VYPR

CVEs

343,049 total · page 6564 of 6,861

AllCriticalHighKEV
  • CVE-2005-4524Dec 28, 2005
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.01

    Mantis 1.0.0rc3 does not properly handle "Make note private" when a bug is being resolved, which has unknown impact and attack vectors, probably related to an information leak.

  • CVE-2005-4525Dec 28, 2005
    Sygate
    Protection Agent
    risk 0.00cvss —epss 0.00

    SmcGui.exe in Sygate Protection Agent 5.0 build 6144 allows local users to obtain management control over the agent by executing the GUI (SmcGui.exe) and then killing the process, which causes the privileged management GUI to launch.

  • CVE-2005-4526Dec 28, 2005
    Clearswift
    Mimesweeper For Web
    risk 0.00cvss —epss 0.02

    Clearswift MIMEsweeper For Web (a.k.a. WEBsweeper) 4.0 through 5.1 allows remote attackers to bypass filtering via a URL that does not include a .exe extension but returns an executable file.

  • CVE-2005-4527Dec 28, 2005
    Direct News
    Direct News
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Direct News 4.9 allow remote attackers to execute arbitrary SQL commands via (1) the setLang parameter in index.php and (2) unspecified search module parameters.

  • CVE-2005-4528Dec 28, 2005
    Chatspot
    Chatspot
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Chatspot 2.0.0a7 module for phpBB allows remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2005-4529Dec 28, 2005
    Chatspot
    Chatspot
    risk 0.00cvss —epss 0.02

    The Chatspot 2.0.0a7 module for phpBB might allow remote attackers to impersonate other users via unknown vectors.

  • CVE-2005-4530Dec 28, 2005
    Alstrasoft
    Epay
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft EPay Enterprise 3.0 (formerly DoPays) allow remote attackers to inject arbitrary web script or HTML via multiple unspecified parameters in (1) profile.htm, (2) card.htm, (3) bank.htm, (4) subscriptions.htm, (5)…

  • CVE-2005-4532Dec 28, 2005
    Scponly
    Scponly
    risk 0.00cvss —epss 0.00

    scponlyc in scponly 4.1 and earlier, when the operating system supports LD_PRELOAD mechanisms, allows local users to execute arbitrary code with root privileges by creating a chroot directory in their home directory, hard linking to a system setuid application, and using a…

  • CVE-2005-4533Dec 28, 2005
    Scponly
    Scponly
    risk 0.00cvss —epss 0.01

    Argument injection vulnerability in scponlyc in scponly 4.1 and earlier, when both scp and rsync compatibility are enabled, allows local users to execute arbitrary applications via "getopt" style argument specifications, which are not filtered.

  • CVE-2005-3341Dec 27, 2005
    DHIS
    DNS Package
    risk 0.00cvss —epss 0.00

    DHIS tools DNS package (dhis-tools-dns) before 5.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files created by (1) register-q.sh and (2) register-p.sh.

  • CVE-2005-3343Dec 27, 2005
    Tkdiff
    Tkdiff
    risk 0.00cvss —epss 0.00

    tkdiff before 4.1.1 allows local users to overwrite arbitrary files via a symlink attack on temporary files.

  • CVE-2005-3535Dec 27, 2005
    Ketm
    Ketm
    risk 0.00cvss —epss 0.02

    Buffer overflow in KETM 0.0.6 allows local users to execute arbitrary code via unknown vectors.

  • CVE-2005-4509Dec 23, 2005
    Parallel Tools Consortium
    Ptools
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.asp in pTools allows remote attackers to execute arbitrary SQL commands via the docID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2005-4510Dec 23, 2005
    Extensis
    Netpublish Server
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in server.np in NetPublish Server 7 allows remote attackers to read arbitrary files via "../" sequences in the template parameter.

  • CVE-2005-4511Dec 23, 2005
    TN3270 Resource Gateway
    TN3270 Resource Gateway
    risk 0.00cvss —epss 0.00

    Format string vulnerability in TN3270 Resource Gateway 1.1.0 allows local users to cause a denial of service and possibly execute arbitrary code via format string specifiers in syslog function calls.

  • CVE-2005-4512Dec 23, 2005
    Waxtrapp
    Waxtrapp
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in WAXTRAPP 3.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.

  • CVE-2005-4513Dec 23, 2005
    Wandsoft
    E Search
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in WANDSOFT e-SEARCH allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the keywords parameter.

  • CVE-2005-4514Dec 23, 2005
    Webwasher
    Csm Appliance Suite
    risk 0.00cvss —epss 0.02

    The encapsulation script mechanism in Webwasher CSM Appliance Suite 5.x uses case-sensitive detection of malicious tokens, which allows attackers to bypass script detection by using tokens that can be upper or lower case. NOTE: the vendor has stated that this problem could not…

  • CVE-2005-4515Dec 23, 2005
    Lois Software
    Webdb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in WebDB 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified search parameters, possibly Search0. NOTE: the vendor has disputed this issue, saying that "WebDB is a generic online database system used by many of…

  • CVE-2005-4505Dec 23, 2005
    McAfee
    Virusscan Enterprise
    risk 0.03cvss —epss 0.01

    Unquoted Windows search path vulnerability in McAfee VirusScan Enterprise 8.0i (patch 11) and CMA 3.5 (patch 5) might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run by naPrdMgr.exe when it attempts to execute EntVUtil.EXE…

  • CVE-2005-4506Dec 23, 2005
    Nexus Concepts
    Dev Hound
    risk 0.00cvss —epss 0.00

    Nexus Concepts Dev Hound 2.24 and earlier stores username and password information in cleartext in the devhound.tdbd file, which allows local users to gain privileges.

  • CVE-2005-4507Dec 23, 2005
    Nexus Concepts
    Dev Hound
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Nexus Concepts Dev Hound 2.24 and earlier allow remote attackers to inject arbitrary web script or HTML via multiple unspecified user input fields.

  • CVE-2005-4508Dec 23, 2005
    Nexus Concepts
    Dev Hound
    risk 0.00cvss —epss 0.01

    Nexus Concepts Dev Hound 2.24 and earlier allows remote attackers to obtain the installation path via a URL containing a non-existent .dll file.

  • CVE-2005-3536Dec 22, 2005
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in phpBB 2 before 2.0.18 allows remote attackers to execute arbitrary SQL commands via the topic type.

  • CVE-2005-3537Dec 22, 2005
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.01

    A "missing request validation" error in phpBB 2 before 2.0.18 allows remote attackers to edit private messages of other users, probably by modifying certain parameters or other inputs.

  • CVE-2005-3660Dec 22, 2005
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service (memory exhaustion and panic) by creating a large number of connected file descriptors or socketpairs and setting a large data transfer buffer, then preventing Linux from being able to finish the transfer by…

  • CVE-2005-4504Dec 22, 2005
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.12

    The khtml::RenderTableSection::ensureRows function in KHTMLParser in Apple Mac OS X 10.4.3 and earlier, as used by Safari and TextEdit, allows remote attackers to cause a denial of service (memory consumption and application crash) via HTML files with a large ROWSPAN attribute…

  • CVE-2005-3534Dec 22, 2005
    Nbd
    nbd
    risk 0.00cvss —epss 0.06

    Buffer overflow in the Network Block Device (nbd) server 2.7.5 and earlier, and 2.8.0 through 2.8.2, allows remote attackers to execute arbitrary code via a large request, which is written past the end of the buffer because nbd does not account for memory taken by the reply…

  • CVE-2005-4500Dec 22, 2005
    Musicbox
    Musicbox
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in MusicBox 2.3 allows remote attackers to execute arbitrary SQL commands via the (1) show and (2) type parameter. NOTE: the provenance of this information is unknown, although it was later rediscovered.

  • CVE-2005-4501Dec 22, 2005
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.01

    MediaWiki before 1.5.4 uses a hard-coded "internal placeholder string", which allows remote attackers to bypass protection against cross-site scripting (XSS) attacks and execute Javascript using inline style attributes, which are processed by Internet Explorer.

  • CVE-2005-4502Dec 22, 2005
    Net Square
    Httprint
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in httprint v202, and possibly other versions before v301, allows remote attackers to inject arbitrary web script or HTML via the Server field in an HTTP response, which is not sanitized before being displayed to the user.

  • CVE-2005-4503Dec 22, 2005
    Net Square
    Httprint
    risk 0.03cvss —epss 0.04

    httprint v202, and possibly other versions before v301, allows remote attackers to cause a denial of service (crash) via a long Server field in an HTTP response.

  • CVE-2005-3631Dec 22, 2005
    Red Hat
    Enterprise Linux Desktop
    risk 0.00cvss —epss 0.00

    udev does not properly set permissions on certain files in /dev/input, which allows local users to obtain sensitive data that is entered at the console, such as user passwords.

  • CVE-2005-4475Dec 22, 2005
    OpenCMS
    OpenCms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in OpenCms 6.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.

  • CVE-2005-4476Dec 22, 2005
    Openedit
    Openedit
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in store/search/results.html in OpenEdit 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) oe-action and (2) page parameters.

  • CVE-2005-4477Dec 22, 2005
    papaya
    papaya CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in papaya CMS 4.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the bab[searchfor] parameter.

  • CVE-2005-4478Dec 22, 2005
    Papoo
    Papoo
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Papoo 2.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) menuid parameter to (a) index.php and (b) guestbook.php, and the (2) forumid and (3) reporeid_print parameters to (c) print.php.

  • CVE-2005-4479Dec 22, 2005
    Phpslash
    Phpslash
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in article.php in phpSlash 0.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the story_id parameter.

  • CVE-2005-4480Dec 22, 2005
    Plexcor
    CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Plexcor CMS 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.

  • CVE-2005-4481Dec 22, 2005
    Polopoly
    Polopoly
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Polopoly 9 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters. NOTE: the vendor has disputed this vulnerability, stating that the "XSS flaw was only part of the custom…

  • CVE-2005-4482Dec 22, 2005
    Portalapp
    Portalapp
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in login.asp in PortalApp 3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the ret_page parameter.

  • CVE-2005-4483Dec 22, 2005
    Iatek
    Siteenable
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in login.asp in SiteEnable 3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the ret_page parameter.

  • CVE-2005-4484Dec 22, 2005
    Iatek
    Intranetapp
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in IntranetApp 3.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ret_page parameter to login.asp or the (2) do_search and (3) search parameters to content.asp.

  • CVE-2005-4485Dec 22, 2005
    Iatek
    Projectapp
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in ProjectApp 3.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the keywords parameter to (1) forums.asp, (2) search_employees.asp, (3) cat.asp, and (4) links.asp; (5) projectid parameter to…

  • CVE-2005-4486Dec 22, 2005
    Quantum Art
    Qp7 Enterprise
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Quantum Art QP7.Enterprise (formerly Q-Publishing) allows remote attackers to execute arbitrary SQL commands via the p_news_id parameter to (1) news_and_events_new.asp and (2) news.asp. NOTE: on 20060227, the vendor disputed the accuracy of this…

  • CVE-2005-4487Dec 22, 2005
    Ramsite
    R1 CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in RAMSite R|1 CMS 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchfield parameter.

  • CVE-2005-4488Dec 22, 2005
    wCMS
    wCMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.tpl in Redakto WCMS 3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) iid, (2) iid2, (3) r, (4) cart, (5) str, (6) nf, and (7) a parameters.

  • CVE-2005-4489Dec 22, 2005
    Scoop
    Scoop
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Scoop 1.1 RC1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) type and (2) count parameters, and (3) the query string in a story.

  • CVE-2005-4490Dec 22, 2005
    Commercial Interactive Media
    Scoop
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in SCOOP! 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) keyword and (2) invalid parameter to articleSearch.asp; (3) username and (4) invalid parameter to lostPassword.asp; (5)…

  • CVE-2005-4491Dec 22, 2005
    Sitekit
    Sitekit CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Sitekit CMS 6.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) query string, (2) textonly, (3) locID, and (4) lang parameters to (a) Default.aspx, and the (6) ClickFrom parameter to (b)…