CVEs

343,710 total · page 6540 of 6,875

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2006-0559	McAfee Webshield SMTP		0.00	—	0.06	Apr 4, 2006	Format string vulnerability in the SMTP server for McAfee WebShield 4.5 MR2 and earlier allows remote attackers to execute arbitrary code via format strings in the domain name portion of a destination address, which are not properly handled when a bounce message is constructed.
CVE-2006-1058	Busybox Busybox	Med	0.36	5.5	0.00	Apr 4, 2006	BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables.
CVE-2006-1601	Sun Corporation Cluster		0.00	—	0.00	Apr 4, 2006	Unspecified vulnerability in SunPlex Manager in Sun Cluster 3.1 4/04 allows local users with solaris.cluster.gui authorization to view arbitrary files via unspecified vectors.
CVE-2006-1602	Phpnuke Clan Phpnuke Clan		0.00	—	0.02	Apr 4, 2006	PHP remote file inclusion vulnerability in includes/functions_common.php in the VWar Account module (vWar_Account) in PHPNuke Clan 3.0.1 allows remote attackers to include arbitrary files via a URL in the vwar_root2 parameter. NOTE: it is possible that this issue stems from a…
CVE-2006-1603	PhpBB phpBB		0.00	—	0.01	Apr 4, 2006	Cross-site scripting (XSS) vulnerability in profile.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via the cur_password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…
CVE-2006-1604	Exponent Exponent CMS		0.00	—	0.02	Apr 4, 2006	Unspecified vulnerability in Exponent CMS before 0.96.5 RC 1 has unknown impact and remote attack vectors related to variables that are not "typecasted."
CVE-2006-1605	Exponent Exponent CMS		0.00	—	0.03	Apr 4, 2006	Unspecified vulnerability in the image module in Exponent CMS before 0.96.5 RC 1 allows remote attackers to execute arbitrary code via unknown vectors involving "parsed PHP."
CVE-2006-1606	Exponent Exponent CMS		0.00	—	0.01	Apr 4, 2006	Unspecified vulnerability in the image module in Exponent CMS before 0.96.5 RC 1 allows "directory disclosure" with unknown attack vectors.
CVE-2006-1607	Exponent Exponent CMS		0.00	—	0.01	Apr 4, 2006	Unspecified vulnerability in the banner module in Exponent CMS before 0.96.5 RC 1 allows "php injection" via unknown attack vectors.
CVE-2006-1609	Hitachi XFIT/S/ZGN		0.00	—	0.02	Apr 4, 2006	Unspecified vulnerability in Hitachi XFIT/S, XFIT/S/JCA, XFIT/S/ZGN, and XFIT/S ZENGIN TCP/IP Procedure allows remote attackers to cause a denial of service (server process and transfer control process stop) when the products "receive data unexpectedly".
CVE-2006-1610	Squery Squery		0.04	—	0.07	Apr 4, 2006	PHP remote file inclusion vulnerability in lib/armygame.php in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party (ALP), allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter. NOTE: this only occurs when register_globals…
CVE-2006-1611	KGB Archiver KGB Archiver		0.00	—	0.02	Apr 4, 2006	Directory traversal vulnerability in KGB Archiver before 1.1.5.22 allows remote attackers to overwrite arbitrary files wile decompressing an archive, possibly due to directory traversal sequences in a filename.
CVE-2006-1612	Aweb Labs Awebnews		0.00	—	0.02	Apr 4, 2006	Multiple cross-site scripting (XSS) vulnerabilities in visview.php in aWebNews 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) yname, (2) emailadd, (3) subject, and (4) comment parameters.
CVE-2006-1613	Aweb Labs Awebnews		0.03	—	0.02	Apr 4, 2006	Multiple SQL injection vulnerabilities in aWebNews 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) user123 variable in (a) login.php or (b) fpass.php; or (2) cid parameter to (c) visview.php.
CVE-2006-1598	An An Httpd		0.00	—	0.02	Apr 3, 2006	AN HTTPD 1.42n, and possibly other versions before 1.42p, allows remote attackers to obtain source code of scripts via crafted requests with (1) dot and (2) space characters in the file extension.
CVE-2006-1599	Vcreator v-creator		0.00	—	0.03	Apr 3, 2006	Unspecified vulnerability in VCEngine.php in v-creator before 1.3-pre3, when the VC_CRYPTO_METHOD option is OPENSSL, allows remote attackers to execute arbitrary commands, possibly due to problems in the (1) encrypt and (2) decrypt functions.
CVE-2006-1600	Phpwebgallery Phpwebgallery		0.00	—	0.01	Apr 3, 2006	SQL injection vulnerability in category.php in PhpWebGallery 1.4.1 allows remote attackers to execute arbitrary SQL commands via the search parameter.
CVE-2006-1433	Annuaire Directory		0.00	—	0.02	Apr 3, 2006	Annuaire (Directory) 1.0 allows remote attackers to obtain sensitive information via a direct request to include/lang-en.php, which reveals the full installation path.
CVE-2006-1434	Annuaire Directory		0.00	—	0.01	Apr 3, 2006	Cross-site scripting (XSS) vulnerability in inscription.php in Annuaire (Directory) 1.0 allows remote attackers to inject arbitrary web script or HTML via the Comment Field (COMMENTAIRE parameter).
CVE-2006-1435	Aria Aria		0.00	—	0.01	Apr 3, 2006	Cross-site scripting (XSS) vulnerability in genmessage.php in Accounting Receiving and Inventory Administration (ARIA) 0.99-6 allows remote attackers to inject arbitrary web script or HTML via the Message Field (message parameter).
CVE-2006-1438	Andy Grayndler Aphpkb		0.00	—	0.01	Apr 3, 2006	Multiple cross-site scripting (XSS) vulnerabilities in Andy's PHP Knowledgebase (aphpkb) 0.57 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword_list parameter to (a) index.php; (2) title, (3) article, (4) author, and (5) keywords parameters to (b)…
CVE-2006-1587	NetBSD NetBSD		0.00	—	0.00	Apr 3, 2006	NetBSD 1.6 up to 3.0, when a user has "set record" in .mailrc with the default umask set, creates the record file with 0644 permissions, which allows local users to read the record file.
CVE-2006-1588	NetBSD NetBSD		0.00	—	0.00	Apr 3, 2006	The bridge ioctl (if_bridge code) in NetBSD 1.6 through 3.0 does not clear sensitive memory before copying ioctl results to the requesting process, which allows local users to obtain portions of kernel memory.
CVE-2006-1589	NetBSD NetBSD		0.00	—	0.00	Apr 3, 2006	The elf_load_file function in NetBSD 2.0 through 3.0 allows local users to cause a denial of service (kernel crash) via an ELF interpreter that does not have a PT_LOAD section in its header, which triggers a null dereference.
CVE-2006-1590	Secureideas Basic Analysis And Security Engine		0.03	—	0.04	Apr 3, 2006	Cross-site scripting (XSS) vulnerability in the PrintFreshPage function in (1) Basic Analysis and Security Engine (BASE) 1.2.4 and (2) Analysis Console for Intrusion Databases (ACID) 0.9.6b23 allows remote attackers to inject arbitrary web script or HTML via the (a) back…
CVE-2006-1591	Microsoft Windows Help		0.01	—	0.07	Apr 3, 2006	Heap-based buffer overflow in Microsoft Windows Help winhlp32.exe allows user-assisted attackers to execute arbitrary code via crafted embedded image data in a .hlp file.
CVE-2006-1592	Zdaemon Zdaemon		0.00	—	0.05	Apr 3, 2006	Buffer overflow in the is_client_wad_ok function in w_wad.cpp for (1) Zdaemon 1.08.01 and (2) X-Doom allows remote attackers to execute arbitrary code via a long filename argument.
CVE-2006-1593	Zdaemon Zdaemon		0.03	—	0.05	Apr 3, 2006	The (1) ZD_MissingPlayer, (2) ZD_UseItem, and (3) ZD_LoadNewClientLevel functions in sv_main.cpp for (a) Zdaemon 1.08.01 and (b) X-Doom allows remote attackers to cause a denial of service (crash) via an invalid player slot or item number, which causes an invalid memory access,…
CVE-2006-1594	Claroline Claroline		0.00	—	0.05	Apr 3, 2006	Multiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and earlier allow remote attackers to use ".." (dot dot) sequences to (1) read arbitrary files via the file parameter in a rqEditHtml command to document/rqmkhtml.php or (2) execute…
CVE-2006-1595	Claroline Claroline		0.03	—	0.05	Apr 3, 2006	Cross-site scripting (XSS) vulnerability in document/rqmkhtml.php in Claroline 1.7.4 and earlier allows remote attackers to read arbitrary files via ".." sequences in the file parameter in a rqEditHtml command.
CVE-2006-1596	Claroline Claroline		0.00	—	0.02	Apr 3, 2006	PHP remote file inclusion vulnerability in learnPath/include/scormExport.inc.php in Claroline 1.7.4 and earlier allows remote attackers to execute arbitrary PHP code via the includePath parameter.
CVE-2006-1575	Vscripts.pl Qlnews		0.00	—	0.01	Apr 2, 2006	Multiple cross-site scripting (XSS) vulnerabilities in news.php in QLnews 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) autorx and (2) newsx parameters.
CVE-2006-1576	QLnews QLnews		0.00	—	0.02	Apr 2, 2006	Direct static code injection vulnerability in QLnews 1.2 allows remote authenticated administrators to execute arbitrary PHP code by modifying config.php.
CVE-2006-1577	Mantisbt Mantis		0.00	—	0.02	Apr 2, 2006	Multiple cross-site scripting (XSS) vulnerabilities in view_all_set.php in Mantis 1.0.1, 1.0.0rc5, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) start_day, (2) start_year, and (3) start_month parameters.
CVE-2006-1578	Index Data Aps Keystone Digital Library Suite		0.00	—	0.01	Apr 2, 2006	Multiple SQL injection vulnerabilities in Keystone Digital Library Suite (DLS) 1.5.4 and earlier allow remote attackers to execute arbitrary SQL commands via the subject_type_id parameter in (1) the index page and (2) the search module.
CVE-2006-1579	Dbbs Dbbs		0.03	—	0.01	Apr 2, 2006	SQL injection vulnerability in topics.php in Dynamic Bulletin Board System (DbbS) 2.0-alpha and earlier allows remote attackers to execute arbitrary SQL commands via the limite parameter.
CVE-2006-1580	Websina Bugzero		0.03	—	0.02	Apr 2, 2006	Multiple cross-site scripting (XSS) vulnerabilities in Bugzero 4.3.1 and other versions allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter in query.jsp and (2) entryId parameter in edit.jsp.
CVE-2006-1581	Blanknberg Blanknberg		0.03	—	0.03	Apr 2, 2006	Directory traversal vulnerability in index.php in Blank'N'Berg 0.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the _path parameter.
CVE-2006-1582	Blanknberg Blanknberg		0.03	—	0.02	Apr 2, 2006	Cross-site scripting (XSS) vulnerability in index.php in Blank'N'Berg 0.2 allows remote attackers to inject arbitrary web script or HTML via the _path parameter. NOTE: this might be resultant from the directory traversal issue.
CVE-2006-1583	Warcraft III Replay Parser for PHP Warcraft III Replay Parser for PHP		0.00	—	0.01	Apr 2, 2006	Cross-site scripting (XSS) vulnerability in index.php in Warcraft III Replay Parser for PHP 1.8c allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: post-disclosure analysis by CVE suggests that the "page" parameter is not used in this…
CVE-2006-1584	Warcraft III Replay Parser for PHP Warcraft III Replay Parser for PHP		0.03	—	0.06	Apr 2, 2006	Unspecified vulnerability in index.php in Warcraft III Replay Parser for PHP 1.8c allows remote attackers to inject arbitrary web script or HTML via the page parameter, possibly related to fopen function calls or file uploads. NOTE: post-disclosure analysis by CVE suggests that…
CVE-2006-1585	3dsrc Monalbum		0.00	—	0.01	Apr 2, 2006	Multiple SQL injection vulnerabilities in MonAlbum 0.8.7 allow remote attackers to execute arbitrary SQL commands via (1) the pc parameter in (a) index.php and (2) pnom, (3) pcourriel, and (4) pcommentaire parameters in (b) image_agrandir.php.
CVE-2006-1586	ISP of Egypt SiteMan		0.03	—	0.01	Apr 2, 2006	SQL injection vulnerability in admin_login.asp in ISP of Egypt SiteMan allows remote attackers to execute arbitrary SQL commands via the pass parameter.
CVE-2006-1567	Sitesearch Indexer		0.03	—	0.02	Apr 1, 2006	Cross-site scripting (XSS) vulnerability in searchresults.asp in SiteSearch Indexer 3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchField parameter.
CVE-2006-1568	Redcms Redcms		0.03	—	0.02	Apr 1, 2006	Multiple cross-site scripting (XSS) vulnerabilities in register.php in RedCMS 0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) email, (2) location, or (3) website parameters.
CVE-2006-1569	Redcms Redcms		0.03	—	0.02	Apr 1, 2006	Multiple SQL injection vulnerabilities in RedCMS 0.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters to (a) login.php or (b) register.php; or (3) u parameter to (c) profile.php.
CVE-2006-1570	Esqlanelapse Esqlanelapse		0.00	—	0.01	Apr 1, 2006	Cross-site scripting (XSS) vulnerability in Esqlanelapse 2.0 and 2.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVE-2006-1571	qliteNews qliteNews		0.00	—	0.01	Apr 1, 2006	Multiple SQL injection vulnerabilities in loginprocess.php in qliteNews 2005.07.01 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.
CVE-2006-1572	Oxygen Oxygen		0.03	—	0.01	Apr 1, 2006	SQL injection vulnerability in post.php in Oxygen 1.1.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter in a newthread action.
CVE-2006-1573	Mediaslash.com Mediaslash Gallery		0.03	—	0.03	Apr 1, 2006	PHP remote file inclusion vulnerability in index.php in MediaSlash Gallery allows remote attackers to execute arbitrary PHP code via a URL in the rub parameter (part of the $page_menu variable).

CVE-2006-0559Apr 4, 2006
McAfee
Webshield SMTP
risk 0.00cvss —epss 0.06
Format string vulnerability in the SMTP server for McAfee WebShield 4.5 MR2 and earlier allows remote attackers to execute arbitrary code via format strings in the domain name portion of a destination address, which are not properly handled when a bounce message is constructed.
CVE-2006-1058MedApr 4, 2006
Busybox
Busybox
risk 0.36cvss 5.5epss 0.00
BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables.
CVE-2006-1601Apr 4, 2006
Sun Corporation
Cluster
risk 0.00cvss —epss 0.00
Unspecified vulnerability in SunPlex Manager in Sun Cluster 3.1 4/04 allows local users with solaris.cluster.gui authorization to view arbitrary files via unspecified vectors.
CVE-2006-1602Apr 4, 2006
Phpnuke Clan
Phpnuke Clan
risk 0.00cvss —epss 0.02
PHP remote file inclusion vulnerability in includes/functions_common.php in the VWar Account module (vWar_Account) in PHPNuke Clan 3.0.1 allows remote attackers to include arbitrary files via a URL in the vwar_root2 parameter. NOTE: it is possible that this issue stems from a…
CVE-2006-1603Apr 4, 2006
PhpBB
phpBB
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in profile.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via the cur_password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…
CVE-2006-1604Apr 4, 2006
Exponent
Exponent CMS
risk 0.00cvss —epss 0.02
Unspecified vulnerability in Exponent CMS before 0.96.5 RC 1 has unknown impact and remote attack vectors related to variables that are not "typecasted."
CVE-2006-1605Apr 4, 2006
Exponent
Exponent CMS
risk 0.00cvss —epss 0.03
Unspecified vulnerability in the image module in Exponent CMS before 0.96.5 RC 1 allows remote attackers to execute arbitrary code via unknown vectors involving "parsed PHP."
CVE-2006-1606Apr 4, 2006
Exponent
Exponent CMS
risk 0.00cvss —epss 0.01
Unspecified vulnerability in the image module in Exponent CMS before 0.96.5 RC 1 allows "directory disclosure" with unknown attack vectors.
CVE-2006-1607Apr 4, 2006
Exponent
Exponent CMS
risk 0.00cvss —epss 0.01
Unspecified vulnerability in the banner module in Exponent CMS before 0.96.5 RC 1 allows "php injection" via unknown attack vectors.
CVE-2006-1609Apr 4, 2006
Hitachi
XFIT/S/ZGN
risk 0.00cvss —epss 0.02
Unspecified vulnerability in Hitachi XFIT/S, XFIT/S/JCA, XFIT/S/ZGN, and XFIT/S ZENGIN TCP/IP Procedure allows remote attackers to cause a denial of service (server process and transfer control process stop) when the products "receive data unexpectedly".
CVE-2006-1610Apr 4, 2006
Squery
Squery
risk 0.04cvss —epss 0.07
PHP remote file inclusion vulnerability in lib/armygame.php in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party (ALP), allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter. NOTE: this only occurs when register_globals…
CVE-2006-1611Apr 4, 2006
KGB Archiver
KGB Archiver
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in KGB Archiver before 1.1.5.22 allows remote attackers to overwrite arbitrary files wile decompressing an archive, possibly due to directory traversal sequences in a filename.
CVE-2006-1612Apr 4, 2006
Aweb Labs
Awebnews
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in visview.php in aWebNews 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) yname, (2) emailadd, (3) subject, and (4) comment parameters.
CVE-2006-1613Apr 4, 2006
Aweb Labs
Awebnews
risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in aWebNews 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) user123 variable in (a) login.php or (b) fpass.php; or (2) cid parameter to (c) visview.php.
CVE-2006-1598Apr 3, 2006
An
An Httpd
risk 0.00cvss —epss 0.02
AN HTTPD 1.42n, and possibly other versions before 1.42p, allows remote attackers to obtain source code of scripts via crafted requests with (1) dot and (2) space characters in the file extension.
CVE-2006-1599Apr 3, 2006
Vcreator
v-creator
risk 0.00cvss —epss 0.03
Unspecified vulnerability in VCEngine.php in v-creator before 1.3-pre3, when the VC_CRYPTO_METHOD option is OPENSSL, allows remote attackers to execute arbitrary commands, possibly due to problems in the (1) encrypt and (2) decrypt functions.
CVE-2006-1600Apr 3, 2006
Phpwebgallery
Phpwebgallery
risk 0.00cvss —epss 0.01
SQL injection vulnerability in category.php in PhpWebGallery 1.4.1 allows remote attackers to execute arbitrary SQL commands via the search parameter.
CVE-2006-1433Apr 3, 2006
Annuaire
Directory
risk 0.00cvss —epss 0.02
Annuaire (Directory) 1.0 allows remote attackers to obtain sensitive information via a direct request to include/lang-en.php, which reveals the full installation path.
CVE-2006-1434Apr 3, 2006
Annuaire
Directory
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in inscription.php in Annuaire (Directory) 1.0 allows remote attackers to inject arbitrary web script or HTML via the Comment Field (COMMENTAIRE parameter).
CVE-2006-1435Apr 3, 2006
Aria
Aria
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in genmessage.php in Accounting Receiving and Inventory Administration (ARIA) 0.99-6 allows remote attackers to inject arbitrary web script or HTML via the Message Field (message parameter).
CVE-2006-1438Apr 3, 2006
Andy Grayndler
Aphpkb
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Andy's PHP Knowledgebase (aphpkb) 0.57 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword_list parameter to (a) index.php; (2) title, (3) article, (4) author, and (5) keywords parameters to (b)…
CVE-2006-1587Apr 3, 2006
NetBSD
NetBSD
risk 0.00cvss —epss 0.00
NetBSD 1.6 up to 3.0, when a user has "set record" in .mailrc with the default umask set, creates the record file with 0644 permissions, which allows local users to read the record file.
CVE-2006-1588Apr 3, 2006
NetBSD
NetBSD
risk 0.00cvss —epss 0.00
The bridge ioctl (if_bridge code) in NetBSD 1.6 through 3.0 does not clear sensitive memory before copying ioctl results to the requesting process, which allows local users to obtain portions of kernel memory.
CVE-2006-1589Apr 3, 2006
NetBSD
NetBSD
risk 0.00cvss —epss 0.00
The elf_load_file function in NetBSD 2.0 through 3.0 allows local users to cause a denial of service (kernel crash) via an ELF interpreter that does not have a PT_LOAD section in its header, which triggers a null dereference.
CVE-2006-1590Apr 3, 2006
Secureideas
Basic Analysis And Security Engine
risk 0.03cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in the PrintFreshPage function in (1) Basic Analysis and Security Engine (BASE) 1.2.4 and (2) Analysis Console for Intrusion Databases (ACID) 0.9.6b23 allows remote attackers to inject arbitrary web script or HTML via the (a) back…
CVE-2006-1591Apr 3, 2006
Microsoft
Windows Help
risk 0.01cvss —epss 0.07
Heap-based buffer overflow in Microsoft Windows Help winhlp32.exe allows user-assisted attackers to execute arbitrary code via crafted embedded image data in a .hlp file.
CVE-2006-1592Apr 3, 2006
Zdaemon
Zdaemon
risk 0.00cvss —epss 0.05
Buffer overflow in the is_client_wad_ok function in w_wad.cpp for (1) Zdaemon 1.08.01 and (2) X-Doom allows remote attackers to execute arbitrary code via a long filename argument.
CVE-2006-1593Apr 3, 2006
Zdaemon
Zdaemon
risk 0.03cvss —epss 0.05
The (1) ZD_MissingPlayer, (2) ZD_UseItem, and (3) ZD_LoadNewClientLevel functions in sv_main.cpp for (a) Zdaemon 1.08.01 and (b) X-Doom allows remote attackers to cause a denial of service (crash) via an invalid player slot or item number, which causes an invalid memory access,…
CVE-2006-1594Apr 3, 2006
Claroline
Claroline
risk 0.00cvss —epss 0.05
Multiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and earlier allow remote attackers to use ".." (dot dot) sequences to (1) read arbitrary files via the file parameter in a rqEditHtml command to document/rqmkhtml.php or (2) execute…
CVE-2006-1595Apr 3, 2006
Claroline
Claroline
risk 0.03cvss —epss 0.05
Cross-site scripting (XSS) vulnerability in document/rqmkhtml.php in Claroline 1.7.4 and earlier allows remote attackers to read arbitrary files via ".." sequences in the file parameter in a rqEditHtml command.
CVE-2006-1596Apr 3, 2006
Claroline
Claroline
risk 0.00cvss —epss 0.02
PHP remote file inclusion vulnerability in learnPath/include/scormExport.inc.php in Claroline 1.7.4 and earlier allows remote attackers to execute arbitrary PHP code via the includePath parameter.
CVE-2006-1575Apr 2, 2006
Vscripts.pl
Qlnews
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in news.php in QLnews 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) autorx and (2) newsx parameters.
CVE-2006-1576Apr 2, 2006
QLnews
QLnews
risk 0.00cvss —epss 0.02
Direct static code injection vulnerability in QLnews 1.2 allows remote authenticated administrators to execute arbitrary PHP code by modifying config.php.
CVE-2006-1577Apr 2, 2006
Mantisbt
Mantis
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in view_all_set.php in Mantis 1.0.1, 1.0.0rc5, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) start_day, (2) start_year, and (3) start_month parameters.
CVE-2006-1578Apr 2, 2006
Index Data Aps
Keystone Digital Library Suite
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in Keystone Digital Library Suite (DLS) 1.5.4 and earlier allow remote attackers to execute arbitrary SQL commands via the subject_type_id parameter in (1) the index page and (2) the search module.
CVE-2006-1579Apr 2, 2006
Dbbs
Dbbs
risk 0.03cvss —epss 0.01
SQL injection vulnerability in topics.php in Dynamic Bulletin Board System (DbbS) 2.0-alpha and earlier allows remote attackers to execute arbitrary SQL commands via the limite parameter.
CVE-2006-1580Apr 2, 2006
Websina
Bugzero
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Bugzero 4.3.1 and other versions allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter in query.jsp and (2) entryId parameter in edit.jsp.
CVE-2006-1581Apr 2, 2006
Blanknberg
Blanknberg
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in index.php in Blank'N'Berg 0.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the _path parameter.
CVE-2006-1582Apr 2, 2006
Blanknberg
Blanknberg
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in index.php in Blank'N'Berg 0.2 allows remote attackers to inject arbitrary web script or HTML via the _path parameter. NOTE: this might be resultant from the directory traversal issue.
CVE-2006-1583Apr 2, 2006
Warcraft III Replay Parser for PHP
Warcraft III Replay Parser for PHP
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in index.php in Warcraft III Replay Parser for PHP 1.8c allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: post-disclosure analysis by CVE suggests that the "page" parameter is not used in this…
CVE-2006-1584Apr 2, 2006
Warcraft III Replay Parser for PHP
Warcraft III Replay Parser for PHP
risk 0.03cvss —epss 0.06
Unspecified vulnerability in index.php in Warcraft III Replay Parser for PHP 1.8c allows remote attackers to inject arbitrary web script or HTML via the page parameter, possibly related to fopen function calls or file uploads. NOTE: post-disclosure analysis by CVE suggests that…
CVE-2006-1585Apr 2, 2006
3dsrc
Monalbum
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in MonAlbum 0.8.7 allow remote attackers to execute arbitrary SQL commands via (1) the pc parameter in (a) index.php and (2) pnom, (3) pcourriel, and (4) pcommentaire parameters in (b) image_agrandir.php.
CVE-2006-1586Apr 2, 2006
ISP of Egypt
SiteMan
risk 0.03cvss —epss 0.01
SQL injection vulnerability in admin_login.asp in ISP of Egypt SiteMan allows remote attackers to execute arbitrary SQL commands via the pass parameter.
CVE-2006-1567Apr 1, 2006
Sitesearch
Indexer
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in searchresults.asp in SiteSearch Indexer 3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchField parameter.
CVE-2006-1568Apr 1, 2006
Redcms
Redcms
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in register.php in RedCMS 0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) email, (2) location, or (3) website parameters.
CVE-2006-1569Apr 1, 2006
Redcms
Redcms
risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in RedCMS 0.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters to (a) login.php or (b) register.php; or (3) u parameter to (c) profile.php.
CVE-2006-1570Apr 1, 2006
Esqlanelapse
Esqlanelapse
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Esqlanelapse 2.0 and 2.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVE-2006-1571Apr 1, 2006
qliteNews
qliteNews
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in loginprocess.php in qliteNews 2005.07.01 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.
CVE-2006-1572Apr 1, 2006
Oxygen
Oxygen
risk 0.03cvss —epss 0.01
SQL injection vulnerability in post.php in Oxygen 1.1.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter in a newthread action.
CVE-2006-1573Apr 1, 2006
Mediaslash.com
Mediaslash Gallery
risk 0.03cvss —epss 0.03
PHP remote file inclusion vulnerability in index.php in MediaSlash Gallery allows remote attackers to execute arbitrary PHP code via a URL in the rub parameter (part of the $page_menu variable).