VYPR

CVEs

343,040 total · page 6570 of 6,861

AllCriticalHighKEV
  • CVE-2005-4230Dec 14, 2005
    Link Up Gold
    Link Up Gold
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in poll.php in Link Up Gold 2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the number parameter.

  • CVE-2005-4231Dec 14, 2005
    Link Up Gold
    Link Up Gold
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Link Up Gold 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) link parameter to tell_friend.php, (2) phrase[] parameter to search.php in a search_links_advanced action, and the (3) direction or (4)…

  • CVE-2005-4232Dec 14, 2005
    Jamit
    Jamit Job Board
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Jamit Job Board 2.4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cat parameter. NOTE: the vendor has disputed this issue, saying "The vulnerability is without any basis and did not actually work."…

  • CVE-2005-4233Dec 14, 2005
    PHP Web Scripts
    AD Manager Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in advertiser_statistic.php in Ad Manager Pro 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the ad_number parameter.

  • CVE-2005-4234Dec 14, 2005
    Powerdev
    Encapsgallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in gallery.php in EncapsGallery 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2005-4235Dec 14, 2005
    Whmcompletesolution
    Whmcompletesolution
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in knowledgebase.php in WHMCompleteSolution 2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameters.

  • CVE-2005-4236Dec 14, 2005
    Cartkeeper
    Ckgold Shopping Cart
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in CKGOLD allows remote attackers to inject arbitrary web script or HTML via the search parameters.

  • CVE-2005-4237Dec 14, 2005
    Servers R Us
    Mysqlauction
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MySQL Auction 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search module parameters, possibly the keyword parameter in the SearchZoom module.

  • CVE-2005-4238Dec 14, 2005
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in view_filters_page.php in Mantis 1.0.0rc3 and earlier allows remote attackers to inject arbitrary web script or HTML via the target_field parameter.

  • CVE-2005-4239Dec 14, 2005
    PHP Jackknife
    PHP Jackknife
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Search/DisplayResults.php in PHP JackKnife 2.21 and earlier allows remote attackers to inject arbitrary web script or HTML via URL-encoded values in the sKeywords parameter.

  • CVE-2005-4240Dec 14, 2005
    Vcd Db
    Vcd Db
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in search.php in VCD-db 0.98 and earlier allows remote attackers to execute arbitrary SQL commands via the by parameter.

  • CVE-2005-4241Dec 14, 2005
    Vcd Db
    Vcd Db
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the category page in VCD-db 0.98 and earlier allows remote attackers to inject arbitrary web script or HTML via the batch parameter.

  • CVE-2005-4244Dec 14, 2005
    Snipegallery
    Snipe Gallery
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in Snipe Gallery 3.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) gallery_id parameter to view.php and (2) image_id parameter to image.php.

  • CVE-2005-4245Dec 14, 2005
    Snipegallery
    Snipe Gallery
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in search.php in Snipe Gallery 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.

  • CVE-2005-4246Dec 14, 2005
    Plogger
    Plogger
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Plogger Beta 2 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) id parameter to index.php and (2) page parameter.

  • CVE-2005-4247Dec 14, 2005
    Plogger
    Plogger
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Plogger Beta 2 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchterms parameter.

  • CVE-2005-4250Dec 14, 2005
    Mcgallery
    Mcgallery Pro
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in mcGallery PRO 2.2 and earlier allows remote attackers to read arbitrary files via the language parameter.

  • CVE-2005-4251Dec 14, 2005
    Mcgallery
    Mcgallery Pro
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in mcGallery PRO 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) start, and (3) rand parameters to show.php, and the (4) album parameter to index.php.

  • CVE-2005-4252Dec 14, 2005
    Mcgallery
    Mcgallery Pro
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in mcGallery PRO 2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search module parameters.

  • CVE-2005-2827Dec 14, 2005
    Microsoft
    Windows Nt
    risk 0.03cvss —epss 0.03

    The thread termination routine in the kernel for Windows NT 4.0 and 2000 (NTOSKRNL.EXE) allows local users to modify kernel memory and execution flow via steps in which a terminating thread causes Asynchronous Procedure Call (APC) entries to free the wrong data, aka the "Windows…

  • CVE-2005-3352Dec 13, 2005
    Apache
    Httpd
    risk 0.00cvss —epss 0.74

    Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.

  • CVE-2005-4189Dec 13, 2005
    Horde (software)
    Kronolith H4
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Calendar name field when creating calendars, (2) event title field when deleting events, the (3) Category…

  • CVE-2005-4190Dec 13, 2005
    Horde (software)
    Application Framework
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by (1) the identity field, (2) Category and (3) Label search fields, (4)…

  • CVE-2005-4191Dec 13, 2005
    Horde (software)
    Nag Task List Manager H3
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in templates/tasklists/tasklists.inc in Horde Nag Task List Manager H3 before 2.0.4 allow remote authenticated users to inject arbitrary web script or HTML via (1) the tasklist's name or (2) description, when creating a new…

  • CVE-2005-4192Dec 13, 2005
    Horde (software)
    Mnemo H3
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in templates/notepads/notepads.inc in Horde Mnemo Note Manager H3 before 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) the notepad's name or (2) description, when creating a new notepad.

  • CVE-2005-4193Dec 13, 2005
    Usebb
    Usebb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in UseBB before 0.7 allows remote attackers to inject arbitrary web script or HTML via the $_SERVER['PHP_SELF'] variable.

  • CVE-2005-4194Dec 13, 2005
    Sights 'n Sounds
    Streaming Media Server
    risk 0.03cvss —epss 0.03

    Buffer overflow in MediaServerList.exe in Sights 'n Sounds Streaming Media Server 2.0.3.a allows remote attackers to cause a denial of service (application crash) via a long query string.

  • CVE-2005-4195Dec 13, 2005
    Scout Portal Toolkit
    SPT
    risk 0.03cvss —epss 0.06

    Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the ParentId parameter in SPT--BrowseResources.php, (2) ResourceId parameter in SPT--FullRecord.php, (3) ResourceOffset…

  • CVE-2005-4196Dec 13, 2005
    Scout Portal Toolkit
    Scout Portal Toolkit
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the ss parameter in SPT--QuickSearch.php; (2) ParentId parameter in SPT--BrowseResources.php; (3) the…

  • CVE-2005-4197Dec 13, 2005
    Nortel
    SSL VPN
    risk 0.04cvss —epss 0.12

    tunnelform.yaws in Nortel SSL VPN 4.2.1.6 allows remote attackers to execute arbitrary commands via a link in the a parameter, which is executed with extra privileges in a cryptographically signed Java Applet.

  • CVE-2005-4198Dec 13, 2005
    Netref
    Netref
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Netref 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter. NOTE: the provenance of this issue is unknown; the details were obtained solely from third party sources.

  • CVE-2005-4199Dec 13, 2005
    MyBB
    Mybb
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5) showcodebuttons in an options…

  • CVE-2005-4200Dec 13, 2005
    MyBB
    Mybb
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before 1.0 have unknown impact and attack vectors, a different set of vulnerabilities than those identified by CVE-2005-4199.

  • CVE-2005-4201Dec 13, 2005
    My Album Online
    My Album Online
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in My Album Online 1.0 allows remote attackers to access arbitrary files via ".../" (triple dot) sequences in unspecified vectors.

  • CVE-2005-4202Dec 13, 2005
    Logisphere
    Logisphere
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in LogiSphere 0.9.9j allow remote attackers to access arbitrary files via (1) .. (dot dot), (2) "..." (triple dot), and (3) "..//" sequences in the URL, (4) "../" sequences in the source parameter to viewsource.jsp, or (5) "..\" (dot…

  • CVE-2005-4203Dec 13, 2005
    Logisphere
    Logisphere
    risk 0.00cvss —epss 0.02

    LogiSphere 0.9.9j does not restrict the number of messages that can be sent, which allows remote attackers to cause a denial of service by sending a large number of messages via the msg command. NOTE: due to lack of appropriate details by the original researcher, it is unclear…

  • CVE-2005-4204Dec 13, 2005
    Logisphere
    Logisphere
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in LogiSphere 0.9.9j allows remote attackers to inject arbitrary Javascript via the msg command. NOTE: due to lack of appropriate details by the original researcher, it is unclear whether this issue is distinct from the msg DoS.

  • CVE-2005-4205Dec 13, 2005
    Locazo
    Classifieds
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in searchdb.asp in LocazoList 1.03c and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter.

  • CVE-2005-4206MedDec 13, 2005
    Blackboard
    Academic Suite
    risk 0.43cvss 6.1epss 0.02

    Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to redirect users to other URLs and conduct phishing attacks via a modified url parameter to frameset.jsp, which loads the URL into a frame…

  • CVE-2005-4207Dec 13, 2005
    Btgrup
    Admin Webcontroller Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in BTGrup Admin WebController Script allows remote attackers to execute SQL commands via the (1) Username and (2) Password fields.

  • CVE-2005-4208Dec 13, 2005
    Flatnuke
    Flatnuke
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in Flatnuke 2.5.6 allows remote attackers to access arbitrary files via a .. (dot dot) and null byte (%00) in the id parameter of the read module.

  • CVE-2005-4209Dec 13, 2005
    Alt N
    Mdaemon
    risk 0.03cvss —epss 0.02

    WorldClient webmail in Alt-N MDaemon 8.1.3 allows remote attackers to prevent arbitrary users from accessing their inboxes via script tags in the Subject header of an e-mail message, which prevents the user from being able to access the Inbox folder, possibly due to a cross-site…

  • CVE-2005-4210Dec 13, 2005
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Opera before 8.51, when running on Windows with Input Method Editor (IME) installed, allows remote attackers to cause a denial of service (persistent application crash) by bookmarking a site with a long title.

  • CVE-2005-4178Dec 12, 2005
    Dropbear SSH Project
    Dropbear SSH
    risk 0.00cvss —epss 0.03

    Buffer overflow in Dropbear server before 0.47 allows authenticated users to execute arbitrary code via unspecified inputs that cause insufficient memory to be allocated due to an incorrect expression that does not enforce the proper order of operations.

  • CVE-2005-4177Dec 12, 2005
    Magic Book
    Personal and Professional
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in book.cfm in Magic Book Personal and Professional 2.0 allows remote attackers to inject arbitrary web script or HTML via the StartRow parameter.

  • CVE-2005-4165Dec 11, 2005
    Asp Dev
    Asp Resources Forum
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ASP-DEV ASP Resources Forum allow remote attackers to execute arbitrary SQL commands via the (1) forum_id parameter to forum.asp, (2) unspecified parameters to register.asp, and (3) the "Search For" field in search.asp.

  • CVE-2005-4166Dec 11, 2005
    Duware
    Duportal
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in password.asp in DUWare DUportal Pro 3.4.3 allows remote attackers to inject arbitrary web script or HTML via the result parameter.

  • CVE-2005-4167Dec 11, 2005
    Efiction
    Efiction
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in eFiction 1.0 and 1.1 allows remote attackers to inject arbitrary web script or HTML via the let parameter in a viewlist action to titles.php.

  • CVE-2005-4168Dec 11, 2005
    Efiction
    Efiction
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in eFiction 1.0, 1.1, and 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the let parameter in a viewlist action to titles.php and (2) the username.

  • CVE-2005-4169Dec 11, 2005
    Efiction
    Efiction
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in eFiction 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) let parameter in a viewlist action to authors.php and (2) sid parameter to viewstory.php.