VYPR

CVEs

380,383 total · page 7263 of 7,608

AllCriticalHighKEV
  • CVE-2006-2084Apr 29, 2006
    Farsinews
    Farsinews
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in FarsiNews 2.5.3 Pro and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) month and (2) year parameters in (a) index.php, and the (3) mod parameter in (b) admin.php.

  • CVE-2006-2085Apr 29, 2006
    Speedproject
    Speedcommander
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in (1) CxAce60.dll and (2) CxAce60u.dll in SpeedProject Squeez 5.10 Build 4460, and SpeedCommander 10.52 Build 4450 and 11.01 Build 4450, allow user-assisted remote attackers to execute arbitrary code via an ACE archive that contains a file with a long…

  • CVE-2006-2086Apr 29, 2006
    Juniper Networks
    Ive OS
    risk 0.08cvss —epss 0.67

    Buffer overflow in JuniperSetupDLL.dll, loaded from JuniperSetup.ocx by the Juniper SSL-VPN Client when accessing a Juniper NetScreen IVE device running IVE OS before 4.2r8.1, 5.0 before 5.0r6.1, 5.1 before 5.1r8, 5.2 before 5.2r4.1, or 5.3 before 5.3r2.1, allows remote…

  • CVE-2006-2087Apr 29, 2006
    Hitachi
    Groupmax
    risk 0.00cvss —epss 0.02

    The Gmax Mail client in Hitachi Groupmax before 20060426 allows remote attackers to cause a denial of service (application hang or erroneous behavior) via an attachment with an MS-DOS device filename.

  • CVE-2006-2088Apr 29, 2006
    Devsyn
    Open Bulletin Board
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Devsyn Open Bulletin Board (OpenBB) 1.0.6 allow remote attackers to inject arbitrary web script or HTML via (1) the FID parameter in board.php and (2) the TID parameter in read.php. NOTE: the SQL injection issues are…

  • CVE-2006-2089Apr 29, 2006
    Mysmartbb
    Mysmartbb
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in misc.php in MySmartBB 1.1.x allow remote attackers to inject arbitrary web script or HTML via the (1) id and (2) username parameters.

  • CVE-2006-2090Apr 29, 2006
    Mysmartbb
    Mysmartbb
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in misc.php in MySmartBB 1.1.x allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) username parameters.

  • CVE-2006-2091Apr 29, 2006
    Vwar
    Virtual War
    risk 0.00cvss —epss 0.01

    admin.php in Virtual War (VWar) 1.5 and versions before 1.2 allows remote attackers to obtain sensitive information via an invalid vwar_root parameter, which reveals the path in an error message.

  • CVE-2006-2092Apr 29, 2006
    Microfocus
    StorageWorks Secure Path for Windows
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in HP StorageWorks Secure Path for Windows 4.0C-SP2 before 20060419 allows remote attackers to cause an unspecified denial of service via unknown vectors.

  • CVE-2006-2093Apr 29, 2006
    Tenable
    Nessus
    risk 0.00cvss —epss 0.04

    Nessus before 2.2.8, and 3.x before 3.0.3, allows user-assisted attackers to cause a denial of service (memory consumption) via a NASL script that calls split with an invalid sep parameter. NOTE: a design goal of the NASL language is to facilitate sharing of security tests by…

  • CVE-2006-2094Apr 29, 2006
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.23

    Microsoft Internet Explorer before Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, when Prompt is configured in Security Settings, uses modal dialogs to verify that a user wishes to run an ActiveX control or perform other risky actions, which allows…

  • CVE-2006-2095Apr 29, 2006
    Phex
    Phex
    risk 0.00cvss —epss 0.02

    Phex before 2.8.6 allows remote attackers to cause a denial of service (application hang) by initiating multiple chat requests to a single user and then logging off.

  • CVE-2006-2096Apr 29, 2006
    Neocrome
    Land Down Under
    risk 0.00cvss —epss 0.01

    plug.php in Land Down Under (LDU) 802 and earlier allows remote attackers to obtain sensitive information via an invalid (1) month or (2) year parameter, which reveals the path in an error message.

  • CVE-2006-2097Apr 29, 2006
    Invision Power Services
    Power Board
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in func_msg.php in Invision Power Board (IPB) 2.1.4 allows remote attackers to execute arbitrary SQL commands via the from_contact field in a private message (PM).

  • CVE-2006-2098Apr 29, 2006
    PHP Thumbnail Autoindex
    PHP Thumbnail Autoindex
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in Thumbnail AutoIndex before 2.0 allows remote attackers to execute arbitrary PHP code via (1) README.html or (2) HEADER.html.

  • CVE-2006-2099Apr 29, 2006
    Ezbsystems
    Ultraiso
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in UltraISO 8.0.0.1392 allows remote attackers to write arbitrary files via a .. (dot dot) in a filename in an ISO image.

  • CVE-2006-2100Apr 29, 2006
    Magiciso
    Magic Iso Maker
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in Magic ISO 5.0 Build 0166 allows remote attackers to write arbitrary files via a .. (dot dot) in a filename in an ISO image.

  • CVE-2006-2101Apr 29, 2006
    WinISO
    WinISO
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in WinISO 5.3 allows remote attackers to write arbitrary files via a .. (dot dot) in a filename in an ISO image.

  • CVE-2006-2102Apr 29, 2006
    Poweriso
    Poweriso
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in PowerISO 2.9 allows remote attackers to write arbitrary files via a .. (dot dot) in a filename in an ISO image.

  • CVE-2006-2103Apr 29, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in MyBB (MyBulletinBoard) 1.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the (1) query string ($querystring variable) in (a) admin/adminlogs.php, which is not properly handled by adminfunctions.php; or (2)…

  • CVE-2006-2104Apr 29, 2006
    Kmail
    Kmail
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Kamgaing Email System (kmail) 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) d parameter to main.php, ordner parameter to (2) main.php, or (3) webdisk.php, (4) draft parameter to…

  • CVE-2006-2105Apr 29, 2006
    Jupiter CMS
    CMS
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in index.php in Jupiter CMS 1.1.4 and 1.1.5 allows remote attackers to read arbitrary files via ".." sequences terminated by a %00 (null) character in the n parameter.

  • CVE-2006-2106Apr 29, 2006
    Edgewall Software
    Trac
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Edgewall Software Trac 0.9.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors related to a "wiki macro."

  • CVE-2006-2107Apr 29, 2006
    risk 0.03cvss —epss 0.05

    Buffer overflow in BL4 SMTP Server 0.1.4 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long argument to the (1) EHLO, (2) MAIL FROM, and (3) RCPT TO commands.

  • CVE-2006-2108Apr 29, 2006
    Océ
    3121/3122 Printer
    risk 0.03cvss —epss 0.04

    parser.exe in Océ (OCE) 3121/3122 Printer allows remote attackers to cause a denial of service (crash or reboot) via a long request, possibly triggering a buffer overflow.

  • CVE-2006-2083Apr 28, 2006
    Rsync
    Rsync
    risk 0.00cvss —epss 0.04

    Integer overflow in the receive_xattr function in the extended attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers to execute arbitrary code via crafted extended attributes that trigger a buffer overflow.

  • CVE-2006-2079Apr 27, 2006
    Verosky Media
    Instant Photo Gallery
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in portfolio.php in Verosky Media Instant Photo Gallery, possibly before 1.0.2, allows remote attackers to inject arbitrary web script or HTML via the cat_id parameter.

  • CVE-2006-2080Apr 27, 2006
    Verosky Media
    Instant Photo Gallery
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in portfolio_photo_popup.php in Verosky Media Instant Photo Gallery 1.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter, which is not cleansed before calling the count_click function in includes/functions/fns_std.php. …

  • CVE-2006-2081Apr 27, 2006
    Oracle Corporation
    Database Server
    risk 0.05cvss —epss 0.22

    Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via the GET_DOMAIN_INDEX_METADATA function in the DBMS_EXPORT_EXTENSION package. NOTE: this issue was originally linked to DB05 (CVE-2006-1870), but a reliable third party has claimed that…

  • CVE-2006-2075Apr 27, 2006
    Don Moore
    Mydns
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in MyDNS 1.1.0 allows remote attackers to cause a denial of service via a crafted DNS message, aka "Query-of-death," as demonstrated by the OUSPG PROTOS DNS test suite.

  • CVE-2006-2076Apr 27, 2006
    Pdnsd
    Pdnsd
    risk 0.00cvss —epss 0.05

    Memory leak in Paul Rombouts pdnsd before 1.2.4 allows remote attackers to cause a denial of service (memory consumption) via a DNS query with an unsupported (1) QTYPE or (2) QCLASS, as demonstrated by the OUSPG PROTOS DNS test suite.

  • CVE-2006-2077Apr 27, 2006
    Pdnsd
    Pdnsd
    risk 0.00cvss —epss 0.03

    Buffer overflow in Paul Rombouts pdnsd before 1.2.4 has unknown impact and attack vectors. NOTE: this issue might be related to the OUSPG PROTOS DNS test suite.

  • CVE-2006-2078Apr 27, 2006
    Furukawa
    Fitelnet
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in multiple FITELnet products, including FITELnet-F40, F80, F100, F120, F1000, and E20/E30, allow remote attackers to cause a denial of service via crafted DNS messages that trigger errors in (1) ProxyDNS or (2) PKI-Resolver, as demonstrated…

  • CVE-2006-2072Apr 27, 2006
    Delegate
    Delegate
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in DeleGate 9.x before 9.0.6 and 8.x before 8.11.6 allow remote attackers to cause a denial of service via crafted DNS responses messages that cause (1) a buffer over-read or (2) infinite recursion, which can trigger a segmentation fault or…

  • CVE-2006-2073Apr 27, 2006
    Isc
    Bind
    risk 0.01cvss —epss 0.08

    Unspecified vulnerability in ISC BIND allows remote attackers to cause a denial of service via a crafted DNS message with a "broken" TSIG, as demonstrated by the OUSPG PROTOS DNS test suite.

  • CVE-2006-2074Apr 27, 2006
    Juniper Networks
    Junose
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Juniper Networks JUNOSe E-series routers before 7-1-1 has unknown impact and remote attack vectors related to the DNS "client code," as demonstrated by the OUSPG PROTOS DNS test suite.

  • CVE-2006-2071Apr 27, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Linux kernel 2.4.x and 2.6.x up to 2.6.16 allows local users to bypass IPC permissions and modify a readonly attachment of shared memory by using mprotect to give write permission to the attachment. NOTE: some original raw sources combined this issue with CVE-2006-1524, but…

  • CVE-2006-1514Apr 27, 2006
    Abcmidi
    Abcmidi
    risk 0.00cvss —epss 0.04

    Multiple buffer overflows in the abcmidi-yaps translator in abcmidi 20050101, and other versions, allow remote attackers to execute arbitrary code via crafted ABC music files that trigger the overflows during translation into PostScript.

  • CVE-2006-2064Apr 27, 2006
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the libpkcs11 library in Sun Solaris 10 might allow local users to gain privileges or cause a denial of service (application failure) via unknown attack vectors that involve the getpwnam family of non-reentrant functions.

  • CVE-2006-2065Apr 27, 2006
    PHP Surveyor
    Phpsurveyor
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in save.php in PHPSurveyor 0.995 and earlier allows remote attackers to execute arbitrary SQL commands via the surveyid cookie. NOTE: this issue could be leveraged to execute arbitrary PHP code, as demonstrated by inserting directory traversal…

  • CVE-2006-2066Apr 27, 2006
    Mkportal
    Mkportal
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities pm_popup.php in MKPortal 1.1 Rc1 and earlier, as used with vBulletin 3.5.4 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) u1, (2) m1, (3) m2, (4) m3, (5) m4 parameters.

  • CVE-2006-2067Apr 27, 2006
    Mkportal
    Mkportal
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in vb_board_functions.php in MKPortal 1.1, as used with vBulletin 3.5.4 and earlier, allows remote attackers to execute arbitrary SQL commands via the userid parameter.

  • CVE-2006-2068Apr 27, 2006
    Hitachi
    JP1
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Hitachi JP1 products allow remote attackers to cause a denial of service (application stop or fail) via unexpected requests or data.

  • CVE-2006-2069Apr 27, 2006
    PowerDNS
    Powerdns
    risk 0.00cvss —epss 0.06

    The recursor in PowerDNS before 3.0.1 allows remote attackers to cause a denial of service (application crash) via malformed EDNS0 packets.

  • CVE-2006-2070Apr 27, 2006
    DevBB
    DevBB
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in member.php in DevBB 1.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the member parameter in a viewpro action.

  • CVE-2006-2043Apr 26, 2006
    IP3 Networks
    Ip3 Netaccess 75
    risk 0.03cvss —epss 0.01

    na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 allows local users to gain Unix shell access via "`" (backtick) characters in the appliance's command line interface (CLI).

  • CVE-2006-2044Apr 26, 2006
    IP3 Networks
    Ip3 Netaccess 75
    risk 0.00cvss —epss 0.01

    na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 has a default username of admin and a default password of admin.

  • CVE-2006-2045Apr 26, 2006
    IP3 Networks
    Ip3 Netaccess 75
    risk 0.00cvss —epss 0.00

    The (1) shadow password file in na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 has world readable permissions, which allows local users to view encrypted passwords; and the (2) NetAccess database file has world readable and writable permissions, which allows local users…

  • CVE-2006-2046Apr 26, 2006
    Application Dynamics
    Cartweaver Coldfusion
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) keywords parameters in (a) Results.cfm, and the (3) ProdID parameter in (b) Details.cfm.

  • CVE-2006-2047Apr 26, 2006
    Application Dynamics
    Cartweaver Coldfusion
    risk 0.00cvss —epss 0.02

    Application Dynamics Cartweaver ColdFusion 2.16.11 and earlier allows remote attackers to obtain sensitive information via an invalid (1) secondary, (2) PageNum_Results, (3) category, or (4) keywords parameter in (a) Results.cfm; or an invalid (5) ProdID parameter in (b)…