VYPR

CVEs

381,363 total · page 7229 of 7,628

AllCriticalHighKEV
  • CVE-2006-4959Sep 23, 2006
    Sun Corporation
    Secure Global Desktop
    risk 0.00cvss —epss 0.02

    Sun Secure Global Desktop (SSGD, aka Tarantella) before 4.3 allows remote attackers to obtain sensitive information, including hostnames, versions, and settings details, via unspecified vectors, possibly involving (1) taarchives.cgi, (2) ttaAuthentication.jsp, (3)…

  • CVE-2006-4960Sep 23, 2006
    Blue Dragon
    PHP Blue Dragon
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php Php Blue Dragon 2.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the m parameter, which is reflected in an error message resulting from a failed SQL query.

  • CVE-2006-4961Sep 23, 2006
    Blue Dragon
    PHP Blue Dragon
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the GetModuleConfig function in public_includes/pub_kernel/pbd_modules.php in Php Blue Dragon 2.9.1 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter to index.php.

  • CVE-2006-4962Sep 23, 2006
    Blue Dragon
    PHP Blue Dragon
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in pbd_engine.php in Php Blue Dragon 2.9.1 and earlier allows remote attackers to read and execute arbitrary local files via a .. (dot dot) sequence via the phpExt parameter, as demonstrated by executing PHP code in a log file.

  • CVE-2006-4963Sep 23, 2006
    Siteserver
    CMS
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in index.php in Exponent CMS 0.96.3 allows remote attackers to read and execute arbitrary local files via a .. (dot dot) sequence in the view parameter in the show_view action in the calendarmodule module, as demonstrated by executing PHP code…

  • CVE-2006-4964Sep 23, 2006
    Maxdev
    Mdpro
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MAXdev MDPro 1.0.76 before 20060918 allows remote attackers to inject arbitrary web script or HTML via (1) vectors that bypass the XSS protection mechanisms of the pnVarCleanFromInput function, and (2) unspecified vectors related to…

  • CVE-2006-4945Sep 23, 2006
    Cardway
    Digitalwebshop
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in Cardway (aka Frederic Boudaud) DigitalWebShop 1.128 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the _PHPLIB[libdir] parameter to (1) rechnung.php or (2) prepend.php.

  • CVE-2006-4946Sep 23, 2006
    Dmitry Sheiko
    Business Card Web Builder
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in include/startup.inc.php in CMSDevelopment Business Card Web Builder (BCWB) 0.99, and possibly 2.5 Beta and earlier, allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.

  • CVE-2006-4947Sep 23, 2006
    Drupal
    Search Keyword Module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Drupal 4.7 Search Keywords module before 1.15 2006/09/15 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "lack of validation on output."

  • CVE-2006-4948Sep 23, 2006
    Prosysinfo
    TFTP Server Tftpdwin
    risk 0.07cvss —epss 0.55

    Stack-based buffer overflow in tftpd.exe in ProSysInfo TFTP Server TFTPDWIN 0.4.2 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a long file name. NOTE: the provenance of this information is unknown; the details are obtained from…

  • CVE-2006-4949Sep 23, 2006
    Drupal
    profile_pages
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Drupal 4.6 Site Profile Directory (profile_pages.module) before 1.1.2.1 and the Drupal 4.7 Site Profile Directory (profile_pages.module) before 1.2.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified…

  • CVE-2006-4935Sep 23, 2006
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    The Database module in Moodle before 1.6.2 does not properly handle uploaded files, which has unspecified impact and remote attack vectors.

  • CVE-2006-4936Sep 23, 2006
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Moodle before 1.6.2 does not properly validate the module instance id when creating a course module object, which has unspecified impact and remote attack vectors.

  • CVE-2006-4937Sep 23, 2006
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    lib/setup.php in Moodle before 1.6.2 sets the error reporting level to 7 to display E_WARNING messages to users even if debugging is disabled, which might allow remote authenticated users to obtain sensitive information by triggering the messages.

  • CVE-2006-4938Sep 23, 2006
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    help.php in Moodle before 1.6.2 does not check the existence of certain help files before including them, which might allow remote authenticated users to obtain the path in an error message.

  • CVE-2006-4939Sep 23, 2006
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    backup/backup_scheduled.php in Moodle before 1.6.2 generates trace data with the full backup pathname even when debugging is disabled, which might allow attackers to obtain the pathname.

  • CVE-2006-4940Sep 23, 2006
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    login/forgot_password.php in Moodle before 1.6.2 allows remote attackers to obtain sensitive information (e-mail addresses and Moodle account names) via a find action.

  • CVE-2006-4941Sep 23, 2006
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Moodle before 1.6.2 might allow remote attackers to inject arbitrary web script or HTML via (1) the choose parameter in files/index.php and (2) the sub parameter in doc/index.php.

  • CVE-2006-4942Sep 23, 2006
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Moodle before 1.6.2, when the configuration lacks (1) algebra or (2) tex filters, allows remote authenticated users to write LaTeX or MimeTeX output files to the top level of the dataroot directory via (a) filter/algebra/pix.php or (b) filter/tex/pix.php.

  • CVE-2006-4943Sep 23, 2006
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    course/jumpto.php in Moodle before 1.6.2 does not validate the session key (sesskey) before providing content from arbitrary local URIs, which allows remote attackers to obtain sensitive information via the jump parameter.

  • CVE-2006-4944Sep 23, 2006
    ProgSys
    ProgSys
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in includes/pear/Net/DNS/RR.php in ProgSys 0.151 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpdns_basedir parameter.

  • CVE-2006-4899Sep 22, 2006
    Ca
    eTrust Security Command Center
    risk 0.04cvss —epss 0.10

    The ePPIServlet script in Computer Associates (CA) eTrust Security Command Center 1.0 and r8 up to SP1 CR2, when running on Windows, allows remote attackers to obtain the web server path via a "'" (single quote) in the PIProfile function, which leaks the path in an error message.

  • CVE-2006-4900Sep 22, 2006
    Ca
    eTrust Security Command Center
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in Computer Associates (CA) eTrust Security Command Center 1.0 and r8 up to SP1 CR2, allows remote authenticated users to read and delete arbitrary files via ".." sequences in the eSCCAdHocHtmlFile parameter to eSMPAuditServlet, which is not…

  • CVE-2006-4901Sep 22, 2006
    Ca
    eTrust Audit
    risk 0.04cvss —epss 0.11

    Computer Associates (CA) eTrust Security Command Center 1.0 and r8 up to SP1 CR2, and eTrust Audit 1.5 and r8, allows remote attackers to spoof alerts and conduct replay attacks by invoking eTSAPISend.exe with the desired arguments.

  • CVE-2006-3507Sep 21, 2006
    Apple Inc.
    Mac OS X
    risk 0.03cvss —epss 0.01

    Multiple stack-based buffer overflows in the AirPort wireless driver on Apple Mac OS X 10.3.9 and 10.4.7 allow physically proximate attackers to execute arbitrary code by injecting crafted frames into a wireless network.

  • CVE-2006-3508Sep 21, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Heap-based buffer overflow in the AirPort wireless driver on Apple Mac OS X 10.4.7 allows physically proximate attackers to cause a denial of service (crash), gain privileges, and execute arbitrary code via a crafted frame that is not properly handled during scan cache updates.

  • CVE-2006-3509Sep 21, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    Integer overflow in the API for the AirPort wireless driver on Apple Mac OS X 10.4.7 might allow physically proximate attackers to cause a denial of service (crash) or execute arbitrary code in third-party wireless software that uses the API via crafted frames.

  • CVE-2006-4915Sep 21, 2006
    Innovate
    Portal
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in index.php in Innovate Portal 2.0 allows remote attackers to inject arbitrary web script or HTML via the content parameter.

  • CVE-2006-4916Sep 21, 2006
    Dora Emlak
    Tekman Portal
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in uye_profil.asp in Tekman Portal (TR) 1.0 allows remote attackers to execute arbitrary SQL commands via the uye_id parameter.

  • CVE-2006-4917Sep 21, 2006
    Pt News
    Pt News
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in search.php in PT News 1.7.8 allows remote attackers to inject arbitrary web script or HTML via the pgname parameter.

  • CVE-2006-4918Sep 21, 2006
    Simple Discussion Board
    Simple Discussion Board
    risk 0.04cvss —epss 0.08

    Multiple PHP remote file inclusion vulnerabilities in Simple Discussion Board 0.1.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) env_dir parameter to (a) blank.php, (b) admin.php, or (c) builddb.php, and the (2) script_root parameter to blank.php.

  • CVE-2006-4919Sep 21, 2006
    Siteatschool
    Siteatschool
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in starnet/editors/htmlarea/popups/images.php in Site@School (S@S) 2.4.02 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter.

  • CVE-2006-4920Sep 21, 2006
    Siteatschool
    Siteatschool
    risk 0.04cvss —epss 0.11

    Multiple PHP remote file inclusion vulnerabilities in Site@School (S@S) 2.4.02 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the cmsdir parameter to (1) starnet/modules/sn_allbum/slideshow.php, and (2) starnet/themes/editable/main.inc.php.

  • CVE-2006-4921Sep 21, 2006
    Siteatschool
    Siteatschool
    risk 0.04cvss —epss 0.07

    PHP remote file inclusion vulnerability in Site@School (S@S) 2.4.03 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cmsdir parameter to starnet/modules/include/include.php. NOTE: some of these details are obtained from third party information.

  • CVE-2006-4922Sep 21, 2006
    Siteatschool
    Siteatschool
    risk 0.04cvss —epss 0.07

    Unrestricted file upload vulnerability in starnet/editors/htmlarea/popups/images.php in Site@School (S@S) 2.4.02 and earlier allows remote attackers to upload and execute arbitrary files with executable extensions.

  • CVE-2006-4923Sep 21, 2006
    Esyndicat
    Esyndicat Portal System
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in search.php in eSyndiCat Portal System allows remote attackers to inject arbitrary web script or HTML via the what parameter.

  • CVE-2006-4904Sep 21, 2006
    Qualiteam
    X Cart
    risk 0.04cvss —epss 0.07

    Dynamic variable evaluation vulnerability in cmpi.php in Qualiteam X-Cart 4.1.3 and earlier allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code, as demonstrated by PHP remote file inclusion via the xcart_dir parameter.

  • CVE-2006-4905Sep 21, 2006
    Artmedic Webdesign
    links
    risk 0.00cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in Artmedic Links 5.0 allows remote attackers to execute arbitrary PHP code via a URL in the id parameter, which is processed by the readfile function.

  • CVE-2006-4906Sep 21, 2006
    More.groupware
    More.groupware
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbitrary SQL commands via the new_calendarid parameter.

  • CVE-2006-4907Sep 21, 2006
    Ohio State University
    Osu Httpd
    risk 0.00cvss —epss 0.02

    OSU 3.11alpha and 3.10a allows remote attackers to obtain sensitive information via a URL to a non-existent file, which displays the web root path in the resulting error message.

  • CVE-2006-4908Sep 21, 2006
    OSU
    OSU
    risk 0.00cvss —epss 0.02

    OSU 3.11alpha and 3.10a allows remote attackers to obtain sensitive information via a URL containing an * (asterisk) wildcard, which displays all matching file and directory information.

  • CVE-2006-4909Sep 21, 2006
    Cisco Systems, Inc.
    Guard Ddos Mitigation Appliance
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Cisco Guard DDoS Mitigation Appliance before 5.1(6), when anti-spoofing is enabled, allows remote attackers to inject arbitrary web script or HTML via certain character sequences in a URL that are not properly handled when the…

  • CVE-2006-4910Sep 21, 2006
    Cisco Systems, Inc.
    Ids
    risk 0.00cvss —epss 0.04

    The web administration interface (mainApp) to Cisco IDS before 4.1(5c), and IPS 5.0 before 5.0(6p1) and 5.1 before 5.1(2) allows remote attackers to cause a denial of service (unresponsive device) via a crafted SSLv2 Client Hello packet.

  • CVE-2006-4911Sep 21, 2006
    Cisco Systems, Inc.
    IPS
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Cisco IPS 5.0 before 5.0(6p2) and 5.1 before 5.1(2), when running in inline or promiscuous mode, allows remote attackers to bypass traffic inspection via a "crafted sequence of fragmented IP packets".

  • CVE-2006-4912Sep 21, 2006
    PHP Docwriter
    PHP Docwriter
    risk 0.04cvss —epss 0.06

    PHP remote file inclusion vulnerability in PHP DocWriter 0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the script parameter.

  • CVE-2006-4913Sep 21, 2006
    Alstrasoft
    E Friends
    risk 0.04cvss —epss 0.10

    Directory traversal vulnerability in chat/getStartOptions.php in AlstraSoft E-friends 4.85 allows remote attackers to include arbitrary local files and possibly execute arbitrary code via a .. (dot dot) sequence and trailing null (%00) byte in the lang parameter, as demonstrated…

  • CVE-2006-4914Sep 21, 2006
    A.l Pifou
    A.l Pifou
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in A.l-Pifou 1.8p2 allows remote attackers to read arbitrary files via ".." sequences in the ze_langue_02 cookie, as demonstrated by using the choix_lng parameter to choix_langue.php to indirectly set the cookie, then accessing livre_dor.php to…

  • CVE-2006-4438Sep 20, 2006
    Doctor Web Ltd
    Dr.web
    risk 0.04cvss —epss 0.10

    Heap-based buffer overflow in SpIDer for Dr.Web Scanner for Linux 4.33, and possibly earlier versions, allows remote attackers to execute arbitrary code via an LHA archive with an extended header that contains a long directory name.

  • CVE-2006-4890Sep 19, 2006
    Unak
    CMS
    risk 0.04cvss —epss 0.08

    Multiple PHP remote file inclusion vulnerabilities in UNAK-CMS 1.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the dirroot parameter to (1) fckeditor/editor/filemanager/browser/default/connectors/php/connector.php or (2)…

  • CVE-2006-4891Sep 19, 2006
    Techno Dreams
    Articles And Papers Package
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in ArticlesTableview.asp in Techno Dreams Articles & Papers Package 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the key parameter.