VYPR

CVEs

378,533 total · page 7343 of 7,571

AllCriticalHighKEV
  • CVE-2005-0896May 2, 2005
    Accomplishtechnology
    Phpmydirectory
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in review.php in phpMyDirectory 10.1.3-rel allow remote attackers to inject arbitrary web script or HTML via the (1) subcat, (2) page, or (3) subsubcat parameter.

  • CVE-2005-0897May 2, 2005
    E Store Kit 2
    PayPal Edition
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in catalog.php in E-Store Kit-2 PayPal Edition allows remote attackers to execute arbitrary PHP code by modifying the menu and main parameters to reference a URL on a remote web server that contains the code.

  • CVE-2005-0899May 2, 2005
    IBM
    Os\/400
    risk 0.00cvss —epss 0.00

    AS/400 running OS400 5.2 installs and enables LDAP by default, which allows remote authenticated users to obtain OS/400 user profiles by performing a search.

  • CVE-2005-0901May 2, 2005
    Nukebookmarks
    Nukebookmarks
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in NukeBookmarks 0.6 for PHP-Nuke allow remote attackers to inject arbitrary web script or HTML via the (1) catname, (2) markname, (3) comment, or (4) category parameter.

  • CVE-2005-0902May 2, 2005
    Nukebookmarks
    Nukebookmarks
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in marks.php in NukeBookmarks 0.6 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the category parameter.

  • CVE-2005-0903May 2, 2005
    Apple Inc.
    Quicktime Pictureviewer
    risk 0.03cvss —epss 0.02

    Buffer overflow in QuickTime PictureViewer 6.5.1 allows remote attackers to cause a denial of service (application crash) via a JPEG file with crafted Huffman Table (marker DHT) data.

  • CVE-2005-0904May 2, 2005
    Microsoft
    Windows Xp
    risk 0.04cvss —epss 0.07

    Remote Desktop in Windows XP SP1 does not verify the "Force shutdown from a remote system" setting, which allows remote attackers to shut down the system by executing TSShutdn.exe.

  • CVE-2005-0905May 2, 2005
    Maxthon
    Maxthon Browser
    risk 0.03cvss —epss 0.02

    Maxthon 1.2.0 allows remote malicious web sites to obtain potentially sensitive data from the search bar via the m2_search_text property.

  • CVE-2005-0906May 2, 2005
    Sacred
    Sacred
    risk 0.03cvss —epss 0.05

    Buffer overflow in a player logging function in the Tincat network library 2.x before 2.0.28, as used in games such as Sacred and The Settlers: Heritage of Kings, allows remote attackers to execute arbitrary code.

  • CVE-2005-0907May 2, 2005
    Valdersoft
    Shopping Cart
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Valdersoft Shopping Cart 3.0 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to category.php, (2) the id parameter to item.php, (3) the lang parameter to index.php, (4) the searchQuery parameter to…

  • CVE-2005-0909May 2, 2005
    TKai
    Shoutbox
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in shoutact.php for TKai's Shoutbox allows remote attackers to execute arbitrary PHP code via the query parameter.

  • CVE-2005-0910May 2, 2005
    Exoops
    Exoops
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in exoops allow remote attackers to inject arbitrary web script or HTML via (1) the sortdays parameter to viewforum.php or (2) the viewcat parameter to index.php.

  • CVE-2005-0913May 2, 2005
    Smarty
    Smarty
    risk 0.00cvss —epss 0.02

    Unknown vulnerability in the regex_replace modifier (modifier.regex_replace.php) in Smarty before 2.6.8 allows attackers to execute arbitrary PHP code.

  • CVE-2005-0915May 2, 2005
    Webmasters Debutants
    Wd Guestbook
    risk 0.00cvss —epss 0.02

    Webmasters-Debutants WD Guestbook 2.8 allows remote attackers to bypass authentication and perform certain administrator actions via a direct HTTP POST request to (1) ajout_admin2.php or (2) suppr.php.

  • CVE-2005-0916May 2, 2005
    Linux
    Kernel
    risk 0.03cvss —epss 0.01

    AIO in the Linux kernel 2.6.11 on the PPC64 or IA64 architectures with CONFIG_HUGETLB_PAGE enabled allows local users to cause a denial of service (system panic) via a process that executes the io_queue_init function but exits without running io_queue_release, which causes…

  • CVE-2005-0917May 2, 2005
    EncapsBB
    EncapsBB
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in index_header.php for EncapsBB 0.3.2_fixed, and possibly other versions, allows remote attackers to execute arbitrary PHP code via the root parameter.

  • CVE-2005-0920May 2, 2005
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Bugtracker.NET 2.0.1 allow remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2005-0921May 2, 2005
    Microsoft
    Outlook 2002 Connector for IBM Lotus Domino
    risk 0.00cvss —epss 0.01

    Microsoft Outlook 2002 Connector for IBM Lotus Domino 2.0 allows local users to save passwords and login credentials locally, even when password caching is disabled by a group policy.

  • CVE-2005-0922May 2, 2005
    Symantec
    Norton Antivirus
    risk 0.00cvss —epss 0.03

    Unknown vulnerability in the Auto-Protect module in Symantec Norton AntiVirus 2004 and 2005, as also used in Internet Security 2004/2005 and System Works 2004/2005, allows attackers to cause a denial of service (system hang or crash) by triggering a scan of a certain file type.

  • CVE-2005-0923May 2, 2005
    Symantec
    Norton Antivirus
    risk 0.00cvss —epss 0.00

    The SmartScan feature in the Auto-Protect module for Symantec Norton AntiVirus 2004 and 2005, as also used in Internet Security 2004/2005 and System Works 2004/2005, allows attackers to cause a denial of service (CPU consumption and system crash) by renaming a file on a network…

  • CVE-2005-0925May 2, 2005
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in login.asp for Ublog Reload 1.0 through 1.0.4 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  • CVE-2005-0926May 2, 2005
    Sylpheed
    Sylpheed
    risk 0.00cvss —epss 0.02

    Buffer overflow in Sylpheed before 1.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attachments with MIME-encoded file names.

  • CVE-2005-0927May 2, 2005
    WebAPP
    WebAPP
    risk 0.00cvss —epss 0.02

    Unknown vulnerability in subs.pl for WebAPP 0.9.9 through 0.9.9.2 has unknown impact and attack vectors, probably involving shell metacharacters or .. sequences.

  • CVE-2005-0928May 2, 2005
    Photopost
    Photopost PHP Pro
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP Pro 5.x allow remote attackers to inject arbitrary web script or HTML via the (1) cat, (2) password, (3) ppuser, (4) sort, or (5) si parameters to showgallery.php, the (6) ppuser, (7) sort, or (8) si parameters…

  • CVE-2005-0929May 2, 2005
    Photopost
    Photopost PHP Pro
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in PhotoPost PHP Pro 5.x may allow remote attackers to execute arbitrary SQL commands via (1) the sl parameter to showmembers.php or (2) the photo parameter to showphoto.php.

  • CVE-2005-0930May 2, 2005
    Stephen Craton
    Chatness
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in message.php in Chatness 2.5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) the user field or (2) the message parameter to message.php.

  • CVE-2005-0932May 2, 2005
    Coinsoft Technologies
    Phpcoin
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in phpCOIN 1.2.1b and earlier allow remote attackers to execute arbitrary SQL commands (1) via the search engine, (2) the username or email fields in the "forgotten password" feature, or (3) the domain name in a package order.

  • CVE-2005-0933May 2, 2005
    Coinsoft Technologies
    Phpcoin
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in auxpage.php for phpCOIN 1.2.1b and earlier allows remote attackers to read arbitrary files via the page parameter.

  • CVE-2005-0934May 2, 2005
    Wackowiki
    Wackowiki
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in WackoWiki R4 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2005-0935May 2, 2005
    Esmi
    Paypal Storefront
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ESMI PayPal Storefront allow remote attackers to execute arbitrary SQL commands via the (1) idpages parameter to pages.php or the (2) id2 parameter to products1.php.

  • CVE-2005-0936May 2, 2005
    Esmi
    Paypal Storefront
    risk 0.03cvss —epss 0.03

    Cross-site scripting vulnerability in products1h.php in ESMI PayPal Storefront allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2005-0938May 2, 2005
    Ublog
    Reload
    risk 0.00cvss —epss 0.01

    Ublog Reload 1.0 through 1.0.4 stores ublogreload.mdb under the web root, which allows remote attackers to read usernames and hashed passwords via a direct request to ublogreload.mdb.

  • CVE-2005-0941May 2, 2005
    Openoffice
    Openoffice
    risk 0.00cvss —epss 0.04

    The StgCompObjStream::Load function in OpenOffice.org OpenOffice 1.1.4 and earlier allocates memory based on 16 bit length values, but process memory using 32 bit values, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a DOC…

  • CVE-2005-0942May 2, 2005
    Sybase
    Adaptive Server Enterprise
    risk 0.00cvss —epss 0.02

    The XP Server process (xp_server) in Sybase Adaptive Server Enterprise (ASE) XP Server 12.x before 12.5.3 ESD#1 allows attackers to cause a denial of service (process crash) via malformed data sent to the XP Server TCP port.

  • CVE-2005-0944May 2, 2005
    Microsoft
    Jet
    risk 0.06cvss —epss 0.34

    Unknown vulnerability in Microsoft Jet DB engine (msjet40.dll) 4.00.8618.0, related to insufficient data validation, allows remote attackers to execute arbitrary code via a crafted mdb file.

  • CVE-2005-0945May 2, 2005
    Asp Press
    Acs Blog
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ACS Blog 1.1.1 allows remote attackers to inject arbitrary web script or HTML via onmouseover or onload events in (1) img, (2) link, or (3) mail tags.

  • CVE-2005-0947May 2, 2005
    Coinsoft Technologies
    Phpcoin
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in auxpage.php in phpCoin 1.2.1b and earlier allows remote attackers to read and execute arbitrary files via a .. (dot dot) in the page parameter.

  • CVE-2005-0948May 2, 2005
    Portalapp
    Portalapp
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ad_click.asp for PortalApp allows remote attackers to execute arbitrary SQL commands via the banner_id parameter.

  • CVE-2005-0949May 2, 2005
    Iatek
    Portalapp
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in content.asp in Iatek PortalApp allow remote attackers to inject arbitrary web script or HTML via the (1) contenttype or (2) keywords parameter.

  • CVE-2005-0952May 2, 2005
    paFileDB
    paFileDB
    risk 0.03cvss —epss 0.06

    Cross-site scripting vulnerability in pafiledb.php in PaFileDB 3.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2005-0953May 2, 2005
    Bzip
    Bzip2
    risk 0.00cvss —epss 0.00

    Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete.

  • CVE-2005-0954May 2, 2005
    Microsoft
    Internet Explorer
    risk 0.01cvss —epss 0.15

    Windows Explorer and Internet Explorer in Windows 2000 SP1 allows remote attackers to cause a denial of service (CPU consumption) via a malformed Windows Metafile (WMF) file.

  • CVE-2005-0955May 2, 2005
    Interakt
    Mx Shop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in InterAKT MX Shop 1.1.1 allows remote attackers to execute arbitrary SQL commands via the id_ctg parameter.

  • CVE-2005-0956May 2, 2005
    Interakt
    Mx Kart
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in InterAKT MX Kart 1.1.2 allow remote attackers to execute arbitrary SQL commands via the (1) idp, (2) id_ctg, or (3) id_man parameter.

  • CVE-2005-0958May 2, 2005
    Yepyep
    Mtftpd
    risk 0.03cvss —epss 0.04

    Format string vulnerability in the log_do function in log.c for YepYep mtftpd 0.0.3, when the statistics option is enabled, allows remote attackers to execute arbitrary code via the CWD command.

  • CVE-2005-0959May 2, 2005
    Yepyep
    Mtftpd
    risk 0.03cvss —epss 0.04

    Buffer overflow in the mt_do_dir function in YepYep mtftpd 0.0.3 may allow attackers to execute arbitrary code via a long path.

  • CVE-2005-0960May 2, 2005
    OpenBSD
    OpenBSD
    risk 0.00cvss —epss 0.01

    Multiple vulnerabilities in the SACK functionality in (1) tcp_input.c and (2) tcp_usrreq.c OpenBSD 3.5 and 3.6 allow remote attackers to cause a denial of service (memory exhaustion or system crash).

  • CVE-2005-0961May 2, 2005
    Horde (software)
    Horde
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Horde 3.0.4 before 3.0.4-RC2 allows remote attackers to inject arbitrary web script or HTML via the parent frame title.

  • CVE-2005-0962May 2, 2005
    Lighthouse Development
    Squirrelcart
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php for Lighthouse Squirrelcart allows remote attackers to execute arbitrary SQL commands via the (1) crn parameter in a show action or (2) rn parameter in a show_detail action.

  • CVE-2005-0963May 2, 2005
    Toshiba
    Acpi Flash BIOS
    risk 0.00cvss —epss 0.00

    An error in the Toshiba ACPI BIOS 1.6 causes the BIOS to only examine the first slot in the Master Boot Record (MBR) table for an active partition, which prevents the system from booting even though the MBR is not malformed. NOTE: it has been debated as to whether or not this…