VYPR

CVEs

381,809 total · page 7207 of 7,637

AllCriticalHighKEV
  • CVE-2006-6540Dec 14, 2006
    Bluetrait
    Bluetrait
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in bt-trackback.php in Bluetrait before 1.2.0, when trackback is enabled, allows remote attackers to execute arbitrary SQL commands via unspecified parameters. NOTE: some of these details are obtained from third party information.

  • CVE-2006-6541Dec 14, 2006
    PHP
    Animated Smiley Generator
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in signer/final.php in warez distributions of Animated Smiley Generator allows remote attackers to execute arbitrary PHP code via a URL in the smiley parameter. NOTE: the vendor disputes this issue, stating that only Warez versions of…

  • CVE-2006-6542Dec 14, 2006
    Fscripts
    Fantastic News
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in news.php in Fantastic News 2.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-6543Dec 14, 2006
    Appintellect
    Spotlight CRM
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in login.asp in AppIntellect SpotLight CRM 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) login (UserName) and possibly (2) password parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2006-6544Dec 14, 2006
    Cm68 News
    Cm68 News
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in CM68 News allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-6545Dec 14, 2006
    PHP
    Errordocs
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/common.php in the ErrorDocs 1.0.0 and earlier module for mxBB (mx_errordocs) allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.

  • CVE-2006-6546Dec 14, 2006
    CuteNews
    aj-fork
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in inc/shows.inc.php in cutenews aj-fork (CN:AJ) 167f and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter.

  • CVE-2006-6512Dec 14, 2006
    Winamp
    Winamp Web Interface (Wawi)
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in the Browse function (/browse URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to list arbitrary directories via URL encoded backslashes ("%2F") in the path parameter.

  • CVE-2006-6513Dec 14, 2006
    Winamp
    Winamp Web Interface (Wawi)
    risk 0.00cvss —epss 0.01

    The CControl::Download function (/dl URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to download arbitrary file types under the root via a trailing "." (dot) in a filename in the file parameter, related to erroneous behavior of the…

  • CVE-2006-6514Dec 14, 2006
    Flippet.org
    Winamp Web Interface
    risk 0.00cvss —epss 0.01

    Winamp Web Interface (Wawi) 7.5.13 and earlier uses an insufficient comparison to determine whether a directory is located below the application's root directory, which allows remote authenticated users to access certain other directories if the name of the root directory is a…

  • CVE-2006-6515Dec 14, 2006
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.01

    Mantis before 1.1.0a2 sets the default value of $g_bug_reminder_threshold to "reporter" instead of a more privileged role, which has unknown impact and attack vectors, possibly related to frequency of reminders.

  • CVE-2006-6516Dec 14, 2006
    Kdpics
    Kdpics
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in KDPics 1.16 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) page parameter to (a) index.php3, or the (2) lib_path parameter to (b) authenticate.inc.php3 or (c) lib/exifer/exif.php.

  • CVE-2006-6517Dec 14, 2006
    Kdpics
    Kdpics
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in KDPics 1.16 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) categories parameter to (a) index.php3 or (b) galeries.inc.php3.

  • CVE-2006-6518Dec 14, 2006
    Scriptphp
    Pronews
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ProNews 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo, (2) email, (3) date, (4) sujet, (5) message, (6) site, and (7) lien parameters to (a) admin/change.php, and the (8) aa parameter…

  • CVE-2006-6519Dec 14, 2006
    ProNews
    ProNews
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in lire-avis.php in ProNews 1.5 allows remote attackers to execute arbitrary SQL commands via the aa parameter.

  • CVE-2006-6520Dec 14, 2006
    Scriptphp
    Messageriescripthp
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Messageriescripthp 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo parameter to (a) existepseudo.php, the (2) email parameter to (b) existeemail.php, or the (3) pageName or (4) cssform…

  • CVE-2006-6521Dec 14, 2006
    Messageriescripthp
    Messageriescripthp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in lire-avis.php in Messageriescripthp 2.0 allows remote attackers to execute arbitrary SQL commands via the aa parameter.

  • CVE-2006-6522Dec 14, 2006
    Wikitimescale
    Twozero
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in WikiTimeScale TwoZero before 2.31 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in the (1) forum module and (2) event descriptions. NOTE: some of these details are obtained from third…

  • CVE-2006-6523Dec 14, 2006
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in mail/manage.html in BoxTrapper in cPanel 11 allows remote attackers to inject arbitrary web script or HTML via the account parameter.

  • CVE-2006-6524Dec 14, 2006
    Ezhrs
    Hr Assist
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the Uname (UserName) parameter.

  • CVE-2006-6525Dec 14, 2006
    Ezhrs
    Hr Assist
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-6526Dec 14, 2006
    Gizzar
    Gizzar
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter.

  • CVE-2006-6527Dec 14, 2006
    Gizzar
    Gizzar
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in guest.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-6528Dec 14, 2006
    Drupal
    Chatroom Module
    risk 0.00cvss —epss 0.01

    The Chatroom Module before 4.7.x.-1.0 for Drupal broadcasts Chatroom visitors' session IDs to all participants, which allows remote attackers to hijack sessions and gain privileges.

  • CVE-2006-6529Dec 14, 2006
    Drupal
    Chatroom Module
    risk 0.00cvss —epss 0.01

    The Chatroom Module before 4.7.x.-1.0 for Drupal displays private messages in a chatroom's last messages overview, which allows remote attackers to obtain sensitive information by reading the overview.

  • CVE-2006-6530Dec 14, 2006
    Drupal
    Help Tip
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2006-6531Dec 14, 2006
    Drupal
    Help Tip
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to inject arbitrary web script or HTML, and possibly obtain administrative access, via node titles.

  • CVE-2006-6532Dec 14, 2006
    Vt Forum
    Vt Forum Lite
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Vt-Forum Lite 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) StrMsg or (2) Topic_ID parameter to (a) vf_info.asp, (b) vf_newtopic.asp, (c) vf_settings.asp, and (d)…

  • CVE-2006-6533Dec 14, 2006
    OsCommerce
    Oscommerce
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in admin/templates_boxes_layout.php in osCommerce 3.0a3 allows remote attackers to include and execute arbitrary PHP files via a .. (dot dot) in the filter parameter. NOTE: this issue can be leveraged to obtain full path information in error…

  • CVE-2006-6534Dec 14, 2006
    OsCommerce
    Oscommerce
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 3.0a3 allow remote attackers to inject arbitrary web script or HTML via the (1) set parameter to admin/modules.php, the (2) selected_box parameter to definitiva/admin/customers.php, the (3) lID parameter to…

  • CVE-2006-5648MedDec 14, 2006
    Ubuntu
    Linux
    risk 0.36cvss 5.5epss 0.00

    Ubuntu Linux 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (resource consumption) by using the (1) sys_get_robust_list and (2) sys_set_robust_list functions to create processes that cannot be killed.

  • CVE-2006-5649MedDec 14, 2006
    Ubuntu
    Linux
    risk 0.36cvss 5.5epss 0.00

    Unspecified vulnerability in the "alignment check exception handling" in Ubuntu 5.10, 6.06 LTS, and 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (kernel panic) via unspecified vectors.

  • CVE-2006-5875Dec 14, 2006
    Enemies Of Carlotta
    Enemies Of Carlotta
    risk 0.00cvss —epss 0.02

    eoc.py in Enemies of Carlotta (EoC) before 1.2.4 allows remote attackers to execute arbitrary commands via shell metacharacters in an "SMTP level e-mail address".

  • CVE-2006-6107Dec 14, 2006
    D Bus Project
    dbus
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match rules for other applications and cause a denial of service (lost process messages).

  • CVE-2006-6508Dec 14, 2006
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.21 allows remote authenticated users to send unauthorized messages as an arbitrary user via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-6509Dec 14, 2006
    Sitekiosk
    Sitekiosk
    risk 0.00cvss —epss 0.00

    Cross-site scripting (XSS) vulnerability in the skinning feature in SiteKiosk before 6.5.150 allows local users to bypass security protections and inject arbitrary web script or HTML via an ABOUT: URI, which is displayed in the title bar of the browser.

  • CVE-2006-6510Dec 14, 2006
    Sitekiosk
    Sitekiosk
    risk 0.00cvss —epss 0.00

    An unspecified ActiveX control in SiteKiosk before 6.5.150 is installed "safe for scripting", which allows local users to bypass security protections and read arbitrary files via certain functions.

  • CVE-2006-6511Dec 14, 2006
    Dadaimc
    Dadaimc
    risk 0.00cvss —epss 0.01

    dadaIMC .99.3 uses an insufficiently restrictive FilesMatch directive in the installed .htaccess file, which allows remote attackers to execute arbitrary PHP code by uploading files whose names contain (1) feature, (2) editor, (3) newswire, (4) otherpress, (5) admin, (6) pbook,…

  • CVE-2006-6496Dec 13, 2006
    Ca
    Anti-Virus 2007
    risk 0.00cvss —epss 0.00

    The (1) VetMONNT.sys and (2) VetFDDNT.sys drivers in CA Anti-Virus 2007 8.1, Anti-Virus for Vista Beta 8.2, and CA Internet Security Suite 2007 v3.0 do not properly handle NULL buffers, which allows local users with administrative access to cause a denial of service (system…

  • CVE-2006-2386Dec 13, 2006
    Microsoft
    Outlook Express
    risk 0.02cvss —epss 0.29

    Unspecified vulnerability in Microsoft Outlook Express 6 and earlier allows remote attackers to execute arbitrary code via a crafted contact record in a Windows Address Book (WAB) file.

  • CVE-2006-4702Dec 13, 2006
    Microsoft
    Windows Media Player
    risk 0.02cvss —epss 0.28

    Buffer overflow in the Windows Media Format Runtime in Microsoft Windows Media Player (WMP) 6.4 and Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file.

  • CVE-2006-5584Dec 13, 2006
    Microsoft
    Windows 2000
    risk 0.03cvss —epss 0.32

    The Remote Installation Service (RIS) in Microsoft Windows 2000 SP4 uses a TFTP server that allows anonymous access, which allows remote attackers to upload and overwrite arbitrary files to gain privileges on systems that use RIS.

  • CVE-2006-5585Dec 13, 2006
    Microsoft
    Windows Xp
    risk 0.00cvss —epss 0.02

    The Client-Server Run-time Subsystem in Microsoft Windows XP SP2 and Server 2003 allows local users to gain privileges via a crafted file manifest within an application, aka "File Manifest Corruption Vulnerability."

  • CVE-2006-6494Dec 13, 2006
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Directory traversal vulnerability in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via a .. (dot dot) sequence in the LANG environment variable that points to a locale file containing attacker-controlled format string specifiers.

  • CVE-2006-6495Dec 13, 2006
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via large precision padding values in a format string specifier in the format parameter of the doprf function. NOTE: this issue normally does not cross privilege…

  • CVE-2006-6493Dec 13, 2006
    OpenLDAP
    Openldap
    risk 0.04cvss —epss 0.09

    Buffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos.c in OpenLDAP 2.4.3 and earlier, when OpenLDAP is compiled with the --enable-kbind (Kerberos KBIND) option, allows remote attackers to execute arbitrary code via an LDAP bind request using the…

  • CVE-2006-5577Dec 12, 2006
    Microsoft
    Ie
    risk 0.02cvss —epss 0.26

    Microsoft Internet Explorer 6 and earlier allows remote attackers to obtain sensitive information via unspecified uses of the OBJECT HTML tag, which discloses the absolute path of the corresponding TIF folder, aka "TIF Folder Information Disclosure Vulnerability," and a…

  • CVE-2006-5578Dec 12, 2006
    Microsoft
    Ie
    risk 0.02cvss —epss 0.22

    Microsoft Internet Explorer 6 and earlier allows remote attackers to read Temporary Internet Files (TIF) and obtain sensitive information via unspecified vectors involving certain drag and drop operations, aka "TIF Folder Information Disclosure Vulnerability," and a different…

  • CVE-2006-5579Dec 12, 2006
    Microsoft
    Internet Explorer
    risk 0.03cvss —epss 0.32

    Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code by using JavaScript to cause certain errors simultaneously, which results in the access of previously freed memory, aka "Script Error Handling Memory Corruption Vulnerability."

  • CVE-2006-5581Dec 12, 2006
    Microsoft
    Internet Explorer
    risk 0.03cvss —epss 0.36

    Unspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via certain DHTML script functions, such as normalize, and "incorrectly created elements" that trigger memory corruption, aka "DHTML Script Function Memory Corruption…