VYPR

CVEs

344,036 total · page 6484 of 6,881

AllCriticalHighKEV
  • CVE-2006-4866Sep 19, 2006
    Apple Inc.
    OS X
    risk 0.03cvss —epss 0.01

    Buffer overflow in kextload in Apple OS X, as used by TDIXSupport in Roxio Toast Titanium and possibly other products, allows local users to execute arbitrary code via a long extension argument.

  • CVE-2006-4867Sep 19, 2006
    Gnuturk
    GNUTurk
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in mods.php in GNUTurk 2G and earlier allows remote attackers to execute arbitrary SQL commands via the t_id parameter when the go parameter is "Forum."

  • CVE-2006-4868Sep 19, 2006
    Microsoft
    Internet Explorer
    risk 0.08cvss —epss 0.62

    Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP2, and possibly other versions, allows remote attackers to execute arbitrary code via a Vector Markup Language (VML) file with a…

  • CVE-2006-4869Sep 19, 2006
    Phpunity
    phpunity.postcard
    risk 0.04cvss —epss 0.06

    PHP remote file inclusion vulnerability in phpunity-postcard.php in phpunity.postcard allows remote attackers to execute arbitrary PHP code via a URL in the gallery_path parameter.

  • CVE-2006-4870Sep 19, 2006
    AeDating
    aeDating
    risk 0.04cvss —epss 0.10

    Multiple PHP remote file inclusion vulnerabilities in AEDating 4.1, and possibly earlier versions, allow remote attackers to execute arbitrary PHP code via a URL in the dir[inc] parameter in (1) inc/design.inc.php or (2) inc/admin_design.inc.php.

  • CVE-2006-4246Sep 19, 2006
    Usermin
    Usermin
    risk 0.00cvss —epss 0.01

    Usermin before 1.220 (20060629) allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user.

  • CVE-2006-4684Sep 19, 2006
    Zope
    Zope
    risk 0.00cvss —epss 0.02

    The docutils module in Zope (Zope2) 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText (reST) markup, which allows remote attackers to read arbitrary files via a csv_table directive, a different vulnerability than CVE-2006-3458.

  • CVE-2006-4855Sep 19, 2006
    Symantec
    Pcanywhere
    risk 0.03cvss —epss 0.01

    The \Device\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.0.33, and other versions of Norton Personal Firewall, Internet Security, AntiVirus, SystemWorks, Symantec Client Security SCS 1.x, 2.x, 3.0, and 3.1, Symantec AntiVirus Corporate Edition SAVCE 8.x, 9.x,…

  • CVE-2006-4856Sep 19, 2006
    Roller Weblogger
    Roller Weblogger
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Roller WebLogger 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) email, or (3) url parameters; (4) certain content parameters in the preview method; or (5) the q parameter in (a)…

  • CVE-2006-4857Sep 19, 2006
    Clicktech
    Clickblog
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in default.asp (aka the login page) in ClickTech ClickBlog 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) form_codeword (aka the Password field) parameters.

  • CVE-2006-4858Sep 19, 2006
    Joomla
    Mambo
    risk 0.04cvss —epss 0.07

    PHP remote file inclusion vulnerability in install.serverstat.php in the Serverstat (com_serverstat) 0.4.4 and earlier component for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-4859Sep 19, 2006
    Limbo CMS
    Limbo CMS
    risk 0.04cvss —epss 0.07

    Unrestricted file upload vulnerability in contact.html.php in the Contact (com_contact) component in Limbo (aka Lite Mambo) CMS 1.0.4.2L and earlier allows remote attackers to upload PHP code to the images/contact folder via a filename with a double extension in the…

  • CVE-2006-4860Sep 19, 2006
    Limbo CMS
    Limbo CMS
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in (1) index.php, (2) minixml.inc.php, (3) doc.inc.php, (4) element.inc.php, (5) node.inc.php, (6) treecomp.inc.php, (7) forum.html.php, (8) forum.php, (9) antihack.php, (10) content.php, (11) initglobals.php, and (12) imanager.php in Limbo…

  • CVE-2006-4861Sep 19, 2006
    Mohammed Mehdi Panjwani
    Complain Center
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in loginprocess.asp in Mohammed Mehdi Panjwani Complain Center 1 allows remote attackers to execute arbitrary SQL commands via the (1) TxtUser (aka Username) and (2) TxtPass (aka Password) parameters in login.asp.

  • CVE-2006-4862Sep 19, 2006
    Easypagecms
    Easypage
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in default.aspx in easypage allows remote attackers to execute arbitrary SQL commands via the srch parameter in the Search page.

  • CVE-2006-4863Sep 19, 2006
    Marc Cagninacci
    Mclinkscounter
    risk 0.00cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Marc Cagninacci mcLinksCounter 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the langfile parameter in (1) login.php, (2) stats.php, (3) detail.php, or (4) erase.php. NOTE: CVE and a third party…

  • CVE-2006-4864Sep 19, 2006
    Enthusiast
    Enthusiast
    risk 0.00cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in All Enthusiast ReviewPost 2.5 allows remote attackers to execute arbitrary PHP code via a URL in the RP_PATH parameter.

  • CVE-2006-4865Sep 19, 2006
    Phpquiz
    Phpquiz
    risk 0.03cvss —epss 0.05

    Walter Beschmout PhpQuiz allows remote attackers to obtain sensitive information via a direct request to cfgphpquiz/install.php and other unspecified vectors.

  • CVE-2006-4844Sep 19, 2006
    Claroline
    Claroline
    risk 0.04cvss —epss 0.10

    PHP remote file inclusion vulnerability in inc/claro_init_local.inc.php in Claroline 1.7.7 and earlier, as used in Dokeos and possibly other products, allows remote attackers to execute arbitrary PHP code via a URL in the extAuthSource[newUser] parameter.

  • CVE-2006-4845Sep 19, 2006
    TeamCal
    TeamCal Pro
    risk 0.04cvss —epss 0.07

    PHP remote file inclusion vulnerability in includes/footer.html.inc.php in TeamCal Pro 2.8.001 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the tc_config[app_root] parameter.

  • CVE-2006-4846Sep 19, 2006
    Citrix Systems
    Access Gateway
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Citrix Access Gateway with Advanced Access Control (AAC) 4.2 before 20060914, when AAC is configured to use LDAP authentication, allows remote attackers to bypass authentication via unknown vectors.

  • CVE-2006-4847Sep 19, 2006
    Ipswitch, Inc.
    Ws FTP Server
    risk 0.10cvss —epss 0.85

    Multiple buffer overflows in Ipswitch WS_FTP Server 5.05 before Hotfix 1 allow remote authenticated users to execute arbitrary code via long (1) XCRC, (2) XSHA1, or (3) XMD5 commands.

  • CVE-2006-4848Sep 19, 2006
    Hitweb
    Hitweb
    risk 0.04cvss —epss 0.06

    Multiple PHP remote file inclusion vulnerabilities in Brian Fraval Hitweb 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REP_CLASS parameter to (1) index.php, (2) arbo.php, (3) framepoint.php, (4) genpage.php, (5) lienvalider.php, (6) appreciation.php,…

  • CVE-2006-4849Sep 19, 2006
    Mobilepublisherphp
    Mobilepublisherphp
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in header.php in MobilePublisherPHP 1.5 RC2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.

  • CVE-2006-4850Sep 19, 2006
    Bolinos
    Bolinos
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in system/_b/contentFiles/gBIndex.php in BolinOS 4.5.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the gBRootPath parameter.

  • CVE-2006-4851Sep 19, 2006
    Bolinos
    Bolinos
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in system/_b/contentFiles/gBHTMLEditor.php in BolinOS 4.5.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the gBRootPath parameter. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2006-4852Sep 19, 2006
    Quadcomm
    Q Shop
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in browse.asp in QuadComm Q-Shop 3.5 allows remote attackers to execute arbitrary SQL commands via the OrderBy parameter.

  • CVE-2006-4853Sep 19, 2006
    Haberx
    Haberx
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in kategorix.asp in Haberx 1.02 through 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter in kategorihaberx.asp.

  • CVE-2006-4821Sep 15, 2006
    Drupal
    Userreview
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Drupal 4.7 Userreview module before 1.19 2006/09/12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-4822Sep 15, 2006
    Emusoft
    Emucms
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in eMuSOFT emuCMS 0.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) query or (2) page parameters.

  • CVE-2006-4823Sep 15, 2006
    Reamday Enterprises
    Magic News Pro
    risk 0.04cvss —epss 0.09

    PHP remote file inclusion vulnerability in scripts/news_page.php in Reamday Enterprises Magic News Pro 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the script_path parameter.

  • CVE-2006-4824Sep 15, 2006
    Quicksilver Forums
    Quicksilver Forums
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in lib/activeutil.php in Quicksilver Forums (QSF) 1.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the set[include_path] parameter.

  • CVE-2006-4825Sep 15, 2006
    Softcomplex
    PHP Event Calendar
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in cl_files/index.php in SoftComplex PHP Event Calendar 1.5.1, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) ti, (2) bi, or (3) cbgi parameters.

  • CVE-2006-4826Sep 15, 2006
    Shadowed Portal
    Portal
    risk 0.04cvss —epss 0.10

    PHP remote file inclusion vulnerability in bottom.php in Shadowed Portal 5.599 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.

  • CVE-2006-4827Sep 15, 2006
    Vmist
    Downstat
    risk 0.04cvss —epss 0.06

    Multiple PHP remote file inclusion vulnerabilities in Vmist Downstat 1.8 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the art parameter to (1) admin.php, (2) chart.php, (3) modes.php, or (4) stats.php.

  • CVE-2006-4828Sep 15, 2006
    Photopost
    Photopost PHP Pro
    risk 0.04cvss —epss 0.06

    PHP remote file inclusion vulnerability in zipndownload.php in PhotoPost 4.0 through 4.6 allows remote attackers to execute arbitrary PHP code via a URL in the PP_PATH parameter.

  • CVE-2006-4829Sep 15, 2006
    Blojsom
    Blojsom
    risk 0.04cvss —epss 0.08

    Multiple cross-site scripting (XSS) vulnerabilities in David Czarnecki Blojsom 2.31 allow remote attackers to inject arbitrary web script or HTML via the (1) blog-category-description, (2) blog-entry-title, (3) rss-enclosure-url, (4) technorati-tagsi, or (5) blog-category-name…

  • CVE-2006-4830Sep 15, 2006
    Blojsom
    Blojsom
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in EditBlogTemplatesPlugin.java in David Czarnecki Blojsom 2.30 allows remote attackers to have an unknown impact by sending an HTTP request with a certain value of blogTemplate.

  • CVE-2006-4831Sep 15, 2006
    Iodine
    Iodine
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in IP over DNS is now easy (iodine) before 0.3.2 has unknown impact and attack vectors, related to "potential security problems."

  • CVE-2006-4832Sep 15, 2006
    Verso
    NetPerformer FRAD ACT SDM-95xx
    risk 0.04cvss —epss 0.11

    Buffer overflow in the telnet service in Verso NetPerformer FRAD ACT SDM-95xx 7.xx (R1) and earlier, SDM-93xx 10.x.x (R2) and earlier, and SDM-92xx 9.x.x (R1) and earlier allows remote attackers to cause a denial of service (reboot) and possibly execute arbitrary code via a long…

  • CVE-2006-4833Sep 15, 2006
    Verso
    NetPerformer FRAD ACT SDM-95xx
    risk 0.00cvss —epss 0.03

    Verso NetPerformer FRAD ACT SDM-95xx 7.xx (R1) and earlier, SDM-93xx 10.x.x (R2) and earlier, and SDM-92xx 9.x.x (R1) and earlier allow remote attackers to cause a denial of service (hang or reboot) via an ICMP packet with the same destination and source address and port, aka…

  • CVE-2006-4834Sep 15, 2006
    Phpquiz
    Phpquiz
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in index.php in Jule Slootbeek phpQuiz 0.01 allows remote attackers to execute arbitrary PHP code via a URL in the pagename parameter.

  • CVE-2006-4835Sep 15, 2006
    Bluview
    Blue Magic Board
    risk 0.00cvss —epss 0.02

    Bluview Blue Magic Board (BMB) (aka BMForum) 5.5 allows remote attackers to obtain sensitive information via a direct request to (1) footer.php, (2) header.php, (3) db_mysql_error.php, (4) langlist.php, (5) sendmail.php, or (6) style.php, which reveals the path in various error…

  • CVE-2006-4836Sep 15, 2006
    Dcp Portal
    Dcp Portal
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in login.php in DCP-Portal SE 6.0 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: The lostpassword.php and calendar.php vectors are already covered by CVE-2005-3365, and the search.php vector is already…

  • CVE-2006-4837Sep 15, 2006
    Dcp Portal
    Dcp Portal
    risk 0.00cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in DCP-Portal SE 6.0 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter in (1) library/lib.php and (2) library/editor/editor.php. NOTE: the same primary issue can be used for full path…

  • CVE-2006-4838Sep 15, 2006
    Dcp Portal
    Dcp Portal
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal SE 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) root_url and (2) dcp_version parameters in (a) admin/inc/footer.inc.php, and the root_url, (3) page_top_name, (4) page_name, and (5)…

  • CVE-2006-4820Sep 15, 2006
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in X.25 on HP-UX B.11.00, B.11.11, and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors.

  • CVE-2006-4568Sep 15, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 1.5.0.7 and SeaMonkey before 1.0.5 allows remote attackers to bypass the security model and inject content into the sub-frame of another site via targetWindow.frames[n].document.open(), which facilitates spoofing and other attacks.

  • CVE-2006-4569Sep 15, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The popup blocker in Mozilla Firefox before 1.5.0.7 opens the "blocked popups" display in the context of the Location bar instead of the subframe from which the popup originated, which might make it easier for remote user-assisted attackers to conduct cross-site scripting (XSS)…

  • CVE-2006-4570Sep 15, 2006
    Mozilla Corporation
    Thunderbird
    risk 0.00cvss —epss 0.02

    Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original…