VYPR

CVEs

380,251 total · page 7278 of 7,606

AllCriticalHighKEV
  • CVE-2006-1208Mar 14, 2006
    Sergey Korostel
    PHP Upload Center
    risk 0.00cvss —epss 0.02

    Sergey Korostel PHP Upload Center allows remote attackers to execute arbitrary PHP code by uploading a file whose name ends in a .php.li extension, which can be accessed from the upload directory.

  • CVE-2006-1209Mar 14, 2006
    PHP Advanced Transfer Manager
    PHP Advanced Transfer Manager
    risk 0.03cvss —epss 0.03

    PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a users/[USERNAME] file.

  • CVE-2006-1210Mar 14, 2006
    IBM
    Tivoli Micromuse Netcool/NeuSecure
    risk 0.00cvss —epss 0.02

    The web interface for IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 includes the MySQL database username and password in cleartext in body.phtml, which allows remote attackers to gain privileges by reading the source. NOTE: IBM has privately confirmed to CVE that a fix is…

  • CVE-2006-1211Mar 14, 2006
    IBM
    Tivoli Micromuse Netcool/NeuSecure
    risk 0.00cvss —epss 0.01

    IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 configures a MySQL database to allow connections from any source IP address with the ns database account, which allows remote attackers to bypass the Netcool/NeuSecure application layer and perform unauthorized database actions. …

  • CVE-2006-1212Mar 14, 2006
    Corenews
    Corenews
    risk 0.03cvss —epss 0.04

    Unspecified vulnerability in index.php in Core CoreNews 2.0.1 allows remote attackers to execute arbitrary commands via the page parameter, possibly due to a PHP remote file include vulnerability. NOTE: this vulnerability could not be confirmed by source code inspection of…

  • CVE-2006-1213Mar 14, 2006
    Jiros
    Banner System
    risk 0.04cvss —epss 0.09

    JiRo's Banner System Experience and Professional 1.0 and earlier allows remote attackers to bypass access restrictions and gain privileges via a direct request to certain scripts in the files directory, as demonstrated by using addadmin.asp to create a new administrator account.

  • CVE-2006-1214Mar 14, 2006
    Unrealircd
    Unrealircd
    risk 0.03cvss —epss 0.04

    UnrealIRCd 3.2.3 allows remote attackers to cause an unspecified denial of service by causing a linked server to send malformed TKL Q:Line commands, as demonstrated by "TKL - q\x08Q *\x08PoC."

  • CVE-2006-1194Mar 13, 2006
    Enet
    Enet Library
    risk 0.03cvss —epss 0.04

    Integer signedness error in the enet_protocol_handle_incoming_commands function in protocol.c for ENet library CVS version Jul 2005 and earlier, as used in products including (1) Cube, (2) Sauerbraten, and (3) Duke3d_w32, allows remote attackers to cause a denial of service…

  • CVE-2006-1195Mar 13, 2006
    Enet
    Enet Library
    risk 0.00cvss —epss 0.02

    The enet_protocol_handle_send_fragment function in protocol.c for ENet library CVS version Jul 2005 and earlier, as used in products including (1) Cube, (2) Sauerbraten, and (3) Duke3d_w32, allows remote attackers to cause a denial of service (application crash) via a packet…

  • CVE-2006-1196Mar 13, 2006
    QwikiWiki
    QwikiWiki
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in QwikiWiki 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) from and (2) help parameters to (a) index.php; (3) action, (4) page, (5) debug, (6) help, (7) username, or (8) password parameters to…

  • CVE-2006-1197Mar 13, 2006
    Macrovision
    Safedisc
    risk 0.00cvss —epss 0.00

    SafeDisc installs the driver service for the secdrv.sys driver with insecure permissions, which allows local users to gain privileges by changing the configuration to reference a malicious program.

  • CVE-2006-0049Mar 13, 2006
    Gnupg
    Gnupg
    risk 0.00cvss —epss 0.02

    gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid,…

  • CVE-2006-0819Mar 13, 2006
    Dwarf
    Dwarf HTTP Server
    risk 0.00cvss —epss 0.02

    Dwarf HTTP Server 1.3.2 allows remote attackers to obtain the source code of JSP files via (1) dot, (2) space, (3) slash, or (4) NULL characters in the filename extension of an HTTP request.

  • CVE-2006-0820Mar 13, 2006
    Dwarf
    Dwarf HTTP Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Dwarf HTTP Server 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified error messages.

  • CVE-2006-0950Mar 13, 2006
    Unalz
    Unalz
    risk 0.00cvss —epss 0.02

    unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." (dot dot) sequences in a filename.

  • CVE-2006-1183Mar 13, 2006
    Ubuntu
    Linux
    risk 0.03cvss —epss 0.03

    The Ubuntu 5.10 installer does not properly clear passwords from the installer log file (questions.dat), and leaves the log file with world-readable permissions, which allows local users to gain privileges.

  • CVE-2006-0557Mar 12, 2006
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    sys_mbind in mempolicy.c in Linux kernel 2.6.16 and earlier does not sanity check the maxnod variable before making certain computations for the get_nodes function, which has unknown impact and attack vectors.

  • CVE-2006-1159Mar 12, 2006
    Easy File Sharing
    Web Server
    risk 0.04cvss —epss 0.07

    Format string vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in the query string argument in an HTTP GET request.

  • CVE-2006-1160Mar 12, 2006
    Easy File Sharing
    Web Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote attackers to inject arbitrary web script or HTML via the Description field in creating a folder or uploading a file.

  • CVE-2006-1161Mar 12, 2006
    Easy File Sharing
    Web Server
    risk 0.03cvss —epss 0.03

    Absolute path traversal vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote registered users to execute arbitrary code by uploading a malicious file to the Windows startup folder.

  • CVE-2006-1162Mar 12, 2006
    Nodez
    Nodez
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in Nodez 4.6.1.1 and earlier allows remote attackers to read or include arbitrary PHP files via a .. (dot dot) in the op parameter, as demonstrated by inserting malicious Email parameters into list.gtdat, then accessing list.gtdat using the op…

  • CVE-2006-1163Mar 12, 2006
    Nodez
    Nodez
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Nodez 4.6.1.1 allows remote attackers to inject arbitrary web script or HTML via the op parameter. NOTE: it is possible that this issue is resultant from the directory traversal vulnerability.

  • CVE-2006-1164Mar 12, 2006
    Nodez
    Nodez
    risk 0.03cvss —epss 0.03

    Nodez 4.6.1.1 and earlier stores sensitive data in the list.gtdat file under the web document root with insufficient access control, which allows remote attackers to obtain usernames and password hashes by directly accessing list.gtdat.

  • CVE-2006-1165Mar 12, 2006
    Dokuwiki
    Dokuwiki
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the mediamanager module in DokuWiki before 2006-03-05 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors relating to "handling EXIF data."

  • CVE-2006-1166Mar 12, 2006
    Monotone
    Monotone
    risk 0.00cvss —epss 0.00

    Monotone 0.25 and earlier, when a user creates a file in a directory called "mt", and when checking out that file on a case-insensitive file system such as Windows or Mac OS X, places the file into the "MT" bookkeeping directory, which could allow context-dependent attackers to…

  • CVE-2006-1155Mar 12, 2006
    Manas Tungare
    Site Membership Script
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to inject arbitrary web script or HTML via the Error parameter in (1) login.asp and (2) default.asp.

  • CVE-2006-1156Mar 12, 2006
    Manas Tungare
    Site Membership Script
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to execute arbitrary SQL commands via the Username parameter in login.asp.

  • CVE-2006-1157Mar 12, 2006
    Adp
    Adp Forum
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Vz Scripts ADP Forum 2.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the Subject field (possibly messaggio parameter) when posting a new message in post.php.

  • CVE-2006-1158Mar 12, 2006
    Kerio Technologies
    Kerio Mailserver
    risk 0.00cvss —epss 0.02

    Kerio MailServer before 6.1.3 Patch 1 allows remote attackers to cause a denial of service (application crash) via a crafted IMAP LOGIN command.

  • CVE-2006-1140Mar 10, 2006
    Redblog
    Redblog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in rss.php in RedBLoG 0.5 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.

  • CVE-2006-1141Mar 10, 2006
    QmailAdmin
    QmailAdmin
    risk 0.00cvss —epss 0.05

    Buffer overflow in qmailadmin.c in QmailAdmin before 1.2.10 allows remote attackers to execute arbitrary code via a long PATH_INFO environment variable.

  • CVE-2006-1142Mar 10, 2006
    Ravenous Web Server
    Ravenous Web Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Ravenous Web Server before 0.7.1 allows remote attackers to access arbitrary rvplg files, with unknown impact.

  • CVE-2006-1143Mar 10, 2006
    Ftpoed
    Ftpoed Blog Engine
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in FTPoed Blog Engine 1.1 allows remote attackers to inject arbitrary web script or HTML via the comment_body parameter, as used by the comment field, when posting a comment.

  • CVE-2006-1144Mar 10, 2006
    HitHost
    HitHost
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in HitHost 1.0.0 allows remote attackers to inject arbitrary web script or HTML via (1) the user parameter in deleteuser.php and (2) the hits parameter in viewuser.php.

  • CVE-2006-1145Mar 10, 2006
    Alien Arena
    Alien Arena
    risk 0.03cvss —epss 0.04

    Format string vulnerability in the safe_cprintf function in acebot_cmds.c in Alien Arena 2006 Gold Edition 5.00 allows remote attackers (possibly authenticated) to execute arbitrary code via unspecified vectors when the server sends crafted messages to the clients.

  • CVE-2006-1146Mar 10, 2006
    Alien Arena
    Alien Arena
    risk 0.03cvss —epss 0.05

    Stack-based buffer overflow in the Cmd_Say_f function in g_cmds.c in Alien Arena 2006 Gold Edition 5.00 allows remote attackers (possibly authenticated) to execute arbitrary code by sending a long message to the server.

  • CVE-2006-1147Mar 10, 2006
    Alien Arena
    Alien Arena
    risk 0.03cvss —epss 0.03

    The Com_sprintf function in q_shared.c in Alien Arena 2006 Gold Edition 5.00 does not properly NULL terminate certain long strings, which allows remote attackers (possibly authenticated) to cause a denial of service (application crash) via a long skin, weapon, or model name.

  • CVE-2006-1148Mar 10, 2006
    Peercast
    Peercast
    risk 0.09cvss —epss 0.73

    Multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp in PeerCast before 0.1217 allow remote attackers to execute arbitrary code via an HTTP GET request with a long (1) parameter name or (2) value in a URL, which triggers the overflow in the…

  • CVE-2006-1149Mar 10, 2006
    Owl
    Owl Intranet Engine
    risk 0.04cvss —epss 0.10

    PHP remote file inclusion vulnerability in lib/OWL_API.php in OWL Intranet Engine 0.82, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the xrms_file_root parameter, which is not initialized before use.

  • CVE-2006-1150Mar 10, 2006
    Teg
    Tenes Empanadas Graciela
    risk 0.00cvss —epss 0.02

    Buffer overflow in Tenes Empanadas Graciela (TEG) 0.11.1, automatically appends an _ (underscore) to the end of duplicate nicknames, which allows remote attackers to cause a denial of service (application crash) by creating multiple users with long, identical nicknames, which…

  • CVE-2006-1151Mar 10, 2006
    M Phorum
    M Phorum
    risk 0.03cvss —epss 0.04

    Cross-site scripting vulnerability in index.php in M-Phorum 0.2 allows remote attackers to inject arbitrary web script or HTML via the go parameter.

  • CVE-2006-1152Mar 10, 2006
    M Phorum
    M Phorum
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in index.php in M-Phorum 0.2 allows remote attackers to include arbitrary files via the go parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2006-1153Mar 10, 2006
    D2 Shoutbox
    D2 Shoutbox
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in D2-Shoutbox 4.2 allows remote attackers to execute arbitrary SQL commands via the load parameter, when performing a Shoutbox action through Invision Power Board (IPB).

  • CVE-2006-1154Mar 10, 2006
    Fscripts
    Fantastic News
    risk 0.00cvss —epss 0.03

    PHP remote file inclusion vulnerability in archive.php in Fantastic News 2.1.2 allows remote attackers to include arbitrary files via the CONFIG[script_path] variable. NOTE: 2.1.4 was also reported to be vulnerable.

  • CVE-2006-1129Mar 10, 2006
    Ekinboard
    Ekinboard
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in config.php in EKINboard 1.0.3 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username cookie.

  • CVE-2006-1130Mar 10, 2006
    Ekinboard
    Ekinboard
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in EKINboard 1.0.3 allows remote attackers to inject arbitrary web script or HTML via a Javascript URI in a BBCode img tag.

  • CVE-2006-1131Mar 10, 2006
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in read.php in bitweaver CMS 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the comment_title parameter.

  • CVE-2006-1132Mar 10, 2006
    Vbzoom
    Vbzoom
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in show.php in vbzoom 1.11 allow remote attackers to execute arbitrary SQL commands via the MainID parameter. NOTE: the SubjectID vector is already covered by CVE-2005-4729.

  • CVE-2006-1133Mar 10, 2006
    Vbzoom
    Vbzoom
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in vbzoom 1.11 allow remote attackers to inject arbitrary web script or HTML via the UserID parameter to (1) comment.php or (2) contact.php. NOTE: the profile.php/UserName vector is already covered by CVE-2005-2441.

  • CVE-2006-1134Mar 10, 2006
    Cyboards
    PHP Lite
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in CyBoards PHP Lite 1.25, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the parent parameter to (1) post.php and possibly (2) process_post.php.