VYPR

CVEs

343,710 total · page 6529 of 6,875

AllCriticalHighKEV
  • CVE-2006-2143May 2, 2006
    textfileBB
    textfileBB
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in TextFileBB 1.0.16 allow remote attackers to inject arbitrary web script or HTML via Javascript events such as "onmouseover" in the (1) color, (2) size, or (3) url bbcode tags.

  • CVE-2006-2144May 2, 2006
    Dmcounter
    Dmcounter
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in kopf.php in DMCounter 0.9.2-b allows remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter.

  • CVE-2006-2145May 2, 2006
    Harold Bakker
    Hb Ns
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in HB-NS 1.1.6 allow remote attackers to execute arbitrary SQL commands via the (1) topic or (2) id parameter.

  • CVE-2006-2146May 2, 2006
    Harold Bakker
    Hb Ns
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in HB-NS 1.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) poster_name, (2) poster_email, (3) poster_homepage, or (4) message parameter.

  • CVE-2006-2127May 1, 2006
    Blog Mod
    Blog Mod
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in weblog_posting.php in Blog Mod 0.2.x allows remote attackers to execute arbitrary SQL commands via the r parameter.

  • CVE-2006-2128May 1, 2006
    Deltascripts
    Pro Publish
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Pro Publish 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameter to (a) admin/login.php, (3) find_str parameter to (b) search.php, or (4) artid parameter to (c) art.php, or (5) catid…

  • CVE-2006-2129May 1, 2006
    Deltascripts
    Pro Publish
    risk 0.00cvss —epss 0.01

    Direct static code injection vulnerability in Pro Publish 2.0 allows remote authenticated administrators to execute arbitrary PHP code by editing certain settings, which are stored in set_inc.php.

  • CVE-2006-2130May 1, 2006
    Advanced Poll
    Advanced Poll
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in include/class_poll.php in Advanced Poll 2.0.4 allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.

  • CVE-2006-2131May 1, 2006
    Advanced Poll
    Advanced Poll
    risk 0.00cvss —epss 0.02

    include/class_poll.php in Advanced Poll 2.0.4 uses the HTTP_X_FORWARDED_FOR (X-Forwarded-For HTTP header) to identify the IP address of a client, which makes it easier for remote attackers to spoof the source IP and bypass voting restrictions.

  • CVE-2006-2132May 1, 2006
    DUclassified
    DUclassified
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in detail.asp in DUclassified allows remote attackers to execute arbitrary SQL commands via the iPro parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-2133May 1, 2006
    Boonex
    Barracuda
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in BoonEx Barracuda 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) link_dir_target and (2) link_id_target parameter, possibly involving the link_edit functionality.

  • CVE-2006-2120May 1, 2006
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.01

    The TIFFToRGB function in libtiff before 3.8.1 allows remote attackers to cause a denial of service (crash) via a crafted TIFF image with Yr/Yg/Yb values that exceed the YCR/YCG/YCB values, which triggers an out-of-bounds read.

  • CVE-2006-2121May 1, 2006
    I Rater
    Platinum
    risk 0.03cvss —epss 0.04

    PHP remote file include vulnerability in admin/config_settings.tpl.php in I-RATER Platinum allows remote attackers to execute arbitrary code via a URL in the include_path parameter. NOTE: this is a different vector, and possibly a different vulnerability, than CVE-2006-1929.

  • CVE-2006-2122May 1, 2006
    Coolmenus
    Coolmenus
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in index.php in CoolMenus allows remote attackers to execute arbitrary code via a URL in the page parameter. NOTE: the original report for this issue is probably erroneous, since CoolMenus does not appear to be written in PHP.

  • CVE-2006-2123May 1, 2006
    Nav
    Network Administration Visualized
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the report interface in Network Administration Visualized (NAV) before 3.0.1 allow remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2006-2124May 1, 2006
    SunShop
    SunShop
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in SunShop 3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) prevaction, (2) previd, (3) prevstart, (4) itemid, (5) id, and (6) action parameters in index.php.

  • CVE-2006-2126May 1, 2006
    Maxtrade
    MaxTrade
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pocategories.php in MaxTrade 1.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) categori and (2) stranica parameters.

  • CVE-2006-2116May 1, 2006
    Planet Concept
    Planetgallery
    risk 0.03cvss —epss 0.03

    planetGallery allows remote attackers to gain administrator privileges via a direct request to admin/gallery_admin.php.

  • CVE-2006-2117May 1, 2006
    Thyme
    Thyme
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Thyme 1.3 allows remote attackers to inject arbitrary web script or HTML via the search page.

  • CVE-2006-2118May 1, 2006
    JMK
    Picture Gallery
    risk 0.00cvss —epss 0.02

    JMK's Picture Gallery allows remote attackers to bypass authentication via a direct request to admin_gallery.php3, possibly related to the add action.

  • CVE-2006-2119May 1, 2006
    Artmedic Webdesign
    Event
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in event/index.php in Artmedic Event allows remote attackers to execute arbitrary code via a URL in the page parameter.

  • CVE-2006-1989May 1, 2006
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.06

    Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code via long HTTP headers.

  • CVE-2006-2110May 1, 2006
    Virtual Private Server
    Vserver
    risk 0.00cvss —epss 0.00

    Virtual Private Server (Vserver) 2.0.x before 2.0.2-rc18 and 2.1.x before 2.1.1-rc18 provides certain context capabilities (ccaps) that allow local guest users to perform operations that were only intended to be allowed by the guest-root.

  • CVE-2006-2111May 1, 2006
    Microsoft
    Outlook Express
    risk 0.06cvss —epss 0.40

    A component in Microsoft Outlook Express 6 allows remote attackers to bypass domain restrictions and obtain sensitive information via redirections with the mhtml: URI handler, as originally reported for Internet Explorer 6 and 7, aka "URL Redirect Cross Domain Information…

  • CVE-2006-2114May 1, 2006
    Sws
    Sws Simple Web Server
    risk 0.00cvss —epss 0.04

    Buffer overflow in SWS web Server 0.1.7 allows remote attackers to execute arbitrary code via a long request.

  • CVE-2006-2115May 1, 2006
    Sws
    Sws Simple Web Server
    risk 0.00cvss —epss 0.03

    Format string vulnerability in SWS web Server 0.1.7 allows remote attackers to execute arbitrary code via unspecified vectors that are not properly handled in a syslog function call.

  • CVE-2006-2084Apr 29, 2006
    Farsinews
    Farsinews
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in FarsiNews 2.5.3 Pro and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) month and (2) year parameters in (a) index.php, and the (3) mod parameter in (b) admin.php.

  • CVE-2006-2085Apr 29, 2006
    Speedproject
    Speedcommander
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in (1) CxAce60.dll and (2) CxAce60u.dll in SpeedProject Squeez 5.10 Build 4460, and SpeedCommander 10.52 Build 4450 and 11.01 Build 4450, allow user-assisted remote attackers to execute arbitrary code via an ACE archive that contains a file with a long…

  • CVE-2006-2086Apr 29, 2006
    Juniper Networks
    Ive OS
    risk 0.08cvss —epss 0.67

    Buffer overflow in JuniperSetupDLL.dll, loaded from JuniperSetup.ocx by the Juniper SSL-VPN Client when accessing a Juniper NetScreen IVE device running IVE OS before 4.2r8.1, 5.0 before 5.0r6.1, 5.1 before 5.1r8, 5.2 before 5.2r4.1, or 5.3 before 5.3r2.1, allows remote…

  • CVE-2006-2087Apr 29, 2006
    Hitachi
    Groupmax
    risk 0.00cvss —epss 0.02

    The Gmax Mail client in Hitachi Groupmax before 20060426 allows remote attackers to cause a denial of service (application hang or erroneous behavior) via an attachment with an MS-DOS device filename.

  • CVE-2006-2088Apr 29, 2006
    Devsyn
    Open Bulletin Board
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Devsyn Open Bulletin Board (OpenBB) 1.0.6 allow remote attackers to inject arbitrary web script or HTML via (1) the FID parameter in board.php and (2) the TID parameter in read.php. NOTE: the SQL injection issues are…

  • CVE-2006-2089Apr 29, 2006
    Mysmartbb
    Mysmartbb
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in misc.php in MySmartBB 1.1.x allow remote attackers to inject arbitrary web script or HTML via the (1) id and (2) username parameters.

  • CVE-2006-2090Apr 29, 2006
    Mysmartbb
    Mysmartbb
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in misc.php in MySmartBB 1.1.x allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) username parameters.

  • CVE-2006-2091Apr 29, 2006
    Vwar
    Virtual War
    risk 0.00cvss —epss 0.01

    admin.php in Virtual War (VWar) 1.5 and versions before 1.2 allows remote attackers to obtain sensitive information via an invalid vwar_root parameter, which reveals the path in an error message.

  • CVE-2006-2092Apr 29, 2006
    Microfocus
    StorageWorks Secure Path for Windows
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in HP StorageWorks Secure Path for Windows 4.0C-SP2 before 20060419 allows remote attackers to cause an unspecified denial of service via unknown vectors.

  • CVE-2006-2093Apr 29, 2006
    Tenable
    Nessus
    risk 0.00cvss —epss 0.04

    Nessus before 2.2.8, and 3.x before 3.0.3, allows user-assisted attackers to cause a denial of service (memory consumption) via a NASL script that calls split with an invalid sep parameter. NOTE: a design goal of the NASL language is to facilitate sharing of security tests by…

  • CVE-2006-2094Apr 29, 2006
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.23

    Microsoft Internet Explorer before Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, when Prompt is configured in Security Settings, uses modal dialogs to verify that a user wishes to run an ActiveX control or perform other risky actions, which allows…

  • CVE-2006-2095Apr 29, 2006
    Phex
    Phex
    risk 0.00cvss —epss 0.02

    Phex before 2.8.6 allows remote attackers to cause a denial of service (application hang) by initiating multiple chat requests to a single user and then logging off.

  • CVE-2006-2096Apr 29, 2006
    Neocrome
    Land Down Under
    risk 0.00cvss —epss 0.01

    plug.php in Land Down Under (LDU) 802 and earlier allows remote attackers to obtain sensitive information via an invalid (1) month or (2) year parameter, which reveals the path in an error message.

  • CVE-2006-2097Apr 29, 2006
    Invision Power Services
    Power Board
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in func_msg.php in Invision Power Board (IPB) 2.1.4 allows remote attackers to execute arbitrary SQL commands via the from_contact field in a private message (PM).

  • CVE-2006-2098Apr 29, 2006
    PHP Thumbnail Autoindex
    PHP Thumbnail Autoindex
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in Thumbnail AutoIndex before 2.0 allows remote attackers to execute arbitrary PHP code via (1) README.html or (2) HEADER.html.

  • CVE-2006-2099Apr 29, 2006
    Ezbsystems
    Ultraiso
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in UltraISO 8.0.0.1392 allows remote attackers to write arbitrary files via a .. (dot dot) in a filename in an ISO image.

  • CVE-2006-2100Apr 29, 2006
    Magiciso
    Magic ISO Maker
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in Magic ISO 5.0 Build 0166 allows remote attackers to write arbitrary files via a .. (dot dot) in a filename in an ISO image.

  • CVE-2006-2101Apr 29, 2006
    WinISO
    WinISO
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in WinISO 5.3 allows remote attackers to write arbitrary files via a .. (dot dot) in a filename in an ISO image.

  • CVE-2006-2102Apr 29, 2006
    Poweriso
    Poweriso
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in PowerISO 2.9 allows remote attackers to write arbitrary files via a .. (dot dot) in a filename in an ISO image.

  • CVE-2006-2103Apr 29, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in MyBB (MyBulletinBoard) 1.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the (1) query string ($querystring variable) in (a) admin/adminlogs.php, which is not properly handled by adminfunctions.php; or (2)…

  • CVE-2006-2104Apr 29, 2006
    Kmail
    Kmail
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Kamgaing Email System (kmail) 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) d parameter to main.php, ordner parameter to (2) main.php, or (3) webdisk.php, (4) draft parameter to…

  • CVE-2006-2105Apr 29, 2006
    Jupiter CMS
    Jupiter CMS
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in index.php in Jupiter CMS 1.1.4 and 1.1.5 allows remote attackers to read arbitrary files via ".." sequences terminated by a %00 (null) character in the n parameter.

  • CVE-2006-2106Apr 29, 2006
    Edgewall Software
    Trac
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Edgewall Software Trac 0.9.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors related to a "wiki macro."

  • CVE-2006-2107Apr 29, 2006
    risk 0.03cvss —epss 0.05

    Buffer overflow in BL4 SMTP Server 0.1.4 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long argument to the (1) EHLO, (2) MAIL FROM, and (3) RCPT TO commands.