VYPR

CVEs

342,369 total · page 6605 of 6,848

AllCriticalHighKEV
  • CVE-2005-1607May 16, 2005
    Remote Cart
    Remote Cart
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in shop.cgi in Remote Cart allows remote attackers to inject arbitrary web script or HTML via the (1) merchant or (2) demo parameters.

  • CVE-2005-1608May 16, 2005
    Spidean
    Autotheme
    risk 0.00cvss —epss 0.01

    Multiple unknown vulnerabilities in the Blocks module in Spidean AutoTheme 1.7 and AT-Lite for PostNuke have unknown impact.

  • CVE-2005-1609May 16, 2005
    Sun Corporation
    Storedge 6130 Arrays
    risk 0.00cvss —epss 0.02

    Unknown vulnerability in Sun StorEdge 6130 Arrays (SE6130) with serial numbers between 0451AWF00G and 0513AWF00J allows local users and remote attackers to delete data.

  • CVE-2005-1610May 16, 2005
    Tru Zone
    Nukeet
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in security.php for Tru-Zone NukeET 3.0 and 3.1 allows remote attackers to inject arbitrary web script or HTML via a base64 encoded Codigo parameter.

  • CVE-2005-1611May 16, 2005
    Web Crossing Inc
    Web Crossing
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in WebX in Web Crossing 5.x allows remote attackers to inject arbitrary web script or HTML via a URL with an "@" followed by the desired script.

  • CVE-2005-1612May 16, 2005
    Openbb
    Openbb
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in read.php in Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to execute arbitrary SQL commands via the TID parameter.

  • CVE-2005-1613May 16, 2005
    Openbb
    Openbb
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in member.php in Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to inject arbitrary web script or HTML via the reverse parameter in a list action.

  • CVE-2005-1614May 16, 2005
    Ultimate PHP Board
    Ultimate PHP Board
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in viewforum.php in Ultimate PHP Board (UPB) 1.8 through 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the postorder parameter.

  • CVE-2005-1615May 16, 2005
    Ultimate PHP Board
    Ultimate PHP Board
    risk 0.03cvss —epss 0.02

    viewforum.php in Ultimate PHP Board (UPB) 1.8 through 1.9.6 may allow remote attackers to read sensitive data via the postorder parameter, which is not properly handled by textdb.inc.php, possibly due to a SQL injection vulnerability.

  • CVE-2005-1616May 16, 2005
    Ultimate PHP Board
    Ultimate PHP Board
    risk 0.00cvss —epss 0.01

    viewforum.php in Ultimate PHP Board (UPB) 1.8 through 1.9.6 allows remote attackers to obtain sensitive information via an invalid (1) id or possibly (2) postorder parameter, which reveals the path in an error message when a file can not be opened.

  • CVE-2005-1617May 16, 2005
    Willings
    Webcam Lite
    risk 0.00cvss —epss 0.00

    Willings WebCam and WebCam Lite 2.8 and earlier stores the password in memory in plaintext, which allows local users to gain sensitive information.

  • CVE-2005-1618May 16, 2005
    Yahoo
    Messenger
    risk 0.03cvss —epss 0.03

    The YMSGR URL handler in Yahoo! Messenger 5.x through 6.0 allows remote attackers to cause a denial of service (disconnect) via a room login or a room join request packet with a third : (colon) and an & (ampersand), which causes Messenger to send a corrupted packet to the…

  • CVE-2005-1619May 16, 2005
    Phpmychat
    Phpmychat
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in (1) start_page.css.php3 (aka start-page.css.php3) or (2) style.css.php3 in PHPMyChat 0.14.5 allow remote attackers to inject arbitrary web script or HTML commands via the FontName parameter. NOTE: it was later reported that…

  • CVE-2005-1620May 16, 2005
    Soren Boysen
    Skull Splitter Guestbook
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Skull-Splitter Guestbook 1.0, 2.0 and 2.2 allows remote attackers to inject arbitrary web script or HTML via the (1) title or (2) content of a message.

  • CVE-2005-1621May 16, 2005
    Postnuke
    Postnuke
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the pnModFunc function in pnMod.php for PostNuke 0.750 through 0.760rc4 allows remote attackers to read arbitrary files via a .. (dot dot) in the func parameter to index.php.

  • CVE-2005-1622May 16, 2005
    Softbizscripts
    E-Shop
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in productsByCategory.asp in MetaCart e-Shop allows remote attackers to inject arbitrary web script or HTML via the strCatalog_NAME parameter.

  • CVE-2005-1544May 14, 2005
    LibTIFF
    Libtiff
    risk 0.04cvss —epss 0.14

    Stack-based buffer overflow in libTIFF before 3.7.2 allows remote attackers to execute arbitrary code via a TIFF file with a malformed BitsPerSample tag.

  • CVE-2005-1545May 14, 2005
    Ht Editor
    Ht Editor
    risk 0.00cvss —epss 0.02

    Integer overflow in the ELF parser in HT Editor before 0.8.0 allows remote attackers to execute arbitrary code via a crafted ELF file, which leads to a heap-based buffer overflow.

  • CVE-2005-1546May 14, 2005
    Ht Editor
    Ht Editor
    risk 0.00cvss —epss 0.03

    Buffer overflow in the PE parser in HT Editor before 0.8.0 allows remote attackers to execute arbitrary code via a crafted PE file.

  • CVE-2005-1547May 14, 2005
    Bakbone
    Netvault
    risk 0.03cvss —epss 0.03

    Heap-based buffer overflow in the demo version of Bakbone Netvault, and possibly other versions, allows remote attackers to execute arbitrary commands via a large packet to port 20031.

  • CVE-2005-1548May 14, 2005
    Advanced Guestbook
    Advanced Guestbook
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Advanced Guestbook 2.3.1 allows remote attackers to execute arbitrary SQL commands via the entry parameter.

  • CVE-2005-1549May 14, 2005
    Colored Scripts
    Easy Message Board
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in easymsgb.pl in Easy Message Board allows remote attackers to read arbitrary files via a .. (dot dot) in the print parameter.

  • CVE-2005-1550May 14, 2005
    Easy Message Board
    easymsgb.pl
    risk 0.04cvss —epss 0.04

    easymsgb.pl in Easy Message Board allows remote attackers to execute arbitrary commands via shell metacharacters in the print parameter.

  • CVE-2005-1551May 14, 2005
    Sophos
    Anti Virus
    risk 0.00cvss —epss 0.04

    Sophos Anti-Virus 3.93 does not check downloaded files for viruses when they have only been written, which creates a race condition and may allow remote attackers to bypass virus protection if the file is executed before the antivirus starts on system reboot.

  • CVE-2005-1552May 14, 2005
    Geovision
    Digital Surveillance System
    risk 0.03cvss —epss 0.03

    GeoVision Digital Video Surveillance System 6.04, 6.1 and 7.0, when set to create JPEG images, does not properly protect an image even when a password and username is assigned, which may allow remote attackers to gain sensitive information via a direct request to the image.

  • CVE-2005-1553May 14, 2005
    Geovision
    Digital Surveillance System
    risk 0.00cvss —epss 0.01

    GeoVision Digital Video Surveillance System 6.04, 6.1 and 7.0 uses a weak encryption scheme to encrypt passwords, which allows remote attackers to obtain the password via sniffing.

  • CVE-2005-1554May 14, 2005
    Wowbb
    Wowbb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in view_user.php in WowBB 1.6, 1.61, and 1.62 allows remote attackers to execute arbitrary SQL commands via the sort_by parameter.

  • CVE-2005-1556May 14, 2005
    Gamespy
    Gamespy SDK Cd Key Validation Toolkit
    risk 0.00cvss —epss 0.02

    Gamespy cd-key validation system allows remote attackers to cause a denial of service (cd-key already in use) by capturing and replaying a cd-key authorization session.

  • CVE-2005-1563May 14, 2005
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.01

    Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 displays a different error message depending on whether a product exists or not, which allows remote attackers to determine hidden products.

  • CVE-2005-1566May 14, 2005
    Acrowave
    AAP-3100AR
    risk 0.00cvss —epss 0.02

    Acrowave AAP-3100AR wireless router allows remote attackers to bypass authentication by pressing CTRL-C at the username or password prompt in a telnet session, which causes the shell to crash and restart, then leave the user in the new shell.

  • CVE-2005-1569May 14, 2005
    Directtopics
    Directtopics
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in DirectTopics 2.1 and 2.2 allows remote attackers to inject arbitrary web script via a javascript: URL in (1) a thread or (2) an IMG tag.

  • CVE-2005-1570May 14, 2005
    Battleaxe Software
    Bttlxeforum
    risk 0.00cvss —epss 0.01

    forum.asp in bttlxeForum 2.0 allows remote attackers to obtain full path information via a certain hex-encoded argument to the page parameter, possibly due to a SQL injection vulnerability.

  • CVE-2005-1571May 14, 2005
    Wenig And Spitzer Williams
    Showoff Digital Media Software
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in ShowOff! 1.5.4 allow remote attackers to read arbitrary files via ".." sequences in arguments to the (1) ShowAlbum, (2) ShowVideo, or (3) ShowGraphic scripts.

  • CVE-2005-1574May 14, 2005
    Microsoft
    Windows Media Player
    risk 0.00cvss —epss 0.05

    Windows Media Player 9 and 10, in certain cases, allows content protected by Windows Media Digital Rights Management (WMDRM) to redirect the user to a web site to obtain a license, even when the "Acquire licenses automatically for protected content" setting is not enabled.

  • CVE-2005-1575May 14, 2005
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    The file download dialog in Mozilla Firefox 0.10.1 and 1.0 for Windows allows remote attackers to hide the real file types of downloaded files via the Content-Type HTTP header and a filename containing whitespace, dots, or ASCII byte 160.

  • CVE-2005-1577May 14, 2005
    Apg Technology
    Classmaster
    risk 0.00cvss —epss 0.01

    APG Technology ClassMaster does not properly restrict access to sensitive folders, which allows remote attackers to access folders via a network share.

  • CVE-2005-1581May 14, 2005
    Eric Fichot
    Bug Report
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Bug Report 1.0 allows remote attackers to inject arbitrary web script or HTML via various fields to bug_report.php, which are not filtered or quoted when processed by bug_list.php or admin/index.php.

  • CVE-2005-1582May 14, 2005
    1Two News
    1Two News
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php for 1Two News 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) nom, (2) email, (3) siteweb, or (4) commentaire variables.

  • CVE-2005-1583May 14, 2005
    risk 0.00cvss —epss 0.01

    1Two News 1.0 allows remote attackers to (1) delete images for new stories via a direct request to admin/delete.php or (2) upload arbitrary images via a direct request to admin/upload.php.

  • CVE-2005-1584May 14, 2005
    Open Solution
    Quick.forum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php for Quick.Forum 2.1.6 allows remote attackers to inject arbitrary web script or HTML via the topic field in a NewTopic action.

  • CVE-2005-1586May 14, 2005
    Open Solution
    Quick.forum
    risk 0.00cvss —epss 0.01

    Quick.Forum 2.1.6 stores potentially sensitive information such as usernames, banned IP addresses, censored words, and backups under the web document root, which allows remote attackers to obtain that information via a direct request to (1) db/users.txt, (2) db/banList.txt, (3)…

  • CVE-2005-1587May 14, 2005
    Open Solution
    Quick.cart
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php for Quick.cart 0.3.0 allows remote attackers to inject arbitrary web script or HTML via the sWord parameter.

  • CVE-2005-0758May 13, 2005
    Gzip
    Gzip
    risk 0.00cvss —epss 0.01

    zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.

  • CVE-2005-1578May 13, 2005
    EnCase
    Forensic Edition
    risk 0.00cvss —epss 0.00

    EnCase Forensic Edition 4.18a does not support Device Configuration Overlays (DCO), which allows attackers to hide information without detection.

  • CVE-2005-0969May 12, 2005
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Heap-based buffer overflow in the syscall emulation functionality in Mac OS X before 10.3.9 allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code via crafted parameters.

  • CVE-2005-0971May 12, 2005
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in the semop system call in Mac OS X 10.3.9 and earlier allows local users to gain privileges via crafted arguments.

  • CVE-2005-0972May 12, 2005
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Integer overflow in the searchfs system call in Mac OS X 10.3.9 and earlier allows local users to execute arbitrary code via crafted parameters.

  • CVE-2005-0973May 12, 2005
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Unknown vulnerability in the setsockopt system call in Mac OS X 10.3.9 and earlier allows local users to cause a denial of service (memory exhaustion) via crafted arguments.

  • CVE-2005-0974May 12, 2005
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Unknown vulnerability in the nfs_mount call in Mac OS X 10.3.9 and earlier allows local users to gain privileges via crafted arguments.

  • CVE-2005-1531May 12, 2005
    Mozilla Corporation
    Mozilla
    risk 0.00cvss —epss 0.03

    Firefox before 1.0.4 and Mozilla Suite before 1.7.8 does not properly implement certain security checks for script injection, which allows remote attackers to execute script via "Wrapped" javascript: URLs, as demonstrated using (1) a javascript: URL in a view-source: URL, (2) a…