VYPR

CVEs

381,917 total · page 7203 of 7,639

AllCriticalHighKEV
  • CVE-2006-6809Dec 29, 2006
    Vladimir Meshakov
    buratinable templator
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in process.php in Vladimir Menshakov buratinable templator (aka bubla) 1.0.0rc2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) bu_dir or (2) bu_config[dir] parameter.

  • CVE-2006-6810Dec 29, 2006
    Db Hub
    Db Hub
    risk 0.03cvss —epss 0.04

    Unspecified vulnerability in the clear_user_list function in src/main.c in DB Hub 0.3 allows remote attackers to cause a denial of service (application crash) via crafted network traffic, which triggers memory corruption.

  • CVE-2006-6811MedDec 29, 2006
    KDE
    Ksirc
    risk 0.46cvss 6.5epss 0.11

    KsIRC 1.3.12 allows remote attackers to cause a denial of service (crash) via a long PRIVMSG string when connecting to an Internet Relay Chat (IRC) server, which causes an assertion failure and results in a NULL pointer dereference. NOTE: this issue was originally reported as a…

  • CVE-2006-6812Dec 29, 2006
    Myphpcalendar
    Myphpcalendar
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in myPHPCalendar 10.1 allow remote attackers to execute arbitrary PHP code via a URL in the cal_dir parameter to (1) admin.php, (2) contacts.php, or (3) convert-date.php.

  • CVE-2006-6813Dec 29, 2006
    Mxmania
    Mxmania File Upload Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in detail.asp in Mxmania File Upload Manager (FUM) 1.0.6 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2006-6814Dec 29, 2006
    Hosting Controller
    Hosting Controller
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in FolderManager/FolderManager.aspx in Hosting Controller 7c allows remote authenticated users to read and modify arbitrary files, and list arbitrary directories via ..\ (dot dot backslash) sequences in the BrowsePath parameter.

  • CVE-2006-6815Dec 29, 2006
    Dmxready
    Dmxready Secure Login Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in DMXReady Secure Login Manager 1.0 allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified parameters to (1) set_preferences.asp, (2) send_password_preferences.asp, and (3)…

  • CVE-2006-6816Dec 29, 2006
    Dmxready
    Dmxready Secure Login Manager
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in DMXReady Secure Login Manager 1.0 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) set_preferences.asp, (2) send_password_preferences.asp, and (3) SecureLoginManager/list.asp in the Local-Admin…

  • CVE-2006-6817Dec 29, 2006
    Alstrasoft
    Webhost Directory
    risk 0.00cvss —epss 0.01

    AlstraSoft Web Host Directory allows remote attackers to obtain sensitive information by requesting any invalid URI, which reveals the path in an error message, a different vulnerability than CVE-2006-2617.

  • CVE-2006-6818Dec 29, 2006
    Alstrasoft
    Webhost Directory
    risk 0.00cvss —epss 0.02

    AlstraSoft Web Host Directory allows remote attackers to bypass authentication and change the admin password via a direct request to admin/config.

  • CVE-2006-6819Dec 29, 2006
    Alstrasoft
    Webhost Directory
    risk 0.03cvss —epss 0.02

    AlstraSoft Web Host Directory stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a backup database via a direct request for admin/backup/db.

  • CVE-2006-6820Dec 29, 2006
    Enthrallweb
    Ecoupons
    risk 0.03cvss —epss 0.02

    myprofile.asp in Enthrallweb eCoupons does not properly validate the MM_recordId parameter during profile updates, which allows remote authenticated users to modify certain profile fields of another account by specifying that account's username in a modified MM_recordId…

  • CVE-2006-6821Dec 29, 2006
    Enthrallweb
    Enews
    risk 0.03cvss —epss 0.02

    myprofile.asp in Enthrallweb eNews does not properly validate the MM_recordId parameter during profile updates, which allows remote authenticated users to modify certain profile fields of another account by specifying that account's username in a modified MM_recordId parameter.

  • CVE-2006-6822Dec 29, 2006
    Enthrallweb
    Eclassifieds
    risk 0.03cvss —epss 0.02

    myprofile.asp in Enthrallweb eClassifieds does not properly validate the MM_recordId parameter during profile updates, which allows remote authenticated users to modify certain profile fields of another account by specifying that account's username in a modified MM_recordId…

  • CVE-2006-6823Dec 29, 2006
    Yrch
    Yrch
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in plugins/metasearch/plug.inc.php in Yrch! 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.

  • CVE-2006-6824Dec 29, 2006
    Jim Hu and Chad Little
    PHP iCalendar
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Jim Hu and Chad Little PHP iCalendar 2.23 rc1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) getdate parameter in (a) day.php, (b) month.php, (c) year.php, (d) week.php, (e) search.php,…

  • CVE-2006-6799Dec 28, 2006
    Cacti (software)
    Cacti
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the…

  • CVE-2006-6800Dec 28, 2006
    Limbo CMS
    Event Module
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion in eventcal/mod_eventcal.php in the event module 1.0 for Limbo CMS allows remote attackers to execute arbitrary PHP code via a URL in the lm_absolute_path parameter.

  • CVE-2006-6801Dec 28, 2006
    Sh News
    Sh News
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in misc.php in SH-News 0.93, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the news_cfg[path] parameter.

  • CVE-2006-6802Dec 28, 2006
    Enthrallweb
    Epages
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in actualpic.asp in Enthrallweb ePages allows remote attackers to execute arbitrary SQL commands via the Biz_ID parameter.

  • CVE-2006-6803Dec 28, 2006
    Enthrallweb
    Ecars
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Types.asp in Enthrallweb eCars 1.0 allows remote attackers to execute arbitrary SQL commands via the Type_id parameter.

  • CVE-2006-6804Dec 28, 2006
    Dragon
    Dragon Business Directory - Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in bus_details.asp in Dragon Business Directory - Pro (aka Dragon Internet Business Search Directory - Pro) 3.01.12 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2006-6805Dec 28, 2006
    Enthrallweb
    Ejobs
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in newsdetail.asp in Enthrallweb eJobs allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2006-6806Dec 28, 2006
    Enthrallweb
    Emates
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in newsdetail.asp in Enthrallweb eMates 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2006-6807Dec 28, 2006
    Softwebs Nepal
    Ananda Real Estate
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the agent parameter.

  • CVE-2006-6808Dec 28, 2006
    WordPress
    WordPress
    risk 0.00cvss —epss 0.07

    Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the get_file_description function in…

  • CVE-2006-6318Dec 28, 2006
    Elog
    Elog
    risk 0.00cvss —epss 0.03

    The show_elog_list function in elogd.c in elog 2.6.2 and earlier allows remote authenticated users to cause a denial of service (daemon crash) by attempting to access a logbook whose name begins with "global," which results in a NULL pointer dereference. NOTE: some of these…

  • CVE-2006-6797Dec 28, 2006
    Microsoft
    Windows
    risk 0.04cvss —epss 0.07

    The Client Server Run-Time Subsystem (CSRSS) in Microsoft Windows allows local users to cause a denial of service (crash) or read arbitrary memory from csrss.exe via crafted arguments to the NtRaiseHardError function with status 0x50000018, a different vulnerability than…

  • CVE-2006-6776Dec 28, 2006
    Future Internet
    Future Internet
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Future Internet allow remote attackers to execute arbitrary SQL commands via the (1) newsId or (2) categoryid parameter in a Portal.Showpage action in index.cfm, or (3) the langId parameter in index.cfm.

  • CVE-2006-6777Dec 28, 2006
    Future Internet
    Future Internet
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.cfm in Future Internet allows remote attackers to inject arbitrary web script or HTML via the categoryId parameter in a Portal.ShowPage action.

  • CVE-2006-6778Dec 28, 2006
    Timberwolf
    Timberwolf
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in shownews.php in TimberWolf 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the nid parameter.

  • CVE-2006-6779Dec 28, 2006
    Jelsoft
    Vbulletin
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin allows remote attackers to inject arbitrary web script or HTML via an SWF file that uses ActionScript to trigger execution of JavaScript.

  • CVE-2006-6780Dec 28, 2006
    Hlstats
    Hlstats
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the login form in HLstats 1.20 through 1.34 allows remote attackers to execute arbitrary SQL commands via the killLimit parameter.

  • CVE-2006-6781Dec 28, 2006
    Hlstats
    Hlstats
    risk 0.03cvss —epss 0.03

    HLstats 1.20 through 1.34 allows remote attackers to obtain sensitive information via playinfo mode, with certain values of the player and playerdata[lastName][] parameters, which reveals the path in an error message.

  • CVE-2006-6782Dec 28, 2006
    Pnamazu
    Pnamazu
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in pnamazu 2006.02.28 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-6783Dec 28, 2006
    Logahead
    Logahead Unu
    risk 0.00cvss —epss 0.02

    logahead UNU 1.0 before 20061226 allows remote attackers to upload arbitrary files via unspecified vectors related to plugins/widged/_widged.php (aka the WidgEd plugin), possibly because of an authentication bypass. NOTE: some of these details are obtained from third party…

  • CVE-2006-6784Dec 28, 2006
    Netbula
    Anyboard
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Netbula Anyboard allows remote attackers to execute arbitrary SQL commands via the user name in the login form.

  • CVE-2006-6785Dec 28, 2006
    Open Newsletter
    Open Newsletter
    risk 0.03cvss —epss 0.04

    The (1) settings.php and (2) subscribers.php scripts in Open Newsletter 2.5 and earlier do not exit when authentication fails, which allows remote attackers to perform unauthorized administrative actions, or execute arbitrary code in conjunction with another vulnerability.

  • CVE-2006-6786Dec 28, 2006
    Open Newsletter
    Open Newsletter
    risk 0.03cvss —epss 0.02

    Open Newsletter 2.5 and earlier allows remote authenticated administrators to execute arbitrary PHP code by inserting the code into the email parameter to (1) subscribe.php or (2) unsubscribe.php.

  • CVE-2006-6787Dec 28, 2006
    Mxmania
    Newsletter Mx
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/admin_mail_adressee.asp in Newsletter MX 1.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2006-6788Dec 28, 2006
    Luckybot
    Luckybot
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in LuckyBot 3 allow remote attackers to execute arbitrary PHP code via a URL in the dir parameter to (1) run.php or (2) ircbot.class.php.

  • CVE-2006-6789Dec 28, 2006
    Phpbbxtra
    Phpbbxtra
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in Phpbbxtra 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-6790Dec 28, 2006
    Ultimate PHP Board
    Ultimate PHP Board
    risk 0.03cvss —epss 0.02

    Direct static code injection vulnerability in chat/login.php in Ultimate PHP Board (UPB) 2.0b1 and earlier allows remote attackers to inject arbitrary PHP code via the username parameter, which is injected into chat/text.php.

  • CVE-2006-6791Dec 28, 2006
    Chatwm
    Chatwm
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in SelGruFra.asp in chatwm 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) txtUse and (2) txtPas parameters.

  • CVE-2006-6792Dec 28, 2006
    Mxmania
    Calendar Mx Basic
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in calendar_detail.asp in Calendar MX BASIC 1.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-6793Dec 28, 2006
    Okul Merkezi
    Okul Merkezi Portal
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in ataturk.php in Okul Merkezi Portal 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

  • CVE-2006-6794Dec 28, 2006
    Efkan
    Forum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.asp in Efkan Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the grup parameter.

  • CVE-2006-6795Dec 28, 2006
    Myphpnuke
    Myphpnuke
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in gallery/displayCategory.php in the My_eGallery 2.5.6 module in myPHPNuke (MPN) allows remote attackers to execute arbitrary PHP code via a URL in the basepath parameter.

  • CVE-2006-6796Dec 28, 2006
    Mtcms
    Mtcms
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in admin/admin_settings.php in MTCMS 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ins_file parameter.

  • CVE-2006-6769Dec 27, 2006
    PHP Live
    PHP Live
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in PHP Live! 3.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) search_string parameter in (a) setup/transcripts.php, the (2) l parameter in (b) index.php, the (3) login field in (c)…