VYPR

CVEs

344,021 total · page 6497 of 6,881

AllCriticalHighKEV
  • CVE-2006-4085Aug 11, 2006
    Olaf Noehring
    The Search Engine Project
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in Olaf Noehring The Search Engine Project (TSEP) 0.942 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the tsep_config[absPath] parameter to pagenavigation.php, a different vector than CVE-2006-4055. NOTE:…

  • CVE-2006-4086Aug 11, 2006
    Ozjournals
    Ozjournals
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Elaine Aquino Online Zone Journals (OZJournals) 1.5 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2006-4087Aug 11, 2006
    Mojoscripts
    Mojogallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin.cgi in mojoscripts.com mojoGallery allows remote attackers to inject arbitrary web script or HTML via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party…

  • CVE-2006-4088Aug 11, 2006
    Civicspace
    Civicspace
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in CivicSpace 0.8.5 allow remote attackers to inject arbitrary web script or HTML via the (1) Subject, (2) Comment, and (3) Add new comment sections.

  • CVE-2006-4089Aug 11, 2006
    Alsaplayer
    Alsaplayer
    risk 0.04cvss —epss 0.10

    Multiple buffer overflows in Andy Lo-A-Foe AlsaPlayer 0.99.76 and earlier allow remote attackers to cause a denial of service (application crash), or have other unknown impact, via (1) a long Location field sent by a web server, which triggers an overflow in the reconnect…

  • CVE-2006-4090Aug 11, 2006
    Webligo
    Bloghoster
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Webligo BlogHoster 2.2 allows remote attackers to inject arbitrary web script or HTML via the "From: part of the comment post," probably involving the nickname parameter to previewcomment.php.

  • CVE-2006-4091Aug 11, 2006
    Archangel Management
    Archangel Weblog
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Archangel Management Archangel Weblog 0.90.02 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Comment section.

  • CVE-2006-4092Aug 11, 2006
    Simpliciti
    Locked Browser
    risk 0.00cvss —epss 0.00

    Simpliciti Locked Browser does not properly limit a user's actions to ones within the intended Internet Explorer environment, which allows local users to perform unauthorized actions by visiting a web site that executes a JavaScript window.blur loop to remove focus from the…

  • CVE-2006-4072Aug 11, 2006
    Club Nuke
    [XP]
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Club-Nuke [XP] 2.0 LCID 2048 allow remote attackers to execute arbitrary SQL commands via the (1) haber_id parameter to haber_detay.asp, and allow remote authenticated users to execute arbitrary SQL commands via the (2) menu_id parameter…

  • CVE-2006-4073Aug 11, 2006
    Phpcc
    Phpcc
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Fabian Hainz phpCC Beta 4.2 allow remote attackers to execute arbitrary PHP code via a URL in the base_dir parameter to (1) login.php, (2) reactivate.php, or (3) register.php.

  • CVE-2006-4074Aug 11, 2006
    JoomlaDeveloping
    JD-Wiki
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in lib/tpl/default/main.php in the JD-Wiki Component (com_jd-wiki) 1.0.2 and earlier for Joomla!, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-4075Aug 11, 2006
    Wim Fleischhauer
    Docpile We
    risk 0.04cvss —epss 0.10

    Multiple PHP remote file inclusion vulnerabilities in Wim Fleischhauer docpile: wim's edition (docpile:we) 0.2.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the INIT_PATH parameter to (1) lib/folder.class.php, (2) lib/email.inc.php, (3)…

  • CVE-2006-4076Aug 11, 2006
    Wim Fleischhauer
    Docpile We
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Wim Fleischhauer docpile: wim's edition (docpile:we) 0.2.2 allow remote attackers to execute arbitrary PHP code via a URL in the INIT_PATH parameter to (1) lib/access.inc.php, (2) lib/folders.inc.php, (3) lib/init.inc.php or…

  • CVE-2006-4077Aug 11, 2006
    Vincenzo Valvano
    Comet WebFileManager
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in CheckUpload.php in Vincenzo Valvano Comet WebFileManager (CWFM) 0.9.1, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the Language parameter.

  • CVE-2006-4078Aug 11, 2006
    Deluxebb
    Deluxebb
    risk 0.00cvss —epss 0.02

    pm.php (aka the PM system) in DeluxeBB 1.08, and possibly earlier, allows remote attackers to bypass authentication by providing an arbitrary username in the membercookie cookie parameter.

  • CVE-2006-4079Aug 11, 2006
    Deluxebb
    Deluxebb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in newpost.php in DeluxeBB 1.08, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the subject parameter (aka the topic title field).

  • CVE-2006-4080Aug 11, 2006
    Deluxebb
    Deluxebb
    risk 0.00cvss —epss 0.01

    DeluxeBB 1.08, and possibly earlier, uses cookies that include the MD5 hash of a password, which allows remote attackers to gain privileges by sniffing or cross-site scripting (XSS) and conduct password guessing attacks.

  • CVE-2006-4071Aug 10, 2006
    Microsoft
    Windows Xp
    risk 0.05cvss —epss 0.23

    Sign extension vulnerability in the createBrushIndirect function in the GDI library (gdi32.dll) in Microsoft Windows XP, Server 2003, and possibly other versions, allows user-assisted attackers to cause a denial of service (application crash) via a crafted WMF file.

  • CVE-2006-4050Aug 10, 2006
    David Walker
    Phpautomembersarea
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in auto_check_renewals.php in phpAutoMembersArea (phpAMA) 3.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the installed_config_file parameter.

  • CVE-2006-4051Aug 10, 2006
    Turnkey Web Tools
    PHP Live Helper
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in global.php in Turnkey Web Tools PHP Live Helper 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the abs_path parameter.

  • CVE-2006-4052Aug 10, 2006
    Turnkey Web Tools
    PHP Simple Shop
    risk 0.04cvss —epss 0.10

    Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools PHP Simple Shop 2.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the abs_path parameter to (1) admin/index.php, (2) admin/adminindex.php, (3) admin/adminglobal.php, (4)…

  • CVE-2006-4053Aug 10, 2006
    ME
    ME Download System
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in templates/header.php in ME Download System 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the Vb8878b936c2bd8ae0cab parameter.

  • CVE-2006-4054Aug 10, 2006
    Ehmig
    Me Download System
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in ME Download System 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) Vb8878b936c2bd8ae0cab parameter to (a) inc/sett_style.php or (b) inc/sett_smilies.php; or the (2) Vb6c4d0e18a204a63b38f, (3)…

  • CVE-2006-4055Aug 10, 2006
    Tsep
    Tsep
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in Olaf Noehring The Search Engine Project (TSEP) 0.942 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the tsep_config[absPath] parameter to (1) include/colorswitch.php, (2)…

  • CVE-2006-4056Aug 10, 2006
    The Address Book
    The Address Book
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the authentication process in katzlbt (a) The Address Book 1.04e and earlier and (b) The Address Book Reloaded before 2.0-rc4 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters. …

  • CVE-2006-4057Aug 10, 2006
    Mitch Murray
    Eremove
    risk 0.00cvss —epss 0.03

    Buffer overflow in the preview_create function in gui.cpp in Mitch Murray Eremove 1.4 allows remote attackers to cause a denial of service (application crash), and possibly execute arbitrary code, via a large email attachment.

  • CVE-2006-4058Aug 10, 2006
    Simplog
    Simplog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in archive.php in Simplog 0.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the keyw parameter when performing a search. NOTE: some details are obtained from third party information.

  • CVE-2006-4059Aug 10, 2006
    Usolved
    Newsolved
    risk 0.04cvss —epss 0.09

    Multiple PHP remote file inclusion vulnerabilities in USOLVED NEWSolved Lite 1.9.2, and possibly earlier, allow remote attackers to execute arbitrary PHP code via a URL in the abs_path parameter to (1) newsscript_lyt.php, (2) newsticker/newsscript_get.php, (3)…

  • CVE-2006-4060Aug 10, 2006
    Visual Events Calendar
    Visual Events Calendar
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in calendar.php in Visual Events Calendar 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the cfg_dir parameter.

  • CVE-2006-4061Aug 10, 2006
    Thomas Pequet
    Phpprintanalyzer
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in Thomas Pequet phpPrintAnalyzer 1.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the rep_par_rapport_racine parameter. NOTE: this issue has been disputed by third…

  • CVE-2006-4062Aug 10, 2006
    Dmitry Sheiko
    Sapid Shop
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in usr/extensions/get_tree.inc.php in Dmitry Sheiko SAPID Shop 1.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[root_path] parameter.

  • CVE-2006-4063Aug 10, 2006
    Csaba Godor
    Sapid Blog Beta 2
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Csaba Godor SAPID Blog Beta 2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) root_path parameter to (a) usr/extensions/get_blog_infochannel.inc.php, (b)…

  • CVE-2006-4064Aug 10, 2006
    Yenerturk
    Yenerturk Haber Script
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in default.asp in YenerTurk Haber Script 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: it was later reported reported that 2.0 is also affected.

  • CVE-2006-4065Aug 10, 2006
    Dmitry Sheiko
    Sapid Gallery
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Dmitry Sheiko SAPID Gallery 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) root_path parameter to (a) usr/extensions/get_calendar.inc.php or the (2) GLOBALS[root_path] parameter to…

  • CVE-2006-4066Aug 10, 2006
    Microsoft
    Windows Xp
    risk 0.01cvss —epss 0.06

    The Graphical Device Interface Plus library (gdiplus.dll) in Microsoft Windows XP SP2 allows context-dependent attackers to cause a denial of service (application crash) via certain images that trigger a divide-by-zero error, as demonstrated by a (1) .ico file, (2) .png file…

  • CVE-2006-4067Aug 10, 2006
    Cakephp
    Cakephp
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 ("Not Found") error page. NOTE: some of these details are obtained from…

  • CVE-2006-4068Aug 10, 2006
    Pswd.js
    Pswd.js
    risk 0.03cvss —epss 0.03

    The pswd.js script relies on the client to calculate whether a username and password match hard-coded hashed values for a server, and uses a hashing scheme that creates a large number of collisions, which makes it easier for remote attackers to conduct offline brute force…

  • CVE-2006-4069Aug 10, 2006
    Ozjournals
    Ozjournals
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Elaine Aquino Online Zone Journals (OZJournals) 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) m and (2) c parameters in index.php, (3) a search action, and (4) a "submit comment" action.

  • CVE-2006-4070Aug 10, 2006
    Imendio
    Planner
    risk 0.00cvss —epss 0.02

    Format string vulnerability in Imendio Planner 0.13 allows user-assisted attackers to execute arbitrary code via format string specifiers in a filename.

  • CVE-2006-4040Aug 9, 2006
    Mywebland
    Myevent
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in myevent.php in myWebland myEvent 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the myevent_path parameter.

  • CVE-2006-4041Aug 9, 2006
    Pike
    Pike
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Pike before 7.6.86, when using a Postgres database server, allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors.

  • CVE-2006-4042Aug 9, 2006
    Mywebland
    Mybloggie
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) title, (2) url, (3) excerpt, or (4) blog_name parameters.

  • CVE-2006-4043Aug 9, 2006
    Mywebland
    Mybloggie
    risk 0.00cvss —epss 0.02

    index.php in myWebland myBloggie 2.1.4 and earlier allows remote attackers to obtain sensitive information via a query that only specifies the viewdate mode, which reveals the table prefix in a SQL error message.

  • CVE-2006-4044Aug 9, 2006
    Brad Fears
    Phpcodecabinet
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in Beautifier/Core.php in Brad Fears phpCodeCabinet 0.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the BEAUT_PATH parameter.

  • CVE-2006-4045Aug 9, 2006
    Torbstoff
    News
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in news.php in Torbstoff News 4 allows remote attackers to execute arbitrary PHP code via a URL in the pfad parameter.

  • CVE-2006-4046Aug 9, 2006
    Open Cubic Player
    Open Cubic Player
    risk 0.04cvss —epss 0.14

    Multiple stack-based buffer overflows in Open Cubic Player 2.6.0pre6 and earlier for Windows, and 0.1.10_rc5 and earlier on Linux/BSD, allow remote attackers to execute arbitrary code via (1) a large .S3M file handled by the mpLoadS3M function, (2) a crafted .IT file handled by…

  • CVE-2006-4047Aug 9, 2006
    Netious CMS
    CMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Netious CMS 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

  • CVE-2006-4048Aug 9, 2006
    Netious CMS
    CMS
    risk 0.00cvss —epss 0.01

    Netious CMS 0.4 initializes session IDs based on the client IP address, which allows remote attackers to gain access to the administration section when originating from the same IP address as the administrator. NOTE: the provenance of this information is unknown; the details…

  • CVE-2006-4049Aug 9, 2006
    Sun Corporation
    Ray Server Software
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the utxconfig utility in Sun Ray Server Software 3.x allows local users to create or overwrite arbitrary files via unknown attack vectors.

  • CVE-2006-3122Aug 9, 2006
    Isc
    DHCP
    risk 0.00cvss —epss 0.04

    The supersede_lease function in memory.c in ISC DHCP (dhcpd) server 2.0pl5 allows remote attackers to cause a denial of service (application crash) via a DHCPDISCOVER packet with a 32 byte client-identifier, which causes the packet to be interpreted as a corrupt uid and causes…