 26, 2006
    Ascended
    Guestbook
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in embedded.php in Ascended Guestbook 1.0.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[path] parameter.

  • CVE-2006-5532Oct 26, 2006
    Rmsoft
    Gallery System
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in rmgs/images.php in RMSOFT Gallery System 2.0 allows remote attackers to inject arbitrary web script or HTML via the kw parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2006-5533Oct 26, 2006
    Aroundme
    Aroundme
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in AROUNDMe 0.6.9, and possibly earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the templatePath parameter in template/barnraiser_01/pol_view.tpl.php and other…

  • CVE-2006-5534Oct 26, 2006
    Zwahlen
    Online Shop
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.htm in Zwahlen Online Shop Freeware 5.2.2.50, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) cat, (2) Kat, (3) id, or (4) no parameters. NOTE: some of these details are…

  • CVE-2006-5535Oct 26, 2006
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in WebHostManager (WHM) 10.8.0 cPanel 10.9.0 R50 allow remote attackers to inject arbitrary web script or HTML via the (1) theme parameter to scripts/dosetmytheme and the (2) template parameter to scripts2/editzonetemplate.

  • CVE-2006-5536Oct 26, 2006
    Dlink
    Dsl G624t
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in cgi-bin/webcm in D-Link DSL-G624T firmware 3.00B01T01.YA-C.20060616 allows remote attackers to read arbitrary files via a .. (dot dot) in the getpage parameter.

  • CVE-2006-5537Oct 26, 2006
    Dlink
    Dsl G624t
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/webcm in D-Link DSL-G624T firmware 3.00B01T01.YA-C.20060616 allow remote attackers to inject arbitrary web script or HTML via the (1) upnp:settings/state or (2) upnp:settings/connection parameters.

  • CVE-2006-5538Oct 26, 2006
    Dlink
    Dsl G624t
    risk 0.00cvss —epss 0.01

    D-Link DSL-G624T firmware 3.00B01T01.YA-C.20060616 allows remote attackers to list contents of the cgi-bin directory via unspecified vectors, probably a direct request.

  • CVE-2006-5539Oct 26, 2006
    Ueberproject Management System
    Ueberproject Management System
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in login/secure.php in UeberProject Management System 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cfg[homepath] parameter.

  • CVE-2006-5540Oct 26, 2006
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.02

    backend/parser/analyze.c in PostgreSQL 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) via certain aggregate functions in an UPDATE statement, which are not properly handled during a "MIN/MAX index optimization."

  • CVE-2006-5541Oct 26, 2006
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.02

    backend/parser/parse_coerce.c in PostgreSQL 7.4.1 through 7.4.14, 8.0.x before 8.0.9, and 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) via a coercion of an unknown element to ANYARRAY.

  • CVE-2006-5542Oct 26, 2006
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.02

    backend/tcop/postgres.c in PostgreSQL 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) related to duration logging of V3-protocol Execute messages for (1) COMMIT and (2) ROLLBACK SQL statements.

  • CVE-2006-5543Oct 26, 2006
    Pgosd
    Pgosd
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in misc/function.php3 in PHP Generator of Object SQL Database (PGOSD), when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.

  • CVE-2006-5544Oct 26, 2006
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Visual truncation vulnerability in Microsoft Internet Explorer 7 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a malicious URL containing non-breaking spaces (%A0), which causes the address bar to omit some characters from the URL.

  • CVE-2006-5545Oct 26, 2006
    Symantec
    Mail Security
    risk 0.00cvss —epss 0.02

    Premium Antispam in Symantec Mail Security for Domino Server 5.1.x before 5.1.2.28 does not filter certain SMTP address formats, which allows remote attackers to use the product as a spam relay.

  • CVE-2006-5546Oct 26, 2006
    Otscms
    Otscms
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in OTSCMS/OTSCMS.php in Open Tibia Server Content Management System (OTSCMS) 1.3.0 through 1.4.1 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[config][otscms][directories][classes] parameter.

  • CVE-2006-5547Oct 26, 2006
    Otscms
    Otscms
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in OTSCMS/OTSCMS.php in Open Tibia Server Content Management System (OTSCMS) 1.0.0 through 1.0.3 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[config][otscms][directories][includes] parameter.

  • CVE-2006-5548Oct 26, 2006
    Otscms
    Otscms
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in OTSCMS/OTSCMS.php in Open Tibia Server Content Management System (OTSCMS) 2.0.0 through 2.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[config][directories][classes] parameter.

  • CVE-2006-5549Oct 26, 2006
    Adobe Inc.
    PHP SDK
    risk 0.00cvss —epss 0.03

    PHP remote file inclusion vulnerability in libraries/amfphp/amf-core/custom/CachedGateway.php in Adobe PHP SDK allows remote attackers to execute arbitrary PHP code via the AMFPHP_BASE parameter. NOTE: this issue has been disputed by a third-party researcher who states that…

  • CVE-2006-5550Oct 26, 2006
    FreeBSD
    FreeBSD
    risk 0.03cvss —epss 0.01

    The kernel in FreeBSD 6.1 and OpenBSD 4.0 allows local users to cause a denial of service via unspecified vectors involving certain ioctl requests to /dev/crypto.

  • CVE-2006-5551Oct 26, 2006
    QK
    SMTP
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in QK SMTP 3.01 and earlier might allow remote attackers to execute arbitrary code via a long argument to the RCPT TO command.

  • CVE-2006-5552Oct 26, 2006
    Revilloc Solutions
    Mailserver
    risk 0.03cvss —epss 0.05

    Multiple heap-based buffer overflows in RevilloC MailServer 1.21 and earlier allow remote attackers to cause a denial of service (CPU consumption or application crash) or execute arbitrary code via a long argument to the (1) MAIL FROM or (2) RCPT TO command.

  • CVE-2006-5553Oct 26, 2006
    Cisco Systems, Inc.
    Security Agent
    risk 0.00cvss —epss 0.03

    Cisco Security Agent (CSA) for Linux 4.5 before 4.5.1.657 and 5.0 before 5.0.0.193, as used by Unified CallManager (CUCM) and Unified Presence Server (CUPS), allows remote attackers to cause a denial of service (resource consumption) via a port scan with certain options.

  • CVE-2006-5554Oct 26, 2006
    Imageview
    Imageview
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in Imageview 5 allows remote attackers to read or execute arbitrary local files via a .. (dot dot) in the user_settings cookie, as demonstrated by using the MyFile parameter in albumview.php to upload a text/plain .gif file…

  • CVE-2006-5555Oct 26, 2006
    Epnadmin
    Epnadmin
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in constantes.inc.php in EPNadmin 0.7 and 0.7.1 allows remote attackers to execute arbitrary PHP code via the langage parameter.

  • CVE-2006-5513Oct 26, 2006
    Geonetwork
    Opensource
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in GeoNetwork opensource before 2.0.3 allows remote attackers to execute arbitrary SQL commands, and complete a login, via unspecified vectors.

  • CVE-2006-5514Oct 26, 2006
    Wgcc
    Web Group Communication Center
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in quiz.php in Web Group Communication Center (WGCC) 0.5.6b and earlier allows remote attackers to execute arbitrary SQL commands via the qzid parameter.

  • CVE-2006-5515Oct 26, 2006
    Phpadsnew
    Phpadsnew
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in lib-history.inc.php in phpAdsNew and phpPgAds before 2.0.8-pr1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to injected data that is stored by a delivery script and displayed by the…

  • CVE-2006-5516Oct 26, 2006
    Wikini
    Wikini
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in actions/usersettings.php in WikiNi before 0.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) email parameters to wakka.php.

  • CVE-2006-5517Oct 26, 2006
    Rhode Island
    Open Meetings Filing System
    risk 0.04cvss —epss 0.09

    Multiple PHP remote file inclusion vulnerabilities in Rhode Island Open Meetings Filing Application (OMFA) allow remote attackers to execute arbitrary PHP code via a URL in the PROJECT_ROOT parameter to (1) editmeetings/session.php, (2) email/session.php, (3)…

  • CVE-2006-5518Oct 26, 2006
    Christopher Fowler
    Rssonate
    risk 0.04cvss —epss 0.10

    Multiple PHP remote file inclusion vulnerabilities in Christopher Fowler (Rhode Island) RSSonate allow remote attackers to execute arbitrary PHP code via a URL in the PROJECT_ROOT parameter to (1) xml2rss.php, (2) config_local.php, (3) rssonate.php, and (4) sql2xml.php in…

  • CVE-2006-5519Oct 26, 2006
    Mambweather
    Mambweather
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in Savant2/Savant2_Plugin_options.php in the MambWeather 1.8.1 and earlier component for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-5520Oct 26, 2006
    Deltascripts
    PHP Classifieds
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in functions.php in DeltaScripts PHP Classifieds 7.1 allows remote attackers to execute arbitrary PHP code via a URL in the set_path parameter.

  • CVE-2006-5521Oct 26, 2006
    Net DNS
    Net DNS
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in DNS/RR.php in Net_DNS 0.03 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpdns_basedir parameter.

  • CVE-2006-5522Oct 26, 2006
    Johannes Erdfelt
    Kawf
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Johannes Erdfelt Kawf 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the config parameter in (1) main.php or (2) user/account/main.php.

  • CVE-2006-5523Oct 26, 2006
    Ez Ticket
    Ez Ticket
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in common.php in EZ-Ticket 0.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the ezt_root_path parameter.

  • CVE-2006-5524Oct 26, 2006
    Phplist
    Phplist
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: This issue might overlap CVE-2006-5321.

  • CVE-2006-5525Oct 26, 2006
    PHP-Nuke
    PHP Nuke
    risk 0.03cvss —epss 0.01

    Incomplete blacklist vulnerability in mainfile.php in PHP-Nuke 7.9 and earlier allows remote attackers to conduct SQL injection attacks via (1) "/**/UNION " or (2) " UNION/**/" sequences, which are not rejected by the protection mechanism, as demonstrated by a SQL injection via…

  • CVE-2006-5382Oct 25, 2006
    risk 0.00cvss —epss 0.02

    3Com Switch SS3 4400 switches, firmware 5.11, 6.00 and 6.10 and earlier, allow remote attackers to read the SNMP Read-Write Community string and conduct unauthorized actions via unspecified "normally restricted management packets on the device" that cause the community string to…

  • CVE-2006-5501Oct 25, 2006
    AOL
    Aol
    risk 0.00cvss —epss 0.03

    Buffer overflow in the AOL.PicDownloadCtrl.1 ActiveX control (YGPPicDownload.dll) 9.2.3.0 in America Online (AOL) 9.0 Security Edition allows remote attackers to execute arbitrary code via the downloadFileDirectory property, a different vulnerability than CVE-2006-5502.

  • CVE-2006-5502Oct 25, 2006
    AOL
    Aol
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in the AOL.PicDownloadCtrl.1 ActiveX control (YGPPicDownload.dll) 9.2.3.0 in America Online (AOL) 9.0 Security Edition allows remote attackers to execute arbitrary code via the AddPictureNoAlbum method, a different vulnerability than CVE-2006-5501.

  • CVE-2006-5503Oct 25, 2006
    Simple Machines
    Simple Machines Forum
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Simple Machines Forum (SMF) 1.1 RC2 allows remote attackers to inject arbitrary web script or HTML via the action parameter.

  • CVE-2006-5504Oct 25, 2006
    Simple Machines
    Simple Machines Forum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Simple Machines Forum (SMF) allows remote attackers to inject arbitrary web script or HTML via a base64 encoded params value in the action parameter.

  • CVE-2006-5505Oct 25, 2006
    2bgal
    2bgal
    risk 0.03cvss —epss 0.03

    Multiple PHP file inclusion vulnerabilities in 2BGal 3.0 allow remote attackers to execute arbitrary PHP code via the lang parameter to (1) admin/configuration.inc.php, (2) admin/creer_album.inc.php, (3) admin/changepwd.php.inc, and unspecified other files. NOTE: the provenance…

  • CVE-2006-5506Oct 25, 2006
    Wiclear
    Wiclear
    risk 0.04cvss —epss 0.10

    Multiple PHP remote file inclusion vulnerabilities in WiClear 0.10 allow remote attackers to execute arbitrary PHP code via the path parameter in (1) inc/prepend.inc.php, (2) inc/lib/boxes.lib.php, (3) inc/lib/tools.lib.php, (4) tools/trackback/index.php, and (5)…

  • CVE-2006-5507Oct 25, 2006
    Der Dirigent
    Der Dirigent
    risk 0.00cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in Der Dirigent (DeDi) 1.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the cfg_dedi[dedi_path] parameter in (1) find.php, (2) insert_line.php, (3) fullscreen.php, (4) changecase.php, (5) insert_link.php,…

  • CVE-2006-5508Oct 25, 2006
    Woltlab
    Burning Book
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in addentry.php in WoltLab Burning Book 1.1.2 allow remote attackers to execute arbitrary SQL commands via (1) the n parameter and (2) the User-Agent HTTP header.