CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2006

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complex ity Authen tication Confiden tiality Integrity Availa bility
1 CVE-2006-6790 1 2006-12-27 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Direct static code injection vulnerability in chat/login.php in Ultimate PHP Board (UPB) 2.0b1 and earlier allows remote attackers to inject arbitrary PHP code via the username parameter, which is injected into chat/text.php.
2 CVE-2006-6759 1 DoS 2006-12-26 2008-09-05
5.0
 None Remote Low Not required None None Partial
A certain ActiveX control in rpau3260.dll in RealNetworks RealPlayer 10.5 allows remote attackers to cause a denial of service (Internet Explorer crash) by invoking the RealPlayer.Initialize method with certain arguments.
3 CVE-2006-6722 1 2006-12-23 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Bandwebsite (aka Bandsite portal system) 1.5 allows remote attackers to create administrative accounts via a direct request to admin.php with the Login parameter set to 1.
4 CVE-2006-6721 1 XSS 2006-12-23 2008-09-05
6.8
 User Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in shout.php in Knusperleicht ShoutBox 2.6 allow remote attackers to inject arbitrary web script or HTML via the (1) sbNick or (2) sbKommentar parameter.
5 CVE-2006-6626 1 XSS 2006-12-18 2008-09-05
6.8
 User Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in an unspecified component of Moodle 1.5 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. NOTE: It is unclear whether this candidate overlaps CVE-2006-4784 or CVE-2006-4941.
6 CVE-2006-6625 1 XSS 2006-12-18 2008-09-05
6.8
 User Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in mod/forum/discuss.php in Moodle 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the navtail parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
7 CVE-2006-6624 1 DoS 2006-12-18 2008-09-10
4.0
 None Remote Low Single system None None Partial
The FTP Server in Sambar Server 6.4 allows remote authenticated users to cause a denial of service (application crash) via a long series of "./" sequences in the SIZE command.
8 CVE-2006-6576 119 1 DoS Exec Code Overflow 2006-12-15 2011-10-18
7.5
 User Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in Golden FTP Server (goldenftpd) 1.92 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long PASS command. NOTE: it was later reported that 4.70 is also affected. NOTE: the USER vector is already covered by CVE-2005-0634.
9 CVE-2006-6563 1 Exec Code Overflow 2006-12-15 2008-09-05
6.6
 Admin Local Medium Single system Complete Complete Complete
Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value.
10 CVE-2006-6341 1 Exec Code File Inclusion 2006-12-06 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in mg.applanix 1.3.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the apx_root_path parameter to (1) act/act_check_access.php, (2) dsp/dsp_form_booking_ctl.php, and (3) dsp/dsp_bookings.php.
11 CVE-2006-6334 1 Exec Code Overflow 2006-12-07 2008-09-05
6.8
 User Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the SendChannelData function in wfica.ocx in Citrix Presentation Server Client before 9.230 for Windows allows remote malicious web sites to execute arbitrary code via a DataSize parameter that is less than the length of the Data buffer.
12 CVE-2006-6288 119 1 Exec Code Overflow 2006-12-04 2011-09-20
4.6
 None Local Low Not required Partial Partial Partial
Multiple buffer overflows in Niek Albers CoolPlayer 216 and earlier allow remote attackers to execute arbitrary code via (1) a playlist file with long song names, because of an overflow in the CPL_AddPrefixedFile function in CPI_Playlist.c; (2) a skin file with long button names, because of an overflow in the main_skin_check_ini_value function in skin.c; and (3) a skin file with long bitmap filenames, because of an overflow in the main_skin_open function in skin.c.
13 CVE-2006-6184 1 DoS Exec Code Overflow 2006-11-30 2011-09-21
10.0
 Admin Remote Low Not required Complete Complete Complete
Multiple stack-based buffer overflows in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long filename in a (1) GET or (2) PUT command.
14 CVE-2006-6161 1 Exec Code Sql 2006-11-28 2009-02-06
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Doug Luxem Liberum Help Desk 0.97.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) uid parameter to (a) inout/status.asp, (b) inout/update.asp, and (c) forgotpass.asp. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
15 CVE-2006-6157 89 1 Exec Code Sql 2006-11-28 2011-08-08
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in ContentNow 1.39 and earlier allows remote attackers to execute arbitrary SQL commands via the pageid parameter. NOTE: this issue can be leveraged for path disclosure with an invalid pageid parameter.
16 CVE-2006-6026 119 1 DoS Exec Code Overflow 2006-11-21 2011-10-18
10.0
 Admin Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in Real Networks Helix Server and Helix Mobile Server before 11.1.3, and Helix DNA Server 11.0 and 11.1, allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a DESCRIBE request that contains an invalid LoadTestPassword field.
17 CVE-2006-5905 1 2006-11-15 2009-06-09
6.4
 None Remote Low Not required Partial Partial None
Web Directory Pro allows remote attackers to (1) backup the database and obtain the backup via a direct request to admin/backup_db.php or (2) modify configuration via a direct request to admin/options.php.
18 CVE-2006-5854 1 Exec Code Overflow 2006-12-03 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple buffer overflows in the Spooler service (nwspool.dll) in Novell Netware Client 4.91 through 4.91 SP2 allow remote attackers to execute arbitrary code via a long argument to the (1) EnumPrinters and (2) OpenPrinter functions.
19 CVE-2006-5763 1 Exec Code File Inclusion 2006-11-06 2008-09-05
5.1
 User Remote High Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in Free File Hosting 1.1, and possibly earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the AD_BODY_TEMP parameter to (1) login.php, (2) register.php, or (3) send.php. NOTE: the original provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this issue was later reported for the "File Upload System" which is a component of Free File Hosting. Vector 1 also affects Free Image Hosting 2.0, which contains the same code.
20 CVE-2006-5762 94 1 Exec Code File Inclusion 2006-11-06 2011-08-22
5.1
 User Remote High Not required Partial Partial Partial
PHP remote file inclusion vulnerability in forgot_pass.php in Free File Hosting 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AD_BODY_TEMP parameter. NOTE: this issue was later reported for the "File Upload System" which is a component of Free File Hosting. This also affects Free Image Hosting 2.0, which contains the same code.
21 CVE-2006-5745 1 Exec Code Mem. Corr. 2006-11-06 2008-12-15
7.6
 Admin Remote High Not required Complete Complete Complete
Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows, when accessed by Internet Explorer, allows remote attackers to execute arbitrary code via crafted arguments that lead to memory corruption, a different vulnerability than CVE-2006-4685. NOTE: some of these details are obtained from third party information.
22 CVE-2006-5629 89 1 Exec Code Sql 2006-10-31 2011-09-08
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Hosting Controller 6.1 before Hotfix 3.3 allow remote attackers to execute arbitrary SQL commands via the ForumID parameter in (1) DisableForum.asp and (2) enableForum.asp. NOTE: it was later reported that the vulnerability is present in 6.1 Hotfix 3.3 and earlier.
23 CVE-2006-5612 94 1 Exec Code File Inclusion 2006-10-30 2011-08-23
7.5
 User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in aide.php3 (aka aide.php) in GestArt beta 1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the aide parameter.
24 CVE-2006-5521 1 Exec Code File Inclusion 2006-10-26 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in DNS/RR.php in Net_DNS 0.03 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpdns_basedir parameter.
25 CVE-2006-5507 94 1 Exec Code File Inclusion 2006-10-25 2011-09-08
7.5
 User Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in Der Dirigent (DeDi) 1.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the cfg_dedi[dedi_path] parameter in (1) find.php, (2) insert_line.php, (3) fullscreen.php, (4) changecase.php, (5) insert_link.php, (6) insert_table.php, (7) table_cellprop.php, (8) table_prop.php, (9) table_rowprop.php, (10) insert_page.php, and possibly insert_marquee.php in backend/external/wysiswg/popups/.
26 CVE-2006-5202 1 2006-10-10 2008-09-05
5.0
 None Remote Low Not required None Partial None
Linksys WRT54g firmware 1.00.9 does not require credentials when making configuration changes, which allows remote attackers to modify arbitrary configurations via a direct request to Security.tri, as demonstrated using the SecurityMode and layout parameters, a different issue than CVE-2006-2559.
27 CVE-2006-5113 1 Dir. Trav. 2006-10-03 2008-09-10
7.5
 User Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in common.php in Yuuki Yoshizawa Exporia 0.3.0 allows remote attackers to include and execute local files via a .. (dot dot) in the lan parameter to includes.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
28 CVE-2006-5043 94 1 Exec Code File Inclusion 2006-09-27 2011-05-06
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in the Joomlaboard Forum Component (com_joomlaboard) before 1.1.2 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the sbp parameter to (1) file_upload.php or (2) image_upload.php, a variant of CVE-2006-3528.
29 CVE-2006-4962 1 Exec Code Dir. Trav. 2006-09-23 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
Directory traversal vulnerability in pbd_engine.php in Php Blue Dragon 2.9.1 and earlier allows remote attackers to read and execute arbitrary local files via a .. (dot dot) sequence via the phpExt parameter, as demonstrated by executing PHP code in a log file.
30 CVE-2006-4878 1 Exec Code Dir. Trav. 2006-09-19 2008-09-05
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in footer.php in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to read and include arbitrary local files via a .. (dot dot) sequence in the template parameter. NOTE: this was later reported to affect 1.0.1, and demonstrated for code execution by uploading and accessing an avatar file.
31 CVE-2006-4794 1 XSS 2006-09-14 2008-09-05
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the query string (PATH_INFO) in (1) contact.php, (2) download.php, (3) admin.php, (4) fpw.php, (5) news.php, (6) search.php, (7) signup.php, (8) submitnews.php, and (9) user.php. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
32 CVE-2006-4704 1 Exec Code Bypass 2006-11-01 2008-09-05
6.8
 User Remote Medium Not required Partial Partial Partial
Cross-zone scripting vulnerability in the WMI Object Broker (WMIScriptUtils.WMIObjectBroker2) ActiveX control (WmiScriptUtils.dll) in Microsoft Visual Studio 2005 allows remote attackers to bypass Internet zone restrictions and execute arbitrary code by instantiating dangerous objects, aka "WMI Object Broker Vulnerability."
33 CVE-2006-4608 1 XSS 2006-09-06 2009-04-18
6.8
 User Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in Longino Jacome php-Revista 1.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) cadena parameter in busqueda.php and the (2) email parameter in lista.php.
34 CVE-2006-4607 1 Bypass 2006-09-06 2009-04-18
7.5
 User Remote Low Not required Partial Partial Partial
admin/index.php in Longino Jacome php-Revista 1.1.2 allows remote attackers to bypass authentication controls by setting the ID_ADMIN and SUPER_ADMIN parameters to 1.
35 CVE-2006-4606 2 Exec Code Sql 2006-09-06 2009-04-18
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Longino Jacome php-Revista 1.1.2 allow remote attackers to execute arbitrary SQL commands via the (1) id_temas parameter in busqueda_tema.php, the (2) cadena parameter in busqueda.php, the (3) id_autor parameter in autor.php, the (4) email parameter in lista.php, and the (5) id_articulo parameter in articulo.php.
36 CVE-2006-4605 1 Exec Code File Inclusion 2006-09-06 2009-04-18
7.5
 User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in index.php in Longino Jacome php-Revista 1.1.2 allows remote attackers to execute arbitrary PHP code via the adodb parameter.
37 CVE-2006-4533 94 1 Exec Code File Inclusion 2006-09-01 2011-11-10
7.5
 User Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in Plume CMS 1.0.6 and earlier allow remote attackers to execute arbitrary PHP code via the _PX_config[manager_path] parameter to (1) articles.php, (2) categories.php, (3) news.php, (4) prefs.php, (5) sites.php, (6) subtypes.php, (7) users.php, (8) xmedia.php, (9) frontinc/class.template.php, (10) inc/lib.text.php, (11) install/index.php, (12) install/upgrade.php, and (13) tools/htaccess/index.php. NOTE: other vectors are covered by CVE-2006-3562, CVE-2006-2645, and CVE-2006-0725.
38 CVE-2006-4440 1 Exec Code File Inclusion 2006-08-29 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in main.php in Ay System Solutions CMS 2.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path[ShowProcessHandle] parameter.
39 CVE-2006-4366 1 Exec Code File Inclusion 2006-08-26 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in index.php in RedBLoG 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
40 CVE-2006-4343 1 DoS 2006-09-28 2011-09-07
4.3
 None Remote Medium Not required None None Partial
The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference.
41 CVE-2006-4318 1 Exec Code Overflow 2006-08-23 2008-09-05
6.5
 User Remote Low Single system Partial Partial Partial
Buffer overflow in WFTPD Server 3.23 allows remote attackers to execute arbitrary code via long SIZE commands.
42 CVE-2006-4301 20 1 DoS 2006-08-22 2008-09-05
5.0
 None Remote Low Not required None None Partial
Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (crash) via a long Color attribute in multiple DirectX Media Image DirectX Transforms ActiveX COM Objects from (a) dxtmsft.dll and (b) dxtmsft3.dll, including (1) DXImageTransform.Microsoft.MaskFilter.1, (2) DXImageTransform.Microsoft.Chroma.1, and (3) DX3DTransform.Microsoft.Shapes.1.
43 CVE-2006-4142 1 Exec Code Sql 2006-08-14 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in extra/online.php in Virtual War (VWar) 1.5.0 R14 and earlier allows remote attackers to execute arbitrary SQL commands via the n parameter.
44 CVE-2006-3690 1 Exec Code File Inclusion 2006-07-21 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter to (1) components/com_minibb.php or (2) components/minibb/index.php.
45 CVE-2006-3683 1 Exec Code File Inclusion 2006-07-21 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in poll.php in Flipper Poll 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
46 CVE-2006-3656 1 Mem. Corr. 2006-07-18 2011-04-12
2.6
 None Remote High Not required None Partial None
Unspecified vulnerability in Microsoft PowerPoint 2003 allows user-assisted attackers to cause memory corruption via a crafted PowerPoint file, which triggers the corruption when the file is closed. NOTE: due to the lack of available details as of 20060717, it is unclear how this is related to CVE-2006-3655, CVE-2006-3660, and CVE-2006-3590, although it is possible that they are all different.
47 CVE-2006-3598 1 Exec Code Sql 2006-07-18 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Sections module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the artid parameter in a viewarticle op.
48 CVE-2006-3362 1 Exec Code 2006-07-06 2009-08-19
5.1
 User Remote High Not required Partial Partial Partial
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
49 CVE-2006-3317 1 Exec Code File Inclusion 2006-06-29 2008-09-05
5.1
 User Remote High Not required Partial Partial Partial
PHP remote file inclusion vulnerability in phpRaid 3.0.6 allows remote attackers to execute arbitrary code via a URL in the phpraid_dir parameter to (1) announcements.php and (2) rss.php, a different set of vectors and affected versions than CVE-2006-3316 and CVE-2006-3116.
50 CVE-2006-3144 94 1 Exec Code File Inclusion 2006-06-22 2011-08-22
7.5
 User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in micro_cms_files/microcms-include.php in Implied By Design (IBD) Micro CMS 3.5 (aka 0.3.5) and earlier allows remote attackers to execute arbitrary PHP code via a URL in the microcms_path parameter. NOTE: it was later reported that this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.
Total number of vulnerabilities : 89   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritive source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritive source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritive source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.