VYPR

CVEs

343,049 total · page 6563 of 6,861

AllCriticalHighKEV
  • CVE-2005-4590Dec 30, 2005
    Spb
    Kiosk Engine
    risk 0.00cvss —epss 0.00

    Spb Kiosk Engine 1.0.0.1 allows local users to bypass restrictions on allowed applications via (1) removable media containing a program that will execute because of the autorun setting and (2) applications that are able to invoke other applications, as demonstrated by a file:…

  • CVE-2005-4563Dec 29, 2005
    Enterprise Heart
    Enterprise Connector
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in main.php in Enterprise Heart Enterprise Connector 1.0.2 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the loginid parameter, a different vulnerability than CVE-2005-3875.

  • CVE-2005-4564Dec 29, 2005
    Adtran
    Netvanta
    risk 0.00cvss —epss 0.02

    The Internet Key Exchange version 1 (IKEv1) implementation in ADTRAN NetVanta before 10.03.03.E might allow remote attackers to cause a denial of service via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.

  • CVE-2005-4565Dec 29, 2005
    Adtran
    Netvanta
    risk 0.00cvss —epss 0.02

    Format string vulnerability in the Internet Key Exchange version 1 (IKEv1) implementation in ADTRAN NetVanta before 10.03.03.E might allow remote attackers to have an unknown impact via format string specifiers in crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test…

  • CVE-2005-4566Dec 29, 2005
    Adtran
    Netvanta
    risk 0.00cvss —epss 0.03

    Buffer overflow in the Internet Key Exchange version 1 (IKEv1) implementation in ADTRAN NetVanta before 10.03.03.E might allow remote attackers to have an unknown impact via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.

  • CVE-2005-4567Dec 29, 2005
    Floosietek
    Ftgate
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in FTGate Technology (formerly known as Floosietek) FTGate 4.4 (Build 4.4.000 Oct 26 2005) allow remote attackers to inject arbitrary web script or HTML by sending (1) the href parameter to index.fts, or the param1 parameter to…

  • CVE-2005-4568Dec 29, 2005
    Floosietek
    Ftgate
    risk 0.00cvss —epss 0.03

    Multiple format string vulnerabilities in FTGate Technology (formerly known as Floosietek) FTGate 4.4 (aka Build 4.4.000 Oct 26 2005) allow remote attackers to execute arbitrary code via format string specifiers in the (1) USER, (2) PASS, and (3) TOP commands to the POP3 server;…

  • CVE-2005-4569Dec 29, 2005
    Floosietek
    Ftgate
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in index.fts in FTGate Technology (formerly known as Floosietek) FTGate 4.4 (aka Build 4.4.000 Oct 26 2005) allows remote attackers to execute arbitrary code via a long tzoffset value.

  • CVE-2005-4570Dec 29, 2005
    Fortinet
    Fortios
    risk 0.00cvss —epss 0.02

    The Internet Key Exchange version 1 (IKEv1) implementations in Fortinet FortiOS 2.50, 2.80 and 3.0, FortiClient 2.0,; and FortiManager 2.80 and 3.0 allow remote attackers to cause a denial of service (termination of a process that is automatically restarted) via IKE packets with…

  • CVE-2005-4571Dec 29, 2005
    Myezshop
    Myezshop Shopping Cart
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in myEZshop Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the Keyword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2005-4572Dec 29, 2005
    Myezshop
    Myezshop Shopping Cart
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in myEZshop Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) GroupsId and (2) ItemsId parameters in admin.php. NOTE: the provenance of this information is unknown; the details are obtained solely from…

  • CVE-2005-4573Dec 29, 2005
    Plogger
    Plogger
    risk 0.04cvss —epss 0.12

    PHP remote file include vulnerability in plog-admin-functions.php in Plogger Beta 2 allows remote attackers to execute arbitrary code via a URL in the config[basedir] parameter.

  • CVE-2005-4574Dec 29, 2005
    Paperthin
    Commonspot Content Server
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in loader.cfm in PaperThin CommonSpot Content Server 4.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the bNewWindow parameter.

  • CVE-2005-4575Dec 29, 2005
    Paperthin
    Commonspot Content Server
    risk 0.00cvss —epss 0.01

    PaperThin CommonSpot Content Server 4.5 and earlier allow remote attackers to obtain sensitive information via an invalid errmsg parameter to loader.cfm with a url parameter set to email-login-info.cfm, which leaks the full pathname in the resulting error message.

  • CVE-2005-4576Dec 29, 2005
    Fatwire
    Updateengine
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in the UpdateEngine program in Fatwire UpdateEngine 6.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) COUNTRYNAME, (2) EMAIL, and (3) FUELAP_TEMPLATENAME parameters.

  • CVE-2005-4577Dec 29, 2005
    Hitachi
    Business Logic
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Hitachi Business Logic - Container (BLC) P-2443-9114 01-00 through 02-06 on Windows, and P-1M43-9111 01-01 through 02-00 on AIX, allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in an…

  • CVE-2005-4578Dec 29, 2005
    Hitachi
    Business Logic
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Hitachi Business Logic - Container (BLC) P-2443-9114 01-00 through 02-06 on Windows, and P-1M43-9111 01-01 through 02-00 on AIX, allow remote attackers to execute arbitrary SQL commands via unknown attack vectors in an unspecified input…

  • CVE-2005-4579Dec 29, 2005
    Hitachi
    Business Logic
    risk 0.00cvss —epss 0.01

    Multiple HTTP response splitting vulnerabilities in Hitachi Business Logic - Container (BLC) P-2443-9114 01-00 through 02-06 on Windows, and P-1M43-9111 01-01 through 02-00 on AIX, allow remote attackers to inject arbitrary HTTP headers via unknown attack vectors in an…

  • CVE-2005-4580Dec 29, 2005
    Day
    Communique
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Day Communique 4 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search.

  • CVE-2005-4581Dec 29, 2005
    Scott Draves
    Electric Sheep
    risk 0.00cvss —epss 0.00

    Buffer overflow in Electric Sheep 2.6.3 client allows local users to execute arbitrary code via a long window-id parameter. NOTE: because the program is not setuid and not normally called from remote programs, there may not be a typical attack vector for the issue that crosses…

  • CVE-2005-4582Dec 29, 2005
    Scott Draves
    Electric Sheep
    risk 0.00cvss —epss 0.02

    Electric Sheep 2.6.3 does not require authentication or integrity checks from the server to the client, which allows remote attackers to download and display arbitrary MPEG movie files via (1) DNS spoofing, (2) a URL on the command line, or (3) a URL in the configuration file.…

  • CVE-2005-4583Dec 29, 2005
    VMware
    Esx
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the Management Interface in VMware ESX Server 2.x up to 2.5.x before 24 December 2005 allows "remote code execution in the Web browser" via unspecified attack vectors, probably related to cross-site scripting (XSS).

  • CVE-2005-4584Dec 29, 2005
    Bzflag
    Bzflag Server
    risk 0.03cvss —epss 0.05

    BZFlag server 2.0.4 and earlier allows remote attackers to cause a denial of service (application crash) via a callsign that is not followed by a NULL (\0) character.

  • CVE-2005-4585Dec 29, 2005
    Ethereal Group
    Ethereal
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the GTP dissector for Ethereal 0.9.1 to 0.10.13 allows remote attackers to cause a denial of service (infinite loop) via unknown attack vectors.

  • CVE-2005-3345Dec 28, 2005
    Rssh
    Rssh
    risk 0.00cvss —epss 0.00

    rssh 2.0.0 through 2.2.3 allows local users to bypass access restrictions and gain root privileges by using the rssh_chroot_helper command to chroot to an external directory.

  • CVE-2005-4560Dec 28, 2005
    Microsoft
    Windows
    risk 0.10cvss —epss 0.86

    The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer…

  • CVE-2005-4545Dec 28, 2005
    Netdirect
    Shopengine
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.asp in NetDirect ShopEngine allows remote attackers to inject arbitrary web script or HTML via the EXPS parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2005-4546Dec 28, 2005
    Eggblog
    Eggblog
    risk 0.00cvss —epss 0.02

    search.php in eggblog 2.0 allows remote attackers to obtain the full path via an invalid q parameter, as used by the Keyword and Search fields, possibly due to an SQL injection vulnerability.

  • CVE-2005-4547Dec 28, 2005
    Eggblog
    Eggblog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in home/search.php in eggblog 2.0 allows remote attackers to execute arbitrary SQL commands via the q parameter, as used by the Keyword and Search fields.

  • CVE-2005-4548Dec 28, 2005
    Rws
    Statistics Counter
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the "user area" in RWS Statistics Counter before 2.4.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2005-4549Dec 28, 2005
    Oracle Corporation
    Application Server Discussion Forum Portlet
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Oracle Application Server (OracleAS) Discussion Forum Portlet allows remote attackers to inject arbitrary web script or HTML via the (1) RowKeyValue parameter in the PORTAL schema; and the (2) title and (3) content input fields when…

  • CVE-2005-4550Dec 28, 2005
    Oracle Corporation
    Application Server Discussion Forum Portlet
    risk 0.03cvss —epss 0.06

    The PORTAL schema in Oracle Application Server (OracleAS) Discussion Forum Portlet allows remote attackers to obtain the source code for arbitrary JSP and other files via a df_next_page parameter with a trailing null byte (%00).

  • CVE-2005-4551Dec 28, 2005
    Simpbook
    Simpbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in sign.php in codegrrl SimpBook 1.0, when html_enable is on, allows remote attackers to inject arbitrary web script or HTML via the message parameter to index.php.

  • CVE-2005-4552Dec 28, 2005
    Sun Corporation
    Solaris Pc Netlink
    risk 0.00cvss —epss 0.00

    The (1) slsmgr and (2) slsadmin programs in Sun Solaris PC NetLink 2.0 create temporary files insecurely, which allows local users to gain privileges.

  • CVE-2005-4553Dec 28, 2005
    Kmint21 Software
    Golden FTP Server
    risk 0.04cvss —epss 0.10

    Buffer overflow in Golden FTP Server 1.92 allows remote attackers to execute arbitrary code via a long APPE command. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2005-4554Dec 28, 2005
    Dev
    Dev Web Management System
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in DEV web management system 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter in an openforum action (openforum.php) in index.php, (2) cat parameter in getfile.php, and (3) target parameter…

  • CVE-2005-4555Dec 28, 2005
    Dev
    Dev Web Management System
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in add.php in DEV web management system 1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) ENTER_ARTICLE_TITLE, (2) SPECIFY_ZONE, (3) ENTER_ARTICLE_HEADER, and (4) ENTER_ARTICLE_BODY indices in the…

  • CVE-2005-4556Dec 28, 2005
    Merak
    Mail Server
    risk 0.04cvss —epss 0.10

    PHP remote file include vulnerability in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, when register_globals is enabled, allows remote attackers to include arbitrary local and remote PHP files via a URL in the (1)…

  • CVE-2005-4557Dec 28, 2005
    Merak
    Mail Server
    risk 0.04cvss —epss 0.09

    dir/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, allows remote attackers to include arbitrary local files via a null byte (%00) in the lang parameter, possibly due to a directory traversal…

  • CVE-2005-4558Dec 28, 2005
    Merak
    Mail Server
    risk 0.04cvss —epss 0.08

    IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict acceptable values for the language parameter to mail/settings.html before it is stored in a database, which can allow remote authenticated users…

  • CVE-2005-4559Dec 28, 2005
    Merak
    Mail Server
    risk 0.04cvss —epss 0.09

    mail/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly initialize the default_layout and layout_settings variables when an unrecognized HTTP_USER_AGENT string is provided, which allows…

  • CVE-2005-4534Dec 28, 2005
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.02

    The shadow database feature (syncshadowdb) in Bugzilla 2.9 through 2.16.10 allows local users to overwrite arbitrary files via a symlink attack on temporary files.

  • CVE-2005-4516Dec 28, 2005
    PHP-Fusion
    Phpfusion
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion 6.00.200 through 6.00.300 allow remote attackers to inject arbitrary web script or HTML via (1) the sortby parameter in members.php and (2) IMG tags.

  • CVE-2005-4517Dec 28, 2005
    PHP-Fusion
    Phpfusion
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in PHP-Fusion 6.00.200 through 6.00.300 allows remote attackers to execute arbitrary SQL commands via the ratings parameter in multiple scripts, such as ratings_include.php.

  • CVE-2005-4518Dec 28, 2005
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.04

    Mantis before 0.19.4 allows remote attackers to bypass the file upload size restriction by modifying the max_file_size parameter to (1) bug_file_add.php, (2) bug_report.php, (3) bug_report_advanced_page.php, and (4) proj_doc_add_page.php.

  • CVE-2005-4519Dec 28, 2005
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the manage user page (manage_user_page.php) in Mantis 1.0.0rc3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) prefix and (2) sort parameters to the manage user page (manage_user_page.php), or (3) the…

  • CVE-2005-4520Dec 28, 2005
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.02

    Unspecified "port injection" vulnerabilities in filters in Mantis 1.0.0rc3 and earlier have unknown impact and attack vectors. NOTE: due to a lack of relevant details in the vendor changelog, which is the source of this description, it is unclear whether this is a duplicate of…

  • CVE-2005-4521Dec 28, 2005
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.02

    CRLF injection vulnerability in Mantis 1.0.0rc3 and earlier allows remote attackers to modify HTTP headers and conduct HTTP response splitting attacks via (1) the return parameter in login_cookie_test.php and (2) ref parameter in login_select_proj_page.php.

  • CVE-2005-4522Dec 28, 2005
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the view_filters_page.php filters script in Mantis 1.0.0rc3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) view_type and (2) target_field parameters.

  • CVE-2005-4523Dec 28, 2005
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.02

    Mantis 1.0.0rc3 and earlier discloses private bugs via public RSS feeds, which allows remote attackers to obtain sensitive information.