VYPR

CVEs

380,321 total · page 7266 of 7,607

AllCriticalHighKEV
  • CVE-2006-1869Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in Oracle Database Server 8.1.7.4 and 9.0.1.5 has unknown impact and attack vectors in the Dictionary component, aka Vuln# DB04.

  • CVE-2006-1870Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2 has unknown impact and attack vectors in the Export component, aka Vuln# DB05. NOTE: details are unavailable from Oracle, but as of 20060427, they have not publicly commented…

  • CVE-2006-1871Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Oracle Database Server 9.2.0.7 and 10.1.0.5 allows remote attackers to execute arbitrary SQL commands via the DELETE_FROM_TABLE function in the DBMS_LOGMNR_SESSION (Log Miner) package, aka Vuln# DB06.

  • CVE-2006-1872Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle Database Server 9.0.1.5 and 9.2.0.7 has unknown impact and attack vectors in the Oracle Enterprise Manager Intelligent Agent component, aka Vuln# DB07.

  • CVE-2006-1873Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Oracle Database Server 9.2.0.7, 10.1.0.4, and 10.2.0.1 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB08.

  • CVE-2006-1874Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, and 9.2.0.6 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB09. NOTE: Oracle has not disputed reliable claims that this issue is SQL injection in MDSYS.PRVT_IDX using the…

  • CVE-2006-1875Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Oracle Database Server 9.0.1.5, 9.2.0.7, and 10.1.0.5 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB11. NOTE: Oracle has not disputed reliable researcher claims that this issue is SQL injection in…

  • CVE-2006-1876Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle Database Server 9.2.0.7 and 10.1.0.4 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB12. NOTE: details are unavailable from Oracle, but as of 20060421, they have not publicly disputed a claim by a reliable…

  • CVE-2006-1877Apr 20, 2006
    Oracle Corporation
    Database Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, and 9.2.0.7 has unknown impact and attack vectors in the Oracle Spatial component, aka Vuln# DB13.

  • CVE-2006-1878Apr 20, 2006
    Phpfaber
    Topsites
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in phpFaber TopSites allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2006-1879Apr 20, 2006
    Oracle Corporation
    Collaboration Suite
    risk 0.00cvss —epss 0.05

    Multiple unspecified vulnerabilities in the Email Server component in Oracle Collaboration Suite 9.0.4.2, 10.1.1, 10.1.2.0, and 10.1.2.1 have unknown impact and attack vectors, aka Vuln# (1) OCS01, (2) OCS02, (3) OCS03, and (4) OCS04.

  • CVE-2006-1880Apr 20, 2006
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10CU2 have unknown impact and attack vectors, as identified by Vuln# (1) APPS01 in the (a) Application Install component; (2) APPS09 in the (b) Oracle Diagnostics Interfaces component; (3)…

  • CVE-2006-1881Apr 20, 2006
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Financials for Asia/Pacific component in Oracle E-Business Suite and Applications 11.5.9 has unknown impact and attack vectors. component, aka Vuln# APPS02.

  • CVE-2006-1882Apr 20, 2006
    Oracle Corporation
    Iprocurement
    risk 0.00cvss —epss 0.06

    Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10 have unknown impact and attack vectors, as identified by Vuln# (1) APPS03 in (a) iProcurement; (2) APPS04 in (b) Oracle Application Object Library; (3) APPS06, (4) APPS07, and (5) APPS08 in…

  • CVE-2006-1883Apr 20, 2006
    Oracle Corporation
    E Business Suite
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite and Applications 11.5.10CU1 has unknown impact and attack vectors, aka Vuln# APPS05.

  • CVE-2006-1884Apr 20, 2006
    Oneworld
    Oneworld Tools
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the Oracle Thesaurus Management System component in Oracle E-Business Suite and OPA 4.5.2 Applications has unknown impact and attack vectors, aka Vuln# OPA01.

  • CVE-2006-1885Apr 20, 2006
    Oracle Corporation
    Enterprise Manager
    risk 0.00cvss —epss 0.04

    Multiple unspecified vulnerabilities in the Reporting Framework component in Oracle Enterprise Manager 9.0.1.5 and 9.2.0.7 have unknown impact and attack vectors, aka Vuln# (1) EM01 and (2) EM02.

  • CVE-2006-1886Apr 20, 2006
    Oracle Corporation
    Peoplesoft Enterprise
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise 8.46.12 and 8.47.04 has unknown impact and attack vectors, aka Vuln# PSE01.

  • CVE-2006-1887Apr 20, 2006
    Oracle Corporation
    Jd Edwards Enterpriseone
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Security Server 8.95.J1 has unknown impact and attack vectors, aka Vuln# JDE01.

  • CVE-2006-1888Apr 20, 2006
    Phpgraphy
    Phpgraphy
    risk 0.00cvss —epss 0.02

    phpGraphy 0.9.11 and earlier allows remote attackers to bypass authentication and gain administrator privileges via a direct request to index.php with the editwelcome parameter set to 1, which can then be used to modify the main page to inject arbitrary HTML and web script. …

  • CVE-2006-1889Apr 20, 2006
    Script Solution.de
    Boardsolution
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the search action handler in index.php in Nils Asmussen (aka SCRIPTSOLUTION) Boardsolution 1.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the "Search for" item (keyword parameter).

  • CVE-2006-1890Apr 20, 2006
    Mywebland
    Myevent
    risk 0.00cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in myWebland myEvent 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the myevent_path parameter in (1) event.php and (2) initialize.php. NOTE: vector 2 was later reported to affect 1.4 as well.

  • CVE-2006-1891Apr 20, 2006
    Betaboard
    Betaboard
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Martin Scheffler betaboard 0.1 allows remote attackers to inject arbitrary web script or HTML via a user's profile, possibly using the FormVal_profile parameter. NOTE: it is not clear whether this is a distributable product or a…

  • CVE-2006-1892Apr 20, 2006
    Avast\!
    Linux Home Edition
    risk 0.00cvss —epss 0.00

    avast! 4 Linux Home Edition 1.0.5 allows local users to modify permissions of arbitrary files via a symlink attack on the /tmp/_avast4_ temporary directory.

  • CVE-2006-1893Apr 20, 2006
    AR Blog
    AR Blog
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in print.php in ar-blog 5.2 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2006-1894Apr 20, 2006
    Revoboard
    Revoboard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in RevoBoard 1.8, as derived from PunBB, allows remote attackers to inject arbitrary web script or HTML via a substitution cipher of the email tag, which is transformed when the application's e-mail address obfuscator reverses the…

  • CVE-2006-1895Apr 20, 2006
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.01

    Direct static code injection vulnerability in includes/template.php in phpBB allows remote authenticated users with write access to execute arbitrary PHP code by modifying a template in a way that (1) bypasses a loose ".*" regular expression to match BEGIN and END statements in…

  • CVE-2006-1896Apr 20, 2006
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in phpBB allows remote authenticated users with Administration Panel access to execute arbitrary PHP code via crafted Font Colour 3 ($theme[fontcolor3] variable) and/or signature values, possibly involving the highlight functionality. NOTE: the…

  • CVE-2006-1897Apr 20, 2006
    Talentsoft
    Web\+ Shop
    risk 0.00cvss —epss 0.02

    Webplus (aka talentsoft) Web+Shop 5.3.6, when Redirect URL for "Script Not Found" Error is not configured, allows remote attackers to obtain sensitive information via a quote (') or possibly other invalid value in the storeid parameter in store.wml in webplus.exe, which reveals…

  • CVE-2006-1898Apr 20, 2006
    Tinyphpforum
    Tinyphpforum
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Ralph Capper Tiny PHP Forum (TPF) 3.6 allow remote attackers to inject arbitrary web script or HTML via (1) the uname parameter in a view action in profile.php and (2) a login name. NOTE: the "Access to hash password" issue…

  • CVE-2006-1899Apr 20, 2006
    Dev
    Neuron Blog
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in dev Neuron Blog 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) website parameters.

  • CVE-2006-1900Apr 20, 2006
    Debian
    Amaya
    risk 0.04cvss —epss 0.17

    Multiple buffer overflows in World Wide Web Consortium (W3C) Amaya 9.4, and possibly other versions including 8.x before 8.8.5, allow remote attackers to execute arbitrary code via a long value in (1) the COMPACT attribute of the COLGROUP element, (2) the ROWS attribute of the…

  • CVE-2006-1901Apr 20, 2006
    Mozilla Corporation
    Camino
    risk 0.00cvss —epss 0.02

    Mozilla Camino 1.0 and earlier allow remote attackers to cause a denial of service (null dereference and application crash or hang) via HTML with certain improperly nested elements. NOTE: this might be the same issue as CVE-2006-1724.

  • CVE-2006-1902Apr 20, 2006
    GNU
    Gcc
    risk 0.00cvss —epss 0.00

    fold_binary in fold-const.c in GNU Compiler Collection (gcc) 4.1 improperly handles pointer overflow when folding a certain expr comparison to a corresponding offset comparison in cases other than EQ_EXPR and NE_EXPR, which might introduce buffer overflow vulnerabilities into…

  • CVE-2006-1903Apr 20, 2006
    Userland
    Manila
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in UserLand Manila allow remote attackers to inject arbitrary web script or HTML (1) via the referer parameter in sendMail, and via attributes of (2) the A element and certain other HTML elements in web pages edited with the…

  • CVE-2006-1904Apr 20, 2006
    Animegenesis
    Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in AnimeGenesis Gallery allows remote attackers to inject arbitrary web script or HTML via the cat parameter.

  • CVE-2006-1905Apr 20, 2006
    Xine
    Xine Lib
    risk 0.04cvss —epss 0.14

    Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.3 allow remote attackers to execute arbitrary code via format string specifiers in a long filename on an EXTINFO line in a playlist file.

  • CVE-2006-1906Apr 20, 2006
    Jjgan852
    Phplister
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in jjgan852 phpLister 0.4.1 allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2006-1524Apr 19, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    madvise_remove in Linux kernel 2.6.16 up to 2.6.16.6 does not follow file and mmap restrictions, which allows local users to bypass IPC permissions and replace portions of readonly tmpfs files with zeroes, aka the MADV_REMOVE vulnerability. NOTE: this description was originally…

  • CVE-2006-1525Apr 19, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    ip_route_input in Linux kernel 2.6 before 2.6.16.8 allows local users to cause a denial of service (panic) via a request for a route for a multicast IP address, which triggers a null dereference.

  • CVE-2006-1247Apr 19, 2006
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    rm_mlcache_file in bos.rte.install in AIX 5.1.0 through 5.3.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.

  • CVE-2006-1828Apr 19, 2006
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL commands and execute arbitrary code via the sess_username variable, as set by the php121un HTTP COOKIE parameter, which is used in multiple files including…

  • CVE-2006-1829Apr 19, 2006
    Sybase
    Easerver
    risk 0.00cvss —epss 0.01

    EAServer Manager in Sybase EAServer 5.2 and 5.3 allows remote authenticated users, possibly guests, to obtain password credentials of arbitrary users via unspecified vectors involving (1) connection caches, (2) open password prompts, and (3) stored custom connection profiles.

  • CVE-2006-1830Apr 19, 2006
    Sun Corporation
    Java Studio Enterprise
    risk 0.00cvss —epss 0.00

    Sun Java Studio Enterprise 8, when installed as root, creates certain files with world-writable permissions, which allows local users to execute arbitrary commands via unspecified vectors.

  • CVE-2006-1831Apr 19, 2006
    Coder World
    Sysinfo
    risk 0.04cvss —epss 0.08

    Direct static code injection vulnerability in sysinfo.cgi in sysinfo 1.21 and possibly other versions before 2.25 allows remote attackers to execute arbitrary commands via a leading ; (semicolon) in the name parameter in a systemdoc action, which is injected into phpinfo.php.

  • CVE-2006-1832Apr 19, 2006
    Sysinfo
    sysinfo
    risk 0.04cvss —epss 0.07

    sysinfo.cgi in sysinfo 1.21 allows remote attackers to obtain the installation path via the debugger action.

  • CVE-2006-1833Apr 19, 2006
    NetBSD
    NetBSD
    risk 0.00cvss —epss 0.01

    Intel RNG Driver in NetBSD 1.6 through 3.0 may incorrectly detect the presence of the pchb interface, which will cause it to always generate the same random number, which allows remote attackers to more easily crack encryption keys generated from the interface.

  • CVE-2006-1834Apr 19, 2006
    Opera
    Opera
    risk 0.04cvss —epss 0.12

    Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, which pass a length check. NOTE: a sign extension problem makes the attack easier with shorter strings.

  • CVE-2006-1835Apr 19, 2006
    Calendarix
    Calendarix
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in yearcal.php in Calendarix allows remote attackers to inject arbitrary web script or HTML via the ycyear parameter.

  • CVE-2006-1836Apr 19, 2006
    Symantec
    Liveupdate
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in unspecified components in Symantec LiveUpdate for Macintosh 3.0.0 through 3.5.0 do not set the execution path, which allows local users to gain privileges via a Trojan horse program.