VYPR

CVEs

380,877 total · page 7254 of 7,618

AllCriticalHighKEV
  • CVE-2006-3069Jun 19, 2006
    Iglooweb
    Doublespeak
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in DoubleSpeak 0.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the config[private] parameter in multiple files, as demonstrated by (1) index.php, (2) faq.php, and (3) hardware.php. NOTE:…

  • CVE-2006-3070Jun 19, 2006
    Zeroboard
    Zeroboard
    risk 0.00cvss —epss 0.02

    write_ok.php in Zeroboard 4.1 pl8, when installed on Apache with mod_mime, allows remote attackers to bypass restrictions for uploading files with executable extensions by uploading a .htaccess file that with an AddType directive that assigns an executable module to files with…

  • CVE-2006-3071Jun 19, 2006
    Anton Belev
    Mp3 Search Archive
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in MP3 Search/Archive 1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter, as used by the "search box", and (2) res parameter.

  • CVE-2006-3072Jun 19, 2006
    Symantec
    Security Information Manager
    risk 0.00cvss —epss 0.00

    M4 Macro Library in Symantec Security Information Manager before 4.0.2.29 HOTFIX 1 allows local users to execute arbitrary commands via crafted "rule definitions", which produces dangerous Java code during M4 transformation.

  • CVE-2006-3073Jun 19, 2006
    Cisco Systems, Inc.
    Asa 5500
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the WebVPN feature in the Cisco VPN 3000 Series Concentrators and Cisco ASA 5500 Series Adaptive Security Appliances (ASA), when in WebVPN clientless mode, allow remote attackers to inject arbitrary web script or HTML via…

  • CVE-2006-3074Jun 19, 2006
    Kaspersky Lab
    Internet Security
    risk 0.04cvss —epss 0.07

    klif.sys in Kaspersky Internet Security 6.0 and 7.0, Kaspersky Anti-Virus (KAV) 6.0 and 7.0, KAV 6.0 for Windows Workstations, and KAV 6.0 for Windows Servers does not validate certain parameters to the (1) NtCreateKey, (2) NtCreateProcess, (3) NtCreateProcessEx, (4)…

  • CVE-2006-3075Jun 19, 2006
    Picturedis
    Picturedis Professional
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in PictureDis Professional 1.33 Build 234 and earlier and PictureDis Photoalbum 4.82 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to files in photoalbum/ including (1)…

  • CVE-2006-3076Jun 19, 2006
    Blue Dragon
    Phpbluedragon CMS
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in software_upload/public_includes/pub_templates/vphptree/template.php in PhpBlueDragon CMS 2.9.1 allows remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPath parameter.

  • CVE-2006-3077Jun 19, 2006
    Axent
    Axentguestbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in guestbook.cfm in aXentGuestbook 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the startrow parameter.

  • CVE-2006-3078Jun 19, 2006
    Apboard
    Apboard
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in APBoard 2.2-r3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) PHPSESSID parameter in board.php and (2) viewcatmod parameter in main.php.

  • CVE-2006-3079Jun 19, 2006
    Sspwiz
    Sspwiz Plus
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.cfm in SSPwiz Plus 1.0.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the message parameter.

  • CVE-2006-3080Jun 19, 2006
    Axent
    Axentforum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in viewposts.cfm in aXentForum II and earlier allows remote attackers to inject arbitrary web script or HTML via the startrow parameter.

  • CVE-2006-3059Jun 17, 2006
    Microsoft
    Excel
    risk 0.06cvss —epss 0.41

    Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors. NOTE: this is a different vulnerability than CVE-2006-3086.

  • CVE-2006-2909Jun 16, 2006
    Picozip
    Picozip
    risk 0.04cvss —epss 0.09

    Stack-based buffer overflow in the info tip shell extension (zipinfo.dll) in PicoZip 4.01 allows remote attackers to execute arbitrary code via a long filename in an (1) ACE, (2) RAR, or (3) ZIP archive, which is triggered when the user moves the mouse over the archive.

  • CVE-2006-3043Jun 16, 2006
    CreaFrameXe
    CFXe CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.cfm in CreaFrameXe (CFXe) CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the voltext_suche parameter.

  • CVE-2006-3044Jun 16, 2006
    Logisphere
    Logisphere
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in LogiSphere 1.6.0 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected in an error page.

  • CVE-2006-3045Jun 16, 2006
    Foing
    Foing
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in manage_songs.php in Foing 0.7.0e and earlier allows remote attackers to execute arbitrary PHP code via a URL in the foing_root_path parameter.

  • CVE-2006-3046Jun 16, 2006
    Subtextproject
    Subtext
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the admin login feature in Subtext 1.5, in a multiblog setup, allows remote administrators of one blog to login to another blog.

  • CVE-2006-3047Jun 16, 2006
    Tiki
    Tiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  • CVE-2006-3048Jun 16, 2006
    Tiki
    Tiki
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.

  • CVE-2006-3049Jun 16, 2006
    Mole Group Ticket Booking Script
    Mole Group Ticket Booking Script
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in booking3.php in Mole Group Ticket Booking Script allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) address1, (3) address2, (4) county, (5) postcode, (6) email, (7) phone, or (8) mobile…

  • CVE-2006-3050Jun 16, 2006
    SixCMS
    SixCMS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in detail.php in SixCMS 6.0, and other versions before 6.0.6patch2, allows remote attackers to read arbitrary files via a .. (dot dot) sequence and trailing null (%00) byte in the template parameter.

  • CVE-2006-3051Jun 16, 2006
    SixCMS
    SixCMS
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in list.php in SixCMS 6.0, and other versions before 6.0.6patch2, allows remote attackers to inject arbitrary script code or HTML via the page parameter.

  • CVE-2006-3052Jun 16, 2006
    Cescripts
    Event Registration Paypal
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Event Registration allows remote attackers to inject arbitrary web script or HTML via the (1) event_id parameter to view-event-details.php or (2) select_events parameter to event-registration.php. NOTE: the provenance of this…

  • CVE-2006-3053Jun 16, 2006
    Phorum
    Phorum
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHORUM[http_path] parameter. NOTE: this issue has been disputed by the vendor, who states "common.php is checked on the very…

  • CVE-2006-3054Jun 16, 2006
    Vbzoom
    Vbzoom
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in VBZooM 1.11 allow remote attackers to execute arbitrary SQL commands via the (1) sobjectID or (2) MAINID parameters to (a) show.php or (3) MainID parameter to (b) subject.php.

  • CVE-2006-3055Jun 16, 2006
    Vbzoom
    Vbzoom
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in VBZooM 1.02 allow remote attackers to execute arbitrary SQL commands via the (1) QuranID, (2) ShowByQuranID, or (3) Action parameters to meaning.php.

  • CVE-2006-3056Jun 16, 2006
    Vbzoom
    Vbzoom
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in language.php in VBZooM 1.01 allows remote attackers to execute arbitrary SQL commands via the Action parameter.

  • CVE-2006-3057Jun 16, 2006
    Networkmanager
    dhcp (dhcdbd)
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in NetworkManager daemon for DHCP (dhcdbd) allows remote attackers to cause a denial of service (crash) via certain invalid DHCP responses that trigger memory corruption.

  • CVE-2006-2195Jun 15, 2006
    Horde (software)
    Horde
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in horde 3 (horde3) before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via (1) templates/problem/problem.inc and (2) test.php.

  • CVE-2006-2197Jun 15, 2006
    Wvware
    Wv2
    risk 0.00cvss —epss 0.03

    Integer overflow in wv2 before 0.2.3 might allow context-dependent attackers to execute arbitrary code via a crafted Microsoft Word document.

  • CVE-2006-2449Jun 15, 2006
    KDE
    Kde
    risk 0.00cvss —epss 0.00

    KDE Display Manager (KDM) in KDE 3.2.0 up to 3.5.3 allows local users to read arbitrary files via a symlink attack related to the session type for login.

  • CVE-2006-2916HigJun 15, 2006
    KDE
    Arts
    risk 0.51cvss 7.8epss 0.00

    artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing setuid to fail, which prevents artsd from dropping privileges.

  • CVE-2006-3019Jun 15, 2006
    Phpcms
    Phpcms
    risk 0.04cvss —epss 0.08

    Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMS_INCLUDEPATH parameter to files in parser/include/ including (1) class.parser_phpcms.php, (2) class.session_phpcms.php, (3)…

  • CVE-2006-3020Jun 15, 2006
    WS Album
    WS-Album
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in FullPhoto.asp in WS-Album 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) image and (2) PublisedDate parameters.

  • CVE-2006-3021Jun 15, 2006
    BlueCollar
    iGallery
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in BlueCollar i-Gallery 4.1 PLUS and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) n and (2) d parameters in (a) login.asp and the d parameter in (b) igallery.asp.

  • CVE-2006-3022Jun 15, 2006
    Fips
    fipsGallery
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in zoom.php in fipsGallery 1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter.

  • CVE-2006-3023Jun 15, 2006
    Uapplication
    Uphotogallery
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in thumbnails.asp in Uapplication Uphotogallery 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) s and (2) block parameters.

  • CVE-2006-3024Jun 15, 2006
    Evgenius
    Counter
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in EvGenius Counter 3.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the page parameter in (1) monthly.php and (2) daily.php.

  • CVE-2006-3025Jun 15, 2006
    Chris Lea
    Lucid Calendar
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Cal.PHP3 in Chris Lea Lucid Calendar 0.22 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. NOTE: the provenance of this information is unknown; the details are obtained from third party…

  • CVE-2006-3026Jun 15, 2006
    Clicktech
    Clickgallery
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ClickGallery 5.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gallery_id parameter in gallery.asp and (2) parentcurrentpage parameter in view_gallery.asp.

  • CVE-2006-3027Jun 15, 2006
    Enthrallweb
    Ephotos
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in Enthrallwebe ePhotos 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) CAT_ID parameter in (a) subphotos.asp and (b) subLevel2.asp, the (2) AL_ID parameter in (c) photo.asp, and the (3) SUB_ID parameter…

  • CVE-2006-3028Jun 15, 2006
    Minerva
    Minerva
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in stat_modules/users_age/module.php in Minerva 2.0.8a Build 237 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

  • CVE-2006-3029Jun 15, 2006
    Clicktech
    Clickcart
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in default.asp in ClickTech Clickcart 6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat parameter.

  • CVE-2006-3030Jun 15, 2006
    Dwzone
    Dwzone Shopping Cart
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in DwZone Shopping Cart 1.1.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ToCategory and (2) FromCategory parameters to (a) ProductDetailsForm.asp and (3) UserName and (4) Password…

  • CVE-2006-3031Jun 15, 2006
    FipsCMS
    fipsCMS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.asp in fipsCMS 4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) w, (2) phcat, (3) dayid, and (4) calw parameters.

  • CVE-2006-3032Jun 15, 2006
    XTREME ASP
    Photo Gallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Xtreme ASP Photo Gallery 1.05 and earlier, and possibly 2.0 (trial), allow remote attackers to inject arbitrary web script or HTML via the (1) catname and (2) total parameters in (a) displaypic.asp, and the (3) catname…

  • CVE-2006-3033Jun 15, 2006
    Myscrapbook
    Myscrapbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MyScrapbook 3.1 allows remote attackers to inject arbitrary web script or HTML via the input box in singlepage.php when submitting scrapbook pages.

  • CVE-2006-3034Jun 15, 2006
    Myscrapbook
    Myscrapbook
    risk 0.00cvss —epss 0.01

    MyScrapbook 3.1 allows remote attackers to obtain sensitive information via a direct request to files in the txt-db-api directory such as txt-db-api/sql.php, which reveals the path in an error message.

  • CVE-2006-3035Jun 15, 2006
    Myscrapbook
    Myscrapbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in addwords.php in MyScrapbook 3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) comment parameters. NOTE: the provenance of this information is unknown; the details are…