VYPR

CVEs

343,956 total · page 6509 of 6,880

AllCriticalHighKEV
  • CVE-2006-3370Jul 6, 2006
    Blueboy
    Blueboy
    risk 0.00cvss —epss 0.01

    Blueboy 1.0.3 stores bb_news_config.inc under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information, including the database configuration.

  • CVE-2006-3371Jul 6, 2006
    Eupla
    Foros
    risk 0.00cvss —epss 0.01

    Eupla Foros 1.0 stores the inc/config.inc file under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information, including the database configuration.

  • CVE-2006-3372Jul 6, 2006
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.09

    Apple Safari 2.0.4/419.3 allows remote attackers to cause a denial of service (application crash) via a DHTML setAttributeNode function call with zero arguments, which triggers a null dereference.

  • CVE-2006-3373Jul 6, 2006
    Hobbit Monitor
    Hobbit
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the client/bin/logfetch script in Hobbit 4.2-beta allows local users to read arbitrary files, related to logfetch running as setuid root.

  • CVE-2006-3374Jul 6, 2006
    Randshop
    Randshop
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in Randshop 1.2 and earlier, including 0.9.3, allows remote attackers to execute arbitrary PHP code via a URL in the incl parameter.

  • CVE-2006-3375Jul 6, 2006
    Randshop
    Randshop
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/header.inc.php in Randshop 1.1.1 allows remote attackers to execute arbitrary PHP code via the dateiPfad parameter.

  • CVE-2006-3376Jul 6, 2006
    Wvware
    Libwmf
    risk 0.01cvss —epss 0.08

    Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.

  • CVE-2006-3377Jul 6, 2006
    Jmb Software
    Autorank
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in JMB Software AutoRank PHP 3.02 and earlier, and AutoRank Pro 5.01 and earlier, allows remote attackers to inject arbitrary web script or HTML via the (1) Keyword parameter in search.php and the (2) Username parameter in main.cgi.

  • CVE-2006-3378Jul 6, 2006
    Ubuntu
    shadow
    risk 0.00cvss —epss 0.00

    passwd command in shadow in Ubuntu 5.04 through 6.06 LTS, when called with the -f, -g, or -s flag, does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits.

  • CVE-2006-3379Jul 6, 2006
    Hiki
    Hiki Wiki
    risk 0.00cvss —epss 0.02

    Algorithmic complexity vulnerability in Hiki Wiki 0.6.0 through 0.6.5 and 0.8.0 through 0.8.5 allows remote attackers to cause a denial of service (CPU consumption) by performing a diff between large, crafted pages that trigger the worst case.

  • CVE-2006-3380Jul 6, 2006
    Freestyle
    Wiki
    risk 0.00cvss —epss 0.02

    Algorithmic complexity vulnerability in FreeStyle Wiki before 3.6.2 allows remote attackers to cause a denial of service (CPU consumption) by performing a diff between large, crafted pages that trigger the worst case.

  • CVE-2006-3381Jul 6, 2006
    Sturgeon Upload
    Sturgeon Upload
    risk 0.03cvss —epss 0.03

    SturGeoN Upload allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension, then directly accessing the file. NOTE: It is uncertain whether this is a vulnerability or a feature of the product.

  • CVE-2006-3382Jul 6, 2006
    Mads
    Mads
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in mAds 1.0 allows remote attackers to inject arbitrary web script or HTML via the "search string".

  • CVE-2006-3383Jul 6, 2006
    Mads
    Mads
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in mAds 1.0 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as onmouseover within a URL. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2006-3384Jul 6, 2006
    Vincent Leclercq
    News
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in divers.php in Vincent Leclercq News 5.2 allows remote attackers to execute arbitrary SQL commands via the (1) id and (2) texte parameters.

  • CVE-2006-3385Jul 6, 2006
    Vincent Leclercq
    News
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in divers.php in Vincent Leclercq News 5.2 allows remote attackers to inject arbitrary web script or HTML via the (1) id and (2) disabled parameters.

  • CVE-2006-3386Jul 6, 2006
    Vincent Leclercq
    News
    risk 0.00cvss —epss 0.01

    index.php in Vincent Leclercq News 5.2 allows remote attackers to obtain sensitive information, such as the installation path, via a mail[] parameter with invalid values.

  • CVE-2006-3387Jul 6, 2006
    Fusionphp
    Fusion News
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in sources/post.php in Fusion News 1.0, when register_globals is enabled, allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the fil_config parameter, which can be used to execute PHP code that has been injected…

  • CVE-2006-3388Jul 6, 2006
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the table parameter.

  • CVE-2006-3389Jul 6, 2006
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the…

  • CVE-2006-3390Jul 6, 2006
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.

  • CVE-2006-3391Jul 6, 2006
    Imbc
    Imbccontents Activex Control
    risk 0.00cvss —epss 0.01

    The Execute function in iMBCContents ActiveX Control before 2.0.0.59 allows remote attackers to execute arbitrary files via the file URI handler.

  • CVE-2006-3392Jul 6, 2006
    Webmin
    Webmin
    risk 0.09cvss —epss 0.78

    Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed…

  • CVE-2006-3393Jul 6, 2006
    Papyrus
    NASCAR Racing 4
    risk 0.00cvss —epss 0.02

    Papyrus NASCAR Racing 4 4.1.3.1.6 and earlier, 2002 Season 1.1.0.2 and earlier, and 2003 Season 1.2.0.1 and earlier allows remote attackers to cause a denial of service (CPU consumption) by sending an empty UDP datagram, which is not properly discarded due to use of the FIONREAD…

  • CVE-2006-3394Jul 6, 2006
    Bxcp
    Bxcp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the files mod in index.php in BXCP 0.3.0.4 allows remote attackers to execute arbitrary SQL commands via the where parameter in a view action.

  • CVE-2006-3395Jul 6, 2006
    Webdesignhq
    Sitebuilder Fx
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in top.php in SiteBuilder-FX 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter.

  • CVE-2006-3396Jul 6, 2006
    Miro International
    Galleria
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in galleria.html.php in Galleria Mambo Module 1.0 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3397Jul 6, 2006
    Pkr Internet
    Taskjitsu
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Taskjitsu before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via multiple unspecified parameters, including the (1) title and (2) description parameters when creating a task.

  • CVE-2006-3398Jul 6, 2006
    Pkr Internet
    Taskjitsu
    risk 0.00cvss —epss 0.01

    The "change password forms" in Taskjitsu before 2.0.1 includes password hashes in hidden form fields, which allows remote attackers to obtain sensitive information from the (1) Category Editor and (2) User Information editor.

  • CVE-2006-3399Jul 6, 2006
    Moniwiki
    Moniwiki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in wiki.php in MoniWiki before 1.1.2-20060702 allows remote attackers to inject arbitrary Javascript via the URL, which is reflected back in an error message, a variant of CVE-2004-1632.

  • CVE-2006-3400Jul 6, 2006
    Quake 3 Engine
    Quake 3 Engine
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in the CG_ServerCommand function in Quake 3 Engine as used by Soldier of Fortune 2 (SOF2MP) GOLD 1.03 allows remote attackers to cause a denial of service and possibly execute code by sending a long command from the server.

  • CVE-2006-3401Jul 6, 2006
    ID Software
    Quake 3 Engine
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in Quake 3 Engine as used by Quake 3: Arena 1.32b and 1.32c allows remote attackers to cause a denial of service and possibly execute code via long CS_ITEMS values.

  • CVE-2006-3402Jul 6, 2006
    Virtuastore
    Virtuastore
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in VirtuaStore 2.0 allows remote attackers to execute arbitrary SQL commands via the password parameter when logging in.

  • CVE-2006-3404Jul 6, 2006
    GIMP
    Gimp
    risk 0.00cvss —epss 0.05

    Buffer overflow in the xcf_load_vector function in app/xcf/xcf-load.c for gimp before 2.2.12 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XCF file with a large num_axes value in the VECTORS property.

  • CVE-2006-3351Jul 6, 2006
    Microsoft
    Windows Xp
    risk 0.01cvss —epss 0.07

    Buffer overflow in Windows Explorer (explorer.exe) on Windows XP and 2003 allows user-assisted attackers to cause a denial of service (repeated crash) and possibly execute arbitrary code via a .url file with an InternetShortcut tag containing a long URL and a large number of…

  • CVE-2006-3352Jul 6, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Cross-domain vulnerability in Mozilla Firefox allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the…

  • CVE-2006-3353Jul 6, 2006
    Opera
    Opera
    risk 0.04cvss —epss 0.08

    Opera 9 allows remote attackers to cause a denial of service (crash) via a crafted web page that triggers an out-of-bounds memory access, related to an iframe and JavaScript that accesses certain style sheets properties.

  • CVE-2006-3354Jul 6, 2006
    Microsoft
    Internet Explorer
    risk 0.04cvss —epss 0.17

    Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the Filter property of an ADODB.Recordset ActiveX object to certain values multiple times, which triggers a null dereference.

  • CVE-2006-3336Jul 5, 2006
    TWiki
    Twiki
    risk 0.00cvss —epss 0.03

    TWiki 01-Dec-2000 up to 4.0.3 allows remote attackers to bypass the upload filter and execute arbitrary code via filenames with double extensions such as ".php.en", ".php.1", and other allowed extensions that are not .txt. NOTE: this is only a vulnerability when the server…

  • CVE-2006-2194Jul 5, 2006
    Ppp
    ppp
    risk 0.00cvss —epss 0.00

    The winbind plugin in pppd for ppp 2.4.4 and earlier does not check the return code from the setuid function call, which might allow local users to gain privileges by causing setuid to fail, such as exceeding PAM limits for the maximum number of user processes, which prevents…

  • CVE-2006-2910Jul 5, 2006
    Cowon America
    Jetaudio
    risk 0.00cvss —epss 0.02

    Buffer overflow in jetAudio 6.2.6.8330 (Basic), and possibly other versions, allows user-assisted attackers to execute arbitrary code via an audio file (such as WMA) with long ID Tag values including (1) Title, (2) Author, and (3) Album, which triggers the overflow in the…

  • CVE-2006-2935Jul 5, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The dvd_read_bca function in the DVD handling code in drivers/cdrom/cdrom.c in Linux kernel 2.2.16, and later versions, assigns the wrong value to a length variable, which allows local users to execute arbitrary code via a crafted USB Storage device that triggers a buffer…

  • CVE-2006-3344Jul 3, 2006
    Siemens Foundation
    Speedstream Wireless Router
    risk 0.00cvss —epss 0.02

    Siemens Speedstream Wireless Router 2624 allows local users to bypass authentication and access protected files by using the Universal Plug and Play UPnP/1.0 component.

  • CVE-2006-3345Jul 3, 2006
    Ajax Softwares
    Alipager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in AliPAGER, possibly 1.5 and earlier, allows remote attackers to inject arbitrary web script or HTML via a chat line.

  • CVE-2006-3346Jul 3, 2006
    Mynewsgroup
    Mynewsgroup
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in tree.php in MyNewsGroups 0.6 allows remote attackers to execute arbitrary SQL commands via the grp_id parameter.

  • CVE-2006-3347Jul 3, 2006
    Devilz Clanportal
    Devilz Clanportal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in deV!Lz Clanportal DZCP 1.3.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-3348Jul 3, 2006
    Swsoft
    Hspcomplete
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in HSPcomplete 3.2.2 and 3.3 Beta and earlier allow remote attackers to execute arbitrary SQL commands via the (1) type parameter in report.php and (2) level parameter in custom_buttons.php.

  • CVE-2006-3349Jul 3, 2006
    Sms Script
    Sms Script
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in SmS Script allow remote attackers to execute arbitrary SQL commands via the CatID parameter in (1) cat.php and (2) add.php.

  • CVE-2006-3337Jul 3, 2006
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in frontend/x/files/select.html in cPanel 10.8.2-CURRENT 118 and earlier allows remote attackers to inject arbitrary web script or HTML via the file parameter.

  • CVE-2006-3338Jul 3, 2006
    Atlassian
    Jira
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Atlassian JIRA 3.6.2-#156 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a direct request to secure/ConfigureReleaseNote.jspa, which are not sanitized before being returned in an error page.