VYPR

CVEs

381,808 total · page 7208 of 7,637

AllCriticalHighKEV
  • CVE-2006-6335Dec 12, 2006
    Sophos
    Scanning Engine
    risk 0.01cvss —epss 0.13

    Multiple buffer overflows in Sophos Anti-Virus scanning engine before 2.40 allow remote attackers to execute arbitrary code via (1) a SIT archive with a long filename that is not null-terminated, which triggers a heap-based overflow in veex.dll due to improper length…

  • CVE-2006-6482Dec 12, 2006
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.02

    Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request (1) for a non-existent (a) JWS, (b) CFM, (c) CFML, or (d) CFC file, which displays the installation path in the resulting error message; or (2) to /CFIDE/administrator/login.cfm…

  • CVE-2006-6483Dec 12, 2006
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.02

    Adobe ColdFusion MX 7.x before 7.0.2 does not properly filter HTML tags when protecting against cross-site scripting (XSS) attacks, which allows remote attackers to inject arbitrary web script or HTML via a NULL byte (%00) in certain HTML tags, as demonstrated using "%00script"…

  • CVE-2006-6484Dec 12, 2006
    MailEnable
    Mailenable
    risk 0.00cvss —epss 0.03

    The IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.34, Professional Edition 1.6 through 1.83, and Enterprise Edition 1.1 through 1.40 allows remote attackers to cause a denial of service (crash) via unspecified vectors that trigger a null pointer…

  • CVE-2006-6485Dec 12, 2006
    Shopsite
    Shopsite
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ShopSite 8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the prevlocation parameter in shopper/sc/registration.cgi and other unspecified vectors.

  • CVE-2006-6486Dec 12, 2006
    Easypagecms
    Easypage
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in EasyPage allows remote attackers to execute arbitrary SQL commands via unspecified vectors in sptrees/default.aspx, possibly involving the docId parameter. NOTE: this issue appears to have been disputed by a third party researcher, stating that…

  • CVE-2006-6423Dec 12, 2006
    MailEnable
    Mailenable
    risk 0.09cvss —epss 0.71

    Stack-based buffer overflow in the IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.35, Professional Edition 1.6 through 1.84, and Enterprise Edition 1.1 through 1.41 allows remote attackers to execute arbitrary code via a pre-authentication command…

  • CVE-2006-6481Dec 12, 2006
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.04

    Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.

  • CVE-2006-5873Dec 12, 2006
    Debian
    linux
    risk 0.00cvss —epss 0.02

    Buffer overflow in the cluster_process_heartbeat function in cluster.c in layer 2 tunneling protocol network server (l2tpns) before 2.1.21 allows remote attackers to cause a denial of service via a large heartbeat packet.

  • CVE-2006-6478Dec 12, 2006
    Scriptphp
    Annoncescripthp
    risk 0.04cvss —epss 0.11

    Multiple SQL injection vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a) email.php, the (2) no parameter in (b) voirannonce.php, the (3) idmembre parameter in (c) admin/admin_membre/fiche_membre.php,…

  • CVE-2006-6479Dec 12, 2006
    AnnonceScriptHP
    AnnonceScriptHP
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the email parameter in (1) erreurinscription.php, (2) Templates/admin.dwt.php, (3) Templates/commun.dwt.php, (4) membre.dwt.php, and (5)…

  • CVE-2006-6480Dec 12, 2006
    AnnonceScriptHP
    AnnonceScriptHP
    risk 0.00cvss —epss 0.01

    admin/admin_membre/fiche_membre.php in AnnonceScriptHP 2.0 allows remote attackers to obtain sensitive information via the idmembre parameter, which discloses the passwords for arbitrary users.

  • CVE-2006-5871Dec 11, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    smbfs in Linux kernel 2.6.8 and other versions, and 2.4.x before 2.4.34, when UNIX extensions are enabled, ignores certain mount options, which could cause clients to use server-specified uid, gid and mode settings.

  • CVE-2006-6462Dec 11, 2006
    Cm68 News
    Cm68 News
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in engine/oldnews.inc.php in CM68 News 12.02.06 allows remote attackers to execute arbitrary PHP code via a URL in the addpath parameter.

  • CVE-2006-6463Dec 11, 2006
    Midicart Software
    Midicart PHP Shopping Cart
    risk 0.00cvss —epss 0.01

    Unrestricted file upload vulnerability in admin/add.php in Midicart allows remote authenticated users to upload arbitrary .php files, and possibly other files, to the images/ directory under the web root.

  • CVE-2006-6464Dec 11, 2006
    Midicart Software
    Midicart
    risk 0.00cvss —epss 0.01

    viewcart in Midicart accepts negative numbers in the Qty (quantity) field, which allows remote attackers to obtain a smaller total price for a shopping cart.

  • CVE-2006-6465Dec 11, 2006
    Wikyblog
    Wikyblog
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in WBmap.php in WikyBlog 1.3.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter. NOTE: CVE disputes this vulnerability because l is validated by ctype_alpha…

  • CVE-2006-6466Dec 11, 2006
    Wikyblog
    Wikyblog
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in WBmap.php in WikyBlog 1.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) key, (2) d, (3) l, or (4) v parameter. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2006-6467Dec 11, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 do not properly restrict access to SMB file resources, which allows remote attackers to gain unspecified file or directory access via vectors related to (1)…

  • CVE-2006-6468Dec 11, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.00

    Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 do not check the Fully Qualified Domain Name (FQDN) during a "Validate Repository SSL Certificate" scan, which has unknown impact and attack vectors, possibly…

  • CVE-2006-6469Dec 11, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.00

    Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 do not block the postgres port (5432/tcp), which has unknown impact and remote attack vectors, probably related to unauthorized connections to a PostgreSQL daemon.

  • CVE-2006-6470Dec 11, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    The SNMP Agent in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 returns no error for a non-writable object, which has unknown impact and attack vectors. NOTE: due to the vagueness of the advisory, it is not…

  • CVE-2006-6471Dec 11, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 use weak permissions for certain files, which allows unspecified file access.

  • CVE-2006-6472Dec 11, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    The httpd.conf file in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 configures port 443 to be always active, which has unknown impact and remote attack vectors.

  • CVE-2006-6473Dec 11, 2006
    Xerox
    Workcentre
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 have unknown impact and attack vectors, related to (1) an Immediate Image Overwrite (IIO) error message at the Local User…

  • CVE-2006-6456Dec 11, 2006
    Microsoft
    Word
    risk 0.03cvss —epss 0.32

    Unspecified vulnerability in Microsoft Word 2000, 2002, and 2003 and Word Viewer 2003 allows remote attackers to execute code via unspecified vectors related to malformed data structures that trigger memory corruption, a different vulnerability than CVE-2006-5994.

  • CVE-2006-6457Dec 11, 2006
    Tiki
    Tiki
    risk 0.00cvss —epss 0.01

    tiki-wiki_rss.php in Tikiwiki 1.9.5, 1.9.2, and possibly other versions allows remote attackers to obtain sensitive information (MySQL username and password) via an invalid (large or negative) ver parameter, which leaks the information in an error message.

  • CVE-2006-6458Dec 11, 2006
    Trend Micro
    Internet Security
    risk 0.00cvss —epss 0.03

    The Trend Micro scan engine before 8.320 for Windows and before 8.150 on HP-UX and AIX, as used in Trend Micro PC Cillin - Internet Security 2006, Office Scan 7.3, and Server Protect 5.58, allows remote attackers to cause a denial of service (CPU consumption and system hang) via…

  • CVE-2006-6459Dec 11, 2006
    PhpBB
    Toplist
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in toplist.php in PhpBB Toplist 1.3.7 allows remote attackers to inject arbitrary HTML or web script via the (1) Name and (2) Information fields when adding a new site (toplistnew action).

  • CVE-2006-6460Dec 11, 2006
    Short URL
    Short URL
    risk 0.00cvss —epss 0.02

    Yourfreeworld.com Short Url & Url Tracker Script allows remote attackers to obtain sensitive information via an invalid id parameter to login.php, which leaks the path in an error message. NOTE: this issue might be resultant from CVE-2006-2509.

  • CVE-2006-6461Dec 11, 2006
    Yourfreeworld
    Stylish Text Ads Script
    risk 0.00cvss —epss 0.02

    tr1.php in Yourfreeworld Stylish Text Ads Script allows remote attackers to obtain the installation path via an invalid id parameter, which leaks the path in an error message. NOTE: this issue might be resultant from CVE-2006-2508.

  • CVE-2006-6444Dec 10, 2006
    Divx
    Player
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in Nostra DivX Player 2.1, 2.2.00.0, and possibly earlier, allows remote attackers to execute arbitrary code via a long string in an M3U file. NOTE: The provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-6445Dec 10, 2006
    Envolution
    Envolution
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in error.php in Envolution 1.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log…

  • CVE-2006-6446Dec 10, 2006
    Iware
    Iware Professional
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in iWare Professional 5.0.4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the D parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from…

  • CVE-2006-6447Dec 10, 2006
    Vt Forum
    Vt Forum Lite
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Vt-Forum Lite 1.3 and 1.5 allow remote attackers to inject arbitrary web script or HTML via (1) the StrMes parameter in vf_info.asp and possibly (2) a URL in the SRC attribute of an IFRAME element that is submitted to…

  • CVE-2006-6448Dec 10, 2006
    Vt Forum
    Vt Forum Lite
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Vt-Forum Lite 1.3 and earlier allow remote attackers to execute arbitrary SQL commands via the user parameter to vf_memberdetail.asp, and other unspecified vectors. NOTE: The provenance of this information is unknown; the details are…

  • CVE-2006-6449Dec 10, 2006
    Vt Forum
    Vt Forum Lite
    risk 0.00cvss —epss 0.01

    Vt-Forum Lite 1.3 and earlier store sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/forum.mdb. NOTE: The provenance of this information is unknown; the details are…

  • CVE-2006-6450Dec 10, 2006
    Novell
    Zenworks Patch Management Server
    risk 0.02cvss —epss 0.22

    Multiple SQL injection vulnerabilities in dagent/downloadreport.asp in Novell ZENworks Patch Management (ZPM) before 6.3.2.700 allow remote attackers to execute arbitrary SQL commands via the (1) agentid and (2) pass parameters.

  • CVE-2006-6451Dec 10, 2006
    Swsoft
    Plesk
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in SWsoft Plesk 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) get_password.php or (2) login_up.php3.

  • CVE-2006-6452Dec 10, 2006
    Myarticles
    Myarticles
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the MyArticles module before 0.6 beta 1, for RunCMS, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) topics.php, (2) submit.php, and (3) class/calendar.class.php.

  • CVE-2006-6453Dec 10, 2006
    J Owamp
    Web Interface
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in JOWAMP_ShowPage.php in J-OWAMP Web Interface 2.1 allows remote authenticated users to execute arbitrary PHP code via a URL in the link parameter.

  • CVE-2006-6454Dec 10, 2006
    J Owamp
    Web Interface
    risk 0.00cvss —epss 0.03

    execInBackground.php in J-OWAMP Web Interface 2.1b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters to the (1) exe and (2) args parameters, which are used in an exec function call. NOTE: the provenance of this information is unknown;…

  • CVE-2006-6455Dec 10, 2006
    Duware
    Dudirectory
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in admin/default.asp in DUware DUdirectory 3.1, and possibly DUdirectory Pro and Pro SQL 3.x, allow remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password parameter. NOTE: some of these details are obtained…

  • CVE-2006-6383Dec 10, 2006
    PHP
    PHP
    risk 0.03cvss —epss 0.01

    PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ";" in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but…

  • CVE-2006-6443Dec 10, 2006
    Novell
    Client
    risk 0.00cvss —epss 0.02

    Buffer overflow in the Novell Distributed Print Services (NDPS) Print Provider for Windows component (NDPPNT.DLL) in Novell Client 4.91 has unknown impact and remote attack vectors.

  • CVE-2006-6379Dec 10, 2006
    Broadcom Corporation
    Server Protection Suite
    risk 0.05cvss —epss 0.21

    Buffer overflow in the BrightStor Backup Discovery Service in multiple CA products, including ARCserve Backup r11.5 SP1 and earlier, ARCserve Backup 9.01 up to 11.1, Enterprise Backup 10.5, and CA Server Protection Suite r2, allows remote attackers to execute arbitrary code via…

  • CVE-2006-6332Dec 10, 2006
    Madwifi
    Madwifi
    risk 0.05cvss —epss 0.20

    Stack-based buffer overflow in net80211/ieee80211_wireless.c in MadWifi before 0.9.2.1 allows remote attackers to execute arbitrary code via unspecified vectors, related to the encode_ie and giwscan_cb functions.

  • CVE-2006-6413Dec 10, 2006
    Amateras
    Amateras Sns
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Amateras sns 3.11 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-6414Dec 10, 2006
    Dol Storye
    Dol Storye
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in dettaglio.asp in dol storye allow remote attackers to execute arbitrary SQL commands via the (1) id_doc or (2) id_aut parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-6415Dec 10, 2006
    Phpadsnew
    Phpadsnew
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in admin/lib-maintenance.inc.php in phpAdsNew 2.0.4-pr2 allows remote attackers to execute arbitrary PHP code via a URL in the phpAds_path parameter, a different component than CVE-2006-3984. NOTE: this issue is disputed by CVE, since…