CVE Daily
← All years

Uncategorized 2006

Page 2/49.

CVEs without a recognized CWE (not present in the CWE map or marked as N/A).

CVSS ≥ 0.0
2006-12-28
High

CVE-2006-6807

SQL injection vulnerability in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the agent parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6806

SQL injection vulnerability in newsdetail.asp in Enthrallweb eMates 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6805

SQL injection vulnerability in newsdetail.asp in Enthrallweb eJobs allows remote attackers to execute arbitrary SQL commands via the ID parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6808

Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have r…

CVSS: 6.8CWE: N/A
Read more
High

CVE-2006-6803

SQL injection vulnerability in Types.asp in Enthrallweb eCars 1.0 allows remote attackers to execute arbitrary SQL commands via the Type_id parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6802

SQL injection vulnerability in actualpic.asp in Enthrallweb ePages allows remote attackers to execute arbitrary SQL commands via the Biz_ID parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6801

PHP remote file inclusion vulnerability in misc.php in SH-News 0.93, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the news_cfg[path] parameter.

CVSS: 6.8CWE: N/A
Read more
Medium

CVE-2006-6800

PHP remote file inclusion in eventcal/mod_eventcal.php in the event module 1.0 for Limbo CMS allows remote attackers to execute arbitrary PHP code via a URL in the lm_absolute_path parameter.

CVSS: 6.8CWE: N/A
Read more
High

CVE-2006-6799

SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6318

The show_elog_list function in elogd.c in elog 2.6.2 and earlier allows remote authenticated users to cause a denial of service (daemon crash) by attempting to access a logbook whose name begins with…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-6797

The Client Server Run-Time Subsystem (CSRSS) in Microsoft Windows allows local users to cause a denial of service (crash) or read arbitrary memory from csrss.exe via crafted arguments to the NtRaiseH…

CVSS: 6.6CWE: N/A
Read more
Medium

CVE-2006-6786

Open Newsletter 2.5 and earlier allows remote authenticated administrators to execute arbitrary PHP code by inserting the code into the email parameter to (1) subscribe.php or (2) unsubscribe.php.

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2006-6796

PHP remote file inclusion vulnerability in admin/admin_settings.php in MTCMS 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ins_file parameter.

CVSS: 6.8CWE: N/A
Read more
High

CVE-2006-6795

PHP remote file inclusion vulnerability in gallery/displayCategory.php in the My_eGallery 2.5.6 module in myPHPNuke (MPN) allows remote attackers to execute arbitrary PHP code via a URL in the basepa…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6794

SQL injection vulnerability in default.asp in Efkan Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the grup parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6793

PHP remote file inclusion vulnerability in ataturk.php in Okul Merkezi Portal 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6792

SQL injection vulnerability in calendar_detail.asp in Calendar MX BASIC 1.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter. NOTE: The provenance of this…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6790

Direct static code injection vulnerability in chat/login.php in Ultimate PHP Board (UPB) 2.0b1 and earlier allows remote attackers to inject arbitrary PHP code via the username parameter, which is in…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6788

Multiple PHP remote file inclusion vulnerabilities in LuckyBot 3 allow remote attackers to execute arbitrary PHP code via a URL in the dir parameter to (1) run.php or (2) ircbot.class.php.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6787

SQL injection vulnerability in admin/admin_mail_adressee.asp in Newsletter MX 1.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6791

SQL injection vulnerability in SelGruFra.asp in chatwm 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) txtUse and (2) txtPas parameters.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6785

The (1) settings.php and (2) subscribers.php scripts in Open Newsletter 2.5 and earlier do not exit when authentication fails, which allows remote attackers to perform unauthorized administrative act…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6779

Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin allows remote attackers to inject arbitrary web script or HTML via an SWF file that uses ActionScript to trigger execution of JavaScript.

CVSS: 6.8CWE: N/A
Read more
High

CVE-2006-6784

SQL injection vulnerability in Netbula Anyboard allows remote attackers to execute arbitrary SQL commands via the user name in the login form.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6776

Multiple SQL injection vulnerabilities in Future Internet allow remote attackers to execute arbitrary SQL commands via the (1) newsId or (2) categoryid parameter in a Portal.Showpage action in index.…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6777

Cross-site scripting (XSS) vulnerability in index.cfm in Future Internet allows remote attackers to inject arbitrary web script or HTML via the categoryId parameter in a Portal.ShowPage action.

CVSS: 6.8CWE: N/A
Read more
Medium

CVE-2006-6778

Cross-site scripting (XSS) vulnerability in shownews.php in TimberWolf 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the nid parameter.

CVSS: 6.8CWE: N/A
Read more
High

CVE-2006-6789

PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in Phpbbxtra 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6780

SQL injection vulnerability in the login form in HLstats 1.20 through 1.34 allows remote attackers to execute arbitrary SQL commands via the killLimit parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6781

HLstats 1.20 through 1.34 allows remote attackers to obtain sensitive information via playinfo mode, with certain values of the player and playerdata[lastName][] parameters, which reveals the path in…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-6782

Cross-site scripting (XSS) vulnerability in pnamazu 2006.02.28 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS: 6.8CWE: N/A
Read more
2006-12-27
Medium

CVE-2006-6769

Multiple cross-site scripting (XSS) vulnerabilities in PHP Live! 3.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) search_string parameter in (a) setup/trans…

CVSS: 6.8CWE: N/A
Read more
Medium

CVE-2006-6770

Multiple PHP remote file inclusion vulnerabilities in Jinzora Media Jukebox 2.7 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the in…

CVSS: 6.8CWE: N/A
Read more
Medium

CVE-2006-6771

Multiple PHP remote file inclusion vulnerabilities in Irokez CMS 0.7.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS…

CVSS: 6.8CWE: N/A
Read more
High

CVE-2006-6773

pages/register/register.php in Fishyshoop 0.930 beta allows remote attackers to create arbitrary administrative users by setting the is_admin HTTP POST parameter to 1.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6774

PHP remote file inclusion vulnerability in socios/maquetacion_socio.php (members/maquetacion_member.php) in Ciberia Content Federator 1.0 allows remote attackers to execute arbitrary PHP code via the…

CVSS: 6.8CWE: N/A
Read more
Low

CVE-2006-6775

acFTP 1.5 allows remote authenticated users to cause a denial of service via a crafted argument to the (1) REST or (2) PBSZ command.

CVSS: 3.5CWE: N/A
Read more
Medium

CVE-2006-6768

Multiple cross-site scripting (XSS) vulnerabilities in default.asp in PWP Technologies The Classified Ad System allow remote attackers to inject arbitrary web script or HTML via the (1) cat or (2) ma…

CVSS: 6.8CWE: N/A
Read more
Medium

CVE-2006-6761

Stack-based buffer overflow in the IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via a long argument to the SUBSCRIBE command.

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2006-6762

The IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to cause a denial of service via an APPEND command with a single "(" (parenthesis) in the argument.

CVSS: 4.0CWE: N/A
Read more
High

CVE-2006-6763

Multiple PHP remote file inclusion vulnerabilities in the Keep It Simple Guest Book (KISGB) allow remote attackers to execute arbitrary PHP code via a URL in the (1) path_to_themes parameter in (a) a…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6765

Multiple PHP file inclusion vulnerabilities in src/admin/pt_upload.php in Pagetool 1.07 allow remote attackers to execute arbitrary PHP code via (1) a local filename or FTP/share URI in the config_fi…

CVSS: 6.8CWE: N/A
Read more
High

CVE-2006-6766

Multiple SQL injection vulnerabilities in cwmExplorer 1.1.0 and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: The provenance of this information is…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6764

PHP remote file inclusion vulnerability in authenticate.php in Keep It Simple Guest Book (KISGB), when executing PHP through CGI, allows remote attackers to execute arbitrary PHP code via a URL in th…

CVSS: 6.8CWE: N/A
Read more
Critical

CVE-2006-6424

Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code (1) by appending literals to certain IMAP verbs when specifying command continuation req…

CVSS: 9.0CWE: N/A
Read more
Critical

CVE-2006-6425

Stack-based buffer overflow in the IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via unspecified vectors involving the APPEND com…

CVSS: 9.0CWE: N/A
Read more
Medium

CVE-2006-6753

Event Viewer (eventvwr.exe) in Microsoft Windows does not properly display log data that contains '%' (percent) characters, which might make it impossible to use Event Viewer to determine the actual…

CVSS: 4.1CWE: N/A
Read more
Medium

CVE-2006-6754

Multiple SQL injection vulnerabilities in Ixprim 1.2 allow remote attackers to execute arbitrary SQL commands via the story_id parameter to ixm_ixpnews.php, and unspecified other vectors.

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2006-6755

Ixprim 1.2 allows remote attackers to obtain sensitive information via a direct request for kernel/plugins/fckeditor2/ixprim_api.php, which reveals the path in an error message.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-6756

The code function in install.fct.php in Ixprim 1.2 produces a guessable value of the confidential IXP_CODE in mainfile.php, which might allow remote attackers to gain access to the administration pan…

CVSS: 5.1CWE: N/A
Read more
High

CVE-2006-6757

Directory traversal vulnerability in index.php in cwmExplorer 1.0 allows remote attackers to read arbitrary files and source code, and obtain sensitive information via directory traversal sequences i…

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2006-6758

Directory traversal vulnerability in Http explorer 1.02 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the URI.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-6759

A certain ActiveX control in rpau3260.dll in RealNetworks RealPlayer 10.5 allows remote attackers to cause a denial of service (Internet Explorer crash) by invoking the RealPlayer.Initialize method w…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2006-6752

Buffer overflow in FTPRush 1.0.0.610 might allow attackers to gain privileges via a long Host field. NOTE: The provenance of this information is unknown; the details are obtained solely from third p…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6750

Format string vulnerability in XM Easy Personal FTP Server 5.0.1 allows remote attackers to cause a denial of service (application crash) via format string specifiers in a long PORT command. NOTE: t…

CVSS: 5.0CWE: N/A
Read more
2006-12-26
Medium

CVE-2006-6730

OpenBSD and NetBSD permit usermode code to kill the display server and write to the X.Org /dev/xf86 device, which allows local users with root privileges to reduce securelevel by replacing the System…

CVSS: 6.6CWE: N/A
Read more
Medium

CVE-2006-6736

Unspecified vulnerability in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 6 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions,…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-6737

Unspecified vulnerability in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 5 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_10 and earlier 1.4.x versions,…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2006-6742

Multiple buffer overflows in FTP Print Server 2.4 and 2.4.5 in HP LaserJet 5000 Series printers with firmware R.25.15 or R.25.47, and HP LaserJet 5100 Series printers with firmware V.29.12, allow rem…

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2006-6743

phpProfiles before 2.1.1 uses world writable permissions for certain profile files and directories, which allows local users to modify or delete files, related to (1) users/include/do_makeprofile.inc…

CVSS: 4.6CWE: N/A
Read more
Low

CVE-2006-6744

phpProfiles before 2.1.1 does not have an index.php or other index file in the (1) image_data, (2) graphics/comm, or (3) users read/write directories, which might allow remote attackers to list direc…

CVSS: 2.1CWE: N/A
Read more
Critical

CVE-2006-6745

Multiple unspecified vulnerabilities in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and earlier, and Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier…

CVSS: 9.3CWE: N/A
Read more
Critical

CVE-2006-6731

Multiple buffer overflows in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions,…

CVSS: 9.3CWE: N/A
Read more
Medium

CVE-2006-6724

BolinTech Dream FTP Server 1.02 allows remote authenticated users, including anonymous users, to cause a denial of service (application crash) via a certain invalid PORT command.

CVSS: 4.0CWE: N/A
Read more
Medium

CVE-2006-6728

Unspecified vulnerability in the info request mechanism in LAN Messenger before 1.5.1.2 allows remote attackers to cause a denial of service (application crash) or transmit spam via unspecified vecto…

CVSS: 6.4CWE: N/A
Read more
High

CVE-2006-6723

The Workstation service in Microsoft Windows 2000 SP4 and XP SP2 allows remote attackers to cause a denial of service (memory consumption) via a large maxlen value in an NetrWkstaUserEnum RPC request.

CVSS: 7.8CWE: CWE-399
Read more
2006-12-23
Medium

CVE-2006-6719

The ftp_syst function in ftp-basic.c in Free Software Foundation (FSF) GNU wget 1.10.2 allows remote attackers to cause a denial of service (application crash) via a malicious FTP server with a large…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2006-6722

Bandwebsite (aka Bandsite portal system) 1.5 allows remote attackers to create administrative accounts via a direct request to admin.php with the Login parameter set to 1.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6721

Multiple cross-site scripting (XSS) vulnerabilities in shout.php in Knusperleicht ShoutBox 2.6 allow remote attackers to inject arbitrary web script or HTML via the (1) sbNick or (2) sbKommentar para…

CVSS: 6.8CWE: N/A
Read more
High

CVE-2006-6716

SQL injection vulnerability in administration/administre2.php in Eric GUILLAUME uploader&downloader 3 allows remote attackers to execute arbitrary SQL commands via the id_user parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6718

The Allied Telesis AT-9000/24 Ethernet switch has a default password for its admin account, "manager," which allows remote attackers to perform unauthorized actions.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6717

The Allied Telesis AT-9000/24 Ethernet switch accepts management packets from arbitrary VLANs, contrary to the documentation, which allows remote attackers to conduct attacks against the switch from…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6708

Cross-site scripting (XSS) vulnerability in listings.asp in MGinternet Property Site Manager allows remote attackers to inject arbitrary web script or HTML via the s parameter.

CVSS: 6.8CWE: N/A
Read more
High

CVE-2006-6714

Multiple memory leaks in Hitachi Directory Server 2 P-2444-A124 before 02-11-/K on Windows, and P-1B44-A121 before 02-10-/V on HP-UX, allow remote attackers to cause a denial of service (memory consu…

CVSS: 7.8CWE: N/A
Read more
Critical

CVE-2006-6713

Buffer overflow in Hitachi Directory Server 2 P-2444-A124 before 02-11-/K on Windows, and P-1B44-A121 before 02-10-/V on HP-UX, allows remote attackers to execute arbitrary code via crafted LDAP requ…

CVSS: 10.0CWE: N/A
Read more
Medium

CVE-2006-6712

Cross-site scripting (XSS) vulnerability in SugarCRM Open Source 4.5.0f and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in crafted email messages.

CVSS: 6.8CWE: N/A
Read more
High

CVE-2006-6711

PHP remote file inclusion vulnerability in compteur/mapage.php in Newxooper 0.9.1 allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6709

Multiple SQL injection vulnerabilities in MGinternet Property Site Manager allow remote attackers to execute arbitrary SQL commands via the (1) p parameter to (a) detail.asp; the (2) l, (3) typ, or (…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6715

PHP remote file inclusion vulnerability in footer.inc.php in PowerClan 1.14a and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the sett…

CVSS: 5.1CWE: N/A
Read more
High

CVE-2006-6707

Stack-based buffer overflow in the NeoTraceExplorer.NeoTraceLoader ActiveX control (NeoTraceExplorer.dll) in NeoTrace Express 3.25 and NeoTrace Pro (aka McAfee Visual Trace) 3.25 allows remote attack…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6700

Cross-site scripting (XSS) vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This information is based upon a vague initial…

CVSS: 6.8CWE: N/A
Read more
Medium

CVE-2006-6699

Multiple CRLF injection vulnerabilities in Oracle Portal 9.0.2 and possibly other versions allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-6704

Cross-site scripting (XSS) vulnerability in the Webadmin in @Mail before 4.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "unescaped data in the da…

CVSS: 6.8CWE: N/A
Read more
Medium

CVE-2006-6702

Cross-site scripting (XSS) vulnerability in Global.pm in @Mail before 4.61 allows remote attackers to inject arbitrary web script or HTML via crafted e-mail messages. NOTE: The provenance of this in…

CVSS: 6.8CWE: N/A
Read more
Medium

CVE-2006-6703

Multiple cross-site scripting (XSS) vulnerabilities in Oracle Portal 9i and 10g allow remote attackers to inject arbitrary JavaScript via the tc parameter in webapp/jsp/container_tabs.jsp, and other…

CVSS: 6.8CWE: N/A
Read more
2006-12-22
Low

CVE-2006-6698

The GConf daemon (gconfd) in GConf 2.14.0 creates temporary files under directories with names based on the username, even when GCONF_GLOBAL_LOCKS is not set, which allows local users to cause a deni…

CVSS: 1.9CWE: N/A
Read more
High

CVE-2006-6697

CRLF injection vulnerability in webapp/jsp/calendar.jsp in Oracle Portal 10g and earlier, including 9.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting…

CVSS: 7.5CWE: N/A
Read more
2006-12-21
Medium

CVE-2006-6686

PHP remote file inclusion vulnerability in sender.php in Carsen Klock TextSend 1.5 allows remote attackers to execute arbitrary PHP code via a URL in the ROOT_PATH parameter.

CVSS: 6.8CWE: N/A
Read more
High

CVE-2006-6690

rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6691

Multiple PHP remote file inclusion vulnerabilities in Valdersoft Shopping Cart 3.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the commonIncludePath parameter to (1)…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6692

Multiple format string vulnerabilities in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in i…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6693

Multiple buffer overflows in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via long strings to the (1) zabbix_log and (2)…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6694

Directory traversal vulnerability in include/config.php in E-Uploader Pro 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a .. (dot dot) in the language parameter, as demons…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6695

Multiple cross-site scripting (XSS) vulnerabilities in index.php in Carsen Klock TextSend 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) error or (2) success parameter.…

CVSS: 6.8CWE: N/A
Read more
High

CVE-2006-6688

Web Automated Perl Portal (WebAPP) 0.9.9.4, and 0.9.9.3.4 Network Edition (NE) (aka WebAPP.NET) allows remote attackers to bypass filtering mechanisms via unknown vectors. NOTE: The provenance of th…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6682

Pedro Lineu Orso chetcpasswd 2.3.3 provides a different error message when a request with a valid username fails, compared to a request with an invalid username, which allows remote attackers to dete…

CVSS: 5.0CWE: CWE-388
Read more
High

CVE-2006-6683

Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that processes /etc/shadow and does not follow the PAM configuration, which might allow remote attack…

CVSS: 7.8CWE: CWE-264
Read more
Medium

CVE-2006-6680

Pedro Lineu Orso chetcpasswd before 2.3.1 does not document the need for 0400 permissions on /etc/chetcpasswd.allow, which might allow local users to gain sensitive information by reading this file.

CVSS: 4.6CWE: N/A
Read more
High

CVE-2006-6681

Pedro Lineu Orso chetcpasswd 2.3.3 does not have a rate limit for client requests, which might allow remote attackers to determine passwords via a dictionary attack.

CVSS: 7.5CWE: CWE-399
Read more
Medium

CVE-2006-6104

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) t…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2006-6671

SQL injection vulnerability in down.asp in Burak Yylmaz Download Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6672

Multiple SQL injection vulnerabilities in Burak Yylmaz Download Portal allow remote attackers to execute arbitrary SQL commands via the (1) kid or possibly (2) id parameter to (a) HABERLER.ASP and (b…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6673

WinFtp Server 2.0.2 allows remote attackers to cause a denial of service (crash) via long (1) PASV, (2) LIST, (3) USER, (4) PORT, and possibly other commands.

CVSS: 5.0CWE: N/A
Read more
Low

CVE-2006-6674

Ozeki HTTP-SMS Gateway 1.0, and possibly earlier, stores usernames and passwords in plaintext in the HKLM\Software\Ozeki\SMSServer\CurrentVersion\Plugins\httpsmsgate registry key, which allows local…

CVSS: 2.1CWE: CWE-310
Read more
Medium

CVE-2006-6675

Cross-site scripting (XSS) vulnerability in Novell NetWare 6.5 Support Pack 5 and 6 and Novell Apache on NetWare 2.0.48 allows remote attackers to inject arbitrary web script or HTML via unspecified…

CVSS: 6.8CWE: N/A
Read more
Critical

CVE-2006-6676

Integer overflow in the (a) OLE2 and (b) CHM parsers for ESET NOD32 Antivirus before 1.1743 allows remote attackers to execute arbitrary code via a crafted (1) .DOC or (2) .CAB file that triggers a h…

CVSS: 9.3CWE: CWE-189
Read more
Low

CVE-2006-6677

ESET NOD32 Antivirus before 1.1743 allows remote attackers to cause a denial of service (crash) via a crafted .CHM file that triggers a divide-by-zero error.

CVSS: 2.6CWE: N/A
Read more
High

CVE-2006-6678

The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands…

CVSS: 7.5CWE: N/A
Read more
2006-12-20
Medium

CVE-2006-6665

Buffer overflow in Astonsoft DeepBurner Pro and Free 1.8.0 and earlier allows user-assisted remote attackers to execute arbitrary code via a long file name tag in a dbr file.

CVSS: 6.8CWE: N/A
Read more
Critical

CVE-2006-6670

Unspecified vulnerability in Nortel CallPilot 4.x Server has unknown impact and attack vectors, aka P-2006-0011-GLOBAL.

CVSS: 10.0CWE: N/A
Read more
Medium

CVE-2006-6669

Cross-site scripting (XSS) vulnerability in export_handler.php in WebCalendar 1.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter.

CVSS: 6.8CWE: N/A
Read more
Medium

CVE-2006-6668

Cross-site scripting (XSS) vulnerability in VerliAdmin 0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: The provenance of this informatio…

CVSS: 6.8CWE: N/A
Read more
High

CVE-2006-6666

PHP remote file inclusion vulnerability in index.php in VerliAdmin 0.3 and earlier allows remote authenticated users to execute arbitrary PHP code via a URL in the q parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-6667

Multiple SQL injection vulnerabilities in VerliAdmin 0.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) nick_mod or (2) nick parameter to (a) repass.php or (b) verif…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6664

Format string vulnerability in Marathon Aleph One before 0.17.1 and 2006-12-17 might allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via format strin…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-6663

The server component in Marathon Aleph One before 0.17.1 and 2006-12-17 allows remote attackers to cause a denial of service (application crash) via unspecified vectors related to "gathering net game…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-6662

Unspecified vulnerability in Linux User Management (novell-lum) on SUSE Linux Enterprise Desktop 10 and Open Enterprise Server 9, under unspecified conditions, allows local users to log in to the con…

CVSS: 4.1CWE: CWE-264
Read more
High

CVE-2006-6661

Variable overwrite vulnerability in blog.php in PHP-Update 2.7 and earlier allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code via multiple vectors that us…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-6660

The nodeType function in KDE libkhtml 4.2.0 and earlier, as used by Konquerer, KMail, and other programs, allows remote attackers to cause a denial of service (crash) via malformed HTML tags, possibl…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2006-6648

PHP remote file inclusion vulnerability in main.inc.php in planetluc.com RateMe 1.3.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pathtoscript parameter.

CVSS: 7.5CWE: N/A
Read more
>