VYPR

CVEs

379,992 total · page 7282 of 7,600

AllCriticalHighKEV
  • CVE-2006-0704Feb 15, 2006
    Ie
    Ie Integrator
    risk 0.00cvss —epss 0.01

    iE Integrator 4.4.220114, when configured without a "bespoke error page" in acm.ini, allows remote attackers to obtain sensitive information via a URL that calls a non-existent .aspx script in the integrator/apps directory, which results in an error message that displays the…

  • CVE-2006-0705Feb 15, 2006
    F-Secure
    F Secure SSH Server
    risk 0.01cvss —epss 0.10

    Format string vulnerability in a logging function as used by various SFTP servers, including (1) AttachmateWRQ Reflection for Secure IT UNIX Server before 6.0.0.9, (2) Reflection for Secure IT Windows Server before 6.0 build 38, (3) F-Secure SSH Server for Windows before 5.3…

  • CVE-2006-0706Feb 15, 2006
    Scripter.ch
    Gastebuch
    risk 0.03cvss —epss 0.02

    Cross-site scripting vulnerability in eintrag.php in Gästebuch (Gastebuch) before 1.3.3 allows remote attackers to inject arbitrary web script or HTML via the URL, which is used in the homepage parameter.

  • CVE-2006-0707Feb 15, 2006
    Pyblosxom
    Pyblosxom
    risk 0.00cvss —epss 0.01

    PyBlosxom before 1.3.2, when running on certain webservers, allows remote attackers to read arbitrary files via an HTTP request with multiple leading / (slash) characters, which is accessed using the PATH_INFO variable.

  • CVE-2006-0708Feb 15, 2006
    Nullsoft
    Winamp
    risk 0.01cvss —epss 0.07

    Multiple buffer overflows in NullSoft Winamp 5.13 and earlier allow remote attackers to execute arbitrary code via (1) an m3u file containing a long URL ending in .wma, (2) a pls file containing a File1 field with a long URL ending in .wma, or (3) an m3u file with a long…

  • CVE-2006-0709Feb 15, 2006
    Metamail Corporation
    Metamail
    risk 0.01cvss —epss 0.06

    Buffer overflow in Metamail 2.7-50 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via e-mail messages with a long boundary attribute, a different vulnerability than CVE-2004-0105.

  • CVE-2006-0710Feb 15, 2006
    Isode
    M Vault Server
    risk 0.03cvss —epss 0.05

    Double free vulnerability in isode.eddy in Isode M-Vault Server 11.3 allows remote attackers to execute arbitrary code via a crafted LDAP request, as demonstrated by ProtoVer Sample LDAP.

  • CVE-2006-0711Feb 15, 2006
    Neomail
    Neomail
    risk 0.00cvss —epss 0.01

    The (1) addfolder and (2) deletefolder functions in neomail-prefs.pl in NeoMail 1.28 do not validate the Session ID, which allows remote attackers to add and delete arbitrary files, when configured with homedirfolders and homedirspools disabled.

  • CVE-2006-0712Feb 15, 2006
    Squishdot
    Squishdot
    risk 0.00cvss —epss 0.02

    mail_html template in Squishdot 1.5.0 and earlier does not properly validate the (1) email and (2) title variables, which allows remote attackers to bypass spam filters by injecting SMTP headers, probably due to a CRLF injection vulnerability.

  • CVE-2006-0713Feb 15, 2006
    Linpha
    Linpha
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php, (3) install/sec_stage_install.php, (4)…

  • CVE-2006-0714Feb 15, 2006
    Flyspray
    Flyspray
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in the installation file (sql/install-0.9.7.php) in Flyspray 0.9.7 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the adodbpath parameter.

  • CVE-2006-0715Feb 15, 2006
    Solucija
    Snews
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in sNews 1.3 allows remote attackers to inject arbitrary web script or HTML via the comment field.

  • CVE-2006-0716Feb 15, 2006
    Solucija
    Snews
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in sNews 1.3 allows remote attackers to execute arbitrary SQL commands via the (1) category and (2) id parameters.

  • CVE-2006-0717Feb 15, 2006
    IBM
    Tivoli Directory Server
    risk 0.04cvss —epss 0.10

    IBM Tivoli Directory Server 6.0 allows remote attackers to cause a denial of service (crash) via a crafted LDAP request, as demonstrated by test 2532 in the ProtoVer Sample LDAP test suite.

  • CVE-2006-0680Feb 15, 2006
    Plain Black
    Webgui
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in WebGUI before 6.8.6-gamma allows remote attackers to create an account, when anonymous registration is disabled, via a certain URL.

  • CVE-2006-0681Feb 15, 2006
    Power Daemon
    Power Daemon
    risk 0.03cvss —epss 0.04

    Format string vulnerability in powerd.c in Power Daemon (powerd) 2.0.2 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the WHATIDO variable.

  • CVE-2006-0682Feb 15, 2006
    E107
    E107
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in bbcodes system in e107 before 0.7.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  • CVE-2006-0683Feb 15, 2006
    Virtual Hosting Control System
    Virtual Hosting Control System
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Virtual Hosting Control System (VHCS) 2.4.7.1 with v.1 patch and earlier allows remote attackers to inject arbitrary web script or HTML via the username, which is recorded in a log file but not properly handled when the administrator…

  • CVE-2006-0684Feb 15, 2006
    Virtual Hosting Control System
    Virtual Hosting Control System
    risk 0.03cvss —epss 0.03

    change_password.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not verify the old password when a user changes the password, which may allow remote attackers to gain unauthorized access.

  • CVE-2006-0685Feb 15, 2006
    Virtual Hosting Control System
    Virtual Hosting Control System
    risk 0.03cvss —epss 0.05

    The check_login function in login.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not exit when authentication fails, which allows remote attackers to gain unauthorized access.

  • CVE-2006-0686Feb 15, 2006
    Virtual Hosting Control System
    Virtual Hosting Control System
    risk 0.00cvss —epss 0.03

    add_user.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not check user privileges when adding a new administrative user, which allows remote attackers to gain unauthorized access.

  • CVE-2006-0687Feb 15, 2006
    Docmgr
    Docmgr
    risk 0.03cvss —epss 0.03

    process.php in DocMGR 0.54.2 does not initialize the $siteModInfo variable when a direct request is made, which allows remote attackers to include arbitrary local files or possibly remote files via a modified includeModule and siteModInfo variable.

  • CVE-2006-0006Feb 14, 2006
    Microsoft
    Windows 2000
    risk 0.07cvss —epss 0.50

    Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4, Media Player 9 on Windows 2000 SP4 and XP SP1, and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap…

  • CVE-2006-0382Feb 14, 2006
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Apple Mac OS X 10.4.5 and allows local users to cause a denial of service (crash) via an undocumented system call.

  • CVE-2006-0451Feb 14, 2006
    Fedorahosted
    Directory Server
    risk 0.00cvss —epss 0.02

    Multiple memory leaks in the LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (memory consumption) via invalid BER packets that trigger an error, which might prevent memory from being freed if it was allocated during the ber_scanf…

  • CVE-2006-0452Feb 14, 2006
    Red Hat
    Directory Server
    risk 0.00cvss —epss 0.02

    dn2ancestor in the LDAP component in Fedora Directory Server 1.0 allows remote attackers to cause a denial of service (CPU and memory consumption) via a ModDN operation with a DN that contains a large number of "," (comma) characters, which results in a large amount of…

  • CVE-2006-0453Feb 14, 2006
    Red Hat
    Directory Server
    risk 0.00cvss —epss 0.02

    The LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (crash) via a certain "bad BER sequence" that results in a free of uninitialized memory, as demonstrated using the ProtoVer LDAP test suite.

  • CVE-2006-0004Feb 14, 2006
    Microsoft
    Office
    risk 0.03cvss —epss 0.32

    Microsoft PowerPoint 2000 in Office 2000 SP3 has an interaction with Internet Explorer that allows remote attackers to obtain sensitive information via a PowerPoint presentation that attempts to access objects in the Temporary Internet Files Folder (TIFF).

  • CVE-2006-0005Feb 14, 2006
    Microsoft
    Windows Media Player
    risk 0.06cvss —epss 0.39

    Buffer overflow in the plug-in for Microsoft Windows Media Player (WMP) 9 and 10, when used in browsers other than Internet Explorer and set as the default application to handle media files, allows remote attackers to execute arbitrary code via HTML with an EMBED element…

  • CVE-2006-0008Feb 14, 2006
    Microsoft
    Office
    risk 0.00cvss —epss 0.02

    The ShellAbout API call in Korean Input Method Editor (IME) in Korean versions of Microsoft Windows XP SP1 and SP2, Windows Server 2003 up to SP1, and Office 2003, allows local users to gain privileges by launching the "shell about dialog box" and clicking the "End-User License…

  • CVE-2006-0013Feb 14, 2006
    Microsoft
    Windows Xp
    risk 0.03cvss —epss 0.35

    Buffer overflow in the Web Client service (WebClnt.dll) for Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote authenticated users or Guests to execute arbitrary code via crafted RPC requests, a different vulnerability than CVE-2005-1207.

  • CVE-2006-0021Feb 14, 2006
    Microsoft
    Windows Xp
    risk 0.08cvss —epss 0.63

    Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang) via an IGMP packet with an invalid IP option, aka the "IGMP v3 DoS Vulnerability."

  • CVE-2006-0553Feb 14, 2006
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.03

    PostgreSQL 8.1.0 through 8.1.2 allows authenticated database users to gain additional privileges via "knowledge of the backend protocol" using a crafted SET ROLE to other database users, a different vulnerability than CVE-2006-0678.

  • CVE-2006-0678Feb 14, 2006
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.00

    PostgreSQL 7.3.x before 7.3.14, 7.4.x before 7.4.12, 8.0.x before 8.0.7, and 8.1.x before 8.1.3, when compiled with Asserts enabled, allows local users to cause a denial of service (server crash) via a crafted SET SESSION AUTHORIZATION command, a different vulnerability than…

  • CVE-2006-0677Feb 14, 2006
    Heimdal
    Heimdal
    risk 0.00cvss —epss 0.03

    telnetd in Heimdal 0.6.x before 0.6.6 and 0.7.x before 0.7.2 allows remote unauthenticated attackers to cause a denial of service (server crash) via unknown vectors that trigger a null dereference.

  • CVE-2006-0668Feb 13, 2006
    Pwsphp
    Pwsphp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in PwsPHP 1.2.3 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in message.php in the espace_membre module. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2006-0669Feb 13, 2006
    GA
    Forum Light
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in archive.asp in GA's Forum Light allow remote attackers to execute arbitrary SQL commands via the (1) Forum and (2) pages parameter. NOTE: SecurityTracker says that the vendor has disputed this issue, saying that GA Forum Light does not…

  • CVE-2006-0670Feb 13, 2006
    Hcidump
    hcidump
    risk 0.00cvss —epss 0.04

    Buffer overflow in l2cap.c in hcidump 1.29 allows remote attackers to cause a denial of service (crash) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet.

  • CVE-2006-0671Feb 13, 2006
    Sony Ericsson
    K600i
    risk 0.03cvss —epss 0.05

    Buffer overflow in Sony Ericsson K600i, V600i, W800i, and T68i cell phone allows remote attackers to cause a denial of service (reboot or shutdown) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet whose length…

  • CVE-2006-0672Feb 13, 2006
    Microfocus
    Psc 1210 All In One
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in HP PSC 1210 All-in-One Drivers before 1.0.06 has unknown impact and attack vectors.

  • CVE-2006-0673Feb 13, 2006
    Reamday Enterprises
    Magic Calendar Lite
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in cms/index.php in Magic Calendar Lite 1.02, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) $total_login and (2) $total_password parameter.

  • CVE-2006-0674Feb 13, 2006
    IBM
    Aix
    risk 0.00cvss —epss 0.00

    Buffer overflow in the arp command of IBM AIX 5.3 L, 5.3, 5.2.2, 5.2 L, and 5.2 allows local users to cause a denial of service (crash) via a long iftype argument.

  • CVE-2006-0675Feb 13, 2006
    Glen Campbell
    Siteframe
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search.php in Siteframe 5.0.1 allows remote attackers to inject arbitrary web script or HTML via the q parameter.

  • CVE-2006-0676Feb 13, 2006
    PHP-Nuke
    PHP Nuke
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in header.php in PHP-Nuke 6.0 to 7.8 allows remote attackers to inject arbitrary web script or HTML via the pagetitle parameter.

  • CVE-2006-0046Feb 13, 2006
    Adzapper
    adzapper
    risk 0.00cvss —epss 0.03

    squid_redirect script in adzapper before 2006-01-29 allows remote attackers to cause a denial of service (CPU consumption) via a URL with a large number of trailing / (forward slashes), which might produce inefficient regular expressions.

  • CVE-2006-0056Feb 13, 2006
    Pam Mysql
    Pam Mysql
    risk 0.01cvss —epss 0.06

    Double free vulnerability in the authentication and authentication token alteration code in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords,…

  • CVE-2006-0597Feb 13, 2006
    Elog
    Elog
    risk 0.00cvss —epss 0.03

    Multiple stack-based buffer overflows in elogd.c in elog before 2.5.7 r1558-4 allow attackers to cause a denial of service (application crash) and possibly execute code via long "revision attributes".

  • CVE-2006-0598Feb 13, 2006
    Elog
    Elog
    risk 0.00cvss —epss 0.03

    Buffer overflow in elogd.c in elog before 2.5.7 r1558-4 allows attackers to execute code via unspecified variables, when writing to the log file.

  • CVE-2006-0599Feb 13, 2006
    Stefan Ritt
    Elog Web Logbook
    risk 0.00cvss —epss 0.02

    The (1) elog.c and (2) elogd.c components in elog before 2.5.7 r1558-4 generate different responses depending on whether or not a username is valid, which allows remote attackers to determine valid usernames.

  • CVE-2006-0600Feb 13, 2006
    Elog
    Elog
    risk 0.00cvss —epss 0.02

    elog before 2.5.7 r1558-4 allows remote attackers to cause a denial of service (infinite redirection) via a request with the fail parameter set to 1, which redirects to the same request.