|
342451
|
4.9 |
MEDIUM
|
bitrix
|
bitrix_site_manager
|
Cross-site scripting (XSS) vulnerability in the administrative interface Bitrix Site Manager 4.1.x allows remote attackers to inject arbitrary web script or HTML via unspecified inputs.
|
NVD-CWE-Other
|
CVE-2006-2477
|
2018-10-19 01:40 |
2006-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342452
|
5.0 |
MEDIUM
|
bitrix
|
bitrix_site_manager
|
Bitrix Site Manager 4.1.x allows remote attackers to redirect users to other websites via a modified back_url during a HTTP POST request. NOTE: this issue has been referred to as "cross-site scriptin…
|
NVD-CWE-Other
|
CVE-2006-2478
|
2018-10-19 01:40 |
2006-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342453
|
5.0 |
MEDIUM
|
bitrix
|
bitrix_site_manager
|
The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers to obtain sensitive information and ultimately execute arbi…
|
NVD-CWE-Other
|
CVE-2006-2479
|
2018-10-19 01:40 |
2006-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342454
|
4.3 |
MEDIUM
|
icewarp
|
web_mail
|
Cross-site scripting (XSS) vulnerability in index.html in IceWarp WebMail 5.5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter.
|
NVD-CWE-Other
|
CVE-2006-2484
|
2018-10-19 01:40 |
2006-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342455
|
7.5 |
HIGH
|
quezza
|
quezza_bb
|
PHP remote file inclusion vulnerability in includes/class_template.php in Quezza 1.0 and earlier, and possibly 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the quezza_root…
|
NVD-CWE-Other
|
CVE-2006-2485
|
2018-10-19 01:40 |
2006-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342456
|
6.4 |
MEDIUM
|
yapbb
|
yapbb
|
SQL injection vulnerability in find.php in YapBB 1.2 Beta2 and earlier allows remote attackers to execute arbitrary SQL commands via the userID parameter.
|
NVD-CWE-Other
|
CVE-2006-2486
|
2018-10-19 01:40 |
2006-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342457
|
7.5 |
HIGH
|
scoznet
|
scoznews
|
Multiple PHP remote file inclusion vulnerabilities in ScozNews 1.2.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CONFIG[main_path] parameter in (1) functions.php…
|
NVD-CWE-Other
|
CVE-2006-2487
|
2018-10-19 01:40 |
2006-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342458
|
4.3 |
MEDIUM
|
mobotix
|
mobotix_ip_network_camera
|
Multiple cross-site scripting (XSS) vulnerabilities in Mobotix IP Network Cameras M1 1.9.4.7 and M10 2.0.5.2, and other versions before 2.2.3.18 for M10/D10 and 3.0.3.31 for M22, allow remote attacke…
|
CWE-79
Cross-site Scripting
|
CVE-2006-2490
|
2018-10-19 01:40 |
2006-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342459
|
4.3 |
MEDIUM
|
mobotix
|
mobotix_ip_network_camera
|
Vendor Provided Solution Statement:
According the vendor, MOBOTIX "has resolved this problem as of 2006-06-27.
MOBOTIX AG provides new software versions that include a security patch that prevent…
|
CWE-79
Cross-site Scripting
|
CVE-2006-2490
|
2018-10-19 01:40 |
2006-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342460
|
6.8 |
MEDIUM
|
boastmachine
kailash_nadh
|
boastmachine
|
Cross-site scripting (XSS) vulnerability in (1) index.php and (2) bmc/admin.php in BoastMachine (bMachine) 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query…
|
NVD-CWE-Other
|
CVE-2006-2491
|
2018-10-19 01:40 |
2006-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342461
|
10.0 |
HIGH
|
novell
|
edirectory
imonitor
|
Buffer overflow in iMonitor 2.4 in Novell eDirectory 8.8 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unknown attack vectors.
|
NVD-CWE-Other
|
CVE-2006-2496
|
2018-10-19 01:40 |
2006-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342462
|
5.8 |
MEDIUM
|
aspbb
|
aspbb
|
Multiple cross-site scripting (XSS) vulnerabilities in AspBB 0.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter to default.asp or (2) get parameter to pr…
|
NVD-CWE-Other
|
CVE-2006-2497
|
2018-10-19 01:40 |
2006-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342463
|
7.5 |
HIGH
|
xfairguy
|
codeavalanche_news
|
SQL injection vulnerability in default.asp in CodeAvalanche News (CANews) 1.2 allows remote attackers to execute arbitrary SQL commands via the password field.
|
NVD-CWE-Other
|
CVE-2006-2499
|
2018-10-19 01:40 |
2006-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342464
|
6.8 |
MEDIUM
|
xfairguy
|
codeavalanche_news
|
Cross-site scripting (XSS) vulnerability in add_news.asp in CodeAvalanche News (CANews) 1.2 allows remote attackers to inject arbitrary web script or HTML via the Headline field. NOTE: if this issue…
|
NVD-CWE-Other
|
CVE-2006-2500
|
2018-10-19 01:40 |
2006-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342465
|
7.5 |
HIGH
|
deluxebb
|
deluxebb
|
SQL injection vulnerability in misc.php in DeluxeBB 1.06 allows remote attackers to execute arbitrary SQL commands via the name parameter.
|
NVD-CWE-Other
|
CVE-2006-2503
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342466
|
7.5 |
HIGH
|
azboard
|
azboard
|
Multiple SQL injection vulnerabilities in mono AZBOARD 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) search and (2) cate parameters to (a) list.asp, and the (3)…
|
NVD-CWE-Other
|
CVE-2006-2504
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342467
|
3.6 |
LOW
|
oracle
|
database_server
|
Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via a reference to a malicious package in the TYPE_NAME argument in the (1) GET_DOMAIN_INDEX_TABLES or (2) GET…
|
NVD-CWE-Other
|
CVE-2006-2505
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342468
|
6.8 |
MEDIUM
|
sphider
|
sphider
|
Multiple cross-site scripting (XSS) vulnerabilities in search.php in Sphider allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO and (2) the category parameter.
|
CWE-79
Cross-site Scripting
|
CVE-2006-2506
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342469
|
7.5 |
HIGH
|
teake_nutma
|
foing
|
Multiple PHP remote file inclusion vulnerabilities in Teake Nutma Foing 0.2.0 through 0.7.0, as used with phpBB, allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path …
|
NVD-CWE-Other
|
CVE-2006-2507
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342470
|
6.4 |
MEDIUM
|
yourfreeworld
|
stylish_text_ads_script
|
SQL injection vulnerability in tr1.php in YourFreeWorld.com Stylish Text Ads Script allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly involving an attack vector…
|
NVD-CWE-Other
|
CVE-2006-2508
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342471
|
7.5 |
HIGH
|
yourfreeworld
|
short_url_and_url_tracker_script
|
SQL injection vulnerability in login.php in YourFreeWorld.com Short Url & Url Tracker Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
|
NVD-CWE-Other
|
CVE-2006-2509
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342472
|
6.8 |
MEDIUM
|
yourfreeworld
|
short_url_and_url_tracker_script
|
Cross-site scripting (XSS) vulnerability in the URL submission form in YourFreeWorld.com Short Url & Url Tracker Script allows remote attackers to inject arbitrary web script or HTML via an unspecifi…
|
NVD-CWE-Other
|
CVE-2006-2510
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342473
|
6.5 |
MEDIUM
|
frontrange
|
iheat
|
The ActiveX version of FrontRange iHEAT allows remote authenticated users to run arbitrary programs or access arbitrary files on the host machine by uploading a file with an extension that is not ass…
|
NVD-CWE-Other
|
CVE-2006-2511
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342474
|
6.8 |
MEDIUM
|
hiox_india
|
guest_book
|
Cross-site scripting (XSS) vulnerability in index.php in Hiox Guestbook 3.1 allows remote attackers to inject arbitrary web script or HTML via the input forms for signing the guestbook.
|
NVD-CWE-Other
|
CVE-2006-2515
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342475
|
5.1 |
MEDIUM
|
xoops
|
xoops
|
mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks o…
|
CWE-22
Path Traversal
|
CVE-2006-2516
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342476
|
5.1 |
MEDIUM
|
xoops
|
xoops
|
Successful exploitation requires that "register_globals" is enabled, and that "magic_quotes_gpc" is disabled.
|
CWE-22
Path Traversal
|
CVE-2006-2516
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342477
|
2.6 |
LOW
|
phpwcms
|
phpwcms
|
Cross-site scripting (XSS) vulnerability in phpwcms 1.2.5-DEV allows remote attackers to inject arbitrary web script or HTML via the BL[be_cnt_plainhtml] parameter to include/inc_tmpl/content/cnt6.in…
|
NVD-CWE-Other
|
CVE-2006-2518
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342478
|
2.6 |
LOW
|
phpwcms
|
phpwcms
|
Directory traversal vulnerability in include/inc_ext/spaw/spaw_control.class.php in phpwcms 1.2.5-DEV allows remote attackers to include arbitrary local files via .. (dot dot) sequences in the spaw_r…
|
NVD-CWE-Other
|
CVE-2006-2519
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342479
|
5.0 |
MEDIUM
|
bitberry_software
|
bitzipper
|
Directory traversal vulnerability in BitZipper 4.1.2 SR-1 and earlier allows remote attackers to create files in arbitrary directories via a .. (dot dot) in the filename of a file that is stored in …
|
NVD-CWE-Other
|
CVE-2006-2520
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342480
|
6.4 |
MEDIUM
|
power_place
|
php_easy_galerie
|
PHP remote file inclusion vulnerability in index.php in PHP Easy Galerie 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the includepath parameter.
|
NVD-CWE-Other
|
CVE-2006-2526
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342481
|
7.5 |
HIGH
|
smartisoft
|
phpbazar
|
Admin/admin.php in phpBazar 2.1.0 and earlier allows remote attackers to bypass the authentication process and gain unauthorized access to the administrative section by setting the action parameter t…
|
NVD-CWE-Other
|
CVE-2006-2527
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342482
|
5.0 |
MEDIUM
|
snitz_communications
|
avatar_mod
|
avatar_upload.asp in Avatar MOD 1.3 for Snitz Forums 3.4, and possibly other versions, allows remote attackers to bypass file type checks and upload arbitrary files via a null byte in the file name, …
|
CWE-264
Permissions, Privileges, and Access Controls
|
CVE-2006-2530
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342483
|
7.5 |
HIGH
|
ipswitch
|
whatsup
|
Ipswitch WhatsUp Professional 2006 only verifies the user's identity via HTTP headers, which allows remote attackers to spoof being a trusted console and bypass authentication by setting HTTP User-Ag…
|
NVD-CWE-Other
|
CVE-2006-2531
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342484
|
6.4 |
MEDIUM
|
greg_donald
|
destiney_rated_images_script
|
stats.php in Destiney Rated Images Script 0.5.0 allows remote attackers to obtain the installation path via an invalid s parameter, which displays the path in an error message. NOTE: this issue was …
|
NVD-CWE-Other
|
CVE-2006-2532
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342485
|
5.8 |
MEDIUM
|
greg_donald
|
destiney_rated_images_script
|
Cross-site scripting (XSS) vulnerability in (1) addWeblog.php and (2) leaveComments.php in Destiney Rated Images Script 0.5.0 does not properly filter all vulnerable HTML tags, which allows remote at…
|
NVD-CWE-Other
|
CVE-2006-2533
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342486
|
5.0 |
MEDIUM
|
greg_donald
|
destiney_links_script
|
Destiney Links Script 2.1.2 does not protect library and other support files, which allows remote attackers to obtain the installation path via a direct URL to files in the (1) include and (2) themes…
|
NVD-CWE-Other
|
CVE-2006-2534
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342487
|
5.0 |
MEDIUM
|
greg_donald
|
destiney_links_script
|
index.php in Destiney Links Script 2.1.2 allows remote attackers to obtain the installation path via an invalid show parameter referencing a non-existent file, which reveals the path in the resulting…
|
CWE-200
Information Exposure
|
CVE-2006-2535
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342488
|
5.8 |
MEDIUM
|
greg_donald
|
destiney_links_script
|
Cross-site scripting (XSS) vulnerability in Destiney Links Script 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) "Search" (term parameter in index.php) and (2) "Add …
|
NVD-CWE-Other
|
CVE-2006-2536
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342489
|
2.6 |
LOW
|
ie_tab
mozilla
|
ie_tab
firefox
|
IE Tab 1.0.9 plugin for Mozilla Firefox 1.5.0.3 allows remote user-assisted attackers to cause a denial of service (application crash), possibly due to a null dereference, via certain Javascript, as …
|
NVD-CWE-Other
|
CVE-2006-2538
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342490
|
5.0 |
MEDIUM
|
dieselscripts
|
diesel_job_site
|
Privacy leak in install.php for Diesel PHP Job Site sends sensitive information such as user credentials to an e-mail address controlled by the product developers.
|
NVD-CWE-Other
|
CVE-2006-2540
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342491
|
7.5 |
HIGH
|
john_andersson
|
zixforum
|
SQL injection vulnerability in settings.asp in Zixforum 1.12 allows remote attackers to execute arbitrary SQL commands via the layid parameter to (1) login.asp and (2) main.asp.
|
NVD-CWE-Other
|
CVE-2006-2541
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342492
|
5.1 |
MEDIUM
|
xtreme_scripts
|
xtreme_topsites
|
Xtreme Topsites 1.1 allows remote attackers to trigger MySQL errors and possibly conduct SQL injection attacks via unspecified vectors in join.php.
|
NVD-CWE-Other
|
CVE-2006-2543
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342493
|
2.6 |
LOW
|
xtreme_scripts
|
xtreme_topsites
|
Multiple cross-site scripting (XSS) vulnerabilities in Xtreme Topsites 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter in stats.php and (2) unspecified inpu…
|
CWE-79
Cross-site Scripting
|
CVE-2006-2545
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342494
|
10.0 |
HIGH
|
sap
|
sapdba
|
Unspecified vulnerability in the sapdba command in SAP with Informix before 700, and 700 up to patch 100, allows local users to execute arbitrary commands via unknown vectors related to "insecure env…
|
NVD-CWE-Other
|
CVE-2006-2547
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342495
|
7.5 |
HIGH
|
perlpodder
prodder
|
perlpodder
prodder
|
Prodder before 0.5, and perlpodder before 0.5, allows remote attackers to execute arbitrary code via shell metacharacters in the URL of a podcast (url attribute of an enclosure tag, or $enc_url varia…
|
CWE-94
Code Injection
|
CVE-2006-2548
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342496
|
7.5 |
HIGH
|
pdf_tools_ag
|
pdf_form_filling_and_flattening_tool
|
Stack-based buffer overflow in PDF Form Filling and Flattening Tool before 3.1.0.12 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via long field names.
|
NVD-CWE-Other
|
CVE-2006-2549
|
2018-10-19 01:40 |
2006-05-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342497
|
5.1 |
MEDIUM
|
perlpodder
|
perlpodder
|
perlpodder before 0.5 allows remote attackers to execute arbitrary code via shell metacharacters in the URL of a podcast, which are executed when saving the URL to a log file. NOTE: the wget vector …
|
NVD-CWE-Other
|
CVE-2006-2550
|
2018-10-19 01:40 |
2006-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342498
|
2.1 |
LOW
|
hp
|
hp-ux
|
Unspecified vulnerability in the kernel in HP-UX B.11.00 allows local users to cause an unspecified denial of service via unknown vectors.
|
NVD-CWE-Other
|
CVE-2006-2551
|
2018-10-19 01:40 |
2006-05-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342499
|
5.0 |
MEDIUM
|
jemscripts
|
downloadcontrol
|
Jemscripts DownloadControl 1.0 allows remote attackers to obtain sensitive information via an invalid dcid parameter to dc.php, which leaks the pathname in an error message. NOTE: this was originall…
|
NVD-CWE-Other
|
CVE-2006-2552
|
2018-10-19 01:40 |
2006-05-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342500
|
4.3 |
MEDIUM
|
jemscripts
|
downloadcontrol
|
Cross-site scripting (XSS) vulnerability in Jemscripts DownloadControl 1.0 allows remote attackers to inject arbitrary HTML or web script via the dcid parameter to dc.php. NOTE: the provenance of th…
|
NVD-CWE-Other
|
CVE-2006-2553
|
2018-10-19 01:40 |
2006-05-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
