VYPR

CVEs

344,038 total · page 6476 of 6,881

AllCriticalHighKEV
  • CVE-2006-5249Oct 12, 2006
    Tagit
    Tagboard
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in tagmin/delTagUser.php in TagIt! Tagboard 2.1.B Build 2 (tagit2b) allows remote attackers to execute arbitrary PHP code via a URL in the configpath parameter.

  • CVE-2006-5250Oct 12, 2006
    Blueshoes
    BlueShoes
    risk 0.04cvss —epss 0.07

    PHP remote file inclusion vulnerability in lib/googlesearch/GoogleSearch.php in BlueShoes 4.6_public and earlier allows remote attackers to execute arbitrary PHP code via a URL in the APP[path][lib] parameter, a different vector than CVE-2006-2864.

  • CVE-2006-5233Oct 11, 2006
    Polycom
    Soundpoint IP 301
    risk 0.00cvss —epss 0.02

    Polycom SoundPoint IP 301 VoIP Desktop Phone, firmware version 1.4.1.0040, allows remote attackers to cause a denial of service (reboot) via (1) a long URL sent to the HTTP daemon and (2) unspecified manipulations as demonstrated by the Nessus http_fingerprinting_hmap.nasl…

  • CVE-2006-5234Oct 11, 2006
    Phpwebsite
    Phpwebsite
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in phpWebSite 0.10.2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPWS_SOURCE_DIR parameter in (1) init.php, (2) users.php, (3) Cookie.php, (4) forms.php, (5) Groups.php, (6) ModSetting.php, (7)…

  • CVE-2006-5235Oct 11, 2006
    Dimension Of Phpbb
    Dimension Of Phpbb
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in includes/functions_kb.php in Dimension of phpBB 0.2.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2006-5236Oct 11, 2006
    4homepages
    4images
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in search.php in 4images 1.7.x allows remote authenticated users to execute arbitrary SQL commands via the search_user parameter.

  • CVE-2006-5230Oct 11, 2006
    Freeforum
    Freeforum
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in forum.php in FreeForum 0.9.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the fpath parameter.

  • CVE-2006-5231Oct 11, 2006
    Grandstream
    Gxp 2000
    risk 0.00cvss —epss 0.02

    Grandstream GXP-2000 VoIP Desktop Phone, firmware version 1.1.0.5, allows remote attackers to cause a denial of service (hang or reboot) via a large amount of ASCII data sent to port (1) 5060/UDP, (2) 5062/UDP, (3) 5064/UDP, (4) 5066/UDP, (5) 9876/UDP, or (6) 26789/UDP.

  • CVE-2006-5232Oct 11, 2006
    Isearch
    Isearch
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in iSearch 2.16 allow remote attackers to execute arbitrary PHP code via a URL in the isearch_path parameter in (1) index.php, (2) viewcache.php, (3) sitemap.php, (4) isearch.inc.php, (5) google_sitemap.php, (6) stats.php, or…

  • CVE-2006-3887Oct 10, 2006
    AOL
    Ygp Screensaver Activex Control
    risk 0.00cvss —epss 0.04

    Buffer overflow in AOL You've Got Pictures (YGP) Screensaver ActiveX control allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2006-3888Oct 10, 2006
    AOL
    Ygp Pic Downloader Activex Control
    risk 0.00cvss —epss 0.06

    Buffer overflow in AOL You've Got Pictures (YGP) Pic Downloader YGPPDownload ActiveX control (AOL.PicDownloadCtrl.1, YGPPicDownload.dll), as used in America Online 9.0 Security Edition, allows remote attackers to execute arbitrary code via a long argument to the SetAlbumName…

  • CVE-2006-5229Oct 10, 2006
    OpenSSL Project
    OpenSSL
    risk 0.07cvss —epss 0.54

    OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as…

  • CVE-2006-2387Oct 10, 2006
    Microsoft
    Excel
    risk 0.01cvss —epss 0.12

    Unspecified vulnerability in Microsoft Excel 2000, 2002, 2003, 2004 for Mac, v.X for Mac, Excel Viewer 2003, and Microsoft Works Suite 2004 through 2006 allows user-assisted attackers to execute arbitrary code via a crafted DATETIME record in an XLS file, a different…

  • CVE-2006-3434Oct 10, 2006
    Microsoft
    Office
    risk 0.02cvss —epss 0.29

    Unspecified vulnerability in Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac allows remote user-assisted attackers to execute arbitrary code via a crafted string that triggers memory corruption.

  • CVE-2006-3647Oct 10, 2006
    Microsoft
    Word
    risk 0.02cvss —epss 0.26

    Integer overflow in Microsoft Word 2000, 2002, 2003, 2004 for Mac, and v.X for Mac allows remote user-assisted attackers to execute arbitrary code via a crafted string in a Word document, which overflows a 16-bit integer length value, aka "Memmove Code Execution," a different…

  • CVE-2006-3650Oct 10, 2006
    Microsoft
    Office
    risk 0.03cvss —epss 0.36

    Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac do not properly parse the length of a chart record, which allows remote user-assisted attackers to execute arbitrary code via a Word document with an embedded malformed chart record that triggers an overwrite of…

  • CVE-2006-3651Oct 10, 2006
    Microsoft
    Word
    risk 0.02cvss —epss 0.31

    Unspecified vulnerability in Microsoft Word 2000, 2002, and Office 2003 allows remote user-assisted attackers to execute arbitrary code via a crafted mail merge file, a different vulnerability than CVE-2006-3647 and CVE-2006-4693.

  • CVE-2006-3864Oct 10, 2006
    Microsoft
    Office
    risk 0.03cvss —epss 0.32

    Unspecified vulnerability in mso.dll in Microsoft Office 2000, XP, and 2003, and Microsoft PowerPoint 2000, XP, and 2003, allows remote user-assisted attackers to execute arbitrary code via a malformed record in a (1) .DOC, (2) .PPT, or (3) .XLS file that triggers memory…

  • CVE-2006-3867Oct 10, 2006
    Microsoft
    Excel
    risk 0.01cvss —epss 0.09

    Unspecified vulnerability in Microsoft Excel 2000, 2002, 2003, 2004 for Mac, v.X for Mac, and Excel Viewer 2003 allows user-assisted attackers to execute arbitrary code via a crafted Lotus 1-2-3 file, a different vulnerability than CVE-2006-2387 and CVE-2006-3875.

  • CVE-2006-3868Oct 10, 2006
    Microsoft
    Office
    risk 0.02cvss —epss 0.23

    Unspecified vulnerability in Microsoft Office XP and 2003 allows remote user-assisted attackers to execute arbitrary code via a malformed Smart Tag.

  • CVE-2006-3875Oct 10, 2006
    Microsoft
    Excel
    risk 0.01cvss —epss 0.09

    Unspecified vulnerability in Microsoft Excel 2000, 2002, 2003, 2004 for Mac, v.X for Mac, and Excel Viewer 2003 allows user-assisted attackers to execute arbitrary code via a crafted COLINFO record in an XLS file, a different vulnerability than CVE-2006-2387 and CVE-2006-3867.

  • CVE-2006-3877Oct 10, 2006
    Microsoft
    Office
    risk 0.01cvss —epss 0.12

    Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allows user-assisted attackers to execute arbitrary code via an unspecified "crafted file," a different vulnerability than CVE-2006-3435,…

  • CVE-2006-3978Oct 10, 2006
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in a Verity third party library, as used on Adobe ColdFusion MX 7 through MX 7.0.2 and possibly other products, allows local users to execute arbitrary code via unknown attack vectors.

  • CVE-2006-4685Oct 10, 2006
    Microsoft
    XML Core Services
    risk 0.02cvss —epss 0.20

    The XMLHTTP ActiveX control in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 does not properly handle HTTP server-side redirects, which allows remote user-assisted attackers to access content from other domains.

  • CVE-2006-4686Oct 10, 2006
    Microsoft
    XML Core Services
    risk 0.02cvss —epss 0.29

    Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted Web page.

  • CVE-2006-4692Oct 10, 2006
    Microsoft
    Windows Xp
    risk 0.02cvss —epss 0.27

    Argument injection vulnerability in the Windows Object Packager (packager.exe) in Microsoft Windows XP SP1 and SP2 and Server 2003 SP1 and earlier allows remote user-assisted attackers to execute arbitrary commands via a crafted file with a "/" (slash) character in the filename…

  • CVE-2006-4693Oct 10, 2006
    Microsoft
    Word
    risk 0.02cvss —epss 0.22

    Unspecified vulnerability in Microsoft Word 2004 for Mac and v.X for Mac allows remote user-assisted attackers to execute arbitrary code via a crafted string in a Word file, a different issue than CVE-2006-3647 and CVE-2006-3651.

  • CVE-2006-4696Oct 10, 2006
    Microsoft
    Windows 2000
    risk 0.03cvss —epss 0.43

    Unspecified vulnerability in the Server service in Microsoft Windows 2000 SP4, Server 2003 SP1 and earlier, and XP SP2 and earlier allows remote attackers to execute arbitrary code via a crafted packet, aka "SMB Rename Vulnerability."

  • CVE-2006-5199Oct 10, 2006
    Adobe Inc.
    Contribute
    risk 0.00cvss —epss 0.01

    Adobe Contribute Publishing Server leaks the administrator password in logs that are created during product installation, which allows local users to gain privileges to the server.

  • CVE-2006-5200Oct 10, 2006
    Adobe Inc.
    Breeze Licensed Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Adobe Breeze 5 Licensed Server and Breeze 5.1 Licensed Server allows attackers to read arbitrary files via unknown vectors related to "URL parsing."

  • CVE-2006-3435Oct 10, 2006
    Microsoft
    Office
    risk 0.03cvss —epss 0.36

    PowerPoint in Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac does not properly parse the slide notes field in a document, which allows remote user-assisted attackers to execute arbitrary code via crafted data in this field, which triggers an erroneous object…

  • CVE-2006-3436Oct 10, 2006
    Microsoft
    .net Framework
    risk 0.03cvss —epss 0.38

    Cross-site scripting (XSS) vulnerability in Microsoft .NET Framework 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "ASP.NET controls that set the AutoPostBack property to true".

  • CVE-2006-3876Oct 10, 2006
    Microsoft
    Office
    risk 0.01cvss —epss 0.11

    Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allows user-assisted attackers to execute arbitrary code via a crafted Data record in a PPT file, a different vulnerability than CVE-2006-3435…

  • CVE-2006-5221Oct 10, 2006
    Cahier De Textes
    Cahier De Textes
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Cahier de texte 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) matiere_ID parameter in lire.php or the (2) classe_ID parameter in lire_a_faire.php.

  • CVE-2006-5222Oct 10, 2006
    Dimension Of Phpbb
    Dimension Of Phpbb
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Dimension of phpBB 0.2.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) includes/themen_portal_mitte.php or (2) includes/logger_engine.php.

  • CVE-2006-5223Oct 10, 2006
    Nivisec
    User Viewed Posts Tracker
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in includes/functions_user_viewed_posts.php in the Nivisec User Viewed Posts Tracker module 1.0 and earlier for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5224Oct 10, 2006
    Dimitri Seitz
    Security Suite IP Logger
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/logger_engine.php in Dimitri Seitz Security Suite IP Logger 1.0.0 in dwingmods for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5225Oct 10, 2006
    Aai Portal
    Aaiportal
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in AAIportal before 1.4.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2006-5226Oct 10, 2006
    Freenews
    Freenews
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in moteur/moteur.php in Prologin.fr Freenews 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter.

  • CVE-2006-5227Oct 10, 2006
    Torrentflux
    Torrentflux
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin.php in TorrentFlux 2.1 allows remote attackers to inject arbitrary web script or HTML via (1) the $user_agent variable, probably obtained from the User-Agent HTTP header, and possibly (2) the $ip_resolved variable.

  • CVE-2006-5228Oct 10, 2006
    Rob Hensley
    Ackertodo
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the Google Gadget login.php (gadget/login.php) in Rob Hensley ackerTodo 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) up_login, (2) up_pass, or (3) up_num_tasks parameters.

  • CVE-2006-4812Oct 10, 2006
    PHP
    PHP
    risk 0.04cvss —epss 0.15

    Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function…

  • CVE-2006-4927Oct 10, 2006
    Symantec
    NAVENG
    risk 0.03cvss —epss 0.02

    The (a) NAVENG (NAVENG.SYS) and (b) NAVEX15 (NAVEX15.SYS) device drivers 20061.3.0.12 and later, as used in Symantec AntiVirus and security products, allow local users to gain privileges by overwriting critical system addresses using a crafted Irp to the IOCTL functions (1)…

  • CVE-2006-4980Oct 10, 2006
    Python (programming language)
    Python
    risk 0.00cvss —epss 0.05

    Buffer overflow in the repr function in Python 2.3 through 2.6 before 20060822 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via crafted wide character UTF-32/UCS-4 strings to certain scripts.

  • CVE-2006-4997HigOct 10, 2006
    Linux
    Kernel
    risk 0.49cvss 7.5epss 0.05

    The clip_mkip function in net/atm/clip.c of the ATM subsystem in Linux kernel allows remote attackers to cause a denial of service (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (freed pointer dereference).

  • CVE-2006-5072Oct 10, 2006
    Mono
    Mono
    risk 0.00cvss —epss 0.00

    The System.CodeDom.Compiler classes in Novell Mono create temporary files with insecure permissions, which allows local users to overwrite arbitrary files or execute arbitrary code via a symlink attack.

  • CVE-2006-5142Oct 10, 2006
    Ca
    Brightstor ARCserve Backup
    risk 0.01cvss —epss 0.12

    Stack-based buffer overflow in CA BrightStor ARCserve Backup R11.5 client and server allows remote attackers to execute arbitrary code via long messages to the CheyenneDS Mailslot.

  • CVE-2006-5143Oct 10, 2006
    Ca
    Brightstor ARCserve Backup
    risk 0.09cvss —epss 0.78

    Multiple buffer overflows in CA BrightStor ARCserve Backup r11.5 SP1 and earlier, r11.1, and 9.01; BrightStor ARCserve Backup for Windows r11; BrightStor Enterprise Backup 10.5; Server Protection Suite r2; and Business Protection Suite r2 allow remote attackers to execute…

  • CVE-2006-5168Oct 10, 2006
    Simon Brown
    Pebble
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the search functionality in Simon Brown Pebble 2.0.0 RC1 and RC2 allows remote attackers to inject arbitrary web script or HTML via the query string.

  • CVE-2006-5169Oct 10, 2006
    Powerportal
    Powerportal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in John Himmelman (aka DaRk2k1) PowerPortal 1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to registering a user. NOTE: the provenance of this information is unknown; the…