Security Vulnerabilities Published In 2006(Gain Information)

2006 : January February March April May June July August September October November December

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2006-6914		+Info	2006-12-31	2011-03-08	5.0	None	Remote	Low	Not required	Partial	None	None
Unspecified vulnerability in ftpd in IBM AIX 5.2.0 and 5.3.0 allows remote attackers to obtain sensitive information, including passwords, via unspecified vectors.
2	CVE-2006-6891		+Info	2006-12-31	2017-10-19	5.0	None	Remote	Low	Not required	Partial	None	None
Vz (Adp) Forum 2.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrative account name and password hash via a direct request for users/admin.txt.
3	CVE-2006-6889		+Info	2006-12-31	2017-10-19	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
FreeStyle Wiki (fswiki) 3.6.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain passwords via a direct request for config/user.dat.
4	CVE-2006-6888		+Info	2006-12-31	2017-10-19	5.0	None	Remote	Low	Not required	Partial	None	None
P-News 1.16 and 1.17 store sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrative account name and password hash via a direct request for db/user.dat.
5	CVE-2006-6886	200	+Info	2006-12-31	2017-07-29	5.0	None	Remote	Low	Not required	Partial	None	None
phpwcms 1.2.5-DEV allows remote attackers to obtain sensitive information via a direct request for (1) files.public-userroot.inc.php or (2) files.private.additions.inc.php in include/inc_lib/, which reveals the path in various error messages.
6	CVE-2006-6866		+Info	2006-12-31	2017-10-19	7.8	None	Remote	Low	Not required	Complete	None	None
STphp EasyNews PRO 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, email addresses, and password hashes via a direct request for data/users.txt.
7	CVE-2006-6838		+Info	2006-12-31	2018-10-17	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Rediff Bol Downloader ActiveX (OCX) control allows remote attackers to execute arbitrary files, and obtain sensitive information (usernames and pathnames), via a URL in the url vbscript parameter.
8	CVE-2006-6829		+Info	2006-12-31	2011-03-08	7.8	None	Remote	Low	Not required	Complete	None	None
Efkan Forum 1.0 and earlier store sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for forum.mdb. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
9	CVE-2006-6825		+Info	2006-12-29	2011-03-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Calendar MX BASIC 1.0.2 and earlier store sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for calendar.mdb. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
10	CVE-2006-6817		+Info	2006-12-29	2018-10-17	5.0	None	Remote	Low	Not required	Partial	None	None
AlstraSoft Web Host Directory allows remote attackers to obtain sensitive information by requesting any invalid URI, which reveals the path in an error message, a different vulnerability than CVE-2006-2617.
11	CVE-2006-6781		+Info	2006-12-28	2018-10-17	5.0	None	Remote	Low	Not required	Partial	None	None
HLstats 1.20 through 1.34 allows remote attackers to obtain sensitive information via playinfo mode, with certain values of the player and playerdata[lastName][] parameters, which reveals the path in an error message.
12	CVE-2006-6757		Dir. Trav. +Info	2006-12-27	2017-10-19	7.8	None	Remote	Low	Not required	Complete	None	None
Directory traversal vulnerability in index.php in cwmExplorer 1.0 allows remote attackers to read arbitrary files and source code, and obtain sensitive information via directory traversal sequences in the show_file parameter.
13	CVE-2006-6755		+Info	2006-12-27	2018-10-17	5.0	None	Remote	Low	Not required	Partial	None	None
Ixprim 1.2 allows remote attackers to obtain sensitive information via a direct request for kernel/plugins/fckeditor2/ixprim_api.php, which reveals the path in an error message.
14	CVE-2006-6735	200	Dir. Trav. +Info	2006-12-26	2018-10-17	5.0	None	Remote	Low	Not required	Partial	None	None
modules/viewcategory.php in Minh Nguyen Duong Obie Website Mini Web Shop 2.1.c allows remote attackers to obtain sensitive information via a request with an arbitrary catname parameter but no itemsdb parameter, which reveals the path in an error message. NOTE: CVE analysis suggests that this error might be resultant from a more serious issue such as directory traversal.
15	CVE-2006-6674	310	+Info	2006-12-21	2011-08-25	2.1	None	Local	Low	Not required	Partial	None	None
Ozeki HTTP-SMS Gateway 1.0, and possibly earlier, stores usernames and passwords in plaintext in the HKLM\Software\Ozeki\SMSServer\CurrentVersion\Plugins\httpsmsgate registry key, which allows local users to obtain sensitive information.
16	CVE-2006-6658		+Info	2006-12-20	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
Inktomi Search 4.1.4 allows remote attackers to obtain sensitive information via direct requests with missing parameters to (1) help/header.html, (2) thesaurus.html, and (3) topics.html, which leak the installation path in the resulting error message, a related issue to CVE-2006-5970.
17	CVE-2006-6656		+Info	2006-12-20	2008-09-05	2.1	None	Local	Low	Not required	Partial	None	None
Unspecified vulnerability in ptrace in NetBSD-current before 20061027, NetBSD 3.0 and 3.0.1 before 20061027, and NetBSD 2.x before 20061119 allows local users to read kernel memory and obtain sensitive information via certain manipulations of a PT_LWPINFO request, which leads to a memory leak and information leak.
18	CVE-2006-6637	200	+Info	2006-12-19	2011-06-14	5.0	None	Remote	Low	Not required	Partial	None	None
The Servlet Engine and Web Container in IBM WebSphere Application Server (WAS) before 6.0.2.17, when ibm-web-ext.xmi sets fileServingEnabled to true and servlet caching is enabled, allows remote attackers to obtain JSP source code and other sensitive information via "specific requests."
19	CVE-2006-6617		+Info	2006-12-18	2018-10-17	6.5	None	Remote	Low	???	Partial	Partial	Partial
projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 allows remote authenticated users to obtain the MSProjectUser password for a SQL database via a GetInitializationData request, which includes the information in the UserName and Password tags of the response.
20	CVE-2006-6613		Dir. Trav. +Info	2006-12-18	2017-10-19	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Directory traversal vulnerability in language.php in phpAlbum 0.4.1 Beta 6 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files or obtain sensitive information via a .. (dot dot) in the pa_lang[include_file] parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by language.php.
21	CVE-2006-6583		+Info	2006-12-15	2008-09-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
ScriptMate User Manager 2.1 and earlier allow remote attackers to obtain sensitive information via unspecified vectors related to (1) the Logins box and (2) the Search box.
22	CVE-2006-6580		+Info	2006-12-15	2008-09-05	6.4	None	Remote	Low	Not required	None	Partial	Partial
admin/change.php in ProNews 1.5 does not check whether a user is permitted to change news items, which allows remote attackers to add or delete information within an item, and possibly have other impacts. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
23	CVE-2006-6574		+Info	2006-12-15	2017-07-29	5.0	None	Remote	Low	Not required	Partial	None	None
Mantis before 1.1.0a2 does not implement per-item access control for Issue History (Bug History), which allows remote attackers to obtain sensitive information by reading the Change column, as demonstrated by the Change column of a custom field.
24	CVE-2006-6573		+Info	2006-12-15	2017-07-29	6.0	None	Remote	Medium	???	Partial	Partial	Partial
Unspecified vulnerability in Citrix Access Gateway 4.5 Advanced Edition, and 4.2 with Advanced Access Control (AAC) 4.2, when deployed on the Access Gateway appliance 4.2 through 4.2.2 allows remote authenticated users to "gain access to data" and obtain sensitive information via unspecified vectors.
25	CVE-2006-6569		+Info	2006-12-15	2018-10-17	7.8	None	Remote	Low	Not required	Complete	None	None
form.php in GenesisTrader 1.0 allows remote attackers to read source code for arbitrary files and obtain sensitive information via the (1) do and (2) chem parameters with a "modfich" floap parameter.
26	CVE-2006-6529		+Info	2006-12-14	2008-09-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Chatroom Module before 4.7.x.-1.0 for Drupal displays private messages in a chatroom's last messages overview, which allows remote attackers to obtain sensitive information by reading the overview.
27	CVE-2006-6482		+Info	2006-12-12	2018-10-17	5.0	None	Remote	Low	Not required	Partial	None	None
Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request (1) for a non-existent (a) JWS, (b) CFM, (c) CFML, or (d) CFC file, which displays the installation path in the resulting error message; or (2) to /CFIDE/administrator/login.cfm without a host, which can reveal the server's internal IP address in an HREF tag.
28	CVE-2006-6480		+Info	2006-12-12	2018-10-17	5.0	None	Remote	Low	Not required	Partial	None	None
admin/admin_membre/fiche_membre.php in AnnonceScriptHP 2.0 allows remote attackers to obtain sensitive information via the idmembre parameter, which discloses the passwords for arbitrary users.
29	CVE-2006-6460		+Info	2006-12-11	2017-07-29	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Yourfreeworld.com Short Url & Url Tracker Script allows remote attackers to obtain sensitive information via an invalid id parameter to login.php, which leaks the path in an error message. NOTE: this issue might be resultant from CVE-2006-2509.
30	CVE-2006-6457	200	+Info	2006-12-11	2018-10-17	5.0	None	Remote	Low	Not required	Partial	None	None
tiki-wiki_rss.php in Tikiwiki 1.9.5, 1.9.2, and possibly other versions allows remote attackers to obtain sensitive information (MySQL username and password) via an invalid (large or negative) ver parameter, which leaks the information in an error message.
31	CVE-2006-6449		+Info	2006-12-10	2017-07-29	6.4	None	Remote	Low	Not required	Partial	Partial	None
Vt-Forum Lite 1.3 and earlier store sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/forum.mdb. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
32	CVE-2006-6439		+Info	2006-12-10	2008-09-10	7.8	None	Remote	Low	Not required	Complete	None	None
Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows remote attackers to download the audit log and obtain potentially sensitive information via unspecified vectors.
33	CVE-2006-6435		+Info	2006-12-10	2008-09-10	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The SNMP implementation in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 does not generate authentication failure traps, which allows remote attackers to more easily gain system access and obtain sensitive information via a brute force attack.
34	CVE-2006-6430		+Info	2006-12-10	2017-07-29	7.8	None	Remote	Low	Not required	Complete	None	None
Web services in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 do not require HTTPS, which allows remote attackers to obtain sensitive information by sniffing the unencrypted HTTP traffic.
35	CVE-2006-6392		Dir. Trav. +Info	2006-12-08	2017-07-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Directory traversal vulnerability in index.php in plx Web Studio (aka plxWebDev) plx Pay 3.2 and earlier allows remote attackers to include and execute arbitrary local files, or obtain user credentials and other sensitive information, via a .. (dot dot) in the read parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
36	CVE-2006-6373		+Info	2006-12-07	2018-10-17	5.0	None	Remote	Low	Not required	Partial	None	None
PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via a direct request for libraries/common.lib.php, which reveals the path in an error message.
37	CVE-2006-6346		DoS +Info	2006-12-07	2018-10-17	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Unspecified vulnerability in SAP Internet Graphics Service (IGS) 6.40 Patchlevel 15 and earlier, and 7.00 Patchlevel 3 and earlier, allows remote attackers to cause a denial of service (service shutdown), obtain sensitive information (configuration files), and conduct certain other unauthorized activities, related to "Undocumented Features." NOTE: it is possible that there are multiple issues. This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended. This is likely a different issue than CVE-2006-4134.
38	CVE-2006-6286		+Info	2006-12-04	2017-07-29	1.7	None	Local	Low	???	Partial	None	None
Palm Desktop 4.1.4 and earlier stores user data with weak permissions under the application directory, which allows local users to obtain sensitive information (address books, calendar files, and todo lists of other users) via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
39	CVE-2006-6279		+Info	2006-12-04	2018-10-17	5.0	None	Remote	Low	Not required	Partial	None	None
index.php in @lex Guestbook 4.0.1 allows remote attackers to obtain sensitive information via a skin parameter referencing a nonexistent skin, which reveals the installation path in an error message.
40	CVE-2006-6273		+Info	2006-12-04	2018-10-17	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
sp_index.php in Simple PHP Gallery 1.1 allows remote attackers to obtain sensitive information via an invalid dir parameter, which reveals the path in an error message.
41	CVE-2006-6267		+Info	2006-12-04	2018-10-17	7.8	None	Remote	Low	Not required	Complete	None	None
PostNuke 0.7.5.0, and certain minor versions, allows remote attackers to obtain sensitive information via a non-numeric value of the stop parameter, which reveals the path in an error message.
42	CVE-2006-6257		+Info	2006-12-04	2018-10-17	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The file manager in AlternC 0.9.5 and earlier, when warnings are enabled in PHP, allows remote attackers to obtain sensitive information via certain folder names such as ones composed of JavaScript code, which reveal the path in a warning message.
43	CVE-2006-6253		+Info	2006-12-04	2018-10-17	5.0	None	Remote	Low	Not required	Partial	None	None
Cahier de texte 2.0 stores sensitive information under the web root, possibly with insufficient access control, which might allow remote attackers to obtain all users' passwords via a direct request for administration/dump.sql.
44	CVE-2006-6248		+Info	2006-12-04	2018-10-17	7.8	None	Remote	Low	Not required	Complete	None	None
index.php in GPhotos 1.5 allows remote attackers to obtain sensitive information via an invalid rep parameter, which reveals the full path in an error message.
45	CVE-2006-6238		+Info	2006-12-03	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
The AutoFill feature in Apple Safari 2.0.4 does not properly verify that all automatically populated form fields are visible to the user, which allows remote attackers to obtain sensitive information, such as usernames and passwords, via input fields of zero width, a variant of CVE-2006-6077.
46	CVE-2006-6231		+Info	2006-12-02	2018-10-17	5.0	None	Remote	Low	Not required	Partial	None	None
vuBB 0.2.1 and earlier allows remote attackers to obtain sensitive information via a direct request to includes/vubb.php, which leaks the path in an error message.
47	CVE-2006-6119		+Info	2006-11-26	2018-10-17	5.0	None	Remote	Low	Not required	Partial	None	None
mmgallery 1.55 allows remote attackers to obtain sensitive information via a direct request for thumbs.php, which reveals the installation path in various error messages.
48	CVE-2006-6113		+Info	2006-11-28	2018-10-17	5.0	None	Remote	Low	Not required	Partial	None	None
Monkey Boards 0.3.5 allows remote attackers to obtain sensitive information via direct requests to (1) include/admin_auth.inc.php and (2) include/engine/class.compiler.php, which reveals the full path in an error message. NOTE: this issue is only an exposure if the administrator has changed the default script path.
49	CVE-2006-6085		+Info	2006-11-24	2017-07-20	5.0	None	Remote	Low	Not required	Partial	None	None
Kile before 1.9.3 does not assign a backup file the same permissions as the original file, which might allow local users to obtain sensitive information.
50	CVE-2006-6010		+Info	2006-11-21	2018-10-17	5.0	None	Remote	Low	Not required	Partial	None	None
SAP allows remote attackers to obtain potentially sensitive information such as operating system and SAP version via an RFC_SYSTEM_INFO RfcCallReceive request, a different vulnerability than CVE-2003-0747.

Total number of vulnerabilities : 272 Page : 1 (This Page)2 3 4 5 6