VYPR

CVEs

379,321 total · page 7318 of 7,587

AllCriticalHighKEV
  • CVE-2005-3054Sep 26, 2005
    PHP
    PHP
    risk 0.00cvss —epss 0.00

    fopen_wrappers.c in PHP 4.4.0, and possibly other versions, does not properly restrict access to other directories when the open_basedir directive includes a trailing slash, which allows PHP scripts in one directory to access files in other directories whose names are substrings…

  • CVE-2005-3055Sep 26, 2005
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Linux kernel 2.6.8 to 2.6.14-rc2 allows local users to cause a denial of service (kernel OOPS) via a userspace process that issues a USB Request Block (URB) to a USB device and terminates before the URB is finished, which leads to a stale pointer reference.

  • CVE-2005-3059Sep 26, 2005
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in Opera 8.50 on Linux and Windows have unknown impact and attack vectors, related to (1) " handling of must-revalidate cache directive for HTTPS pages" or (2) a "display issue with cookie comment encoding."

  • CVE-2005-3045Sep 24, 2005
    My Little Forum
    Mylittleforum
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in search.php in My Little Forum 1.5 and 1.6 beta allows remote attackers to execute arbitrary SQL commands via the phrase field.

  • CVE-2005-3046Sep 24, 2005
    PhpMyAdmin
    Phpmyfaq
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in password.php in PhpMyFaq 1.5.1 allows remote attackers to modify SQL queries and gain administrator privileges via the user field.

  • CVE-2005-3047Sep 24, 2005
    PhpMyAdmin
    Phpmyfaq
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in PhpMyFaq 1.5.1 allow remote attackers to inject arbitrary web script or HTML via the (1) PMF_CONF[version] parameter to footer.php or (2) PMF_LANG[metaLanguage] to header.php.

  • CVE-2005-3048Sep 24, 2005
    PhpMyAdmin
    Phpmyfaq
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in index.php in PhpMyFaq 1.5.1 allows remote attackers to read arbitrary files or include arbitrary PHP files via a .. (dot dot) in the LANGCODE parameter, which also allows direct code injection via the User Agent field in a request packet,…

  • CVE-2005-3049Sep 24, 2005
    PhpMyAdmin
    Phpmyfaq
    risk 0.00cvss —epss 0.03

    PhpMyFaq 1.5.1 stores data files under the web document root with insufficient access control and predictable filenames, which allows remote attackers to obtain sensitive information via a direct request to the data/tracking[DATE] file.

  • CVE-2005-3050Sep 24, 2005
    PhpMyAdmin
    Phpmyfaq
    risk 0.00cvss —epss 0.01

    PhpMyFaq 1.5.1 allows remote attackers to obtain sensitive information via a LANGCODE parameter that does not exist, which reveals the path in an error message.

  • CVE-2005-3051Sep 24, 2005
    7 Zip
    7 Zip
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in the ARJ plugin (arj.dll) 3.9.2.0 for 7-Zip 3.13, 4.23, and 4.26 BETA, as used in products including Turbo Searcher, allows remote attackers to execute arbitrary code via a large ARJ block.

  • CVE-2005-3052Sep 24, 2005
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in module/down.inc.php in jportal 2.3.1 allows remote attackers to execute arbitrary SQL commands via the search field to download.php.

  • CVE-2005-2701Sep 23, 2005
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to execute arbitrary code via an XBM image file that ends in a large number of spaces instead of the expected end tag.

  • CVE-2005-2702Sep 23, 2005
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Unicode sequences with "zero-width non-joiner" characters.

  • CVE-2005-2703Sep 23, 2005
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to modify HTTP headers of XML HTTP requests via XMLHttpRequest, and possibly use the client to exploit vulnerabilities in servers or proxies, including HTTP request smuggling and HTTP request splitting.

  • CVE-2005-2704Sep 23, 2005
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to spoof DOM objects via an XBL control that implements an internal XPCOM interface.

  • CVE-2005-2705Sep 23, 2005
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Integer overflow in the JavaScript engine in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 might allow remote attackers to execute arbitrary code.

  • CVE-2005-2706Sep 23, 2005
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Firefox before 1.0.7 and Mozilla before Suite 1.7.12 allows remote attackers to execute Javascript with chrome privileges via an about: page such as about:mozilla.

  • CVE-2005-2707Sep 23, 2005
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to spawn windows without user interface components such as the address and status bar, which could be used to conduct spoofing or phishing attacks.

  • CVE-2005-3044Sep 22, 2005
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Multiple vulnerabilities in Linux kernel before 2.6.13.2 allow local users to cause a denial of service (kernel OOPS from null dereference) via (1) fput in a 32-bit ioctl on 64-bit x86 systems or (2) sockfd_put in the 32-bit routing_ioctl function on 64-bit systems.

  • CVE-2005-3031Sep 22, 2005
    Cambridge Computer Corporation
    Vxftpsrv
    risk 0.00cvss —epss 0.04

    Buffer overflow in vxFtpSrv 0.9.7 allows remote attackers to execute arbitrary code via a long USER name.

  • CVE-2005-3032Sep 22, 2005
    Cambridge Computer Corporation
    Vxtftpsrv
    risk 0.00cvss —epss 0.04

    Buffer overflow in vxTftpSrv 1.7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TFTP request with a long filename argument.

  • CVE-2005-3033Sep 22, 2005
    Cambridge Computer Corporation
    Vxweb
    risk 0.00cvss —epss 0.03

    Stack-based buffer overflow in vxWeb 1.1.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.

  • CVE-2005-3034Sep 22, 2005
    Compuware
    Driverstudio
    risk 0.00cvss —epss 0.02

    Compuware DriverStudio Remote Control service (DSRsvc.exe) 2.7 and 3.0 beta 2 allows remote attackers to bypass authentication via a null session.

  • CVE-2005-3035Sep 22, 2005
    Compuware
    Driverstudio
    risk 0.00cvss —epss 0.02

    Compuware DriverStudio Remote Control service (DSRsvc.exe) 2.7 and 3.0 beta 2 allows remote attackers to cause a denial of service (reboot) via a UDP packet sent directly to port 9110.

  • CVE-2005-3036Sep 22, 2005
    File Transfer Anywhere
    File Transfer Anywhere
    risk 0.00cvss —epss 0.00

    File Transfer Anywhere 3.01 stores sensitive password information in plaintext in the PASS value in the "File Transfer Anywhere" registry key, which allows local users to gain privileges.

  • CVE-2005-3037Sep 22, 2005
    Handy Address Book
    Handy Address Book Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Handy Address Book Server 1.1 allows remote attackers to inject arbitrary web script or HTML via the SEARCHTEXT parameter in a demos URL.

  • CVE-2005-3038Sep 22, 2005
    Hosting Controller
    Hosting Controller
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Hosting Controller 6.1 before Hotfix 2.4 allows remote attackers to list and read contents of arbitrary drives, related to "the PHP vulnerability."

  • CVE-2005-3039Sep 22, 2005
    Mall23
    Mall23
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in infopage.asp in Mall23 eCommerce allows remote attackers to execute arbitrary SQL commands via the idPage parameter.

  • CVE-2005-3040Sep 22, 2005
    Tac
    Vista
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the web interface (ISALogin.dll) for TAC Vista 4.0, and possibly other versions before 4.3, allows remote attackers to read arbitrary files via ".." sequences in the Template parameter.

  • CVE-2005-3041Sep 22, 2005
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Unspecified "drag-and-drop vulnerability" in Opera Web Browser before 8.50 on Windows allows "unintentional file uploads."

  • CVE-2005-3042Sep 22, 2005
    Webmin
    Webmin
    risk 0.00cvss —epss 0.04

    miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters (line feed or carriage return).

  • CVE-2005-3043Sep 22, 2005
    Mall23
    Mall23
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in AddItem.asp in Mall23 eCommerce allows remote attackers to execute arbitrary SQL commands via the idOption_Dropdown_2 parameter.

  • CVE-2005-3018Sep 21, 2005
    Apple Inc.
    Safari
    risk 0.03cvss —epss 0.03

    Apple Safari allows remote attackers to cause a denial of service (application crash) via a crafted data:// URL.

  • CVE-2005-3019Sep 21, 2005
    Jelsoft
    Vbulletin
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in vBulletin before 3.0.9 allow remote attackers to execute arbitrary SQL commands via the (1) request parameter to joinrequests.php, (2) limitnumber or (3) limitstart to user.php, (4) usertitle.php, or (5) usertools.php.

  • CVE-2005-3020Sep 21, 2005
    Jelsoft
    Vbulletin
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter to css.php, (2) redirect parameter to index.php, (3) email parameter to user.php, (4) goto parameter to…

  • CVE-2005-3021Sep 21, 2005
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.01

    image.php in vBulletin 3.0.9 and earlier allows remote attackers with access to the administrator panel to upload arbitrary files via the upload action.

  • CVE-2005-3022Sep 21, 2005
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameter to announcement.php, (2) userid parameter to user.php, (3) calendar parameter to admincalendar.php, (4) cronid…

  • CVE-2005-3023Sep 21, 2005
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via certain arguments to (1) announcement.php, (2) admincalendar.php, (3) bbcode.php, (4) cronadmin.php, (5) email.php, (6) faq.php,…

  • CVE-2005-3024Sep 21, 2005
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameter to announcement.php, the (2) thread[forumid] or (3) criteria parameters to thread.php, (4) userid parameter to…

  • CVE-2005-3025Sep 21, 2005
    Jelsoft
    Vbulletin
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the loc parameter to (1) modcp/index.php or (2) admincp/index.php, or the ip parameter to (3) modcp/user.php or (4)…

  • CVE-2005-3026Sep 21, 2005
    Alstrasoft
    Epay
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in index.php in Alstrasoft Epay Pro 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the read parameter.

  • CVE-2005-3027Sep 21, 2005
    Sybari
    Antigen
    risk 0.00cvss —epss 0.02

    Sybari Antigen 8.0 SR2 does not properly filter SMTP messages, which allows remote attackers to bypass custom filter rules and send file attachments of arbitrary file types via a message with a subject of "Antigen forwarded attachment".

  • CVE-2005-3029Sep 21, 2005
    Ahnlab
    V3 Virusblock 2005
    risk 0.00cvss —epss 0.04

    Stack-based buffer overflow in AhnLab V3Pro 2004 build 6.0.0.383, V3 VirusBlock 2005 build 6.0.0.383, and V3Net for Windows Server 6.0 build 6.0.0.383 allows remote attackers to execute arbitrary code via a long filname in an ACE archive.

  • CVE-2005-3030Sep 21, 2005
    Ahnlab
    V3 Virusblock 2005
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in the archive decompression library in AhnLab V3Pro 2004 build 6.0.0.383, V3 VirusBlock 2005 build 6.0.0.383, and V3Net for Windows Server 6.0 build 6.0.0.383 allows remote attackers to write arbitrary files via a .. (dot dot) in the filename…

  • CVE-2005-3013Sep 21, 2005
    Novell
    Suse Linux
    risk 0.00cvss —epss 0.01

    Buffer overflow in liby2util in Yet another Setup Tool (YaST) for SuSE Linux 9.3 allows local users to execute arbitrary code via a long Loc entry.

  • CVE-2005-3014Sep 21, 2005
    Ensim
    Webppliance
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Ensim webplliance allows remote attackers to inject arbitrary web script or HTML via the Login (OCW_login_username) field.

  • CVE-2005-3015Sep 21, 2005
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in IBM Lotus Domino 6.5.2 allows remote attackers to inject arbitrary web script or HTML via the (1) BaseTarget or (2) Src parameters.

  • CVE-2005-3016Sep 21, 2005
    PHP-Nuke
    PHP Nuke
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in the WYSIWYG editor in PHP-Nuke before 7.9 Final have unknown impact and attack vectors.

  • CVE-2005-3017Sep 21, 2005
    Content2web
    Content2web
    risk 0.00cvss —epss 0.01

    PHP file inclusion vulnerability in index.php in Content2Web 1.0.1 allows remote attackers to include arbitrary files via the show parameter, which can lead to resultant errors such as path disclosure, SQL error messages, and cross-site scripting (XSS).

  • CVE-2005-0138Sep 21, 2005
    Sgi
    Irix
    risk 0.00cvss —epss 0.01

    rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not correctly allow access to anonymous clients that connect from a system whose hostname can not be determined. NOTE: while this issue occurs in a security mechanism, there is no apparent attacker role and probably does…