VYPR

CVEs

343,710 total · page 6539 of 6,875

AllCriticalHighKEV
  • CVE-2006-1666Apr 7, 2006
    Arab Portal
    Arab Portal
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in forum.php in Arab Portal 2.0.1 stable allows remote attackers to execute arbitrary SQL commands via the mineID parameter.

  • CVE-2006-1667Apr 7, 2006
    Crafty Syntax Image Gallery
    Crafty Syntax Image Gallery
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in slides.php in Eric Gerdes Crafty Syntax Image Gallery (CSIG) (aka PHP thumbnail Photo Gallery) 3.1g and earlier allows remote authenticated users to execute arbitrary SQL commands via the limitquery_s parameter when the $projectid variable is less…

  • CVE-2006-1668Apr 7, 2006
    Crafty Syntax Image Gallery
    Crafty Syntax Image Gallery
    risk 0.03cvss —epss 0.04

    newimage.php in Eric Gerdes Crafty Syntax Image Gallery (CSIG) (aka PHP thumbnail Photo Gallery) 3.1g and earlier allows remote authenticated users to upload and execute arbitrary PHP code via a multipart/form-data POST with a .jpg filename in the fullimage parameter and the ext…

  • CVE-2006-1669Apr 7, 2006
    Phpheaven
    Phpmychat
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in chat/messagesL.php3 in phpHeaven Team PHPMyChat 0.14.5 and earlier allows remote attackers to execute arbitrary SQL commands via the T parameter. NOTE: this issue can be leveraged to execute arbitrary shell commands since the username is later…

  • CVE-2006-1670Apr 7, 2006
    Cisco Systems, Inc.
    Optical Networking Systems Software
    risk 0.00cvss —epss 0.02

    Control cards for Cisco Optical Networking System (ONS) 15000 series nodes before 20060405 allow remote attackers to cause a denial of service (memory exhaustion and possibly card reset) by sending an invalid response when the final ACK is expected, aka bug ID CSCei45910.

  • CVE-2006-1671Apr 7, 2006
    Cisco Systems, Inc.
    Optical Networking Systems Software
    risk 0.00cvss —epss 0.02

    Control cards for Cisco Optical Networking System (ONS) 15000 series nodes before 20060405 allow remote attackers to cause a denial of service (card reset) via (1) a "crafted" IP packet to a device with secure mode EMS-to-network-element access, aka bug ID CSCsc51390; (2) a…

  • CVE-2006-1672Apr 7, 2006
    Cisco Systems, Inc.
    Transport Controller
    risk 0.00cvss —epss 0.04

    The installation of Cisco Transport Controller (CTC) for Cisco Optical Networking System (ONS) 15000 series nodes adds a Java policy file entry with a wildcard that grants the java.security.AllPermission permission to any http URL containing "fs/LAUNCHER.jar", which allows…

  • CVE-2006-1673Apr 7, 2006
    Jelsoft
    Vbug Tracker
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in vbugs.php in Dark_Wizard vBug Tracker 3.5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the sortorder parameter.

  • CVE-2006-1614Apr 6, 2006
    ClamAV
    Clamav
    risk 0.01cvss —epss 0.08

    Integer overflow in the cli_scanpe function in the PE header parser (libclamav/pe.c) in Clam AntiVirus (ClamAV) before 0.88.1, when ArchiveMaxFileSize is disabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code.

  • CVE-2006-1615Apr 6, 2006
    ClamAV
    Clamav
    risk 0.01cvss —epss 0.11

    Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are…

  • CVE-2006-1629Apr 6, 2006
    OpenVPN
    OpenVPN
    risk 0.00cvss —epss 0.03

    OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD_PRELOAD environment variable.

  • CVE-2006-1630Apr 6, 2006
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.05

    The cli_bitset_set function in libclamav/others.c in Clam AntiVirus (ClamAV) before 0.88.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger an "invalid memory access."

  • CVE-2006-1634Apr 6, 2006
    Lucidcms
    Lucidcms
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in LucidCMS 2.0.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the command parameter.

  • CVE-2006-1635Apr 6, 2006
    Lucidcms
    Lucidcms
    risk 0.00cvss —epss 0.01

    LucidCMS 2.0.0 RC4 allows remote attackers to obtain sensitive information via a direct request to /lucid_phplib/translator.php, which reveals the path in an error message.

  • CVE-2006-1636Apr 6, 2006
    Vwar
    VWar
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in get_header.php in VWar 1.5.0 R12 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter. NOTE: this is a different vulnerability than CVE-2006-1503.

  • CVE-2006-1637Apr 6, 2006
    AWebBB
    aWebBB
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in aWebBB 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) tname or (2) fpost parameters to (a) post.php; (3) fullname, (4) emailadd, (5) country, (6) sig, or (7) otherav parameters to (b)…

  • CVE-2006-1638Apr 6, 2006
    Aweb Labs
    Awebbb
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in aWebBB 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) Username parameter to (a) accounts.php, (b) changep.php, (c) editac.php, (d) feedback.php, (e) fpass.php, (f) login.php, (g) post.php, (h) reply.php, or (i)…

  • CVE-2006-1639Apr 6, 2006
    Wire Plastik Design
    Wpblog
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in index.php in wpBlog 0.4 allows remote attackers to execute arbitrary SQL commands via the postid parameter.

  • CVE-2006-1640Apr 6, 2006
    Czaries Network
    Czarnews
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in news.php in CzarNews 1.14 allows remote attackers to inject arbitrary web script or HTML via the email parameter.

  • CVE-2006-1641Apr 6, 2006
    Czaries Network
    Czarnews
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in CzarNews 1.14 allow remote attackers to execute arbitrary SQL commands via the (1) usern or (2) passw parameters to (a) cn_auth.php, (3) s parameter to (b) news.php, or (4) a parameter to (c) dpost.php.

  • CVE-2006-1642Apr 6, 2006
    Interact
    Interact
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Interact 2.1.1 allows remote attackers to inject arbitrary web script or HTML via (1) the search_terms parameter to (a) search.php, and (2) the first_name, (3) last_name, (4) email, (5) password, and (6) confirm_password parameters to…

  • CVE-2006-1643Apr 6, 2006
    Interact
    Interact
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in login.php in Interact 2.1.1 allows remote attackers to execute arbitrary SQL commands via the user_name parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party.

  • CVE-2006-1644Apr 6, 2006
    Interact
    Interact
    risk 0.00cvss —epss 0.01

    login.php in Interact 2.1.1 generates different responses depending on whether or not a username is valid, which allows remote attackers to determine valid usernames. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-1645Apr 6, 2006
    Reloadcms
    Reloadcms
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Anton Vlasov and Rostislav Gaitkuloff ReloadCMS 1.2.5 and earlier allows remote attackers to inject arbitrary web script or HTML and gain leverage to execute arbitrary PHP code via the User-Agent HTTP header, which is displayed by…

  • CVE-2006-1646Apr 6, 2006
    Internet Key Exchange
    Internet Key Exchange
    risk 0.00cvss —epss 0.02

    The Internet Key Exchange version 1 (IKEv1) implementation (isakmp_agg.c) in the Shoichi Sakane KAME Project racoon, as used by NetBSD 1.6, 2.x before 20060119, certain FreeBSD releases, and possibly other distributions of BSD or Linux operating systems, when running in…

  • CVE-2006-1647Apr 6, 2006
    SMART Technologies
    Synchroneyes
    risk 0.00cvss —epss 0.02

    An unspecified "logical programming mistake" in SMART SynchronEyes Student and Teacher 6.0, and possibly earlier versions, allows remote attackers to cause a denial of service via a large packet to the Teacher discovery port (UDP port 5496), which causes a thread to terminate…

  • CVE-2006-1648Apr 6, 2006
    SMART Technologies
    Synchroneyes
    risk 0.00cvss —epss 0.02

    SMART SynchronEyes Student and Teacher 6.0, and possibly earlier versions, allows remote attackers to cause a denial of service (memory consumption) via a certain packet to the Teacher discovery port that causes SynchronEyes to connect to the attacker's machine and read a value…

  • CVE-2006-1649Apr 6, 2006
    Eset
    Nod32
    risk 0.00cvss —epss 0.00

    The "restore to" selection in the "quarantine a file" capability of ESET NOD32 before 2.51.26 allows a restore to any directory that permits read access by the invoking user, which allows local users to create new files despite write-access directory permissions.

  • CVE-2006-1650Apr 6, 2006
    Firefox
    Firefox
    risk 0.00cvss —epss 0.01

    Firefox 1.5.0.1 allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. …

  • CVE-2006-1651Apr 6, 2006
    Microsoft
    Isa Server
    risk 0.01cvss —epss 0.15

    Microsoft ISA Server 2004 allows remote attackers to bypass certain filtering rules, including ones for (1) ICMP and (2) TCP, via IPv6 packets. NOTE: An established researcher has disputed this issue, saying that "Neither ISA Server 2004 nor Windows 2003 Basic Firewall support…

  • CVE-2006-1652Apr 6, 2006
    Ultravnc
    Ultravnc
    risk 0.08cvss —epss 0.67

    Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-assisted remote attackers to execute arbitrary code via a malicious server that sends a long string to a client that connects on TCP port 5900, which triggers an…

  • CVE-2006-1653Apr 6, 2006
    Angelinecms
    Angelinecms
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in loadkernel.php in AngelineCMS 0.8.1 allows remote attackers to execute arbitrary PHP code via a URL in the installPath parameter.

  • CVE-2006-1654Apr 6, 2006
    Microfocus
    Color Laserjet 4600
    risk 0.03cvss —epss 0.05

    Directory traversal vulnerability in the HP Color LaserJet 2500 Toolbox and Color LaserJet 4600 Toolbox on Microsoft Windows before 20060402 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 5225.

  • CVE-2006-1655Apr 6, 2006
    risk 0.00cvss —epss 0.02

    Multiple buffer overflows in mpg123 0.59r allow user-assisted attackers to trigger a segmentation fault and possibly have other impacts via a certain MP3 file, as demonstrated by mpg1DoS3. NOTE: this issue might be related to CVE-2004-0991, but it is not clear.

  • CVE-2006-1656Apr 6, 2006
    Vserver
    Util Vserver
    risk 0.00cvss —epss 0.00

    vserver in util-vserver 0.30.209 executes a command as root when the suexec userid parameter is invalid and non-numeric, which might cause local users to inadvertently execute dangerous commands as root.

  • CVE-2006-1631Apr 5, 2006
    Cisco Systems, Inc.
    Content Services Switch 11500
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the HTTP compression functionality in Cisco CSS 11500 Series Content Services switches allows remote attackers to cause a denial of service (device reload) via (1) "valid, but obsolete" or (2) "specially crafted" HTTP requests.

  • CVE-2006-1055Apr 5, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The fill_write_buffer function in sysfs/file.c in Linux kernel 2.6.12 up to versions before 2.6.17-rc1 does not zero terminate a buffer when a length of PAGE_SIZE or more is requested, which might allow local users to cause a denial of service (crash) by causing an out-of-bounds…

  • CVE-2006-0051Apr 5, 2006
    Kaffeine
    Kaffeine Player
    risk 0.00cvss —epss 0.03

    Buffer overflow in playlistimport.cpp in Kaffeine Player 0.4.2 through 0.7.1 allows user-assisted attackers to execute arbitrary code via long HTTP request headers when Kaffeine is "fetching remote playlists", which triggers the overflow in the http_peek function.

  • CVE-2006-0401Apr 5, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Mac OS X before 10.4.6, when running on an Intel-based computer, allows attackers with physical access to bypass the firmware password and log on in Single User Mode via unspecified vectors.

  • CVE-2006-1616Apr 5, 2006
    Advanced Poll
    Advanced Poll
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Advanced Poll 2.02 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to comments.php or (2) poll_id parameter to page.php.

  • CVE-2006-1617Apr 5, 2006
    Advanced Poll
    Advanced Poll
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Advanced Poll 2.02 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to comments.php or (2) poll_id parameter to page.php. NOTE: it is possible that this issue is resultant from…

  • CVE-2006-1618Apr 5, 2006
    Doomsday
    Doomsday
    risk 0.04cvss —epss 0.13

    Format string vulnerability in the (1) Con_message and (2) conPrintf functions in con_main.c in Doomsday engine 1.8.6 allows remote attackers to execute arbitrary code via format string specifiers in an argument to the JOIN command, and possibly other command arguments.

  • CVE-2006-1619Apr 5, 2006
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    IBM WebSphere Application Server 4.0.1 through 4.0.3 allows remote attackers to cause a denial of service (application crash) via an HTTP request with a large header.

  • CVE-2006-1620Apr 5, 2006
    Hosting Controller
    Hosting Controller
    risk 0.00cvss —epss 0.02

    admin/accounts/AccountActions.asp in Hosting Controller 2002 RC 1 allows remote attackers to modify passwords of other users, probably via an "Update User" ActionType with a modified UserName parameter and the PassCheck parameter set to TRUE. It was later reported that the…

  • CVE-2006-1621Apr 5, 2006
    Hosting Controller
    Hosting Controller
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in admin/folders/saveuploadfiles.asp in Hosting Controller 2002 RC 1 allows remote authenticated users to overwrite arbitrary files via an absolute path in the OpenPath parameter.

  • CVE-2006-1622Apr 5, 2006
    Phpselect
    Phpselect
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in PHPSelect linksubmit allows remote attackers to inject arbitrary web script or HTML via (1) the description parameter to linklist.php and possibly other vectors involving (2) index.php and (3) linksubmit.php.

  • CVE-2006-1623Apr 5, 2006
    Andries Bruinsma
    Flexible Development
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in main.php in an unspecified "file created by Andries Bruinsma," possibly a FleXiBle Development (FXB) application, allows remote attackers to include and execute arbitrary PHP code. NOTE: this disclosure is extremely vague and has very little…

  • CVE-2006-1624Apr 5, 2006
    Sysklogd Project
    Sysklogd
    risk 0.00cvss —epss 0.03

    The default configuration of syslogd in the Linux sysklogd package does not enable the -x (disable name lookups) option, which allows remote attackers to cause a denial of service (traffic amplification) via messages with spoofed source IP addresses.

  • CVE-2006-1625Apr 5, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.10 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a BBCode email tag, as demonstrated using the onmousemove event.

  • CVE-2006-1626Apr 5, 2006
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.25

    Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash…