CVE Daily
← All years

All CVEs — 2006

Page 1/7.

Browse all CVEs by publication year. Use filters to refine.

CVSS ≥ 0.0
2006-12-31
Medium

CVE-2006-6852

Eval injection vulnerability in tDiary 2.0.3 and 2.1.4.200 61127 allows remote authenticated users to execute arbitrary Ruby code via unspecified vectors, possibly related to incorrect input validati…

CVSS: 6.0 CWE: CWE-20
Read more
Medium

CVE-2006-7233

Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.6.0, and possibly other versions before 3.5.3, allows remote attackers to…

CVSS: 4.3 CWE: CWE-79
Read more
Low

CVE-2006-7232

sql_select.cc in MySQL 5.0.x before 5.0.32 and 5.1.x before 5.1.14 allows remote authenticated users to cause a denial of service (crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table, a…

CVSS: 3.5 CWE: CWE-89
Read more
High

CVE-2006-7231

SQL injection vulnerability in display.asp in Civica Software Civica allows remote attackers to execute arbitrary SQL commands via the Entry parameter. NOTE: the provenance of this information is un…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2006-6912

SQL injection vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly the userfile or filename parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2006-6887

Unrestricted file upload vulnerability in logahead UNU 1.0 allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors related to plugins/widged/_widged.php (aka the Widg…

CVSS: 6.8 CWE: CWE-94
Read more
Medium

CVE-2006-6886

phpwcms 1.2.5-DEV allows remote attackers to obtain sensitive information via a direct request for (1) files.public-userroot.inc.php or (2) files.private.additions.inc.php in include/inc_lib/, which…

CVSS: 5.0 CWE: CWE-200
Read more
Critical

CVE-2006-6884

Buffer overflow in the WZFILEVIEW.FileViewCtrl.61 ActiveX control (aka Sky Software "FileView" ActiveX control) for WinZip 10.0 Build 6667 allows remote attackers to execute arbitrary code via a long…

CVSS: 9.3 CWE: CWE-119
Read more
Medium

CVE-2006-6882

Cross-site scripting (XSS) vulnerability in golden book allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2006-6881

Buffer overflow in the Get_Wep function in cofvnet.c for ATMEL Linux PCI PCMCIA USB Drivers drivers 3.4.1.1 corruption allows attackers to execute arbitrary code via a long name argument.

CVSS: 7.5 CWE: CWE-119
Read more
High

CVE-2006-6880

Multiple SQL injection vulnerabilities in code/guestadd.php in PHP-Update 2.7 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) newmessage, (2) newname, (3) newwebsite,…

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2006-6832

Cross-site scripting (XSS) vulnerability in Joomla! before 1.0.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to poll.php or the module ti…

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2006-6848

SQL injection vulnerability in admin.asp in ASPTicker 1.0 allows remote attackers to execute arbitrary SQL commands via the PATH_INFO, possibly related to the Password parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Critical

CVE-2006-6143

The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, calls an uninitialized function p…

CVSS: 9.3 CWE: CWE-824
Read more
High

CVE-2006-5974

fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger a NULL…

CVSS: 7.8 CWE: CWE-20
Read more
High

CVE-2006-5867

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive in…

CVSS: 7.8 CWE: CWE-20
Read more
Medium

CVE-2006-5858

Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte i…

CVSS: 5.0 CWE: CWE-200
Read more
High

CVE-2006-5266

Multiple buffer overflows in Microsoft Dynamics GP (formerly Great Plains) 9.0 and earlier allow remote attackers to execute arbitrary code via (1) a crafted Distributed Process Manager (DPM) message…

CVSS: 7.5 CWE: CWE-119
Read more
Medium

CVE-2006-5265

Unspecified vulnerability in Microsoft Dynamics GP (formerly Great Plains) 9.0 and earlier allows remote attackers to cause a denial of service (crash) via an invalid magic number in a Distributed Pr…

CVSS: 5.0 CWE: CWE-20
Read more
Medium

CVE-2006-4727

Cross-site scripting (XSS) vulnerability in emfadmin/statusView.do in Tumbleweed EMF Administration Module 6.2.2 Build 4123, and possibly other versions before 6.3.2, allows remote attackers to injec…

CVSS: 4.3 CWE: CWE-79
Read more
Critical

CVE-2006-4695

Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary code via a crafted URL, aka "Office Web Components…

CVSS: 9.3 CWE: CWE-94
Read more
Medium

CVE-2006-4220

Multiple cross-site scripting (XSS) vulnerabilities in webacc in Novell GroupWise WebAccess before 7 Support Pack 3 Public Beta allow remote attackers to inject arbitrary web script or HTML via the (…

CVSS: 4.3 CWE: CWE-79
Read more
2006-12-29
Medium

CVE-2006-6824

Multiple cross-site scripting (XSS) vulnerabilities in Jim Hu and Chad Little PHP iCalendar 2.23 rc1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) getdate para…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2006-6811

KsIRC 1.3.12 allows remote attackers to cause a denial of service (crash) via a long PRIVMSG string when connecting to an Internet Relay Chat (IRC) server, which causes an assertion failure and resul…

CVSS: 6.5 CWE: CWE-617
Read more
2006-12-28
High

CVE-2006-6783

logahead UNU 1.0 before 20061226 allows remote attackers to upload arbitrary files via unspecified vectors related to plugins/widged/_widged.php (aka the WidgEd plugin), possibly because of an authen…

CVSS: 7.5 CWE: CWE-287
Read more
2006-12-27
Critical

CVE-2006-6772

Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run with the dump or backend option, allows remote attackers to execute arbitrary code via format string sp…

CVSS: 9.3 CWE: CWE-134
Read more
High

CVE-2006-6760

Multiple PHP remote file inclusion vulnerabilities in template.php in Phpmymanga 0.8.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) actionsPage or (2) formPag…

CVSS: 7.5 CWE: CWE-94
Read more
Medium

CVE-2006-6746

Multiple cross-site scripting (XSS) vulnerabilities in Xt-News 0.1 allow remote attackers to inject arbitrary web script or HTML via the id_news parameter to (1) add_comment.php or (2) show_news.php.

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2006-6747

SQL injection vulnerability in show_news.php in Xt-News 0.1 allows remote attackers to execute arbitrary SQL commands via the id_news parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2006-6748

PHP remote file inclusion vulnerability in i-accueil.php in Newxooper 0.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter. NOTE: The provenance of…

CVSS: 7.5 CWE: CWE-94
Read more
Critical

CVE-2006-6749

Buffer overflow in the parse_expression function in parse_config in OpenSER 1.1.0 allows attackers to have an unknown impact via a long str parameter.

CVSS: 9.3 CWE: CWE-119
Read more
Medium

CVE-2006-6751

Format string vulnerability in XM Easy Personal FTP Server 5.2.1 allows remote attackers to cause a denial of service (application crash) via format string specifiers in the USER command or certain o…

CVSS: 5.0 CWE: CWE-134
Read more
2006-12-26
Medium

CVE-2006-6741

Cross-site request forgery (CSRF) vulnerability in urlobox in MKPortal allows remote attackers to delete arbitrary messages as an administrator via a delete operation in an img BBcode tag.

CVSS: 5.8 CWE: CWE-352
Read more
High

CVE-2006-6740

Multiple PHP remote file inclusion vulnerabilities in phpProfiles 3.1.2b and earlier allow remote attackers to execute arbitrary PHP code via a URL in the menu parameter to (1) include/body.inc.php o…

CVSS: 7.5 CWE: CWE-94
Read more
High

CVE-2006-6739

PHP remote file inclusion vulnerability in buycd.php in Paristemi 0.8.3 allows remote attackers to execute arbitrary PHP code via a URL in the HTTP_DOCUMENT_ROOT parameter, a different vector than CV…

CVSS: 7.5 CWE: CWE-94
Read more
Medium

CVE-2006-6738

PHP remote file inclusion vulnerability in statistic.php in cwmCounter 5.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.

CVSS: 6.8 CWE: CWE-94
Read more
Medium

CVE-2006-6735

modules/viewcategory.php in Minh Nguyen Duong Obie Website Mini Web Shop 2.1.c allows remote attackers to obtain sensitive information via a request with an arbitrary catname parameter but no itemsdb…

CVSS: 5.0 CWE: CWE-200
Read more
Medium

CVE-2006-6734

Cross-site scripting (XSS) vulnerability in modules/viewcategory.php in Minh Nguyen Duong Obie Website Mini Web Shop 2.1.c allows remote attackers to inject arbitrary web script or HTML via the catna…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2006-6733

Cross-site scripting (XSS) vulnerability in support/view.php in Support Cards 1 (osTicket) allows remote attackers to inject arbitrary web script or HTML via the e parameter.

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2006-6732

PHP remote file inclusion vulnerability in archive.php in cwmVote 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the abs parameter.

CVSS: 6.8 CWE: CWE-94
Read more
Medium

CVE-2006-6725

Multiple directory traversal vulnerabilities in PHPBuilder 0.0.2 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to (1) lib/htm2php.php and (2)…

CVSS: 5.0 CWE: CWE-22
Read more
High

CVE-2006-6726

PHP remote file inclusion vulnerability in inertianews_main.php in inertianews 0.02 beta allows remote attackers to execute arbitrary PHP code via a URL in the inews_path parameter.

CVSS: 7.5 CWE: CWE-94
Read more
High

CVE-2006-6727

PHP remote file inclusion vulnerability in inertianews_class.php in inertianews 0.02 beta and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter.

CVSS: 7.5 CWE: CWE-94
Read more
Medium

CVE-2006-6729

Cross-site scripting (XSS) vulnerability in a-blog 1.51 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS: 4.3 CWE: CWE-79
Read more
2006-12-23
High

CVE-2006-6720

PHP remote file inclusion vulnerability in admin/index_sitios.php in Azucar CMS 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the _VIEW parameter.

CVSS: 7.5 CWE: CWE-94
Read more
High

CVE-2006-6701

Cross-site request forgery (CSRF) vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary settings and perform unauthorized action…

CVSS: 7.5 CWE: CWE-352
Read more
Medium

CVE-2006-6705

Multiple unspecified vulnerabilities in the template files in Soumu Workflow for Groupmax 01-00 through 01-01, Soumu Workflow 02-00 through 03-03, and Koukyoumuke Soumu Workflow 01-00 through 01-01 a…

CVSS: 5.0 CWE: CWE-287
Read more
Medium

CVE-2006-6706

SQL injection vulnerability in Soumu Workflow for Groupmax 01-00 through 01-01, Soumu Workflow 02-00 through 03-03, and Koukyoumuke Soumu Workflow 01-00 through 01-01 allows remote authenticated user…

CVSS: 6.5 CWE: CWE-89
Read more
High

CVE-2006-6710

Multiple PHP remote file inclusion vulnerabilities in PgmReloaded 0.8.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) lang parameter to (a) index.php, the (2)…

CVSS: 7.5 CWE: CWE-94
Read more
2006-12-22
Medium

CVE-2006-6696

Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted d…

CVSS: 6.9 CWE: CWE-119
Read more
2006-12-21
Medium

CVE-2006-6687

Cross-site scripting (XSS) vulnerability in Web Automated Perl Portal (WebAPP) 0.9.9.4, and 0.9.9.3.4 Network Edition (NE) (aka WebAPP.NET), allows remote attackers to inject arbitrary web script or…

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2006-6689

Multiple PHP remote file inclusion vulnerabilities in Paristemi 0.8.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the SERVER_DIRECTORY parameter to unspecified scrip…

CVSS: 7.5 CWE: CWE-94
Read more
High

CVE-2006-6679

Pedro Lineu Orso chetcpasswd before 2.4 relies on the X-Forwarded-For HTTP header when verifying a client's status on an IP address ACL, which allows remote attackers to gain unauthorized access by s…

CVSS: 7.5 CWE: CWE-863
Read more
High

CVE-2006-6684

Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd before 2.4 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long X-Forward…

CVSS: 7.5 CWE: CWE-119
Read more
High

CVE-2006-6685

Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd 2.3.3 allows local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long REMOTE_ADDR environ…

CVSS: 7.2 CWE: CWE-119
Read more
2006-12-20
Critical

CVE-2006-6652

Buffer overflow in the glob implementation (glob.c) in libc in NetBSD-current before 20050914, NetBSD 2.* and 3.* before 20061203, and Apple Mac OS X before 2007-004, as used by the FTP daemon and tn…

CVSS: 9.0 CWE: CWE-119
Read more
Low

CVE-2006-6653

The accept function in NetBSD-current before 20061023, NetBSD 3.0 and 3.0.1 before 20061024, and NetBSD 2.x before 20061029 allows local users to cause a denial of service (socket consumption) via an…

CVSS: 1.7 CWE: CWE-20
Read more
Medium

CVE-2006-6499

The js_dtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 overwrites memory instead of exiting when the floating point p…

CVSS: 4.3 CWE: CWE-835
Read more
Medium

CVE-2006-6500

Heap-based buffer overflow in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to cause a denial of service (cr…

CVSS: 6.8 CWE: CWE-119
Read more
Critical

CVE-2006-6504

Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document…

CVSS: 9.3 CWE: CWE-94
Read more
2006-12-19
Medium

CVE-2006-6637

The Servlet Engine and Web Container in IBM WebSphere Application Server (WAS) before 6.0.2.17, when ibm-web-ext.xmi sets fileServingEnabled to true and servlet caching is enabled, allows remote atta…

CVSS: 5.0 CWE: CWE-200
Read more
High

CVE-2006-6106

Multiple buffer overflows in the cmtp_recv_interopmsg function in the Bluetooth driver (net/bluetooth/cmtp/capi.c) in the Linux kernel 2.4.22 up to 2.4.33.4 and 2.6.2 before 2.6.18.6, and 2.6.19.x, a…

CVSS: 7.5 CWE: CWE-119
Read more
2006-12-18
High

CVE-2006-5872

login.pl in SQL-Ledger before 2.6.21 and LedgerSMB before 1.1.5 allows remote attackers to execute arbitrary Perl code via the "-e" flag in the script parameter, which is used as an argument to the p…

CVSS: 7.5 CWE: CWE-20
Read more
2006-12-15
Medium

CVE-2006-6597

Argument injection vulnerability in HyperAccess 8.4 allows user-assisted remote attackers to execute arbitrary vbscript and commands via the /r option in a telnet:// URI, which is configured to use h…

CVSS: 6.8 CWE: CWE-88
Read more
High

CVE-2006-6581

PHP remote file inclusion vulnerability in tests/debug_test.php in Vernet Loic PHP_Debug 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the debugClassLocation parameter.

CVSS: 7.5 CWE: CWE-20
Read more
High

CVE-2006-6576

Heap-based buffer overflow in Golden FTP Server (goldenftpd) 1.92 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long PASS command.…

CVSS: 7.5 CWE: CWE-787
Read more
Medium

CVE-2006-6565

FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to the (1) LIST or (2) NLST commands, which results in a NULL pointer dereference,…

CVSS: 4.0 CWE: CWE-476
Read more
2006-12-14
Medium

CVE-2006-5648

Ubuntu Linux 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (resource consumption) by using the (1) sys_get_robust_list and (2) sys_set_robust_list functions to create pro…

CVSS: 5.5 CWE: CWE-400
Read more
Medium

CVE-2006-5649

Unspecified vulnerability in the "alignment check exception handling" in Ubuntu 5.10, 6.06 LTS, and 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (kernel panic) via unspe…

CVSS: 5.5 CWE: CWE-400
Read more
2006-12-12
Critical

CVE-2006-5579

Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code by using JavaScript to cause certain errors simultaneously, which results in the access of previously freed memory, aka…

CVSS: 9.3 CWE: CWE-119
Read more
2006-12-11
High

CVE-2006-6462

PHP remote file inclusion vulnerability in engine/oldnews.inc.php in CM68 News 12.02.06 allows remote attackers to execute arbitrary PHP code via a URL in the addpath parameter.

CVSS: 7.5 CWE: CWE-94
Read more
Medium

CVE-2006-6457

tiki-wiki_rss.php in Tikiwiki 1.9.5, 1.9.2, and possibly other versions allows remote attackers to obtain sensitive information (MySQL username and password) via an invalid (large or negative) ver pa…

CVSS: 5.0 CWE: CWE-200
Read more
2006-12-10
Medium

CVE-2006-6451

Multiple cross-site scripting (XSS) vulnerabilities in SWsoft Plesk 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) get_password.php…

CVSS: 6.8 CWE: CWE-79
Read more
Medium

CVE-2006-6383

PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ";" in a session_save_path argument, followed by an allowed path,…

CVSS: 4.6 CWE: CWE-20
Read more
High

CVE-2006-6427

The Web User Interface in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allows remote attackers to execute arbitrary commands via…

CVSS: 7.5 CWE: CWE-78
Read more
Critical

CVE-2006-6442

Stack-based buffer overflow in the SetClientInfo function in the CDDBControlAOL.CDDBAOLControl ActiveX control (cddbcontrol.dll), as used in America Online (AOL) 7.0 4114.563, 8.0 4129.230, and 9.0 S…

CVSS: 9.3 CWE: CWE-119
Read more
High

CVE-2006-6418

Buffer overflow in the POSIX Threads library (libpthread) on HP Tru64 UNIX 4.0F PK8, 4.0G PK4, and 5.1A PK6 allows local users to gain root privileges via a long PTHREAD_CONFIG environment variable.

CVSS: 7.2 CWE: CWE-119
Read more
Medium

CVE-2006-6400

Buffer overflow in JustSystems Hanako 2004 through 2006, Hanako viewer 1.x, Ichitaro 2004, Ichitaro 2005, Ichitaro Lite2, Ichitaro viewer 4.x, and Sanshiro 2005 allows remote attackers to execute arb…

CVSS: 6.8 CWE: CWE-119
Read more
Medium

CVE-2006-6401

Multiple cross-site scripting (XSS) vulnerabilities in mystats.php in MyStats 1.0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) connexion, (2) by, and (3) de…

CVSS: 6.8 CWE: CWE-79
Read more
High

CVE-2006-6402

SQL injection vulnerability in mystats.php in MyStats 1.0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the details parameter.

CVSS: 7.5 CWE: CWE-89
Read more
2006-12-08
High

CVE-2006-6396

Stack-based buffer overflow in BlazeVideo HDTV Player 2.1, and possibly earlier, allows remote attackers to execute arbitrary code via a long filename in a PLF playlist, a different product than CVE-…

CVSS: 7.5 CWE: CWE-119
Read more
2006-12-07
Medium

CVE-2006-6359

Cross-site scripting (XSS) vulnerability in Stefan Frech online-bookmarks 0.6.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS: 6.8 CWE: CWE-79
Read more
Critical

CVE-2006-6361

Heap-based buffer overflow in the uploadprogress_php_rfc1867_file function in uploadprogress.c in Bitflux Upload Progress Meter before 8276 allows remote attackers to cause a denial of service (crash…

CVSS: 10.0 CWE: CWE-119
Read more
High

CVE-2006-6367

Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2006-6337

Multiple SQL injection vulnerabilities in giris.asp in Aspee and Dogantepe Ziyaretci Defteri allow remote attackers to execute arbitrary SQL commands via the (1) kullanici or (2) parola parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2006-6349

Multiple SQL injection vulnerabilities in PWP Technologies The Classified Ad System allow remote attackers to execute arbitrary SQL commands via (1) the main parameter in a view action (includes/main…

CVSS: 7.5 CWE: CWE-89
Read more
2006-12-05
Medium

CVE-2006-6291

Stack overflow in the IMAP module (MEIMAPS.EXE) in MailEnable Professional 1.6 through 1.83 and 2.0 through 2.33, and MailEnable Enterprise 1.1 through 1.40 and 2.0 through 2.33, allows remote authen…

CVSS: 6.8 CWE: CWE-119
Read more
High

CVE-2006-6293

Heap-based buffer overflow in FRISK Software F-Prot Antivirus before 4.6.7 allows user-assisted remote attackers to execute arbitrary code via a crafted CHM file. NOTE: this issue has at least a part…

CVSS: 7.5 CWE: CWE-119
Read more
2006-12-04
Medium

CVE-2006-6288

Multiple buffer overflows in Niek Albers CoolPlayer 216 and earlier allow remote attackers to execute arbitrary code via (1) a playlist file with long song names, because of an overflow in the CPL_Ad…

CVSS: 4.6 CWE: CWE-119
Read more
Medium

CVE-2006-6276

HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypas…

CVSS: 6.8 CWE: CWE-444
Read more
Medium

CVE-2006-6275

Race condition in the kernel in Sun Solaris 8 through 10 allows local users to cause a denial of service (panic) via unspecified vectors, possibly related to the exitlwps function and SIGKILL and /pr…

CVSS: 4.7 CWE: CWE-362
Read more
2006-12-03
Medium

CVE-2006-6242

Multiple directory traversal vulnerabilities in Serendipity 1.0.3 and earlier allow remote attackers to read or include arbitrary local files via a .. (dot dot) sequence in the serendipity[charset] p…

CVSS: 6.8 CWE: CWE-22
Read more
Medium

CVE-2006-6241

Sorin Chitu Telnet-FTP Server 1.0 allows remote authenticated users to cause a denial of service (crash) via consecutive RETR commands. NOTE: The provenance of this information is unknown; the detai…

CVSS: 4.0 CWE: CWE-20
Read more
2006-12-01
High

CVE-2006-6199

Stack-based buffer overflow in BlazeVideo BlazeDVD Standard and Professional 5.0, and possibly earlier, allows remote attackers to execute arbitrary code via a long filename in a PLF playlist.

CVSS: 7.5 CWE: CWE-119
Read more
High

CVE-2006-6212

PHP remote file inclusion vulnerability in centre.php in Site News (site_news) 2.00, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE…

CVSS: 7.5 CWE: CWE-94
Read more
Critical

CVE-2006-6183

Multiple stack-based buffer overflows in 3Com 3CTftpSvc 2.0.1, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long mode field (aka t…

CVSS: 10.0 CWE: CWE-119
Read more
2006-11-30
High

CVE-2006-4514

Heap-based buffer overflow in the ole_info_read_metabat function in Gnome Structured File library (libgsf) 1.14.0, and other versions before 1.14.2, allows context-dependent attackers to execute arbi…

CVSS: 7.5 CWE: CWE-119
Read more
2006-11-29
High

CVE-2006-6168

tiki-register.php in TikiWiki before 1.9.7 allows remote attackers to trigger "notification-spam" via certain vectors such as a comma-separated list of addresses in the email field, related to lack o…

CVSS: 7.5 CWE: CWE-20
Read more
Medium

CVE-2006-6162

Cross-site scripting (XSS) vulnerability in tiki-edit_structures.php in TikiWiki 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the pageAlias parameter. NOTE: The provenanc…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2006-6163

Cross-site scripting (XSS) vulnerability in tiki-setup_base.php in TikiWiki before 1.9.7 allows remote attackers to inject arbitrary JavaScript via unspecified parameters.

CVSS: 4.3 CWE: CWE-79
Read more
2006-11-28
High

CVE-2006-6157

SQL injection vulnerability in index.php in ContentNow 1.39 and earlier allows remote attackers to execute arbitrary SQL commands via the pageid parameter. NOTE: this issue can be leveraged for path…

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2006-6159

Multiple cross-site scripting (XSS) vulnerabilities in newticket.php in DeskPRO 2.0.0 and 2.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) message or (2) subject parame…

CVSS: 6.8 CWE: CWE-79
Read more
High

CVE-2006-6133

Stack-based buffer overflow in Visual Studio Crystal Reports for Microsoft Visual Studio .NET 2002 and 2002 SP1, .NET 2003 and 2003 SP1, and 2005 and 2005 SP1 (formerly Business Objects Crystal Repor…

CVSS: 7.6 CWE: CWE-119
Read more
High

CVE-2006-6134

Heap-based buffer overflow in the WMCheckURLScheme function in WMVCORE.DLL in Microsoft Windows Media Player (WMP) 10.00.00.4036 on Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote atta…

CVSS: 7.5 CWE: CWE-119
Read more
2006-11-27
High

CVE-2006-6125

Heap-based buffer overflow in the wireless driver (WG311ND5.SYS) 2.3.1.10 for NetGear WG311v1 wireless adapter allows remote attackers to execute arbitrary code via an 802.11 management frame with a…

CVSS: 7.5 CWE: CWE-119
Read more
2006-11-26
Medium

CVE-2006-6108

Cross-site scripting (XSS) vulnerability in EC-CUBE before 1.0.1a-beta allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2006-6109

Multiple SQL injection vulnerabilities in CandyPress Store 3.5.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) policy parameter in openPolicy.asp or the (2) brand parameter…

CVSS: 7.5 CWE: CWE-89
Read more
2006-11-24
Medium

CVE-2006-6096

Cross-site scripting (XSS) vulnerability in activenews_search.asp in ActiveNews Manager allows remote attackers to inject arbitrary web script or HTML via the query parameter.

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2006-6095

Multiple SQL injection vulnerabilities in ActiveNews Manager allow remote attackers to execute arbitrary SQL commands via the (1) articleID parameter to activenews_view.asp or the (2) page parameter…

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2006-6086

PHP remote file inclusion vulnerability in src/ark_inc.php in e-Ark 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the cfg_pear_path parameter.

CVSS: 5.1 CWE: CWE-94
Read more
High

CVE-2006-6094

Multiple SQL injection vulnerabilities in ActiveNews Manager allow remote attackers to execute arbitrary SQL commands via the (1) catID parameter to activeNews_categories.asp, the (2) articleID param…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2006-6073

Multiple SQL injection vulnerabilities in Enthrallweb eShopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) ProductID parameter in productdetail.asp or the (2) categoryi…

CVSS: 7.5 CWE: CWE-89
Read more
2006-11-22
Medium

CVE-2006-6035

Cross-site scripting (XSS) vulnerability in list.php in BLOG:CMS 4.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the FADDR parameter.

CVSS: 6.8 CWE: CWE-79
Read more
Medium

CVE-2006-6037

Multiple cross-site scripting (XSS) vulnerabilities in index.php in Dan Jensen Travelsized CMS 0.4.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) page, (2) page_i…

CVSS: 6.8 CWE: CWE-79
Read more
High

CVE-2006-6038

SQL injection vulnerability in editpoll.php in Powie's PHP Forum (pForum) 1.29a and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2006-6041

Multiple PHP remote file inclusion vulnerabilities in Laurent Van den Reysen WORK system e-commerce 3.0.2, and other versions before 3.0.4, allow remote attackers to execute arbitrary PHP code via a…

CVSS: 7.5 CWE: CWE-94
Read more
Medium

CVE-2006-6046

Multiple cross-site scripting (XSS) vulnerabilities in eggblog 3.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) edit parameter to (a) admin/articles.php or (b) admin/co…

CVSS: 6.8 CWE: CWE-79
Read more
Medium

CVE-2006-6047

Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the f parameter…

CVSS: 5.8 CWE: CWE-22
Read more
Medium

CVE-2006-6048

SQL injection vulnerability in index.php in Etomite CMS 0.6.1.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS: 6.8 CWE: CWE-89
Read more
2006-11-21
High

CVE-2006-6025

QUALCOMM Eudora WorldMail 4.0 allows remote attackers to cause a denial of service, as demonstrated by a certain module in VulnDisco Pack. NOTE: The provenance of this information is unknown; the de…

CVSS: 7.5 CWE: CWE-400
Read more