VYPR

CVEs

381,337 total · page 7235 of 7,627

AllCriticalHighKEV
  • CVE-2006-4610Sep 7, 2006
    Graphiks
    Grapagenda
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in index.php in GrapAgenda 0.11 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the page parameter.

  • CVE-2006-4611Sep 7, 2006
    Dsocks
    Dsocks
    risk 0.04cvss —epss 0.08

    Buffer overflow in the _tor_resolve function in dsocks.c in dsocks before 1.4 allows remote attackers to execute arbitrary code via unspecified vectors, possibly involving a long node name.

  • CVE-2006-4612Sep 7, 2006
    Zixforum
    Zixforum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ReplyNew.asp in ZIXForum 1.12 allows remote attackers to execute arbitrary SQL commands via the RepId parameter.

  • CVE-2006-4613Sep 7, 2006
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in SnapGear before 3.1.4u1 allow remote attackers to cause a denial of service via unspecified vectors involving (1) IPSec replay windows and (2) the use of vulnerable versions of ClamAV before 0.88.4. NOTE: it is possible that vector 2 is…

  • CVE-2006-4614Sep 7, 2006
    Pocket Pc
    Pocket Pc
    risk 0.00cvss —epss 0.00

    PDAapps Verichat for Pocket PC 1.30bh stores usernames and passwords in plaintext in the Windows Mobile registry, which allows local users to obtain sensitive information via keys under \HKEY_CURRENT_USER\Software\PDAapps\VeriChat.

  • CVE-2006-4615Sep 7, 2006
    Shape
    IM+ Mobile Instant Messenger
    risk 0.00cvss —epss 0.00

    Shape Services IM+ Mobile Instant Messenger for Pocket PC 3.10 stores usernames and passwords in plaintext in %PROGRAMFILES%\IMPlus\implus.cfg, which allows local users to obtain sensitive information by reading the file.

  • CVE-2006-4616Sep 7, 2006
    MailEnable
    Mailenable
    risk 0.00cvss —epss 0.03

    SMTP service in MailEnable Standard, Professional, and Enterprise before ME-10014 (20060904) allows remote attackers to cause a denial of service via an SPF lookup for a domain with a large number of records, which triggers a null pointer exception.

  • CVE-2006-4617Sep 7, 2006
    Frappe
    CRM
    risk 0.00cvss —epss 0.01

    Unrestricted file upload vulnerability in fileupload.html in vtiger CRM 4.2.4, and possibly earlier versions, allows remote attackers to upload and execute arbitrary files with executable extensions in the /cashe/mails folder.

  • CVE-2006-4618Sep 7, 2006
    Adodb
    Adodb
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in adodb-postgres7.inc.php in John Lim ADOdb, possibly 4.01 and earlier, as used in Intechnic In-link 2.3.4, allows remote attackers to execute arbitrary PHP code via a URL in the ADODB_DIR parameter.

  • CVE-2006-4619Sep 7, 2006
    Avira
    Antivir Personal
    risk 0.00cvss —epss 0.00

    The start update window in update.exe in Avira AntiVir PersonalEdition Classic 7.0 build 151 allows local users to gain system privileges via a "Shatter" style attack on the (1) IParam parameter, and the (2) PBM_GETRANGE and (3) PBM_SETRANGE messages in an unspecified progress…

  • CVE-2006-4620Sep 7, 2006
    Alt N
    Webadmin
    risk 0.00cvss —epss 0.01

    The useredit_account.wdm module in Alt-N WebAdmin 3.2.5 running with MDaemon 9.0.6, and possibly earlier versions, allows remote authenticated domain administrators to gain privileges and obtain access to the system mail queue by modifying the mailbox of the MDaemon user account…

  • CVE-2006-4621Sep 7, 2006
    Bare Concept Media
    Pheap CMS
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in settings.php in Pheap 1.2, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the lpref parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party…

  • CVE-2006-4622Sep 7, 2006
    AnnonceV
    AnnonceV
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in annonce.php in AnnonceV (aka annoncesV) 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

  • CVE-2006-4583Sep 6, 2006
    Tufat
    Flashchat
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in FlashChat before 4.6.2 allow remote attackers to execute arbitrary PHP code via a URL in the dir[inc] parameter in (1) inc/cmses/aedatingCMS.php, (2) inc/cmses/aedatingCMS2.php, or (3) inc/cmses/aedating4CMS.php.

  • CVE-2006-4584Sep 6, 2006
    Tr Forum
    Tr Forum
    risk 0.03cvss —epss 0.05

    Tr Forum 2.0 allows remote attackers to bypass authentication and add an administrative account via the login and password parameters to admin/insert_admin.php.

  • CVE-2006-4585Sep 6, 2006
    Tr Forum
    Tr Forum
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in admin/editer.php in Tr Forum 2.0 allows remote authenticated users to execute arbitrary SQL commands via the id2 parameter. NOTE: this can be leveraged with other Tr Forum vulnerabilities to allow unauthenticated attackers to gain privileges.

  • CVE-2006-4586Sep 6, 2006
    Tr Forum
    Tr Forum
    risk 0.03cvss —epss 0.03

    The admin panel in Tr Forum 2.0 accepts a username and password hash for authentication, which allows remote authenticated users to perform unauthorized actions, as demonstrated by modifying user settings via the id parameter to /membres/modif_profil.php, and changing a password…

  • CVE-2006-4587Sep 6, 2006
    Vtiger
    CRM
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 4.2.4, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) description parameter in unspecified modules or the (2) solution parameter in the HelpDesk module.

  • CVE-2006-4588Sep 6, 2006
    Vtiger
    CRM
    risk 0.00cvss —epss 0.02

    vtiger CRM 4.2.4, and possibly earlier, allows remote attackers to bypass authentication and access administrative modules via a direct request to index.php with a modified module parameter, as demonstrated using the Settings module.

  • CVE-2006-4589Sep 6, 2006
    Dyncms
    Dyncms
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in 0_admin/modules/Wochenkarte/frontend/index.php in DynCMS 6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the x_admindir parameter.

  • CVE-2006-4590Sep 6, 2006
    Jetstat.com
    Js Asp Faq Manager
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in admin/default.asp in Jetstat.com JS ASP Faq Manager 1.10 and earlier allows remote attackers to execute arbitrary SQL commands via the uid parameter, a different vector than CVE-2006-4463. NOTE: the provenance of this information is unknown; the…

  • CVE-2006-4591Sep 6, 2006
    Alstrasoft
    Template Seller
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in AlstraSoft Template Seller, and possibly AltraSoft Template Seller Pro 3.25, allow remote attackers to execute arbitrary PHP code via a URL in the config[template_path] parameter to (1) payment/payment_result.php or (2)…

  • CVE-2006-4592Sep 6, 2006
    8pixel.net
    Simple Blog
    risk 0.03cvss —epss 0.01

    Incomplete blacklist vulnerability in default.asp in 8pixel.net Simple Blog 2.3 and earlier allows remote attackers to conduct SQL injection attacks via ">" characters in the id parameter, which are not filtered by the protection mechanism.

  • CVE-2006-4593Sep 6, 2006
    Softbb
    Softbb
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in SoftBB 0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2006-4594Sep 6, 2006
    phpATM
    phpATM
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpAtm) 1.21 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the include_location parameter in (1) confirm.php or (2) login.php. NOTE: the include_location…

  • CVE-2006-3742Sep 6, 2006
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.01

    The KDE PAM configuration shipped with Fedora Core 5 causes KDM passwords to be cached, which allows attackers to login without a password by attempting to log in multiple times.

  • CVE-2006-4563Sep 6, 2006
    Warpspeed
    Myheadlines
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the MyHeadlines before 4.3.2 module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the myh_op parameter to modules.php.

  • CVE-2006-4564Sep 6, 2006
    Simple Machines
    Forum
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Sources/ManageBoards.php in Simple Machines Forum 1.1 RC3 allows remote attackers to execute arbitrary SQL commands via the cur_cat parameter.

  • CVE-2006-2941Sep 6, 2006
    Mailman
    Mailman
    risk 0.00cvss —epss 0.03

    Mailman before 2.1.9rc1 allows remote attackers to cause a denial of service via unspecified vectors involving "standards-breaking RFC 2231 formatted headers".

  • CVE-2006-3126Sep 6, 2006
    Julian Pawlowski
    Capi4hylafax
    risk 0.00cvss —epss 0.03

    c2faxrecv in capi4hylafax 01.02.03 allows remote attackers to execute arbitrary commands via null (\0) and shell metacharacters in the TSI string, as demonstrated by a fax from an anonymous number.

  • CVE-2006-3636Sep 6, 2006
    Mailman
    Mailman
    risk 0.04cvss —epss 0.07

    Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-4095HigSep 6, 2006
    Isc
    Bind
    risk 0.50cvss 7.5epss 0.12

    BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via certain SIG queries, which cause an assertion failure when multiple RRsets are returned.

  • CVE-2006-4096Sep 6, 2006
    Isc
    Bind
    risk 0.01cvss —epss 0.08

    BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via a flood of recursive queries, which cause an INSIST failure when the response is received after the recursion queue is empty.

  • CVE-2006-4459Sep 6, 2006
    Digi International Inc
    Anywhere Usb5
    risk 0.00cvss —epss 0.01

    Integer overflow in AnywhereUSB/5 1.80.00 allows local users to cause a denial of service (crash) via a 1 byte header size specified in the USB string descriptor.

  • CVE-2006-4543Sep 6, 2006
    Hlstats
    Hlstats
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in HLStats 1.34 allows remote attackers to inject arbitrary web script or HTML via the (1) game parameter in players mode, the (2) weapon parameter in weaponinfo mode, the (3) st parameter in search mode, the (4) action…

  • CVE-2006-4544Sep 6, 2006
    Exbb
    Exbb
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in ExBB 1.9.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the exbb[home_path] parameter in files in the modules directory including (1) birstday/birst.php (2)…

  • CVE-2006-4545Sep 6, 2006
    Modulebased CMS
    Modulebased CMS
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in ModuleBased CMS Pre-Alpha allows remote attackers to execute arbitrary PHP code via the _SERVER parameter in (1) admin/avatar.php, (2) libs/archive.class.php, (3) libs/login.php, (4) libs/profiles.class.php, and (5)…

  • CVE-2006-4546Sep 6, 2006
    Lyris
    Listmanager
    risk 0.00cvss —epss 0.01

    Lyris ListManager 8.95 allows remote authenticated users, who have administrative privileges for at least one list on the server, to add new administrators to any list via a modified MEMBERS_.List_ parameter.

  • CVE-2006-4547Sep 6, 2006
    Lyris
    Listmanager
    risk 0.00cvss —epss 0.01

    Lyris ListManager 8.95 allows remote authenticated users to obtain sensitive information by attempting to add a user with a ' (single quote) character in the name, which reveals the details of the underlying SQL query, possibly because of a forced SQL error or SQL injection.

  • CVE-2006-4548Sep 6, 2006
    E107
    E107
    risk 0.00cvss —epss 0.02

    e107 0.75 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code via the tinyMCE_imglib_include image/jpeg parameter…

  • CVE-2006-4549Sep 6, 2006
    Chxo
    Feedsplitter
    risk 0.00cvss —epss 0.01

    CHXO Feedsplitter 2006-01-21 allows remote attackers to read the source code of feedsplitter.php via the showsource function. NOTE: this issue is not a vulnerability in standard distributions, but could be an issue if the source has been modified.

  • CVE-2006-4550Sep 6, 2006
    Chxo
    Feedsplitter
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to read arbitrary XML files via .. (dot dot) sequences in the format parameter with a leading ".", which bypasses a security check.

  • CVE-2006-4551Sep 6, 2006
    Chxo
    Feedsplitter
    risk 0.00cvss —epss 0.02

    Eval injection vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to execute arbitrary PHP code via (1) the file specified as the value of the format parameter, and possibly (2) the RSS feed.

  • CVE-2006-4552Sep 6, 2006
    Chxo
    Feedsplitter
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to inject arbitrary web script or HTML via the RSS feed.

  • CVE-2006-4553Sep 6, 2006
    Joomla
    Com Comprofiler
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in plugin.class.php in the com_comprofiler Components 1.0 RC2 for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-4554Sep 6, 2006
    Becubed
    Compression Plus
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in the ReadFile function in the ZOO-processing exports in the BeCubed Compression Plus before 5.0.1.28, as used in products including (1) Tumbleweed EMF, (2) VCOM/Ontrack PowerDesk Pro, (3) Canyon Drag and Zip, (4) Canyon Power File, and (5) Canyon…

  • CVE-2006-4555Sep 6, 2006
    Retro64
    Cr64loader Activex Control
    risk 0.00cvss —epss 0.04

    Buffer overflow in the Retro64 / Miniclip CR64Loader ActiveX control allows remote attackers to execute arbitrary code via unspecified vectors involving an HTML document that references the CLSID of the control.

  • CVE-2006-4556Sep 6, 2006
    Joomla
    Jim Component
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in index.php in the JIM component for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: another researcher has stated that the product distribution does not…

  • CVE-2006-4557Sep 6, 2006
    Bob Jewell
    Discloser
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in plugins/plugins.php in Bob Jewell Discloser 0.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the type parameter. NOTE: another researcher has stated that an attacker cannot control the type parameter. As of…

  • CVE-2006-4558Sep 6, 2006
    Deluxebb
    Deluxebb
    risk 0.03cvss —epss 0.04

    DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod_mime module, allows remote attackers to execute arbitrary PHP code by uploading files with double extensions via the fileupload parameter in a newthread action in newpost.php.