VYPR

CVEs

380,345 total · page 7265 of 7,607

AllCriticalHighKEV
  • CVE-2006-1977Apr 21, 2006
    Flexbb
    Flexbb
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in FlexBB 0.5.7 BETA and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) message parameters.

  • CVE-2006-1978Apr 21, 2006
    Flexbb
    Flexbb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in inc/start.php in FlexBB 0.5.5 and earlier allows remote attackers to execute arbitrary SQL commands via the flexbb_username COOKIE parameter.

  • CVE-2006-1979Apr 21, 2006
    Manic Web
    Mwguest
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in mwguest.php in Manic Web MWGuest 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the homepage parameter.

  • CVE-2006-1980Apr 21, 2006
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in W2B Online Banking allows remote attackers to inject arbitrary web script or HTML via the (1) query string, (2) SID parameter, or (3) ilang parameter.

  • CVE-2006-1981Apr 21, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Java InputMethods on Mac OS X 10.4.5 may cause InputMethods to send input events for secure fields to the wrong text field, which might reveal the password to others who can view the screen.

  • CVE-2006-1982Apr 21, 2006
    Apple Inc.
    Mac OS X
    risk 0.05cvss —epss 0.20

    Heap-based buffer overflow in the LZWDecodeVector function in Mac OS X before 10.4.6, as used in applications that use ImageIO or AppKit, allows remote attackers to execute arbitrary code via crafted TIFF images.

  • CVE-2006-1983Apr 21, 2006
    Apple Inc.
    Mac OS X
    risk 0.01cvss —epss 0.08

    Multiple heap-based buffer overflows in Mac OS X 10.4.6 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) PredictorVSetField function for TIFF or (2) CFAllocatorAllocate function for GIF, as used in applications that…

  • CVE-2006-1984Apr 21, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the _cg_TIFFSetField function in Mac OS X 10.4.6 and earlier, as used in applications that use ImageIO or AppKit, allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a null dereference.

  • CVE-2006-1985Apr 21, 2006
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.14

    Heap-based buffer overflow in BOM BOMArchiveHelper 10.4 (6.3) Build 312, as used in Mac OS X 10.4.6 and earlier, allows user-assisted attackers to execute arbitrary code via a crafted archive (such as ZIP) that contains long path names, which triggers an error in the BOMStackPop…

  • CVE-2006-1986Apr 21, 2006
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    Apple Safari 2.0.3 allows remote attackers to cause a denial of service and possibly execute code via a large CELLSPACING attribute in a TABLE tag, which triggers an error in KWQListIteratorImpl::KWQListIteratorImpl.

  • CVE-2006-1987Apr 21, 2006
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.04

    Apple Safari 2.0.3 allows remote attackers to cause a denial of service and possibly execute code via an invalid FRAME tag, possibly due to (1) multiple SCROLLING attributes with no values, or (2) a SRC attribute with no value. NOTE: due to lack of diagnosis by the researcher,…

  • CVE-2006-1988Apr 21, 2006
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    The WebTextRenderer(WebInternal) _CG_drawRun:style:geometry: function in Apple Safari 2.0.3 allows remote attackers to cause a denial of service (application crash) via an HTML LI tag with a large VALUE attribute (list item number), which triggers a null dereference in…

  • CVE-2006-1954Apr 21, 2006
    Nfec.de
    Rechnungszentrale
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in authent.php4 in Nicolas Fischer (aka NFec) RechnungsZentrale V2 1.1.3, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the User field.

  • CVE-2006-1955Apr 21, 2006
    Nfec.de
    Rechnungszentrale
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in authent.php4 in Nicolas Fischer (aka NFec) RechnungsZentrale V2 1.1.3, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter.

  • CVE-2006-1956Apr 21, 2006
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to obtain sensitive information via an invalid feed parameter, which reveals the path in an error message.

  • CVE-2006-1957Apr 21, 2006
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.02

    The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to cause a denial of service (disk consumption and possibly web-server outage) via multiple requests with different values of the feed parameter.

  • CVE-2006-1958Apr 21, 2006
    Wired Community Software
    Wwwthreads
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in WWWThreads RC 3 allow remote attackers to execute arbitrary SQL commands via (1) the forumreferrer cookie to register.php and (2) the messages parameter in message_list.php.

  • CVE-2006-1959Apr 21, 2006
    Actualscripts
    Actualanalyzer Lite
    risk 0.04cvss —epss 0.13

    PHP remote file inclusion vulnerability in direct.php in ActualScripts ActualAnalyzer Lite 2.72 and earlier, Gold 7.63 and earlier, and Server 8.23 and earlier allows remote attackers to execute arbitrary code via a URL in the rf parameter.

  • CVE-2006-1960Apr 21, 2006
    Cisco Systems, Inc.
    Wireless Lan Solution Engine
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in the appliance web user interface in Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13 allows remote attackers to inject arbitrary web script or HTML, possibly via the displayMsg parameter to…

  • CVE-2006-1961Apr 21, 2006
    Cisco Systems, Inc.
    Wireless Lan Solution Engine
    risk 0.00cvss —epss 0.03

    Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13, Hosting Solution Engine (HSE) and User Registration Tool (URT) before 20060419, and all versions of Ethernet Subscriber Solution Engine (ESSE) and CiscoWorks2000 Service Management Solution (SMS)…

  • CVE-2006-1962Apr 21, 2006
    Pcpin
    Chat
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in PCPIN Chat 5.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username field (login parameter) to main.php.

  • CVE-2006-1963Apr 21, 2006
    Pcpin
    Chat
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in main.php in PCPIN Chat 5.0.4 and earlier allows remote authenticated users to include and execute arbitrary PHP code via a ".." (dot dot) in a language cookie, as demonstrated by uploading then accessing a smiliefile image that actually…

  • CVE-2006-1964Apr 21, 2006
    Aspsitem
    Aspsitem
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Haberler.asp in ASPSitem 1.83 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-1965Apr 21, 2006
    Aasi Media
    Net Clubs Pro
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in aasi media Net Clubs Pro 4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) onuser, (2) pass, (3) chatsys, (4) room, (5) username, and (6) to parameters in (a) sendim.cgi; the (7)…

  • CVE-2006-1966Apr 21, 2006
    Fortinet
    Fortinet28
    risk 0.00cvss —epss 0.02

    An unspecified Fortinet product, possibly Fortinet28, allows remote attackers to cause a denial of service via a "small synflood" to the SMTP port (TCP port 25), as demonstrated by a 10-microsecond wait between sending packets. NOTE: this issue has been disputed in followup…

  • CVE-2006-1967Apr 21, 2006
    Kcscripts
    Portal Pack
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in calendar/Visitor.cgi in KCScripts Calendar, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the sort_order parameter.

  • CVE-2006-1968Apr 21, 2006
    Kcscripts
    Portal Pack
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in news/NsVisitor.cgi in KCScripts News Publisher, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the sort_order parameter.

  • CVE-2006-1969Apr 21, 2006
    Kcscripts
    Portal Pack
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search/search.cgi in an unspecified KCScripts script, probably Search Engine or Site Search, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the q…

  • CVE-2006-1970Apr 21, 2006
    Kcscripts
    Portal Pack
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in classifieds/viewcat.cgi in KCScripts Classifieds, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the cat_id parameter.

  • CVE-2006-1971Apr 21, 2006
    Krankikom
    Contentboxx
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in login.php in KRANKIKOM ContentBoxX allows remote attackers to inject arbitrary web script or HTML via the action parameter.

  • CVE-2006-1972Apr 21, 2006
    Wingnut
    Easygallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in EasyGallery.php in Wingnut EasyGallery allows remote attackers to inject arbitrary web script or HTML via the ordner parameter.

  • CVE-2006-1973Apr 21, 2006
    Linksys
    Rt31p2
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Linksys RT31P2 VoIP router allow remote attackers to cause a denial of service via malformed Session Initiation Protocol (SIP) messages.

  • CVE-2006-1974Apr 21, 2006
    MyBB
    Mybb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in MyBB (MyBulletinBoard) before 1.04 allows remote attackers to execute arbitrary SQL commands via the referrer parameter.

  • CVE-2006-1975Apr 21, 2006
    Stadtaus
    PHP Gastebuch
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in guestbook_newentry.php in PHP-Gastebuch 1.61 allows remote attackers to inject arbitrary web script or HTML via the Kommentar field.

  • CVE-2006-1976Apr 21, 2006
    Prayer Request Board
    PRB
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in addRequest.php in Prayer Request Board (PRB) Beta 1 before 20060320 allows remote attackers to inject arbitrary web script or HTML via the Request field.

  • CVE-2006-1941Apr 20, 2006
    Neon
    Neon Responder
    risk 0.03cvss —epss 0.04

    Neon Responder 5.4 for LANsurveyor allows remote attackers to cause a denial of service (application outage) via a crafted Clock Synchronisation packet that triggers an access violation.

  • CVE-2006-1942Apr 20, 2006
    Netscape
    Netscape
    risk 0.00cvss —epss 0.03

    Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then…

  • CVE-2006-1943Apr 20, 2006
    Smarter Scripts
    Intellilink Pro
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Smarter Scripts IntelliLink Pro 5.06 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter in addlink_lwp.cgi and the (2) id, (3) forgotid, and (4) forgotpass parameters in…

  • CVE-2006-1944Apr 20, 2006
    Sibsoft
    Communimail
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in SibSoft CommuniMail 1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the list_id parameter in mailadmin.cgi and (2) the form_id parameter in templates.cgi.

  • CVE-2006-1945Apr 20, 2006
    AWStats
    Awstats
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config parameter. NOTE: this might be the same core issue as CVE-2005-2732.

  • CVE-2006-1946Apr 20, 2006
    Visale
    Visale
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Visale 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the keyval parameter in pbpgst.cgi, (2) the catsubno parameter in pblscg.cgi, and (3) the listno parameter in pblsmb.cgi.

  • CVE-2006-1947Apr 20, 2006
    Nicplex
    Plexum
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in plexum.php in NicPlex Plexum X5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) pagesize, (2) maxrec, and (3) startpos parameters.

  • CVE-2006-1948Apr 20, 2006
    IBM
    Lotus Notes
    risk 0.00cvss —epss 0.01

    The "Add Sender to Address Book" operation (AddSenderToAddressBook.lss) and NameHelper.lss in IBM Lotus Notes 6.0 and 6.5 before 20060331 do not properly store information in the Personal Address Book when multiple messages are checked and a message uses AltFrom, which might…

  • CVE-2006-1949Apr 20, 2006
    Nicplex
    Plexcart
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in plexcart.pl in NicPlex PlexCart X3 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2006-1950Apr 20, 2006
    Perlcoders Group
    Bannerfarm
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in banners.cgi in PerlCoders BannerFarm 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) aff and (2) cat parameters.

  • CVE-2006-1931Apr 20, 2006
    Yukihiro Matsumoto
    Ruby
    risk 0.04cvss —epss 0.10

    The HTTP/XMLRPC server in Ruby before 1.8.2 uses blocking sockets, which allows attackers to cause a denial of service (blocked connections) via a large amount of data.

  • CVE-2006-1907Apr 20, 2006
    Mywebland
    Myevent
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in myEvent 1.x allow remote attackers to inject arbitrary SQL commands via the event_id parameter to (1) addevent.php or (2) del.php or (3) event_desc parameter to addevent.php. NOTE: the provenance of this information is unknown; the…

  • CVE-2006-1908Apr 20, 2006
    Mywebland
    Myevent
    risk 0.00cvss —epss 0.01

    Cross-site scripting vulnerability in addevent.php in myEvent 1.x allows remote attackers to inject arbitrary web script or HTML via the event_desc parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-1909Apr 20, 2006
    Coppermine
    Coppermine
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in index.php in Coppermine 1.4.4 allows remote attackers to read arbitrary files via a .//./ (modified dot dot slash) in the file parameter, which causes a regular expression to collapse the sequences into standard "../" sequences.

  • CVE-2006-1910Apr 20, 2006
    Serendipity
    Serendipity
    risk 0.00cvss —epss 0.01

    config.php in S9Y Serendipity 1.0 beta 2 allows remote attackers to inject arbitrary PHP code by editing values that are stored in config.php and later executed. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.