VYPR

CVEs

343,955 total · page 6517 of 6,880

AllCriticalHighKEV
  • CVE-2006-2384Jun 13, 2006
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.19

    Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been…

  • CVE-2006-2385Jun 13, 2006
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file.

  • CVE-2006-2376Jun 13, 2006
    Microsoft
    Windows 98
    risk 0.03cvss —epss 0.41

    Integer overflow in the PolyPolygon function in Graphics Rendering Engine on Microsoft Windows 98 and Me allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) or EMF image with a sum of entries in the vertext counts array and number of polygons that…

  • CVE-2006-2660Jun 13, 2006
    PHP
    PHP
    risk 0.00cvss —epss 0.00

    Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and create PHP files with fixed names in other directories via a pathname argument longer than MAXPATHLEN, which prevents a unique string from…

  • CVE-2006-3005Jun 13, 2006
    File Project
    Linux
    risk 0.00cvss —epss 0.02

    The JPEG library in media-libs/jpeg before 6b-r7 on Gentoo Linux is built without the -maxmem feature, which could allow context-dependent attackers to cause a denial of service (memory exhaustion) via a crafted JPEG file that exceeds the intended memory limits.

  • CVE-2006-3006Jun 13, 2006
    Ifoto
    Ifoto
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in iFoto 0.20, and possibly other versions before 0.50, allows remote attackers to inject arbitrary HTML or web script via a base64-encoded file parameter.

  • CVE-2006-3007Jun 13, 2006
    Shoutcast
    SHOUTcast Server
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in SHOUTcast 1.9.5 allow remote attackers to inject arbitrary HTML or web script via the DJ fields (1) Description, (2) URL, (3) Genre, (4) AIM, and (5) ICQ.

  • CVE-2006-2908Jun 13, 2006
    PhpBB
    Mybulletinboard
    risk 0.03cvss —epss 0.04

    The domecode function in inc/functions_post.php in MyBulletinBoard (MyBB) 1.1.2, and possibly other versions, allows remote attackers to execute arbitrary PHP code via the username field, which is used in a preg_replace function call with a /e (executable) modifier.

  • CVE-2006-2982Jun 13, 2006
    Enterprise Payroll Systems
    Enterprise Payroll Systems
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter in (1) footer.php and (2) admin/footer.php.

  • CVE-2006-2983Jun 13, 2006
    Enterprise Payroll Systems
    Enterprise Payroll Systems
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter in cal.php. NOTE: the provenance of this information is unknown; the details…

  • CVE-2006-2984Jun 13, 2006
    Integramod
    Integramod
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in IntegraMOD 1.4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the STYLE_URL parameter. NOTE: it is possible that this issue is resultant from SQL injection.

  • CVE-2006-2985Jun 13, 2006
    Integramod
    Integramod
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in IntegraMOD 1.4.0 and earlier allows remote attackers to execute arbitrary SQL commands via double-encoded "'" characters in the STYLE_URL parameter.

  • CVE-2006-2986Jun 13, 2006
    Baby Katie Media
    Very Simple Car Lister
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Baby Katie Media (a) very Simple Car Lister (vSCAL) 1.0 and (b) very simple Realty Lister (vsREAL) 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) lid parameter in index.php and the (2) title…

  • CVE-2006-2987Jun 13, 2006
    Dominios Europa
    Picrate
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Dominios Europa PICRATE (aka TAL RateMyPic) 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) voteid, and (3) vfiel parameters to (a) index.php, and via the (4) nick, (5) email, (6) city, (7) messen, and…

  • CVE-2006-2988Jun 13, 2006
    Chemical Dictionary
    Chemical Dictionary
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in dictionary.php in Chemical Dictionary allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in a browse action.

  • CVE-2006-2989Jun 13, 2006
    Iisworks
    Listpics
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in listpics.asp in ASP ListPics 4.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the info parameter.

  • CVE-2006-2990Jun 13, 2006
    Vanillasoft
    Helpdesk
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in default.asp in VanillaSoft Helpdesk 2005 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.

  • CVE-2006-2991Jun 13, 2006
    Ringlink
    Ringlink
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Ringlink 3.2 allow remote attackers to inject arbitrary web script or HTML via a JavaScript URI in the SRC attribute of an IMG element, and possibly other manipulations, in the ringid parameter in (1) next.cgi, (2)…

  • CVE-2006-2992Jun 13, 2006
    My Photo Scrapbook
    My Photo Scrapbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in display.asp in My Photo Scrapbook 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the key_m parameter.

  • CVE-2006-2993Jun 13, 2006
    My Photo Scrapbook
    My Photo Scrapbook
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in My Photo Scrapbook 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the key parameter in (1) Displayview.asp and (2) Details_Photo_bv.asp.

  • CVE-2006-2994Jun 13, 2006
    Phaziz
    phazizGuestbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in phazizGuestbook 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) email, (3) url fields, and (4) text field (content parameter).

  • CVE-2006-2995Jun 13, 2006
    Webprojectdb
    Webprojectdb
    risk 0.04cvss —epss 0.08

    Multiple PHP remote file inclusion vulnerabilities in WebprojectDB 0.1.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the INCDIR parameter in (1) include/nav.php and (2) include/lang.php.

  • CVE-2006-2996Jun 13, 2006
    Lovecompass
    Aepartner
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in inc/design.inc.php in LoveCompass aePartner 0.8.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the dir[data] parameter.

  • CVE-2006-2997Jun 13, 2006
    Zms Publishing
    Zms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in ZMS 2.9 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the raw parameter in the search field.

  • CVE-2006-2998Jun 13, 2006
    Free Qboard
    Free Qboard
    risk 0.04cvss —epss 0.07

    PHP remote file inclusion vulnerability in board/post.php in free QBoard 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the qb_path parameter.

  • CVE-2006-2999Jun 13, 2006
    Okscripts
    Quicklinks
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in OkScripts QuickLinks 1.1 allows remote attackers to inject arbitrary web script or HTML via the q parameter.

  • CVE-2006-3000Jun 13, 2006
    Okscripts
    Okarticles
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in OkScripts OkArticles 1.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter.

  • CVE-2006-3001Jun 13, 2006
    Okscripts
    Okmall
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in OkScripts OkMall 1.0 allow remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: this might be resultant from another vulnerability, since the XSS is reflected in an error message.

  • CVE-2006-3002Jun 13, 2006
    Easy AD Manager
    Easy AD Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in details.php in Easy Ad-Manager allows remote attackers to inject arbitrary web script or HTML via the mbid parameter, which is reflected in an error message. NOTE: on 20060829, the vendor notified CVE that this issue has been fixed.

  • CVE-2006-3003Jun 13, 2006
    Easy AD Manager
    Easy AD Manager
    risk 0.00cvss —epss 0.01

    details.php in Easy Ad-Manager allows remote attackers to obtain the full installation path via an invalid mbid parameter, which leaks the path in an error message. NOTE: this might be resultant from another vulnerability, since this vector also produces cross-site scripting…

  • CVE-2006-3004Jun 13, 2006
    Scriptsez
    Ez Ringtone Manager
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Ez Ringtone Manager allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter in player.php and (2) keyword parameter when performing a search.

  • CVE-2006-2981Jun 12, 2006
    Arantius
    Vice Stats
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in vs_search.php in Arantius Vice Stats before 1.0.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors, a different issue than CVE-2006-2972.

  • CVE-2006-2972Jun 12, 2006
    Arantius
    Vice Stats
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in vs_resource.php in Arantius Vice Stats 0.5b and 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2006-2973Jun 12, 2006
    PHP Lite
    Calendar Express
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in month.php in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) catid and (2) cid parameter. NOTE: this might be a duplicate of CVE-2005-4009.c.

  • CVE-2006-2974Jun 12, 2006
    Emailarchitect
    Email Server
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 6.1.0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) errCode and (2) uid parameter in (a) default.asp and (3) dname parameter in (b) /admin/dns.asp and (c)…

  • CVE-2006-2975Jun 12, 2006
    Pbl Guestbook
    Pbl Guestbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in pblguestbook.php in PBL Guestbook 1.31 allow remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of IMG tags in the (1) name, (2) email, and (3) website parameter, which bypasses XSS…

  • CVE-2006-2976Jun 12, 2006
    Coppermine
    Coppermine Photo Gallery
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in usermgr.php in Coppermine Photo Gallery before 1.4.7 has unknown impact and remote attack vectors, possibly related to authorization/authentication errors.

  • CVE-2006-2977Jun 12, 2006
    Pearlabs
    Mafia Moblog
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in big.php in Mafia Moblog 0.6M1 and earlier allows remote attackers to execute arbitrary SQL commands via the img parameter.

  • CVE-2006-2978Jun 12, 2006
    Mafia
    Moblog
    risk 0.00cvss —epss 0.01

    Mafia Moblog 0.6M1 and earlier allows remote attackers to obtain the installation path in an error message via a direct request to (1) big.php and (2) upgrade.php.

  • CVE-2006-2979Jun 12, 2006
    Viart
    Shop
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ViArt Shop Free 2.5.5, and possibly other distributions including Light, Standard, and Enterprise, allow remote attackers to inject arbitrary web script or HTML via the (1) forum_id parameter in forum.php, which is not…

  • CVE-2006-2980Jun 12, 2006
    Viart
    Shop Free
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in block_forum_topic_new.php in ViArt Shop Free 2.5.5, and possibly other distributions including Light, Standard, and Enterprise, might allow remote attackers to execute arbitrary SQL commands via unknown vectors, probably involving the forum_id…

  • CVE-2006-2943Jun 12, 2006
    Cgi Rescue
    Webform
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in CGI-RESCUE WebFORM 4.1 and earlier allows remote attackers to inject email headers, which facilitates sending spam messages. NOTE: the details for this issue are obtained from third party information.

  • CVE-2006-2944Jun 12, 2006
    Cgi Rescue
    Form2mail
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in CGI-RESCUE FORM2MAIL 1.21 and earlier allows remote attackers to inject email headers, which facilitates sending spam messages. NOTE: the details for this issue are obtained from third party information.

  • CVE-2006-2945Jun 12, 2006
    Dokuwiki
    Dokuwiki
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the user profile change functionality in DokuWiki, when Access Control Lists are enabled, allows remote authenticated users to read unauthorized files via unknown attack vectors.

  • CVE-2006-2946Jun 12, 2006
    Dmx Forum
    Dmx Forum
    risk 0.03cvss —epss 0.03

    Dmx Forum 2.1a stores _includes/bd.inc under the web root with insufficient access control, which allows remote attackers to obtain database username and password information.

  • CVE-2006-2947Jun 12, 2006
    Dmx Forum
    Dmx Forum
    risk 0.03cvss —epss 0.03

    Dmx Forum 2.1a allows remote attackers to obtain username and password information via a direct request to pops/edit.php with a modified membre parameter.

  • CVE-2006-2948Jun 12, 2006
    Metalinks
    A Cart
    risk 0.00cvss —epss 0.01

    A-CART 2.0 stores the acart2_0.mdb file under the web document root with insufficient access control, which allows remote attackers to obtain username and password information.

  • CVE-2006-2949Jun 12, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in private.php in MyBB 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the do parameter.

  • CVE-2006-2950Jun 12, 2006
    Npds
    Npds
    risk 0.00cvss —epss 0.02

    Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) header.php, (2) contact.php, or (3) forum_extender.php, which reveals the path in an error message.

  • CVE-2006-2951Jun 12, 2006
    Npds
    Npds
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Net Portal Dynamic System (NPDS) 5.10 and earlier allow remote attackers to inject arbitrary web script and HTML via the (1) Titlesitename or (2) sitename parameter to (a) header.php, (3) nuke_url parameter to (b)…