VYPR

CVEs

342,589 total · page 6591 of 6,852

AllCriticalHighKEV
  • CVE-2005-2101Aug 17, 2005
    KDE
    Kde
    risk 0.00cvss —epss 0.01

    langen2kvtml in KDE 3.0 to 3.4.2 creates insecure temporary files in /tmp with predictable names, which allows local users to overwrite arbitrary files.

  • CVE-2005-2588Aug 17, 2005
    Dvbbs
    Dvbbs
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in DVBBS 7.1 SP2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the page parameter to dispbbs.asp, (2) name parameter to dispuser.asp, or the (3) title, (4) view, or (5) act parameter to…

  • CVE-2005-2589Aug 17, 2005
    Linksys
    Wrt54gs
    risk 0.00cvss —epss 0.01

    Unknown vulnerability in Linksys WRT54GS wireless router with firmware 4.50.6, with WPA Personal/TKIP authentication enabled, allows remote clients to bypass authentication by connecting without using encryption.

  • CVE-2005-2590Aug 17, 2005
    Parlano
    Mindalign
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Parlano MindAlign 5.0 and later versions allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2005-2591Aug 17, 2005
    Parlano
    Mindalign
    risk 0.00cvss —epss 0.01

    Parlano MindAlign 5.0 and later versions allows remote attackers to list valid users via unknown vectors, aka the "User Enumeration" vulnerability.

  • CVE-2005-2592Aug 17, 2005
    Parlano
    Mindalign
    risk 0.00cvss —epss 0.02

    Unknown vulnerability in Parlano MindAlign 5.0 and later versions allows remote attackers to bypass authentication via unknown vectors.

  • CVE-2005-2593Aug 17, 2005
    Parlano
    Mindalign
    risk 0.00cvss —epss 0.01

    Parlano MindAlign 5.0 and later versions uses weak encryption, with unknown impact and attack vectors.

  • CVE-2005-2594Aug 17, 2005
    Apple Inc.
    Safari
    risk 0.03cvss —epss 0.03

    Apple Safari 1.3 (132) on Mac OS X 1.3.9 allows remote attackers to cause a denial of service (crash) via certain Javascript, possibly involving a function that defines a handler for itself within the function body.

  • CVE-2005-2595Aug 17, 2005
    Dada Mail
    Dada Mail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Dada Mail before 2.10 Alpha 1 allows remote attackers to execute arbitrary Javascript via archived messages.

  • CVE-2005-2596Aug 17, 2005
    Gallery Project
    Gallery
    risk 0.00cvss —epss 0.00

    User.php in Gallery, as used in Postnuke, allows users with any Admin privileges to gain access to all galleries.

  • CVE-2005-2597Aug 17, 2005
    AOL
    Aol Client Software
    risk 0.00cvss —epss 0.00

    AOL Client Software 9.0 uses insecure permissions for its installation path, which allows local users to execute arbitrary code with SYSTEM privileges by replacing ACSD.exe with a malicious program.

  • CVE-2005-2598Aug 17, 2005
    Dokeos
    Dokeos
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in Dokeos 1.6 and earlier, and possibly Claroline, allow remote attackers to (1) delete arbitrary files or directories via the delete parameter to claroline/scorm/scormdocument.php, (2) move arbitrary files via the move_to and…

  • CVE-2005-2599Aug 17, 2005
    Hummingbird
    Connectivity
    risk 0.00cvss —epss 0.01

    Hummingbird FTP for Connectivity 10.0 uses weak encryption (trivial encoding) to store the user's password in the FTP profile, which allows attackers to gain privileges.

  • CVE-2005-2600Aug 17, 2005
    Fudforum
    Fudforum
    risk 0.00cvss —epss 0.02

    FUDForum 2.6.15 with "Tree View" enabled, as used in other products such as phpgroupware and egroupware, allows remote attackers to read private posts via a modified mid parameter.

  • CVE-2005-2601Aug 17, 2005
    Midicart Software
    Midicart PHP Shopping Cart
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in MidiCart allows remote attackers to execute arbitrary SQL commands via the code_no parameter to (1) Item_Show.asp or (2) search_list.asp.

  • CVE-2005-2602Aug 17, 2005
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Thunderbird 1.0 and Firefox 1.0.6 allows remote attackers to obfuscate URIs via a long URI, which causes the address bar to go blank and could facilitate phishing attacks.

  • CVE-2005-2603Aug 17, 2005
    Mig
    My Image Gallery
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php for My Image Gallery (Mig ) 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the (1) currDir or (2) image parameters.

  • CVE-2005-2604Aug 17, 2005
    Mig
    My Image Gallery
    risk 0.00cvss —epss 0.02

    index.php for My Image Gallery (Mig ) 1.4.1 allows remote attackers to obtain the web server path via certain currDir and image arguments, which leaks the path in an error message.

  • CVE-2005-2605Aug 17, 2005
    Omnipilot Software
    Lasso Professional Server
    risk 0.00cvss —epss 0.01

    Unknown vulnerability in Lasso Professional Server8.0.4 and 8.0.5 allows attackers to bypass authentication, related to [Auth] tags.

  • CVE-2005-2606Aug 17, 2005
    Phlymail
    Phlymail
    risk 0.00cvss —epss 0.01

    Unknown vulnerability in the "frontend authentication" in PHlyMail 3.02.00 has unknown impact and attack vectors.

  • CVE-2005-2607Aug 17, 2005
    Phpsimplicity
    Simplicity Of Upload
    risk 0.00cvss —epss 0.02

    PHP file include vulnerability in download.php in PHPSimplicity Simplicity oF Upload before 1.3.1 allows remote attackers to include arbitrary local and remote files via the language parameter and a terminating null ("%00") characters.

  • CVE-2005-2608Aug 17, 2005
    Safehtml
    Safehtml
    risk 0.00cvss —epss 0.01

    SafeHTML before 1.3.5 does not properly filter script in UTF-7 and CSS comments, which allows remote attackers to conduct cross-site scripting (XSS) attacks in vulnerable applications that use SafeHTML.

  • CVE-2005-2609Aug 17, 2005
    Vegadns
    Vegadns
    risk 0.00cvss —epss 0.02

    index.php in VegaDNS 0.8.1, 0.9.8, and possibly other versions, allows remote attackers to obtain the full server path via an invalid VDNS_Sessid parameter.

  • CVE-2005-2610Aug 17, 2005
    Vegadns
    Vegadns
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in VegaDNS 0.8.1, 0.9.8, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the message parameter.

  • CVE-2005-2611Aug 17, 2005
    Symantec
    Netbackup
    risk 0.09cvss —epss 0.87

    VERITAS Backup Exec for Windows Servers 8.6 through 10.0, Backup Exec for NetWare Servers 9.0 and 9.1, and NetBackup for NetWare Media Server Option 4.5 through 5.1 uses a static password during authentication from the NDMP agent to the server, which allows remote attackers to…

  • CVE-2005-2612Aug 17, 2005
    WordPress
    WordPress
    risk 0.02cvss —epss 0.39

    Direct code injection vulnerability in WordPress 1.5.1.3 and earlier allows remote attackers to execute arbitrary PHP code via the cache_lastpostdate[server] cookie.

  • CVE-2005-2613Aug 17, 2005
    Cpaint
    Cpaint
    risk 0.00cvss —epss 0.01

    Unknown vulnerability in CPAINT Ajax Toolkit before 1.3-SP allows attackers to execute arbitrary PHP or ASP code or read files via unknown vectors.

  • CVE-2005-2614Aug 17, 2005
    Discuz
    Discuz\!
    risk 0.00cvss —epss 0.02

    Discuz! 4.0 rc4 does not properly restrict types of files that are uploaded to the server, which allows remote attackers to execute arbitrary commands via a filename containing ".php.rar" or other multiple extensions that include .php.

  • CVE-2005-2615Aug 17, 2005
    Eqdkp
    Eqdkp
    risk 0.00cvss —epss 0.01

    Unknown vulnerability in session.php in EQdkp before 1.3.0 has unknown impact and attack vectors, possibly involving auto_login_id.

  • CVE-2005-2616Aug 17, 2005
    Ezupload
    Ezupload
    risk 0.05cvss —epss 0.11

    Multiple PHP file include vulnerabilities in ezUpload 2.2 allow remote attackers to execute arbitrary code via the path parameter to (1) initialize.php, (2) customize.php, (3) form.php, or (4) index.php.

  • CVE-2005-2617Aug 17, 2005
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The syscall32_setup_pages function in syscall32.c for Linux kernel 2.6.12 and later, on the 64-bit x86 platform, does not check the return value of the insert_vm_struct function, which allows local users to trigger a memory leak via a 32-bit application with crafted ELF headers.

  • CVE-2005-2620Aug 17, 2005
    Novell
    Groupwise
    risk 0.00cvss —epss 0.02

    grpWise.exe for Novell GroupWise client 5.5 through 6.5.2 stores the password in plaintext in memory, which allows attackers to obtain the password using a debugger or another mechanism to read process memory.

  • CVE-2005-2097Aug 16, 2005
    Xpdf
    Xpdf
    risk 0.00cvss —epss 0.00

    xpdf and kpdf do not properly validate the "loca" table in PDF files, which allows local users to cause a denial of service (disk consumption and hang) via a PDF file with a "broken" loca table, which causes a large temporary file to be created when xpdf attempts to reconstruct…

  • CVE-2005-2102Aug 16, 2005
    Gaim
    Gaim
    risk 0.00cvss —epss 0.02

    The AIM/ICQ module in Gaim before 1.5.0 allows remote attackers to cause a denial of service (application crash) via a filename that contains invalid UTF-8 characters.

  • CVE-2005-2103CriAug 16, 2005
    Gaim
    Gaim
    risk 0.69cvss 9.8epss 0.16

    Buffer overflow in the AIM and ICQ module in Gaim before 1.5.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an away message with a large number of AIM substitution strings, such as %t or %n.

  • CVE-2005-2357Aug 16, 2005
    EMC Corporation
    Navisphere Manager
    risk 0.04cvss —epss 0.03

    Directory traversal vulnerability in EMC Navisphere Manager 6.4.1.0.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.

  • CVE-2005-2358Aug 16, 2005
    EMC Corporation
    Navisphere Manager
    risk 0.00cvss —epss 0.02

    EMC Navisphere Manager 6.4.1.0.0 allows remote attackers to list arbitrary directories via an HTTP request for a directory that ends in a "." (trailing dot).

  • CVE-2005-2470Aug 16, 2005
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.13

    Buffer overflow in a "core application plug-in" for Adobe Reader 5.1 through 7.0.2 and Acrobat 5.0 through 7.0.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.

  • CVE-2005-2555Aug 16, 2005
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Linux kernel 2.6.x does not properly restrict socket policy access to users with the CAP_NET_ADMIN capability, which could allow local users to conduct unauthorized activities via (1) ipv4/ip_sockglue.c and (2) ipv6/ipv6_sockglue.c.

  • CVE-2005-2558Aug 16, 2005
    MySQL
    MySQL
    risk 0.01cvss —epss 0.02

    Stack-based buffer overflow in the init_syms function in MySQL 4.0 before 4.0.25, 4.1 before 4.1.13, and 5.0 before 5.0.7-beta allows remote authenticated users who can create user-defined functions to execute arbitrary code via a long function_name field.

  • CVE-2005-2559Aug 16, 2005
    E107
    E107
    risk 0.00cvss —epss 0.02

    doping.php in ePing plugin 1.02 and earlier for e107 portal allows remote attackers to execute arbitrary code or overwrite files via (1) shell metacharacters in the eping_count parameter or (2) restricted shell metacharacters such as ">" and "&" in the eping_host parameter,…

  • CVE-2005-2560Aug 16, 2005
    CFBB
    CFBB
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.cfm in CFBB 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2005-2561Aug 16, 2005
    Myfaq
    Myfaq
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MYFAQ 1.0 allow remote attackers to execute arbitrary SQL commands via the Theme parameter to (1) affichagefaq.php3, (2) choixsoustheme.php3, (3) consultation.php3, (4) insfaq.php3, (5) inssoustheme.php3, (6) instheme.php3, (7)…

  • CVE-2005-2562Aug 16, 2005
    Gravityboardx
    Gravity Board X
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in Gravity Board X (GBX) 1.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the login field.

  • CVE-2005-2563Aug 16, 2005
    Gravityboardx
    Gravity Board X
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Gravity Board X (GBX) 1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the board_id parameter to deletethread.php or (2) the template.

  • CVE-2005-2564Aug 16, 2005
    Gravityboardx
    Gravity Board X
    risk 0.03cvss —epss 0.05

    Direct static code injection vulnerability in editcss.php in Gravity Board X (GBX) 1.1 allows remote attackers to execute arbitrary PHP code, HTML, and script via the csscontent parameter, which is directly inserted into the gbxfinal.css file.

  • CVE-2005-2565Aug 16, 2005
    Gravityboardx
    Gravity Board X
    risk 0.00cvss —epss 0.01

    Gravity Board X (GBX) 1.1 allows remote attackers to obtain sensitive information via (1) a 1 in the perm parameter to deletethread.php or a direct request to (2) ban.php, (3) addnews.php, (4) banned.php, (5) boardstats.php, (6) adminform.php, (7) /forms/admininfo.php, (8)…

  • CVE-2005-2566Aug 16, 2005
    Openbb
    Openbb
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Open Bulletin Board (OpenBB) allow remote attackers to execute arbitrary SQL commands via the (1) FID parameter to board.php or (2) UID parameter to member.php.

  • CVE-2005-2567Aug 16, 2005
    Syscp Team
    Syscp
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in SysCP 1.2.10 and earlier allows remote attackers to execute arbitrary PHP code via the language parameter.

  • CVE-2005-2568Aug 16, 2005
    Syscp Team
    Syscp
    risk 0.00cvss —epss 0.02

    Eval injection vulnerability in the template engine for SysCP 1.2.10 and earlier allows remote attackers to execute arbitrary PHP code via a string containing the code within "{" and "}" (curly bracket) characters, which are processed by the PHP eval function.