CVE Daily
← All years

Uncategorized 2006

Page 47/49.

CVEs without a recognized CWE (not present in the CWE map or marked as N/A).

CVSS ≥ 0.0
2006-02-01
Medium

CVE-2006-0487

Multiple unspecified vulnerabilities in Tumbleweed MailGate Email Firewall (EMF) 6.x allow remote attackers to (1) trigger temporarily incorrect processing of an e-mail message under "extremely heavy…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0486

Certain Cisco IOS releases in 12.2S based trains with maintenance release number 25 and later, 12.3T based trains, and 12.4 based trains reuse a Tcl Shell process across login sessions of different l…

CVSS: 4.6CWE: N/A
Read more
Medium

CVE-2006-0485

The TCL shell in Cisco IOS 12.2(14)S before 12.2(14)S16, 12.2(18)S before 12.2(18)S11, and certain other releases before 25 January 2006 does not perform Authentication, Authorization, and Accounting…

CVSS: 4.6CWE: N/A
Read more
2006-01-31
High

CVE-2006-0483

Cisco VPN 3000 series concentrators running software 4.7.0 through 4.7.2.A allow remote attackers to cause a denial of service (device reload or user disconnect) via a crafted HTTP packet.

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2006-0484

Directory traversal vulnerability in Vis.pl, as part of the FACE CONTROL product, allows remote attackers to read arbitrary files via a .. (dot dot) in any parameter that opens a file, such as (1) s…

CVSS: 5.0CWE: N/A
Read more
Low

CVE-2006-0482

Linux kernel 2.6.15.1 and earlier, when running on SPARC architectures, allows local users to cause a denial of service (hang) via a "date -s" command, which causes invalid sign extended arguments to…

CVSS: 2.1CWE: N/A
Read more
Medium

CVE-2006-0475

PHP-Ping 1.3 does not properly validate ping counts, which allows remote attackers to cause a denial of service (ping flood) via a negative count parameter.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0480

Cross-site scripting (XSS) vulnerability in the Articles module in sPaiz-Nuke allows remote attackers to inject arbitrary web script or HTML via the query parameter in the search file.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0479

pmwiki.php in PmWiki 2.1 beta 20, with register_globals enabled, allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GPC variable and a GLOBALS[…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2006-0477

Buffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to execute arbitrary code via an index file with a long symbolic link.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-0476

Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field).

CVSS: 7.6CWE: N/A
Read more
High

CVE-2006-0478

CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php. NOTE: the vendor states "The initial annou…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-0474

Multiple integer overflows in Shareaza 2.2.1.0 allow remote attackers to execute arbitrary code via (1) a large packet length field, which causes an overflow in the ReadBuffer function in (a) BTPacke…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0470

Cross-site scripting (XSS) vulnerability in search.php in MyBulletinBoard (MyBB) 1.02 allows remote attackers to inject arbitrary web script or HTML via the (1) sortby and (2) sortordr parameters, wh…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0472

Cross-site scripting (XSS) vulnerability in guestbook.php in my little homepage my little guestbook, as last modified in March 2004, allows remote attackers to inject arbitrary Javascript via a javas…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0471

Cross-site scripting (XSS) vulnerability in the bbcode function in functions.php in my little homepage my little forum, as last modified in June 2005, allows remote attackers to inject arbitrary Java…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0473

Cross-site scripting (XSS) vulnerability in the bbcode function in weblog.php in my little homepage my little weblog, as last modified in April 2004, allows remote attackers to inject arbitrary Javas…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0043

Buffer overflow in the realpath function in nfs-server rpc.mountd, as used in SUSE Linux 9.1 through 10.0, allows local users to execute arbitrary code via unspecified vectors involving mount request…

CVSS: 4.6CWE: N/A
Read more
Medium

CVE-2006-0467

Unspecified vulnerability in Pioneers (formerly gnocatan) before 0.9.49 allows remote attackers to cause a denial of service (application crash) via long chat messages.

CVSS: 5.0CWE: N/A
Read more
2006-01-30
High

CVE-2006-0468

CommuniGate Pro Core Server before 5.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via LDAP messages with negative BER lengths, and possibly oth…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0469

Cross-site scripting (XSS) vulnerability in UebiMiau 2.7.9, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of…

CVSS: 4.3CWE: N/A
Read more
2006-01-27
High

CVE-2006-0464

Multiple SQL injection vulnerabilities in index.php in IdeoContent Manager allow remote attackers to execute arbitrary SQL commands via the (1) goto_id or (2) mid parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0466

Cross-site scripting (XSS) vulnerability in search.asp in Goldstag Content Management System allows remote attackers to inject arbitrary web script or HTML via the text parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0465

Cross-site scripting (XSS) vulnerability in risultati_ricerca.php in active121 Site Manager allows remote attackers to inject arbitrary web script or HTML via the cerca parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0461

Cross-site scripting (XSS) vulnerability in core.input.php in ExpressionEngine 1.4.1 allows remote attackers to inject arbitrary web script or HTML via HTTP_REFERER (referer).

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0463

Cross-site scripting (XSS) vulnerability in IdeoContent Manager allows remote attackers to inject arbitrary web script or HTML via the (1) goto_id parameter to index.php or (2) page parameter to news…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2006-0462

SQL injection vulnerability in comentarios.php in AndoNET Blog 2004.09.02 allows remote attackers to execute arbitrary SQL commands via the entrada parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-0057

Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to bypass the Kill bit settings for dangerous ActiveX controls via unknown vectors involving crafted HTML, which can expose the br…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0450

phpBB 2.0.19 and earlier allows remote attackers to cause a denial of service (application crash) by (1) registering many users through profile.php or (2) using search.php to search in a certain way…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0449

Early termination vulnerability in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allows remote attackers to cause a denial of service (infinite loop) by sending an APPEND command and dis…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2006-0448

Multiple directory traversal vulnerabilities in (1) EPSTIMAP4S.EXE and (2) SPA-IMAP4S.EXE in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allow remote attackers to (a) list arbitrary di…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-0447

Multiple buffer overflows in E-Post Mail Server 4.10 and SPA-PRO Mail @Solomon 4.00 allow remote attackers to execute arbitrary code via a long username to the (1) AUTH PLAIN or (2) AUTH LOGIN SMTP c…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0446

Unspecified vulnerability in WeBWorK 2.1.3 and 2.2-pre1 allows remote privileged attackers to execute arbitrary commands as the web server via unknown attack vectors.

CVSS: 6.5CWE: N/A
Read more
2006-01-26
Medium

CVE-2006-0439

Text Rider 2.4 stores sensitive data in the data directory under the web document root with insufficient access control, which allows remote attackers to obtain usernames and password hashes by direc…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0440

Text Rider 2.4 allows attackers to bypass authentication and upload files without providing a valid password by obtaining the MD5 hash of the password (possibly via another vulnerability that reads i…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2006-0441

Stack-based buffer overflow in Sami FTP Server 2.0.1 allows remote attackers to execute arbitrary code via a long USER command, which triggers the overflow when the log is viewed.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0443

Cross-site scripting (XSS) vulnerability in archive.php in CheesyBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) realname and (2) comment parameters, or (3) via a…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0444

SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page…

CVSS: 6.8CWE: N/A
Read more
Medium

CVE-2006-0445

index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by "\", which will displa…

CVSS: 4.0CWE: N/A
Read more
High

CVE-2006-0436

Unspecified vulnerability in HP HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain privileges via unknown attack vectors.

CVSS: 7.2CWE: N/A
Read more
High

CVE-2006-0435

Unspecified vulnerability in Oracle PL/SQL (PLSQL), as used in Database Server DS 9.2.0.7 and 10.1.0.5, Application Server 1.0.2.2, 9.0.4.2, 10.1.2.0.2, 10.1.2.1.0, and 10.1.3.0.0, E-Business Suite a…

CVSS: 7.5CWE: N/A
Read more
2006-01-25
Low

CVE-2006-0432

Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to add custom security policies, causes incorrect policies to…

CVSS: 2.1CWE: N/A
Read more
Low

CVE-2006-0431

Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server's SSL identity via unknown attack vectors.

CVSS: 2.1CWE: N/A
Read more
Medium

CVE-2006-0430

Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are enabled, cause the server to run more slowly, which makes it…

CVSS: 5.0CWE: N/A
Read more
Low

CVE-2006-0429

BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have not been activated by a server reboot, which could cause an administrator to perform inap…

CVSS: 2.1CWE: N/A
Read more
High

CVE-2006-0426

BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorde…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-0428

Unspecified vulnerability in BEA WebLogic Portal 8.1 SP3 through SP5, when using Web Services Remote Portlets (WSRP), allows remote attackers to access restricted web resources via crafted URLs.

CVSS: 7.5CWE: N/A
Read more
Low

CVE-2006-0427

Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing function…

CVSS: 2.1CWE: N/A
Read more
High

CVE-2006-0423

BEA WebLogic Portal 8.1 through SP3 stores the password for the RDBMS Authentication provider in cleartext in the config.xml file, which allows attackers to gain privileges.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0425

BEA WebLogic Portal 8.1 through SP4 allows remote attackers to obtain the source for a deployment descriptor file via unknown vectors.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0422

Multiple unspecified vulnerabilities in BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allow remote attackers to access MBean attributes or cause an un…

CVSS: 6.4CWE: N/A
Read more
Medium

CVE-2006-0421

By design, BEA WebLogic Server and WebLogic Express 7.0 and 6.1, when creating multiple domains from the same WebLogic instance on the same machine, allows administrators of any created domain to acc…

CVSS: 4.6CWE: N/A
Read more
Medium

CVE-2006-0420

BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when servlets use relative forwarding, which allows remote attackers to cause a denial of service…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0419

BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which allows remote attackers to read user entries or cause a de…

CVSS: 6.4CWE: N/A
Read more
Medium

CVE-2006-0424

BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allows remote authenticated guest users to read the server log and obtain sensitive configuration inform…

CVSS: 4.0CWE: N/A
Read more
Low

CVE-2006-0379

FreeBSD kernel 5.4-STABLE and 6.0 does not completely initialize a buffer before making it available to userland, which could allow local users to read portions of kernel memory.

CVSS: 2.1CWE: N/A
Read more
Low

CVE-2006-0380

A logic error in FreeBSD kernel 5.4-STABLE and 6.0 causes the kernel to calculate an incorrect buffer length, which causes more data to be copied to userland than intended, which could allow local us…

CVSS: 2.1CWE: N/A
Read more
Medium

CVE-2006-0381

A logic error in the IP fragment cache functionality in pf in FreeBSD 5.3, 5.4, and 6.0, and OpenBSD, when a 'scrub fragment crop' or 'scrub fragment drop-ovl' rule is being used, allows remote attac…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0415

Cross-site scripting (XSS) vulnerability in index.php in SleeperChat 0.3f and earlier allows remote attackers to inject arbitrary web script or HTML via the pseudo parameter.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2006-0418

Eval injection vulnerability in 123 Flash Chat Server 5.0 and 5.1 allows attackers to execute arbitrary code via a crafted username.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-0417

SQL injection vulnerability in login.php in miniBloggie 1.0 and earlier, when gpc_magic_quotes is disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0225

scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.

CVSS: 4.6CWE: N/A
Read more
Medium

CVE-2006-0414

Tor before 0.1.1.20 allows remote attackers to identify hidden services via a malicious Tor server that attempts a large number of accesses of the hidden service, which eventually causes a circuit to…

CVSS: 5.0CWE: N/A
Read more
Critical

CVE-2006-0411

claro_init_local.inc.php in Claroline 1.7.2 uses guessable session cookies (MD5 hash of connection time), which allows remote attackers to hijack sessions and possibly gain administrative privileges.

CVSS: 10.0CWE: N/A
Read more
Medium

CVE-2006-0407

Cross-site scripting (XSS) vulnerability in post.php in AZ Bulletin Board (AZbb) 1.1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) nickname parameter and (…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0410

SQL injection vulnerability in ADOdb before 4.71, when using PostgreSQL, allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors involving binary strings.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0409

Cross-site scripting (XSS) vulnerability in index.php in Pixelpost Photoblog 1.4.3 allows remote attackers to inject arbitrary web script or HTML via the "Add Comment" field in a comment popup.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2006-0408

rsh utility in Sun Grid Engine (SGE) before 6.0u7_1 allows local users to gain privileges and execute arbitrary code via unspecified vectors, possibly involving command line arguments.

CVSS: 7.2CWE: N/A
Read more
Medium

CVE-2006-0405

The TIFFFetchShortPair function in tif_dirread.c in libtiff 3.8.0 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a NULL pointer derefe…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0406

search.php in MyBB 1.0.2 allows remote attackers to obtain sensitive information via a certain search request that reveals the table prefix in a SQL error message, possibly due to invalid parameters.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0404

Note-A-Day Weblog 2.2 stores sensitive data under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to archive…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2006-0402

SQL injection vulnerability in Zoph before 0.5pre1 allows remote attackers to execute arbitrary SQL commands.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0224

Buffer overflow in Library of Assorted Spiffy Things (LibAST) 0.6.1 and earlier, as used in Eterm and possibly other software, allows local users to execute arbitrary code as the utmp user via a long…

CVSS: 4.6CWE: N/A
Read more
2006-01-23
High

CVE-2006-0036

ip_nat_pptp in the PPTP NAT helper (netfilter/ip_nat_helper_pptp.c) in Linux kernel 2.6.14, and other versions, allows remote attackers to cause a denial of service (memory corruption or crash) via a…

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2006-0037

ip_nat_pptp in the PPTP NAT helper (netfilter/ip_nat_helper_pptp.c) in Linux kernel 2.6.14, and other versions, allows local users to cause a denial of service (memory corruption or crash) via a craf…

CVSS: 4.9CWE: N/A
Read more
Medium

CVE-2006-0378

Cross-site scripting (XSS) vulnerability in Netrix X-Site Manager allows remote attackers to inject arbitrary web script or HTML via the product_id parameter, as originally demonstrated for a custom…

CVSS: 4.3CWE: N/A
Read more
2006-01-22
Medium

CVE-2006-0366

Cross-site scripting (XSS) vulnerability in Phpclanwebsite (aka PCW) allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a BBCode img tag.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2006-0376

The 802.11 wireless client in certain operating systems including Windows 2000, Windows XP, and Windows Server 2003 does not warn the user when (1) it establishes an association with a station in ad…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0375

Advantage Century Telecommunication (ACT) P202S IP Phone 1.01.21 running firmware 1.1.21 on VxWorks uses a hardcoded Network Time Protocol (NTP) server in Taiwan, which could allow remote attackers t…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0373

Cross-site scripting (XSS) vulnerability in register.aspx in Douran FollowWeb allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NOTE: the provenance of this…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2006-0372

Multiple SQL injection vulnerabilities in config.php in Insane Visions BlogPHP, possibly 1.0, allow remote attackers to execute arbitrary SQL commands via the (1) blogphp_username or (2) blogphp_pass…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0371

Directory traversal vulnerability in index.php in Noah Medling RCBlog 1.03 allows remote attackers to read arbitrary .txt files, possibly including one that stores the administrator's account name an…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0370

Noah Medling RCBlog 1.03 stores the data and config directories under the web root with insufficient access control, which allows remote attackers to view account names and MD5 password hashes.

CVSS: 5.0CWE: N/A
Read more
High

CVE-2006-0368

Cisco CallManager 3.2 and earlier, 3.3 before 3.3(5)SR1, 4.0 before 4.0(2a)SR2c, and 4.1 before 4.1(3)SR2 allow remote attackers to (1) cause a denial of service (CPU and memory consumption) via a la…

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2006-0367

Unspecified vulnerability in Cisco CallManager 3.2 and earlier, 3.3 before 3.3(5)SR1, 4.0 before 4.0(2a)SR2c, and 4.1 before 4.1(3)SR2 allows remote authenticated users with read-only administrative…

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2006-0357

Grant Averett Cerberus FTP Server 2.32, and possibly earlier versions, allows remote attackers to cause an unspecified denial of service via a long string that does not contain a valid FTP command.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0365

Cross-site scripting (XSS) vulnerability in XMB (aka extreme message board) allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an IMG element.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0362

TippingPoint Intrusion Prevention System (IPS) TOS before 2.1.4.6324, and TOS 2.2.x before 2.2.1.6506, allow remote attackers to cause a denial of service (CPU consumption) via an unknown vector, pro…

CVSS: 5.0CWE: CWE-399
Read more
Medium

CVE-2006-0361

Cross-site scripting (XSS) vulnerability in addcomment.php in Bit 5 Blog 8.01 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in an <a> tag in the comment paramete…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0360

MPM SIP HP-180W Wireless IP Phone WE.00.17 allows remote attackers to obtain sensitive information and possibly cause a denial of service via a direct connection to UDP port 9090, which is undocument…

CVSS: 6.4CWE: N/A
Read more
High

CVE-2006-0358

Multiple SQL injection vulnerabilities in PowerPortal, possibly 1.1 beta through 1.3, allow remote attackers to execute arbitrary SQL commands via the search parameter in (1) index.php and (2) search…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0356

Ari Pikivirta Home Ftp Server 1.0.7 allows remote attackers to cause an unspecified denial of service via a long USER command combined with a long PASS command.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0355

Helmsman Research (aka CoolUtils) HomeFtp 1.1 allows remote attackers to cause an unspecified denial of service via a long USER command combined with a long PASS command and an NLST command.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0354

Cisco IOS before 12.3-7-JA2 on Aironet Wireless Access Points (WAP) allows remote authenticated users to cause a denial of service (termination of packet passing or termination of client connections)…

CVSS: 5.5CWE: CWE-399
Read more
Low

CVE-2006-0363

The "Remember my Password" feature in MSN Messenger 7.5 stores passwords in an encrypted format under the HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds registry key, which might allow local…

CVSS: 2.1CWE: N/A
Read more
2006-01-21
High

CVE-2006-0349

SQL injection vulnerability in eggblog 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to blog.php.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0352

The default configuration of Fluffington FLog 1.01 installs users.0.dat under the web document root with insufficient access control, which might allow remote attackers to obtain sensitive informatio…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0351

Unspecified "critical denial-of-service vulnerability" in MyDNS before 1.1.0 has unknown impact and attack vectors.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0350

Cross-site scripting (XSS) vulnerability in eggblog 2.0 allow remote attackers to inject arbitrary web script or HTML via the message field to topic.php.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0348

Format string vulnerability in the write_logfile function in ELOG before 2.6.1 allows remote attackers to cause a denial of service (server crash) via unknown attack vectors. NOTE: the provenance of…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0347

Directory traversal vulnerability in ELOG before 2.6.1 allows remote attackers to access arbitrary files outside of the elog directory via "../" (dot dot) sequences in the URL.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0346

Cross-site scripting (XSS) vulnerability in SaralBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via a website field in a new comment to view.php, which is not properly handle…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2006-0345

Multiple SQL injection vulnerabilities in SaralBlog 1.0 allow remote attackers to execute arbitrary SQL commands via the search parameter to search.php. NOTE: the id/viewprofile.php issue is already…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0344

Directory traversal vulnerability in Intervations FileCOPA FTP Server 1.01 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the (1) STOR and (2) RETR commands.

CVSS: 6.4CWE: N/A
Read more
Medium

CVE-2006-0343

Unspecified vulnerability in the Port Discovery Standard and Advanced features in Hitachi JP1/NetInsight II allows attackers to stop the Port Discovery service via unknown vectors involving "invalid…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2006-0342

RockLiffe MailSite HTTP Mail management agent (httpma) 7.0.3.1 allows remote attackers to cause a denial of service (CPU consumption and crash) via a malformed query string containing special charact…

CVSS: 7.8CWE: CWE-399
Read more
Medium

CVE-2006-0336

Kerio WinRoute Firewall before 6.1.4 Patch 2 allows attackers to cause a denial of service (CPU consumption and hang) via unknown vectors involving "browsing the web".

CVSS: 5.0CWE: N/A
Read more
High

CVE-2006-0339

Buffer overflow in BitComet Client 0.60 allows remote attackers to execute arbitrary code, when the publisher's name link is clicked, via a long publisher URI in a torrent file.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0338

Multiple F-Secure Anti-Virus products and versions for Windows and Linux, including Anti-Virus for Windows Servers 5.52 and earlier, Internet Security 2004, 2005 and 2006, and Anti-Virus for Linux Se…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2006-0337

Buffer overflow in multiple F-Secure Anti-Virus products and versions for Windows and Linux, including Anti-Virus for Windows Servers 5.52 and earlier, Internet Security 2004, 2005 and 2006, and Anti…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0330

Cross-site scripting (XSS) vulnerability in Gallery before 1.5.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, possibly involving the user name (fullname).

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0335

Multiple unspecified vulnerabilities in Kerio WinRoute Firewall before 6.1.4 Patch 1 allow remote attackers to cause a denial of service via multiple unspecified vectors involving (1) long strings re…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2006-0329

SQL injection vulnerability in HITSENSER Data Mart Server BS, BS-S, BS-M, BS-L, and EX allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0334

Cross-site scripting (XSS) vulnerability in search.php in My Amazon Store Manager 1.0 allows remote attackers to inject arbitrary web script or HTML via the Keywords parameter. NOTE: some sources cl…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0328

Format string vulnerability in Tftpd32 2.81 allows remote attackers to cause a denial of service via format string specifiers in a filename in a (1) GET or (2) SEND request.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0327

TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php, (2) showpic.php, or (3) tables.php, which causes them to incorrectly define a variable and…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0331

Buffer overflow in Change passwd 3.1 (chpasswd) SquirrelMail plugin allows local users to execute arbitrary code via long command line arguments.

CVSS: 4.6CWE: N/A
Read more
Medium

CVE-2006-0333

Cross-site scripting (XSS) vulnerability in ar-blog 5.2 allows remote attackers to inject arbitrary web script or HTML via the (1) month or (2) year parameter to index.php.

CVSS: 4.3CWE: N/A
Read more
2006-01-20
High

CVE-2006-0019

Heap-based buffer overflow in the encodeURI and decodeURI functions in the kjs JavaScript interpreter engine in KDE 3.2.0 through 3.5.0 allows remote attackers to execute arbitrary code via a crafted…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-0045

crawl before 4.0.0 does not securely call programs when saving and loading games, which allows local users to gain privileges.

CVSS: 7.2CWE: N/A
Read more
>