VYPR

CVEs

343,083 total · page 6558 of 6,862

AllCriticalHighKEV
  • CVE-2005-4597Dec 31, 2005
    IPei
    iPei Guestbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in iPei Guestbook 1.7 allows remote attackers to inject arbitrary web script or HTML via the email parameter, as used by the email field, when signing a guestbook.

  • CVE-2005-4598Dec 31, 2005
    Ooapp
    Ooapp Guestbook
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in home.php in OoApp Guestbook 2.1 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2005-4599Dec 31, 2005
    Moxiecode
    Tinymce Compressor PHP
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in tiny_mce_gzip.php in TinyMCE Compressor PHP before 1.06 allows remote attackers to inject arbitrary web script or HTML via the index parameter.

  • CVE-2005-4600Dec 31, 2005
    Moxiecode
    Tinymce Compressor PHP
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in tiny_mce_gzip.php in TinyMCE Compressor PHP before 1.06 allows remote attackers to read or include arbitrary files via a trailing null byte (%00) in the (1) theme, (2) language, (3) plugins, or (4) lang parameter.

  • CVE-2005-4601Dec 31, 2005
    ImageMagick
    Imagemagick
    risk 0.00cvss —epss 0.04

    The delegate code in ImageMagick 6.2.4.5-0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename that is processed by the display command.

  • CVE-2005-4602Dec 31, 2005
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in inc/function_upload.php in MyBB before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the file extension of an uploaded file attachment.

  • CVE-2005-4603Dec 31, 2005
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in printthread.php in MyBB 1.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a thread message, which is not properly sanitized in the print view of the thread.

  • CVE-2005-4604Dec 31, 2005
    Jean Jacques Sarton
    Mtink
    risk 0.00cvss —epss 0.03

    Buffer overflow in MTink in the printer-filters-utils package allows local users to execute arbitrary code via a long HOME environment variable.

  • CVE-2005-4605Dec 31, 2005
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    The procfs code (proc_misc.c) in Linux 2.6.14.3 and other versions before 2.6.15 allows attackers to read sensitive kernel memory via unspecified vectors in which a signed value is added to an unsigned value.

  • CVE-2005-4606Dec 31, 2005
    Webwiz
    Database Login
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in check_user.asp in multiple Web Wiz products including (1) Site News 3.06 and earlier, (2) Journal 1.0 and earlier, (3) Polls 3.06 and earlier, and (4) and Database Login 1.71 and earlier allows remote attackers to execute arbitrary SQL commands via…

  • CVE-2005-4607Dec 31, 2005
    Incogen
    Bugport
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in BugPort 1.147 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) ids[0], (2) action, (3) report_id, (4) devWherePair[1][1], and (5) binds[0] parameters.

  • CVE-2005-4608Dec 31, 2005
    BugPort
    BugPort
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in BugPort 1.147 allows remote attackers to execute arbitrary SQL commands via the (1) devWherePair[0], (2) orderBy, and (3) where parameters.

  • CVE-2005-4609Dec 31, 2005
    BugPort
    BugPort
    risk 0.00cvss —epss 0.01

    index.php in BugPort 1.147 and earlier allows remote attackers to obtain sensitive information such as full path and system configuration via an invalid action parameter.

  • CVE-2005-4610Dec 31, 2005
    Dopewars
    Dopewars
    risk 0.00cvss —epss 0.03

    Format string vulnerability in the server for Dopewars before 1.5.12, when running as an NT service, allows remote attackers to execute arbitrary code via unspecified attack vectors.

  • CVE-2005-4611Dec 31, 2005
    Phpfreebies.com
    Free Clickbank
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in search.php in Free ClickBank 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the keywords parameter.

  • CVE-2005-4612Dec 31, 2005
    Vubb
    Vubb
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in VUBB alpha rc1 allow remote attackers to execute arbitrary SQL commands via the (1) f parameter to viewforum.php, (2) t parameter to viewtopic.php, and (3) view parameter to usercp.php.

  • CVE-2005-4613Dec 31, 2005
    Vubb
    Vubb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in VUBB alpha rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified fields in the user edit profile.

  • CVE-2005-4614Dec 31, 2005
    DigiSHOP
    digiSHOP
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in digiSHOP 3.1.17 and earlier allow remote attackers to execute arbitrary SQL commands or obtain the full installation path via (1) the c parameter in cart.php and (2) unspecified search module parameters.

  • CVE-2005-4615Dec 31, 2005
    DapperDesk
    DapperDesk
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in news.php in DapperDesk 3.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2005-4616Dec 31, 2005
    ISupport
    iSupport
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in iSupport 1.06 allows remote attackers to execute arbitrary SQL commands via the include_file parameter.

  • CVE-2005-4617Dec 31, 2005
    Forperfect
    Csupport
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in tickets.php in cSupport 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the pg parameter.

  • CVE-2005-4618Dec 31, 2005
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Buffer overflow in sysctl in the Linux Kernel 2.6 before 2.6.15 allows local users to corrupt user memory and possibly cause a denial of service via a long string, which causes sysctl to write a zero byte outside the buffer. NOTE: since the sysctl is called from a userland…

  • CVE-2005-4619Dec 31, 2005
    Phpoutsourcing
    Zorum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in phpoutsourcing Zorum Forum 3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the rollid parameter in the showhtmllist method.

  • CVE-2005-4620Dec 31, 2005
    Rarlab
    Winrar
    risk 0.03cvss —epss 0.01

    Buffer overflow in WinRAR 3.50 and earlier allows local users to execute arbitrary code via a long command-line argument. NOTE: because this program executes with the privileges of the invoking user, and because remote programs do not normally have the ability to specify a…

  • CVE-2005-4621Dec 31, 2005
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the editavatar page in vBulletin 3.5.1 allows remote attackers to inject arbitrary web script or HTML via a URL in the remote avatar url field, in which the URL generates a parsing error, and possibly requiring a trailing extension…

  • CVE-2005-4622Dec 31, 2005
    Efilego
    Efilego
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in eFileGo 3.01 allows remote attackers to execute arbitrary code, read arbitrary files, and upload arbitrary files via a ... (triple dot) in (1) the URL on port 608 and (2) the argument to upload.exe.

  • CVE-2005-4623Dec 31, 2005
    Efilego
    Efilego
    risk 0.00cvss —epss 0.02

    upload.exe in eFileGo 3.01 allows remote attackers to cause a denial of service (CPU consumption) via an argument with an invalid directory name.

  • CVE-2005-4624Dec 31, 2005
    Ptnet
    ircd
    risk 0.00cvss —epss 0.02

    The m_join function in channel.c for PTnet ircd 1.5 and 1.6 allows remote attackers to cause a denial of service (memory exhaustion that triggers a daemon restart) via a large number of requests to join a "charmed channel" such as PTnet, #PTnoticias and #*.log, which causes ircd…

  • CVE-2005-4625Dec 31, 2005
    Intel
    Display Adapter Driver
    risk 0.00cvss —epss 0.02

    Drivers for certain display adapters, including (1) an unspecified ATI driver and (2) an unspecified Intel driver, might allow remote attackers to cause a denial of service (system crash) via a large JPEG image, as demonstrated in Internet Explorer using stoopid.jpg with a width…

  • CVE-2005-4626Dec 31, 2005
    Recruitment Software
    Recruitment Software
    risk 0.00cvss —epss 0.01

    The default configuration of Recruitment Software installs admin/site.xml under the web document root with insufficient access control, which might allow remote attackers to obtain sensitive information (MySQL database credentials) via a direct request.

  • CVE-2005-4627Dec 31, 2005
    Gfhost
    Gfhost
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in (1) GmailSite 1.0 through 1.0.4 and (2) GFHost 0.1.1 through 0.4.2 allows remote attackers to inject arbitrary web script or HTML via the lng parameter.

  • CVE-2005-4628Dec 31, 2005
    HelpDeskPoint
    HelpDeskPoint
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in HelpDeskPoint 2.38 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2005-4629Dec 31, 2005
    Smbcms
    Smbcms
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in SMBCMS 2.1 allows remote attackers to execute arbitrary SQL commands via unspecified search parameters.

  • CVE-2005-4630Dec 31, 2005
    Clientexec
    Clientexec
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in ClientExec 2.3 allows remote attackers to execute arbitrary SQL commands via the (1) billshowid, (2) billdetailid, (3) fuse, and (4) frmClientID parameters.

  • CVE-2005-4631Dec 31, 2005
    Zina
    Zina
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Zina 0.12.07 and earlier allows remote attackers to execute arbitrary SQL commands via the p parameter.

  • CVE-2005-4632Dec 31, 2005
    Vote Pro
    Vote Pro
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in poll_frame.php in Vote! Pro 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the poll_id parameter.

  • CVE-2005-4634Dec 31, 2005
    Activecampaign
    Supporttrio
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in ActiveCampaign SupportTrio 1.4 allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the provenance of this information is unknown because the source URL is not available; the details are obtained…

  • CVE-2005-4635Dec 31, 2005
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    The nl_fib_input function in fib_frontend.c in the Linux kernel before 2.6.15 does not check for valid lengths of the header and payload, which allows remote attackers to cause a denial of service (invalid memory reference) via malformed fib_lookup netlink messages.

  • CVE-2005-4636Dec 31, 2005
    Openoffice
    Openoffice
    risk 0.00cvss —epss 0.00

    OpenOffice.org 2.0 and earlier, when hyperlinks has been disabled, does not prevent the user from clicking the WWW-browser button in the Hyperlink dialog, which makes it easier for attackers to trick the user into bypassing intended security settings.

  • CVE-2005-4637Dec 31, 2005
    Kayako
    Supportsuite
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kayako SupportSuite 3.00.26 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) nav parameter in the downloads module, (2) Full Name and (3) Email fields in the core module, (4)…

  • CVE-2005-4638Dec 31, 2005
    Kayako
    Supportsuite
    risk 0.00cvss —epss 0.01

    index.php in Kayako SupportSuite 3.00.26 and earlier allow remote attackers to obtain the full path via (1) _a and (2) newsid parameters in the news module, (3) downloaditemid parameter in the downloads module, and (4) kbarticleid parameter in the knowledgebase module.

  • CVE-2005-4639Dec 31, 2005
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Buffer overflow in the CA-driver (dst_ca.c) for TwinHan DST Frontend/Card in Linux kernel 2.6.12 and other versions before 2.6.15 allows local users to cause a denial of service (crash) and possibly execute arbitrary code by "reading more than 8 bytes into an 8 byte long array".

  • CVE-2005-4640Dec 31, 2005
    Class 1
    Poll Software
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in class-1 Poll Software 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) pollid or (2) previouspoll parameters.

  • CVE-2005-4641Dec 31, 2005
    Eazycms
    Eazycms
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in home.php in eazyCMS 2.0 allows remote attackers to execute arbitrary SQL commands via the page_id parameter.

  • CVE-2005-4642Dec 31, 2005
    Hydrobb
    Hydrobb
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in HydroBB 1.0.0 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the s parameter to (1) search.php, (2) members.php, (3) stats.php, (4) viewforum.php, (5) register.php, (6) usercp.php, (7) groups.php,…

  • CVE-2005-4643Dec 31, 2005
    Antharia
    Oncontent CMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Antharia OnContent // CMS allows remote attackers to execute arbitrary SQL commands via the pid parameter. NOTE: it is not clear, but this might be an application service provider, in which case it might be excluded from CVE.

  • CVE-2005-4644Dec 31, 2005
    Edgewall Software
    Trac
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the HTML WikiProcessor in Edgewall Trac 0.9.2 allows remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag.

  • CVE-2005-4645Dec 31, 2005
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in 3CFR allows remote attackers to execute arbitrary SQL commands via the LangueID parameter.

  • CVE-2005-4646Dec 31, 2005
    Pearlinger
    Pearl Forums
    risk 0.03cvss —epss 0.03

    Unspecified vulnerability in index.php in PEARLINGER Pearl Forums 2.4 allows remote attackers to include arbitrary files via the mode parameter, possibly due to a directory traversal vulnerability. NOTE: the provenance of this information is unknown; the details are obtained…

  • CVE-2005-4647Dec 31, 2005
    Pearlinger
    Pearl Forums
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in PEARLINGER Pearl Forums 2.4 allow remote attackers to execute arbitrary SQL commands via the (1) forumsId and (2) topicId parameters in index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from…