VYPR

CVEs

344,038 total · page 6479 of 6,881

AllCriticalHighKEV
  • CVE-2006-5130Oct 3, 2006
    Jaf CMS
    Jaf CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) url, (3) title, and (4) about parameters in a forum post. NOTE: the provenance of this…

  • CVE-2006-5131Oct 3, 2006
    Jaf CMS
    Jaf CMS
    risk 0.00cvss —epss 0.02

    module/shout/jafshout.php (aka the shoutbox) in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allows remote attackers to execute arbitrary code within sections bounded by "<?php" and "?>", possibly due to a static code injection vulnerability involving admin/data_inc.php.

  • CVE-2006-5132Oct 3, 2006
    Phpmyagenda
    Phpmyagenda
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in phpMyAgenda 3.0 Final and earlier allow remote attackers to execute arbitrary PHP code via a URL in the rootagenda parameter to (1) agendaplace.php3, (2) agendaplace2.php3, (3) infoevent.php3, and (4) agenda2.php3, different…

  • CVE-2006-5133Oct 3, 2006
    Guildftpd
    Guildftpd
    risk 0.00cvss —epss 0.03

    Buffer overflow in GuildFTPd 0.999.13 allows remote attackers to have an unknown impact, possibly code execution related to input containing "globbing chars."

  • CVE-2006-5134Oct 3, 2006
    MERCURY
    SiteScope
    risk 0.00cvss —epss 0.01

    Mercury SiteScope 8.2 (8.1.2.0) allows remote authenticated users to cause a denial of service (loss of connectivity to the classic interface) via attempted HTML injection into the "new monitor description" field.

  • CVE-2006-5135Oct 3, 2006
    A Blog
    A Blog
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in A-Blog 2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) open_box, (2) middle_box, and (3) close_box parameters in (a) sources/myaccount.php; the (4) navigation_end parameter in (b)…

  • CVE-2006-5136Oct 3, 2006
    Groupee
    UBB.threads
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in ubbt.inc.php in Groupee UBB.threads 6.5.1.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[thispath] or (2) GLOBALS[configdir] parameter.

  • CVE-2006-5137Oct 3, 2006
    Groupee
    UBB.threads
    risk 0.03cvss —epss 0.02

    Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to (1) inject PHP code via a theme[] array parameter to admin/doedittheme.php, which is injected into includes/theme.inc.php; (2) inject PHP code via a config[] array…

  • CVE-2006-5138Oct 3, 2006
    Groupee
    UBB.threads
    risk 0.00cvss —epss 0.01

    Groupee UBB.threads 6.5.1.1 allows remote attackers to obtain sensitive information via a direct request for cron/php/subscriptions.php, which reveals the path in an error message.

  • CVE-2006-5139Oct 3, 2006
    Mkportal
    Mkportal
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in MkPortal allows remote attackers to corrupt web site content, and possibly have other impact, via a certain long Message that affects "Tables," related to the Urlobox.

  • CVE-2006-5140Oct 3, 2006
    Lappy512
    PHP Krazy Image Host Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in display.php in Lappy512 PHP Krazy Image Host Script (phpkimagehost) 0.7a allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-5141Oct 3, 2006
    Kevin A. Gordon
    Open Geo Targeting
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in script.php in Kevin A. Gordon Open Geo Targeting (aka geotarget) allows remote attackers to execute arbitrary PHP code via a URL in the anp_path parameter. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2006-4387Oct 3, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Apple Mac OS X 10.4 through 10.4.7, when the administrator clears the "Allow user to administer this computer" checkbox in System Preferences for a user, does not remove the user's account from the appserveradm or appserverusr groups, which still allows the user to manage…

  • CVE-2006-4390Oct 3, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    CFNetwork in Apple Mac OS X 10.4 through 10.4.7 and 10.3.9 allows remote SSL sites to appear as trusted sites by using encryption without authentication, which can cause the lock icon in Safari to be displayed even when the site's identity cannot be trusted.

  • CVE-2006-4391Oct 3, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.06

    Buffer overflow in Apple ImageIO on Apple Mac OS X 10.4 through 10.4.7 allows remote attackers to execute arbitrary code via a malformed JPEG2000 image.

  • CVE-2006-4392Oct 3, 2006
    Apple Inc.
    Mac OS X
    risk 0.03cvss —epss 0.01

    The Mach kernel, as used in operating systems including (1) Mac OS X 10.4 through 10.4.7 and (2) OpenStep before 4.2, allows local users to gain privileges via a parent process that forces an exception in a setuid child and uses Mach exception ports to modify the child's thread…

  • CVE-2006-4393Oct 3, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in LoginWindow in Apple Mac OS X 10.4 through 10.4.7, when Fast User Switching is enabled, allows local users to gain access to Kerberos tickets of other users.

  • CVE-2006-4394Oct 3, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    A logic error in LoginWindow in Apple Mac OS X 10.4 through 10.4.7, allows network accounts without GUIds to bypass service access controls and log into the system using loginwindow via unknown vectors.

  • CVE-2006-4395Oct 3, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in QuickDraw Manager in Apple Mac OS X 10.3.9 and 10.4 through 10.4.7 allows context-dependent attackers to cause a denial of service ("memory corruption" and crash) via a crafted PICT image that is not properly handled by a certain "unsupported…

  • CVE-2006-4397Oct 3, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Unchecked error condition in LoginWindow in Apple Mac OS X 10.4 through 10.4.7 prevents Kerberos tickets from being destroyed if a user does not successfully log on to a network account from the login window, which might allow later users to gain access to the original user's…

  • CVE-2006-4399Oct 3, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    User interface inconsistency in Workgroup Manager in Apple Mac OS X 10.4 through 10.4.7 appears to allow administrators to change the authentication type from crypt to ShadowHash passwords for accounts in a NetInfo parent, when such an operation is not actually supported, which…

  • CVE-2006-5098Sep 29, 2006
    Dokuwiki
    Dokuwiki
    risk 0.00cvss —epss 0.02

    lib/exec/fetch.php in DokuWiki before 2006-03-09e allows remote attackers to cause a denial of service (CPU consumption) via large w and h parameters, when resizing an image.

  • CVE-2006-5099Sep 29, 2006
    Dokuwiki
    Dokuwiki
    risk 0.00cvss —epss 0.02

    lib/exec/fetch.php in DokuWiki before 2006-03-09e, when conf[imconvert] is configured to use ImageMagick, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) w and (2) h parameters, which are not filtered when invoking convert.

  • CVE-2006-5093Sep 29, 2006
    Tagit
    Tagboard
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in index.php in Tagmin Control Center in TagIt! Tagboard 2.1.B Build 2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

  • CVE-2006-5094Sep 29, 2006
    Phpbb Xs
    Phpbb Xs
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/functions_kb.php in the phpBB XS 2 (Spain version) allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter, a different vector than CVE-2006-4780 or CVE-2006-4893.

  • CVE-2006-5095Sep 29, 2006
    Myphotos
    Myphotos
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in index.php in MyPhotos 0.1.3b beta allows remote attackers to execute arbitrary PHP code via the includesdir parameter. NOTE: this issue is disputed by CVE on 20060927, since the includesdir is defined before being used when the product…

  • CVE-2006-5096Sep 29, 2006
    Joomla
    VirtueMart
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in VirtueMart (formerly known as mambo-phpShop) Joomla! eCommerce Edition CMS 1.0.11, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the Itemid parameter in a (1)…

  • CVE-2006-5097Sep 29, 2006
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in net2ftp, possibly 0.1 through 0.62, allows remote attackers to execute arbitrary PHP code via a URL in the application_rootdir parameter. NOTE: this issue has been disputed by a third party researcher, CVE, and the vendor. …

  • CVE-2006-5087Sep 29, 2006
    Evobb
    Evobb
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in evoBB 0.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path parameter in (1) track.php or (2) connect.php.

  • CVE-2006-5088Sep 29, 2006
    Phpheaven
    Phpmychat
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in connected_users.lib.php3 in phpHeaven phpMyChat 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the ChatPath parameter.

  • CVE-2006-5089Sep 29, 2006
    Jim Plush
    My Bic
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in mybic_server.php in Jim Plush My-BIC 0.6.5 allows remote attackers to execute arbitrary PHP code via a URL in the file parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party…

  • CVE-2006-5090Sep 29, 2006
    Phoenix Evolution
    Phoenix Evolution CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Phoenix Evolution CMS (PECMS) allow remote attackers to inject arbitrary web script or HTML via the (1) mod or (2) action parameters in index.php, or the (3) pageid parameter in modules/pageedit/index.php. NOTE: the…

  • CVE-2006-5091Sep 29, 2006
    Microfocus
    HP-UX B.11.11 and B.11.23 CIFS Server (Samba)
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in HP-UX B.11.11 and B.11.23 CIFS Server (Samba) allows local users to gain privileges or obtain "unauthorized access" via unspecified vectors.

  • CVE-2006-5092Sep 29, 2006
    A Blog
    A Blog
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in navigation/menu.php in A-Blog 2 allows remote attackers to execute arbitrary PHP code via a URL in the navigation_start parameter.

  • CVE-2006-4247Sep 29, 2006
    Plone (software)
    Plone
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."

  • CVE-2006-4925Sep 29, 2006
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.15

    packet.c in ssh in OpenSSH allows remote attackers to cause a denial of service (crash) by sending an invalid protocol sequence with USERAUTH_SUCCESS before NEWKEYS, which causes newkeys[mode] to be NULL.

  • CVE-2006-5073Sep 29, 2006
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Sun Solaris 8, 9 and 10 allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets, a different vulnerability than CVE-2006-5013.

  • CVE-2006-5074Sep 29, 2006
    PHP Invoice
    PHP Invoice
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in home.php in PHP Invoice 2.2 allows remote attackers to inject arbitrary web script or HTML via the alert parameter.

  • CVE-2006-5075Sep 29, 2006
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.03

    The Kernel SSL Proxy service (svc:/network/ssl/proxy) in Sun Solaris 10 before 20060926 allows remote attackers to cause a denial of service (system crash) via unspecified vectors related to an SSL client.

  • CVE-2006-5076Sep 29, 2006
    Openconcept
    Back End CMS
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in OpenConcept Back-End 0.4.5 allow remote attackers to execute arbitrary PHP code via a URL in the includes_path parameter in (1) admin/index.php, (2) Facts.php, or (3) search.php.

  • CVE-2006-5077Sep 29, 2006
    Minerva
    Minerva
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin/admin_topic_action_logging.php in Chris Smith Minerva Build 238 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5078Sep 29, 2006
    Polaring
    Polaring
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in view/general.php in Kristian Niemi Polaring 00.04.03 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _SESSION[dirMain] parameter.

  • CVE-2006-5079Sep 29, 2006
    Matt Humphrey
    paBugs
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in class.mysql.php in Matt Humphrey paBugs 2.0 Beta 3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path_to_bt_dir parameter.

  • CVE-2006-5080Sep 29, 2006
    Movabletype
    Movable Type Enterprise
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the search function in Six Apart Movable Type 3.3 to 3.32, and Movable Type Enterprise 1.01 and 1.02, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-5081Sep 29, 2006
    Jl Webworks
    Quickblogger
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in acc.php in QuickBlogger (QB) 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

  • CVE-2006-5082Sep 29, 2006
    Sugarcrm
    Sugar Suite
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Sugar Suite Open Source (SugarCRM) before 4.2.1 Patch C (20060917) has unspecified impact, related to code execution, and unspecified attack vectors.

  • CVE-2006-5083Sep 29, 2006
    Integrated MODs
    IM Portal
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in includes/functions_portal.php in Integrated MODs (IM) Portal 1.2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-5084Sep 29, 2006
    Skype Technologies
    Skype
    risk 0.04cvss —epss 0.16

    Format string vulnerability in the NSRunAlertPanel function in eBay Skype for Mac 1.5.*.79 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed Skype URL, as originally reported to involve a null…

  • CVE-2006-5085Sep 29, 2006
    Pixel Motion
    Blog
    risk 0.07cvss —epss 0.44

    Static code injection vulnerability in config.php in Blog Pixel Motion 2.1.1 allows remote attackers to execute arbitrary PHP code via the nom_blog parameter, which is injected into include/variables.php.

  • CVE-2006-5086Sep 29, 2006
    Pixel Motion
    Blog
    risk 0.03cvss —epss 0.01

    Blog Pixel Motion 2.1.1 allows remote attackers to change the username and password for the admin user via a direct request to insere_base.php with modified (1) login and (2) pass parameters. NOTE: this issue was claimed to be SQL injection by the original researcher, but it is…