VYPR

CVEs

343,710 total · page 6527 of 6,875

AllCriticalHighKEV
  • CVE-2006-2262May 9, 2006
    Singapore
    Singapore
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in singapore 0.9.7 allows remote attackers to inject arbitrary web script or HTML via the image parameter.

  • CVE-2006-2263May 9, 2006
    Virtual Programming
    Vp Asp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in shopcurrency.asp in VP-ASP 6.00 allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2006-2264May 9, 2006
    Ocean12
    Calendar manager
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Ocean12 Calendar Manager Pro 1.00 allow remote attackers to execute arbitrary SQL commands via the (1) date parameter to admin/main.asp, (2) SearchFor parameter to admin/view.asp, or (3) ID parameter to admin/edit.asp. NOTE: the…

  • CVE-2006-2265May 9, 2006
    Ocean12
    Calendar manager
    risk 0.03cvss —epss 0.02

    Cross-site scripting vulnerability in admin/main.asp in Ocean12 Calendar Manager Pro 1.00 allows remote attackers to inject arbitrary web script or HTML via the date parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-2266May 9, 2006
    Chirpy
    Chirpy
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Chirpy! 0.1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters.

  • CVE-2006-2267May 9, 2006
    Kerio Technologies
    Winroute Firewall
    risk 0.00cvss —epss 0.03

    Kerio WinRoute Firewall before 6.2.1 allows remote attackers to cause a denial of service (application crash) via unknown vectors in the "email protocol inspectors," possibly (1) SMTP and (2) POP3.

  • CVE-2006-2268May 9, 2006
    Flexcustomer
    Flexcustomer
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in FlexCustomer 0.0.4 and earlier allows remote attackers to bypass authentication and execute arbitrary SQL commands via the admin and ordinary user interface, probably involving the (1) checkuser and (2) checkpass parameters to (a) admin/index.php,…

  • CVE-2006-2269May 9, 2006
    Mywebland
    Mybloggie
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in myWebland MyBloggie 2.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a BBCode img tag.

  • CVE-2006-2270May 9, 2006
    Jetbox
    Jetbox CMS
    risk 0.04cvss —epss 0.14

    PHP remote file inclusion vulnerability in includes/config.php in Jetbox CMS 2.1 allows remote attackers to execute arbitrary code via a URL in the relative_script_path parameter.

  • CVE-2006-2236May 8, 2006
    ID Software
    Quake 3 Engine
    risk 0.04cvss —epss 0.08

    Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III Arena 1.32b allows remote attackers to execute arbitrary commands via a long remapShader command.

  • CVE-2006-2237May 8, 2006
    AWStats
    Awstats
    risk 0.01cvss —epss 0.58

    The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.

  • CVE-2006-2221May 5, 2006
    Process One
    Ejabberd
    risk 0.00cvss —epss 0.00

    A third-party installer generation tool, possibly BitRock InstallBuilder, as used in products including Process-one ejabberd 1.1.1_1 and earlier, generates an installer that allows local users to cause a denial of service via a symlink attack on the bitrock_installer.log…

  • CVE-2006-2222May 5, 2006
    Zawhttpd
    zawhttpd
    risk 0.03cvss —epss 0.04

    Buffer overflow in zawhttpd 0.8.23, and possibly previous versions, allows remote attackers to cause a denial of service (daemon crash) via a request for a URI composed of several "\" (backslash) characters.

  • CVE-2006-2223May 5, 2006
    Quagga (software)
    Quagga
    risk 0.04cvss —epss 0.11

    RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly implement configurations that (1) disable RIPv1 or (2) require plaintext or MD5 authentication, which allows remote attackers to obtain sensitive information (routing state) via REQUEST packets such as SEND UPDATE.

  • CVE-2006-2224May 5, 2006
    Quagga (software)
    Quagga
    risk 0.04cvss —epss 0.10

    RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly enforce RIPv2 authentication requirements, which allows remote attackers to modify routing state via RIPv1 RESPONSE packets.

  • CVE-2006-2225May 5, 2006
    XM
    Easy Personal FTP Server
    risk 0.03cvss —epss 0.06

    Buffer overflow in XM Easy Personal FTP Server 4.3 and earlier allows remote attackers to execute arbitrary code, probably via a USER command with a long username.

  • CVE-2006-2226May 5, 2006
    XM
    Easy Personal FTP Server
    risk 0.03cvss —epss 0.04

    Buffer overflow in XM Easy Personal FTP Server 4.2 and 5.0.1 allows remote authenticated users to cause a denial of service via a long argument to the PORT command.

  • CVE-2006-2227May 5, 2006
    Punbb
    Punbb
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in misc.php in PunBB 1.2.11 allows remote attackers to inject arbitrary web script or HTML via the req_message parameter, because the value of the redirect_url parameter is not sanitized.

  • CVE-2006-2228May 5, 2006
    W Agora
    W Agora
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in w-Agora (aka Web-Agora) 4.2.0 allows remote attackers to inject arbitrary web script or HTML via a post with a BBCode tag that contains a JavaScript event name followed by whitespace before the '=' (equals) character, which bypasses a…

  • CVE-2006-2229May 5, 2006
    OpenVPN
    OpenVPN
    risk 0.00cvss —epss 0.01

    OpenVPN 2.0.7 and earlier, when configured to use the --management option with an IP that is not 127.0.0.1, uses a cleartext password for TCP sessions to the management interface, which might allow remote attackers to view sensitive information or cause a denial of service.

  • CVE-2006-2230May 5, 2006
    Xine
    Xine Lib
    risk 0.04cvss —epss 0.07

    Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.4 might allow attackers to cause a denial of service via format string specifiers in an MP3 filename specified on the command line. NOTE: this is a different vulnerability than CVE-2006-1905. In addition,…

  • CVE-2006-2231May 5, 2006
    Big Webmaster
    Guestbook Script
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in addguest.cgi in Big Webmaster Guestbook Script 1.02 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) mail, (2) site, (3) city, (4) state, (5) country, and possibly (6) name fields, which…

  • CVE-2006-2232May 5, 2006
    Scriptsez
    Cute Guestbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Scriptsez Cute Guestbook 20060211 allows remote attackers to inject arbitrary web script or HTML via the Comments field when signing the guestbook.

  • CVE-2006-2233May 5, 2006
    Banktown
    BankTown Client Control
    risk 0.04cvss —epss 0.07

    Buffer overflow in BankTown Client Control (aka BtCxCtl20Com) 1.4.2.51817, and possibly 1.5.2.50209, allows remote attackers to execute arbitrary code via a long string in the first argument to SetBannerUrl. NOTE: portions of these details are obtained from third party…

  • CVE-2006-2234May 5, 2006
    Tyrocms
    Tyrocms
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in TyroCMS beta 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) a javascript URI in an img BBCode tag, or a JavaScript event in a (2) url BBCode tag or (3) color BBCode tag.

  • CVE-2006-2235May 5, 2006
    Codemunkyx
    Simple Poll
    risk 0.00cvss —epss 0.03

    CodeMunkyX (aka free-php.net) Simple Poll 1.0, when authentication is not required for the admin directory, allows remote attackers to gain administrative privileges by appending /admin/ to the top-level URI of the application.

  • CVE-2006-1052May 5, 2006
    Linux
    SELinux
    risk 0.00cvss —epss 0.00

    The selinux_ptrace logic in hooks.c in SELinux for Linux 2.6.6 allows local users with ptrace permissions to change the tracer SID to an SID of another process.

  • CVE-2006-1516May 5, 2006
    MySQL
    MySQL
    risk 0.06cvss —epss 0.34

    The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to read portions of memory via a username without a trailing null byte, which causes a buffer over-read.

  • CVE-2006-1517May 5, 2006
    MySQL
    MySQL
    risk 0.00cvss —epss 0.05

    sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to obtain sensitive information via a COM_TABLE_DUMP request with an incorrect packet length, which includes portions of memory in an error message.

  • CVE-2006-1518May 5, 2006
    MySQL
    MySQL
    risk 0.06cvss —epss 0.36

    Buffer overflow in the open_table function in sql_base.cc in MySQL 5.0.x up to 5.0.20 might allow remote attackers to execute arbitrary code via crafted COM_TABLE_DUMP packets with invalid length values.

  • CVE-2006-2203May 5, 2006
    Kerio Technologies
    Kerio Mailserver
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Kerio MailServer before 6.1.4 has unknown impact and remote attack vectors related to a "possible bypass of attachment filter."

  • CVE-2006-2204May 5, 2006
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the topic deletion functionality (post_delete function in func_mod.php) for Invision Power Board 2.1.5 allows remote authenticated moderators to execute arbitrary SQL commands via the selectedpids parameter, which bypasses an integer value check…

  • CVE-2006-2205May 5, 2006
    NetBSD
    NetBSD
    risk 0.00cvss —epss 0.00

    The audio_write function in NetBSD 3.0 allows local users to cause a denial of service (kernel crash) by using the audiosetinfo ioctl to change the sample rate of an audio device.

  • CVE-2006-2206May 5, 2006
    Ultravnc
    Ultravnc
    risk 0.00cvss —epss 0.02

    The MS-Logon authentication scheme in UltraVNC (aka Ultr@VNC) 1.0.1 uses weak encryption (XOR) for challenge/response, which allows remote attackers to gain privileges by sniffing and decrypting passwords.

  • CVE-2006-2208May 5, 2006
    Planetluc
    Mynews
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in mynews.inc.php in MyNews 1.6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) hash and (2) page parameters.

  • CVE-2006-2209May 5, 2006
    PHP Arena
    Pacheckbook
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in PHP Arena paCheckBook 1.1 allow remote attackers to execute arbitrary SQL commands via (1) the transtype parameter in an add action or (2) entry parameter in an edit action. NOTE: the provenance of this information is…

  • CVE-2006-2210May 5, 2006
    321soft
    PHP Gallery
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in 321soft PhP-Gallery 0.9 allows remote attackers to inject arbitrary web script or HTML via the path parameter. NOTE: this issue might be resultant from the directory traversal vulnerability.

  • CVE-2006-2211May 5, 2006
    321soft
    PHP Gallery
    risk 0.03cvss —epss 0.03

    Absolute path traversal vulnerability in index.php in 321soft PhP-Gallery 0.9 allows remote attackers to browse arbitrary directories via the path parameter.

  • CVE-2006-2212May 5, 2006
    Karjasoft
    Sami FTP Server
    risk 0.08cvss —epss 0.58

    Buffer overflow in KarjaSoft Sami FTP Server 2.0.2 and earlier allows remote attackers to execute arbitrary code via a long (1) USER or (2) PASS command.

  • CVE-2006-2213May 5, 2006
    W1.fi
    Hostapd
    risk 0.00cvss —epss 0.02

    Hostapd 0.3.7-2 allows remote attackers to cause a denial of service (segmentation fault) via an unspecified value in the key_data_length field of an EAPoL frame.

  • CVE-2006-2214May 5, 2006
    4images
    4images
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in 4images 1.7.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sessionid parameter in (1) top.php and (2) member.php. NOTE: this issue has also been reported to affect 1.7.2.

  • CVE-2006-2216May 5, 2006
    Devsyn
    Open Bulletin Board
    risk 0.00cvss —epss 0.01

    Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to obtain the full path of the web server via an invalid pforums parameter to (1) misc.php and (2) member.php.

  • CVE-2006-2217May 5, 2006
    Invision Power Services
    Power Board
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Invision Power Board allows remote attackers to execute arbitrary SQL commands via the pid parameter in a reputation action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-2218May 5, 2006
    Microsoft
    Internet Explorer
    risk 0.03cvss —epss 0.33

    Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "exceptional conditions" that trigger memory corruption, as demonstrated using an exception handler and nested object tags, a variant of…

  • CVE-2006-2202May 4, 2006
    Invision Power Services
    Gallery
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in post.php in Invision Gallery 2.0.6 allows remote attackers to execute arbitrary SQL commands via the album parameter.

  • CVE-2006-2201May 4, 2006
    Ca
    Resource Initialization Manager
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in CA Resource Initialization Manager (CAIRIM) 1.x before 20060502, as used in z/OS Common Services and the LMP component in multiple products, allows attackers to violate integrity via a certain "problem state program" that uses SVC to gain access to…

  • CVE-2006-2163May 4, 2006
    Desert Dog Software
    Pinnacle Cart
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Pinnacle Cart 3.33 and earlier allows remote attackers to inject arbitrary web script or HTML via the setbackurl parameter.

  • CVE-2006-2164May 4, 2006
    Pentasoft Corp.
    Shopping Cart
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Avactis Shopping Cart 0.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) category_id parameter in (a) store_special_offers.php and (b) store.php, and (2) prod_id parameter in (c) cart.php and (d)…

  • CVE-2006-2165May 4, 2006
    Pentasoft Corp.
    Shopping Cart
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Avactis Shopping Cart 0.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) category_id parameter in (a) store_special_offers.php and (b) store.php and (2) prod_id parameter in (c)…

  • CVE-2006-2166May 4, 2006
    Cisco Systems, Inc.
    Unity Express
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the HTTP management interface in Cisco Unity Express (CUE) 2.2(2) and earlier, when running on any CUE Advanced Integration Module (AIM) or Network Module (NM), allows remote authenticated attackers to reset the password for any user with an expired…