VYPR

CVEs

343,710 total · page 6530 of 6,875

AllCriticalHighKEV
  • CVE-2006-2108Apr 29, 2006
    Océ
    3121/3122 Printer
    risk 0.03cvss —epss 0.04

    parser.exe in Océ (OCE) 3121/3122 Printer allows remote attackers to cause a denial of service (crash or reboot) via a long request, possibly triggering a buffer overflow.

  • CVE-2006-2083Apr 28, 2006
    Rsync
    Rsync
    risk 0.00cvss —epss 0.04

    Integer overflow in the receive_xattr function in the extended attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers to execute arbitrary code via crafted extended attributes that trigger a buffer overflow.

  • CVE-2006-2079Apr 27, 2006
    Verosky Media
    Instant Photo Gallery
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in portfolio.php in Verosky Media Instant Photo Gallery, possibly before 1.0.2, allows remote attackers to inject arbitrary web script or HTML via the cat_id parameter.

  • CVE-2006-2080Apr 27, 2006
    Verosky Media
    Instant Photo Gallery
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in portfolio_photo_popup.php in Verosky Media Instant Photo Gallery 1.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter, which is not cleansed before calling the count_click function in includes/functions/fns_std.php. …

  • CVE-2006-2081Apr 27, 2006
    Oracle Corporation
    Database Server
    risk 0.05cvss —epss 0.22

    Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via the GET_DOMAIN_INDEX_METADATA function in the DBMS_EXPORT_EXTENSION package. NOTE: this issue was originally linked to DB05 (CVE-2006-1870), but a reliable third party has claimed that…

  • CVE-2006-2075Apr 27, 2006
    Don Moore
    Mydns
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in MyDNS 1.1.0 allows remote attackers to cause a denial of service via a crafted DNS message, aka "Query-of-death," as demonstrated by the OUSPG PROTOS DNS test suite.

  • CVE-2006-2076Apr 27, 2006
    Pdnsd
    Pdnsd
    risk 0.00cvss —epss 0.05

    Memory leak in Paul Rombouts pdnsd before 1.2.4 allows remote attackers to cause a denial of service (memory consumption) via a DNS query with an unsupported (1) QTYPE or (2) QCLASS, as demonstrated by the OUSPG PROTOS DNS test suite.

  • CVE-2006-2077Apr 27, 2006
    Pdnsd
    Pdnsd
    risk 0.00cvss —epss 0.03

    Buffer overflow in Paul Rombouts pdnsd before 1.2.4 has unknown impact and attack vectors. NOTE: this issue might be related to the OUSPG PROTOS DNS test suite.

  • CVE-2006-2078Apr 27, 2006
    Furukawa
    Fitelnet
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in multiple FITELnet products, including FITELnet-F40, F80, F100, F120, F1000, and E20/E30, allow remote attackers to cause a denial of service via crafted DNS messages that trigger errors in (1) ProxyDNS or (2) PKI-Resolver, as demonstrated…

  • CVE-2006-2072Apr 27, 2006
    Delegate
    Delegate
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in DeleGate 9.x before 9.0.6 and 8.x before 8.11.6 allow remote attackers to cause a denial of service via crafted DNS responses messages that cause (1) a buffer over-read or (2) infinite recursion, which can trigger a segmentation fault or…

  • CVE-2006-2073Apr 27, 2006
    Isc
    Bind
    risk 0.01cvss —epss 0.08

    Unspecified vulnerability in ISC BIND allows remote attackers to cause a denial of service via a crafted DNS message with a "broken" TSIG, as demonstrated by the OUSPG PROTOS DNS test suite.

  • CVE-2006-2074Apr 27, 2006
    Juniper Networks
    Junose
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Juniper Networks JUNOSe E-series routers before 7-1-1 has unknown impact and remote attack vectors related to the DNS "client code," as demonstrated by the OUSPG PROTOS DNS test suite.

  • CVE-2006-2071Apr 27, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Linux kernel 2.4.x and 2.6.x up to 2.6.16 allows local users to bypass IPC permissions and modify a readonly attachment of shared memory by using mprotect to give write permission to the attachment. NOTE: some original raw sources combined this issue with CVE-2006-1524, but…

  • CVE-2006-1514Apr 27, 2006
    Abcmidi
    Abcmidi
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in the abcmidi-yaps translator in abcmidi 20050101, and other versions, allow remote attackers to execute arbitrary code via crafted ABC music files that trigger the overflows during translation into PostScript.

  • CVE-2006-2064Apr 27, 2006
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the libpkcs11 library in Sun Solaris 10 might allow local users to gain privileges or cause a denial of service (application failure) via unknown attack vectors that involve the getpwnam family of non-reentrant functions.

  • CVE-2006-2065Apr 27, 2006
    PHP Surveyor
    Phpsurveyor
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in save.php in PHPSurveyor 0.995 and earlier allows remote attackers to execute arbitrary SQL commands via the surveyid cookie. NOTE: this issue could be leveraged to execute arbitrary PHP code, as demonstrated by inserting directory traversal…

  • CVE-2006-2066Apr 27, 2006
    Mkportal
    Mkportal
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities pm_popup.php in MKPortal 1.1 Rc1 and earlier, as used with vBulletin 3.5.4 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) u1, (2) m1, (3) m2, (4) m3, (5) m4 parameters.

  • CVE-2006-2067Apr 27, 2006
    Mkportal
    Mkportal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in vb_board_functions.php in MKPortal 1.1, as used with vBulletin 3.5.4 and earlier, allows remote attackers to execute arbitrary SQL commands via the userid parameter.

  • CVE-2006-2068Apr 27, 2006
    Hitachi
    JP1
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Hitachi JP1 products allow remote attackers to cause a denial of service (application stop or fail) via unexpected requests or data.

  • CVE-2006-2069Apr 27, 2006
    PowerDNS
    Powerdns
    risk 0.00cvss —epss 0.06

    The recursor in PowerDNS before 3.0.1 allows remote attackers to cause a denial of service (application crash) via malformed EDNS0 packets.

  • CVE-2006-2070Apr 27, 2006
    DevBB
    DevBB
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in member.php in DevBB 1.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the member parameter in a viewpro action.

  • CVE-2006-2043Apr 26, 2006
    IP3 Networks
    Ip3 Netaccess 75
    risk 0.03cvss —epss 0.01

    na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 allows local users to gain Unix shell access via "`" (backtick) characters in the appliance's command line interface (CLI).

  • CVE-2006-2044Apr 26, 2006
    IP3 Networks
    Ip3 Netaccess 75
    risk 0.00cvss —epss 0.01

    na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 has a default username of admin and a default password of admin.

  • CVE-2006-2045Apr 26, 2006
    IP3 Networks
    Ip3 Netaccess 75
    risk 0.00cvss —epss 0.00

    The (1) shadow password file in na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 has world readable permissions, which allows local users to view encrypted passwords; and the (2) NetAccess database file has world readable and writable permissions, which allows local users…

  • CVE-2006-2046Apr 26, 2006
    Application Dynamics
    Cartweaver Coldfusion
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) keywords parameters in (a) Results.cfm, and the (3) ProdID parameter in (b) Details.cfm.

  • CVE-2006-2047Apr 26, 2006
    Application Dynamics
    Cartweaver Coldfusion
    risk 0.00cvss —epss 0.02

    Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid (1) secondary, (2) PageNum_Results, (3) category, or (4) keywords parameter in (a) Results.cfm; or an invalid (5) ProdID parameter in (b)…

  • CVE-2006-2048Apr 26, 2006
    Phpwebftp
    Phpwebftp
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Edwin van Wijk phpWebFTP 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) port, (2) server, and (3) user parameters. NOTE: it is possible that the affected version is actually 3.2.

  • CVE-2006-2049Apr 26, 2006
    Dcscripts
    Dcforumlite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in dcboard.cgi in DCScripts DCForumLite 3.0 allows remote attackers to inject arbitrary web script or HTML via the az parameter.

  • CVE-2006-2050Apr 26, 2006
    Dcscripts
    Dcforumlite
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in dcboard.cgi in DCScripts DCForumLite 3.0 allows remote attackers to execute arbitrary SQL commands via the az parameter.

  • CVE-2006-2051Apr 26, 2006
    Nextage
    Nextage Shopping Cart
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in myadmin/index.php in NextAge Shopping Cart allow remote attackers to inject arbitrary web script or HTML via the (1) username and (2) password parameters.

  • CVE-2006-2052Apr 26, 2006
    Verosky Media
    Instant Photo Gallery
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Verosky Media Instant Photo Gallery allows remote attackers to inject arbitrary web script or HTML via the member parameter in a viewpro action in member.php. NOTE: the original report may be inaccurate, since the "viewpro" string does…

  • CVE-2006-2053Apr 26, 2006
    Quickestore
    Quickestore
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in QuickEStore 7.9 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the OrderID parameter in (a) shipping.cfm and (b) checkout.cfm, (2) ItemID parameter in (c) proddetail.cfm, (3) SubCatID parameter in (d)…

  • CVE-2006-2054Apr 26, 2006
    risk 0.00cvss —epss 0.02

    3Com Baseline Switch 2848-SFP Plus Model #3C16486 with firmware before 1.0.2.0 allows remote attackers to cause a denial of service (unstable operation) via long DHCP packets.

  • CVE-2006-2055Apr 26, 2006
    Microsoft
    Outlook
    risk 0.01cvss —epss 0.15

    Argument injection vulnerability in Microsoft Outlook 2003 SP1 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an…

  • CVE-2006-2056Apr 26, 2006
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.13

    Argument injection vulnerability in Internet Explorer 6 for Windows XP SP2 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook…

  • CVE-2006-2057Apr 26, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Argument injection vulnerability in Mozilla Firefox 1.0.6 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an…

  • CVE-2006-2058Apr 26, 2006
    Avant Force
    Avant Browser
    risk 0.00cvss —epss 0.02

    Argument injection vulnerability in Avant Browser 10.1 Build 17 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by launching Microsoft Outlook with an…

  • CVE-2006-2059Apr 26, 2006
    Invision Power Services
    Power Board
    risk 0.04cvss —epss 0.08

    action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a "#e" (execute)…

  • CVE-2006-2060Apr 26, 2006
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in action_admin/paysubscriptions.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote authenticated administrators to include and execute arbitrary local PHP files via a .. (dot dot) in the name parameter, preceded by…

  • CVE-2006-2061Apr 26, 2006
    Invision Power Services
    Power Board
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in lib/func_taskmanager.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary SQL commands via the ck parameter, which can inject at most 32 characters.

  • CVE-2006-2062Apr 26, 2006
    Leadhound Network
    Leadhound Full
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Leadhound Full and LITE 2.1, and probably the Network Version "Full Version", allow remote attackers to execute arbitrary SQL commands via the (1) banner parameter in agent_links.pl; the offset parameter in (2) agent_links.pl, (3)…

  • CVE-2006-2063Apr 26, 2006
    Leadhound Network
    Leadhound Full
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Leadhound Full and LITE 2.1, and probably the Network Version "Full Version", allow remote attackers to inject arbitrary web script or HTML via the login parameter in (1) agent_affil.pl, (2) agent_help.pl, (3) agent_faq.pl,…

  • CVE-2006-1864Apr 26, 2006
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    Directory traversal vulnerability in smbfs in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\\" sequences, a similar vulnerability to CVE-2006-1863.

  • CVE-2006-2037Apr 26, 2006
    Thwboard
    Thwboard
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Thwboard 3.0 Beta 2.84 allows remote attackers to inject arbitrary web script or HTML via the navpath parameter.

  • CVE-2006-2038Apr 26, 2006
    AmpleShop
    ampleShop
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in ampleShop 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) RecordID parameter in (a) Customeraddresses_RecordAction.cfm and (b) youraccount.cfm; (2) solus parameter in (c) detail.cfm; and (3) cat…

  • CVE-2006-2039Apr 26, 2006
    Ubertec
    Help Center Live
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the osTicket module in Help Center Live before 2.1.0 allow remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2006-2040Apr 26, 2006
    Keil Software
    Photokorn
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in photokorn 1.53 and 1.542 allow remote attackers to execute arbitrary SQL commands via the (1) cat, (2) pic and (3) page parameter in index.php; (4) id parameter in postcard.php; and (5) cat parameter in print.php.

  • CVE-2006-2041Apr 26, 2006
    Phpwebgallery
    Phpwebgallery
    risk 0.00cvss —epss 0.01

    PhpWebGallery before 1.6.0RC1 allows remote attackers to obtain arbitrary pictures via a request to picture.php without specifying the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

  • CVE-2006-0048Apr 26, 2006
    Francesco Stablum
    Tcpick
    risk 0.00cvss —epss 0.02

    Francesco Stablum tcpick 0.2.1 allows remote attackers to cause a denial of service (segmentation fault) via certain fragmented packets, possibly involving invalid headers and an attacker-controlled payload length. NOTE: this issue might be a buffer overflow or overread.

  • CVE-2006-2027Apr 26, 2006
    Pablo Software Solutions
    Quick 'n Easy FTP Server Professional and Lite
    risk 0.03cvss —epss 0.04

    Buffer overflow in Unicode processing in the logging functionality in Pablo Software Solutions Quick 'n Easy FTP Server Professional and Lite, probably 3.0, allows remote authenticated users to execute arbitrary code by sending a command with a long argument, which triggers a…