VYPR

CVEs

343,710 total · page 6528 of 6,875

AllCriticalHighKEV
  • CVE-2006-2167May 4, 2006
    Sloughflash
    Sf Users
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in SloughFlash SF-Users 1.0, possibly in register.php, allows remote attackers to inject arbitrary web script or HTML by setting the username field to contain JavaScript in the SRC attribute of an IMG element.

  • CVE-2006-2168May 4, 2006
    Fileprotection Express
    Fileprotection Express
    risk 0.00cvss —epss 0.02

    FileProtection Express 1.0.1 and earlier allows remote attackers to bypass authentication via a cookie with an Admin value of 1.

  • CVE-2006-2169May 4, 2006
    Bestpractical
    Request Tracker
    risk 0.00cvss —epss 0.01

    RT: Request Tracker 3.5.HEAD allows remote attackers to obtain sensitive information via the Rows parameter in Dist/Display.html, which reveals the installation path in an error message.

  • CVE-2006-2170May 4, 2006
    Argosoft
    FTP Server
    risk 0.00cvss —epss 0.05

    Buffer overflow in ArgoSoft FTP Server 1.4.3.6 allows remote attackers to execute arbitrary code via Unicode in the RNTO command, as demonstrated by the Infigo FTPStress Fuzzer.

  • CVE-2006-2171May 4, 2006
    WarFTPd
    WarFTPd
    risk 0.00cvss —epss 0.05

    Buffer overflow in WDM.exe in WarFTPD allows remote attackers to execute arbitrary code via unspecified arguments, as demonstrated by the Infigo FTPStress Fuzzer.

  • CVE-2006-2172May 4, 2006
    Gene6
    G6 FTP Server
    risk 0.00cvss —epss 0.04

    Buffer overflow in Gene6 FTP Server 3.1.0 allows remote authenticated attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long argument to (1) MKD or (2) XMKD, as demonstrated by the Infigo FTPStress Fuzzer.

  • CVE-2006-2173May 4, 2006
    Filezilla
    Filezilla Server
    risk 0.01cvss —epss 0.07

    Buffer overflow in FileZilla FTP Server 2.2.22 allows remote authenticated attackers to cause a denial of service and possibly execute arbitrary code via a long (1) PORT or (2) PASS followed by the MLSD command, or (2) the remote server interface, as demonstrated by the Infigo…

  • CVE-2006-2174May 4, 2006
    Virtual Hosting Control System
    Virtual Hosting Control System
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in admin/server_day_stats.php in Virtual Hosting Control System (VHCS) allow remote attackers to inject arbitrary web script or HTML via the (1) day, (2) month, or (3) year parameter.

  • CVE-2006-2175May 4, 2006
    Ftrainsoft
    Fast Click
    risk 0.04cvss —epss 0.09

    PHP remote file inclusion vulnerability in FtrainSoft Fast Click 2.3.8 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) show.php or (2) top.php.

  • CVE-2006-2176May 4, 2006
    Linkliste
    Linkliste
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in links.php in PHP Linkliste 1.0b allow remote attackers to inject arbitrary web script or HTML via the (1) new_input, (2) new_url, or (3) new_name parameter.

  • CVE-2006-2177May 4, 2006
    Bitdamaged
    Geoblog
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in viewcat.php in geoBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.

  • CVE-2006-2178May 4, 2006
    CyberBuild
    CyberBuild
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in CyberBuild allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to login.asp, (2) ProductIndex parameter to browse0.htm, (3) rowcolor parameter to result.asp, or (4) heading parameter…

  • CVE-2006-2179May 4, 2006
    CyberBuild
    CyberBuild
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in CyberBuild allow remote attackers to execute arbitrary SQL commands via the (1) SessionID parameter to login.asp or (2) ProductIndex parameter to browse0.htm.

  • CVE-2006-2180May 4, 2006
    Golden FTP Server Pro
    Golden FTP Server Pro
    risk 0.04cvss —epss 0.07

    Buffer overflow in Golden FTP Server Pro 2.70 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long argument to the (1) NLST or (2) APPE commands, as demonstrated by the Infigo FTPStress Fuzzer.

  • CVE-2006-2181May 4, 2006
    Albinator
    Albinator
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in Albinator 2.0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) cid parameter to dlisting.php or (2) preloadSlideShow parameter to showpic.php.

  • CVE-2006-2182May 4, 2006
    Albinator
    Albinator
    risk 0.04cvss —epss 0.08

    Multiple PHP remote file inclusion vulnerabilities in (1) eday.php, (2) eshow.php, or (3) forgot.php in albinator 2.0.8 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the Config_rootdir parameter.

  • CVE-2006-2183May 4, 2006
    Truecrypt Foundation
    Truecrypt
    risk 0.00cvss —epss 0.01

    Untrusted search path vulnerability in Truecrypt 4.1, when running suid root on Linux, allows local users to execute arbitrary commands and gain privileges via a modified PATH environment variable that references a malicious mount command.

  • CVE-2006-2184May 4, 2006
    Chadha
    Phpkb Knowledge Base
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in PHPKB Knowledge Base allows remote attackers to inject arbitrary web script or HTML via the searchkeyword parameter. NOTE: the issue was originally disputed by the vendor, but on 20060519, the vendor notified CVE that…

  • CVE-2006-2186May 4, 2006
    Zenphoto
    Zenphoto
    risk 0.00cvss —epss 0.02

    zenphoto 1.0.1 beta and earlier allow remote attackers to obtain sensitive information via a direct request for the (1) /photos/themes/default/ and (2) /photos/themes/testing/ URIs, which reveals the path in an error message.

  • CVE-2006-2187May 4, 2006
    Zenphoto
    Zenphoto
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in zenphoto 1.0.1 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) a parameter in i.php, and the (2) album and (3) image parameters in index.php.

  • CVE-2006-2188May 4, 2006
    Cmscout
    Cmscout
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in CMScout 1.10 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the Body field of a private message (PM), (2) BBCode, or (3) a forum post.

  • CVE-2006-2189May 4, 2006
    Servous
    Sblog
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in search.php in Servous sBLOG 0.7.2 allows remote attackers to execute arbitrary SQL commands via the keyword parameter. NOTE: this issue can be used to trigger path disclosure. In addition, it might be primary to vector 1 in CVE-2006-1135.

  • CVE-2006-2190May 4, 2006
    Open Webmail
    Openwebmail
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ow-shared.pl in OpenWebMail (OWM) 2.51 and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionid parameter in (1) openwebmail-send.pl, (2) openwebmail-advsearch.pl, (3) openwebmail-folder.pl, (4)…

  • CVE-2006-1527May 3, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    The SCTP-netfilter code in Linux kernel before 2.6.16.13 allows remote attackers to trigger a denial of service (infinite loop) via unknown vectors that cause an invalid SCTP chunk size to be processed by the for_each_sctp_chunk function.

  • CVE-2006-2162May 3, 2006
    Nagios
    Nagios
    risk 0.00cvss —epss 0.05

    Buffer overflow in CGI scripts in Nagios 1.x before 1.4 and 2.x before 2.3 allows remote attackers to execute arbitrary code via a negative content length (Content-Length) HTTP header.

  • CVE-2006-2149May 3, 2006
    Aardvark
    Aardvark Topsites PHP
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in sources/lostpw.php in Aardvark Topsites PHP 4.2.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the CONFIG[path] parameter, as demonstrated by including a GIF that contains PHP…

  • CVE-2006-2150May 3, 2006
    PhpBB
    Toplist
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in top/list.php in phpBB TopList 1.3.8 and earlier allows remote attackers to include arbitrary files via the returnpath parameter.

  • CVE-2006-2151May 3, 2006
    PhpBB
    Toplist
    risk 0.04cvss —epss 0.11

    PHP remote file inclusion vulnerability in toplist.php in phpBB TopList 1.3.8 and earlier, when register_globals is enabled, allows remote attackers to include arbitrary files via the phpbb_root_path parameter.

  • CVE-2006-2152May 3, 2006
    PhpBB
    Phpbb Advanced Guestbook
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in admin/addentry.php in phpBB Advanced Guestbook 2.4.0 and earlier, when register_globals is enabled, allows remote attackers to include arbitrary files via the phpbb_root_path parameter.

  • CVE-2006-2153May 3, 2006
    Directadmin
    Directadmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in HTM_PASSWD in DirectAdmin Hosting Management allows remote attackers to inject arbitrary web script or HTML via the domain parameter.

  • CVE-2006-2154May 3, 2006
    EMC Corporation
    Retrospect
    risk 0.00cvss —epss 0.00

    EMC Retrospect for Windows 6.5 before 6.5.382, 7.0 before 7.0.344, and 7.5 before 7.5.1.105 does not drop privileges before opening files, which allows local users to execute arbitrary code via the File>Open dialog.

  • CVE-2006-2155May 3, 2006
    EMC Corporation
    Retrospect
    risk 0.00cvss —epss 0.00

    EMC Retrospect for Windows 6.5 before 6.5.382, 7.0 before 7.0.344, and 7.5 before 7.5.1.105 allows local users to execute arbitrary code by replacing the Retrospect.exe file, possibly due to improper file permissions.

  • CVE-2006-2156May 3, 2006
    X7 Chat
    X7 Chat
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in help/index.php in X7 Chat 2.0 and earlier allows remote attackers to include arbitrary files via .. (dot dot) sequences in the help_file parameter.

  • CVE-2006-2157May 3, 2006
    Plogger
    Plogger
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in gallery.php in Plogger Beta 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter, when the level is set to "slideshow". NOTE: This is a different vulnerability than CVE-2005-4246.

  • CVE-2006-2158May 3, 2006
    Stadtaus
    Guestbook Script
    risk 0.00cvss —epss 0.02

    Dynamic variable evaluation vulnerability in index.php in Stadtaus Guestbook Script 1.7 and earlier, when register_globals is enabled, allows remote attackers to modify arbitrary program variables via parameters, which are evaluated as PHP variable variables, as demonstrated by…

  • CVE-2006-2159May 3, 2006
    Russcom Network
    Loginphp
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in help.php in Russcom Network Loginphp allows remote attackers to spoof e-mails and inject MIME headers via CRLF sequences in the email address.

  • CVE-2006-2160May 3, 2006
    Russcom Network
    Loginphp
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Russcom Network Loginphp (Russcom.Loginphp) allows remote attackers to inject arbitrary web script or HTML via the username field when registering.

  • CVE-2006-1526May 2, 2006
    Xorg
    X11r6
    risk 0.00cvss —epss 0.01

    Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which…

  • CVE-2006-2148May 2, 2006
    Cgiirc
    Cgiirc
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in client.c in CGI:IRC (CGIIRC) before 0.5.8 might allow remote attackers to execute arbitrary code via (1) cookies or (2) the query string.

  • CVE-2006-2147May 2, 2006
    Resmgr
    Resmgrd
    risk 0.00cvss —epss 0.00

    resmgrd in resmgr for SUSE Linux and other distributions does not properly handle when access to a USB device is granted by using "usb:," notation, which grants access to all USB devices and allows local users to bypass intended restrictions. NOTE: this is a different…

  • CVE-2006-2109May 2, 2006
    Jsboard
    Jsboard
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the parse_query_str function in include/print.php in JSBoard 2.0.10 and 2.0.11, and possibly other versions before 2.0.12, allows remote attackers to inject arbitrary web script or HTML via parameters that are set as global variables…

  • CVE-2006-2134May 2, 2006
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.10

    PHP remote file inclusion vulnerability in /includes/kb_constants.php in Knowledge Base Mod for PHPbb 2.0.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.

  • CVE-2006-2135May 2, 2006
    Ruperts News
    Ruperts News
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in login.php in Ruperts News allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2006-2136May 2, 2006
    Aznews
    Aznews
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in news.php in AZNEWS allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2006-2137May 2, 2006
    Openphpnuke
    Openphpnuke
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in master.php in OpenPHPNuke and 2.3.3 earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.

  • CVE-2006-2138May 2, 2006
    Neomail
    Neomail
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in neomail.pl in NeoMail 1.29 allows remote attackers to inject arbitrary web script or HTML via the sessionid parameter.

  • CVE-2006-2139May 2, 2006
    Wilsonncareabusinesses
    PHP Newsfeed
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in PHP Newsfeed 20040723 allow remote attackers to execute arbitrary SQL commands via the (1) name parameter to (a) deltables.php, (2) select, (3) header, (4) url, (5) source, or (6) time parameters to (b) manualsubmit.php, (7) num…

  • CVE-2006-2140May 2, 2006
    Orbitscripts
    Orbithyip
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in OrbitHYIP 2.0 and earlier allow remote attackers to inject arbitrary web script via the (1) referral parameter to signup.php or (2) id parameter to members.php.

  • CVE-2006-2141May 2, 2006
    Collaborative Portal Server Project
    Collaborative Portal Server
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in popup_image in Collaborative Portal Server (CPS) 3.4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the pos argument.

  • CVE-2006-2142May 2, 2006
    Limbo CMS
    Limbo CMS
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in classes/adodbt/sql.php in Limbo CMS 1.04 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the classes_dir parameter.