Vulnerabilities (CVE)

CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2006-0727 1 Musox 1 Df Msanalysis 2011-03-08 7.5 HIGH N/A
SQL injection vulnerability in mstrack.php in MusOX DF MSAnalysis (DFMSA), as used in some environments that use CPG-Nuke Dragonfly CMS, allows remote attackers to trigger path disclosure from a SQL syntax error, and possibly execute arbitrary SQL commands, via certain query data, probably involving the profile name.
CVE-2006-0751 1 Noofs Team 1 Network Object Oriented File System 2011-03-08 10.0 HIGH N/A
Multiple unspecified vulnerabilities in the (1) Filesystem in USErspace (FUSE) client and (2) NOOFS daemon in in Network Object Oriented File System (NOOFS) before 0.9.0 have unspecified impact and attack vectors.
CVE-2006-0876 1 Popfile 1 Popfile 2011-03-08 5.0 MEDIUM N/A
POPFile before 0.22.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors involving character sets within e-mail messages.
CVE-2005-4833 1 Ibm 1 Websphere Application Server 2011-03-08 4.3 MEDIUM N/A
IBM WebSphere Application Server (WAS) 6.0 before 20050201, when serving pages in an Application WAR or an Extended Document Root, allows remote attackers to obtain the JSP source code and other sensitive information via "a specific JSP URL," related to lack of normalization of the URL format.
CVE-2006-0313 1 Pdfdirectory 1 Pdfdirectory 2011-03-08 7.5 HIGH N/A
Multiple SQL injection vulnerabilities in PDFdirectory before 1.0 allow remote attackers to execute arbitrary SQL commands via multiple unspecified vectors involving (1) util.php, (2) userpref.php, (3) user.php, (4) uploadfrm.php, (5) title.php, (6) team.php, (7) stats.php, (8) page.php, (9) org.php, (10) member.php, (11) index.php, (12) group.php, or (13) anniv.php.
CVE-2006-0185 1 Php-nuke 2 News Module, Pool Module 2011-03-08 5.0 MEDIUM N/A
Multiple cross-site scripting vulnerabilities in the (1) Pool or (2) News Modules in Php-Nuke allow remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag.
CVE-2006-0067 1 Vego 1 Vego Links Builder 2011-03-08 7.5 HIGH N/A
SQL injection vulnerability in login.php in VEGO Links Builder 2.00 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVE-2006-0201 1 Paypal 1 Php Toolkit 2011-03-08 5.0 MEDIUM N/A
Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50, and possibly earlier versions, allows remote attackers to enter false payment entries into the log file via HTTP POST requests to ipn_success.php.
CVE-2006-0068 1 Primo Place 1 Primo Cart 2011-03-08 7.5 HIGH N/A
SQL injection vulnerability in Primo Cart 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) q parameter to search.php and (2) email parameter to user.php.
CVE-2006-0202 1 Paypal 1 Php Toolkit 2011-03-08 3.6 LOW N/A
Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier has (1) world-readable permissions for ipn/logs/ipn_success.txt, which allows local users to view sensitive information (payment data), and (2) world-writable permissions for ipn/logs, which allows local users to delete or replace payment data.
CVE-2006-0112 1 Enhanced Simple Php Gallery 1 Enhanced Simple Php Gallery 2011-03-08 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in index.php in Enhanced Simple PHP Gallery 1.7 allows remote attackers to inject arbitrary web script or HTML via the dir parameter.
CVE-2006-0085 1 Nkads 1 Nkads 2011-03-08 7.5 HIGH N/A
SQL injection vulnerability in Nkads 1.0 alfa 3 allows remote attackers to execute arbitrary SQL commands via the (1) usuario_nkads_admin or (2) password_nkads_admin parameters.
CVE-2006-0158 1 Cyberdoc 1 Sitesuite Cms 2011-03-08 7.5 HIGH N/A
SQL injection vulnerability in index.php in CyberDoc SiteSuite CMS allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVE-2006-0093 1 Ecardmax.com 1 Atcard Me Php 2011-03-08 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in index.php in @Card ME PHP allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
CVE-2006-0314 1 Pdfdirectory 1 Pdfdirectory 2011-03-08 7.5 HIGH N/A
PDFdirectory before 1.0 stores sensitive data in plaintext, which allows remote attackers to obtain arbitrary users' passwords by direct queries to the database, possibly via one of the SQL injection vulnerabilities.
CVE-2005-4806 1 Sun 1 Java System Web Proxy Server 2011-03-08 5.0 MEDIUM N/A
Multiple unspecified vulnerabilities in Sun Java System Web Proxy Server 3.6 SP7 and earlier allow remote attackers to cause a denial of service (unresponsive service) via unknown vectors.
CVE-2006-0125 1 Appserv Open Project 1 Appserv 2011-03-08 5.0 MEDIUM N/A
Unspecified vulnerability in appserv/main.php in AppServ 2.4.5 allows remote attackers to include arbitrary files via the appserv_root parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. There is not enough detail from these third party sources to know whether this is directory traversal, remote file include, or another issue.
CVE-2006-0077 1 Richard Dawe 1 File Extattr 2011-03-08 2.1 LOW N/A
Off-by-one error in the getfattr function in File::ExtAttr before 0.03 allows attackers to trigger a buffer overflow via unspecified attack vectors.
CVE-2005-4834 1 Ibm 1 Websphere Application Server 2011-03-08 5.0 MEDIUM N/A
IBM WebSphere Application Server (WAS) 5.0.2.5 through 5.1.1.3 allows remote attackers to obtain JSP source code and other sensitive information, related to incorrect request processing by the web container.
CVE-2006-0126 1 Rxvt-unicode 1 Rxvt-unicode 2011-03-08 4.6 MEDIUM N/A
rxvt-unicode before 6.3, on certain platforms that use openpty and non-Unix pty devices such as Linux and most BSD platforms, does not maintain the intended permissions of tty devices, which allows local users to gain read and write access to the devices.
CVE-2005-4823 1 Hp 1 Http Server 2011-03-08 10.0 HIGH N/A
Buffer overflow in the HP HTTP Server 5.0 through 5.95 of the HP Web-enabled Management Software allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2006-0127 1 Rockliffe 1 Mailsite 2011-03-08 4.0 MEDIUM N/A
Directory traversal vulnerability in the IMAP service of Rockliffe MailSite before 6.1.22.1 allows remote authenticated users to rename the folders of other users via a .. (dot dot) in the RENAME command.
CVE-2006-0109 1 Modular Merchant 1 Shopping Cart 2011-03-08 5.0 MEDIUM N/A
Cross-site scripting vulnerability in category.php in Modular Merchant Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
CVE-2006-0086 1 Next Generation Image Gallery 1 Next Generation Image Gallery 2011-03-08 5.0 MEDIUM N/A
Cross-site scripting vulnerability in index.php in Next Generation Image Gallery 0.0.1 Lite Edition allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVE-2006-0084 1 Rasmp 1 Rasmp 2011-03-08 5.0 MEDIUM N/A
Cross-site scripting vulnerability in index.php in raSMP 2.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the $_SERVER[HTTP_USER_AGENT] variable (User-Agent header).
CVE-2006-0089 1 Esri 1 Arcpad 2011-03-08 5.0 MEDIUM N/A
Buffer overflow in ESRI ArcPad 7.0.0.156 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .amp file with a COORDSYS tag with a long string attribute.
CVE-2006-0056 1 Pam-mysql 1 Pam-mysql 2011-03-08 7.5 HIGH N/A
Double free vulnerability in the authentication and authentication token alteration code in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords, which lead to a double free of a pointer that was created by the pam_get_item function. NOTE: this issue only occurs in certain configurations in which there are multiple PAM modules, PAM-MySQL is not evaluated first, and there are no requisite modules before PAM-MySQL.
CVE-2006-0090 1 Idv Directory Viewer 1 Idv Directory Viewer 2011-03-08 5.0 MEDIUM N/A
Directory traversal vulnerability in index.php in IDV Directory Viewer before 2005.1 allows remote attackers to view arbitrary directory contents via a .. (dot dot) in the dir parameter.
CVE-2006-0129 1 Rockliffe 1 Mailsite 2011-03-08 5.0 MEDIUM N/A
Mail Management Agent (MAILMA) (aka Mail Management Server) in Rockliffe MailSite 7.0.3.1 and earlier generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames via user requests to TCP port 106.
CVE-2006-0122 1 Aquifer Cms 1 Aquifer Cms 2011-03-08 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in Public/Index.asp in Aquifer CMS allows remote attackers to inject arbitrary web script or HTML via the Keyword parameter.
CVE-2005-4565 1 Adtran 1 Netvanta 2011-03-08 10.0 HIGH N/A
Format string vulnerability in the Internet Key Exchange version 1 (IKEv1) implementation in ADTRAN NetVanta before 10.03.03.E might allow remote attackers to have an unknown impact via format string specifiers in crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
CVE-2005-4548 1 Rws 1 Statistics Counter 2011-03-08 7.5 HIGH N/A
SQL injection vulnerability in the "user area" in RWS Statistics Counter before 2.4.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVE-2005-4508 1 Nexus Concepts 1 Dev Hound 2011-03-08 5.0 MEDIUM N/A
Nexus Concepts Dev Hound 2.24 and earlier allows remote attackers to obtain the installation path via a URL containing a non-existent .dll file.
CVE-2005-4566 1 Adtran 1 Netvanta 2011-03-08 10.0 HIGH N/A
Buffer overflow in the Internet Key Exchange version 1 (IKEv1) implementation in ADTRAN NetVanta before 10.03.03.E might allow remote attackers to have an unknown impact via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
CVE-2005-4353 1 Toenda Software Development 1 Toendacms 2011-03-08 7.5 HIGH N/A
SQL injection vulnerability in index.php in toendaCMS 0.6.2.1, when configured to use a SQL database, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2005-4522 1 Mantis 1 Mantis 2011-03-08 4.3 MEDIUM N/A
Multiple cross-site scripting (XSS) vulnerabilities in the view_filters_page.php filters script in Mantis 1.0.0rc3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) view_type and (2) target_field parameters.
CVE-2005-4381 1 Caravel Cms 1 Caravel Cms 2011-03-08 4.3 MEDIUM N/A
Multiple cross-site scripting (XSS) vulnerabilities in Caravel CMS 3.0 Beta 1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) fileDN and (2) folderviewer_attrs parameters.
CVE-2005-4707 1 Php Gen 1 Php Gen 2011-03-08 4.3 MEDIUM N/A
Multiple cross-site scripting (XSS) vulnerabilities in PHP GEN before 1.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVE-2005-4330 1 Ihtml Merchant 1 Ihtml Merchant Mall 2011-03-08 7.5 HIGH N/A
SQL injection vulnerability in browse.ihtml in iHTML Merchant Mall allows remote attackers to execute arbitrary SQL commands via the (1) id, (2) store, and (3) step parameters.
CVE-2005-4494 1 Spip 1 Spip 2011-03-08 2.6 LOW N/A
Cross-site scripting (XSS) vulnerability in SPIP 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) spip_login.php3 and (2) spip_pass.php3.
CVE-2005-4479 1 Phpslash 1 Phpslash 2011-03-08 7.5 HIGH N/A
SQL injection vulnerability in article.php in phpSlash 0.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the story_id parameter.
CVE-2005-4567 1 Floosietek 1 Ftgate 2011-03-08 5.8 MEDIUM N/A
Multiple cross-site scripting (XSS) vulnerabilities in FTGate Technology (formerly known as Floosietek) FTGate 4.4 (Build 4.4.000 Oct 26 2005) allow remote attackers to inject arbitrary web script or HTML by sending (1) the href parameter to index.fts, or the param1 parameter to (2) /domains/index.fts, (3) /config/licence.fts, or (4) /config/systemacl.fts.
CVE-2005-4695 1 Symantec 1 Brightmail Antispam 2011-03-08 5.0 MEDIUM N/A
Symantec Brightmail AntiSpam 6.0 build 1 and 2 allows remote attackers to cause a denial of service (bmserver component termination) via malformed MIME messages.
CVE-2005-4568 1 Floosietek 1 Ftgate 2011-03-08 7.5 HIGH N/A
Multiple format string vulnerabilities in FTGate Technology (formerly known as Floosietek) FTGate 4.4 (aka Build 4.4.000 Oct 26 2005) allow remote attackers to execute arbitrary code via format string specifiers in the (1) USER, (2) PASS, and (3) TOP commands to the POP3 server; and the (4) LIST and (5) AUTHENTICATE commands to the IMAP server.
CVE-2005-4713 1 Pam Mysql 1 Pam Mysql 2011-03-08 5.0 MEDIUM N/A
Unspecified vulnerability in the SQL logging facility in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors, probably involving the pam_mysql_sql_log function when being used in vsftpd, which does not include the IP address argument to an sprintf call.
CVE-2005-4521 1 Mantis 1 Mantis 2011-03-08 5.0 MEDIUM N/A
CRLF injection vulnerability in Mantis 1.0.0rc3 and earlier allows remote attackers to modify HTTP headers and conduct HTTP response splitting attacks via (1) the return parameter in login_cookie_test.php and (2) ref parameter in login_select_proj_page.php.
CVE-2005-4496 1 Forum One 1 Syntaxcms 2011-03-08 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in search in SyntaxCMS 1.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the search_query parameter.
CVE-2005-4569 1 Floosietek 1 Ftgate 2011-03-08 7.5 HIGH N/A
Stack-based buffer overflow in index.fts in FTGate Technology (formerly known as Floosietek) FTGate 4.4 (aka Build 4.4.000 Oct 26 2005) allows remote attackers to execute arbitrary code via a long tzoffset value.
CVE-2005-4331 1 Ihtml Merchant 1 Ihtml Merchant 2011-03-08 7.5 HIGH N/A
SQL injection vulnerability in merchant.ihtml in iHTML Merchant Version 2 Pro allows remote attackers to execute arbitrary SQL commands via the (1) step, (2) id, and (3) pid parameters.
CVE-2005-4473 1 Macromedia 1 Jrun 2011-03-08 5.0 MEDIUM N/A
Unspecified vulnerability in Macromedia JRun 4 web server (JWS) allows remote attackers to view web application source code via "a malformed URL."