VYPR

CVEs

379,713 total · page 7301 of 7,595

AllCriticalHighKEV
  • CVE-2005-4338Dec 19, 2005
    Blackboard
    Academic Suite
    risk 0.00cvss —epss 0.03

    announcement.pl in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to gain administrator privileges by setting the context parameter to "admin".

  • CVE-2005-4339Dec 19, 2005
    Blackboard
    Academic Suite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to inject arbitrary web script or HTML via the context parameter to announcement.pl, which is…

  • CVE-2005-4341Dec 19, 2005
    Blackboard
    Academic Suite
    risk 0.00cvss —epss 0.01

    Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to list all available categories via a blank category_id parameter to category.pl. NOTE: it is not clear whether this information is…

  • CVE-2005-4342Dec 19, 2005
    Macromedia
    Coldfusion
    risk 0.00cvss —epss 0.02

    ColdFusion Sandbox on Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 does not throw an exception if the SecurityManager is disabled, which might allow remote attackers to "bypass security controls," aka "JRun Clustered Sandbox Security Vulnerability."

  • CVE-2005-4343Dec 19, 2005
    Macromedia
    Coldfusion
    risk 0.00cvss —epss 0.01

    Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 allows remote attackers to attach arbitrary files and send mail via a crafted Subject field, which is not properly handled by the CFMAIL tag in applications that use ColdFusion, aka "CFMAIL injection…

  • CVE-2005-4344Dec 19, 2005
    Macromedia
    Coldfusion
    risk 0.00cvss —epss 0.00

    Adobe (formerly Macromedia) ColdFusion MX 7.0 does not honor when the CFOBJECT /CreateObject(Java) setting is disabled, which allows local users to create an object despite the specified configuration.

  • CVE-2005-4345Dec 19, 2005
    Macromedia
    Coldfusion
    risk 0.00cvss —epss 0.00

    Adobe (formerly Macromedia) ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, which allows local developers to obtain the hash and gain privileges.

  • CVE-2005-4346Dec 19, 2005
    PhpBB
    Blog
    risk 0.00cvss —epss 0.01

    Invalid SQL syntax error in blog.php in phpBB Blog 2.2.2 and earlier allows remote attackers to obtain the full path of the application via an invalid permalink parameter to index.php, which produces an invalid SQL query that leaks the full pathname in a SQL syntax error…

  • CVE-2005-4316Dec 17, 2005
    Microfocus
    Hpux
    risk 0.04cvss —epss 0.07

    HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allows remote attackers to cause a denial of service via a "Rose Attack" that involves sending a subset of small IP fragments that do not form a complete, larger packet.

  • CVE-2005-4317Dec 17, 2005
    Limbo CMS
    Limbo CMS
    risk 0.03cvss —epss 0.05

    Limbo CMS 1.0.4.2 and earlier, with register_globals off, does not protect the $_SERVER variable from external modification, which allows remote attackers to use the _SERVER[REMOTE_ADDR] parameter to (1) conduct cross-site scripting (XSS) attacks in the stats module or (2)…

  • CVE-2005-4318Dec 17, 2005
    Siteadmin
    CMS
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in Limbo CMS 1.0.4.2 and earlier, with register_globals off, allows remote attackers to execute arbitrary SQL commands via the _SERVER[REMOTE_ADDR] parameter, which modifies the underlying $_SERVER variable.

  • CVE-2005-4319Dec 17, 2005
    Limbo CMS
    Limbo CMS
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index2.php in Limbo CMS 1.0.4.2 and earlier allows remote attackers to include arbitrary PHP files via ".." sequences in the option parameter.

  • CVE-2005-4320Dec 17, 2005
    Limbo CMS
    Limbo CMS
    risk 0.00cvss —epss 0.02

    Limbo CMS 1.0.4.2 and earlier allows remote attackers to obtain the installation path of the application via a direct request to (1) doc.inc.php, (2) element.inc.php, and (3) node.inc.php, which leaks the path in an error message.

  • CVE-2005-4321Dec 17, 2005
    Apani Networks
    Epiforce Agent
    risk 0.00cvss —epss 0.03

    The Internet Key Exchange version 1 (IKEv1) implementation in Apani Networks EpiForce 1.9 and earlier running IPSec, allow remote attackers to cause a denial of service (crash) via certain IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the…

  • CVE-2005-4322Dec 17, 2005
    Hitachi
    Cosminexus Collaboration Portal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Hitachi Cosminexus Collaboration Portal 06-00 through 06-10-/B, Groupmax Collaboration Portal 07-00 through 07-10-/B, and Groupmax Collaboration Web Client 07-00 through 07-10-/A allow remote attackers to inject arbitrary…

  • CVE-2005-4323Dec 17, 2005
    Hitachi
    Cosminexus Collaboration Portal
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Hitachi Cosminexus Collaboration Portal 06-00 through 06-10-/B, Groupmax Collaboration Portal 07-00 through 07-10-/B, and Groupmax Collaboration Web Client 07-00 through 07-10-/A allow remote attackers to cause a denial of service of unspecified…

  • CVE-2005-4324Dec 17, 2005
    Hitachi
    Groupmax
    risk 0.00cvss —epss 0.02

    Hitachi Groupmax Mail SMTP 06-50 through 06-52-/A and 07-00 through 07-20 allows remote attackers to cause a denial of service (service stop) via an e-mail message with an "invalid format."

  • CVE-2005-4325Dec 17, 2005
    Driverse
    Driverse
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Driverse before 0.56b have unknown impact and attack vectors, related to (1) a "ptrace exploit" and (2) "some other potential security problems."

  • CVE-2005-4326Dec 17, 2005
    Apcupsd
    PowerChute Network Shutdown
    risk 0.00cvss —epss 0.01

    The web interface for American Power Conversion (APC) PowerChute Network Shutdown performs all communication in cleartext (base64-encoded), which allows remote attackers to sniff authentication credentials.

  • CVE-2005-4327Dec 17, 2005
    Michaelarndt
    Webcal
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Michael Arndt WebCal 1.11-3.04 allow remote attackers to inject arbitrary web script or HTML via the (1) function, (2) year, and (3) date parameters to webcal.cgi, (4) new calendar entries, and (5) notes for entries.

  • CVE-2005-4328Dec 17, 2005
    Webglimpse
    Webglimpse
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in webglimpse.cgi in Webglimpse 2.14.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the ID parameter.

  • CVE-2005-4329Dec 17, 2005
    PHP Arena
    Pafiledb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in pafiledb.php in PHP Arena paFileDB Extreme Edition RC 5 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) newsid and (2) id parameter.

  • CVE-2005-4330Dec 17, 2005
    iHTML
    Merchant Mall
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in browse.ihtml in iHTML Merchant Mall allows remote attackers to execute arbitrary SQL commands via the (1) id, (2) store, and (3) step parameters.

  • CVE-2005-4331Dec 17, 2005
    Ihtml Merchant
    Ihtml Merchant
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in merchant.ihtml in iHTML Merchant Version 2 Pro allows remote attackers to execute arbitrary SQL commands via the (1) step, (2) id, and (3) pid parameters.

  • CVE-2005-4332Dec 17, 2005
    Cisco Systems, Inc.
    Clean Access
    risk 0.00cvss —epss 0.04

    Cisco Clean Access 3.5.5 and earlier on the Secure Smart Manager allows remote attackers to bypass authentication and cause a denial of service or upload files via direct requests to obsolete JSP files including (1) admin/uploadclient.jsp, (2) apply_firmware_action.jsp, and (3)…

  • CVE-2005-4333Dec 17, 2005
    Binary Concepts
    Binary Board System
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Binary Board System (BBS) 0.2.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) inreplyto, (2) article, and (3) board parameters to reply.pl, (4) branch, (5) board, and (6) stats.pl…

  • CVE-2005-4334Dec 17, 2005
    Zixforum
    Zixforum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ZixForum 1.12 allows remote attackers to execute arbitrary SQL commands via the H_ID parameter to (1) zixforum/forum.asp, as used in (2) Headforums.asp and (3) Subject.asp.

  • CVE-2005-4335Dec 17, 2005
    Courseforum
    Projectforum
    risk 0.00cvss —epss 0.02

    ProjectForum 4.7.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted pageid parameter to admin/versions.html.

  • CVE-2005-4336Dec 17, 2005
    Courseforum
    Projectforum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in ProjectForum 4.7.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) fwd parameter in admin/adminsignin.html and (2) originalpageid parameter in admin/newpage.html associated with a group.

  • CVE-2005-4302Dec 17, 2005
    EZDatabase
    EZDatabase
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in ezDatabase 2.1.2 and earlier allows remote attackers to include arbitrary local files via ".." sequences in the p parameter.

  • CVE-2005-4303Dec 17, 2005
    Indexcor
    Ezdatabase
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php for ezDatabase 2.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the db_id parameter.

  • CVE-2005-4304Dec 17, 2005
    EZDatabase
    EZDatabase
    risk 0.00cvss —epss 0.02

    index.php in ezDatabase 2.1.2 and earlier allows remote attackers to obtain sensitive information via an invalid cat_id parameter, which leaks the full pathname in an error message. NOTE: these details are uncertain because the original report has terminology problems and lack…

  • CVE-2005-4305Dec 17, 2005
    Edgewall Software
    Trac
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Edgewall Trac 0.9, 0.9.1, and 0.9.2 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly sanitized before it is returned in an error page.

  • CVE-2005-4306Dec 17, 2005
    Focalmedia.net
    Sitenet Bbs
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in SiteNet BBS 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) pg, (2) tid, (3) cid, and (4) fid parameters to netboardr.cgi, or (5) cid parameter to search.cgi.

  • CVE-2005-4307Dec 17, 2005
    ScareCrow
    ScareCrow
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ScareCrow 2.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the forum parameter to (1) forum.cgi and (2) post.cgi, or (3) the user parameter to profile.cgi.

  • CVE-2005-4308Dec 17, 2005
    Scriptscenter
    Ezupload Pro
    risk 0.00cvss —epss 0.02

    index.php in ezUpload Pro 2.2 and earlier allows remote attackers to include files via the mode parameter.

  • CVE-2005-4309Dec 17, 2005
    Scriptscenter
    Ezupload Pro
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in ezUpload Pro 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified search module parameters.

  • CVE-2005-4310Dec 17, 2005
    SSH
    Tectia Server
    risk 0.00cvss —epss 0.01

    SSH Tectia Server 5.0.0 (A, F, and T), when allowing host-based authentication only, allows users to log in with the wrong credentials.

  • CVE-2005-4311Dec 17, 2005
    DCForum
    DCForum
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in DCForum 6.25 and earlier, and possibly DCForum+ 1.x, allows remote attackers to inject arbitrary web script or HTML via (1) the page parameter in dcboard.php and (2) unspecified search parameters.

  • CVE-2005-4312Dec 17, 2005
    Almondsoft
    Almond Classifieds
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in AlmondSoft Almond Classifieds 5.02 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2005-4313Dec 17, 2005
    Almondsoft
    Almond Personals
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in index.php in AlmondSoft Almond Personals 4.05 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2005-4314Dec 17, 2005
    PPCal
    PPCal Shopping Cart
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ppcal.cgi in PPCal Shopping Cart 3.3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) stop and (2) user parameters.

  • CVE-2005-4315Dec 17, 2005
    Plexum
    PLEXCART X3
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the search function in Plexum PLEXCART X3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly involving the (1) s_itemname and (2) s_orderby parameters to plexcart.pl.

  • CVE-2005-3652Dec 16, 2005
    Citrix Systems
    Ica Program Neighborhood Client
    risk 0.01cvss —epss 0.16

    Heap-based buffer overflow in Citrix Program Neighborhood client 9.0 and earlier allows remote attackers to execute arbitrary code via a long name value in an Application Set response.

  • CVE-2005-4297Dec 16, 2005
    Bbboard
    Bbboard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in bbBoard 2.56 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly via the "keys" parameter.

  • CVE-2005-4298Dec 16, 2005
    Atlantpro.com
    Atlantforum
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in atl.cgi in AtlantForum 4.02 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) sch_allsubct, (2) before, and (3) ct parameters.

  • CVE-2005-4299Dec 16, 2005
    Atlantpro.com
    Atlant Pro
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in atl.cgi in Atlant Pro 4.02 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) before and (2) ct parameters.

  • CVE-2005-4300Dec 16, 2005
    Libremail
    Libremail
    risk 0.00cvss —epss 0.02

    Format string vulnerability in the lire_pop function in pop.c in libremail 1.1.0 and earlier, with compiled with the debug option, allows remote attackers to execute arbitrary code via a crafted e-mail or POP server response.

  • CVE-2005-4301Dec 16, 2005
    Phpxplorer
    Phpxplorer
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in phpXplorer 0.9.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the address bar field.

  • CVE-2005-3253Dec 16, 2005
    Avaya
    AP
    risk 0.00cvss —epss 0.02

    Wireless Access Points (AP) for (1) Avaya AP-3 through AP-6 2.5 to 2.5.4, and AP-7/AP-8 2.5 and other versions before 3.1, and (2) Proxim AP-600 and AP-2000 before 2.5.5, and Proxim AP-700 and AP-4000 after 2.4.11 and before 3.1, use a static WEP key of "12345", which allows…