CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2006(Bypass)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2006-6865 Dir. Trav. Bypass 2006-12-31 2008-09-05
7.8
 None Remote Low Not required None None Complete
Directory traversal vulnerability in SAFileUpSamples/util/viewsrc.asp in SoftArtisans FileUp (SAFileUp) 5.0.14 allows remote attackers to read arbitrary files via a %c0%ae. (Unicode dot dot) in the path parameter, which bypasses the checks for ".." sequences.
2 CVE-2006-6818 Bypass 2006-12-29 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
AlstraSoft Web Host Directory allows remote attackers to bypass authentication and change the admin password via a direct request to admin/config.
3 CVE-2006-6783 287 Bypass 2006-12-27 2011-05-19
7.5
 User Remote Low Not required Partial Partial Partial
logahead UNU 1.0 before 20061226 allows remote attackers to upload arbitrary files via unspecified vectors related to plugins/widged/_widged.php (aka the WidgEd plugin), possibly because of an authentication bypass. NOTE: some of these details are obtained from third party information.
4 CVE-2006-6705 287 Bypass 2006-12-22 2010-08-25
5.0
 None Remote Low Not required Partial None None
Multiple unspecified vulnerabilities in the template files in Soumu Workflow for Groupmax 01-00 through 01-01, Soumu Workflow 02-00 through 03-03, and Koukyoumuke Soumu Workflow 01-00 through 01-01 allow remote attackers to bypass authentication mechanisms on web pages via unknown vectors.
5 CVE-2006-6688 Bypass 2006-12-21 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Web Automated Perl Portal (WebAPP) 0.9.9.4, and 0.9.9.3.4 Network Edition (NE) (aka WebAPP.NET) allows remote attackers to bypass filtering mechanisms via unknown vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
6 CVE-2006-6683 264 Bypass 2006-12-21 2011-04-27
7.8
 None Remote Low Not required Complete None None
Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that processes /etc/shadow and does not follow the PAM configuration, which might allow remote attackers to bypass intended restrictions implemented through PAM.
7 CVE-2006-6623 Bypass 2006-12-18 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Sygate Personal Firewall 5.6.2808 relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process by spoofing the (1) ImagePathName, (2) CommandLine, and (3) WindowTitle fields in the PEB.
8 CVE-2006-6622 Bypass 2006-12-18 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Soft4Ever Look 'n' Stop (LnS) 2.05p2 before 20061215 relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process by spoofing the (1) ImagePathName, (2) CommandLine, and (3) WindowTitle fields in the PEB.
9 CVE-2006-6621 Bypass 2006-12-18 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Filseclab Personal Firewall 3.0.0.8686 relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process by spoofing the (1) ImagePathName, (2) CommandLine, and (3) WindowTitle fields in the PEB.
10 CVE-2006-6620 Bypass 2006-12-18 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Comodo Personal Firewall 2.3.6.81 relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process by spoofing the (1) ImagePathName, (2) CommandLine, and (3) WindowTitle fields in the PEB.
11 CVE-2006-6619 Bypass 2006-12-18 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
AVG Anti-Virus plus Firewall 7.5.431 relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process by spoofing the (1) ImagePathName, (2) CommandLine, and (3) WindowTitle fields in the PEB.
12 CVE-2006-6618 Bypass 2006-12-18 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
AntiHook 3.0.0.23 - Desktop relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process by spoofing the (1) ImagePathName, (2) CommandLine, and (3) WindowTitle fields in the PEB.
13 CVE-2006-6572 Bypass 2006-12-15 2008-09-05
6.5
 None Remote Low Single system Partial Partial Partial
Unspecified vulnerability in Citrix Advanced Access Control (AAC) Option 4.0, and Access Gateway 4.2 with Advanced Access Control 4.2, before 20061114, when the Browser-Only access feature is enabled, allows remote authenticated users to bypass access policies via a certain login method, a different issue than CVE-2006-4846. NOTE: some of these details are obtained from third party information.
14 CVE-2006-6556 Exec Code Bypass 2006-12-14 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
The eyeHome function in apps/eyeHome.eyeapp/aplic.php in EyeOS before 0.9.3-3 allows remote attackers to upload and execute arbitrary code via dangerous file extensions that are not all lowercase, which bypasses a cleansing operation.
15 CVE-2006-6537 Bypass 2006-12-13 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
IBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html.
16 CVE-2006-6510 Bypass 2006-12-13 2008-09-05
1.7
 None Local Low Single system Partial None None
An unspecified ActiveX control in SiteKiosk before 6.5.150 is installed "safe for scripting", which allows local users to bypass security protections and read arbitrary files via certain functions.
17 CVE-2006-6509 XSS Bypass 2006-12-13 2008-09-05
4.1
 User Local Medium Single system Partial Partial Partial
Cross-site scripting (XSS) vulnerability in the skinning feature in SiteKiosk before 6.5.150 allows local users to bypass security protections and inject arbitrary web script or HTML via an ABOUT: URI, which is displayed in the title bar of the browser.
18 CVE-2006-6507 XSS Bypass 2006-12-19 2008-09-05
4.3
 None Remote Medium Not required None Partial None
Mozilla Firefox 2.0 before 2.0.0.1 allows remote attackers to bypass Cross-Site Scripting (XSS) protection via vectors related to a Function.prototype regression error.
19 CVE-2006-6503 XSS Bypass 2006-12-19 2010-11-30
6.8
 User Remote Medium Not required Partial Partial Partial
Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to bypass cross-site scripting (XSS) protection by changing the src attribute of an IMG element to a javascript: URI.
20 CVE-2006-6441 Bypass 2006-12-10 2008-09-10
4.6
 None Local Low Not required Partial Partial Partial
Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows local users to bypass security controls and boot Alchemy via certain alternate boot media, as demonstrated by a USB thumb drive.
21 CVE-2006-6434 Bypass 2006-12-10 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the Web User Interface in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows remote attackers to bypass authentication controls via unknown vectors.
22 CVE-2006-6409 DoS Bypass 2006-12-09 2008-09-05
10.0
 None Remote Low Not required Complete Complete Complete
F-Secure Anti-Virus for Linux Gateways 4.65 allows remote attackers to cause a denial of service (possibly fatal scan error), and possibly bypass virus detection, by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
23 CVE-2006-6408 Bypass 2006-12-09 2008-09-05
5.0
 None Remote Low Not required None Partial None
Kaspersky Anti-Virus for Linux Mail Servers 5.5.10 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
24 CVE-2006-6407 Bypass 2006-12-09 2008-09-05
5.0
 None Remote Low Not required None Partial None
F-Prot Antivirus for Linux x86 Mail Servers 4.6.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
25 CVE-2006-6406 Bypass 2006-12-09 2010-09-15
5.0
 None Remote Low Not required None Partial None
Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
26 CVE-2006-6405 Bypass 2006-12-09 2008-09-05
5.0
 None Remote Low Not required None Partial None
BitDefender Mail Protection for SMB 2.0 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
27 CVE-2006-6383 Bypass 2006-12-10 2008-11-15
4.6
 None Local Low Not required Partial Partial Partial
PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ";" in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path.
28 CVE-2006-6276 XSS Bypass 2006-12-04 2008-09-05
6.8
 None Remote Medium Not required Partial Partial Partial
HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting (XSS), and poison web caches via unspecified attack vectors.
29 CVE-2006-6264 Bypass 2006-12-04 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Teredo creates trusted peer entries for arbitrary incoming source Teredo addresses, even if the low 32 bits represent an intranet address, which might allow remote attackers to send IPv4 traffic to intranet hosts that use non-RFC1918 addresses, bypassing IPv4 ingress filtering.
30 CVE-2006-6263 Bypass 2006-12-04 2008-09-05
6.8
 User Remote Medium Not required Partial Partial Partial
Teredo clients, when source routing is enabled, recognize a Routing header in an encapsulated IPv6 packet and send the packet to the next hop, which might allow remote attackers to bypass policies of certain Internet gateways that drop all source-routed packets.
31 CVE-2006-6165 +Priv Bypass 2006-11-28 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
** DISPUTED ** ld.so in FreeBSD, NetBSD, and possibly other BSD distributions does not remove certain harmful environment variables, which allows local users to gain privileges by passing certain environment variables to loading processes. NOTE: this issue has been disputed by a third party, stating that it is the responsibility of the application to properly sanitize the environment.
32 CVE-2006-6123 XSS Bypass 2006-11-26 2008-09-05
2.6
 None Remote High Not required None Partial None
Coppermine Photo Gallery (CPG) 1.4.8 stable, with register_globals enabled, allows remote attackers to bypass XSS protection and set arbitrary variables via a query string that causes the variable to be defined in global space, with separate _GET, _REQUEST, or other critical parameters, which are unset by the protection scheme and prevent the original variable from being detected.
33 CVE-2006-5916 Bypass 2006-11-15 2008-09-10
5.0
 None Remote Low Not required None Partial None
Intego VirusBarrier X4 allows context-dependent attackers to bypass virus protection by quickly injecting many infected files into the filesystem, which prevents VirusBarrier from processing all the files.
34 CVE-2006-5794 Bypass 2006-11-08 2010-09-15
7.5
 User Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker verification that authentication has been successful, which might allow attackers to bypass authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging vulnerabilities in the unprivileged process, which are not known to exist.
35 CVE-2006-5787 Bypass 2006-11-07 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
admin/index.php in IPrimal Forums as of 20061105 allows remote attackers to bypass authentication and modify user passwords via a direct request, possibly related to an authentication issue in admin/chk_admin.php.
36 CVE-2006-5778 Bypass 2006-11-07 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
ftpd in linux-ftpd 0.17, and possibly other versions, performs a chdir before setting the UID, which allows local users to bypass intended access restrictions by redirecting their home directory to a restricted directory.
37 CVE-2006-5777 Bypass 2006-11-06 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Creasito E-Commerce Content Manager 1.3.08 allows remote attackers to bypass authentication and perform privileged functions via a non-empty finame parameter to (1) addnewcont.php, (2) adminpassw.php, (3) amministrazione.php, (4) artins.php, (5) bgcolor.php, (6) cancartcat.php, (7) canccat.php, (8) cancelart.php, (9) cancontsit.php, (10) chanpassamm.php, (11) dele.php, (12) delecat.php, (13) delecont.php, (14) emailall.php, (15) gestflashtempl.php, (16) gestmagart.php, (17) gestmagaz.php, (18) gestpre.php, (19) input.php, (20) input3.php, (21) insnucat.php, (22) instempflash.php, (23) mailfc.php, (24) modfdati.php, (25) rescont4.php, (26) ricordo1.php, (27) ricordo4.php, (28) tabcatalg.php, (29) tabcont.php, (30) tabcont3.php, (31) tabstile.php, (32) tabstile3.php, (33) testimmg.php, and (34) update.php in admin/. NOTE: some of these details are obtained from third party information.
38 CVE-2006-5706 Bypass 2006-11-03 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Unspecified vulnerabilities in PHP, probably before 5.2.0, allow local users to bypass open_basedir restrictions and perform unspecified actions via unspecified vectors involving the (1) chdir and (2) tempnam functions. NOTE: the tempnam vector might overlap CVE-2006-1494.
39 CVE-2006-5668 Bypass 2006-11-02 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Ampache 3.3.2 and earlier, when register_globals is enabled, allows remote attackers to bypass security restrictions and gain guest access.
40 CVE-2006-5660 Bypass 2006-11-02 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Cisco Security Agent Management Center (CSAMC) 5.1 before 5.1.0.79 does not properly handle certain LDAP error messages, which allows remote attackers to bypass authentication requirements via an empty password when using an external LDAP server.
41 CVE-2006-5592 Bypass 2006-10-27 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Admin/adpoll.asp in PacPoll 4.0 and earlier allows remote attackers to bypass authentication by settng the polllog cookie value to "xx".
42 CVE-2006-5428 Bypass +Info 2006-10-20 2008-09-05
5.0
 None Remote Low Not required Partial None None
rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a display_get_requesters operation, which allows remote attackers to bypass the GUI login and obtain sensitive information (ticket data) via a direct request.
43 CVE-2006-5412 Exec Code Bypass 2006-10-20 2008-09-05
5.1
 User Remote High Not required Partial Partial Partial
admin.php in PHP Outburst Easynews 4.4.1 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication, and gain the ability to execute arbitrary code, via the en_login_id parameter.
44 CVE-2006-5340 Sql Bypass 2006-10-17 2012-10-22
7.1
 None Remote High Single system Complete Complete Complete
Multiple unspecified vulnerabilities in Oracle Spatial component in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2 have unknown impact and remote authenticated attack vectors related to (1) mdsys.sdo_lrs, aka Vuln# DB13, and (2) Vuln# DB17. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB13 is related to bypassing input validation for SQL injection related to convert_to_lrs_layer and dbms_assert, and DB17 is related to SQL injection in the trigger in the SDO_DROP_USER package.
45 CVE-2006-5290 Exec Code Bypass 2006-10-13 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
The ESS/ Network Controller and MicroServer Web Server components of Xerox WorkCentre and WorkCentre Pro 232, 238, 245, 255, 265 and 275 allow remote attackers to bypass authentication and execute arbitrary code via "WebUI command injection on TCP/IP hostname."
46 CVE-2006-5245 Bypass 2006-10-11 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Eazy Cart allows remote attackers to bypass authentication and gain administrative access via a direct request for admin/home/index.php, and possibly other PHP scripts under admin/.
47 CVE-2006-5178 362 Bypass 2006-10-10 2010-09-15
6.2
 Admin Local High Not required Complete Complete Complete
Race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions to change the file path after the open_basedir check and before the file is opened by the underlying system, as demonstrated by symlinking a symlink into a subdirectory, to point to a parent directory via .. (dot dot) sequences, and then unlinking the resulting symlink.
48 CVE-2006-4983 Bypass 2006-09-25 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Cisco NAC allows quarantined devices to communicate over the network with (1) DNS, (2) DHCP, and (3) EAPoUDP, which allows attackers to bypass control methods by tunneling network traffic through one of these protocols.
49 CVE-2006-4982 Bypass 2006-09-25 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
Cisco NAC maintains an exception list that does not record device properties other than MAC address, which allows physically proximate attackers to bypass control methods and join a local network by spoofing the MAC address of a different type of device, as demonstrated by using the MAC address of a disconnected printer.
50 CVE-2006-4981 Bypass 2006-09-25 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
Symantec Sygate NAC allows physically proximate attackers to bypass control methods and join a local network by selecting a forged MAC address associated with an exception rule that (1) permits all non-Windows devices or (2) whitelists certain sets of Organizationally Unique Identifiers (OUIs).
Total number of vulnerabilities : 267   Page : 1 (This Page)2 3 4 5 6
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.