VYPR

CVEs

343,956 total · page 6506 of 6,880

AllCriticalHighKEV
  • CVE-2006-3577Jul 13, 2006
    Lifetype
    Lifetype
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in LifeType 1.0.5 allows remote attackers to execute arbitrary SQL commands via the Date parameter in a Default op.

  • CVE-2006-3578Jul 13, 2006
    Fujitsu
    Serverview
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Fujitsu ServerView 2.50 up to 3.60L98 and 4.10L11 up to 4.11L81 allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2006-3579Jul 13, 2006
    Fujitsu
    Serverview
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Fujitsu ServerView 2.50 up to 3.60L98 and 4.10L11 up to 4.11L81 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-3580Jul 13, 2006
    Asp Stats Generator
    Asp Stats Generator
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pages.asp in ASP Stats Generator before 2.1.2 allows remote attackers to execute arbitrary SQL commands via the order parameter.

  • CVE-2006-3560Jul 13, 2006
    Blue Dojo
    Graffiti Forums
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in topics.php in Blue Dojo Graffiti Forums 1.0 allows remote attackers to execute arbitrary SQL commands via the f parameter.

  • CVE-2006-3561Jul 13, 2006
    Bt
    Voyager 2091 Wireless Adsl Router
    risk 0.04cvss —epss 0.07

    BT Voyager 2091 Wireless firmware 2.21.05.08m_A2pB018c1.d16d and earlier, and 3.01m and earlier, allow remote attackers to bypass the authentication process and gain sensitive information, such as configuration information via (1) /btvoyager_getconfig.sh, PPP credentials via (2)…

  • CVE-2006-3562Jul 13, 2006
    Plume CMS
    CMS
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerabilities in plume cms 1.0.4 allow remote attackers to execute arbitrary PHP code via a URL in the _PX_config[manager_path] parameter to (1) index.php, (2) rss.php, or (3) search.php, a different set of vectors and versions than CVE-2006-2645 and…

  • CVE-2006-3563Jul 13, 2006
    Winged Gallery
    Winged Gallery
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in gallery/thumb.php in Winged Gallery 1.0 allows remote attackers to inject arbitrary web script or HTML via the image parameter.

  • CVE-2006-3564Jul 13, 2006
    Hivemail
    Hivemail
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the email, (2) cond, or (3) name parameters to (a) addressbook.view.php, (4) the daysprune parameter to (b) index.php, (5) the…

  • CVE-2006-3565Jul 13, 2006
    Hivemail
    Hivemail
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in search.results.php in HiveMail 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the fields[] parameter.

  • CVE-2006-3566Jul 13, 2006
    Hivemail
    Hivemail
    risk 0.00cvss —epss 0.01

    search.results.php in HiveMail 3.1 and earlier allows remote attackers to obtain the installation path via certain manipulations related to the (1) searchdate and (2) folderids parameters.

  • CVE-2006-3567Jul 13, 2006
    Juniper Networks
    Dx
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web administration interface logging feature in Juniper Networks (Redline) DX 5.1.x, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the username login field.

  • CVE-2006-3568Jul 13, 2006
    Fantastic
    Guestbook
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in guestbook.php in Fantastic Guestbook 2.0.1, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the (1) first_name, (2) last_name, or (3) nickname parameters.

  • CVE-2006-3569Jul 13, 2006
    NetApp
    Data Ontap
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in NetApp Data ONTAP 7.0x through 7.0.4P8D9, 7.1x, 7.1.0.1x, and 7.2RC1, RC2, and RC3, as used in IBM N series Filers and other products, allows unauthorized users to gain access to privileged commands via unknown vectors, probably related to incorrect…

  • CVE-2006-3570Jul 13, 2006
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the webform module in Drupal 4.6 before July 8, 2006 and 4.7 before July 8, 2006 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-3571Jul 13, 2006
    Papoo
    Papoo
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in interna/hilfe.php in Papoo 3 RC3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) titel or (2) ausgabe parameters.

  • CVE-2006-3572Jul 13, 2006
    Papoo
    Papoo
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in forumthread.php in Papoo 3 RC3 and earlier allows remote attackers to execute arbitrary SQL commands via the msgid parameter.

  • CVE-2006-3538Jul 13, 2006
    Beatificfaith
    Eprayer
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in demo.php in BeatificFaith Eprayer Alpha allow remote attackers to inject arbitrary web script or HTML via the SRC attribute of a SCRIPT element in the (1) "Your name" field and (2) "Enter Prayer Request here" field.

  • CVE-2006-3539Jul 13, 2006
    Dkscript
    Dragons Kingdom Script
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in DKScript.com Dragon's Kingdom Script 1.0 allow remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element in the (1) Subject and (2) Message fields in a do=write (aka…

  • CVE-2006-3540Jul 13, 2006
    Zonelabs
    Zonealarm Security Suite
    risk 0.00cvss —epss 0.01

    Check Point Zone Labs ZoneAlarm Internet Security Suite 6.5.722.000, 6.1.737.000, and possibly other versions do not properly validate RegSaveKey, RegRestoreKey, and RegDeleteKey function calls, which allows local users to cause a denial of service (system crash) via a certain…

  • CVE-2006-3541Jul 13, 2006
    Kyberna
    Ky2help
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Meine Links (aka My Links) in Kyberna ky2help allows remote authenticated users to execute arbitrary SQL commands via unspecified "textboxes."

  • CVE-2006-3542Jul 13, 2006
    Garry Glendown
    Shopping Cart
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Garry Glendown Shopping Cart 0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) shop name field in (a) editshop.php, (b) edititem.php, and (c) index.php; and via the (2) item field in editshop.php…

  • CVE-2006-3543Jul 13, 2006
    Invision Power Services
    Power Board
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.x and 2.x allow remote attackers to execute arbitrary SQL commands via the (1) idcat and (2) code parameters in a ketqua action in index.php; the id parameter in a (3) Attach and (4) ref action in index.php;…

  • CVE-2006-3544Jul 13, 2006
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.3 Final allow remote attackers to execute arbitrary SQL commands via the CODE parameter in a (1) Stats, (2) Mail, and (3) Reg action in index.php. NOTE: the developer has disputed this issue, stating that "At…

  • CVE-2006-3545Jul 13, 2006
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.14

    Microsoft Internet Explorer 7.0 Beta allows remote attackers to cause a denial of service (application crash) via a web page with multiple empty APPLET start tags. NOTE: a third party has disputed this issue, stating that the crash does not occur with Microsoft Internet…

  • CVE-2006-3546Jul 13, 2006
    Patrice Freydiere
    ImgSvr
    risk 0.03cvss —epss 0.03

    Patrice Freydiere ImgSvr (aka ADA Image Server) allows remote attackers to cause a denial of service (daemon crash) via a long HTTP POST request. NOTE: this might be the same issue as CVE-2004-2463.

  • CVE-2006-3547MedJul 13, 2006
    VMware
    Player
    risk 0.36cvss 5.5epss 0.01

    EMC VMware Player allows user-assisted attackers to cause a denial of service (unrecoverable application failure) via a long value of the ide1:0.fileName parameter in the .vmx file of a virtual machine. NOTE: third parties have disputed this issue, saying that write access to…

  • CVE-2006-3548Jul 13, 2006
    Horde (software)
    Horde
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a (1) javascript URI or an external (2) http, (3) https, or (4) ftp URI in the url…

  • CVE-2006-3549Jul 13, 2006
    Horde (software)
    Application Framework
    risk 0.00cvss —epss 0.02

    services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform "Web tunneling" attacks and use the server as a proxy via (1) http, (2) https, and (3) ftp…

  • CVE-2006-3550Jul 13, 2006
    F5, Inc.
    FirePass 4100
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in F5 Networks FirePass 4100 5.x allow remote attackers to inject arbitrary web script or HTML via unspecified "writable form fields and hidden fields," including "authentication frontends."

  • CVE-2006-3551Jul 13, 2006
    NCP
    Secure Enterprise Client
    risk 0.00cvss —epss 0.00

    NCP Secure Enterprise Client (aka VPN/PKI client) 8.30 Build 59, and possibly earlier versions, when the Link Firewall and Personal Firewall are both configured to block all inbound and outbound network traffic, allows context-dependent attackers to send inbound UDP traffic with…

  • CVE-2006-3552Jul 13, 2006
    Ipswitch, Inc.
    Ipswitch Collaboration Suite
    risk 0.00cvss —epss 0.02

    Premium Anti-Spam in Ipswitch IMail Secure Server 2006 and Collaboration Suite 2006 Premium, when using a certain .dat file in the StarEngine /data directory from 20060630 or earlier, does not properly receive and implement bullet signature updates, which allows…

  • CVE-2006-3553Jul 13, 2006
    Planet Concept
    Planetnews
    risk 0.00cvss —epss 0.06

    PlaNet Concept planetNews allows remote attackers to bypass authentication and execute arbitrary code via a direct request to news/admin/planetnews.php.

  • CVE-2006-3554Jul 13, 2006
    Mkportal
    Mkportal
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in index.php in MKPortal 1.0.1 Final allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language cookie, as demonstrated by using a gl_session cookie to inject PHP sequences into the…

  • CVE-2006-3555Jul 13, 2006
    PHP-Fusion
    Phpfusion
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using edit_profile.php to upload a (1) avatar or (2) forum image attachment that has a .gif or .jpg extension, and…

  • CVE-2006-3556Jul 13, 2006
    Extcalendar
    Extcalendar
    risk 0.04cvss —epss 0.07

    PHP remote file inclusion vulnerability in extcalendar.php in Mohamed Moujami ExtCalendar 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3557Jul 13, 2006
    MT Orumcek
    Toplist
    risk 0.00cvss —epss 0.01

    MT Orumcek Toplist 2.2 stores DB/orumcektoplist.mdb under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request.

  • CVE-2006-3558Jul 13, 2006
    Auracms
    Auracms
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Arif Supriyanto auraCMS 1.62 allow remote attackers to inject arbitrary web script or HTML via (1) the judul_artikel parameter in teman.php and (2) the title of an article sent to admin, which is displayed when…

  • CVE-2006-3559Jul 13, 2006
    Auracms
    Auracms
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Arif Supriyanto auraCMS 1.62 allow remote attackers to execute arbitrary SQL commands and delete all shoutbox messages via the (1) name and (2) pesan parameters.

  • CVE-2006-3452Jul 12, 2006
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.01

    Adobe Reader and Acrobat 6.0.4 and earlier, on Mac OSX, has insecure file and directory permissions, which allows local users to gain privileges by overwriting program files.

  • CVE-2006-3530Jul 12, 2006
    Joomla
    PccookBook
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in com_pccookbook/pccookbook.php in the PccookBook Component for Mambo and Joomla 0.3 and possibly up to 1.3.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the mosConfig_absolute_path…

  • CVE-2006-3531Jul 12, 2006
    Pivot
    Pivot
    risk 0.04cvss —epss 0.09

    includes/editor/insert_image.php in Pivot 1.30 RC2 and earlier creates the authentication credentials from parameters, which allows remote attackers to obtain privileges and upload arbitrary files via modified (1) pass and (2) session parameters, and (3) pass and (4) userlevel…

  • CVE-2006-3532Jul 12, 2006
    Pivot
    Pivot
    risk 0.04cvss —epss 0.08

    PHP file inclusion vulnerability in includes/edit_new.php in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a FTP URL or full file path in the Paths[extensions_path] parameter.

  • CVE-2006-3533Jul 12, 2006
    Pivot
    Pivot
    risk 0.03cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) fg, (2) line1, (3) line2, (4) bg, (5) c1, (6) c2, (7) c3, and (8) c4 parameters in (a)…

  • CVE-2006-3534Jul 12, 2006
    Nullsoft
    Shoutcast Dsp
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Nullsoft SHOUTcast DSP before 1.9.6 filters directory traversal sequences before decoding, which allows remote attackers to read arbitrary files via encoded dot dot (%2E%2E) sequences in an HTTP GET request for a file path containing…

  • CVE-2006-3535Jul 12, 2006
    Nullsoft
    Shoutcast Dsp
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in Nullsoft SHOUTcast DSP before 1.9.7 allows remote attackers to read arbitrary files via unspecified vectors that are a "slight variation" of CVE-2006-3534.

  • CVE-2006-3536Jul 12, 2006
    risk 0.00cvss —epss 0.02

    Direct static code injection vulnerability in code/class_db_text.php in EJ3 TOPo 2.2.178 and earlier allows remote attackers to execute arbitrary PHP code via parameters such as (1) descripcion and (2) pais, which are stored directly in a PHP script. NOTE: the provenance of…

  • CVE-2006-3537Jul 12, 2006
    Randshop
    Randshop
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in Randshop before 1.2 allows remote attackers to execute arbitrary PHP code via the dateiPfad parameter, a different vector than CVE-2006-3375.

  • CVE-2006-3403Jul 12, 2006
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.06

    The smdb daemon (smbd/service.c) in Samba 3.0.1 through 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of share connection requests.

  • CVE-2006-3520Jul 12, 2006
    Sabdrimer CMS
    Sabdrimer CMS
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in skins/advanced/advanced1.php in Sabdrimer Pro 2.2.4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pluginpath[0] parameter.