Max CVSS 10.0 Min CVSS 1.2 Total Count2
IDCVSSSummaryLast (major) updatePublished
CVE-2007-0908 5.0
The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the key_length variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element
30-10-2018 - 16:26 13-02-2007 - 23:28
CVE-2005-3390 7.5
The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST reque
30-10-2018 - 16:25 01-11-2005 - 12:47
CVE-2006-0714 5.0
Directory traversal vulnerability in the installation file (sql/install-0.9.7.php) in Flyspray 0.9.7 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the adodbpath parameter.
19-10-2018 - 15:45 15-02-2006 - 11:06
CVE-2006-0174 4.0
Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to obtain sensitive information (intranet IP addresses and enumerations of valid parameter values) via a direct request to hc, which reveals
19-10-2018 - 15:43 11-01-2006 - 21:03
CVE-2006-0156 4.3
Cross-site scripting (XSS) vulnerability in Foxrum 4.0.4f allows remote attackers to inject arbitrary Javascript via the javascript URI in bbcode url tags in (1) addpost1.php and (2) addtopic1.php.
19-10-2018 - 15:43 10-01-2006 - 11:03
CVE-2006-0135 7.5
SQL injection vulnerability in login.php in TheWebForum (twf) 1.2.1 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the username parameter (aka the u variable).
19-10-2018 - 15:42 09-01-2006 - 11:03
CVE-2006-0105 5.0
PostgreSQL 8.0.x before 8.0.6 and 8.1.x before 8.1.2, when running on Windows, allows remote attackers to cause a denial of service (postmaster exit and no new connections) via a large number of simultaneous connection requests.
19-10-2018 - 15:42 10-01-2006 - 20:03
CVE-2006-0104 5.0
Directory traversal vulnerability in TinyPHPForum 3.6 and earlier allows remote attackers to create a new user account, create a new topic, or view the profile of a user account, as demonstrated via a .. (dot dot) in the uname parameter to profile.ph
19-10-2018 - 15:42 06-01-2006 - 11:03
CVE-2006-0103 5.0
TinyPHPForum 3.6 and earlier stores the (1) users/[USERNAME].hash and (2) users/[USERNAME].email files under the web root with insufficient access control, which allows remote attackers to list all registered users and possibly obtain other sensitive
19-10-2018 - 15:42 06-01-2006 - 11:03
CVE-2006-0102 4.3
Cross-site scripting (XSS) vulnerability in TinyPHPForum (TPF) 3.6 and earlier allows remote attackers to inject arbitrary web script via a javascript: scheme in an "[a]" bbcode tag, possibly the txt parameter to action.php.
19-10-2018 - 15:42 06-01-2006 - 11:03
CVE-2005-4080 4.3
Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via UTF16 encoded attachments and strings that will be executed when viewed using Inte
19-10-2018 - 15:40 08-12-2005 - 01:03
CVE-2005-2340 7.5
Heap-based buffer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a crafted (1) QuickTime Image File (QTIF), (2) PICT, or (3) JPEG format image with a long data field.
19-10-2018 - 15:32 31-12-2005 - 05:00
CVE-2004-2745 7.8
Directory traversal vulnerability in Anteco Visual Technologies OwnServer 1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.
19-10-2018 - 15:30 31-12-2004 - 05:00
CVE-2006-3546 5.0
Patrice Freydiere ImgSvr (aka ADA Image Server) allows remote attackers to cause a denial of service (daemon crash) via a long HTTP POST request. NOTE: this might be the same issue as CVE-2004-2463.
18-10-2018 - 16:47 13-07-2006 - 00:05
CVE-2006-3200 5.0
Unspecified versions of Internet Explorer allow remote attackers to cause a denial of service (crash) via an IFRAME with a src tag containing a "File://" URI followed by an 8-bit character. NOTE: some third parties were unable to verify this issue.
18-10-2018 - 16:46 23-06-2006 - 20:06
CVE-2006-2812 6.8
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Dominios Europa PICRATE (aka TAL RateMyPic) 1.0 allow remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element in the (1) n
18-10-2018 - 16:43 05-06-2006 - 17:02
CVE-2006-2507 7.5
Multiple PHP remote file inclusion vulnerabilities in Teake Nutma Foing 0.2.0 through 0.7.0, as used with phpBB, allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) index.php, (2) song.php, (3) faq.p
18-10-2018 - 16:40 22-05-2006 - 19:02
CVE-2006-1640 2.6
Cross-site scripting (XSS) vulnerability in news.php in CzarNews 1.14 allows remote attackers to inject arbitrary web script or HTML via the email parameter.
18-10-2018 - 16:33 06-04-2006 - 10:04
CVE-2006-1502 5.1
Multiple integer overflows in MPlayer 1.0pre7try2 allow remote attackers to cause a denial of service and trigger heap-based buffer overflows via (1) a certain ASF file handled by asfheader.c that causes the asf_descrambling function to be passed a n
18-10-2018 - 16:32 30-03-2006 - 00:06
CVE-2006-1419 5.0
SQL injection vulnerability in the Calendar module in nuked-klan 1.7.5 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter to index.php.
18-10-2018 - 16:32 28-03-2006 - 20:02
CVE-2006-6539 10.0
Multiple buffer overflows in Winamp Web Interface (Wawi) 7.5.13 and earlier (1) allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an (a) long username or a (b) crafted packet to the FindBa
17-10-2018 - 21:49 14-12-2006 - 02:28
CVE-2006-6514 3.5
Winamp Web Interface (Wawi) 7.5.13 and earlier uses an insufficient comparison to determine whether a directory is located below the application's root directory, which allows remote authenticated users to access certain other directories if the name
17-10-2018 - 21:49 14-12-2006 - 01:28
CVE-2006-6513 3.5
The CControl::Download function (/dl URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to download arbitrary file types under the root via a trailing "." (dot) in a filename in the file parameter, related to err
17-10-2018 - 21:49 14-12-2006 - 01:28
CVE-2006-6512 3.5
Directory traversal vulnerability in the Browse function (/browse URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to list arbitrary directories via URL encoded backslashes ("%2F") in the path parameter. The at
17-10-2018 - 21:49 14-12-2006 - 01:28
CVE-2006-6206 7.5
SQL injection vulnerability in item.asp in WarHound General Shopping Cart allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.
17-10-2018 - 21:47 01-12-2006 - 01:28
CVE-2006-5789 4.0
War FTP Daemon (WarFTPd) 1.82.00-RC11 allows remote authenticated users to cause a denial of service via a large number of "%s" format strings in (1) CWD, (2) CDUP, (3) DELE, (4) NLST, (5) LIST, (6) SIZE, and possibly other commands. NOTE: it is pos
17-10-2018 - 21:45 07-11-2006 - 23:07
CVE-2006-5309 7.5
PHP remote file inclusion vulnerability in language/lang_french/lang_prillian_faq.php in the Prillian French 0.8.0 and earlier module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
17-10-2018 - 21:42 17-10-2006 - 16:07
CVE-2006-4990 7.5
Multiple PHP remote file inclusion vulnerabilities in PhotoPost allow remote attackers to execute arbitrary PHP code via a URL in the PP_PATH parameter in (1) addfav.php, (2) adm-admlog.php, (3) adm-approve.php, (4) adm-backup.php, (5) adm-cats.php,
17-10-2018 - 21:40 26-09-2006 - 02:07
CVE-2006-4667 7.5
Multiple SQL injection vulnerabilities in RunCMS 1.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) uid parameter in (a) class/sessions.class.php, and the (2) timezone_offset and (3) umode parameters in (b) class/xoopsuser.php
17-10-2018 - 21:38 09-09-2006 - 00:04
CVE-2006-4283 7.5
Multiple PHP remote file inclusion vulnerabilities in SOLMETRA SPAW Editor 1.0.6 and 1.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the spaw_dir parameter in dialogs/ scripts including (1) a.php, (2) collorpicker.php, (3) img
17-10-2018 - 21:34 22-08-2006 - 17:04
CVE-2006-4008 7.5
PHP remote file inclusion vulnerability in index.php in Knusperleicht Faq 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the faq_path parameter.
17-10-2018 - 21:32 07-08-2006 - 19:04
CVE-2006-3997 7.5
PHP remote file inclusion vulnerability in hsList.php in WoWRoster (aka World of Warcraft Roster) 1.5.x and earlier allows remote attackers to execute arbitrary PHP code via a URL in the subdir parameter.
17-10-2018 - 21:32 05-08-2006 - 01:04
CVE-2006-3993 5.1
PHP remote file inclusion vulnerability in copyright.php in Olaf Noehring The Search Engine Project (TSEP) 0.942 allows remote attackers to execute arbitrary PHP code via a URL in the tsep_config[absPath] parameter. Successful exploitation requires t
17-10-2018 - 21:32 05-08-2006 - 00:04
CVE-2006-3990 7.5
Multiple PHP remote file inclusion vulnerabilities in Paul M. Jones Savant2, possibly when used with the com_mtree component for Mambo and Joomla!, allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path paramete
17-10-2018 - 21:32 05-08-2006 - 00:04
CVE-2006-3989 5.1
PHP remote file inclusion vulnerability in index.php in Knusperleicht Shoutbox 4.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the sb_include_path parameter. Successful exploitation requires that "register_globals"
17-10-2018 - 21:32 05-08-2006 - 00:04
CVE-2006-3988 5.1
PHP remote file inclusion vulnerability in index.php in Knusperleicht newsReporter 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the news_include_path parameter. Successful exploitation requires that "register_glo
17-10-2018 - 21:32 05-08-2006 - 00:04
CVE-2006-3987 5.1
Multiple PHP remote file inclusion vulnerabilities in index.php in Knusperleicht FileManager 1.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) dwl_download_path or (2) dwl_include_path parameters. Successful ex
17-10-2018 - 21:32 05-08-2006 - 00:04
CVE-2006-3986 7.5
PHP remote file inclusion vulnerability in index.php in Knusperleicht Newsletter 3.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the NL_PATH parameter.
17-10-2018 - 21:32 05-08-2006 - 00:04
CVE-2006-3984 7.5
PHP remote file inclusion vulnerability in phpAdsNew/view.inc.php in Albasoftware Phpauction 2.1 and possibly later versions, with phpAdsNew 2.0.5, allows remote attackers to execute arbitrary PHP code via a URL in the phpAds_path parameter.
17-10-2018 - 21:32 05-08-2006 - 00:04
CVE-2006-3982 7.5
PHP remote file inclusion vulnerability in quickie.php in Knusperleicht Quickie, probably 0.2, allows remote attackers to execute arbitrary PHP code via a URL in the QUICK_PATH parameter.
17-10-2018 - 21:32 05-08-2006 - 00:04
CVE-2006-3980 6.8
PHP remote file inclusion vulnerability in administrator/components/com_mgm/help.mgm.php in Mambo Gallery Manager (MGM) 0.95r2 and earlier for Mambo 4.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path pa
17-10-2018 - 21:32 05-08-2006 - 00:04
CVE-2007-3407 5.0
Sergey Lyubka Simple HTTPD (shttpd) 1.38 allows remote attackers to obtain sensitive information (script source code) via a URL with a trailing encoded space (%20).
16-10-2018 - 16:49 26-06-2007 - 18:30
CVE-2007-2857 7.5
PHP remote file inclusion vulnerability in sample/xls2mysql in ABC Excel Parser Pro 4.0 allows remote attackers to execute arbitrary PHP code via a URL in the parser_path parameter.
16-10-2018 - 16:45 24-05-2007 - 19:30
CVE-2007-2290 7.5
Multiple PHP remote file inclusion vulnerabilities in B2 Weblog and News Publishing Tool 0.6.1 allow remote attackers to execute arbitrary PHP code via a URL in the b2inc parameter to (1) b2archives.php, (2) b2categories.php, or (3) b2mail.php. NOTE
16-10-2018 - 16:42 26-04-2007 - 19:19
CVE-2007-1922 9.3
The Impulse Tracker (IT) and ScreamTracker 3 (S3M) modules in IN_MOD.DLL in AOL Nullsoft Winamp 5.33 allows remote attackers to execute arbitrary code via a crafted (1) .IT or (2) .S3M file containing integer values that are used as memory offsets, w
16-10-2018 - 16:41 10-04-2007 - 23:19
CVE-2007-1486 10.0
PHP remote file inclusion vulnerability in template.class.php in Carbonize Lazarus Guestbook before 1.7.3 allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to admin.php, probably due to a dynamic variable e
16-10-2018 - 16:38 16-03-2007 - 21:19
CVE-2007-1139 10.0
Unrestricted file upload vulnerability in Cromosoft Simple Plantilla PHP (SPP) allows remote attackers to upload arbitrary scripts via a filename with a double extension.
16-10-2018 - 16:36 02-03-2007 - 21:18
CVE-2007-1138 5.0
Absolute path traversal vulnerability in list_main_pages.php in Cromosoft Simple Plantilla PHP (SPP) allows remote attackers to list arbitrary directories, and read arbitrary files, via an absolute pathname in the nfolder parameter.
16-10-2018 - 16:36 02-03-2007 - 21:18
CVE-2007-0873 7.5
nabopoll 1.1.2 allows remote attackers to bypass authentication and access certain administrative functionality via a direct request for (1) config_edit.php, (2) template_edit.php, or (3) survey_edit.php in admin/.
16-10-2018 - 16:34 12-02-2007 - 19:28
CVE-2007-0178 7.5
PHP remote file inclusion vulnerability in info.php in Easy Banner Pro 2.8 allows remote attackers to execute arbitrary PHP code via a URL in the s[phppath] parameter.
16-10-2018 - 16:31 11-01-2007 - 00:28
CVE-2006-7078 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Professional Home Page Tools Login Script, as of July 2006, allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) vorname, and (3) nachname parameters in the registe
16-10-2018 - 16:29 02-03-2007 - 21:18
CVE-2006-7072 4.3
Cross-site scripting (XSS) vulnerability in GeoClassifieds Enterprise 2.0.5.2 and earlier allows remote attackers to inject arbitrary web script and HTML via the (1) b[username] and (2) c parameters to (a) index.php, the b[username] parameter to (b)
16-10-2018 - 16:29 02-03-2007 - 21:18
CVE-2006-7070 7.5
Unrestricted file upload vulnerability in manager/media/ibrowser/scripts/rfiles.php in Etomite CMS 0.6.1 and earlier allows remote attackers to upload and execute arbitrary files via an nfile[] parameter with a filename that contains a .php extension
16-10-2018 - 16:29 02-03-2007 - 21:18
CVE-2006-7067 6.0
Oracle 10g R2 and possibly other versions allows remote attackers to trigger internal errors, and possibly have other impacts, via an "alter session set events" command with invalid arguments. NOTE: this issue was originally disputed by a third part
16-10-2018 - 16:29 02-03-2007 - 21:18
CVE-2008-0673 7.5
TinTin++ 1.97.9 and WinTin++ 1.97.9 open files on the basis of an inbound file-transfer request, before the user has an opportunity to decline the request, which allows remote attackers to truncate arbitrary files in the top level of a home directory
15-10-2018 - 22:02 12-02-2008 - 01:00
CVE-2008-0672 5.0
The process_chat_input function in TinTin++ 1.97.9 and WinTin++ 1.97.9 allows remote attackers to cause a denial of service (application crash) via a YES message without a newline character, which triggers a NULL dereference.
15-10-2018 - 22:02 12-02-2008 - 01:00
CVE-2008-0671 10.0
Stack-based buffer overflow in the add_line_buffer function in TinTin++ 1.97.9 and WinTin++ 1.97.9 allows remote attackers to execute arbitrary code via a long chat message, related to conversion from LF to CRLF.
15-10-2018 - 22:02 12-02-2008 - 01:00
CVE-2008-0231 7.5
Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange Cutout, (4) Lonely Maple, (5) Endless, (6) Classic Theme, and (7) Music Theme webpage templates allow remote attackers to include a
15-10-2018 - 21:58 11-01-2008 - 00:46
CVE-2007-6312 4.3
Cross-site scripting (XSS) vulnerability in the logon page in Web Reporting Tools portal in Websense Enterprise and Web Security Suite 6.3 allows remote attackers to inject arbitrary web script or HTML via the username field.
15-10-2018 - 21:51 11-12-2007 - 21:46
CVE-2007-5787 5.0
Micro Login System 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing a password via a direct request for userpwd.txt.
15-10-2018 - 21:46 01-11-2007 - 16:46
CVE-2007-5752 7.5
adduser.php in PHP-AGTC Membership (AGTC-Membership) System 1.1a does not require authentication, which allows remote attackers to create accounts via a modified form, as demonstrated by an account with admin (userlevel 4) privileges.
15-10-2018 - 21:46 31-10-2007 - 17:46
CVE-2007-5739 5.0
Directory traversal vulnerability in component/flashupload/download.jsp in the FlashUpload component in Korean GHBoard allows remote attackers to read arbitrary files via a .. (dot dot) in the name parameter.
15-10-2018 - 21:46 30-10-2007 - 23:46
CVE-2007-5738 6.8
The FlashUpload component in Korean GHBoard uses a client-side protection mechanism to prevent uploading of dangerous file extensions, which allows remote attackers to bypass restrictions and upload arbitrary files via a modified copy of component/fl
15-10-2018 - 21:46 30-10-2007 - 23:46
CVE-2007-5737 7.5
Unrestricted file upload vulnerability in component/upload.jsp in Korean GHBoard allows remote attackers to upload arbitrary files via unspecified vectors, probably involving a direct request.
15-10-2018 - 21:46 30-10-2007 - 23:46
CVE-2007-5736 6.4
Unrestricted file upload vulnerability in upload.php in SeeBlick 1.0 Beta allows remote attackers to upload arbitrary files via unspecified vectors. NOTE: these files are stored with .html extensions, so the scope of the attack might be limited to r
15-10-2018 - 21:46 30-10-2007 - 23:46
CVE-2007-5735 5.0
eFileMan 7.1.0.87-88 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain unspecified user information via a direct request for cgi-bin/efileman/efileman_config.pm.
15-10-2018 - 21:46 30-10-2007 - 23:46
CVE-2007-5734 6.4
Unrestricted file upload vulnerability in eFileMan 7.1.0.87-88 allows remote attackers to upload arbitrary files, with "uploads/upload_file." destination filenames, via unspecified vectors to upload.cgi, accessed from upload.html.
15-10-2018 - 21:46 30-10-2007 - 23:46
CVE-2007-5733 7.5
Unrestricted file upload vulnerability in upload/upload.php in Japanese PHP Gallery Hosting, when Open directory mode is enabled, allows remote attackers to upload and execute arbitrary PHP code via a ServerPath parameter specifying a filename with a
15-10-2018 - 21:46 30-10-2007 - 23:46
CVE-2007-5732 5.0
Directory traversal vulnerability in downloadfile.php in eLouai's Force Download of media files script, as available on 20071030 and earlier, allows remote attackers to read arbitrary files via the file parameter. NOTE: this issue only occurs in env
15-10-2018 - 21:46 30-10-2007 - 23:46
CVE-2007-5727 4.3
Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other versions, allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary web script o
15-10-2018 - 21:46 30-10-2007 - 21:46
CVE-2007-5650 7.5
Directory traversal vulnerability in system.php in ReloadCMS 1.2.7 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module parameter to index.php.
15-10-2018 - 21:45 23-10-2007 - 21:47
CVE-2007-5646 6.8
SQL injection vulnerability in Sources/Search.php in Simple Machines Forum (SMF) 1.1.3, when MySQL 5 is used, allows remote attackers to execute arbitrary SQL commands via the userspec parameter in a search2 action to index.php.
15-10-2018 - 21:45 23-10-2007 - 21:47
CVE-2007-5640 7.1
The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), Mobile Voice Client, and other product lines, allow remote attackers to block calls and force re-registrati
15-10-2018 - 21:45 23-10-2007 - 17:46
CVE-2007-5639 7.1
The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and other Nortel IP Phone, Mobile Voice Client, and WLAN Handsets products allow remote attackers to cause a denial of service (device hang) via a flood of Mute and UnMute messages that have a spo
15-10-2018 - 21:45 23-10-2007 - 17:46
CVE-2007-5638 4.3
The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other product lines, use only 65536 different values in the 32-bit ID number field of an RUDP datagram,
15-10-2018 - 21:45 23-10-2007 - 17:46
CVE-2007-5637 4.3
The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other product lines allow remote attackers to eavesdrop on the physical environment via an Open Audio S
15-10-2018 - 21:45 23-10-2007 - 17:46
CVE-2007-5636 7.5
Buffer overflow in the Nortel UNIStim IP Softphone 2050 allows remote attackers to cause a denial of service (application abort) and possibly execute arbitrary code via a flood of invalid characters to the RTCP port (5678/udp) that triggers a Windows
15-10-2018 - 21:45 23-10-2007 - 17:46
CVE-2007-5625 4.3
Cross-site scripting (XSS) vulnerability in filename.asp in ASP Site Search SearchSimon Lite 1.0 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter.
15-10-2018 - 21:45 23-10-2007 - 16:46
CVE-2007-5587 6.9
Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professional x64 and x64 SP2, Server 2003 SP1 and SP2, and Server 2003 x64 and x64 SP2 allows local users to overwrite arbitrary memory loc
15-10-2018 - 21:45 19-10-2007 - 21:17
CVE-2007-5564 2.6
Multiple cross-site scripting (XSS) vulnerabilities in NSSboard (formerly Simple PHP Forum) 6.1 allow remote attackers to inject arbitrary web script or HTML via (1) HTML tags when BBcode is disabled; or the (2) user, (3) email, or (4) Real Name fiel
15-10-2018 - 21:45 18-10-2007 - 20:17
CVE-2007-5546 9.3
Multiple stack-based buffer overflows in TIBCO SmartPGM FX allow remote attackers to execute arbitrary code or cause a denial of service (service stop and file-transfer outage) via unspecified vectors. NOTE: as of 20071016, the only disclosure is a
15-10-2018 - 21:45 18-10-2007 - 20:17
CVE-2007-5545 7.5
Format string vulnerability in TIBCO SmartPGM FX allows remote attackers to execute arbitrary code via format string specifiers in unspecified vectors. NOTE: as of 20071016, the only disclosure is a vague pre-advisory with no actionable information.
15-10-2018 - 21:45 18-10-2007 - 20:17
CVE-2007-5513 5.0
The XML DB (XMLDB) component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 generates incorrect audit entries in the USERID column in which (1) long usernames are trimmed to 5 characters, or (2) short entries contain any extra characters from us
15-10-2018 - 21:45 17-10-2007 - 23:17
CVE-2007-5511 6.5
SQL injection vulnerability in Workspace Manager for Oracle Database before OWM 10.2.0.4.1, OWM 10.1.0.8.0, and OWM 9.2.0.8.0 allows attackers to execute arbitrary SQL commands via the FINDRICSET procedure in the LT package. NOTE: this is probably c
15-10-2018 - 21:45 17-10-2007 - 23:17
CVE-2007-5508 6.5
Multiple SQL injection vulnerabilities in the CTXSYS Intermedia application for the Oracle Text component (CTX_DOC) in Oracle Database 10.1.0.5 and 10.2.0.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) THEMES, (2) GI
15-10-2018 - 21:45 17-10-2007 - 23:17
CVE-2007-5507 6.4
The GIOP service in TNS Listener in the Oracle Net Services component in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote attackers to cause a denial of service (crash) or read potentially sensitive memory via a conn
15-10-2018 - 21:45 17-10-2007 - 23:17
CVE-2007-5506 7.8
The Core RDBMS component in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote attackers to cause a denial of service (CPU consumption) via a crafted type 6 Data packet, aka DB20.
15-10-2018 - 21:45 17-10-2007 - 23:17
CVE-2007-5479 4.3
Cross-site scripting (XSS) vulnerability in Search.asp in Xcomputer allows remote attackers to inject arbitrary web script or HTML via the EXPS parameter.
15-10-2018 - 21:45 16-10-2007 - 23:17
CVE-2007-5478 4.3
Cross-site scripting (XSS) vulnerability in projects in Nabh Stringbeans Portal (sbportal) 3.2 allows remote attackers to inject arbitrary web script or HTML via the project_name parameter.
15-10-2018 - 21:45 16-10-2007 - 23:17
CVE-2007-5464 6.5
Stack-based buffer overflow in Live for Speed 0.5X10 and earlier allows remote authenticated users to cause a denial of service (client crash) and possibly execute arbitrary code via a long skin name.
15-10-2018 - 21:45 15-10-2007 - 22:17
CVE-2007-5463 5.0
ideal_process.php in the iDEAL payment module in ViArt Shop 3.3 beta and earlier might allow remote attackers to obtain the pathname for certificate and key files via an "iDEAL transaction", possibly involving fopen error messages for nonexistent fil
15-10-2018 - 21:45 15-10-2007 - 22:17
CVE-2007-5460 7.1
Microsoft ActiveSync 4.1, as used in Windows Mobile 5.0, uses weak encryption (XOR obfuscation with a fixed key) when sending the user's PIN/Password over the USB connection from the host to the device, which might make it easier for attackers to dec
15-10-2018 - 21:44 15-10-2007 - 22:17
CVE-2007-5456 7.5
Microsoft Internet Explorer 7 and earlier allows remote attackers to bypass the "File Download - Security Warning" dialog box and download arbitrary .exe files by placing a '?' (question mark) followed by a non-.exe filename after the .exe filename,
15-10-2018 - 21:44 14-10-2007 - 18:17
CVE-2007-5448 4.3
Madwifi 0.9.3.2 and earlier allows remote attackers to cause a denial of service (panic) via a beacon frame with a large length value in the extended supported rates (xrates) element, which triggers an assertion error, related to net80211/ieee80211_s
15-10-2018 - 21:44 14-10-2007 - 18:17
CVE-2007-5445 6.8
Buffer overflow in the DB Software Laboratory VImpX (VImpAX1) ActiveX control in VImpX.ocx 4.7.3.0 allows remote attackers to execute arbitrary code via a long RejectedRecordsFile parameter, a different vector than CVE-2007-2667.
15-10-2018 - 21:44 14-10-2007 - 18:17
CVE-2007-5444 5.0
CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files.
15-10-2018 - 21:44 14-10-2007 - 18:17
CVE-2007-5443 4.3
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) the anchor tag and (2) listtags.
15-10-2018 - 21:44 14-10-2007 - 18:17
CVE-2007-5442 3.5
CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upload unspecified files via unknown vectors.
15-10-2018 - 21:44 14-10-2007 - 18:17
CVE-2007-5441 6.5
CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by (1) adding a user via a direct request to admin/adduser.ph
15-10-2018 - 21:44 14-10-2007 - 18:17
CVE-2007-5440 7.5
** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in CRS Manager allow remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter to (1) index.php or (2) login.php. NOTE: this issue is disputed by CVE, s
15-10-2018 - 21:44 14-10-2007 - 17:17
CVE-2007-5439 5.0
CA (formerly Computer Associates) eTrust ITM (Threat Manager) 8.1 stores sensitive user information in log files with predictable names, which allows remote attackers to obtain this information via unspecified vectors.
15-10-2018 - 21:44 13-10-2007 - 01:17
CVE-2007-5438 1.9
Unspecified vulnerability in a certain ActiveX control in Reconfig.DLL in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.
15-10-2018 - 21:44 13-10-2007 - 01:17
CVE-2007-5437 5.8
The web console in CA (formerly Computer Associates) eTrust ITM (Threat Manager) 8.1 allows remote attackers to redirect users to arbitrary web sites via a crafted HTTP URL on port 6689.
15-10-2018 - 21:44 13-10-2007 - 01:17
CVE-2007-5436 7.6
Buffer overflow in a certain ActiveX control in ScanObjectBrowser.DLL in G DATA Antivirus 2007 might allow remote attackers to execute arbitrary code via unspecified parameters to the SelectPath function. NOTE: this issue might not cross privilege bo
15-10-2018 - 21:44 13-10-2007 - 01:17
CVE-2007-5435 4.3
Unspecified vulnerability in CA ERwin Process Modeler (formerly AllFusion Process Modeler) 7.2 might allow user-assisted remote attackers to cause a denial of service via a crafted Data Standards File (Datatype Standards File).
15-10-2018 - 21:44 13-10-2007 - 01:17
CVE-2007-5434 4.3
Cross-site scripting (XSS) vulnerability in PRO-search 0.17.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter to the default URI.
15-10-2018 - 21:44 12-10-2007 - 23:17
CVE-2007-5433 4.3
Multiple cross-site scripting (XSS) vulnerabilities in index.cgi in Site-Up 2.64 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) search or (2) search mask field.
15-10-2018 - 21:44 12-10-2007 - 23:17
CVE-2007-5432 7.5
Stride 1.0 has a default administrator username of "scott" with the password "running", which allows remote attackers to obtain administrative access through login.php.
15-10-2018 - 21:44 12-10-2007 - 23:17
CVE-2007-5431 7.8
include/imageupload.js in the MyFTPUploader module in Stride 1.0 contains sensitive information including FTP login credentials, which might allow remote attackers to gain unauthorized access to the FTP server being used by the module by viewing the
15-10-2018 - 21:44 12-10-2007 - 23:17
CVE-2007-5430 7.5
Multiple SQL injection vulnerabilities in Stride 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the p parameter to main.php in the Content Management System, (2) the id parameter in a sto cmd action to shop.php in the Merchant s
15-10-2018 - 21:44 12-10-2007 - 23:17
CVE-2007-5429 4.3
Cross-site scripting (XSS) vulnerability in index.php in Nucleus 3.01 allows remote attackers to inject arbitrary web script or HTML via the archive parameter.
15-10-2018 - 21:44 12-10-2007 - 23:17
CVE-2007-5428 4.3
Cross-site scripting (XSS) vulnerability in UMI CMS allows remote attackers to inject arbitrary web script or HTML via the search_string parameter to the default URI in search_do/.
15-10-2018 - 21:44 12-10-2007 - 23:17
CVE-2007-5427 4.3
Cross-site scripting (XSS) vulnerability in the com_search component in Joomla! 1.0.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchword parameter. NOTE: this might be related to CVE-2007-4189.1.
15-10-2018 - 21:44 12-10-2007 - 23:17
CVE-2007-5426 4.3
Multiple cross-site scripting (XSS) vulnerabilities in ActiveKB NX 2.5.4 allow remote attackers to inject arbitrary web script or HTML via the page parameter to the default URI for some directories, as demonstrated by (1) ActiveKB/ and (2) default/ca
15-10-2018 - 21:44 12-10-2007 - 23:17
CVE-2007-5425 6.4
SQL injection vulnerability in admin/index.php in Interspire ActiveKB 1.5 allows remote attackers to execute arbitrary SQL commands via the questId parameter in a hideQuestion ToDo action. NOTE: the catId vector is already covered by CVE-2007-5131.
15-10-2018 - 21:44 12-10-2007 - 23:17
CVE-2007-5424 7.5
The disable_functions feature in PHP 4 and 5 allows attackers to bypass intended restrictions by using an alias, as demonstrated by using ini_alter when ini_set is disabled.
15-10-2018 - 21:44 12-10-2007 - 23:17
CVE-2007-5423 7.5
tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are processed by create_function.
15-10-2018 - 21:44 12-10-2007 - 23:17
CVE-2007-5420 2.6
The 3Com 3CRWER100-75 router with 1.2.10ww software, when remote management is disabled but a web server has been configured, serves a web page to external clients, which might allow remote attackers to obtain information about the router's existence
15-10-2018 - 21:44 12-10-2007 - 21:17
CVE-2007-5419 10.0
The 3Com 3CRWER100-75 router with 1.2.10ww software, when enabling an optional virtual server, configures this server to accept all source IP addresses on the external (Internet) interface unless the user selects other options, which might expose the
15-10-2018 - 21:44 12-10-2007 - 21:17
CVE-2007-5418 7.5
Multiple PHP remote file inclusion vulnerabilities in CARE2X 2G 2.2 allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) en_copyrite.php, (2) vi_copyrite.php, and (3) ar_copyrite.php in language/ directorie
15-10-2018 - 21:44 12-10-2007 - 21:17
CVE-2007-5417 5.0
Directory traversal vulnerability in index.php in boastMachine (aka bMachine) 2.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
15-10-2018 - 21:44 12-10-2007 - 21:17
CVE-2007-5416 6.8
Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by invoking the drupal
15-10-2018 - 21:44 12-10-2007 - 21:17
CVE-2007-5415 4.3
Cross-site scripting (XSS) vulnerability in Mozilla Firefox 2.0, when UTF-7 document content is rendered directly in UTF-7, allows remote attackers to inject arbitrary web script or HTML via a gopher URI that uses '/' (slash) characters to delimit a
15-10-2018 - 21:44 12-10-2007 - 21:17
CVE-2007-5414 2.6
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0, when UTF-7 document content is rendered directly in UTF-7, allows remote attackers to inject arbitrary web script or HTML via a gopher URI that uses single quote characters to de
15-10-2018 - 21:44 12-10-2007 - 21:17
CVE-2007-5410 6.8
PHP remote file inclusion vulnerability in admin.wmtrssreader.php in the webmaster-tips.net Flash RSS Reader (com_wmtrssreader) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site param
15-10-2018 - 21:44 12-10-2007 - 18:17
CVE-2007-5389 6.8
** DISPUTED ** PHP remote file inclusion vulnerability in preview.php in the swMenuFree (com_swmenufree) 4.6 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: a rel
15-10-2018 - 21:44 12-10-2007 - 10:17
CVE-2007-5385 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
15-10-2018 - 21:44 12-10-2007 - 01:17
CVE-2007-5384 4.3
Multiple cross-site request forgery (CSRF) vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to perform actions as administrators via unspecified POST requests, as dem
15-10-2018 - 21:44 12-10-2007 - 01:17
CVE-2007-5383 10.0
The Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allows remote attackers on an intranet to bypass authentication and gain administrative access via vectors including a '/' (slash) character at the end of the
15-10-2018 - 21:44 12-10-2007 - 01:17
CVE-2007-5372 10.0
Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via (1) the invoice quantity field or (2) the sort field.
15-10-2018 - 21:44 11-10-2007 - 10:17
CVE-2007-5371 6.8
Multiple SQL injection vulnerabilities in mutate_content.dynamic.php in MODx 0.9.6 allow remote attackers to execute arbitrary SQL commands via the (1) documentDirty or (2) modVariables parameter.
15-10-2018 - 21:44 11-10-2007 - 10:17
CVE-2007-5370 4.3
Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/dnewsweb.exe in NetWin DNewsWeb (DNews News Server) 57e1 allow remote attackers to inject arbitrary web script or HTML via the (1) group or (2) utag parameter.
15-10-2018 - 21:44 11-10-2007 - 10:17
CVE-2007-5369 5.0
The GetMagicNumberString function in Massive Entertainment World in Conflict 1.000 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a string to the VoIP port (52999/tcp) with an invalid value in
15-10-2018 - 21:44 11-10-2007 - 10:17
CVE-2007-5364 10.0
** DISPUTED ** Directory traversal vulnerability in payments/ideal_process.php in the iDEAL transaction handler in ViArt Shopping Cart allows remote attackers to have an unknown impact via directory traversal sequences in the filename parameter to t
15-10-2018 - 21:44 11-10-2007 - 01:17
CVE-2007-5327 10.0
Stack-based buffer overflow in the RPC interface for the Message Engine (mediasvr.exe) in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows remote attackers to execute arbitrary code via a long argument in the 0x1
15-10-2018 - 21:42 13-10-2007 - 00:17
CVE-2007-5312 4.3
Cross-site scripting (XSS) vulnerability in TorrentTrader Classic 1.07 allows remote attackers to inject arbitrary web script or HTML via the (1) color parameter to pjirc/css.php and the (2) cat parameter to browse.php.
15-10-2018 - 21:42 09-10-2007 - 21:17
CVE-2007-5311 7.5
Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic Edition 1.07 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ss_uri parameter.
15-10-2018 - 21:42 09-10-2007 - 21:17
CVE-2007-5307 7.5
ELSEIF CMS Beta 0.6 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a .php file
15-10-2018 - 21:42 09-10-2007 - 18:17
CVE-2007-5306 5.0
ELSEIF CMS Beta 0.6 allows remote attackers to obtain sensitive information (full path) via unspecified vectors to utilisateurs/votesresultats.php.
15-10-2018 - 21:42 09-10-2007 - 18:17
CVE-2007-5305 7.5
Multiple PHP remote file inclusion vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the (1) contenus parameter to (a) contenus.php; the (2) tpelseifportalrepertoire parameter to (b) votes.php, (
15-10-2018 - 21:42 09-10-2007 - 18:17
CVE-2007-5304 4.3
Multiple cross-site scripting (XSS) vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) repertimage parameter to utilisateurs/vousetesbannis.php, the (2) elseifvotetxtresultatduvote paramet
15-10-2018 - 21:42 09-10-2007 - 18:17
CVE-2007-5298 6.4
Multiple PHP remote file inclusion vulnerabilities in CMS Creamotion allow remote attackers to execute arbitrary PHP code via a URL in the cfg[document_uri] parameter to (1) _administration/securite.php and (2) _administration/gestion_configurations/
15-10-2018 - 21:42 09-10-2007 - 18:17
CVE-2007-5294 6.8
PHP remote file inclusion vulnerability in core/aural.php in IDMOS 1.0-beta (aka Phoenix) allows remote attackers to execute arbitrary PHP code via a URL in the site_absolute_path parameter.
15-10-2018 - 21:42 09-10-2007 - 18:17
CVE-2007-5293 2.6
Multiple cross-site scripting (XSS) vulnerabilities in IDMOS 1.0-beta (aka Phoenix) allow remote attackers to inject arbitrary web script or HTML via the (1) err_msg parameter to error.php and the (2) content parameter to templates/simple/ia.php.
15-10-2018 - 21:42 09-10-2007 - 18:17
CVE-2007-5265 7.5
Multiple format string vulnerabilities in websrv.cpp in Dawn of Time 1.69s beta4 and earlier allow remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) password fields when accessing certain "restricted z
15-10-2018 - 21:41 08-10-2007 - 21:17
CVE-2007-5264 5.0
Battlefront Dropteam 1.3.3 and earlier sends the client's online account name and password to the game server, which allows malicious game servers to steal account information.
15-10-2018 - 21:41 08-10-2007 - 21:17
CVE-2007-5263 7.5
Multiple buffer overflows in Battlefront Dropteam 1.3.3 and earlier allow remote attackers to execute arbitrary code via (1) a crafted "0x5c" packet or (2) many 32-bit numbers in a "0x18" packet, or cause a denial of service (crash) via (3) a large "
15-10-2018 - 21:41 08-10-2007 - 21:17
CVE-2007-5262 7.5
Multiple format string vulnerabilities in Battlefront Dropteam 1.3.3 and earlier allow remote attackers to execute arbitrary code via format string specifiers in the (1) username, (2) password, and (3) nickname fields in a "0x01" packet.
15-10-2018 - 21:41 08-10-2007 - 21:17
CVE-2007-5190 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Alcatel OmniVista 4760 R4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the action parameter to php-bin/Webclient.php or (2) the Langue parameter to the defa
15-10-2018 - 21:41 22-10-2007 - 19:46
CVE-2007-4749 6.8
The cmdjob utility in Autodesk Backburner 3.0.2 allows remote attackers to execute arbitrary commands on render servers by queueing jobs that contain these commands. NOTE: this is only a vulnerability in environments in which the administrator has n
15-10-2018 - 21:37 14-09-2007 - 00:17
CVE-2007-4600 4.6
The "Protect Worksheet" functionality in Mathsoft Mathcad 12 through 13.1, and PTC Mathcad 14, implements file access restrictions via a protection element in a gzipped XML file, which allows attackers to bypass these restrictions by removing this el
15-10-2018 - 21:36 18-10-2007 - 20:17
CVE-2007-4429 5.0
Unspecified vulnerability in Skype allows remote attackers to cause a denial of service (server hang) via unknown vectors related to sending long URIs, as claimed to be actively exploited on 20070817 using a "call to a specific number." NOTE: this i
15-10-2018 - 21:35 20-08-2007 - 19:17
CVE-2007-4094 7.5
PHP remote file inclusion vulnerability in library/authorize.php in IDevSpot PhpHostBot allows remote attackers to execute arbitrary PHP code via a URL in the login_form parameter, a different vector than CVE-2006-3776.
15-10-2018 - 21:33 30-07-2007 - 20:17
CVE-2008-4800 5.0
The DebugDiag ActiveX control in CrashHangExt.dll, possibly 1.0, in Microsoft Debug Diagnostic Tool allows remote attackers to cause a denial of service (NULL pointer dereference and Internet Explorer 6.0 crash) via a large negative integer argument
11-10-2018 - 20:52 31-10-2008 - 00:00
CVE-2008-4324 5.0
The user interface event dispatcher in Mozilla Firefox 3.0.3 on Windows XP SP2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a series of keypress, click, onkeydown, onkeyup, onmousedown, and
11-10-2018 - 20:51 29-09-2008 - 20:09
CVE-2008-4300 5.0
A certain ActiveX control in adsiis.dll in Microsoft Internet Information Services (IIS) allows remote attackers to cause a denial of service (browser crash) via a long string in the second argument to the GetObject method. NOTE: this issue was disc
11-10-2018 - 20:51 29-09-2008 - 17:17
CVE-2008-4299 5.0
A certain ActiveX control in the Microsoft Internet Authentication Service (IAS) Helper COM Component in iashlpr.dll allows remote attackers to cause a denial of service (browser crash) via a large integer value in the first argument to the PutProper
11-10-2018 - 20:51 29-09-2008 - 17:17
CVE-2008-4120 4.3
Multiple cross-site scripting (XSS) vulnerabilities in FlatPress 0.804 allow remote attackers to inject arbitrary web script or HTML via the (1) user or (2) pass parameter to login.php, or the (3) name parameter to contact.php.
11-10-2018 - 20:50 29-09-2008 - 17:17
CVE-2008-3827 9.3
Multiple integer underflows in the Real demuxer (demux_real.c) in MPlayer 1.0_rc2 and earlier allow remote attackers to cause a denial of service (process termination) and possibly execute arbitrary code via a crafted video file that causes the strea
11-10-2018 - 20:49 29-09-2008 - 19:25
CVE-2008-3582 6.8
SQL injection vulnerability in login.php in Keld PHP-MySQL News Script 0.7.1 allows remote attackers to execute arbitrary SQL commands via the username parameter.
11-10-2018 - 20:48 10-08-2008 - 21:41
CVE-2008-2642 7.5
SQL injection vulnerability in login.php in OtomiGenX 2.2 allows remote attackers to execute arbitrary SQL commands via the userAccount parameter (aka the User Name field) to index.php. NOTE: some of these details are obtained from third party infor
11-10-2018 - 20:42 10-06-2008 - 18:32
CVE-2008-2474 10.0
Buffer overflow in x87 before 3.5.5 in ABB Process Communication Unit 400 (PCU400) 4.4 through 4.6 allows remote attackers to execute arbitrary code via a crafted packet using the (1) IEC60870-5-101 or (2) IEC60870-5-104 communication protocol to the
11-10-2018 - 20:41 29-09-2008 - 17:17
CVE-2008-2003 7.5
BadBlue 2.72 Personal Edition stores multiple programs in the web document root with insufficient access control, which allows remote attackers to (1) cause a denial of service via multiple invocations of uninst.exe, and have an unknown impact via (2
11-10-2018 - 20:38 28-04-2008 - 20:05
CVE-2008-1304 4.3
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) inviteemail parameter in an invite action to wp-admin/users.php and the (2) to parameter in a sent action
11-10-2018 - 20:31 12-03-2008 - 17:44
CVE-2011-3012 10.0
The ioQuake3 engine, as used in World of Padman 1.2 and earlier, Tremulous 1.1.0, and ioUrbanTerror 2007-12-20, does not check for dangerous file extensions before writing to the quake3 directory, which allows remote attackers to execute arbitrary co
09-10-2018 - 19:33 09-08-2011 - 20:55
CVE-2011-2764 10.0
The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier, as used in World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror, does not properly determine dangerous file extensions, which a
09-10-2018 - 19:33 04-08-2011 - 02:45
CVE-2011-2719 6.4
libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other
09-10-2018 - 19:32 01-08-2011 - 19:55
CVE-2011-2701 5.8
The ocsp_check function in rlm_eap_tls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 clien
09-10-2018 - 19:32 04-08-2011 - 02:45
CVE-2011-1412 7.5
sys/sys_unix.c in the ioQuake3 engine on Unix and Linux, as used in World of Padman 1.5.x before 1.5.1.1 and OpenArena 0.8.x-15 and 0.8.x-16, allows remote game servers to execute arbitrary commands via shell metacharacters in a long fs_game variable
09-10-2018 - 19:30 04-08-2011 - 02:45
CVE-2006-7071 7.5
SQL injection vulnerability in classes/class_session.php in Invision Power Board (IPB) 2.1 up to 2.1.6 allows remote attackers to execute arbitrary SQL commands via the CLIENT_IP parameter.
11-10-2017 - 01:31 02-03-2007 - 21:18
CVE-2005-2475 1.2
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
11-10-2017 - 01:30 05-08-2005 - 04:00
CVE-2003-1461 7.2
Buffer overflow in rwrite for HP-UX 11.0 could allow local users to execute arbitrary code via a long argument. NOTE: the vendor was unable to reproduce the problem on a system that had been patched for an lp vulnerability (CVE-2002-1473).
11-10-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1375 7.2
Buffer overflow in wall for HP-UX 10.20 through 11.11 may allow local users to execute arbitrary code by calling wall with a large file as an argument.
11-10-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1359 7.2
Buffer overflow in stmkfont utility of HP-UX 10.0 through 11.22 allows local users to gain privileges via a long command line argument.
11-10-2017 - 01:29 31-12-2003 - 05:00
CVE-2008-5932 5.0
CodeAvalanche FreeForum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the password via a direct request for _private/CAForum.mdb. NOTE: some o
29-09-2017 - 01:32 21-01-2009 - 18:30
CVE-2008-5777 7.5
SQL injection vulnerability in index.php in CadeNix allows remote attackers to execute arbitrary SQL commands via the cid parameter.
29-09-2017 - 01:32 30-12-2008 - 20:30
CVE-2008-5582 7.5
SQL injection vulnerability in utilities/login.asp in Nukedit 4.9.x, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the email parameter.
29-09-2017 - 01:32 15-12-2008 - 18:00
CVE-2008-5213 7.5
SQL injection vulnerability in featured_article.php in AJ Article 1.0 allows remote attackers to execute arbitrary SQL commands via the artid parameter in a search detail action.
29-09-2017 - 01:32 24-11-2008 - 17:30
CVE-2008-4602 6.5
Directory traversal vulnerability in index.php in Post Affiliate Pro 2.0 allows remote authenticated users to read and possibly execute arbitrary local files via a .. (dot dot) in the md parameter.
29-09-2017 - 01:32 18-10-2008 - 00:18
CVE-2008-4380 7.8
The web interface in Samsung DVR SHR2040 allows remote attackers to cause a denial of service (crash) via a malformed HTTP request, related to the filter for configuration properties and "/x" characters.
29-09-2017 - 01:32 01-10-2008 - 15:38
CVE-2008-4376 7.5
SQL injection vulnerability in index.php in Live TV Script allows remote attackers to execute arbitrary SQL commands via the mid parameter.
29-09-2017 - 01:32 01-10-2008 - 15:38
CVE-2008-4373 7.5
SQL injection vulnerability in job_seeker/applynow.php in AvailScript Job Portal Script allows remote attackers to execute arbitrary SQL commands via the jid parameter.
29-09-2017 - 01:32 01-10-2008 - 15:38
CVE-2008-4321 9.3
Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long response to the PWD command.
29-09-2017 - 01:32 29-09-2008 - 19:25
CVE-2008-4318 10.0
Observer 0.3.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter to (1) whois.php or (2) netcmd.php.
29-09-2017 - 01:32 29-09-2008 - 19:25
CVE-2008-3953 7.5
SQL injection vulnerability in keyword_search_action.php in Vastal I-Tech Shaadi Zone 1.0.9 allows remote attackers to execute arbitrary SQL commands via the tage parameter.
29-09-2017 - 01:31 11-09-2008 - 01:13
CVE-2008-3291 7.5
SQL injection vulnerability in index.php in AproxEngine (aka Aprox CMS Engine) 5.1.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
29-09-2017 - 01:31 24-07-2008 - 18:41
CVE-2011-0065 10.0
Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, allows remote attackers to execute arbitrary code via vectors related to OBJECT's mChannel.
19-09-2017 - 01:31 07-05-2011 - 18:55
CVE-2011-2403 6.5
SQL injection vulnerability in HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, and 9.10 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
29-08-2017 - 01:29 01-08-2011 - 19:55
CVE-2011-2402 4.3
Cross-site scripting (XSS) vulnerability in HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, and 9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
29-08-2017 - 01:29 01-08-2011 - 19:55
CVE-2011-2399 7.8
Unspecified vulnerability in the Media Management Daemon (mmd) in HP Data Protector 6.11 and earlier allows remote attackers to cause a denial of service via unknown vectors.
29-08-2017 - 01:29 01-08-2011 - 19:55
CVE-2011-0438 6.8
nslcd/pam.c in the nss-pam-ldapd 0.8.0 PAM module returns a success code when a user is not found in LDAP, which allows remote attackers to bypass authentication.
17-08-2017 - 01:33 15-03-2011 - 17:55
CVE-2010-4107 7.8
The default configuration of the PJL Access value in the File System External Access settings on HP LaserJet MFP printers, Color LaserJet MFP printers, and LaserJet 4100, 4200, 4300, 5100, 8150, and 9000 printers enables PJL commands that use the dev
17-08-2017 - 01:33 17-11-2010 - 16:00
CVE-2007-5629 4.3
Cross-site scripting (XSS) vulnerability in admin/logon.asp in ShoppingTree CandyPress Store 4.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different vector than CVE-2007-2804. NOTE: the provenance of thi
29-07-2017 - 01:33 23-10-2007 - 16:46
CVE-2006-7090 6.8
PHP remote file inclusion vulnerability in phpbb_security.php in phpBB Security 1.0.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the php_root_path parameter.
29-07-2017 - 01:29 02-03-2007 - 21:18
CVE-2006-7085 4.3
Rigter Portal System (RPS) 1.0, 2.0, and 3.0 allows remote attackers to add arbitrary content and conduct XSS attacks via a direct request to add_art.php. NOTE: this issue was originally reported as SQL injection, but this is not likely.
29-07-2017 - 01:29 02-03-2007 - 21:18
CVE-2006-7083 4.3
Directory traversal vulnerability in index.php in Rigter Portal System (RPS) 1.0, 2.0, and 3.0 allows remote attackers to read arbitrary files via ".." sequences in the id parameter.
29-07-2017 - 01:29 02-03-2007 - 21:18
CVE-2006-7082 7.5
Rigter Portal System (RPS) 1.0, 2.0, and 3.0 allows remote attackers to bypass authentication and upload arbitrary files via direct requests to (1) adm/photos/images.php and (2) adm/down/files.php.
29-07-2017 - 01:29 02-03-2007 - 21:18
CVE-2006-7077 6.8
SQL injection vulnerability in guestbook.php in Advanced Guestbook 2.4 for phpBB allows remote attackers to execute arbitrary SQl commands via the entry parameter.
29-07-2017 - 01:29 02-03-2007 - 21:18
CVE-2006-7076 4.3
Cross-site scripting (XSS) vulnerability in guestbook.php in Advanced Guestbook 2.4 for phpBB allows remote attackers to inject arbitrary web script or HTML via the entry parameter. NOTE: this issue might be resultant from SQL injection.
29-07-2017 - 01:29 02-03-2007 - 21:18
CVE-2004-2720 4.3
Cross-site scripting (XSS) vulnerability in register.asp in Snitz Forums 2000 3.4.04 and earlier allows remote attackers to inject arbitrary web script or HTML via javascript events in the Email parameter.
29-07-2017 - 01:29 31-12-2004 - 05:00
CVE-2004-2699 4.3
deleteicon.aspx in AspDotNetStorefront 3.3 allows remote attackers to delete arbitrary product images via a modified ProductID parameter.
29-07-2017 - 01:29 31-12-2004 - 05:00
CVE-2003-1514 7.8
eMule 0.29c allows remote attackers to cause a denial of service (crash) via a long password, possibly due to a buffer overflow.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1506 4.3
Cross-site scripting (XSS) vulnerability in dansguardian.pl in Adelix CensorNet 3.0 through 3.2 allows remote attackers to execute arbitrary script as other users by injecting arbitrary HTML or script into the DENIEDURL parameter.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1505 4.3
Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (crash) by creating a web page or HTML e-mail with a textarea in a div element whose scrollbar-base-color is modified by a CSS style, which is then moved.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1497 6.3
Buffer overflow in the system log viewer of Linksys BEFSX41 1.44.3 allows remote attackers to cause a denial of service via an HTTP request with a long Log_Page_Num variable.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1490 7.8
SonicWall Pro running firmware 6.4.0.1 allows remote attackers to cause a denial of service (device reset) via a long HTTP POST to the internal interface, possibly due to a buffer overflow.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1487 10.0
Multiple "command injection" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the Phorum configuration files via the (1) UserAdmin program, (2) Edit user profile, or (3) stats program.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1486 5.0
Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to (1) smileys.php, (2) quick_listrss.php, (3) purge.php, (4) news.php, (5) memberlist.php, (6) forum_listrss.php, (7) forum_list
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1484 4.3
Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (crash) by creating a DHTML link that uses the AnchorClick "A" object with a blank href attribute.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1481 5.8
CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the refere
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1475 6.8
Netbus 1.5 through 1.7 allows more than one client to be connected at the same time, but only prompts the first connection for authentication, which allows remote attackers to gain access.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1472 5.0
Buffer overflow in 3D-FTP client 4.0 allows remote FTP servers to cause a denial of service (crash) and possibly execute arbitrary code via a long banner.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1470 9.0
Buffer overflow in IMAP service in MDaemon 6.7.5 and earlier allows remote authenticated users to cause a denial of service (crash) and execute arbitrary code via a CREATE command with a long mailbox name.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1467 4.3
Multiple cross-site scripting (XSS) vulnerabilities in (1) login.php, (2) register.php, (3) post.php, and (4) common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1465 5.0
Directory traversal vulnerability in download.php in Phorum 3.4 through 3.4.2 allows remote attackers to read arbitrary files.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1464 7.8
Buffer overflow in Siemens 45 series mobile phones allows remote attackers to cause a denial of service (disconnect and unavailable inbox) via a Short Message Service (SMS) message with a long image name.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1463 3.5
Absolute path traversal vulnerability in Alt-N Technologies WebAdmin 2.0.0 through 2.0.2 allows remote attackers with administrator privileges to (1) determine the installation path by reading the contents of the Name parameter in a link, and (2) rea
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1459 6.8
Multiple PHP remote file inclusion vulnerabilities in ttCMS 2.2 and ttForum allow remote attackers to execute arbitrary PHP code via the (1) template parameter in News.php or (2) installdir parameter in install.php.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1458 7.5
SQL injection vulnerability in Profile.php in ttCMS 2.2 and ttForum allows remote attackers to execute arbitrary SQL commands via the member name.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1457 4.6
Auerswald COMsuite CTI ControlCenter 3.1 creates a default "runasositron" user account with an easily guessable password, which allows local users or remote attackers to gain access.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1456 5.0
Album.pl 6.1 allows remote attackers to execute arbitrary commands, when an alternative configuration file is used, via unknown attack vectors.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1454 5.0
Invision Power Services Invision Board 1.0 through 1.1.1, when a forum is password protected, stores the administrator password in a cookie in plaintext, which could allow remote attackers to gain access.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1453 4.3
Cross-site scripting (XSS) vulnerability in the MytextSanitizer function in XOOPS 1.3.5 through 1.3.9 and XOOPS 2.0 through 2.0.1 allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in an IMG tag.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1452 3.6
Untrusted search path vulnerability in Qualcomm qpopper 4.0 through 4.05 allows local users to execute arbitrary code by modifying the PATH environment variable to reference a malicious smbpasswd program.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1450 5.0
BitchX 75p3 and 1.0c16 through 1.0c20cvs allows remote attackers to cause a denial of service (segmentation fault) via a malformed RPL_NAMREPLY numeric 353 message.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1447 1.9
IBM WebSphere Advanced Server Edition 4.0.4 uses a weak encryption algorithm (XOR and base64 encoding), which allows local users to decrypt passwords when the configuration file is exported to XML.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1445 4.6
Stack-based buffer overflow in Far Manager 1.70beta1 and earlier allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long pathname.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1415 6.8
NetCharts XBRL Server 4.0.0 allows remote attackers to obtain sensitive information via an HTTP request with an invalid chunked transfer encoding specification.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1414 4.3
Directory traversal vulnerability in parse_xml.cg Apple Darwin Streaming Server 4.1.2 and Apple Quicktime Streaming Server 4.1.1 allows remote attackers to read arbitrary files via a ... (triple dot) in the filename parameter.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1413 4.3
parse_xml.cgi in Apple Darwin Streaming Server 4.1.1 allows remote attackers to determine the existence of arbitrary files by using ".." sequences in the filename parameter and comparing the resulting error messages.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1407 7.2
Buffer overflow in cmd.exe in Windows NT 4.0 may allow local users to execute arbitrary code via a long pathname argument to the cd command.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1397 4.3
The PluginContext object of Opera 6.05 and 7.0 allows remote attackers to cause a denial of service (crash) via an HTTP request containing a long string that gets passed to the ShowDocument method.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1395 9.0
Buffer overflow in KaZaA Media Desktop 2.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a response to the ad server.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1394 5.0
CoffeeCup Software Password Wizard 4.0 stores sensitive information such as usernames and passwords in a .apw file under the web document root with insufficient access control, which allows remote attackers to obtain that information via a direct req
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1393 8.5
Buffer overflow in Gupta SQLBase 8.1.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long EXECUTE command.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1387 7.5
Buffer overflow in Opera 6.05 and 6.06, and possibly other versions, allows remote attackers to execute arbitrary code via a URL with a long username.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1383 7.5
WEB-ERP 0.1.4 and earlier allows remote attackers to obtain sensitive information via an HTTP request for the logicworks.ini file, which contains the MySQL database username and password.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1382 7.5
Buffer overflow in ISMail 1.4.3 and earlier allow remote attackers to execute arbitrary code via long domain names in (1) MAIL FROM or (2) RCPT TO fields.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1381 6.8
Format string vulnerability in AMX 0.9.2 and earlier, a plugin for Valve Software's Half-Life Server, allows remote attackers to execute arbitrary commands via format string specifiers in the amx_say command.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1376 4.6
WinZip 8.0 uses weak random number generation for password protected ZIP files, which allows local users to brute force the encryption keys and extract the data from the zip file by guessing the state of the stream coder.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1367 7.8
The which_access variable for Majordomo 2.0 through 1.94.4, and possibly earlier versions, is set to "open" by default, which allows remote attackers to identify the email addresses of members of mailing lists via a "which" command.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1366 3.3
chpass in OpenBSD 2.0 through 3.2 allows local users to read portions of arbitrary files via a hard link attack on a temporary file used to store user database information.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1365 5.0
The escape_dangerous_chars function in CGI::Lite 2.0 and earlier does not correctly remove special characters including (1) "\" (backslash), (2) "?", (3) "~" (tilde), (4) "^" (carat), (5) newline, or (6) carriage return, which could allow remote atta
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1360 7.2
Buffer overflow in the setupterm function of (1) lanadmin and (2) landiag programs of HP-UX 10.0 through 10.34 allows local users to execute arbitrary code via a long TERM environment variable.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1358 7.2
rs.F300 for HP-UX 10.0 through 11.22 uses the PATH environment variable to find and execute programs such as rm while operating at raised privileges, which allows local users to gain privileges by modifying the path to point to a malicious rm program
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1357 10.0
ProxyView has a default administrator password of Administrator for Embedded Windows NT, which allows remote attackers to gain access.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1351 5.0
Directory traversal vulnerability in edittag.cgi in EditTag 1.1 allows remote attackers to read arbitrary files via a "%2F.." (encoded slash dot dot) in the file parameter.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1350 4.3
List Site Pro 2.0 allows remote attackers to hijack user accounts by inserting a "|" (pipe), which is used as a field delimiter, into the bannerurl field.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1348 4.3
Cross-site scripting (XSS) vulnerability in guestbook.cgi in ftls.org Guestbook 1.1 allows remote attackers to inject arbitrary web script or HTML via the (1) comment, (2) name, or (3) title field.
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2003-1347 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog 1.3.7 allow remote attackers to inject arbitrary web script or HTML via the (1) cid parameter to comment.php, (2) uid parameter to profiles.php, (3) uid to users.php, and (4) homepage fie
29-07-2017 - 01:29 31-12-2003 - 05:00
CVE-2002-2303 7.8
3D3.Com ShopFactory 5.8 uses client-side encryption and decryption for sensitive price data, which allows remote attackers to modify shopping cart prices by using the Javascript to decrypt the cookie that contains the data.
29-07-2017 - 01:29 31-12-2002 - 05:00
CVE-2002-2291 7.8
Calisto Internet Talker 0.04 and earlier allows remote attackers to cause a denial of service (hang) via a long request, possibly triggering a buffer overflow.
29-07-2017 - 01:29 31-12-2002 - 05:00
CVE-2002-2289 5.0
soinfo.php in BadBlue 1.7.1 calls the phpinfo function, which allows remote attackers to gain sensitive information including ODBC passwords.
29-07-2017 - 01:29 31-12-2002 - 05:00
CVE-2002-2273 4.3
Cross-site scripting (XSS) vulnerability in Webster HTTP Server allows remote attackers to inject arbitrary web script or HTML via the URL.
29-07-2017 - 01:29 31-12-2002 - 05:00
CVE-2002-2269 9.4
Directory traversal vulnerability in Webster HTTP Server allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
29-07-2017 - 01:29 31-12-2002 - 05:00
CVE-2006-2174 4.3
Multiple cross-site scripting (XSS) vulnerabilities in admin/server_day_stats.php in Virtual Hosting Control System (VHCS) allow remote attackers to inject arbitrary web script or HTML via the (1) day, (2) month, or (3) year parameter.
20-07-2017 - 01:31 04-05-2006 - 12:38
CVE-2006-0160 7.5
SQL injection vulnerability in add_post.php3 in Venom Board 1.22 allows remote attackers to execute arbitrary SQL commands via the (1) parent, (2) root, and (3) topic_id parameters to post.php3.
20-07-2017 - 01:29 10-01-2006 - 11:03
CVE-2004-1331 2.6
The execCommand method in Microsoft Internet Explorer 6.0 SP2 allows remote attackers to bypass the "File Download - Security Warning" dialog and save arbitrary files with arbitrary extensions via the SaveAs command.
11-07-2017 - 01:30 16-11-2004 - 05:00
CVE-2011-0923 10.0
The client in HP Data Protector does not properly validate EXEC_CMD arguments, which allows remote attackers to execute arbitrary Perl code via a crafted command, related to the "local bin directory."
23-08-2016 - 02:03 09-02-2011 - 01:00
CVE-2011-4156 4.3
Cross-site scripting (XSS) vulnerability in HP Network Node Manager i (NNMi) 9.0x and 9.1x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-4155.
14-02-2012 - 04:09 16-11-2011 - 22:55
CVE-2011-4155 4.3
Cross-site scripting (XSS) vulnerability in HP Network Node Manager i (NNMi) 9.0x and 9.1x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-4156.
14-02-2012 - 04:09 16-11-2011 - 22:55
CVE-2010-4877 4.3
Cross-site scripting (XSS) vulnerability in index.php in OneCMS 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the view parameter.
14-02-2012 - 04:02 07-10-2011 - 10:55
CVE-2011-2404 7.5
A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability
14-01-2012 - 03:54 11-08-2011 - 22:55
CVE-2011-1536 5.0
Unspecified vulnerability in HP Performance Insight 5.0, 5.1x. 5.2x, 5.3x, 5.4, 5.41, and 5.41.002 allows remote attackers to obtain sensitive information via unknown vectors.
22-09-2011 - 03:30 29-04-2011 - 22:55
CVE-2011-0807 10.0
Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Admin
22-09-2011 - 03:28 20-04-2011 - 03:14
CVE-2005-3654 7.5
Blue Coat Systems Inc. WinProxy before 6.1a allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of packets with 0xFF characters to the Telnet port (TCP 23), which corrupts the heap.
08-03-2011 - 02:26 31-12-2005 - 05:00
CVE-2006-7084 5.0
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-7083. Reason: This candidate is a duplicate of CVE-2006-7083. Notes: All CVE users should reference CVE-2006-7083 instead of this candidate. All references and descriptions in t
11-09-2008 - 00:47 02-03-2007 - 21:18
CVE-2003-1520 6.8
SQL injection vulnerability in FuzzyMonkey My Classifieds 2.11 allows remote attackers to execute arbitrary SQL commands via the email parameter.
05-09-2008 - 20:37 31-12-2003 - 05:00
CVE-2003-1466 7.5
Unspecified vulnerability in Phorum 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via (1) register.php or (2) login.php.
05-09-2008 - 20:37 31-12-2003 - 05:00
CVE-2002-2418 4.3
Cross-site scripting (XSS) vulnerability in acFreeProxy (aka acFP) 1.33 beta 7 allows remote attackers to inject arbitrary web script or HTML via the URL, which is inserted into an error page.
05-09-2008 - 20:33 31-12-2002 - 05:00
CVE-2002-2398 5.0
The new thread posting page in APBoard 2.02 and 2.03 allows remote attackers to post messages to protected forums by modifying the insertinto parameter.
05-09-2008 - 20:33 31-12-2002 - 05:00
CVE-2002-2235 5.0
member2.php in vBulletin 2.2.9 and earlier does not properly restrict the $perpage variable to be an integer, which causes an error message to be reflected back to the user without quoting, which facilitates cross-site scripting (XSS) and possibly ot
05-09-2008 - 20:32 31-12-2002 - 05:00
Back to Top Mark selected
Back to Top