VYPR

CVEs

380,320 total · page 7267 of 7,607

AllCriticalHighKEV
  • CVE-2006-1838Apr 19, 2006
    Fuju
    News
    risk 0.03cvss —epss 0.03

    edit_kategorie.php in Fuju News 1.0 allows remote attackers to bypass authentication by setting the authorized cookie.

  • CVE-2006-1839Apr 19, 2006
    Phpalbum.net
    Phpalbum
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in language.php in PHP Album 0.3.2.3, when register_globals is enabled, allows remote attackers to execute arbitrary code via an FTP URL in the data_dir parameter, which satisfies the file_exists function call.

  • CVE-2006-1840Apr 19, 2006
    Empire Server
    Empire Server
    risk 0.00cvss —epss 0.01

    Multiple format string vulnerabilities in Empire Server before 4.3.1 allow attackers to cause a denial of service (crash) via the (1) load, (2) spy and (3) bomb functions.

  • CVE-2006-1841Apr 19, 2006
    Kailash Nadh
    Boastmachine
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in boastMachine (bMachine) 2.7, and possibly other versions before 2.9b, allows remote attackers to inject arbitrary web script or HTML via the key parameter, as used by the search field.

  • CVE-2006-1842Apr 19, 2006
    Cynical Games
    Shoutbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in global.php in ShoutBOOK 1.1 allows remote attackers to inject arbitrary web script or HTML via the (1) NAME and (2) COMMENTS parameters.

  • CVE-2006-1843Apr 19, 2006
    Cynical Games
    Shoutbook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in global.php in ShoutBOOK 1.1 allows remote attackers to inject arbitrary web script or HTML via the (1) LOCATION and (2) URL parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third…

  • CVE-2006-1844Apr 19, 2006
    Debian
    Shadow
    risk 0.00cvss —epss 0.00

    The Debian installer for the (1) shadow 4.0.14 and (2) base-config 2.53.10 packages includes sensitive information in world-readable log files, including preseeded passwords and pppoeconf passwords, which might allow local users to gain privileges.

  • CVE-2006-1846Apr 19, 2006
    PHP-Nuke
    Your_Account
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to inject arbitrary HTML and web script via the ublock parameter, which is saved in the user's personal menu. NOTE: the provenance of this information is unknown;…

  • CVE-2006-1847Apr 19, 2006
    PHP-Nuke
    PHP Nuke
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to execute arbitrary SQL commands via the user_id parameter in the Your_Home functionality. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2006-1848Apr 19, 2006
    Linpha
    Linpha
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in stats_view.php in LinPHA 1.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) date_from, (2) date_to, and (3) date parameter.

  • CVE-2006-1849Apr 19, 2006
    XFlow
    xFlow
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in members_only/index.cgi in xFlow 5.46.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) position and (2) id parameter.

  • CVE-2006-1850Apr 19, 2006
    XFlow
    xFlow
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in xFlow 5.46.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) level, (2) position, (3) id, and (4) action parameters to members_only/index.cgi, and the (5) page parameter to…

  • CVE-2006-1851Apr 19, 2006
    Skymarx Solutions
    Xflow
    risk 0.00cvss —epss 0.01

    xFlow 5.46.11 and earlier allows remote attackers to determine the installation path of the application via the (1) action parameter to members_only/index.cgi and (2) page parameter customer_area/index.cgi, probably due to invalid values.

  • CVE-2006-1852Apr 19, 2006
    Article Publisher Pro
    Article Publisher Pro
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in category.php in Article Publisher Pro 1.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cname parameter.

  • CVE-2006-1853Apr 19, 2006
    Moderngigabyte
    Modernbill
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ModernBill 4.3.2 and earlier allow remote attackers or administrators to execute arbitrary SQL commands via the (1) id parameter in (a) user.php, or (2) where and (3) order parameters to (b) admin.php.

  • CVE-2006-1854Apr 19, 2006
    Bluepay
    Bluepay Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in BluePay Manager 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML during a login action via the (1) Account Name and (2) Username field. NOTE: the vendor has disputed this vulnerability, saying…

  • CVE-2006-1753Apr 18, 2006
    Debian
    linux
    risk 0.00cvss —epss 0.00

    A cron job in fcheck before 2.7.59 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.

  • CVE-2006-1827Apr 18, 2006
    Digium
    Asterisk
    risk 0.01cvss —epss 0.07

    Integer signedness error in format_jpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length.

  • CVE-2006-0744Apr 18, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Linux kernel before 2.6.16.5 does not properly handle uncanonical return addresses on Intel EM64T CPUs, which reports an exception in the SYSRET instead of the next instruction, which causes the kernel exception handler to run on the user stack with the wrong GS.

  • CVE-2006-1797Apr 18, 2006
    NetBSD
    NetBSD
    risk 0.00cvss —epss 0.00

    The kernel in NetBSD-current before September 28, 2005 allows local users to cause a denial of service (system crash) by using the SIOCGIFALIAS ioctl to gather information on a non-existent alias of a network interface, which causes a NULL pointer dereference.

  • CVE-2006-1798Apr 18, 2006
    Rateit
    Rateit
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in rateit.php in RateIt 2.2 allows remote attackers to execute arbitrary SQL commands via the rateit_id parameter.

  • CVE-2006-1799Apr 18, 2006
    Censtore
    censtore.cgi
    risk 0.03cvss —epss 0.03

    censtore.cgi in Censtore 7.3.002 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter.

  • CVE-2006-1800Apr 18, 2006
    SimpleBBS
    SimpleBBS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in posts.php in SimpleBBS 1.0.6 through 1.1 allows remote attackers to include and execute arbitrary files via ".." sequences in the language cookie, as demonstrated by by injecting the code into the gl_session cookie of users.php, which is…

  • CVE-2006-1801Apr 18, 2006
    PlanetSearch+
    planetSearch+
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in planetsearchplus.php in planetSearch+ allows remote attackers to inject arbitrary web script or HTML via the search_exp parameter.

  • CVE-2006-1802Apr 18, 2006
    Tinywebgallery
    Tinywebgallery
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in TinyWebGallery 1.3 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the twg_album parameter.

  • CVE-2006-1803Apr 18, 2006
    PhpMyAdmin
    phpMyAdmin
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to inject arbitrary web script or HTML via the sql_query parameter.

  • CVE-2006-1804Apr 18, 2006
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to execute arbitrary SQL commands via the sql_query parameter.

  • CVE-2006-1805Apr 18, 2006
    Powerscripts
    Powerclan
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in member.php in PowerClan 1.14 allows remote attackers to execute arbitrary SQL commands via the memberid parameter.

  • CVE-2006-1806Apr 18, 2006
    Musicbox
    Musicbox
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Musicbox 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter in a search action.

  • CVE-2006-1807Apr 18, 2006
    Musicbox
    Musicbox
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Musicbox 2.3.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) start parameter in a search action or (2) type parameter in a top action.

  • CVE-2006-1808Apr 18, 2006
    Lifetype
    Lifetype
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Lifetype 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the show parameter in a Template operation.

  • CVE-2006-1809Apr 18, 2006
    Lifetype
    Lifetype
    risk 0.00cvss —epss 0.01

    index.php in Lifetype 1.0.3 allows remote attackers to obtain sensitive information via an invalid show parameter, which reveals the path in an error message.

  • CVE-2006-1810Apr 18, 2006
    Flexbb
    Flexbb
    risk 0.00cvss —epss 0.00

    Multiple cross-site scripting (XSS) vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to inject arbitrary web script or HTML via the (1) ICQ, (2) AIM, (3) MSN, (4) Google Talk, (5) Website Name, (6) Website Address, (7) Email Address, (8) Location, (9) Signature, and…

  • CVE-2006-1811Apr 18, 2006
    Flexbb
    Flexbb
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) forumid, or (3) threadid parameter to index.php; the (4) ICQ, (5) AIM, (6) MSN, (7) Google Talk, (8) Website Name, (9) Website Address, (10)…

  • CVE-2006-1812Apr 18, 2006
    Phpwebftp
    Phpwebftp
    risk 0.00cvss —epss 0.01

    phpWebFTP 3.2 and earlier stores script.js under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information.

  • CVE-2006-1813Apr 18, 2006
    Phpwebftp
    Phpwebftp
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in index.php in phpWebFTP 3.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the language parameter.

  • CVE-2006-1814Apr 18, 2006
    NetBSD
    NetBSD
    risk 0.00cvss —epss 0.00

    NetBSD 1.6, 2.0, 2.1 and 3.0 allows local users to cause a denial of service (memory exhaustion) by using the sysctl system call to lock a large buffer into physical memory.

  • CVE-2006-1815Apr 18, 2006
    Tritanium Bulletin Board
    TBB
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in register.php in Tritanium Bulletin Board (TBB) 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) newuser_realname and (2) newuser_icq parameters, a different vector than CVE-2006-1768. NOTE:…

  • CVE-2006-1816Apr 18, 2006
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.03

    PHP remote file inclusion vulnerability in VBulletin 3.5.1, 3.5.2, and 3.5.4 allows remote attackers to execute arbitrary code via a URL in the systempath parameter to (1) ImpExModule.php, (2) ImpExController.php, and (3) ImpExDisplay.php.

  • CVE-2006-1817Apr 18, 2006
    Warforge.NEWS
    warforge.NEWS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in authcheck.php in warforge.NEWS 1.0, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the (1) authusername and possibly the (2) authpassword cookie.

  • CVE-2006-1818Apr 18, 2006
    Warforge.NEWS
    NEWS
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in warforge.NEWS 1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly including the (1) first_name and (2) last_name parameter in myaccounts.php. NOTE: portions of these details…

  • CVE-2006-1819Apr 18, 2006
    Phpwebsite
    Phpwebsite
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in the loadConfig function in index.php in phpWebSite 0.10.2 and earlier allows remote attackers to include arbitrary local files and execute arbitrary PHP code via the hub_dir parameter, as demonstrated by including access_log. NOTE: in some…

  • CVE-2006-1820Apr 18, 2006
    Modx
    MODX
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in ModX 0.9.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this might be resultant from the directory traversal vulnerability.

  • CVE-2006-1821Apr 18, 2006
    Modx
    MODX
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in ModX 0.9.1 allows remote attackers to read arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the id parameter.

  • CVE-2006-1822Apr 18, 2006
    Farsinews
    Farsinews
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search.php in FarsiNews 2.5.3 Pro and earlier allows remote attackers to inject arbitrary web script or HTML via the selected_search_arch parameter.

  • CVE-2006-1823Apr 18, 2006
    Farsinews
    Farsinews
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in FarsiNews 2.5.3 Pro and earlier allows remote attackers to obtain the installation path via ".." sequences in the archive parameter to index.php, which leaks the full pathname in an error message.

  • CVE-2006-1824Apr 18, 2006
    Phpguestbook
    Phpguestbook
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in PhpGuestbook.php in PhpGuestbook 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) Website, and (3) Comment parameter.

  • CVE-2006-1825Apr 18, 2006
    Phplinks
    Phplinks
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in phpLinks 2.1.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter.

  • CVE-2006-1826Apr 18, 2006
    Snipegallery
    Snipe Gallery
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Snipe Gallery 3.1.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gallery_id parameter in view.php, (2) keyword parameter in search.php, and (3) image_id parameter in image.php. NOTE:…

  • CVE-2006-1796Apr 17, 2006
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions before 2.0.1, allows remote attackers to inject arbitrary web script or HTML to Internet Explorer users via the request URI…