VYPR

CVEs

344,040 total · page 6472 of 6,881

AllCriticalHighKEV
  • CVE-2006-5455Oct 23, 2006
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in editversions.cgi in Bugzilla before 2.22.1 and 2.23.x before 2.23.3 allows user-assisted remote attackers to create, modify, or delete arbitrary bug reports via a crafted URL.

  • CVE-2006-5456Oct 23, 2006
    ImageMagick
    Imagemagick
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in GraphicsMagick before 1.1.7 and ImageMagick 6.0.7 allow user-assisted attackers to cause a denial of service and possibly execute arbitrary code via (1) a DCM image that is not properly handled by the ReadDCMImage function in coders/dcm.c, or (2) a…

  • CVE-2006-5457Oct 23, 2006
    Casinosoft
    Casino Script
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the registration form in Casinosoft Casino Script (Masvet) 3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) surname field.

  • CVE-2006-5458Oct 23, 2006
    Hinton Design
    Phpht Topsites
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in common.php in Hinton Design phpht Topsites allows remote attackers to execute arbitrary PHP code via a URL in the phpht_real_path parameter.

  • CVE-2006-5459Oct 23, 2006
    Alex
    Downloadengine
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1.4.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) $_ENGINE[eng_dir] and possibly (2) spaw_root parameters in admin/includes/spaw/spaw_script.js.php, and the (3)…

  • CVE-2006-5460Oct 23, 2006
    Hinton Design
    Phpht Topsites
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in Hinton Design phpht Topsites allow remote attackers to execute arbitrary PHP code via a URL in the phpht_real_path parameter to (1) index.php, (2) certain other scripts in the top-level directory, and (3) certain scripts in…

  • CVE-2006-5442Oct 21, 2006
    Viewvc
    Viewvc
    risk 0.00cvss —epss 0.02

    ViewVC 1.0.2 and earlier does not specify a charset in its HTTP headers or HTML documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks that inject arbitrary UTF-7 encoded JavaScript code via a view.

  • CVE-2006-5432Oct 20, 2006
    PhpPowerCards
    phpPowerCards
    risk 0.03cvss —epss 0.03

    Multiple direct static code injection vulnerabilities in db/txt.inc.php in phpPowerCards 2.10, when register_globals is enabled, allow remote attackers to create or overwrite arbitrary files via the (1) email[to], (2) email[from], (3) name[to], (4) name[from], (5) picture, (6)…

  • CVE-2006-5433Oct 20, 2006
    Timm Maass
    Alice CMS
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in modules/guestbook/index.php in ALiCE-CMS 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[local_root] parameter.

  • CVE-2006-5434Oct 20, 2006
    P News
    P News
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in p-news.php in P-News 1.16 and 1.17 allows remote attackers to execute arbitrary PHP code via a URL in the pn_lang parameter.

  • CVE-2006-5435Oct 20, 2006
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in groupcp.php in phpBB 2.0.10 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. NOTE: CVE and the vendor dispute this vulnerability because $phpbb_root_path is defined before use

  • CVE-2006-5436Oct 20, 2006
    Freefaq
    Freefaq
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in FreeFAQ 1.0.e allows remote attackers to execute arbitrary PHP code via a URL in the faqpath parameter.

  • CVE-2006-5437Oct 20, 2006
    Phpadsnew
    Phpadsnew
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in upgrade.php in phpAdsNew 2.0.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the phpAds_config[language] parameter. NOTE: this issue could not be reproduced by a third party

  • CVE-2006-5438Oct 20, 2006
    Comdev
    Forum
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in adminfoot.php in Comdev Forum 4.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2006-5439Oct 20, 2006
    Comdev
    Comdev Misc Tools
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in adminfoot.php in Comdev Misc Tools 4.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter. NOTE: the provenance of this information is unknown; the details…

  • CVE-2006-5440Oct 20, 2006
    Comdev
    Comdev Form Designer
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in adminfoot.php in Comdev Form Designer 4.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter. NOTE: the provenance of this information is unknown; the…

  • CVE-2006-5441Oct 20, 2006
    Comdev
    Comdev Web Blogger
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in adminfoot.php in Comdev Web Blogger 4.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter. NOTE: the provenance of this information is unknown; the details…

  • CVE-2006-4926Oct 20, 2006
    Kaspersky Lab
    Internet Security
    risk 0.03cvss —epss 0.01

    The NDIS-TDI Hooking Engine, as used in the (1) KLICK (KLICK.SYS) and (2) KLIN (KLIN.SYS) device drivers 2.0.0.281 for in Kaspersky Labs Anti-Virus 6.0.0.303 and other Anti-Virus and Internet Security products, allows local users to execute arbitrary code via crafted Irp…

  • CVE-2006-5423Oct 20, 2006
    Lou Portail
    Lou Portail
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in admin/admin_module.php in Lou Portail 1.4.1, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the g_admin_rep parameter. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2006-5424Oct 20, 2006
    Justsystems
    Ichitaro
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Justsystem Ichitaro 2006, 2006 trial version, and Government 2006 allows remote attackers to execute arbitrary code via a modified document, possibly because of a buffer overflow, a different vulnerability than CVE-2006-4326.

  • CVE-2006-5425Oct 20, 2006
    Xorp
    Extensible Open Router Platform
    risk 0.00cvss —epss 0.02

    XORP (eXtensible Open Router Platform) 1.2 and 1.3 allows remote attackers to cause a denial of service (application crash) via an Open Shortest Path First (OSPF) Link State Advertisement (LSA) with an invalid LSA length field.

  • CVE-2006-5426Oct 20, 2006
    LoCal
    Calendar System
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in lib/lcUser.php in LoCal Calendar System 1.1 remote attackers to execute arbitrary PHP code via a URL in the LIBDIR parameter.

  • CVE-2006-5427Oct 20, 2006
    PHP Amx
    PHP Amx
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in plugins/main.php in Php AMX 0.9.0, when register_globals is enabled or magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plug_path parameter.

  • CVE-2006-5428Oct 20, 2006
    Cerberus
    Helpdesk
    risk 0.03cvss —epss 0.03

    rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a display_get_requesters operation, which allows remote attackers to bypass the GUI login and obtain sensitive information (ticket data) via a direct request.

  • CVE-2006-5429Oct 20, 2006
    Brim Project
    Brim
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Barry Nauta BRIM 1.2.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the renderer parameter in template.tpl.php in (1) templates/barrel/, (2) templates/sidebar/, (3) templates/text-only, (4)…

  • CVE-2006-5430Oct 20, 2006
    Db Central
    CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the search functionality in db-central (dbc) Enterprise CMS and db-central CMS allows remote attackers to inject arbitrary web script or HTML via the needle parameter. NOTE: the provenance of this information is unknown; the details…

  • CVE-2006-5431Oct 20, 2006
    Phpoutsourcing
    Zorum
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in gorum/dbproperty.php in PHPOutsourcing Zorum 3.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the appDirName parameter.

  • CVE-2006-5408Oct 20, 2006
    Highwall
    Enterprise
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the wireless IDS management interface for Highwall Enterprise and Highwall Endpoint 4.0.2.11045 allow remote attackers to inject arbitrary HTML or web script via unspecified vectors.

  • CVE-2006-5409Oct 20, 2006
    Highwall
    Enterprise
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the wireless IDS management interface for Highwall Enterprise and Highwall Endpoint 4.0.2.11045 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2006-5410Oct 20, 2006
    Boonex
    Dolphin
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in templates/tmpl_dfl/scripts/index.php in BoonEx Dolphin 5.2 allows remote attackers to execute arbitrary PHP code via a URL in the dir[inc] parameter. NOTE: it is possible that this issue overlaps CVE-2006-4189.

  • CVE-2006-5411Oct 20, 2006
    Free Web Publishing System
    FreeWPS
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in upload.php for Free Web Publishing System (FreeWPS), possibly 2.11 and earlier, allows remote attackers to upload and execute arbitrary PHP programs.

  • CVE-2006-5412Oct 20, 2006
    Myiosoft
    Easynews
    risk 0.03cvss —epss 0.04

    admin.php in PHP Outburst Easynews 4.4.1 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication, and gain the ability to execute arbitrary code, via the en_login_id parameter.

  • CVE-2006-5413Oct 20, 2006
    Supermod
    Supermod
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in SuperMod 3.0.0 for YABB (YaBBSM) allow remote attackers to execute arbitrary PHP code via a URL in the sourcedir parameter to (1) Offline.php, (2) Sources/Admin.php, (3) Sources/Offline.php, or (4) content/portalshow.php.

  • CVE-2006-5414Oct 20, 2006
    Brim Project
    Brim
    risk 0.00cvss —epss 0.01

    Barry Nauta BRIM before 1.2.1 allows remote authenticated users to read information from other users via a modified URL.

  • CVE-2006-5415Oct 20, 2006
    News Defilante Horizontale
    News Defilante Horizontale
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/functions_newshr.php in the News Defilante Horizontale 4.1.1 and earlier module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5416Oct 20, 2006
    F5, Inc.
    FirePass 1000 SSL VPN
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in my.acctab.php3 in F5 Networks FirePass 1000 SSL VPN 5.5, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the sid parameter.

  • CVE-2006-5417Oct 20, 2006
    McAfee
    Virusscan
    risk 0.00cvss —epss 0.02

    McAfee Network Agent (mcnasvc.exe) 1.0.178.0, as used by multiple McAfee products possibly including Internet Security Suite, Personal Firewall Plus, and VirusScan, allows remote attackers to cause a denial of service (agent crash) via a long packet, possibly because of an…

  • CVE-2006-5418Oct 20, 2006
    PhpBB
    Searchindexer
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in archive/archive_topic.php in pbpbb archive for search engines (SearchIndexer) (aka phpBBSEI) for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5419Oct 20, 2006
    University Of Glasgow
    Specimen Image Database
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in client.php in University of Glasgow Specimen Image Database (SID), when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter.

  • CVE-2006-5420Oct 20, 2006
    Kerio Technologies
    Winroute Firewall
    risk 0.00cvss —epss 0.03

    Kerio WinRoute Firewall 6.2.2 and earlier allows remote attackers to cause a denial of service (crash) via malformed DNS responses.

  • CVE-2006-5421Oct 20, 2006
    Wsn Forum
    Wsn Forum
    risk 0.03cvss —epss 0.03

    WSN Forum 1.3.4 and earlier allows remote attackers to execute arbitrary PHP code via a modified pathname in the pathtoconfig parameter that points to an avatar image that contains PHP code, which is then accessed from prestart.php. NOTE: this issue has been labeled remote file…

  • CVE-2006-5422Oct 20, 2006
    Lodel
    Lodel CMS
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in calcul-page.php in Lodel (patchlodel) 0.7.3 allows remote attackers to execute arbitrary PHP code via a URL in the home parameter.

  • CVE-2006-5403Oct 19, 2006
    Symantec
    Norton Antivirus
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in an ActiveX control used in Symantec Automated Support Assistant, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute…

  • CVE-2006-5404Oct 19, 2006
    Symantec
    Norton Antivirus
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in an ActiveX control used in Symantec Automated Support Assistant, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, allows user-assisted remote attackers to obtain sensitive information via unspecified vectors.

  • CVE-2006-5405Oct 19, 2006
    Toshiba
    Bluetooth Wireless Device Driver
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Toshiba Bluetooth wireless device driver 3.x and 4 through 4.00.35, as used in multiple products, allows physically proximate attackers to cause a denial of service (crash), corrupt memory, and possibly execute arbitrary code via crafted Bluetooth…

  • CVE-2006-5406Oct 19, 2006
    Passgo
    Defender
    risk 0.00cvss —epss 0.00

    Passgo Defender 5.2 creates the application directory with insecure permissions (Everyone/Full Control), which allows local users to read and modify sensitive files. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

  • CVE-2006-5407Oct 19, 2006
    Osticket
    Osticket
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in open_form.php in osTicket allows remote attackers to execute arbitrary PHP code via a URL in the include_dir parameter.

  • CVE-2006-5398Oct 18, 2006
    Simplog
    Simplog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in comments.php in Simplog 0.9.3.1 allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2006-5399Oct 18, 2006
    Phprecipebook
    Phprecipebook
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in classes/Import_MM.class.php in PHPRecipeBook 2.36, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the g_rb_basedir parameter.

  • CVE-2006-5400Oct 18, 2006
    Cyberbrau
    Cyberbrau
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in forum/track.php in CyberBrau 0.9.4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.