VYPR

CVEs

380,748 total · page 7259 of 7,615

AllCriticalHighKEV
  • CVE-2006-2678May 31, 2006
    Preprojects
    Pre News Manager
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Pre News Manager 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to (a) index.php, and the (2) nid parameter to (b) news_detail.php, (c) email_story.php, (d) thankyou.php, (e)…

  • CVE-2006-2679May 31, 2006
    Cisco Systems, Inc.
    VPN Client
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the VPN Client for Windows Graphical User Interface (GUI) (aka the VPN client dialer) in Cisco VPN Client for Windows 4.8.00.* and earlier, except for 4.7.00.0533, allows local authenticated, interactive users to gain privileges, possibly due to…

  • CVE-2006-2680May 31, 2006
    AZ Photo Album Script Pro
    AZ Photo Album Script Pro
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in AZ Photo Album Script Pro allows remote attackers to inject arbitrary web script or HTML via the gazpart parameter.

  • CVE-2006-2681May 31, 2006
    Socketmail
    Socketmail
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in SocketMail Lite and Pro 2.2.6 and earlier, when register_globals and magic_quotes are enabled, allows remote attackers to execute arbitrary PHP code via a URL in the site_path parameter to (1) index.php and (2) inc-common.php.

  • CVE-2006-2682May 31, 2006
    Openconcept
    Back End CMS
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in BE_config.php in Back-End CMS 0.7.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _PSL[classdir] parameter.

  • CVE-2006-2683May 31, 2006
    Open Medium
    CMS
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in 404.php in open-medium.CMS 0.25 allows remote attackers to execute arbitrary PHP code via a URL in the REDSYS[MYPATH][TEMPLATES] parameter.

  • CVE-2006-2684May 31, 2006
    CMS Mundo
    CMS Mundo
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the search module in CMS Mundo 1.0 allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter.

  • CVE-2006-2685May 31, 2006
    Secureideas
    Basic Analysis and Security Engine
    risk 0.07cvss —epss 0.49

    PHP remote file inclusion vulnerability in Basic Analysis and Security Engine (BASE) 1.2.4 and earlier, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the BASE_path parameter to (1) base_qry_common.php, (2) base_stat_common.php,…

  • CVE-2006-2686May 31, 2006
    Actionapps
    Actionapps
    risk 0.04cvss —epss 0.14

    PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[AA_INC_PATH] parameter in (1) cached.php3, (2) cron.php3, (3) discussion.php3, (4) filldisc.php3, (5) filler.php3, (6) fillform.php3, (7)…

  • CVE-2006-2687May 31, 2006
    PHP AGTC
    Membership System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in adduser.php in PHP-AGTC Membership System 1.1a and earlier allows remote attackers to inject arbitrary web script or HTML via the email address (useremail parameter).

  • CVE-2006-2688May 31, 2006
    Achievo
    Achievo
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the employees node (class.employee.inc) in Achievo 1.1.0 and earlier and 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the atkselector parameter.

  • CVE-2006-2689May 31, 2006
    Eva Web
    Eva Web
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in EVA-Web 2.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) debut_image parameter in (a) article-album.php3, (2) date parameter in (b) rubrique.php3, and the (3) perso and (4) aide…

  • CVE-2006-2690May 31, 2006
    Eva Web
    Eva Web
    risk 0.00cvss —epss 0.01

    An unspecified script in EVA-Web 2.1.2 and earlier, probably index.php, allows remote attackers to obtain the full path of the web server via invalid (1) perso or (2) aide parameters.

  • CVE-2006-2691May 31, 2006
    Amule
    Amule
    risk 0.00cvss —epss 0.01

    Unspecified "information leakage" vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to access arbitrary images, including dynamically generated images, via unknown vectors.

  • CVE-2006-2692May 31, 2006
    Amule
    Amule
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to read arbitrary image, HTML, or PHP files via unknown vectors, probably related to directory traversal.

  • CVE-2006-2693May 31, 2006
    Nivisec
    Hacks List
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in admin/admin_hacks_list.php in Nivisec Hacks List 1.20 and earlier for phpBB, when register_globals is enabled, allows remote attackers to read arbitrary files via a ".." in the phpEx parameter.

  • CVE-2006-2694May 31, 2006
    Scriptscenter
    Ezupload Pro
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in EzUpload Pro 2.10 allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) form.php, (2) customize.php, and (3) initialize.php.

  • CVE-2006-2695May 31, 2006
    Dian Gemilang
    Dgnews
    risk 0.00cvss —epss 0.02

    admin/upprocess.php in DGNews 1.5 and earlier allows remote attackers to execute arbitrary code by uploading scripts with arbitrary extensions to the img directory.

  • CVE-2006-2696May 31, 2006
    Easy Content
    Forums
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerabilities in Easy-Content Forums 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) startletter parameter in userview.asp and the (2) catid parameter in topics.asp.

  • CVE-2006-2697May 31, 2006
    Easy Content
    Forums
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Easy-Content Forums 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) startletter parameter in userview.asp and the (2) forumname parameter in topics.asp.

  • CVE-2006-2698May 31, 2006
    Geeklog
    Geeklog
    risk 0.00cvss —epss 0.02

    Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to (1) layout/professional/functions.php or (2) getimage.php.

  • CVE-2006-2699May 31, 2006
    Geeklog
    Geeklog
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in getimage.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to inject arbitrary HTML or web script via the image argument in a show action.

  • CVE-2006-2700May 31, 2006
    Geeklog
    Geeklog
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in admin/auth.inc.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the loginname parameter.

  • CVE-2006-2701May 31, 2006
    Geeklog
    Geeklog
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to story submission.

  • CVE-2006-2702May 31, 2006
    WordPress
    WordPress
    risk 0.00cvss —epss 0.03

    vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PC_REMOTE_ADDR HTTP header, which vars.php uses to redefine $_SERVER['REMOTE_ADDR'].

  • CVE-2006-2663May 30, 2006
    Ifusionservices
    Iflance
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in iFlance 1.1 allow remote attackers to inject arbitrary web script or HTML via certain inputs to (1) acc_verify.php or (2) project.php.

  • CVE-2006-2664May 30, 2006
    IFdate
    iFdate
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in iFdate 1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) username, (2) password fields, or certain other input text boxes.

  • CVE-2006-2665May 30, 2006
    V Webmail
    V Webmail
    risk 0.04cvss —epss 0.09

    PHP remote file inclusion vulnerability in includes/mailaccess/pop3/core.php in V-Webmail 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[pear_dir] parameter.

  • CVE-2006-2666May 30, 2006
    V Webmail
    V Webmail
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in includes/mailaccess/pop3.php in V-Webmail 1.5 through 1.6.4 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[pear_dir] parameter.

  • CVE-2006-2667May 30, 2006
    WordPress
    WordPress
    risk 0.00cvss —epss 0.15

    Direct static code injection vulnerability in WordPress 2.0.2 and earlier allows remote attackers to execute arbitrary commands by inserting a carriage return and PHP code when updating a profile, which is appended after a special comment sequence into files in (1)…

  • CVE-2006-2668May 30, 2006
    Docebo
    Docebo
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 2.05 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to (1) modules/credits/business.php, (2) modules/credits/credits.php, or (3) modules/credits/help.php.

  • CVE-2006-2669May 30, 2006
    Pre Shopping Mall
    Pre Shopping Mall
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Pre Shopping Mall 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter in search.php (the "search box"), (2) the prodid parameter in detail.php, and the (3) cid parameter in…

  • CVE-2006-2670May 30, 2006
    Calendarscripts.com
    Chatpat
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ChatPat 1.0 allow remote attackers to inject arbitrary web script or HTML via a chat message in (1) fastchat.php and (2) fastshow.php.

  • CVE-2006-2671May 30, 2006
    ChatPat
    ChatPat
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in ChatPat 1.0 allows remote attackers to execute arbitrary SQL commands via the nickname field.

  • CVE-2006-2672May 30, 2006
    Realty Pro One
    Realty Pro One
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Realty Pro One allow remote attackers to inject arbitrary web script or HTML via the (1) listingid parameter to (a) images.php, (b) index_other.php, or (c) request_info.php; (2) propertyid parameter to (d) searchlookup.php,…

  • CVE-2006-2673May 30, 2006
    E Board
    Elite Board
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search.html in Bulletin Board Elite-Board (E-Board) 1.1 allows remote attackers to inject arbitrary web script or HTML via the search box.

  • CVE-2006-2674May 30, 2006
    Tamber
    Forum
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Tamber Forum 1.9.13 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) frm_id parameter to (a) show_forum.asp, (2) a search field to (b) forum_search.asp, (3) Email address or (4) Password to (c)…

  • CVE-2006-2675May 30, 2006
    UBBThreads
    UBBThreads
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in ubbt.inc.php in UBBThreads 5.x and 6.x allows remote attackers to execute arbitrary PHP code via a URL in the (1) thispath or (2) configdir parameters.

  • CVE-2006-2659May 30, 2006
    Double Precision Incorporated
    Courier MTA
    risk 0.00cvss —epss 0.02

    libs/comverp.c in Courier MTA before 0.53.2 allows attackers to cause a denial of service (CPU consumption) via unknown vectors involving usernames that contain the "=" (equals) character, which is not properly handled during encoding.

  • CVE-2006-2661May 30, 2006
    FreeType
    Freetype
    risk 0.04cvss —epss 0.16

    ftutil.c in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a crafted font file that triggers a null dereference.

  • CVE-2006-2656May 30, 2006
    LibTIFF
    Libtiff
    risk 0.04cvss —epss 0.14

    Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via a long filename. NOTE: tiffsplit is not setuid. If there is not a common scenario under which tiffsplit is called with…

  • CVE-2006-2632May 30, 2006
    Bytehoard
    Bytehoard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Andrew Godwin ByteHoard 2.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via file descriptions.

  • CVE-2006-2633May 30, 2006
    Bytehoard
    Bytehoard
    risk 0.00cvss —epss 0.01

    Absolute path traversal vulnerability in the copy action in index.php in Andrew Godwin ByteHoard 2.1 and earlier allows remote authenticated users to create or overwrite files in other users' directories by specifying the absolute path of the directory in the infolder parameter…

  • CVE-2006-2634May 30, 2006
    Neocrome
    Seditio
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Neocrome Land Down Under (LDU) in Neocrome Seditio 102 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer field.

  • CVE-2006-2635May 30, 2006
    Tiki
    Tikiwiki CMS\/groupware
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in Tikiwiki (aka Tiki CMS/Groupware) 1.9.x allow remote attackers to inject arbitrary web script or HTML via malformed nested HTML tags such as "<script>" in (1) offset and (2) days parameters in (a)…

  • CVE-2006-2636May 30, 2006
    Katywhitton
    Newscmslite
    risk 0.03cvss —epss 0.04

    newsadmin.asp in Katy Whitton NewsCMSLite allows remote attackers to bypass authentication and gain administrative access by setting the loggedIn cookie to "xY1zZoPQ".

  • CVE-2006-2637May 30, 2006
    Tuttophp
    Morris Guestbook
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in view.php in TuttoPhp (1) Morris Guestbook 1, (2) Pretty Guestbook 1, and (3) Smile Guestbook 1 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element in the pagina…

  • CVE-2006-2638May 30, 2006
    Qjstudios
    Qjforum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in member.asp in qjForum allows remote attackers to execute arbitrary SQL commands via the uName parameter.

  • CVE-2006-2639May 30, 2006
    Phpsimplechoose
    Phpsimplechoose
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the input forms in prattmic and Master5006 PHPSimpleChoose 0.3 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element.

  • CVE-2006-2640May 30, 2006
    Omegasoft
    Interneserviceslosungen
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in OmegaMw7a.ASP in OMEGA (aka Omegasoft) INterneSErvicesLosungen (INSEL) allows remote attackers to inject arbitrary web script or HTML via the WCE parameter.