CVEs

343,326 total · page 6541 of 6,867

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2006-1096	Digital Builder Nz Ecommerce		0.00	—	0.01	Mar 9, 2006	Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this…
CVE-2006-1097	Woltlab Datenbank MOD		0.00	—	0.01	Mar 9, 2006	Multiple cross-site scripting (XSS) vulnerabilities in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allow remote attackers to inject arbitrary web script or HTML via the fileid parameter to (1) info_db.php or (2) database.php.
CVE-2006-1098	Digital Builder Nz Ecommerce		0.03	—	0.01	Mar 9, 2006	Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the (1) informationID or (2) ParentCategory parameter to index.php. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by…
CVE-2006-1099	Logit Logit		0.03	—	0.02	Mar 9, 2006	PHP remote file include vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2006-1100	Sauerbraten Cube		0.04	—	0.08	Mar 9, 2006	Buffer overflow in the sgetstr function in shared/cube.h in Sauerbraten 2006_02_28 and earlier, as derived from the Cube engine, allows remote attackers to execute arbitrary code via long streams of input data.
CVE-2006-1101	Sauerbraten Cube		0.03	—	0.05	Mar 9, 2006	The (1) sgetstr and (2) getint functions in Sauerbraten 2006_02_28, as derived from the Cube engine, allow remote attackers to cause a denial of service (segmentation fault) via long streams of input data that trigger an out-of-bounds read, as demonstrated using SV_EXT tag data…
CVE-2006-1102	Sauerbraten Cube		0.03	—	0.05	Mar 9, 2006	Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (client exit) by forcing the server to change to a map (ogz) file whose name contains ".." sequences and has a certain length that prevents the addition of the ".ogz"…
CVE-2006-1103	Sauerbraten Cube		0.04	—	0.07	Mar 9, 2006	engine/server.cpp in Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (segmentation fault) via a client that does not completely join the game and times out, which results in a null pointer dereference.
CVE-2006-1104	Pixelpost Pixelpost		0.00	—	0.01	Mar 9, 2006	Multiple SQL injection vulnerabilities in Pixelpost 1.5 beta 1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the showimage parameter in index.php; and the (2) USER_AGENT, (3) HTTP_REFERER, and (4) HTTP_HOST HTTP header fields as used in the…
CVE-2006-1105	Pixelpost Pixelpost		0.00	—	0.02	Mar 9, 2006	Pixelpost 1.5 beta 1 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the…
CVE-2006-1106	Pixelpost Pixelpost		0.00	—	0.02	Mar 9, 2006	Cross-site scripting (XSS) vulnerability in Pixelpost 1.5 beta 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) message, (2) name, (3) url, and (4) email parameters when commenting on a post. NOTE: the vendor has disputed some issues from…
CVE-2006-1107	Nmdeluxe Nmdeluxe		0.00	—	0.01	Mar 9, 2006	Cross-site scripting (XSS) vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the nick parameter.
CVE-2006-1108	Nmdeluxe Nmdeluxe		0.00	—	0.01	Mar 9, 2006	SQL injection vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2006-1109	Totalecommerce Totalecommerce		0.03	—	0.01	Mar 9, 2006	SQL injection vulnerability in index.asp in Total Ecommerce 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: it is not clear whether this report is associated with a specific product. If not, then it should not be included in CVE.
CVE-2006-1110	Aztek Forum Forum		0.03	—	0.02	Mar 9, 2006	Cross-site scripting (XSS) vulnerability in Aztek Forum 4.0 allows remote attackers to inject arbitrary web script or HTML via the message body in a new message.
CVE-2006-1111	Aztek Forum Forum		0.03	—	0.01	Mar 9, 2006	Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a "/" in the msg parameter to index.php, which reveals usernames and passwords in a MySQL error message, possibly due to a forced SQL error or SQL injection.
CVE-2006-1112	Aztek Forum Forum		0.03	—	0.03	Mar 9, 2006	Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a long login value in a register form, which displays the installation path in a MySQL error message.
CVE-2006-1113	Loudblog Loudblog		0.03	—	0.01	Mar 9, 2006	SQL injection vulnerability in podcast.php in Loudblog before 0.42 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2006-1114	Loudblog Loudblog		0.03	—	0.03	Mar 9, 2006	Multiple directory traversal vulnerabilities in Loudblog before 0.42 allow remote attackers to read or include arbitrary files via a .. (dot dot) and trailing %00 (NULL) byte in the (1) template and (2) page parameters in (a) index.php, and the (3) language parameter in (b)…
CVE-2006-1115	Ncipher HSM		0.00	—	0.01	Mar 9, 2006	nCipher HSM before 2.22.6, when generating a Diffie-Hellman public/private key pair without any specified DiscreteLogGroup parameters, chooses random parameters that could allow an attacker to crack the private key in significantly less time than a brute force attack.
CVE-2006-1116	Ncipher Ncore		0.00	—	0.02	Mar 9, 2006	The CBC-MAC integrity functions in the nCipher nCore API before 2.18 transmit the initialization vector IV as part of a message when the implementation uses a non-zero IV, which allows remote attackers to bypass integrity checks and modify messages without being detected.
CVE-2006-1117	Ncipher Nforce		0.00	—	0.01	Mar 9, 2006	nCipher firmware before V10, as used by (1) nShield, (2) nForce, (3) netHSM, (4) payShield, (5) SecureDB, (6) DSE200 Document Sealing Engine, (7) Time Source Master Clock (TSMC), and possibly other products, contains certain options that were only intended for testing and not…
CVE-2006-1118	Bmail Bmail		0.00	—	0.01	Mar 9, 2006	SQL injection vulnerability in bmail before Aardvark PR9.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving GBK character sets.
CVE-2006-0746	Xpdf Xpdf		0.00	—	0.03	Mar 9, 2006	Certain patches for kpdf do not include all relevant patches from xpdf that were associated with CVE-2005-3627, which allows context-dependent attackers to exploit vulnerabilities that were present in CVE-2005-3627.
CVE-2006-1074	Jason Boettcher Liero Xtreme		0.00	—	0.02	Mar 9, 2006	Jason Boettcher Liero Xtreme 0.62b and earlier allow remote attackers to cause a denial of service (application crash or hang) via a long argument to the connect command.
CVE-2006-1075	Jason Boettcher Liero Xtreme		0.00	—	0.04	Mar 9, 2006	Format string vulnerability in the visualization function in Jason Boettcher Liero Xtreme 0.62b and earlier allows remote attackers to execute arbitrary code via format string specifiers in (1) a nickname, (2) a dedicated server name, or (3) a mapname in a level (aka .lxl) file.
CVE-2006-1076	Invision Power Services Power Board		0.03	—	0.01	Mar 9, 2006	SQL injection vulnerability in index.php, possibly during a showtopic operation, in Invision Power Board (IPB) 2.1.5 allows remote attackers to execute arbitrary SQL commands via the st parameter.
CVE-2006-1077	Evo Dev Evoblog		0.00	—	0.01	Mar 9, 2006	Multiple cross-site scripting (XSS) vulnerabilities in the commentary in Evo-Dev evoBlog allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter and (2) other unspecified parameters.
CVE-2006-1078	Acme Thttpd	Hig	0.55	8.4	0.01	Mar 9, 2006	Multiple buffer overflows in htpasswd, as used in Acme thttpd 2.25b, and possibly other products such as Apache, might allow local users to gain privileges via (1) a long command line argument and (2) a long line in a file. NOTE: since htpasswd is normally installed as a…
CVE-2006-1079	Acme Thttpd		0.00	—	0.00	Mar 9, 2006	htpasswd, as used in Acme thttpd 2.25b and possibly other products such as Apache, might allow local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function. NOTE: since htpasswd is normally installed as a…
CVE-2006-1080	Game Panel Game Panel		0.03	—	0.02	Mar 9, 2006	Cross-site scripting (XSS) vulnerability in login.php in Game-Panel 2.6.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the message parameter, possibly requiring a URL encoded value.
CVE-2006-1081	Jonathan Beckett Pluggedout Nexus		0.03	—	0.02	Mar 9, 2006	SQL injection vulnerability in forgotten_password.php in Jonathan Beckett PluggedOut Nexus 0.1 allows remote attackers to execute arbitrary SQL commands via the email parameter.
CVE-2006-1082	Phparcadescript Phparcadescript		0.00	—	0.02	Mar 9, 2006	Multiple cross-site scripting (XSS) vulnerabilities in phpArcadeScript 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the gamename parameter in tellafriend.php, (2) the login_status parameter in loginbox.php, (3) the submissionstatus…
CVE-2006-1083	PHP Stats Phpstats		0.00	—	0.02	Mar 9, 2006	Multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to read and possibly execute arbitrary files via a .. (dot dot) in the (1) option[language] and (2) option[template] parameters, and (3) possibly other parameters, to (a)…
CVE-2006-1084	PHP Stats Phpstats		0.00	—	0.02	Mar 9, 2006	Multiple SQL injection vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the option[prefix] parameter in admin.php and other unspecified PHP scripts, and (2) the PC_REMOTE_ADDR HTTP header to click.php.
CVE-2006-1085	PHP Stats Phpstats		0.00	—	0.03	Mar 9, 2006	admin.php in PHP-Stats 0.1.9.1 and earlier allows remote attackers to bypass authentication, gain administrator privileges, and execute arbitrary PHP code by modifying the option[admin_pass] parameter and setting the pass_cookie to the MD5 hash of the specified password.
CVE-2006-1087	PHP Stats Phpstats		0.00	—	0.02	Mar 9, 2006	Direct static code injection vulnerability in the modify_config action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the option_new[compatibility_mode] parameter, which is not filtered before being…
CVE-2006-1088	PHP Stats Phpstats		0.00	—	0.02	Mar 9, 2006	PHP-Stats 0.1.9.1 and earlier allows remote attackers to obtain potentially sensitive information via a direct request to checktables.php, which lists the database table_prefix.
CVE-2006-1070	Dvguestbook Dvguestbook		0.03	—	0.02	Mar 8, 2006	Cross-site scripting (XSS) vulnerability in dv_gbook.php in DVguestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the f parameter.
CVE-2006-1071	Dvguestbook Dvguestbook		0.03	—	0.02	Mar 8, 2006	Cross-site scripting (XSS) vulnerability in index.php in DVguestbook 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVE-2006-1072	Simplog Simplog		0.00	—	0.01	Mar 8, 2006	Cross-site scripting (XSS) vulnerability in Daverave Simplog 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a blog post.
CVE-2006-1073	Simplog Simplog		0.03	—	0.03	Mar 8, 2006	Directory traversal vulnerability in index.php in Daverave Simplog 1.0.2 and earlier allows remote attackers to include or read arbitrary .txt files via the (1) act and (2) blogid parameters.
CVE-2006-1069	Geeklog Geeklog		0.00	—	0.02	Mar 7, 2006	Unspecified vulnerability in the session handling for Geeklog 1.4.x before 1.4.0sr2, 1.3.11 before 1.3.11sr5, 1.3.9 before 1.3.9sr5, and possibly earlier versions allows attackers to gain privileges as arbitrary users via unknown vectors.
CVE-2006-1065	PhpBB Mybulletinboard		0.00	—	0.01	Mar 7, 2006	SQL injection vulnerability in search.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to execute arbitrary SQL commands via the forums[] parameter.
CVE-2006-1067	Linksys Wrt54g		0.00	—	0.02	Mar 7, 2006	Linksys WRT54G routers version 5 (running VXWorks) allow remote attackers to cause a denial of service by sending a malformed DCC SEND string to an IRC channel, which causes an IRC connection reset, possibly related to the masquerading code for NAT environments, and as…
CVE-2006-1068	Netgear router		0.00	—	0.02	Mar 7, 2006	Netgear 614 and 624 routers, possibly running VXWorks, allow remote attackers to cause a denial of service by sending a malformed DCC SEND string to an IRC channel, which causes an IRC connection reset, possibly related to the masquerading code for NAT environments, and as…
CVE-2006-1051	Akarru Social Bookmarking Engine		0.00	—	0.01	Mar 7, 2006	SQL injection vulnerability in Akarru Social BookMarking Engine before 0.4.3.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors, possibly involving the username parameter to akarru.lib/users.php.
CVE-2006-1062	Lurker Lurker		0.00	—	0.02	Mar 7, 2006	Unspecified vulnerability in lurker.cgi for Lurker 2.0 and earlier allows attackers to read arbitrary files via unknown vectors.
CVE-2006-1063	Lurker Lurker		0.00	—	0.02	Mar 7, 2006	Unspecified vulnerability in Lurker 2.0 and earlier allows remote attackers to create or overwrite files in any writable directory that is named "mbox".
CVE-2006-1064	Lurker Lurker		0.00	—	0.02	Mar 7, 2006	Multiple cross-site scripting (XSS) vulnerabilities in Lurker 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

CVE-2006-1096Mar 9, 2006
Digital Builder
Nz Ecommerce
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this…
CVE-2006-1097Mar 9, 2006
Woltlab
Datenbank MOD
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allow remote attackers to inject arbitrary web script or HTML via the fileid parameter to (1) info_db.php or (2) database.php.
CVE-2006-1098Mar 9, 2006
Digital Builder
Nz Ecommerce
risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the (1) informationID or (2) ParentCategory parameter to index.php. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by…
CVE-2006-1099Mar 9, 2006
Logit
Logit
risk 0.03cvss —epss 0.02
PHP remote file include vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2006-1100Mar 9, 2006
Sauerbraten
Cube
risk 0.04cvss —epss 0.08
Buffer overflow in the sgetstr function in shared/cube.h in Sauerbraten 2006_02_28 and earlier, as derived from the Cube engine, allows remote attackers to execute arbitrary code via long streams of input data.
CVE-2006-1101Mar 9, 2006
Sauerbraten
Cube
risk 0.03cvss —epss 0.05
The (1) sgetstr and (2) getint functions in Sauerbraten 2006_02_28, as derived from the Cube engine, allow remote attackers to cause a denial of service (segmentation fault) via long streams of input data that trigger an out-of-bounds read, as demonstrated using SV_EXT tag data…
CVE-2006-1102Mar 9, 2006
Sauerbraten
Cube
risk 0.03cvss —epss 0.05
Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (client exit) by forcing the server to change to a map (ogz) file whose name contains ".." sequences and has a certain length that prevents the addition of the ".ogz"…
CVE-2006-1103Mar 9, 2006
Sauerbraten
Cube
risk 0.04cvss —epss 0.07
engine/server.cpp in Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (segmentation fault) via a client that does not completely join the game and times out, which results in a null pointer dereference.
CVE-2006-1104Mar 9, 2006
Pixelpost
Pixelpost
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in Pixelpost 1.5 beta 1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the showimage parameter in index.php; and the (2) USER_AGENT, (3) HTTP_REFERER, and (4) HTTP_HOST HTTP header fields as used in the…
CVE-2006-1105Mar 9, 2006
Pixelpost
Pixelpost
risk 0.00cvss —epss 0.02
Pixelpost 1.5 beta 1 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the…
CVE-2006-1106Mar 9, 2006
Pixelpost
Pixelpost
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Pixelpost 1.5 beta 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) message, (2) name, (3) url, and (4) email parameters when commenting on a post. NOTE: the vendor has disputed some issues from…
CVE-2006-1107Mar 9, 2006
Nmdeluxe
Nmdeluxe
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the nick parameter.
CVE-2006-1108Mar 9, 2006
Nmdeluxe
Nmdeluxe
risk 0.00cvss —epss 0.01
SQL injection vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2006-1109Mar 9, 2006
Totalecommerce
Totalecommerce
risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.asp in Total Ecommerce 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: it is not clear whether this report is associated with a specific product. If not, then it should not be included in CVE.
CVE-2006-1110Mar 9, 2006
Aztek Forum
Forum
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Aztek Forum 4.0 allows remote attackers to inject arbitrary web script or HTML via the message body in a new message.
CVE-2006-1111Mar 9, 2006
Aztek Forum
Forum
risk 0.03cvss —epss 0.01
Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a "*/*" in the msg parameter to index.php, which reveals usernames and passwords in a MySQL error message, possibly due to a forced SQL error or SQL injection.
CVE-2006-1112Mar 9, 2006
Aztek Forum
Forum
risk 0.03cvss —epss 0.03
Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a long login value in a register form, which displays the installation path in a MySQL error message.
CVE-2006-1113Mar 9, 2006
Loudblog
Loudblog
risk 0.03cvss —epss 0.01
SQL injection vulnerability in podcast.php in Loudblog before 0.42 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2006-1114Mar 9, 2006
Loudblog
Loudblog
risk 0.03cvss —epss 0.03
Multiple directory traversal vulnerabilities in Loudblog before 0.42 allow remote attackers to read or include arbitrary files via a .. (dot dot) and trailing %00 (NULL) byte in the (1) template and (2) page parameters in (a) index.php, and the (3) language parameter in (b)…
CVE-2006-1115Mar 9, 2006
Ncipher
HSM
risk 0.00cvss —epss 0.01
nCipher HSM before 2.22.6, when generating a Diffie-Hellman public/private key pair without any specified DiscreteLogGroup parameters, chooses random parameters that could allow an attacker to crack the private key in significantly less time than a brute force attack.
CVE-2006-1116Mar 9, 2006
Ncipher
Ncore
risk 0.00cvss —epss 0.02
The CBC-MAC integrity functions in the nCipher nCore API before 2.18 transmit the initialization vector IV as part of a message when the implementation uses a non-zero IV, which allows remote attackers to bypass integrity checks and modify messages without being detected.
CVE-2006-1117Mar 9, 2006
Ncipher
Nforce
risk 0.00cvss —epss 0.01
nCipher firmware before V10, as used by (1) nShield, (2) nForce, (3) netHSM, (4) payShield, (5) SecureDB, (6) DSE200 Document Sealing Engine, (7) Time Source Master Clock (TSMC), and possibly other products, contains certain options that were only intended for testing and not…
CVE-2006-1118Mar 9, 2006
Bmail
Bmail
risk 0.00cvss —epss 0.01
SQL injection vulnerability in bmail before Aardvark PR9.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving GBK character sets.
CVE-2006-0746Mar 9, 2006
Xpdf
Xpdf
risk 0.00cvss —epss 0.03
Certain patches for kpdf do not include all relevant patches from xpdf that were associated with CVE-2005-3627, which allows context-dependent attackers to exploit vulnerabilities that were present in CVE-2005-3627.
CVE-2006-1074Mar 9, 2006
Jason Boettcher
Liero Xtreme
risk 0.00cvss —epss 0.02
Jason Boettcher Liero Xtreme 0.62b and earlier allow remote attackers to cause a denial of service (application crash or hang) via a long argument to the connect command.
CVE-2006-1075Mar 9, 2006
Jason Boettcher
Liero Xtreme
risk 0.00cvss —epss 0.04
Format string vulnerability in the visualization function in Jason Boettcher Liero Xtreme 0.62b and earlier allows remote attackers to execute arbitrary code via format string specifiers in (1) a nickname, (2) a dedicated server name, or (3) a mapname in a level (aka .lxl) file.
CVE-2006-1076Mar 9, 2006
Invision Power Services
Power Board
risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php, possibly during a showtopic operation, in Invision Power Board (IPB) 2.1.5 allows remote attackers to execute arbitrary SQL commands via the st parameter.
CVE-2006-1077Mar 9, 2006
Evo Dev
Evoblog
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the commentary in Evo-Dev evoBlog allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter and (2) other unspecified parameters.
CVE-2006-1078HigMar 9, 2006
Acme
Thttpd
risk 0.55cvss 8.4epss 0.01
Multiple buffer overflows in htpasswd, as used in Acme thttpd 2.25b, and possibly other products such as Apache, might allow local users to gain privileges via (1) a long command line argument and (2) a long line in a file. NOTE: since htpasswd is normally installed as a…
CVE-2006-1079Mar 9, 2006
Acme
Thttpd
risk 0.00cvss —epss 0.00
htpasswd, as used in Acme thttpd 2.25b and possibly other products such as Apache, might allow local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function. NOTE: since htpasswd is normally installed as a…
CVE-2006-1080Mar 9, 2006
Game Panel
Game Panel
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in login.php in Game-Panel 2.6.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the message parameter, possibly requiring a URL encoded value.
CVE-2006-1081Mar 9, 2006
Jonathan Beckett
Pluggedout Nexus
risk 0.03cvss —epss 0.02
SQL injection vulnerability in forgotten_password.php in Jonathan Beckett PluggedOut Nexus 0.1 allows remote attackers to execute arbitrary SQL commands via the email parameter.
CVE-2006-1082Mar 9, 2006
Phparcadescript
Phparcadescript
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in phpArcadeScript 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the gamename parameter in tellafriend.php, (2) the login_status parameter in loginbox.php, (3) the submissionstatus…
CVE-2006-1083Mar 9, 2006
PHP Stats
Phpstats
risk 0.00cvss —epss 0.02
Multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to read and possibly execute arbitrary files via a .. (dot dot) in the (1) option[language] and (2) option[template] parameters, and (3) possibly other parameters, to (a)…
CVE-2006-1084Mar 9, 2006
PHP Stats
Phpstats
risk 0.00cvss —epss 0.02
Multiple SQL injection vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the option[prefix] parameter in admin.php and other unspecified PHP scripts, and (2) the PC_REMOTE_ADDR HTTP header to click.php.
CVE-2006-1085Mar 9, 2006
PHP Stats
Phpstats
risk 0.00cvss —epss 0.03
admin.php in PHP-Stats 0.1.9.1 and earlier allows remote attackers to bypass authentication, gain administrator privileges, and execute arbitrary PHP code by modifying the option[admin_pass] parameter and setting the pass_cookie to the MD5 hash of the specified password.
CVE-2006-1087Mar 9, 2006
PHP Stats
Phpstats
risk 0.00cvss —epss 0.02
Direct static code injection vulnerability in the modify_config action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the option_new[compatibility_mode] parameter, which is not filtered before being…
CVE-2006-1088Mar 9, 2006
PHP Stats
Phpstats
risk 0.00cvss —epss 0.02
PHP-Stats 0.1.9.1 and earlier allows remote attackers to obtain potentially sensitive information via a direct request to checktables.php, which lists the database table_prefix.
CVE-2006-1070Mar 8, 2006
Dvguestbook
Dvguestbook
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in dv_gbook.php in DVguestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the f parameter.
CVE-2006-1071Mar 8, 2006
Dvguestbook
Dvguestbook
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in index.php in DVguestbook 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVE-2006-1072Mar 8, 2006
Simplog
Simplog
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Daverave Simplog 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a blog post.
CVE-2006-1073Mar 8, 2006
Simplog
Simplog
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in index.php in Daverave Simplog 1.0.2 and earlier allows remote attackers to include or read arbitrary .txt files via the (1) act and (2) blogid parameters.
CVE-2006-1069Mar 7, 2006
Geeklog
Geeklog
risk 0.00cvss —epss 0.02
Unspecified vulnerability in the session handling for Geeklog 1.4.x before 1.4.0sr2, 1.3.11 before 1.3.11sr5, 1.3.9 before 1.3.9sr5, and possibly earlier versions allows attackers to gain privileges as arbitrary users via unknown vectors.
CVE-2006-1065Mar 7, 2006
PhpBB
Mybulletinboard
risk 0.00cvss —epss 0.01
SQL injection vulnerability in search.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to execute arbitrary SQL commands via the forums[] parameter.
CVE-2006-1067Mar 7, 2006
Linksys
Wrt54g
risk 0.00cvss —epss 0.02
Linksys WRT54G routers version 5 (running VXWorks) allow remote attackers to cause a denial of service by sending a malformed DCC SEND string to an IRC channel, which causes an IRC connection reset, possibly related to the masquerading code for NAT environments, and as…
CVE-2006-1068Mar 7, 2006
Netgear
router
risk 0.00cvss —epss 0.02
Netgear 614 and 624 routers, possibly running VXWorks, allow remote attackers to cause a denial of service by sending a malformed DCC SEND string to an IRC channel, which causes an IRC connection reset, possibly related to the masquerading code for NAT environments, and as…
CVE-2006-1051Mar 7, 2006
Akarru
Social Bookmarking Engine
risk 0.00cvss —epss 0.01
SQL injection vulnerability in Akarru Social BookMarking Engine before 0.4.3.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors, possibly involving the username parameter to akarru.lib/users.php.
CVE-2006-1062Mar 7, 2006
Lurker
Lurker
risk 0.00cvss —epss 0.02
Unspecified vulnerability in lurker.cgi for Lurker 2.0 and earlier allows attackers to read arbitrary files via unknown vectors.
CVE-2006-1063Mar 7, 2006
Lurker
Lurker
risk 0.00cvss —epss 0.02
Unspecified vulnerability in Lurker 2.0 and earlier allows remote attackers to create or overwrite files in any writable directory that is named "mbox".
CVE-2006-1064Mar 7, 2006
Lurker
Lurker
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Lurker 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.