CVEs

343,963 total · page 6505 of 6,880

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2006-3671	Hyper Estraier Hyper Estraier	0.00	—	0.02	Jul 18, 2006	Cross-site request forgery (CSRF) vulnerability in the communicate function in estmaster.c for Hyper Estraier before 1.3.3 allows remote attackers to perform unauthorized actions as other users via unknown vectors.
CVE-2006-3672	KDE Konqueror	0.04	—	0.07	Jul 18, 2006	KDE Konqueror 3.5.1 and earlier allows remote attackers to cause a denial of service (application crash) by calling the replaceChild method on a DOM object, which triggers a null dereference, as demonstrated by calling document.replaceChild with a 0 (zero) argument.
CVE-2006-3673	Armagetron Armagetron Advanced	0.00	—	0.02	Jul 18, 2006	nNetObject.cpp in Armagetron Advanced 2.8.2 and earlier allows remote attackers to cause a denial of service (application crash) via a large owner value, which causes an assert error.
CVE-2006-3674	Armagetron Armagetron Advanced	0.00	—	0.02	Jul 18, 2006	nNetObject.cpp in Armagetron Advanced 2.8.2 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a large number handled by the id_req_handler function.
CVE-2006-3606	Sun Corporation Solaris	0.00	—	0.02	Jul 18, 2006	Unspecified vulnerability in Sun Solaris X Inter Client Exchange library (libICE) on Solaris 8 and 9 allows context-dependent attackers to cause a denial of service (application crash) to applications that use the library.
CVE-2006-3607	Softbizscripts Banner Exchange Network Script	0.03	—	0.02	Jul 18, 2006	Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Banner Exchange Script (aka Banner Exchange Network Script) 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the city parameter in (a) insertmember.php, and (2) a PHPSESSID cookie in (b)…
CVE-2006-3608	Flatnuke Flatnuke	0.03	—	0.02	Jul 18, 2006	The Gallery module in Simone Vellei Flatnuke 2.5.7 and earlier, when Gallery uploads are enabled, does not restrict the extensions of uploaded files that begin with a GIF header, which allows remote authenticated users to execute arbitrary PHP code via an uploaded .php file.
CVE-2006-3609	Orbitcoders Orbitmatrix	0.00	—	0.01	Jul 18, 2006	Cross-site scripting (XSS) vulnerability in index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to inject arbitrary web script or HTML via the page_name parameter with an IMG tag containing a javascript URI in the SRC attribute.
CVE-2006-3610	Orbitcoders Orbitmatrix	0.00	—	0.01	Jul 18, 2006	index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to obtain sensitive information (partial database schema) via a modified page_name parameter, which reflects portions of an SQL query in the result. NOTE: it is not clear whether the information is…
CVE-2006-3611	Phorum Phorum	0.03	—	0.02	Jul 18, 2006	Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALS[template] parameter, as demonstrated by injecting PHP sequences into a log file, which is then…
CVE-2006-3612	Phorum Phorum	0.00	—	0.01	Jul 18, 2006	Cross-site scripting (XSS) vulnerability in Phorum 5.1.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2006-3613	Chamberland Technology Ezwaiter Online	0.00	—	0.01	Jul 18, 2006	Multiple cross-site scripting (XSS) vulnerabilities in Chamberland Technology ezWaiter 3.0 Online and possibly Enterprise Software (aka enterprise edition) allow remote attackers to inject arbitrary web script or HTML via the (1) itemfor (aka "Who is this item for?") and (2)…
CVE-2006-3614	Orbitcoders Orbitmatrix	0.00	—	0.01	Jul 18, 2006	index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to trigger a SQL error via the page_name parameter, possibly due to a SQL injection vulnerability.
CVE-2006-3615	Phorum Phorum	0.00	—	0.02	Jul 18, 2006	Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable.
CVE-2006-3616	Carbonize Lazarus Guestbook	0.03	—	0.02	Jul 18, 2006	Multiple cross-site scripting (XSS) vulnerabilities in Carbonize Lazarus Guestbook 1.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the show parameter in codes-english.php and (2) the img parameter in picture.php, after the name of an…
CVE-2006-3617	Pixelated By Lev Guestbook	0.00	—	0.01	Jul 18, 2006	Cross-site scripting (XSS) vulnerability in pblguestbook.php in Pixelated By Lev (PBL) Guestbook 1.32 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) message (aka comments), (3) website, and (4) email parameters, which bypasses…
CVE-2006-3620	Koobi Pro CMS	0.00	—	0.01	Jul 18, 2006	Cross-site scripting (XSS) vulnerability in the showtopic module in Koobi Pro CMS 5.6 allows remote attackers to inject arbitrary web script or HTML via the toid parameter.
CVE-2006-3621	Koobi Pro CMS	0.03	—	0.01	Jul 18, 2006	SQL injection vulnerability in the showtopic module in Koobi Pro CMS 5.6 allows remote attackers to execute arbitrary SQL commands via the toid parameter.
CVE-2006-3622	Koobi Pro CMS	0.00	—	0.01	Jul 18, 2006	The showtopic module in Koobi Pro CMS 5.6 allows remote attackers to obtain sensitive information via a ' (single quote) in the p parameter, which displays the path in an error message. NOTE: it is not clear whether this is SQL injection or a forced SQL error.
CVE-2006-3623	McAfee Epolicy Orchestrator Agent	0.00	—	0.02	Jul 18, 2006	Directory traversal vulnerability in Framework Service component in McAfee ePolicy Orchestrator agent 3.5.0.x and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the directory and filename in a PropsResponse (PackageType) request.
CVE-2006-3624	Flv Flv Player	0.03	—	0.02	Jul 18, 2006	Multiple cross-site scripting (XSS) vulnerabilities in FLV Players 8 allow remote attackers to inject arbitrary web script or HTML via the url parameter to (1) player.php or (2) popup.php.
CVE-2006-3625	Flv Flv Player	0.00	—	0.01	Jul 18, 2006	FLV Players 8 allows remote attackers to obtain sensitive information via (1) a direct request to paginate.php or (2) an invalid p parameter to player.php, which reveal the path in an error message.
CVE-2006-3626	Linux Kernel	0.00	—	0.02	Jul 18, 2006	Race condition in Linux kernel 2.6.17.4 and earlier allows local users to gain root privileges by using prctl with PR_SET_DUMPABLE in a way that causes /proc/self/environ to become setuid root.
CVE-2006-2450	Libvncserver Libvncserver	0.00	—	0.04	Jul 18, 2006	auth.c in LibVNCServer 0.7.1 allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, a different issue than CVE-2006-2369.
CVE-2006-3591	Microsoft Internet Explorer	0.05	—	0.26	Jul 18, 2006	Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) by accessing the URL property of a TriEditDocument.TriEditDocument object before it has been initialized, which triggers a NULL pointer dereference.
CVE-2006-3592	Cisco Systems, Inc. Unified Callmanager	0.00	—	0.01	Jul 18, 2006	Unspecified vulnerability in the command line interface (CLI) in Cisco Unified CallManager (CUCM) 5.0(1) through 5.0(3a) allows local users to execute arbitrary commands with elevated privileges via unspecified vectors, involving "certain CLI commands," aka bug CSCse11005.
CVE-2006-3593	Cisco Systems, Inc. Unified Callmanager	0.00	—	0.01	Jul 18, 2006	The command line interface (CLI) in Cisco Unified CallManager (CUCM) 5.0(1) through 5.0(3a) allows local users to overwrite arbitrary files by redirecting a command's output to a file or folder, aka bug CSCse31704.
CVE-2006-3594	Cisco Systems, Inc. Unified Callmanager	0.00	—	0.04	Jul 18, 2006	Buffer overflow in Cisco Unified CallManager (CUCM) 5.0(1) through 5.0(3a) allows remote attackers to execute arbitrary code via a long hostname in a SIP request, aka bug CSCsd96542.
CVE-2006-3595	Cisco Systems, Inc. Router Web Setup	0.00	—	0.04	Jul 18, 2006	The default configuration of IOS HTTP server in Cisco Router Web Setup (CRWS) before 3.3.0 build 31 does not require credentials, which allows remote attackers to access the server with arbitrary privilege levels, aka bug CSCsa78190.
CVE-2006-3596	Cisco Systems, Inc. Intrusion Prevention System	0.00	—	0.02	Jul 18, 2006	The device driver for Intel-based gigabit network adapters in Cisco Intrusion Prevention System (IPS) 5.1(1) through 5.1(p1), as installed on various Cisco Intrusion Prevention System 42xx appliances, allows remote attackers to cause a denial of service (kernel panic and…
CVE-2006-3597	Ubuntu passwd	0.00	—	0.01	Jul 18, 2006	passwd before 1:4.0.13 on Ubuntu 6.06 LTS leaves the root password blank instead of locking it when the administrator selects the "Go Back" option after the final "Installation complete" message and uses the main menu, which causes the password to be zeroed out in the…
CVE-2006-3598	PHP-Nuke Sections Module	0.00	—	0.01	Jul 18, 2006	SQL injection vulnerability in the Sections module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the artid parameter in a viewarticle op.
CVE-2006-3599	PHP-Nuke Advanced Classified Module	0.00	—	0.01	Jul 18, 2006	SQL injection vulnerability in the Nuke Advanced Classifieds module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id_ads parameter in an EditAds op.
CVE-2006-3600	Libtunepimp Libtunepimp	0.00	—	0.04	Jul 18, 2006	Multiple stack-based buffer overflows in the LookupTRM::lookup function in libtunepimp (TunePimp) 0.4.2 allow remote user-assisted attackers to cause a denial of service (application crash) and possibly execute code via a long (1) Album release date (MBE_ReleaseGetDate), (2)…
CVE-2006-3601	Dnnsoftware Dotnetnuke	0.00	—	0.02	Jul 18, 2006	UNVERIFIABLE Unspecified vulnerability in an unspecified DNN Modules module for DotNetNuke (.net nuke) allows remote attackers to gain privileges via unspecified vectors, as used in an attack against the Microsoft France web site. NOTE: due to the lack of details and…
CVE-2006-3602	Farsinews Farsinews	0.03	—	0.03	Jul 18, 2006	Directory traversal vulnerability in jscripts/tiny_mce/tiny_mce_gzip.php in FarsiNews 3.0 BETA 1 allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing null (%00) byte in the language parameter in the advanced theme.
CVE-2006-3603	FlexWATCH Network Camera	0.03	—	0.02	Jul 18, 2006	Cross-site scripting (XSS) vulnerability in index.php in FlexWATCH Network Camera 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL.
CVE-2006-3604	FlexWATCH Network Camera	0.03	—	0.03	Jul 18, 2006	Directory traversal vulnerability in FlexWATCH Network Camera 3.0 and earlier allows remote attackers to bypass access restrictions for (1) admin/aindex.asp or (2) admin/aindex.html via a .. (dot dot) and encoded / (%2f) sequence in the URL.
CVE-2006-3605	Microsoft Internet Explorer	0.05	—	0.24	Jul 18, 2006	Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the Transition property on an uninitialized DXImageTransform.Microsoft.RevealTrans.1 ActiveX Object, which triggers a null dereference.
CVE-2006-3590	Microsoft Powerpoint	0.01	—	0.14	Jul 14, 2006	mso.dll, as used by Microsoft PowerPoint 2000 through 2003, allows user-assisted attackers to execute arbitrary commands via a malformed shape container in a PPT file that leads to memory corruption, as exploited by Trojan.PPDropper.B, a different issue than CVE-2006-1540 and…
CVE-2006-1301	Microsoft Excel	0.01	—	0.10	Jul 13, 2006	Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted SELECTION record that triggers memory corruption, a different vulnerability than CVE-2006-1302.
CVE-2006-1308	Microsoft Excel	0.01	—	0.09	Jul 13, 2006	Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted FNGROUPCOUNT value.
CVE-2006-1309	Microsoft Excel	0.01	—	0.10	Jul 13, 2006	Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted LABEL record that triggers memory corruption.
CVE-2006-1302	Microsoft Excel	0.01	—	0.14	Jul 13, 2006	Buffer overflow in Microsoft Excel 2000 through 2003 allows user-assisted attackers to execute arbitrary code via a .xls file with certain crafted fields in a SELECTION record, which triggers memory corruption, aka "Malformed SELECTION record Vulnerability."
CVE-2006-1304	Microsoft Excel	0.01	—	0.11	Jul 13, 2006	Buffer overflow in Microsoft Excel 2000 through 2003 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted COLINFO record, which triggers the overflow during a "data filling operation."
CVE-2006-1306	Microsoft Excel	0.01	—	0.09	Jul 13, 2006	Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted BIFF record with an attacker-controlled array index that is used for a function pointer, aka "Malformed OBJECT record Vulnerability."
CVE-2006-2388	Microsoft Excel	0.01	—	0.11	Jul 13, 2006	Microsoft Office Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via malformed cell comments, which lead to modification of "critical data offsets" during the rebuilding process.
CVE-2006-3135	Hotwebscripts CMS Mundo	0.00	—	0.02	Jul 13, 2006	Multiple SQL injection vulnerabilities in CMS Mundo 1.0 build 008, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) news_id parameter in the (a) news module, (2) searchstring parameter in (b) the search module, (3) id parameter in…
CVE-2006-3587	Adobe Inc. Flashplayer	0.01	—	0.08	Jul 13, 2006	Unspecified vulnerability in Adobe (Macromedia) Flash Player 8.0.24.0 allows remote attackers to execute arbitrary commands via a malformed .swf file that results in "multiple improper memory access" errors.
CVE-2006-3588	Adobe Inc. Flashplayer	0.01	—	0.07	Jul 13, 2006	Unspecified vulnerability in Adobe (Macromedia) Flash Player 8.0.24.0 allows remote attackers to cause a denial of service (browser crash) via a malformed, compressed .swf file, a different issue than CVE-2006-3587.

CVE-2006-3671Jul 18, 2006
Hyper Estraier
Hyper Estraier
risk 0.00cvss —epss 0.02
Cross-site request forgery (CSRF) vulnerability in the communicate function in estmaster.c for Hyper Estraier before 1.3.3 allows remote attackers to perform unauthorized actions as other users via unknown vectors.
CVE-2006-3672Jul 18, 2006
KDE
Konqueror
risk 0.04cvss —epss 0.07
KDE Konqueror 3.5.1 and earlier allows remote attackers to cause a denial of service (application crash) by calling the replaceChild method on a DOM object, which triggers a null dereference, as demonstrated by calling document.replaceChild with a 0 (zero) argument.
CVE-2006-3673Jul 18, 2006
Armagetron
Armagetron Advanced
risk 0.00cvss —epss 0.02
nNetObject.cpp in Armagetron Advanced 2.8.2 and earlier allows remote attackers to cause a denial of service (application crash) via a large owner value, which causes an assert error.
CVE-2006-3674Jul 18, 2006
Armagetron
Armagetron Advanced
risk 0.00cvss —epss 0.02
nNetObject.cpp in Armagetron Advanced 2.8.2 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a large number handled by the id_req_handler function.
CVE-2006-3606Jul 18, 2006
Sun Corporation
Solaris
risk 0.00cvss —epss 0.02
Unspecified vulnerability in Sun Solaris X Inter Client Exchange library (libICE) on Solaris 8 and 9 allows context-dependent attackers to cause a denial of service (application crash) to applications that use the library.
CVE-2006-3607Jul 18, 2006
Softbizscripts
Banner Exchange Network Script
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Banner Exchange Script (aka Banner Exchange Network Script) 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the city parameter in (a) insertmember.php, and (2) a PHPSESSID cookie in (b)…
CVE-2006-3608Jul 18, 2006
Flatnuke
Flatnuke
risk 0.03cvss —epss 0.02
The Gallery module in Simone Vellei Flatnuke 2.5.7 and earlier, when Gallery uploads are enabled, does not restrict the extensions of uploaded files that begin with a GIF header, which allows remote authenticated users to execute arbitrary PHP code via an uploaded .php file.
CVE-2006-3609Jul 18, 2006
Orbitcoders
Orbitmatrix
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to inject arbitrary web script or HTML via the page_name parameter with an IMG tag containing a javascript URI in the SRC attribute.
CVE-2006-3610Jul 18, 2006
Orbitcoders
Orbitmatrix
risk 0.00cvss —epss 0.01
index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to obtain sensitive information (partial database schema) via a modified page_name parameter, which reflects portions of an SQL query in the result. NOTE: it is not clear whether the information is…
CVE-2006-3611Jul 18, 2006
Phorum
Phorum
risk 0.03cvss —epss 0.02
Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALS[template] parameter, as demonstrated by injecting PHP sequences into a log file, which is then…
CVE-2006-3612Jul 18, 2006
Phorum
Phorum
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Phorum 5.1.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2006-3613Jul 18, 2006
Chamberland Technology
Ezwaiter Online
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Chamberland Technology ezWaiter 3.0 Online and possibly Enterprise Software (aka enterprise edition) allow remote attackers to inject arbitrary web script or HTML via the (1) itemfor (aka "Who is this item for?") and (2)…
CVE-2006-3614Jul 18, 2006
Orbitcoders
Orbitmatrix
risk 0.00cvss —epss 0.01
index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to trigger a SQL error via the page_name parameter, possibly due to a SQL injection vulnerability.
CVE-2006-3615Jul 18, 2006
Phorum
Phorum
risk 0.00cvss —epss 0.02
Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable.
CVE-2006-3616Jul 18, 2006
Carbonize
Lazarus Guestbook
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Carbonize Lazarus Guestbook 1.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the show parameter in codes-english.php and (2) the img parameter in picture.php, after the name of an…
CVE-2006-3617Jul 18, 2006
Pixelated By Lev
Guestbook
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in pblguestbook.php in Pixelated By Lev (PBL) Guestbook 1.32 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) message (aka comments), (3) website, and (4) email parameters, which bypasses…
CVE-2006-3620Jul 18, 2006
Koobi Pro
CMS
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the showtopic module in Koobi Pro CMS 5.6 allows remote attackers to inject arbitrary web script or HTML via the toid parameter.
CVE-2006-3621Jul 18, 2006
Koobi Pro
CMS
risk 0.03cvss —epss 0.01
SQL injection vulnerability in the showtopic module in Koobi Pro CMS 5.6 allows remote attackers to execute arbitrary SQL commands via the toid parameter.
CVE-2006-3622Jul 18, 2006
Koobi Pro
CMS
risk 0.00cvss —epss 0.01
The showtopic module in Koobi Pro CMS 5.6 allows remote attackers to obtain sensitive information via a ' (single quote) in the p parameter, which displays the path in an error message. NOTE: it is not clear whether this is SQL injection or a forced SQL error.
CVE-2006-3623Jul 18, 2006
McAfee
Epolicy Orchestrator Agent
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in Framework Service component in McAfee ePolicy Orchestrator agent 3.5.0.x and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the directory and filename in a PropsResponse (PackageType) request.
CVE-2006-3624Jul 18, 2006
Flv
Flv Player
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in FLV Players 8 allow remote attackers to inject arbitrary web script or HTML via the url parameter to (1) player.php or (2) popup.php.
CVE-2006-3625Jul 18, 2006
Flv
Flv Player
risk 0.00cvss —epss 0.01
FLV Players 8 allows remote attackers to obtain sensitive information via (1) a direct request to paginate.php or (2) an invalid p parameter to player.php, which reveal the path in an error message.
CVE-2006-3626Jul 18, 2006
Linux
Kernel
risk 0.00cvss —epss 0.02
Race condition in Linux kernel 2.6.17.4 and earlier allows local users to gain root privileges by using prctl with PR_SET_DUMPABLE in a way that causes /proc/self/environ to become setuid root.
CVE-2006-2450Jul 18, 2006
Libvncserver
Libvncserver
risk 0.00cvss —epss 0.04
auth.c in LibVNCServer 0.7.1 allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, a different issue than CVE-2006-2369.
CVE-2006-3591Jul 18, 2006
Microsoft
Internet Explorer
risk 0.05cvss —epss 0.26
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) by accessing the URL property of a TriEditDocument.TriEditDocument object before it has been initialized, which triggers a NULL pointer dereference.
CVE-2006-3592Jul 18, 2006
Cisco Systems, Inc.
Unified Callmanager
risk 0.00cvss —epss 0.01
Unspecified vulnerability in the command line interface (CLI) in Cisco Unified CallManager (CUCM) 5.0(1) through 5.0(3a) allows local users to execute arbitrary commands with elevated privileges via unspecified vectors, involving "certain CLI commands," aka bug CSCse11005.
CVE-2006-3593Jul 18, 2006
Cisco Systems, Inc.
Unified Callmanager
risk 0.00cvss —epss 0.01
The command line interface (CLI) in Cisco Unified CallManager (CUCM) 5.0(1) through 5.0(3a) allows local users to overwrite arbitrary files by redirecting a command's output to a file or folder, aka bug CSCse31704.
CVE-2006-3594Jul 18, 2006
Cisco Systems, Inc.
Unified Callmanager
risk 0.00cvss —epss 0.04
Buffer overflow in Cisco Unified CallManager (CUCM) 5.0(1) through 5.0(3a) allows remote attackers to execute arbitrary code via a long hostname in a SIP request, aka bug CSCsd96542.
CVE-2006-3595Jul 18, 2006
Cisco Systems, Inc.
Router Web Setup
risk 0.00cvss —epss 0.04
The default configuration of IOS HTTP server in Cisco Router Web Setup (CRWS) before 3.3.0 build 31 does not require credentials, which allows remote attackers to access the server with arbitrary privilege levels, aka bug CSCsa78190.
CVE-2006-3596Jul 18, 2006
Cisco Systems, Inc.
Intrusion Prevention System
risk 0.00cvss —epss 0.02
The device driver for Intel-based gigabit network adapters in Cisco Intrusion Prevention System (IPS) 5.1(1) through 5.1(p1), as installed on various Cisco Intrusion Prevention System 42xx appliances, allows remote attackers to cause a denial of service (kernel panic and…
CVE-2006-3597Jul 18, 2006
Ubuntu
passwd
risk 0.00cvss —epss 0.01
passwd before 1:4.0.13 on Ubuntu 6.06 LTS leaves the root password blank instead of locking it when the administrator selects the "Go Back" option after the final "Installation complete" message and uses the main menu, which causes the password to be zeroed out in the…
CVE-2006-3598Jul 18, 2006
PHP-Nuke
Sections Module
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the Sections module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the artid parameter in a viewarticle op.
CVE-2006-3599Jul 18, 2006
PHP-Nuke
Advanced Classified Module
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the Nuke Advanced Classifieds module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id_ads parameter in an EditAds op.
CVE-2006-3600Jul 18, 2006
Libtunepimp
Libtunepimp
risk 0.00cvss —epss 0.04
Multiple stack-based buffer overflows in the LookupTRM::lookup function in libtunepimp (TunePimp) 0.4.2 allow remote user-assisted attackers to cause a denial of service (application crash) and possibly execute code via a long (1) Album release date (MBE_ReleaseGetDate), (2)…
CVE-2006-3601Jul 18, 2006
Dnnsoftware
Dotnetnuke
risk 0.00cvss —epss 0.02
** UNVERIFIABLE ** Unspecified vulnerability in an unspecified DNN Modules module for DotNetNuke (.net nuke) allows remote attackers to gain privileges via unspecified vectors, as used in an attack against the Microsoft France web site. NOTE: due to the lack of details and…
CVE-2006-3602Jul 18, 2006
Farsinews
Farsinews
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in jscripts/tiny_mce/tiny_mce_gzip.php in FarsiNews 3.0 BETA 1 allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing null (%00) byte in the language parameter in the advanced theme.
CVE-2006-3603Jul 18, 2006
FlexWATCH
Network Camera
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in index.php in FlexWATCH Network Camera 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL.
CVE-2006-3604Jul 18, 2006
FlexWATCH
Network Camera
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in FlexWATCH Network Camera 3.0 and earlier allows remote attackers to bypass access restrictions for (1) admin/aindex.asp or (2) admin/aindex.html via a .. (dot dot) and encoded / (%2f) sequence in the URL.
CVE-2006-3605Jul 18, 2006
Microsoft
Internet Explorer
risk 0.05cvss —epss 0.24
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the Transition property on an uninitialized DXImageTransform.Microsoft.RevealTrans.1 ActiveX Object, which triggers a null dereference.
CVE-2006-3590Jul 14, 2006
Microsoft
Powerpoint
risk 0.01cvss —epss 0.14
mso.dll, as used by Microsoft PowerPoint 2000 through 2003, allows user-assisted attackers to execute arbitrary commands via a malformed shape container in a PPT file that leads to memory corruption, as exploited by Trojan.PPDropper.B, a different issue than CVE-2006-1540 and…
CVE-2006-1301Jul 13, 2006
Microsoft
Excel
risk 0.01cvss —epss 0.10
Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted SELECTION record that triggers memory corruption, a different vulnerability than CVE-2006-1302.
CVE-2006-1308Jul 13, 2006
Microsoft
Excel
risk 0.01cvss —epss 0.09
Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted FNGROUPCOUNT value.
CVE-2006-1309Jul 13, 2006
Microsoft
Excel
risk 0.01cvss —epss 0.10
Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted LABEL record that triggers memory corruption.
CVE-2006-1302Jul 13, 2006
Microsoft
Excel
risk 0.01cvss —epss 0.14
Buffer overflow in Microsoft Excel 2000 through 2003 allows user-assisted attackers to execute arbitrary code via a .xls file with certain crafted fields in a SELECTION record, which triggers memory corruption, aka "Malformed SELECTION record Vulnerability."
CVE-2006-1304Jul 13, 2006
Microsoft
Excel
risk 0.01cvss —epss 0.11
Buffer overflow in Microsoft Excel 2000 through 2003 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted COLINFO record, which triggers the overflow during a "data filling operation."
CVE-2006-1306Jul 13, 2006
Microsoft
Excel
risk 0.01cvss —epss 0.09
Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted BIFF record with an attacker-controlled array index that is used for a function pointer, aka "Malformed OBJECT record Vulnerability."
CVE-2006-2388Jul 13, 2006
Microsoft
Excel
risk 0.01cvss —epss 0.11
Microsoft Office Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via malformed cell comments, which lead to modification of "critical data offsets" during the rebuilding process.
CVE-2006-3135Jul 13, 2006
Hotwebscripts
CMS Mundo
risk 0.00cvss —epss 0.02
Multiple SQL injection vulnerabilities in CMS Mundo 1.0 build 008, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) news_id parameter in the (a) news module, (2) searchstring parameter in (b) the search module, (3) id parameter in…
CVE-2006-3587Jul 13, 2006
Adobe Inc.
Flashplayer
risk 0.01cvss —epss 0.08
Unspecified vulnerability in Adobe (Macromedia) Flash Player 8.0.24.0 allows remote attackers to execute arbitrary commands via a malformed .swf file that results in "multiple improper memory access" errors.
CVE-2006-3588Jul 13, 2006
Adobe Inc.
Flashplayer
risk 0.01cvss —epss 0.07
Unspecified vulnerability in Adobe (Macromedia) Flash Player 8.0.24.0 allows remote attackers to cause a denial of service (browser crash) via a malformed, compressed .swf file, a different issue than CVE-2006-3587.