VYPR

CVEs

344,036 total · page 6492 of 6,881

AllCriticalHighKEV
  • CVE-2006-4429Aug 29, 2006
    Phlymail
    Phlymail
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in handlers/email/mod.output.php in PHlyMail Lite 3.4.4 and earlier (Build 3.04.04) allows remote attackers to execute arbitrary PHP code via a URL in the _PM_[path][handler] parameter, a different vector than CVE-2006-4291. NOTE: This…

  • CVE-2006-4430Aug 29, 2006
    Cisco Systems, Inc.
    Network Admission Control
    risk 0.00cvss —epss 0.02

    The Cisco Network Admission Control (NAC) 3.6.4.1 and earlier allows remote attackers to prevent installation of the Cisco Clean Access (CCA) Agent and bypass local and remote protection mechanisms by modifying (1) the HTTP User-Agent header or (2) the behavior of the TCP/IP…

  • CVE-2006-4431Aug 29, 2006
    Zend
    Zend Platform
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in the (a) Session Clustering Daemon and the (b) mod_cluster module in the Zend Platform 2.2.1 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a (1) empty or (2) crafted PHP session identifier…

  • CVE-2006-4432Aug 29, 2006
    Zend
    Zend Platform
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Zend Platform 2.2.1 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the final component of the PHP session identifier (PHPSESSID). NOTE: in some cases, this issue can be leveraged to perform…

  • CVE-2006-4433Aug 29, 2006
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote attackers to exploit other vulnerabilities by inserting PHP code into the PHPSESSID, which is…

  • CVE-2006-4434HigAug 29, 2006
    Sendmail, Inc.
    Sendmail
    risk 0.49cvss 7.5epss 0.04

    Use-after-free vulnerability in Sendmail before 8.13.8 allows remote attackers to cause a denial of service (crash) via a long "header line", which causes a previously freed variable to be referenced. NOTE: the original developer has disputed the severity of this issue, saying…

  • CVE-2006-4435Aug 29, 2006
    OpenBSD
    OpenBSD
    risk 0.00cvss —epss 0.00

    OpenBSD 3.8, 3.9, and possibly earlier versions allows context-dependent attackers to cause a denial of service (kernel panic) by allocating more semaphores than the default.

  • CVE-2006-4436Aug 29, 2006
    OpenBSD
    OpenBSD
    risk 0.00cvss —epss 0.02

    isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates Security Associations (SA) with a replay window of size 0 when isakmpd acts as a responder during SA negotiation, which allows remote attackers to replay IPSec packets and bypass the replay protection.

  • CVE-2006-4417Aug 28, 2006
    XOOPS
    Xoops
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in edituser.php in Xoops before 2.0.15 allows remote attackers to execute arbitrary SQL commands via the user_avatar parameter.

  • CVE-2006-4418Aug 28, 2006
    Wikepage
    Wikepage
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php for Wikepage 2006.2a Opus 10 allows remote attackers to include arbitrary local files via the lng parameter, as demonstrated by inserting PHP code into a log file.

  • CVE-2006-4419Aug 28, 2006
    Promanager
    Promanager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in note.php in ProManager 0.73 allows remote attackers to execute arbitrary SQL commands via the note_id parameter.

  • CVE-2006-4420Aug 28, 2006
    Phaos
    Phaos
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in include_lang.php in Phaos 0.9.2 allows remote attackers to include arbitrary local files via ".." sequences in the lang parameter.

  • CVE-2006-4416Aug 28, 2006
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in the mkvg command in IBM AIX 5.2 and 5.3 allows local users to gain privileges by modifying the path to point to a malicious (1) chdev, (2) mkboot, (3) varyonvg, or (4) varyoffvg program.

  • CVE-2006-4380Aug 28, 2006
    MySQL
    MySQL
    risk 0.00cvss —epss 0.00

    MySQL before 4.1.13 allows local users to cause a denial of service (persistent replication slave crash) via a query with multiupdate and subselects.

  • CVE-2006-4354Aug 27, 2006
    Phome
    Phome Empire CMS
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in e/class/CheckLevel.php in Phome Empire CMS 3.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the check_path parameter.

  • CVE-2006-4355Aug 27, 2006
    Drupal
    Easylinks Module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Drupal Easylinks Module (easylinks.module) 4.7 before 1.5.2.1 2006/08/19 12:02:27 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-4356Aug 27, 2006
    Drupal
    Easylinks Module
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Drupal Easylinks Module (easylinks.module) 4.7 before 1.5.2.1 2006/08/19 12:02:27 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2006-4357Aug 27, 2006
    Dieselscripts
    Smart Traffic
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in clients/index.php in Diesel Smart Traffic allows remote attackers to execute arbitrary PHP code via a URL in the src parameter.

  • CVE-2006-4358Aug 27, 2006
    Diesel Pay
    Diesel Pay
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Diesel Pay allows remote attackers to inject arbitrary web script or HTML via the read parameter.

  • CVE-2006-4359Aug 27, 2006
    Powerzip
    Powerzip
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in Trident Software PowerZip 7.06 Build 3895 on Windows 2000 allows remote attackers to execute arbitrary code via a ZIP archive containing a long filename.

  • CVE-2006-4360Aug 27, 2006
    Drupal
    E-commerce
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in E-commerce 4.7 for Drupal before file.module 1.37.2.4 (20060812) allows remote authenticated users with the "create products" permission to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-4361Aug 27, 2006
    Dieselscripts
    Job Site
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in jobseekers/forgot.php in Diesel Job Site allow remote attackers to inject arbitrary web script or HTML via the (1) uname or (2) SEmail parameters.

  • CVE-2006-4362Aug 27, 2006
    Dieselscripts
    Paid Mail
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in getad.php in Diesel Paid Mail allows remote attackers to inject arbitrary web script or HTML via the ps parameter.

  • CVE-2006-4363Aug 27, 2006
    Cropimage Component
    Cropimage Component
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin.cropcanvas.php in the CropImage component (com_cropimage) 1.0 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the cropimagedir parameter.

  • CVE-2006-4364Aug 27, 2006
    Alt N
    Mdaemon
    risk 0.07cvss —epss 0.55

    Multiple heap-based buffer overflows in the POP3 server in Alt-N Technologies MDaemon before 9.0.6 allow remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via long strings that contain '@' characters in the (1) USER and (2) APOP…

  • CVE-2006-3124Aug 26, 2006
    Streamripper
    Streamripper
    risk 0.04cvss —epss 0.19

    Buffer overflow in the HTTP header parsing in Streamripper before 1.61.26 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted HTTP headers.

  • CVE-2006-4365Aug 26, 2006
    Vistabb
    Vistabb
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in VistaBB 2.0.33 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) includes/functions_mod_user.php or (2) includes/functions_portal.php.

  • CVE-2006-4366Aug 26, 2006
    Redblog
    Redblog
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in RedBLoG 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

  • CVE-2006-4367Aug 26, 2006
    All Topics
    All Topics Hack
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in alltopics.php in the All Topics Hack 1.5.0 and earlier for phpBB 2.0.21 allows remote attackers to execute arbitrary SQL commands via the start parameter.

  • CVE-2006-4368Aug 26, 2006
    Integramod
    Integramod
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/functions_portal.php in IntegraMOD Portal 2.x and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-4369Aug 26, 2006
    Integramod
    Integramod
    risk 0.03cvss —epss 0.03

    Absolute path traversal vulnerability in includes/functions_portal.php in IntegraMOD Portal 2.x and earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via an absolute pathname in the phpbb_root_path parameter.

  • CVE-2006-4370Aug 26, 2006
    Alt N
    Webadmin
    risk 0.00cvss —epss 0.02

    Alt-N WebAdmin 3.2.3 and 3.2.4 running with MDaemon 9.0.5, and possibly earlier, allow remote authenticated domain administrators to change a global administrator's password and gain privileges via the userlist.wdm file.

  • CVE-2006-4371Aug 26, 2006
    Alt N
    Webadmin
    risk 0.00cvss —epss 0.03

    Multiple directory traversal vulnerabilities in Alt-N WebAdmin 3.2.3 and 3.2.4 running with MDaemon 9.0.5, and possibly earlier, allow remote authenticated global administrators to read arbitrary files via a .. (dot dot) in the file parameter to (1) logfile_view.wdm and (2)…

  • CVE-2006-4372Aug 26, 2006
    Constructor Component
    Constructor Component
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in admin.lurm_constructor.php in the Lurm Constructor component (com_lurm_constructor) 0.6b and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the lm_absolute_path parameter.

  • CVE-2006-4373Aug 26, 2006
    Derek Leung
    Pslash
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in modules/visitors2/include/config.inc.php in pSlash 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the lvc_include_dir parameter.

  • CVE-2006-4374Aug 26, 2006
    IrfanView
    Irfanview
    risk 0.03cvss —epss 0.03

    IrfanView 3.98 (with plugins) allows user-assisted attackers to cause a denial of service (application crash) via a crafted ANI image file, possibly due to a buffer overflow.

  • CVE-2006-4375Aug 26, 2006
    Mambo (software)
    Contacts Xtd Component
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in contxtd.class.php in the Contacts XTD (ContXTD) component for Mambo (com_contxtd) allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: another researcher has disputed this…

  • CVE-2006-4376Aug 26, 2006
    Guder Und Koch Netzwerktechnik
    Eichhorn Portal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Guder und Koch Netzwerktechnik Eichhorn Portal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly including the (1) profil_nr and (2) sprache parameters in the main portion of the…

  • CVE-2006-4377Aug 26, 2006
    Guder Und Koch Netzwerktechnik
    Eichhorn Portal
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Guder und Koch Netzwerktechnik Eichhorn Portal allow remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly including the (1) profil_nr and (2) sprache parameters in the main portion of the portal, the (3)…

  • CVE-2006-4378Aug 26, 2006
    Joomla
    Rssxt Component
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in the Rssxt component for Joomla! (com_rssxt), possibly 2.0 Beta 1 or 1.0 and earlier, allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter in (1) pinger.php, (2) RPC.php, or…

  • CVE-2006-4352Aug 25, 2006
    Cisco Systems, Inc.
    Content Services Switch 11000
    risk 0.00cvss —epss 0.01

    The ArrowPoint cookie functionality for Cisco 11000 series Content Service Switches specifies an internal IP address if the administrator does not specify a string option, which allows remote attackers to obtain sensitive information.

  • CVE-2006-4353Aug 25, 2006
    Sun Corporation
    Java System Content Delivery Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Sun Java System Content Delivery Server 4.0, 4.1, and 5.0 allows local and remote attackers to read data from arbitrary files via unspecified vectors.

  • CVE-2006-2112Aug 25, 2006
    Dell
    3000cn
    risk 0.00cvss —epss 0.02

    Fuji Xerox Printing Systems (FXPS) print engine, as used in products including (1) Dell 3000cn through 5110cn and (2) Fuji Xerox DocuPrint firmware before 20060628 and Network Option Card firmware before 5.13, allows remote attackers to use the FTP printing interface as a proxy…

  • CVE-2006-2113Aug 25, 2006
    Dell
    3000cn
    risk 0.00cvss —epss 0.02

    The embedded HTTP server in Fuji Xerox Printing Systems (FXPS) print engine, as used in products including (1) Dell 3000cn through 5110cn and (2) Fuji Xerox DocuPrint firmware before 20060628 and Network Option Card firmware before 5.13, does not properly perform authentication…

  • CVE-2006-3743Aug 25, 2006
    ImageMagick
    Imagemagick
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in ImageMagick before 6.2.9 allow user-assisted attackers to execute arbitrary code via crafted XCF images.

  • CVE-2006-3744Aug 25, 2006
    ImageMagick
    Imagemagick
    risk 0.00cvss —epss 0.03

    Multiple integer overflows in ImageMagick before 6.2.9 allows user-assisted attackers to execute arbitrary code via crafted Sun Rasterfile (bitmap) images that trigger heap-based buffer overflows.

  • CVE-2006-4347Aug 24, 2006
    Cool
    Cool Manager
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in user logon authentication request handling in Cool_CoolD.exe in Cool Manager 5.0 (5,60,90,28) and Cool Messenger Office/School Server 5.5 (5,65,12,13) allows remote attackers to execute arbitrary SQL commands via the username field.

  • CVE-2006-4348Aug 24, 2006
    Joomla
    Kochsuite
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in config.kochsuite.php in the Kochsuite (com_kochsuite) 0.9.4 component for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-4349Aug 24, 2006
    Toenda Software Development
    Toendacms
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in ToendaCMS 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the tcms_administer_site parameter to an unspecified script, probably index.php. NOTE: this issue has been disputed by a third party, who…

  • CVE-2006-4350Aug 24, 2006
    Oneorzero
    Oneorzero
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in OneOrZero 1.6.4.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.