VYPR

CVEs

344,038 total · page 6480 of 6,881

AllCriticalHighKEV
  • CVE-2006-2937Sep 28, 2006
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.11

    OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d allows remote attackers to cause a denial of service (infinite loop and memory consumption) via malformed ASN.1 structures that trigger an improperly handled error condition.

  • CVE-2006-2940Sep 28, 2006
    OpenSSL Project
    OpenSSL
    risk 0.00cvss —epss 0.05

    OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) "public exponent" or (2) "public modulus" values in X.509 certificates that require extra time to…

  • CVE-2006-3738Sep 28, 2006
    OpenSSL Project
    OpenSSL
    risk 0.04cvss —epss 0.49

    Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers.

  • CVE-2006-4343Sep 28, 2006
    OpenSSL Project
    OpenSSL
    risk 0.04cvss —epss 0.17

    The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference.

  • CVE-2006-5053Sep 28, 2006
    Web News
    Web News
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in webnews/template.php in Web-News 1.6.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the content_page parameter.

  • CVE-2006-5054Sep 28, 2006
    Iyzi Forum
    Iyzi Forum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in uye/uye_ayrinti.asp in iyzi Forum 1 Beta 2 and earlier allows remote attackers to execute arbitrary SQL commands via the uye_nu parameter.

  • CVE-2006-5055Sep 28, 2006
    Forum One
    Syntaxcms
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin/testing/tests/0004_init_urls.php in syntaxCMS 1.1.1 through 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the init_path parameter.

  • CVE-2006-5056Sep 28, 2006
    Opial
    Opial Audio Video Download Management
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Opial Audio/Video Download Management 1.0 allows remote attackers to inject arbitrary web script or HTML via the destination parameter in the Login view.

  • CVE-2006-5057Sep 28, 2006
    Ktools
    Photostore
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Ktools.net PhotoStore allow remote attackers to inject arbitrary web script or HTML via the (1) gid parameter in details.php, or the (2) photogid parameter in view_photog.php.

  • CVE-2006-5058Sep 28, 2006
    Activision
    Call Of Duty
    risk 0.04cvss —epss 0.10

    Buffer overflow in (1) Call of Duty 1.5b and earlier, (2) Call of Duty United Offensive 1.51b and earlier, and (3) Call of Duty 2 1.3 and earlier allows remote attackers to execute arbitrary code via a long map argument to the "callvote map" command.

  • CVE-2006-5059Sep 28, 2006
    Wired Community Software
    Wwwthreads
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in WWWthreads 5.4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the Cat parameter to (1) dosearch.php, (2) postlist.php, (3) showmembers.php, (4) faq_english.php, (5) online.php, (6) login.php,…

  • CVE-2006-5060Sep 28, 2006
    Jamroom
    Jamroom
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in login.php in Jamroom 3.0.16 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the forgot parameter in the forgot mode.

  • CVE-2006-5061Sep 28, 2006
    Advanced Clan Script
    Advanced Clan Script
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in mcf.php in Advanced-Clan-Script (AVCX) 3.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the content parameter.

  • CVE-2006-5062Sep 28, 2006
    Pblang
    Pblang
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in templates/pb/language/lang_nl.php in PBLang (PBL) 4.66z and earlier allows remote attackers to execute arbitrary PHP code via a URL in the temppath parameter.

  • CVE-2006-5063Sep 28, 2006
    Elog
    Elog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Elog 2.6.1 allows remote attackers to inject arbitrary web script or HTML by editing log entries in HTML mode.

  • CVE-2006-5064Sep 28, 2006
    Birdblog
    Birdblog
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in BirdBlog 1.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) entryid parameter in comment.php, (2) page parameter in index.php, or the (3) uid parameter in user.php. NOTE: the…

  • CVE-2006-5065Sep 28, 2006
    Zoomstats
    Zoomstats
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in libs/dbmax/mysql.php in ZoomStats 1.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[lib][db][path] parameter.

  • CVE-2006-5066Sep 28, 2006
    Danphpsupport
    Danphpsupport
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in DanPHPSupport 0.5, and other versions before 1.0, allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in index.php or the (2) do parameter in admin.php.

  • CVE-2006-5067Sep 28, 2006
    PHP System Administration Toolkit
    PHP System Administration Toolkit
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in loader.php in PHP System Administration Toolkit (PHPSaTK) allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[config] parameter. NOTE: this issue is disputed by CVE; analysis shows that the GLOBALS[config]…

  • CVE-2006-5068Sep 28, 2006
    Brudaswen
    Brudanews
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in admin/index.php in Brudaswen (1) BrudaNews 1.1 and earlier and (2) BrudaGB 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the o parameter.

  • CVE-2006-5069Sep 28, 2006
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in class.tx_indexedsearch.php in the Indexed Search 2.9.0 extension for Typo3 before 4.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2006-5070Sep 28, 2006
    Facestones
    Facestones
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in fsl2/objects/fs_form_links.php in faceStones Personal 2.0.42 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[fsinit][objpath] parameter.

  • CVE-2006-5071Sep 28, 2006
    Eyeos Project
    Eyeos
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in eyeOS before 0.9.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) eyeNav and (2) system/baixar.php.

  • CVE-2006-5016Sep 27, 2006
    E Vision
    E Vision CMS
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in admin/x_image.php in Szava Gyula and Csaba Tamas e-Vision CMS, probably 1.0, allows remote attackers to upload arbitrary files to the /imagebank directory.

  • CVE-2006-5017Sep 27, 2006
    E Vision
    E Vision CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/all_users.php in Szava Gyula and Csaba Tamas e-Vision CMS, probably 1.0, allows remote attackers to execute arbitrary SQL commands via the from parameter.

  • CVE-2006-5018Sep 27, 2006
    Contentkeeper Technologies
    Contentkeeper
    risk 0.00cvss —epss 0.02

    ContentKeeper 123.25 and earlier places passwords in cleartext in an INPUT element in cgi-bin/ck/changepw.cgi, which allows remote authenticated users to obtain passwords via this URI.

  • CVE-2006-5019Sep 27, 2006
    Birddog
    Mini
    risk 0.03cvss —epss 0.04

    Google Mini 4.4.102.M.36 and earlier allows remote attackers to obtain sensitive information via a direct request for /search with an invalid client parameter, which reveals the path in an error message.

  • CVE-2006-5020Sep 27, 2006
    Solidstate
    Solidstate
    risk 0.04cvss —epss 0.11

    Multiple PHP remote file inclusion vulnerabilities in SolidState 0.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the base_path parameter in manager/pages/ scripts including (1) AccountsPage.class.php, (2) AddInvoicePage.class.php, (3)…

  • CVE-2006-5021CriSep 27, 2006
    Redblog
    Redblog
    risk 0.67cvss 9.8epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in redgun RedBLoG 0.5 allow remote attackers to execute arbitrary PHP code via a URL in (1) the root parameter in imgen.php, and the root_path parameter in (2) admin/config.php, (3) common.php, and (4) admin/index.php. NOTE:…

  • CVE-2006-5022Sep 27, 2006
    Joshua Wilson
    pNews System
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in includes/global.php in Joshua Wilson pNews System 1.1.0 (aka PowerNews) allows remote attackers to execute arbitrary PHP code via a URL in the nbs parameter.

  • CVE-2006-5023Sep 27, 2006
    Yigit Aybuga
    Xweblog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in kategori.asp in xweblog 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the kategori parameter.

  • CVE-2006-5024CriSep 27, 2006
    Paisterist
    Simple HTTP Scanner
    risk 0.64cvss 9.8epss 0.02

    Multiple unspecified vulnerabilities in Paisterist Simple HTTP Scanner (sHTTPScanner) before 0.4 have unknown impact and attack vectors.

  • CVE-2006-5025Sep 27, 2006
    Paisterist
    Simple HTTP Scanner
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Paisterist Simple HTTP Scanner (sHTTPScanner) before 0.2 have unknown impact and attack vectors.

  • CVE-2006-5026Sep 27, 2006
    Paisterist
    Simple HTTP Scanner
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Paisterist Simple HTTP Scanner (sHTTPScanner) before 0.3 have unknown impact and attack vectors.

  • CVE-2006-5027Sep 27, 2006
    Jeroen Vennegoor
    Jevoncms
    risk 0.00cvss —epss 0.01

    Jeroen Vennegoor JevonCMS, possibly pre alpha, allows remote attackers to obtain sensitive information via a direct request for php/main/phplib files (1) db_msql.inc, (2) db_mssql.inc, (3) db_mysql.inc, (4) db_oci8.inc, (5) db_odbc.inc, (6) db_oracle.inc, and (7) db_pgsql.inc;…

  • CVE-2006-5028Sep 27, 2006
    Swsoft
    Plesk
    risk 0.07cvss —epss 0.46

    Directory traversal vulnerability in filemanager/filemanager.php in SWsoft Plesk 7.5 Reload and Plesk 7.6 for Microsoft Windows allows remote attackers to list arbitrary directories via a ../ (dot dot slash) in the file parameter in a chdir action.

  • CVE-2006-5029Sep 27, 2006
    Woltlab
    Burning Board
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in thread.php in WoltLab Burning Board (wBB) 2.3.x allows remote attackers to obtain the version numbers of PHP, MySQL, and wBB via the page parameter. NOTE: this issue might be a forced SQL error. Also, the original report was disputed by a third…

  • CVE-2006-5030Sep 27, 2006
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in modules/messages/index.php in exV2 2.0.4.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the sort parameter.

  • CVE-2006-5031Sep 27, 2006
    Cakephp
    Cakephp
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with "%00" and a .js filename.

  • CVE-2006-5032Sep 27, 2006
    Phpartenaire
    Phpartenaire
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in dix.php3 in PHPartenaire 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the url_phpartenaire parameter.

  • CVE-2006-5033Sep 27, 2006
    Paul Smith Computer Services
    Vcap
    risk 0.03cvss —epss 0.04

    Unspecified vulnerability in StoresAndCalendarsList.cgi in Paul Smith Computer Services vCAP 1.9.0 Beta and earlier allows remote attackers to cause a denial of service via the session parameter, possibly related to format string specifiers or malformed URL encoding.

  • CVE-2006-5034Sep 27, 2006
    Paul Smith Computer Services
    Vcap
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in Paul Smith Computer Services vCAP 1.9.0 Beta and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

  • CVE-2006-5035Sep 27, 2006
    Paul Smith Computer Services
    Vcap
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Paul Smith Computer Services vCAP 1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the statusmsg parameter in RegisterPage.cgi or (2) a URI corresponding to a nonexistent file. NOTE: the provenance…

  • CVE-2006-5036Sep 27, 2006
    Mysource
    Mysource
    risk 0.00cvss —epss 0.01

    MySource Matrix 3.8 and earlier, and MySource 2.x, allow remote attackers to use the application as an HTTP proxy server via the sq_remote_page_url parameter to access arbitrary sites with the server's IP address and conduct cross-site scripting (XSS) attacks. NOTE: the…

  • CVE-2006-5037Sep 27, 2006
    Mysource
    Mysource
    risk 0.00cvss —epss 0.01

    MySource Matrix after 3.8 allows remote attackers to use the application as an HTTP proxy server via a MIME encoded URL in the sq_content_src parameter to access arbitrary sites with the server's IP address and conduct cross-site scripting (XSS) attacks. NOTE: the researcher…

  • CVE-2006-5038Sep 27, 2006
    Fiwin
    SS28S
    risk 0.00cvss —epss 0.02

    The FiWin SS28S WiFi VoIP SIP/Skype Phone, firmware version 01_02_07, has a hard-coded username and password, which allows remote attackers to gain administrative access via telnet.

  • CVE-2006-5039Sep 27, 2006
    Joomla
    Events
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Events 1.3 beta module (com_events) for Joomla! has unspecified impact and attack vectors.

  • CVE-2006-5040Sep 27, 2006
    Joomla
    SEF404x (com_sef)
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in SEF404x (com_sef) for Joomla! has unspecified impact and attack vectors.

  • CVE-2006-5041Sep 27, 2006
    Joomla
    Hot Properties
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Hot Properties (possibly com_hotproperties) 0.97 and earlier for Joomla! has unspecified impact and attack vectors.

  • CVE-2006-5042Sep 27, 2006
    Joomla
    Mosmedia
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in mosMedia (com_mosmedia) 1.0.8 and earlier for Joomla! has unspecified impact and attack vectors.