VYPR

CVEs

343,956 total · page 6510 of 6,880

AllCriticalHighKEV
  • CVE-2006-3339Jul 3, 2006
    Atlassian
    Jira
    risk 0.00cvss —epss 0.01

    secure/ConfigureReleaseNote.jspa in Atlassian JIRA 3.6.2-#156 allows remote attackers to obtain sensitive information via unspecified manipulations of the projectId parameter, which displays the installation path and other system information in an error message.

  • CVE-2006-3340Jul 3, 2006
    Pearlinger
    Pearl For Mambo
    risk 0.04cvss —epss 0.15

    Multiple PHP remote file inclusion vulnerabilities in Pearl For Mambo module 1.6 for Mambo, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via the (1) phpbb_root_path parameter in (a) includes/functions_cms.php and the (2)…

  • CVE-2006-3341Jul 3, 2006
    Myads
    Myads
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in annonces-p-f.php in MyAds module 2.04jp for Xoops allows remote attackers to execute arbitrary SQL commands via the lid parameter.

  • CVE-2006-3342Jul 3, 2006
    Olate
    Arctic
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Arctic 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search cmd.

  • CVE-2006-3343Jul 3, 2006
    Crisoft Ricette
    Crisoft Ricette
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in recipe/cookbook.php in CrisoftRicette 1.0pre15b allows remote attackers to execute arbitrary PHP code via a URL in the crisoftricette parameter.

  • CVE-2006-3335Jul 3, 2006
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in mkdir in HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allows local users to gain privileges via unknown attack vectors.

  • CVE-2006-3323Jun 30, 2006
    Mastersfusion
    MF Piadas
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in admin/admin.php in MF Piadas 1.0 allows remote attackers to execute arbitrary PHP code via the page parameter. NOTE: the same vector can be used for cross-site scripting, but CVE analysis suggests that this is resultant from file…

  • CVE-2006-3324Jun 30, 2006
    ID Software
    Quake 3 Engine
    risk 0.03cvss —epss 0.04

    The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks…

  • CVE-2006-3325Jun 30, 2006
    ID Software
    Quake 3 Engine
    risk 0.03cvss —epss 0.05

    client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine (ioquake3) revision 810 and earlier allows remote malicious servers to overwrite arbitrary write-protected cvars variables on the client, such as cl_allowdownload for Automatic Downloading and…

  • CVE-2006-3326Jun 30, 2006
    QuickZip
    QuickZip
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in QuickZip 3.06.3 allows remote user-assisted attackers to overwrite arbitrary files or directories via .. (dot dot) sequences in filenames within (1) TAR,(2) GZ, and (3) JAR archives. NOTE: the provenance of this information is unknown; the…

  • CVE-2006-3327Jun 30, 2006
    Custom dating biz
    dating script
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Custom dating biz dating script 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) sn20_special_cases parameter ("Special Cases" field) in profile/mini.php, (2) tyxx01_album_name parameter ("Album Name"…

  • CVE-2006-3328Jun 30, 2006
    Hostflow
    Hostflow
    risk 0.00cvss —epss 0.01

    new_ticket.cgi in Hostflow 2.2.1-15 allows remote attackers to steal and replay authentication credentials via an IMG tag in the desc parameter ("Ticket Description" field) that points to a URL that captures referer URLs, possibly due to a cross-site scripting (XSS)…

  • CVE-2006-3329Jun 30, 2006
    Deltascripts
    PHP Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in search.php in PHP/MySQL Classifieds (PHP Classifieds) allows remote attackers to execute arbitrary SQL commands via the rate parameter.

  • CVE-2006-3330Jun 30, 2006
    PHP/MySQL Classifieds
    PHP/MySQL Classifieds
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in AddAsset1.php in PHP/MySQL Classifieds (PHP Classifieds) allows remote attackers to execute arbitrary SQL commands via the (1) ProductName ("Title" field), (2) url, and (3) Description parameters, possibly related to issues in add1.php.

  • CVE-2006-3331Jun 30, 2006
    Opera
    Opera
    risk 0.00cvss —epss 0.04

    Opera before 9.0 does not reset the SSL security bar after displaying a download dialog from an SSL-enabled website, which allows remote attackers to spoof a trusted SSL certificate from an untrusted website and facilitates phishing attacks.

  • CVE-2006-3332Jun 30, 2006
    Zorum
    Zorum Forum
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Zorum Forum 3.5 allows remote attackers to execute arbitrary SQL commands via the (1) offset, (2) tid, (3) fromid, (4) sortby, (5) fromfrommethod, and (6) fromfromlist parameters.

  • CVE-2006-3333Jun 30, 2006
    Zorum
    Zorum Forum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Zorum Forum 3.5 allows remote attackers to inject web script or HTML via the multiple unspecified parameters, including the (1) frommethod, (2) list, and (3) method, which are reflected in an error message. NOTE: some of…

  • CVE-2006-3334Jun 30, 2006
    Libpng
    Libpng
    risk 0.00cvss —epss 0.04

    Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to "chunk error processing," possibly involving the…

  • CVE-2006-2934Jun 30, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.05

    SCTP conntrack (ip_conntrack_proto_sctp.c) in netfilter for Linux kernel 2.6.17 before 2.6.17.3 and 2.6.16 before 2.6.16.23 allows remote attackers to cause a denial of service (crash) via a packet without any chunks, which causes a variable to contain an invalid value that is…

  • CVE-2006-3322Jun 30, 2006
    Spiffyjr
    Phpraid
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in includes/functions_logging.php in phpRaid 3.0.5, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the log_hack function.

  • CVE-2006-3118Jun 30, 2006
    Canonical
    Spread
    risk 0.00cvss —epss 0.00

    spread uses a temporary file with a static filename based on the port number, which allows local users to cause a denial of service by creating the file during a race condition between unlink and bind function calls. NOTE: spread deletes this temporary file before use, which…

  • CVE-2006-2198Jun 30, 2006
    Openoffice
    Openoffice
    risk 0.00cvss —epss 0.03

    OpenOffice.org (aka StarOffice) 1.1.x up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to conduct unauthorized activities via an OpenOffice document with a malicious BASIC macro, which is executed without prompting the user.

  • CVE-2006-2199Jun 30, 2006
    Openoffice
    Openoffice
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Java Applets in OpenOffice.org 1.1.x (aka StarOffice) up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to escape the Java sandbox and conduct unauthorized activities via certain applets in OpenOffice documents.

  • CVE-2006-3117Jun 30, 2006
    Openoffice
    Openoffice
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in OpenOffice.org (aka StarOffice) 1.1.x up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to execute arbitrary code via a crafted OpenOffice XML document that is not properly handled by (1) Calc, (2) Draw, (3) Impress, (4) Math, or (5)…

  • CVE-2006-3321Jun 30, 2006
    Openforum
    Openforum
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in openforum.asp in OpenForum 1.2 Beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ofdisp and (2) ofmsgid parameters.

  • CVE-2006-3319Jun 30, 2006
    PHP Icalendar
    Phpicalendar
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in rss/index.php in PHP iCalendar 2.22 and earlier allows remote attackers to inject arbitrary web script or HTML via the cal parameter.

  • CVE-2006-3320Jun 30, 2006
    Sitebar
    Sitebar
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in command.php in SiteBar 3.3.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the command parameter.

  • CVE-2006-1467Jun 29, 2006
    Apple Inc.
    iTunes
    risk 0.01cvss —epss 0.07

    Integer overflow in the AAC file parsing code in Apple iTunes before 6.0.5 on Mac OS X 10.2.8 or later, and Windows XP and 2000, allows remote user-assisted attackers to execute arbitrary code via an AAC (M4P, M4A, or M4B) file with a sample table size (STSZ) atom with a…

  • CVE-2006-3115Jun 29, 2006
    Spiffyjr
    Phpraid
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in view.php in phpRaid 3.0.4, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the raid_id parameter.

  • CVE-2006-3116Jun 29, 2006
    Spiffyjr
    Phpraid
    risk 0.01cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in phpRaid 3.0.4 and 3.0.5 allow remote attackers to execute arbitrary code via a URL in the phpraid_dir parameter to (1) configuration.php, (3) guilds.php, (4) index.php, (5) locations.php, (6) login.php, (7) lua_output.php,…

  • CVE-2006-3316Jun 29, 2006
    Spiffyjr
    Phpraid
    risk 0.00cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in phpRaid 3.0.5 allow remote attackers to execute arbitrary code via a URL in the phpraid_dir parameter to (1) logs.php and (2) users.php, a different set of vectors than CVE-2006-3116.

  • CVE-2006-3317Jun 29, 2006
    Spiffyjr
    Phpraid
    risk 0.04cvss —epss 0.17

    PHP remote file inclusion vulnerability in phpRaid 3.0.6 allows remote attackers to execute arbitrary code via a URL in the phpraid_dir parameter to (1) announcements.php and (2) rss.php, a different set of vectors and affected versions than CVE-2006-3316 and CVE-2006-3116.

  • CVE-2006-3318Jun 29, 2006
    Spiffyjr
    Phpraid
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in register.php for phpRaid 3.0.6 and possibly other versions, when the authorization type is phpraid, allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) email parameters.

  • CVE-2006-3312Jun 29, 2006
    Qatraq
    Qatraq
    risk 0.00cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in ashmans and Bill Echlin QaTraq 6.5 RC and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) link_print, (2) link_upgrade, (3) link_sql, (4) link_next, (5) link_prev, and (6) link_list…

  • CVE-2006-3313Jun 29, 2006
    Netsoft
    Smartnet
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.jsp in Netsoft smartNet 2.0 allows remote attackers to inject arbitrary web script or HTML via the keyWord parameter.

  • CVE-2006-3314Jun 29, 2006
    Rahnemaco
    Rahnemaco
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in page.php in an unspecified RahnemaCo.com product, possibly eShop, allows remote attackers to execute arbitrary PHP code via a URL in the pageid parameter.

  • CVE-2006-3315Jun 29, 2006
    Rahnemaco
    Rahnemaco
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in page.php in an unspecified RahnemaCo.com product, possibly eShop, allows remote attackers to execute arbitrary PHP code via a URL in the osCsid parameter.

  • CVE-2006-3268Jun 29, 2006
    Novell
    Groupwise
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Windows Client API in Novell GroupWise 5.x through 7 might allow users to obtain "random programmatic access" to other email within the same post office.

  • CVE-2006-3293Jun 29, 2006
    EnergyMech
    EnergyMech
    risk 0.00cvss —epss 0.02

    parse_notice (TiCPU) in EnergyMech (emech) before 3.0.2 allows remote attackers to cause a denial of service (crash) via empty IRC CTCP NOTICE messages.

  • CVE-2006-3294Jun 29, 2006
    Cbsms
    Mambo Module
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in mod_cbsms_messages.php in CBSMS Mambo Module 1.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3295Jun 29, 2006
    Georgecurrums
    Open Guestbook
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in header.php in Open Guestbook 0.5 allows remote attackers to inject arbitrary web script or HTML via the title parameter.

  • CVE-2006-3296Jun 29, 2006
    Georgecurrums
    Open Guestbook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in view.php in Open Guestbook 0.5 allows remote attackers to execute arbitrary SQL commands via the offset parameter.

  • CVE-2006-3297Jun 29, 2006
    Uebimiau
    Uebimiau
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in error.php in UebiMiau Webmail 2.7.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the icq parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third…

  • CVE-2006-3298Jun 29, 2006
    Yahoo
    Messenger
    risk 0.03cvss —epss 0.03

    Yahoo! Messenger 7.5.0.814 and 7.0.438 allows remote attackers to cause a denial of service (crash) via messages that contain non-ASCII characters, which triggers the crash in jscript.dll.

  • CVE-2006-3299Jun 29, 2006
    Usenet Script
    Usenet Script
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Usenet Script 0.5 allows remote attackers to inject arbitrary web script or HTML via the group parameter.

  • CVE-2006-3300Jun 29, 2006
    Phpmysms
    Phpmysms
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in sms_config/gateway.php in PhpMySms 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ROOT_PATH parameter.

  • CVE-2006-3301Jun 29, 2006
    Phpqladmin
    Phpqladmin
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in phpQLAdmin 2.2.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the domain parameter in (1) user_add.php or (2) unit_add.php.

  • CVE-2006-3302Jun 29, 2006
    Cbsms
    Mambo Module
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in mod_cbsms.php in CBSMS Mambo Module 1.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosC_a_path parameter. NOTE: the provenance of this information is unknown;…

  • CVE-2006-3303Jun 29, 2006
    Deluxebb
    Deluxebb
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in pm.php in DeluxeBB 1.07 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) subject or (2) to parameters.

  • CVE-2006-3304Jun 29, 2006
    Deluxebb
    Deluxebb
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in cp.php in DeluxeBB 1.07 and earlier allows remote attackers to execute arbitrary SQL commands via the xmsn parameter.