VYPR

CVEs

343,955 total · page 6515 of 6,880

AllCriticalHighKEV
  • CVE-2006-3088Jun 19, 2006
    Cescripts
    Car Classifieds
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Car Classifieds allows remote attackers to inject arbitrary web script or HTML via the make_id parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

  • CVE-2006-3089Jun 19, 2006
    Phpmyfactures
    Phpmyfactures
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in PhpMyFactures 1.0, and possibly 1.2 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) prefixe_dossier parameter in (a) /inc/header.php; (2) msg parameter in (b)…

  • CVE-2006-3090Jun 19, 2006
    Phpmyfactures
    Phpmyfactures
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in PhpMyFactures 1.0, and possibly 1.2 and earlier, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) id_pays parameter in (a) /pays/modifier_pays.php; (2) id_produit, (3) quantite, (4)…

  • CVE-2006-3091Jun 19, 2006
    Phpmyfactures
    Phpmyfactures
    risk 0.00cvss —epss 0.02

    PhpMyFactures 1.0, and possibly 1.2 and earlier, allows remote attackers to obtain the installation path via a direct request to (1) /verif.php, (2) /inc/footer.php, and (3) /remises/ajouter_remise.php.

  • CVE-2006-3092Jun 19, 2006
    Phpmyfactures
    Phpmyfactures
    risk 0.00cvss —epss 0.03

    PhpMyFactures 1.2 and earlier allows remote attackers to bypass authentication and modify data via direct requests with modified parameters to (1) /tva/ajouter_tva.php, (2) /remises/ajouter_remise.php, (3) /pays/ajouter_pays.php, (4) /pays/modifier_pays.php, (5)…

  • CVE-2006-3093Jun 19, 2006
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.06

    Multiple unspecified vulnerabilities in Adobe Acrobat Reader (acroread) before 7.0.8 have unknown impact and unknown vectors.

  • CVE-2006-3094Jun 19, 2006
    Calendarix
    Basic
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Calendarix Basic 0.7.20060401 and earlier, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) cal_event.php and (2) cal_popup.php.

  • CVE-2006-3095Jun 19, 2006
    Ipostmx
    Ipostmx 2005
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in iPostMX 2005 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the RETURNURL parameter in (1) userlogin.cfm and (2) account.cfm.

  • CVE-2006-3096Jun 19, 2006
    Ipostmx
    Ipostmx 2005
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in iPostMX 2005 2.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) forum parameter in messagepost.cfm and (2) topic parameter in topics.cfm. NOTE: this item was created based on information in a blog entry…

  • CVE-2006-3086Jun 19, 2006
    Microsoft
    Hyperlink Object Library
    risk 0.08cvss —epss 0.56

    Stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName function in Microsoft Hyperlink Object Library (hlink.dll) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long hyperlink, as demonstrated using an Excel…

  • CVE-2006-3081Jun 19, 2006
    MySQL
    MySQL
    risk 0.05cvss —epss 0.22

    mysqld in MySQL 4.1.x before 4.1.18, 5.0.x before 5.0.19, and 5.1.x before 5.1.6 allows remote authorized users to cause a denial of service (crash) via a NULL second argument to the str_to_date function.

  • CVE-2006-3082Jun 19, 2006
    Gnupg
    Gnupg
    risk 0.04cvss —epss 0.07

    parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length (long user ID string), which could lead to an integer overflow, as…

  • CVE-2006-3012Jun 19, 2006
    Eschew.net
    Phpbannerexchange
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in phpBannerExchange before 2.0 Update 6 allows remote attackers to execute arbitrary SQL commands via the (1) login parameter in (a) client/stats.php and (b) admin/stats.php, or the (2) pass parameter in client/stats.php.

  • CVE-2006-3013Jun 19, 2006
    Eschew.net
    Phpbannerexchange
    risk 0.00cvss —epss 0.02

    Interpretation conflict in resetpw.php in phpBannerExchange before 2.0 Update 6 allows remote attackers to execute arbitrary SQL commands via an email parameter containing a null (%00) character after a valid e-mail address, which passes the validation check in the eregi PHP…

  • CVE-2006-3060Jun 19, 2006
    Webexceluk
    P.a.i.d
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in P.A.I.D 2.2 allows remote attackers to inject arbitrary web script or HTML via the (1) read parameter in index.php, (2) farea parameter in faq.php, and (3) unspecified input fields on the "My Account" login page.

  • CVE-2006-3061Jun 19, 2006
    5 Star Review
    5 Star Review
    risk 0.04cvss —epss 0.07

    Multiple cross-site scripting (XSS) vulnerabilities in 5 Star Review allow remote attackers to inject arbitrary web script or HTML via the (1) sort parameter in index2.php, (2) item_id parameter in report.php, (3) search_term parameter (aka the "search box") in…

  • CVE-2006-3062Jun 19, 2006
    Myphp Guestbook
    Myphp Guestbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in myPHP Guestbook 2.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

  • CVE-2006-3063Jun 19, 2006
    Myphp Guestbook
    Myphp Guestbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in myPHP Guestbook 1.x through 2.0.0-r1 and before 2.0.1 RC5 allow remote attackers to inject arbitrary web script or HTML via the (1) comment, (2) email, (3) homepage, (4) id, (5) name, and (6) text parameters in (a)…

  • CVE-2006-3064Jun 19, 2006
    Coppermine
    Coppermine Photo Gallery
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the add_hit function in include/function.inc.php in Coppermine Photo Gallery (CPG) 1.4.8, when "Keep detailed hit statistics" is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) referer and (2) user-agent HTTP headers.

  • CVE-2006-3065Jun 19, 2006
    Blursoft
    Blur6ex
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in engine/shards/blog.php in blur6ex 0.3.462 allows remote attackers to execute arbitrary SQL commands via the ID parameter in a proc_reply action in the blog shard. NOTE: This is a similar vulnerability to CVE-2006-1763, but the affected code and…

  • CVE-2006-3066Jun 19, 2006
    IBM
    Db2 Universal Database
    risk 0.00cvss —epss 0.02

    Buffer overflow in the TCP/IP listener in IBM DB2 Universal Database (UDB) before 8.1 FixPak 12 allows remote attackers to cause a denial of service (application crash) via a long MGRLVLLS message inside of an EXCSAT message when establishing a connection.

  • CVE-2006-3067Jun 19, 2006
    IBM
    Db2 Universal Database
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in IBM DB2 Universal Database (UDB) before 8.1 FixPak 12 allow remote attackers to cause a denial of service (application crash) via a (1) "long column list" in the (a) REPLACE INTO and (b) INSERT INTO portions of the LOAD command or a (2)…

  • CVE-2006-3068Jun 19, 2006
    IBM
    Db2 Universal Database
    risk 0.00cvss —epss 0.02

    IBM DB2 Universal Database (UDB) before 8.2 FixPak 12 allows remote attackers to cause a denial of service (application crash) by sending "incorrect information ... regarding the package name/creator," which leads to a "memory overwrite."

  • CVE-2006-3069Jun 19, 2006
    Iglooweb
    Doublespeak
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in DoubleSpeak 0.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the config[private] parameter in multiple files, as demonstrated by (1) index.php, (2) faq.php, and (3) hardware.php. NOTE:…

  • CVE-2006-3070Jun 19, 2006
    Zeroboard
    Zeroboard
    risk 0.00cvss —epss 0.02

    write_ok.php in Zeroboard 4.1 pl8, when installed on Apache with mod_mime, allows remote attackers to bypass restrictions for uploading files with executable extensions by uploading a .htaccess file that with an AddType directive that assigns an executable module to files with…

  • CVE-2006-3071Jun 19, 2006
    Anton Belev
    Mp3 Search Archive
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in MP3 Search/Archive 1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter, as used by the "search box", and (2) res parameter.

  • CVE-2006-3072Jun 19, 2006
    Symantec
    Security Information Manager
    risk 0.00cvss —epss 0.00

    M4 Macro Library in Symantec Security Information Manager before 4.0.2.29 HOTFIX 1 allows local users to execute arbitrary commands via crafted "rule definitions", which produces dangerous Java code during M4 transformation.

  • CVE-2006-3073Jun 19, 2006
    Cisco Systems, Inc.
    Asa 5500
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the WebVPN feature in the Cisco VPN 3000 Series Concentrators and Cisco ASA 5500 Series Adaptive Security Appliances (ASA), when in WebVPN clientless mode, allow remote attackers to inject arbitrary web script or HTML via…

  • CVE-2006-3074Jun 19, 2006
    Kaspersky Lab
    Internet Security
    risk 0.04cvss —epss 0.07

    klif.sys in Kaspersky Internet Security 6.0 and 7.0, Kaspersky Anti-Virus (KAV) 6.0 and 7.0, KAV 6.0 for Windows Workstations, and KAV 6.0 for Windows Servers does not validate certain parameters to the (1) NtCreateKey, (2) NtCreateProcess, (3) NtCreateProcessEx, (4)…

  • CVE-2006-3075Jun 19, 2006
    Picturedis
    Picturedis Professional
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in PictureDis Professional 1.33 Build 234 and earlier and PictureDis Photoalbum 4.82 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to files in photoalbum/ including (1)…

  • CVE-2006-3076Jun 19, 2006
    Blue Dragon
    Phpbluedragon CMS
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in software_upload/public_includes/pub_templates/vphptree/template.php in PhpBlueDragon CMS 2.9.1 allows remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPath parameter.

  • CVE-2006-3077Jun 19, 2006
    Axent
    Axentguestbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in guestbook.cfm in aXentGuestbook 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the startrow parameter.

  • CVE-2006-3078Jun 19, 2006
    Apboard
    Apboard
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in APBoard 2.2-r3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) PHPSESSID parameter in board.php and (2) viewcatmod parameter in main.php.

  • CVE-2006-3079Jun 19, 2006
    Sspwiz
    Sspwiz Plus
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.cfm in SSPwiz Plus 1.0.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the message parameter.

  • CVE-2006-3080Jun 19, 2006
    Axent
    Axentforum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in viewposts.cfm in aXentForum II and earlier allows remote attackers to inject arbitrary web script or HTML via the startrow parameter.

  • CVE-2006-3059Jun 17, 2006
    Microsoft
    Excel
    risk 0.06cvss —epss 0.41

    Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors. NOTE: this is a different vulnerability than CVE-2006-3086.

  • CVE-2006-2909Jun 16, 2006
    Picozip
    Picozip
    risk 0.04cvss —epss 0.09

    Stack-based buffer overflow in the info tip shell extension (zipinfo.dll) in PicoZip 4.01 allows remote attackers to execute arbitrary code via a long filename in an (1) ACE, (2) RAR, or (3) ZIP archive, which is triggered when the user moves the mouse over the archive.

  • CVE-2006-3043Jun 16, 2006
    CreaFrameXe
    CFXe CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.cfm in CreaFrameXe (CFXe) CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the voltext_suche parameter.

  • CVE-2006-3044Jun 16, 2006
    Logisphere
    Logisphere
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in LogiSphere 1.6.0 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected in an error page.

  • CVE-2006-3045Jun 16, 2006
    Foing
    Foing
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in manage_songs.php in Foing 0.7.0e and earlier allows remote attackers to execute arbitrary PHP code via a URL in the foing_root_path parameter.

  • CVE-2006-3046Jun 16, 2006
    Subtextproject
    Subtext
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the admin login feature in Subtext 1.5, in a multiblog setup, allows remote administrators of one blog to login to another blog.

  • CVE-2006-3047Jun 16, 2006
    Tiki
    Tiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  • CVE-2006-3048Jun 16, 2006
    Tiki
    Tiki
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.

  • CVE-2006-3049Jun 16, 2006
    Mole Group Ticket Booking Script
    Mole Group Ticket Booking Script
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in booking3.php in Mole Group Ticket Booking Script allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) address1, (3) address2, (4) county, (5) postcode, (6) email, (7) phone, or (8) mobile…

  • CVE-2006-3050Jun 16, 2006
    SixCMS
    SixCMS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in detail.php in SixCMS 6.0, and other versions before 6.0.6patch2, allows remote attackers to read arbitrary files via a .. (dot dot) sequence and trailing null (%00) byte in the template parameter.

  • CVE-2006-3051Jun 16, 2006
    SixCMS
    SixCMS
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in list.php in SixCMS 6.0, and other versions before 6.0.6patch2, allows remote attackers to inject arbitrary script code or HTML via the page parameter.

  • CVE-2006-3052Jun 16, 2006
    Cescripts
    Event Registration Paypal
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Event Registration allows remote attackers to inject arbitrary web script or HTML via the (1) event_id parameter to view-event-details.php or (2) select_events parameter to event-registration.php. NOTE: the provenance of this…

  • CVE-2006-3053Jun 16, 2006
    Phorum
    Phorum
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHORUM[http_path] parameter. NOTE: this issue has been disputed by the vendor, who states "common.php is checked on the very…

  • CVE-2006-3054Jun 16, 2006
    Vbzoom
    Vbzoom
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in VBZooM 1.11 allow remote attackers to execute arbitrary SQL commands via the (1) sobjectID or (2) MAINID parameters to (a) show.php or (3) MainID parameter to (b) subject.php.

  • CVE-2006-3055Jun 16, 2006
    Vbzoom
    Vbzoom
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in VBZooM 1.02 allow remote attackers to execute arbitrary SQL commands via the (1) QuranID, (2) ShowByQuranID, or (3) Action parameters to meaning.php.