VYPR

CVEs

378,579 total · page 7340 of 7,572

AllCriticalHighKEV
  • CVE-2005-0582May 2, 2005
    Ca
    License Client
    risk 0.06cvss —epss 0.37

    Buffer overflow in Computer Associates (CA) License Client 0.1.0.15 allows remote attackers to execute arbitrary code via a long filename in a PUTOLF request.

  • CVE-2005-0583May 2, 2005
    Ca
    License Client
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in Computer Associates (CA) License Client 0.1.0.15 allows remote attackers to create arbitrary files via .. (dot dot) sequences in a PUTOLF request.

  • CVE-2005-0584May 2, 2005
    Mozilla Corporation
    Mozilla
    risk 0.00cvss —epss 0.01

    Firefox before 1.0.1 and Mozilla before 1.7.6, when displaying the HTTP Authentication dialog, do not change the focus to the tab that generated the prompt, which could facilitate spoofing and phishing attacks.

  • CVE-2005-0586May 2, 2005
    Mozilla Corporation
    Mozilla
    risk 0.00cvss —epss 0.01

    Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to spoof the extensions of files to download via the Content-Disposition header, which could be used to trick users into downloading dangerous content.

  • CVE-2005-0588May 2, 2005
    Mozilla Corporation
    Mozilla
    risk 0.00cvss —epss 0.02

    Firefox before 1.0.1 and Mozilla before 1.7.6 does not restrict xsl:include and xsl:import tags in XSLT stylesheets to the current domain, which allows remote attackers to determine the existence of files on the local system.

  • CVE-2005-0589May 2, 2005
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.01

    The Form Fill feature in Firefox before 1.0.1 allows remote attackers to steal potentially sensitive information via an input control that monitors the values that are generated by the autocomplete capability.

  • CVE-2005-0590May 2, 2005
    Mozilla Corporation
    Mozilla
    risk 0.00cvss —epss 0.02

    The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears…

  • CVE-2005-0591May 2, 2005
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Firefox before 1.0.1 allows remote attackers to spoof the (1) security and (2) download modal dialog boxes, which could be used to trick users into executing script or downloading and executing a file, aka "Firespoofing."

  • CVE-2005-0595May 2, 2005
    Working Resources Inc.
    Badblue
    risk 0.08cvss —epss 0.60

    Buffer overflow in ext.dll in BadBlue 2.55 allows remote attackers to execute arbitrary code via a long mfcisapicommand parameter.

  • CVE-2005-0596May 2, 2005
    PHP
    PHP
    risk 0.00cvss —epss 0.00

    PHP 4 (PHP4) allows attackers to cause a denial of service (daemon crash) by using the readfile function on a file whose size is a multiple of the page size.

  • CVE-2005-0597May 2, 2005
    Cisco Systems, Inc.
    Application And Content Networking Software
    risk 0.00cvss —epss 0.03

    Cisco devices running Application and Content Networking System (ACNS) 5.0 before 5.0.17.6 and 5.1 before 5.1.11.6 allow remote attackers to cause a denial of service (process restart) via a "crafted TCP connection."

  • CVE-2005-0599May 2, 2005
    Cisco Systems, Inc.
    Application And Content Networking Software
    risk 0.00cvss —epss 0.02

    Cisco devices running Application and Content Networking System (ACNS) 4.x, 5.0, or 5.1 before 5.1.11.6 allow remote attackers to cause a denial of service (CPU consumption) via malformed IP packets.

  • CVE-2005-0601May 2, 2005
    Cisco Systems, Inc.
    Application And Content Networking Software
    risk 0.00cvss —epss 0.02

    Cisco devices running Application and Content Networking System (ACNS) 4.x, 5.0, 5.1, or 5.2 use a default password when the setup dialog has not been run, which allows remote attackers to gain access.

  • CVE-2005-0602May 2, 2005
    Info Zip
    Unzip
    risk 0.00cvss —epss 0.00

    Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges.

  • CVE-2005-0604May 2, 2005
    Gfi
    Languard Network Security Scanner
    risk 0.00cvss —epss 0.00

    lnss.exe in GFI Languard Network Security Scanner 5.0 stores the username and password in memory in plaintext, which could allow local administrators to obtain domain administrator credentials.

  • CVE-2005-0606May 2, 2005
    Cubecart
    Cubecart
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in settings.inc.php for CubeCart 2.0.0 through 2.0.5, as used in multiple PHP files, allows remote attackers to inject arbitrary HTML or web script via the (1) cat_id, (2) PHPSESSID, (3) view_doc, (4) product, (5) session, (6) catname,…

  • CVE-2005-0607May 2, 2005
    Cubecart
    Cubecart
    risk 0.00cvss —epss 0.01

    CubeCart 2.0.0 through 2.0.5 allows remote attackers to determine the full path of the server via direct calls without parameters to (1) information.php, (2) language.php, (3) list_docs.php, (4) popular_prod.php, (5) sale.php, (6) subfooter.inc.php, (7) subheader.inc.php, (8)…

  • CVE-2005-0611May 2, 2005
    RealNetworks
    Realplayer
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in RealNetworks RealPlayer 10.5 (6.0.12.1056 and earlier), 10, 8, and RealOne Player V2 and V1, allows remote attackers to execute arbitrary code via .WAV files.

  • CVE-2005-0612May 2, 2005
    Cisco Systems, Inc.
    IP/VC Videoconferencing System
    risk 0.00cvss —epss 0.02

    Cisco IP/VC Videoconferencing System 3510, 3520, 3525 and 3530 contain hard-coded default SNMP community strings, which allows remote attackers to gain access, cause a denial of service, and modify configuration.

  • CVE-2005-0614May 2, 2005
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.08

    sessions.php in phpBB 2.0.12 and earlier allows remote attackers to gain administrator privileges via the autologinid value in a cookie.

  • CVE-2005-0615May 2, 2005
    Postnuke
    Postnuke
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in (1) index.php, (2) modules.php, or (3) admin.php in PostNuke 0.760-RC2 allow remote attackers to execute arbitrary SQL code via the catid parameter.

  • CVE-2005-0617May 2, 2005
    Postnuke
    Postnuke
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in dl-search.php in PostNuke 0.750 and 0.760-RC2 allows remote attackers to execute arbitrary SQL commands via the show parameter.

  • CVE-2005-0618May 2, 2005
    Symantec
    Gateway Security
    risk 0.00cvss —epss 0.01

    The SMTP binding function in Symantec Firewall/VPN Appliance 200/200R firmware after 1.5Z and before 1.68, Gateway Security 360/360R and 460/460R firmware before vuild 858, and Nexland Pro800turbo, when configured for load balancing between two WANs, might send SMTP traffic to a…

  • CVE-2005-0621May 2, 2005
    Scrapland
    Scrapland
    risk 0.03cvss —epss 0.03

    Scrapland 1.0 and earlier allows remote attackers to cause a denial of service (server termination) by triggering an error, which is treated as a fatal error by the server, as demonstrated using (1) signed integers for size values, (2) an invalid model, (3) a "newpos" value that…

  • CVE-2005-0627May 2, 2005
    Trolltech
    Qt
    risk 0.00cvss —epss 0.00

    Qt before 3.3.4 searches the BUILD_PREFIX directory, which could be world-writable, to load shared libraries regardless of the LD_LIBRARY_PATH environment variable, which allows local users to execute arbitrary programs.

  • CVE-2005-0634May 2, 2005
    Kmint21 Software
    Golden FTP Server
    risk 0.04cvss —epss 0.10

    Buffer overflow in Golden FTP Server 1.92 allows remote attackers to execute arbitrary code via a long USER command.

  • CVE-2005-0635May 2, 2005
    Foxmail
    Server
    risk 0.04cvss —epss 0.07

    Buffer overflow in Foxmail Server 2.0 allows remote attackers to execute arbitrary code via a long USER command.

  • CVE-2005-0637May 2, 2005
    OpenBSD
    OpenBSD
    risk 0.00cvss —epss 0.01

    The copy functions in locore.s such as copyout in OpenBSD 3.5 and 3.6, and possibly other BSD based operating systems, may allow attackers to exceed certain address boundaries and modify kernel memory.

  • CVE-2005-0642May 2, 2005
    Ca
    Unicenter Asset Management
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Query Designer for Computer Associates (CA) Unicenter Asset Management (UAM) 4.0 allows remote attackers to execute arbitrary SQL via an imported file.

  • CVE-2005-0643May 2, 2005
    McAfee
    Scan Engine
    risk 0.04cvss —epss 0.10

    Buffer overflow in McAfee Scan Engine 4320 with DAT version before 4357 allows remote attackers to execute arbitrary code via crafted LHA files.

  • CVE-2005-0644May 2, 2005
    McAfee
    Scan Engine
    risk 0.01cvss —epss 0.07

    Buffer overflow in McAfee Scan Engine 4320 with DAT version before 4436 allows remote attackers to execute arbitrary code via a malformed LHA file with a type 2 header file name field, a variant of CVE-2005-0643.

  • CVE-2005-0645May 2, 2005
    CuteNews
    CuteNews
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in show.inc.php in cuteNews 1.3.6 allows remote attackers to inject arbitrary HTML, web script, and PHP code via the (1) CLIENT-IP or (2) X-FORWARDED-FOR header in an HTTP POST request to show_news.php.

  • CVE-2005-0646May 2, 2005
    PaNews
    paNews
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in auth.php in paNews 2.0.4b allows remote attackers to execute arbitrary SQL via the mysql_prefix parameter.

  • CVE-2005-0647May 2, 2005
    PaNews
    paNews
    risk 0.03cvss —epss 0.04

    admin_setup.php in paNews 2.0.4b allows remote attackers to inject arbitrary PHP code via the (1) $form[comments] or (2) $form[autoapprove] parameters, which are written to config.php.

  • CVE-2005-0648May 2, 2005
    Pixel Apes Group
    Safehtml
    risk 0.00cvss —epss 0.01

    Multiple vulnerabilities in Pixel-Apes SafeHTML before 1.3.0 allow remote attackers to bypass cross-site scripting (XSS) protection via (1) "decimal HTML entities" or (2) "the \x00 symbol."

  • CVE-2005-0649May 2, 2005
    Pixel Apes Group
    Safehtml
    risk 0.00cvss —epss 0.01

    Pixel-Apes SafeHTML before 1.2.1 allows remote attackers to bypass cross-site scripting (XSS) protection via "hexadecimal HTML entities."

  • CVE-2005-0650May 2, 2005
    Projectbb
    Projectbb
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ProjectBB 0.4.5.1 allow remote attackers to inject arbitrary web script or HTML via (1) the pages parameter to divers.php (incorrectly referred to as "drivers.php" by some sources), (2) in the search feature text area, (3)…

  • CVE-2005-0651May 2, 2005
    Projectbb
    Projectbb
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ProjectBB 0.4.5.1 allow remote attackers to execute arbitrary SQL commands via (1) liste or (2) desc parameters to divers.php (incorrectly referred to as "drivers.php" by some sources), (3) the search feature text area, (4) post name in…

  • CVE-2005-0652May 2, 2005
    Microfocus
    Openvms
    risk 0.00cvss —epss 0.00

    Unknown vulnerability in HP OpenVMS VAX 7.x and 6.x and OpenVMS Alpha 7.x or 6.x allows local users to access privileged files.

  • CVE-2005-0653May 2, 2005
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    phpMyAdmin 2.6.1 does not properly grant permissions on tables with an underscore in the name, which grants remote authenticated users more privileges than intended.

  • CVE-2005-0654May 2, 2005
    GIMP
    Gimp
    risk 0.00cvss —epss 0.02

    gifload.exe in GIMP 2.0.5, 2.2.3, and possibly 2.2.4 allows remote attackers or local users to cause a denial of service (application crash) via the image descriptor (1) height or (2) width fields set to zero.

  • CVE-2005-0655May 2, 2005
    Auracms
    Auracms
    risk 0.00cvss —epss 0.02

    auraCMS 1.5 allows remote attackers to obtain sensitive information via an HTTP request with an invalid id parameter to (1) teman.php, (2) hal.php, or (3) arsip.php, which reveals the path in a PHP error message.

  • CVE-2005-0656May 2, 2005
    Auracms
    Auracms
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in auraCMS 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) hits parameter to hits.php, (2) query parameter to index.php, or (3) theCount parameter to counter.php.

  • CVE-2005-0657May 2, 2005
    Computalynx
    Cproxy
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Computalynx CProxy 3.3.x and 3.4.x through 3.4.4 allows remote attackers to read arbitrary files or cause a denial of service (application crash) via a .. (dot dot) in an HTTP request.

  • CVE-2005-0658May 2, 2005
    Cmw Linklist
    Cmw Linklist
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in a third party extension to TYPO3 allows remote attackers to execute arbitrary SQL commands via the category_uid parameter.

  • CVE-2005-0659May 2, 2005
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.02

    phpBB 2.0.13 and earlier allows remote attackers to obtain sensitive information via a direct request to oracle.php, which reveals the path in a PHP error message.

  • CVE-2005-0660May 2, 2005
    Adalis Infomatique
    D Forum
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in D-Forum 1.11 allows remote attackers to inject arbitrary web script or HTML via certain fields, as demonstrated using the page parameter in nav.php3.

  • CVE-2005-0661May 2, 2005
    Woltlab
    Burning Board
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the getwbbuserdata function in session.php for Woltlab Burning Board 2.0.3 through 2.3.0 allows remote attackers to execute arbitrary SQL commands via the (1) userid or (2) lastvisit cookie.

  • CVE-2005-0662May 2, 2005
    Mercuryboard
    Mercuryboard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php for MercuryBoard 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the Avatar field.

  • CVE-2005-0663May 2, 2005
    Mercuryboard
    Mercuryboard
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in index.php for MercuryBoard 1.1.2 allows remote attackers to inject arbitrary SQL commands via the f parameter.