CVEs

343,710 total · page 6526 of 6,875

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2006-2279	Saphplesson Saphplesson		0.00	—	0.02	May 10, 2006	Multiple SQL injection vulnerabilities in SaphpLesson 3.0 allow remote attackers to execute arbitrary SQL commands via (1) the Find parameter in (a) search.php, and the (2) LID and (3) Rate parameters in (b) misc.php.
CVE-2006-2280	Openengine Openengine		0.03	—	0.04	May 10, 2006	Directory traversal vulnerability in website.php in openEngine 1.8 Beta 2 and earlier allows remote attackers to list arbitrary directories and read arbitrary files via a .. (dot dot) in the template parameter.
CVE-2006-2281	X Scripts X Poll		0.00	—	0.02	May 10, 2006	X-Scripts X-Poll (xpoll) 2.30 allows remote attackers to execute arbitrary PHP code by using admin/images/add.php to upload a PHP file, then access it.
CVE-2006-2282	X7 Chat X7 Chat		0.00	—	0.01	May 10, 2006	Cross-site scripting (XSS) vulnerability in X7 Chat 2.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the URL of an avatar, possibly related to the avatar parameter in register.php.
CVE-2006-2283	Spiffyjr Phpraid		0.00	—	0.02	May 10, 2006	Multiple PHP remote file inclusion vulnerabilities in SpiffyJr phpRaid 2.9.5 through 3.0.b3 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) auth.php and (2) auth_phpbb when the phpBB portal is enabled, and via a URL in the…
CVE-2006-2284	Claroline Claroline		0.04	—	0.07	May 10, 2006	Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) clarolineRepositorySys parameter in ldap.inc.php and the (2) claro_CasLibPath parameter in casProcess.inc.php.
CVE-2006-2285	Dokeos Dokeos		0.03	—	0.04	May 10, 2006	PHP remote file inclusion vulnerability in authldap.php in Dokeos 1.6.4 allows remote attackers to execute arbitrary PHP code via a URL in the includePath parameter.
CVE-2006-2286	Dokeos Dokeos		0.00	—	0.02	May 10, 2006	Multiple PHP remote file inclusion vulnerabilities in claro_init_global.inc.php in Dokeos 1.6.3 and earlier, and Dokeos community release 2.0.3, allow remote attackers to execute arbitrary PHP code via a URL in the (1) rootSys and (2) clarolineRepositorySys parameters, and…
CVE-2006-2287	Vision Source Vision Source CMS		0.00	—	0.01	May 10, 2006	Multiple cross-site scripting (XSS) vulnerabilities in Vision Source 0.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the fields in a user's profile.
CVE-2006-2288	Avahi Avahi		0.00	—	0.00	May 10, 2006	Avahi before 0.6.10 allows local users to cause a denial of service (mDNS/DNS-SD service disconnect) via unspecified mDNS name conflicts.
CVE-2006-2289	Avahi Avahi		0.00	—	0.00	May 10, 2006	Buffer overflow in avahi-core in Avahi before 0.6.10 allows local users to execute arbitrary code via unknown vectors.
CVE-2006-2290	Www.goel.ch 2005 Comments Script		0.00	—	0.01	May 10, 2006	Multiple cross-site scripting (XSS) vulnerabilities in kommentar.php in 2005-Comments-Script allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) email, and (3) url parameter.
CVE-2006-2291	Inhouse Associates Ia Calendar		0.00	—	0.01	May 10, 2006	Cross-site scripting (XSS) vulnerability in calendar_new.asp in IA-Calendar allows remote attackers to inject arbitrary web script or HTML via the TypeName1 parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVE-2006-2292	Inhouse Associates Ia Calendar		0.00	—	0.01	May 10, 2006	Multiple SQL injection vulnerabilities in IA-Calendar allow remote attackers to execute arbitrary SQL commands via the (1) type parameter in (a) calendar_new.asp and (b) default.asp, and (2) ID parameter in (c) calendar_detail.asp. NOTE: the provenance of this information is…
CVE-2006-2293	Expinion.net Multicalendars		0.03	—	0.01	May 10, 2006	SQL injection vulnerability in all_calendars.asp in MultiCalendars 3.0 allows remote attackers to execute arbitrary SQL commands via the calsids parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVE-2006-2294	Dynamic Dynamic Galerie		0.03	—	0.02	May 10, 2006	Cross-site scripting (XSS) vulnerability in Dynamic Galerie 1.0 allows remote attackers to inject arbitrary web script or HTML via the pfad parameter in (1) index.php and (2) galerie.php. NOTE: this issue might be resultant from directory traversal.
CVE-2006-2295	Dynamic Dynamic Galerie		0.03	—	0.03	May 10, 2006	Directory traversal vulnerability in Dynamic Galerie 1.0 allows remote attackers to access arbitrary files via an absolute path in the pfad parameter to (1) index.php and (2) galerie.php.
CVE-2006-2296	EDirectoryPro EDirectoryPro		0.03	—	0.01	May 10, 2006	SQL injection vulnerability in search_result.asp in EDirectoryPro 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the keyword parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVE-2006-0027	Microsoft Exchange Server		0.09	—	0.79	May 10, 2006	Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal or (2) iCal Calendar properties.
CVE-2006-2274	Lksctp Stream Control Transmission Protocol		0.00	—	0.04	May 9, 2006	Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (infinite recursion and crash) via a packet that contains two or more DATA fragments, which causes an skb pointer to refer back to itself when the full message is reassembled, leading to…
CVE-2006-2275	Lksctp Stream Control Transmission Protocol	Hig	0.49	7.5	0.03	May 9, 2006	Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (deadlock) via a large number of small messages to a receiver application that cannot process the messages quickly enough, which leads to "spillover of the receive buffer."
CVE-2006-2042	Adobe Inc. Dreamweaver		0.00	—	0.05	May 9, 2006	Adobe Dreamweaver 8 before 8.0.2 and MX 2004 can generate code that allows SQL injection attacks in the (1) ColdFusion, (2) PHP mySQL, (3) ASP, (4) ASP.NET, and (5) JSP server models.
CVE-2006-2271	Lksctp Lksctp		0.00	—	0.04	May 9, 2006	The ECNE chunk handling in Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (kernel panic) via an unexpected chunk when the session is in CLOSED state.
CVE-2006-2272	Linux sctp		0.00	—	0.04	May 9, 2006	Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (kernel panic) via incoming IP fragmented (1) COOKIE_ECHO and (2) HEARTBEAT SCTP control chunks.
CVE-2006-0515	Cisco Systems, Inc. Cisco Adaptive Security Appliance		0.04	—	0.09	May 9, 2006	Cisco PIX/ASA 7.1.x before 7.1(2) and 7.0.x before 7.0(5), PIX 6.3.x before 6.3.5(112), and FWSM 2.3.x before 2.3(4) and 3.x before 3.1(7), when used with Websense/N2H2, allows remote attackers to bypass HTTP access restrictions by splitting the GET method of an HTTP request…
CVE-2006-1172	Tdc Cryptomathic Cenroll Activex Control		0.04	—	0.14	May 9, 2006	Stack-based buffer overflow in the createPKCS10 function in Cryptomathic Cenroll ActiveX Control 1.1.0.0 allows remote attackers to execute arbitrary code via vectors related to the TDC Digital signature.
CVE-2006-2161	TZipBuilder TZipBuilder		0.00	—	0.04	May 9, 2006	Buffer overflow in (1) TZipBuilder 1.79.03.01, (2) Abakt 0.9.2 and 0.9.3-beta1, (3) CAM UnZip 4.0 and 4.3, and possibly other products, allows user-assisted attackers to execute arbitrary code via a ZIP archive that contains a file with a long file name.
CVE-2006-2239	Newsadmin Newsadmin		0.00	—	0.01	May 9, 2006	SQL injection vulnerability in readarticle.php in Newsadmin 1.1 allows remote attackers to execute arbitrary SQL commands via the nid parameter.
CVE-2006-2240	Fujitsu Netshelter Fw		0.00	—	0.02	May 9, 2006	Unspecified vulnerability in the (1) web cache or (2) web proxy in Fujitsu NetShelter/FW allows remote attackers to cause a denial of service (device unresponsiveness) via certain DNS packets, as demonstrated by the OUSPG PROTOS DNS test suite.
CVE-2006-2241	Fast Click SQL Lite SQL Lite		0.03	—	0.04	May 9, 2006	PHP remote file inclusion vulnerability in show.php in Fast Click SQL Lite 1.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: This is a different vulnerability than CVE-2006-2175.
CVE-2006-2242	Acftp Acftp		0.03	—	0.04	May 9, 2006	acFTP 1.4 allows remote attackers to cause a denial of service (application crash) via a long string with "{" (brace) characters to the USER command.
CVE-2006-2243	—		0.00	—	0.01	May 9, 2006	Multiple cross-site scripting (XSS) vulnerabilities in Web4Future News Portal allow remote attackers to inject arbitrary web script or HTML via the ID parameter to (1) comentarii.php or (2) view.php. NOTE: this issue might be resultant from SQL injection.
CVE-2006-2244	—		0.00	—	0.01	May 9, 2006	Multiple SQL injection vulnerabilities in Web4Future News Portal allow remote attackers to execute arbitrary SQL commands via the ID parameter to (1) comentarii.php or (2) view.php.
CVE-2006-2245	PhpBB Phpbb Auction		0.04	—	0.08	May 9, 2006	PHP remote file inclusion vulnerability in auction\auction_common.php in Auction mod 1.3m for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVE-2006-2246	Ublog UBlog		0.00	—	0.01	May 9, 2006	Cross-site scripting (XSS) vulnerability in UBlog 1.6 Access Edition allows remote attackers to inject arbitrary web script or HTML via text fields when adding a blog entry.
CVE-2006-2247	Webcalendar Webcalendar		0.00	—	0.02	May 9, 2006	WebCalendar 1.0.1 to 1.0.3 generates different error messages depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames.
CVE-2006-2248	Xeneo Web Server		0.00	—	0.02	May 9, 2006	Xeneo Web Server 2.2.22.0 allows remote attackers to obtain the source code of script files via crafted requests containing dot, space, and slash characters in the file extension.
CVE-2006-2249	CuteNews CuteNews		0.03	—	0.02	May 9, 2006	Multiple cross-site scripting (XSS) vulnerabilities in search.php in CuteNews 1.4.1 and earlier, and possibly 1.4.5, allow remote attackers to inject arbitrary web script or HTML via the (1) user, (2) story, or (3) title parameters.
CVE-2006-2250	CuteNews CuteNews		0.00	—	0.01	May 9, 2006	CuteNews 1.4.1 allows remote attackers to obtain sensitive information via a direct request to (1) /inc/show.inc.php or (2) /inc/functions.inc.php, which reveal the path in an error message.
CVE-2006-2251	Invision Power Services Community Blog		0.00	—	0.01	May 9, 2006	SQL injection vulnerability in the do_mmod function in mod.php in Invision Community Blog (ICB) 1.1.2 final through 1.2 allows remote attackers with moderator privileges to execute arbitrary SQL commands via the selectedbids parameter.
CVE-2006-2252	Openfaq Openfaq		0.03	—	0.03	May 9, 2006	Cross-site scripting vulnerability in submit.php in OpenFAQ 0.4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVE-2006-2253	Statit Statit 4		0.03	—	0.04	May 9, 2006	PHP remote file inclusion vulnerability in visible_count_inc.php in Statit 4 (060207) allows remote attackers to execute arbitrary PHP code via a URL in the statitpath parameter.
CVE-2006-2254	Intervations Filecopa		0.03	—	0.04	May 9, 2006	Buffer overflow in filecpnt.exe in FileCOPA 1.01 allows remote attackers to cause a denial of service (application crash) via a username with a large number of newline characters.
CVE-2006-2255	Creative Software Community Portal		0.03	—	0.02	May 9, 2006	Multiple SQL injection vulnerabilities in Creative Community Portal 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to (a) ArticleView.php, (2) forum_id parameter to (b) DiscView.php or (c) Discussions.php, (3) event_id…
CVE-2006-2256	Eqdkp Eqdkp		0.04	—	0.07	May 9, 2006	PHP remote file inclusion vulnerability in includes/dbal.php in EQdkp 1.3.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the eqdkp_root_path parameter.
CVE-2006-2257	EasyEvent easyEvent		0.00	—	0.01	May 9, 2006	Cross-site scripting (XSS) vulnerability in index.php in easyEvent 1.2 allows remote attackers to inject arbitrary web script or HTML via the curr_year parameter.
CVE-2006-2258	MaxxSchedule MaxxSchedule		0.00	—	0.01	May 9, 2006	Cross-site scripting (XSS) vulnerability in Logon.asp in MaxxSchedule 1.0 allows remote attackers to inject arbitrary web script or HTML via the Error parameter.
CVE-2006-2259	MaxxSchedule MaxxSchedule		0.00	—	0.01	May 9, 2006	SQL injection vulnerability in Logon.asp in MaxxSchedule 1.0 allows remote attackers to execute arbitrary SQL commands via the txtLogon parameter.
CVE-2006-2260	Drupal Drupal		0.00	—	0.01	May 9, 2006	Cross-site scripting (XSS) vulnerability in the project module (project.module) in Drupal 4.5 and 4.6 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVE-2006-2261	Acal Acal		0.03	—	0.03	May 9, 2006	PHP remote file inclusion vulnerability in day.php in ACal 2.2.6 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.

CVE-2006-2279May 10, 2006
Saphplesson
Saphplesson
risk 0.00cvss —epss 0.02
Multiple SQL injection vulnerabilities in SaphpLesson 3.0 allow remote attackers to execute arbitrary SQL commands via (1) the Find parameter in (a) search.php, and the (2) LID and (3) Rate parameters in (b) misc.php.
CVE-2006-2280May 10, 2006
Openengine
Openengine
risk 0.03cvss —epss 0.04
Directory traversal vulnerability in website.php in openEngine 1.8 Beta 2 and earlier allows remote attackers to list arbitrary directories and read arbitrary files via a .. (dot dot) in the template parameter.
CVE-2006-2281May 10, 2006
X Scripts
X Poll
risk 0.00cvss —epss 0.02
X-Scripts X-Poll (xpoll) 2.30 allows remote attackers to execute arbitrary PHP code by using admin/images/add.php to upload a PHP file, then access it.
CVE-2006-2282May 10, 2006
X7 Chat
X7 Chat
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in X7 Chat 2.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the URL of an avatar, possibly related to the avatar parameter in register.php.
CVE-2006-2283May 10, 2006
Spiffyjr
Phpraid
risk 0.00cvss —epss 0.02
Multiple PHP remote file inclusion vulnerabilities in SpiffyJr phpRaid 2.9.5 through 3.0.b3 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) auth.php and (2) auth_phpbb when the phpBB portal is enabled, and via a URL in the…
CVE-2006-2284May 10, 2006
Claroline
Claroline
risk 0.04cvss —epss 0.07
Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) clarolineRepositorySys parameter in ldap.inc.php and the (2) claro_CasLibPath parameter in casProcess.inc.php.
CVE-2006-2285May 10, 2006
Dokeos
Dokeos
risk 0.03cvss —epss 0.04
PHP remote file inclusion vulnerability in authldap.php in Dokeos 1.6.4 allows remote attackers to execute arbitrary PHP code via a URL in the includePath parameter.
CVE-2006-2286May 10, 2006
Dokeos
Dokeos
risk 0.00cvss —epss 0.02
Multiple PHP remote file inclusion vulnerabilities in claro_init_global.inc.php in Dokeos 1.6.3 and earlier, and Dokeos community release 2.0.3, allow remote attackers to execute arbitrary PHP code via a URL in the (1) rootSys and (2) clarolineRepositorySys parameters, and…
CVE-2006-2287May 10, 2006
Vision Source
Vision Source CMS
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Vision Source 0.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the fields in a user's profile.
CVE-2006-2288May 10, 2006
Avahi
Avahi
risk 0.00cvss —epss 0.00
Avahi before 0.6.10 allows local users to cause a denial of service (mDNS/DNS-SD service disconnect) via unspecified mDNS name conflicts.
CVE-2006-2289May 10, 2006
Avahi
Avahi
risk 0.00cvss —epss 0.00
Buffer overflow in avahi-core in Avahi before 0.6.10 allows local users to execute arbitrary code via unknown vectors.
CVE-2006-2290May 10, 2006
Www.goel.ch
2005 Comments Script
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in kommentar.php in 2005-Comments-Script allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) email, and (3) url parameter.
CVE-2006-2291May 10, 2006
Inhouse Associates
Ia Calendar
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in calendar_new.asp in IA-Calendar allows remote attackers to inject arbitrary web script or HTML via the TypeName1 parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVE-2006-2292May 10, 2006
Inhouse Associates
Ia Calendar
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in IA-Calendar allow remote attackers to execute arbitrary SQL commands via the (1) type parameter in (a) calendar_new.asp and (b) default.asp, and (2) ID parameter in (c) calendar_detail.asp. NOTE: the provenance of this information is…
CVE-2006-2293May 10, 2006
Expinion.net
Multicalendars
risk 0.03cvss —epss 0.01
SQL injection vulnerability in all_calendars.asp in MultiCalendars 3.0 allows remote attackers to execute arbitrary SQL commands via the calsids parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVE-2006-2294May 10, 2006
Dynamic
Dynamic Galerie
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Dynamic Galerie 1.0 allows remote attackers to inject arbitrary web script or HTML via the pfad parameter in (1) index.php and (2) galerie.php. NOTE: this issue might be resultant from directory traversal.
CVE-2006-2295May 10, 2006
Dynamic
Dynamic Galerie
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in Dynamic Galerie 1.0 allows remote attackers to access arbitrary files via an absolute path in the pfad parameter to (1) index.php and (2) galerie.php.
CVE-2006-2296May 10, 2006
EDirectoryPro
EDirectoryPro
risk 0.03cvss —epss 0.01
SQL injection vulnerability in search_result.asp in EDirectoryPro 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the keyword parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVE-2006-0027May 10, 2006
Microsoft
Exchange Server
risk 0.09cvss —epss 0.79
Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal or (2) iCal Calendar properties.
CVE-2006-2274May 9, 2006
Lksctp
Stream Control Transmission Protocol
risk 0.00cvss —epss 0.04
Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (infinite recursion and crash) via a packet that contains two or more DATA fragments, which causes an skb pointer to refer back to itself when the full message is reassembled, leading to…
CVE-2006-2275HigMay 9, 2006
Lksctp
Stream Control Transmission Protocol
risk 0.49cvss 7.5epss 0.03
Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (deadlock) via a large number of small messages to a receiver application that cannot process the messages quickly enough, which leads to "spillover of the receive buffer."
CVE-2006-2042May 9, 2006
Adobe Inc.
Dreamweaver
risk 0.00cvss —epss 0.05
Adobe Dreamweaver 8 before 8.0.2 and MX 2004 can generate code that allows SQL injection attacks in the (1) ColdFusion, (2) PHP mySQL, (3) ASP, (4) ASP.NET, and (5) JSP server models.
CVE-2006-2271May 9, 2006
Lksctp
Lksctp
risk 0.00cvss —epss 0.04
The ECNE chunk handling in Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (kernel panic) via an unexpected chunk when the session is in CLOSED state.
CVE-2006-2272May 9, 2006
Linux
sctp
risk 0.00cvss —epss 0.04
Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (kernel panic) via incoming IP fragmented (1) COOKIE_ECHO and (2) HEARTBEAT SCTP control chunks.
CVE-2006-0515May 9, 2006
Cisco Systems, Inc.
Cisco Adaptive Security Appliance
risk 0.04cvss —epss 0.09
Cisco PIX/ASA 7.1.x before 7.1(2) and 7.0.x before 7.0(5), PIX 6.3.x before 6.3.5(112), and FWSM 2.3.x before 2.3(4) and 3.x before 3.1(7), when used with Websense/N2H2, allows remote attackers to bypass HTTP access restrictions by splitting the GET method of an HTTP request…
CVE-2006-1172May 9, 2006
Tdc
Cryptomathic Cenroll Activex Control
risk 0.04cvss —epss 0.14
Stack-based buffer overflow in the createPKCS10 function in Cryptomathic Cenroll ActiveX Control 1.1.0.0 allows remote attackers to execute arbitrary code via vectors related to the TDC Digital signature.
CVE-2006-2161May 9, 2006
TZipBuilder
TZipBuilder
risk 0.00cvss —epss 0.04
Buffer overflow in (1) TZipBuilder 1.79.03.01, (2) Abakt 0.9.2 and 0.9.3-beta1, (3) CAM UnZip 4.0 and 4.3, and possibly other products, allows user-assisted attackers to execute arbitrary code via a ZIP archive that contains a file with a long file name.
CVE-2006-2239May 9, 2006
Newsadmin
Newsadmin
risk 0.00cvss —epss 0.01
SQL injection vulnerability in readarticle.php in Newsadmin 1.1 allows remote attackers to execute arbitrary SQL commands via the nid parameter.
CVE-2006-2240May 9, 2006
Fujitsu
Netshelter Fw
risk 0.00cvss —epss 0.02
Unspecified vulnerability in the (1) web cache or (2) web proxy in Fujitsu NetShelter/FW allows remote attackers to cause a denial of service (device unresponsiveness) via certain DNS packets, as demonstrated by the OUSPG PROTOS DNS test suite.
CVE-2006-2241May 9, 2006
Fast Click SQL Lite
SQL Lite
risk 0.03cvss —epss 0.04
PHP remote file inclusion vulnerability in show.php in Fast Click SQL Lite 1.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: This is a different vulnerability than CVE-2006-2175.
CVE-2006-2242May 9, 2006
Acftp
Acftp
risk 0.03cvss —epss 0.04
acFTP 1.4 allows remote attackers to cause a denial of service (application crash) via a long string with "{" (brace) characters to the USER command.
CVE-2006-2243May 9, 2006
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Web4Future News Portal allow remote attackers to inject arbitrary web script or HTML via the ID parameter to (1) comentarii.php or (2) view.php. NOTE: this issue might be resultant from SQL injection.
CVE-2006-2244May 9, 2006
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in Web4Future News Portal allow remote attackers to execute arbitrary SQL commands via the ID parameter to (1) comentarii.php or (2) view.php.
CVE-2006-2245May 9, 2006
PhpBB
Phpbb Auction
risk 0.04cvss —epss 0.08
PHP remote file inclusion vulnerability in auction\auction_common.php in Auction mod 1.3m for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVE-2006-2246May 9, 2006
Ublog
UBlog
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in UBlog 1.6 Access Edition allows remote attackers to inject arbitrary web script or HTML via text fields when adding a blog entry.
CVE-2006-2247May 9, 2006
Webcalendar
Webcalendar
risk 0.00cvss —epss 0.02
WebCalendar 1.0.1 to 1.0.3 generates different error messages depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames.
CVE-2006-2248May 9, 2006
Xeneo
Web Server
risk 0.00cvss —epss 0.02
Xeneo Web Server 2.2.22.0 allows remote attackers to obtain the source code of script files via crafted requests containing dot, space, and slash characters in the file extension.
CVE-2006-2249May 9, 2006
CuteNews
CuteNews
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in search.php in CuteNews 1.4.1 and earlier, and possibly 1.4.5, allow remote attackers to inject arbitrary web script or HTML via the (1) user, (2) story, or (3) title parameters.
CVE-2006-2250May 9, 2006
CuteNews
CuteNews
risk 0.00cvss —epss 0.01
CuteNews 1.4.1 allows remote attackers to obtain sensitive information via a direct request to (1) /inc/show.inc.php or (2) /inc/functions.inc.php, which reveal the path in an error message.
CVE-2006-2251May 9, 2006
Invision Power Services
Community Blog
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the do_mmod function in mod.php in Invision Community Blog (ICB) 1.1.2 final through 1.2 allows remote attackers with moderator privileges to execute arbitrary SQL commands via the selectedbids parameter.
CVE-2006-2252May 9, 2006
Openfaq
Openfaq
risk 0.03cvss —epss 0.03
Cross-site scripting vulnerability in submit.php in OpenFAQ 0.4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVE-2006-2253May 9, 2006
Statit
Statit 4
risk 0.03cvss —epss 0.04
PHP remote file inclusion vulnerability in visible_count_inc.php in Statit 4 (060207) allows remote attackers to execute arbitrary PHP code via a URL in the statitpath parameter.
CVE-2006-2254May 9, 2006
Intervations
Filecopa
risk 0.03cvss —epss 0.04
Buffer overflow in filecpnt.exe in FileCOPA 1.01 allows remote attackers to cause a denial of service (application crash) via a username with a large number of newline characters.
CVE-2006-2255May 9, 2006
Creative Software
Community Portal
risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in Creative Community Portal 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to (a) ArticleView.php, (2) forum_id parameter to (b) DiscView.php or (c) Discussions.php, (3) event_id…
CVE-2006-2256May 9, 2006
Eqdkp
Eqdkp
risk 0.04cvss —epss 0.07
PHP remote file inclusion vulnerability in includes/dbal.php in EQdkp 1.3.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the eqdkp_root_path parameter.
CVE-2006-2257May 9, 2006
EasyEvent
easyEvent
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in index.php in easyEvent 1.2 allows remote attackers to inject arbitrary web script or HTML via the curr_year parameter.
CVE-2006-2258May 9, 2006
MaxxSchedule
MaxxSchedule
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Logon.asp in MaxxSchedule 1.0 allows remote attackers to inject arbitrary web script or HTML via the Error parameter.
CVE-2006-2259May 9, 2006
MaxxSchedule
MaxxSchedule
risk 0.00cvss —epss 0.01
SQL injection vulnerability in Logon.asp in MaxxSchedule 1.0 allows remote attackers to execute arbitrary SQL commands via the txtLogon parameter.
CVE-2006-2260May 9, 2006
Drupal
Drupal
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the project module (project.module) in Drupal 4.5 and 4.6 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVE-2006-2261May 9, 2006
Acal
Acal
risk 0.03cvss —epss 0.03
PHP remote file inclusion vulnerability in day.php in ACal 2.2.6 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.