VYPR

CVEs

343,710 total · page 6537 of 6,875

AllCriticalHighKEV
  • CVE-2006-1782Apr 13, 2006
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Solaris 8 and 9 allows local users to obtain the LDAP Directory Server root Distinguished Name (rootDN) password when a privileged user (1) runs idsconfig; or "insecurely" runs LDAP2 commands with the -w option, including (2) ldapadd, (3) ldapdelete,…

  • CVE-2006-1783Apr 13, 2006
    Patronet
    CMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in PatroNet CMS allows remote attackers to inject arbitrary web script or HTML via the URI.

  • CVE-2006-1755Apr 13, 2006
    Matthew Dingley
    Md News
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin.php in MD News 1 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-1756Apr 13, 2006
    Matthew Dingley
    Md News
    risk 0.00cvss —epss 0.02

    MD News 1 allows remote attackers to bypass authentication via a direct request to a script in the Administration Area.

  • CVE-2006-1757Apr 13, 2006
    Vegadns
    Vegadns
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Vegadns 0.99 allows remote attackers to inject arbitrary web script or HTML via the message parameter.

  • CVE-2006-1758Apr 13, 2006
    Vegadns
    Vegadns
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Vegadns 0.99 allows remote attackers to execute arbitrary SQL commands via the cid parameter.

  • CVE-2006-1759Apr 13, 2006
    Swsoft
    Confixx
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in allgemein_transfer.php in SWSoft Confixx 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the jahr parameter.

  • CVE-2006-1760Apr 13, 2006
    JetPhoto
    JetPhoto
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in JetPhoto allow remote attackers to inject arbitrary web script or HTML via the page parameter in (1) Classic.view/thumbnail.php, (2) Classic.view/gallery.php, (3) Classic.view/detail.php, or (4) Orange.view/detail.php; or…

  • CVE-2006-1761Apr 13, 2006
    Blur6ex
    blur6ex
    risk 0.00cvss —epss 0.01

    Cross-site scripting vulnerability in index.php in blur6ex 0.3.452 allows remote attackers to inject arbitrary web script or HTML via the errormsg parameter, which is not sanitized in the error message. NOTE: the vector in the shard parameter is not XSS and has been assigned a…

  • CVE-2006-1762Apr 13, 2006
    Blur6ex
    blur6ex
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in index.php in blur6ex 0.3.452 allows remote attackers to include arbitrary files via the shard parameter. NOTE: this issue can be exploited to produce resultant XSS when the parameter has XSS manipulations, and path disclosure with other…

  • CVE-2006-1763Apr 13, 2006
    Blur6ex
    blur6ex
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in blur6ex 0.3.452 allows remote attackers to execute arbitrary SQL commands via the ID parameter in a (1) g_reply or (2) g_permaPost action to the blog shard (engine/shards/blog.php), or a (3) g_viewContent action to the…

  • CVE-2006-1764Apr 13, 2006
    Hosting Controller
    Hosting Controller
    risk 0.00cvss —epss 0.02

    Hosting Controller 6.1 stores forum/db/forum.mdb under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as user name and password credentials. NOTE: the provenance of this information is unknown; the…

  • CVE-2006-1754Apr 13, 2006
    Swsoft
    Confixx
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in SWSoft Confixx 3.0.6, 3.0.8, and 3.1.2 allows remote attackers to execute arbitrary SQL commands via the SID parameter.

  • CVE-2006-1523Apr 12, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    The __group_complete_signal function in the RCU signal handling (signal.c) in Linux kernel 2.6.16, and possibly other versions, has unknown impact and attack vectors related to improper use of BUG_ON.

  • CVE-2006-1743Apr 12, 2006
    Jbook
    Jbook
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in form.php in JBook 1.4 allow remote attackers to execute arbitrary SQL commands via the (1) nom or (2) mail parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-1744Apr 12, 2006
    BSDGames
    sail
    risk 0.00cvss —epss 0.01

    Buffer overflow in pl_main.c in sail in BSDgames before 2.17-7 allows local users to execute arbitrary code via a long player name that is used in a scanf function call.

  • CVE-2006-1745Apr 12, 2006
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in login.php in Bitweaver 1.3 allows remote attackers to inject arbitrary web script or HTML via the error parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-1746Apr 12, 2006
    Phplist
    Phplist
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in PHPList 2.10.2 and earlier allows remote attackers to include arbitrary local files via the (1) GLOBALS[database_module] or (2) GLOBALS[language_module] parameters, which overwrite the underlying $GLOBALS variable.

  • CVE-2006-1747Apr 12, 2006
    Vwar
    Virtual War
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in Virtual War (VWar) 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter to (1) admin/admin.php, (2) war.php, (3) stats.php, (4) news.php, (5) joinus.php, (6) challenge.php, (7) calendar.php,…

  • CVE-2006-1748Apr 12, 2006
    XMB Forum
    XMB Forum
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in XMB Forum 1.9.5 allows remote attackers to inject arbitrary web script or HTML by uploading a Flash (.SWF) video that contains a getURL function call, which causes the video to be rendered without disabling ActionScript.

  • CVE-2006-1749Apr 12, 2006
    Phplist
    Phplist
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in config.php in phpListPro 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the returnpath parameter. NOTE: this issue was later reported to affect 2.01 as well.

  • CVE-2006-1750Apr 12, 2006
    Autogallery
    Autogallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Autogallery 0.41 allow remote attackers to inject arbitrary web script or HTML via the (1) pic or (2) show parameters.

  • CVE-2006-1751Apr 12, 2006
    MvBlog
    MvBlog
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MvBlog before 1.6 allow remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2006-1752Apr 12, 2006
    MvBlog
    MvBlog
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the backend in MvBlog before 1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) body fields in a comment.

  • CVE-2006-0003Apr 12, 2006
    Microsoft
    Data Access Components
    risk 0.10cvss —epss 0.82

    Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in Microsoft Data Access Components (MDAC) 2.7 and 2.8, allows remote attackers to execute arbitrary code via unknown attack vectors.

  • CVE-2006-0012Apr 12, 2006
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.24

    Unspecified vulnerability in Windows Explorer in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via attack vectors involving COM objects and "crafted files and directories," aka the "Windows Shell Vulnerability."

  • CVE-2006-0014Apr 12, 2006
    Microsoft
    Outlook Express
    risk 0.02cvss —epss 0.24

    Buffer overflow in Microsoft Outlook Express 5.5 and 6 allows remote attackers to execute arbitrary code via a crafted Windows Address Book (WAB) file containing "certain Unicode strings" and modified length values.

  • CVE-2006-0015Apr 11, 2006
    Microsoft
    Frontpage Server Extensions
    risk 0.05cvss —epss 0.24

    Cross-site scripting (XSS) vulnerability in _vti_bin/_vti_adm/fpadmdll.dll in Microsoft FrontPage Server Extensions 2002 and SharePoint Team Services allows remote attackers to inject arbitrary web script or HTML, then leverage the attack to execute arbitrary programs or create…

  • CVE-2006-1185Apr 11, 2006
    Microsoft
    Internet Explorer
    risk 0.09cvss —epss 0.70

    Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes memory corruption.

  • CVE-2006-1186Apr 11, 2006
    Microsoft
    Internet Explorer
    risk 0.08cvss —epss 0.58

    Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2) Mdt2dd.dll, and (3) Mdt2gddo.dll COM objects as ActiveX controls, which leads to memory corruption.

  • CVE-2006-1188Apr 11, 2006
    Microsoft
    Internet Explorer
    risk 0.08cvss —epss 0.57

    Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads to memory corruption.

  • CVE-2006-1189Apr 11, 2006
    Microsoft
    Internet Explorer
    risk 0.08cvss —epss 0.61

    Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with an International Domain Name (IDN) using double-byte character sets (DBCS), aka the "Double Byte Character Parsing Memory…

  • CVE-2006-1190Apr 11, 2006
    Microsoft
    Internet Explorer
    risk 0.08cvss —epss 0.61

    Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object, which could cause Internet Explorer to run the object in the wrong security context or zone, and allow remote attackers to…

  • CVE-2006-1191Apr 11, 2006
    Microsoft
    Internet Explorer
    risk 0.06cvss —epss 0.32

    Microsoft Internet Explorer 5.01 through 6 does not always correctly identify the domain that is associated with a browser window, which allows remote attackers to obtain sensitive cross-domain information and spoof sites by running script after the user has navigated to another…

  • CVE-2006-1192Apr 11, 2006
    Microsoft
    Internet Explorer
    risk 0.06cvss —epss 0.31

    Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via unknown methods that allow "window content to persist" after the user has navigated to another site, aka the "Address…

  • CVE-2006-1713Apr 11, 2006
    Phpmyforum
    Phpmyforum
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Christoph Roeder phpMyForum 4.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2006-1714Apr 11, 2006
    Phpmyforum
    Phpmyforum
    risk 0.03cvss —epss 0.03

    CRLF injection vulnerability in index.php in Christoph Roeder phpMyForum 4.0 allows remote attackers to inject HTTP headers via hex-encoded CRLF sequences in the type parameter.

  • CVE-2006-1715Apr 11, 2006
    Tugzip
    Tugzip
    risk 0.00cvss —epss 0.01

    Multiple directory traversal vulnerabilities in Christian Kindahl TUGZip 3.4.0.0, 3.3.0.0, and 3.1.0.2 allow user-assisted attackers to create files in arbitrary directories via a .. (dot dot) in an archive pack with a crafted (1) .gz, (2) .jar, (3) .rar, or (4) .zip file.

  • CVE-2006-1716Apr 11, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.10 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a BBCode img tag. NOTE: the email vector is already covered by CVE-2006-1625, although…

  • CVE-2006-1717Apr 11, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in newthread.php in MyBB (aka MyBulletinBoard) 1.10, when configured to permit new threads by unregistered users, allows remote attackers to inject arbitrary web script or HTML via the username.

  • CVE-2006-1718Apr 11, 2006
    Clever Copy
    Clever Copy
    risk 0.04cvss —epss 0.07

    Magus Perde Clever Copy 3.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to view the database username and password via a direct request for connect.inc.

  • CVE-2006-1719Apr 11, 2006
    Microsoft
    Ie
    risk 0.01cvss —epss 0.14

    Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) via any scrollbar Cascading Style Sheets (CSS) property.

  • CVE-2006-1720Apr 11, 2006
    Saphplesson
    Saphplesson
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in SaphpLesson 3.0 allows remote attackers to inject arbitrary web script or HTML via the Word parameter. NOTE: it is possible that this issue is resultant from SQL injection.

  • CVE-2006-1721Apr 11, 2006
    Cyrus
    Sasl
    risk 0.00cvss —epss 0.02

    digestmd5.c in the CMU Cyrus Simple Authentication and Security Layer (SASL) library 2.1.18, and possibly other versions before 2.1.21, allows remote unauthenticated attackers to cause a denial of service (segmentation fault) via malformed inputs in DIGEST-MD5 negotiation.

  • CVE-2006-1722Apr 11, 2006
    Suche
    Shopxs
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in suche.htm in ShopXS 4.0 allows remote attackers to inject arbitrary web script or HTML via the Suchstring1 (aka search) parameter.

  • CVE-2006-1712Apr 11, 2006
    GNU
    Mailman
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the private archive script (private.py) in GNU Mailman 2.1.7 allows remote attackers to inject arbitrary web script or HTML via the action argument.

  • CVE-2006-1710Apr 11, 2006
    Design Nation
    Dnguestbook
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in admin.php in Design Nation DNGuestbook 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) email and (2) id parameters.

  • CVE-2006-1711Apr 11, 2006
    Plone (software)
    Plone
    risk 0.03cvss —epss 0.04

    Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.

  • CVE-2006-1060Apr 11, 2006
    Xzgv
    Xzgv
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in zgv before 5.8 and xzgv before 0.8 might allow user-assisted attackers to execute arbitrary code via a JPEG image with more than 3 output components, such as a CMYK or YCCK color space, which causes less memory to be allocated than required.

  • CVE-2006-1690Apr 11, 2006
    Manic Web
    Mwnewsletter
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in subscribe.php in MWNewsletter 1.0.0b allows remote attackers to inject arbitrary web script or HTML via the user_name parameter.