VYPR

CVEs

381,351 total · page 7232 of 7,628

AllCriticalHighKEV
  • CVE-2006-3454Sep 14, 2006
    Symantec
    Client Security
    risk 0.00cvss —epss 0.00

    Multiple format string vulnerabilities in Symantec AntiVirus Corporate Edition 8.1 up to 10.0, and Client Security 1.x up to 3.0, allow local users to execute arbitrary code via format strings in (1) Tamper Protection and (2) Virus Alert Notification messages.

  • CVE-2006-4724Sep 14, 2006
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the ColdFusion Flash Remoting Gateway in Adobe ColdFusion MX 7 and 7.01 allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors involving a crafted command.

  • CVE-2006-4725Sep 14, 2006
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.01

    Adobe ColdFusion MX 7 and 7.01 allows local users to bypass security restrictions and call components (CFC) within a sandbox from CFML templates that are located outside of the sandbox.

  • CVE-2006-4726Sep 14, 2006
    Adobe Inc.
    Coldfusion
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 6.1 through 7.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a ColdFusion error page.

  • CVE-2006-4771Sep 14, 2006
    Jbc
    Forumjbc
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in haut.php in ForumJBC 4 allows remote attackers to inject arbitrary web script or HTML via the nb_connecte parameter.

  • CVE-2006-4772Sep 14, 2006
    Hotplug CMS
    CMS
    risk 0.00cvss —epss 0.01

    HotPlug CMS stores sensitive information under the web root with insufficient access control, which allows remote attackers to read the admin password and database credentials via a direct request for includes/class/config.inc.

  • CVE-2006-4773Sep 14, 2006
    Sun Corporation
    StorEdge 6130 Array Controllers
    risk 0.00cvss —epss 0.02

    Sun StorEdge 6130 Array Controllers with firmware 06.12.10.11 and earlier allow remote attackers to cause a denial of service (controller reboot) via a flood of traffic on the LAN.

  • CVE-2006-4774Sep 14, 2006
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.05

    The VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) allows remote attackers to cause a denial of service by sending a VTP version 1 summary frame with a VTP version field value of 2.

  • CVE-2006-4775Sep 14, 2006
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.05

    The VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) and CatOS allows remote attackers to cause a denial of service by sending a VTP update with a revision value of 0x7FFFFFFF, which is incremented to 0x80000000 and is interpreted as a negative number in a signed…

  • CVE-2006-4776Sep 14, 2006
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in the VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) allows remote attackers to execute arbitrary code via a long VLAN name in a VTP type 2 summary advertisement.

  • CVE-2006-4777Sep 14, 2006
    Microsoft
    Ie
    risk 0.09cvss —epss 0.80

    Heap-based buffer overflow in the DirectAnimation Path Control (DirectAnimation.PathControl) COM object (daxctle.ocx) for Internet Explorer 6.0 SP1, on Chinese and possibly other Windows distributions, allows remote attackers to execute arbitrary code via unknown manipulations…

  • CVE-2006-4757Sep 13, 2006
    E107
    E107
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the admin section in e107 0.7.5 allow remote authenticated administrative users to execute arbitrary SQL commands via the (1) linkopentype, (2) linkrender, (3) link_class, and (4) link_id parameters in (a) links.php; the (5) searchquery…

  • CVE-2006-4758Sep 13, 2006
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.02

    phpBB 2.0.21 does not properly handle pathnames ending in %00, which allows remote authenticated administrative users to upload arbitrary files, as demonstrated by a query to admin/admin_board.php with an avatar_path parameter ending in .php%00.

  • CVE-2006-4759Sep 13, 2006
    Punbb
    Punbb
    risk 0.00cvss —epss 0.02

    PunBB 1.2.12 does not properly handle an avatar directory pathname ending in %00, which allows remote authenticated administrative users to upload arbitrary files and execute code, as demonstrated by a query to admin_options.php with an avatars_dir parameter ending in %00. NOTE:…

  • CVE-2006-4760Sep 13, 2006
    Benjamin Pasero And Tobias Eichert
    Rssowl
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Benjamin Pasero and Tobias Eichert RSSOwl allow remote attackers to inject arbitrary web script or HTML via a web feed, as demonstrated by certain test cases of the Robert Auger and Caleb Sima RSS and Atom feed reader test…

  • CVE-2006-4761Sep 13, 2006
    Luke Hutteman
    Sharpreader
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Luke Hutteman SharpReader allow remote attackers to inject arbitrary web script or HTML via a web feed, as demonstrated by certain test cases of the Robert Auger and Caleb Sima RSS and Atom feed reader test suite.

  • CVE-2006-4762Sep 13, 2006
    Rssreader
    Rssreader
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Ykoon RssReader allow remote attackers to inject arbitrary web script or HTML via a web feed, as demonstrated by certain test cases of the Robert Auger and Caleb Sima RSS and Atom feed reader test suite.

  • CVE-2006-4763Sep 13, 2006
    IBM
    Domino Web Access
    risk 0.00cvss —epss 0.02

    IBM Lotus Domino Web Access (DWA) 7.0.1 does not expire a client's Lightweight Third-Party Authentication token (LtpaToken) upon logout, which allows remote attackers to obtain a user's privileges by intercepting the LtpaToken cookie.

  • CVE-2006-4764Sep 13, 2006
    Wtools
    Wtools
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in common.php in Thomas LETE WTools 0.0.1-ALPH allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.

  • CVE-2006-4765Sep 13, 2006
    Netgear
    Dg834gt
    risk 0.00cvss —epss 0.01

    NETGEAR DG834GT Wireless ADSL router running firmware 1.01.28 allows attackers to cause a denial of service (device hang) via a long string in the username field in the login window.

  • CVE-2006-4766Sep 13, 2006
    Newsscript.co.uk
    Newsscript
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in print.php in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allows remote attackers to read arbitrary files via a .. (dot dot) in the ide parameter.

  • CVE-2006-4767Sep 13, 2006
    Newsscript.co.uk
    Newsscript
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in Stefan Ernst Newsscript (aka WM-News) 0.5beta allow remote attackers to (1) read arbitrary local files via a .. (dot dot) sequence in the ide parameter in modify.php and (2) write to arbitrary local files via a .. sequence in the…

  • CVE-2006-4768Sep 13, 2006
    Newsscript.co.uk
    Newsscript
    risk 0.00cvss —epss 0.01

    Multiple direct static code injection vulnerabilities in add_go.php in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allow remote attackers to execute arbitrary PHP code via the (1) description, (2) issue, (3) title, (4) var, (5) name, (6) keywords, and (7) note parameters,…

  • CVE-2006-4769Sep 13, 2006
    Keil Software
    P4cms
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in abf_js.php in p4CMS 1.05 allows remote attackers to execute arbitrary PHP code via a URL in the abs_pfad parameter.

  • CVE-2006-4770Sep 13, 2006
    Miniportail
    Miniportal
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in menu.php in MiniPort@l 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the skiny parameter.

  • CVE-2006-4732Sep 13, 2006
    Microsoft
    Visual Basic
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in Microsoft Visual Basic (VB) 6 has an unknown impact ("overflow") via a project that contains a certain Click event procedure, as demonstrated using the msgbox function and the VB.Label object.

  • CVE-2006-4733Sep 13, 2006
    Sips
    Sips
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in sipssys/code/box.inc.php in Haakon Nilsen simple, integrated publishing system (SIPS) 0.3.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the config[sipssys] parameter. NOTE: the product's documentation…

  • CVE-2006-4734Sep 13, 2006
    Tiki
    Tiki
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in tiki-g-admin_processes.php in Tikiwiki 1.9.4 allow remote attackers to execute arbitrary SQL commands via the (1) pid and (2) where parameters.

  • CVE-2006-4735Sep 13, 2006
    Magpierss
    Magpierss
    risk 0.00cvss —epss 0.01

    Kellan Elliott-McCrea MagpieRSS allows remote attackers to obtain sensitive information via a direct request for (1) rss_fetch.inc.php or (2) rss_parse.inc.php, which reveals the path in various error messages.

  • CVE-2006-4736Sep 13, 2006
    Cms.r.
    CMS.r.
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in CMS.R. 5.5 allow remote attackers to execute arbitrary SQL commands via the (1) adminname and (2) adminpass parameters. NOTE: some of these details are obtained from third party information.

  • CVE-2006-4737Sep 13, 2006
    Jetbox
    Jetbox CMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Jetbox CMS allows remote attackers to inject arbitrary web script or HTML via the item parameter. NOTE: The view vector is already covered by CVE-2006-3586.2.

  • CVE-2006-4738Sep 13, 2006
    Jetbox
    Jetbox CMS
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in phpthumb.php in Jetbox CMS allows remote attackers to execute arbitrary PHP code via a URL in the includes_path parameter. NOTE: The relative_script_path vector is already covered by CVE-2006-2270.

  • CVE-2006-4739Sep 13, 2006
    Jetbox
    Jetbox CMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Jetbox CMS allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the OriginalImageData parameter to phpthumb.php.

  • CVE-2006-4740Sep 13, 2006
    Jetbox
    Jetbox CMS
    risk 0.00cvss —epss 0.01

    Jetbox CMS allows remote attackers to obtain sensitive information via a direct request for certain files, which reveal the path in an error message.

  • CVE-2006-4741Sep 13, 2006
    Idevspot
    Phplinkexchange
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in bits_listings.php in IDevSpot PhpLinkExchange 1.0 allows remote attackers to execute arbitrary code via the svr_rootPhpStart parameter.

  • CVE-2006-4742Sep 13, 2006
    Idevspot
    Phplinkexchange
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in user_add.php in IDevSpot PhpLinkExchange 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2006-4743Sep 13, 2006
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for (1) 404.php, (2) akismet.php, (3) archive.php, (4) archives.php, (5) attachment.php, (6) blogger.php, (7) comments.php, (8) comments-popup.php, (9) dotclear.php, (10)…

  • CVE-2006-4744Sep 13, 2006
    Abidia
    Abidia Wireless
    risk 0.00cvss —epss 0.01

    Abidia (1) O-Anywhere and (2) Abidia Wireless transmit authentication credentials in cleartext, which allows remote attackers to obtain sensitive information by sniffing.

  • CVE-2006-4745Sep 13, 2006
    Scarybear
    Pocketexpense Pro
    risk 0.00cvss —epss 0.00

    ScaryBear PocketExpense Pro 3.9.1 uses an internally recorded key to protect a data file whose contents are stored in plaintext, which allows local users to disable authentication and access the file by modifying a certain value in the file header.

  • CVE-2006-4746Sep 13, 2006
    AnnonceV
    Web Server Creator Web Portal
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in news/include/customize.php in Web Server Creator 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the l parameter.

  • CVE-2006-4747Sep 13, 2006
    Idevspot
    Textads
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in IdevSpot TextAds allow remote attackers to inject arbitrary web script or HTML via (1) the id parameter in delete.php and (2) the error parameter in error.php.

  • CVE-2006-4748Sep 13, 2006
    F Art Agency
    BLOG:CMS
    risk 0.00cvss —epss 0.03

    Multiple SQL injection vulnerabilities in F-ART BLOG:CMS 4.1 allow remote attackers to execute arbitrary SQL commands via the (1) xagent, (2) xpath, (3) xreferer, and (4) xdns parameters in (a) admin/plugins/NP_Log.php, and the (5) pitem parameter in (b)…

  • CVE-2006-4749Sep 13, 2006
    Bugada Andrea
    PHP Advanced Transfer Manager
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpATM) 1.20 allow remote attackers to execute arbitrary PHP code via the include_location parameter in (1) activate.php, (2) configure.php, (3) fileop.php, (4) getimg.php, (5) ipblocked.php,…

  • CVE-2006-4750Sep 13, 2006
    Openi CMS Group
    Openi CMS
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in openi-admin/base/fileloader.php in OPENi-CMS 1.0.1, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the config[openi_dir] parameter.

  • CVE-2006-4751Sep 13, 2006
    Laurentiu Matei
    Expandable Home Page CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5.1 allows remote attackers to inject arbitrary web script or HTML via the errcode parameter.

  • CVE-2006-4752Sep 13, 2006
    Laurentiu Matei
    Expandable Home Page CMS
    risk 0.00cvss —epss 0.02

    Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5.1 allows remote attackers to obtain the installation path via a query to the engine module, probably with an invalid action parameter.

  • CVE-2006-4753Sep 13, 2006
    PHProg
    PHProg
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in PHProg before 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter.

  • CVE-2006-4754Sep 13, 2006
    AnnonceV
    Phprog
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in PHProg before 1.1 allows remote attackers to inject arbitrary web script or HTML via the album parameter, which is used in an opendir call. NOTE: the same primary issue can be used for full path disclosure with an invalid…

  • CVE-2006-4755Sep 13, 2006
    PhpMyDirectory
    phpMyDirectory
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in alpha.php in phpMyDirectory 10.4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the letter parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party…

  • CVE-2006-4756Sep 13, 2006
    Accomplishtechnology
    Phpmydirectory
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in alpha.php in phpMyDirectory 10.4.6 and earlier allows remote attackers to execute arbitrary SQL commands via the letter parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.