VYPR

CVEs

343,955 total · page 6514 of 6,880

AllCriticalHighKEV
  • CVE-2006-3142Jun 22, 2006
    Vbzoom
    Vbzoom
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in forum.php in VBZooM 1.11 allows remote attackers to execute arbitrary SQL commands via the MainID parameter.

  • CVE-2006-3143Jun 22, 2006
    Maximus
    Schoolmax
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in icue_login.asp in Maximus SchoolMAX 4.0.1 and earlier iCue and iParent applications allows remote attackers to inject arbitrary web script or HTML via the error_msg parameter.

  • CVE-2006-3144Jun 22, 2006
    Impliedbydesign
    Micro CMS
    risk 0.04cvss —epss 0.09

    PHP remote file inclusion vulnerability in micro_cms_files/microcms-include.php in Implied By Design (IBD) Micro CMS 3.5 (aka 0.3.5) and earlier allows remote attackers to execute arbitrary PHP code via a URL in the microcms_path parameter. NOTE: it was later reported that this…

  • CVE-2006-3145Jun 22, 2006
    Netpbm
    Netpbm
    risk 0.00cvss —epss 0.05

    Buffer overflow in pamtofits of NetPBM 10.30 through 10.33 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code when assembling the header, possibly related to an off-by-one error.

  • CVE-2006-3146Jun 22, 2006
    Toshiba
    Bluetooth Stack
    risk 0.00cvss —epss 0.02

    The TOSRFBD.SYS driver for Toshiba Bluetooth Stack 4.00.29 and earlier on Windows allows remote attackers to cause a denial of service (reboot) via a L2CAP echo request that triggers an out-of-bounds memory access, similar to "Ping o' Death" and as demonstrated by BlueSmack. …

  • CVE-2006-3147Jun 22, 2006
    Hosting Controller
    Hosting Controller
    risk 0.03cvss —epss 0.03

    Unspecified vulnerability in Hosting Controller before 6.1 (aka Hotfix 3.2) allows remote authenticated attackers to gain host admin privileges, list all resellers, or change resellers' passwords via unspecified vectors. NOTE: due to the lack of precise details, it is not clear…

  • CVE-2006-3148Jun 22, 2006
    Open Realty
    Open Realty
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability, possibly in search.inc.php, in Open-Realty 2.3.1 allows remote attackers to execute arbitrary SQL commands via the sorttype parameter to index.php.

  • CVE-2006-3149Jun 22, 2006
    Phpmyforum
    Phpmyforum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in topic.php in phpMyForum 4.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.

  • CVE-2006-3150Jun 22, 2006
    Cavoxcms
    Cavoxcms
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in CavoxCms 1.0.16 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2006-3151Jun 22, 2006
    Associated
    Associated CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in AssoCIateD (aka ACID) 1.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the menu parameter.

  • CVE-2006-3152Jun 22, 2006
    Bluehouse Project
    Phptrader
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in phpTRADER 4.9 SP5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) sectio parameter in (a) login.php, (b) write_newad.php, (c) newad.php, (d) printad.php, (e) askseller.php, (f) browse.php, (g)…

  • CVE-2006-3153Jun 22, 2006
    Thinkfactory
    Ultimate Estate
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.pl in Ultimate Estate 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat parameter.

  • CVE-2006-3154Jun 22, 2006
    Thinkfactory
    Ultimate Estate
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.pl in Ultimate Estate 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-3155Jun 22, 2006
    Thinkfactory
    Ultimate Estate
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Ultimate Auction 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) item parameter in (a) emailtofriend.pl or (b) violation.pl, (2) seller parameter in (c) vsoa.pl, (3) user parameter…

  • CVE-2006-3156Jun 22, 2006
    Thinkfactory
    Ultimate Eshop
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.cgi in Ultimate eShop 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the subid parameter.

  • CVE-2006-3157Jun 22, 2006
    Thinkfactory
    Ultimategoogle
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Thinkfactory UltimateGoogle 1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the REQ parameter.

  • CVE-2006-3158Jun 22, 2006
    Eduha Meeting
    Eduha Meeting
    risk 0.03cvss —epss 0.03

    index.php in Eduha Meeting does not properly restrict file extensions before permitting a file upload, which allows remote attackers to bypass security checks and upload or execute arbitrary php code via the add action.

  • CVE-2006-3159Jun 22, 2006
    Sun Corporation
    Iplanet Messaging Server
    risk 0.00cvss —epss 0.00

    pipe_master in Sun ONE/iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003) allows local users to read portions of restricted files via a symlink attack on msg.conf in a directory identified by the CONFIGROOT environment variable, which returns the first line of the file…

  • CVE-2006-3160Jun 22, 2006
    Onedotoh
    Simple File Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in fm.php in ONEdotOH Simple File Manager (SFM) 0.24a and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2006-3161Jun 22, 2006
    Saphplesson
    Saphplesson
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in misc.php in SaphpLesson 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the action parameter.

  • CVE-2006-3162Jun 22, 2006
    Smartsitecms
    Smartsitecms
    risk 0.04cvss —epss 0.07

    PHP remote file inclusion vulnerability in include/inc_foot.php in SmartSiteCMS 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.

  • CVE-2006-3163Jun 22, 2006
    Imgallery
    Imgallery
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in galeria.php in IMGallery 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) start or (2) sort parameters.

  • CVE-2006-3164Jun 22, 2006
    Tpl Design
    Tplshop
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in category.php in TPL Design tplShop 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the first_row parameter.

  • CVE-2006-3165Jun 22, 2006
    Free Realty
    Free Realty
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in propview.php in Free Realty 2.9-0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the sort parameter.

  • CVE-2006-3166Jun 22, 2006
    Free Realty
    Free Realty
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in propview.php in Free Realty 2.9-0.6 and earlier allows remote attackers to execute arbitrary web script or HTML via the sort parameter.

  • CVE-2006-3167Jun 22, 2006
    Free Realty
    Free Realty
    risk 0.00cvss —epss 0.01

    Free Realty before 2.9 allows remote attackers to obtain the full path and other sensitive information via unspecified manipulations that produce an error message.

  • CVE-2006-3129Jun 22, 2006
    Nc Linklist
    Nc Linklist
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in NC LinkList 1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) view parameters.

  • CVE-2006-3130Jun 22, 2006
    Clubpage
    Clubpage
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Clubpage allows remote attackers to execute arbitrary SQL commands via the category parameter.

  • CVE-2006-3131Jun 22, 2006
    Clubpage
    Clubpage
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Clubpage allow remote attackers to inject arbitrary web script or HTML via the (1) news_archive, (2) language, and (3) intranetLogin parameters in (a) index.php; the (4) sites_id parameter in (b) sites.php; and the (5)…

  • CVE-2006-3132Jun 22, 2006
    Qto
    Qtofilemanager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in qtofm.php4 in QTOFileManager 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, as originally reported for index.php.

  • CVE-2006-3014Jun 22, 2006
    Microsoft
    Excel
    risk 0.05cvss —epss 0.30

    Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet.

  • CVE-2006-3127Jun 21, 2006
    Sun Corporation
    Java Enterprise System
    risk 0.00cvss —epss 0.03

    Memory leak in Network Security Services (NSS) 3.11, as used in Sun Java Enterprise System 2003Q4 through 2005Q1 and Java System Directory Server 5.2, allows remote attackers to cause a denial of service (memory consumption) by performing a large number of RSA cryptographic…

  • CVE-2006-3128Jun 21, 2006
    Easy CMS
    Easy CMS
    risk 0.00cvss —epss 0.01

    choose_file.php in easy-CMS 0.1.2, when mod_mime is installed, does not restrict uploads of filenames with multiple extensions, which allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a GIF file extension, then directly accessing that file in the…

  • CVE-2006-2911Jun 21, 2006
    CMS Mundo
    CMS Mundo
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in controlpanel/index.php in CMS Mundo before 1.0 build 008 allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2006-2931Jun 21, 2006
    CMS Mundo
    CMS Mundo
    risk 0.00cvss —epss 0.01

    CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote attackers to execute arbitrary PHP code by uploading and later directly accessing certain files.

  • CVE-2006-3101Jun 21, 2006
    Cisco Systems, Inc.
    Secure ACS for UNIX
    risk 0.05cvss —epss 0.24

    Cross-site scripting (XSS) vulnerability in LogonProxy.cgi in Cisco Secure ACS for UNIX 2.3 allows remote attackers to inject arbitrary web script or HTML via the (1) error, (2) SSL, and (3) Ok parameters.

  • CVE-2006-3102Jun 21, 2006
    Bitweaver
    Bitweaver
    risk 0.04cvss —epss 0.08

    Race condition in articles/BitArticle.php in Bitweaver 1.3, when run on Apache with the mod_mime extension, allows remote attackers to execute arbitrary PHP code by uploading arbitrary files with double extensions, which are stored for a small period of time under the webroot in…

  • CVE-2006-3103Jun 21, 2006
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in Bitweaver 1.3 allows remote attackers to inject arbitrary web script or HTML via the (1) error parameter in users/login.php and the (2) feedback parameter in articles/index.php.

  • CVE-2006-3104Jun 21, 2006
    Bitweaver
    Bitweaver
    risk 0.04cvss —epss 0.09

    users/index.php in Bitweaver 1.3 allows remote attackers to obtain sensitive information via an invalid sort_mode parameter, which reveals the installation path and database information in the resultant error message.

  • CVE-2006-3105Jun 21, 2006
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.03

    CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.

  • CVE-2006-3106Jun 21, 2006
    phpMyDesktop|Arcade
    phpMyDesktop|Arcade
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in phpMyDesktop|Arcade 1.0 allows remote attackers to inject arbitrary web script or HTML via the subsite parameter in the subsite todo.

  • CVE-2006-3107Jun 21, 2006
    Docebo
    Docebo
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in (1) GLOBALS[where_framework] to (a) admin/modules/news/news_class.php and (b)…

  • CVE-2006-3108Jun 21, 2006
    Emailarchitect
    Email Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in EmailArchitect Email Server 6.1 allows remote attackers to inject arbitrary Javascript via an HTML div tag with a carriage return between the onmouseover attribute and its value, which bypasses the mail filter.

  • CVE-2006-3109Jun 21, 2006
    Cisco Systems, Inc.
    Unified Callmanager
    risk 0.04cvss —epss 0.13

    Cross-site scripting (XSS) vulnerability in Cisco CallManager 3.3 before 3.3(5)SR3, 4.1 before 4.1(3)SR4, 4.2 before 4.2(3), and 4.3 before 4.3(1), allows remote attackers to inject arbitrary web script or HTML via the (1) pattern parameter in ccmadmin/phonelist.asp and (2)…

  • CVE-2006-3110Jun 21, 2006
    Chipmailer
    Chipmailer
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in main.php in Chipmailer 1.09 allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) betreff, (3) mail, and (4) text parameters.

  • CVE-2006-3111Jun 21, 2006
    Chipmailer
    Chipmailer
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in main.php in Chipmailer 1.09 allow remote attackers to execute arbitrary SQL commands via multiple parameters, as demonstrated by (1) anfang, (2) name, (3) mail, (4) anrede, (5) vorname, (6) nachname, (7) gebtag, (8) gebmonat, and (9)…

  • CVE-2006-3112Jun 21, 2006
    Chipmailer
    Chipmailer
    risk 0.00cvss —epss 0.01

    Chipmailer 1.09 allows remote attackers to obtain sensitive information via a direct request to php.php, which displays the output of the phpinfo function.

  • CVE-2006-2942Jun 20, 2006
    TWiki
    Twiki
    risk 0.00cvss —epss 0.02

    TWiki 4.0.0, 4.0.1, and 4.0.2 allows remote attackers to gain Twiki administrator privileges via a TWiki.TWikiRegistration form with a modified action attribute that references the Sandbox web instead of the user web, which can then be used to associate the user's login name…

  • CVE-2006-3097Jun 20, 2006
    Microfocus
    Support Tools Manager
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Support Tools Manager (xstm, cstm, and stm) on HP-UX B.11.11 and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors.

  • CVE-2006-3087Jun 19, 2006
    Ezgallery
    Ezgallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in EZGallery 1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) pUserID, (2) aid, (3) aname, (4) uid, and (5) m parameter in (a) common/galleries.asp; (6) aid, (7) aname, (8) uid, (9) m,…