VYPR

CVEs

343,931 total · page 6521 of 6,879

AllCriticalHighKEV
  • CVE-2006-2769Jun 2, 2006
    Snort
    Snort
    risk 0.04cvss —epss 0.11

    The HTTP Inspect preprocessor (http_inspect) in Snort 2.4.0 through 2.4.4 allows remote attackers to bypass "uricontent" rules via a carriage return (\r) after the URL and before the HTTP declaration.

  • CVE-2006-2770Jun 2, 2006
    Pppblog
    Pppblog
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in randompic.php in pppBLOG 0.3.8 and earlier, when register_globals is enabled, allows remote attackers to read arbitrary files via a .. (dot dot) sequence in an index of the "file" array parameter, as demonstrated by file[0].

  • CVE-2006-2771Jun 2, 2006
    Hogstorps
    Hogstorp Guestbook
    risk 0.03cvss —epss 0.02

    admin/radera/tabort.asp in Hogstorps hogstorp guestbook 2.0 does not verify user credentials, which allows remote attackers to delete arbitrary posts via a modified delID parameter.

  • CVE-2006-2772Jun 2, 2006
    Hogstorps
    Hogstorp Guestbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in add.asp in Hogstorps hogstorp guestbook 2.0 allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) email, and (3) headline parameters. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2006-2773Jun 2, 2006
    Hogstorps
    Hogstorp Guestbook
    risk 0.00cvss —epss 0.02

    admin/redigera/redigera2.asp in Hogstorps hogstorp Guestbook 2.0 does not verify user credentials, which allows remote attackers to edit arbitrary posts via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third…

  • CVE-2006-2774Jun 2, 2006
    Qontentone
    Qontentone CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in QontentOne CMS allows remote attackers to inject arbitrary web script or HTML via the search_phrase parameter.

  • CVE-2006-2654Jun 2, 2006
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in smbfs smbfs on FreeBSD 4.10 up to 6.1 allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\\" sequences. NOTE: this is similar to CVE-2006-1864, but this is a different implementation of smbfs, so it has a…

  • CVE-2006-2655Jun 2, 2006
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.01

    The build process for ypserv in FreeBSD 5.3 up to 6.1 accidentally disables access restrictions when using the /var/yp/securenets file, which allows remote attackers to bypass intended access restrictions.

  • CVE-2006-2755Jun 2, 2006
    UBBThreads
    UBBThreads
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in UBBThreads 5.x and earlier allows remote attackers to inject arbitrary web script or HTML via the debug parameter, as demonstrated by stealing MD5 hashes of passwords.

  • CVE-2006-2756Jun 2, 2006
    Eitsop
    My Web Server
    risk 0.00cvss —epss 0.02

    Eitsop My Web Server 1.0 allows remote attackers to cause a denial of service (application crash) via a long GET request. NOTE: CVE analysis suggests that this is a different product, and therefore a different vulnerability, than CVE-2002-1897.

  • CVE-2006-2757Jun 2, 2006
    Chipmunk Scripts
    guestbook
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Chipmunk guestbook allows remote attackers to inject arbitrary web script or HTML via the (1) start parameter in (a) index.php; (2) forumID parameter in index.php, (b) newtopic.php, and (c) reply.php; and (3) ID parameter to (d)…

  • CVE-2006-2758Jun 2, 2006
    Eclipse
    Jetty
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary files via a %2e%2e%5c (encoded ../) in the URL. NOTE: this might be the same issue as CVE-2005-3747.

  • CVE-2006-2759Jun 2, 2006
    Eclipse
    Jetty
    risk 0.00cvss —epss 0.01

    jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probably other mixed case manipulations.

  • CVE-2006-2760Jun 2, 2006
    4nNukeWare
    4nForum
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in modules.php in 4nNukeWare 4nForum 0.91 allows remote attackers to execute arbitrary SQL commands via the tid parameter.

  • CVE-2006-2761Jun 2, 2006
    Hitachi
    Hitsenser3
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Hitachi HITSENSER3 HITSENSER3/PRP, HITSENSER3/PUP, HITSENSER3/STP, and HITSENSER3/EUP allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.

  • CVE-2006-2762Jun 2, 2006
    Webcalendar
    Webcalendar
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in includes/config.php in WebCalendar 1.0.3 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter, which is remotely accessed in an fopen call whose results are used to define a user_inc setting that…

  • CVE-2006-2763Jun 2, 2006
    Preprojects
    Pre News Manager
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in Pre News Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) index.php, and the (2) nid parameter to (b) news_detail.php, (c) email_story.php, (d) thankyou.php, (e) printable_view.php, (f)…

  • CVE-2006-2764Jun 2, 2006
    Xander Ladage
    Guestbookxl
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in GuestbookXL 1.3 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in an IMG tag in a comment field to (1) guestwrite.php or (2) guestbook.php.

  • CVE-2006-2765Jun 2, 2006
    Interlink
    Advantage
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in news_information.php in Interlink Advantage allows remote attackers to inject arbitrary web script or HTML via the flag parameter.

  • CVE-2006-2308Jun 2, 2006
    EServ
    EServ/3
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the IMAP service in EServ/3 3.25 allows remote authenticated users to read other user's email messages, create/rename arbitrary directories on the system, and delete empty directories via directory traversal sequences in the (1) CREATE, (2)…

  • CVE-2006-2309Jun 2, 2006
    EServ
    EServ/3
    risk 0.00cvss —epss 0.02

    The HTTP service in EServ/3 3.25 allows remote attackers to obtain sensitive information via crafted HTTP requests containing dot, space, and slash characters, which reveals the source code of script files.

  • CVE-2006-2753Jun 1, 2006
    MySQL
    MySQL
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22 allows context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in character sets such as SJIS, BIG5, and GBK, which are not properly handled when the…

  • CVE-2006-2754Jun 1, 2006
    OpenLDAP
    Openldap
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in st.c in slurpd for OpenLDAP before 2.3.22 might allow attackers to execute arbitrary code via a long hostname.

  • CVE-2006-2439Jun 1, 2006
    Zipcentral
    Zipcentral
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in ZipCentral 4.01 allows remote user-assisted attackers to execute arbitrary code via a ZIP archive containing a long filename.

  • CVE-2006-2703Jun 1, 2006
    Redcarpet Project
    Redcarpet
    risk 0.00cvss —epss 0.01

    The RedCarpet command-line client (rug) does not verify SSL certificates from a server, which allows remote attackers to read network traffic and execute commands via a man-in-the-middle (MITM) attack.

  • CVE-2006-2725Jun 1, 2006
    Eggblog
    Eggblog
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in rss/posts.php in Eggblog before 3.07 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-2726Jun 1, 2006
    Fastpublish
    Fastpublish CMS
    risk 0.05cvss —epss 0.19

    PHP remote file inclusion vulnerability in Fastpublish CMS 1.6.9.d allows remote attackers to include arbitrary files via the config[fsBase] parameter in (1) drucken.php, (2) drucken2.php, (3) email_an_benutzer.php, (4) rechnung.php, (5) suche/search.php and (6)…

  • CVE-2006-2727Jun 1, 2006
    Eggblog
    Eggblog
    risk 0.00cvss —epss 0.02

    home/register.php in Eggblog before 3.0 allows remote attackers to change the password of administrators and possibly other users via a modified username parameter.

  • CVE-2006-2728Jun 1, 2006
    Jan Chmelik
    Photoalbum Bandw
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in superalbum/index.php in Photoalbum B&W 1.3 allows remote attackers to inject arbitrary web script or HTML via the pic parameter.

  • CVE-2006-2729Jun 1, 2006
    Photoalbum B&W
    Photoalbum B&W
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in superalbum/index.php in Photoalbum B&W 1.3 allows remote attackers to inject arbitrary web script or HTML via the gal parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-2730Jun 1, 2006
    Hot Open Tickets
    Hot Open Tickets
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin/lib_action_step.php in Hot Open Tickets (HOT) 11012004_ver2f, when register_globals is enabled, allows remote attackers to include arbitrary files via the GLOBALS[CLASS_PATH] parameter. NOTE: this issue might be resultant from a…

  • CVE-2006-2731Jun 1, 2006
    Enigma Haber
    Enigma Haber
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in Enigma Haber 4.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a) e_mesaj_yas.asp, (b) edi_haber.asp, and (c) haber_devam.asp; (2) hid parameter in (d) yazdir.asp and (e) yorum.asp, and…

  • CVE-2006-2732Jun 1, 2006
    Mini Nuke
    Mini Nuke
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in Your_Account.asp in Mini-Nuke 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) yas_1, (2) yas_2, and (3) yas_3 parameters.

  • CVE-2006-2733Jun 1, 2006
    Mini Nuke
    Mini Nuke
    risk 0.00cvss —epss 0.01

    membership.asp in Mini-Nuke 2.3 and earlier uses plaintext security codes, which allows remote attackers to register multiple times via automated scripts.

  • CVE-2006-2734Jun 1, 2006
    Mini Nuke
    Mini Nuke
    risk 0.00cvss —epss 0.02

    enter.asp in Mini-Nuke 2.3 and earlier makes it easier for remote attackers to conduct password guessing attacks by setting the guvenlik parameter to the same value as the hidden gguvenlik parameter, which bypasses a verification step because the gguvenlik parameter is assumed…

  • CVE-2006-2735Jun 1, 2006
    Activity Mod Plus
    Activity Mod Plus
    risk 0.04cvss —epss 0.07

    PHP remote file inclusion vulnerability in language/lang_english/lang_activity.php in Activity MOD Plus (Amod) 1.1.0, as used with phpBB when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. NOTE:…

  • CVE-2006-2736Jun 1, 2006
    Blend Portal
    Blend Portal
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in blend_data/blend_common.php in Blend Portal 1.2.0, as used with phpBB when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. NOTE: This is a similar…

  • CVE-2006-2737Jun 1, 2006
    Nukedit
    Nukedit
    risk 0.03cvss —epss 0.03

    utilities/register.asp in Nukedit 4.9.6 and earlier allows remote attackers to create new users as part of arbitrary groups, including the administrative group, via a modified groupid parameter when creating a user via the addDB action.

  • CVE-2006-2738Jun 1, 2006
    Open-Xchange
    Open Xchange Server
    risk 0.00cvss —epss 0.02

    The open source version of Open-Xchange 0.8.2 and earlier uses a static default username and password with a valid login shell in the initfile for the ldap-server, which allows remote attackers to access any server where the default has not been changed.

  • CVE-2006-2739Jun 1, 2006
    Epicdesigns
    tinyBB
    risk 0.04cvss —epss 0.09

    PHP remote file inclusion vulnerability in footers.php in Epicdesigns tinyBB 0.3, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the tinybb_footers parameter.

  • CVE-2006-2740Jun 1, 2006
    Epicdesigns
    tinyBB
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in Epicdesigns tinyBB 0.3 allow remote attackers to execute arbitrary SQL commands via the (1) q parameter in (a) forgot.php, and the (2) username and (3) password parameters in (b) login.php, and other unspecified vectors.

  • CVE-2006-2741Jun 1, 2006
    Epicdesigns
    tinyBB
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Epicdesigns tinyBB 0.3 allow remote attackers to inject arbitrary web script or HTML via the q parameter in forgot.php, which is echoed in an error message, and other unspecified vectors.

  • CVE-2006-2742Jun 1, 2006
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to execute arbitrary SQL commands via the (1) count and (2) from variables to (a) database.mysql.inc, (b) database.pgsql.inc, and (c) database.mysqli.inc.

  • CVE-2006-2743Jun 1, 2006
    Drupal
    Drupal
    risk 0.04cvss —epss 0.11

    Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which allows remote attackers to upload, modify, or execute arbitrary files in the files directory.

  • CVE-2006-2744Jun 1, 2006
    Facile Interactive Web
    Facile Interactive Web
    risk 0.04cvss —epss 0.10

    PHP remote file inclusion vulnerability in p-popupgallery.php in F@cile Interactive Web 0.8.41 through 0.8.5 allows remote attackers to execute arbitrary PHP code via a URL in the l parameter.

  • CVE-2006-2745Jun 1, 2006
    Facile Interactive Web
    Facile Interactive Web
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in F@cile Interactive Web 0.8.5 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) pathfile parameter in (a) p-editpage.php and (b) p-editbox.php, and the (2)…

  • CVE-2006-2746Jun 1, 2006
    Facile Interactive Web
    Facile Interactive Web
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in F@cile Interactive Web 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) lang parameter in index.php, and the (2) mytheme and (3) myskin parameters in multiple "p-themes"…

  • CVE-2006-2747Jun 1, 2006
    Fredi Bach
    Phpmydesktop Arcade
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in PhpMyDesktop|arcade 1.0 FINAL allows remote attackers to read arbitrary files or execute PHP code via a .. (dot dot) sequence and trailing null (%00) byte in the subsite parameter in a showsubsite todo.

  • CVE-2006-2748Jun 1, 2006
    Open Searchable Image Catalogue
    Open Searchable Image Catalogue
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the do_mysql_query function in core.php for Open Searchable Image Catalogue (OSIC) before 0.7.0.1 allows remote attackers to inject arbitrary SQL commands via multiple vectors, as demonstrated by the (1) type parameter in adminfunctions.php and the…

  • CVE-2006-2749Jun 1, 2006
    Open Searchable Image Catalogue
    Open Searchable Image Catalogue
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in search.php in Open Searchable Image Catalogue (OSIC) 0.7.0.1 and earlier allows remote attackers to inject arbitrary SQL commands via the (1) txtCustomField and (2) CustomFieldID array parameters.