VYPR

CVEs

343,956 total · page 6511 of 6,880

AllCriticalHighKEV
  • CVE-2006-3305Jun 29, 2006
    Uebimiau
    Uebimiau
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in UebiMiau Webmail 2.7.10, and 2.7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) f_user parameter in index.php, the (2) pag parameter in messages.php, or the (3) lid, (4) tid, and (5)…

  • CVE-2006-3306Jun 29, 2006
    Project EROS
    bbsengine
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the preparestring function in lib/common.php in Project EROS bbsengine before 20060501-0142-jam, and possibly earlier versions dating back to 2006-02-23, might allow remote attackers to inject arbitrary web script or HTML via unknown…

  • CVE-2006-3307Jun 29, 2006
    Zoid Technologies
    Project Eros Bbsengine
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Project EROS bbsengine before bbsengine-20060429-1550-jam allow remote attackers to execute arbitrary SQL commands via (1) unspecified parameters in the php/comment.php and (2) the getpartialmatches method in php/aolbonics.php.

  • CVE-2006-3308Jun 29, 2006
    Project EROS
    bbsengine
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the wpprop code for Project EROS bbsengine before 20060622-0315 has unknown impact and remote attack vectors via [img] tags, possibly cross-site scripting (XSS).

  • CVE-2006-3309Jun 29, 2006
    Scout Portal Toolkit
    SPT
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in SPT--ForumTopics.php in Scout Portal Toolkit (SPT) 1.4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the forumid parameter.

  • CVE-2006-3286Jun 28, 2006
    Cisco Systems, Inc.
    Wireless Control System
    risk 0.00cvss —epss 0.03

    The internal database in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(63) stores a hard-coded username and password in plaintext within unspecified files, which allows remote authenticated users to access the database (aka bug CSCsd15951).

  • CVE-2006-3287Jun 28, 2006
    Cisco Systems, Inc.
    Wireless Control System
    risk 0.00cvss —epss 0.03

    Cisco Wireless Control System (WCS) for Linux and Windows 4.0(1) and earlier uses a default administrator username "root" and password "public," which allows remote attackers to gain access (aka bug CSCse21391).

  • CVE-2006-3288Jun 28, 2006
    Cisco Systems, Inc.
    Wireless Control System
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the TFTP server in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51), when configured to use a directory path name that contains a space character, allows remote authenticated users to read and overwrite arbitrary files via…

  • CVE-2006-3289Jun 28, 2006
    Cisco Systems, Inc.
    Wireless Control System
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the login page of the HTTP interface for the Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a "malicious URL".

  • CVE-2006-3290Jun 28, 2006
    Cisco Systems, Inc.
    Wireless Control System
    risk 0.00cvss —epss 0.02

    HTTP server in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames and directory paths via a direct URL request.

  • CVE-2006-3291Jun 28, 2006
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.04

    The web interface on Cisco IOS 12.3(8)JA and 12.3(8)JA1, as used on the Cisco Wireless Access Point and Wireless Bridge, reconfigures itself when it is changed to use the "Local User List Only (Individual Passwords)" setting, which removes all security and password…

  • CVE-2006-3292Jun 28, 2006
    Jaws
    Jaws
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in the Search gadget in Jaws 0.6.2 allows remote attackers to execute arbitrary SQL commands via queries with the "LIKE" keyword in the searchdata parameter (search field).

  • CVE-2006-3269Jun 28, 2006
    Thorcms
    Thorcms
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/functions_cms.php in THoRCMS 1.3.1 allows remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter.

  • CVE-2006-3270Jun 28, 2006
    Thorcms
    Thorcms
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in cms_admin.php in THoRCMS 1.3.1 allows remote attackers to execute arbitrary SQL commands via multiple unspecified parameters, such as the add_link_mid parameter. NOTE: the provenance of this information is unknown; portions of the details are…

  • CVE-2006-3271Jun 28, 2006
    Softbizscripts
    Dating
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Softbiz Dating 1.0 allow remote attackers to execute SQL commands via the (1) country and (2) sort_by parameters in (a) search_results.php; (3) browse parameter in (b) featured_photos.php; (4) cid parameter in (c) products.php, (d)…

  • CVE-2006-3272Jun 28, 2006
    Some Chess
    Some Chess
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in menu.php in Some Chess 1.5 rc2 allows remote attackers to conduct actions as another user, such as changing usernames and passwords, via unspecified vectors. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2006-3273Jun 28, 2006
    Astrodog Press
    Some Chess
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in menu.php in Some Chess 1.5 rc1 allows remote attackers to inject arbitrary web script or HTML via the user parameter ("New Name" field).

  • CVE-2006-3274Jun 28, 2006
    Webmin
    Webmin
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Webmin before 1.280, when run on Windows, allows remote attackers to read arbitrary files via \ (backslash) characters in the URL to certain directories under the web root, such as the image directory.

  • CVE-2006-3275Jun 28, 2006
    Yabb
    Yabb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in profile.php in YaBB SE 1.5.5 and earlier allows remote attackers to execute SQL commands via a double-encoded user parameter in a viewprofile action.

  • CVE-2006-3276Jun 28, 2006
    RealNetworks
    Helix Server
    risk 0.01cvss —epss 0.14

    Heap-based buffer overflow in RealNetworks Helix DNA Server 10.0 and 11.0 allows remote attackers to execute arbitrary code via (1) a long User-Agent HTTP header in the RTSP service and (2) unspecified vectors involving the "parsing of HTTP URL schemes".

  • CVE-2006-3277Jun 28, 2006
    MailEnable
    Mailenable
    risk 0.03cvss —epss 0.06

    The SMTP service of MailEnable Standard 1.92 and earlier, Professional 2.0 and earlier, and Enterprise 2.0 and earlier before the MESMTPC hotfix, allows remote attackers to cause a denial of service (application crash) via a HELO command with a null byte in the argument,…

  • CVE-2006-3278Jun 28, 2006
    Positive Software
    H Sphere
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in H-Sphere 2.5.1 Beta 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) next_template, (2) start, (3) curr_menu_id, and (4) arid parameters in psoft/servlet/resadmin/psoft.hsphere.CP when using the…

  • CVE-2006-3279Jun 28, 2006
    AeDating
    aeDating
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in aeDating 4.1 allows remote attackers to inject arbitrary web script or HTML via the (1) Sex parameter in index.php, (2) ProfileType parameter in join_form.php, and (3) Email parameter in forgot.php.

  • CVE-2006-3280Jun 28, 2006
    Microsoft
    Internet Explorer
    risk 0.07cvss —epss 0.56

    Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that…

  • CVE-2006-3281Jun 28, 2006
    Microsoft
    Internet Explorer
    risk 0.07cvss —epss 0.48

    Microsoft Internet Explorer 6.0 does not properly handle Drag and Drop events, which allows remote user-assisted attackers to execute arbitrary code via a link to an SMB file share with a filename that contains encoded ..\ (%2e%2e%5c) sequences and whose extension contains the…

  • CVE-2006-3282Jun 28, 2006
    Dating Agent PRO
    Dating Agent PRO
    risk 0.00cvss —epss 0.01

    requirements.php in Dating Agent PRO 4.7.1 allows remote attackers to obtain sensitive information via a direct request, which calls the phpinfo function.

  • CVE-2006-3283Jun 28, 2006
    Dating Agent PRO
    Dating Agent PRO
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Dating Agent PRO 4.7.1 allows remote attackers to execute arbitrary SQL commands via the (1) pid parameter in picture.php, (2) mid parameter in mem.php, and the (3) sex and (4) relationship parameters in search.php.

  • CVE-2006-3284Jun 28, 2006
    Dating Agent PRO
    Dating Agent PRO
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Dating Agent PRO 4.7.1 allows remote attackers to inject arbitrary web script or HTML via the login parameter in (1) webmaster/index.php and (2) search.php.

  • CVE-2006-3285Jun 28, 2006
    Cisco Systems, Inc.
    Wireless Control System
    risk 0.00cvss —epss 0.03

    The internal database in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) uses an undocumented, hard-coded username and password, which allows remote authenticated users to read, and possibly modify, sensitive configuration data (aka bugs CSCsd15955).

  • CVE-2006-2200Jun 28, 2006
    Mimms
    Mimms
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in libmms, as used by (a) MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the (1) send_command, (2) string_utf16, (3) get_data, and (4)…

  • CVE-2006-3253Jun 28, 2006
    Jelsoft
    Vbulletin
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in member.php in vBulletin 3.5.x allows remote attackers to inject arbitrary web script or HTML via the u parameter. NOTE: the vendor has disputed this report, stating that they have been unable to replicate the issue and that "the…

  • CVE-2006-3254Jun 28, 2006
    Woltlab
    Burning Board
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in newthread.php in Woltlab Burning Board (WBB) 2.0 RC2 allows remote attackers to execute arbitrary SQL commands via the boardid parameter.

  • CVE-2006-3255Jun 28, 2006
    Woltlab
    Burning Board
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in showmods.php in Woltlab Burning Board (WBB) 1.2 allows remote attackers to execute arbitrary SQL commands via the boardid parameter.

  • CVE-2006-3256Jun 28, 2006
    Woltlab
    Burning Board
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in report.php in Woltlab Burning Board (WBB) 2.3.1 allows remote attackers to execute arbitrary SQL commands via the postid parameter.

  • CVE-2006-3257Jun 28, 2006
    Claroline
    Claroline
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.7.7 allow remote attackers to inject arbitrary HTML or web script via unspecified attack vectors, possibly including (1) calendar/myagenda.php, (2) document/document.php, (3) phpbb/newtopic.php, (4)…

  • CVE-2006-0456Jun 27, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The strnlen_user function in Linux kernel before 2.6.16 on IBM S/390 can return an incorrect value, which allows local users to cause a denial of service via unknown vectors.

  • CVE-2006-1469Jun 27, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.05

    Stack-based buffer overflow in ImageIO in Apple Mac OS X 10.4 up to 10.4.6 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image.

  • CVE-2006-1470Jun 27, 2006
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.08

    OpenLDAP in Apple Mac OS X 10.4 up to 10.4.6 allows remote attackers to cause a denial of service (crash) via an invalid LDAP request that triggers an assert error.

  • CVE-2006-1471Jun 27, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Format string vulnerability in the CF_syslog function launchd in Apple Mac OS X 10.4 up to 10.4.6 allows local users to execute arbitrary code via format string specifiers that are not properly handled in a syslog call in the logging facility, as demonstrated by using a crafted…

  • CVE-2006-1468Jun 27, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Apple File Protocol (AFP) server in Apple Mac OS X 10.4 up to 10.4.6 includes the names of restricted files and folders within search results, which might allow remote attackers to obtain sensitive information.

  • CVE-2006-3223Jun 27, 2006
    Broadcom Corporation
    Etrust Antivirus
    risk 0.01cvss —epss 0.07

    Format string vulnerability in CA Integrated Threat Management (ITM), eTrust Antivirus (eAV), and eTrust PestPatrol (ePP) r8 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a scan job with format strings in the description field.

  • CVE-2006-3258Jun 27, 2006
    Bnbt
    Easytracker
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.html in BNBT TrinEdit and EasyTracker 7.7r3.2004.10.27 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) filter or (2) sort parameters.

  • CVE-2006-3259Jun 27, 2006
    E107
    E107
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the (1) ep parameter to search.php and the (2) subject parameter in comment.php (aka the Subject field when posting a comment).

  • CVE-2006-3260Jun 27, 2006
    Virtual Design Studios
    Vlbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in vlbook 1.02 allows remote attackers to inject arbitrary web script or HTML via the message parameter.

  • CVE-2006-3261Jun 27, 2006
    Trend Micro
    Control Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Trend Micro Control Manager (TMCM) 3.5 allows remote attackers to inject arbitrary web script or HTML via the username field on the login page, which is not properly sanitized before being displayed in the error log.

  • CVE-2006-3262Jun 27, 2006
    Mambo (software)
    Mambo
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter.

  • CVE-2006-3263Jun 27, 2006
    Mambo (software)
    Mambo
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2006-3264Jun 27, 2006
    Namo
    Deepsearch
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in mclient.cgi in Namo DeepSearch 4.5 allows remote attackers to inject arbitrary web script or HTML via the p parameter.

  • CVE-2006-3265Jun 27, 2006
    Qdig
    Qdig
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Qdig before 1.2.9.3, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pre_gallery or (2) post_gallery parameters.

  • CVE-2006-3266Jun 27, 2006
    Bee Hive
    Bee-hive Lite
    risk 0.04cvss —epss 0.18

    Multiple PHP remote file inclusion vulnerabilities in Bee-hive Lite 1.2 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) header parameter to (a) conad/include/rootGui.inc.php and (b) include/rootGui.inc.php;…