VYPR

CVEs

381,352 total · page 7231 of 7,628

AllCriticalHighKEV
  • CVE-2006-4822Sep 15, 2006
    Emusoft
    Emucms
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in eMuSOFT emuCMS 0.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) query or (2) page parameters.

  • CVE-2006-4823Sep 15, 2006
    Reamday Enterprises
    Magic News Pro
    risk 0.04cvss —epss 0.09

    PHP remote file inclusion vulnerability in scripts/news_page.php in Reamday Enterprises Magic News Pro 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the script_path parameter.

  • CVE-2006-4824Sep 15, 2006
    Quicksilver Forums
    Quicksilver Forums
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in lib/activeutil.php in Quicksilver Forums (QSF) 1.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the set[include_path] parameter.

  • CVE-2006-4825Sep 15, 2006
    Softcomplex
    PHP Event Calendar
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in cl_files/index.php in SoftComplex PHP Event Calendar 1.5.1, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) ti, (2) bi, or (3) cbgi parameters.

  • CVE-2006-4826Sep 15, 2006
    Shadowed Portal
    Portal
    risk 0.04cvss —epss 0.10

    PHP remote file inclusion vulnerability in bottom.php in Shadowed Portal 5.599 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.

  • CVE-2006-4827Sep 15, 2006
    Vmist
    Downstat
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in Vmist Downstat 1.8 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the art parameter to (1) admin.php, (2) chart.php, (3) modes.php, or (4) stats.php.

  • CVE-2006-4828Sep 15, 2006
    Photopost
    Photopost PHP Pro
    risk 0.04cvss —epss 0.07

    PHP remote file inclusion vulnerability in zipndownload.php in PhotoPost 4.0 through 4.6 allows remote attackers to execute arbitrary PHP code via a URL in the PP_PATH parameter.

  • CVE-2006-4829Sep 15, 2006
    Blojsom
    Blojsom
    risk 0.04cvss —epss 0.09

    Multiple cross-site scripting (XSS) vulnerabilities in David Czarnecki Blojsom 2.31 allow remote attackers to inject arbitrary web script or HTML via the (1) blog-category-description, (2) blog-entry-title, (3) rss-enclosure-url, (4) technorati-tagsi, or (5) blog-category-name…

  • CVE-2006-4830Sep 15, 2006
    Blojsom
    Blojsom
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in EditBlogTemplatesPlugin.java in David Czarnecki Blojsom 2.30 allows remote attackers to have an unknown impact by sending an HTTP request with a certain value of blogTemplate.

  • CVE-2006-4831Sep 15, 2006
    Iodine
    Iodine
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in IP over DNS is now easy (iodine) before 0.3.2 has unknown impact and attack vectors, related to "potential security problems."

  • CVE-2006-4832Sep 15, 2006
    Verso
    NetPerformer FRAD ACT SDM-95xx
    risk 0.04cvss —epss 0.11

    Buffer overflow in the telnet service in Verso NetPerformer FRAD ACT SDM-95xx 7.xx (R1) and earlier, SDM-93xx 10.x.x (R2) and earlier, and SDM-92xx 9.x.x (R1) and earlier allows remote attackers to cause a denial of service (reboot) and possibly execute arbitrary code via a long…

  • CVE-2006-4833Sep 15, 2006
    Verso
    NetPerformer FRAD ACT SDM-95xx
    risk 0.00cvss —epss 0.03

    Verso NetPerformer FRAD ACT SDM-95xx 7.xx (R1) and earlier, SDM-93xx 10.x.x (R2) and earlier, and SDM-92xx 9.x.x (R1) and earlier allow remote attackers to cause a denial of service (hang or reboot) via an ICMP packet with the same destination and source address and port, aka…

  • CVE-2006-4834Sep 15, 2006
    Phpquiz
    Phpquiz
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in index.php in Jule Slootbeek phpQuiz 0.01 allows remote attackers to execute arbitrary PHP code via a URL in the pagename parameter.

  • CVE-2006-4835Sep 15, 2006
    Bluview
    Blue Magic Board
    risk 0.00cvss —epss 0.02

    Bluview Blue Magic Board (BMB) (aka BMForum) 5.5 allows remote attackers to obtain sensitive information via a direct request to (1) footer.php, (2) header.php, (3) db_mysql_error.php, (4) langlist.php, (5) sendmail.php, or (6) style.php, which reveals the path in various error…

  • CVE-2006-4836Sep 15, 2006
    Dcp Portal
    Dcp Portal
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in login.php in DCP-Portal SE 6.0 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: The lostpassword.php and calendar.php vectors are already covered by CVE-2005-3365, and the search.php vector is already…

  • CVE-2006-4837Sep 15, 2006
    Dcp Portal
    Dcp Portal
    risk 0.00cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in DCP-Portal SE 6.0 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter in (1) library/lib.php and (2) library/editor/editor.php. NOTE: the same primary issue can be used for full path…

  • CVE-2006-4838Sep 15, 2006
    Dcp Portal
    Dcp Portal
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal SE 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) root_url and (2) dcp_version parameters in (a) admin/inc/footer.inc.php, and the root_url, (3) page_top_name, (4) page_name, and (5)…

  • CVE-2006-4820Sep 15, 2006
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in X.25 on HP-UX B.11.00, B.11.11, and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors.

  • CVE-2006-4568Sep 15, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 1.5.0.7 and SeaMonkey before 1.0.5 allows remote attackers to bypass the security model and inject content into the sub-frame of another site via targetWindow.frames[n].document.open(), which facilitates spoofing and other attacks.

  • CVE-2006-4569Sep 15, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    The popup blocker in Mozilla Firefox before 1.5.0.7 opens the "blocked popups" display in the context of the Location bar instead of the subframe from which the popup originated, which might make it easier for remote user-assisted attackers to conduct cross-site scripting (XSS)…

  • CVE-2006-4570Sep 15, 2006
    Mozilla Corporation
    Thunderbird
    risk 0.00cvss —epss 0.02

    Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original…

  • CVE-2006-4571Sep 15, 2006
    Mozilla Corporation
    Thunderbird
    risk 0.00cvss —epss 0.06

    Multiple unspecified vulnerabilities in Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5 allow remote attackers to cause a denial of service (crash), corrupt memory, and possibly execute arbitrary code via unspecified vectors, some of which involve…

  • CVE-2006-4340Sep 15, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote…

  • CVE-2006-4565Sep 15, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Heap-based buffer overflow in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a JavaScript regular expression with a "minimal quantifier."

  • CVE-2006-4566Sep 15, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5 allows remote attackers to cause a denial of service (crash) via a malformed JavaScript regular expression that ends with a backslash in an unterminated character set ("[\\"), which leads to a…

  • CVE-2006-4567Sep 15, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 1.5.0.7 and Thunderbird before 1.5.0.7 makes it easy for users to accept self-signed certificates for the auto-update mechanism, which might allow remote user-assisted attackers to use DNS spoofing to trick users into visiting a malicious site and…

  • CVE-2006-4437Sep 14, 2006
    Tagger
    Tagger LE
    risk 0.04cvss —epss 0.08

    Eval injection vulnerability in Tagger LE allows remote attackers to execute arbitrary PHP code via the query string in (1) tags.php, (2) sign.php, and (3) admin/index.php.

  • CVE-2006-4800Sep 14, 2006
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in libavcodec in ffmpeg before 0.4.9_p20060530 allow remote attackers to cause a denial of service or possibly execute arbitrary code via multiple unspecified vectors in (1) dtsdec.c, (2) vorbis.c, (3) rm.c, (4) sierravmd.c, (5) smacker.c, (6) tta.c,…

  • CVE-2006-4801Sep 14, 2006
    Roxio
    Toast
    risk 0.00cvss —epss 0.00

    Race condition in Deja Vu, as used in Roxio Toast Titanium 7 and possibly other products, allows local users to execute arbitrary code via temporary files, including dejavu_manual.rb, which are executed with raised privileges.

  • CVE-2006-4802Sep 14, 2006
    Symantec
    Client Security
    risk 0.00cvss —epss 0.00

    Format string vulnerability in the Real Time Virus Scan service in Symantec AntiVirus Corporate Edition 8.1 up to 10.0, and Client Security 1.x up to 3.0, allows local users to execute arbitrary code via an unspecified vector related to alert notification messages, a different…

  • CVE-2006-4803Sep 14, 2006
    Novell
    Identity Manager
    risk 0.00cvss —epss 0.01

    The Fan-Out Linux and UNIX receiver scripts in Novell Identity Manager (IDM) 3.0.1 allows local users to execute arbitrary commands via unspecified vectors involving certain environment variables and "code injection."

  • CVE-2006-4793Sep 14, 2006
    Tualblog
    Tualblog
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in icerik.asp in TualBLOG 1.0 allow remote attackers to execute arbitrary SQL commands, as demonstrated by the icerikno parameter.

  • CVE-2006-4794Sep 14, 2006
    E107
    E107
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the query string (PATH_INFO) in (1) contact.php, (2) download.php, (3) admin.php, (4) fpw.php, (5) news.php, (6) search.php, (7) signup.php, (8)…

  • CVE-2006-4795Sep 14, 2006
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport software in HP-UX B.11.11 and B.11.23 before 20060912 allows local users to cause a denial of service via unspecified vectors.

  • CVE-2006-4796Sep 14, 2006
    Snitz Forums 2000
    Snitz Forums 2000
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in forum.asp in Snitz Forums 2000 3.4.06 allows remote attackers to inject arbitrary web script or HTML via the sortorder parameter (strtopicsortord variable).

  • CVE-2006-4797Sep 14, 2006
    CloudNine Interactive
    CJ Tag Board
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in tag.php in CloudNine Interactive CJ Tag Board 3.0 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a url BBcode tag in the cjmsg parameter.

  • CVE-2006-4798Sep 14, 2006
    Dws Systems Inc.
    SQL Ledger
    risk 0.00cvss —epss 0.01

    SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history.

  • CVE-2006-4799Sep 14, 2006
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.03

    Buffer overflow in ffmpeg for xine-lib before 1.1.2 might allow context-dependent attackers to execute arbitrary code via a crafted AVI file and "bad indexes", a different vulnerability than CVE-2005-4048 and CVE-2006-2802.

  • CVE-2006-4790Sep 14, 2006
    GNU
    Gnutls
    risk 0.00cvss —epss 0.03

    verify.c in GnuTLS before 1.4.4, when using an RSA key with exponent 3, does not properly handle excess data in the digestAlgorithm.parameters field when generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and…

  • CVE-2006-4778Sep 14, 2006
    Creative Commons
    ccHost
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Creative Commons Tools ccHost before 3.0 allows remote attackers to execute arbitrary SQL commands via a crafted URL, which is used to populate the file ID. NOTE: Some details are obtained from third party information.

  • CVE-2006-4779Sep 14, 2006
    PhpBB
    Vitrax Premodded Phpbb
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in includes/functions_portal.php in Vitrax Premodded phpBB 1.0.6-R3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-4780Sep 14, 2006
    Phpbb Xs
    Phpbb Xs
    risk 0.04cvss —epss 0.09

    PHP remote file inclusion vulnerability in includes/functions.php in phpBB XS 0.58 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-4781Sep 14, 2006
    Futuresoft
    TFTP Server Multithreaded
    risk 0.03cvss —epss 0.06

    Heap-based buffer overflow in FutureSoft TFTP Server Multithreaded (MT) 1.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by sending a crafted packet to port 69/UDP, which triggers the overflow when constructing an absolute path…

  • CVE-2006-4782Sep 14, 2006
    Webspell
    Webspell
    risk 0.03cvss —epss 0.03

    src/index.php in WebSPELL 4.01.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication and gain sensitive information stored in the database via a modified userID parameter in a write action to admin/database.php.

  • CVE-2006-4783Sep 14, 2006
    Webspell
    Webspell
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in squads.php in WebSPELL 4.01.01 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the squadID parameter.

  • CVE-2006-4784Sep 14, 2006
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.6.1 and earlier might allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) doc/index.php or (2) files/index.php.

  • CVE-2006-4785Sep 14, 2006
    Moodle
    Moodle
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the format parameter as stored in the $blogEntry variable, which is not properly handled by the insert_record function, which calls…

  • CVE-2006-4786Sep 14, 2006
    Moodle
    Moodle
    risk 0.00cvss —epss 0.01

    Moodle 1.6.1 and earlier allows remote attackers to obtain sensitive information via (1) help.php and (2) other unspecified vectors involving scheduled backups.

  • CVE-2006-4787Sep 14, 2006
    Alphamail
    Alphamail
    risk 0.00cvss —epss 0.00

    AlphaMail before 1.0.16 allows local users to obtain sensitive information via the logging functionality, which displays unencrypted passwords in an error message. NOTE: some details are obtained from third party information.

  • CVE-2006-4788Sep 14, 2006
    Telekorn
    Signkorn Guestbook
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in includes/log.inc.php in Telekorn SignKorn Guestbook (SL) 1.3 and earlier, when register_globals is enabled and _SESSION[permission] parameter is set to "yes", allows remote attackers to execute arbitrary PHP code via a URL in the…