VYPR

CVEs

343,710 total · page 6535 of 6,875

AllCriticalHighKEV
  • CVE-2006-1850Apr 19, 2006
    XFlow
    xFlow
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in xFlow 5.46.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) level, (2) position, (3) id, and (4) action parameters to members_only/index.cgi, and the (5) page parameter to…

  • CVE-2006-1851Apr 19, 2006
    Skymarx Solutions
    Xflow
    risk 0.00cvss —epss 0.01

    xFlow 5.46.11 and earlier allows remote attackers to determine the installation path of the application via the (1) action parameter to members_only/index.cgi and (2) page parameter customer_area/index.cgi, probably due to invalid values.

  • CVE-2006-1852Apr 19, 2006
    Article Publisher Pro
    Article Publisher Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in category.php in Article Publisher Pro 1.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cname parameter.

  • CVE-2006-1853Apr 19, 2006
    Moderngigabyte
    Modernbill
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ModernBill 4.3.2 and earlier allow remote attackers or administrators to execute arbitrary SQL commands via the (1) id parameter in (a) user.php, or (2) where and (3) order parameters to (b) admin.php.

  • CVE-2006-1854Apr 19, 2006
    Bluepay
    Bluepay Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in BluePay Manager 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML during a login action via the (1) Account Name and (2) Username field. NOTE: the vendor has disputed this vulnerability, saying…

  • CVE-2006-1753Apr 18, 2006
    Debian
    Debian Linux
    risk 0.00cvss —epss 0.00

    A cron job in fcheck before 2.7.59 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.

  • CVE-2006-1827Apr 18, 2006
    Digium
    Asterisk
    risk 0.01cvss —epss 0.07

    Integer signedness error in format_jpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length.

  • CVE-2006-0744Apr 18, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Linux kernel before 2.6.16.5 does not properly handle uncanonical return addresses on Intel EM64T CPUs, which reports an exception in the SYSRET instead of the next instruction, which causes the kernel exception handler to run on the user stack with the wrong GS.

  • CVE-2006-1797Apr 18, 2006
    NetBSD
    NetBSD
    risk 0.00cvss —epss 0.00

    The kernel in NetBSD-current before September 28, 2005 allows local users to cause a denial of service (system crash) by using the SIOCGIFALIAS ioctl to gather information on a non-existent alias of a network interface, which causes a NULL pointer dereference.

  • CVE-2006-1798Apr 18, 2006
    Rateit
    Rateit
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in rateit.php in RateIt 2.2 allows remote attackers to execute arbitrary SQL commands via the rateit_id parameter.

  • CVE-2006-1799Apr 18, 2006
    Censtore
    censtore.cgi
    risk 0.03cvss —epss 0.03

    censtore.cgi in Censtore 7.3.002 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter.

  • CVE-2006-1800Apr 18, 2006
    SimpleBBS
    SimpleBBS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in posts.php in SimpleBBS 1.0.6 through 1.1 allows remote attackers to include and execute arbitrary files via ".." sequences in the language cookie, as demonstrated by by injecting the code into the gl_session cookie of users.php, which is…

  • CVE-2006-1801Apr 18, 2006
    PlanetSearch+
    planetSearch+
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in planetsearchplus.php in planetSearch+ allows remote attackers to inject arbitrary web script or HTML via the search_exp parameter.

  • CVE-2006-1802Apr 18, 2006
    Tinywebgallery
    Tinywebgallery
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in TinyWebGallery 1.3 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the twg_album parameter.

  • CVE-2006-1803Apr 18, 2006
    PhpMyAdmin
    phpMyAdmin
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to inject arbitrary web script or HTML via the sql_query parameter.

  • CVE-2006-1804Apr 18, 2006
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to execute arbitrary SQL commands via the sql_query parameter.

  • CVE-2006-1805Apr 18, 2006
    Powerscripts
    Powerclan
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in member.php in PowerClan 1.14 allows remote attackers to execute arbitrary SQL commands via the memberid parameter.

  • CVE-2006-1806Apr 18, 2006
    Musicbox
    Musicbox
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Musicbox 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter in a search action.

  • CVE-2006-1807Apr 18, 2006
    Musicbox
    Musicbox
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Musicbox 2.3.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) start parameter in a search action or (2) type parameter in a top action.

  • CVE-2006-1808Apr 18, 2006
    Lifetype
    Lifetype
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Lifetype 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the show parameter in a Template operation.

  • CVE-2006-1809Apr 18, 2006
    Lifetype
    Lifetype
    risk 0.00cvss —epss 0.01

    index.php in Lifetype 1.0.3 allows remote attackers to obtain sensitive information via an invalid show parameter, which reveals the path in an error message.

  • CVE-2006-1810Apr 18, 2006
    Flexbb
    Flexbb
    risk 0.00cvss —epss 0.00

    Multiple cross-site scripting (XSS) vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to inject arbitrary web script or HTML via the (1) ICQ, (2) AIM, (3) MSN, (4) Google Talk, (5) Website Name, (6) Website Address, (7) Email Address, (8) Location, (9) Signature, and…

  • CVE-2006-1811Apr 18, 2006
    Flexbb
    Flexbb
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) forumid, or (3) threadid parameter to index.php; the (4) ICQ, (5) AIM, (6) MSN, (7) Google Talk, (8) Website Name, (9) Website Address, (10)…

  • CVE-2006-1812Apr 18, 2006
    Phpwebftp
    Phpwebftp
    risk 0.00cvss —epss 0.01

    phpWebFTP 3.2 and earlier stores script.js under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information.

  • CVE-2006-1813Apr 18, 2006
    Phpwebftp
    Phpwebftp
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in index.php in phpWebFTP 3.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the language parameter.

  • CVE-2006-1814Apr 18, 2006
    NetBSD
    NetBSD
    risk 0.00cvss —epss 0.00

    NetBSD 1.6, 2.0, 2.1 and 3.0 allows local users to cause a denial of service (memory exhaustion) by using the sysctl system call to lock a large buffer into physical memory.

  • CVE-2006-1815Apr 18, 2006
    Tritanium Bulletin Board
    TBB
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in register.php in Tritanium Bulletin Board (TBB) 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) newuser_realname and (2) newuser_icq parameters, a different vector than CVE-2006-1768. NOTE:…

  • CVE-2006-1816Apr 18, 2006
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.03

    PHP remote file inclusion vulnerability in VBulletin 3.5.1, 3.5.2, and 3.5.4 allows remote attackers to execute arbitrary code via a URL in the systempath parameter to (1) ImpExModule.php, (2) ImpExController.php, and (3) ImpExDisplay.php.

  • CVE-2006-1817Apr 18, 2006
    Warforge.NEWS
    warforge.NEWS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in authcheck.php in warforge.NEWS 1.0, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the (1) authusername and possibly the (2) authpassword cookie.

  • CVE-2006-1818Apr 18, 2006
    Warforge.NEWS
    NEWS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in warforge.NEWS 1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly including the (1) first_name and (2) last_name parameter in myaccounts.php. NOTE: portions of these details…

  • CVE-2006-1819Apr 18, 2006
    Phpwebsite
    Phpwebsite
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in the loadConfig function in index.php in phpWebSite 0.10.2 and earlier allows remote attackers to include arbitrary local files and execute arbitrary PHP code via the hub_dir parameter, as demonstrated by including access_log. NOTE: in some…

  • CVE-2006-1820Apr 18, 2006
    Modx
    MODX
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in ModX 0.9.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this might be resultant from the directory traversal vulnerability.

  • CVE-2006-1821Apr 18, 2006
    Modx
    MODX
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in ModX 0.9.1 allows remote attackers to read arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the id parameter.

  • CVE-2006-1822Apr 18, 2006
    Farsinews
    Farsinews
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search.php in FarsiNews 2.5.3 Pro and earlier allows remote attackers to inject arbitrary web script or HTML via the selected_search_arch parameter.

  • CVE-2006-1823Apr 18, 2006
    Farsinews
    Farsinews
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in FarsiNews 2.5.3 Pro and earlier allows remote attackers to obtain the installation path via ".." sequences in the archive parameter to index.php, which leaks the full pathname in an error message.

  • CVE-2006-1824Apr 18, 2006
    Phpguestbook
    Phpguestbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in PhpGuestbook.php in PhpGuestbook 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) Website, and (3) Comment parameter.

  • CVE-2006-1825Apr 18, 2006
    Phplinks
    Phplinks
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in phpLinks 2.1.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter.

  • CVE-2006-1826Apr 18, 2006
    Snipegallery
    Snipe Gallery
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Snipe Gallery 3.1.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gallery_id parameter in view.php, (2) keyword parameter in search.php, and (3) image_id parameter in image.php. NOTE:…

  • CVE-2006-1796Apr 17, 2006
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions before 2.0.1, allows remote attackers to inject arbitrary web script or HTML to Internet Explorer users via the request URI…

  • CVE-2006-1793Apr 17, 2006
    Runcms
    Runcms
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in runCMS 1.2 and earlier allows remote attackers to read arbitrary files via the bbPath[path] parameter to (1) class.forumposts.php and (2) forumpollrenderer.php. NOTE: this issue is closely related to CVE-2006-0659.

  • CVE-2006-1794Apr 17, 2006
    Mambo (software)
    Mambo
    risk 0.03cvss —epss 0.06

    SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via (1) the $username variable in the mosGetParam function and (2) the $task parameter in the mosMenuCheck function in (a)…

  • CVE-2006-1795Apr 17, 2006
    Upoint
    @1 Table Publisher
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in tablepublisher.cgi in UPDI Network Enterprise @1 Table Publisher 2006-03-23 allows remote attackers to inject arbitrary web script or HTML via the Title of Table field.

  • CVE-2006-1436Apr 15, 2006
    Upoint
    At1 Event Publisher
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in UPOINT @1 Event Publisher allow remote attackers to inject arbitrary web script or HTML via the (1) Event, (2) Description, (3) Time, (4) Website, and (5) Public Remarks fields to (a) eventpublisher_admin.htm and (b)…

  • CVE-2006-1437Apr 15, 2006
    Upoint
    At1 Event Publisher
    risk 0.00cvss —epss 0.01

    UPOINT @1 Event Publisher stores sensitive information under the web document root with insufifcient access control, which allows remote attackers to read private comments via a direct request to eventpublisher.txt.

  • CVE-2006-1792Apr 15, 2006
    MailEnable
    Mailenable
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the POP service in MailEnable Standard Edition before 1.94, Professional Edition before 1.74, and Enterprise Edition before 1.22 has unknown attack vectors and impact related to "authentication exploits". NOTE: this is a different set of affected…

  • CVE-2006-1791Apr 14, 2006
    QuickBlogger
    QuickBlogger
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in acc.php in QuickBlogger 1.4 allows remote attackers to read or include arbitrary local files via the request parameter. NOTE: this issue can also produce resultant XSS when the associated include statement fails.

  • CVE-2006-0558Apr 14, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    perfmon (perfmon.c) in Linux kernel on IA64 architectures allows local users to cause a denial of service (crash) by interrupting a task while another process is accessing the mm_struct, which triggers a BUG_ON action in the put_page_testzero function.

  • CVE-2006-1790Apr 14, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the InstallTrigger.install method, which leads to memory corruption.

  • CVE-2006-1737Apr 14, 2006
    Seamonkey
    Seamonkey
    risk 0.00cvss —epss 0.05

    Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary bytecode via JavaScript with a large…

  • CVE-2006-1738Apr 14, 2006
    Seamonkey
    Seamonkey
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) by changing the (1) -moz-grid and (2) -moz-grid-group display…