VYPR

CVEs

343,931 total · page 6519 of 6,879

AllCriticalHighKEV
  • CVE-2006-2838Jun 6, 2006
    F-Secure
    Internet Gatekeeper
    risk 0.00cvss —epss 0.06

    Buffer overflow in the web console in F-Secure Anti-Virus for Microsoft Exchange 6.40, and Internet Gatekeeper 6.40 through 6.42 and 6.50 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors. NOTE: By…

  • CVE-2006-2839Jun 6, 2006
    Webwork
    Webwork
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in PG Problem Editor module (PGProblemEditor.pm) in WeBWorK Online Homework Delivery System 2.2.0 and earlier allows remote attackers to read and write files outside of the templates directory.

  • CVE-2006-2840Jun 6, 2006
    Pmwiki
    Pmwiki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in (1) uploads.php and (2) "url links" in PmWiki 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

  • CVE-2006-2841Jun 6, 2006
    Associated
    Associated CMS
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in AssoCIateD (aka ACID) CMS 1.1.3 allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) menu.php, (2) profile.php, (3) users.php, (4) cache_mngt.php, and (5) gallery_functions.php.

  • CVE-2006-2842Jun 6, 2006
    SquirrelMail
    Squirrelmail
    risk 0.07cvss —epss 0.47

    PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue…

  • CVE-2006-2843Jun 6, 2006
    Redaxo
    Redaxo
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the (1) REX[INCLUDE_PATH] parameter in (a) addons/import_export/pages/index.inc.php and (b) pages/community.inc.php.

  • CVE-2006-2844Jun 6, 2006
    Redaxo
    Redaxo
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to (1) simple_user/pages/index.inc.php and (2) stats/pages/index.inc.php.

  • CVE-2006-2845Jun 6, 2006
    Redaxo
    Redaxo
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to image_resize/pages/index.inc.php.

  • CVE-2006-2846Jun 6, 2006
    Visiongate
    Visiongate Portal System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Print.PHP in VisionGate Portal System allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. NOTE: The provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-2847Jun 6, 2006
    Fullrevolution
    Aspweblinks
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in links.asp in aspWebLinks 2.0 allows remote attackers to execute arbitrary SQL commands via the linkID parameter.

  • CVE-2006-2848Jun 6, 2006
    AspWebLinks
    aspWebLinks
    risk 0.03cvss —epss 0.02

    links.asp in aspWebLinks 2.0 allows remote attackers to change the administrative password, possibly via a direct request with a modified txtAdministrativePassword field.

  • CVE-2006-2849Jun 6, 2006
    Bytehoard
    Bytehoard
    risk 0.04cvss —epss 0.11

    PHP remote file inclusion vulnerability in includes/webdav/server.php in Bytehoard 2.1 Epsilon/Delta allows remote attackers to execute arbitrary PHP code via a URL in the bhconfig[bhfilepath] parameter.

  • CVE-2006-2850Jun 6, 2006
    Labwiki Project
    Labwiki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in recentchanges.php in PHP Labware LabWiki 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the help parameter.

  • CVE-2006-2851Jun 6, 2006
    Dotproject
    Dotproject
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in dotProject 2.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, which are not properly handled when the client is using Internet Explorer.

  • CVE-2006-2852Jun 6, 2006
    DotWidget For Articles
    CMS
    risk 0.04cvss —epss 0.11

    PHP remote file inclusion vulnerability in dotWidget CMS 1.0.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file_path parameter in (1) index.php, (2) feedback.php, and (3) printfriendly.php.

  • CVE-2006-2853Jun 6, 2006
    Abarcar
    Abarcar Realty Portal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in content.php in abarcar Realty Portal 5.1.5 allows remote attackers to execute arbitrary SQL commands via the cat parameter.

  • CVE-2006-2854Jun 6, 2006
    Ibwd
    Ibwd Guestbook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in iBWd Guestbook 1.0 allows remote attackers to execute arbitrary SQL commands via the offset parameter.

  • CVE-2006-2855Jun 6, 2006
    Xuebook
    Xuebook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in xueBook 1.0 allows remote attackers to execute arbitrary SQL commands via the start parameter.

  • CVE-2006-2856Jun 6, 2006
    Activestate
    Activeperl
    risk 0.00cvss —epss 0.00

    ActiveState ActivePerl 5.8.8.817 for Windows configures the site/lib directory with "Users" group permissions for changing files, which allows local users to gain privileges by creating a malicious sitecustomize.pl file in that directory. NOTE: The provenance of this…

  • CVE-2006-2857Jun 6, 2006
    Lifetype
    Lifetype
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in LifeType 1.0.4 allows remote attackers to execute arbitrary SQL commands via the articleId parameter in a ViewArticle action (viewarticleaction.class.php).

  • CVE-2006-2858Jun 6, 2006
    Locazo
    Classifieds
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in viewmsg.asp in LocazoList Classifieds 1.05e allows remote attackers to execute arbitrary SQL commands via the msgid parameter.

  • CVE-2006-2859Jun 6, 2006
    Mywebland
    Mybloggie
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in MyBloggie 2.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mybloggie_root_path parameter to (1) admin.php or (2) scode.php. NOTE: this issue has been disputed in multiple third party followups,…

  • CVE-2006-2860Jun 6, 2006
    Webspot
    Webspotblogging
    risk 0.04cvss —epss 0.13

    PHP remote file inclusion vulnerability in Webspotblogging 3.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) inc/logincheck.inc.php, (2) inc/adminheader.inc.php, (3) inc/global.php, or (4) inc/mainheader.inc.php. NOTE: some of…

  • CVE-2006-2861Jun 6, 2006
    Particle Soft
    Particle Wiki
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Particle Wiki 1.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter.

  • CVE-2006-2862Jun 6, 2006
    Particle Gallery
    Particle Gallery
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in viewimage.php in Particle Gallery 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the imageid parameter.

  • CVE-2006-2863Jun 6, 2006
    Office Ocx
    Cs Cart
    risk 0.04cvss —epss 0.09

    PHP remote file inclusion vulnerability in class.cs_phpmailer.php in CS-Cart 1.3.3 allows remote attackers to execute arbitrary PHP code via a URL in the classes_dir parameter.

  • CVE-2006-2864Jun 6, 2006
    Blueshoes
    Framework
    risk 0.04cvss —epss 0.15

    Multiple PHP remote file inclusion vulnerabilities in BlueShoes Framework 4.6 allow remote attackers to execute arbitrary PHP code via a URL in the (1) APP[path][applications] parameter to (a) Bs_Faq.class.php, (2) APP[path][core] parameter to (b) fileBrowserInner.php, (c)…

  • CVE-2006-2865Jun 6, 2006
    PhpBB
    phpBB
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in template.php in phpBB 2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: followup posts have disputed this issue, stating that template.php does not appear in phpBB and does not use a $page…

  • CVE-2006-2866Jun 6, 2006
    Dotclear
    Dotclear
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in layout/prepend.php in DotClear 1.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a FTP URL in the blog_dc_path parameter, which passes file_exists() and is_dir() tests on PHP 5.

  • CVE-2006-2867Jun 6, 2006
    Coolforum
    Coolforum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in editpost.php in CoolForum 0.8.3 beta and earlier allows remote attackers to execute arbitrary SQL commands via the post parameter.

  • CVE-2006-2868Jun 6, 2006
    Claroline
    Claroline
    risk 0.04cvss —epss 0.11

    Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.6 allow remote attackers to execute arbitrary PHP code via a URL in the includePath cookie to (1) auth/extauth/drivers/mambo.inc.php or (2) auth/extauth/drivers/postnuke.inc.php.

  • CVE-2006-2869Jun 6, 2006
    Avast\!
    Avast
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the CHM unpacker in avast! before 4.7.844 has unknown impact and remote attack vectors.

  • CVE-2006-2870Jun 6, 2006
    Intelligent Solutions
    Asp Discussion Forum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in forum_search.asp in Intelligent Solutions Inc. ASP Discussion Forum allows remote attackers to inject arbitrary web script or HTML via the search variable.

  • CVE-2006-2871Jun 6, 2006
    Cyboards
    PHP Lite
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in include/common.php in CyBoards PHP Lite 1.25 allows remote attackers to execute arbitrary PHP code via a URL in the script_path parameter. NOTE: CVE disputes this issue, since $script_path is set to a constant value

  • CVE-2006-2872Jun 6, 2006
    Rumble
    Rumble
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in config.php in Rumble 1.02 allows remote attackers to execute arbitrary PHP code via a URL in the configArr[pathtodir] parameter.

  • CVE-2006-2873Jun 6, 2006
    Enigma Haber
    Enigma Haber
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in hava.asp in Enigma Haber 4.2 allows remote attackers to inject arbitrary web script or HTML via the il parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-2874Jun 6, 2006
    OSADS
    Alliance Database
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in OSADS Alliance Database before 1.4 has unknown impact and attack vectors related to a "Security Leak to lock in HTML-Code," possibly due to a cross-site scripting (XSS) vulnerability involving comments.

  • CVE-2006-2831Jun 6, 2006
    Drupal
    Drupal
    risk 0.00cvss —epss 0.04

    Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, when running under certain Apache configurations such as when FileInfo overrides are disabled within .htaccess, allows remote attackers to execute arbitrary code by uploading a file with multiple extensions, a variant of…

  • CVE-2006-2832Jun 6, 2006
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the upload module (upload.module) in Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via the uploaded filename.

  • CVE-2006-2833Jun 6, 2006
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the taxonomy module in Drupal 4.6.8 and 4.7.2 allows remote attackers to inject arbitrary web script or HTML via inputs that are not properly validated when the page title is output, possibly involving the $names variable.

  • CVE-2006-2828Jun 5, 2006
    PHP-Nuke
    Ev
    risk 0.03cvss —epss 0.02

    Global variable overwrite vulnerability in PHP-Nuke allows remote attackers to conduct remote PHP file inclusion attacks via a modified phpbb_root_path parameter to the admin scripts (1) index.php, (2) admin_ug_auth.php, (3) admin_board.php, (4) admin_disallow.php, (5)…

  • CVE-2006-2829Jun 5, 2006
    TIBCO Software
    Hawk
    risk 0.00cvss —epss 0.00

    Buffer overflow in Hawk Monitoring Agent (HMA) for TIBCO Hawk before 4.6.1 and TIBCO Runtime Agent (TRA) before 5.4 allows authenticated users to execute arbitrary code via the configuration for tibhawkhma.

  • CVE-2006-2830Jun 5, 2006
    TIBCO Software
    Hawk
    risk 0.00cvss —epss 0.06

    Buffer overflow in TIBCO Rendezvous before 7.5.1, TIBCO Runtime Agent (TRA) before 5.4, and Hawk before 4.6.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the HTTP administrative interface.

  • CVE-2006-2806Jun 5, 2006
    Apache
    James
    risk 0.00cvss —epss 0.06

    The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows remote attackers to cause a denial of service (CPU consumption) via a long argument to the MAIL command.

  • CVE-2006-2807Jun 5, 2006
    Aspwebsoft
    Speedy Asp Discussion Forum
    risk 0.03cvss —epss 0.04

    ASPwebSoft Speedy Asp Discussion Forum allows remote attackers to change the password of any account via a modified account id and possibly arbitrary values of the name, email, country, password, and passwordre parameters to profileupdate.asp.

  • CVE-2006-2808Jun 5, 2006
    Lycos
    Htmlgear Guestgear
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Lycos Tripod htmlGEAR guestGEAR (aka Guest Gear) allows remote attackers to inject arbitrary web script or HTML via a guestbook post containing a javascript URI in the SRC attribute of the BR element after an extra "iframe" tagname…

  • CVE-2006-2809Jun 5, 2006
    AR Blog
    AR Blog
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in ar-blog 5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) count parameter, and possibly the (2) next, (3) Year_the_news, and (4) mo parameters. NOTE: the year and month vectors are…

  • CVE-2006-2810Jun 5, 2006
    Belchior Foundry
    Vcard
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Belchior Foundry vCard 2.9 allow remote attackers to inject arbitrary web script or HTML via the page parameter in (1) toprated.php and (2) newcards.php. NOTE: the card_id vector is already covered by CVE-2006-1230.

  • CVE-2006-2811Jun 5, 2006
    Ovidentia
    Ovidentia
    risk 0.04cvss —epss 0.17

    Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the babInstallPath parameter in (1) index.php, (2) topman.php, (3) approb.php, (4) vacadmb.php, (5) vacadma.php, (6) vacadm.php, (7)…

  • CVE-2006-2812Jun 5, 2006
    Dominios Europa
    Picrate
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Dominios Europa PICRATE (aka TAL RateMyPic) 1.0 allow remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element in the (1) name (aka nick), (2) email,…