VYPR

CVEs

344,038 total · page 6478 of 6,881

AllCriticalHighKEV
  • CVE-2006-5148Oct 5, 2006
    Forum82
    Forum82
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Forum82 2.5.2b and earlier allow remote attackers to execute arbitrary PHP code via a URL in the repertorylevel parameter including scripts in /forum/ including (1) search.php, (2) message.php, (3) member.php, (4) mail.php,…

  • CVE-2006-5149Oct 5, 2006
    Openbiblio
    Openbiblio
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in OpenBiblio before 0.5.2 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the page parameter to shared/help.php or (2) the tab parameter to shared/header.php.

  • CVE-2006-5150Oct 5, 2006
    Openbiblio
    Openbiblio
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the reports system in OpenBiblio before 0.5.2 allows remote attackers with report privileges to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2006-5151Oct 5, 2006
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in HP Ignite-UX server before C.6.9.150 for HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers to "gain root access" via unspecified vectors.

  • CVE-2006-5152Oct 5, 2006
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL that is returned in a large HTTP 404 error message without an explicit charset, a related issue to CVE-2006-0032.

  • CVE-2006-5153Oct 5, 2006
    Kerio Technologies
    Personal Firewall
    risk 0.00cvss —epss 0.02

    The (1) fwdrv.sys and (2) khips.sys drivers in Sunbelt Kerio Personal Firewall 4.3.268 and earlier do not validate arguments passed through to SSDT functions, including NtCreateFile, NtDeleteFile, NtLoadDriver, NtMapViewOfSection, NtOpenFile, and NtSetInformationFile, which…

  • CVE-2006-5154Oct 5, 2006
    Deluxebb
    Deluxebb
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in cp/sig.php in DeluxeBB 1.09 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the templatefolder parameter.

  • CVE-2006-5155Oct 5, 2006
    Videodb
    Videodb
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in core/pdf.php in VideoDB 2.2.1 and earlier allows remote attackers to execute arbitrary PHP code via the config[pdf_module] parameter.

  • CVE-2006-5156Oct 5, 2006
    McAfee
    Epolicy Orchestrator
    risk 0.09cvss —epss 0.72

    Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot before 1.1.1.126 allows remote attackers to execute arbitrary code via a request to /spipe/pkg/ with a long source header.

  • CVE-2006-5157Oct 5, 2006
    Trend Micro
    Officescan
    risk 0.00cvss —epss 0.06

    Format string vulnerability in the ActiveX control (ATXCONSOLE.OCX) in TrendMicro OfficeScan Corporate Edition (OSCE) before 7.3 Patch 1 allows remote attackers to execute arbitrary code via format string identifiers in the "Management Console's Remote Client Install name…

  • CVE-2006-5158HigOct 5, 2006
    Linux
    Kernel
    risk 0.49cvss 7.5epss 0.03

    The nlmclnt_mark_reclaim in clntlock.c in NFS lockd in Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (process crash) and deny access to NFS exports via unspecified vectors that trigger a kernel oops (null dereference) and a deadlock.

  • CVE-2006-5159Oct 5, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in Mozilla Firefox allows remote attackers to execute arbitrary code via unspecified vectors involving JavaScript. NOTE: the vendor and original researchers have released a follow-up comment disputing the severity of this issue, in which the…

  • CVE-2006-5160HigOct 5, 2006
    Mozilla Corporation
    Firefox
    risk 0.53cvss 8.1epss 0.02

    Multiple unspecified vulnerabilities in Mozilla Firefox have unspecified vectors and impact, as claimed during ToorCon 2006. NOTE: the vendor and original researchers have released a follow-up comment disputing this issue, in which one researcher states that "I have no…

  • CVE-2006-5161Oct 5, 2006
    IBM
    Client Security Password Manager
    risk 0.00cvss —epss 0.01

    IBM Client Security Password Manager stores and distributes saved passwords based upon the title of a website, which allows remote attackers to obtain username and password credentials by changing the title of an HTML page.

  • CVE-2006-5162Oct 5, 2006
    Microsoft
    Internet Explorer
    risk 0.06cvss —epss 0.35

    wininet.dll in Microsoft Internet Explorer 6.0 SP2 and earlier allows remote attackers to cause a denial of service (unhandled exception and crash) via a long Content-Type header, which triggers a stack overflow.

  • CVE-2006-5163Oct 5, 2006
    IBM
    Informix Dynamic Server
    risk 0.00cvss —epss 0.00

    IBM Informix Dynamic Server 10.UC3RC1 Trial for Linux and possibly other versions creates /tmp/installserver.txt with insecure permissions, which allows local users to append data to arbitrary files via a symlink attack.

  • CVE-2006-5164Oct 5, 2006
    Sum Effect Software
    Digishop
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in cart.php in Sum Effect Software digiSHOP 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) sortBy or (2) search parameters.

  • CVE-2006-5165Oct 5, 2006
    Skrypty
    Ppa Gallery
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in inc/functions.inc.php in Skrypty PPA Gallery 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the config[ppa_root_path] parameter.

  • CVE-2006-5166Oct 5, 2006
    PHP Web Scripts
    Easy Banner Free
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in functions.php in PHP Web Scripts Easy Banner Free allows remote attackers to execute arbitrary PHP code via a URL in the s[phppath] parameter.

  • CVE-2006-5167Oct 5, 2006
    Basilix
    BasiliX
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in BasiliX 1.1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) BSX_LIBDIR parameter in scripts in /files/ including (a) abook.php3, (b) compose-attach.php3, (c) compose-menu.php3, (d)…

  • CVE-2006-5100Oct 3, 2006
    Netwin
    Webnews
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in parse/parser.php in WEB//NEWS (aka webnews) 1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the WN_BASEDIR parameter.

  • CVE-2006-5101Oct 3, 2006
    Comdev
    Comdev CSV Importer
    risk 0.00cvss —epss 0.04

    PHP remote file inclusion vulnerability in include.php in Comdev CSV Importer 3.1 and possibly 4.1, as used in (1) Comdev Contact Form 3.1, (2) Comdev Customer Helpdesk 3.1, (3) Comdev Events Calendar 3.1, (4) Comdev FAQ Support 3.1, (5) Comdev Guestbook 3.1, (6) Comdev Links…

  • CVE-2006-5102Oct 3, 2006
    Sebastian Baumann And Philipp Wolfer
    Newswriter SW
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in include/editfunc.inc.php in Sebastian Baumann and Philipp Wolfer Newswriter SW 1.42 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the NWCONF_SYSTEM[server_path] parameter.

  • CVE-2006-5103Oct 3, 2006
    Bbsnew
    Bbsnew
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in admin/index2.php in bbsNew 2.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the "right" parameter.

  • CVE-2006-5104Oct 3, 2006
    Jelsoft
    Vbulletin
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in global.php in Jelsoft vBulletin 2.x allows remote attackers to execute arbitrary SQL commands via the templatesused parameter.

  • CVE-2006-5105Oct 3, 2006
    Syntaxcms
    SyntaxCMS
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in SyntaxCMS 1.1.1 through 1.3 allow remote attackers to execute arbitrary PHP code via a URL in (1) the init_path parameter to admin/testing/tests/0030_init_syntax.php, or (2) an unspecified parameter to…

  • CVE-2006-5106Oct 3, 2006
    Facileforms
    Facileforms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in FacileForms before 1.4.7 for Mambo and Joomla!, when either register_globals or RG_EMULATION is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-5107Oct 3, 2006
    Cubecart
    Cubecart
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to execute arbitrary SQL commands via (1) the user_name parameter in admin/forgot_pass.php, (2) the order_id parameter in view_order.php, (3) the view_doc parameter in view_doc.php, and (4)…

  • CVE-2006-5108Oct 3, 2006
    Cubecart
    Cubecart
    risk 0.03cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to inject arbitrary web script or HTML via the order_id parameter in (1) admin/print_order.php and (2) view_order.php; the (3) site_url and (4) la_search_home parameters and…

  • CVE-2006-5109Oct 3, 2006
    Cubecart
    Cubecart
    risk 0.00cvss —epss 0.01

    Devellion CubeCart 2.0.x allows remote attackers to obtain sensitive information via a direct request for (1) link_navi.php or (2) spotlight.php, which reveals the path in various error messages. NOTE: the information.php, language.php, list_docs.php, popular_prod.php,…

  • CVE-2006-5110Oct 3, 2006
    PHP Invoice
    PHP Invoice
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in home.php in PHP Invoice 2.2 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different vector than CVE-2006-5074. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2006-5111Oct 3, 2006
    Libksba Library
    Libksba Library
    risk 0.00cvss —epss 0.02

    The libksba library 0.9.12 and possibly other versions, as used by gpgsm in the newpg package on SUSE LINUX, allows attackers to cause a denial of service (application crash) via a malformed X.509 certificate in a signature.

  • CVE-2006-5112Oct 3, 2006
    Intervations
    Navicopa Web Server
    risk 0.08cvss —epss 0.67

    Buffer overflow in InterVations NaviCOPA Web Server 2.01 allows remote attackers to execute arbitrary code via a long HTTP GET request.

  • CVE-2006-5113Oct 3, 2006
    Yuuki Yoshizawa
    Exporia
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in common.php in Yuuki Yoshizawa Exporia 0.3.0 allows remote attackers to include and execute local files via a .. (dot dot) in the lan parameter to includes.php. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2006-5114Oct 3, 2006
    SAP
    Internet Transaction Server
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in wgate in SAP Internet Transaction Server (ITS) 6.1 and 6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) ~urlmime or (2) ~command parameter, different vectors than CVE-2003-0749.

  • CVE-2006-5115Oct 3, 2006
    Kgb Project
    Kgb
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in kgcall.php in KGB 1.87 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the engine parameter, as demonstrated by uploading a file containing PHP code with an image/jpeg content type, and then…

  • CVE-2006-5116Oct 3, 2006
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables…

  • CVE-2006-5117Oct 3, 2006
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    phpMyAdmin before 2.9.1-rc1 has a libraries directory under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via direct requests for certain files.

  • CVE-2006-5118Oct 3, 2006
    Phpselect
    Web Development Division
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php3 in the PDD package for PHPSelect Web Development Division allows remote attackers to execute arbitrary PHP code via a URL in the Application_Root parameter.

  • CVE-2006-5119Oct 3, 2006
    Zen Cart
    ZenCart
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Zen Cart 1.3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_name or (2) admin_pass parameter in (a) admin/login.php, or the (3) admin_email parameter in (b) admin/password_forgotten.php.

  • CVE-2006-5120Oct 3, 2006
    Scott Metoyer
    Red Mombin
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Scott Metoyer Red Mombin 0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) index.php and (2) process_login.php.

  • CVE-2006-5121Oct 3, 2006
    Postnuke
    Postnuke
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in modules/Downloads/admin.php in the Admin section of PostNuke 0.762 allows remote attackers to execute arbitrary SQL commands via the hits parameter.

  • CVE-2006-5122Oct 3, 2006
    MERCURY
    SiteScope
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Mercury SiteScope 8.2 (8.1.2.0) allow remote authenticated users to inject arbitrary web script or HTML via (1) "any field create name field" except "create new group name" or (2) any description field.

  • CVE-2006-5123Oct 3, 2006
    Phprojekt
    Phprojekt
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Albrecht Guenther PHProjekt 5.1.x before 5.1.2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lib_path or (2) lang_path parameter in unspecified files, related to code changes intended to fix…

  • CVE-2006-5124Oct 3, 2006
    Joshua Muheim
    Phpmywebmin
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Joshua Muheim phpMyWebmin 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) target and (2) action parameters in window.php, and possibly the (3) target parameter in home.php.

  • CVE-2006-5125Oct 3, 2006
    Joshua Muheim
    Phpmywebmin
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in window.php, possibly used by home.php, in Joshua Muheim phpMyWebmin 1.0 allows remote attackers to obtain sensitive information via a directory name in the target parameter, which triggers a directory listing through the opendir function.

  • CVE-2006-5126Oct 3, 2006
    Powerportal
    Powerportal
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in John Himmelman (aka DaRk2k1) PowerPortal 1.3a allows remote attackers to execute arbitrary PHP code via a URL in the file_name[] parameter.

  • CVE-2006-5127Oct 3, 2006
    Bartels Schoene
    Conpresso
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Bartels Schoene ConPresso before 4.0.5a allow remote attackers to inject arbitrary web script or HTML via (1) the nr parameter in detail.php, (2) the msg parameter in db_mysql.inc.php, and (3) the pos parameter in index.php.

  • CVE-2006-5128Oct 3, 2006
    Bartels Schoene
    Conpresso
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Bartels Schoene ConPresso before 4.0.5a allows remote attackers to execute arbitrary SQL commands via the nr parameter.

  • CVE-2006-5129Oct 3, 2006
    Jaf CMS
    Jaf CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) the message parameter, and possibly other parameters, in module/shout/jafshout.php (aka the shoutbox);…