VYPR

CVEs

379,623 total · page 7306 of 7,593

AllCriticalHighKEV
  • CVE-2005-3968Dec 3, 2005
    Phpx
    Phpx
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in auth.inc.php in PHPX 3.5.9 and earlier allows remote attackers to execute arbitrary SQL commands, bypass authentication, and upload arbitrary PHP code via the username parameter.

  • CVE-2005-3969Dec 3, 2005
    Mxchange
    Mxchange
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in MXChange before 0.2.0-pre10 PL492 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2005-3970Dec 3, 2005
    Mxchange
    Mxchange
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in MXChange before 0.2.0-pre10 PL492 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2005-3971Dec 3, 2005
    Citrix Systems
    Nfuse
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the login form in Citrix MetaFrame Secure Access Manager 2.0 through 2.2 and NFuse Elite 1.0 allows remote attackers to inject arbitrary web script or HTML via the username field.

  • CVE-2005-3972Dec 3, 2005
    Extreme Corporate
    Extreme Search
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in extremesearch.php in Extreme Search Corporate Edition 6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2005-3973Dec 3, 2005
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allow remote attackers to inject arbitrary web script or HTML via various HTML tags and values, such as the (1) legend tag and the value parameter used in (2) label and (3)…

  • CVE-2005-3974Dec 3, 2005
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission.

  • CVE-2005-3975Dec 3, 2005
    Drupal
    Drupal
    risk 0.00cvss —epss 0.05

    Interpretation conflict in file.inc in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the…

  • CVE-2005-3976Dec 3, 2005
    Duware
    Duclassified
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in type.asp, as used in multiple DUware products including (1) DUamazon 3.1, (2) DUarticle 1.1, (3) DUclassified 4.2, (4) DUdirectory 3.1 and DUdirectory Pro 3.0 and 3.0 SQL, (5) DUdownload 1.1, (6) DUgallery 3.3, (7) DUnews 1.1, and (8) DUpaypal 3.1…

  • CVE-2005-3977Dec 3, 2005
    Qualityebiz
    Qualityppc
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in QualityEBiz Quality PPC 1553 allows remote attackers to inject web script or HTML via the REQ parameter to the search module.

  • CVE-2005-3978Dec 3, 2005
    Scriptdevelopers.net
    Netclassifieds
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in NetClassifieds Premium Edition 1.0.1, Professional Edition 1.5.1, Standard Edition 1.9.6.3, and Free Edition 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) CatID parameter in (a) ViewCat.php and (b)…

  • CVE-2005-3979Dec 3, 2005
    Coppermine
    Coppermine Photo Gallery
    risk 0.00cvss —epss 0.02

    relocate_server.php in Coppermine Photo Gallery (CPG) 1.4.2 and 1.4 beta is not removed after installation and does not use authentication, which allows remote attackers to obtain sensitive information, such as database configuration, via a direct request.

  • CVE-2005-3964Dec 2, 2005
    OpenMotif
    libUil
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in libUil (libUil.so) in OpenMotif 2.2.3, and possibly other versions, allows attackers to execute arbitrary code via the (1) diag_issue_diagnostic function in UilDiags.c and (2) open_source_file function in UilSrcSrc.c.

  • CVE-2005-3963Dec 2, 2005
    Dotclear
    Dotclear
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in session.php in DotClear before 1.2.3 allows remote attackers to execute arbitrary SQL commands via the dc_xd parameter in a cookie.

  • CVE-2005-3962Dec 1, 2005
    Perl Foundation
    Perl
    risk 0.00cvss —epss 0.01

    Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a…

  • CVE-2005-3930Dec 1, 2005
    N 13
    News
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in N-13 News 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2005-3931Dec 1, 2005
    Asp Rider
    Asp Rider
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.asp in ASP-Rider 1.6 allows remote attackers to execute arbitrary SQL commands via the HTTP referer.

  • CVE-2005-3932Dec 1, 2005
    O Kiraku
    Nikki
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in okiraku.php in O-Kiraku Nikki 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the day_id parameter.

  • CVE-2005-3933Dec 1, 2005
    88script
    88script Event Calendar
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in 88Script's Event Calendar 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter.

  • CVE-2005-3934Dec 1, 2005
    Symantec
    Pcanywhere
    risk 0.04cvss —epss 0.09

    Buffer overflow in Symantec pcAnywhere 11.0.1, 11.5.1, and all other 32-bit versions allows remote attackers to cause a denial of service (application crash) via unknown attack vectors.

  • CVE-2005-3935Dec 1, 2005
    Socketkb
    Socketkb
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in SocketKB 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) node and (2) art_id parameters.

  • CVE-2005-3936Dec 1, 2005
    Socketkb
    Socketkb
    risk 0.00cvss —epss 0.02

    PHP file include vulnerability in SocketKB 1.1.0 and earlier allows remote attackers to include arbitrary local files via the __f parameter.

  • CVE-2005-3937Dec 1, 2005
    Softbizscripts
    B2B Trading Marketplace Script
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Softbiz B2B Trading Marketplace Script 1.1 and earler allows remote attackers to execute arbitrary SQL commands via the cid parameter in (1) selloffers.php, (2) buyoffers.php, (3) products.php, or (4) profiles.php.

  • CVE-2005-3938Dec 1, 2005
    Softbizscripts
    FAQ Script
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in Softbiz FAQ Script 1.1 and earler allows remote attackers to execute arbitrary SQL commands via the id parameter in (1) index.php, (2) faq_qanda.php, (3) refer_friend.php, (4) print_article.php, or (5) add_comment.php.

  • CVE-2005-3939Dec 1, 2005
    Wsn Knowledge Base
    Wsn Knowledge Base
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in WSN Knowledge Base 1.2.0 and earler allow remote attackers to execute arbitrary SQL commands via the (1) catid, (2) perpage, (3) ascdesc, and (4) orderlinks in a displaycat action in (a) index.php; and the (5) id parameter in (b)…

  • CVE-2005-3940Dec 1, 2005
    ORCA
    Ringmaker
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ringmaker.php in Orca Ringmaker 2.3c and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter.

  • CVE-2005-3941Dec 1, 2005
    Greywyvern
    Orca Blog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in blog.php in Orca Blog 1.3b and earlier allows remote attackers to execute arbitrary SQL commands via the msg parameter.

  • CVE-2005-3942Dec 1, 2005
    Greywyvern
    Orca Knowledgebase
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in knowledgebase-control.php in Orca Knowledgebase 2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the qid parameter.

  • CVE-2005-3943Dec 1, 2005
    ilyav
    FAQ System
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ilyav FAQ System 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) FAQ_ID and (2) action parameters in (a) viewFAQ.php; and (3) CATEGORY_ID parameter in (b) index.php.

  • CVE-2005-3944Dec 1, 2005
    ilyav
    Survey System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in survey.php in ilyav Survey System 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the SURVEY_ID parameter.

  • CVE-2005-3945Dec 1, 2005
    Microsoft
    Windows 2000
    risk 0.01cvss —epss 0.12

    The SynAttackProtect protection in Microsoft Windows 2003 before SP1 and Windows 2000 before SP4 with Update Roll-up uses a hash of predictable data, which allows remote attackers to cause a denial of service (CPU consumption) via a flood of SYN packets that produce identical…

  • CVE-2005-3946Dec 1, 2005
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Opera 8.50 allows remote attackers to cause a denial of service (crash) via a Java applet with a large string argument to the removeMember JNI method for the com.opera.JSObject class.

  • CVE-2005-3947Dec 1, 2005
    PHP Upload Center
    PHP Upload Center
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in index.php in PHP Upload Center allows remote attackers to read arbitrary files via "../" sequences in the filename parameter.

  • CVE-2005-3948Dec 1, 2005
    Phpalbum
    Phpalbum
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in main.php in PHPAlbum 0.2.3 and earlier allows remote attackers to read arbitrary files via the (1) cmd and (2) var1 parameters.

  • CVE-2005-3949Dec 1, 2005
    Webcalendar
    Webcalendar
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) startid parameter to activity_log.php, (2) startid parameter to admin_handler.php, (3) template parameter to edit_template.php, and (4) multiple…

  • CVE-2005-3950Dec 1, 2005
    Nufw
    Nufw
    risk 0.00cvss —epss 0.01

    nuauth in NuFW 1.0.x before 1.0.16 and 1.1 allows authenticated users to cause a denial of service via malformed packets.

  • CVE-2005-3951Dec 1, 2005
    PHP Labs
    Survey Wizard
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in survey.php in PHP Labs Survey Wizard allows remote attackers to execute arbitrary SQL commands via the sid parameter.

  • CVE-2005-3952Dec 1, 2005
    PHP Labs
    Top Auction
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in PHP Labs Top Auction allows remote attackers to execute arbitrary SQL commands via the (1) category and (2) type parameters to viewcat.php, or (3) certain search parameters. NOTE: later a disclosure reported the affected version as 1.0.

  • CVE-2005-3953Dec 1, 2005
    Bedeng
    PSP
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Bedeng PSP 1.1 allows remote attackers to execute arbitrary SQL commands via the cwhere parameter to (1) index.php and (2) download.php, or (3) ckode parameter to baca.php.

  • CVE-2005-3954Dec 1, 2005
    Blogbuddies
    Blogbuddies
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in blogBuddies 0.3 allows remote attackers to inject arbitrary web script or HTML via the u parameter to index.php.

  • CVE-2005-3955Dec 1, 2005
    Jaws
    Jaws
    risk 0.03cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in MagpieRSS 7.1, as used in (a) blogBuddiesv 0.3, (b) Jaws 0.6.2, and possibly other products, allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) magpie_debug.php and (2) rss_url…

  • CVE-2005-3956Dec 1, 2005
    Dmanews
    Dmanews
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in DMANews 0.904 and 0.910 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a comments action and the (2) sortorder and (3) display_num parameters in a news_list action.

  • CVE-2005-3957Dec 1, 2005
    Dotclear
    Dotclear
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the Trackback functionality in DotClear 1.2.1 has unknown impact and attack vectors.

  • CVE-2005-3958Dec 1, 2005
    Entergal Mx
    Entergal Mx
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Entergal MX 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) idcat parameter in a showcat action and (2) the action parameter.

  • CVE-2005-3959Dec 1, 2005
    Freewebstat
    Freewebstat
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in FreeWebStat 1.0 rev37 allow remote attackers to inject arbitrary web script or HTML via the (1) site, (2) jsref, (3) jsres, and (4) jscolor parameters to pixel.php, which are not sanitized before being included in the…

  • CVE-2005-3960Dec 1, 2005
    Kadu
    Kadu
    risk 0.00cvss —epss 0.02

    Kadu 0.4.2 and 0.5.0pre allows remote attackers to cause a denial of service (crash or generated traffic) via a malformed message, possibly with incomplete information.

  • CVE-2005-3961Dec 1, 2005
    Webcalendar
    Webcalendar
    risk 0.00cvss —epss 0.02

    export_handler.php in WebCalendar 1.0.1 allows remote attackers to overwrite WebCalendar data files via a modified id parameter.

  • CVE-2005-2757Dec 1, 2005
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in CoreFoundation in Mac OS X and OS X Server 10.4 through 10.4.3 allows remote attackers to execute arbitrary code via unknown attack vectors involving "validation of URLs."

  • CVE-2005-3700Dec 1, 2005
    Apple Inc.
    Mac OS X
    risk 0.00cvss —epss 0.00

    Unknown vulnerability in iodbcadmintool in the ODBC Administrator utility in Mac OS X and OS X Server 10.3.9 and 10.4.3 allows local users to execute arbitrary code via unknown attack vectors.

  • CVE-2005-3701Dec 1, 2005
    Apple Inc.
    Mac OS X Server
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in passwordserver in Mac OS X Server 10.3.9 and 10.4.3, when creating an Open Directory master server, allows local users to gain privileges via unknown attack vectors.