VYPR

CVEs

343,267 total · page 6548 of 6,866

AllCriticalHighKEV
  • CVE-2006-0453Feb 14, 2006
    Red Hat
    Directory Server
    risk 0.00cvss —epss 0.02

    The LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (crash) via a certain "bad BER sequence" that results in a free of uninitialized memory, as demonstrated using the ProtoVer LDAP test suite.

  • CVE-2006-0004Feb 14, 2006
    Microsoft
    Office
    risk 0.02cvss —epss 0.31

    Microsoft PowerPoint 2000 in Office 2000 SP3 has an interaction with Internet Explorer that allows remote attackers to obtain sensitive information via a PowerPoint presentation that attempts to access objects in the Temporary Internet Files Folder (TIFF).

  • CVE-2006-0005Feb 14, 2006
    Microsoft
    Windows Media Player
    risk 0.06cvss —epss 0.44

    Buffer overflow in the plug-in for Microsoft Windows Media Player (WMP) 9 and 10, when used in browsers other than Internet Explorer and set as the default application to handle media files, allows remote attackers to execute arbitrary code via HTML with an EMBED element…

  • CVE-2006-0008Feb 14, 2006
    Microsoft
    Office
    risk 0.00cvss —epss 0.02

    The ShellAbout API call in Korean Input Method Editor (IME) in Korean versions of Microsoft Windows XP SP1 and SP2, Windows Server 2003 up to SP1, and Office 2003, allows local users to gain privileges by launching the "shell about dialog box" and clicking the "End-User License…

  • CVE-2006-0013Feb 14, 2006
    Microsoft
    Windows Xp
    risk 0.03cvss —epss 0.35

    Buffer overflow in the Web Client service (WebClnt.dll) for Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote authenticated users or Guests to execute arbitrary code via crafted RPC requests, a different vulnerability than CVE-2005-1207.

  • CVE-2006-0021Feb 14, 2006
    Microsoft
    Windows Xp
    risk 0.08cvss —epss 0.63

    Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang) via an IGMP packet with an invalid IP option, aka the "IGMP v3 DoS Vulnerability."

  • CVE-2006-0553Feb 14, 2006
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.03

    PostgreSQL 8.1.0 through 8.1.2 allows authenticated database users to gain additional privileges via "knowledge of the backend protocol" using a crafted SET ROLE to other database users, a different vulnerability than CVE-2006-0678.

  • CVE-2006-0678Feb 14, 2006
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.00

    PostgreSQL 7.3.x before 7.3.14, 7.4.x before 7.4.12, 8.0.x before 8.0.7, and 8.1.x before 8.1.3, when compiled with Asserts enabled, allows local users to cause a denial of service (server crash) via a crafted SET SESSION AUTHORIZATION command, a different vulnerability than…

  • CVE-2006-0677Feb 14, 2006
    Heimdal
    Heimdal
    risk 0.00cvss —epss 0.03

    telnetd in Heimdal 0.6.x before 0.6.6 and 0.7.x before 0.7.2 allows remote unauthenticated attackers to cause a denial of service (server crash) via unknown vectors that trigger a null dereference.

  • CVE-2006-0668Feb 13, 2006
    Pwsphp
    Pwsphp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in PwsPHP 1.2.3 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in message.php in the espace_membre module. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2006-0669Feb 13, 2006
    GA
    Forum Light
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in archive.asp in GA's Forum Light allow remote attackers to execute arbitrary SQL commands via the (1) Forum and (2) pages parameter. NOTE: SecurityTracker says that the vendor has disputed this issue, saying that GA Forum Light does not…

  • CVE-2006-0670Feb 13, 2006
    Hcidump
    hcidump
    risk 0.00cvss —epss 0.03

    Buffer overflow in l2cap.c in hcidump 1.29 allows remote attackers to cause a denial of service (crash) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet.

  • CVE-2006-0671Feb 13, 2006
    Sony Ericsson
    K600i
    risk 0.03cvss —epss 0.05

    Buffer overflow in Sony Ericsson K600i, V600i, W800i, and T68i cell phone allows remote attackers to cause a denial of service (reboot or shutdown) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet whose length…

  • CVE-2006-0672Feb 13, 2006
    Microfocus
    Psc 1210 All In One
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in HP PSC 1210 All-in-One Drivers before 1.0.06 has unknown impact and attack vectors.

  • CVE-2006-0673Feb 13, 2006
    Reamday Enterprises
    Magic Calendar Lite
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in cms/index.php in Magic Calendar Lite 1.02, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) $total_login and (2) $total_password parameter.

  • CVE-2006-0674Feb 13, 2006
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    Buffer overflow in the arp command of IBM AIX 5.3 L, 5.3, 5.2.2, 5.2 L, and 5.2 allows local users to cause a denial of service (crash) via a long iftype argument.

  • CVE-2006-0675Feb 13, 2006
    Glen Campbell
    Siteframe
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search.php in Siteframe 5.0.1 allows remote attackers to inject arbitrary web script or HTML via the q parameter.

  • CVE-2006-0676Feb 13, 2006
    PHP-Nuke
    PHP Nuke
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in header.php in PHP-Nuke 6.0 to 7.8 allows remote attackers to inject arbitrary web script or HTML via the pagetitle parameter.

  • CVE-2006-0046Feb 13, 2006
    Adzapper
    adzapper
    risk 0.00cvss —epss 0.03

    squid_redirect script in adzapper before 2006-01-29 allows remote attackers to cause a denial of service (CPU consumption) via a URL with a large number of trailing / (forward slashes), which might produce inefficient regular expressions.

  • CVE-2006-0056Feb 13, 2006
    Pam Mysql
    Pam Mysql
    risk 0.01cvss —epss 0.06

    Double free vulnerability in the authentication and authentication token alteration code in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords,…

  • CVE-2006-0597Feb 13, 2006
    Elog
    Elog
    risk 0.00cvss —epss 0.03

    Multiple stack-based buffer overflows in elogd.c in elog before 2.5.7 r1558-4 allow attackers to cause a denial of service (application crash) and possibly execute code via long "revision attributes".

  • CVE-2006-0598Feb 13, 2006
    Elog
    Elog
    risk 0.00cvss —epss 0.03

    Buffer overflow in elogd.c in elog before 2.5.7 r1558-4 allows attackers to execute code via unspecified variables, when writing to the log file.

  • CVE-2006-0599Feb 13, 2006
    Stefan Ritt
    Elog Web Logbook
    risk 0.00cvss —epss 0.02

    The (1) elog.c and (2) elogd.c components in elog before 2.5.7 r1558-4 generate different responses depending on whether or not a username is valid, which allows remote attackers to determine valid usernames.

  • CVE-2006-0600Feb 13, 2006
    Elog
    Elog
    risk 0.00cvss —epss 0.02

    elog before 2.5.7 r1558-4 allows remote attackers to cause a denial of service (infinite redirection) via a request with the fail parameter set to 1, which redirects to the same request.

  • CVE-2006-0647Feb 13, 2006
    Sun Corporation
    Java System Directory Server
    risk 0.04cvss —epss 0.10

    LDAP service in Sun Java System Directory Server 5.2, running on Linux and possibly other platforms, allows remote attackers to cause a denial of service (memory allocation error) via an LDAP packet with a crafted subtree search request, as demonstrated using the ProtoVer LDAP…

  • CVE-2006-0648Feb 13, 2006
    PHP Icalendar
    Phpicalendar
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in PHP iCalendar 2.0.1, 2.1, and 2.2 allow remote attackers to include arbitrary files via the (1) getdate and possibly other parameters used in the replace_files function in search.php and (2) $file variable as used in the parse…

  • CVE-2006-0649Feb 13, 2006
    Dataparksearch
    Dataparksearch
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in DataparkSearch before 4.37 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-0650Feb 13, 2006
    Cpaint
    Cpaint
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in cpaint2.inc.php in the CPAINT library before 2.0.3, as used in multiple scripts, allows remote attackers to inject arbitrary web script or HTML via the cpaint_response_type parameter, which is displayed in a resulting error message, as…

  • CVE-2006-0651Feb 13, 2006
    Vwdev
    Vwdev
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in vwdev allows remote attackers to execute arbitrary SQL commands via the UID parameter in the definition Page.

  • CVE-2006-0652Feb 13, 2006
    Whmcompletesolution
    Whmcompletesolution
    risk 0.00cvss —epss 0.01

    WHMCompleteSolution (WHMCS) before 2.3 assigns incorrect permissions to "resellers", which allows remote authenticated users to perform privileged actions or obtain sensitive information. NOTE: this report is based on a vendor bug report that identified "incorrect permissions."…

  • CVE-2006-0653Feb 13, 2006
    Hinton Design
    Phpht Topsites
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Hinton Design phpht Topsites 1.3 allow remote attackers to execute arbitrary SQL commands via multiple vectors including the username parameter.

  • CVE-2006-0654Feb 13, 2006
    Hinton Design
    Phpht Topsites
    risk 0.00cvss —epss 0.02

    check.php in Hinton Design phpht Topsites 1.3 does not validate passwords when using cookies, which allows remote attackers to bypass authentication via unspecified cookies.

  • CVE-2006-0655Feb 13, 2006
    Hinton Design
    Phpht Topsites
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in (1) link_edited.php and (2) link_added.php in Hinton Design phpht Topsites 1.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-0656Feb 13, 2006
    Microfocus
    Systems Insight Manager
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in HP Systems Insight Manager 4.2 through 5.0 SP3 for Windows allows remote attackers to access arbitrary files via unspecified vectors, a different vulnerability than CVE-2005-2006.

  • CVE-2006-0657Feb 13, 2006
    Softcomplex
    PHP Event Calendar
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Softcomplex PHP Event Calendar 1.5 allows remote authenticated users to inject arbitrary web script or HTML, and corrupt data, via the (1) username and (2) password parameters, which are not sanitized before being written to users.php.…

  • CVE-2006-0658Feb 13, 2006
    Fckeditor
    Fckeditor
    risk 0.04cvss —epss 0.07

    Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the…

  • CVE-2006-0659Feb 13, 2006
    Runcms
    Runcms
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file include vulnerabilities in RunCMS 1.2 and earlier, with register_globals and allow_url_fopen enabled, allow remote attackers to execute arbitrary code via the bbPath[path] parameter in (1) class.forumposts.php and (2) forumpollrenderer.php.

  • CVE-2006-0660Feb 13, 2006
    Farsinews
    Farsinews
    risk 0.03cvss —epss 0.05

    Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to (1) read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or (2) include arbitrary files via the…

  • CVE-2006-0661Feb 13, 2006
    Scriptme
    Sme Blog Host
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Scriptme SmE GB Host 1.21 and SmE Blog Host allows remote attackers to inject arbitrary web script or HTML via the BBcode url tag.

  • CVE-2006-0662Feb 13, 2006
    IBM
    Lotus Domino iNotes Client
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Lotus Domino iNotes Client 6.5.4 allows remote attackers to inject arbitrary web script or HTML via email with attached html files, which are directly rendered in the browser.

  • CVE-2006-0663Feb 13, 2006
    IBM
    Lotus Domino iNotes Client
    risk 0.03cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in Lotus Domino iNotes Client 6.5.4 and 7.0 allow remote attackers to inject arbitrary web script or HTML via (1) an email subject; (2) an encoded javascript URI, as demonstrated using "java script:"; or (3) when the Domino…

  • CVE-2006-0664Feb 13, 2006
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in config_defaults_inc.php in Mantis before 1.0 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third…

  • CVE-2006-0665Feb 13, 2006
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in (1) query_store.php and (2) manage_proj_create.php in Mantis before 1.0.0 has unknown impact and attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. An original vendor…

  • CVE-2006-0646Feb 11, 2006
    SUSE S.A.
    Linux
    risk 0.00cvss —epss 0.00

    ld in SUSE Linux 9.1 through 10.0, and SLES 9, in certain circumstances when linking binaries, can leave an empty RPATH or RUNPATH, which allows local attackers to execute arbitrary code as other users via by running an ld-linked application from the current directory, which…

  • CVE-2006-0645Feb 10, 2006
    GNU
    Gnutls
    risk 0.00cvss —epss 0.04

    Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via "out-of-bounds access" caused by invalid input, as demonstrated by…

  • CVE-2006-0628Feb 10, 2006
    Dale Ray
    Myquiz
    risk 0.03cvss —epss 0.06

    myquiz.pl in Dale Ray MyQuiz 1.01 allows remote attackers to execute arbitrary commands via shell metacharacters in the URL, which are not properly handled as part of the PATH_INFO environment variable.

  • CVE-2006-0629Feb 10, 2006
    AOL
    Instant Messenger
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in AOL Instant Messenger (AIM) 5.9.3861 allows user-assisted remote attackers to cause a denial of service (client crash) and possibly execute arbitrary code by tricking the user into requesting Buddy Info about a long screen name, which might cause a…

  • CVE-2006-0630Feb 10, 2006
    Ritlabs
    The Bat
    risk 0.00cvss —epss 0.02

    RITLabs The Bat! before 3.0.0.15 displays certain important headers from encapsulated data in message/partial MIME messages, instead of the real headers, which is in violation of RFC2046 header merging rules and allows remote attackers to spoof the origin of e-mail by sending a…

  • CVE-2006-0631Feb 10, 2006
    Erik C. Thauvin
    Mailback
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in mailback.pl in Erik C. Thauvin mailback allows remote attackers to use mailback as a "spam proxy" by modifying mail headers, including recipient e-mail addresses, via newline characters in the Subject field.

  • CVE-2006-0632Feb 10, 2006
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.03

    The gen_rand_string function in phpBB 2.0.19 uses insufficiently random data (small value space) to create the activation key ("validation ID") that is sent by e-mail when establishing a password, which makes it easier for remote attackers to obtain the key and modify passwords…