VYPR

CVEs

343,710 total · page 6533 of 6,875

AllCriticalHighKEV
  • CVE-2006-1942Apr 20, 2006
    Netscape
    Netscape
    risk 0.00cvss —epss 0.03

    Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then…

  • CVE-2006-1943Apr 20, 2006
    Smarter Scripts
    Intellilink Pro
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Smarter Scripts IntelliLink Pro 5.06 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter in addlink_lwp.cgi and the (2) id, (3) forgotid, and (4) forgotpass parameters in…

  • CVE-2006-1944Apr 20, 2006
    Sibsoft
    Communimail
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in SibSoft CommuniMail 1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the list_id parameter in mailadmin.cgi and (2) the form_id parameter in templates.cgi.

  • CVE-2006-1945Apr 20, 2006
    AWStats
    Awstats
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config parameter. NOTE: this might be the same core issue as CVE-2005-2732.

  • CVE-2006-1946Apr 20, 2006
    Visale
    Visale
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Visale 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the keyval parameter in pbpgst.cgi, (2) the catsubno parameter in pblscg.cgi, and (3) the listno parameter in pblsmb.cgi.

  • CVE-2006-1947Apr 20, 2006
    Nicplex
    Plexum
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in plexum.php in NicPlex Plexum X5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) pagesize, (2) maxrec, and (3) startpos parameters.

  • CVE-2006-1948Apr 20, 2006
    IBM
    Lotus Notes
    risk 0.00cvss —epss 0.01

    The "Add Sender to Address Book" operation (AddSenderToAddressBook.lss) and NameHelper.lss in IBM Lotus Notes 6.0 and 6.5 before 20060331 do not properly store information in the Personal Address Book when multiple messages are checked and a message uses AltFrom, which might…

  • CVE-2006-1949Apr 20, 2006
    Nicplex
    Plexcart
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in plexcart.pl in NicPlex PlexCart X3 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2006-1950Apr 20, 2006
    Perlcoders Group
    Bannerfarm
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in banners.cgi in PerlCoders BannerFarm 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) aff and (2) cat parameters.

  • CVE-2006-1931Apr 20, 2006
    Yukihiro Matsumoto
    Ruby
    risk 0.04cvss —epss 0.10

    The HTTP/XMLRPC server in Ruby before 1.8.2 uses blocking sockets, which allows attackers to cause a denial of service (blocked connections) via a large amount of data.

  • CVE-2006-1907Apr 20, 2006
    Mywebland
    Myevent
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in myEvent 1.x allow remote attackers to inject arbitrary SQL commands via the event_id parameter to (1) addevent.php or (2) del.php or (3) event_desc parameter to addevent.php. NOTE: the provenance of this information is unknown; the…

  • CVE-2006-1908Apr 20, 2006
    Mywebland
    Myevent
    risk 0.00cvss —epss 0.01

    Cross-site scripting vulnerability in addevent.php in myEvent 1.x allows remote attackers to inject arbitrary web script or HTML via the event_desc parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-1909Apr 20, 2006
    Coppermine
    Coppermine
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in index.php in Coppermine 1.4.4 allows remote attackers to read arbitrary files via a .//./ (modified dot dot slash) in the file parameter, which causes a regular expression to collapse the sequences into standard "../" sequences.

  • CVE-2006-1910Apr 20, 2006
    Serendipity
    Serendipity
    risk 0.00cvss —epss 0.01

    config.php in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values that are stored in config.php and later executed. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-1911Apr 20, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MyBB (MyBulletinBoard) 1.1 allows remote attackers to inject arbitrary web script or HTML via the attachment content disposition in an HTML attachment.

  • CVE-2006-1912Apr 20, 2006
    MyBB
    Mybb
    risk 0.03cvss —epss 0.02

    MyBB (MyBulletinBoard) 1.1.0 does not set the constant KILL_GLOBAL variable in (1) global.php and (2) inc/init.php, which allows remote attackers to initialize arbitrary variables that are processed by an @extract command, which could then be leveraged to conduct cross-site…

  • CVE-2006-1913Apr 20, 2006
    Jax Scripts
    Jax Guestbook
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in jax_guestbook.php in Jax Guestbook 3.1, 3.31, and 3.50 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2006-1914Apr 20, 2006
    Dbbs
    Dbbs
    risk 0.00cvss —epss 0.01

    DbbS 2.0-alpha and earlier allows remote attackers to obtain sensitive information via an invalid (1) fcategoryid parameter to topics.php or (2) unavariabile, (3) GLOBALS, or (4) _SERVER[] parameters to script.php. NOTE: this information leak might be resultant from a global…

  • CVE-2006-1915Apr 20, 2006
    Dbbs
    Dbbs
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in topics.php in DbbS 2.0-alpha and earlier allows remote attackers to execute arbitrary SQL commands via the fcategoryid parameter.

  • CVE-2006-1916Apr 20, 2006
    Dbbs
    Dbbs
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in profile.php in DbbS 2.0-alpha and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ulocation or (2) uhobbies parameters.

  • CVE-2006-1917Apr 20, 2006
    Blackorpheus
    Clanmemberskript
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in member.php in Blackorpheus ClanMemberSkript 1.0 allows remote attackers to execute arbitrary SQL commands via the userID parameter.

  • CVE-2006-1918Apr 20, 2006
    Papoo
    Papoo
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Papoo 2.1.5 allow remote attackers to inject arbitrary web script or HTML via the menuid parameter to (1) index.php or (2) forum.php, or the (3) reporeid_print parameter to print.php.

  • CVE-2006-1919Apr 20, 2006
    Thomas Voecking
    Internet Photoshow
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in index.php in Internet Photoshow 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

  • CVE-2006-1920Apr 20, 2006
    Pmtool
    Pmtool
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in index.php in PMTool 1.2.2 allows remote attackers to execute arbitrary SQL commands via the order parameter in the include files (1) user.inc.php, (2) customer.inc.php, and (3) project.inc.php. NOTE: the provenance of this information is unknown;…

  • CVE-2006-1921Apr 20, 2006
    PHP Net Tools
    PHP Net Tools
    risk 0.03cvss —epss 0.04

    nettools.php in PHP Net Tools 2.7.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter.

  • CVE-2006-1922Apr 20, 2006
    Sweetphp
    Totalcalendar
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in (1) about.php or (2) auth.php in TotalCalendar allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter.

  • CVE-2006-1923Apr 20, 2006
    Linpha
    Linpha
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) RSS/RSS.php and (2) possibly other vectors.

  • CVE-2006-1924Apr 20, 2006
    Linpha
    Linpha
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in functions/db_api.php in LinPHA 1.1.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2006-1925Apr 20, 2006
    Cutephp
    Cutenews
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in the editnews module (inc/editnews.mdu) in index.php in CuteNews 1.4.1 allows remote attackers to read or modify files via the source parameter in the (1) editnews or (2) doeditnews action. NOTE: this can also produce resultant XSS when the…

  • CVE-2006-1926Apr 20, 2006
    Thwboard
    Thwboard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in showtopic.php in ThWboard 2.84 beta 3 and earlier allows remote attackers to execute arbitrary SQL commands via the pagenum parameter.

  • CVE-2006-1927Apr 20, 2006
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.02

    Cisco IOS XR, when configured for Multi Protocol Label Switching (MPLS) and running on Cisco CRS-1 or Cisco 12000 series routers, allows remote attackers to cause a denial of service (Line card crash) via certain MPLS packets, as identified by Cisco bug ID CSCsc77475.

  • CVE-2006-1928Apr 20, 2006
    Cisco Systems, Inc.
    iOS Xr
    risk 0.00cvss —epss 0.02

    Cisco IOS XR, when configured for Multi Protocol Label Switching (MPLS) and running on Cisco CRS-1 routers, allows remote attackers to cause a denial of service (Modular Services Cards (MSC) crash or "MPLS packet handling problems") via certain MPLS packets, as identified by…

  • CVE-2006-1929Apr 20, 2006
    I Rater
    Platinum
    risk 0.04cvss —epss 0.07

    PHP remote file inclusion vulnerability in include/common.php in I-Rater Platinum allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.

  • CVE-2006-1930Apr 20, 2006
    Green Minute
    Green Minute
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in userscript.php in Green Minute 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) huserid, (2) pituus, or (3) date parameters. NOTE: this issue has been disputed by the vendor, saying "those parameters…

  • CVE-2006-1056Apr 20, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The Linux kernel before 2.6.16.9 and the FreeBSD kernel, when running on AMD64 and other 7th and 8th generation AuthenticAMD processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one process to determine…

  • CVE-2006-1866Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and other versions have unknown impact and attack vectors in the (1) Advanced Replication component, as identified by Vuln# DB01, and (2) Oracle Spatial component, as identified…

  • CVE-2006-1867Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle Database Server 9.2.0.6 has unknown impact and attack vectors in the Advanced Replication component, aka Vuln# DB02.

  • CVE-2006-1868Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.01cvss —epss 0.12

    Buffer overflow in the Advanced Replication component in Oracle Database Server 10.1.0.4 allows database users to execute arbitrary code via the VERIFY_LOG procedure of the DBMS_SNAPSHOT_UTL package, aka Vuln# DB03.

  • CVE-2006-1869Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in Oracle Database Server 8.1.7.4 and 9.0.1.5 has unknown impact and attack vectors in the Dictionary component, aka Vuln# DB04.

  • CVE-2006-1870Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2 has unknown impact and attack vectors in the Export component, aka Vuln# DB05. NOTE: details are unavailable from Oracle, but as of 20060427, they have not publicly commented…

  • CVE-2006-1871Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Oracle Database Server 9.2.0.7 and 10.1.0.5 allows remote attackers to execute arbitrary SQL commands via the DELETE_FROM_TABLE function in the DBMS_LOGMNR_SESSION (Log Miner) package, aka Vuln# DB06.

  • CVE-2006-1872Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle Database Server 9.0.1.5 and 9.2.0.7 has unknown impact and attack vectors in the Oracle Enterprise Manager Intelligent Agent component, aka Vuln# DB07.

  • CVE-2006-1873Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Oracle Database Server 9.2.0.7, 10.1.0.4, and 10.2.0.1 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB08.

  • CVE-2006-1874Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, and 9.2.0.6 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB09. NOTE: Oracle has not disputed reliable claims that this issue is SQL injection in MDSYS.PRVT_IDX using the…

  • CVE-2006-1875Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Oracle Database Server 9.0.1.5, 9.2.0.7, and 10.1.0.5 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB11. NOTE: Oracle has not disputed reliable researcher claims that this issue is SQL injection in…

  • CVE-2006-1876Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle Database Server 9.2.0.7 and 10.1.0.4 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB12. NOTE: details are unavailable from Oracle, but as of 20060421, they have not publicly disputed a claim by a reliable…

  • CVE-2006-1877Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, and 9.2.0.7 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB13.

  • CVE-2006-1878Apr 20, 2006
    Phpfaber
    Topsites
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in phpFaber TopSites allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2006-1879Apr 20, 2006
    Oracle Corporation
    Collaboration Suite
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the Email Server component in Oracle Collaboration Suite 9.0.4.2, 10.1.1, 10.1.2.0, and 10.1.2.1 have unknown impact and attack vectors, aka Vuln# (1) OCS01, (2) OCS02, (3) OCS03, and (4) OCS04.

  • CVE-2006-1880Apr 20, 2006
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10CU2 have unknown impact and attack vectors, as identified by Vuln# (1) APPS01 in the (a) Application Install component; (2) APPS09 in the (b) Oracle Diagnostics Interfaces component; (3)…