VYPR

CVEs

343,281 total · page 6544 of 6,866

AllCriticalHighKEV
  • CVE-2006-0900Feb 27, 2006
    FreeBSD
    FreeBSD
    risk 0.08cvss —epss 0.64

    nfsd in FreeBSD 6.0 kernel allows remote attackers to cause a denial of service via a crafted NFS mount request, as demonstrated by the ProtoVer NFS test suite.

  • CVE-2006-0901Feb 27, 2006
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the hsfs filesystem in Solaris 8, 9, and 10 allows unspecified attackers to cause a denial of service (panic) or execute arbitrary code.

  • CVE-2006-0885Feb 25, 2006
    CuteNews
    CuteNews
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in show_news.php in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the show parameter.

  • CVE-2006-0886Feb 25, 2006
    Dev
    Dev Web Management System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in register.php in DEV web management system 1.5 allows remote attackers to inject arbitrary web script or HTML via the "City/Region" field (mesto variable). NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2006-0887Feb 25, 2006
    Phplib Team
    Phplib
    risk 0.03cvss —epss 0.03

    Eval injection vulnerability in sessions.inc in PHP Base Library (PHPLib) before 7.4a, when index.php3 from the PHPLib distribution is available on the server, allows remote attackers to execute arbitrary PHP code by including a base64-encoded representation of the code in a…

  • CVE-2006-0888Feb 25, 2006
    Invision Power Services
    Power Board
    risk 0.04cvss —epss 0.08

    index.php in Invision Power Board (IPB) 2.0.1, with Code Confirmation disabled, allows remote attackers to cause an unspecified denial of service by registering a large number of users.

  • CVE-2006-0889Feb 25, 2006
    Brown Bear Software
    Calcium
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Calcium 3.10.1 allows remote attackers to inject arbitrary web script or HTML via the EventText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-0890Feb 25, 2006
    Speedproject
    Speedcommander
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in SpeedProject Squeez 5.1, as used in (1) ZipStar 5.1 and (2) SpeedCommander 11.01.4450, allows remote attackers to overwrite arbitrary files via unspecified manipulations in a (1) JAR or (2) ZIP archive.

  • CVE-2006-0891Feb 25, 2006
    Nocc
    Nocc
    risk 0.04cvss —epss 0.08

    Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing NULL (%00) byte in (1) the _SESSION['nocc_theme'] parameter in (a) html/footer.php; and (2) the lang and (3) theme…

  • CVE-2006-0892Feb 25, 2006
    Nocc
    Nocc
    risk 0.00cvss —epss 0.04

    NOCC Webmail 1.0 stores e-mail attachments in temporary files with predictable filenames, which makes it easier for remote attackers to execute arbitrary code by accessing the e-mail attachment via directory traversal vulnerabilities.

  • CVE-2006-0893Feb 25, 2006
    Nocc
    Nocc
    risk 0.00cvss —epss 0.02

    NOCC Webmail 1.0 allows remote attackers to obtain sensitive information via a direct request to (1) the profiles directory, which leaks e-mail addresses contained in filenames of profiles, and (2) the tmp directory, which lists names of uploaded attachments.

  • CVE-2006-0894Feb 25, 2006
    Nocc
    Nocc
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in NOCC Webmail 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the html_error_occurred parameter in error.php, (2) html_filter_select parameter in filter_prefs.php, (3) html_no_mail parameter in…

  • CVE-2006-0895Feb 25, 2006
    Nocc
    Nocc
    risk 0.00cvss —epss 0.02

    NOCC Webmail 1.0 allows remote attackers to obtain the installation path via a direct request to html/header.php.

  • CVE-2006-0896Feb 25, 2006
    Simple Machines
    Simple Machines Forum
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Sources/Register.php in Simple Machine Forum (SMF) 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For HTTP header field.

  • CVE-2006-0897Feb 25, 2006
    VCS
    Virtual Program Management Intranet (VPMi) Enterprise
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in VCS Virtual Program Management Intranet (VPMi) Enterprise 3.3 allows remote attackers to execute arbitrary SQL commands via the UpdateID0 parameter to Service_Requests.asp. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2006-0898Feb 25, 2006
    Crypt::CBC
    Crypt::CBC
    risk 0.00cvss —epss 0.01

    Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael.

  • CVE-2006-0884Feb 24, 2006
    Mozilla Corporation
    Thunderbird
    risk 0.04cvss —epss 0.07

    The WYSIWYG rendering engine ("rich mail" editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass javascript security settings and obtain sensitive information or cause a crash via an e-mail containing a javascript URI in the SRC attribute of an…

  • CVE-2006-0813Feb 24, 2006
    Winace
    Winace
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in WinACE 2.60 allows user-assisted attackers to execute arbitrary code via a large header block in an ARJ archive.

  • CVE-2006-0871Feb 24, 2006
    Mambo (software)
    Mambo
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in the _setTemplate function in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to read and include arbitrary files via the mos_change_template parameter. NOTE: CVE-2006-1794 has been assigned to the SQL injection…

  • CVE-2006-0872Feb 24, 2006
    Coppermine
    Coppermine Photo Gallery
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in init.inc.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the lang parameter.

  • CVE-2006-0873Feb 24, 2006
    Coppermine
    Coppermine Photo Gallery
    risk 0.00cvss —epss 0.02

    Absolute path traversal vulnerability in docs/showdocs.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via the f parameter, and possibly remote files using UNC share pathnames.

  • CVE-2006-0874Feb 24, 2006
    Intensive Point
    Iuser Ecommerce
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Intensive Point iUser Ecommerce before 2.2 have unspecified vectors and impact, as addressed by "Urgent secure fixes". NOTE: this might be a duplicate of CVE-2006-0854, but the vendor announcement for this issue (from January 8, 2005) is…

  • CVE-2006-0875Feb 24, 2006
    Runcms
    Runcms
    risk 0.03cvss —epss 0.03

    Cross-site scripting vulnerability in ratefile.php in RunCMS 1.3a5 allows remote attackers to inject arbitrary web script or HTML via the lid parameter.

  • CVE-2006-0876Feb 24, 2006
    Popfile
    Popfile
    risk 0.00cvss —epss 0.02

    POPFile before 0.22.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors involving character sets within e-mail messages.

  • CVE-2006-0877Feb 24, 2006
    Easy Forum
    Easy Forum
    risk 0.03cvss —epss 0.03

    Cross-site scripting vulnerability in Easy Forum 2.5 allows remote attackers to inject arbitrary web script or HTML via the image variable.

  • CVE-2006-0878Feb 24, 2006
    Noah's Classifieds
    Noah's Classifieds
    risk 0.00cvss —epss 0.02

    Noah's Classifieds 1.3 allows remote attackers to obtain the installation path via a direct request to include files, as demonstrated by classifieds/gorum/category.php.

  • CVE-2006-0879Feb 24, 2006
    Noah's Classifieds
    Noah's Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the search tool in Noah's Classifieds 1.3 allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors.

  • CVE-2006-0880Feb 24, 2006
    Nordicwind
    Noah's Classifieds
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Noah's Classifieds 1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) inf parameter; or, when register_globals is enabled, the (2) upperTemplate and (3) lowerTemplate parameters.

  • CVE-2006-0881Feb 24, 2006
    Noah's Classifieds
    Noah's Classifieds
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file include vulnerabilities in gorum/gorumlib.php in Noah's Classifieds 1.3, when register_globals is enabled, allow remote attackers to include arbitrary PHP files via the (1) upperTemplate and (2) lowerTemplate parameters, as demonstrated using the…

  • CVE-2006-0882Feb 24, 2006
    Noah's Classifieds
    Noah's Classifieds
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in include.php in Noah's Classifieds 1.3 allows remote attackers to include arbitrary local files via the otherTemplate parameter to index.php.

  • CVE-2006-0188Feb 24, 2006
    SquirrelMail
    Squirrelmail
    risk 0.00cvss —epss 0.02

    webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the right_frame parameter. NOTE: this has been called a cross-site scripting (XSS) issue, but it is different than what is normally identified as…

  • CVE-2006-0195Feb 24, 2006
    SquirrelMail
    Squirrelmail
    risk 0.00cvss —epss 0.02

    Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via style sheet specifiers with invalid (1) "/*" and "*/" comments, or (2) a newline in a "url" specifier, which is processed by…

  • CVE-2006-0300Feb 24, 2006
    GNU
    Tar
    risk 0.00cvss —epss 0.05

    Buffer overflow in tar 1.14 through 1.15.90 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute code via unspecified vectors involving PAX extended headers.

  • CVE-2006-0377Feb 24, 2006
    SquirrelMail
    Squirrelmail
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox parameter of the sqimap_mailbox_select command, aka "IMAP injection."

  • CVE-2006-0856Feb 23, 2006
    Scriptme
    Sme Gb Host
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in login.php in Scriptme SmE GB Host 1.21 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the Username parameter.

  • CVE-2006-0857Feb 23, 2006
    E107
    E107
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Chatbox Plugin 1.0 in e107 0.7.2 allows remote attackers to inject arbitrary HTML or web script via a Chatbox, as demonstrated using a SCRIPT element.

  • CVE-2006-0858Feb 23, 2006
    Starforce
    Safe N Sec Personal \+ Anti Spyware
    risk 0.00cvss —epss 0.00

    Unquoted Windows search path vulnerability in (1) snsmcon.exe, (2) the autostartup mechanism, and (3) an unspecified installation component in StarForce Safe'n'Sec Personal + Anti-Spyware 2.0 and earlier, and possibly other StarForce Safe'n'Sec products, might allow local users…

  • CVE-2006-0859Feb 23, 2006
    Michael Salzer
    Guestbox
    risk 0.00cvss —epss 0.01

    Michael Salzer Guestbox 0.6, and other versions before 0.8, allows remote attackers to post an admin comment to a guestbook entry via a certain modified form, possibly related to the nummer parameter.

  • CVE-2006-0860Feb 23, 2006
    Michael Salzer
    Guestbox
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Michael Salzer Guestbox 0.6, and other versions before 0.8, allow remote attackers to inject arbitrary web script or HTML via (1) HTML tags that follow a "http://" string, which bypasses a regular expression check, and (2)…

  • CVE-2006-0861Feb 23, 2006
    Michael Salzer
    Guestbox
    risk 0.00cvss —epss 0.02

    Michael Salzer Guestbox 0.6, and other versions before 0.8, allows remote attackers to obtain the source IP addresses of guestbook entries via a direct request to /gb/gblog.

  • CVE-2006-0862Feb 23, 2006
    Infovista
    Portalse
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in InfoVista PortalSE 2.0 Build 20087 on Solaris 8 without the IV00038969 hotfix allows remote attackers to read arbitrary files via a crafted URL.

  • CVE-2006-0863Feb 23, 2006
    Infovista
    Portalse
    risk 0.00cvss —epss 0.02

    InfoVista PortalSE 2.0 Build 20087 on Solaris 8 allows remote attackers to obtain sensitive information by specifying a nonexistent server in the server field, which reveals the path in an error message.

  • CVE-2006-0864Feb 23, 2006
    Hauri
    Virobot
    risk 0.00cvss —epss 0.03

    filescan in Global Hauri ViRobot 2.0 20050817 does not verify the Cookie HTTP header, which allows remote attackers to gain administrative privileges via an arbitrary cookie value.

  • CVE-2006-0865Feb 23, 2006
    Punbb
    Punbb
    risk 0.03cvss —epss 0.03

    PunBB 1.2.10 and earlier allows remote attackers to cause a denial of service (resource consumption) by registering many user accounts quickly.

  • CVE-2006-0866Feb 23, 2006
    Punbb
    Punbb
    risk 0.00cvss —epss 0.01

    PunBB 1.2.10 and earlier allows remote attackers to conduct brute force guessing attacks for an account's password, which may be as short as 4 characters.

  • CVE-2006-0867Feb 23, 2006
    South River Technologies
    Webdrive
    risk 0.00cvss —epss 0.01

    Buffer overflow in certain versions of South River (aka SRT) WebDrive, possibly version 6.08 build 1131 and version 8, allows remote attackers to cause a denial of service (application crash and persistent erratic behavior) via a long string in the name entry field.

  • CVE-2006-0868Feb 23, 2006
    Pear
    XML Rpc
    risk 0.00cvss —epss 0.02

    Multiple unspecified injection vulnerabilities in unspecified Auth Container back ends for PEAR::Auth before 1.2.4, and 1.3.x before 1.3.0r4, allow remote attackers to "falsify authentication credentials," related to the "underlying storage containers."

  • CVE-2006-0869Feb 23, 2006
    Pear
    Pear Liveuser
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in the "remember me" feature in liveuser.php in PHP Extension and Application Repository (PEAR) LiveUser 0.16.8 and earlier allows remote attackers to determine file existence, and possibly delete arbitrary files with short pathnames or possibly…

  • CVE-2006-0870Feb 23, 2006
    Mini Nuke
    CMS System
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in pages.asp in Mini-Nuke CMS System 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: version 2.3 was later reported to be vulnerable as well.

  • CVE-2006-0720Feb 23, 2006
    Nullsoft
    Winamp
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in Nullsoft Winamp 5.12 and 5.13 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted .m3u file that causes an incorrect strncpy function call when the player pauses or stops the file.