VYPR

CVEs

380,368 total · page 7264 of 7,608

AllCriticalHighKEV
  • CVE-2006-2063Apr 26, 2006
    Leadhound Network
    Leadhound Full
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Leadhound Full and LITE 2.1, and probably the Network Version "Full Version", allow remote attackers to inject arbitrary web script or HTML via the login parameter in (1) agent_affil.pl, (2) agent_help.pl, (3) agent_faq.pl,…

  • CVE-2006-1864Apr 26, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in smbfs in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\\" sequences, a similar vulnerability to CVE-2006-1863.

  • CVE-2006-2037Apr 26, 2006
    Thwboard
    Thwboard
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Thwboard 3.0 Beta 2.84 allows remote attackers to inject arbitrary web script or HTML via the navpath parameter.

  • CVE-2006-2038Apr 26, 2006
    AmpleShop
    ampleShop
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in ampleShop 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) RecordID parameter in (a) Customeraddresses_RecordAction.cfm and (b) youraccount.cfm; (2) solus parameter in (c) detail.cfm; and (3) cat…

  • CVE-2006-2039Apr 26, 2006
    Ubertec
    Help Center Live
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the osTicket module in Help Center Live before 2.1.0 allow remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2006-2040Apr 26, 2006
    Keil Software
    Photokorn
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in photokorn 1.53 and 1.542 allow remote attackers to execute arbitrary SQL commands via the (1) cat, (2) pic and (3) page parameter in index.php; (4) id parameter in postcard.php; and (5) cat parameter in print.php.

  • CVE-2006-2041Apr 26, 2006
    Phpwebgallery
    Phpwebgallery
    risk 0.00cvss —epss 0.01

    PhpWebGallery before 1.6.0RC1 allows remote attackers to obtain arbitrary pictures via a request to picture.php without specifying the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

  • CVE-2006-0048Apr 26, 2006
    Francesco Stablum
    Tcpick
    risk 0.00cvss —epss 0.02

    Francesco Stablum tcpick 0.2.1 allows remote attackers to cause a denial of service (segmentation fault) via certain fragmented packets, possibly involving invalid headers and an attacker-controlled payload length. NOTE: this issue might be a buffer overflow or overread.

  • CVE-2006-2027Apr 26, 2006
    Pablo Software Solutions
    Quick 'n Easy FTP Server Professional and Lite
    risk 0.03cvss —epss 0.04

    Buffer overflow in Unicode processing in the logging functionality in Pablo Software Solutions Quick 'n Easy FTP Server Professional and Lite, probably 3.0, allows remote authenticated users to execute arbitrary code by sending a command with a long argument, which triggers a…

  • CVE-2006-2028Apr 26, 2006
    Simplog
    Simplog
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in imagelist.php in Jeremy Ashcraft Simplog 0.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the imagedir parameter. NOTE: this issue might be resultant from directory traversal.

  • CVE-2006-2029Apr 26, 2006
    Simplog
    Simplog
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Jeremy Ashcraft Simplog 0.9.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) tid parameter in (a) preview.php; the (2) cid, (3) pid, and (4) eid parameters in (b) archive.php; and the (5) pid parameter…

  • CVE-2006-2030Apr 26, 2006
    Alliedtelesyn
    At 9724ts
    risk 0.00cvss —epss 0.01

    The Allied Telesyn AT-9724TS switch allows remote attackers to cause a denial of service via a large amount of UDP data to the switch, which leads to unstable operation and possibly failure of the management interface or routing.

  • CVE-2006-2031Apr 26, 2006
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8.0.2, 2.8.1-dev, and 2.9.0-dev allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

  • CVE-2006-2032Apr 26, 2006
    Corenews
    Corenews
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Core CoreNews 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) icon_id and (2) userid parameters in preview.php.

  • CVE-2006-2033Apr 26, 2006
    Corenews
    Corenews
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in Core CoreNews 2.0.1 and earlier allows remote authenticated users to execute arbitrary commands via the show parameter. NOTE: this is a different vector than CVE-2006-1212, although it might be the same primary issue.

  • CVE-2006-2034Apr 26, 2006
    Flexbb
    Flexbb
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in function/showprofile.php in FlexBB 0.5.5 allows remote attackers to execute arbitrary SQL commands, and view all usernames and passwords, via the id parameter to the showprofile page in index.php.

  • CVE-2006-2035Apr 26, 2006
    Websense
    Websense
    risk 0.00cvss —epss 0.00

    Websense, when configured to permit access to the dynamic content category, allows local users to bypass intended blocking of the Uncategorized category by appending a "/?" sequence to a URL.

  • CVE-2006-2036Apr 26, 2006
    Iopus
    Secure Email Attachments
    risk 0.00cvss —epss 0.00

    iOpus Secure Email Attachments (SEA), probably 1.0, does not properly handle passwords that consist of repetitions of a substring, which allows attackers to decrypt files by entering only the substring.

  • CVE-2006-2024Apr 25, 2006
    LibTIFF
    Libtiff
    risk 0.04cvss —epss 0.09

    Multiple vulnerabilities in libtiff before 3.8.1 allow context-dependent attackers to cause a denial of service via a TIFF image that triggers errors in (1) the TIFFFetchAnyArray function in (a) tif_dirread.c; (2) certain "codec cleanup methods" in (b) tif_lzw.c, (c)…

  • CVE-2006-2025Apr 25, 2006
    LibTIFF
    Libtiff
    risk 0.04cvss —epss 0.11

    Integer overflow in the TIFFFetchData function in tif_dirread.c for libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via a crafted TIFF image.

  • CVE-2006-2026Apr 25, 2006
    LibTIFF
    Libtiff
    risk 0.04cvss —epss 0.10

    Double free vulnerability in tif_jpeg.c in libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers errors related to "setfield/getfield methods in cleanup functions."

  • CVE-2006-1863Apr 25, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in CIFS in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\\" sequences, a similar vulnerability to CVE-2006-1864.

  • CVE-2006-2020Apr 25, 2006
    Asteriskathome
    Asterisk Recording Interface (ARI)
    risk 0.04cvss —epss 0.08

    Asterisk Recording Interface (ARI) in Asterisk@Home before 2.8 stores recordings/includes/main.conf under the web document root with insufficient access control, which allows remote attackers to obtain password information.

  • CVE-2006-2021Apr 25, 2006
    Asterisk
    Asterisk
    risk 0.00cvss —epss 0.02

    Absolute path traversal vulnerability in recordings/misc/audio.php in the Asterisk Recording Interface (ARI) web interface in Asterisk@Home before 2.8 allows remote attackers to read arbitrary MP3, WAV, and GSM files via a full pathname in the recording parameter. NOTE: this…

  • CVE-2006-2022Apr 25, 2006
    Fenice
    Fenice
    risk 0.04cvss —epss 0.15

    Buffer overflow in the parse_url function in the RTSP module (rtsp/parse_url.c) in Fenice 1.10 and earlier allows remote attackers to execute arbitrary code via a long URL.

  • CVE-2006-2023Apr 25, 2006
    Fenice
    Fenice
    risk 0.00cvss —epss 0.02

    Integer overflow in the RTSP_msg_len function in rtsp/RTSP_msg_len.c in Fenice 1.10 and earlier allows remote attackers to cause a denial of service (application crash) via a large HTTP Content-Length value, which leads to an invalid memory access.

  • CVE-2006-2019Apr 25, 2006
    Apple Inc.
    Safari
    risk 0.03cvss —epss 0.04

    Apple Mac OS X Safari 2.0.3, 1.3.1, and possibly other versions allows remote attackers to cause a denial of service (CPU consumption and crash) via a TD element with a large number in the rowspan attribute.

  • CVE-2006-1513Apr 25, 2006
    Ianmcalister
    Abc2ps
    risk 0.00cvss —epss 0.02

    Multiple buffer overflows in abc2ps before 1.3.3 allow user-assisted attackers to execute arbitrary code via crafted ABC music files.

  • CVE-2006-1932Apr 25, 2006
    Ethereal Group
    Ethereal
    risk 0.00cvss —epss 0.03

    Off-by-one error in the OID printing routine in Ethereal 0.10.x up to 0.10.14 has unknown impact and remote attack vectors.

  • CVE-2006-1933Apr 25, 2006
    Ethereal Group
    Ethereal
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (large or infinite loops) viarafted packets to the (1) UMA and (2) BER dissectors.

  • CVE-2006-1934Apr 25, 2006
    Ethereal Group
    Ethereal
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the (1) ALCAP dissector, (2) Network Instruments file code, or (3) NetXray/Windows Sniffer file code.

  • CVE-2006-1935Apr 25, 2006
    Ethereal Group
    Ethereal
    risk 0.00cvss —epss 0.05

    Buffer overflow in Ethereal 0.9.15 up to 0.10.14 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the COPS dissector.

  • CVE-2006-1936Apr 25, 2006
    Ethereal Group
    Ethereal
    risk 0.00cvss —epss 0.04

    Buffer overflow in Ethereal 0.8.5 up to 0.10.14 allows remote attackers to execute arbitrary code via the telnet dissector.

  • CVE-2006-1937Apr 25, 2006
    Ethereal Group
    Ethereal
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null dereference) via (1) multiple vectors in H.248, and the (2) X.509if, (3) SRVLOC, (4) H.245, (5) AIM, and (6) general packet dissectors; and…

  • CVE-2006-1938Apr 25, 2006
    Ethereal Group
    Ethereal
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in Ethereal 0.8.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null dereference) via the (1) Sniffer capture or (2) SMB PIPE dissector.

  • CVE-2006-1939Apr 25, 2006
    Ethereal Group
    Ethereal
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in Ethereal 0.9.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null dereference) via (1) an invalid display filter, or the (2) GSM SMS, (3) ASN.1-based, (4) DCERPC NT, (5) PER, (6) RPC, (7) DCERPC, and (8)…

  • CVE-2006-1940Apr 25, 2006
    Ethereal Group
    Ethereal
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Ethereal 0.10.4 up to 0.10.14 allows remote attackers to cause a denial of service (abort) via the SNDCP dissector.

  • CVE-2006-1993Apr 25, 2006
    Mozilla Corporation
    Firefox
    risk 0.07cvss —epss 0.54

    Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain Javascript that is not properly handled by the contentWindow.focus method in an iframe, which causes a reference to a deleted…

  • CVE-2006-1994Apr 25, 2006
    Dforum
    Dforum
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in dForum 1.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DFORUM_PATH parameter to (1) about.php, (2) admin.php, (3) anmelden.php, (4) losethread.php, (5) config.php, (6) delpost.php, (7)…

  • CVE-2006-1995Apr 25, 2006
    Scry Gallery
    Scry Gallery
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in index.php in Scry Gallery 1.1 allows remote attackers to read arbitrary files via ".." sequences in the p parameter, which is not properly sanitized due to an rtrim function call with the arguments in the wrong order.

  • CVE-2006-1996Apr 25, 2006
    Scry Gallery
    Scry Gallery
    risk 0.00cvss —epss 0.02

    Scry Gallery 1.1 allows remote attackers to obtain sensitive information via an invalid p parameter, which reveals the path in an error message.

  • CVE-2006-1997Apr 25, 2006
    Sybase
    Pylon Anywhere
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Sybase Pylon Anywhere groupware synchronization server before 7.0 allows local users to obtain sensitive information such as email and PIM data of another user via unknown attack vectors.

  • CVE-2006-1998Apr 25, 2006
    OpenTTD
    Openttd
    risk 0.03cvss —epss 0.01

    OpenTTD 0.4.7 and earlier allows local users to cause a denial of service (application exit) via a large invalid error number, which triggers an error.

  • CVE-2006-1999Apr 25, 2006
    OpenTTD
    Openttd
    risk 0.04cvss —epss 0.09

    The multiplayer menu in OpenTTD 0.4.7 allows remote attackers to cause a denial of service via a UDP packet with an incorrect size, which causes the client to return to the main menu.

  • CVE-2006-2000Apr 25, 2006
    Logmethods
    Logmethods
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in /lms/a2z.jsp in logMethods 0.9 allows remote attackers to inject arbitrary web script or HTML via the kwd parameter.

  • CVE-2006-2001Apr 25, 2006
    Scry Gallery
    Scry Gallery
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Scry Gallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: this is a different vulnerability than the directory traversal vector.

  • CVE-2006-2002Apr 25, 2006
    Mygamingladder
    Mygamingladder
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in stats.php in MyGamingLadder 7.0 allows remote attackers to execute arbitrary PHP code via a URL in the dir[base] parameter.

  • CVE-2006-2003Apr 25, 2006
    Community Architect
    Guestbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in cgi-bin/guest in Community Architect Guestbook allows remote attackers to inject arbitrary web script or HTML by signing the guestbook, which is displayed by fsguestbook.html. NOTE: the provenance of this information is unknown; the…

  • CVE-2006-2004Apr 25, 2006
    RI Blog
    RI Blog
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in RI Blog 1.1 allow remote attackers to execute arbitrary SQL command via the (1) username or (2) password fields.

  • CVE-2006-2005Apr 25, 2006
    Clansys
    Clansys
    risk 0.03cvss —epss 0.03

    Eval injection vulnerability in index.php in ClanSys 1.1 allows remote attackers to execute arbitrary PHP code via PHP code in the page parameter, as demonstrated by using an "include" statement that is injected into the eval statement. NOTE: this issue has been described as…