VYPR

CVEs

343,963 total · page 6504 of 6,880

AllCriticalHighKEV
  • CVE-2006-3728Jul 21, 2006
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the kernel in Solaris 10 with patch 118822-29 (118844-29 on x86) and without patch 118833-11 (118855-08) allows remote authenticated users to cause a denial of service via unspecified vectors that lead to "kernel data structure corruption" that can…

  • CVE-2006-3729Jul 21, 2006
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.21

    DataSourceControl in Internet Explorer 6 on Windows XP SP2 with Office installed allows remote attackers to cause a denial of service (crash) via a large negative integer argument to the getDataMemberName method of a OWC11.DataSourceControl.11 object, which leads to an integer…

  • CVE-2006-3730HigJul 21, 2006
    Microsoft
    Internet Explorer
    risk 0.65cvss 8.8epss 0.64

    Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a 0x7fffffff argument to the setSlice method on a WebViewFolderIcon ActiveX object, which leads to an invalid memory…

  • CVE-2006-3731Jul 21, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    Mozilla Firefox 1.5.0.4 and earlier allows remote user-assisted attackers to cause a denial of service (crash) via a form with a multipart/form-data encoding and a user-uploaded file. NOTE: a third party has claimed that this issue might be related to the LiveHTTPHeaders…

  • CVE-2006-3732Jul 21, 2006
    Cisco Systems, Inc.
    Cs Mars
    risk 0.00cvss —epss 0.01

    Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.1 ships with an Oracle database that contains several default accounts and passwords, which allows attackers to obtain sensitive information.

  • CVE-2006-3733Jul 21, 2006
    Cisco Systems, Inc.
    Security Monitoring Analysis And Response System
    risk 0.04cvss —epss 0.12

    jmx-console/HtmlAdaptor in the jmx-console in the JBoss web application server, as shipped with Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.1, allows remote attackers to gain privileges as the CS-MARS administrator and execute arbitrary Java code…

  • CVE-2006-3734Jul 21, 2006
    Cisco Systems, Inc.
    Cs Mars
    risk 0.03cvss —epss 0.03

    Multiple unspecified vulnerabilities in the Command Line Interface (CLI) for Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.1, allow local CS-MARS administrators to execute arbitrary commands as root.

  • CVE-2006-3735Jul 21, 2006
    Mail2forum
    Mail2forum
    risk 0.04cvss —epss 0.09

    Multiple PHP remote file inclusion vulnerabilities in Mail2Forum (module for phpBB) 1.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the m2f_root_path parameter to (1) m2f/m2f_phpbb204.php, (2) m2f/m2f_forum.php, (3) m2f/m2f_mailinglist.php or…

  • CVE-2006-3736Jul 21, 2006
    Mambo (software)
    Videodb
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in core/videodb.class.xml.php in the VideoDB component for Mambo 0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3737Jul 21, 2006
    Swsoft
    Plesk
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in filemanager/filemanager.php in the control panel in SWsoft Plesk 8.0 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the file parameter.

  • CVE-2006-3748Jul 21, 2006
    Mikedeboer
    Loudmouth
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in includes/abbc/abbc.class.php in the LoudMouth Component for Mambo 4.0j, and possibly other versions including 4.1, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3749Jul 21, 2006
    Mambo (software)
    Sitemap
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in sitemap.xml.php in Sitemap component (com_sitemap) 2.0.0 for Mambo 4.5.1 CMS, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3750Jul 21, 2006
    Hashcash
    Hashcash
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in server.php in the Hashcash Component (com_hashcash) 1.2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3751Jul 21, 2006
    Htmlarea3
    Htmlarea3
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in popups/ImageManager/config.inc.php in the HTMLArea3 Addon Component (com_htmlarea3_xtd-c) for ImageManager 1.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3752Jul 21, 2006
    Professional Home Page Tools
    Guestbook
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in class.php in Professional Home Page Tools Guestbook allow remote attackers to execute arbitrary SQL commands via the (1) hidemail, (2) name, (3) mail, (4) ip, or (5) text parameters.

  • CVE-2006-3753Jul 21, 2006
    Professional Home Page Tools
    Guestbook
    risk 0.00cvss —epss 0.01

    setcookie.php for the administration login in Professional Home Page Tools Guestbook records the hash of the administrator password in a cookie, which allows attackers to conduct brute force password guessing attacks after obtaining the hash.

  • CVE-2006-3754Jul 21, 2006
    Flushcms
    Flushcms
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in Include/editor/rich_files/class.rich.php in FlushCMS 1.0.0-pre2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the class_path parameter.

  • CVE-2006-3755Jul 21, 2006
    Flushcms
    Flushcms
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in Include/editor/class.rich.php in FlushCMS 1.0.0-pre2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the class_path parameter. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2006-3756Jul 21, 2006
    Geeklog
    Geeklog
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Geeklog 1.4.0sr4 and earlier, and 1.3.11sr6 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when validating comments in (1) lib-comment.php (1.4.0sr4) or (2) comment.php (0.3.11sr6).

  • CVE-2006-3757Jul 21, 2006
    Zen Cart
    ZenCart
    risk 0.00cvss —epss 0.01

    index.php in Zen Cart 1.3.0.2 allows remote attackers to obtain sensitive information via empty (1) _GET[], (2) _SESSION[], (3) _POST[], (4) _COOKIE[], or (5) _SESSION[] array parameters, which reveals the installation path in an error message. NOTE: this issue might be…

  • CVE-2006-3758Jul 21, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    inc/init.php in Archive Mode (Light) in MyBB (aka MyBulletinBoard) 1.1.4 calls the extract function with EXTR_OVERWRITE on HTTP POST and GET variables, which allows remote attackers to overwrite arbitrary variables, as demonstrated via an SQL injection using the…

  • CVE-2006-3759Jul 21, 2006
    PhpBB
    Mybulletinboard
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in MyBB (aka MyBulletinBoard) 1.1.4, related has unspecified impact and attack vectors related to "user group manipulation."

  • CVE-2006-3760Jul 21, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) 1.1.4 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2006-3761Jul 21, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.0 RC2 through 1.1.4 allows remote attackers to inject arbitrary web script or HTML via a javascript URI with an SGML numeric character reference in the url BBCode tag, as…

  • CVE-2006-3762Jul 21, 2006
    Touch Control
    Activex Control
    risk 0.00cvss —epss 0.01

    The Touch Control ActiveX control 2.0.0.55 allows remote attackers to read and possibly execute arbitrary files via a "file///" URI in the sPath parameter to the Execute function.

  • CVE-2006-3763Jul 21, 2006
    Dieselscripts
    Joke Site
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in category.php in Diesel Joke Site allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-3764Jul 21, 2006
    Till Gerken
    Phppolls
    risk 0.00cvss —epss 0.01

    Till Gerken phpPolls 1.0.3 allows remote attackers to create a new poll via a direct request to phpPollAdmin.php3 with the poll_action parameter set to create.

  • CVE-2006-3765Jul 21, 2006
    Huttenlocher Webdesign
    Hwdeguest
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Huttenlocher Webdesign hwdeGUEST 2.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the "name input" field in new_entry.php.

  • CVE-2006-3766Jul 21, 2006
    Darren's $5 Script Archive
    osDate
    risk 0.00cvss —epss 0.01

    Darren's $5 Script Archive osDate 1.1.7 and earlier allows users to boost their own ratings via a txtrating parameter with a score greater than the intended maximum of 10.

  • CVE-2006-3767Jul 21, 2006
    Darren's $5 Script Archive
    osDate
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in showprofile.php in Darren's $5 Script Archive osDate 1.1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the onerror attribute in an HTML IMG tag with a non-existent source file in txtcomment parameter,…

  • CVE-2006-3618Jul 18, 2006
    Pixelated By Lev
    Guestbook
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in pblguestbook.php in Pixelated By Lev (PBL) Guestbook 1.32 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) name, (2) email, (3) website, (4) comments, (5) rate, and (6) private parameters.

  • CVE-2006-3652Jul 18, 2006
    Microsoft
    Isa Server
    risk 0.02cvss —epss 0.19

    Microsoft Internet Security and Acceleration (ISA) Server 2004 allows remote attackers to bypass file extension filters via a request with a trailing "#" character. NOTE: as of 20060715, this could not be reproduced by third parties.

  • CVE-2006-3653Jul 18, 2006
    Microsoft
    Works
    risk 0.04cvss —epss 0.15

    wksss.exe 8.4.702.0 in Microsoft Works Spreadsheet 8.0 allows remote attackers to cause a denial of service (CPU consumption or crash) via crafted (1) Works, (2) Excel, and (3) Lotus 1-2-3 files.

  • CVE-2006-3654Jul 18, 2006
    Microsoft
    Works
    risk 0.04cvss —epss 0.48

    Buffer overflow in wksss.exe 8.4.702.0 in Microsoft Works Spreadsheet 8.0 allows remote attackers to cause a denial of service (CPU consumption or crash) via crafted Excel files.

  • CVE-2006-3655Jul 18, 2006
    Microsoft
    Powerpoint
    risk 0.05cvss —epss 0.21

    Unspecified vulnerability in mso.dll in Microsoft PowerPoint 2003 allows user-assisted attackers to execute arbitrary code via a crafted PowerPoint file. NOTE: due to the lack of available details as of 20060717, it is unclear how this is related to CVE-2006-3656,…

  • CVE-2006-3656Jul 18, 2006
    Microsoft
    Powerpoint
    risk 0.05cvss —epss 0.21

    Unspecified vulnerability in Microsoft PowerPoint 2003 allows user-assisted attackers to cause memory corruption via a crafted PowerPoint file, which triggers the corruption when the file is closed. NOTE: due to the lack of available details as of 20060717, it is unclear how…

  • CVE-2006-3657Jul 18, 2006
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.17

    Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (stack overflow exception) via a DXImageTransform.Microsoft.Gradient ActiveX object with a long (1) StartColorStr or (2) EndColorStr property.

  • CVE-2006-3658Jul 18, 2006
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.13

    Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by accessing the object references of a FolderItem ActiveX object, which triggers a null dereference in the security check.

  • CVE-2006-3659Jul 18, 2006
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.15

    Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the location or URL property of a MHTMLFile ActiveX object.

  • CVE-2006-3660Jul 18, 2006
    Microsoft
    Powerpoint
    risk 0.04cvss —epss 0.18

    Unspecified vulnerability in Microsoft PowerPoint 2003 has unknown impact and user-assisted attack vectors related to powerpnt.exe. NOTE: due to the lack of available details as of 20060717, it is unclear how this is related to CVE-2006-3655, CVE-2006-3656, and CVE-2006-3590,…

  • CVE-2006-3661Jul 18, 2006
    CuteNews
    CuteNews
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Index.PHP in CuteNews 1.4.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

  • CVE-2006-3662Jul 18, 2006
    Atutor
    Atutor
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. NOTE: this issue has been disputed by the vendor, who states "The mentioned SQL injection vulnerability is not possible." However, the…

  • CVE-2006-3663Jul 18, 2006
    Finjan Software
    Vital Security Appliance
    risk 0.00cvss —epss 0.00

    Finjan Vital Security Appliance 5100/8100 NG 8.3.5 stores passwords in plaintext in a backup file, which allows local users to gain privileges. NOTE: the vendor has notified CVE that this issue was fixed in 8.3.6.

  • CVE-2006-3664Jul 18, 2006
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in NIS server on Sun Solaris 8, 9, and 10 allows local and remote attackers to cause a denial of service (ypserv hang) via unknown vectors.

  • CVE-2006-3665Jul 18, 2006
    SquirrelMail
    Squirrelmail
    risk 0.00cvss —epss 0.01

    SquirrelMail 1.4.6 and earlier, with register_globals enabled, allows remote attackers to hijack cookies in src/redirect.php via unknown vectors. NOTE: while "cookie theft" is frequently associated with XSS, the vendor disclosure is too vague to be certain of this.

  • CVE-2006-3666Jul 18, 2006
    AjaxPortal
    AjaxPortal
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in AjaxPortal 3.0, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the 'Search' field, a different vulnerability than CVE-2006-3515.

  • CVE-2006-3667Jul 18, 2006
    Sybase
    Financial Fusion Consumer Banking Solution
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Sybase/Financial Fusion Consumer Banking Suite versions before 20060706 has unknown impact and remote attack vectors.

  • CVE-2006-3668Jul 18, 2006
    Dynamic Universal Music Bibliotheque
    Dumb
    risk 0.04cvss —epss 0.10

    Heap-based buffer overflow in the it_read_envelope function in Dynamic Universal Music Bibliotheque (DUMB) 0.9.3 and earlier and current CVS as of 20060716, including libdumb, allows user-assisted attackers to execute arbitrary code via a ".it" (Impulse Tracker) file with an…

  • CVE-2006-3669Jul 18, 2006
    Mercury Messenger
    Mercury Messenger
    risk 0.00cvss —epss 0.00

    Mercury Messenger, possibly 1.7.1.1 and other versions, when running on a multi-user Mac OS X platform, stores chat logs with world-readable permissions within the /Users directory, which allows local users to read the chat logs from other users.

  • CVE-2006-3670Jul 18, 2006
    Winlpd
    Winlpd
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in Winlpd 1.26 allows remote attackers to execute arbitrary code via a long string in a request to TCP port 515.