VYPR

CVEs

380,383 total · page 7262 of 7,608

AllCriticalHighKEV
  • CVE-2006-2150May 3, 2006
    PhpBB
    Toplist
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in top/list.php in phpBB TopList 1.3.8 and earlier allows remote attackers to include arbitrary files via the returnpath parameter.

  • CVE-2006-2151May 3, 2006
    PhpBB
    Toplist
    risk 0.04cvss —epss 0.11

    PHP remote file inclusion vulnerability in toplist.php in phpBB TopList 1.3.8 and earlier, when register_globals is enabled, allows remote attackers to include arbitrary files via the phpbb_root_path parameter.

  • CVE-2006-2152May 3, 2006
    PhpBB
    Phpbb Advanced Guestbook
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in admin/addentry.php in phpBB Advanced Guestbook 2.4.0 and earlier, when register_globals is enabled, allows remote attackers to include arbitrary files via the phpbb_root_path parameter.

  • CVE-2006-2153May 3, 2006
    Directadmin
    Directadmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in HTM_PASSWD in DirectAdmin Hosting Management allows remote attackers to inject arbitrary web script or HTML via the domain parameter.

  • CVE-2006-2154May 3, 2006
    EMC Corporation
    Retrospect
    risk 0.00cvss —epss 0.00

    EMC Retrospect for Windows 6.5 before 6.5.382, 7.0 before 7.0.344, and 7.5 before 7.5.1.105 does not drop privileges before opening files, which allows local users to execute arbitrary code via the File>Open dialog.

  • CVE-2006-2155May 3, 2006
    EMC Corporation
    Retrospect
    risk 0.00cvss —epss 0.00

    EMC Retrospect for Windows 6.5 before 6.5.382, 7.0 before 7.0.344, and 7.5 before 7.5.1.105 allows local users to execute arbitrary code by replacing the Retrospect.exe file, possibly due to improper file permissions.

  • CVE-2006-2156May 3, 2006
    X7 Chat
    X7 Chat
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in help/index.php in X7 Chat 2.0 and earlier allows remote attackers to include arbitrary files via .. (dot dot) sequences in the help_file parameter.

  • CVE-2006-2157May 3, 2006
    Plogger
    Plogger
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in gallery.php in Plogger Beta 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter, when the level is set to "slideshow". NOTE: This is a different vulnerability than CVE-2005-4246.

  • CVE-2006-2158May 3, 2006
    Stadtaus
    Guestbook Script
    risk 0.00cvss —epss 0.02

    Dynamic variable evaluation vulnerability in index.php in Stadtaus Guestbook Script 1.7 and earlier, when register_globals is enabled, allows remote attackers to modify arbitrary program variables via parameters, which are evaluated as PHP variable variables, as demonstrated by…

  • CVE-2006-2159May 3, 2006
    Russcom Network
    Loginphp
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in help.php in Russcom Network Loginphp allows remote attackers to spoof e-mails and inject MIME headers via CRLF sequences in the email address.

  • CVE-2006-2160May 3, 2006
    Russcom Network
    Loginphp
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Russcom Network Loginphp (Russcom.Loginphp) allows remote attackers to inject arbitrary web script or HTML via the username field when registering.

  • CVE-2006-1526May 2, 2006
    Xorg
    X11r6
    risk 0.00cvss —epss 0.01

    Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which…

  • CVE-2006-2148May 2, 2006
    Cgiirc
    Cgiirc
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in client.c in CGI:IRC (CGIIRC) before 0.5.8 might allow remote attackers to execute arbitrary code via (1) cookies or (2) the query string.

  • CVE-2006-2147May 2, 2006
    Resmgr
    Resmgrd
    risk 0.00cvss —epss 0.00

    resmgrd in resmgr for SUSE Linux and other distributions does not properly handle when access to a USB device is granted by using "usb:," notation, which grants access to all USB devices and allows local users to bypass intended restrictions. NOTE: this is a different…

  • CVE-2006-2109May 2, 2006
    Jsboard
    Jsboard
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the parse_query_str function in include/print.php in JSBoard 2.0.10 and 2.0.11, and possibly other versions before 2.0.12, allows remote attackers to inject arbitrary web script or HTML via parameters that are set as global variables…

  • CVE-2006-2134May 2, 2006
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.10

    PHP remote file inclusion vulnerability in /includes/kb_constants.php in Knowledge Base Mod for PHPbb 2.0.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.

  • CVE-2006-2135May 2, 2006
    Ruperts News
    Ruperts News
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in login.php in Ruperts News allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2006-2136May 2, 2006
    Aznews
    Aznews
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in news.php in AZNEWS allows remote attackers to execute arbitrary SQL commands via the ID parameter.

  • CVE-2006-2137May 2, 2006
    Openphpnuke
    Openphpnuke
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in master.php in OpenPHPNuke and 2.3.3 earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.

  • CVE-2006-2138May 2, 2006
    Neomail
    Neomail
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in neomail.pl in NeoMail 1.29 allows remote attackers to inject arbitrary web script or HTML via the sessionid parameter.

  • CVE-2006-2139May 2, 2006
    Wilsonncareabusinesses
    PHP Newsfeed
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in PHP Newsfeed 20040723 allow remote attackers to execute arbitrary SQL commands via the (1) name parameter to (a) deltables.php, (2) select, (3) header, (4) url, (5) source, or (6) time parameters to (b) manualsubmit.php, (7) num…

  • CVE-2006-2140May 2, 2006
    Orbitscripts
    Orbithyip
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in OrbitHYIP 2.0 and earlier allow remote attackers to inject arbitrary web script via the (1) referral parameter to signup.php or (2) id parameter to members.php.

  • CVE-2006-2141May 2, 2006
    Collaborative Portal Server Project
    Collaborative Portal Server
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in popup_image in Collaborative Portal Server (CPS) 3.4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the pos argument.

  • CVE-2006-2142May 2, 2006
    Limbo CMS
    Limbo CMS
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in classes/adodbt/sql.php in Limbo CMS 1.04 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the classes_dir parameter.

  • CVE-2006-2143May 2, 2006
    textfileBB
    textfileBB
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in TextFileBB 1.0.16 allow remote attackers to inject arbitrary web script or HTML via Javascript events such as "onmouseover" in the (1) color, (2) size, or (3) url bbcode tags.

  • CVE-2006-2144May 2, 2006
    Dmcounter
    Dmcounter
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in kopf.php in DMCounter 0.9.2-b allows remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter.

  • CVE-2006-2145May 2, 2006
    Harold Bakker
    Hb Ns
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in HB-NS 1.1.6 allow remote attackers to execute arbitrary SQL commands via the (1) topic or (2) id parameter.

  • CVE-2006-2146May 2, 2006
    Harold Bakker
    Hb Ns
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in HB-NS 1.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) poster_name, (2) poster_email, (3) poster_homepage, or (4) message parameter.

  • CVE-2006-2127May 1, 2006
    Blog Mod
    Blog Mod
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in weblog_posting.php in Blog Mod 0.2.x allows remote attackers to execute arbitrary SQL commands via the r parameter.

  • CVE-2006-2128May 1, 2006
    Deltascripts
    Pro Publish
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Pro Publish 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameter to (a) admin/login.php, (3) find_str parameter to (b) search.php, or (4) artid parameter to (c) art.php, or (5) catid…

  • CVE-2006-2129May 1, 2006
    Deltascripts
    Pro Publish
    risk 0.00cvss —epss 0.01

    Direct static code injection vulnerability in Pro Publish 2.0 allows remote authenticated administrators to execute arbitrary PHP code by editing certain settings, which are stored in set_inc.php.

  • CVE-2006-2130May 1, 2006
    Advanced Poll
    Advanced Poll
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in include/class_poll.php in Advanced Poll 2.0.4 allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.

  • CVE-2006-2131May 1, 2006
    Advanced Poll
    Advanced Poll
    risk 0.00cvss —epss 0.02

    include/class_poll.php in Advanced Poll 2.0.4 uses the HTTP_X_FORWARDED_FOR (X-Forwarded-For HTTP header) to identify the IP address of a client, which makes it easier for remote attackers to spoof the source IP and bypass voting restrictions.

  • CVE-2006-2132May 1, 2006
    DUclassified
    DUclassified
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in detail.asp in DUclassified allows remote attackers to execute arbitrary SQL commands via the iPro parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-2133May 1, 2006
    Boonex
    Barracuda
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in BoonEx Barracuda 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) link_dir_target and (2) link_id_target parameter, possibly involving the link_edit functionality.

  • CVE-2006-2120May 1, 2006
    LibTIFF
    Libtiff
    risk 0.00cvss —epss 0.01

    The TIFFToRGB function in libtiff before 3.8.1 allows remote attackers to cause a denial of service (crash) via a crafted TIFF image with Yr/Yg/Yb values that exceed the YCR/YCG/YCB values, which triggers an out-of-bounds read.

  • CVE-2006-2121May 1, 2006
    I Rater
    Platinum
    risk 0.03cvss —epss 0.04

    PHP remote file include vulnerability in admin/config_settings.tpl.php in I-RATER Platinum allows remote attackers to execute arbitrary code via a URL in the include_path parameter. NOTE: this is a different vector, and possibly a different vulnerability, than CVE-2006-1929.

  • CVE-2006-2122May 1, 2006
    Coolmenus
    Coolmenus
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in index.php in CoolMenus allows remote attackers to execute arbitrary code via a URL in the page parameter. NOTE: the original report for this issue is probably erroneous, since CoolMenus does not appear to be written in PHP.

  • CVE-2006-2123May 1, 2006
    Nav
    Network Administration Visualized
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the report interface in Network Administration Visualized (NAV) before 3.0.1 allow remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2006-2124May 1, 2006
    SunShop
    SunShop
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in SunShop 3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) prevaction, (2) previd, (3) prevstart, (4) itemid, (5) id, and (6) action parameters in index.php.

  • CVE-2006-2126May 1, 2006
    Maxtrade
    MaxTrade
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pocategories.php in MaxTrade 1.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) categori and (2) stranica parameters.

  • CVE-2006-2116May 1, 2006
    Planet Concept
    Planetgallery
    risk 0.03cvss —epss 0.03

    planetGallery allows remote attackers to gain administrator privileges via a direct request to admin/gallery_admin.php.

  • CVE-2006-2117May 1, 2006
    Thyme
    Thyme
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Thyme 1.3 allows remote attackers to inject arbitrary web script or HTML via the search page.

  • CVE-2006-2118May 1, 2006
    JMK
    Picture Gallery
    risk 0.00cvss —epss 0.02

    JMK's Picture Gallery allows remote attackers to bypass authentication via a direct request to admin_gallery.php3, possibly related to the add action.

  • CVE-2006-2119May 1, 2006
    Artmedic Webdesign
    Event
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in event/index.php in Artmedic Event allows remote attackers to execute arbitrary code via a URL in the page parameter.

  • CVE-2006-1989May 1, 2006
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.06

    Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code via long HTTP headers.

  • CVE-2006-2110May 1, 2006
    Virtual Private Server
    Vserver
    risk 0.00cvss —epss 0.00

    Virtual Private Server (Vserver) 2.0.x before 2.0.2-rc18 and 2.1.x before 2.1.1-rc18 provides certain context capabilities (ccaps) that allow local guest users to perform operations that were only intended to be allowed by the guest-root.

  • CVE-2006-2111May 1, 2006
    Microsoft
    Outlook Express
    risk 0.06cvss —epss 0.40

    A component in Microsoft Outlook Express 6 allows remote attackers to bypass domain restrictions and obtain sensitive information via redirections with the mhtml: URI handler, as originally reported for Internet Explorer 6 and 7, aka "URL Redirect Cross Domain Information…

  • CVE-2006-2114May 1, 2006
    Sws
    Sws Simple Web Server
    risk 0.00cvss —epss 0.04

    Buffer overflow in SWS web Server 0.1.7 allows remote attackers to execute arbitrary code via a long request.

  • CVE-2006-2115May 1, 2006
    Sws
    Sws Simple Web Server
    risk 0.00cvss —epss 0.03

    Format string vulnerability in SWS web Server 0.1.7 allows remote attackers to execute arbitrary code via unspecified vectors that are not properly handled in a syslog function call.