CVE Daily
← All years

Uncategorized 2006

Page 48/49.

CVEs without a recognized CWE (not present in the CWE map or marked as N/A).

CVSS ≥ 0.0
2006-01-19
Medium

CVE-2006-0322

Unspecified vulnerability the edit comment formatting functionality in MediaWiki 1.5.x before 1.5.6 and 1.4.x before 1.4.14 allows attackers to cause a denial of service (infinite loop) via "certain…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2006-0324

SQL injection vulnerability in WebspotBlogging 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter to login.php.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-0314

PDFdirectory before 1.0 stores sensitive data in plaintext, which allows remote attackers to obtain arbitrary users' passwords by direct queries to the database, possibly via one of the SQL injection…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-0320

SQL injection vulnerability in admin/processlogin.php in Bit 5 Blog 8.01 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password para…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0319

Directory traversal vulnerability in the FTP server (port 22003/tcp) in Farmers WIFE 4.4 SP1 allows remote attackers to create arbitrary files via ".." (dot dot) sequences in a (1) PUT, (2) SIZE, and…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0317

Cross-site scripting (XSS) vulnerability in rkrt_stats.php in RedKernel Referrer Tracker 1.1.0-3 allows remote attackers to inject arbitrary web script or HTML via a query string value as a GET, whic…

CVSS: 4.3CWE: N/A
Read more
Critical

CVE-2006-0316

Buffer overflow in YGPPicFinder.DLL in AOL You've Got Pictures (YGP) Picture Finder Tool ActiveX Control, as used in AOL 8.0, 8.0 Plus, and 9.0 Classic, allows remote attackers to execute arbitrary c…

CVSS: 10.0CWE: N/A
Read more
Medium

CVE-2006-0315

index.php in EZDatabase before 2.1.2 does not properly cleanse the p parameter before constructing and including a .php filename, which allows remote attackers to conduct directory traversal attacks,…

CVSS: 5.8CWE: N/A
Read more
Medium

CVE-2006-0312

create.php in aoblogger 2.3 allows remote attackers to bypass authentication and create new blog entries by setting the uza parameter to 1.

CVSS: 5.0CWE: N/A
Read more
High

CVE-2006-0313

Multiple SQL injection vulnerabilities in PDFdirectory before 1.0 allow remote attackers to execute arbitrary SQL commands via multiple unspecified vectors involving (1) util.php, (2) userpref.php, (…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-0311

SQL injection vulnerability in login.php in aoblogger 2.3 allows remote attackers to execute arbitrary SQL commands via the username parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0310

Cross-site scripting (XSS) vulnerability in aoblogger 2.3 allows remote attackers to inject arbitrary Javascript via a javascript URI in the BBcode url tag.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0309

Linksys BEFVP41 VPN Router 2.0 with firmware 1.01.04 allows remote attackers on the local network, to cause a denial of service via IP packets with a null IP option length.

CVSS: 4.0CWE: N/A
Read more
Critical

CVE-2006-0226

Integer overflow in IEEE 802.11 network subsystem (ieee80211_ioctl.c) in FreeBSD before 6.0-STABLE, while scanning for wireless networks, allows remote attackers to execute arbitrary code by broadcas…

CVSS: 10.0CWE: N/A
Read more
High

CVE-2006-0305

Clipcomm CPW-100E VoIP 802.11b Wireless Handset Phone running firmware 1.1.12 (051129) and CP-100E VoIP 802.11b Wireless Phone running firmware 1.1.60 allows remote attackers to gain unauthorized acc…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0307

The DM Primer in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0, BrightStor ARCserve Backup for Laptops & Desktops r11.0, r11.1, r11.1 SP1, Unicenter Rem…

CVSS: 5.0CWE: CWE-399
Read more
Medium

CVE-2006-0306

The DM Primer (dmprimer.exe) in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0, BrightStor ARCserve Backup for Laptops & Desktops r11.0, r11.1, r11.1 SP1…

CVSS: 5.0CWE: CWE-399
Read more
High

CVE-2006-0304

Buffer overflow in Dual DHCP DNS Server 1.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the DHCP options field.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0302

ZyXel P2000W VoIP 802.11b Wireless Phone running firmware WV.00.02 allows remote attackers to obtain sensitive information, such as MAC address and software version, by directly accessing UDP port 90…

CVSS: 5.0CWE: N/A
Read more
Critical

CVE-2006-0303

Multiple unspecified vulnerabilities in the (1) publishing component, (2) Contact Component, (3) TinyMCE Compressor, and (4) other components in Joomla! 1.0.5 and earlier have unknown impact and atta…

CVSS: 10.0CWE: N/A
Read more
2006-01-18
Medium

CVE-2006-0275

Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# REP04. NOTE: Oracle…

CVSS: 5.0CWE: N/A
Read more
Critical

CVE-2006-0284

Multiple unspecified vulnerabilities in Oracle Application Server 9.0.4.2 and 10.1.2.0.2, and E-Business Suite and Applications 11.5.10, have unspecified impact and attack vectors, as identified by O…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0277

Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) APPS01 in the (a) Application In…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0278

Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.9 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) APPS02 in the (a) CRM Technical F…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0279

Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 4.3 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) APPS13 and (2) APPS14 in the Oracle…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0280

Unspecified vulnerability in Oracle PeopleSoft Enterprise Portal 8.4 Bundle 15, 8.8 Bundle 10, and 8.9 Bundle 2 has unspecified impact and attack vectors, as identified by Oracle Vuln# PSE01.

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0281

Unspecified vulnerability in Oracle JD Edwards HTML Server 8.95.F1 SP23_L1 has unspecified impact and attack vectors, as identified by Oracle Vuln# JDE01.

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0282

Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.5, Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, and Collaboration Suite Release 2, vers…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0285

Unspecified vulnerability in the Java Net component of Oracle Database Server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.4, and Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, has unspe…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0286

Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.5, and Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, has unsp…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0287

Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 10.1.0.5 and Application Server 10.1.2.0.2 has unspecified impact and attack vectors, as identified by Oracle V…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0288

Multiple unspecified vulnerabilities in the Oracle Reports Developer component of Oracle Application Server 9.0.4.1 and E-Business Suite and Applications 11.5.10 have unspecified impact and attack ve…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0289

Multiple unspecified vulnerabilities in Oracle Application Server 6.0.8.26(PS17) and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0290

Unspecified vulnerability in Oracle Database Server 9.2.0.7, Application Server 9.0.4.2 and 10.1.2.1, Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i), and E-Business Suite and Applications…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0291

Multiple unspecified vulnerabilities in Oracle Database Server 10.2.0.1, Application Server 9.0.4.2 and 10.1.2.1, Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i), and E-Business Suite and A…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0276

Multiple unspecified vulnerabilities in Oracle Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i) have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) OCS01, 2) OCS02,…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0283

Unspecified vulnerability in Oracle Database Server 10.1.0.4.2, Application Server 10.1.2.0.2, and Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i) has unspecified impact and attack vectors,…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0274

Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 and 10.1.2.0.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# REP03.

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0265

Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.1 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB17 in…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0273

Unspecified vulnerability in the Portal component of Oracle Application Server 9.0.4.2 and 10.1.2.0 has unspecified impact and attack vectors, as identified by Oracle Vuln# AS01.

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0257

Unspecified vulnerability in the Change Data Capture component of Oracle Database server 9.2.0.7, 10.1.0.5, and 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB02.…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0258

Unspecified vulnerability in the Connection Manager component of Oracle Database server 8.1.7.4 and 9.0.1.5 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB03.

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0259

Multiple unspecified vulnerabilities in Oracle Database server 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB04 and (2) DB06 in the (a) Data Pump component;…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0260

Multiple unspecified vulnerabilities in Oracle Database server 9.2.0.7 and 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB05 in the (a) Data Pump component;…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0261

Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB07 in the Dictio…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0263

Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, 10.1.0.5, and 10.2.0.1 have unspecified impact and attack vectors, as identified by Oracle Vuln…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0262

Unspecified vulnerability in the Net Foundation Layer component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4 has unspecified impact and attack vectors, as identifie…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0256

Unspecified vulnerability in the Advanced Queuing component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.6, 10.1.0.3 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB01.

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0266

Unspecified vulnerability in the Query Optimizer component of Oracle Database server 9.0.1.5, 9.2.0.7, and 10.1.0.5 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB19.

CVSS: 9.0CWE: N/A
Read more
Critical

CVE-2006-0267

Unspecified vulnerability in the Query Optimizer component of Oracle Database server 9.2.0.6 and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB20.

CVSS: 9.0CWE: N/A
Read more
Critical

CVE-2006-0268

Unspecified vulnerability in the Security component of Oracle Database server 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB2…

CVSS: 9.0CWE: N/A
Read more
Critical

CVE-2006-0270

Unspecified vulnerability in the Transparent Data Encryption (TDE) Wallet component of Oracle Database server 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB27.…

CVSS: 10.0CWE: CWE-310
Read more
Critical

CVE-2006-0271

Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vul…

CVSS: 10.0CWE: N/A
Read more
Critical

CVE-2006-0272

Unspecified vulnerability in the XML Database component of Oracle Database server 9.2.0.7 and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB29. NOTE: based on m…

CVSS: 9.0CWE: N/A
Read more
Medium

CVE-2006-0248

Virata-EmWeb web server 6_1_0, as used in (1) Intracom JetSpeed 500 and 520 and (2) Allied Data Technologies CopperJet 811 RouterPlus, allows remote attackers to access privileged information, such a…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2006-0255

Unquoted Windows search path vulnerability in Check Point VPN-1 SecureClient might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run when SecureCl…

CVSS: 7.2CWE: N/A
Read more
Medium

CVE-2006-0253

Buffer overflow in the Bluetooth OBEX Object Push service in "Blue Neighbors.EXE" in AmbiCom Blue Neighbors 2.50 Build 2500 and earlier allows remote attackers to execute arbitrary code via a long fi…

CVSS: 5.1CWE: N/A
Read more
High

CVE-2006-0252

SQL injection vulnerability in Benders Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via multiple parameters, as demonstrated by the (1) year, (2) month, and (3) day paramete…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0251

Cross-site scripting (XSS) vulnerability in fom.cgi in Faq-O-Matic 2.711 allows remote attackers to inject arbitrary web script or HTML via the (1) _duration, (2) file, and (3) cmd parameters.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0250

Format string vulnerability in the snmp_input function in snmptrapd in CMU SNMP utilities (cmu-snmp) allows remote attackers to execute arbitrary code by sending crafted SNMP messages to UDP port 162.

CVSS: 6.4CWE: N/A
Read more
Medium

CVE-2006-0254

Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid par…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0247

Cross-site scripting (XSS) vulnerability in anyboard.cgi in Netbula Anyboard 9.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the tK parameter in a find command.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0245

Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the (3) redir, (4) productId, (5) docId, (6) act, and (7) c…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0244

Directory traversal vulnerability in workspaces.php in phpXplorer 0.9.33 allows remote attackers to include arbitrary files via a .. (dot dot) and trailing null byte (%00) in the sShare parameter. N…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0243

Cross-site scripting (XSS) vulnerability in SMBCMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the text parameter, which is used by the "Search Site" field. NOTE: the prov…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2006-0044

Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0246

Cross-site scripting (XSS) vulnerability in down.pl in Widexl Download Tracker 1.06 allows remote attackers to inject arbitrary web script or HTML via the ID parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0241

Cross-site scripting vulnerability in WBNews 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the Name field.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0242

Cross-site scripting vulnerability in index.php in PHP Fusebox 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter.

CVSS: 6.4CWE: N/A
Read more
Medium

CVE-2006-0239

Multiple cross-site scripting (XSS) vulnerabilities in Simple Blog 2.1 allow remote attackers to inject arbitrary web script or HTML via (1) a comment to comments.asp and (2) possibly certain other f…

CVSS: 5.8CWE: N/A
Read more
High

CVE-2006-0238

SQL injection vulnerability in wp-stats.php in GaMerZ WP-Stats 2.0 allows remote attackers to execute arbitrary SQL commands via the author parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0237

Cross-site scripting (XSS) vulnerability in index.php in GTP iCommerce allows remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) subcat parameters. NOTE: the provenance…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2006-0235

SQL injection vulnerability in WhiteAlbum 2.5 allows remote attackers to execute arbitrary SQL commands via the dir parameter to pictures.php.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-0234

SQL injection vulnerability in index.php in microBlog 2.0 RC-10 allows remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters.

CVSS: 7.5CWE: N/A
Read more
2006-01-17
High

CVE-2006-0228

The RBAC functionality in grsecurity before 2.1.8 does not properly handle when the admin role creates a service and then exits the shell without unauthenticating, which causes the service to be rest…

CVSS: 7.2CWE: N/A
Read more
Low

CVE-2006-0229

Unquoted Windows search path vulnerability in Wehntrust might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run when Wehntrust creates the autosta…

CVSS: 2.1CWE: N/A
Read more
Low

CVE-2006-0227

Multiple unspecified vulnerabilities in lpsched in Sun Solaris 8, 9, and 10 allow local users to delete arbitrary files or disable the LP print service via unknown attack vectors.

CVSS: 2.6CWE: N/A
Read more
2006-01-16
High

CVE-2006-0221

SQL injection vulnerability in index.asp in the Admin Panel in Dragon Design Services Network (DDSN) cm3 content manager (CM3CMS) allows remote attackers to execute arbitrary SQL commands via the (1)…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0222

Cross-site scripting (XSS) vulnerability in fullview.php in AlstraSoft Template Seller Pro allows remote attackers to inject arbitrary web script or HTML via the tempid parameter.

CVSS: 4.3CWE: N/A
Read more
Critical

CVE-2006-0218

Multiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before 1.0.2 have unspecified impact and attack vectors, related to (1) admin/moderate.php, (2) admin/themes.php, (3) inc/functions.php,…

CVSS: 10.0CWE: N/A
Read more
Medium

CVE-2006-0220

Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5.3 through 6.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the day parameter in calendar.php and (2) the…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2006-0219

The original distribution of MyBulletinBoard (MyBB) to update from older versions to 1.0.2 omits or includes older versions of certain critical files, which allows attackers to conduct (1) SQL inject…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0215

Cross-site scripting (XSS) vulnerability in admin.php in QualityEBiz Quality PPC (QPPC) 1.0 build 1644 allows remote attackers to inject arbitrary web script or HTML via the cpage parameter. NOTE: t…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0216

admin.php in QualityEBiz Quality PPC (QPPC) 1.0 build 1644 allows remote attackers to obtain sensitive information, possibly the installation path of the application, via unspecified "meta characters…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0217

Multiple cross-site scripting (XSS) vulnerabilities in Ultimate Auction 3.67 allow remote attackers to inject arbitrary web script or HTML via the (1) item parameter in item.pl and (2) category param…

CVSS: 4.3CWE: N/A
Read more
2006-01-15
High

CVE-2006-0214

Eval injection vulnerability in ezDatabase 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the db_id parameter to visitorupload.php, as demonstrated using phpinfo and includ…

CVSS: 7.5CWE: N/A
Read more
2006-01-14
High

CVE-2006-0209

SQL injection vulnerability in general_functions.php in TankLogger 2.4 allows remote attackers to execute arbitrary SQL commands via the (1) livestock_id parameter to showInfo.php and (2) tank_id par…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0210

Cross-site scripting (XSS) vulnerability in index.php in Interspire TrackPoint NX before 0.1 allows remote attackers to inject arbitrary web script or HTML via the username parameter when using the L…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0211

Cross-site scripting (XSS) vulnerability in forgotPassword.asp in Helm Hosting Control Panel 3.2.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the txtEmailAddress p…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0212

Directory traversal vulnerability in OBEX Push services in Toshiba Bluetooth Stack 4.00.23(T) and earlier allows remote attackers to upload arbitrary files to arbitrary remote locations specified by…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0213

Kolab Server 2.0.1, 2.0.2 and development versions pre-2.1-20051215 and earlier, when authenticating users via secure SMTP, stores authentication credentials in plaintext in the postfix.log file, whi…

CVSS: 4.6CWE: N/A
Read more
2006-01-13
Low

CVE-2006-0202

Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier has (1) world-readable permissions for ipn/logs/ipn_success.txt, which allows local users to view…

CVSS: 3.6CWE: N/A
Read more
High

CVE-2006-0206

Eval injection vulnerability in Light Weight Calendar (LWC) 1.0 (20040909) and earlier allows remote attackers to execute arbitrary PHP code via the date parameter in cal.php, which is included by in…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0204

Multiple cross-site scripting (XSS) vulnerabilities in Wordcircle 2.17 allow remote attackers to inject arbitrary web script or HTML via (1) the "Course name" field in index.php when the frm paramete…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0198

Cross-site scripting (XSS) vulnerability in a certain module, possibly poll or Pool, for XOOPS allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0201

Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50, and possibly earlier versions, allows remote attackers to enter false payment entries into the log file via HTTP POST…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0197

The XClientMessageEvent struct used in certain components of X.Org 6.8.2 and earlier, possibly including (1) the X server and (2) Xlib, uses a "long" specifier for elements of the l array, which resu…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2006-0196

Unspecified vulnerability in Serial line sniffer (aka slsnif) 0.4.4 allows local users to gain privileges via a long value of the HOME environment variable, possibly because of a buffer overflow.

CVSS: 4.6CWE: N/A
Read more
High

CVE-2006-0189

Buffer overflow in eStara Softphone 3.0.1.14 through 3.0.1.46 allows remote attackers to execute arbitrary code via a long attribute (aka "a") field in the SDP data of a SIP packet on UDP port 5060.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2006-0191

Unspecified vulnerability in Sun Solaris 10 allows local users to cause a denial of service (null dereference) via unspecified vectors involving the use of the find command on the "/proc" filesystem.…

CVSS: 4.9CWE: N/A
Read more
Medium

CVE-2006-0193

Cross-site scripting (XSS) vulnerability in the Hosting Control Panel (psoft.hsphere.CP) in Positive Software H-Sphere 2.4.3 Patch 8 and earlier allows remote attackers to inject arbitrary web script…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2006-0194

Cross-site scripting (XSS) vulnerability in default.asp in FogBugz 4.029, and other versions before 4.0.33, allows remote attackers to inject arbitrary web script or HTML via the dest parameter in th…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2006-0190

Unspecified vulnerability in Sun Solaris 9 and 10 for the x86 platform allows local users to gain privileges or cause a denial of service (panic) via unspecified vectors, possibly involving functions…

CVSS: 7.2CWE: N/A
Read more
2006-01-12
Medium

CVE-2006-0183

Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via (1) the edit=header value, which modifies header.php…

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2006-0187

By design, Microsoft Visual Studio 2005 automatically executes code in the Load event of a user-defined control (UserControl1_Load function), which allows user-assisted attackers to execute arbitrary…

CVSS: 5.1CWE: N/A
Read more
Medium

CVE-2006-0185

Multiple cross-site scripting vulnerabilities in the (1) Pool or (2) News Modules in Php-Nuke allow remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an I…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2006-0184

Multiple SQL injection vulnerabilities in AspTopSites allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to goto.asp or (2) password parameter to includeloginuser.asp.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-0182

login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside".

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-0181

Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.1.3 has an undocumented administrative account with a default password, which allows local users to gain privileges via the…

CVSS: 7.2CWE: N/A
Read more
Medium

CVE-2006-0180

Cross-site scripting (XSS) vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the Title field on the "Adding New Event" page, and possibly oth…

CVSS: 4.3CWE: N/A
Read more
2006-01-11
Medium

CVE-2006-0168

Cross-site scripting (XSS) vulnerability in MyPhPim 01.05 allows remote attackers to inject arbitrary web script or HTML via the description field on the "Create New todo" page.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2006-0178

Format string vulnerability in /bin/ftp in UNICOS 9.0.2.2 allows local users to have an unknown impact via format string specifiers in the quote command. NOTE: because the program is not setuid and…

CVSS: 7.2CWE: N/A
Read more
High

CVE-2006-0177

Multiple buffer overflows in Cray UNICOS 9.0.2.2 might allow local users to gain privileges by (1) invoking /usr/bin/script with a long command line argument or (2) setting the -c option of /etc/nu t…

CVSS: 7.2CWE: N/A
Read more
High

CVE-2006-0176

Buffer overflow in certain functions in src/fileio.c and src/unix/fileio.c in xmame before 11 January 2006 may allow local users to gain privileges via a long (1) -lang, (2) -ctrlr, (3) -pb, or (4) -…

CVSS: 7.2CWE: N/A
Read more
Medium

CVE-2006-0174

Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to obtain sensitive information (intranet IP addresses and enumerations of valid paramete…

CVSS: 4.0CWE: N/A
Read more
Medium

CVE-2006-0173

Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to misrepresent the type and name of a file via modified doc_ext and id parameters, which…

CVSS: 4.0CWE: N/A
Read more
High

CVE-2006-0169

addresses.php3 in MyPhPim 01.05 does not restrict uploaded files, which allows remote attackers to execute arbitrary PHP code via the pdbfile variable, then directly accessing those files from the up…

CVSS: 7.5CWE: N/A
Read more
Low

CVE-2006-0172

Cross-site scripting (XSS) vulnerability in the file manager utility in Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to inject arbitra…

CVSS: 3.5CWE: N/A
Read more
High

CVE-2006-0167

SQL injection vulnerability in MyPhPim 01.05 allows remote attackers to execute arbitrary SQL commands via the (1) cal_id parameter in calendar.php3 and the (2) password field on the login page.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2006-0163

SQL injection vulnerability in the search module (modules/Search/index.php) of PHPNuke EV 7.7 -R1 allows remote attackers to execute arbitrary SQL commands via the query parameter, which is used by t…

CVSS: 7.5CWE: N/A
Read more
>