VYPR

CVEs

343,710 total · page 6538 of 6,875

AllCriticalHighKEV
  • CVE-2006-1691Apr 11, 2006
    Manic Web
    Mwnewsletter
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in MWNewsletter 1.0.0b allows remote attackers to execute arbitrary SQL commands via the user_name parameter to unsubscribe.php.

  • CVE-2006-1692Apr 11, 2006
    Manic Web
    Mwnewsletter
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MWNewsletter 1.0.0b allow remote attackers to execute arbitrary SQL commands via the (1) user_email parameter to (a) unsubscribe.php or (b) subscribe.php; or the (2) user_name parameter to subscribe.php. NOTE: the provenance of this…

  • CVE-2006-1693Apr 11, 2006
    Globalscape
    Secure FTP Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in GlobalSCAPE Secure FTP Server before 3.1.4 Build 01.10.2006 allows attackers to cause a denial of service (application crash) via a "custom command" with a long argument.

  • CVE-2006-1694Apr 11, 2006
    Xbrite
    Xbrite Members
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in members.php in XBrite Members 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-1695Apr 11, 2006
    Fbida
    Fbi
    risk 0.00cvss —epss 0.00

    The fbgs script in the fbi package 2.01-1.4, when the TMPDIR environment variable is not defined, allows local users to overwrite arbitrary files via a symlink attack on temporary files in /var/tmp/fbps-[PID].

  • CVE-2006-1696Apr 11, 2006
    Gallery Project
    Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Gallery before 1.5.3 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  • CVE-2006-1697Apr 11, 2006
    Matt Wright
    Guestbook
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Matt Wright Guestbook 2.3.1 allows remote attackers to execute arbitrary web script or HTML via the (1) Your Name, (2) E-Mail, or (3) Comments fields when posting a message.

  • CVE-2006-1698Apr 11, 2006
    Matt Wright
    Guestbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Matt Wright Guestbook 2.3.1 allows remote attackers to execute arbitrary web script or HTML via the (1) url, (2) city, (3) state, or (4) country parameters. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2006-1699Apr 11, 2006
    Aweb Labs
    Banner Generator
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Aweb Banner Generator 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the banner parameter in view mode.

  • CVE-2006-1700Apr 11, 2006
    Aweb Scripts
    Seller
    risk 0.00cvss —epss 0.02

    Buy.php in Aweb Scripts Seller uses predictable cookies for authentication based on the time and the script number, which allows remote attackers to bypass authentication.

  • CVE-2006-1701Apr 11, 2006
    Shadowed Portal
    Portal
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Pages module in Shadowed Portal allows remote attackers to inject arbitrary web script or HTML via the page parameter to load.php.

  • CVE-2006-1702Apr 11, 2006
    Spip
    Spip
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in spip_login.php3 in SPIP 1.8.3 allows remote attackers to execute arbitrary PHP code via a URL in the url parameter.

  • CVE-2006-1703Apr 11, 2006
    Sire
    Sire
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in lire.php in Sire 2.0 nws allows remote attackers to execute arbitrary PHP code via a URL in the rub parameter.

  • CVE-2006-1704Apr 11, 2006
    Sire
    Sire
    risk 0.03cvss —epss 0.02

    Sire 2.0 nws allows remote attackers to upload arbitrary image files without authentication via a direct request to upload.php.

  • CVE-2006-1705Apr 11, 2006
    Oracle Corporation
    Oracle9i
    risk 0.00cvss —epss 0.01

    Oracle Database 9.2.0.0 to 10.2.0.3 allows local users with "SELECT" privileges for a base table to insert, update, or delete data by creating a crafted view then performing the operations on that view.

  • CVE-2006-1706Apr 11, 2006
    Kansok Communications
    Shopweezle
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Shopweezle 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) itemID parameter to (a) login.php and (b) memo.php; and the (2) itemgr, (3) brandID, and (4) album parameters to (c) index.php. NOTE: this issue also…

  • CVE-2006-1707Apr 11, 2006
    Shopweezle
    Shopweezle
    risk 0.00cvss —epss 0.01

    index.php in Shopweezle 2.0 allows remote attackers to include arbitrary local files via the url parameter.

  • CVE-2006-1708Apr 11, 2006
    Clansys
    Clansys
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in member.php in Clansys 1.1 allows remote attackers to execute arbitrary SQL commands via the showid parameter in the member page to index.php.

  • CVE-2006-1709Apr 11, 2006
    Interaktiv
    Interaktiv.shop
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in shop_main.cgi in interaktiv.shop 5 allows remote attackers to inject arbitrary web script or HTML via the (1) pn and (2) sbeg parameters.

  • CVE-2006-1676Apr 11, 2006
    Maxdev
    Mdpro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro (MD-Pro) 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a display action, which is not…

  • CVE-2006-1677Apr 11, 2006
    Maxdev
    Mdpro
    risk 0.00cvss —epss 0.01

    MAXdev MDPro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to obtain the full path of the server via a direct request to includes/legacy.php.

  • CVE-2006-1678Apr 11, 2006
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.8.0.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors in unspecified scripts in the themes directory.

  • CVE-2006-1679Apr 11, 2006
    Jupiter CMS
    Jupiter CMS
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in modules/online.php in Jupiter CMS 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the layout parameter to index.php.

  • CVE-2006-1680Apr 11, 2006
    Jupiter CMS
    Jupiter CMS
    risk 0.00cvss —epss 0.01

    Jupiter CMS 1.1.5, when display_errors is enabled, allows remote attackers to obtain the full server path via a direct request to modules/online.php.

  • CVE-2006-1681Apr 11, 2006
    Cherokee
    Cherokee Httpd
    risk 0.01cvss —epss 0.07

    Cross-site scripting (XSS) vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated.

  • CVE-2006-1682Apr 11, 2006
    Talentsoft
    Web\+ Shop
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in webplus.exe in TalentSoft Web+Shop 5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the deptname parameter, possibly involving the webpshop/ department.wml script.

  • CVE-2006-1683Apr 11, 2006
    Chipmunk Scripts
    guestbook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/login.php in Chipmunk Guestbook allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the User name.

  • CVE-2006-1684Apr 11, 2006
    Powergap
    Shopsystem
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in ecotwo Shopsystem 1.0-192 and earlier allows remote attackers to include arbitrary local files via (1) the lang parameter in news.php and (2) other unspecified vectors.

  • CVE-2006-1685Apr 11, 2006
    Apt
    Apt Webshop System
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in modules.php in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allow remote attackers to execute arbitrary SQL commands via the (1) group, (2) seite, and (3) id parameter, possibly involving the artikel functionality. NOTE: this…

  • CVE-2006-1686Apr 11, 2006
    Apt
    Apt Webshop System
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in modules.php in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allows remote attackers to access unspecified files via a modified warp parameter.

  • CVE-2006-1687Apr 11, 2006
    Apt
    Apt Webshop System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allows remote attackers to inject arbitrary web script or HTML via the message parameter, probably involving the basket functionality.

  • CVE-2006-1688Apr 11, 2006
    Squery
    Squery
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party (ALP), allow remote attackers to execute arbitrary PHP code via a URL in the libpath parameter to scripts in the lib directory including (1) ase.php,…

  • CVE-2006-1689Apr 11, 2006
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in su in HP HP-UX B.11.11, when using the LDAP netgroup feature, allows local users to gain unspecified access.

  • CVE-2006-1549Apr 10, 2006
    PHP
    PHP
    risk 0.03cvss —epss 0.01

    PHP 4.4.2 and 5.1.2 allows local users to cause a crash (segmentation fault) by defining and executing a recursive function. NOTE: it has been reported by a reliable third party that some later versions are also affected.

  • CVE-2006-1522Apr 10, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The sys_add_key function in the keyring code in Linux kernel 2.6.16.1 and 2.6.17-rc1, and possibly earlier versions, allows local users to cause a denial of service (OOPS) via keyctl requests that add a key to a user key instead of a keyring key, which causes an invalid…

  • CVE-2006-1494Apr 10, 2006
    PHP
    PHP
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass open_basedir restrictions allows remote attackers to create files in arbitrary directories via the tempnam function.

  • CVE-2006-1608Apr 10, 2006
    PHP
    PHP
    risk 0.03cvss —epss 0.01

    The copy function in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass safe mode and read arbitrary files via a source argument containing a compress.zlib:// URI.

  • CVE-2006-1674Apr 10, 2006
    Phpwebgallery
    Phpwebgallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in PHPWebGallery 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter, a different vulnerability than CVE-2006-1675.

  • CVE-2006-1675Apr 10, 2006
    Phpwebgallery
    Phpwebgallery
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in PHPWebGallery 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) cat, (2) num, and (3) search parameters to (a) category.php, and the (4) slideshow, (5) show_metadata, and (6) start parameters to…

  • CVE-2006-0053Apr 10, 2006
    Tonycoz
    Imager
    risk 0.04cvss —epss 0.09

    Imager (libimager-perl) before 0.50 allows user-assisted attackers to cause a denial of service (segmentation fault) by writing a 2- or 4-channel JPEG image (or a 2-channel TGA image) to a scalar, which triggers a NULL pointer dereference.

  • CVE-2006-0996Apr 10, 2006
    PHP
    PHP
    risk 0.04cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed.

  • CVE-2006-0951Apr 8, 2006
    Eset
    Nod32 Antivirus
    risk 0.00cvss —epss 0.00

    The GUI (nod32.exe) in NOD32 2.5 runs with SYSTEM privileges when the scheduler runs a scheduled on-demand scan, which allows local users to execute arbitrary code during a scheduled scan via unspecified attack vectors.

  • CVE-2006-1657Apr 7, 2006
    Chucky A. Ivey
    N.t.
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Chucky A. Ivey N.T. 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter, which is not filtered when the administrator views the "Login Log" page.

  • CVE-2006-1658Apr 7, 2006
    Chucky A. Ivey
    N.t.
    risk 0.00cvss —epss 0.02

    Direct static code injection vulnerability in ticker.db.php in Chucky A. Ivey N.T. 1.1.0 allows remote administrators to insert arbitrary PHP code into the config file, which is included other N.T. scripts.

  • CVE-2006-1659Apr 7, 2006
    Softbizscripts
    Image Gallery Script
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Softbiz Image Gallery allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in image_desc.php, (2) provided parameter in template.php, (3) cid parameter in suggest_image.php, (4) img_id parameter in…

  • CVE-2006-1660Apr 7, 2006
    Softbizscripts
    Image Gallery Script
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in image_desc.php in Softbiz Image Gallery allows remote attackers to inject arbitrary web script or HTML via msg parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

  • CVE-2006-1661Apr 7, 2006
    Sk Soft
    Skforum
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in SKForum 1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) areaID parameter in area.View.action, (2) time parameter in planning.View.action, and (3) userID parameter in user.View.action.

  • CVE-2006-1662Apr 7, 2006
    Limbo CMS
    Limbo CMS
    risk 0.03cvss —epss 0.03

    The frontpage option in Limbo CMS 1.0.4.2 and 1.0.4.1 allows remote attackers to execute arbitrary PHP commands via the Itemid parameter in index.php.

  • CVE-2006-1664Apr 7, 2006
    Xine
    Xine Lib
    risk 0.04cvss —epss 0.15

    Buffer overflow in xine_list_delete_current in libxine 1.14 and earlier, as distributed in xine-lib 1.1.1 and earlier, allows remote attackers to execute arbitrary code via a crafted MPEG stream.

  • CVE-2006-1665Apr 7, 2006
    Arab Portal
    Arab Portal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Arab Portal 2.0.1 stable allow remote attackers to inject arbitrary web script or HTML via the (1) adminJump and (2) forum_middle parameters in (a) forum.php, and the (3) form parameter in (b) members.php, (c) pm.php, and…