VYPR

CVEs

343,281 total · page 6545 of 6,866

AllCriticalHighKEV
  • CVE-2006-0855Feb 23, 2006
    Zoo
    zoo
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the fullpath function in misc.c for zoo 2.10 and earlier, as used in products such as Barracuda Spam Firewall, allows user-assisted attackers to execute arbitrary code via a crafted ZOO file that causes the combine function to return a longer…

  • CVE-2006-0803Feb 23, 2006
    Novell
    YaST Online Update
    risk 0.00cvss —epss 0.02

    The signature verification functionality in the YaST Online Update (YOU) script handling relies on a gpg feature that is not intended for signature verification, which prevents YOU from detecting malicious scripts or code that do not pass the signature check when gpg 1.4.x is…

  • CVE-2006-0812Feb 23, 2006
    Visnetic
    Visnetic Antivirus Plug In For Mail Server
    risk 0.00cvss —epss 0.00

    The VisNetic AntiVirus Plug-in (DKAVUpSch.exe) for Mail Server 4.6.0.4, 4.6.1.1, and possibly other versions before 4.6.1.2, does not drop privileges before executing other programs, which allows local users to gain privileges.

  • CVE-2006-0850Feb 23, 2006
    Ilch.de
    Ilchclan
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in include/includes/user/login.php in ilchClan before 1.05g allows remote attackers to execute arbitrary SQL commands via the login_name parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-0851Feb 23, 2006
    IlchClan
    ilchClan
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the forum module of ilchClan 1.05g and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter, when creating a newpost.

  • CVE-2006-0852Feb 23, 2006
    Devscripts
    Admbook
    risk 0.03cvss —epss 0.03

    Direct static code injection vulnerability in write.php in Admbook 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via the X-Forwarded-For HTTP header field, which is inserted into content-data.php.

  • CVE-2006-0853Feb 23, 2006
    True North
    Ia Emailserver
    risk 0.00cvss —epss 0.03

    Buffer overflow in the IMAP service of TrueNorth Internet Anywhere (IA) eMailserver 5.3.4 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long SEARCH argument.

  • CVE-2006-0854Feb 23, 2006
    Intensive Point
    Iuser Ecommerce
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in common.php in Intensive Point iUser Ecommerce allows remote attackers to include arbitrary files via a URL in the include_path variable, which is not initialized before being used.

  • CVE-2006-0848Feb 22, 2006
    Apple Inc.
    Mac OS X
    risk 0.08cvss —epss 0.58

    The "Open 'safe' files after downloading" option in Safari on Apple Mac OS X allows remote user-assisted attackers to execute arbitrary commands by tricking a user into downloading a __MACOSX folder that contains metadata (resource fork) that invokes the Terminal, which…

  • CVE-2006-0834Feb 22, 2006
    Uniden
    Uip1868p
    risk 0.00cvss —epss 0.01

    Uniden UIP1868P VoIP Telephone and Router has a default password of admin for the web-based configuration utility, which allows remote attackers to obtain sensitive information on the device such as telephone numbers called, and possibly connect to other hosts. NOTE: it is…

  • CVE-2006-0835Feb 22, 2006
    Mitridat
    Web Calendar Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in dropbase.php in MitriDAT Web Calendar Pro allows remote attackers to modify internal SQL queries and cause a denial of service (inaccessible database) via the tabls parameter.

  • CVE-2006-0836Feb 22, 2006
    Mozilla Corporation
    Thunderbird
    risk 0.03cvss —epss 0.03

    Mozilla Thunderbird 1.5 allows user-assisted attackers to cause an unspecified denial of service by tricking the user into importing an LDIF file with a long field into the address book, as demonstrated by a long homePhone field.

  • CVE-2006-0837Feb 22, 2006
    IBM
    Netcool/NeuSecure
    risk 0.00cvss —epss 0.00

    IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 has world-readable permissions for (1) /etc/neusecure.conf, (2) /opt/NeuSecure/etc/cms-3.0.236.buildconf, and (3) /opt/NeuSecure/bin/ns_archiver.log, which allows local users to read sensitive information such as passwords. NOTE:…

  • CVE-2006-0838Feb 22, 2006
    IBM
    Netcool/NeuSecure
    risk 0.00cvss —epss 0.00

    IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 stores cleartext passwords in the (1) CMS_DBPASS, (2) CMSM_DBPASS, and (3) RPT_DBPASS fields in /etc/neusecure.conf, and in (4) /opt/NeuSecure/bin/ns_archiver.log, which allows local users to gain privileges. NOTE: IBM has…

  • CVE-2006-0839Feb 22, 2006
    Sourcefire
    Snort
    risk 0.00cvss —epss 0.01

    The frag3 preprocessor in Sourcefire Snort 2.4.3 does not properly reassemble certain fragmented packets with IP options, which allows remote attackers to evade detection of certain attacks, possibly related to IP option lengths.

  • CVE-2006-0840Feb 22, 2006
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.02

    manage_user_page.php in Mantis 1.00rc4 and earlier does not properly handle a sort parameter containing a ' (quote) character, which allows remote attackers to trigger a SQL error that may be repeatedly reported to a user who makes subsequent web accesses with the…

  • CVE-2006-0841Feb 22, 2006
    Mantisbt
    Mantis
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in Mantis 1.00rc4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) hide_status, (2) handler_id, (3) user_monitor, (4) reporter_id, (5) view_type, (6) show_severity, (7) show_category, (8)…

  • CVE-2006-0842Feb 22, 2006
    Atmail
    @Mail
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Calacode @Mail 4.3 allows remote attackers to inject arbitrary web script or HTML via a modified javascript: string in the SRC attribute of an IMG element in an e-mail message, as demonstrated by "java script:." NOTE: the…

  • CVE-2006-0843Feb 22, 2006
    Leif M. Wright
    Blog 3.5
    risk 0.00cvss —epss 0.01

    Leif M. Wright's Blog 3.5 stores the config file and other txt files under the web root with insufficient access control, which allows remote attackers to read the administrator's password.

  • CVE-2006-0844Feb 22, 2006
    Leif M. Wright
    Blog 3.5
    risk 0.00cvss —epss 0.02

    Leif M. Wright's Blog 3.5 does not make a password comparison when authenticating an administrator via a cookie, which allows remote attackers to bypass login authentication, probably by setting the blogAdmin cookie.

  • CVE-2006-0845Feb 22, 2006
    Leif M. Wright
    Blog 3.5
    risk 0.00cvss —epss 0.01

    Leif M. Wright's Blog 3.5 allows remote authenticated users with administrative privileges to execute arbitrary programs, including shell commands, by configuring the sendmail path to a malicious pathname.

  • CVE-2006-0846Feb 22, 2006
    Leif M. Wright
    Blog 3.5
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Leif M. Wright's Blog 3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) Referer and (2) User-Agent HTTP headers, which are stored in a log file and not sanitized when the administrator views the…

  • CVE-2006-0847Feb 22, 2006
    Cherrypy
    Cherrypy
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors.

  • CVE-2006-0832Feb 22, 2006
    Wpc.easy
    Wpc.easy
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in admin.asp in WPC.easy allow remote attackers to execute arbitrary SQL commands via the (1) uid and (2) pwd parameter.

  • CVE-2006-0833Feb 22, 2006
    Boonex
    Barracuda Directory
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Barracuda Directory 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) Add URL and (2) Suggest Category module. NOTE: the provenance of this information is unknown; portions…

  • CVE-2006-0821Feb 21, 2006
    Bxcp
    Bxcp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in BXCP 0.299 allows remote attackers to execute arbitrary SQL commands via the tid parameter.

  • CVE-2006-0822Feb 21, 2006
    EmuLinker
    Kaillera Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in EmuLinker Kaillera Server before 0.99.17 allows remote attackers to cause a denial of service (probably resource consumption) via a crafted packet that causes a "ghost game" to be left on the server.

  • CVE-2006-0823Feb 21, 2006
    Geeklog
    Geeklog
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to inject arbitrary SQL commands via the (1) userid variable to users.php or (2) sessid variable to lib-sessions.php.

  • CVE-2006-0824Feb 21, 2006
    Geeklog
    Geeklog
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in lib-common.php in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to include arbitrary local files and execute arbitrary code via (1) absolute paths in unspecified parameters and (2) the language cookie, as…

  • CVE-2006-0825Feb 21, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allow remote attackers to bypass authentication or gain "unauthorized network access" via…

  • CVE-2006-0826Feb 21, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allows remote attackers to cause a denial of service via a crafted Postscript request.

  • CVE-2006-0827Feb 21, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Cross-site scripting vulnerability in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  • CVE-2006-0828Feb 21, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allows remote attackers to "reduce effectiveness of security features" via unknown attack vectors.

  • CVE-2006-0829Feb 21, 2006
    Futurenuke
    Platinum
    risk 0.00cvss —epss 0.02

    Cross-site scripting vulnerability in E-Blah Platinum 9.7 allows remote attackers to inject arbitrary web script or HTML via the referer (HTTP_REFERER), which is not sanitized when the log file is viewed by the administrator using "Click Log".

  • CVE-2006-0830Feb 21, 2006
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.14

    The scripting engine in Internet Explorer allows remote attackers to cause a denial of service (resource consumption) and possibly execute arbitrary code via a web page that contains a recurrent call to an infinite loop in Javascript or VBscript, which consumes the stack, as…

  • CVE-2006-0831Feb 21, 2006
    Tasarim Rehberi
    Tasarim Rehberi
    risk 0.00cvss —epss 0.01

    PHP remote file include vulnerability in index.php in Tasarim Rehberi allows remote attackers to execute arbitrary PHP code via a URL in the (1) sayfaadi or (2) sayfa parameter. NOTE: this might be a site-specific issue. If so, it should not be included in CVE.

  • CVE-2006-0805Feb 21, 2006
    PHP-Nuke
    PHP Nuke
    risk 0.03cvss —epss 0.03

    The CAPTCHA functionality in php-Nuke 6.0 through 7.9 uses fixed challenge/response pairs that only vary once per day based on the User Agent (HTTP_USER_AGENT), which allows remote attackers to bypass CAPTCHA controls by fixing the User Agent, performing a valid…

  • CVE-2006-0806Feb 21, 2006
    Adodb
    Adodb
    risk 0.03cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via (1) the next_page parameter in adodb-pager.inc.php and (2) other unspecified vectors related to…

  • CVE-2006-0807Feb 21, 2006
    Njstar
    Japanese Word Processor
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in NJStar Chinese and Japanese Word Processor 4.x and 5.x before 5.10 allows user-assisted attackers to execute arbitrary code via font names in NJStar (.njx) documents.

  • CVE-2006-0808Feb 21, 2006
    Mute
    Mute
    risk 0.00cvss —epss 0.02

    MUTE 0.4 allows remote attackers to cause a denial of service (messages not forwarded) and obtain sensitive information about a target by filling a client's mWebCache cache with malicious "zombie" nodes.

  • CVE-2006-0809Feb 21, 2006
    Skate Board
    Skate Board
    risk 0.00cvss —epss 0.03

    Multiple SQL injection vulnerabilities in Skate Board 0.9 allow remote attackers to execute arbitrary SQL commands via the (1) usern parameter in (a) sendpass.php, and the (2) usern and (3) passwd parameters and (4) sf_cookie cookie in (b) login.php and (c) logged.php.

  • CVE-2006-0810Feb 21, 2006
    Skate Board
    Skate Board
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in config.php in Skate Board 0.9 allows remote authenticated administrators to execute arbitrary PHP code by causing certain variables in config.php to be modified, possibly due to XSS or direct static code injection.

  • CVE-2006-0811Feb 21, 2006
    Skate Board
    Skate Board
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in reguser.php in Skate Board 0.9 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters involved with the registration form.

  • CVE-2006-0804Feb 21, 2006
    Tin
    Tin
    risk 0.00cvss —epss 0.03

    Off-by-one error in TIN 1.8.0 and earlier might allow attackers to execute arbitrary code via unknown vectors that trigger a buffer overflow.

  • CVE-2006-0800Feb 20, 2006
    Postnuke
    Postnuke
    risk 0.03cvss —epss 0.02

    Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing "<" character, which is interpreted as a ">" character by some web browsers but bypasses the blacklist protection in (1) the…

  • CVE-2006-0801Feb 20, 2006
    Postnuke
    NS-Languages
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is off, allows remote attackers to execute arbitrary SQL commands via the language parameter to admin.php.

  • CVE-2006-0802Feb 20, 2006
    Postnuke
    NS-Languages
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is enabled, allows remote attackers to inject arbitrary web script or HTML via the language parameter in a missing or translation operation.

  • CVE-2006-0790Feb 19, 2006
    Rockliffe
    Mailsite
    risk 0.00cvss —epss 0.02

    Rockliffe MailSite 7.0 and earlier allows remote attackers to cause a denial of service by sending crafted LDAP packets to port 389/TCP, as demonstrated by the ProtoVer LDAP testsuite.

  • CVE-2006-0791Feb 19, 2006
    Dreamcost
    Hostadmin
    risk 0.04cvss —epss 0.07

    PHP remote file inclusion vulnerability in index.php in DreamCost HostAdmin allows remote attackers to include arbitrary files via the $path variable, which is not initialized before use.

  • CVE-2006-0792Feb 19, 2006
    V Webmail
    V Webmail
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in preferences.personal.php in V-webmail 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the newid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…