VYPR

CVEs

343,267 total · page 6550 of 6,866

AllCriticalHighKEV
  • CVE-2006-0589Feb 8, 2006
    MyTopix
    MyTopix
    risk 0.00cvss —epss 0.02

    MyTopix 1.2.3 allows remote attackers to obtain the installation path via a direct request to logon.mod.php, which leaks the path in an error message.

  • CVE-2006-0590Feb 8, 2006
    MyTopix
    MyTopix
    risk 0.00cvss —epss 0.02

    MyTopix 1.2.3 allows remote attackers to obtain the installation path via an invalid hl parameter to index.php, which leads to path disclosure, possibly related to invalid SQL syntax.

  • CVE-2006-0591Feb 8, 2006
    Openwall
    Crypt Blowfish
    risk 0.00cvss —epss 0.00

    The crypt_gensalt functions for BSDI-style extended DES-based and FreeBSD-sytle MD5-based password hashes in crypt_blowfish 0.4.7 and earlier do not evenly and randomly distribute salts, which makes it easier for attackers to guess passwords from a stolen password file due to…

  • CVE-2006-0592Feb 8, 2006
    Lexmark
    Printer Sharing
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the Lexmark Printer Sharing LexBce Server Service (LexPPS), possibly 8.29 and 9.41, allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based on a vague initial disclosure; details will be updated…

  • CVE-2006-0593Feb 8, 2006
    PHP-Fusion
    Phpfusion
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the (1) shout_name field in shoutbox_panel.php and the (2) comments field in comments_include.php.

  • CVE-2006-0576Feb 8, 2006
    OProfile
    OProfile
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in opcontrol in OProfile 0.9.1 and earlier allows local users to execute arbitrary commands via a modified PATH that references malicious (1) which or (2) dirname programs. NOTE: while opcontrol normally is not run setuid, a common…

  • CVE-2006-0577Feb 8, 2006
    Lexmark
    X1185
    risk 0.00cvss —epss 0.00

    Lexmark X1185 printer allows local users to gain SYSTEM privileges by navigating to the "Appearance" dialog and selecting the "Additional styles (skins) are available on the Lexmark web site" option, which launches a web browser that is running with SYSTEM privileges.

  • CVE-2006-0575Feb 7, 2006
    Thibault Godouet
    Fcron
    risk 0.00cvss —epss 0.02

    convert-fcrontab in Fcron 2.9.5 and 3.0.0 allows remote attackers to create or overwrite arbitrary files via ".." sequences and a symlink attack on the temporary file that is used during conversion.

  • CVE-2006-0454Feb 7, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    Linux kernel before 2.6.15.3 down to 2.6.12, while constructing an ICMP response in icmp_send, does not properly handle when the ip_options_echo function in icmp.c fails, which allows remote attackers to cause a denial of service (crash) via vectors such as (1) record-route and…

  • CVE-2006-0567Feb 7, 2006
    Xaraya
    Files
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Files Xaraya module before 0.5.1, when the Archive Directory field on the Modify Config page is blank, allows remote attackers to access files outside of the web root via ".." (dot dot) sequences.

  • CVE-2006-0568Feb 7, 2006
    Outblaze
    Outblaze
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in throw.main in Outblaze allows remote attackers to inject arbitrary web script or HTML via the file parameter.

  • CVE-2006-0569Feb 7, 2006
    Papoo
    Papoo
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in user_class.php in Papoo 2.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the username field during the registration of a new account. NOTE: the provenance of this information is unknown; the details…

  • CVE-2006-0570Feb 7, 2006
    Phpstatus
    phpstatus
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in phpstatus 1.0, when gpc_magic_quotes is disabled, allow remote attackers to execute arbitrary SQL commands and bypass authentication via (1) the username parameter in check.php and (2) unknown attack vectors in the administrative…

  • CVE-2006-0571Feb 7, 2006
    Hinton Design
    Phpstatus
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in phpstatus 1.0 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in the administrative interface.

  • CVE-2006-0572Feb 7, 2006
    Hinton Design
    Phpstatus
    risk 0.00cvss —epss 0.02

    phpstatus 1.0 does not require passwords when using cookies to identify a user, which allows remote attackers to bypass authentication.

  • CVE-2006-0573Feb 7, 2006
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilies in cPanel 10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to (a) editquota.html or (b) dodelpop.html; (2) showtree parameter to (c) diskusage.html; or the (3) mon, (4)…

  • CVE-2006-0574Feb 7, 2006
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in mime/handle.html in cPanel 10 allows remote attackers to inject arbitrary web script or HTML via the (1) file extension or (2) mime-type.

  • CVE-2006-0513Feb 6, 2006
    IBM
    Tivoli Web Server Plug-in
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in pkmslogout in Tivoli Web Server Plug-in 5.1.0.10 in Tivoli Access Manager (TAM) 5.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.

  • CVE-2006-0562Feb 6, 2006
    Pluggedout
    Blog
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in problem.php in PluggedOut Blog 1.9.9c allows remote attackers to inject arbitrary web script or HTML via the data parameter.

  • CVE-2006-0563Feb 6, 2006
    Pluggedout
    Blog
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in exec.php in PluggedOut Blog 1.9.9c allows remote attackers to execute arbitrary SQL commands via the entryid parameter in a comment_add action.

  • CVE-2006-0564Feb 6, 2006
    Microsoft
    HTML Help Workshop
    risk 0.09cvss —epss 0.71

    Stack-based buffer overflow in Microsoft HTML Help Workshop 4.74.8702.0, and possibly earlier versions, and as included in the Microsoft HTML Help 1.4 SDK, allows context-dependent attackers to execute arbitrary code via a .hhp file with a long Contents file field.

  • CVE-2006-0565Feb 6, 2006
    Loudblog
    Loudblog
    risk 0.04cvss —epss 0.09

    PHP remote file include vulnerability in inc/backend_settings.php in Loudblog 0.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the $GLOBALS[path] parameter.

  • CVE-2006-0566Feb 6, 2006
    Stalker
    Communigate Pro
    risk 0.00cvss —epss 0.02

    The LDAP component in CommuniGate Pro Core Server 5.0.7 allows remote attackers to cause a denial of service (application crash) via LDAP messages that contain Distinguished Names (DN) fields with a large number of elements.

  • CVE-2006-0437Feb 6, 2006
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin_smilies.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as "onmouseover" in the (1) smile_url or (2) smile_emotion parameters, which bypasses a check for "<" and ">"…

  • CVE-2006-0438Feb 6, 2006
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode (IMG) are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to (1)…

  • CVE-2006-0552Feb 4, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in the Net Listener component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, and 9.2.0.7 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB11.

  • CVE-2006-0539Feb 4, 2006
    Fcron
    Fcron
    risk 0.03cvss —epss 0.01

    The convert-fcrontab program in fcron 3.0.0 might allow local users to gain privileges via a long command-line argument, which causes Linux glibc to report heap memory corruption, possibly because a strcpy in the strdup2 function can "overwrite some data."

  • CVE-2006-0540Feb 4, 2006
    Tachyon
    Vanilla Guestbook
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2006-0541Feb 4, 2006
    Tachyon
    Vanilla Guestbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to "posting new messages."

  • CVE-2006-0542Feb 4, 2006
    Nukedweb
    Guestbookhost
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in config.php in NukedWeb GuestBookHost 2005.04.25 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameters.

  • CVE-2006-0543Feb 4, 2006
    Cerulean Studios
    Trillian
    risk 0.00cvss —epss 0.01

    Cerulean Trillian 3.1.0.120 allows remote attackers to cause a denial of service (client crash) via an AIM message containing the Mac encoded Rich Text Format (RTF) escape sequences (1) \'d1, (2) \'d2, (3) \'d3, (4) \'d4, and (5) \'d5. NOTE: the provenance of this information…

  • CVE-2006-0544Feb 4, 2006
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.22

    urlmon.dll in Microsoft Internet Explorer 7.0 beta 2 (aka 7.0.5296.0) allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a BGSOUND element with its SRC attribute set to "file://" followed by a large number of "-"…

  • CVE-2006-0545Feb 4, 2006
    Groupee
    UBB.threads
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in showflat.php in Groupee (formerly known as Infopop) UBB.threads 6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Number parameter.

  • CVE-2006-0546Feb 4, 2006
    Egeinternet
    Egeinternet
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in index.php in a certain application available from /v1/tr/portfoy.php on www.egeinternet.com allows remote attackers to execute arbitrary code via "evilcode" in the key parameter, possibly a PHP remote file include vulnerability in which the attack…

  • CVE-2006-0547Feb 4, 2006
    Oracle Corporation
    Database Server
    risk 0.01cvss —epss 0.10

    Oracle Database 8i, 9i, and 10g allow remote authenticated users to execute arbitrary SQL statements in the context of the SYS user and bypass audit logging, including statements to create new privileged database accounts, via a modified AUTH_ALTER_SESSION attribute in the…

  • CVE-2006-0548Feb 4, 2006
    Oracle Corporation
    Database 10g
    risk 0.00cvss —epss 0.04

    SQL injection vulnerability in the Oracle Text component of Oracle Database 10g, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE…

  • CVE-2006-0549Feb 4, 2006
    Oracle Corporation
    Database 10g
    risk 0.04cvss —epss 0.08

    SQL injection vulnerability in the SYS.DBMS_METADATA_UTIL package in Oracle Database 10g, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a…

  • CVE-2006-0550Feb 4, 2006
    Oracle Corporation
    Oracle Client
    risk 0.01cvss —epss 0.08

    Buffer overflow in an unspecified Oracle Client utility might allow remote attackers to execute arbitrary code or cause a denial of service. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively…

  • CVE-2006-0551Feb 4, 2006
    Oracle Corporation
    Database 10g
    risk 0.00cvss —epss 0.04

    SQL injection vulnerability in the Data Pump Metadata API in Oracle Database 10g and possibly earlier might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being…

  • CVE-2006-0531Feb 4, 2006
    Sun Corporation
    Java System Access Manager
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Sun Java System Access Manager 7.0 allows local users logged in as "root" to bypass authentication and gain top-level administrator privileges via the amadmin CLI tool.

  • CVE-2006-0532Feb 4, 2006
    Viart
    Shop
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in resultat.asp in SoftMaker Shop allows remote attackers to inject arbitrary web script or HTML via a strSok parameter containing a javascript: URI in an IMG SRC attribute.

  • CVE-2006-0533Feb 4, 2006
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in webmailaging.cgi in cPanel allows remote attackers to inject arbitrary web script or HTML via the numdays parameter.

  • CVE-2006-0534Feb 4, 2006
    Cybershop
    Asp Ultimate E Commerce Script
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in default.asp in CyberShop Ultimate E-commerce allow remote attackers to inject arbitrary web script or HTML via the (1) ortak or (2) kat parameter.

  • CVE-2006-0535Feb 4, 2006
    Communityserver.org
    Community Server
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Community Server allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NOTE: this candidate does not contain any actionable or distinguishing information. Perhaps it should not be…

  • CVE-2006-0536Feb 4, 2006
    Neomail
    Neomail
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in neomail.pl in NeoMail 1.27 allows remote attackers to inject arbitrary web script or HTML via the sort parameter. NOTE: some sources say that the affected parameter is "date," but the demonstration URL shows that it is "sort".

  • CVE-2006-0537Feb 4, 2006
    Kinesphere Corporation
    Exchange POP3
    risk 0.06cvss —epss 0.41

    Buffer overflow in the POP3 server in Kinesphere Corporation eXchange before 5.0.060125 allows remote attackers to execute arbitrary code via a long RCPT TO argument.

  • CVE-2006-0538Feb 4, 2006
    Ciphertrust
    Ironmail
    risk 0.00cvss —epss 0.02

    CipherTrust IronMail 5.0.1, when "Denial of Service Protection" is enabled, allows remote attackers to cause a denial of service (possibly CPU consumption) via a SYN flood with malformed TCP packets from multiple connections.

  • CVE-2006-0299Feb 2, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the…

  • CVE-2006-0297Feb 2, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Multiple integer overflows in Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the (1) EscapeAttributeValue in jsxml.c for E4X, (2) nsSVGCairoSurface::Init in SVG, and (3)…

  • CVE-2006-0298Feb 2, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The XML parser in Mozilla Firefox before 1.5.0.1 and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly read sensitive data via unknown attack vectors that trigger an out-of-bounds read.