VYPR

CVEs

379,724 total · page 7300 of 7,595

AllCriticalHighKEV
  • CVE-2005-4405Dec 20, 2005
    Random Mouse Software
    Red Queen
    risk 0.00cvss —epss 0.01

    redqueen.cgi in Red Queen 1.02 and earlier allows remote attackers to obtain the full server path via invalid (1) yellowpage_id, (2) skin_id, (3) supplier_id, and (4) module parameters, which leaks the path in an error message.

  • CVE-2005-4406Dec 20, 2005
    MERCURY
    Mercury CMS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.cfm in Mercury CMS 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter.

  • CVE-2005-4407Dec 20, 2005
    Tmc Visionpool
    Mercury CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.cfm in Mercury CMS 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) content and (2) criteria parameters.

  • CVE-2005-4408Dec 20, 2005
    Pc Media
    Miraserver
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Miraserver 1.0 RC4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php, (2) id parameter to newsitem.php, and (3) cat parameter to article.php.

  • CVE-2005-4409Dec 20, 2005
    Mmbase
    Mmbase
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MMBase 1.7.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.

  • CVE-2005-4410Dec 20, 2005
    Nqcontent
    Nqcontent
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in NQcontent 3 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the text parameter.

  • CVE-2005-4411Dec 20, 2005
    David Harris
    Mercury Mail Transport System
    risk 0.08cvss —epss 0.65

    Buffer overflow in Mercury Mail Transport System 4.01b allows remote attackers to execute arbitrary code via a long request to TCP port 105.

  • CVE-2005-4412Dec 20, 2005
    Citrix Systems
    Program Neighborhood Client
    risk 0.00cvss —epss 0.00

    Citrix Program Neighborhood client before 9.150 caches the user password in plaintext in the GUI while asterisks are used to visually obfuscate the password, which allows attackers with access to the session to obtain the password by using a tool to directly access the field.

  • CVE-2005-4413Dec 20, 2005
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in sample scripts in IBM WebSphere Application Server 6 allow remote attackers to inject arbitrary web script or HTML via the (1) E-mail address field to (a) PlantsByWebSphere/login.jsp, (2) message field to (b)…

  • CVE-2005-4414Dec 20, 2005
    Open Lab
    Teamwork
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Teamwork 3 before alpha 1.7 has unknown impact and attack vectors, related to "a menu security bug."

  • CVE-2005-4415Dec 20, 2005
    TML CMS
    Tml
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in TML CMS 0.5 allows remote attackers to inject arbitrary web script or HTML via the form parameter.

  • CVE-2005-4416Dec 20, 2005
    TML CMS
    Tml
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in TML CMS 0.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2005-4417Dec 20, 2005
    Belkin
    Bluetooth Software
    risk 0.03cvss —epss 0.05

    The default configuration of Widcomm Bluetooth for Windows (BTW) 4.0.1.1500 and earlier, as installed on Belkin Bluetooth Software 1.4.2 Build 10 and ANYCOM Blue USB-130-250 Software 4.0.1.1500, and possibly other devices, sets null Authentication and Authorization values, which…

  • CVE-2005-4419Dec 20, 2005
    Honeycomb
    CategoryResults.cfm
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in CategoryResults.cfm in Honeycomb Archive and Honeycomb Archive Enterprise 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) series, (2) cat_parent, (3) cat, and (4) div parameters.

  • CVE-2005-4420Dec 20, 2005
    Honeycomb
    Archive Enterprise
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Honeycomb Archive Enterprise 3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the keyword parameter in search.cfm.

  • CVE-2005-4421Dec 20, 2005
    Dev Editor
    Dev Editor
    risk 0.00cvss —epss 0.02

    Dev-Editor 3.0 allows remote attackers to access any directory outside the web root whose name is a substring of the web root directory name.

  • CVE-2005-4422Dec 20, 2005
    Toenda Software Development
    Toendacms
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in toendaCMS before 0.6.2 Stable allows remote authenticated administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in data/images/albums.

  • CVE-2005-4423Dec 20, 2005
    Phpfm
    Phpfm
    risk 0.03cvss —epss 0.03

    Unrestricted file upload vulnerability in PHPFM before 0.2.3 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension to an accessible directory, as demonstrated using a file with a .php extension, aka "upload phpshell."

  • CVE-2005-4424Dec 20, 2005
    Phpkit
    Phpkit
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in PHPKIT 1.6.1 R2 and earlier might allow remote authenticated users to execute arbitrary PHP code via a .. (dot dot) in the path parameter and a %00 at the end of the filename, as demonstrated by an avatar filename ending with .png%00.

  • CVE-2005-4425Dec 20, 2005
    Kerio Technologies
    Winroute Firewall
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Kerio WinRoute Firewall before 6.1.3 allows remote attackers to cause a denial of service (crash) via certain RTSP streams.

  • CVE-2005-4426Dec 20, 2005
    Yabb
    Yabb
    risk 0.00cvss —epss 0.01

    Interpretation conflict in YaBB before 2.1 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer as a result of…

  • CVE-2005-4368Dec 20, 2005
    Roundcube
    Webmail
    risk 0.00cvss —epss 0.01

    roundcube webmail Alpha, with a default high verbose level ($rcmail_config['debug_level'] = 1), allows remote attackers to obtain the full path of the application via an invalid_task parameter, which leaks the path in an error message.

  • CVE-2005-4369Dec 20, 2005
    The Collective
    Acuity CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Acuity CMS 2.6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly strSearchKeywords to browse.asp.

  • CVE-2005-4370Dec 20, 2005
    Acidcat
    Acidcat CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in main_content.asp in Acidcat 2.1.13 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter to default.asp.

  • CVE-2005-4371Dec 20, 2005
    Acidcat
    Acidcat CMS
    risk 0.03cvss —epss 0.03

    Acidcat 2.1.13 and earlier stores the database under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a request to databases/acidcat.mdb.

  • CVE-2005-4372Dec 20, 2005
    AWF
    Adaptive Website Framework
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in account.html in Adaptive Website Framework (AWF) 2.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2005-4373Dec 20, 2005
    Adaptive Website Framework
    AWF
    risk 0.00cvss —epss 0.01

    Adaptive Website Framework (AWF) 2.10 and earlier allows remote attackers to obtain the full path of the application via an invalid mode parameter to community.html, which leaks the path in an error message.

  • CVE-2005-4374Dec 20, 2005
    Allinta
    Allinta CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Allinta 2.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to faq.asp and (2) searchQuery parameter to search.asp.

  • CVE-2005-4375Dec 20, 2005
    Box Uk
    Amaxus
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Amaxus 3 and earlier allows remote attackers to inject arbitrary web script or HTML via the change parameter. NOTE: it is possible that this is resultant from CVE-2005-4376.

  • CVE-2005-4376Dec 20, 2005
    Amaxus
    Amaxus
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in Amaxus 3 and earlier allows remote attackers to access arbitrary files via ".." sequences in the change parameter.

  • CVE-2005-4377Dec 20, 2005
    Baseline
    Baseline CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Page.asp in Baseline CMS 1.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) PageID and (2) SiteNodeID parameters.

  • CVE-2005-4378Dec 20, 2005
    Nma
    Baseline CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Page.asp in Baseline CMS 1.95 and earlier allows remote attackers to execute arbitrary SQL commands via the SiteNodeID parameter.

  • CVE-2005-4379Dec 20, 2005
    Bitweaver
    Bitweaver
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to inject arbitrary web script or HTML via the (1) sort_mode parameter to (a) fisheye/list_galleries.php, (b) messages/message_box.php, and (c) users/my.php; the (2)…

  • CVE-2005-4380Dec 20, 2005
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to execute arbitrary SQL commands via the (1) sort_mode parameter to (a) fisheye/list_galleries.php, (b) messages/message_box.php, and (c) users/my.php; the (2) post_id parameter to (d)…

  • CVE-2005-4381Dec 20, 2005
    Caravel CMS
    Caravel CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Caravel CMS 3.0 Beta 1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) fileDN and (2) folderviewer_attrs parameters.

  • CVE-2005-4382Dec 20, 2005
    Citysoft
    Community Enterprise
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in CitySoft Community Enterprise 4.x allows remote attackers to execute arbitrary SQL commands via the (1) nodeID, (2) pageID, (3) ID, and (4) parentid parameter to index.cfm; and (5) documentFormatId parameter to document/docWindow.cfm.

  • CVE-2005-4383Dec 20, 2005
    Citysoft
    Community Enterprise
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.cfm in CitySoft Community Enterprise 4.x allows remote attackers to inject arbitrary web script or HTML via the (1) presentationSite, (2) docPublishYear, (3) docDescription, (4) publishState, (5) docAuthor, (6) docTitle, (7)…

  • CVE-2005-4384Dec 20, 2005
    Citysoft
    Community Enterprise
    risk 0.00cvss —epss 0.01

    CitySoft Community Enterprise 4.x allows remote attackers to obtain the full path of the server via an invalid (1) fuseaction parameter to index.cfm and (2) documentid parameter to document/docWindow.cfm.

  • CVE-2005-4385Dec 20, 2005
    Cofax
    Cofax
    risk 0.04cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in search.htm in Cofax 2.0 RC3 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter.

  • CVE-2005-4386Dec 20, 2005
    Colony
    CMS
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Colony CMS 2.75 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.

  • CVE-2005-4387Dec 20, 2005
    Contenite
    Contenite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in home.php in contenite 0.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2005-4388Dec 20, 2005
    Contentserv
    Contens
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.cfm in CONTENS 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the near parameter.

  • CVE-2005-4389Dec 20, 2005
    Contentserv
    Contens
    risk 0.00cvss —epss 0.01

    search.cfm in CONTENS 3.0 and earlier allows remote attackers to obtain the full server path via invalid (1) submit.y, (2) bool, (3) itemsperpage, (4) submit, (5) submit.x, (6) criteria, (7) advanced, and (8) intern parameters.

  • CVE-2005-4354Dec 20, 2005
    Webglimpse
    Webglimpse
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in webglimpse.cgi in Webglimpse 2.14.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query parameter.

  • CVE-2005-4355Dec 20, 2005
    Xmpie
    Ustore
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in UStore allow remote attackers to inject arbitrary web script or HTML via the (1) Cat parameter in default.asp and the (2) accessdenied parameter in admin/default.asp. NOTE: the provenance of this information is unknown; the…

  • CVE-2005-4356Dec 20, 2005
    Xmpie
    Ustore
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in UStore allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2005-4357Dec 20, 2005
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in phpBB 2.0.18, when "Allowed HTML tags" is enabled, allows remote attackers to inject arbitrary Javascript via a permitted HTML tag with " (quote) characters and active attributes such as onmouseover.

  • CVE-2005-4358Dec 20, 2005
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.02

    admin/admin_disallow.php in phpBB 2.0.18 allows remote attackers to obtain the installation path via a direct request with a non-empty setmodules parameter, which causes an invalid append_sid function call that leaks the path in an error message.

  • CVE-2005-4359Dec 20, 2005
    ODFaq
    ODFaq
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in includes/core.inc.php in ODFaq 2.1.0 allows remote attackers to execute arbitrary SQL commands via the (1) cat and (2) srcText parameters to faq.php.

  • CVE-2005-4360Dec 20, 2005
    Microsoft
    Internet Information Server
    risk 0.10cvss —epss 0.87

    The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value…