VYPR

CVEs

380,877 total · page 7253 of 7,618

AllCriticalHighKEV
  • CVE-2006-3165Jun 22, 2006
    Free Realty
    Free Realty
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in propview.php in Free Realty 2.9-0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the sort parameter.

  • CVE-2006-3166Jun 22, 2006
    Free Realty
    Free Realty
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in propview.php in Free Realty 2.9-0.6 and earlier allows remote attackers to execute arbitrary web script or HTML via the sort parameter.

  • CVE-2006-3167Jun 22, 2006
    Free Realty
    Free Realty
    risk 0.00cvss —epss 0.01

    Free Realty before 2.9 allows remote attackers to obtain the full path and other sensitive information via unspecified manipulations that produce an error message.

  • CVE-2006-3129Jun 22, 2006
    Nc Linklist
    Nc Linklist
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in NC LinkList 1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) view parameters.

  • CVE-2006-3130Jun 22, 2006
    Clubpage
    Clubpage
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in Clubpage allows remote attackers to execute arbitrary SQL commands via the category parameter.

  • CVE-2006-3131Jun 22, 2006
    Clubpage
    Clubpage
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Clubpage allow remote attackers to inject arbitrary web script or HTML via the (1) news_archive, (2) language, and (3) intranetLogin parameters in (a) index.php; the (4) sites_id parameter in (b) sites.php; and the (5)…

  • CVE-2006-3132Jun 22, 2006
    Qto
    Qtofilemanager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in qtofm.php4 in QTOFileManager 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, as originally reported for index.php.

  • CVE-2006-3014Jun 22, 2006
    Microsoft
    Excel
    risk 0.05cvss —epss 0.30

    Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet.

  • CVE-2006-3127Jun 21, 2006
    Sun Corporation
    Java Enterprise System
    risk 0.00cvss —epss 0.03

    Memory leak in Network Security Services (NSS) 3.11, as used in Sun Java Enterprise System 2003Q4 through 2005Q1 and Java System Directory Server 5.2, allows remote attackers to cause a denial of service (memory consumption) by performing a large number of RSA cryptographic…

  • CVE-2006-3128Jun 21, 2006
    Easy CMS
    Easy CMS
    risk 0.00cvss —epss 0.01

    choose_file.php in easy-CMS 0.1.2, when mod_mime is installed, does not restrict uploads of filenames with multiple extensions, which allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a GIF file extension, then directly accessing that file in the…

  • CVE-2006-2911Jun 21, 2006
    CMS Mundo
    CMS Mundo
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in controlpanel/index.php in CMS Mundo before 1.0 build 008 allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2006-2931Jun 21, 2006
    CMS Mundo
    CMS Mundo
    risk 0.00cvss —epss 0.02

    CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote attackers to execute arbitrary PHP code by uploading and later directly accessing certain files.

  • CVE-2006-3101Jun 21, 2006
    Cisco Systems, Inc.
    Secure ACS for UNIX
    risk 0.05cvss —epss 0.24

    Cross-site scripting (XSS) vulnerability in LogonProxy.cgi in Cisco Secure ACS for UNIX 2.3 allows remote attackers to inject arbitrary web script or HTML via the (1) error, (2) SSL, and (3) Ok parameters.

  • CVE-2006-3102Jun 21, 2006
    Bitweaver
    Bitweaver
    risk 0.04cvss —epss 0.08

    Race condition in articles/BitArticle.php in Bitweaver 1.3, when run on Apache with the mod_mime extension, allows remote attackers to execute arbitrary PHP code by uploading arbitrary files with double extensions, which are stored for a small period of time under the webroot in…

  • CVE-2006-3103Jun 21, 2006
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in Bitweaver 1.3 allows remote attackers to inject arbitrary web script or HTML via the (1) error parameter in users/login.php and the (2) feedback parameter in articles/index.php.

  • CVE-2006-3104Jun 21, 2006
    Bitweaver
    Bitweaver
    risk 0.04cvss —epss 0.09

    users/index.php in Bitweaver 1.3 allows remote attackers to obtain sensitive information via an invalid sort_mode parameter, which reveals the installation path and database information in the resultant error message.

  • CVE-2006-3105Jun 21, 2006
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.03

    CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.

  • CVE-2006-3106Jun 21, 2006
    phpMyDesktop|Arcade
    phpMyDesktop|Arcade
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in phpMyDesktop|Arcade 1.0 allows remote attackers to inject arbitrary web script or HTML via the subsite parameter in the subsite todo.

  • CVE-2006-3107Jun 21, 2006
    Docebo
    Docebo
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in (1) GLOBALS[where_framework] to (a) admin/modules/news/news_class.php and (b)…

  • CVE-2006-3108Jun 21, 2006
    Emailarchitect
    Email Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in EmailArchitect Email Server 6.1 allows remote attackers to inject arbitrary Javascript via an HTML div tag with a carriage return between the onmouseover attribute and its value, which bypasses the mail filter.

  • CVE-2006-3109Jun 21, 2006
    Cisco Systems, Inc.
    Unified Callmanager
    risk 0.04cvss —epss 0.14

    Cross-site scripting (XSS) vulnerability in Cisco CallManager 3.3 before 3.3(5)SR3, 4.1 before 4.1(3)SR4, 4.2 before 4.2(3), and 4.3 before 4.3(1), allows remote attackers to inject arbitrary web script or HTML via the (1) pattern parameter in ccmadmin/phonelist.asp and (2)…

  • CVE-2006-3110Jun 21, 2006
    Chipmailer
    Chipmailer
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in main.php in Chipmailer 1.09 allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) betreff, (3) mail, and (4) text parameters.

  • CVE-2006-3111Jun 21, 2006
    Chipmailer
    Chipmailer
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in main.php in Chipmailer 1.09 allow remote attackers to execute arbitrary SQL commands via multiple parameters, as demonstrated by (1) anfang, (2) name, (3) mail, (4) anrede, (5) vorname, (6) nachname, (7) gebtag, (8) gebmonat, and (9)…

  • CVE-2006-3112Jun 21, 2006
    Chipmailer
    Chipmailer
    risk 0.00cvss —epss 0.01

    Chipmailer 1.09 allows remote attackers to obtain sensitive information via a direct request to php.php, which displays the output of the phpinfo function.

  • CVE-2006-2942Jun 20, 2006
    TWiki
    Twiki
    risk 0.00cvss —epss 0.02

    TWiki 4.0.0, 4.0.1, and 4.0.2 allows remote attackers to gain Twiki administrator privileges via a TWiki.TWikiRegistration form with a modified action attribute that references the Sandbox web instead of the user web, which can then be used to associate the user's login name…

  • CVE-2006-3097Jun 20, 2006
    Microfocus
    Support Tools Manager
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Support Tools Manager (xstm, cstm, and stm) on HP-UX B.11.11 and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors.

  • CVE-2006-3087Jun 19, 2006
    Ezgallery
    Ezgallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in EZGallery 1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) pUserID, (2) aid, (3) aname, (4) uid, and (5) m parameter in (a) common/galleries.asp; (6) aid, (7) aname, (8) uid, (9) m,…

  • CVE-2006-3088Jun 19, 2006
    Cescripts
    Car Classifieds
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Car Classifieds allows remote attackers to inject arbitrary web script or HTML via the make_id parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

  • CVE-2006-3089Jun 19, 2006
    Phpmyfactures
    Phpmyfactures
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in PhpMyFactures 1.0, and possibly 1.2 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) prefixe_dossier parameter in (a) /inc/header.php; (2) msg parameter in (b)…

  • CVE-2006-3090Jun 19, 2006
    Phpmyfactures
    Phpmyfactures
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in PhpMyFactures 1.0, and possibly 1.2 and earlier, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) id_pays parameter in (a) /pays/modifier_pays.php; (2) id_produit, (3) quantite, (4)…

  • CVE-2006-3091Jun 19, 2006
    Phpmyfactures
    Phpmyfactures
    risk 0.00cvss —epss 0.02

    PhpMyFactures 1.0, and possibly 1.2 and earlier, allows remote attackers to obtain the installation path via a direct request to (1) /verif.php, (2) /inc/footer.php, and (3) /remises/ajouter_remise.php.

  • CVE-2006-3092Jun 19, 2006
    Phpmyfactures
    Phpmyfactures
    risk 0.00cvss —epss 0.03

    PhpMyFactures 1.2 and earlier allows remote attackers to bypass authentication and modify data via direct requests with modified parameters to (1) /tva/ajouter_tva.php, (2) /remises/ajouter_remise.php, (3) /pays/ajouter_pays.php, (4) /pays/modifier_pays.php, (5)…

  • CVE-2006-3093Jun 19, 2006
    Adobe Inc.
    Acrobat
    risk 0.00cvss —epss 0.06

    Multiple unspecified vulnerabilities in Adobe Acrobat Reader (acroread) before 7.0.8 have unknown impact and unknown vectors.

  • CVE-2006-3094Jun 19, 2006
    Calendarix
    Basic
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Calendarix Basic 0.7.20060401 and earlier, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) cal_event.php and (2) cal_popup.php.

  • CVE-2006-3095Jun 19, 2006
    Ipostmx
    Ipostmx 2005
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in iPostMX 2005 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the RETURNURL parameter in (1) userlogin.cfm and (2) account.cfm.

  • CVE-2006-3096Jun 19, 2006
    Ipostmx
    Ipostmx 2005
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in iPostMX 2005 2.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) forum parameter in messagepost.cfm and (2) topic parameter in topics.cfm. NOTE: this item was created based on information in a blog entry…

  • CVE-2006-3086Jun 19, 2006
    Microsoft
    Hyperlink Object Library
    risk 0.08cvss —epss 0.56

    Stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName function in Microsoft Hyperlink Object Library (hlink.dll) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long hyperlink, as demonstrated using an Excel…

  • CVE-2006-3081Jun 19, 2006
    MySQL
    MySQL
    risk 0.05cvss —epss 0.26

    mysqld in MySQL 4.1.x before 4.1.18, 5.0.x before 5.0.19, and 5.1.x before 5.1.6 allows remote authorized users to cause a denial of service (crash) via a NULL second argument to the str_to_date function.

  • CVE-2006-3082Jun 19, 2006
    Gnupg
    Gnupg
    risk 0.04cvss —epss 0.07

    parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length (long user ID string), which could lead to an integer overflow, as…

  • CVE-2006-3012Jun 19, 2006
    Eschew.net
    Phpbannerexchange
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in phpBannerExchange before 2.0 Update 6 allows remote attackers to execute arbitrary SQL commands via the (1) login parameter in (a) client/stats.php and (b) admin/stats.php, or the (2) pass parameter in client/stats.php.

  • CVE-2006-3013Jun 19, 2006
    Eschew.net
    Phpbannerexchange
    risk 0.00cvss —epss 0.02

    Interpretation conflict in resetpw.php in phpBannerExchange before 2.0 Update 6 allows remote attackers to execute arbitrary SQL commands via an email parameter containing a null (%00) character after a valid e-mail address, which passes the validation check in the eregi PHP…

  • CVE-2006-3060Jun 19, 2006
    Webexceluk
    P.a.i.d
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in P.A.I.D 2.2 allows remote attackers to inject arbitrary web script or HTML via the (1) read parameter in index.php, (2) farea parameter in faq.php, and (3) unspecified input fields on the "My Account" login page.

  • CVE-2006-3061Jun 19, 2006
    5 Star Review
    5 Star Review
    risk 0.04cvss —epss 0.07

    Multiple cross-site scripting (XSS) vulnerabilities in 5 Star Review allow remote attackers to inject arbitrary web script or HTML via the (1) sort parameter in index2.php, (2) item_id parameter in report.php, (3) search_term parameter (aka the "search box") in…

  • CVE-2006-3062Jun 19, 2006
    Myphp Guestbook
    Myphp Guestbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in myPHP Guestbook 2.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

  • CVE-2006-3063Jun 19, 2006
    Myphp Guestbook
    Myphp Guestbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in myPHP Guestbook 1.x through 2.0.0-r1 and before 2.0.1 RC5 allow remote attackers to inject arbitrary web script or HTML via the (1) comment, (2) email, (3) homepage, (4) id, (5) name, and (6) text parameters in (a)…

  • CVE-2006-3064Jun 19, 2006
    Coppermine
    Coppermine Photo Gallery
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the add_hit function in include/function.inc.php in Coppermine Photo Gallery (CPG) 1.4.8, when "Keep detailed hit statistics" is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) referer and (2) user-agent HTTP headers.

  • CVE-2006-3065Jun 19, 2006
    Blursoft
    Blur6ex
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in engine/shards/blog.php in blur6ex 0.3.462 allows remote attackers to execute arbitrary SQL commands via the ID parameter in a proc_reply action in the blog shard. NOTE: This is a similar vulnerability to CVE-2006-1763, but the affected code and…

  • CVE-2006-3066Jun 19, 2006
    IBM
    Db2 Universal Database
    risk 0.00cvss —epss 0.02

    Buffer overflow in the TCP/IP listener in IBM DB2 Universal Database (UDB) before 8.1 FixPak 12 allows remote attackers to cause a denial of service (application crash) via a long MGRLVLLS message inside of an EXCSAT message when establishing a connection.

  • CVE-2006-3067Jun 19, 2006
    IBM
    Db2 Universal Database
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in IBM DB2 Universal Database (UDB) before 8.1 FixPak 12 allow remote attackers to cause a denial of service (application crash) via a (1) "long column list" in the (a) REPLACE INTO and (b) INSERT INTO portions of the LOAD command or a (2)…

  • CVE-2006-3068Jun 19, 2006
    IBM
    Db2 Universal Database
    risk 0.00cvss —epss 0.02

    IBM DB2 Universal Database (UDB) before 8.2 FixPak 12 allows remote attackers to cause a denial of service (application crash) by sending "incorrect information ... regarding the package name/creator," which leads to a "memory overwrite."