VYPR

CVEs

343,956 total · page 6512 of 6,880

AllCriticalHighKEV
  • CVE-2006-3267Jun 27, 2006
    Infinite Core Technologies
    Ict
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Infinite Core Technologies (ICT) 1.0 Gold and earlier allows remote attackers to execute arbitrary SQL commands via the post parameter.

  • CVE-2006-3250Jun 27, 2006
    Microsoft
    Windows Live Messenger
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in Windows Live Messenger 8.0 allows user-assisted attackers to execute arbitrary code via a crafted Contact List (.ctt) file, which triggers the overflow when it is imported by the user.

  • CVE-2006-3251Jun 27, 2006
    Hashcash
    Hashcash
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in the array_push function in hashcash.c for Hashcash before 1.21 might allow attackers to execute arbitrary code via crafted entries.

  • CVE-2006-3252Jun 27, 2006
    Algorithmic Research
    PrivateWire VPN
    risk 0.08cvss —epss 0.62

    Buffer overflow in the Online Registration Facility for Algorithmic Research PrivateWire VPN software up to 3.7 allows remote attackers to execute arbitrary code via a long GET request.

  • CVE-2006-3134Jun 27, 2006
    Gracenote
    Cddbcontrol Activex Control
    risk 0.01cvss —epss 0.11

    Buffer overflow in GraceNote CDDBControl ActiveX Control, as used by multiple products that use Gracenote CDDB, allows remote attackers to execute arbitrary code via a long option string.

  • CVE-2006-3230Jun 27, 2006
    Azureus Tracker
    Azureus Tracker
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.tmpl in Azureus Tracker 2.4.0.2 and earlier (Java BitTorrent Client Tracker) allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2006-3231Jun 27, 2006
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in IBM WebSphere Application Server (WAS) before 6.0.2.11, when fileServingEnabled is true, allows remote attackers to obtain JSP source code and other sensitive information via "URIs with special characters."

  • CVE-2006-3232Jun 27, 2006
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in IBM WebSphere Application Server before 6.0.2.11 has unknown impact and attack vectors because the "UserNameToken cache was improperly used."

  • CVE-2006-3233Jun 27, 2006
    Open Webmail
    Openwebmail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in openwebmail-read.pl in Open WebMail (OWM) 2.52, and other versions released before 06/18/2006, allows remote attackers to inject arbitrary web script or HTML via the from field. NOTE: some third party sources have mentioned the "to"…

  • CVE-2006-3234Jun 27, 2006
    FineShop
    FineShop
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in FineShop 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) produkt, (2) id_produc, and (3) id_kat parameters.

  • CVE-2006-3235Jun 27, 2006
    FineShop
    FineShop
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in FineShop 3.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) promocja, (2) wysw, or (3) id_produc parameters.

  • CVE-2006-3236Jun 27, 2006
    ThinkWMS
    thinkWMS
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in thinkWMS 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a) index.php or (b) printarticle.php, and the (2) catid parameter in index.php.

  • CVE-2006-3237Jun 27, 2006
    Enterprise Groupware System
    Enterprise Groupware System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Enterprise Groupware System (EGS) 1.2.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter.

  • CVE-2006-3238Jun 27, 2006
    Vbzoom
    Vbzoom
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in VBZooM 1.00 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) MemberID parameter to rank.php, and the (2) QuranID parameter to lng.php.

  • CVE-2006-3239Jun 27, 2006
    Vbzoom
    Vbzoom
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in message.php in VBZooM 1.11 and earlier allows remote attackers to execute arbitrary SQL commands via the UserID parameter.

  • CVE-2006-3240Jun 27, 2006
    Dotproject
    Dotproject
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in classes/ui.class.php in dotProject 2.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter.

  • CVE-2006-3241Jun 27, 2006
    Xennobb
    Xennobb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in messages.php in XennoBB 1.0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the tid parameter.

  • CVE-2006-3242Jun 27, 2006
    Mutt
    Mutt
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in the browse_get_namespace function in imap/browse.c of Mutt 1.4.2.1 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via long namespaces received from the IMAP server.

  • CVE-2006-3243Jun 27, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in usercp.php in MyBB (MyBulletinBoard) 1.0 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the showcodebuttons parameter.

  • CVE-2006-3244Jun 27, 2006
    Anthill
    Anthill
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Anthill 0.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) order parameter in buglist.php and the (2) bug parameter in query.php.

  • CVE-2006-3245Jun 27, 2006
    Mvnforum
    Mvnforum
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in activatemember in mvnForum 1.0 GA and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) member and (2) activatecode parameters.

  • CVE-2006-3246Jun 27, 2006
    Gl Sh
    Deaf Forum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in show.php in GL-SH Deaf Forum 6.4.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the sort parameter.

  • CVE-2006-3247Jun 27, 2006
    Gl Sh
    Deaf Forum
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in show.php in GL-SH Deaf Forum 6.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) search, (2) page, and (3) action parameters. NOTE: the provenance of this information is unknown; the…

  • CVE-2006-3249Jun 27, 2006
    Phorum
    Phorum
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the vendor has disputed this report, stating "If a non positive integer or non-integer is used for the page parameter…

  • CVE-2006-3229Jun 27, 2006
    Open Webmail
    Openwebmail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Open WebMail (OWM) 2.52, and other versions released before 05/12/2006, allows remote attackers to inject arbitrary web script or HTML via the (1) To and (2) From fields in openwebmail-main.pl, and possibly (3) other unspecified…

  • CVE-2006-3011Jun 26, 2006
    PHP
    PHP
    risk 0.03cvss —epss 0.01

    The error_log function in basic_functions.c in PHP before 4.4.4 and 5.x before 5.1.5 allows local users to bypass safe mode and open_basedir restrictions via a "php://" or other scheme in the third argument, which disables safe mode.

  • CVE-2006-3228Jun 26, 2006
    Winamp
    Winamp
    risk 0.04cvss —epss 0.11

    Buffer overflow in in_midi.dll for WinAmp 2.90 up to 5.23, including 5.21, allows remote attackers to execute arbitrary code via a crafted .mid (MIDI) file.

  • CVE-2006-3224Jun 26, 2006
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.01

    Apple Safari 2.0.3 (417.9.3) on Mac OS X 10.4.6 allows remote attackers to cause a denial of service (CPU consumption) via Javascript with an infinite for loop. NOTE: it could be argued that this is not a vulnerability, unless it interferes with the operation of the system…

  • CVE-2006-3225Jun 26, 2006
    Sun Corporation
    Java System Application Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Sun ONE Application Server 7 before Update 9, Java System Application Server 7 2004Q2 before Update 5, and Java System Application Server Enterprise Edition 8.1 2005 Q1 allows remote attackers to inject arbitrary HTML or web script via…

  • CVE-2006-3226Jun 26, 2006
    Cisco Systems, Inc.
    Secure Access Control Server
    risk 0.00cvss —epss 0.02

    Cisco Secure Access Control Server (ACS) 4.x for Windows uses the client's IP address and the server's port number to grant access to an HTTP server port for an administration session, which allows remote attackers to bypass authentication via various methods, aka "ACS Weak…

  • CVE-2006-3227Jun 26, 2006
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.14

    Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera, and Firefox might allow remote attackers to modify the visual presentation of web pages and possibly bypass protection mechanisms such as content filters via ASCII characters with…

  • CVE-2006-2196Jun 26, 2006
    Pinball
    pinball
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in pinball 0.3.1 allows local users to gain privileges via unknown attack vectors that cause pinball to load plugins from an attacker-controlled directory while operating at raised privileges.

  • CVE-2006-2310Jun 26, 2006
    BlueDragon
    Server JX
    risk 0.04cvss —epss 0.07

    BlueDragon Server and Server JX 6.2.1.286 for Windows allows remote attackers to cause a denial of service (hang) via a request for a .cfm file whose name contains an MS-DOS device name such as (1) con, (2) aux, (3) com1, and (4) com2.

  • CVE-2006-2311Jun 26, 2006
    BlueDragon
    BlueDragon Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in BlueDragon Server and Server JX 6.2.1.286 for Windows allows remote attackers to inject arbitrary web script or HTML via the filename in a request to a (1) .cfm or (2) .cfml file, which reflects the result in the default error page.

  • CVE-2006-3218Jun 24, 2006
    Woltlab
    Burning Board
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in profile.php in Woltlab Burning Board (WBB) 2.1.6 allows remote attackers to execute arbitrary SQL commands via the userid parameter.

  • CVE-2006-3219Jun 24, 2006
    Woltlab
    Burning Board
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in thread.php in Woltlab Burning Board (WBB) 2.2.2 allows remote attackers to execute arbitrary SQL commands via the threadid parameter.

  • CVE-2006-3220Jun 24, 2006
    Woltlab
    Burning Board
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in studienplatztausch.php in Woltlab Burning Board (WBB) 2.2.1 allows remote attackers to execute arbitrary SQL commands via the sid parameter.

  • CVE-2006-3221Jun 24, 2006
    DataLife Engine
    DataLife Engine
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in DataLife Engine 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via double-encoded values in the user parameter in a userinfo subaction.

  • CVE-2006-3222Jun 24, 2006
    Fortinet
    Fortios
    risk 0.00cvss —epss 0.02

    The FTP proxy module in Fortinet FortiOS (FortiGate) before 2.80 MR12 and 3.0 MR2 allows remote attackers to bypass anti-virus scanning via the Enhanced Passive (EPSV) FTP mode.

  • CVE-2006-3203Jun 24, 2006
    Ultimate PHP Board
    Ultimate PHP Board
    risk 0.00cvss —epss 0.03

    The installation of Ultimate PHP Board (UPB) 1.9.6 and earlier includes a default administrator login account and password, which allows remote attackers to gain privileges.

  • CVE-2006-3204Jun 24, 2006
    Ultimate PHP Board
    Ultimate PHP Board
    risk 0.00cvss —epss 0.02

    Ultimate PHP Board (UPB) 1.9.6 and earlier uses a cryptographically weak block cipher with a large key collision space, which allows remote attackers to determine a suitable decryption key given the plaintext and ciphertext by obtaining the plaintext password, which is sent when…

  • CVE-2006-3205Jun 24, 2006
    Ultimate PHP Board
    Ultimate PHP Board
    risk 0.00cvss —epss 0.01

    Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote attackers to gain access via modified user_env, pass_env, power_env, and id_env parameters in a cookie, which comprise a persistent logon that does not vary across sessions.

  • CVE-2006-3206Jun 24, 2006
    Ultimate PHP Board
    Ultimate PHP Board
    risk 0.00cvss —epss 0.01

    register.php in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote attackers to create arbitrary accounts via the "[NR]" sequence in the signature field, which is used to separate multiple records.

  • CVE-2006-3207Jun 24, 2006
    Ultimate PHP Board
    Ultimate PHP Board
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in newpost.php in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) sequence and trailing null (%00) byte in the id parameter, as demonstrated by injecting a Perl CGI script using…

  • CVE-2006-3208Jun 24, 2006
    Ultimate PHP Board
    Ultimate PHP Board
    risk 0.00cvss —epss 0.01

    Direct static code injection vulnerability in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote authenticated administrators to execute arbitrary PHP code via multiple unspecified "configuration fields" in (1) admin_chatconfig.php, (2) admin_configcss.php, (3)…

  • CVE-2006-3209Jun 24, 2006
    Microsoft
    Windows Xp
    risk 0.00cvss —epss 0.02

    The Task scheduler (at.exe) on Microsoft Windows XP spawns each scheduled process with SYSTEM permissions, which allows local users to gain privileges. NOTE: this issue has been disputed by third parties, who state that the Task scheduler is limited to the Administrators group…

  • CVE-2006-3210Jun 24, 2006
    Le Ralf
    Ralf Image Gallery
    risk 0.04cvss —epss 0.13

    Ralf Image Gallery (RIG) 0.7.4 and other versions before 1.0, when register_globals is enabled, allows remote attackers to conduct PHP remote file inclusion and directory traversal attacks via URLs or ".." sequences in the (1) dir_abs_src parameter in (a) check_entry.php, (b)…

  • CVE-2006-3211Jun 24, 2006
    Cjguestbook Project
    Cjguestbook
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in sign.php in cjGuestbook 1.3 and earlier allows remote attackers to inject Javascript code via a javascript URI in an img bbcode tag in the comments parameter.

  • CVE-2006-3212Jun 24, 2006
    Cjguestbook Project
    Cjguestbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in sign.php in cjGuestbook 1.3 and earlier allows remote attackers to inject web script or HTML via the (1) name, (2) email, (3) add, and (4) wName parameters. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2006-3213Jun 24, 2006
    Webboa
    Webboa
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in WeBBoA Hosting 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter to an unspecified script, possibly host/yeni_host.asp.