VYPR

CVEs

380,299 total · page 7272 of 7,606

AllCriticalHighKEV
  • CVE-2006-1610Apr 4, 2006
    Squery
    Squery
    risk 0.04cvss —epss 0.08

    PHP remote file inclusion vulnerability in lib/armygame.php in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party (ALP), allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter. NOTE: this only occurs when register_globals…

  • CVE-2006-1611Apr 4, 2006
    KGB Archiver
    KGB Archiver
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in KGB Archiver before 1.1.5.22 allows remote attackers to overwrite arbitrary files wile decompressing an archive, possibly due to directory traversal sequences in a filename.

  • CVE-2006-1612Apr 4, 2006
    Aweb Labs
    Awebnews
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in visview.php in aWebNews 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) yname, (2) emailadd, (3) subject, and (4) comment parameters.

  • CVE-2006-1613Apr 4, 2006
    Aweb Labs
    Awebnews
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in aWebNews 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) user123 variable in (a) login.php or (b) fpass.php; or (2) cid parameter to (c) visview.php.

  • CVE-2006-1598Apr 3, 2006
    An
    An Httpd
    risk 0.00cvss —epss 0.02

    AN HTTPD 1.42n, and possibly other versions before 1.42p, allows remote attackers to obtain source code of scripts via crafted requests with (1) dot and (2) space characters in the file extension.

  • CVE-2006-1599Apr 3, 2006
    Vcreator
    v-creator
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in VCEngine.php in v-creator before 1.3-pre3, when the VC_CRYPTO_METHOD option is OPENSSL, allows remote attackers to execute arbitrary commands, possibly due to problems in the (1) encrypt and (2) decrypt functions.

  • CVE-2006-1600Apr 3, 2006
    Phpwebgallery
    Phpwebgallery
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in category.php in PhpWebGallery 1.4.1 allows remote attackers to execute arbitrary SQL commands via the search parameter.

  • CVE-2006-1433Apr 3, 2006
    Annuaire
    Directory
    risk 0.00cvss —epss 0.02

    Annuaire (Directory) 1.0 allows remote attackers to obtain sensitive information via a direct request to include/lang-en.php, which reveals the full installation path.

  • CVE-2006-1434Apr 3, 2006
    Annuaire
    Directory
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in inscription.php in Annuaire (Directory) 1.0 allows remote attackers to inject arbitrary web script or HTML via the Comment Field (COMMENTAIRE parameter).

  • CVE-2006-1435Apr 3, 2006
    Aria
    Aria
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in genmessage.php in Accounting Receiving and Inventory Administration (ARIA) 0.99-6 allows remote attackers to inject arbitrary web script or HTML via the Message Field (message parameter).

  • CVE-2006-1438Apr 3, 2006
    Andy Grayndler
    Andys PHP Knowledgebase
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Andy's PHP Knowledgebase (aphpkb) 0.57 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword_list parameter to (a) index.php; (2) title, (3) article, (4) author, and (5) keywords parameters to (b)…

  • CVE-2006-1587Apr 3, 2006
    NetBSD
    NetBSD
    risk 0.00cvss —epss 0.00

    NetBSD 1.6 up to 3.0, when a user has "set record" in .mailrc with the default umask set, creates the record file with 0644 permissions, which allows local users to read the record file.

  • CVE-2006-1588Apr 3, 2006
    NetBSD
    NetBSD
    risk 0.00cvss —epss 0.00

    The bridge ioctl (if_bridge code) in NetBSD 1.6 through 3.0 does not clear sensitive memory before copying ioctl results to the requesting process, which allows local users to obtain portions of kernel memory.

  • CVE-2006-1589Apr 3, 2006
    NetBSD
    NetBSD
    risk 0.00cvss —epss 0.00

    The elf_load_file function in NetBSD 2.0 through 3.0 allows local users to cause a denial of service (kernel crash) via an ELF interpreter that does not have a PT_LOAD section in its header, which triggers a null dereference.

  • CVE-2006-1590Apr 3, 2006
    Secureideas
    Basic Analysis and Security Engine
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the PrintFreshPage function in (1) Basic Analysis and Security Engine (BASE) 1.2.4 and (2) Analysis Console for Intrusion Databases (ACID) 0.9.6b23 allows remote attackers to inject arbitrary web script or HTML via the (a) back…

  • CVE-2006-1591Apr 3, 2006
    Microsoft
    Windows Help
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in Microsoft Windows Help winhlp32.exe allows user-assisted attackers to execute arbitrary code via crafted embedded image data in a .hlp file.

  • CVE-2006-1592Apr 3, 2006
    Zdaemon
    Zdaemon
    risk 0.00cvss —epss 0.05

    Buffer overflow in the is_client_wad_ok function in w_wad.cpp for (1) Zdaemon 1.08.01 and (2) X-Doom allows remote attackers to execute arbitrary code via a long filename argument.

  • CVE-2006-1593Apr 3, 2006
    Zdaemon
    Zdaemon
    risk 0.03cvss —epss 0.05

    The (1) ZD_MissingPlayer, (2) ZD_UseItem, and (3) ZD_LoadNewClientLevel functions in sv_main.cpp for (a) Zdaemon 1.08.01 and (b) X-Doom allows remote attackers to cause a denial of service (crash) via an invalid player slot or item number, which causes an invalid memory access,…

  • CVE-2006-1594Apr 3, 2006
    Claroline
    Claroline
    risk 0.00cvss —epss 0.05

    Multiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and earlier allow remote attackers to use ".." (dot dot) sequences to (1) read arbitrary files via the file parameter in a rqEditHtml command to document/rqmkhtml.php or (2) execute…

  • CVE-2006-1595Apr 3, 2006
    Claroline
    Claroline
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in document/rqmkhtml.php in Claroline 1.7.4 and earlier allows remote attackers to read arbitrary files via ".." sequences in the file parameter in a rqEditHtml command.

  • CVE-2006-1596Apr 3, 2006
    Claroline
    Claroline
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in learnPath/include/scormExport.inc.php in Claroline 1.7.4 and earlier allows remote attackers to execute arbitrary PHP code via the includePath parameter.

  • CVE-2006-1575Apr 2, 2006
    Vscripts.pl
    Qlnews
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in news.php in QLnews 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) autorx and (2) newsx parameters.

  • CVE-2006-1576Apr 2, 2006
    QLnews
    QLnews
    risk 0.00cvss —epss 0.02

    Direct static code injection vulnerability in QLnews 1.2 allows remote authenticated administrators to execute arbitrary PHP code by modifying config.php.

  • CVE-2006-1577Apr 2, 2006
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in view_all_set.php in Mantis 1.0.1, 1.0.0rc5, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) start_day, (2) start_year, and (3) start_month parameters.

  • CVE-2006-1578Apr 2, 2006
    Index Data Aps
    Keystone Digital Library Suite
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Keystone Digital Library Suite (DLS) 1.5.4 and earlier allow remote attackers to execute arbitrary SQL commands via the subject_type_id parameter in (1) the index page and (2) the search module.

  • CVE-2006-1579Apr 2, 2006
    Dbbs
    Dbbs
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in topics.php in Dynamic Bulletin Board System (DbbS) 2.0-alpha and earlier allows remote attackers to execute arbitrary SQL commands via the limite parameter.

  • CVE-2006-1580Apr 2, 2006
    Websina
    Bugzero
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Bugzero 4.3.1 and other versions allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter in query.jsp and (2) entryId parameter in edit.jsp.

  • CVE-2006-1581Apr 2, 2006
    Blanknberg
    Blanknberg
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in Blank'N'Berg 0.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the _path parameter.

  • CVE-2006-1582Apr 2, 2006
    Blanknberg
    Blanknberg
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Blank'N'Berg 0.2 allows remote attackers to inject arbitrary web script or HTML via the _path parameter. NOTE: this might be resultant from the directory traversal issue.

  • CVE-2006-1583Apr 2, 2006
    Warcraft III Replay Parser for PHP
    Warcraft III Replay Parser for PHP
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Warcraft III Replay Parser for PHP 1.8c allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: post-disclosure analysis by CVE suggests that the "page" parameter is not used in this…

  • CVE-2006-1584Apr 2, 2006
    Warcraft III Replay Parser for PHP
    Warcraft III Replay Parser for PHP
    risk 0.03cvss —epss 0.06

    Unspecified vulnerability in index.php in Warcraft III Replay Parser for PHP 1.8c allows remote attackers to inject arbitrary web script or HTML via the page parameter, possibly related to fopen function calls or file uploads. NOTE: post-disclosure analysis by CVE suggests that…

  • CVE-2006-1585Apr 2, 2006
    3dsrc
    Monalbum
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MonAlbum 0.8.7 allow remote attackers to execute arbitrary SQL commands via (1) the pc parameter in (a) index.php and (2) pnom, (3) pcourriel, and (4) pcommentaire parameters in (b) image_agrandir.php.

  • CVE-2006-1586Apr 2, 2006
    ISP of Egypt
    SiteMan
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin_login.asp in ISP of Egypt SiteMan allows remote attackers to execute arbitrary SQL commands via the pass parameter.

  • CVE-2006-1567Apr 1, 2006
    Sitesearch
    Indexer
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in searchresults.asp in SiteSearch Indexer 3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchField parameter.

  • CVE-2006-1568Apr 1, 2006
    Redcms
    Redcms
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in register.php in RedCMS 0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) email, (2) location, or (3) website parameters.

  • CVE-2006-1569Apr 1, 2006
    Redcms
    Redcms
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in RedCMS 0.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters to (a) login.php or (b) register.php; or (3) u parameter to (c) profile.php.

  • CVE-2006-1570Apr 1, 2006
    Esqlanelapse
    Esqlanelapse
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Esqlanelapse 2.0 and 2.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  • CVE-2006-1571Apr 1, 2006
    qliteNews
    qliteNews
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in loginprocess.php in qliteNews 2005.07.01 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.

  • CVE-2006-1572Apr 1, 2006
    Oxygen
    Oxygen
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in post.php in Oxygen 1.1.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter in a newthread action.

  • CVE-2006-1573Apr 1, 2006
    Mediaslash.com
    Mediaslash Gallery
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php in MediaSlash Gallery allows remote attackers to execute arbitrary PHP code via a URL in the rub parameter (part of the $page_menu variable).

  • CVE-2006-1574Apr 1, 2006
    Hitachi
    Groupmax World Wide Web
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Groupmax World Wide Web, World Wide Web Desktop, World Wide Web for Scheduler, and Desktop for Scheduler, allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  • CVE-2006-0052Mar 31, 2006
    Mailman
    Mailman
    risk 0.00cvss —epss 0.03

    The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between…

  • CVE-2006-1552Mar 31, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    Integer overflow in ImageIO in Apple Mac OS X 10.4 up to 10.4.5 allows remote attackers to cause a denial of service (crash) via a crafted JPEG image with malformed JPEG metadata, as demonstrated using Safari, aka "Deja-Doom".

  • CVE-2006-1553Mar 31, 2006
    VSNS
    Lemon
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in functions/final_functions.php in VSNS Lemon 3.2.0, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-1554Mar 31, 2006
    VSNS
    Lemon
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in VSNS Lemon 3.2.0 allows remote attackers to inject arbitrary web script or HTML via the name parameter while adding a comment.

  • CVE-2006-1555Mar 31, 2006
    VSNS
    Lemon
    risk 0.00cvss —epss 0.02

    VSNS Lemon 3.2.0 allows remote attackers to bypass authentication and access password-protected articles by setting the vsns[topic_id] cookie to the targeted topic.

  • CVE-2006-1556Mar 31, 2006
    Al Caricatier
    Al Caricatier
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in view_caricatier.php in AL-Caricatier 2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) CatName, (2) CaricatierID, or (3) CatID parameter.

  • CVE-2006-1557Mar 31, 2006
    Skintech
    X Changer
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in X-Changer 0.2 allow remote attackers to execute arbitrary SQL commands via the (1) from and (2) into parameters in a calculate action, and the (3) id parameter in an edit action to index.php.

  • CVE-2006-1558Mar 31, 2006
    PHP
    PHP Script Index
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in PHP Script Index allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2006-1559Mar 31, 2006
    PHP
    PHP Script Index
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in PHP Script Index allows remote attackers to execute arbitrary SQL commands via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.