VYPR

CVEs

381,305 total · page 7246 of 7,627

AllCriticalHighKEV
  • CVE-2006-1473Aug 2, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.05

    Integer overflow in AFP Server for Apple Mac OS X 10.3.9 and 10.4.7 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via unknown vectors.

  • CVE-2006-3495Aug 2, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.01

    AFP Server in Apple Mac OS X 10.3.9 and 10.4.7 stores reconnect keys in a world-readable file, which allows local users to obtain the keys and access files and folders of other users.

  • CVE-2006-3496Aug 2, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    AFP Server in Apple Mac OS X 10.3.9 and 10.4.7 allows remote attackers to cause denial of service (crash) via an invalid AFP request that triggers an unchecked error condition.

  • CVE-2006-3497Aug 2, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the "compression state handling" in Bom for Apple Mac OS X 10.3.9 and 10.4.7 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Zip archive.

  • CVE-2006-3498Aug 2, 2006
    Apple Inc.
    Mac OS X
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in bootpd in the DHCP component for Apple Mac OS X 10.3.9 and 10.4.7 allows remote attackers to execute arbitrary code via a crafted BOOTP request.

  • CVE-2006-3971Aug 2, 2006
    Scott Weedon
    Ajax Chat
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in visitor/livesupport/chat.php in Scott Weedon Ajax Chat, possibly 0.1, allows remote attackers to inject arbitrary web script or HTML via the userid parameter.

  • CVE-2006-3972Aug 2, 2006
    Scott Weedon
    Ajax Chat
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in includes/operator_chattranscript.php in Scott Weedon Ajax Chat, possibly 0.1, allows remote attackers to read arbitrary files via a .. (dot dot) in the chatid parameter.

  • CVE-2006-3962Aug 1, 2006
    Mambo (software)
    Bayesiannaivefilter
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in administrator/components/com_bayesiannaivefilter/lang.php in the bayesiannaivefilter component (com_bayesiannaivefilter) 1.1 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path…

  • CVE-2006-3963Aug 1, 2006
    Banex
    Banex
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Banex PHP MySQL Banner Exchange 2.21 allow remote attackers to execute arbitrary SQL commands via the (1) site_name parameter to (a) signup.php, and the (2) id, (3) deleteuserbanner, (4) viewmem, (5) viewmemunb, (6) viewunmem,or (7)…

  • CVE-2006-3964Aug 1, 2006
    Banex
    Banex
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in members.php in Banex PHP MySQL Banner Exchange 2.21 allows remote attackers to execute arbitrary PHP code via a URL in the cfg_root parameter.

  • CVE-2006-3965Aug 1, 2006
    Banex
    Banex
    risk 0.00cvss —epss 0.01

    Banex PHP MySQL Banner Exchange 2.21 stores lib.inc under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as database usernames and passwords.

  • CVE-2006-3966Aug 1, 2006
    PHP Layers Menu
    PHP Layers Menu
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in /lib/tree/layersmenu.inc.php in the PHP Layers Menu 2.3.5 package for MyNewsGroups :) 0.6b and earlier allows remote attackers to execute arbitrary PHP code via a URL in the myng_root parameter.

  • CVE-2006-3967Aug 1, 2006
    Moskool
    Moskool
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in component/option,com_moskool/Itemid,34/admin.moskool.php in MamboXChange Moskool 1.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3968Aug 1, 2006
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.01

    The crypto provider in Sun Solaris 10 3/05 HW2 without patch 121236-01, when running on Sun Fire T2000 platforms, incorrectly verifies a DSA signature, which might prevent applications from detecting that the data has been modified.

  • CVE-2006-3969Aug 1, 2006
    Joomla
    Colophon
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in administrator/components/com_colophon/admin.colophon.php in Colophon 1.2 and earlier for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3970Aug 1, 2006
    Joomla
    Lmo
    risk 0.04cvss —epss 0.09

    PHP remote file inclusion vulnerability in lmo.php in the LMO Component (com_lmo) 1.0b2 and earlier for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3947Aug 1, 2006
    Mambo (software)
    Mambatstaff
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in components/com_mambatstaff/mambatstaff.php in the Mambatstaff 3.1b and earlier component for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3948Aug 1, 2006
    PHP-Nuke
    Inp
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in modules.php in PHP-Nuke INP allows remote attackers to inject arbitrary web script or HTML via the query parameter.

  • CVE-2006-3949Aug 1, 2006
    Mambo (software)
    Artlinks Component
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in artlinks.dispnew.php in the Artlinks component (com_artlinks) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3950Aug 1, 2006
    X Scripts
    X Statistics
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in x-statistics.php in X-Scripts X-Statistics 1.20 allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.

  • CVE-2006-3951Aug 1, 2006
    Moodle
    Moodle
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in moodle.php in Mam-moodle alpha component (com_moodle) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3952Aug 1, 2006
    EFS Software
    Easy File Sharing FTP Server
    risk 0.08cvss —epss 0.67

    Stack-based buffer overflow in EFS Software Easy File Sharing FTP Server 2.0 allows remote attackers to execute arbitrary code via a long argument to the PASS command. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

  • CVE-2006-3953Aug 1, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in usercp.php in MyBB (aka MyBulletinBoard) 1.x allows remote attackers to inject arbitrary web script or HTML via the gallery parameter.

  • CVE-2006-3954Aug 1, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in usercp.php in MyBB (aka MyBulletinBoard) 1.x allows remote attackers to read arbitrary files via a .. (dot dot) in the gallery parameter in a (1) avatar or (2) do_avatar action.

  • CVE-2006-3955Aug 1, 2006
    Minibb
    Minibb
    risk 0.04cvss —epss 0.10

    Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a allow remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter to (1) news.php, (2) search.php, or (3) whosOnline.php.

  • CVE-2006-3956Aug 1, 2006
    Advanced Webhost Billing System
    Advanced Webhost Billing System
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in contact.php in Advanced Webhost Billing System (AWBS) 2.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) AccountUsername and (3) Message parameters.

  • CVE-2006-3957Aug 1, 2006
    Bosdev
    Bosdates
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in payment.php in BosDev BosDates allows remote attackers to execute arbitrary PHP code via a URL in the insPath parameter.

  • CVE-2006-3958Aug 1, 2006
    Pkr Internet
    Taskjitsu
    risk 0.00cvss —epss 0.01

    Multiple unspecified cross-site scripting (XSS) vulnerabilities in Taskjitsu 2.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) the Search Tasks system, or authenticated users via (2) the Edit Task system, (3) the back-end Category Editor system, and (4)…

  • CVE-2006-3959Aug 1, 2006
    X Scripts
    X-Protection
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in protect.php in X-Scripts X-Protection 1.10, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameter.

  • CVE-2006-3960Aug 1, 2006
    X Scripts
    X Poll
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in top.php in X-Scripts X-Poll, probably 2.30, allows remote attackers to execute arbitrary SQL commands via the poll parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

  • CVE-2006-3961Aug 1, 2006
    McAfee
    Virusscan
    risk 0.06cvss —epss 0.34

    Buffer overflow in McSubMgr ActiveX control (mcsubmgr.dll) in McAfee Security Center 6.0.23 for Internet Security Suite 2006, Wireless Home Network Security, Personal Firewall Plus, VirusScan, Privacy Service, SpamKiller, AntiSpyware, and QuickClean allows remote user-assisted…

  • CVE-2006-3941Jul 31, 2006
    Sun Corporation
    N1 Grid Engine
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the daemons for Sun N1 Grid Engine 5.3 and N1 Grid Engine 6.0 allows local users to cause a denial of service (grid service shutdown) and possibly execute arbitrary code using buffer overflows via unknown vectors that cause (1) qmaster or (2) execd…

  • CVE-2006-3942Jul 31, 2006
    Microsoft
    Windows
    risk 0.09cvss —epss 0.75

    The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL…

  • CVE-2006-3943Jul 31, 2006
    Microsoft
    Ie
    risk 0.04cvss —epss 0.16

    Stack-based buffer overflow in NDFXArtEffects in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) via long (1) RGBExtraColor, (2) RGBForeColor, and (3) RGBBackColor properties.

  • CVE-2006-3944Jul 31, 2006
    Microsoft
    Internet Explorer
    risk 0.04cvss —epss 0.17

    Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) via a (1) Forms.ListBox.1 or (2) Forms.ListBox.1 object with the ListWidth property set to (a) 0x7fffffff, which triggers an integer overflow exception, or to (b)…

  • CVE-2006-3945Jul 31, 2006
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    The CSS functionality in Opera 9 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by setting the background property of a DHTML element to a long http or https URL, which triggers memory corruption.

  • CVE-2006-3946Jul 31, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.05

    WebCore in Apple Mac OS X 10.3.9 and 10.4 through 10.4.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted HTML that triggers a "memory management error" in WebKit, possibly due to a buffer overflow, as originally…

  • CVE-2006-3933Jul 31, 2006
    Alkacon
    Opencms
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.2.2 allows remote authenticated users to inject arbitrary web script or HTML via the message body.

  • CVE-2006-3934Jul 31, 2006
    Alkacon
    Opencms
    risk 0.00cvss —epss 0.01

    Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.

  • CVE-2006-3935Jul 31, 2006
    Alkacon
    Opencms
    risk 0.00cvss —epss 0.02

    system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to (1) send broadcast messages to all users (/workplace/broadcast), (2) list all users (/accounts/users), (3)…

  • CVE-2006-3936Jul 31, 2006
    Alkacon
    Opencms
    risk 0.00cvss —epss 0.01

    system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp.

  • CVE-2006-3937Jul 31, 2006
    Xguestbook
    Xguestbook
    risk 0.00cvss —epss 0.01

    post.php in x_atrix xGuestBook 1.02 allows remote attackers to obtain sensitive information via a request without the (1) user, (2) mail, (3) p, or (4) url parameter, which reveals the installation path in an error message.

  • CVE-2006-3938Jul 31, 2006
    Dotclear
    Dotclear
    risk 0.00cvss —epss 0.02

    DotClear allows remote attackers to obtain sensitive information via a direct request for (1) edit_cat.php, (2) index.php, (3) edit_link.php in ecrire/tools/blogroll/; (4) syslog/index.php, (5) thememng/index.php, (6) toolsmng/index.php, (7) utf8convert/index.php in…

  • CVE-2006-3939Jul 31, 2006
    Scriptscenter
    Ezupload Pro
    risk 0.00cvss —epss 0.02

    ScriptsCenter ezUpload Pro 2.2.0 allows remote attackers to perform administrative activities without authentication in (1) filter.php, which permits changing the Extensions Mode file type; (2) access.php, which permits changing the Protection Method; (3) edituser.php, which…

  • CVE-2006-3940Jul 31, 2006
    PhpBB
    Phpbb Auction
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in phpbb-Auction allow remote attackers to execute arbitrary SQL commands via (1) the ar parameter in auction_room.php and (2) the u parameter in auction_store.php. NOTE: the auction_rating.php vector is already covered by CVE-2005-1234. …

  • CVE-2006-3120Jul 31, 2006
    Brian Wotring
    Osiris
    risk 0.00cvss —epss 0.03

    Format string vulnerability in Brian Wotring Osiris before 4.2.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unspecified attack vectors related to the logging functions.

  • CVE-2006-3926Jul 31, 2006
    Phpprobid
    Phpprobid
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in PhpProBid 5.24 allow remote attackers to execute arbitrary SQL commands via the (1) view or (2) start parameters to (a) viewfeedback.php or the (3) orderType parameter to (b) categories.php.

  • CVE-2006-3927Jul 31, 2006
    Phpprobid
    Phpprobid
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in auctionsearch.php in PhpProBid 5.24 allows remote attackers to inject arbitrary web script or HTML via the advsrc parameter.

  • CVE-2006-3928Jul 31, 2006
    Mikael Software
    Wmnews
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in WMNews 0.2a and earlier allows remote attackers to execute arbitrary PHP code via a URL in the base_datapath parameter.

  • CVE-2006-3929Jul 31, 2006
    Zyxel
    Prestige 660h 61
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Forms/rpSysAdmin script on the Zyxel Prestige 660H-61 ADSL Router running firmware 3.40(PT.0)b32 allows remote attackers to inject arbitrary web script or HTML via hex-encoded values in the a parameter.