VYPR

CVEs

343,037 total · page 6574 of 6,861

AllCriticalHighKEV
  • CVE-2005-3992Dec 4, 2005
    Wineggdropshell
    Wineggdropshell
    risk 0.03cvss —epss 0.05

    Multiple buffer overflows in WinEggDropShell remote access trojan (RAT) 1.7 allow remote attackers to execute arbitrary code via (1) a long GET request to the HTTP server, or a long (2) USER or (3) PASS command to the FTP server.

  • CVE-2005-3985Dec 4, 2005
    Astaro
    Security Linux
    risk 0.00cvss —epss 0.04

    The Internet Key Exchange version 1 (IKEv1) implementation in Astaro Security Linux before 6.102 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due…

  • CVE-2005-3986Dec 4, 2005
    Verosky Media
    Instant Photo Gallery
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in Instant Photo Gallery 1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat_id parameter in portfolio.php and (2) cid parameter in content.php.

  • CVE-2005-3987Dec 4, 2005
    Tradesoft
    Tradesoft CMS
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Tradesoft CMS allow remote attackers to execute arbitrary SQL commands via unspecified attack vectors.

  • CVE-2005-3988Dec 4, 2005
    Pineapple Technologies
    Lore
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in article.php in Pineapple Technologies Lore 1.5.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2005-3989Dec 4, 2005
    Avaya
    TN2602AP IP Media Resource 320
    risk 0.00cvss —epss 0.02

    Memory leak in Avaya TN2602AP IP Media Resource 320 circuit pack before vintage 9 firmware allows remote attackers to cause a denial of service (memory consumption) via crafted VoIP packets.

  • CVE-2005-3980Dec 4, 2005
    Edgewall Software
    Trac
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in the ticket query module in Edgewall Trac 0.9 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the group parameter.

  • CVE-2005-3981Dec 4, 2005
    Microsoft
    Windows Xp
    risk 0.03cvss —epss 0.04

    NOTE: this issue has been disputed by third parties. Microsoft Windows XP, 2000, and 2003 allows local users to kill a writable process by using the CreateRemoteThread function with certain arguments on a process that has been opened using the OpenProcess function, possibly…

  • CVE-2005-3982Dec 4, 2005
    Webcalendar
    Webcalendar
    risk 0.04cvss —epss 0.07

    CRLF injection vulnerability in layers_toggle.php in WebCalendar 1.0.1 might allow remote attackers to modify HTTP headers and conduct HTTP response splitting attacks via the ret parameter, which is used to redirect URL requests.

  • CVE-2005-3983Dec 4, 2005
    Microfocus
    Systems Insight Manager
    risk 0.00cvss —epss 0.02

    Unknown vulnerability in the login page for HP Systems Insight Manager (SIM) 4.0 and 4.1, when accessed by Microsoft Internet Explorer with the MS04-025 patch, leads to a denial of service (browser hang). NOTE: although the advisory is vague, this issue does not appear to…

  • CVE-2005-3984Dec 4, 2005
    Webcalendar
    Webcalendar
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in WebCalendar 1.0.1 allows remote attackers to execute arbitrary SQL commands via the time_range parameter to edit_report_handler.php. NOTE: the startid/activity_log.php vector is already covered by CVE-2005-3949.

  • CVE-2005-3966Dec 3, 2005
    Java Search Engine
    Java Search Engine
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in search.jsp in Java Search Engine (JSE) 0.9.34 allows remote attackers to inject arbitrary web script or HTML via the q parameter.

  • CVE-2005-3967Dec 3, 2005
    Atlassian
    Confluence
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the dosearchsite.action module in Atlassian Confluence 2.0.1 Build 321 allows remote attackers to inject arbitrary web script or HTML via the searchQuery.queryString search module parameter.

  • CVE-2005-3968Dec 3, 2005
    Phpx
    Phpx
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in auth.inc.php in PHPX 3.5.9 and earlier allows remote attackers to execute arbitrary SQL commands, bypass authentication, and upload arbitrary PHP code via the username parameter.

  • CVE-2005-3969Dec 3, 2005
    Mxchange
    Mxchange
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in MXChange before 0.2.0-pre10 PL492 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2005-3970Dec 3, 2005
    Mxchange
    Mxchange
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MXChange before 0.2.0-pre10 PL492 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2005-3971Dec 3, 2005
    Citrix Systems
    Nfuse
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the login form in Citrix MetaFrame Secure Access Manager 2.0 through 2.2 and NFuse Elite 1.0 allows remote attackers to inject arbitrary web script or HTML via the username field.

  • CVE-2005-3972Dec 3, 2005
    Extreme Corporate
    Extreme Search
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in extremesearch.php in Extreme Search Corporate Edition 6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2005-3973Dec 3, 2005
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allow remote attackers to inject arbitrary web script or HTML via various HTML tags and values, such as the (1) legend tag and the value parameter used in (2) label and (3)…

  • CVE-2005-3974Dec 3, 2005
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission.

  • CVE-2005-3975Dec 3, 2005
    Drupal
    Drupal
    risk 0.00cvss —epss 0.05

    Interpretation conflict in file.inc in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the…

  • CVE-2005-3976Dec 3, 2005
    Duware
    Duclassified
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in type.asp, as used in multiple DUware products including (1) DUamazon 3.1, (2) DUarticle 1.1, (3) DUclassified 4.2, (4) DUdirectory 3.1 and DUdirectory Pro 3.0 and 3.0 SQL, (5) DUdownload 1.1, (6) DUgallery 3.3, (7) DUnews 1.1, and (8) DUpaypal 3.1…

  • CVE-2005-3977Dec 3, 2005
    Qualityebiz
    Qualityppc
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in QualityEBiz Quality PPC 1553 allows remote attackers to inject web script or HTML via the REQ parameter to the search module.

  • CVE-2005-3978Dec 3, 2005
    Scriptdevelopers.net
    Netclassifieds
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition 1.0.1, Professional Edition 1.5.1, Standard Edition 1.9.6.3, and Free Edition 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) CatID parameter in (a) ViewCat.php and (b)…

  • CVE-2005-3979Dec 3, 2005
    Coppermine
    Coppermine Photo Gallery
    risk 0.00cvss —epss 0.02

    relocate_server.php in Coppermine Photo Gallery (CPG) 1.4.2 and 1.4 beta is not removed after installation and does not use authentication, which allows remote attackers to obtain sensitive information, such as database configuration, via a direct request.

  • CVE-2005-3964Dec 2, 2005
    OpenMotif
    libUil
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in libUil (libUil.so) in OpenMotif 2.2.3, and possibly other versions, allows attackers to execute arbitrary code via the (1) diag_issue_diagnostic function in UilDiags.c and (2) open_source_file function in UilSrcSrc.c.

  • CVE-2005-3963Dec 2, 2005
    Dotclear
    Dotclear
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in session.php in DotClear before 1.2.3 allows remote attackers to execute arbitrary SQL commands via the dc_xd parameter in a cookie.

  • CVE-2005-3962Dec 1, 2005
    Perl Foundation
    Perl
    risk 0.00cvss —epss 0.01

    Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a…

  • CVE-2005-3930Dec 1, 2005
    N 13
    News
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in N-13 News 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2005-3931Dec 1, 2005
    Asp Rider
    Asp Rider
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.asp in ASP-Rider 1.6 allows remote attackers to execute arbitrary SQL commands via the HTTP referer.

  • CVE-2005-3932Dec 1, 2005
    O Kiraku
    Nikki
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in okiraku.php in O-Kiraku Nikki 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the day_id parameter.

  • CVE-2005-3933Dec 1, 2005
    88script
    88script Event Calendar
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in 88Script's Event Calendar 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter.

  • CVE-2005-3934Dec 1, 2005
    Symantec
    Pcanywhere
    risk 0.04cvss —epss 0.09

    Buffer overflow in Symantec pcAnywhere 11.0.1, 11.5.1, and all other 32-bit versions allows remote attackers to cause a denial of service (application crash) via unknown attack vectors.

  • CVE-2005-3935Dec 1, 2005
    Socketkb
    Socketkb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in SocketKB 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) node and (2) art_id parameters.

  • CVE-2005-3936Dec 1, 2005
    Socketkb
    Socketkb
    risk 0.00cvss —epss 0.02

    PHP file include vulnerability in SocketKB 1.1.0 and earlier allows remote attackers to include arbitrary local files via the __f parameter.

  • CVE-2005-3937Dec 1, 2005
    Softbizscripts
    B2B Trading Marketplace Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Softbiz B2B Trading Marketplace Script 1.1 and earler allows remote attackers to execute arbitrary SQL commands via the cid parameter in (1) selloffers.php, (2) buyoffers.php, (3) products.php, or (4) profiles.php.

  • CVE-2005-3938Dec 1, 2005
    Softbizscripts
    FAQ Script
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in Softbiz FAQ Script 1.1 and earler allows remote attackers to execute arbitrary SQL commands via the id parameter in (1) index.php, (2) faq_qanda.php, (3) refer_friend.php, (4) print_article.php, or (5) add_comment.php.

  • CVE-2005-3939Dec 1, 2005
    Wsn Knowledge Base
    Wsn Knowledge Base
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in WSN Knowledge Base 1.2.0 and earler allow remote attackers to execute arbitrary SQL commands via the (1) catid, (2) perpage, (3) ascdesc, and (4) orderlinks in a displaycat action in (a) index.php; and the (5) id parameter in (b)…

  • CVE-2005-3940Dec 1, 2005
    ORCA
    Ringmaker
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ringmaker.php in Orca Ringmaker 2.3c and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter.

  • CVE-2005-3941Dec 1, 2005
    Greywyvern
    Orca Blog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in blog.php in Orca Blog 1.3b and earlier allows remote attackers to execute arbitrary SQL commands via the msg parameter.

  • CVE-2005-3942Dec 1, 2005
    Greywyvern
    Orca Knowledgebase
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in knowledgebase-control.php in Orca Knowledgebase 2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the qid parameter.

  • CVE-2005-3943Dec 1, 2005
    ilyav
    FAQ System
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ilyav FAQ System 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) FAQ_ID and (2) action parameters in (a) viewFAQ.php; and (3) CATEGORY_ID parameter in (b) index.php.

  • CVE-2005-3944Dec 1, 2005
    ilyav
    Survey System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in survey.php in ilyav Survey System 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the SURVEY_ID parameter.

  • CVE-2005-3945Dec 1, 2005
    Microsoft
    Windows 2000
    risk 0.01cvss —epss 0.12

    The SynAttackProtect protection in Microsoft Windows 2003 before SP1 and Windows 2000 before SP4 with Update Roll-up uses a hash of predictable data, which allows remote attackers to cause a denial of service (CPU consumption) via a flood of SYN packets that produce identical…

  • CVE-2005-3946Dec 1, 2005
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Opera 8.50 allows remote attackers to cause a denial of service (crash) via a Java applet with a large string argument to the removeMember JNI method for the com.opera.JSObject class.

  • CVE-2005-3947Dec 1, 2005
    PHP Upload Center
    PHP Upload Center
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in PHP Upload Center allows remote attackers to read arbitrary files via "../" sequences in the filename parameter.

  • CVE-2005-3948Dec 1, 2005
    Phpalbum
    Phpalbum
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in main.php in PHPAlbum 0.2.3 and earlier allows remote attackers to read arbitrary files via the (1) cmd and (2) var1 parameters.

  • CVE-2005-3949Dec 1, 2005
    Webcalendar
    Webcalendar
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) startid parameter to activity_log.php, (2) startid parameter to admin_handler.php, (3) template parameter to edit_template.php, and (4) multiple…

  • CVE-2005-3950Dec 1, 2005
    Nufw
    Nufw
    risk 0.00cvss —epss 0.01

    nuauth in NuFW 1.0.x before 1.0.16 and 1.1 allows authenticated users to cause a denial of service via malformed packets.

  • CVE-2005-3951Dec 1, 2005
    PHP Labs
    Survey Wizard
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in survey.php in PHP Labs Survey Wizard allows remote attackers to execute arbitrary SQL commands via the sid parameter.