VYPR

CVEs

380,385 total · page 7261 of 7,608

AllCriticalHighKEV
  • CVE-2006-2234May 5, 2006
    Tyrocms
    Tyrocms
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in TyroCMS beta 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) a javascript URI in an img BBCode tag, or a JavaScript event in a (2) url BBCode tag or (3) color BBCode tag.

  • CVE-2006-2235May 5, 2006
    Codemunkyx
    Simple Poll
    risk 0.00cvss —epss 0.03

    CodeMunkyX (aka free-php.net) Simple Poll 1.0, when authentication is not required for the admin directory, allows remote attackers to gain administrative privileges by appending /admin/ to the top-level URI of the application.

  • CVE-2006-1052May 5, 2006
    Linux
    SELinux
    risk 0.00cvss —epss 0.00

    The selinux_ptrace logic in hooks.c in SELinux for Linux 2.6.6 allows local users with ptrace permissions to change the tracer SID to an SID of another process.

  • CVE-2006-1516May 5, 2006
    MySQL
    MySQL
    risk 0.06cvss —epss 0.36

    The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to read portions of memory via a username without a trailing null byte, which causes a buffer over-read.

  • CVE-2006-1517May 5, 2006
    MySQL
    MySQL
    risk 0.00cvss —epss 0.05

    sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to obtain sensitive information via a COM_TABLE_DUMP request with an incorrect packet length, which includes portions of memory in an error message.

  • CVE-2006-1518May 5, 2006
    MySQL
    MySQL
    risk 0.06cvss —epss 0.38

    Buffer overflow in the open_table function in sql_base.cc in MySQL 5.0.x up to 5.0.20 might allow remote attackers to execute arbitrary code via crafted COM_TABLE_DUMP packets with invalid length values.

  • CVE-2006-2203May 5, 2006
    Kerio Technologies
    Kerio Mailserver
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Kerio MailServer before 6.1.4 has unknown impact and remote attack vectors related to a "possible bypass of attachment filter."

  • CVE-2006-2204May 5, 2006
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the topic deletion functionality (post_delete function in func_mod.php) for Invision Power Board 2.1.5 allows remote authenticated moderators to execute arbitrary SQL commands via the selectedpids parameter, which bypasses an integer value check…

  • CVE-2006-2205May 5, 2006
    NetBSD
    NetBSD
    risk 0.00cvss —epss 0.00

    The audio_write function in NetBSD 3.0 allows local users to cause a denial of service (kernel crash) by using the audiosetinfo ioctl to change the sample rate of an audio device.

  • CVE-2006-2206May 5, 2006
    Ultravnc
    Ultravnc
    risk 0.00cvss —epss 0.02

    The MS-Logon authentication scheme in UltraVNC (aka Ultr@VNC) 1.0.1 uses weak encryption (XOR) for challenge/response, which allows remote attackers to gain privileges by sniffing and decrypting passwords.

  • CVE-2006-2208May 5, 2006
    Planetluc
    Mynews
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in mynews.inc.php in MyNews 1.6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) hash and (2) page parameters.

  • CVE-2006-2209May 5, 2006
    PHP Arena
    Pacheckbook
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in PHP Arena paCheckBook 1.1 allow remote attackers to execute arbitrary SQL commands via (1) the transtype parameter in an add action or (2) entry parameter in an edit action. NOTE: the provenance of this information is…

  • CVE-2006-2210May 5, 2006
    321soft
    PHP Gallery
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in 321soft PhP-Gallery 0.9 allows remote attackers to inject arbitrary web script or HTML via the path parameter. NOTE: this issue might be resultant from the directory traversal vulnerability.

  • CVE-2006-2211May 5, 2006
    321soft
    PHP Gallery
    risk 0.03cvss —epss 0.03

    Absolute path traversal vulnerability in index.php in 321soft PhP-Gallery 0.9 allows remote attackers to browse arbitrary directories via the path parameter.

  • CVE-2006-2212May 5, 2006
    Karjasoft
    Sami FTP Server
    risk 0.08cvss —epss 0.59

    Buffer overflow in KarjaSoft Sami FTP Server 2.0.2 and earlier allows remote attackers to execute arbitrary code via a long (1) USER or (2) PASS command.

  • CVE-2006-2213May 5, 2006
    W1.fi
    Hostapd
    risk 0.00cvss —epss 0.02

    Hostapd 0.3.7-2 allows remote attackers to cause a denial of service (segmentation fault) via an unspecified value in the key_data_length field of an EAPoL frame.

  • CVE-2006-2214May 5, 2006
    4images
    4images
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in 4images 1.7.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sessionid parameter in (1) top.php and (2) member.php. NOTE: this issue has also been reported to affect 1.7.2.

  • CVE-2006-2216May 5, 2006
    Devsyn
    Open Bulletin Board
    risk 0.00cvss —epss 0.01

    Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to obtain the full path of the web server via an invalid pforums parameter to (1) misc.php and (2) member.php.

  • CVE-2006-2217May 5, 2006
    Invision Power Services
    Power Board
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Invision Power Board allows remote attackers to execute arbitrary SQL commands via the pid parameter in a reputation action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2006-2218May 5, 2006
    Microsoft
    Internet Explorer
    risk 0.03cvss —epss 0.33

    Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "exceptional conditions" that trigger memory corruption, as demonstrated using an exception handler and nested object tags, a variant of…

  • CVE-2006-2202May 4, 2006
    Invision Power Services
    Gallery
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in post.php in Invision Gallery 2.0.6 allows remote attackers to execute arbitrary SQL commands via the album parameter.

  • CVE-2006-2201May 4, 2006
    Ca
    Resource Initialization Manager
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in CA Resource Initialization Manager (CAIRIM) 1.x before 20060502, as used in z/OS Common Services and the LMP component in multiple products, allows attackers to violate integrity via a certain "problem state program" that uses SVC to gain access to…

  • CVE-2006-2163May 4, 2006
    Desert Dog Software
    Pinnacle Cart
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Pinnacle Cart 3.33 and earlier allows remote attackers to inject arbitrary web script or HTML via the setbackurl parameter.

  • CVE-2006-2164May 4, 2006
    Pentasoft Corp.
    Shopping Cart
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Avactis Shopping Cart 0.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) category_id parameter in (a) store_special_offers.php and (b) store.php, and (2) prod_id parameter in (c) cart.php and (d)…

  • CVE-2006-2165May 4, 2006
    Pentasoft Corp.
    Shopping Cart
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Avactis Shopping Cart 0.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) category_id parameter in (a) store_special_offers.php and (b) store.php and (2) prod_id parameter in (c)…

  • CVE-2006-2166May 4, 2006
    Cisco Systems, Inc.
    Unity Express
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the HTTP management interface in Cisco Unity Express (CUE) 2.2(2) and earlier, when running on any CUE Advanced Integration Module (AIM) or Network Module (NM), allows remote authenticated attackers to reset the password for any user with an expired…

  • CVE-2006-2167May 4, 2006
    Sloughflash
    Sf Users
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in SloughFlash SF-Users 1.0, possibly in register.php, allows remote attackers to inject arbitrary web script or HTML by setting the username field to contain JavaScript in the SRC attribute of an IMG element.

  • CVE-2006-2168May 4, 2006
    Fileprotection Express
    Fileprotection Express
    risk 0.00cvss —epss 0.02

    FileProtection Express 1.0.1 and earlier allows remote attackers to bypass authentication via a cookie with an Admin value of 1.

  • CVE-2006-2169May 4, 2006
    Bestpractical
    Request Tracker
    risk 0.00cvss —epss 0.01

    RT: Request Tracker 3.5.HEAD allows remote attackers to obtain sensitive information via the Rows parameter in Dist/Display.html, which reveals the installation path in an error message.

  • CVE-2006-2170May 4, 2006
    Argosoft
    FTP Server
    risk 0.00cvss —epss 0.05

    Buffer overflow in ArgoSoft FTP Server 1.4.3.6 allows remote attackers to execute arbitrary code via Unicode in the RNTO command, as demonstrated by the Infigo FTPStress Fuzzer.

  • CVE-2006-2171May 4, 2006
    WarFTPd
    WarFTPd
    risk 0.00cvss —epss 0.05

    Buffer overflow in WDM.exe in WarFTPD allows remote attackers to execute arbitrary code via unspecified arguments, as demonstrated by the Infigo FTPStress Fuzzer.

  • CVE-2006-2172May 4, 2006
    Gene6
    G6 FTP Server
    risk 0.00cvss —epss 0.04

    Buffer overflow in Gene6 FTP Server 3.1.0 allows remote authenticated attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long argument to (1) MKD or (2) XMKD, as demonstrated by the Infigo FTPStress Fuzzer.

  • CVE-2006-2173May 4, 2006
    Filezilla
    Filezilla Server
    risk 0.01cvss —epss 0.07

    Buffer overflow in FileZilla FTP Server 2.2.22 allows remote authenticated attackers to cause a denial of service and possibly execute arbitrary code via a long (1) PORT or (2) PASS followed by the MLSD command, or (2) the remote server interface, as demonstrated by the Infigo…

  • CVE-2006-2174May 4, 2006
    Virtual Hosting Control System
    Virtual Hosting Control System
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in admin/server_day_stats.php in Virtual Hosting Control System (VHCS) allow remote attackers to inject arbitrary web script or HTML via the (1) day, (2) month, or (3) year parameter.

  • CVE-2006-2175May 4, 2006
    Ftrainsoft
    Fast Click
    risk 0.04cvss —epss 0.09

    PHP remote file inclusion vulnerability in FtrainSoft Fast Click 2.3.8 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) show.php or (2) top.php.

  • CVE-2006-2176May 4, 2006
    Linkliste
    Linkliste
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in links.php in PHP Linkliste 1.0b allow remote attackers to inject arbitrary web script or HTML via the (1) new_input, (2) new_url, or (3) new_name parameter.

  • CVE-2006-2177May 4, 2006
    Bitdamaged
    Geoblog
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in viewcat.php in geoBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.

  • CVE-2006-2178May 4, 2006
    CyberBuild
    CyberBuild
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in CyberBuild allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to login.asp, (2) ProductIndex parameter to browse0.htm, (3) rowcolor parameter to result.asp, or (4) heading parameter…

  • CVE-2006-2179May 4, 2006
    CyberBuild
    CyberBuild
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in CyberBuild allow remote attackers to execute arbitrary SQL commands via the (1) SessionID parameter to login.asp or (2) ProductIndex parameter to browse0.htm.

  • CVE-2006-2180May 4, 2006
    Golden FTP Server Pro
    Golden FTP Server Pro
    risk 0.04cvss —epss 0.07

    Buffer overflow in Golden FTP Server Pro 2.70 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long argument to the (1) NLST or (2) APPE commands, as demonstrated by the Infigo FTPStress Fuzzer.

  • CVE-2006-2181May 4, 2006
    Albinator
    Albinator
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in Albinator 2.0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) cid parameter to dlisting.php or (2) preloadSlideShow parameter to showpic.php.

  • CVE-2006-2182May 4, 2006
    Albinator
    Albinator
    risk 0.04cvss —epss 0.08

    Multiple PHP remote file inclusion vulnerabilities in (1) eday.php, (2) eshow.php, or (3) forgot.php in albinator 2.0.8 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the Config_rootdir parameter.

  • CVE-2006-2183May 4, 2006
    Truecrypt Foundation
    Truecrypt
    risk 0.00cvss —epss 0.01

    Untrusted search path vulnerability in Truecrypt 4.1, when running suid root on Linux, allows local users to execute arbitrary commands and gain privileges via a modified PATH environment variable that references a malicious mount command.

  • CVE-2006-2184May 4, 2006
    Chadha
    Phpkb Knowledge Base
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in PHPKB Knowledge Base allows remote attackers to inject arbitrary web script or HTML via the searchkeyword parameter. NOTE: the issue was originally disputed by the vendor, but on 20060519, the vendor notified CVE that…

  • CVE-2006-2186May 4, 2006
    Zenphoto
    Zenphoto
    risk 0.00cvss —epss 0.02

    zenphoto 1.0.1 beta and earlier allow remote attackers to obtain sensitive information via a direct request for the (1) /photos/themes/default/ and (2) /photos/themes/testing/ URIs, which reveals the path in an error message.

  • CVE-2006-2187May 4, 2006
    Zenphoto
    Zenphoto
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in zenphoto 1.0.1 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) a parameter in i.php, and the (2) album and (3) image parameters in index.php.

  • CVE-2006-2188May 4, 2006
    Cmscout
    Cmscout
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in CMScout 1.10 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the Body field of a private message (PM), (2) BBCode, or (3) a forum post.

  • CVE-2006-2189May 4, 2006
    Servous
    Sblog
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in search.php in Servous sBLOG 0.7.2 allows remote attackers to execute arbitrary SQL commands via the keyword parameter. NOTE: this issue can be used to trigger path disclosure. In addition, it might be primary to vector 1 in CVE-2006-1135.

  • CVE-2006-2190May 4, 2006
    Open Webmail
    Openwebmail
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ow-shared.pl in OpenWebMail (OWM) 2.51 and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionid parameter in (1) openwebmail-send.pl, (2) openwebmail-advsearch.pl, (3) openwebmail-folder.pl, (4)…

  • CVE-2006-1527May 3, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.04

    The SCTP-netfilter code in Linux kernel before 2.6.16.13 allows remote attackers to trigger a denial of service (infinite loop) via unknown vectors that cause an invalid SCTP chunk size to be processed by the for_each_sctp_chunk function.