NVD脆弱性情報トップ

検索メニュー表示

ベンダー名
プロダクト・サービス名
タイトル
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
公表日降順
更新日降順
表示数

NVD（National Vulnerability Database）で管理されている脆弱性の一覧を検索することが出来ます。
JVN（Japan Vulnerability Note）より先に脆弱性情報が更新される事が多いため、JVNに未記載の脆弱性が更新されている場合があります。

JVN（Japan Vulnerability Note）に関連した脆弱性がある場合は詳細画面で情報を表示します。

CWEで検索する場合は、CWE概要を参照して、CWE番号を確認してください。

CRITICAL
HIGH
MEDIUM
LOW

更新日:2026年7月16日4:30

No	CVSS	レベル攻撃区分	ベンダー名	プロダクト名	タイトル	CWE	CVE	更新日	公表日	影響表示	Exploit PoC 検索
364601	4.3	MEDIUM	idevspot	isupport	Multiple cross-site scripting (XSS) vulnerabilities in IDevSpot iSupport 1.8 allow remote attackers to inject arbitrary web script or HTML via (1) the suser parameter in support/rightbar.php, (2) the…	NVD-CWE-Other	CVE-2006-4884	2008-09-6 06:10	2006-09-20	表示	GitHub Exploit DB Packet Storm

364602	5.0	MEDIUM	microsoft	ie	Microsoft Internet Explorer 6 and earlier allows remote attackers to cause a denial of service (application hang) via a CSS-formatted HTML INPUT element within a DIV element that has a larger size th…	NVD-CWE-Other	CVE-2006-4888	2008-09-6 06:10	2006-09-20	表示	GitHub Exploit DB Packet Storm

364603	4.9	MEDIUM	novell	edirectory	Unspecified vulnerability in the NCPENGINE in Novell eDirectory 8.7.3.8 allows local users to cause a denial of service (CPU consumption) via unspecified vectors, as originally demonstrated using a N…	NVD-CWE-Other	CVE-2006-4185	2008-09-6 06:09	2006-08-17	表示	GitHub Exploit DB Packet Storm

364604	4.9	MEDIUM	novell	edirectory	This vulnerability is addressed in the following product release: Novell, eDirectory, 8.7.3 SP9	NVD-CWE-Other	CVE-2006-4185	2008-09-6 06:09	2006-08-17	表示	GitHub Exploit DB Packet Storm

364605	2.1	LOW	novell	edirectory	The iManager in eMBoxClient.jar in Novell eDirectory 8.7.3.8 writes passwords in plaintext to a log file, which allows local users to obtain passwords by reading the file.	NVD-CWE-Other	CVE-2006-4186	2008-09-6 06:09	2006-08-17	表示	GitHub Exploit DB Packet Storm

364606	4.3	MEDIUM	panda	panda_activescan	Cross-site scripting (XSS) vulnerability in ascan_6.asp in Panda ActiveScan 5.53.00 allows remote attackers to inject arbitrary web script or HTML via the email parameter.	NVD-CWE-Other	CVE-2006-4295	2008-09-6 06:09	2006-08-23	表示	GitHub Exploit DB Packet Storm

364607	5.0	MEDIUM	cisco	content_services_switch_11000	The ArrowPoint cookie functionality for Cisco 11000 series Content Service Switches specifies an internal IP address if the administrator does not specify a string option, which allows remote attacke…	NVD-CWE-Other	CVE-2006-4352	2008-09-6 06:09	2006-08-25	表示	GitHub Exploit DB Packet Storm

364608	7.5	HIGH	redblog	redblog	PHP remote file inclusion vulnerability in index.php in RedBLoG 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter. NOTE: the provenance of this informati…	NVD-CWE-Other	CVE-2006-4366	2008-09-6 06:09	2006-08-27	表示	GitHub Exploit DB Packet Storm

364609	4.3	MEDIUM	pmwiki	pmwiki	Cross-site scripting (XSS) vulnerability in PmWiki before 2.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "table markups".	NVD-CWE-Other	CVE-2006-4453	2008-09-6 06:09	2006-08-31	表示	GitHub Exploit DB Packet Storm

364610	10.0	HIGH	paessler	ipcheck_server_monitor	Paessler IPCheck Server Monitor before 5.3.3.639/640 does not properly implement a "list of acceptable host IP addresses in the probe settings," which has unknown impact and attack vectors.	NVD-CWE-Other	CVE-2006-4461	2008-09-6 06:09	2006-09-1	表示	GitHub Exploit DB Packet Storm

364611	5.0	MEDIUM	moderngigabyte	modernbill	ModernBill 5.0.4 and earlier uses cURL with insecure settings for CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST that do not verify SSL certificates, which allows remote attackers to read network …	NVD-CWE-Other	CVE-2006-4499	2008-09-6 06:09	2006-09-1	表示	GitHub Exploit DB Packet Storm

364612	4.3	MEDIUM	devellion	cubecart	Cross-site scripting (XSS) vulnerability in CubeCart 3.0.12 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the links array.	NVD-CWE-Other	CVE-2006-4525	2008-09-6 06:09	2006-09-2	表示	GitHub Exploit DB Packet Storm

364613	7.5	HIGH	devellion	cubecart	SQL injection vulnerability in includes/content/viewCat.inc.php in CubeCart 3.0.12 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the sea…	NVD-CWE-Other	CVE-2006-4526	2008-09-6 06:09	2006-09-2	表示	GitHub Exploit DB Packet Storm

364614	2.6	LOW	devellion	cubecart	includes/content/gateway.inc.php in CubeCart 3.0.12 and earlier, when magic_quotes_gpc is disabled, uses an insufficiently restrictive regular expression to validate the gateway parameter, which allo…	NVD-CWE-Other	CVE-2006-4527	2008-09-6 06:09	2006-09-2	表示	GitHub Exploit DB Packet Storm

364615	5.0	MEDIUM	ibm	lotus_notes	IBM Lotus Notes 6.0, 6.5, and 7.0 does not properly handle replies to e-mail messages with alternate name users when the (1) "Save As Draft" option is used or (2) a "," (comma) is inside the "phrase"…	NVD-CWE-Other	CVE-2006-3778	2008-09-6 06:08	2006-07-24	表示	GitHub Exploit DB Packet Storm

364616	4.0	MEDIUM	kailash_nadh	boastmachine	The Languages selection in the admin interface in Kailash Nadh boastMachine (formerly bMachine) 3.1 and earlier allows remote authenticated administrators to upload files with arbitrary extensions to…	NVD-CWE-Other	CVE-2006-3830	2008-09-6 06:08	2006-07-25	表示	GitHub Exploit DB Packet Storm

364617	4.3	MEDIUM	dokeos	dokeos	Multiple cross-site scripting (XSS) vulnerabilities in Dokeos before 1.6.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2006-3924	2008-09-6 06:08	2006-07-29	表示	GitHub Exploit DB Packet Storm

364618	5.0	MEDIUM	pswd.js	pswd.js	The pswd.js script relies on the client to calculate whether a username and password match hard-coded hashed values for a server, and uses a hashing scheme that creates a large number of collisions, …	CWE-255 証明書・パスワード管理	CVE-2006-4068	2008-09-6 06:08	2006-08-10	表示	GitHub Exploit DB Packet Storm

364619	10.0	HIGH	david_walker	phpautomembersarea	Unspecified vulnerability in phpAutoMembersArea (phpAMA) before 3.2.4 has unknown impact and attack vectors, related to "a potential security exploit which is critical."	NVD-CWE-Other	CVE-2006-4084	2008-09-6 06:08	2006-08-11	表示	GitHub Exploit DB Packet Storm

364620	10.0	HIGH	david_walker	phpautomembersarea	Upgrade to 3.2.4	NVD-CWE-Other	CVE-2006-4084	2008-09-6 06:08	2006-08-11	表示	GitHub Exploit DB Packet Storm

364621	6.4	MEDIUM	tor	tor	TLS handshakes in Tor before 0.1.1.20 generate public-private keys based on TLS context rather than the connection, which makes it easier for remote attackers to conduct brute force attacks on the en…	NVD-CWE-Other	CVE-2006-3411	2008-09-6 06:07	2006-07-7	表示	GitHub Exploit DB Packet Storm

364622	6.4	MEDIUM	tor	tor	Tor before 0.1.1.20 does not sufficiently obey certain firewall options, which allows remote attackers to bypass intended access restrictions for dirservers, direct connections, or proxy servers.	NVD-CWE-Other	CVE-2006-3412	2008-09-6 06:07	2006-07-7	表示	GitHub Exploit DB Packet Storm

364623	5.0	MEDIUM	tor	tor	The privoxy configuration file in Tor before 0.1.1.20, when run on Apple OS X, logs all data via the "logfile", which allows attackers to obtain potentially sensitive information.	NVD-CWE-Other	CVE-2006-3413	2008-09-6 06:07	2006-07-7	表示	GitHub Exploit DB Packet Storm

364624	5.0	MEDIUM	tor	tor	Tor before 0.1.1.20 supports server descriptors that contain hostnames instead of IP addresses, which allows remote attackers to arbitrarily group users by providing preferential address resolution.	NVD-CWE-Other	CVE-2006-3414	2008-09-6 06:07	2006-07-7	表示	GitHub Exploit DB Packet Storm

364625	6.4	MEDIUM	tor	tor	Tor before 0.1.1.20 uses improper logic to validate the "OR" destination, which allows remote attackers to perform a man-in-the-middle (MITM) attack via unspecified vectors.	NVD-CWE-Other	CVE-2006-3415	2008-09-6 06:07	2006-07-7	表示	GitHub Exploit DB Packet Storm

364626	6.4	MEDIUM	tor	tor	Tor client before 0.1.1.20 prefers entry points based on is_fast or is_stable flags, which could allow remote attackers to be preferred over nodes that are identified as more trustworthy "entry guard…	NVD-CWE-Other	CVE-2006-3417	2008-09-6 06:07	2006-07-7	表示	GitHub Exploit DB Packet Storm

364627	5.0	MEDIUM	tor	tor	Tor before 0.1.1.20 does not validate that a server descriptor's fingerprint line matches its identity key, which allows remote attackers to spoof the fingerprint line, which might be trusted by user…	NVD-CWE-Other	CVE-2006-3418	2008-09-6 06:07	2006-07-7	表示	GitHub Exploit DB Packet Storm

364628	5.0	MEDIUM	tor	tor	Tor before 0.1.1.20 uses OpenSSL pseudo-random bytes (RAND_pseudo_bytes) instead of cryptographically strong RAND_bytes, and seeds the entropy value at start-up with 160-bit chunks without reseeding,…	NVD-CWE-Other	CVE-2006-3419	2008-09-6 06:07	2006-07-7	表示	GitHub Exploit DB Packet Storm

364629	5.0	MEDIUM	phpmaillist	phpmaillist	PHPMailList 1.8.0 stores sensitive information under the web document root iwth insufficient access control, which allows remote attackers to obtain email addresses of subscribers, configuration info…	NVD-CWE-Other	CVE-2006-3483	2008-09-6 06:07	2006-07-11	表示	GitHub Exploit DB Packet Storm

364630	5.0	MEDIUM	virtuastore	virtuastore	VirtuaStore 2.0 stores sensitive files under the web root with insufficient access control, which allows remote attackers to obtain local database information by directly accessing database/virtuasto…	NVD-CWE-Other	CVE-2006-3487	2008-09-6 06:07	2006-07-11	表示	GitHub Exploit DB Packet Storm

364631	5.0	MEDIUM	virtuastore	virtuastore	Absolute path traversal vulnerability in administrador.asp in VirtuaStore 2.0 allows remote attackers to possibly read arbitrary directories or files via an absolute path with Windows drive letter in…	NVD-CWE-Other	CVE-2006-3488	2008-09-6 06:07	2006-07-11	表示	GitHub Exploit DB Packet Storm

364632	7.5	HIGH	sensesites	commonsense_cms	SQL injection vulnerability in search.php in SenseSites CommonSense CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the Date parameter. NOTE: the provenance of this information…	NVD-CWE-Other	CVE-2006-3576	2008-09-6 06:07	2006-07-13	表示	GitHub Exploit DB Packet Storm

364633	7.5	HIGH	lifetype	lifetype	SQL injection vulnerability in index.php in LifeType 1.0.5 allows remote attackers to execute arbitrary SQL commands via the Date parameter in a Default op.	NVD-CWE-Other	CVE-2006-3577	2008-09-6 06:07	2006-07-13	表示	GitHub Exploit DB Packet Storm

364634	5.0	MEDIUM	fujitsu	serverview	Directory traversal vulnerability in Fujitsu ServerView 2.50 up to 3.60L98 and 4.10L11 up to 4.11L81 allows remote attackers to read arbitrary files via unspecified vectors.	NVD-CWE-Other	CVE-2006-3578	2008-09-6 06:07	2006-07-13	表示	GitHub Exploit DB Packet Storm

364635	4.3	MEDIUM	fujitsu	serverview	Cross-site scripting (XSS) vulnerability in Fujitsu ServerView 2.50 up to 3.60L98 and 4.10L11 up to 4.11L81 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2006-3579	2008-09-6 06:07	2006-07-13	表示	GitHub Exploit DB Packet Storm

364636	4.3	MEDIUM	fujitsu	serverview	This vulnerability is addressed in the following product releases: Fujitsu, ServerView, 3.60L99 Fujitsu, ServerView, 4.20L11B	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2006-3579	2008-09-6 06:07	2006-07-13	表示	GitHub Exploit DB Packet Storm

364637	7.2	HIGH	ubuntu	ubuntu_linux	passwd before 1:4.0.13 on Ubuntu 6.06 LTS leaves the root password blank instead of locking it when the administrator selects the "Go Back" option after the final "Installation complete" message and …	NVD-CWE-Other	CVE-2006-3597	2008-09-6 06:07	2006-07-19	表示	GitHub Exploit DB Packet Storm

364638	2.6	LOW	cutephp	cutenews	Cross-site scripting (XSS) vulnerability in Index.PHP in CuteNews 1.4.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. NOTE: the provenance of this information i…	NVD-CWE-Other	CVE-2006-3661	2008-09-6 06:07	2006-07-19	表示	GitHub Exploit DB Packet Storm

364639	10.0	HIGH	kde	kdebase	The KDE PAM configuration shipped with Fedora Core 5 causes KDM passwords to be cached, which allows attackers to login without a password by attempting to log in multiple times.	NVD-CWE-Other	CVE-2006-3742	2008-09-6 06:07	2006-09-7	表示	GitHub Exploit DB Packet Storm

364640	6.8	MEDIUM	lucid_designs	lucid_calendar	Cross-site scripting (XSS) vulnerability in Cal.PHP3 in Chris Lea Lucid Calendar 0.22 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. NOTE: the provenance …	NVD-CWE-Other	CVE-2006-3025	2008-09-6 06:06	2006-06-15	表示	GitHub Exploit DB Packet Storm

364641	6.8	MEDIUM	lucid_designs	lucid_calendar	Lucid Designs, Lucid Calendar, 0.22 is unsupported. A new, supported version of this product will be released in the near future.	NVD-CWE-Other	CVE-2006-3025	2008-09-6 06:06	2006-06-15	表示	GitHub Exploit DB Packet Storm

364642	4.3	MEDIUM	emailarchitect	email_server	Cross-site scripting (XSS) vulnerability in EmailArchitect Email Server 6.1 allows remote attackers to inject arbitrary Javascript via an HTML div tag with a carriage return between the onmouseover a…	NVD-CWE-Other	CVE-2006-3108	2008-09-6 06:06	2006-06-21	表示	GitHub Exploit DB Packet Storm

364643	1.2	LOW	canonical	spread	spread uses a temporary file with a static filename based on the port number, which allows local users to cause a denial of service by creating the file during a race condition between unlink and bin…	NVD-CWE-Other	CVE-2006-3118	2008-09-6 06:06	2006-07-1	表示	GitHub Exploit DB Packet Storm

364644	7.5	HIGH	mambo	mambo	SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.	NVD-CWE-Other	CVE-2006-3263	2008-09-6 06:06	2006-06-28	表示	GitHub Exploit DB Packet Storm

364645	7.5	HIGH	mpg123	mpg123	Heap-based buffer overflow in httpdget.c in mpg123 before 0.59s-rll allows remote attackers to execute arbitrary code via a long URL, which is not properly terminated before being used with the strnc…	NVD-CWE-Other	CVE-2006-3355	2008-09-6 06:06	2006-07-7	表示	GitHub Exploit DB Packet Storm

364646	7.2	HIGH	ubuntu	ubuntu_linux	passwd command in shadow in Ubuntu 5.04 through 6.06 LTS, when called with the -f, -g, or -s flag, does not check the return code of a setuid call, which might allow local users to gain root privileg…	NVD-CWE-Other	CVE-2006-3378	2008-09-6 06:06	2006-07-7	表示	GitHub Exploit DB Packet Storm

364647	5.0	MEDIUM	amule	amule	Multiple unspecified vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to read arbitrary image, HTML, or PHP files via unknown vectors, probably related to directory traversal.	NVD-CWE-Other	CVE-2006-2692	2008-09-6 06:05	2006-05-31	表示	GitHub Exploit DB Packet Storm

364648	5.0	MEDIUM	amule	amule	Successful exploitation requires that the full pathname of the file is known. This vulnerability is addressed in the following product release: aMule, aMule, 2.1.2	NVD-CWE-Other	CVE-2006-2692	2008-09-6 06:05	2006-05-31	表示	GitHub Exploit DB Packet Storm

364649	5.0	MEDIUM	jetty	jetty	Directory traversal vulnerability in jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary files via a %2e%2e%5c (encoded ../) in the URL. NOTE: this might be the same issue as CVE-2…	CWE-22 パス・トラバーサル	CVE-2006-2758	2008-09-6 06:05	2006-06-2	表示	GitHub Exploit DB Packet Storm

364650	5.0	MEDIUM	jetty	jetty	jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probably other mixed case manipulations.	NVD-CWE-Other	CVE-2006-2759	2008-09-6 06:05	2006-06-2	表示	GitHub Exploit DB Packet Storm