VYPR

CVEs

344,036 total · page 6488 of 6,881

AllCriticalHighKEV
  • CVE-2006-4668Sep 9, 2006
    Rob Hensley
    Ackertodo
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Rob Hensley AckerTodo 4.0 allows remote attackers to inject arbitrary web script or HTML via the task_id parameter in an edit_task command.

  • CVE-2006-4669Sep 9, 2006
    Somery
    Somery
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin/system/include.php in Somery 0.4.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the skindir parameter.

  • CVE-2006-4670Sep 9, 2006
    Keil Software
    Gallery
    risk 0.04cvss —epss 0.10

    Multiple PHP remote file inclusion vulnerabilities in PhotoKorn Gallery 1.52 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the dir_path parameter in (1) includes/cart.inc.php or (2) extras/ext_cats.php.

  • CVE-2006-2482Sep 8, 2006
    ZipTV
    ZipTV
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in the TZipTV component in (1) ZipTV for Delphi 7 2006.1.26 and for C++ Builder 2006-1.16, (2) PentaZip 8.5.1.190 and PentaSuite-PRO 8.5.1.221, and possibly other products, allows user-assisted attackers to execute arbitrary code via an ARJ archive…

  • CVE-2006-4379Sep 8, 2006
    Ipswitch, Inc.
    Imail
    risk 0.08cvss —epss 0.60

    Stack-based buffer overflow in the SMTP Daemon in Ipswitch Collaboration 2006 Suite Premium and Standard Editions, IMail, IMail Plus, and IMail Secure allows remote attackers to execute arbitrary code via a long string located after an '@' character and before a ':' character.

  • CVE-2006-4641Sep 8, 2006
    Muratsoft
    Haber Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in kategori.asp in Muratsoft Haber Portal 3.6 allows remote attackers to execute arbitrary SQL commands via the kat parameter.

  • CVE-2006-4642Sep 8, 2006
    Auditwizard
    Auditwizard
    risk 0.00cvss —epss 0.00

    AuditWizard 6.3.2, when using "Remote Audit," logs the administrator password in plaintext to LaytonCmdSvc.log, which allows local users to obtain sensitive information by reading the file.

  • CVE-2006-4643Sep 8, 2006
    Uni Vert
    Phpleague
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in consult/joueurs.php in Uni-Vert PhpLeague 0.82 and earlier allows remote attackers to execute arbitrary SQL commands via the id_joueur parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party…

  • CVE-2006-4644Sep 8, 2006
    Phpfullannu
    Phpfullannu
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in modules/home.module.php in phpFullAnnu 5.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the repmod parameter.

  • CVE-2006-4645Sep 8, 2006
    Akarru
    Social Bookmarking Engine
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in akarru.gui/main_content.php in Akarru Social BookMarking Engine 0.4.3.34 and earlier, and possibly 0.4.4.120, allows remote attackers to execute arbitrary PHP code via a URL in the bm_content parameter.

  • CVE-2006-4646Sep 8, 2006
    Drupal
    Pathauto Module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Drupal 4.7 Pathauto module before pathauto_node.inc 1.17.2.1 and the Drupal 4.6 Pathauto module before pathauto_node.inc 1.14.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-4647Sep 8, 2006
    Sponge News
    Sponge News
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in news.php in Sponge News 2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the sndir parameter.

  • CVE-2006-4648Sep 8, 2006
    Bingo News
    Bingo News
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in bp_ncom.php in BinGo News (BP News) 3.01 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the bnrep parameter.

  • CVE-2006-4649Sep 8, 2006
    Bingo News
    Bingo News
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in bp_news.php in BinGo News (BP News) 3.01 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the bnrep parameter.

  • CVE-2006-4628Sep 8, 2006
    Vcd Db
    Vcd Db
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in VCD-db before 0.983 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when handling comments.

  • CVE-2006-4629Sep 8, 2006
    C News.fr
    C News
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in affichage/commentaires.php in C-News.fr C-News 1.0.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.

  • CVE-2006-4630Sep 8, 2006
    Sky Gunning
    Myspeach
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in jscript.php in Sky GUNNING MySpeach 3.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the my_ms[root] parameter.

  • CVE-2006-4631Sep 8, 2006
    Softbb
    Softbb
    risk 0.03cvss —epss 0.03

    Direct static code injection vulnerability in admin/save_opt.php in SoftBB 0.1, and possibly earlier, allows remote authenticated users to upload and execute arbitrary PHP code via the cache_forum parameter, which saves the code to info_options.php, which is accessible via a…

  • CVE-2006-4632Sep 8, 2006
    Softbb
    Softbb
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in SoftBB 0.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) groupe parameter in addmembre.php and the (2) select parameter in moveto.php.

  • CVE-2006-4633Sep 8, 2006
    Softbb
    Softbb
    risk 0.03cvss —epss 0.03

    index.php in SoftBB 0.1, and possibly earlier, allows remote attackers to obtain the installation path via a null or invalid page[] parameter.

  • CVE-2006-4634Sep 8, 2006
    Vbzoom
    Vbzoom
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in VBZooM allows remote attackers to inject arbitrary web script or HTML via the UserID parameter, a different vector than CVE-2006-1133 and CVE-2005-2441.

  • CVE-2006-4635Sep 8, 2006
    Squiz
    Mysource Classic
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in MySource Classic 2.14.6, and possibly earlier, allows remote authenticated users, with superuser privileges, to inject arbitrary PHP code via unspecified vectors related to the Equation attribute in Web_Extensions - Notitia (I/II). NOTE: due to lack…

  • CVE-2006-4636Sep 8, 2006
    Szewo
    Phpcommander
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Directory parameter, as demonstrated by parameter values naming Apache HTTP Server log files that…

  • CVE-2006-4637Sep 8, 2006
    Acgv News
    News
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in ACGV News 0.9.1 allow remote attackers to execute arbitrary PHP code via a URL in the PathNews parameter in (1) header.php or (2) news.php. NOTE: portions of these details are obtained from third party information.

  • CVE-2006-4638Sep 8, 2006
    Acgv News
    News
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in article.php in ACGV News 0.9.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PathNews parameter.

  • CVE-2006-4639Sep 8, 2006
    C News.fr
    C News
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in C-News.fr C-News 1.0.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path parameter in (1) formulaire_commentaires.php, (2) affichage/liste_news.php, (3)…

  • CVE-2006-4626Sep 7, 2006
    Alwil
    avast! Anti-virus Engine
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in alwil avast! Anti-virus Engine before 4.7.869 allows remote attackers to execute arbitrary code via a crafted LHA file that contains extended headers with file and directory names whose concatenation triggers the overflow.

  • CVE-2006-4627Sep 7, 2006
    Microsoft
    System Information Activex Control
    risk 0.01cvss —epss 0.14

    System Information ActiveX control (msinfo.dll), when accessed via Microsoft Internet Explorer, allows remote attackers to cause a denial of service (crash) via a SaveFile function with a long (1) computer and possibly (2) filename and (3) category argument.

  • CVE-2006-4624Sep 7, 2006
    Mailman
    Mailman
    risk 0.00cvss —epss 0.03

    CRLF injection vulnerability in Utils.py in Mailman before 2.1.9rc1 allows remote attackers to spoof messages in the error log and possibly trick the administrator into visiting malicious URLs via CRLF sequences in the URI.

  • CVE-2006-4595Sep 7, 2006
    Muforum
    Muforum
    risk 0.00cvss —epss 0.01

    muforum (µforum) 0.4c stores membres/members.dat under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames and password hashes.

  • CVE-2006-4596Sep 7, 2006
    Mybace Light
    Mybace Light
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion in MyBace Light Skrip, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the (1) hauptverzeichniss parameter in includes/login_check.php and the (2) template_back parameter in admin/login/content/user_daten.php.

  • CVE-2006-4597Sep 7, 2006
    Icblogger
    Icblogger
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in devam.asp in ICBlogger 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the YID parameter.

  • CVE-2006-4598Sep 7, 2006
    Sslinks
    Sslinks
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in links.php in ssLinks 1.22 allow remote attackers to execute arbitrary SQL commands via the (1) go parameter and (2) id parameter in a rate action.

  • CVE-2006-4599Sep 7, 2006
    Autentificator
    Autentificator
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in aut_verifica.inc.php in Autentificator 2.01 allows remote attackers to execute arbitrary SQL commands via the user parameter.

  • CVE-2006-4600Sep 7, 2006
    OpenLDAP
    Openldap
    risk 0.00cvss —epss 0.03

    slapd in OpenLDAP before 2.3.25 allows remote authenticated users with selfwrite Access Control List (ACL) privileges to modify arbitrary Distinguished Names (DN).

  • CVE-2006-4601Sep 7, 2006
    Annuaire
    1two
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Annuaire 1Two 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-4602Sep 7, 2006
    Tiki
    Tiki
    risk 0.06cvss —epss 0.43

    Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execute arbitrary PHP code via a filepath parameter that contains a filename with a .php extension, which is uploaded to the img/wiki/ directory.

  • CVE-2006-4603Sep 7, 2006
    NCH Swift Sound
    Web Dictate
    risk 0.00cvss —epss 0.02

    NCH Swift Sound Web Dictate 1.02 allows remote attackers to bypass authentication via a null password.

  • CVE-2006-4604Sep 7, 2006
    Lanifex
    Lanifex
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in LFXlib/access_manager.php in Lanifex Database of Managed Objects (DMO) 2.3 Beta and earlier allows remote attackers to execute arbitrary PHP code via the _incMgr parameter.

  • CVE-2006-4605Sep 7, 2006
    Longino
    Jacome PHP Revista
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in index.php in Longino Jacome php-Revista 1.1.2 allows remote attackers to execute arbitrary PHP code via the adodb parameter.

  • CVE-2006-4606Sep 7, 2006
    Longino
    Jacome PHP Revista
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Longino Jacome php-Revista 1.1.2 allow remote attackers to execute arbitrary SQL commands via the (1) id_temas parameter in busqueda_tema.php, the (2) cadena parameter in busqueda.php, the (3) id_autor parameter in autor.php, the (4)…

  • CVE-2006-4607Sep 7, 2006
    Longino
    Jacome PHP Revista
    risk 0.03cvss —epss 0.04

    admin/index.php in Longino Jacome php-Revista 1.1.2 allows remote attackers to bypass authentication controls by setting the ID_ADMIN and SUPER_ADMIN parameters to 1.

  • CVE-2006-4608Sep 7, 2006
    Longino
    Jacome PHP Revista
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in Longino Jacome php-Revista 1.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) cadena parameter in busqueda.php and the (2) email parameter in lista.php.

  • CVE-2006-4609Sep 7, 2006
    Phprojekt
    Phprojekt
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in the Content Management module ("Content manager") for PHProjekt 0.6.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via the path_pre parameter in (1) cm_lib.inc.php, (2)…

  • CVE-2006-4610Sep 7, 2006
    Graphiks
    Grapagenda
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in index.php in GrapAgenda 0.11 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the page parameter.

  • CVE-2006-4611Sep 7, 2006
    Dsocks
    Dsocks
    risk 0.04cvss —epss 0.08

    Buffer overflow in the _tor_resolve function in dsocks.c in dsocks before 1.4 allows remote attackers to execute arbitrary code via unspecified vectors, possibly involving a long node name.

  • CVE-2006-4612Sep 7, 2006
    Zixforum
    Zixforum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ReplyNew.asp in ZIXForum 1.12 allows remote attackers to execute arbitrary SQL commands via the RepId parameter.

  • CVE-2006-4613Sep 7, 2006
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in SnapGear before 3.1.4u1 allow remote attackers to cause a denial of service via unspecified vectors involving (1) IPSec replay windows and (2) the use of vulnerable versions of ClamAV before 0.88.4. NOTE: it is possible that vector 2 is…

  • CVE-2006-4614Sep 7, 2006
    Pocket Pc
    Pocket Pc
    risk 0.00cvss —epss 0.00

    PDAapps Verichat for Pocket PC 1.30bh stores usernames and passwords in plaintext in the Windows Mobile registry, which allows local users to obtain sensitive information via keys under \HKEY_CURRENT_USER\Software\PDAapps\VeriChat.

  • CVE-2006-4615Sep 7, 2006
    Shape
    IM+ Mobile Instant Messenger
    risk 0.00cvss —epss 0.00

    Shape Services IM+ Mobile Instant Messenger for Pocket PC 3.10 stores usernames and passwords in plaintext in %PROGRAMFILES%\IMPlus\implus.cfg, which allows local users to obtain sensitive information by reading the file.