2006 CVEs (page 4)
Page 4 of 72 — CVEs published in 2006, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2006-6991 | | 2007-02-09 | Cross-domain vulnerability in Fast Browser Pro 8.1 allows remote attackers to access restricted information from other domains via an object tag with a data pa… | |
CVE-2006-6990 | | 2007-02-09 | Cross-domain vulnerability in Enigma Browser 3.8.8 allows remote attackers to access restricted information from other domains via an object tag with a data pa… | |
CVE-2006-6989 | | 2007-02-09 | Cross-domain vulnerability in NetCaptor 4.5.7 Personal Edition allows remote attackers to access restricted information from other domains via an object tag wi… | |
CVE-2006-6988 | | 2007-02-09 | Cross-domain vulnerability in Slim Browser 4.07 build 100 allows remote attackers to access restricted information from other domains via an object tag with a… | |
CVE-2006-6987 | | 2007-02-09 | Cross-domain vulnerability in FineBrowser Freeware 3.2.2 allows remote attackers to access restricted information from other domains via an object tag with a d… | |
CVE-2006-6986 | | 2007-02-09 | Cross-domain vulnerability in PhaseOut 5.4.4 allows remote attackers to access restricted information from other domains via an object tag with a data paramete… | |
CVE-2006-6985 | | 2007-02-09 | Cross-domain vulnerability in Maxthon 1.5.6 build 42 allows remote attackers to access restricted information from other domains via an object tag with a data… | |
CVE-2006-6984 | | 2007-02-09 | Cross-domain vulnerability in GreenBrowser 3.4.0622 allows remote attackers to access restricted information from other domains via an object tag with a data p… | |
CVE-2006-6983 | | 2007-02-09 | Cross-domain vulnerability in MYweb4net Browser 3.8.8.0 allows remote attackers to access restricted information from other domains via an object tag with a da… | |
CVE-2006-6982 | | 2007-02-08 | 3proxy 0.5 to 0.5.2 does not offer NTLM authentication before basic authentication, which might cause browsers with incomplete RFC2616/RFC2617 support to use b… | |
CVE-2006-6981 | | 2007-02-08 | 3proxy 0.5 to 0.5.2, when NT-encoded passwords are being used, allows remote attackers to cause a denial of service (blocked account) via unspecified vectors r… | |
CVE-2006-6980 | | 2007-02-08 | The magnatune.com album browser in Amarok allows attackers to cause a denial of service (application crash) via unspecified vectors. | |
CVE-2006-6979 | | 2007-02-08 | The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line… | |
CVE-2006-6978 | | 2007-02-08 | Cross-site scripting (XSS) vulnerability in the "Basic Toolbar Selection" in FCKEditor allows remote attackers to execute arbitrary JavaScript via the javascri… | |
CVE-2006-6977 | | 2007-02-08 | Cross-site scripting (XSS) vulnerability in the "Basic Toolbar Selection" in FreeTextBox allows remote attackers to execute arbitrary JavaScript via the javasc… | |
CVE-2006-6976 | | 2007-02-08 | PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.2 and earlier allows remote attackers to execute arbitrary code via a URL in th… | |
CVE-2006-6975 | Critical | 9.8 | 2007-02-08 | PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.3 allows remote attackers to execute arbitrary code via a URL in the class_pwd… |
CVE-2006-2220 | | 2007-02-08 | phpBB 2.0.20 does not properly verify user-specified input variables used as limits to SQL queries, which allows remote attackers to obtain sensitive informati… | |
CVE-2006-2219 | | 2007-02-08 | phpBB 2.0.20 does not verify user-specified input variable types before being passed to type-dependent functions, which allows remote attackers to obtain sensi… | |
CVE-2006-6974 | | 2007-02-07 | Headstart Solutions DeskPRO stores sensitive information under the web root with insufficient access control, which allows remote attackers to (1) list files i… | |
CVE-2006-6973 | | 2007-02-07 | Headstart Solutions DeskPRO does not require authentication for certain files and directories associated with administrative activities, which allows remote at… | |
CVE-2006-6972 | | 2007-02-07 | SQL injection in torrents.php in BtitTracker 1.3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) by and (2) order parameter… | |
CVE-2006-6971 | | 2007-02-07 | Mozilla Firefox 2.0, possibly only when running on Windows, allows remote attackers to bypass the Phishing Protection mechanism by representing an IP address i… | |
CVE-2006-6970 | | 2007-02-07 | Opera 9.10 Final allows remote attackers to bypass the Fraud Protection mechanism by adding certain characters to the end of a domain name, as demonstrated by… | |
CVE-2006-6969 | | 2007-02-07 | Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which make… | |
CVE-2006-1167 | | 2007-02-06 | SGI ProPack 3 SP6 kernel displays the frame buffer contents of the last session after a reboot, which might allow local users to obtain sensitive information. | |
CVE-2006-6968 | | 2007-02-06 | Cross-site scripting (XSS) vulnerability in the group moderation control center page in Phorum before 5.1.19 might allow remote attackers to inject arbitrary w… | |
CVE-2006-6966 | | 2007-02-04 | phpGraphy before 0.9.13a does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's h… | |
CVE-2006-6535 | | 2007-01-30 | The dev_queue_xmit function in Linux kernel 2.6 can fail before calling the local_bh_disable function, which could lead to data corruption and "node lockups."… | |
CVE-2006-5754 | | 2007-01-30 | The aio_setup_ring function in Linux kernel does not properly initialize a variable, which allows local users to cause a denial of service (crash) via an unspe… | |
CVE-2006-5753 | | 2007-01-30 | Unspecified vulnerability in the listxattr system call in Linux kernel, when a "bad inode" is present, allows local users to cause a denial of service (data co… | |
CVE-2006-6965 | | 2007-01-29 | CRLF injection vulnerability in lib/exe/fetch.php in DokuWiki 2006-03-09e, and possibly earlier, allows remote attackers to inject arbitrary HTTP headers and c… | |
CVE-2006-6964 | | 2007-01-29 | MailEnable Professional before 1.78 provides a cleartext user password when an administrator edits the user's settings, which allows remote authenticated admin… | |
CVE-2006-6963 | | 2007-01-29 | Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 3.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[where_lms]… | |
CVE-2006-6962 | | 2007-01-29 | PHP remote file inclusion vulnerability in rsgallery2.html.php in the RS Gallery2 component (com_rsgallery2) 1.11.2 for Joomla! allows attackers to execute arb… | |
CVE-2006-6961 | | 2007-01-29 | WebRoot Spy Sweeper 4.5.9 and earlier does not detect malware based on file contents, which allows remote attackers to bypass malware detection by changing a f… | |
CVE-2006-6960 | | 2007-01-29 | The Compression Sweep feature in WebRoot Spy Sweeper 4.5.9 and earlier does not handle non-ZIP archives, which allows remote attackers to bypass the malware de… | |
CVE-2006-6959 | | 2007-01-29 | WebRoot Spy Sweeper 4.5.9 and earlier allows local users to bypass the "Startup-Shield" security restrictions by modifying certain registry keys. | |
CVE-2006-6958 | | 2007-01-29 | Multiple PHP remote file inclusion vulnerabilities in phpBlueDragon 2.9.1 allow remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPat… | |
CVE-2006-6957 | | 2007-01-29 | PHP remote file inclusion vulnerability in addons/mod_media/body.php in Docebo 3.0.3 and earlier, when register_globals is enabled, allows remote attackers to… | |
CVE-2006-6956 | | 2007-01-29 | Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via a web page that contains a large number of nested marquee tags, a… | |
CVE-2006-6955 | | 2007-01-29 | Opera allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nested marquee tags, a related is… | |
CVE-2006-6954 | | 2007-01-29 | Flock beta 1 0.7 allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nested marquee tags, a… | |
CVE-2006-6953 | | 2007-01-29 | The virtual keyboard implementation in GlobeTrotter Mobility Manager changes the color of a key as it is pressed, which allows local users to capture arbitrary… | |
CVE-2006-6952 | | 2007-01-24 | Computer Associates Host Intrusion Prevention System (HIPS) drivers (1) Core kmxstart.sys 6.5.4.31 and (2) Firewall kmxfw.sys 6.5.4.10 allow local users to gai… | |
CVE-2006-6951 | | 2007-01-23 | Cross-site scripting (XSS) vulnerability in blog.php in OdysseusBlog allows remote attackers to inject arbitrary web script or HTML via the page parameter. | |
CVE-2006-6950 | | 2007-01-23 | Directory traversal vulnerability in Conti FTPServer 1.0 Build 2.8 allows remote attackers to read arbitrary files and list arbitrary directories via a .. (dot… | |
CVE-2006-6949 | | 2007-01-23 | Conti FTPServer 1.0 Build 2.8 stores user passwords in cleartext in MyServerSettings.ini, which allows local users to obtain sensitive information by reading t… | |
CVE-2006-6948 | | 2007-01-23 | MyODBC Japanese conversion edition 3.51.06, 2.50.29, and 2.50.25 allows remote attackers to cause a denial of service via a certain string in a response, which… | |
CVE-2006-6947 | | 2007-01-23 | The FTP server in the NEC MultiWriter 1700C allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command, a variant of CVE-… | |
CVE-2006-6946 | | 2007-01-23 | The web server in the NEC MultiWriter 1700C allows remote attackers to modify the device configuration via unspecified vectors. | |
CVE-2006-6945 | | 2007-01-19 | SQL injection vulnerability in Virtuemart 1.0.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related to (1) Item… | |
CVE-2006-6944 | | 2007-01-19 | phpMyAdmin before 2.9.1.1 allows remote attackers to bypass Allow/Deny access rules that use IP addresses via false headers. | |
CVE-2006-6943 | | 2007-01-19 | PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to (a) scripts/check_lang.php and (b) themes/darkblue_oran… | |
CVE-2006-6942 | | 2007-01-19 | Multiple cross-site scripting (XSS) vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web script via (1) a commen… | |
CVE-2006-5964 | | 2007-01-19 | choShilA.bpl in PentaZip 8.5.1.190 and PentaSuite-PRO 8.5.1.221 allows local users, and user-assisted remote attackers to cause a denial of service (system cra… | |
CVE-2006-5963 | | 2007-01-19 | Directory traversal vulnerability in PentaZip 8.5.1.190 and PentaSuite-PRO 8.5.1.221 allows user-assisted remote attackers to extract files to arbitrary pathna… | |
CVE-2006-6941 | | 2007-01-19 | index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to obtain sensitive information via an invalid action parameter in an info operation, which… | |
CVE-2006-6489 | | 2007-01-18 | The SISCO OSI stack, as used in SISCO MMS-EASE, ICCP Toolkit for MMS-EASE, AX-S4 MMS and AX-S4 ICCP, and possibly other control system applications, allows rem… | |
CVE-2006-6940 | | 2007-01-17 | Buffer overflow in the ParseHeader function in clsOWA.cls in POP3/SMTP to OWA (pop2owa) 1.1.3 allows remote attackers to execute arbitrary code via a long head… | |
CVE-2006-6939 | | 2007-01-17 | GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function. | |
CVE-2006-6938 | | 2007-01-17 | Directory traversal vulnerability in includes/common.php in NitroTech 0.0.3a, as distributed before 2006, allows remote attackers to include arbitrary files vi… | |
CVE-2006-6937 | | 2007-01-17 | SQL injection vulnerability in displaypic.asp in Xtreme ASP Photo Gallery allows remote attackers to inject arbitrary SQL commands via the sortorder parameter. | |
CVE-2006-6936 | | 2007-01-17 | Cross-site scripting (XSS) vulnerability in Xtreme ASP Photo Gallery allows remote attackers to inject arbitrary HTML or web script via (1) the catname paramet… | |
CVE-2006-6935 | | 2007-01-16 | SQL injection vulnerability in the login component in Portix-PHP 0.4.2 allows remote attackers to execute arbitrary SQL commands via the username and passwd (p… | |
CVE-2006-6934 | | 2007-01-16 | Multiple cross-site scripting (XSS) vulnerabilities in Portix-PHP 0.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) titre or (2)… | |
CVE-2006-6933 | | 2007-01-16 | Easy Chat Server 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download certain files… | |
CVE-2006-6932 | | 2007-01-16 | Multiple SQL injection vulnerabilities in Image Gallery with Access Database allow remote attackers to execute arbitrary SQL commands via (1) the id parameter… | |
CVE-2006-6931 | | 2007-01-16 | Algorithmic complexity vulnerability in Snort before 2.6.1, during predicate evaluation in rule matching for certain rules, allows remote attackers to cause a… | |
CVE-2006-5172 | | 2007-01-16 | Stack-based buffer overflow in the RPC interface in Mediasvr.exe in Computer Associates (CA) Brightstor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10… | |
CVE-2006-5171 | | 2007-01-16 | Stack-based buffer overflow in the RPC interface in Mediasvr.exe in Computer Associates (CA) Brightstor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10… | |
CVE-2006-6767 | High | 7.5 | 2007-01-16 | oftpd before 0.3.7 allows remote attackers to cause a denial of service (daemon abort) via a (1) LPRT or (2) LPASV command with an unsupported address family… |
CVE-2006-6487 | | 2007-01-16 | Cross-site scripting (XSS) vulnerability in index.php in DT Guestbook (dt_guestbook) 1.0f, when register_globals is enabled, allows remote attackers to inject… | |
CVE-2006-5876 | | 2007-01-16 | The soup_headers_parse function in soup-headers.c for libsoup HTTP library before 2.2.99 allows remote attackers to cause a denial of service (crash) via malfo… | |
CVE-2006-6930 | | 2007-01-13 | SQL injection vulnerability in viewad.asp in Rapid Classified 3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |
CVE-2006-6929 | | 2007-01-13 | Multiple cross-site scripting (XSS) vulnerabilities in Rapid Classified 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parame… | |
CVE-2006-6928 | | 2007-01-13 | Multiple cross-site scripting (XSS) vulnerabilities in Rialto 1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a… | |
CVE-2006-6927 | | 2007-01-13 | Multiple SQL injection vulnerabilities in Rialto 1.6 allow remote attackers to execute arbitrary SQL commands via (1) the uname (username) and (2) pword (passw… | |
CVE-2006-6926 | | 2007-01-13 | Buffer overflow in eXtremail 2.1 has unknown impact and attack vectors, as demonstrated by VulnDisco Pack. NOTE: The provenance of this information is unknown… | |
CVE-2006-6925 | | 2007-01-13 | Multiple cross-site scripting (XSS) vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the me… | |
CVE-2006-6924 | | 2007-01-13 | bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to (1) blogs/list_blogs.php, (2) fisheye/i… | |
CVE-2006-6923 | | 2007-01-13 | SQL injection vulnerability in newsletters/edition.php in bitweaver 1.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the tk para… | |
CVE-2006-6922 | | 2007-01-13 | SQL injection vulnerability in Deadlock User Management System (phpdeadlock) 0.64 and earlier allows remote attackers to execute arbitrary SQL commands via uns… | |
CVE-2006-6921 | | 2007-01-12 | Unspecified versions of the Linux kernel allow local users to cause a denial of service (unrecoverable zombie process) via a program with certain instructions… | |
CVE-2006-6920 | | 2007-01-11 | Cross-site scripting (XSS) vulnerability in Nucleus before 3.24 allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly in… | |
CVE-2006-6919 | | 2007-01-11 | Firefox Sage extension 1.3.8 and earlier allows remote attackers to execute arbitrary Javascript in the local context via an RSS feed with an img tag containin… | |
CVE-2006-6918 | | 2007-01-11 | Unspecified vulnerability in the Admin login for Georgian discussion board (GeoBB) before 1.0 has unknown impact and attack vectors. | |
CVE-2006-7233 | | 2006-12-31 | Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.6.0, and possibly other versions… | |
CVE-2006-7232 | | 2006-12-31 | sql_select.cc in MySQL 5.0.x before 5.0.32 and 5.1.x before 5.1.14 allows remote authenticated users to cause a denial of service (crash) via an EXPLAIN SELECT… | |
CVE-2006-7231 | | 2006-12-31 | SQL injection vulnerability in display.asp in Civica Software Civica allows remote attackers to execute arbitrary SQL commands via the Entry parameter. NOTE… | |
CVE-2006-6917 | | 2006-12-31 | Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup R11.5 Server before SP2 allows remote attackers to execute arbitrary code in t… | |
CVE-2006-6916 | | 2006-12-31 | Getahead Direct Web Remoting (DWR) before 1.1.3 allows attackers to cause a denial of service (infinite loop) via unknown vectors related to "crafted input." | |
CVE-2006-6915 | | 2006-12-31 | ftpd in IBM AIX 5.2.0 and 5.3.0 allows remote authenticated users to cause a denial of service (port exhaustion) via unspecified vectors. NOTE: some details we… | |
CVE-2006-6914 | | 2006-12-31 | Unspecified vulnerability in ftpd in IBM AIX 5.2.0 and 5.3.0 allows remote attackers to obtain sensitive information, including passwords, via unspecified vect… | |
CVE-2006-6913 | | 2006-12-31 | Unspecified vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to upload arbitrary PHP scripts via unspecified vectors. | |
CVE-2006-6912 | | 2006-12-31 | SQL injection vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly the userf… | |
CVE-2006-6911 | | 2006-12-31 | SQL injection vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated users to execute arbitrary SQL commands via t… | |
CVE-2006-6910 | | 2006-12-31 | formbankcgi.exe in Fersch Formbankserver 1.9, when the PATH_INFO begins with Abfrage, allows remote attackers to cause a denial of service (daemon crash) via m… | |
CVE-2006-6909 | | 2006-12-31 | Stack-based buffer overflow in http.c in Karl Dahlke Edbrowse (aka Command line editor browser) 3.1.3 allows remote attackers to execute arbitrary code by oper… | |
CVE-2006-6908 | | 2006-12-31 | Buffer overflow in the Bluetooth Stack COM Server in the Widcomm Bluetooth stack, as packaged as Widcomm Stack 3.x and earlier on Windows, Widcomm BTStackServe… |