VYPR

CVEs

343,267 total · page 6551 of 6,866

AllCriticalHighKEV
  • CVE-2006-0292Feb 2, 2006
    Mozilla Corporation
    Mozilla
    risk 0.00cvss —epss 0.04

    The Javascript interpreter (jsinterp.c) in Mozilla and Firefox before 1.5.1 does not properly dereference objects, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via unknown attack vectors related to garbage collection.

  • CVE-2006-0293Feb 2, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The function allocation code (js_NewFunction in jsfun.c) in Firefox 1.5 allows attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via user-defined methods that trigger garbage collection in a way that operates on freed objects.

  • CVE-2006-0294Feb 2, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.

  • CVE-2006-0295Feb 2, 2006
    Mozilla Corporation
    Firefox
    risk 0.09cvss —epss 0.71

    Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the QueryInterface method of the built-in Location and Navigator objects, which leads to memory corruption.

  • CVE-2006-0296Feb 2, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The XULDocument.persist function in Mozilla, Firefox before 1.5.0.1, and SeaMonkey before 1.0 does not validate the attribute name, which allows remote attackers to execute arbitrary Javascript by injecting RDF data into the user's localstore.rdf file.

  • CVE-2006-0529Feb 2, 2006
    Ca
    Message Queuing
    risk 0.00cvss —epss 0.03

    Computer Associates (CA) Message Queuing (CAM / CAFT) before 1.07 Build 220_16 and 1.11 Build 29_20, as used in multiple CA products, allows remote attackers to cause a denial of service via a crafted message to TCP port 4105.

  • CVE-2006-0530Feb 2, 2006
    Ca
    Message Queuing
    risk 0.00cvss —epss 0.03

    Computer Associates (CA) Message Queuing (CAM / CAFT) before 1.07 Build 220_16 and 1.11 Build 29_20, as used in multiple CA products, allows remote attackers to cause a denial of service via spoofed CAM control messages.

  • CVE-2006-0433Feb 2, 2006
    FreeBSD
    FreeBSD
    risk 0.00cvss —epss 0.03

    Selective Acknowledgement (SACK) in FreeBSD 5.3 and 5.4 does not properly handle an incoming selective acknowledgement when there is insufficient memory, which might allow remote attackers to cause a denial of service (infinite loop).

  • CVE-2006-0512Feb 2, 2006
    Padl Software
    Migrationtools
    risk 0.00cvss —epss 0.00

    PADL MigrationTools 46 creates temporary files insecurely, which allows local users to overwrite arbitrary files via a symlink attack on the temporary files, which are not properly created by (1) migrate_all_online.sh, (2) migrate_all_offline.sh, (3)…

  • CVE-2006-0516Feb 2, 2006
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the kernel processing in Solaris 10 64 bit platform, when running in 64-bit mode, allows local users to cause a denial of service (system panic) via unknown attack vectors.

  • CVE-2006-0517Feb 2, 2006
    Spip
    Spip
    risk 0.00cvss —epss 0.03

    Multiple SQL injection vulnerabilities in formulaires/inc-formulaire_forum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id_forum, (2) id_article, or (3) id_breve parameters to forum.php3;…

  • CVE-2006-0518Feb 2, 2006
    Spip
    Spip
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in index.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

  • CVE-2006-0519Feb 2, 2006
    Spip
    Spip
    risk 0.00cvss —epss 0.02

    SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to obtain sensitive information via a direct request to inc-messforum.php3, which reveals the path in an error message.

  • CVE-2006-0520Feb 2, 2006
    Dragoran
    Portal Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability index.php in Dragoran Portal module 1.3 for Invision Power Board (IPB) allows remote attackers to execute arbitrary SQL commands via the site parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third…

  • CVE-2006-0521Feb 2, 2006
    Browsercrm
    Browsercrm
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in results.php in BrowserCRM allows remote attackers to inject arbitrary web script or HTML via certain manipulations of the query parameter, as demonstrated using an IMG SRC tag.

  • CVE-2006-0522Feb 2, 2006
    Symantec
    Sygate Management Server
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in the Authentication Servlet in Symantec Sygate Management Server (SMS) version 4.1 build 1417 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via unknown attack vectors related to a URL.

  • CVE-2006-0523Feb 2, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in global.php in MyBB before 1.03 allows remote attackers to execute arbitrary SQL commands via the templatelist variable.

  • CVE-2006-0524Feb 2, 2006
    Derek Ashauer
    ashNews
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in ashnews.php in Derek Ashauer ashNews 0.83 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2006-0525Feb 2, 2006
    Adobe Inc.
    Photoshop
    risk 0.00cvss —epss 0.01

    Multiple Adobe products, including (1) Photoshop CS2, (2) Illustrator CS2, and (3) Adobe Help Center, install a large number of .EXE and .DLL files with write-access permission for the Everyone group, which allows local users to gain privileges via Trojan horse programs.

  • CVE-2006-0526Feb 2, 2006
    AOL
    Aol Client Software
    risk 0.00cvss —epss 0.00

    The default configuration of the America Online (AOL) client software allows all users to modify a certain registry value that specifies a DLL file name, which might allow local users to gain privileges via a Trojan horse program.

  • CVE-2006-0527Feb 2, 2006
    BIND
    BIND
    risk 0.01cvss —epss 0.08

    BIND 4 (BIND4) and BIND 8 (BIND8), if used as a target forwarder, allows remote attackers to gain privileged access via a "Kashpureff-style DNS cache corruption" attack.

  • CVE-2006-0528Feb 2, 2006
    GNOME Foundation
    Evolution
    risk 0.04cvss —epss 0.09

    The cairo library (libcairo), as used in GNOME Evolution and possibly other products, allows remote attackers to cause a denial of service (persistent client crash) via an attached text file that contains "Content-Disposition: inline" in the header, and a very long line in the…

  • CVE-2006-0505Feb 1, 2006
    Zbattle.net
    Zbattle Client
    risk 0.00cvss —epss 0.01

    zbattle.net Zbattle client 1.09 SR-1 beta allows remote attackers to cause an unspecified denial of service by rapidly creating and closing a game.

  • CVE-2006-0506Feb 1, 2006
    Nuked Klan
    Nuked Klan
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Nuked-klaN 1.7 allows remote attackers to inject arbitrary web script or HTML via the letter parameter.

  • CVE-2006-0507Feb 1, 2006
    Easy CMS
    Easy CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Easy CMS allow remote attackers to inject arbitrary web script or HTML via (1) unknown attack vectors in the administrative interface and (2) input fields of the contact form.

  • CVE-2006-0508Feb 1, 2006
    Easy CMS
    Easy CMS
    risk 0.00cvss —epss 0.01

    Easy CMS stores the images directory under the web document root with insufficient access control and browsing enabled, which allows remote attackers to list and possibly read images that are stored in that directory.

  • CVE-2006-0509Feb 1, 2006
    Cerberus
    Helpdesk
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in clients.php in Cerberus Helpdesk, possibly 2.7, allow remote attackers to inject arbitrary web script or HTML via (1) the contact_search parameter and (2) unspecified url fields.

  • CVE-2006-0510Feb 1, 2006
    Daffodil Software
    Daffodil CRM
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in userlogin.jsp in Daffodil CRM 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified parameters in a login action.

  • CVE-2006-0511Feb 1, 2006
    Blackboard
    Blackboard
    risk 0.00cvss —epss 0.00

    Blackboard Academic Suite 6.0 and earlier does not properly clear session information when de-authenticating a user who is idle, which allows subsequent users to log in as the previous user and gain privileges. NOTE: the vendor has disputed this issue, saying that "This is a…

  • CVE-2006-0499Feb 1, 2006
    Rlink
    Rlink
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in rlink.php in Rlink 1.0.0 module for phpBB allows remote attackers to inject arbitrary web script or HTML via the url parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-0500Feb 1, 2006
    MyCO
    Guestbook
    risk 0.00cvss —epss 0.01

    MyCO Guestbook 1.0 stores the admin directory under the web document root with insufficient access control, which allows remote attackers to perform unspecified privileged actions by directly accessing files via a URL.

  • CVE-2006-0501Feb 1, 2006
    MyCO
    Guestbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MyCO Guestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the Name field, when registering a user.

  • CVE-2006-0502Feb 1, 2006
    Farsinews
    Farsinews
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in loginout.php in FarsiNews 2.1 Beta 2 and earlier, with register_globals enabled, allows remote attackers to include arbitrary files via a URL in the cutepath parameter.

  • CVE-2006-0503Feb 1, 2006
    MailEnable
    Mailenable Professional
    risk 0.00cvss —epss 0.02

    IMAP service in MailEnable Professional Edition before 1.72 allows remote attackers to cause a denial of service (service crash) via unspecified vectors involving the EXAMINE command.

  • CVE-2006-0504Feb 1, 2006
    MailEnable
    Mailenable
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in MailEnable Enterprise Edition before 1.2 allows remote attackers to cause a denial of service (CPU utilization) by viewing "formatted quoted-printable emails" via webmail.

  • CVE-2006-0497Feb 1, 2006
    PHP Gen
    PHP Gen
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in PHP GEN before 1.4 allow remote attackers to inject arbitrary SQL commands via unknown attack vectors.

  • CVE-2006-0498Feb 1, 2006
    PHP Gen
    PHP Gen
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in PHP GEN before 1.4 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  • CVE-2006-0485Feb 1, 2006
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.00

    The TCL shell in Cisco IOS 12.2(14)S before 12.2(14)S16, 12.2(18)S before 12.2(18)S11, and certain other releases before 25 January 2006 does not perform Authentication, Authorization, and Accounting (AAA) command authorization checks, which may allow local users to execute IOS…

  • CVE-2006-0486Feb 1, 2006
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.00

    Certain Cisco IOS releases in 12.2S based trains with maintenance release number 25 and later, 12.3T based trains, and 12.4 based trains reuse a Tcl Shell process across login sessions of different local users on the same terminal if the first user does not use tclquit before…

  • CVE-2006-0487Feb 1, 2006
    Axway
    Email Firewall
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Tumbleweed MailGate Email Firewall (EMF) 6.x allow remote attackers to (1) trigger temporarily incorrect processing of an e-mail message under "extremely heavy loads" and (2) cause an "increased number of missed spam" during "spam…

  • CVE-2006-0488Feb 1, 2006
    Microsoft
    Windows 2000
    risk 0.00cvss —epss 0.02

    The VDM (Virtual DOS Machine) emulation environment for MS-DOS applications in Windows 2000, Windows XP SP2, and Windows Server 2003 allows local users to read the first megabyte of memory and possibly obtain sensitive information, as demonstrated by dumper.asm.

  • CVE-2006-0489Feb 1, 2006
    Khaled Mardam Bey
    Mirc
    risk 0.00cvss —epss 0.00

    Buffer overflow in the font command of mIRC, probably 6.16, allows local users to execute arbitrary code via a long string. NOTE: the original researcher claims that issue has been disputed by the vendor, and that the vendor stated "as far as I can tell, this is neither an…

  • CVE-2006-0490Feb 1, 2006
    Aspthai.net
    Aspthai Forums
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in login.asp in ASPThai.Net ASPThai Forums 8.0 and earlier allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the password field.

  • CVE-2006-0491Feb 1, 2006
    SZUserMgnt
    SZUserMgnt
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in SZUserMgnt.class.php in SZUserMgnt 1.4 allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2006-0492Feb 1, 2006
    Vincent Hor
    Calendarix
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Calendarix allow remote attackers to execute arbitrary SQL commands via (1) the catview parameter in cal_functions.inc.php and (2) the login parameter in cal_login.php. NOTE: the catview vector might overlap CVE-2005-1865.

  • CVE-2006-0493Feb 1, 2006
    Minigal
    Mg2
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MG2 (formerly known as Minigal) 0.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field in a comment associated with a picture.

  • CVE-2006-0494Feb 1, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.00

    Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.02 allows local users with MyBB administrative privileges to include and possibly execute arbitrary local files via directory traversal sequences and a nul (%00) character in the plugin parameter.

  • CVE-2006-0495Feb 1, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Add Thread to Favorites feature in usercp2.php in MyBB (aka MyBulletinBoard) 1.02 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer header ($url variable).

  • CVE-2006-0496Feb 1, 2006
    Netscape
    Netscape
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8.1 and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the -moz-binding (Cascading Style Sheets) CSS…

  • CVE-2006-0483Jan 31, 2006
    Cisco Systems, Inc.
    VPN 3030 Concentator
    risk 0.00cvss —epss 0.03

    Cisco VPN 3000 series concentrators running software 4.7.0 through 4.7.2.A allow remote attackers to cause a denial of service (device reload or user disconnect) via a crafted HTTP packet.