CVE Daily
← All years

All CVEs — 2006

Page 5/7.

Browse all CVEs by publication year. Use filters to refine.

CVSS ≥ 0.0
2006-06-01
High

CVE-2006-2439

Stack-based buffer overflow in ZipCentral 4.01 allows remote user-assisted attackers to execute arbitrary code via a ZIP archive containing a long filename.

CVSS: 7.6 CWE: CWE-119
Read more
2006-05-31
Medium

CVE-2006-2681

PHP remote file inclusion vulnerability in SocketMail Lite and Pro 2.2.6 and earlier, when register_globals and magic_quotes are enabled, allows remote attackers to execute arbitrary PHP code via a U…

CVSS: 6.8 CWE: CWE-94
Read more
Medium

CVE-2006-2685

PHP remote file inclusion vulnerability in Basic Analysis and Security Engine (BASE) 1.2.4 and earlier, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via a URL…

CVSS: 4.0 CWE: CWE-94
Read more
Medium

CVE-2006-2686

PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[AA_INC_PATH] parameter in (1) cached.php3, (2) cron.php3, (…

CVSS: 6.4 CWE: CWE-94
Read more
2006-05-30
Medium

CVE-2006-2663

Multiple cross-site scripting (XSS) vulnerabilities in iFlance 1.1 allow remote attackers to inject arbitrary web script or HTML via certain inputs to (1) acc_verify.php or (2) project.php.

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2006-2669

Multiple cross-site scripting (XSS) vulnerabilities in Pre Shopping Mall 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter in search.php (the "search box"…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2006-2661

ftutil.c in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a crafted font file that triggers a null dereference.

CVSS: 5.0 CWE: CWE-476
Read more
High

CVE-2006-2656

Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via a long filename. NOTE: tiffsplit is not setuid. If there…

CVSS: 7.5 CWE: CWE-119
Read more
Medium

CVE-2006-2635

Multiple cross-site scripting (XSS) vulnerabilities in Tikiwiki (aka Tiki CMS/Groupware) 1.9.x allow remote attackers to inject arbitrary web script or HTML via malformed nested HTML tags such as "<s…

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2006-2636

newsadmin.asp in Katy Whitton NewsCMSLite allows remote attackers to bypass authentication and gain administrative access by setting the loggedIn cookie to "xY1zZoPQ".

CVSS: 7.5 CWE: CWE-287
Read more
High

CVE-2006-2645

PHP remote file inclusion vulnerability in manager/frontinc/prepend.php for Plume 1.0.3 allows remote attackers to execute arbitrary code via a URL in the _PX_config[manager_path] parameter. NOTE: t…

CVSS: 7.5 CWE: CWE-94
Read more
Medium

CVE-2006-2649

Multiple cross-site scripting (XSS) vulnerabilities in (a) search.php, (b) search_cat.php, (c) search_price.php, and (d) product_details.php in the cosmicshop directory for CosmicShoppingCart allow r…

CVSS: 6.8 CWE: CWE-79
Read more
2006-05-28
High

CVE-2006-2453

Multiple unspecified format string vulnerabilities in Dia have unspecified impact and attack vectors, a different set of issues than CVE-2006-2480.

CVSS: 7.5 CWE: CWE-134
Read more
2006-05-26
Medium

CVE-2006-2618

Cross-site scripting (XSS) vulnerability in (1) AlstraSoft Web Host Directory 1.2, aka (2) HyperStop WebHost Directory 1.2, might allow remote attackers to inject arbitrary web script or HTML via the…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2006-2613

Mozilla Suite 1.7.13, Mozilla Firefox 1.5.0.3 and possibly other versions before before 1.8.0, and Netscape 7.2 and 8.1, and possibly other versions and products, allows remote user-assisted attacker…

CVSS: 4.3 CWE: CWE-200
Read more
2006-05-23
Low

CVE-2006-2545

Multiple cross-site scripting (XSS) vulnerabilities in Xtreme Topsites 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter in stats.php and (2) unspecified inpu…

CVSS: 2.6 CWE: CWE-79
Read more
High

CVE-2006-2548

Prodder before 0.5, and perlpodder before 0.5, allows remote attackers to execute arbitrary code via shell metacharacters in the URL of a podcast (url attribute of an enclosure tag, or $enc_url varia…

CVSS: 7.5 CWE: CWE-94
Read more
2006-05-22
Medium

CVE-2006-2535

index.php in Destiney Links Script 2.1.2 allows remote attackers to obtain the installation path via an invalid show parameter referencing a non-existent file, which reveals the path in the resulting…

CVSS: 5.0 CWE: CWE-200
Read more
Medium

CVE-2006-2516

mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks o…

CVSS: 5.1 CWE: CWE-22
Read more
High

CVE-2006-2521

PHP remote file inclusion vulnerability in cron.php in phpMyDirectory 10.4.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ROOT_PATH parameter.

CVSS: 7.5 CWE: CWE-94
Read more
Medium

CVE-2006-2506

Multiple cross-site scripting (XSS) vulnerabilities in search.php in Sphider allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO and (2) the category parameter.

CVSS: 6.8 CWE: CWE-79
Read more
Critical

CVE-2006-1857

Buffer overflow in SCTP in Linux kernel before 2.6.16.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a malformed HB-ACK chunk.

CVSS: 9.0 CWE: CWE-119
Read more
High

CVE-2006-1858

SCTP in Linux kernel before 2.6.16.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a chunk length that is inconsistent with the actual length o…

CVSS: 7.8 CWE: CWE-20
Read more
2006-05-20
High

CVE-2006-2492

Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a m…

CVSS: 8.8 CWE: CWE-120
Read more
2006-05-19
Medium

CVE-2006-2490

Multiple cross-site scripting (XSS) vulnerabilities in Mobotix IP Network Cameras M1 1.9.4.7 and M10 2.0.5.2, and other versions before 2.2.3.18 for M10/D10 and 3.0.3.31 for M22, allow remote attacke…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2006-0039

Race condition in the do_add_counters function in netfilter for Linux kernel 2.6.16 allows local users with CAP_NET_ADMIN capabilities to read kernel memory by triggering the race condition in a way…

CVSS: 4.7 CWE: CWE-362
Read more
Medium

CVE-2006-2480

Format string vulnerability in Dia 0.94 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering errors or warnings, as demonstrated via f…

CVSS: 5.1 CWE: CWE-134
Read more
Low

CVE-2006-2312

Argument injection vulnerability in the URI handler in Skype 2.0.*.104 and 2.5.*.0 through 2.5.*.78 for Windows allows remote authorized attackers to download arbitrary files via a URL that contains…

CVSS: 2.6 CWE: CWE-88
Read more
2006-05-18
Medium

CVE-2006-1528

Linux kernel before 2.6.13 allows local users to cause a denial of service (crash) via a dio transfer from the sg driver to memory mapped (mmap) IO space.

CVSS: 4.9 CWE: CWE-20
Read more
2006-05-17
High

CVE-2006-2428

add.asp in DUware DUbanner 3.1 allows remote attackers to execute arbitrary code by uploading files with arbitrary extensions, such as ASP files, probably due to client-side enforcement that can be b…

CVSS: 7.5 CWE: CWE-434
Read more
Medium

CVE-2006-2431

Cross-site scripting (XSS) vulnerability in the 500 Internal Server Error page on the SOAP port (8880/tcp) in IBM WebSphere Application Server 5.0.2 and earlier, 5.1.x before 5.1.1.12, and 6.0.2 up t…

CVSS: 4.3 CWE: CWE-79
Read more
2006-05-16
High

CVE-2006-2407

Stack-based buffer overflow in (1) WeOnlyDo wodSSHServer ActiveX Component 1.2.7 and 1.3.3 DEMO, as used in other products including (2) FreeSSHd 1.0.9 and (3) freeFTPd 1.0.10, allows remote attacker…

CVSS: 7.5 CWE: CWE-119
Read more
High

CVE-2006-2408

Multiple buffer overflows in Raydium before SVN revision 310 allow remote attackers to execute arbitrary code via a large packet when logged via (1) the raydium_log function in log.c or (2) the raydi…

CVSS: 7.5 CWE: CWE-119
Read more
Medium

CVE-2006-2409

Format string vulnerability in the raydium_log function in console.c in Raydium before SVN revision 310 allows local users to execute arbitrary code via format string specifiers in the format paramet…

CVSS: 4.6 CWE: CWE-134
Read more
Medium

CVE-2006-2416

SQL injection vulnerability in class2.php in e107 0.7.2 and earlier allows remote attackers to execute arbitrary SQL commands via a cookie as defined in $pref['cookie_name'].

CVSS: 5.1 CWE: CWE-89
Read more
Medium

CVE-2006-2417

Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.x before 2.8.0.4 allows remote attackers to inject arbitrary web script or HTML via the theme parameter in unknown scripts. NOTE: the lan…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2006-2420

Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting (XSS) attacks via a title element with HTML encoded sequences such as "&gt;", whi…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2006-2395

PHP remote file inclusion vulnerability in resources/includes/popp.config.loader.inc.php in PopSoft Digital PopPhoto Studio 3.5.4 and earlier allows remote attackers to execute arbitrary PHP code via…

CVSS: 5.0 CWE: CWE-94
Read more
High

CVE-2006-2399

Stack-based buffer overflow in the ServerNetworking::incoming_client_data function in servnet.cpp in Outgun 1.0.3 bot 2 and earlier allows remote attackers to cause a denial of service (application c…

CVSS: 7.5 CWE: CWE-119
Read more
2006-05-15
High

CVE-2006-2369

RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure…

CVSS: 7.5 CWE: CWE-287
Read more
High

CVE-2006-2362

Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423, as used by GNU strings, allows context-dependent attackers to cause a denial of service (appl…

CVSS: 7.3 CWE: CWE-787
Read more
Medium

CVE-2006-2351

Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to inject arbitrary web script or HTML via the (…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2006-2356

NmConsole/utility/RenderMap.asp in Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to obtain sensitive information about network nodes via a modified…

CVSS: 5.0 CWE: CWE-200
Read more
2006-05-12
Low

CVE-2006-1439

NSSecureTextField in AppKit in Apple Mac OS X 10.4.6 does not re-enable secure event input under certain circumstances, which could allow other applications in the window session to monitor input cha…

CVSS: 2.1 CWE: CWE-200
Read more
High

CVE-2006-2238

Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted BMP file that triggers the overflow in the ReadBMP function. NOTE: this issue…

CVSS: 7.5 CWE: CWE-119
Read more
Medium

CVE-2006-1453

Stack-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickDraw PICT image format file containing malformed font information.

CVSS: 5.1 CWE: CWE-119
Read more
Medium

CVE-2006-1454

Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickDraw PICT image format file with malformed image data.

CVSS: 5.1 CWE: CWE-119
Read more
Medium

CVE-2006-1460

Multiple buffer overflows in Apple QuickTime before 7.1 allow remote attackers to execute arbitrary code via a crafted QuickTime movie (.MOV), as demonstrated via a large size for a udta Atom.

CVSS: 5.1 CWE: CWE-119
Read more
Medium

CVE-2006-1461

Multiple buffer overflows in Apple QuickTime before 7.1 allow remote attackers to execute arbitrary code via a crafted QuickTime Flash (SWF) file.

CVSS: 5.1 CWE: CWE-119
Read more
Medium

CVE-2006-1463

Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a H.264 (M4V) video format file with a certain modified size value.

CVSS: 5.1 CWE: CWE-119
Read more
Medium

CVE-2006-2341

The HTTP proxy in Symantec Gateway Security 5000 Series 2.0.1 and 3.0, and Enterprise Firewall 8.0, when NAT is being used, allows remote attackers to determine internal IP addresses by using malform…

CVSS: 5.0 CWE: CWE-200
Read more
High

CVE-2006-2315

PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the go_info[server][classes_root] paramete…

CVSS: 7.5 CWE: CWE-94
Read more
Medium

CVE-2006-2337

Directory traversal vulnerability in webcm in the D-Link DSL-G604T Wireless ADSL Router Modem allows remote attackers to read arbitrary files via an absolute path in the getpage parameter.

CVSS: 5.0 CWE: CWE-22
Read more
2006-05-11
High

CVE-2006-2301

SQL injection vulnerability in admin_default.asp in OzzyWork Galeri allows remote attackers to execute arbitrary SQL commands via the (1) Login or (2) password fields.

CVSS: 7.5 CWE: CWE-89
Read more
2006-05-10
Medium

CVE-2006-2297

Heap-based buffer overflow in Microsoft Infotech Storage System Library (itss.dll) allows user-assisted attackers to execute arbitrary code via a crafted CHM / ITS file that triggers the overflow whi…

CVSS: 4.0 CWE: CWE-119
Read more
High

CVE-2006-0034

Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3…

CVSS: 7.5 CWE: CWE-119
Read more
High

CVE-2006-2281

X-Scripts X-Poll (xpoll) 2.30 allows remote attackers to execute arbitrary PHP code by using admin/images/add.php to upload a PHP file, then access it.

CVSS: 7.5 CWE: CWE-94
Read more
Medium

CVE-2006-2286

Multiple PHP remote file inclusion vulnerabilities in claro_init_global.inc.php in Dokeos 1.6.3 and earlier, and Dokeos community release 2.0.3, allow remote attackers to execute arbitrary PHP code v…

CVSS: 6.8 CWE: CWE-94
Read more
2006-05-09
High

CVE-2006-2275

Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (deadlock) via a large number of small messages to a receiver application that cannot process the messages quick…

CVSS: 7.5 CWE: CWE-667
Read more
High

CVE-2006-2239

SQL injection vulnerability in readarticle.php in Newsadmin 1.1 allows remote attackers to execute arbitrary SQL commands via the nid parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2006-2245

PHP remote file inclusion vulnerability in auction\auction_common.php in Auction mod 1.3m for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 6.8 CWE: CWE-94
Read more
High

CVE-2006-2259

SQL injection vulnerability in Logon.asp in MaxxSchedule 1.0 allows remote attackers to execute arbitrary SQL commands via the txtLogon parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2006-2268

SQL injection vulnerability in FlexCustomer 0.0.4 and earlier allows remote attackers to bypass authentication and execute arbitrary SQL commands via the admin and ordinary user interface, probably i…

CVSS: 7.5 CWE: CWE-89
Read more
2006-05-05
Medium

CVE-2006-2223

RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly implement configurations that (1) disable RIPv1 or (2) require plaintext or MD5 authentication, which allows remote attackers to obtain…

CVSS: 5.0 CWE: CWE-20
Read more
Medium

CVE-2006-2224

RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly enforce RIPv2 authentication requirements, which allows remote attackers to modify routing state via RIPv1 RESPONSE packets.

CVSS: 5.0 CWE: CWE-287
Read more
2006-05-04
Medium

CVE-2006-2181

Multiple cross-site scripting (XSS) vulnerabilities in Albinator 2.0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) cid parameter to dlisting.php or (2) prelo…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2006-2180

Buffer overflow in Golden FTP Server Pro 2.70 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long argument to the (1) NLST or (2) APPE comma…

CVSS: 6.4 CWE: CWE-119
Read more
Medium

CVE-2006-2178

Multiple cross-site scripting (XSS) vulnerabilities in CyberBuild allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to login.asp, (2) ProductIndex paramete…

CVSS: 5.8 CWE: CWE-79
Read more
2006-05-03
High

CVE-2006-2157

SQL injection vulnerability in gallery.php in Plogger Beta 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter, when the level is set to "slideshow". NOTE:…

CVSS: 7.5 CWE: CWE-89
Read more
2006-05-01
High

CVE-2006-2128

Multiple SQL injection vulnerabilities in Pro Publish 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameter to (a) admin/login.php, (3) find_str pa…

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2006-2122

PHP remote file inclusion vulnerability in index.php in CoolMenus allows remote attackers to execute arbitrary code via a URL in the page parameter. NOTE: the original report for this issue is proba…

CVSS: 6.8 CWE: CWE-94
Read more
Medium

CVE-2006-2111

A component in Microsoft Outlook Express 6 allows remote attackers to bypass domain restrictions and obtain sensitive information via redirections with the mhtml: URI handler, as originally reported…

CVSS: 4.3 CWE: CWE-200
Read more
2006-04-29
Medium

CVE-2006-2084

Multiple cross-site scripting (XSS) vulnerabilities in FarsiNews 2.5.3 Pro and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) month and (2) year parameters in (a) i…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2006-2085

Multiple buffer overflows in (1) CxAce60.dll and (2) CxAce60u.dll in SpeedProject Squeez 5.10 Build 4460, and SpeedCommander 10.52 Build 4450 and 11.01 Build 4450, allow user-assisted remote attacker…

CVSS: 5.1 CWE: CWE-119
Read more
High

CVE-2006-2090

Multiple SQL injection vulnerabilities in misc.php in MySmartBB 1.1.x allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) username parameters.

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2006-2094

Microsoft Internet Explorer before Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, when Prompt is configured in Security Settings, uses modal dialogs to verify that a user wishes to…

CVSS: 5.1 CWE: CWE-362
Read more
Low

CVE-2006-2103

SQL injection vulnerability in MyBB (MyBulletinBoard) 1.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the (1) query string ($querystring variable) in (a) admin/…

CVSS: 2.1 CWE: CWE-89
Read more
High

CVE-2006-2108

parser.exe in Océ (OCE) 3121/3122 Printer allows remote attackers to cause a denial of service (crash or reboot) via a long request, possibly triggering a buffer overflow.

CVSS: 7.8 CWE: CWE-119
Read more
2006-04-27
Medium

CVE-2006-2066

Multiple cross-site scripting (XSS) vulnerabilities pm_popup.php in MKPortal 1.1 Rc1 and earlier, as used with vBulletin 3.5.4 and earlier, allow remote attackers to inject arbitrary web script or HT…

CVSS: 4.3 CWE: CWE-79
Read more
2006-04-26
Medium

CVE-2006-2057

Argument injection vulnerability in Mozilla Firefox 1.0.6 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto:…

CVSS: 5.0 CWE: CWE-88
Read more
Medium

CVE-2006-2058

Argument injection vulnerability in Avant Browser 10.1 Build 17 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a m…

CVSS: 5.0 CWE: CWE-88
Read more
Medium

CVE-2006-2055

Argument injection vulnerability in Microsoft Outlook 2003 SP1 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a ma…

CVSS: 5.0 CWE: CWE-88
Read more
Medium

CVE-2006-2056

Argument injection vulnerability in Internet Explorer 6 for Windows XP SP2 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) charac…

CVSS: 5.0 CWE: CWE-88
Read more
2006-04-25
Medium

CVE-2006-2026

Double free vulnerability in tif_jpeg.c in libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image th…

CVSS: 6.5 CWE: CWE-119
Read more
Medium

CVE-2006-1513

Multiple buffer overflows in abc2ps before 1.3.3 allow user-assisted attackers to execute arbitrary code via crafted ABC music files.

CVSS: 5.1 CWE: CWE-119
Read more
Low

CVE-2006-2016

Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dn parameter in (a) compare_form.php, (…

CVSS: 2.6 CWE: CWE-79
Read more
Low

CVE-2006-1057

Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority file.

CVSS: 3.7 CWE: CWE-362
Read more
2006-04-21
High

CVE-2006-1865

Argument injection vulnerability in Beagle before 0.2.5 allows attackers to execute arbitrary commands via crafted filenames that inject command line arguments when Beagle launches external helper ap…

CVSS: 7.5 CWE: CWE-88
Read more
High

CVE-2006-1978

SQL injection vulnerability in inc/start.php in FlexBB 0.5.5 and earlier allows remote attackers to execute arbitrary SQL commands via the flexbb_username COOKIE parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2006-1982

Heap-based buffer overflow in the LZWDecodeVector function in Mac OS X before 10.4.6, as used in applications that use ImageIO or AppKit, allows remote attackers to execute arbitrary code via crafted…

CVSS: 7.5 CWE: CWE-119
Read more
Medium

CVE-2006-1983

Multiple heap-based buffer overflows in Mac OS X 10.4.6 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) PredictorVSetField function for…

CVSS: 6.4 CWE: CWE-119
Read more
Medium

CVE-2006-1985

Heap-based buffer overflow in BOM BOMArchiveHelper 10.4 (6.3) Build 312, as used in Mac OS X 10.4.6 and earlier, allows user-assisted attackers to execute arbitrary code via a crafted archive (such a…

CVSS: 5.1 CWE: CWE-119
Read more
High

CVE-2006-1962

SQL injection vulnerability in PCPIN Chat 5.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username field (login parameter) to main.php.

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2006-1957

The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to cause a denial of service (disk consumption and possibly web-server outage) via multiple requests with different v…

CVSS: 5.0 CWE: CWE-20
Read more
2006-04-20
Low

CVE-2006-1918

Multiple cross-site scripting (XSS) vulnerabilities in Papoo 2.1.5 allow remote attackers to inject arbitrary web script or HTML via the menuid parameter to (1) index.php or (2) forum.php, or the (3)…

CVSS: 2.6 CWE: CWE-79
Read more
High

CVE-2006-1868

Buffer overflow in the Advanced Replication component in Oracle Database Server 10.1.0.4 allows database users to execute arbitrary code via the VERIFY_LOG procedure of the DBMS_SNAPSHOT_UTL package,…

CVSS: 7.5 CWE: CWE-119
Read more
Medium

CVE-2006-1871

SQL injection vulnerability in Oracle Database Server 9.2.0.7 and 10.1.0.5 allows remote attackers to execute arbitrary SQL commands via the DELETE_FROM_TABLE function in the DBMS_LOGMNR_SESSION (Log…

CVSS: 6.5 CWE: CWE-89
Read more
High

CVE-2006-1890

Multiple PHP remote file inclusion vulnerabilities in myWebland myEvent 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the myevent_path parameter in (1) event.php and (2) initi…

CVSS: 7.5 CWE: CWE-94
Read more
Medium

CVE-2006-1896

Unspecified vulnerability in phpBB allows remote authenticated users with Administration Panel access to execute arbitrary PHP code via crafted Font Colour 3 ($theme[fontcolor3] variable) and/or sign…

CVSS: 6.0 CWE: CWE-94
Read more
Low

CVE-2006-1898

Multiple cross-site scripting (XSS) vulnerabilities in Ralph Capper Tiny PHP Forum (TPF) 3.6 allow remote attackers to inject arbitrary web script or HTML via (1) the uname parameter in a view action…

CVSS: 2.6 CWE: CWE-79
Read more
Low

CVE-2006-1902

fold_binary in fold-const.c in GNU Compiler Collection (gcc) 4.1 improperly handles pointer overflow when folding a certain expr comparison to a corresponding offset comparison in cases other than EQ…

CVSS: 2.1 CWE: CWE-119
Read more
2006-04-19
Low

CVE-2006-1247

rm_mlcache_file in bos.rte.install in AIX 5.1.0 through 5.3.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.

CVSS: 3.3 CWE: CWE-59
Read more
Medium

CVE-2006-1840

Multiple format string vulnerabilities in Empire Server before 4.3.1 allow attackers to cause a denial of service (crash) via the (1) load, (2) spy and (3) bomb functions.

CVSS: 6.4 CWE: CWE-134
Read more
2006-04-18
Medium

CVE-2006-0744

Linux kernel before 2.6.16.5 does not properly handle uncanonical return addresses on Intel EM64T CPUs, which reports an exception in the SYSRET instead of the next instruction, which causes the kern…

CVSS: 4.9 CWE: CWE-20
Read more
Medium

CVE-2006-1826

Multiple cross-site scripting (XSS) vulnerabilities in Snipe Gallery 3.1.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gallery_id parameter in view.php, (2)…

CVSS: 4.3 CWE: CWE-79
Read more
2006-04-14
Medium

CVE-2006-1741

Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by (1) "using a mo…

CVSS: 4.3 CWE: CWE-79
Read more
Critical

CVE-2006-1739

The CSS border-rendering code in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial…

CVSS: 9.3 CWE: CWE-119
Read more
Medium

CVE-2006-1729

Mozilla Firefox 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to read arbitrary files by (1) inserting the target filename…

CVSS: 4.3 CWE: CWE-20
Read more
Medium

CVE-2006-1731

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the global window object whe…

CVSS: 4.3 CWE: CWE-79
Read more
2006-04-13
High

CVE-2006-1781

PHP remote file inclusion vulnerability in functions.php in Circle R Monster Top List (MTL) 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter. NOTE: It w…

CVSS: 7.5 CWE: CWE-94
Read more
Medium

CVE-2006-1760

Multiple cross-site scripting (XSS) vulnerabilities in JetPhoto allow remote attackers to inject arbitrary web script or HTML via the page parameter in (1) Classic.view/thumbnail.php, (2) Classic.vie…

CVSS: 4.3 CWE: CWE-79
Read more
2006-04-12
Medium

CVE-2006-1746

Directory traversal vulnerability in PHPList 2.10.2 and earlier allows remote attackers to include arbitrary local files via the (1) GLOBALS[database_module] or (2) GLOBALS[language_module] parameter…

CVSS: 5.0 CWE: CWE-22
Read more
High

CVE-2006-1749

PHP remote file inclusion vulnerability in config.php in phpListPro 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the returnpath parameter. NOTE: this issue was later rep…

CVSS: 7.5 CWE: CWE-94
Read more
Low

CVE-2006-1750

Multiple cross-site scripting (XSS) vulnerabilities in index.php in Autogallery 0.41 allow remote attackers to inject arbitrary web script or HTML via the (1) pic or (2) show parameters.

CVSS: 2.6 CWE: CWE-79
Read more
High

CVE-2006-1751

Multiple SQL injection vulnerabilities in MvBlog before 1.6 allow remote attackers to execute arbitrary SQL commands via unknown vectors.

CVSS: 7.5 CWE: CWE-89
Read more
2006-04-11
Critical

CVE-2006-1189

Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with an International Domain Name (IDN) using double-by…

CVSS: 10.0 CWE: CWE-119
Read more
Low

CVE-2006-1192

Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via unknown methods that allow "window conte…

CVSS: 2.6 CWE: CWE-20
Read more
Low

CVE-2006-1721

digestmd5.c in the CMU Cyrus Simple Authentication and Security Layer (SASL) library 2.1.18, and possibly other versions before 2.1.21, allows remote unauthenticated attackers to cause a denial of se…

CVSS: 2.6 CWE: CWE-20
Read more
High

CVE-2006-1060

Heap-based buffer overflow in zgv before 5.8 and xzgv before 0.8 might allow user-assisted attackers to execute arbitrary code via a JPEG image with more than 3 output components, such as a CMYK or Y…

CVSS: 7.5 CWE: CWE-119
Read more
High

CVE-2006-1688

Multiple PHP remote file inclusion vulnerabilities in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party (ALP), allow remote attackers to execute arbitrary PHP code via a URL in…

CVSS: 7.5 CWE: CWE-94
Read more