VYPR

CVEs

342,869 total · page 6583 of 6,858

AllCriticalHighKEV
  • CVE-2005-3323Oct 27, 2005
    Zope
    Zope
    risk 0.00cvss —epss 0.03

    docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in RestructuredText functionality.

  • CVE-2005-3324Oct 27, 2005
    Appindex
    Mwchat
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in chat.php in MWChat 6.8 allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2005-3325Oct 27, 2005
    Basic Analysis And Security Engine
    Base
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in (1) acid_qry_main.php in Analysis Console for Intrusion Databases (ACID) 0.9.6b20 and (2) base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.2, and unspecified other console scripts in these products, allow remote attackers…

  • CVE-2005-3326Oct 27, 2005
    MyBB
    Mybb
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in usercp.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the awayday parameter.

  • CVE-2005-3327Oct 27, 2005
    Network Appliance
    Data Ontap
    risk 0.00cvss —epss 0.02

    Network Appliance Data ONTAP 7.0 and earlier allows iSCSI Initiators to bypass iSCSI authentication via a modified client that skips the Security (Start) mode, as required by the Login Negotiation protocol, and uses Operational mode without proving identity.

  • CVE-2005-3328Oct 27, 2005
    Punbb
    Punbb
    risk 0.00cvss —epss 0.03

    PHP remote file inclusion vulnerability in common.php in PunBB 1.1.2 through 1.1.5 allows remote attackers to execute arbitrary code via the pun_root parameter.

  • CVE-2005-3329Oct 27, 2005
    Rsa
    Authentication Agent For Web
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in RSA Authentication Agent for Web 5.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the image parameter in a GetPic operation.

  • CVE-2005-3330Oct 27, 2005
    Snoopy
    Snoopy
    risk 0.04cvss —epss 0.17

    The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page, which is not properly…

  • CVE-2005-3331Oct 27, 2005
    Mgdiff
    mgdiff
    risk 0.00cvss —epss 0.00

    viewpatch in mgdiff 1.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.

  • CVE-2005-3332Oct 27, 2005
    Belchior Foundry
    Vcard
    risk 0.03cvss —epss 0.02

    PHP remote file include vulnerability in admin/define.inc.php in Belchior Foundry vCard 2.9 allows remote attackers to execute arbitrary PHP code via the match parameter.

  • CVE-2005-3333Oct 27, 2005
    Ebase
    Ebaseweb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in eBASEweb 3.0 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.

  • CVE-2005-3334Oct 27, 2005
    Flyspray
    Flyspray
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in index.php in Flyspray 0.9.7 through 0.9.8 (devel) allows remote attackers to inject arbitrary web script or HTML via the (1) PHPSESSID, (2) task, (3) string, (4) type, (5) serv, (6) due, (7) dev, and (8) sort2 parameters.

  • CVE-2005-3335Oct 27, 2005
    Mantisbt
    Mantis
    risk 0.01cvss —epss 0.07

    PHP file inclusion vulnerability in bug_sponsorship_list_view_inc.php in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the t_core_path parameter.

  • CVE-2005-3336Oct 27, 2005
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2005-3337Oct 27, 2005
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Mantis before 0.19.3 allow remote attackers to inject arbitrary web script or HTML via (1) unknown vectors involving Javascript and (2) mantis/view_all_set.php.

  • CVE-2005-3338Oct 27, 2005
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Mantis before 0.19.3, when using reminders, causes Mantis to display the real email addresses of users.

  • CVE-2005-3339Oct 27, 2005
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.00

    Mantis before 0.19.3 caches the User ID longer than necessary, which has unknown impact and attack vectors.

  • CVE-2005-2338Oct 27, 2005
    XOOPS
    Xoops
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.12 JP and earlier, XOOPS 2.0.13.1 and earlier, and 2.2.x up to 2.2.3 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) modules that use "XOOPS Code" and (2) newbb in the forum module.

  • CVE-2005-3312Oct 26, 2005
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.12

    The HTML rendering engine in Microsoft Internet Explorer 6.0 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML in corrupted images and other files such as .GIF, JPG, and WAV, which is rendered as HTML when the user clicks on the link, even though the…

  • CVE-2005-3304Oct 26, 2005
    PHP-Nuke
    PHP Nuke
    risk 0.03cvss —epss 0.06

    Multiple SQL injection vulnerabilities in PHP-Nuke 7.8 allow remote attackers to modify SQL queries and execute arbitrary PHP code via (1) the username parameter in the Your Account page, (2) the url parameter in the Downloads module, and (3) the description parameter in the…

  • CVE-2005-3305Oct 26, 2005
    Nuked Klan
    Nuked Klan
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Nuked Klan 1.7 allow remote attackers to execute arbitrary SQL commands via the (1) forum_id or (2) thread_id parameter in the Forum file, (3) the link_id in the Links file, (4) the artid parameter in the Sections file, and (5) the dl_id…

  • CVE-2005-3306Oct 26, 2005
    Flatnuke
    Flatnuke
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php for FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via the user parameter in a profile operation, a different vulnerability than CVE-2005-2814. NOTE: it is possible that this XSS is a resultant…

  • CVE-2005-3307Oct 26, 2005
    Flatnuke
    Flatnuke
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php for FlatNuke 2.5.6 allows remote attackers to read arbitrary files via ".." sequences in the (1) user parameter in a profile operation or (2) quale parameter in a newtopic operation.

  • CVE-2005-3308Oct 26, 2005
    Zomplog
    Zomplog
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Zomplog 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) comment parameter in detail.php, (3) the username parameter in get.php, and (4) the search parameter in index.php.

  • CVE-2005-3309Oct 26, 2005
    Zomplog
    Zomplog
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Zomplog 3.4 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in detail.php and the catid parameter in (2) get.php and (3) index.php.

  • CVE-2005-3310Oct 26, 2005
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.01

    Interpretation conflict in phpBB 2.0.17, with remote avatars and avatar uploading enabled, allows remote authenticated users to inject arbitrary web script or HTML via an HTML file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the…

  • CVE-2005-3311Oct 26, 2005
    BMC Software
    Software Control M Agent
    risk 0.00cvss —epss 0.00

    BMC Software Control-M 6.1.03 for Solaris, and possibly other platforms, allows local users to overwrite arbitrary files via a symlink attack on temporary files.

  • CVE-2005-2524Oct 26, 2005
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Safari after 2.0 in Apple Mac OS X 10.3.9 allows remote attackers to bypass domain restrictions via crafted web archives that cause Safari to render them as if they came from a different site.

  • CVE-2005-2741Oct 26, 2005
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Authorization Services in securityd for Apple Mac OS X 10.3.9 allows local users to gain privileges by granting themselves certain rights that should be restricted to administrators.

  • CVE-2005-2742Oct 26, 2005
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    SecurityAgent in Apple Mac OS X 10.4.2, under certain circumstances, can cause the "Switch User..." button to appear even though the "Enable fast user switching" setting is disabled, which can allow attackers with physical access to gain access to the desktop and bypass the…

  • CVE-2005-2743Oct 26, 2005
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.05

    The Java extensions for QuickTime 6.52 and earlier in Apple Mac OS X 10.3.9 allow untrusted applets to call arbitrary functions in system libraries, which allows remote attackers to execute arbitrary code.

  • CVE-2005-2745Oct 26, 2005
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Mail.app in Mail for Apple Mac OS X 10.3.9, when using Kerberos 5 for SMTP authentication, can include uninitialized memory in a message, which might allow remote attackers to obtain sensitive information.

  • CVE-2005-2746Oct 26, 2005
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Mail.app in Mail for Apple Mac OS X 10.3.9 and 10.4.2 includes message contents when using auto-reply rules, which could cause Mail.app to include decrypted message contents for encrypted messages.

  • CVE-2005-2744Oct 25, 2005
    Apple Inc.
    QuickDraw Manager
    risk 0.00cvss —epss 0.04

    Buffer overflow in QuickDraw Manager for Apple OS X 10.3.9 and 10.4.2, as used by applications such as Safari, Mail, and Finder, allows remote attackers to execute arbitrary code via a crafted PICT file.

  • CVE-2005-2747Oct 25, 2005
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.05

    Buffer overflow in ImageIO for Apple Mac OS X 10.4.2, as used by applications such as WebCore and Safari, allows remote attackers to execute arbitrary code via a crafted GIF file.

  • CVE-2005-2748Oct 25, 2005
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    The malloc function in the libSystem library in Apple Mac OS X 10.3.9 and 10.4.2 allows local users to overwrite arbitrary files by setting the MallocLogFile environment variable to the target file before running a setuid application.

  • CVE-2005-2708Oct 25, 2005
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    The search_binary_handler function in exec.c in Linux 2.4 kernel on 64-bit x86 architectures does not check a return code for a particular function call when virtual memory is low, which allows local users to cause a denial of service (panic), as demonstrated by running a…

  • CVE-2005-2100Oct 25, 2005
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The rw_vm function in usercopy.c in the 4GB split patch for the Linux kernel in Red Hat Enterprise Linux 4 does not perform proper bounds checking, which allows local users to cause a denial of service (crash).

  • CVE-2005-2970Oct 25, 2005
    Apache
    HTTP Server
    risk 0.01cvss —epss 0.14

    Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections.

  • CVE-2005-2926Oct 25, 2005
    SCO Group
    Openserver
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in (1) backupsh and (2) authsh in SCO Openserver 5.0.7 allows local users to execute arbitrary code via a long HOME environment variable.

  • CVE-2005-2927Oct 25, 2005
    SCO Group
    Unixware
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in ppp in SCO Unixware 7.1.3 and 7.1.4, and possibly earlier versions, allows local users to execute arbitrary code via a long argument to the (1) prompt or (2) defprompt command.

  • CVE-2005-2958Oct 25, 2005
    GNOME Foundation
    Libgda2
    risk 0.00cvss —epss 0.04

    Multiple format string vulnerabilities in the GNOME Data Access library for GNOME2 (libgda2) 1.2.1 and earlier allow attackers to execute arbitrary code.

  • CVE-2005-2959Oct 25, 2005
    Todd Miller
    Sudo
    risk 0.00cvss —epss 0.01

    Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users to gain privileges via the (1) SHELLOPTS and (2) PS4 environment variables before executing a bash script on behalf of another user, which are not cleared even though other variables are.

  • CVE-2005-3301Oct 24, 2005
    PhpMyAdmin
    phpMyAdmin
    risk 0.03cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl3 allow remote attackers to inject arbitrary web script or HTML via certain arguments to (1) left.php, (2) queryframe.php, or (3) server_databases.php.

  • CVE-2005-3302HigOct 24, 2005
    Blender
    Blender
    risk 0.51cvss 7.3epss 0.04

    Eval injection vulnerability in bvh_import.py in Blender 2.36 allows attackers to execute arbitrary Python code via a hierarchy element in a .bvh file, which is supplied to an eval function call.

  • CVE-2005-3294Oct 23, 2005
    Typsoft
    Typsoft FTP Server
    risk 0.04cvss —epss 0.08

    Typsoft FTP Server 1.11, with "Sub Directory Include" enabled, allows remote attackers to cause a denial of service (crash) by sending multiple RETR commands. NOTE: it was later reported that 1.10 is also affected.

  • CVE-2005-3295Oct 23, 2005
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in HP-UX B.11.23 on Itanium platforms allows local users to cause a denial of service due to a "specific stack size."

  • CVE-2005-3296Oct 23, 2005
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.06

    The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in.

  • CVE-2005-3297Oct 23, 2005
    Openwbem
    Openwbem
    risk 0.00cvss —epss 0.04

    Multiple integer overflows in OpenWBEM on SuSE Linux 9 allow remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2005-3298Oct 23, 2005
    Openwbem
    Openwbem
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in OpenWBEM on SuSE Linux 9 allow remote attackers to execute arbitrary code via unknown vectors.