VYPR

CVEs

344,036 total · page 6486 of 6,881

AllCriticalHighKEV
  • CVE-2006-4766Sep 13, 2006
    Newsscript.co.uk
    Newsscript
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in print.php in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allows remote attackers to read arbitrary files via a .. (dot dot) in the ide parameter.

  • CVE-2006-4767Sep 13, 2006
    Newsscript.co.uk
    Newsscript
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in Stefan Ernst Newsscript (aka WM-News) 0.5beta allow remote attackers to (1) read arbitrary local files via a .. (dot dot) sequence in the ide parameter in modify.php and (2) write to arbitrary local files via a .. sequence in the…

  • CVE-2006-4768Sep 13, 2006
    Newsscript.co.uk
    Newsscript
    risk 0.00cvss —epss 0.01

    Multiple direct static code injection vulnerabilities in add_go.php in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allow remote attackers to execute arbitrary PHP code via the (1) description, (2) issue, (3) title, (4) var, (5) name, (6) keywords, and (7) note parameters,…

  • CVE-2006-4769Sep 13, 2006
    Keil Software
    P4cms
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in abf_js.php in p4CMS 1.05 allows remote attackers to execute arbitrary PHP code via a URL in the abs_pfad parameter.

  • CVE-2006-4770Sep 13, 2006
    Miniportail
    Miniportal
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in menu.php in MiniPort@l 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the skiny parameter.

  • CVE-2006-4732Sep 13, 2006
    Microsoft
    Visual Basic
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in Microsoft Visual Basic (VB) 6 has an unknown impact ("overflow") via a project that contains a certain Click event procedure, as demonstrated using the msgbox function and the VB.Label object.

  • CVE-2006-4733Sep 13, 2006
    Sips
    Sips
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in sipssys/code/box.inc.php in Haakon Nilsen simple, integrated publishing system (SIPS) 0.3.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the config[sipssys] parameter. NOTE: the product's documentation…

  • CVE-2006-4734Sep 13, 2006
    Tiki
    Tiki
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in tiki-g-admin_processes.php in Tikiwiki 1.9.4 allow remote attackers to execute arbitrary SQL commands via the (1) pid and (2) where parameters.

  • CVE-2006-4735Sep 13, 2006
    Magpierss
    Magpierss
    risk 0.00cvss —epss 0.01

    Kellan Elliott-McCrea MagpieRSS allows remote attackers to obtain sensitive information via a direct request for (1) rss_fetch.inc.php or (2) rss_parse.inc.php, which reveals the path in various error messages.

  • CVE-2006-4736Sep 13, 2006
    Cms.r.
    CMS.r.
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in CMS.R. 5.5 allow remote attackers to execute arbitrary SQL commands via the (1) adminname and (2) adminpass parameters. NOTE: some of these details are obtained from third party information.

  • CVE-2006-4737Sep 13, 2006
    Jetbox
    Jetbox CMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Jetbox CMS allows remote attackers to inject arbitrary web script or HTML via the item parameter. NOTE: The view vector is already covered by CVE-2006-3586.2.

  • CVE-2006-4738Sep 13, 2006
    Jetbox
    Jetbox CMS
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in phpthumb.php in Jetbox CMS allows remote attackers to execute arbitrary PHP code via a URL in the includes_path parameter. NOTE: The relative_script_path vector is already covered by CVE-2006-2270.

  • CVE-2006-4739Sep 13, 2006
    Jetbox
    Jetbox CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Jetbox CMS allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the OriginalImageData parameter to phpthumb.php.

  • CVE-2006-4740Sep 13, 2006
    Jetbox
    Jetbox CMS
    risk 0.00cvss —epss 0.01

    Jetbox CMS allows remote attackers to obtain sensitive information via a direct request for certain files, which reveal the path in an error message.

  • CVE-2006-4741Sep 13, 2006
    Idevspot
    Phplinkexchange
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in bits_listings.php in IDevSpot PhpLinkExchange 1.0 allows remote attackers to execute arbitrary code via the svr_rootPhpStart parameter.

  • CVE-2006-4742Sep 13, 2006
    Idevspot
    Phplinkexchange
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in user_add.php in IDevSpot PhpLinkExchange 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2006-4743Sep 13, 2006
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for (1) 404.php, (2) akismet.php, (3) archive.php, (4) archives.php, (5) attachment.php, (6) blogger.php, (7) comments.php, (8) comments-popup.php, (9) dotclear.php, (10)…

  • CVE-2006-4744Sep 13, 2006
    Abidia
    Abidia Wireless
    risk 0.00cvss —epss 0.01

    Abidia (1) O-Anywhere and (2) Abidia Wireless transmit authentication credentials in cleartext, which allows remote attackers to obtain sensitive information by sniffing.

  • CVE-2006-4745Sep 13, 2006
    Scarybear
    Pocketexpense Pro
    risk 0.00cvss —epss 0.00

    ScaryBear PocketExpense Pro 3.9.1 uses an internally recorded key to protect a data file whose contents are stored in plaintext, which allows local users to disable authentication and access the file by modifying a certain value in the file header.

  • CVE-2006-4746Sep 13, 2006
    AnnonceV
    Web Server Creator Web Portal
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in news/include/customize.php in Web Server Creator 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the l parameter.

  • CVE-2006-4747Sep 13, 2006
    Idevspot
    Textads
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in IdevSpot TextAds allow remote attackers to inject arbitrary web script or HTML via (1) the id parameter in delete.php and (2) the error parameter in error.php.

  • CVE-2006-4748Sep 13, 2006
    F Art Agency
    BLOG:CMS
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in F-ART BLOG:CMS 4.1 allow remote attackers to execute arbitrary SQL commands via the (1) xagent, (2) xpath, (3) xreferer, and (4) xdns parameters in (a) admin/plugins/NP_Log.php, and the (5) pitem parameter in (b)…

  • CVE-2006-4749Sep 13, 2006
    Bugada Andrea
    PHP Advanced Transfer Manager
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpATM) 1.20 allow remote attackers to execute arbitrary PHP code via the include_location parameter in (1) activate.php, (2) configure.php, (3) fileop.php, (4) getimg.php, (5) ipblocked.php,…

  • CVE-2006-4750Sep 13, 2006
    Openi CMS Group
    Openi CMS
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in openi-admin/base/fileloader.php in OPENi-CMS 1.0.1, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the config[openi_dir] parameter.

  • CVE-2006-4751Sep 13, 2006
    Laurentiu Matei
    Expandable Home Page CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5.1 allows remote attackers to inject arbitrary web script or HTML via the errcode parameter.

  • CVE-2006-4752Sep 13, 2006
    Laurentiu Matei
    Expandable Home Page CMS
    risk 0.00cvss —epss 0.02

    Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5.1 allows remote attackers to obtain the installation path via a query to the engine module, probably with an invalid action parameter.

  • CVE-2006-4753Sep 13, 2006
    PHProg
    PHProg
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in PHProg before 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter.

  • CVE-2006-4754Sep 13, 2006
    AnnonceV
    Phprog
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in PHProg before 1.1 allows remote attackers to inject arbitrary web script or HTML via the album parameter, which is used in an opendir call. NOTE: the same primary issue can be used for full path disclosure with an invalid…

  • CVE-2006-4755Sep 13, 2006
    PhpMyDirectory
    phpMyDirectory
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in alpha.php in phpMyDirectory 10.4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the letter parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party…

  • CVE-2006-4756Sep 13, 2006
    Accomplishtechnology
    Phpmydirectory
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in alpha.php in phpMyDirectory 10.4.6 and earlier allows remote attackers to execute arbitrary SQL commands via the letter parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

  • CVE-2006-3739Sep 13, 2006
    Xorg
    X.org
    risk 0.00cvss —epss 0.01

    Integer overflow in the CIDAFM function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted Adobe Font Metrics (AFM) files with a modified number of character metrics (StartCharMetrics), which leads to a heap-based buffer overflow.

  • CVE-2006-3740Sep 13, 2006
    Xorg
    X.org
    risk 0.00cvss —epss 0.01

    Integer overflow in the scan_cidfont function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted (1) CMap and (2) CIDFont font data with modified item counts in the (a) begincodespacerange, (b) cidrange, and (c) notdefrange sections.

  • CVE-2006-4731Sep 13, 2006
    Ledgersmb
    Ledgersmb
    risk 0.03cvss —epss 0.06

    Multiple directory traversal vulnerabilities in (1) login.pl and (2) admin.pl in (a) SQL-Ledger before 2.6.19 and (b) LedgerSMB before 1.0.0p1 allow remote attackers to execute arbitrary Perl code via an unspecified terminal parameter value containing ../ (dot dot slash).

  • CVE-2006-0001Sep 12, 2006
    Microsoft
    Publisher
    risk 0.03cvss —epss 0.40

    Stack-based buffer overflow in Microsoft Publisher 2000 through 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted PUB file, which causes an overflow when parsing fonts.

  • CVE-2006-0032Sep 12, 2006
    Microsoft
    Windows 2000
    risk 0.05cvss —epss 0.33

    Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an…

  • CVE-2006-3311Sep 12, 2006
    Adobe Inc.
    Flex
    risk 0.01cvss —epss 0.17

    Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie.

  • CVE-2006-3442Sep 12, 2006
    Microsoft
    Windows Xp
    risk 0.02cvss —epss 0.26

    Unspecified vulnerability in Pragmatic General Multicast (PGM) in Microsoft Windows XP SP2 and earlier allows remote attackers to execute arbitrary code via a crafted multicast message.

  • CVE-2006-3873Sep 12, 2006
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.29

    Heap-based buffer overflow in URLMON.DLL in Microsoft Internet Explorer 6 SP1 on Windows 2000 and XP SP1, with versions the MS06-042 patch before 20060912, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long URL in a GZIP-encoded…

  • CVE-2006-4381Sep 12, 2006
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.04

    Integer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted H.264 movie.

  • CVE-2006-4382Sep 12, 2006
    Apple Inc.
    Quicktime
    risk 0.01cvss —epss 0.07

    Multiple buffer overflows in Apple QuickTime before 7.1.3 allow user-assisted remote attackers to execute arbitrary code via a crafted QuickTime movie.

  • CVE-2006-4384Sep 12, 2006
    Apple Inc.
    Quicktime
    risk 0.04cvss —epss 0.15

    Heap-based buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via the COLOR_64 chunk in a FLIC (FLC) movie.

  • CVE-2006-4385Sep 12, 2006
    Apple Inc.
    Quicktime
    risk 0.01cvss —epss 0.06

    Buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted SGI image.

  • CVE-2006-4386Sep 12, 2006
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.06

    Integer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted H.264 movie, a different issue than CVE-2006-4381.

  • CVE-2006-4388Sep 12, 2006
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.06

    Integer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted FlashPix file.

  • CVE-2006-4389Sep 12, 2006
    Apple Inc.
    Quicktime
    risk 0.01cvss —epss 0.07

    Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted FlashPix (FPX) file, which triggers an exception that leads to an operation on an uninitialized object.

  • CVE-2006-4640Sep 12, 2006
    Adobe Inc.
    Flashplayer
    risk 0.01cvss —epss 0.10

    Unspecified vulnerability in Adobe Flash Player before 9.0.16.0 allows user-assisted remote attackers to bypass the allowScriptAccess protection via unspecified vectors.

  • CVE-2006-2658Sep 12, 2006
    Mono
    Xsp
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in the xsp component in mod_mono in Mono/C# web server, as used in SUSE Open-Enterprise-Server 1 and SUSE Linux 9.2 through 10.0, allows remote attackers to read arbitrary files via a .. (dot dot) sequence in an HTTP request.

  • CVE-2006-4625Sep 12, 2006
    PHP
    PHP
    risk 0.03cvss —epss 0.01

    PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults.

  • CVE-2006-4705Sep 12, 2006
    Dominic Gamble
    Timesheet.PHP
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in login.php in dwayner79 and Dominic Gamble Timesheet (aka Timesheet.php) 1.2.1 allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2006-4706Sep 12, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.1.7 allows remote attackers to inject arbitrary web script or HTML via a url BBCode tag that contains a javascript URI with an SGML numeric character reference and an embedded…