VYPR

CVEs

380,272 total · page 7276 of 7,606

AllCriticalHighKEV
  • CVE-2006-1325Mar 21, 2006
    Streber
    Streber
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Streber 0.055 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  • CVE-2006-1326Mar 21, 2006
    Invision Power Services
    Power Board
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board 2.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) result_type, (2) search_in, (3) nav, (4) forums, and (5) s parameters in the Search action to index.php; (6) st parameter…

  • CVE-2006-1327Mar 21, 2006
    Softbb
    Softbb
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in reg.php in SoftBB 0.1 allows remote attackers to execute arbitrary SQL commands via the mail parameter.

  • CVE-2006-1328Mar 21, 2006
    Skull Splitter
    Download Counter Wallpaper
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in count.php in Skull-Splitter PHP Downloadcounter for Wallpapers 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) count_fieldname, (2) url_fieldname, or (3) url parameter.

  • CVE-2006-1329Mar 21, 2006
    Jabberstudio
    Jabberd
    risk 0.00cvss —epss 0.03

    The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service ("c2s segfault") by sending a "response stanza before an auth stanza".

  • CVE-2006-1330Mar 21, 2006
    Phpwebsite
    Phpwebsite
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in phpWebsite 0.83 and earlier allow remote attackers to execute arbitrary SQL commands via the sid parameter to (1) friend.php or (2) article.php.

  • CVE-2006-1331Mar 21, 2006
    Noah's Classifieds
    Noah's Classifieds
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Noah's Classifieds 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) method or (2) list parameter.

  • CVE-2006-1332Mar 21, 2006
    Noah's Classifieds
    Noah's Classifieds
    risk 0.00cvss —epss 0.02

    Noah's Classifieds 1.3 and earlier allows remote attackers to obtain sensitive information via an invalid list parameter in the showdetails method to index.php, which reveals the path in an error message.

  • CVE-2006-1333Mar 21, 2006
    Betaparticle
    Betaparticle Blog
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in BetaParticle Blog 6.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to template_permalink.asp or (2) fldGalleryID parameter to template_gallery_detail.asp.

  • CVE-2006-1334Mar 21, 2006
    Maianscriptworld
    Weblog
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Maian Weblog 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) entry and (2) email parameters to (a) print.php and (b) mail.php.

  • CVE-2006-1335Mar 21, 2006
    GNOME Foundation
    Screensaver
    risk 0.00cvss —epss 0.00

    gnome screensaver before 2.14, when running on an X server with AllowDeactivateGrabs and AllowClosedownGrabs enabled, allows attackers with physical access to cause the screensaver to crash and access the session via the Ctl+Alt+Keypad-Multiply keyboard sequence, which removes…

  • CVE-2006-1322Mar 20, 2006
    Novell
    Netware
    risk 0.00cvss —epss 0.03

    Novell Netware NWFTPD 5.06.05 allows remote attackers to cause a denial of service (ABEND) via an MDTM command that uses a long path for the target file, possibly due to a buffer overflow.

  • CVE-2006-1323Mar 20, 2006
    WinHKI
    WinHKI
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in WinHKI 1.6 and earlier allows user-assisted attackers to overwrite arbitrary files via a (1) RAR, (2) TAR, (3) ZIP, or (4) TAR.GZ archive with a file whose file name contains ".." sequences.

  • CVE-2006-1319Mar 20, 2006
    Runit
    Runit
    risk 0.00cvss —epss 0.00

    chpst in runit 1.3.3-1 for Debian GNU/Linux, when compiled on little endian i386 machines against dietlibc, does not properly handle when multiple groups are specified in the -u option, which causes chpst to assign permissions for the root group due to inconsistent bit sizes for…

  • CVE-2006-1320Mar 20, 2006
    Rssh
    Rssh
    risk 0.00cvss —epss 0.02

    util.c in rssh 2.3.0 in Debian GNU/Linux does not use braces to make a block, which causes a check for CVS to always succeed and allows rsync and rdist to bypass intended access restrictions in rssh.conf.

  • CVE-2006-1321Mar 20, 2006
    Webcheck
    Webcheck
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in webcheck before 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the (1) url, (2) title, or (3) author name in a crawled page, which is not properly sanitized in the tooltips of a report.

  • CVE-2006-1284Mar 19, 2006
    Symantec
    Ghost Solutions Suite
    risk 0.00cvss —epss 0.00

    The installation of SQLAnywhere in Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, includes a default administrator login account and password, which allows local users to gain privileges or modify tasks.

  • CVE-2006-1285Mar 19, 2006
    Symantec
    Ghost Solutions Suite
    risk 0.00cvss —epss 0.00

    SQLAnywhere in Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, gives read and write permissions to all users for database shared memory sections, which allows local users to access and possibly modify certain information.

  • CVE-2006-1286Mar 19, 2006
    Symantec
    Ghost Solutions Suite
    risk 0.00cvss —epss 0.00

    Buffer overflow in the login dialog in dbisqlc.exe in SQLAnywhere for Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, might allow local users to read certain sensitive information from the database.

  • CVE-2006-1287Mar 19, 2006
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB) 2.0.4 and 2.1.4 before 20060130 allows remote attackers to steal cookies and probably conduct other activities when the victim is using Internet Explorer.

  • CVE-2006-1288Mar 19, 2006
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to (1) arrays of id/stamp pairs and (2) the keys in arrays of key/value pairs in ipsclass.php; (3)…

  • CVE-2006-1289Mar 19, 2006
    Milkeyway
    Milkeyway Captive Portal
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) password, (3) team, (4) level, (5) status, (6) teamname, and (7) teamlead parameters in (a) auth.php; the (8)…

  • CVE-2006-1290Mar 19, 2006
    Milkeyway
    Milkeyway Captive Portal
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) ipAddress, (2) act, (3) username, and (4) unspecified other parameters in (a) authuser.php; and the (5)…

  • CVE-2006-1291Mar 19, 2006
    PHP Icalendar
    Phpicalendar
    risk 0.04cvss —epss 0.07

    publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write access to the calendars directory, which allows remote attackers to upload and execute arbitrary PHP scripts via a WebDAV PUT request with a filename containing a…

  • CVE-2006-1292Mar 19, 2006
    PHP Icalendar
    Phpicalendar
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the phpicalendar[cookie_language] and…

  • CVE-2006-1293Mar 19, 2006
    Contrexx
    Contrexx CMS
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Contrexx CMS 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF).

  • CVE-2006-1294Mar 19, 2006
    Knowledgebasepublisher
    Knowledgebasepublisher
    risk 0.00cvss —epss 0.02

    PHP remote file include vulnerability in PageController.php in KnowledgebasePublisher 1.2 allows remote attackers to include and execute arbitrary PHP code via a URL in the dir parameter.

  • CVE-2006-1295Mar 19, 2006
    Spip
    Spip
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in recherche.php3 in SPIP 1.8.2-g allows remote attackers to inject arbitrary web script or HTML via the recherche parameter.

  • CVE-2006-1296Mar 19, 2006
    Beagle
    Beagle
    risk 0.00cvss —epss 0.01

    Untrusted search path vulnerability in Beagle 0.2.2.1 might allow local users to gain privileges via a malicious beagle-info program in the current working directory, or possibly directories specified in the PATH.

  • CVE-2006-1297Mar 19, 2006
    Symantec
    Backup Exec
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Veritas Backup Exec for Windows Server Remote Agent 9.1 through 10.1, for Netware Servers and Remote Agent 9.1 and 9.2, and Remote Agent for Linux Servers 10.0 and 10.1 allow attackers to cause a denial of service (application crash or…

  • CVE-2006-1298Mar 19, 2006
    Symantec
    Backup Exec
    risk 0.00cvss —epss 0.02

    Format string vulnerability in the Job Engine service (bengine.exe) in the Media Server in Veritas Backup Exec 10d (10.1) for Windows Servers rev. 5629, Backup Exec 10.0 for Windows Servers rev. 5520, Backup Exec 10.0 for Windows Servers rev. 5484, and Backup Exec 9.1 for…

  • CVE-2006-1273Mar 19, 2006
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox 1.0.7 and 1.5.0.1 allows remote attackers to cause a denial of service (crash) via an HTML tag with a large number of script action handlers such as onload and onmouseover, which triggers the crash when the user views the page source. NOTE: Red Hat has disputed…

  • CVE-2006-1274Mar 19, 2006
    AntiVir
    PersonalEdition Classic
    risk 0.00cvss —epss 0.00

    Classic Planer in AntiVir PersonalEdition Classic 7 does not drop privileges before executing external programs, which allows local users to gain privileges via notepad.exe, which is used to display scan reports.

  • CVE-2006-1275Mar 19, 2006
    Ggz Gaming Zone
    Ggz Gaming Zone
    risk 0.03cvss —epss 0.04

    GGZ Gaming Zone 0.0.12 allows remote attackers to cause a denial of service (client disconnect) via inputs that produce malformed XML, including (1) trailing ' (apostrophe) character on the ID attribute in a PLAYER XML tag, (2) joining with a long ID attribute or non-trailing '…

  • CVE-2006-1276Mar 19, 2006
    Himpfen Consulting
    PHP Simplenews
    risk 0.00cvss —epss 0.04

    admin.php in Himpfen Consulting Company PHP SimpleNEWS 1.0.0 allows remote attackers to bypass authentication by setting the admin parameter in a cookie.

  • CVE-2006-1277Mar 19, 2006
    @1 File Store
    @1 File Store
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in signup.php in @1 File Store 2006.03.07 allows remote attackers to inject arbitrary web script or HTML via the (1) real_name, (2) email, and (3) login parameters.

  • CVE-2006-1278Mar 19, 2006
    @1
    File Store
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) functions.php and (2) user.php in the libs directory, (3) edit.php and (4) delete.php in control/files/, (5) edit.php and (6) delete.php…

  • CVE-2006-1279Mar 19, 2006
    CGI::Session
    CGI::Session
    risk 0.00cvss —epss 0.01

    CGI::Session 4.03-1 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by (1) Driver::File, (2) Driver::db_file, and possibly (3) Driver::sqlite.

  • CVE-2006-1280Mar 19, 2006
    CGI::Session
    CGI::Session
    risk 0.00cvss —epss 0.02

    CGI::Session 4.03-1 does not set proper permissions on temporary files created in (1) Driver::File and (2) Driver::db_file, which allows local users to obtain privileged information, such as session keys, by viewing the files.

  • CVE-2006-1281Mar 19, 2006
    PhpBB
    Mybulletinboard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in member.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vulnerability than CVE-2006-1272. NOTE: 1.10 was later reported to be vulnerable.

  • CVE-2006-1282Mar 19, 2006
    MyBB
    Mybb
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in inc/function.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to conduct cross-site scripting (XSS), poison caches, or hijack pages via CRLF (%0A%0D) sequences in the Referrer HTTP header field, possibly when redirecting to other web…

  • CVE-2006-1260Mar 19, 2006
    Horde (software)
    Horde
    risk 0.04cvss —epss 0.12

    Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check.

  • CVE-2006-1261Mar 19, 2006
    Aspapps
    Aspportal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ASPPortal 3.00 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  • CVE-2006-1262Mar 19, 2006
    Aspapps
    Aspportal
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in ASPPortal 3.00 have unknown impact and attack vectors.

  • CVE-2006-1263Mar 19, 2006
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  • CVE-2006-1264Mar 19, 2006
    Xhawk.net
    Discussion
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in xhawk.net discussion 2.0 beta2 allows remote attackers to inject arbitrary web script or HTML via a Javascript URI in a BBCode img tag.

  • CVE-2006-1265Mar 19, 2006
    Xhawk.net
    Discussion
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in discussion.class.php in xhawk.net discussion 2.0 beta2 allows remote attackers to execute arbitrary SQL commands via the view parameter.

  • CVE-2006-1266Mar 19, 2006
    VPMi
    VPMi Enterprise
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Service_Requests.asp in VPMi Enterprise 3.3 allows remote attackers to inject arbitrary web script or HTML via the Request_Name_Display parameter.

  • CVE-2006-1267Mar 19, 2006
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.01

    Invision Power Board 2.1.4 allows remote attackers to hijack sessions and possibly gain administrative privileges by obtaining the session ID from the s parameter, then replaying it in another request.

  • CVE-2006-1268Mar 19, 2006
    Funkwerk
    X2300
    risk 0.00cvss —epss 0.03

    The Internet Key Exchange implementation in Funkwerk X2300 7.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite. NOTE: due to the lack of details in the advisory,…