2006

Unspecified vulnerability in WebSphere 5.1.1 (or any earlier cumulative fix) Common Configuration Mode + CommonArchive a

The viewfile servlet in the documentation package (resin-doc) for Caucho Resin 3.0.17 and 3.0.18 allows remote attackers

Directory traversal vulnerability in the viewfile servlet in the documentation package (resin-doc) for Caucho Resin 3.0.

Pioneers meta-server before 0.9.55, when the server-console is not installed, allows remote attackers to cause a denial

BEA WebLogic Server before 8.1 Service Pack 4 does not properly set the Quality of Service in certain circumstances, whi

BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6, may send sensitive data over non-secure cha

view_album.php in SelectaPix 1.31 and earlier allows remote attackers to obtain the installation path via a certain requ

Multiple vulnerabilities in BEA WebLogic Server 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 leak sensitive inf

Bitrix Site Manager 4.1.x stores updater.log under the web document root with insufficient access control, which allows

Bitrix Site Manager 4.1.x allows remote attackers to redirect users to other websites via a modified back_url during a H

The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allo

Directory traversal vulnerability in BitZipper 4.1.2 SR-1 and earlier allows remote attackers to create files in arbitra

editor/filemanager/upload/php/upload.php in FCKeditor before 2.3 Beta, when the upload feature is enabled, does not veri

avatar_upload.asp in Avatar MOD 1.3 for Snitz Forums 3.4, and possibly other versions, allows remote attackers to bypass

Destiney Links Script 2.1.2 does not protect library and other support files, which allows remote attackers to obtain th

index.php in Destiney Links Script 2.1.2 allows remote attackers to obtain the installation path via an invalid show par

Integer underflow in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a font file wi

Privacy leak in install.php for Diesel PHP Job Site sends sensitive information such as user credentials to an e-mail ad

A recommended admin password reset mechanism for BEA WebLogic Server 8.1, when followed before October 10, 2005, causes

Jemscripts DownloadControl 1.0 allows remote attackers to obtain sensitive information via an invalid dcid parameter to

The parse_command function in Genecys 0.2 and earlier allows remote attackers to cause a denial of service (crash) via a

Alstrasoft Article Manager Pro 1.6 allows remote attackers to obtain sensitive information via (1) a quote character or

The setFrame function in Lib/2D/Surface.hpp for NetPanzer 0.8 and earlier allows remote attackers to cause a denial of s

Buffer overflow in the WebTool HTTP server component in (1) PunkBuster before 1.229, as used by multiple products includ

Russcom PHPImages allows remote attackers to upload files of arbitrary types by uploading a file with a .gif extension.

Unspecified vulnerability in e107 before 0.7.5 has unknown impact and remote attack vectors related to an "emailing expl

(1) AlstraSoft Web Host Directory 1.2, aka (2) HyperStop WebHost Directory 1.2, allows remote attackers to obtain the in

ftutil.c in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a crafted font file tha

SQL injection vulnerability in ChatPat 1.0 allows remote attackers to execute arbitrary SQL commands via the nickname fi

Dispatch.cgi/_user/uservCard/ in SiteScape Forum 7.2 and possibly earlier generates different responses in a way that al

SiteScape Forum 7.2 and possibly earlier stores the avf.rc configuraiton file under the web document root with insuffici

Unspecified "information leakage" vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to access ar

Multiple unspecified vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to read arbitrary image,

vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a

Secure Elements Class 5 AVR server and client (aka C5 EVM) before 2.8.1 send messages in cleartext, which allows remote

Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 allows remote attackers to cause an unspecified denial of s

Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 allows remote attackers to cause a denial of service via fo

Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 does not validate the peer certificate when obtaining an up

Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 allows remote attackers to read portions of process memory

Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 do not validate the source address of a message, which allows remo

Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 uses the same invariant RSA key for all installations, which allow

Secure Elements Class 5 AVR (aka C5 EVM) 2.8.1 and earlier, and possibly later 2.8.x releases, uses the same initializat

Secure Elements Class 5 AVR (aka C5 EVM) client and server before 2.8.1 do not verify the integrity of a message digest,

Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 generates predictable CEIDs, which allows remote attackers

Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 does not validate the CEID of an incoming message, which al

Unspecified versions of Mozilla Firefox allow remote attackers to cause a denial of service (crash) via a web page that

The RedCarpet command-line client (rug) does not verify SSL certificates from a server, which allows remote attackers to

membership.asp in Mini-Nuke 2.3 and earlier uses plaintext security codes, which allows remote attackers to register mul

enter.asp in Mini-Nuke 2.3 and earlier makes it easier for remote attackers to conduct password guessing attacks by sett

Stack-based buffer overflow in st.c in slurpd for OpenLDAP before 2.3.22 might allow attackers to execute arbitrary code