VYPR

CVEs

343,281 total · page 6542 of 6,866

AllCriticalHighKEV
  • CVE-2006-0814Mar 6, 2006
    Lighttpd
    Lighttpd
    risk 0.01cvss —epss 0.10

    response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files.

  • CVE-2006-0949Mar 6, 2006
    Raidenhttpd
    Raidenhttpd
    risk 0.00cvss —epss 0.02

    RaidenHTTPD 1.1.47 allows remote attackers to obtain source code of script files, including PHP, via crafted requests involving (1) "." (dot), (2) space, and (3) "/" (slash) characters.

  • CVE-2006-1010Mar 6, 2006
    Crossfire
    Crossfire
    risk 0.04cvss —epss 0.17

    Buffer overflow in socket/request.c in CrossFire before 1.9.0, when oldsocketmode is enabled, allows remote attackers to cause a denial of service (segmentation fault) and possibly execute code by sending the server a large request.

  • CVE-2006-1011Mar 6, 2006
    Peters Software
    Lettermerger
    risk 0.00cvss —epss 0.00

    LetterMerger 1.2 stores user information in Access database files with insecure permissions, which allows local users to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-1012Mar 6, 2006
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in WordPress 1.5.2, and possibly other versions before 2.0, allows remote attackers to execute arbitrary SQL commands via the User-Agent field in an HTTP header for a comment.

  • CVE-2006-0387Mar 6, 2006
    Apple Inc.
    Mac OS X
    risk 0.01cvss —epss 0.08

    Stack-based buffer overflow in Safari in Mac OS X 10.4.5 and earlier, and 10.3.9 and earlier, allows remote attackers to execute arbitrary code via unspecified vectors involving a web page with crafted JavaScript, a different vulnerability than CVE-2005-4504.

  • CVE-2006-1000Mar 6, 2006
    Pentacle
    In-Out Board
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in Pentacle In-Out Board 3.0 and earlier allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) newsid parameter to newsdetailsview.asp and (2) password parameter to login.asp.

  • CVE-2006-1001Mar 6, 2006
    Lansuite
    Lanparty Intranet System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the board module in LanSuite LanParty Intranet System 2.0.6 and 2.1.0 beta allows remote attackers to execute arbitrary SQL commands via the fid parameter.

  • CVE-2006-1002Mar 6, 2006
    Netgear
    Wgt624
    risk 0.00cvss —epss 0.03

    NETGEAR WGT624 Wireless DSL router has a default account of super_username "Gearguy" and super_passwd "Geardog", which allows remote attackers to modify the configuration. NOTE: followup posts have suggested that this might not occur with all WGT624 routers.

  • CVE-2006-1003Mar 6, 2006
    Netgear
    Wgt624
    risk 0.00cvss —epss 0.02

    The backup configuration option in NETGEAR WGT624 Wireless Firewall Router stores sensitive information in cleartext, which allows remote attackers to obtain passwords and gain privileges.

  • CVE-2006-1004Mar 6, 2006
    Parodia
    Parodia
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in agencyprofile.asp in Parodia 6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the AG_ID parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party…

  • CVE-2006-1005Mar 6, 2006
    Cactusoft
    Parodia
    risk 0.00cvss —epss 0.01

    agencyprofile.asp in Parodia 6.2 and earlier might allow remote attackers to obtain sensitive information by triggering an SQL error via an invalid AG_ID parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

  • CVE-2006-1006Mar 6, 2006
    Sendcard
    Sendcard
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in sendcard.php in sendcard before 3.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified parameters.

  • CVE-2006-1007Mar 6, 2006
    Nathan Landry
    N8cms Sitesuite CMS
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in N8cms 1.1 and 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) dir and (2) page_id parameter to index.php.

  • CVE-2006-1008Mar 6, 2006
    Nathan Landry
    N8cms Sitesuite CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in N8cms 1.1 and 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) dir and (2) page_id parameter to (a) index.php and (3) userid parameter to (b) mailto.php. NOTE: it is possible that issues 1 and 2…

  • CVE-2006-1009Mar 6, 2006
    M4 Project
    Enigma Suite
    risk 0.00cvss —epss 0.00

    M4 Project enigma-suite before 0.73.3 (Windows) has a default password of "nominal" for the "enigma-client" account, which allows local users to gain access.

  • CVE-2006-0386Mar 3, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    FileVault in Mac OS X 10.4.5 and earlier does not properly mount user directories when creating a FileVault image, which allows local users to access protected files when FileVault is enabled.

  • CVE-2006-0388Mar 3, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Safari in Mac OS X 10.3 before 10.3.9 and 10.4 before 10.4.5 allows remote attackers to redirect users to local files and execute arbitrary JavaScript via unspecified vectors involving HTTP redirection to local resources.

  • CVE-2006-0389Mar 3, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Syndication (Safari RSS) in Mac OS X 10.4 through 10.4.5 allows remote attackers to execute arbitrary JavaScript via unspecified vectors involving RSS feeds.

  • CVE-2006-0391Mar 3, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in the BOM framework in Mac OS X 10.x before 10.3.9 and 10.4 before 10.4.5 allows user-assisted attackers to overwrite or create arbitrary files via an archive that is handled by BOMArchiveHelper.

  • CVE-2006-0995Mar 3, 2006
    EMC Corporation
    Retrospect
    risk 0.00cvss —epss 0.02

    EMC Dantz Retrospect 7 backup client 7.0.107, and other versions before 7.0.109, and 6.5 before 6.5.138 allows remote attackers to cause a denial of service (client termination and loss of backup service) via a malformed packet to TCP port 497, which triggers an assert error.

  • CVE-2006-0969Mar 3, 2006
    Pixelartkingdom
    Top Sites
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in index.php in Top sites de PixelArtKingdom allows remote attackers to include and execute arbitrary files via the page parameter.

  • CVE-2006-0970Mar 3, 2006
    Activecampaign
    Supporttrio
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in one or more ActiveCampaign products, possibly SupportTrio, allows remote attackers to include and execute arbitrary files via the page parameter.

  • CVE-2006-0971Mar 3, 2006
    Lionel Reyero
    Directcontact
    risk 0.03cvss —epss 0.05

    Directory traversal vulnerability in Lionel Reyero DirectContact 0.3b allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.

  • CVE-2006-0972Mar 3, 2006
    Tony Baird
    Fantastic News
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.php in Tony Baird Fantastic News 2.1.1 allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the category vector is already covered by CVE-2005-3846.

  • CVE-2006-0973Mar 3, 2006
    Phpwebsite
    Phpwebsite
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in topics.php in Appalachian State University phpWebSite 0.10.2 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter.

  • CVE-2006-0974Mar 3, 2006
    Battleaxe Software
    Bttlxeforum
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in failure.asp in Battleaxe bttlxeForum 2.0 allows remote attackers to inject arbitrary web script or HTML via the err_txt parameter.

  • CVE-2006-0976Mar 3, 2006
    Spid
    Spid
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in scan_lang_insert.php in Boris Herbiniere-Seve SPiD 1.3.1 allows remote attackers to read arbitrary files via the lang parameter.

  • CVE-2006-0977Mar 3, 2006
    Craig Morrison
    Mts Pro
    risk 0.00cvss —epss 0.02

    Craig Morrison Mail Transport System Professional (aka MTS Pro) acts as an open relay when configured to relay all mail through an external SMTP server, which allows remote attackers to relay mail by connecting to the MTS Pro server, then sending a MAIL FROM that specifies a…

  • CVE-2006-0978Mar 3, 2006
    Argosoft
    Argosoft Mail Server
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the View Headers (aka viewheaders) functionality in ArGoSoft Mail Server Pro 1.8.8.5 allow remote attackers to inject arbitrary web script or HTML via (1) the Subject header, (2) the From header, and (3) certain other…

  • CVE-2006-0979Mar 3, 2006
    Nidelven It
    Issue Dealer
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the local weblog publisher in Nidelven IT Issue Dealer before 0.9.96 has unknown impact and attack vectors.

  • CVE-2006-0980Mar 3, 2006
    Jay Eckles
    Cgi Calendar
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Jay Eckles CGI Calendar 2.7 allow remote attackers to inject arbitrary web script or HTML via the year parameter in (1) index.cgi and (2) viewday.cgi.

  • CVE-2006-0981Mar 3, 2006
    E Merge
    WinAce
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in e-merge WinAce 2.6 and earlier allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive.

  • CVE-2006-0982Mar 3, 2006
    McAfee
    Virex
    risk 0.00cvss —epss 0.01

    The on-access scanner for McAfee Virex 7.7 for Macintosh, in some circumstances, might not activate when malicious content is accessed from the web browser, and might not prevent the content from being saved, which allows remote attackers to bypass virus protection, as…

  • CVE-2006-0983Mar 3, 2006
    QwikiWiki
    QwikiWiki
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in QwikiWiki 1.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2006-0984Mar 3, 2006
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in inc_header.php in EJ3 TOPo 2.2.178 allows remote attackers to inject arbitrary web script or HTML via the gTopNombre parameter.

  • CVE-2006-0985Mar 3, 2006
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in the "post comment" functionality of WordPress 2.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) website, and (3) comment parameters.

  • CVE-2006-0986Mar 3, 2006
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    WordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) default-filters.php, (2) template-loader.php, (3) rss-functions.php, (4) locale.php, (5) wp-db.php, and (6) kses.php in the wp-includes/ directory; and (7)…

  • CVE-2006-0987Mar 3, 2006
    Isc
    Bind
    risk 0.08cvss —epss 0.57

    The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification)…

  • CVE-2006-0988Mar 3, 2006
    Microsoft
    Windows Nt
    risk 0.07cvss —epss 0.55

    The default configuration of the DNS Server service on Windows Server 2003 and Windows 2000, and the Microsoft DNS Server service on Windows NT 4.0, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers…

  • CVE-2006-0956Mar 2, 2006
    Nufw
    Nufw
    risk 0.00cvss —epss 0.01

    nuauth in NuFW before 1.0.21 does not properly handle blocking TLS sockets, which allows remote authenticated users to cause a denial of service (service hang) by flooding packets at the authentication server.

  • CVE-2006-0957Mar 2, 2006
    Zoneo Soft
    Freeforum
    risk 0.00cvss —epss 0.02

    Direct static code injection vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to execute arbitrary PHP code via the (1) X-Forwarded-For and (2) Client-Ip HTTP headers, which are stored in Data/flood.db.php.

  • CVE-2006-0958Mar 2, 2006
    Zoneo Soft
    Freeforum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) subject parameters.

  • CVE-2006-0959Mar 2, 2006
    PhpBB
    Mybulletinboard
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands by setting the comma variable value via the comma parameter in a cookie. NOTE: 1.04 has also been reported to be…

  • CVE-2006-0960Mar 2, 2006
    Compex
    Netpassage Wpe54g
    risk 0.00cvss —epss 0.02

    uConfig agent in Compex NetPassage WPE54G router allows remote attackers to cause a denial of service (unresposiveness) via crafted datagrams to UDP port 7778.

  • CVE-2006-0961Mar 2, 2006
    Cilem
    Cilem Haber
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in yazdir.asp in Cilem Hiber 1.1 allows remote attackers to execute arbitrary SQL commands via the haber_id parameter. NOTE: this product has also been referred to as "Cilem News," although that does not appear to be the proper name.

  • CVE-2006-0962Mar 2, 2006
    Vubb
    Vubb
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the pass parameter in a cookie.

  • CVE-2006-0963Mar 2, 2006
    Stlport Project
    Stlport
    risk 0.00cvss —epss 0.01

    Multiple buffer overflows in STLport 5.0.2 might allow local users to execute arbitrary code via (1) long locale environment variables to a strcpy function call in c_locale_glibc2.c and (2) long arguments to unspecified functions in num_put_float.cpp.

  • CVE-2006-0964Mar 2, 2006
    Ncp Network Communications
    Secure Client
    risk 0.00cvss —epss 0.00

    Client Firewall in NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to bypass firewall program execution rules by replacing an allowed program with an arbitrary program.

  • CVE-2006-0965Mar 2, 2006
    NCP
    Network Communication Secure Client
    risk 0.00cvss —epss 0.00

    NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to bypass security protections and configure privileged options via a long argument to ncpmon.exe, which provides access to alternate privileged menus, possibly due to a…