VYPR

CVEs

343,049 total · page 6567 of 6,861

AllCriticalHighKEV
  • CVE-2005-4373Dec 20, 2005
    Adaptive Website Framework
    AWF
    risk 0.00cvss —epss 0.01

    Adaptive Website Framework (AWF) 2.10 and earlier allows remote attackers to obtain the full path of the application via an invalid mode parameter to community.html, which leaks the path in an error message.

  • CVE-2005-4374Dec 20, 2005
    Allinta
    Allinta CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Allinta 2.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to faq.asp and (2) searchQuery parameter to search.asp.

  • CVE-2005-4375Dec 20, 2005
    Box Uk
    Amaxus
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Amaxus 3 and earlier allows remote attackers to inject arbitrary web script or HTML via the change parameter. NOTE: it is possible that this is resultant from CVE-2005-4376.

  • CVE-2005-4376Dec 20, 2005
    Amaxus
    Amaxus
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in Amaxus 3 and earlier allows remote attackers to access arbitrary files via ".." sequences in the change parameter.

  • CVE-2005-4377Dec 20, 2005
    Baseline
    Baseline CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Page.asp in Baseline CMS 1.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) PageID and (2) SiteNodeID parameters.

  • CVE-2005-4378Dec 20, 2005
    Nma
    Baseline CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Page.asp in Baseline CMS 1.95 and earlier allows remote attackers to execute arbitrary SQL commands via the SiteNodeID parameter.

  • CVE-2005-4379Dec 20, 2005
    Bitweaver
    Bitweaver
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to inject arbitrary web script or HTML via the (1) sort_mode parameter to (a) fisheye/list_galleries.php, (b) messages/message_box.php, and (c) users/my.php; the (2)…

  • CVE-2005-4380Dec 20, 2005
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to execute arbitrary SQL commands via the (1) sort_mode parameter to (a) fisheye/list_galleries.php, (b) messages/message_box.php, and (c) users/my.php; the (2) post_id parameter to (d)…

  • CVE-2005-4381Dec 20, 2005
    Caravel CMS
    Caravel CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Caravel CMS 3.0 Beta 1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) fileDN and (2) folderviewer_attrs parameters.

  • CVE-2005-4382Dec 20, 2005
    Citysoft
    Community Enterprise
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in CitySoft Community Enterprise 4.x allows remote attackers to execute arbitrary SQL commands via the (1) nodeID, (2) pageID, (3) ID, and (4) parentid parameter to index.cfm; and (5) documentFormatId parameter to document/docWindow.cfm.

  • CVE-2005-4383Dec 20, 2005
    Citysoft
    Community Enterprise
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.cfm in CitySoft Community Enterprise 4.x allows remote attackers to inject arbitrary web script or HTML via the (1) presentationSite, (2) docPublishYear, (3) docDescription, (4) publishState, (5) docAuthor, (6) docTitle, (7)…

  • CVE-2005-4384Dec 20, 2005
    Citysoft
    Community Enterprise
    risk 0.00cvss —epss 0.01

    CitySoft Community Enterprise 4.x allows remote attackers to obtain the full path of the server via an invalid (1) fuseaction parameter to index.cfm and (2) documentid parameter to document/docWindow.cfm.

  • CVE-2005-4385Dec 20, 2005
    Cofax
    Cofax
    risk 0.04cvss —epss 0.08

    Cross-site scripting (XSS) vulnerability in search.htm in Cofax 2.0 RC3 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter.

  • CVE-2005-4386Dec 20, 2005
    Colony
    CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Colony CMS 2.75 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.

  • CVE-2005-4387Dec 20, 2005
    Contenite
    Contenite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in home.php in contenite 0.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2005-4388Dec 20, 2005
    Contentserv
    Contens
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.cfm in CONTENS 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the near parameter.

  • CVE-2005-4389Dec 20, 2005
    Contentserv
    Contens
    risk 0.00cvss —epss 0.01

    search.cfm in CONTENS 3.0 and earlier allows remote attackers to obtain the full server path via invalid (1) submit.y, (2) bool, (3) itemsperpage, (4) submit, (5) submit.x, (6) criteria, (7) advanced, and (8) intern parameters.

  • CVE-2005-4354Dec 20, 2005
    Webglimpse
    Webglimpse
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in webglimpse.cgi in Webglimpse 2.14.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query parameter.

  • CVE-2005-4355Dec 20, 2005
    Xmpie
    Ustore
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in UStore allow remote attackers to inject arbitrary web script or HTML via the (1) Cat parameter in default.asp and the (2) accessdenied parameter in admin/default.asp. NOTE: the provenance of this information is unknown; the…

  • CVE-2005-4356Dec 20, 2005
    Xmpie
    Ustore
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in UStore allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2005-4357Dec 20, 2005
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in phpBB 2.0.18, when "Allowed HTML tags" is enabled, allows remote attackers to inject arbitrary Javascript via a permitted HTML tag with " (quote) characters and active attributes such as onmouseover.

  • CVE-2005-4358Dec 20, 2005
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.02

    admin/admin_disallow.php in phpBB 2.0.18 allows remote attackers to obtain the installation path via a direct request with a non-empty setmodules parameter, which causes an invalid append_sid function call that leaks the path in an error message.

  • CVE-2005-4359Dec 20, 2005
    ODFaq
    ODFaq
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in includes/core.inc.php in ODFaq 2.1.0 allows remote attackers to execute arbitrary SQL commands via the (1) cat and (2) srcText parameters to faq.php.

  • CVE-2005-4360Dec 20, 2005
    Microsoft
    Internet Information Server
    risk 0.10cvss —epss 0.87

    The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value…

  • CVE-2005-4361Dec 20, 2005
    Magnolia
    Content Management Suite
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search.html in Magnolia Content Management Suite 2.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter.

  • CVE-2005-4362Dec 20, 2005
    Komodo
    Komodo CMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in page.php in Komodo CMS 2.1 allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2005-4363Dec 20, 2005
    Komodo
    Komodo CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the search engine in Komodo CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.

  • CVE-2005-4364Dec 20, 2005
    Hot Banana
    Web Content Management Suite
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.cfm in Hot Banana Web Content Management Suite 5.3 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.

  • CVE-2005-4365Dec 20, 2005
    Adam Scheinberg
    Flip
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in FLIP 0.9.0.1029 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter in text.php and (2) frame parameter in forum.php.

  • CVE-2005-4366Dec 20, 2005
    DRZES
    HMS
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in DRZES HMS 3.2 allow remote attackers to execute arbitrary SQL commands via the (1) plan_id parameter to (a) domains.php, (b) viewusage.php, (c) pop_accounts.php, (d) databases.php, (e) ftp_users.php, (f) crons.php, (g) pass_dirs.php, (h)…

  • CVE-2005-4367Dec 20, 2005
    DRZES
    HMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in register_domain.php in DRZES HMS 3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the "Domain Availability" field. NOTE: this issue was later reported to affect CONTROLzx…

  • CVE-2005-4350Dec 20, 2005
    Sun Corporation
    Wbem Services
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in WBEM Services A.01.x before A.01.05.12 and A.02.x before A.02.00.08 on HP-UX B.11.00 through B.11.23 allows remote attackers to cause an unspecified denial of service via unknown attack vectors.

  • CVE-2005-4353Dec 20, 2005
    toendaCMS
    toendaCMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in toendaCMS 0.6.2.1, when configured to use a SQL database, allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2005-4349MedDec 19, 2005
    PhpMyAdmin
    phpMyAdmin
    risk 0.41cvss 6.3epss 0.01

    SQL injection vulnerability in server_privileges.php in phpMyAdmin 2.7.0 allows remote authenticated users to execute arbitrary SQL commands via the (1) dbname and (2) checkprivs parameters. NOTE: the vendor and a third party have disputed this issue, saying that the main task…

  • CVE-2005-4337Dec 19, 2005
    Blackboard
    Academic Suite
    risk 0.00cvss —epss 0.02

    The login page in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to bypass authentication and gain privileges as other users via a modified user_id parameter and a "/" in the encoded_pw…

  • CVE-2005-4338Dec 19, 2005
    Blackboard
    Academic Suite
    risk 0.00cvss —epss 0.03

    announcement.pl in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to gain administrator privileges by setting the context parameter to "admin".

  • CVE-2005-4339Dec 19, 2005
    Blackboard
    Academic Suite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to inject arbitrary web script or HTML via the context parameter to announcement.pl, which is…

  • CVE-2005-4341Dec 19, 2005
    Blackboard
    Academic Suite
    risk 0.00cvss —epss 0.01

    Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to list all available categories via a blank category_id parameter to category.pl. NOTE: it is not clear whether this information is…

  • CVE-2005-4342Dec 19, 2005
    Macromedia
    Coldfusion
    risk 0.00cvss —epss 0.02

    ColdFusion Sandbox on Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 does not throw an exception if the SecurityManager is disabled, which might allow remote attackers to "bypass security controls," aka "JRun Clustered Sandbox Security Vulnerability."

  • CVE-2005-4343Dec 19, 2005
    Macromedia
    Coldfusion
    risk 0.00cvss —epss 0.01

    Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 allows remote attackers to attach arbitrary files and send mail via a crafted Subject field, which is not properly handled by the CFMAIL tag in applications that use ColdFusion, aka "CFMAIL injection…

  • CVE-2005-4344Dec 19, 2005
    Macromedia
    Coldfusion
    risk 0.00cvss —epss 0.00

    Adobe (formerly Macromedia) ColdFusion MX 7.0 does not honor when the CFOBJECT /CreateObject(Java) setting is disabled, which allows local users to create an object despite the specified configuration.

  • CVE-2005-4345Dec 19, 2005
    Macromedia
    Coldfusion
    risk 0.00cvss —epss 0.00

    Adobe (formerly Macromedia) ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, which allows local developers to obtain the hash and gain privileges.

  • CVE-2005-4346Dec 19, 2005
    PhpBB
    Blog
    risk 0.00cvss —epss 0.01

    Invalid SQL syntax error in blog.php in phpBB Blog 2.2.2 and earlier allows remote attackers to obtain the full path of the application via an invalid permalink parameter to index.php, which produces an invalid SQL query that leaks the full pathname in a SQL syntax error…

  • CVE-2005-4316Dec 17, 2005
    Microfocus
    Hpux
    risk 0.04cvss —epss 0.07

    HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allows remote attackers to cause a denial of service via a "Rose Attack" that involves sending a subset of small IP fragments that do not form a complete, larger packet.

  • CVE-2005-4317Dec 17, 2005
    Limbo CMS
    Limbo CMS
    risk 0.03cvss —epss 0.05

    Limbo CMS 1.0.4.2 and earlier, with register_globals off, does not protect the $_SERVER variable from external modification, which allows remote attackers to use the _SERVER[REMOTE_ADDR] parameter to (1) conduct cross-site scripting (XSS) attacks in the stats module or (2)…

  • CVE-2005-4318Dec 17, 2005
    Siteadmin
    CMS
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in Limbo CMS 1.0.4.2 and earlier, with register_globals off, allows remote attackers to execute arbitrary SQL commands via the _SERVER[REMOTE_ADDR] parameter, which modifies the underlying $_SERVER variable.

  • CVE-2005-4319Dec 17, 2005
    Limbo CMS
    Limbo CMS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index2.php in Limbo CMS 1.0.4.2 and earlier allows remote attackers to include arbitrary PHP files via ".." sequences in the option parameter.

  • CVE-2005-4320Dec 17, 2005
    Limbo CMS
    Limbo CMS
    risk 0.00cvss —epss 0.02

    Limbo CMS 1.0.4.2 and earlier allows remote attackers to obtain the installation path of the application via a direct request to (1) doc.inc.php, (2) element.inc.php, and (3) node.inc.php, which leaks the path in an error message.

  • CVE-2005-4321Dec 17, 2005
    Apani Networks
    Epiforce Agent
    risk 0.00cvss —epss 0.03

    The Internet Key Exchange version 1 (IKEv1) implementation in Apani Networks EpiForce 1.9 and earlier running IPSec, allow remote attackers to cause a denial of service (crash) via certain IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the…

  • CVE-2005-4322Dec 17, 2005
    Hitachi
    Cosminexus Collaboration Portal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Hitachi Cosminexus Collaboration Portal 06-00 through 06-10-/B, Groupmax Collaboration Portal 07-00 through 07-10-/B, and Groupmax Collaboration Web Client 07-00 through 07-10-/A allow remote attackers to inject arbitrary…