VYPR

CVEs

344,021 total · page 6499 of 6,881

AllCriticalHighKEV
  • CVE-2006-4002Aug 7, 2006
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in user.module in Drupal 4.6 before 4.6.9, and 4.7 before 4.7.3, allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: portions of these details are obtained from third party information.

  • CVE-2006-4003Aug 7, 2006
    Hobbit Monitor
    Hobbit monitor
    risk 0.00cvss —epss 0.01

    The config method in Henrik Storner Hobbit monitor before 4.1.2p2 permits access to files outside of the intended configuration directory, which allows remote attackers to obtain sensitive information via requests to the hobbitd daemon on port 1984/tcp.

  • CVE-2006-4004Aug 7, 2006
    Vbportal
    Vbportal
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in vbPortal 3.0.2 through 3.6.0 Beta 1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bbvbplang cookie, as demonstrated by injecting…

  • CVE-2006-4005Aug 7, 2006
    Bomberclone
    Bomberclone
    risk 0.00cvss —epss 0.03

    BomberClone 0.11.6 and earlier allows remote attackers to cause a denial of service (daemon crash) via (1) a certain malformed PKGF_ackreq packet, which triggers a crash in the rscache_add() function in pkgcache.c; and (2) an error packet, which is intended to be received by…

  • CVE-2006-4006Aug 7, 2006
    Bomberclone
    Bomberclone
    risk 0.04cvss —epss 0.09

    The do_gameinfo function in BomberClone 0.11.6 and earlier, and possibly other functions, does not reset the packet data size, which causes the send_pkg function (packets.c) to use this data size when sending a reply, and allows remote attackers to read portions of server memory.

  • CVE-2006-4007Aug 7, 2006
    Knusperleicht
    Guestbook
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in Knusperleicht Guestbook 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the GB_PATH parameter.

  • CVE-2006-4008Aug 7, 2006
    Knusperleicht
    Faq
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in Knusperleicht Faq 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the faq_path parameter.

  • CVE-2006-4009Aug 7, 2006
    Vwar
    Virtual War
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in war.php in Virtual War (Vwar) 1.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2006-4010Aug 7, 2006
    Vwar
    Virtual War
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in war.php in Virtual War (Vwar) 1.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: other vectors are covered by CVE-2006-3139.

  • CVE-2006-4011Aug 7, 2006
    Kayako
    Esupport
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in esupport/admin/autoclose.php in Kayako eSupport 2.3.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the subd parameter.

  • CVE-2006-4012Aug 7, 2006
    circeOS
    SaveWeb Portal
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in circeOS SaveWeb Portal 3.4 allow remote attackers to execute arbitrary PHP code via a URL in the SITE_Path parameter to (1) poll/poll.php or (2) poll/view_polls.php. NOTE: the menu_dx.php vector is already covered by…

  • CVE-2006-4013Aug 7, 2006
    Symantec
    Brightmail Antispam
    risk 0.00cvss —epss 0.04

    Multiple directory traversal vulnerabilities in Symantec Brightmail AntiSpam (SBAS) before 6.0.4, when the Control Center is allowed to connect from any computer, allow remote attackers to read and overwrite certain files via directory traversal sequences in (1) DATABLOB-GET and…

  • CVE-2006-4014Aug 7, 2006
    Symantec
    Brightmail Antispam
    risk 0.00cvss —epss 0.02

    Symantec Brightmail AntiSpam (SBAS) before 6.0.4, when the Control Center is allowed to connect from any computer, allows remote attackers to cause a denial of service (application freeze) "by sending invalid posts".

  • CVE-2006-4015Aug 7, 2006
    Hewlett-Packard
    ProCurve 3500yl
    risk 0.00cvss —epss 0.04

    Hewlett-Packard (HP) ProCurve 3500yl, 6200yl, and 5400zl switches with software before K.11.33 allow remote attackers to cause a denial of service (possibly memory leak or system crash) via unknown vectors.

  • CVE-2006-4016Aug 7, 2006
    toendaCMS
    toendaCMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in /toendaCMS in toendaCMS stable 1.0.3 and earlier, and unstable 1.1 and earlier, allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2006-4017Aug 7, 2006
    Inter Network Marketing (INM)
    CMS G3
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the search module in Inter Network Marketing (INM) CMS G3 allows remote attackers to inject arbitrary web script or HTML via the search_string parameter.

  • CVE-2006-0395Aug 5, 2006
    Apple Inc.
    Mac OS X
    risk 0.07cvss —epss 0.54

    The Download Validation in Mail in Mac OS X 10.4 does not properly recognize attachment file types to warn a user of an unsafe type, which allows user-assisted remote attackers to execute arbitrary code via crafted file types.

  • CVE-2006-3997Aug 5, 2006
    Wowroster
    Wowroster
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in hsList.php in WoWRoster (aka World of Warcraft Roster) 1.5.x and earlier allows remote attackers to execute arbitrary PHP code via a URL in the subdir parameter.

  • CVE-2006-3998Aug 5, 2006
    Wowroster
    Wowroster
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in conf.php in WoWRoster (aka World of Warcraft Roster) 1.5.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the subdir parameter.

  • CVE-2006-3999Aug 5, 2006
    Iss
    Blackice Pc Protection
    risk 0.00cvss —epss 0.00

    ISS BlackICE PC Protection 3.6.cpj, 3.6.cpiE, and possibly earlier versions do not properly monitor the integrity of the pamversion.dll BlackICE library, which allows local users to subvert BlackICE by replacing pamversion.dll. NOTE: in most cases, the attack would not cross…

  • CVE-2006-4000Aug 5, 2006
    Barracuda Networks
    Barracuda Spam Firewall
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in cgi-bin/preview_email.cgi in Barracuda Spam Firewall (BSF) 3.3.01.001 through 3.3.03.053 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter.

  • CVE-2006-4001Aug 5, 2006
    Barracuda Networks
    Barracuda Spam Firewall
    risk 0.00cvss —epss 0.02

    Login.pm in Barracuda Spam Firewall (BSF) 3.3.01.001 through 3.3.03.053 contains a hard-coded password for the guest account, which allows remote attackers to read sensitive information such as e-mail logs, and possibly e-mail contents and the admin password.

  • CVE-2006-3457Aug 5, 2006
    Symantec
    On Demand Agent
    risk 0.00cvss —epss 0.00

    Symantec On-Demand Agent (SODA) before 2.5 MR2 Build 2157, and the Virtual Desktop module in Symantec On-Demand Protection (SODP) before 2.6 Build 2233, do not properly encrypt files that are subject to policy-based automatic encryption, which might allow local users to read…

  • CVE-2006-3980Aug 5, 2006
    Mambo (software)
    Mambo Gallery Manager
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in administrator/components/com_mgm/help.mgm.php in Mambo Gallery Manager (MGM) 0.95r2 and earlier for Mambo 4.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3981Aug 5, 2006
    Mambo (software)
    Mambo Gallery Manager
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in about.mgm.php in Mambo Gallery Manager (MGM) 0.95r2 and earlier for Mambo 4.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: the provenance of this information is…

  • CVE-2006-3982Aug 5, 2006
    Knusperleicht
    Quickie
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in quickie.php in Knusperleicht Quickie, probably 0.2, allows remote attackers to execute arbitrary PHP code via a URL in the QUICK_PATH parameter.

  • CVE-2006-3983Aug 5, 2006
    Ekilat Llc
    PHP\(reactor\)
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in editprofile.php in php(Reactor) 1.27pl1 allows remote attackers to execute arbitrary PHP code via a URL in the pathtohomedir parameter.

  • CVE-2006-3984Aug 5, 2006
    Phpadsnew
    Phpadsnew
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in phpAdsNew/view.inc.php in Albasoftware Phpauction 2.1 and possibly later versions, with phpAdsNew 2.0.5, allows remote attackers to execute arbitrary PHP code via a URL in the phpAds_path parameter.

  • CVE-2006-3985Aug 5, 2006
    Conexware
    Powerarchiver
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in DZIPS32.DLL 6.0.0.4 in ConeXware PowerArchiver 9.62.03 allows user-assisted attackers to execute arbitrary code by adding a new file to a crafted ZIP archive that already contains a file with a long name.

  • CVE-2006-3986Aug 5, 2006
    Knusperleicht
    Newsletter
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in Knusperleicht Newsletter 3.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the NL_PATH parameter.

  • CVE-2006-3987Aug 5, 2006
    Knusperleicht
    FileManager
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in index.php in Knusperleicht FileManager 1.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) dwl_download_path or (2) dwl_include_path parameters.

  • CVE-2006-3988Aug 5, 2006
    Knusperleicht
    Newsreporter
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in Knusperleicht newsReporter 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the news_include_path parameter.

  • CVE-2006-3989Aug 5, 2006
    Knusperleicht
    Shoutbox
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in Knusperleicht Shoutbox 4.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the sb_include_path parameter.

  • CVE-2006-3990Aug 5, 2006
    Paul M. Jones
    Savant2
    risk 0.04cvss —epss 0.11

    Multiple PHP remote file inclusion vulnerabilities in Paul M. Jones Savant2, possibly when used with the com_mtree component for Mambo and Joomla!, allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter in (1)…

  • CVE-2006-3991Aug 5, 2006
    Vlad Vostrykh
    Voodoo chat
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in Vlad Vostrykh Voodoo chat 1.0RC1b and earlier allows remote attackers to execute arbitrary PHP code via a URL in the file_path parameter.

  • CVE-2006-3992Aug 5, 2006
    Intel
    PRO/Wireless Network Connection
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the Centrino (1) w22n50.sys, (2) w22n51.sys, (3) w29n50.sys, and (4) w29n51.sys Microsoft Windows drivers for Intel 2200BG and 2915ABG PRO/Wireless Network Connection before 10.5 with driver 9.0.4.16 allows remote attackers to execute arbitrary code…

  • CVE-2006-3993Aug 5, 2006
    Tsep
    Tsep
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in copyright.php in Olaf Noehring The Search Engine Project (TSEP) 0.942 allows remote attackers to execute arbitrary PHP code via a URL in the tsep_config[absPath] parameter.

  • CVE-2006-3994Aug 5, 2006
    XMB
    XMB
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in the u2u_send_recp function in u2u.inc.php in XMB (aka extreme message board) 1.9.6 Alpha and earlier allows remote attackers to execute arbitrary SQL commands via the u2uid parameter to u2u.php, which is directly accessed from $_POST and bypasses…

  • CVE-2006-3995Aug 5, 2006
    User Home Pages
    User Home Pages
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in (1) uhp_config.php, and possibly (2) footer.php, (3) functions.php, (4) install.uhp.php, (5) toolbar.uhp.html.php, (6) uhp.class.php, and (7) uninstall.uhp.php, in the UHP (User Home Pages) 0.5 component (aka com_uhp) for…

  • CVE-2006-3996Aug 5, 2006
    Atutor
    Atutor
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in links/index.php in ATutor 1.5.3.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the (1) desc or (2) asc parameters.

  • CVE-2006-3634Aug 4, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The (1) __futex_atomic_op and (2) futex_atomic_cmpxchg_inatomic functions in Linux kernel 2.6.17-rc4 to 2.6.18-rc2 perform the atomic futex operation in the kernel address space instead of the user address space, which allows local users to cause a denial of service (crash).

  • CVE-2006-3975Aug 4, 2006
    Ca
    eTrust Antivirus WebScan
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in CA eTrust Antivirus WebScan allows remote attackers to execute arbitrary code due to "improper bounds checking when processing certain user input."

  • CVE-2006-3976Aug 4, 2006
    Ca
    eTrust Antivirus WebScan
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in CA eTrust Antivirus WebScan before 1.1.0.1048 allows remote attackers to install arbitrary files.

  • CVE-2006-3977Aug 4, 2006
    Ca
    eTrust Antivirus WebScan
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in CA eTrust Antivirus WebScan before 1.1.0.1048 has unknown impact and remote attackers related to "improper processing of outdated WebScan components."

  • CVE-2006-0392Aug 3, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Buffer overflow in Apple Mac OS X 10.4.7 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Canon RAW image.

  • CVE-2006-0393Aug 3, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    OpenSSH in Apple Mac OS X 10.4.7 allows remote attackers to cause a denial of service or determine account existence by attempting to log in using an invalid user, which causes the server to hang.

  • CVE-2006-3459Aug 3, 2006
    LibTIFF
    Libtiff
    risk 0.07cvss —epss 0.51

    Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and other products, allow context-dependent attackers to execute arbitrary code or cause a denial of service via unspecified vectors, including a large tdir_count…

  • CVE-2006-3460Aug 3, 2006
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in the JPEG decoder in the TIFF library (libtiff) before 3.8.2 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an encoded JPEG stream that is longer than the scan line size (TiffScanLineSize).

  • CVE-2006-3461Aug 3, 2006
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in the PixarLog decoder in the TIFF library (libtiff) before 3.8.2 might allow context-dependent attackers to execute arbitrary code via unknown vectors.

  • CVE-2006-3462Aug 3, 2006
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in the NeXT RLE decoder in the TIFF library (libtiff) before 3.8.2 might allow context-dependent attackers to execute arbitrary code via unknown vectors involving decoding large RLE images.