VYPR

CVEs

343,049 total · page 6566 of 6,861

AllCriticalHighKEV
  • CVE-2005-4438Dec 21, 2005
    Dec2rar.dll
    Dec2rar.dll
    risk 0.01cvss —epss 0.06

    Heap-based buffer overflow in Dec2Rar.dll 3.2.14.3, as distributed in the Symantec Antivirus Library and used by various Symantec products, allows remote attackers to execute arbitrary code via RAR archives with sub-block headers that contain incorrect values in the length field.

  • CVE-2005-4439Dec 21, 2005
    Elog
    Elog
    risk 0.00cvss —epss 0.06

    Buffer overflow in ELOG elogd 2.6.0-beta4 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a URL with a long (1) cmd or (2) mode parameter.

  • CVE-2005-4348Dec 21, 2005
    Fetchmail
    Fetchmail
    risk 0.00cvss —epss 0.04

    fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.

  • CVE-2005-4429Dec 21, 2005
    Office Ocx
    Cs Cart
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in CS-Cart 1.3.0 allows remote attackers to execute arbitrary SQL commands via the (1) sort_by and (2) sort_order parameters to index.php.

  • CVE-2005-4430Dec 21, 2005
    LogicBill
    LogicBill
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in LogicBill 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) __mode and (2) __id parameters to helpdesk.php.

  • CVE-2005-4431Dec 21, 2005
    Wowbb
    Wowbb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in WowBB 1.65 allows remote attackers to execute arbitrary SQL commands via the q parameter to search.php. NOTE: the view_user.php/sort_by vector is already covered by CVE-2005-1554 and CVE-2004-2181.

  • CVE-2005-4432Dec 21, 2005
    Playsms
    Playsms
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in PlaySMS 0.8 allows remote attackers to inject arbitrary web script or HTML via the err parameter.

  • CVE-2005-4427Dec 20, 2005
    Cerberus
    Helpdesk
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitrary SQL commands via the (1) file_id parameter to attachment_send.php, (2) the $addy variable in email_parser.php, (3) $address variable in email_parser.php, (4) $a_address…

  • CVE-2005-4428Dec 20, 2005
    Cerberus
    Helpdesk
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Cerberus Helpdesk allows remote attackers to inject arbitrary web script or HTML via the kb_ask parameter.

  • CVE-2005-4390Dec 20, 2005
    Contentserv
    Contentserv
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in ContentServ 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the StoryID parameter.

  • CVE-2005-4391Dec 20, 2005
    Mindroute Software
    Damoon
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in damoon allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the q parameter.

  • CVE-2005-4392Dec 20, 2005
    Siteadmin
    CMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in printer_friendly.cfm in e-publish CMS 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2005-4393Dec 20, 2005
    E Publish
    CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in show.cfm in e-publish CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) obcatid and (2) comid parameters.

  • CVE-2005-4394Dec 20, 2005
    Formicary Ltd.
    Epix
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in EPiX 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search query parameters.

  • CVE-2005-4395Dec 20, 2005
    Farcrycore
    Farcry
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in FarCry 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the criteria parameter.

  • CVE-2005-4396Dec 20, 2005
    Idreamsoft
    Icms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in admin/Default.asp in iCMS allows remote attackers to inject arbitrary web script or HTML via the LoginMSG parameter. NOTE: the provenance of this issue is unknown; the details were obtained solely from third party sources.

  • CVE-2005-4397Dec 20, 2005
    Idreamsoft
    Icms
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in RunScript.asp iCMS allows remote attackers to execute arbitrary SQL commands via the Event_ID parameter.

  • CVE-2005-4398Dec 20, 2005
    Lemoon
    Lemoon
    risk 0.00cvss —epss 0.01

    NOTE: the vendor has disputed this issue. Cross-site scripting (XSS) vulnerability in lemoon 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the q parameter. NOTE: the vendor has disputed this issue,…

  • CVE-2005-4399Dec 20, 2005
    Libertas Solutions
    Libertas Enterprise CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search/index.php in Libertas Enterprise CMS 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page_search parameter.

  • CVE-2005-4400Dec 20, 2005
    Liferay
    Liferay Enterprise Portal
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in downloads/portal_ent in Liferay Portal Enterprise 3.6.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) _77_struts_action, (2) p_p_mode, and (3) p_p_state parameters.

  • CVE-2005-4401Dec 20, 2005
    Lutece
    Lutece
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Lutece 1.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the query parameter.

  • CVE-2005-4402Dec 20, 2005
    MailEnable
    Mailenable
    risk 0.03cvss —epss 0.04

    Buffer overflow in MailEnable Professional 1.71 and earlier, and Enterprise 1.1 and earlier, allows remote authenticated users to execute arbitrary code via a long IMAP EXAMINE command.

  • CVE-2005-4403Dec 20, 2005
    Qcm
    Marwel
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Marwel 2.7 and earlier allows remote attackers to execute arbitrary SQL commands via the show parameter.

  • CVE-2005-4404Dec 20, 2005
    Viart
    Shop
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in default.asp in Media2 CMS Shop 18.x allows remote attackers to execute arbitrary SQL commands via the item parameter. NOTE: the provenance of this issue is unknown; the details were obtained solely from third party sources.

  • CVE-2005-4405Dec 20, 2005
    Random Mouse Software
    Red Queen
    risk 0.00cvss —epss 0.01

    redqueen.cgi in Red Queen 1.02 and earlier allows remote attackers to obtain the full server path via invalid (1) yellowpage_id, (2) skin_id, (3) supplier_id, and (4) module parameters, which leaks the path in an error message.

  • CVE-2005-4406Dec 20, 2005
    MERCURY
    Mercury CMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.cfm in Mercury CMS 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2005-4407Dec 20, 2005
    Tmc Visionpool
    Mercury CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.cfm in Mercury CMS 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) content and (2) criteria parameters.

  • CVE-2005-4408Dec 20, 2005
    Pc Media
    Miraserver
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Miraserver 1.0 RC4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php, (2) id parameter to newsitem.php, and (3) cat parameter to article.php.

  • CVE-2005-4409Dec 20, 2005
    Mmbase
    Mmbase
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MMBase 1.7.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.

  • CVE-2005-4410Dec 20, 2005
    Nqcontent
    Nqcontent
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in NQcontent 3 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the text parameter.

  • CVE-2005-4411Dec 20, 2005
    David Harris
    Mercury Mail Transport System
    risk 0.08cvss —epss 0.65

    Buffer overflow in Mercury Mail Transport System 4.01b allows remote attackers to execute arbitrary code via a long request to TCP port 105.

  • CVE-2005-4412Dec 20, 2005
    Citrix Systems
    Program Neighborhood Client
    risk 0.00cvss —epss 0.00

    Citrix Program Neighborhood client before 9.150 caches the user password in plaintext in the GUI while asterisks are used to visually obfuscate the password, which allows attackers with access to the session to obtain the password by using a tool to directly access the field.

  • CVE-2005-4413Dec 20, 2005
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in sample scripts in IBM WebSphere Application Server 6 allow remote attackers to inject arbitrary web script or HTML via the (1) E-mail address field to (a) PlantsByWebSphere/login.jsp, (2) message field to (b)…

  • CVE-2005-4414Dec 20, 2005
    Open Lab
    Teamwork
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Teamwork 3 before alpha 1.7 has unknown impact and attack vectors, related to "a menu security bug."

  • CVE-2005-4415Dec 20, 2005
    TML CMS
    Tml
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in TML CMS 0.5 allows remote attackers to inject arbitrary web script or HTML via the form parameter.

  • CVE-2005-4416Dec 20, 2005
    TML CMS
    Tml
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in TML CMS 0.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2005-4417Dec 20, 2005
    Belkin
    Bluetooth Software
    risk 0.03cvss —epss 0.05

    The default configuration of Widcomm Bluetooth for Windows (BTW) 4.0.1.1500 and earlier, as installed on Belkin Bluetooth Software 1.4.2 Build 10 and ANYCOM Blue USB-130-250 Software 4.0.1.1500, and possibly other devices, sets null Authentication and Authorization values, which…

  • CVE-2005-4419Dec 20, 2005
    Honeycomb
    CategoryResults.cfm
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in CategoryResults.cfm in Honeycomb Archive and Honeycomb Archive Enterprise 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) series, (2) cat_parent, (3) cat, and (4) div parameters.

  • CVE-2005-4420Dec 20, 2005
    Honeycomb
    Archive Enterprise
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Honeycomb Archive Enterprise 3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the keyword parameter in search.cfm.

  • CVE-2005-4421Dec 20, 2005
    Dev Editor
    Dev Editor
    risk 0.00cvss —epss 0.02

    Dev-Editor 3.0 allows remote attackers to access any directory outside the web root whose name is a substring of the web root directory name.

  • CVE-2005-4422Dec 20, 2005
    Toenda Software Development
    Toendacms
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in toendaCMS before 0.6.2 Stable allows remote authenticated administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in data/images/albums.

  • CVE-2005-4423Dec 20, 2005
    Phpfm
    Phpfm
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in PHPFM before 0.2.3 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension to an accessible directory, as demonstrated using a file with a .php extension, aka "upload phpshell."

  • CVE-2005-4424Dec 20, 2005
    Phpkit
    Phpkit
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in PHPKIT 1.6.1 R2 and earlier might allow remote authenticated users to execute arbitrary PHP code via a .. (dot dot) in the path parameter and a %00 at the end of the filename, as demonstrated by an avatar filename ending with .png%00.

  • CVE-2005-4425Dec 20, 2005
    Kerio Technologies
    Winroute Firewall
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Kerio WinRoute Firewall before 6.1.3 allows remote attackers to cause a denial of service (crash) via certain RTSP streams.

  • CVE-2005-4426Dec 20, 2005
    Yabb
    Yabb
    risk 0.00cvss —epss 0.01

    Interpretation conflict in YaBB before 2.1 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer as a result of…

  • CVE-2005-4368Dec 20, 2005
    Roundcube
    Webmail
    risk 0.00cvss —epss 0.01

    roundcube webmail Alpha, with a default high verbose level ($rcmail_config['debug_level'] = 1), allows remote attackers to obtain the full path of the application via an invalid_task parameter, which leaks the path in an error message.

  • CVE-2005-4369Dec 20, 2005
    The Collective
    Acuity CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Acuity CMS 2.6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly strSearchKeywords to browse.asp.

  • CVE-2005-4370Dec 20, 2005
    Acidcat
    Acidcat CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in main_content.asp in Acidcat 2.1.13 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter to default.asp.

  • CVE-2005-4371Dec 20, 2005
    Acidcat
    Acidcat CMS
    risk 0.03cvss —epss 0.03

    Acidcat 2.1.13 and earlier stores the database under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a request to databases/acidcat.mdb.

  • CVE-2005-4372Dec 20, 2005
    AWF
    Adaptive Website Framework
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in account.html in Adaptive Website Framework (AWF) 2.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter.