VYPR

CVEs

381,917 total · page 7204 of 7,639

AllCriticalHighKEV
  • CVE-2006-6770Dec 27, 2006
    Jinzora
    Jinzora
    risk 0.03cvss —epss 0.05

    Multiple PHP remote file inclusion vulnerabilities in Jinzora Media Jukebox 2.7 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter in (1) popup.php, (2) rss.php, (3) ajax_request.php, and…

  • CVE-2006-6771Dec 27, 2006
    Irokez
    Irokez CMS
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Irokez CMS 0.7.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[PTH][func] parameter in (a) scripts/gallery.scr.php; the (2) GLOBALS[PTH][spaw]…

  • CVE-2006-6772Dec 27, 2006
    risk 0.00cvss —epss 0.05

    Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run with the dump or backend option, allows remote attackers to execute arbitrary code via format string specifiers in the Common Name (CN) field of an SSL certificate associated with an…

  • CVE-2006-6773Dec 27, 2006
    Fishyshoop
    Fishyshoop
    risk 0.03cvss —epss 0.03

    pages/register/register.php in Fishyshoop 0.930 beta allows remote attackers to create arbitrary administrative users by setting the is_admin HTTP POST parameter to 1.

  • CVE-2006-6774Dec 27, 2006
    Ciberia
    Content Federator
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in socios/maquetacion_socio.php (members/maquetacion_member.php) in Ciberia Content Federator 1.0 allows remote attackers to execute arbitrary PHP code via the path parameter. NOTE: some of these details are obtained from third party…

  • CVE-2006-6775Dec 27, 2006
    Acftp
    Acftp
    risk 0.03cvss —epss 0.02

    acFTP 1.5 allows remote authenticated users to cause a denial of service via a crafted argument to the (1) REST or (2) PBSZ command.

  • CVE-2006-6768Dec 27, 2006
    Pwp Technologies
    The Classified AD System
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in default.asp in PWP Technologies The Classified Ad System allow remote attackers to inject arbitrary web script or HTML via the (1) cat or (2) main parameter.

  • CVE-2006-6761Dec 27, 2006
    Novell
    Netmail
    risk 0.07cvss —epss 0.53

    Stack-based buffer overflow in the IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via a long argument to the SUBSCRIBE command.

  • CVE-2006-6762Dec 27, 2006
    Novell
    Netmail
    risk 0.00cvss —epss 0.02

    The IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to cause a denial of service via an APPEND command with a single "(" (parenthesis) in the argument.

  • CVE-2006-6763Dec 27, 2006
    Raven PHP Scripts
    Keep It Simple Guest Book
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in the Keep It Simple Guest Book (KISGB) allow remote attackers to execute arbitrary PHP code via a URL in the (1) path_to_themes parameter in (a) authenticate.php, and the (2) default_path_for_themes parameter in (b) admin.php…

  • CVE-2006-6764Dec 27, 2006
    Raven PHP Scripts
    Keep It Simple Guest Book
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in authenticate.php in Keep It Simple Guest Book (KISGB), when executing PHP through CGI, allows remote attackers to execute arbitrary PHP code via a URL in the default_path_to_themes parameter.

  • CVE-2006-6765Dec 27, 2006
    Pagetool
    Pagetool
    risk 0.03cvss —epss 0.02

    Multiple PHP file inclusion vulnerabilities in src/admin/pt_upload.php in Pagetool 1.07 allow remote attackers to execute arbitrary PHP code via (1) a local filename or FTP/share URI in the config_file parameter or (2) a URL in the ptconf[src] parameter.

  • CVE-2006-6766Dec 27, 2006
    Cwm Design
    Cwmexplorer
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in cwmExplorer 1.1.0 and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: The provenance of this information is unknown; details are obtained solely from third party information.

  • CVE-2006-6424Dec 27, 2006
    Novell
    Netmail
    risk 0.08cvss —epss 0.60

    Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code (1) by appending literals to certain IMAP verbs when specifying command continuation requests to IMAPD, resulting in a heap overflow; and (2) via crafted arguments to…

  • CVE-2006-6425Dec 27, 2006
    Novell
    Netmail
    risk 0.08cvss —epss 0.58

    Stack-based buffer overflow in the IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via unspecified vectors involving the APPEND command.

  • CVE-2006-6753Dec 27, 2006
    Microsoft
    Windows
    risk 0.00cvss —epss 0.02

    Event Viewer (eventvwr.exe) in Microsoft Windows does not properly display log data that contains '%' (percent) characters, which might make it impossible to use Event Viewer to determine the actual data that triggered an event, and might produce long strings that are not…

  • CVE-2006-6754Dec 27, 2006
    Ixprim
    Ixprim
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Ixprim 1.2 allow remote attackers to execute arbitrary SQL commands via the story_id parameter to ixm_ixpnews.php, and unspecified other vectors.

  • CVE-2006-6755Dec 27, 2006
    Ixprim
    Ixprim CMS
    risk 0.03cvss —epss 0.03

    Ixprim 1.2 allows remote attackers to obtain sensitive information via a direct request for kernel/plugins/fckeditor2/ixprim_api.php, which reveals the path in an error message.

  • CVE-2006-6756Dec 27, 2006
    Ixprim
    Ixprim
    risk 0.03cvss —epss 0.02

    The code function in install.fct.php in Ixprim 1.2 produces a guessable value of the confidential IXP_CODE in mainfile.php, which might allow remote attackers to gain access to the administration panel via a brute force attack.

  • CVE-2006-6757Dec 27, 2006
    cwmExplorer
    cwmExplorer
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in cwmExplorer 1.0 allows remote attackers to read arbitrary files and source code, and obtain sensitive information via directory traversal sequences in the show_file parameter.

  • CVE-2006-6758Dec 27, 2006
    HTTP Explorer
    HTTP Explorer Web Server
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in Http explorer 1.02 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the URI.

  • CVE-2006-6759Dec 27, 2006
    RealNetworks
    Realplayer
    risk 0.03cvss —epss 0.03

    A certain ActiveX control in rpau3260.dll in RealNetworks RealPlayer 10.5 allows remote attackers to cause a denial of service (Internet Explorer crash) by invoking the RealPlayer.Initialize method with certain arguments.

  • CVE-2006-6760Dec 27, 2006
    Phpmymanga
    Phpmymanga
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in template.php in Phpmymanga 0.8.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) actionsPage or (2) formPage parameter.

  • CVE-2006-6746Dec 27, 2006
    Xt News
    Xt-News
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Xt-News 0.1 allow remote attackers to inject arbitrary web script or HTML via the id_news parameter to (1) add_comment.php or (2) show_news.php.

  • CVE-2006-6747Dec 27, 2006
    Xt News
    Xt-News
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in show_news.php in Xt-News 0.1 allows remote attackers to execute arbitrary SQL commands via the id_news parameter.

  • CVE-2006-6748Dec 27, 2006
    Newxooper
    Newxooper
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in i-accueil.php in Newxooper 0.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-6749Dec 27, 2006
    Openser
    Openser
    risk 0.00cvss —epss 0.02

    Buffer overflow in the parse_expression function in parse_config in OpenSER 1.1.0 allows attackers to have an unknown impact via a long str parameter.

  • CVE-2006-6750Dec 27, 2006
    XM
    Easy Personal FTP Server
    risk 0.03cvss —epss 0.02

    Format string vulnerability in XM Easy Personal FTP Server 5.0.1 allows remote attackers to cause a denial of service (application crash) via format string specifiers in a long PORT command. NOTE: this issue might be related to CVE-2006-2226.

  • CVE-2006-6751Dec 27, 2006
    XM Easy Personal FTP Server
    FTP Server
    risk 0.03cvss —epss 0.03

    Format string vulnerability in XM Easy Personal FTP Server 5.2.1 allows remote attackers to cause a denial of service (application crash) via format string specifiers in the USER command or certain other available or nonexistent commands. NOTE: It was later reported that 5.3.0…

  • CVE-2006-6752Dec 27, 2006
    Ftprush
    Ftprush
    risk 0.03cvss —epss 0.02

    Buffer overflow in FTPRush 1.0.0.610 might allow attackers to gain privileges via a long Host field. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. Also, it is not clear whether this issue crosses security…

  • CVE-2006-6730Dec 26, 2006
    OpenBSD
    OpenBSD
    risk 0.00cvss —epss 0.00

    OpenBSD and NetBSD permit usermode code to kill the display server and write to the X.Org /dev/xf86 device, which allows local users with root privileges to reduce securelevel by replacing the System Management Mode (SMM) handler via a write to an SMRAM address within /dev/xf86…

  • CVE-2006-6731Dec 26, 2006
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier allow attackers to develop Java applets…

  • CVE-2006-6732Dec 26, 2006
    Cwm Design
    Cwmvote
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in archive.php in cwmVote 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the abs parameter.

  • CVE-2006-6733Dec 26, 2006
    Osticket
    Osticket
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in support/view.php in Support Cards 1 (osTicket) allows remote attackers to inject arbitrary web script or HTML via the e parameter.

  • CVE-2006-6734Dec 26, 2006
    Obie Website
    Mini Web Shop
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in modules/viewcategory.php in Minh Nguyen Duong Obie Website Mini Web Shop 2.1.c allows remote attackers to inject arbitrary web script or HTML via the catname parameter.

  • CVE-2006-6735Dec 26, 2006
    Obie Website
    Mini Web Shop
    risk 0.00cvss —epss 0.02

    modules/viewcategory.php in Minh Nguyen Duong Obie Website Mini Web Shop 2.1.c allows remote attackers to obtain sensitive information via a request with an arbitrary catname parameter but no itemsdb parameter, which reveals the path in an error message. NOTE: CVE analysis…

  • CVE-2006-6736Dec 26, 2006
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 6 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier allows attackers to use untrusted applets…

  • CVE-2006-6737Dec 26, 2006
    Sun Corporation
    Jdk
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 5 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_10 and earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier allows attackers to use untrusted applets…

  • CVE-2006-6738Dec 26, 2006
    Cwm Design
    Cwmcounter
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in statistic.php in cwmCounter 5.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.

  • CVE-2006-6739Dec 26, 2006
    Paristemi
    Paristemi
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in buycd.php in Paristemi 0.8.3 allows remote attackers to execute arbitrary PHP code via a URL in the HTTP_DOCUMENT_ROOT parameter, a different vector than CVE-2006-6689.

  • CVE-2006-6740Dec 26, 2006
    Phpprofiles
    Phpprofiles
    risk 0.04cvss —epss 0.10

    Multiple PHP remote file inclusion vulnerabilities in phpProfiles 3.1.2b and earlier allow remote attackers to execute arbitrary PHP code via a URL in the menu parameter to (1) include/body.inc.php or (2) include/body_admin.inc.php; or a URL in the incpath parameter to (3)…

  • CVE-2006-6741Dec 26, 2006
    Mkportal
    Mkportal
    risk 0.03cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in urlobox in MKPortal allows remote attackers to delete arbitrary messages as an administrator via a delete operation in an img BBcode tag.

  • CVE-2006-6742Dec 26, 2006
    Microfocus
    FTP Print Server
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in FTP Print Server 2.4 and 2.4.5 in HP LaserJet 5000 Series printers with firmware R.25.15 or R.25.47, and HP LaserJet 5100 Series printers with firmware V.29.12, allow remote attackers to cause a denial of service (device crash) via a long string in…

  • CVE-2006-6743Dec 26, 2006
    Phpprofiles
    Phpprofiles
    risk 0.00cvss —epss 0.00

    phpProfiles before 2.1.1 uses world writable permissions for certain profile files and directories, which allows local users to modify or delete files, related to (1) users/include/do_makeprofile.inc.php and (2) users/include/copy.inc.php.

  • CVE-2006-6744Dec 26, 2006
    Phpprofiles
    Phpprofiles
    risk 0.00cvss —epss 0.00

    phpProfiles before 2.1.1 does not have an index.php or other index file in the (1) image_data, (2) graphics/comm, or (3) users read/write directories, which might allow remote attackers to list directory contents or have other unknown impacts.

  • CVE-2006-6745Dec 26, 2006
    Sun Corporation
    Jre
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and earlier, and Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, allow attackers to develop Java applets or applications that are…

  • CVE-2006-6724Dec 26, 2006
    Bolintech
    Dreamftp Server
    risk 0.03cvss —epss 0.03

    BolinTech Dream FTP Server 1.02 allows remote authenticated users, including anonymous users, to cause a denial of service (application crash) via a certain invalid PORT command.

  • CVE-2006-6725Dec 26, 2006
    Phpbuilder
    Phpbuilder
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in PHPBuilder 0.0.2 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to (1) lib/htm2php.php and (2) sitetools/htm2php.php. NOTE: The provenance of this information is unknown;…

  • CVE-2006-6726Dec 26, 2006
    Inertianews
    Inertianews
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in inertianews_main.php in inertianews 0.02 beta allows remote attackers to execute arbitrary PHP code via a URL in the inews_path parameter.

  • CVE-2006-6727Dec 26, 2006
    Inertianews
    Inertianews
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in inertianews_class.php in inertianews 0.02 beta and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter.