VYPR

CVEs

380,758 total · page 7258 of 7,616

AllCriticalHighKEV
  • CVE-2006-2765Jun 2, 2006
    Interlink
    Advantage
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in news_information.php in Interlink Advantage allows remote attackers to inject arbitrary web script or HTML via the flag parameter.

  • CVE-2006-2308Jun 2, 2006
    EServ
    EServ/3
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the IMAP service in EServ/3 3.25 allows remote authenticated users to read other user's email messages, create/rename arbitrary directories on the system, and delete empty directories via directory traversal sequences in the (1) CREATE, (2)…

  • CVE-2006-2309Jun 2, 2006
    EServ
    EServ/3
    risk 0.00cvss —epss 0.02

    The HTTP service in EServ/3 3.25 allows remote attackers to obtain sensitive information via crafted HTTP requests containing dot, space, and slash characters, which reveals the source code of script files.

  • CVE-2006-2753Jun 1, 2006
    MySQL
    MySQL
    risk 0.00cvss —epss 0.04

    SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22 allows context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in character sets such as SJIS, BIG5, and GBK, which are not properly handled when the…

  • CVE-2006-2754Jun 1, 2006
    OpenLDAP
    Openldap
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in st.c in slurpd for OpenLDAP before 2.3.22 might allow attackers to execute arbitrary code via a long hostname.

  • CVE-2006-2439Jun 1, 2006
    Zipcentral
    Zipcentral
    risk 0.04cvss —epss 0.07

    Stack-based buffer overflow in ZipCentral 4.01 allows remote user-assisted attackers to execute arbitrary code via a ZIP archive containing a long filename.

  • CVE-2006-2703Jun 1, 2006
    Redcarpet Project
    Redcarpet
    risk 0.00cvss —epss 0.01

    The RedCarpet command-line client (rug) does not verify SSL certificates from a server, which allows remote attackers to read network traffic and execute commands via a man-in-the-middle (MITM) attack.

  • CVE-2006-2725Jun 1, 2006
    Eggblog
    Eggblog
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in rss/posts.php in Eggblog before 3.07 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-2726Jun 1, 2006
    Fastpublish
    CMS
    risk 0.05cvss —epss 0.19

    PHP remote file inclusion vulnerability in Fastpublish CMS 1.6.9.d allows remote attackers to include arbitrary files via the config[fsBase] parameter in (1) drucken.php, (2) drucken2.php, (3) email_an_benutzer.php, (4) rechnung.php, (5) suche/search.php and (6)…

  • CVE-2006-2727Jun 1, 2006
    Eggblog
    Eggblog
    risk 0.00cvss —epss 0.02

    home/register.php in Eggblog before 3.0 allows remote attackers to change the password of administrators and possibly other users via a modified username parameter.

  • CVE-2006-2728Jun 1, 2006
    Jan Chmelik
    Photoalbum Bandw
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in superalbum/index.php in Photoalbum B&W 1.3 allows remote attackers to inject arbitrary web script or HTML via the pic parameter.

  • CVE-2006-2729Jun 1, 2006
    Photoalbum B&W
    Photoalbum B&W
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in superalbum/index.php in Photoalbum B&W 1.3 allows remote attackers to inject arbitrary web script or HTML via the gal parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-2730Jun 1, 2006
    Hot Open Tickets
    Hot Open Tickets
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin/lib_action_step.php in Hot Open Tickets (HOT) 11012004_ver2f, when register_globals is enabled, allows remote attackers to include arbitrary files via the GLOBALS[CLASS_PATH] parameter. NOTE: this issue might be resultant from a…

  • CVE-2006-2731Jun 1, 2006
    Enigma Haber
    Enigma Haber
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in Enigma Haber 4.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a) e_mesaj_yas.asp, (b) edi_haber.asp, and (c) haber_devam.asp; (2) hid parameter in (d) yazdir.asp and (e) yorum.asp, and…

  • CVE-2006-2732Jun 1, 2006
    Mini Nuke
    Mini Nuke
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in Your_Account.asp in Mini-Nuke 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) yas_1, (2) yas_2, and (3) yas_3 parameters.

  • CVE-2006-2733Jun 1, 2006
    Mini Nuke
    Mini Nuke
    risk 0.00cvss —epss 0.01

    membership.asp in Mini-Nuke 2.3 and earlier uses plaintext security codes, which allows remote attackers to register multiple times via automated scripts.

  • CVE-2006-2734Jun 1, 2006
    Mini Nuke
    Mini Nuke
    risk 0.00cvss —epss 0.02

    enter.asp in Mini-Nuke 2.3 and earlier makes it easier for remote attackers to conduct password guessing attacks by setting the guvenlik parameter to the same value as the hidden gguvenlik parameter, which bypasses a verification step because the gguvenlik parameter is assumed…

  • CVE-2006-2735Jun 1, 2006
    Activity Mod Plus
    Activity Mod Plus
    risk 0.04cvss —epss 0.07

    PHP remote file inclusion vulnerability in language/lang_english/lang_activity.php in Activity MOD Plus (Amod) 1.1.0, as used with phpBB when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. NOTE:…

  • CVE-2006-2736Jun 1, 2006
    Blend Portal
    Blend Portal
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in blend_data/blend_common.php in Blend Portal 1.2.0, as used with phpBB when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. NOTE: This is a similar…

  • CVE-2006-2737Jun 1, 2006
    Nukedit
    Nukedit
    risk 0.03cvss —epss 0.03

    utilities/register.asp in Nukedit 4.9.6 and earlier allows remote attackers to create new users as part of arbitrary groups, including the administrative group, via a modified groupid parameter when creating a user via the addDB action.

  • CVE-2006-2738Jun 1, 2006
    Open-Xchange
    Open Xchange Server
    risk 0.00cvss —epss 0.02

    The open source version of Open-Xchange 0.8.2 and earlier uses a static default username and password with a valid login shell in the initfile for the ldap-server, which allows remote attackers to access any server where the default has not been changed.

  • CVE-2006-2739Jun 1, 2006
    Epicdesigns
    tinyBB
    risk 0.04cvss —epss 0.09

    PHP remote file inclusion vulnerability in footers.php in Epicdesigns tinyBB 0.3, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the tinybb_footers parameter.

  • CVE-2006-2740Jun 1, 2006
    Epicdesigns
    tinyBB
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in Epicdesigns tinyBB 0.3 allow remote attackers to execute arbitrary SQL commands via the (1) q parameter in (a) forgot.php, and the (2) username and (3) password parameters in (b) login.php, and other unspecified vectors.

  • CVE-2006-2741Jun 1, 2006
    Epicdesigns
    tinyBB
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Epicdesigns tinyBB 0.3 allow remote attackers to inject arbitrary web script or HTML via the q parameter in forgot.php, which is echoed in an error message, and other unspecified vectors.

  • CVE-2006-2742Jun 1, 2006
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to execute arbitrary SQL commands via the (1) count and (2) from variables to (a) database.mysql.inc, (b) database.pgsql.inc, and (c) database.mysqli.inc.

  • CVE-2006-2743Jun 1, 2006
    Drupal
    Drupal
    risk 0.00cvss —epss 0.11

    Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which allows remote attackers to upload, modify, or execute arbitrary files in the files directory.

  • CVE-2006-2744Jun 1, 2006
    Facile Interactive Web
    Facile Interactive Web
    risk 0.04cvss —epss 0.10

    PHP remote file inclusion vulnerability in p-popupgallery.php in F@cile Interactive Web 0.8.41 through 0.8.5 allows remote attackers to execute arbitrary PHP code via a URL in the l parameter.

  • CVE-2006-2745Jun 1, 2006
    Facile Interactive Web
    Facile Interactive Web
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in F@cile Interactive Web 0.8.5 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) pathfile parameter in (a) p-editpage.php and (b) p-editbox.php, and the (2)…

  • CVE-2006-2746Jun 1, 2006
    Facile Interactive Web
    Facile Interactive Web
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in F@cile Interactive Web 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) lang parameter in index.php, and the (2) mytheme and (3) myskin parameters in multiple "p-themes"…

  • CVE-2006-2747Jun 1, 2006
    Fredi Bach
    Phpmydesktop Arcade
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in PhpMyDesktop|arcade 1.0 FINAL allows remote attackers to read arbitrary files or execute PHP code via a .. (dot dot) sequence and trailing null (%00) byte in the subsite parameter in a showsubsite todo.

  • CVE-2006-2748Jun 1, 2006
    Open Searchable Image Catalogue
    Open Searchable Image Catalogue
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the do_mysql_query function in core.php for Open Searchable Image Catalogue (OSIC) before 0.7.0.1 allows remote attackers to inject arbitrary SQL commands via multiple vectors, as demonstrated by the (1) type parameter in adminfunctions.php and the…

  • CVE-2006-2749Jun 1, 2006
    Open Searchable Image Catalogue
    Open Searchable Image Catalogue
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in search.php in Open Searchable Image Catalogue (OSIC) 0.7.0.1 and earlier allows remote attackers to inject arbitrary SQL commands via the (1) txtCustomField and (2) CustomFieldID array parameters.

  • CVE-2006-2750Jun 1, 2006
    Open Searchable Image Catalogue
    Open Searchable Image Catalogue
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the do_mysql_query function in core.php for Open Searchable Image Catalogue (OSIC) before 0.7.0.1 allows remote attackers to inject arbitrary web scripts or HTML via failed SQL queries, which is reflected in an error message.

  • CVE-2006-2751Jun 1, 2006
    Open Searchable Image Catalogue
    Open Searchable Image Catalogue
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Open Searchable Image Catalogue (OSIC) 0.7.0.1 and earlier allows remote attackers to inject arbitrary web scripts or HTML via the item_list parameter in search.php.

  • CVE-2006-2752Jun 1, 2006
    Novell
    Linux Desktop
    risk 0.00cvss —epss 0.01

    The RedCarpet /etc/ximian/rcd.conf configuration file in Novell Linux Desktop 9 and SUSE SLES 9 has world-readable permissions, which allows attackers to obtain the rc (RedCarpet) password.

  • CVE-2006-2718Jun 1, 2006
    Jiwa
    Financials
    risk 0.00cvss —epss 0.02

    JIWA Financials 6.4.14 passes a Microsoft SQL Server account's username and password, and the name of a data source, to a Crystal Reports .rpt file, which allows remote authenticated users to execute certain standard stored procedures by referencing them in a user-written .rpt…

  • CVE-2006-2719Jun 1, 2006
    Jiwa
    Financials
    risk 0.00cvss —epss 0.00

    JIWA Financials 6.4.14 stores usernames and passwords for all accounts in cleartext in the HR_Staff table in Microsoft SQL Server, and sends the usernames and passwords in cleartext to the application's SQL Server ODBC driver, which might allow context-dependent attackers to…

  • CVE-2006-2720Jun 1, 2006
    Variomat
    Variomat
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in news.php in VARIOMAT allows remote attackers to execute arbitrary SQL commands via the subcat parameter.

  • CVE-2006-2721Jun 1, 2006
    Variomat
    Variomat
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in news.php in VARIOMAT allows remote attackers to inject arbitrary HTML or web script via the subcat parameter. NOTE: this issue might be resultant from SQL injection.

  • CVE-2006-2722Jun 1, 2006
    Out Of The Trees Web Design
    Selectapix
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in view_album.php in SelectaPix 1.4 allows remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party sources.

  • CVE-2006-2723Jun 1, 2006
    Mozilla Corporation
    Firefox
    risk 0.03cvss —epss 0.03

    Unspecified versions of Mozilla Firefox allow remote attackers to cause a denial of service (crash) via a web page that contains a large number of nested marquee tags. NOTE: a followup post indicated that the initial report could not be verified.

  • CVE-2006-2724Jun 1, 2006
    Punbb
    Punbb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in PunBB 1.2.11 allows remote authenticated administrators to inject arbitrary HTML or web script to other administrators via the "Admin note" feature, a different vulnerability than CVE-2006-2227.

  • CVE-2006-2704May 31, 2006
    Secure Elements
    Class 5 Enterprise Vulnerability Management
    risk 0.00cvss —epss 0.02

    Secure Elements Class 5 AVR server and client (aka C5 EVM) before 2.8.1 send messages in cleartext, which allows remote attackers to read sensitive vulnerability information.

  • CVE-2006-2705May 31, 2006
    Secure Elements
    Class 5 Enterprise Vulnerability Management
    risk 0.00cvss —epss 0.02

    Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 allows remote attackers to cause an unspecified denial of service via a large number of forged client registration messages.

  • CVE-2006-2706May 31, 2006
    Secure Elements
    Class 5 Enterprise Vulnerability Management
    risk 0.00cvss —epss 0.02

    Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 allows remote attackers to cause a denial of service via forged "session start" messages that cause AVR to connect to arbitrary hosts.

  • CVE-2006-2707May 31, 2006
    Secure Elements
    Class 5 Enterprise Vulnerability Management
    risk 0.00cvss —epss 0.01

    Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 does not validate the peer certificate when obtaining an update, which could allow remote attackers to distribute malicious updates to clients.

  • CVE-2006-2708May 31, 2006
    Secure Elements
    Class 5 AVR
    risk 0.00cvss —epss 0.02

    Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 allows remote attackers to read portions of process memory via a modified size for (1) EM_GET_CE_PARAMETER and (2) EM_SET_CE_PARAMETER messages, which leads to a buffer overflow (probably an over-read).

  • CVE-2006-2709May 31, 2006
    Secure Elements
    Class 5 AVR
    risk 0.00cvss —epss 0.04

    Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 do not validate the source address of a message, which allows remote attackers to (1) execute arbitrary code on a client or (2) forge messages to the server.

  • CVE-2006-2710May 31, 2006
    Secure Elements
    Class 5 AVR
    risk 0.00cvss —epss 0.02

    Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 uses the same invariant RSA key for all installations, which allows remote attackers with the key to decrypt communications.

  • CVE-2006-2711May 31, 2006
    Secure Elements
    Class 5 AVR
    risk 0.00cvss —epss 0.02

    Secure Elements Class 5 AVR (aka C5 EVM) 2.8.1 and earlier, and possibly later 2.8.x releases, uses the same initialization vector and key for each message session, which allows remote attackers to obtain potentially sensitive information about messages.