VYPR

CVEs

381,349 total · page 7233 of 7,627

AllCriticalHighKEV
  • CVE-2006-4731Sep 13, 2006
    Ledgersmb
    Ledgersmb
    risk 0.03cvss —epss 0.06

    Multiple directory traversal vulnerabilities in (1) login.pl and (2) admin.pl in (a) SQL-Ledger before 2.6.19 and (b) LedgerSMB before 1.0.0p1 allow remote attackers to execute arbitrary Perl code via an unspecified terminal parameter value containing ../ (dot dot slash).

  • CVE-2006-0001Sep 12, 2006
    Microsoft
    Publisher
    risk 0.03cvss —epss 0.42

    Stack-based buffer overflow in Microsoft Publisher 2000 through 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted PUB file, which causes an overflow when parsing fonts.

  • CVE-2006-0032Sep 12, 2006
    Microsoft
    Windows 2000
    risk 0.05cvss —epss 0.25

    Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an…

  • CVE-2006-3311Sep 12, 2006
    Adobe Inc.
    Flex
    risk 0.01cvss —epss 0.18

    Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie.

  • CVE-2006-3442Sep 12, 2006
    Microsoft
    Windows Xp
    risk 0.02cvss —epss 0.27

    Unspecified vulnerability in Pragmatic General Multicast (PGM) in Microsoft Windows XP SP2 and earlier allows remote attackers to execute arbitrary code via a crafted multicast message.

  • CVE-2006-3873Sep 12, 2006
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.29

    Heap-based buffer overflow in URLMON.DLL in Microsoft Internet Explorer 6 SP1 on Windows 2000 and XP SP1, with versions the MS06-042 patch before 20060912, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long URL in a GZIP-encoded…

  • CVE-2006-4381Sep 12, 2006
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.05

    Integer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted H.264 movie.

  • CVE-2006-4382Sep 12, 2006
    Apple Inc.
    Quicktime
    risk 0.01cvss —epss 0.07

    Multiple buffer overflows in Apple QuickTime before 7.1.3 allow user-assisted remote attackers to execute arbitrary code via a crafted QuickTime movie.

  • CVE-2006-4384Sep 12, 2006
    Apple Inc.
    Quicktime
    risk 0.04cvss —epss 0.16

    Heap-based buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via the COLOR_64 chunk in a FLIC (FLC) movie.

  • CVE-2006-4385Sep 12, 2006
    Apple Inc.
    Quicktime
    risk 0.01cvss —epss 0.07

    Buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted SGI image.

  • CVE-2006-4386Sep 12, 2006
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.06

    Integer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted H.264 movie, a different issue than CVE-2006-4381.

  • CVE-2006-4388Sep 12, 2006
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.06

    Integer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted FlashPix file.

  • CVE-2006-4389Sep 12, 2006
    Apple Inc.
    Quicktime
    risk 0.01cvss —epss 0.08

    Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted FlashPix (FPX) file, which triggers an exception that leads to an operation on an uninitialized object.

  • CVE-2006-4640Sep 12, 2006
    Adobe Inc.
    Flashplayer
    risk 0.01cvss —epss 0.10

    Unspecified vulnerability in Adobe Flash Player before 9.0.16.0 allows user-assisted remote attackers to bypass the allowScriptAccess protection via unspecified vectors.

  • CVE-2006-2658Sep 12, 2006
    Mono
    Xsp
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in the xsp component in mod_mono in Mono/C# web server, as used in SUSE Open-Enterprise-Server 1 and SUSE Linux 9.2 through 10.0, allows remote attackers to read arbitrary files via a .. (dot dot) sequence in an HTTP request.

  • CVE-2006-4625Sep 12, 2006
    PHP
    PHP
    risk 0.03cvss —epss 0.01

    PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults.

  • CVE-2006-4705Sep 12, 2006
    Dominic Gamble
    Timesheet.PHP
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in login.php in dwayner79 and Dominic Gamble Timesheet (aka Timesheet.php) 1.2.1 allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2006-4706Sep 12, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.1.7 allows remote attackers to inject arbitrary web script or HTML via a url BBCode tag that contains a javascript URI with an SGML numeric character reference and an embedded…

  • CVE-2006-4707Sep 12, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in admin/global.php (aka the Admin CP login form) in MyBB (aka MyBulletinBoard) 1.1.7 allows remote attackers to inject arbitrary web script or HTML via the query string ($_SERVER[PHP_SELF]).

  • CVE-2006-4708Sep 12, 2006
    Vikingboard
    Vikingboard
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Vikingboard 0.1b allow remote attackers to inject arbitrary web script or HTML via the (1) act parameter in (a) help.php and (b) search.php, and the (2) p parameter in report.php.

  • CVE-2006-4709Sep 12, 2006
    Vikingboard
    Vikingboard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in topic.php in Vikingboard 0.1b allows remote attackers to execute arbitrary SQL commands via the s parameter.

  • CVE-2006-4710Sep 12, 2006
    Newsgator
    Feeddemon
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in NewsGator FeedDemon before 2.0.0.25 allow remote attackers to inject arbitrary web script or HTML via an Atom 1.0 feed, as demonstrated by certain test cases of the James M. Snell Atom 1.0 feed reader test suite.

  • CVE-2006-4711Sep 12, 2006
    Sage
    Sage
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Sage allow remote attackers to inject arbitrary web script or HTML via an Atom 1.0 feed, as demonstrated by certain test cases of the James M. Snell Atom 1.0 feed reader test suite.

  • CVE-2006-4712Sep 12, 2006
    Sage
    Sage
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use…

  • CVE-2006-4713Sep 12, 2006
    Psywerks
    Puma
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in config.php in PSYWERKS PUMA 1.0 RC2 allows remote attackers to execute arbitrary PHP code via a URL in the fpath parameter.

  • CVE-2006-4714Sep 12, 2006
    Spoonlabs
    Vivvo Article Management CMS
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the classified_path parameter.

  • CVE-2006-4715Sep 12, 2006
    Spoonlabs
    Vivvo Article Management CMS
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in pdf_version.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-4716Sep 12, 2006
    Fire Soft Board
    Fire Soft Board
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in demarrage.php in Fire Soft Board (FSB) RC3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the racine parameter.

  • CVE-2006-4717Sep 12, 2006
    University of Washington
    Pubcookie
    risk 0.00cvss —epss 0.02

    The login redirection mechanism in the Drupal 4.7 Pubcookie module before 1.2.2.4 2006/09/06 and the Drupal 4.6 Pubcookie module before 1.6.2.1 2006/09/07 allows remote attackers to bypass authentication requirements and spoof identities of arbitrary users via unspecified…

  • CVE-2006-4718Sep 12, 2006
    Korviblog
    Korviblog
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in livre_or.php in KorviBlog 1.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) prenom, (2) emailFrom, or (3) body parameters.

  • CVE-2006-4719Sep 12, 2006
    Myabracadaweb
    Myabracadaweb
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in MyABraCaDaWeb 1.0.3, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the base parameter to (1) index.php or (2) pop.php.

  • CVE-2006-4720Sep 12, 2006
    Mcgallery
    Mcgallery Pro
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in random2.php in mcGalleryPRO 2006 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.

  • CVE-2006-4721Sep 12, 2006
    Ccleague
    Pro Sports CMS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in admin.php in CCleague Pro Sports CMS 1.0.1 RC1 allows remote attackers to read and execute arbitrary local files via a .. (dot dot) sequence and trailing null (%00) byte in the language Cookie parameter, as demonstrated by executing PHP code…

  • CVE-2006-4722Sep 12, 2006
    Openbb
    Openbb
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in Open Bulletin Board (OpenBB) 1.0.8 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) index.php and possibly (2) collector.php.

  • CVE-2006-4723Sep 12, 2006
    Raidenhttpd
    Raidenhttpd
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in raidenhttpd-admin/slice/check.php in RaidenHTTPD 1.1.49, when register_globals and WebAdmin is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the SoftParserFileXml parameter.

  • CVE-2006-4623Sep 11, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    The Unidirectional Lightweight Encapsulation (ULE) decapsulation component in dvb-core/dvb_net.c in the dvb driver in the Linux kernel 2.6.17.8 allows remote attackers to cause a denial of service (crash) via an SNDU length of 0 in a ULE packet.

  • CVE-2006-4674Sep 11, 2006
    Dokuwiki
    Dokuwiki
    risk 0.00cvss —epss 0.02

    Direct static code injection vulnerability in doku.php in DokuWiki before 2006-030-09c allows remote attackers to execute arbitrary PHP code via the X-FORWARDED-FOR HTTP header, which is stored in config.php.

  • CVE-2006-4675Sep 11, 2006
    Dokuwiki
    Dokuwiki
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in lib/exe/media.php in DokuWiki before 2006-03-09c allows remote attackers to upload executable files into the data/media folder via unspecified vectors.

  • CVE-2006-4676Sep 11, 2006
    TIBCO Software
    Rendezvous
    risk 0.03cvss —epss 0.01

    TIBCO RendezVous 7.4.11 and earlier logs base64-encoded usernames and passwords in rvrd.db, which allows local users to obtain sensitive information by decoding the log file.

  • CVE-2006-4677Sep 11, 2006
    Phpopenchat
    Phpopenchat
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in contrib/yabbse/poc.php in phpopenchat before 3.0.2 allows remote attackers to execute arbitrary PHP code via the sourcedir parameter. NOTE: this issue was disputed by a third-party researcher who stated that the _REQUEST parameters…

  • CVE-2006-4678Sep 11, 2006
    Evolution
    Evolution
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in News Evolution 3.0.3 allows remote attackers to execute arbitrary PHP code via the _NE[AbsPath] parameter in (1) install.php and (2) migrateNE2toNE3.php.

  • CVE-2006-4679Sep 11, 2006
    Dokuwiki
    Dokuwiki
    risk 0.00cvss —epss 0.02

    DokuWiki before 2006-03-09c enables the debug feature by default, which allows remote attackers to obtain sensitive information by calling doku.php with the X-DOKUWIKI-DO HTTP header set to "debug".

  • CVE-2006-4680Sep 11, 2006
    Canon
    Imagerunner 2620
    risk 0.00cvss —epss 0.01

    The Remote UI in Canon imageRUNNER includes usernames and passwords when exporting an address book, which allows context-dependent attackers to obtain sensitive information.

  • CVE-2006-4681Sep 11, 2006
    IBM
    Director
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in Redirect.bat in IBM Director before 5.10 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the file parameter.

  • CVE-2006-4682Sep 11, 2006
    IBM
    Director
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in IBM Director before 5.10 allow remote attackers to cause a denial of service (crash) via unspecified vectors involving (1) malformed WMI CIM server requests and (2) malformed packets.

  • CVE-2006-4683Sep 11, 2006
    IBM
    Director
    risk 0.00cvss —epss 0.01

    IBM Director before 5.10 allows remote attackers to obtain sensitive information from HTTP headers via HTTP TRACE.

  • CVE-2006-4671Sep 11, 2006
    Fscripts
    Fantastic News
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in headlines.php in Fantastic News 2.1.4, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[script_path] parameter, a different vector than CVE-2006-1154.

  • CVE-2006-4672Sep 11, 2006
    Profitcode
    Ppalcart
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in profitCode ppalCart 2.5 EE, possibly a component of PayProCart, allows remote attackers to execute arbitrary PHP code via a URL in the (1) proMod parameter to (a) index.php, or the (2) docroot parameter to (b) index.php or (c)…

  • CVE-2006-4673Sep 11, 2006
    PHP-Fusion
    Phpfusion
    risk 0.03cvss —epss 0.01

    Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php.

  • CVE-2006-4294Sep 9, 2006
    TWiki
    Twiki
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in viewfile in TWiki 4.0.0 through 4.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.