cpe:/a:microsoft:office:2000:sp3 cpe:/a:microsoft:office:2003:sp1 cpe:/a:microsoft:office:2003:sp2 cpe:/a:microsoft:office:xp:sp3 cpe:/a:microsoft:publisher:2000 cpe:/a:microsoft:publisher:2002 cpe:/a:microsoft:publisher:2003 CVE-2006-0001 2006-09-12T19:07:00.000-04:00 2018-10-19T11:41:40.993-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SREASON 1548 SECTRACK 1016825 MISC http://www.computerterrorism.com/research/ct12-09-2006-2.htm CERT-VN VU#406236 BUGTRAQ 20060912 Computer Terrorism (UK) :: Incident Response Centre - Microsoft Publisher Font Parsing Vulnerability HP SSRT061187 BID 19951 CERT TA06-255A VUPEN ADV-2006-3565 MS MS06-054 XF publisher-pub-code-execution(28648) Stack-based buffer overflow in Microsoft Publisher 2000 through 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted PUB file, which causes an overflow when parsing fonts. cpe:/a:microsoft:exchange_server:5.0 cpe:/a:microsoft:exchange_server:5.0:sp1 cpe:/a:microsoft:exchange_server:5.0:sp2 cpe:/a:microsoft:exchange_server:5.5 cpe:/a:microsoft:exchange_server:5.5:sp1 cpe:/a:microsoft:exchange_server:5.5:sp2 cpe:/a:microsoft:exchange_server:5.5:sp3 cpe:/a:microsoft:exchange_server:5.5:sp4 cpe:/a:microsoft:exchange_server:2000:sp3 cpe:/a:microsoft:office:2000:sp3 cpe:/a:microsoft:office:2003:sp1 cpe:/a:microsoft:office:2003:sp2 cpe:/a:microsoft:office:xp:sp3 cpe:/a:microsoft:outlook:2000:sp3 cpe:/a:microsoft:outlook:2002:sp3 cpe:/a:microsoft:outlook:2003 CVE-2006-0002 2006-01-10T17:03:00.000-05:00 2018-10-19T11:41:42.057-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SREASON 330 SREASON 331 SECTRACK 1015460 SECTRACK 1015461 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-004.htm CERT-VN VU#252146 BUGTRAQ 20060110 Microsoft Exchange Critical Vulnerability BUGTRAQ 20060110 Microsoft Outlook Critical Vulnerability BID 16197 CERT TA06-010A VUPEN ADV-2006-0119 MS MS06-003 XF win-tnef-overflow(22878) Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation. cpe:/a:microsoft:data_access_components:2.5:sp3 cpe:/a:microsoft:data_access_components:2.7 cpe:/a:microsoft:data_access_components:2.7:sp1 cpe:/a:microsoft:data_access_components:2.8 cpe:/a:microsoft:data_access_components:2.8:sp1 cpe:/a:microsoft:data_access_components:2.8:sp2 CVE-2006-0003 2006-04-11T20:02:00.000-04:00 2018-10-19T11:41:44.290-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015894 CONFIRM http://www.hitachi-support.com/security_e/vuls_e/HS06-013_e/01-e.html CONFIRM http://www.hitachi-support.com/security_e/vuls_e/HS06-013_e/index-e.html CERT-VN VU#234812 BUGTRAQ 20070729 Exploit In Internet Explorer BUGTRAQ 20070730 Re: Exploit In Internet Explorer BUGTRAQ 20070730 RE: Exploit In Internet Explorer BUGTRAQ 20070731 Re: Exploit In Internet Explorer BUGTRAQ 20080128 Exploit in IE6,7 BUGTRAQ 20080128 Re: Exploit in IE6,7 BID 17462 BID 20797 MISC http://www.securityfocus.com/data/vulnerabilities/exploits/0day_ie.pdf CERT TA06-101A VUPEN ADV-2006-1319 VUPEN ADV-2006-2452 MS MS06-014 XF mdac-rdsdataspace-execute-code(25006) XF ie-wscriptshell-command-execution(29915) EXPLOIT-DB 2052 EXPLOIT-DB 2164 Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in Microsoft Data Access Components (MDAC) 2.7 and 2.8, allows remote attackers to execute arbitrary code via unknown attack vectors. cpe:/a:microsoft:office:2000:sp3 CVE-2006-0004 2006-02-14T15:02:00.000-05:00 2018-10-12T17:38:12.317-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SECTRACK 1015632 CERT-VN VU#963628 BID 16634 VUPEN ADV-2006-0579 MS MS06-010 XF powerpoint-tiff-information-disclosure(24490) Microsoft PowerPoint 2000 in Office 2000 SP3 has an interaction with Internet Explorer that allows remote attackers to obtain sensitive information via a PowerPoint presentation that attempts to access objects in the Temporary Internet Files Folder (TIFF). cpe:/o:microsoft:windows-nt:datacenter_server cpe:/o:microsoft:windows-nt:datacenter_server:sp1 cpe:/o:microsoft:windows-nt:datacenter_server:sp2 cpe:/o:microsoft:windows-nt:datacenter_server:sp3 cpe:/o:microsoft:windows-nt:datacenter_server:sp4 cpe:/o:microsoft:windows-nt:xp:sp2:home cpe:/o:microsoft:windows-nt:xp_tablet_pc cpe:/o:microsoft:windows-nt:xp_tablet_pc:sp1 cpe:/o:microsoft:windows-nt:xp_tablet_pc:sp2 cpe:/o:microsoft:windows_2000::sp1:pro cpe:/o:microsoft:windows_2000::sp2:pro cpe:/o:microsoft:windows_2000::sp3:pro cpe:/o:microsoft:windows_2000::sp4 cpe:/o:microsoft:windows_2000::sp4:pro cpe:/o:microsoft:windows_2000:- cpe:/o:microsoft:windows_2000_advanced_server cpe:/o:microsoft:windows_2000_advanced_server:sp1 cpe:/o:microsoft:windows_2000_advanced_server:sp2 cpe:/o:microsoft:windows_2000_advanced_server:sp3 cpe:/o:microsoft:windows_2000_advanced_server:sp4 cpe:/o:microsoft:windows_2003_server:datacenter_edition cpe:/o:microsoft:windows_2003_server:datacenter_edition_64-bit cpe:/o:microsoft:windows_2003_server:enterprise_edition cpe:/o:microsoft:windows_2003_server:enterprise_edition_64-bit cpe:/o:microsoft:windows_2003_server:standard cpe:/o:microsoft:windows_2003_server:standard_64-bit cpe:/o:microsoft:windows_2003_server:web_edition cpe:/o:microsoft:windows_server_2000:none cpe:/o:microsoft:windows_server_2000:sp1 cpe:/o:microsoft:windows_server_2000:sp2 cpe:/o:microsoft:windows_server_2000:sp3 cpe:/o:microsoft:windows_server_2003:datacenter_sp1 cpe:/o:microsoft:windows_server_2003:enterprise_sp1 cpe:/o:microsoft:windows_server_2003:standard_sp1 cpe:/o:microsoft:windows_server_2003:web_edition_sp1 cpe:/o:microsoft:windows_xp:::home cpe:/o:microsoft:windows_xp:::media_center cpe:/o:microsoft:windows_xp:::pro cpe:/o:microsoft:windows_xp:::x64 cpe:/o:microsoft:windows_xp::sp1:home cpe:/o:microsoft:windows_xp::sp1:media_center cpe:/o:microsoft:windows_xp::sp1:pro cpe:/o:microsoft:windows_xp::sp2:media_center cpe:/o:microsoft:windows_xp::sp2:pro cpe:/o:microsoft:windows_xp:- CVE-2006-0005 2006-02-14T14:06:00.000-05:00 2019-04-30T10:27:13.913-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015628 IDEFENSE 20060214 Microsoft Windows Media Player Plugin Buffer Overflow Vulnerability CERT-VN VU#692060 BID 16644 CERT TA06-045A VUPEN ADV-2006-0575 MS MS06-006 XF win-mediaplayer-plugin-embed-bo(24493) Buffer overflow in the plug-in for Microsoft Windows Media Player (WMP) 9 and 10, when used in browsers other than Internet Explorer and set as the default application to handle media files, allows remote attackers to execute arbitrary code via HTML with an EMBED element containing a long src attribute. cpe:/a:microsoft:windows_media_player:7.1 cpe:/a:microsoft:windows_media_player:9 cpe:/a:microsoft:windows_media_player:10 cpe:/o:microsoft:windows_2000::sp1 cpe:/o:microsoft:windows_2000::sp4::fr cpe:/o:microsoft:windows_2003_server:r2 cpe:/o:microsoft:windows_98::gold cpe:/o:microsoft:windows_98se cpe:/o:microsoft:windows_me cpe:/o:microsoft:windows_xp::sp1:tablet_pc cpe:/o:microsoft:windows_xp::sp2:tablet_pc CVE-2006-0006 2006-02-14T17:06:00.000-05:00 2018-10-19T11:41:47.633-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SREASON 423 SECTRACK 1015627 MISC http://www.eeye.com/html/research/advisories/AD20060214.html CERT-VN VU#291396 BUGTRAQ 20060214 [EEYEB-20051017] Windows Media Player BMP Heap Overflow BUGTRAQ 20060215 Windows Media Player BMP Heap Overflow (MS06-005) BID 16633 CERT TA06-045A VUPEN ADV-2006-0574 MS MS06-005 XF win-media-player-bmp-bo(24488) Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4, Media Player 9 on Windows 2000 SP4 and XP SP1, and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap (.BMP) file that specifies a size of 0 but contains additional data. cpe:/a:microsoft:office:2000:sp3 cpe:/a:microsoft:office:2003:sp1 cpe:/a:microsoft:office:2003:sp2 cpe:/a:microsoft:office:xp:sp3 CVE-2006-0007 2006-07-11T17:05:00.000-04:00 2018-10-19T11:41:49.307-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS VULNWATCH 20060712 NSFOCUS SA2006-04 : Microsoft Office GIF Filter Buffer Overflow Vulnerability SECTRACK 1016470 CERT-VN VU#668564 BUGTRAQ 20060712 NSFOCUS SA2006-04 : Microsoft Office GIF Filter Buffer Overflow Vulnerability BID 18915 CERT TA06-192A VUPEN ADV-2006-2757 MS MS06-039 Buffer overflow in GIFIMP32.FLT, as used in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via a crafted GIF image that triggers memory corruption when it is parsed. cpe:/a:microsoft:office:2003 cpe:/a:microsoft:office:2003:sp1 cpe:/a:microsoft:office:2003:sp2 cpe:/o:microsoft:windows_2003_server:datacenter_64-bit:sp1 cpe:/o:microsoft:windows_2003_server:enterprise::64-bit cpe:/o:microsoft:windows_2003_server:enterprise:sp1 cpe:/o:microsoft:windows_2003_server:enterprise_64-bit cpe:/o:microsoft:windows_2003_server:enterprise_64-bit:sp1 cpe:/o:microsoft:windows_2003_server:r2::64-bit cpe:/o:microsoft:windows_2003_server:r2::datacenter_64-bit cpe:/o:microsoft:windows_2003_server:r2:sp1 cpe:/o:microsoft:windows_2003_server:standard::64-bit cpe:/o:microsoft:windows_2003_server:standard:sp1 cpe:/o:microsoft:windows_2003_server:standard_64-bit cpe:/o:microsoft:windows_2003_server:web cpe:/o:microsoft:windows_2003_server:web:sp1 cpe:/o:microsoft:windows_xp:::64-bit cpe:/o:microsoft:windows_xp:::home cpe:/o:microsoft:windows_xp:::media_center cpe:/o:microsoft:windows_xp::gold:professional cpe:/o:microsoft:windows_xp::sp1:home cpe:/o:microsoft:windows_xp::sp1:media_center cpe:/o:microsoft:windows_xp::sp2:home cpe:/o:microsoft:windows_xp::sp2:media_center cpe:/o:microsoft:windows_xp::sp2:tablet_pc CVE-2006-0008 2006-02-14T14:06:00.000-05:00 2018-10-30T12:25:26.903-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015631 CERT-VN VU#739844 MISC http://www.ryanstyle.com/alert/my/5/ms06_009_eng.html BUGTRAQ 20060215 Security advisory: Windows IME Vulnerability (MS06-009) BID 16643 VUPEN ADV-2006-0578 MS MS06-009 XF win-korean-ime-privilege-elevation(24492) The ShellAbout API call in Korean Input Method Editor (IME) in Korean versions of Microsoft Windows XP SP1 and SP2, Windows Server 2003 up to SP1, and Office 2003, allows local users to gain privileges by launching the "shell about dialog box" and clicking the "End-User License Agreement" link, which executes Notepad with the privileges of the program that displays the about box. cpe:/a:microsoft:office:2000:sp3 cpe:/a:microsoft:office:2003:sp1 cpe:/a:microsoft:office:2003:sp2 cpe:/a:microsoft:office:2004::mac cpe:/a:microsoft:office:v.x::mac cpe:/a:microsoft:office:xp:sp3 cpe:/a:microsoft:works:2000 cpe:/a:microsoft:works:2001 cpe:/a:microsoft:works:2002 cpe:/a:microsoft:works:2003 cpe:/a:microsoft:works:2004 cpe:/a:microsoft:works:2005 cpe:/a:microsoft:works:2006 CVE-2006-0009 2006-03-14T18:02:00.000-05:00 2018-10-19T11:41:51.667-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060822 Major updates in PowerPoint FAQ document - not a 0-day issue MISC http://blogs.securiteam.com/?author=28 MISC http://blogs.securiteam.com/?p=557 MISC http://blogs.securiteam.com/?p=559 MISC http://isc.sans.org/diary.php?storyid=1618 FULLDISC 20060919 New PowerPoint 0-day Trojan in the wild SECTRACK 1015766 SECTRACK 1016720 SECTRACK 1016886 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm MISC http://www.darkreading.com/document.asp?doc_id=101970 CERT-VN VU#682820 BUGTRAQ 20060314 SYMSA-2006-001: Buffer overflow in Microsoft Office 2000, Office XP (2002), and Office 2003 Routing Slip Metadata BUGTRAQ 20060422 PowerPoint Phishing Trojan BUGTRAQ 20060819 New PowerPoint 0-day and Trojan - FAQ document ready BUGTRAQ 20060822 Major updates in PowerPoint FAQ document - not a 0-day issue BUGTRAQ 20060919 New PowerPoint 0-day Trojan in the wild BUGTRAQ 20060919 Microsoft PowerPoint 0-day Vulnerability FAQ - September written BID 17000 BID 20059 MISC http://www.symantec.com/enterprise/research/SYMSA-2006-001.txt MISC http://www.symantec.com/security_response/writeup.jsp?docid=2006-091810-5028-99 MISC http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ%5FMDROPPER%2EBH CERT TA06-073A VUPEN ADV-2006-0950 VUPEN ADV-2006-3678 MS MS06-012 XF office-routing-slip-bo(25009) XF powerpoint-presentation-code-execution(29009) Buffer overflow in Microsoft Office 2000 SP3, XP SP3, and other versions and packages, allows user-assisted attackers to execute arbitrary code via a routing slip that is longer than specified by the provided length field, as exploited by malware such as TROJ_MDROPPER.BH and Trojan.PPDropper.E in attacks against PowerPoint. cpe:/o:microsoft:windows_2000 cpe:/o:microsoft:windows_2000::sp1 cpe:/o:microsoft:windows_2000::sp2 cpe:/o:microsoft:windows_2000::sp3 cpe:/o:microsoft:windows_2000::sp4 cpe:/o:microsoft:windows_2003_server:datacenter_64-bit:sp1 cpe:/o:microsoft:windows_2003_server:enterprise::64-bit cpe:/o:microsoft:windows_2003_server:enterprise:sp1 cpe:/o:microsoft:windows_2003_server:enterprise_64-bit cpe:/o:microsoft:windows_2003_server:enterprise_64-bit:sp1 cpe:/o:microsoft:windows_2003_server:r2::64-bit cpe:/o:microsoft:windows_2003_server:r2::datacenter_64-bit cpe:/o:microsoft:windows_2003_server:r2:sp1 cpe:/o:microsoft:windows_2003_server:standard::64-bit cpe:/o:microsoft:windows_2003_server:standard:sp1 cpe:/o:microsoft:windows_2003_server:standard_64-bit cpe:/o:microsoft:windows_2003_server:web cpe:/o:microsoft:windows_2003_server:web:sp1 cpe:/o:microsoft:windows_98::gold cpe:/o:microsoft:windows_98se cpe:/o:microsoft:windows_me cpe:/o:microsoft:windows_nt:3.5.1 cpe:/o:microsoft:windows_nt:3.5.1:sp1 cpe:/o:microsoft:windows_nt:3.5.1:sp2 cpe:/o:microsoft:windows_nt:3.5.1:sp3 cpe:/o:microsoft:windows_nt:3.5.1:sp4 cpe:/o:microsoft:windows_nt:3.5.1:sp5 cpe:/o:microsoft:windows_nt:3.5.1:sp5:alpha cpe:/o:microsoft:windows_nt:4.0 cpe:/o:microsoft:windows_nt:4.0::alpha cpe:/o:microsoft:windows_nt:4.0::enterprise_server cpe:/o:microsoft:windows_nt:4.0::server cpe:/o:microsoft:windows_nt:4.0::terminal_server cpe:/o:microsoft:windows_nt:4.0::terminal_server_alpha cpe:/o:microsoft:windows_nt:4.0::workstation cpe:/o:microsoft:windows_nt:4.0:sp1 cpe:/o:microsoft:windows_nt:4.0:sp1:alpha cpe:/o:microsoft:windows_nt:4.0:sp1:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp1:server cpe:/o:microsoft:windows_nt:4.0:sp1:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp1:workstation cpe:/o:microsoft:windows_nt:4.0:sp2 cpe:/o:microsoft:windows_nt:4.0:sp2:alpha cpe:/o:microsoft:windows_nt:4.0:sp2:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp2:server cpe:/o:microsoft:windows_nt:4.0:sp2:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp2:workstation cpe:/o:microsoft:windows_nt:4.0:sp3 cpe:/o:microsoft:windows_nt:4.0:sp3:alpha cpe:/o:microsoft:windows_nt:4.0:sp3:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp3:server cpe:/o:microsoft:windows_nt:4.0:sp3:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp3:workstation cpe:/o:microsoft:windows_nt:4.0:sp4 cpe:/o:microsoft:windows_nt:4.0:sp4:alpha cpe:/o:microsoft:windows_nt:4.0:sp4:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp4:server cpe:/o:microsoft:windows_nt:4.0:sp4:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp4:workstation cpe:/o:microsoft:windows_nt:4.0:sp5 cpe:/o:microsoft:windows_nt:4.0:sp5:alpha cpe:/o:microsoft:windows_nt:4.0:sp5:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp5:server cpe:/o:microsoft:windows_nt:4.0:sp5:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp5:workstation cpe:/o:microsoft:windows_nt:4.0:sp6 cpe:/o:microsoft:windows_nt:4.0:sp6:alpha cpe:/o:microsoft:windows_nt:4.0:sp6:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp6:server cpe:/o:microsoft:windows_nt:4.0:sp6:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp6:workstation cpe:/o:microsoft:windows_nt:4.0:sp6a cpe:/o:microsoft:windows_nt:4.0:sp6a:alpha cpe:/o:microsoft:windows_nt:4.0:sp6a:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp6a:server cpe:/o:microsoft:windows_nt:4.0:sp6a:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp6a:workstation cpe:/o:microsoft:windows_xp:::64-bit cpe:/o:microsoft:windows_xp:::home cpe:/o:microsoft:windows_xp:::media_center cpe:/o:microsoft:windows_xp::gold:professional cpe:/o:microsoft:windows_xp::sp1:home cpe:/o:microsoft:windows_xp::sp1:media_center cpe:/o:microsoft:windows_xp::sp2:home cpe:/o:microsoft:windows_xp::sp2:media_center cpe:/o:microsoft:windows_xp::sp2:tablet_pc CVE-2006-0010 2006-01-10T17:03:00.000-05:00 2019-04-30T10:27:13.913-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS FULLDISC 20060110 [EEYEB-2000801] - Windows Embedded Open Type (EOT) Font Heap Overflow Vulnerability SECTRACK 1015459 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-004.htm EEYE EEYEB20050801 CERT-VN VU#915930 BUGTRAQ 20060110 [EEYEB-2000801] - Windows Embedded Open Type (EOT) Font Heap Overflow Vulnerability BID 16194 CERT TA06-010A VUPEN ADV-2006-0118 MISC http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=375525 MS MS06-002 XF win-embedded-fonts-bo(23922) Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression. CVE-2006-0011 2017-05-11T10:29:03.497-04:00 2017-05-11T10:29:03.497-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2006. Notes: none. cpe:/o:microsoft:windows_2000 cpe:/o:microsoft:windows_2000::sp1 cpe:/o:microsoft:windows_2000::sp2 cpe:/o:microsoft:windows_2000::sp3 cpe:/o:microsoft:windows_2000::sp4 cpe:/o:microsoft:windows_2003_server:datacenter_64-bit:sp1 cpe:/o:microsoft:windows_2003_server:enterprise::64-bit cpe:/o:microsoft:windows_2003_server:enterprise:sp1 cpe:/o:microsoft:windows_2003_server:enterprise_64-bit cpe:/o:microsoft:windows_2003_server:enterprise_64-bit:sp1 cpe:/o:microsoft:windows_2003_server:r2::64-bit cpe:/o:microsoft:windows_2003_server:r2::datacenter_64-bit cpe:/o:microsoft:windows_2003_server:r2:sp1 cpe:/o:microsoft:windows_2003_server:standard::64-bit cpe:/o:microsoft:windows_2003_server:standard:sp1 cpe:/o:microsoft:windows_2003_server:standard_64-bit cpe:/o:microsoft:windows_2003_server:web cpe:/o:microsoft:windows_2003_server:web:sp1 cpe:/o:microsoft:windows_98::gold cpe:/o:microsoft:windows_98se cpe:/o:microsoft:windows_me cpe:/o:microsoft:windows_xp:::64-bit cpe:/o:microsoft:windows_xp:::home cpe:/o:microsoft:windows_xp:::media_center cpe:/o:microsoft:windows_xp::gold:professional cpe:/o:microsoft:windows_xp::sp1:home cpe:/o:microsoft:windows_xp::sp1:media_center cpe:/o:microsoft:windows_xp::sp2:home cpe:/o:microsoft:windows_xp::sp2:media_center cpe:/o:microsoft:windows_xp::sp2:tablet_pc CVE-2006-0012 2006-04-11T20:02:00.000-04:00 2019-04-30T10:27:13.913-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015897 CERT-VN VU#641460 BID 17464 CERT TA06-101A VUPEN ADV-2006-1320 MS MS06-015 XF win-explorer-com-code-execution(25554) Unspecified vulnerability in Windows Explorer in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via attack vectors involving COM objects and "crafted files and directories," aka the "Windows Shell Vulnerability." cpe:/o:microsoft:windows_2003_server:datacenter_64-bit:sp1 cpe:/o:microsoft:windows_2003_server:enterprise::64-bit cpe:/o:microsoft:windows_2003_server:enterprise:sp1 cpe:/o:microsoft:windows_2003_server:enterprise_64-bit cpe:/o:microsoft:windows_2003_server:enterprise_64-bit:sp1 cpe:/o:microsoft:windows_2003_server:r2::64-bit cpe:/o:microsoft:windows_2003_server:r2::datacenter_64-bit cpe:/o:microsoft:windows_2003_server:r2:sp1 cpe:/o:microsoft:windows_2003_server:standard::64-bit cpe:/o:microsoft:windows_2003_server:standard:sp1 cpe:/o:microsoft:windows_2003_server:standard_64-bit cpe:/o:microsoft:windows_2003_server:web cpe:/o:microsoft:windows_2003_server:web:sp1 cpe:/o:microsoft:windows_xp:::64-bit cpe:/o:microsoft:windows_xp:::home cpe:/o:microsoft:windows_xp::gold:professional cpe:/o:microsoft:windows_xp::sp1:home cpe:/o:microsoft:windows_xp::sp2:home CVE-2006-0013 2006-02-14T14:06:00.000-05:00 2018-10-12T17:38:29.367-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015630 CERT-VN VU#388900 BID 16636 VUPEN ADV-2006-0577 MS MS06-008 XF msrpc-webclient-message-bo(24491) Buffer overflow in the Web Client service (WebClnt.dll) for Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote authenticated users or Guests to execute arbitrary code via crafted RPC requests, a different vulnerability than CVE-2005-1207. cpe:/a:microsoft:outlook_express:5.5 cpe:/a:microsoft:outlook_express:5.5:sp1 cpe:/a:microsoft:outlook_express:5.5:sp2 cpe:/a:microsoft:outlook_express:6.0 cpe:/a:microsoft:outlook_express:6.0:sp1 CVE-2006-0014 2006-04-11T20:02:00.000-04:00 2018-10-19T11:41:58.727-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS FULLDISC 20060411 ZDI-06-007: Microsoft Windows Address Book (WAB) File Format Parsing Vulnerability SREASON 691 SECTRACK 1015898 BUGTRAQ 20060411 ZDI-06-007: Microsoft Windows Address Book (WAB) File Format Parsing Vulnerability BID 17459 VUPEN ADV-2006-1321 MISC http://www.zerodayinitiative.com/advisories/ZDI-06-007.html MS MS06-016 XF outlook-express-wab-bo(25535) Buffer overflow in Microsoft Outlook Express 5.5 and 6 allows remote attackers to execute arbitrary code via a crafted Windows Address Book (WAB) file containing "certain Unicode strings" and modified length values. cpe:/a:microsoft:frontpage_server_extensions:2002 cpe:/a:microsoft:sharepoint_team_services CVE-2006-0015 2006-04-11T19:02:00.000-04:00 2018-10-19T11:42:00.680-04:00 6.8 NETWORK MEDIUM NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 704 SECTRACK 1015895 SECTRACK 1015896 MISC http://www.argeniss.com/research/ARGENISS-ADV-040602.txt BUGTRAQ 20060412 Vulnerability in Microsoft FrontPage Server Extensions Could Allow Cross-Site Scripting BID 17452 VUPEN ADV-2006-1322 MS MS06-017 XF fpse-html-xss(25537) Cross-site scripting (XSS) vulnerability in _vti_bin/_vti_adm/fpadmdll.dll in Microsoft FrontPage Server Extensions 2002 and SharePoint Team Services allows remote attackers to inject arbitrary web script or HTML, then leverage the attack to execute arbitrary programs or create new accounts, via the (1) operation, (2) command, and (3) name parameters. CVE-2006-0018 2005-11-29T16:03:00.000-05:00 2008-09-10T15:55:02.087-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-3899. Reason: This candidate is a duplicate of CVE-2005-3899. Notes: All CVE users should reference CVE-2005-3899 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. cpe:/o:kde:kde:3.2 cpe:/o:kde:kde:3.2.0 cpe:/o:kde:kde:3.2.0_beta1 cpe:/o:kde:kde:3.2.1 cpe:/o:kde:kde:3.2.2 cpe:/o:kde:kde:3.2.3 cpe:/o:kde:kde:3.2.x cpe:/o:kde:kde:3.3 cpe:/o:kde:kde:3.3.0 cpe:/o:kde:kde:3.3.1 cpe:/o:kde:kde:3.3.2 cpe:/o:kde:kde:3.3.x cpe:/o:kde:kde:3.4 cpe:/o:kde:kde:3.4.0 cpe:/o:kde:kde:3.4.1 cpe:/o:kde:kde:3.4.2 cpe:/o:kde:kde:3.5.0 CVE-2006-0019 2006-01-20T16:03:00.000-05:00 2018-10-19T11:42:01.587-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM ftp://ftp.kde.org/pub/kde/security_patches/post-3.4.3-kdelibs-kjs.diff SREASON 364 SECTRACK 1015512 SLACKWARE SSA:2006-045-05 DEBIAN DSA-948 GENTOO GLSA-200601-11 CONFIRM http://www.kde.org/info/security/advisory-20060119-1.txt MANDRIVA MDKSA-2006:019 REDHAT RHSA-2006:0184 BUGTRAQ 20060119 [KDE Security Advisory] kjs encodeuri/decodeuri heap overflow SUSE SUSE-SA:2006:003 FEDORA FLSA:178606 BID 16325 UBUNTU USN-245-1 VUPEN ADV-2006-0265 XF kde-kjs-bo(24242) Heap-based buffer overflow in the encodeURI and decodeURI functions in the kjs JavaScript interpreter engine in KDE 3.2.0 through 3.5.0 allows remote attackers to execute arbitrary code via a crafted, UTF-8 encoded URI. cpe:/o:microsoft:windows_2000::sp4::fr cpe:/o:microsoft:windows_2003_server:r2 cpe:/o:microsoft:windows_2003_server:sp1 cpe:/o:microsoft:windows_98::gold cpe:/o:microsoft:windows_98se cpe:/o:microsoft:windows_me cpe:/o:microsoft:windows_xp::sp1:tablet_pc cpe:/o:microsoft:windows_xp::sp2:tablet_pc CVE-2006-0020 2006-01-10T16:03:00.000-05:00 2018-10-12T17:38:34.240-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS MLIST [funsec] 20060110 Another WMF flaw without a Microsoft patch CERT-VN VU#312956 CONFIRM http://www.microsoft.com/technet/security/advisory/913333.mspx BID 16516 CERT TA06-045A VUPEN ADV-2006-0469 MS MS06-004 An unspecified Microsoft WMF parsing application, as used in Internet Explorer 5.01 SP4 on Windows 2000 SP4, and 5.5 SP2 on Windows Millennium, and possibly other versions, allows attackers to cause a denial of service (crash) and possibly execute code via a crafted WMF file with a manipulated WMF header size, possibly involving an integer overflow, a different vulnerability than CVE-2005-4560, and aka "WMF Image Parsing Memory Corruption Vulnerability." cpe:/o:microsoft:windows_2003_server:datacenter_64-bit:sp1 cpe:/o:microsoft:windows_2003_server:enterprise::64-bit cpe:/o:microsoft:windows_2003_server:enterprise:sp1 cpe:/o:microsoft:windows_2003_server:enterprise_64-bit cpe:/o:microsoft:windows_2003_server:r2::64-bit cpe:/o:microsoft:windows_2003_server:r2::datacenter_64-bit cpe:/o:microsoft:windows_2003_server:r2:sp1 cpe:/o:microsoft:windows_2003_server:standard::64-bit cpe:/o:microsoft:windows_2003_server:standard:sp1 cpe:/o:microsoft:windows_2003_server:standard_64-bit cpe:/o:microsoft:windows_2003_server:web cpe:/o:microsoft:windows_2003_server:web:sp1 cpe:/o:microsoft:windows_xp:::64-bit cpe:/o:microsoft:windows_xp:::embedded cpe:/o:microsoft:windows_xp:::home cpe:/o:microsoft:windows_xp:::media_center cpe:/o:microsoft:windows_xp::gold:professional cpe:/o:microsoft:windows_xp::sp1:64-bit cpe:/o:microsoft:windows_xp::sp1:embedded cpe:/o:microsoft:windows_xp::sp1:home cpe:/o:microsoft:windows_xp::sp1:media_center cpe:/o:microsoft:windows_xp::sp2:home cpe:/o:microsoft:windows_xp::sp2:media_center cpe:/o:microsoft:windows_xp::sp2:tablet_pc CVE-2006-0021 2006-02-14T14:06:00.000-05:00 2018-10-19T11:42:03.853-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov SECTRACK 1015629 CERT-VN VU#839284 MISC http://www.securiteam.com/exploits/5PP0T0KI0O.html BUGTRAQ 20071023 SYMSA-2007-012: Microsoft Windows CE IGMP Denial of Service BID 16645 CERT TA06-045A VUPEN ADV-2006-0576 MS MS06-007 XF win-igmpv3-dos(24489) EXPLOIT-DB 1599 Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang) via an IGMP packet with an invalid IP option, aka the "IGMP v3 DoS Vulnerability." cpe:/a:microsoft:powerpoint:2000 cpe:/a:microsoft:powerpoint:2000:sp2 cpe:/a:microsoft:powerpoint:2000:sp3 cpe:/a:microsoft:powerpoint:2000:sr1 cpe:/a:microsoft:powerpoint:2002 cpe:/a:microsoft:powerpoint:2002:sp1 cpe:/a:microsoft:powerpoint:2002:sp2 cpe:/a:microsoft:powerpoint:2002:sp3 cpe:/a:microsoft:powerpoint:2003 cpe:/a:microsoft:powerpoint:2003:sp1 cpe:/a:microsoft:powerpoint:2003:sp2 cpe:/a:microsoft:powerpoint:2003:sp3 cpe:/a:microsoft:powerpoint:2004::mac CVE-2006-0022 2006-06-13T15:06:00.000-04:00 2018-10-12T17:38:37.367-04:00 7.6 NETWORK HIGH NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1016287 CERT-VN VU#190089 BID 18382 CERT TA06-164A VUPEN ADV-2006-2325 MS MS06-028 XF powerpoint-record-bo(26784) Unspecified vulnerability in Microsoft PowerPoint in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 for Mac, and v. X for Mac allows user-assisted attackers to execute arbitrary code via a PowerPoint document with a malformed record, which triggers memory corruption. cpe:/o:microsoft:windows_xp::sp1:tablet_pc cpe:/o:microsoft:windows_xp::sp2:tablet_pc CVE-2006-0023 2006-02-07T21:18:00.000-05:00 2018-10-19T11:42:05.527-04:00 4.3 LOCAL LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015595 SECTRACK 1015765 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm MISC http://www.cs.princeton.edu/~sudhakar/papers/winval.pdf CERT-VN VU#953860 MISC http://www.microsoft.com/technet/security/advisory/914457.mspx BUGTRAQ 20060131 Windows Access Control Demystified VUPEN ADV-2006-0417 CONFIRM http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=391523&RenditionID= MS MS06-011 XF win-auth-users-insecure-permissions(24463) Microsoft Windows XP SP1 and SP2 before August 2004, and possibly other operating systems and versions, uses insecure default ACLs that allow the Authenticated Users group to gain privileges by modifying critical configuration information for the (1) Simple Service Discovery Protocol (SSDP), (2) Universal Plug and Play Device Host (UPnP), (3) NetBT, (4) SCardSvr, (5) DHCP, and (6) DnsCache services, aka "Permissive Windows Services DACLs." NOTE: the NetBT, SCardSvr, DHCP, DnsCache already require privileged access to exploit. cpe:/a:macromedia:flash_player:4.0_r12 cpe:/a:macromedia:flash_player:5.0 cpe:/a:macromedia:flash_player:5.0_r50 cpe:/a:macromedia:flash_player:6.0 cpe:/a:macromedia:flash_player:6.0.29.0 cpe:/a:macromedia:flash_player:6.0.40.0 cpe:/a:macromedia:flash_player:6.0.47.0 cpe:/a:macromedia:flash_player:6.0.65.0 cpe:/a:macromedia:flash_player:6.0.79.0 cpe:/a:macromedia:flash_player:7.0.19.0 cpe:/a:macromedia:flash_player:7.0.60.0 cpe:/a:macromedia:flash_player:7.0.61.0 cpe:/a:macromedia:flash_player:7.0_r19 cpe:/a:macromedia:flash_player:8.0.22.0 CVE-2006-0024 2006-03-15T11:06:00.000-05:00 2018-10-12T17:38:40.477-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://docs.info.apple.com/article.html?artnum=307179 APPLE APPLE-SA-2006-05-11 APPLE APPLE-SA-2007-12-17 SECTRACK 1015770 GENTOO GLSA-200603-20 CERT-VN VU#945060 CONFIRM http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html SUSE SUSE-SA:2006:015 CONFIRM http://www.opera.com/docs/changelogs/windows/854/ REDHAT RHSA-2006:0268 BID 17106 BID 17951 CERT TA06-075A CERT TA06-129A CERT TA06-132A CERT TA07-352A VUPEN ADV-2006-0952 VUPEN ADV-2006-1262 VUPEN ADV-2006-1744 VUPEN ADV-2006-1779 VUPEN ADV-2007-4238 MS MS06-020 XF macromedia-swf-code-execution(25005) Multiple unspecified vulnerabilities in Adobe Flash Player 8.0.22.0 and earlier allow remote attackers to execute arbitrary code via a crafted SWF file. cpe:/a:microsoft:windows_media_player:9 cpe:/a:microsoft:windows_media_player:10 CVE-2006-0025 2006-06-13T15:06:00.000-04:00 2018-10-12T17:38:44.740-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov SECTRACK 1016284 IDEFENSE 20060613 Windows Media Player PNG Chunk Decoding Stack-Based Buffer Overflow CERT-VN VU#608020 BID 18385 CERT TA06-164A VUPEN ADV-2006-2322 MS MS06-024 XF win-media-player-png-bo(26788) Stack-based buffer overflow in Microsoft Windows Media Player 9 and 10 allows remote attackers to execute arbitrary code via a PNG image with a large chunk size. cpe:/a:microsoft:internet_information_server:5.1 cpe:/a:microsoft:internet_information_server:6.0 cpe:/a:microsoft:internet_information_services:5.0 CVE-2006-0026 2006-07-11T18:05:00.000-04:00 2018-10-30T12:25:10.357-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BUGTRAQ 20060718 ASP.DLL Include File Buffer Overflow SECTRACK 1016466 CERT-VN VU#395588 BID 18858 CERT TA06-192A VUPEN ADV-2006-2752 MS MS06-034 XF iis-asp-bo(26796) Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via crafted Active Server Pages (ASP). cpe:/a:microsoft:exchange_server:2000:sp3 cpe:/a:microsoft:exchange_server:2003:sp1 cpe:/a:microsoft:exchange_server:2003:sp2 CVE-2006-0027 2006-05-09T22:10:00.000-04:00 2018-10-12T17:38:47.773-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1016048 CERT-VN VU#303452 BID 17908 CERT TA06-129A VUPEN ADV-2006-1743 MS MS06-019 XF exchange-calendar-code-execution(25556) Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal or (2) iCal Calendar properties. cpe:/a:microsoft:excel:2000 cpe:/a:microsoft:excel:2002 cpe:/a:microsoft:excel:2003 cpe:/a:microsoft:excel:2004::mac_os_x cpe:/a:microsoft:excel:x::mac_os_x cpe:/a:microsoft:office:2000:sp3 cpe:/a:microsoft:office:2003:sp1 cpe:/a:microsoft:office:2003:sp2 cpe:/a:microsoft:office:2004::mac cpe:/a:microsoft:office:v.x::mac cpe:/a:microsoft:office:xp:sp3 CVE-2006-0028 2006-03-14T18:02:00.000-05:00 2018-10-19T11:42:06.900-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SREASON 583 SECTRACK 1015766 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm CERT-VN VU#339878 BUGTRAQ 20060314 ZDI-06-004: Microsoft Excel File Format Parsing Vulnerability CERT TA06-073A VUPEN ADV-2006-0950 MISC http://www.zerodayinitiative.com/advisories/ZDI-06-004.html MS MS06-012 XF excel-parsing-format-file-bo(25225) Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via a BIFF parsing format file containing malformed BOOLERR records that lead to memory corruption, probably involving invalid pointers. cpe:/a:microsoft:excel:2000 cpe:/a:microsoft:excel:2002 cpe:/a:microsoft:excel:2003 cpe:/a:microsoft:excel:2004::mac_os_x cpe:/a:microsoft:excel:x::mac_os_x cpe:/a:microsoft:office:2000:sp3 cpe:/a:microsoft:office:2003:sp1 cpe:/a:microsoft:office:2003:sp2 cpe:/a:microsoft:office:2004::mac cpe:/a:microsoft:office:v.x::mac cpe:/a:microsoft:office:xp:sp3 CVE-2006-0029 2006-03-14T18:02:00.000-05:00 2018-10-12T17:38:51.227-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SREASON 585 SREASON 586 SECTRACK 1015766 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm CERT-VN VU#235774 CERT TA06-073A VUPEN ADV-2006-0950 MS MS06-012 XF excel-description-bo(25227) Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed description, which leads to memory corruption. cpe:/a:microsoft:excel:2000 cpe:/a:microsoft:excel:2002 cpe:/a:microsoft:excel:2003 cpe:/a:microsoft:excel:2004::mac_os_x cpe:/a:microsoft:excel:x::mac_os_x cpe:/a:microsoft:office:2000:sp3 cpe:/a:microsoft:office:2003:sp1 cpe:/a:microsoft:office:2003:sp2 cpe:/a:microsoft:office:2004::mac cpe:/a:microsoft:office:v.x::mac cpe:/a:microsoft:office:xp:sp3 CVE-2006-0030 2006-03-14T18:02:00.000-05:00 2018-10-12T17:38:53.133-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015766 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm CERT-VN VU#123222 BID 16181 CERT TA06-073A VUPEN ADV-2006-0950 MS MS06-012 XF excel-graphic-bo(25229) Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed graphic, which leads to memory corruption. cpe:/a:microsoft:office:2000:sp3 cpe:/a:microsoft:office:2003:sp1 cpe:/a:microsoft:office:2003:sp2 cpe:/a:microsoft:office:2004::mac cpe:/a:microsoft:office:v.x::mac cpe:/a:microsoft:office:xp:sp3 CVE-2006-0031 2006-03-14T18:02:00.000-05:00 2018-10-19T11:42:08.510-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS FULLDISC 20060314 [xfocus-SD-060314]Microsoft Office Excel Buffer Overflow Vulnerability SREASON 589 SECTRACK 1015766 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm CERT-VN VU#104302 BUGTRAQ 20060315 [xfocus-SD-060314]Microsoft Office Excel Buffer Overflow Vulnerability BID 17101 CERT TA06-073A VUPEN ADV-2006-0950 MS MS06-012 XF excel-record-bo(25228) Stack-based buffer overflow in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed record with a modified length value, which leads to memory corruption. cpe:/o:microsoft:windows_2000 cpe:/o:microsoft:windows_2000::sp1 cpe:/o:microsoft:windows_2000::sp2 cpe:/o:microsoft:windows_2000::sp3 cpe:/o:microsoft:windows_2000::sp4 cpe:/o:microsoft:windows_2000:resource_kit cpe:/o:microsoft:windows_2003_server:datacenter_edition cpe:/o:microsoft:windows_2003_server:datacenter_edition:sp1 cpe:/o:microsoft:windows_2003_server:datacenter_edition:sp1_beta_1 cpe:/o:microsoft:windows_2003_server:datacenter_edition_itanium cpe:/o:microsoft:windows_2003_server:datacenter_edition_itanium:sp1 cpe:/o:microsoft:windows_2003_server:datacenter_edition_itanium:sp1_beta_1 cpe:/o:microsoft:windows_2003_server:enterprise_64-bit cpe:/o:microsoft:windows_2003_server:enterprise_edition:sp1 cpe:/o:microsoft:windows_2003_server:enterprise_edition:sp1_beta_1 cpe:/o:microsoft:windows_2003_server:enterprise_edition_itanium cpe:/o:microsoft:windows_2003_server:enterprise_edition_itanium:sp1 cpe:/o:microsoft:windows_2003_server:enterprise_edition_itanium:sp1_beta_1 cpe:/o:microsoft:windows_2003_server:r2::datacenter_64-bit cpe:/o:microsoft:windows_2003_server:sp1::enterprise cpe:/o:microsoft:windows_2003_server:standard cpe:/o:microsoft:windows_2003_server:standard:sp1 cpe:/o:microsoft:windows_2003_server:standard:sp1_beta_1 cpe:/o:microsoft:windows_2003_server:standard_64-bit cpe:/o:microsoft:windows_2003_server:web cpe:/o:microsoft:windows_2003_server:web:sp1 cpe:/o:microsoft:windows_2003_server:web:sp1_beta_1 cpe:/o:microsoft:windows_xp:::64-bit cpe:/o:microsoft:windows_xp:::home cpe:/o:microsoft:windows_xp:::media_center cpe:/o:microsoft:windows_xp::gold:professional cpe:/o:microsoft:windows_xp::sp1:home cpe:/o:microsoft:windows_xp::sp1:media_center cpe:/o:microsoft:windows_xp::sp2:home cpe:/o:microsoft:windows_xp::sp2:media_center cpe:/o:microsoft:windows_xp::sp2:tablet_pc CVE-2006-0032 2006-09-12T19:07:00.000-04:00 2019-04-30T10:27:13.913-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1016826 MISC http://www.geocities.jp/ptrs_sec/advisory09e.html CERT-VN VU#108884 HP SSRT061187 BUGTRAQ 20061002 IE UXSS (Universal XSS in IE, was Re: Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053]) BUGTRAQ 20061001 Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053] BID 19927 CERT TA06-255A VUPEN ADV-2006-3564 MS MS06-053 XF ms-indexing-service-xss(28651) Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7. cpe:/a:microsoft:office:2000:sp3 cpe:/a:microsoft:office:2003:sp1 cpe:/a:microsoft:office:2003:sp2 cpe:/a:microsoft:office:xp:sp3 CVE-2006-0033 2006-07-11T17:05:00.000-04:00 2018-10-12T17:38:58.507-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1016470 MISC http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-22.html CERT-VN VU#459388 BID 18913 CERT TA06-192A VUPEN ADV-2006-2757 MS MS06-039 Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via a crafted PNG image that triggers memory corruption when it is parsed. cpe:/a:microsoft:distributed_transaction_coordinator cpe:/o:microsoft:windows_2000 cpe:/o:microsoft:windows_2000::sp1 cpe:/o:microsoft:windows_2000::sp2 cpe:/o:microsoft:windows_2000::sp3 cpe:/o:microsoft:windows_2000::sp4 cpe:/o:microsoft:windows_2003_server:enterprise::64-bit cpe:/o:microsoft:windows_2003_server:enterprise_64-bit cpe:/o:microsoft:windows_2003_server:r2::64-bit cpe:/o:microsoft:windows_2003_server:r2::datacenter_64-bit cpe:/o:microsoft:windows_2003_server:standard::64-bit cpe:/o:microsoft:windows_2003_server:web cpe:/o:microsoft:windows_nt:4.0 cpe:/o:microsoft:windows_nt:4.0::enterprise_server cpe:/o:microsoft:windows_nt:4.0::server cpe:/o:microsoft:windows_nt:4.0::terminal_server cpe:/o:microsoft:windows_nt:4.0::workstation cpe:/o:microsoft:windows_nt:4.0:sp1 cpe:/o:microsoft:windows_nt:4.0:sp1:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp1:server cpe:/o:microsoft:windows_nt:4.0:sp1:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp1:workstation cpe:/o:microsoft:windows_nt:4.0:sp2 cpe:/o:microsoft:windows_nt:4.0:sp2:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp2:server cpe:/o:microsoft:windows_nt:4.0:sp2:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp2:workstation cpe:/o:microsoft:windows_nt:4.0:sp3 cpe:/o:microsoft:windows_nt:4.0:sp3:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp3:server cpe:/o:microsoft:windows_nt:4.0:sp3:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp3:workstation cpe:/o:microsoft:windows_nt:4.0:sp4 cpe:/o:microsoft:windows_nt:4.0:sp4:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp4:server cpe:/o:microsoft:windows_nt:4.0:sp4:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp4:workstation cpe:/o:microsoft:windows_nt:4.0:sp5 cpe:/o:microsoft:windows_nt:4.0:sp5:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp5:server cpe:/o:microsoft:windows_nt:4.0:sp5:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp5:workstation cpe:/o:microsoft:windows_nt:4.0:sp6 cpe:/o:microsoft:windows_nt:4.0:sp6:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp6:server cpe:/o:microsoft:windows_nt:4.0:sp6:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp6:workstation cpe:/o:microsoft:windows_nt:4.0:sp6a cpe:/o:microsoft:windows_nt:4.0:sp6a:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp6a:server cpe:/o:microsoft:windows_nt:4.0:sp6a:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp6a:workstation cpe:/o:microsoft:windows_xp:::64-bit cpe:/o:microsoft:windows_xp:::embedded cpe:/o:microsoft:windows_xp:::home cpe:/o:microsoft:windows_xp:::media_center cpe:/o:microsoft:windows_xp::gold:professional cpe:/o:microsoft:windows_xp::sp1:64-bit cpe:/o:microsoft:windows_xp::sp1:embedded cpe:/o:microsoft:windows_xp::sp1:home cpe:/o:microsoft:windows_xp::sp1:media_center cpe:/o:microsoft:windows_xp::sp2:tablet_pc CVE-2006-0034 2006-05-09T22:14:00.000-04:00 2019-04-30T10:27:13.913-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS FULLDISC 20060509 [EEYEB20051011A] - Microsoft Distributed Transaction Coordinator Heap Overflow FULLDISC 20060510 Microsoft MSDTC NdrAllocate Validation Vulnerability SREASON 863 SECTRACK 1016047 MISC http://www.eeye.com/html/research/advisories/AD20060509a.html BUGTRAQ 20060509 [EEYEB20051011A] - Microsoft Distributed Transaction Coordinator Heap Overflow BUGTRAQ 20060511 Microsoft MSDTC NdrAllocate Validation Vulnerability BID 17906 VUPEN ADV-2006-1742 MS MS06-018 XF msdtc-network-message-dos(25559) Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or BuildContext opcode, which triggers a bug in the NdrAllocate function, aka the MSDTC Invalid Memory Access Vulnerability. cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.15 CVE-2006-0035 2006-01-11T16:03:00.000-05:00 2017-07-19T21:29:26.347-04:00 4.9 LOCAL LOW NONE NONE NONE COMPLETE http://nvd.nist.gov SREASON 388 CONFIRM http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ad8e4b75c8a7bed475d72ce09bf5267188621961 BID 16414 TRUSTIX 2006-0004 VUPEN ADV-2006-0220 XF kernel-afnetlink-dos(24202) The netlink_rcv_skb function in af_netlink.c in Linux kernel 2.6.14 and 2.6.15 allows local users to cause a denial of service (infinite loop) via a nlmsg_len field of 0. cpe:/o:linux:linux_kernel:2.6.14 CVE-2006-0036 2006-01-23T17:03:00.000-05:00 2017-07-19T21:29:26.410-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov CONFIRM http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=15db34702cfafd24acc60295cf14861e497502ab SREASON 388 BID 16414 TRUSTIX 2006-0004 VUPEN ADV-2006-0220 XF kernel-pptpincallrequest-dos(24203) ip_nat_pptp in the PPTP NAT helper (netfilter/ip_nat_helper_pptp.c) in Linux kernel 2.6.14, and other versions, allows remote attackers to cause a denial of service (memory corruption or crash) via an inbound PPTP_IN_CALL_REQUEST packet that causes a null pointer to be used in an offset calculation. cpe:/o:linux:linux_kernel:2.6.14 CVE-2006-0037 2006-01-23T17:03:00.000-05:00 2017-07-19T21:29:26.457-04:00 4.9 LOCAL LOW NONE NONE NONE COMPLETE http://nvd.nist.gov CONFIRM http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=03b9feca89366952ae5dfe4ad8107b1ece50b710 SREASON 388 BID 16414 TRUSTIX 2006-0004 VUPEN ADV-2006-0220 XF kernel-pptpnathelper-dos(24204) ip_nat_pptp in the PPTP NAT helper (netfilter/ip_nat_helper_pptp.c) in Linux kernel 2.6.14, and other versions, allows local users to cause a denial of service (memory corruption or crash) via a crafted outbound packet that causes an incorrect offset to be calculated from pointer arithmetic when non-linear SKBs (socket buffers) are used. cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.0:test1 cpe:/o:linux:linux_kernel:2.6.0:test10 cpe:/o:linux:linux_kernel:2.6.0:test11 cpe:/o:linux:linux_kernel:2.6.0:test2 cpe:/o:linux:linux_kernel:2.6.0:test3 cpe:/o:linux:linux_kernel:2.6.0:test4 cpe:/o:linux:linux_kernel:2.6.0:test5 cpe:/o:linux:linux_kernel:2.6.0:test6 cpe:/o:linux:linux_kernel:2.6.0:test7 cpe:/o:linux:linux_kernel:2.6.0:test8 cpe:/o:linux:linux_kernel:2.6.0:test9 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.2 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.14.5 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc2 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15.1 cpe:/o:linux:linux_kernel:2.6.15.2 cpe:/o:linux:linux_kernel:2.6.15.3 cpe:/o:linux:linux_kernel:2.6.15.4 cpe:/o:linux:linux_kernel:2.6.15.5 cpe:/o:linux:linux_kernel:2.6.16:rc1 cpe:/o:linux:linux_kernel:2.6_test9_cvs CVE-2006-0038 2006-03-22T15:06:00.000-05:00 2017-10-10T21:30:34.843-04:00 6.9 LOCAL MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm DEBIAN DSA-1097 DEBIAN DSA-1103 CONFIRM http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ee4bb818ae35f68d1f848eae0a7b150a38eb4168 REDHAT RHSA-2006:0575 BID 17178 UBUNTU USN-302-1 VUPEN ADV-2006-1046 VUPEN ADV-2006-2554 CONFIRM https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=186295 XF linux-netfilter-doreplace-overflow(25400) Integer overflow in the do_replace function in netfilter for Linux before 2.6.16-rc3, when using "virtualization solutions" such as OpenVZ, allows local users with CAP_NET_ADMIN rights to cause a buffer overflow in the copy_from_user function. cpe:/o:linux:linux_kernel:2.6.16 CVE-2006-0039 2006-05-19T18:02:00.000-04:00 2017-10-10T21:30:34.937-04:00 4.7 LOCAL HIGH NONE PARTIAL NONE COMPLETE http://nvd.nist.gov CONFIRM http://bugs.gentoo.org/show_bug.cgi?id=133465 CONFIRM http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.17 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-249.htm DEBIAN DSA-1097 DEBIAN DSA-1103 MISC http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2722971cbe831117686039d5c334f2c0f560be13 REDHAT RHSA-2006:0689 BID 18113 UBUNTU USN-311-1 VUPEN ADV-2006-1893 VUPEN ADV-2006-2554 CONFIRM https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191698 XF linux-doaddcounters-race-condition(26583) Race condition in the do_add_counters function in netfilter for Linux kernel 2.6.16 allows local users with CAP_NET_ADMIN capabilities to read kernel memory by triggering the race condition in a way that produces a size value that is inconsistent with allocated memory, which leads to a buffer over-read in IPT_ENTRY_ITERATE. cpe:/a:gnome:evolution:2.4.2.1 CVE-2006-0040 2006-03-09T20:02:00.000-05:00 2018-10-19T11:42:13.603-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov BUGTRAQ 20060301 Evolution Emailer DoS BID 16899 VUPEN ADV-2006-0801 XF evolution-email-dos(25050) GNOME Evolution 2.4.2.1 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a text e-mail with a large number of URLs, possibly due to unknown problems in gtkhtml. CVE-2006-0041 2017-05-26T17:29:00.183-04:00 2017-05-26T17:29:00.183-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. cpe:/a:apache:libapreq2:0.31 cpe:/a:apache:libapreq2:0.31_03 cpe:/a:apache:libapreq2:0.33 cpe:/a:apache:libapreq2:1.0 cpe:/a:apache:libapreq2:1.1 cpe:/a:apache:libapreq2:1.2 cpe:/a:apache:libapreq2:1.3 cpe:/a:apache:libapreq2:1.33 cpe:/a:apache:libapreq2:1.34 cpe:/a:apache:libapreq2:2.01_03:dev cpe:/a:apache:libapreq2:2.02_02:dev cpe:/a:apache:libapreq2:2.03_04:dev cpe:/a:apache:libapreq2:2.04_03:dev cpe:/a:apache:libapreq2:2.05:dev cpe:/a:apache:libapreq2:2.06:dev cpe:/o:debian:debian_linux:3.0 cpe:/o:debian:debian_linux:3.1 CVE-2006-0042 2006-02-18T16:02:00.000-05:00 2018-11-29T10:45:43.193-05:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov 2018-11-19T08:25:26.850-05:00 SREASON 737 CONFIRM http://svn.apache.org/viewcvs.cgi/httpd/apreq/tags/v2_07/CHANGES?rev=376998&view=markup DEBIAN DSA-1000 GENTOO GLSA-200604-08 BID 16710 VUPEN ADV-2006-0645 XF libapreq2-parsing-dos(24917) Unspecified vulnerability in (1) apreq_parse_headers and (2) apreq_parse_urlencoded functions in Apache2::Request (Libapreq2) before 2.07 allows remote attackers to cause a denial of service (CPU consumption) via unknown attack vectors that result in quadratic computational complexity. cpe:/o:suse:suse_linux:1.0 cpe:/o:suse:suse_linux:9.1::personal cpe:/o:suse:suse_linux:9.1::professional cpe:/o:suse:suse_linux:9.1::x86_64 cpe:/o:suse:suse_linux:9.2::personal cpe:/o:suse:suse_linux:9.2::professional cpe:/o:suse:suse_linux:9.2::x86_64 cpe:/o:suse:suse_linux:9.3::personal cpe:/o:suse:suse_linux:9.3::professional cpe:/o:suse:suse_linux:9.3::x86_64 cpe:/o:suse:suse_linux:10.0::professional CVE-2006-0043 2006-01-30T21:03:00.000-05:00 2017-07-19T21:29:26.830-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350020 SUSE SUSE-SA:2006:005 DEBIAN DSA-975 BID 16388 VUPEN ADV-2006-0348 XF nfs-rpcmountd-realpath-bo(24347) Buffer overflow in the realpath function in nfs-server rpc.mountd, as used in SUSE Linux 9.1 through 10.0, allows local users to execute arbitrary code via unspecified vectors involving mount requests and symlinks. cpe:/a:albatross:albatross:1.00 cpe:/a:albatross:albatross:1.01 cpe:/a:albatross:albatross:1.10 cpe:/a:albatross:albatross:1.20 cpe:/a:albatross:albatross:1.30 cpe:/a:albatross:albatross:1.32 CVE-2006-0044 2006-01-17T20:51:00.000-05:00 2017-07-19T21:29:26.877-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://security.debian.org/pool/updates/main/a/albatross/albatross_1.20-2.diff.gz DEBIAN DSA-942 CONFIRM http://www.object-craft.com.au/projects/albatross/news.html BID 16252 VUPEN ADV-2006-0196 XF albatross-context-command-execution(24130) Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields". cpe:/a:linley_henzell:dungeon_crawl:4.0.0_b23 CVE-2006-0045 2006-01-20T16:03:00.000-05:00 2017-07-19T21:29:26.923-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS DEBIAN DSA-949 BID 16337 VUPEN ADV-2006-0303 XF crawl-insecure-command-execution(24262) crawl before 4.0.0 does not securely call programs when saving and loading games, which allows local users to gain privileges. cpe:/a:cameron_simpson:adzapper:2006-01-01 cpe:/a:cameron_simpson:adzapper:2006-01-05 cpe:/a:cameron_simpson:adzapper:2006-01-07 cpe:/a:cameron_simpson:adzapper:2006-01-14 cpe:/a:cameron_simpson:adzapper:2006-01-15 cpe:/a:cameron_simpson:adzapper:2006-01-23 cpe:/a:cameron_simpson:adzapper:2006-01-24 cpe:/a:cameron_simpson:adzapper:2006-01-25 cpe:/a:cameron_simpson:adzapper:2006-01-28 cpe:/a:cameron_simpson:adzapper:2006-01-29 CVE-2006-0046 2006-02-13T06:06:00.000-05:00 2017-07-19T21:29:27.003-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov CONFIRM http://adzapper.sourceforge.net/cvslog.html MISC http://bugs.debian.org/cgi-bin/bugreport.cgi/squid_redirect.diff?bug=350308;msg=5;att=1 MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350308 DEBIAN DSA-966 BID 16558 VUPEN ADV-2006-0491 XF adzapper-squid-redirect-dos(24640) squid_redirect script in adzapper before 2006-01-29 allows remote attackers to cause a denial of service (CPU consumption) via a URL with a large number of trailing / (forward slashes), which might produce inefficient regular expressions. cpe:/a:freeciv:freeciv:2.0.0 cpe:/a:freeciv:freeciv:2.0.1 cpe:/a:freeciv:freeciv:2.0.2 cpe:/a:freeciv:freeciv:2.0.3 cpe:/a:freeciv:freeciv:2.0.4 cpe:/a:freeciv:freeciv:2.0.5 cpe:/a:freeciv:freeciv:2.0.6 cpe:/a:freeciv:freeciv:2.0.7 cpe:/a:freeciv:freeciv:2.0.7a CVE-2006-0047 2006-03-07T06:02:00.000-05:00 2018-10-19T11:42:13.933-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=355211 DEBIAN DSA-994 GENTOO GLSA-200603-11 MANDRIVA MDKSA-2006:053 BUGTRAQ 20060306 Out of memory crash in Freeciv 2.0.7 BID 16975 VUPEN ADV-2006-0838 XF freeciv-packets-dos(25166) packets.c in Freeciv 2.0 before 2.0.8 allows remote attackers to cause a denial of service (server crash) via crafted packets with negative compressed size values. cpe:/a:francesco_stablum:tcpick:0.2.1 CVE-2006-0048 2006-04-25T20:06:00.000-04:00 2017-07-19T21:29:27.173-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://sourceforge.net/mailarchive/forum.php?thread_id=9989610&forum_id=37151 BID 17665 VUPEN ADV-2006-1466 XF tcpick-writec-dos(26090) Francesco Stablum tcpick 0.2.1 allows remote attackers to cause a denial of service (segmentation fault) via certain fragmented packets, possibly involving invalid headers and an attacker-controlled payload length. NOTE: this issue might be a buffer overflow or overread. cpe:/a:gnu:privacy_guard:1.0 cpe:/a:gnu:privacy_guard:1.0.1 cpe:/a:gnu:privacy_guard:1.0.2 cpe:/a:gnu:privacy_guard:1.0.3 cpe:/a:gnu:privacy_guard:1.0.3b cpe:/a:gnu:privacy_guard:1.0.4 cpe:/a:gnu:privacy_guard:1.0.5 cpe:/a:gnu:privacy_guard:1.0.6 cpe:/a:gnu:privacy_guard:1.0.7 cpe:/a:gnu:privacy_guard:1.2 cpe:/a:gnu:privacy_guard:1.2.1 cpe:/a:gnu:privacy_guard:1.2.2 cpe:/a:gnu:privacy_guard:1.2.2:rc1 cpe:/a:gnu:privacy_guard:1.2.3 cpe:/a:gnu:privacy_guard:1.2.4 cpe:/a:gnu:privacy_guard:1.2.5 cpe:/a:gnu:privacy_guard:1.2.6 cpe:/a:gnu:privacy_guard:1.2.7 cpe:/a:gnu:privacy_guard:1.3.3 cpe:/a:gnu:privacy_guard:1.3.4 cpe:/a:gnu:privacy_guard:1.4 cpe:/a:gnu:privacy_guard:1.4.1 cpe:/a:gnu:privacy_guard:1.4.2 cpe:/a:gnu:privacy_guard:1.4.2.1 CVE-2006-0049 2006-03-13T16:06:00.000-05:00 2018-10-19T11:42:14.603-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov SGI 20060401-01-U MLIST [gnupg-announce] 20060309 [Announce] GnuPG does not detect injection of unsigned data SUSE SUSE-SA:2006:014 SREASON 450 SREASON 568 SECTRACK 1015749 DEBIAN DSA-993 GENTOO GLSA-200603-08 MANDRIVA MDKSA-2006:055 FEDORA FEDORA-2006-147 REDHAT RHSA-2006:0266 BUGTRAQ 20060309 GnuPG does not detect injection of unsigned data FEDORA FLSA-2006:185355 BID 17058 SLACKWARE SSA:2006-072-02 TRUSTIX 2006-0014 VUPEN ADV-2006-0915 XF gnupg-nondetached-sig-verification(25184) UBUNTU USN-264-1 gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455. cpe:/o:debian:debian_linux:3.0 cpe:/o:debian:debian_linux:3.0::alpha cpe:/o:debian:debian_linux:3.0::arm cpe:/o:debian:debian_linux:3.0::hppa cpe:/o:debian:debian_linux:3.0::ia-32 cpe:/o:debian:debian_linux:3.0::ia-64 cpe:/o:debian:debian_linux:3.0::m68k cpe:/o:debian:debian_linux:3.0::mips cpe:/o:debian:debian_linux:3.0::mipsel cpe:/o:debian:debian_linux:3.0::ppc cpe:/o:debian:debian_linux:3.0::s-390 cpe:/o:debian:debian_linux:3.0::sparc cpe:/o:debian:debian_linux:3.1 cpe:/o:debian:debian_linux:3.1::alpha cpe:/o:debian:debian_linux:3.1::amd64 cpe:/o:debian:debian_linux:3.1::arm cpe:/o:debian:debian_linux:3.1::hppa cpe:/o:debian:debian_linux:3.1::ia-32 cpe:/o:debian:debian_linux:3.1::ia-64 cpe:/o:debian:debian_linux:3.1::m68k cpe:/o:debian:debian_linux:3.1::mips cpe:/o:debian:debian_linux:3.1::mipsel cpe:/o:debian:debian_linux:3.1::ppc cpe:/o:debian:debian_linux:3.1::s-390 cpe:/o:debian:debian_linux:3.1::sparc CVE-2006-0050 2006-03-23T06:06:00.000-05:00 2017-07-19T21:29:27.317-04:00 1.2 LOCAL HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov DEBIAN DSA-1013 BID 17182 XF snmptrapfmt-log-temprary-file(25442) snmptrapfmt in Debian 3.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary log file. cpe:/a:kaffeine:kaffeine_player:0.4.2 cpe:/a:kaffeine:kaffeine_player:0.4.3 cpe:/a:kaffeine:kaffeine_player:0.4.3b cpe:/a:kaffeine:kaffeine_player:0.5_rc1 cpe:/a:kaffeine:kaffeine_player:0.7.1 CVE-2006-0051 2006-04-05T06:04:00.000-04:00 2018-10-19T11:42:17.463-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015863 DEBIAN DSA-1023 GENTOO GLSA-200604-04 CONFIRM http://www.kde.org/info/security/advisory-20060404-1.txt MANDRIVA MDKSA-2006:065 SUSE SUSE-SR:2006:008 BUGTRAQ 20060405 [Kaffeine Security Advisory] Heap based buffer overflow in http_peek() BID 17372 VUPEN ADV-2006-1229 XF kaffeine-http-peek-bo(25631) UBUNTU USN-268-1 Buffer overflow in playlistimport.cpp in Kaffeine Player 0.4.2 through 0.7.1 allows user-assisted attackers to execute arbitrary code via long HTTP request headers when Kaffeine is "fetching remote playlists", which triggers the overflow in the http_peek function. cpe:/a:gnu:mailman:1.0 cpe:/a:gnu:mailman:1.1 cpe:/a:gnu:mailman:2.0 cpe:/a:gnu:mailman:2.0:beta3 cpe:/a:gnu:mailman:2.0:beta4 cpe:/a:gnu:mailman:2.0:beta5 cpe:/a:gnu:mailman:2.0.1 cpe:/a:gnu:mailman:2.0.2 cpe:/a:gnu:mailman:2.0.3 cpe:/a:gnu:mailman:2.0.4 cpe:/a:gnu:mailman:2.0.5 cpe:/a:gnu:mailman:2.0.6 cpe:/a:gnu:mailman:2.0.7 cpe:/a:gnu:mailman:2.0.8 cpe:/a:gnu:mailman:2.0.9 cpe:/a:gnu:mailman:2.0.10 cpe:/a:gnu:mailman:2.0.11 cpe:/a:gnu:mailman:2.0.12 cpe:/a:gnu:mailman:2.0.13 cpe:/a:gnu:mailman:2.0.14 cpe:/a:gnu:mailman:2.1 cpe:/a:gnu:mailman:2.1.1 cpe:/a:gnu:mailman:2.1.2 cpe:/a:gnu:mailman:2.1.3 cpe:/a:gnu:mailman:2.1.4 cpe:/a:gnu:mailman:2.1.5 cpe:/a:gnu:mailman:2.1b1 CVE-2006-0052 2006-03-31T06:06:00.000-05:00 2018-10-03T17:34:51.350-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SGI 20060602-01-U CONFIRM http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=358892 SECTRACK 1015851 DEBIAN DSA-1027 MANDRIVA MDKSA-2006:061 SUSE SUSE-SR:2006:008 REDHAT RHSA-2006:0486 BID 17311 UBUNTU USN-267-1 The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between the first boundary and the end boundary. cpe:/a:tony_cook:imager:0.41 cpe:/a:tony_cook:imager:0.42 cpe:/a:tony_cook:imager:0.43 cpe:/a:tony_cook:imager:0.44_1 cpe:/a:tony_cook:imager:0.45 cpe:/a:tony_cook:imager:0.45_2 cpe:/a:tony_cook:imager:0.47 cpe:/a:tony_cook:imager:0.48 cpe:/a:tony_cook:imager:0.49 CVE-2006-0053 2006-04-10T14:06:00.000-04:00 2017-07-19T21:29:27.517-04:00 2.6 NETWORK HIGH NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=359661 MISC http://rt.cpan.org/Public/Bug/Display.html?id=18397 DEBIAN DSA-1028 BID 17415 VUPEN ADV-2006-1294 XF imager-jpeg-tga-dos(25717) Imager (libimager-perl) before 0.50 allows user-assisted attackers to cause a denial of service (segmentation fault) by writing a 2- or 4-channel JPEG image (or a 2-channel TGA image) to a scalar, which triggers a NULL pointer dereference. cpe:/o:freebsd:freebsd:6.0:release cpe:/o:freebsd:freebsd:6.0:stable CVE-2006-0054 2006-01-11T16:03:00.000-05:00 2017-07-19T21:29:27.597-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov FREEBSD FreeBSD-SA-06:04 SECTRACK 1015477 BID 16209 XF ipfw-icmp-fragment-dos(24073) The ipfw firewall in FreeBSD 6.0-RELEASE allows remote attackers to cause a denial of service (firewall crash) via ICMP IP fragments that match a reset, reject or unreach action, which leads to an access of an uninitialized pointer. cpe:/o:freebsd:freebsd:4.10 cpe:/o:freebsd:freebsd:4.10:release cpe:/o:freebsd:freebsd:4.10:release_p8 cpe:/o:freebsd:freebsd:4.10:releng cpe:/o:freebsd:freebsd:4.11:release_p3 cpe:/o:freebsd:freebsd:4.11:releng cpe:/o:freebsd:freebsd:4.11:stable cpe:/o:freebsd:freebsd:5.0 cpe:/o:freebsd:freebsd:5.0:alpha cpe:/o:freebsd:freebsd:5.0:release_p14 cpe:/o:freebsd:freebsd:5.0:releng cpe:/o:freebsd:freebsd:5.1 cpe:/o:freebsd:freebsd:5.1:alpha cpe:/o:freebsd:freebsd:5.1:release cpe:/o:freebsd:freebsd:5.1:release_p5 cpe:/o:freebsd:freebsd:5.1:releng cpe:/o:freebsd:freebsd:5.2 cpe:/o:freebsd:freebsd:5.2.1:release cpe:/o:freebsd:freebsd:5.2.1:releng cpe:/o:freebsd:freebsd:5.3 cpe:/o:freebsd:freebsd:5.3:release cpe:/o:freebsd:freebsd:5.3:releng cpe:/o:freebsd:freebsd:5.3:stable cpe:/o:freebsd:freebsd:5.4:pre-release cpe:/o:freebsd:freebsd:5.4:release cpe:/o:freebsd:freebsd:5.4:releng cpe:/o:freebsd:freebsd:6.0:release cpe:/o:freebsd:freebsd:6.0:stable CVE-2006-0055 2006-01-11T16:03:00.000-05:00 2017-07-19T21:29:27.643-04:00 2.1 LOCAL LOW NONE NONE PARTIAL NONE http://nvd.nist.gov FREEBSD FreeBSD-SA-06:02 SECTRACK 1015469 BID 16207 XF ee-ispell-op-symlink(24074) The ispell_op function in ee on FreeBSD 4.10 to 6.0 uses predictable filenames and does not confirm which file is being written, which allows local users to overwrite arbitrary files via a symlink attack when ee invokes ispell. cpe:/a:pam-mysql:pam-mysql:0.1 cpe:/a:pam-mysql:pam-mysql:0.2 cpe:/a:pam-mysql:pam-mysql:0.3 cpe:/a:pam-mysql:pam-mysql:0.4 cpe:/a:pam-mysql:pam-mysql:0.4.7 cpe:/a:pam-mysql:pam-mysql:0.5 cpe:/a:pam-mysql:pam-mysql:0.6 cpe:/a:pam-mysql:pam-mysql:0.7_pre1 cpe:/a:pam-mysql:pam-mysql:0.7_pre2 CVE-2006-0056 2006-02-13T06:06:00.000-05:00 2011-03-07T21:29:14.283-05:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://jvn.jp/cert/JVNVU%23693909/index.html SECTRACK 1015603 CONFIRM http://sourceforge.net/forum/forum.php?forum_id=499394 GENTOO GLSA-200606-18 CERT-VN VU#693909 BID 16564 VUPEN ADV-2006-0490 Double free vulnerability in the authentication and authentication token alteration code in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords, which lead to a double free of a pointer that was created by the pam_get_item function. NOTE: this issue only occurs in certain configurations in which there are multiple PAM modules, PAM-MySQL is not evaluated first, and there are no requisite modules before PAM-MySQL. cpe:/a:microsoft:ie:5.01:sp4 cpe:/a:microsoft:ie:5.5:sp2 cpe:/a:microsoft:ie:6:sp1 cpe:/a:microsoft:ie:6:windows_server_2003_sp1 CVE-2006-0057 2006-01-27T17:03:00.000-05:00 2017-07-19T21:29:27.690-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CERT-VN VU#998297 MISC http://www.microsoft.com/technet/security/bulletin/ms05-054.mspx BID 16409 XF ie-activex-killbit-bypass(24379) Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to bypass the Kill bit settings for dangerous ActiveX controls via unknown vectors involving crafted HTML, which can expose the browser to attacks that would otherwise be prevented by the Kill bit setting. NOTE: CERT/CC claims that MS05-054 fixes this issue, but it is not described in MS05-054. cpe:/a:sendmail:sendmail:8.13.0 cpe:/a:sendmail:sendmail:8.13.1 cpe:/a:sendmail:sendmail:8.13.2 cpe:/a:sendmail:sendmail:8.13.3 cpe:/a:sendmail:sendmail:8.13.4 cpe:/a:sendmail:sendmail:8.13.5 CVE-2006-0058 2006-03-22T15:06:00.000-05:00 2018-10-19T11:42:18.853-04:00 7.6 NETWORK HIGH NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS FREEBSD FreeBSD-SA-06:13 NETBSD NetBSD-SA2006-010 SCO SCOSA-2006.24 SGI 20060302-01-P SGI 20060401-01-U HP HPSBUX02108 HP HPSBTU02116 SREASON 612 SREASON 743 SECTRACK 1015801 SLACKWARE SSA:2006-081-01 SUNALERT 102262 SUNALERT 102324 SUNALERT 200494 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-074.htm CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-078.htm CIAC Q-151 DEBIAN DSA-1015 CONFIRM http://www.f-secure.com/security/fsc-2006-2.shtml GENTOO GLSA-200603-21 ISS 20060322 Sendmail Remote Signal Handling Vulnerability CERT-VN VU#834865 MANDRIVA MDKSA-2006:058 SUSE SUSE-SA:2006:017 OPENBSD [3.8] 006: SECURITY FIX: March 25, 2006 OPENPKG OpenPKG-SA-2006.007 FEDORA FEDORA-2006-194 FEDORA FEDORA-2006-193 REDHAT RHSA-2006:0264 REDHAT RHSA-2006:0265 BUGTRAQ 20060322 sendmail vuln advisories (CVE-2006-0058) FEDORA FLSA:186277 BID 17192 CONFIRM http://www.sendmail.com/company/advisory/index.shtml CERT TA06-081A VUPEN ADV-2006-1049 VUPEN ADV-2006-1051 VUPEN ADV-2006-1068 VUPEN ADV-2006-1072 VUPEN ADV-2006-1139 VUPEN ADV-2006-1157 VUPEN ADV-2006-1529 VUPEN ADV-2006-2189 VUPEN ADV-2006-2490 AIXAPAR IY82992 AIXAPAR IY82993 AIXAPAR IY82994 CONFIRM http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH00688 CONFIRM http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=2751 XF smtp-timeout-bo(24584) Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by triggering timeouts in a way that causes the setjmp and longjmp function calls to be interrupted and modify unexpected memory locations. cpe:/a:livedata:iccp_server:5.00.045 CVE-2006-0059 2006-05-19T15:02:00.000-04:00 2017-07-19T21:29:27.877-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1016113 MISC http://www.digitalbond.com/SCADA_Blog/2006/05/us-cert-livedata-iccp-vulnerability.html CERT-VN VU#190617 MISC http://www.kb.cert.org/vuls/id/JGEI-6MMS9T BID 18010 VUPEN ADV-2006-1830 XF livedata-iccp-rfc1006-bo(26490) Heap-based buffer overflow in the ISO Transport Service over TCP (RFC 1006) implementation of LiveData ICCP Server before 5.00.035 allows remote attackers to cause a denial of service or execute arbitrary code via malformed packets. cpe:/a:phpbb_group:phpbb:2.0.19 CVE-2006-0063 2006-01-05T14:03:00.000-05:00 2011-03-07T00:00:00.000-05:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov 2006-01-06T08:53:00.000-05:00 SREASONRES 20060105 phpBB 2.0.19 XSS SREASON 313 VUPEN ADV-2006-0051 Cross-site scripting (XSS) vulnerability in phpBB 2.0.19, when "Allowed HTML tags" is enabled, allows remote attackers to inject arbitrary web script or HTML via a permitted HTML tag with ' (single quote) characters and active attributes such as onmouseover, a variant of CVE-2005-4357. cpe:/a:devellion:cubecart CVE-2006-0064 2006-01-03T17:03:00.000-05:00 2017-10-18T21:29:02.707-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS VUPEN ADV-2006-0016 EXPLOIT-DB 1398 PHP remote file include vulnerability in includes/orderSuccess.inc.php in CubeCart allows remote attackers to execute arbitrary PHP code via a URL in the glob[rootDir] parameter. cpe:/a:vego:vego_web_forum:1.26 CVE-2006-0065 2006-01-03T17:03:00.000-05:00 2018-10-19T11:42:27.510-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/1/summary.html SREASON 315 BUGTRAQ 20060101 [eVuln] VEGO Web Forum SQL Injection Vulnerability BID 16107 VUPEN ADV-2006-0003 SQL injection vulnerability in (1) functions.php, (2) functions_update.php, and (3) functions_display.php in VEGO Web Forum 1.26 and earlier allows remote attackers to execute arbitrary SQL commands via the theme_id parameter in index.php. cpe:/a:phpjournaler:phpjournaler:1.0 CVE-2006-0066 2006-01-03T17:03:00.000-05:00 2018-10-19T11:42:27.950-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/9/summary.html BUGTRAQ 20060101 [eVuln] PHPjournaler SQL Injection Vulnerability BID 16111 VUPEN ADV-2006-0006 SQL injection vulnerability in index.php in PHPjournaler 1.0 allows remote attackers to execute arbitrary SQL commands via the readold parameter. cpe:/a:vego:vego_links_builder:2.00 CVE-2006-0067 2006-01-03T17:03:00.000-05:00 2011-03-07T21:29:15.097-05:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/2/summary.html BID 16108 VUPEN ADV-2006-0004 SQL injection vulnerability in login.php in VEGO Links Builder 2.00 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. cpe:/a:primo_place:primo_cart:1.0 CVE-2006-0068 2006-01-03T18:03:00.000-05:00 2011-03-07T21:29:15.173-05:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://pridels0.blogspot.com/2006/01/primo-cart-sql-inj.html BID 16125 VUPEN ADV-2006-0008 SQL injection vulnerability in Primo Cart 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) q parameter to search.php and (2) email parameter to user.php. cpe:/a:chipmunk_scripts:chipmunk_guestbook:1.4 CVE-2006-0069 2006-01-03T18:03:00.000-05:00 2018-10-19T11:42:28.340-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/4/summary.html BUGTRAQ 20060101 [eVuln] Chipmunk Guestbook XSS Vulnerability BID 16112 BID 19087 Cross-site scripting (XSS) vulnerability in addentry.php in Chipmunk Guestbook 1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the homepage parameter. cpe:/a:drupal:drupal:4.5.6 cpe:/a:drupal:drupal:4.6.4 CVE-2006-0070 2006-01-03T19:03:00.000-05:00 2018-10-19T11:42:28.667-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060102 Drupal all versiyon xss cehennem.org BUGTRAQ 20060103 Re: Drupal all versiyon xss cehennem.org ** DISPUTED ** Drupal allows remote attackers to conduct cross-site scripting (XSS) attacks via an IMG tag with an unusual encoded Javascript function name, as demonstrated using variations of the alert() function. NOTE: a followup by the vendor suggests that the issue does not exist in 4.5.6 or 4.6.4 when "Filtered HTML" is enabled, and since "Full HTML" would not filter HTML by design, perhaps this should not be included in CVE. cpe:/a:gentoo:app-crypt_pinentry:0.7.2 cpe:/a:gentoo:app-crypt_pinentry:0.7.2:r1 cpe:/o:gentoo:linux CVE-2006-0071 2006-01-03T19:03:00.000-05:00 2008-09-05T16:58:16.653-04:00 6.6 LOCAL LOW NONE COMPLETE COMPLETE NONE http://nvd.nist.gov 2006-01-04T08:39:00.000-05:00 GENTOO GLSA-200601-01 BID 16120 The ebuild for pinentry before 0.7.2-r2 on Gentoo Linux sets setgid bits for pinentry programs, which allows local users to read or overwrite arbitrary files as gid 0. cpe:/o:sco:openserver:5.0 cpe:/o:sco:openserver:5.0.1 cpe:/o:sco:openserver:5.0.2 cpe:/o:sco:openserver:5.0.3 cpe:/o:sco:openserver:5.0.4 cpe:/o:sco:openserver:5.0.5 cpe:/o:sco:openserver:5.0.6 cpe:/o:sco:openserver:5.0.6a cpe:/o:sco:openserver:5.0.7 CVE-2006-0072 2006-01-03T19:03:00.000-05:00 2008-09-05T16:58:16.797-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-01-04T08:42:00.000-05:00 ALLOWS_USER_ACCESS MISC http://downloads.securityfocus.com/vulnerabilities/exploits/Openserver_bof.c BUGTRAQ 20060102 SCO Openserver 5.0.x exploit BID 16122 Buffer overflow in termsh on SCO OpenServer 5.0.7 allows remote attackers to execute arbitrary code via a long -o command line argument. NOTE: this is probably a different vulnerability than CVE-2005-0351 since it involves a distinct attack vector. cpe:/a:discusware:discus_freeware:3.10.5 cpe:/a:discusware:discus_professional:3.10.4 CVE-2006-0073 2006-01-03T19:03:00.000-05:00 2008-09-05T16:58:16.967-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov 2006-01-04T08:44:00.000-05:00 BID 16119 Cross-site scripting (XSS) vulnerability in DiscusWare Discus Freeware 3.10.5 and Professional 3.10.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a URL, which is not properly sanitized from the resulting error message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:jevontech:phpenpals:1.1 CVE-2006-0074 2006-01-03T20:03:00.000-05:00 2018-10-19T11:42:28.840-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/5/summary.html BUGTRAQ 20060101 [eVuln] PHPenpals SQL Injection Vulnerabilit BID 16109 VUPEN ADV-2006-0005 EXPLOIT-DB 8706 SQL injection vulnerability in profile.php in PHPenpals allows remote attackers to execute arbitrary SQL commands via the personalID parameter. NOTE: it was later reported that 1.1 and earlier are affected. cpe:/a:gnu:phpbook:1.0 cpe:/a:gnu:phpbook:1.1 cpe:/a:gnu:phpbook:1.2 cpe:/a:gnu:phpbook:1.3 cpe:/a:gnu:phpbook:1.3.2 CVE-2006-0075 2006-01-03T20:03:00.000-05:00 2018-10-19T11:42:29.370-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/6/summary.html BUGTRAQ 20060101 [eVuln] phpBook PHP Code Execution BID 16106 VUPEN ADV-2006-0002 Direct static code injection vulnerability in phpBook 1.3.2 and earlier allows remote attackers to execute arbitrary PHP code via the e-mail field (mail variable) in a new message, which is written to a PHP file. cpe:/a:oaboard:oaboard:1.0 CVE-2006-0076 2006-01-03T20:03:00.000-05:00 2018-10-19T11:42:29.713-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/3/summary.html SECTRACK 1016211 BUGTRAQ 20060101 [eVuln] oaBoard PHP Code Execution BUGTRAQ 20060530 OaBoard 1.0 Remote File inclusion BUGTRAQ 20060531 Re: OaBoard 1.0 Remote File inclusion BID 16105 PHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter. cpe:/a:richard_dawe:file_extattr:0.1 cpe:/a:richard_dawe:file_extattr:0.2 CVE-2006-0077 2006-01-03T20:03:00.000-05:00 2011-03-07T21:29:15.830-05:00 2.1 LOCAL LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://sourceforge.net/project/shownotes.php?release_id=382199&group_id=153116 BID 16118 VUPEN ADV-2006-0013 Off-by-one error in the getfattr function in File::ExtAttr before 0.03 allows attackers to trigger a buffer overflow via unspecified attack vectors. cpe:/a:haddad_said:b-net_software:1.0 CVE-2006-0078 2006-01-04T01:03:00.000-05:00 2018-10-19T11:42:30.247-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/10/summary.html SREASON 316 CONFIRM http://sourceforge.net/project/shownotes.php?release_id=442067&group_id=117067 BUGTRAQ 20060102 [eVuln] B-net Software Multiple XSS Vulnerabilities BUGTRAQ 20060825 Re: [eVuln] B-net Software Multiple XSS Vulnerabilities BID 16114 VUPEN ADV-2006-0018 Multiple cross-site scripting (XSS) vulnerabilities in B-net Software 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) shout variables to (a) shout.php, or the (3) title and (4) message variables to (b) guestbook.php. cpe:/a:scoznet:scozbook:1.1_beta CVE-2006-0079 2006-01-04T01:03:00.000-05:00 2018-10-19T11:42:30.950-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/11/summary.html SREASON 318 BUGTRAQ 20060102 [eVuln] ScozBook "adminname" Authentication Bypass BID 16115 VUPEN ADV-2006-0027 SQL injection vulnerability in auth.php in ScozNet ScozBook BETA 1.1 allows remote attackers to execute arbitrary SQL commands via the username field (adminname variable). cpe:/a:jelsoft:vbulletin:3.5.2 CVE-2006-0080 2006-01-04T01:03:00.000-05:00 2018-10-19T11:42:31.417-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://kapda.ir/advisory-177.html BUGTRAQ 20060101 [KAPDA::#19] - Html Injection in vBulletin 3.5.2 BUGTRAQ 20060108 Html_Injection in vBulletin 3.5.2 BID 16116 VUPEN ADV-2006-0033 Cross-site scripting (XSS) vulnerability in vBulletin 3.5.2, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the title of an event, which is not properly filtered by (1) calendar.php and (2) reminder.php. cpe:/a:intel:graphics_accelerator_driver:6.14.10.4308 CVE-2006-0081 2006-01-04T01:03:00.000-05:00 2016-12-19T21:59:03.040-05:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov FULLDISC 20060103 Re: Buffer Overflow vulnerability in Windows Display Manager [Suspected] FULLDISC 20060102 Buffer Overflow vulnerability in Windows Display Manager [Suspected] BID 16127 VUPEN ADV-2006-0017 ialmnt5.sys in the ialmrnt5 display driver in Intel Graphics Accelerator Driver 6.14.10.4308 allows attackers to cause a denial of service (crash or screen resolution change) via a long text field, as demonstrated using a long window title. cpe:/a:imagemagick:imagemagick:6.2.3 CVE-2006-0082 2006-01-04T18:03:00.000-05:00 2018-10-19T11:42:32.010-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SGI 20060301-01-U CONFIRM http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=345876 REDHAT RHSA-2006:0178 SREASON 500 SECTRACK 1015623 SLACKWARE SSA:2006-045-03 SUNALERT 231321 DEBIAN DSA-1213 GENTOO GLSA-200602-06 GENTOO GLSA-200602-13.xml MANDRIVA MDKSA-2006:024 SUSE SUSE-SR:2006:006 BUGTRAQ 20061127 rPSA-2006-0218-1 ImageMagick BID 12717 UBUNTU USN-246-1 VUPEN ADV-2008-0412 CONFIRM https://issues.rpath.com/browse/RPL-389 Format string vulnerability in the SetImageInfo function in image.c for ImageMagick 6.2.3 and other versions, and GraphicsMagick, allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a numeric format string specifier such as %d in the file name, a variant of CVE-2005-0397, and as demonstrated using the convert program. cpe:/a:stefan_frings:sms_server_tools CVE-2006-0083 2006-01-09T15:03:00.000-05:00 2017-07-19T21:29:27.957-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS DEBIAN DSA-930 BID 16188 XF smstools-logging-format-string(24034) Format string vulnerability in the logging code of SMS Server Tools (smstools) 1.14.8 and earlier allows local users to execute arbitrary code via unspecified attack vectors. cpe:/a:rasmp:rasmp:2.0.0 CVE-2006-0084 2006-01-05T06:03:00.000-05:00 2011-03-07T21:29:18.643-05:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov VIM 20060116 vendor ack/fix: 22198: raSMP index.php User-Agent Field XSS (fwd) MISC http://evuln.com/vulns/13/summary.html SECTRACK 1015432 BID 16138 VUPEN ADV-2006-0030 Cross-site scripting vulnerability in index.php in raSMP 2.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the $_SERVER[HTTP_USER_AGENT] variable (User-Agent header). cpe:/a:nkads:nkads:1.0alfa2 cpe:/a:nkads:nkads:1.0alfa3 CVE-2006-0085 2006-01-05T06:03:00.000-05:00 2011-03-07T21:29:18.720-05:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.soulblack.com.ar/repo/papers/advisory/nkads_advisory.txt VUPEN ADV-2006-0040 SQL injection vulnerability in Nkads 1.0 alfa 3 allows remote attackers to execute arbitrary SQL commands via the (1) usuario_nkads_admin or (2) password_nkads_admin parameters. cpe:/a:next_generation_image_gallery:next_generation_image_gallery:0.0.1_lite CVE-2006-0086 2006-01-05T06:03:00.000-05:00 2011-03-07T21:29:18.813-05:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov VUPEN ADV-2006-0037 Cross-site scripting vulnerability in index.php in Next Generation Image Gallery 0.0.1 Lite Edition allows remote attackers to inject arbitrary web script or HTML via the page parameter. cpe:/a:lizard_cart:lizard_cart_cms:1.0.4 CVE-2006-0087 2006-01-05T06:03:00.000-05:00 2018-10-19T11:42:34.307-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 314 SECTRACK 1015435 MISC http://www.evuln.com/vulns/12/summary.html BUGTRAQ 20060104 [eVuln] Lizard Cart CMS SQL Injection Vulnerability BID 16140 VUPEN ADV-2006-0029 SQL injection vulnerability in (1) pages.php and (2) detail.php in Lizard Cart CMS 1.04 allows remote attackers to execute arbitrary SQL commands via the id parameter. cpe:/a:intouch:intouch:0.5.1_alpha CVE-2006-0088 2006-01-05T06:03:00.000-05:00 2018-10-19T11:42:34.903-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/8/summary.html BUGTRAQ 20060101 [eVuln] inTouch Authentication Bypass BID 16110 VUPEN ADV-2006-0026 XF intouch-intouch-sql-injection(23954) SQL injection vulnerability in intouch.lib.php in inTouch 0.5.1 Alpha allows remote attackers to execute arbitrary SQL commands via the user parameter. cpe:/a:esri:arcpad:7.0.0.156 CVE-2006-0089 2006-01-05T06:03:00.000-05:00 2011-03-07T21:29:19.097-05:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://users.pandora.be/bratax/advisories/b007.html BID 16136 VUPEN ADV-2006-0032 Buffer overflow in ESRI ArcPad 7.0.0.156 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .amp file with a COORDSYS tag with a long string attribute. cpe:/a:idv_directory_viewer:idv_directory_viewer:2005.1_b1 CVE-2006-0090 2006-01-05T06:03:00.000-05:00 2011-03-07T21:29:19.187-05:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://sourceforge.net/project/shownotes.php?release_id=382593&group_id=152499 BID 16137 VUPEN ADV-2006-0031 Directory traversal vulnerability in index.php in IDV Directory Viewer before 2005.1 allows remote attackers to view arbitrary directory contents via a .. (dot dot) in the dir parameter. cpe:/a:open-xchange:open-xchange:0.8.1.6 CVE-2006-0091 2006-01-05T06:03:00.000-05:00 2016-10-17T23:38:45.400-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060103 Open Xchange XSS SECTRACK 1015431 VUPEN ADV-2006-0034 Cross-site scripting (XSS) vulnerability in webmail in Open-Xchange 0.8.1-6 and earlier, with "Inline HTML" enabled, allows remote attackers to inject arbitrary web script or HTML via e-mail attachments, which are rendered inline. CVE-2006-0092 2006-01-05T06:03:00.000-05:00 2008-09-10T15:55:26.397-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0992, CVE-2006-0158. Reason: this candidate was intended for one issue, but a typo caused it to be associated with a Novell/Groupwise issue. In addition, this issue was a duplicate of a SiteSuite issue that was also assigned CVE-2006-0158. Notes: All CVE users should consult CVE-2006-0992 and CVE-2006-0158 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage. cpe:/a:ecardmax.com:atcard_me_php CVE-2006-0093 2006-01-05T06:03:00.000-05:00 2011-03-07T21:29:19.407-05:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov VUPEN ADV-2006-0039 Cross-site scripting (XSS) vulnerability in index.php in @Card ME PHP allows remote attackers to inject arbitrary web script or HTML via the cat parameter. cpe:/a:oaboard:oaboard:1.0 CVE-2006-0094 2006-01-05T06:03:00.000-05:00 2011-08-23T00:00:00.000-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-01-06T09:12:00.000-05:00 ALLOWS_OTHER_ACCESS VUPEN ADV-2006-0028 PHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc_stat parameter, a different vulnerability than CVE-2006-0076. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.2 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8.1 cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11.1 cpe:/o:linux:linux_kernel:2.6.11.2 cpe:/o:linux:linux_kernel:2.6.11.3 cpe:/o:linux:linux_kernel:2.6.11.4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.9 cpe:/o:linux:linux_kernel:2.6.11.10 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.12 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15:rc4 cpe:/o:linux:linux_kernel:2.6.15:rc5 cpe:/o:linux:linux_kernel:2.6.15:rc6 cpe:/o:linux:linux_kernel:2.6.15:rc7 CVE-2006-0095 2006-01-06T06:03:00.000-05:00 2018-10-19T11:42:35.370-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MLIST [linux-kernel] 20060104 [Patch 2.6] dm-crypt: zero key before freeing it MLIST [linux-kernel] 20060104 [Patch 2.6] dm-crypt: Zero key material before free to avoid information leak SREASON 388 SECTRACK 1015740 DEBIAN DSA-1017 MANDRIVA MDKSA-2006:040 SUSE SUSE-SA:2006:028 FEDORA FEDORA-2006-102 REDHAT RHSA-2006:0132 FEDORA FLSA:157459-4 BID 16301 TRUSTIX 2006-0004 VUPEN ADV-2006-0235 XF kernel-dmcrypt-information-disclosure(24189) UBUNTU USN-244-1 dm-crypt in Linux kernel 2.6.15 and earlier does not clear a structure before it is freed, which leads to a memory disclosure that could allow local users to obtain sensitive information about a cryptographic key. cpe:/o:linux:linux_kernel:2.4.0 cpe:/o:linux:linux_kernel:2.4.0:test1 cpe:/o:linux:linux_kernel:2.4.0:test10 cpe:/o:linux:linux_kernel:2.4.0:test11 cpe:/o:linux:linux_kernel:2.4.0:test12 cpe:/o:linux:linux_kernel:2.4.0:test2 cpe:/o:linux:linux_kernel:2.4.0:test3 cpe:/o:linux:linux_kernel:2.4.0:test4 cpe:/o:linux:linux_kernel:2.4.0:test5 cpe:/o:linux:linux_kernel:2.4.0:test6 cpe:/o:linux:linux_kernel:2.4.0:test7 cpe:/o:linux:linux_kernel:2.4.0:test8 cpe:/o:linux:linux_kernel:2.4.0:test9 cpe:/o:linux:linux_kernel:2.4.1 cpe:/o:linux:linux_kernel:2.4.2 cpe:/o:linux:linux_kernel:2.4.3 cpe:/o:linux:linux_kernel:2.4.4 cpe:/o:linux:linux_kernel:2.4.5 cpe:/o:linux:linux_kernel:2.4.6 cpe:/o:linux:linux_kernel:2.4.7 cpe:/o:linux:linux_kernel:2.4.8 cpe:/o:linux:linux_kernel:2.4.9 cpe:/o:linux:linux_kernel:2.4.10 cpe:/o:linux:linux_kernel:2.4.11 cpe:/o:linux:linux_kernel:2.4.12 cpe:/o:linux:linux_kernel:2.4.13 cpe:/o:linux:linux_kernel:2.4.14 cpe:/o:linux:linux_kernel:2.4.15 cpe:/o:linux:linux_kernel:2.4.16 cpe:/o:linux:linux_kernel:2.4.17 cpe:/o:linux:linux_kernel:2.4.18 cpe:/o:linux:linux_kernel:2.4.18::x86 cpe:/o:linux:linux_kernel:2.4.18:pre1 cpe:/o:linux:linux_kernel:2.4.18:pre2 cpe:/o:linux:linux_kernel:2.4.18:pre3 cpe:/o:linux:linux_kernel:2.4.18:pre4 cpe:/o:linux:linux_kernel:2.4.18:pre5 cpe:/o:linux:linux_kernel:2.4.18:pre6 cpe:/o:linux:linux_kernel:2.4.18:pre7 cpe:/o:linux:linux_kernel:2.4.18:pre8 cpe:/o:linux:linux_kernel:2.4.19 cpe:/o:linux:linux_kernel:2.4.19:pre1 cpe:/o:linux:linux_kernel:2.4.19:pre2 cpe:/o:linux:linux_kernel:2.4.19:pre3 cpe:/o:linux:linux_kernel:2.4.19:pre4 cpe:/o:linux:linux_kernel:2.4.19:pre5 cpe:/o:linux:linux_kernel:2.4.19:pre6 cpe:/o:linux:linux_kernel:2.4.20 cpe:/o:linux:linux_kernel:2.4.21 cpe:/o:linux:linux_kernel:2.4.21:pre1 cpe:/o:linux:linux_kernel:2.4.21:pre4 cpe:/o:linux:linux_kernel:2.4.21:pre7 cpe:/o:linux:linux_kernel:2.4.22 cpe:/o:linux:linux_kernel:2.4.23 cpe:/o:linux:linux_kernel:2.4.23:pre9 cpe:/o:linux:linux_kernel:2.4.23_ow2 cpe:/o:linux:linux_kernel:2.4.24 cpe:/o:linux:linux_kernel:2.4.24_ow1 cpe:/o:linux:linux_kernel:2.4.25 cpe:/o:linux:linux_kernel:2.4.26 cpe:/o:linux:linux_kernel:2.4.27 cpe:/o:linux:linux_kernel:2.4.27:pre1 cpe:/o:linux:linux_kernel:2.4.27:pre2 cpe:/o:linux:linux_kernel:2.4.27:pre3 cpe:/o:linux:linux_kernel:2.4.27:pre4 cpe:/o:linux:linux_kernel:2.4.27:pre5 cpe:/o:linux:linux_kernel:2.4.28 cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.2 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8.1 cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11.1 cpe:/o:linux:linux_kernel:2.6.11.2 cpe:/o:linux:linux_kernel:2.6.11.3 cpe:/o:linux:linux_kernel:2.6.11.4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.9 cpe:/o:linux:linux_kernel:2.6.11.10 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.12 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15:rc4 cpe:/o:linux:linux_kernel:2.6.15:rc5 cpe:/o:linux:linux_kernel:2.6.15:rc6 cpe:/o:linux:linux_kernel:2.6.15:rc7 CVE-2006-0096 2006-01-06T06:03:00.000-05:00 2018-10-03T17:34:56.180-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov DEBIAN DSA-1017 CONFIRM http://www.kernel.org/git/?p=linux/kernel/git/tglx/history.git;a=commitdiff;h=0f1d4813a4a65296e1131f320a60741732bc068f BID 16304 MANDRIVA MDKSA-2006:044 UBUNTU USN-244-1 wan/sdla.c in Linux kernel 2.6.x before 2.6.11 and 2.4.x before 2.4.29 does not require the CAP_SYS_RAWIO privilege for an SDLA firmware upgrade, with unknown impact and local attack vectors. NOTE: further investigation suggests that this issue requires root privileges to exploit, since it is protected by CAP_NET_ADMIN; thus it might not be a vulnerability, although capabilities provide finer distinctions between privilege levels. cpe:/a:php:php:4.3.10 cpe:/a:php:php:4.4.0 cpe:/a:php:php:4.4.1 cpe:/a:php:php:4.4.2 CVE-2006-0097 2006-01-06T06:03:00.000-05:00 2018-10-19T11:42:37.917-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS FULLDISC 20060108 RE: Windows PHP 4.x "0-day" buffer overflow FULLDISC 20060105 Windows PHP 4.x "0-day" buffer overflow CONFIRM http://www.php.net/ChangeLog-4.php#4.4.3 BUGTRAQ 20060105 Windows PHP 4.x "0-day" buffer overflow BID 16145 VUPEN ADV-2006-0046 Stack-based buffer overflow in the create_named_pipe function in libmysql.c in PHP 4.3.10 and 4.4.x before 4.4.3 for Windows allows attackers to execute arbitrary code via a long (1) arg_host or (2) arg_unix_socket argument, as demonstrated by a long named pipe variable in the host argument to the mysql_connect function. cpe:/o:openbsd:openbsd:3.7 cpe:/o:openbsd:openbsd:3.8 CVE-2006-0098 2006-01-06T06:03:00.000-05:00 2008-09-05T16:58:21.280-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-01-06T08:21:00.000-05:00 MISC ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/008_fd.patch SECTRACK 1015437 OPENBSD [3.7] 20060105 008: SECURITY FIX: January 5, 2006 BID 16144 The dupfdopen function in sys/kern/kern_descrip.c in OpenBSD 3.7 and 3.8 allows local users to re-open arbitrary files by using setuid programs to access file descriptors using /dev/fd/. cpe:/a:valdersoft:valdersoft_shopping_cart:3.0 CVE-2006-0099 2006-01-06T06:03:00.000-05:00 2017-10-18T21:29:02.753-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://downloads.securityfocus.com/vulnerabilities/exploits/cijfer-vscxpl.pl BID 16126 EXPLOIT-DB 1401 PHP remote file include vulnerability in (1) include/templates/categories/default.php and (2) certain other include/templates/categories/ PHP scripts in Valdersoft Shopping Cart 3.0 allows remote attackers to execute arbitrary code via a URL in the catalogDocumentRoot parameter. cpe:/a:nicosw:nicoftp:3.0.1.19 CVE-2006-0100 2006-01-06T06:03:00.000-05:00 2018-10-19T11:42:38.403-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SREASON 317 BUGTRAQ 20060102 NicoFTP Stack Overflow Buffer overflow in NicoFTP 3.0.1.19 and earlier might allow local users to execute arbitrary code via a long string in the "Name of site" field of an FTP account. NOTE: because this program executes with the privileges of the invoking user, and because remote programs do not normally have the ability to create or modify FTP accounts in this program, there may not be a typical attack vector for the issue that crosses privilege boundaries. Therefore this may not be a vulnerability. cpe:/a:sblog:sblog:0.7.1_build2005-12-02_beta CVE-2006-0101 2006-01-06T06:03:00.000-05:00 2017-07-19T21:29:28.190-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov VUPEN ADV-2006-0041 XF sblog-multiple-scripts-xss(23979) Multiple cross-site scripting (XSS) vulnerabilities in sBLOG 0.7.1 Beta 20051202 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) p and (2) keyword parameters in (a) index.php and (b) search.php. cpe:/a:ralph_capper:tinyphpforum:3.5 cpe:/a:ralph_capper:tinyphpforum:3.6 cpe:/a:ralph_capper:tinyphpforum:3.46 cpe:/a:ralph_capper:tinyphpforum:3.47 cpe:/a:ralph_capper:tinyphpforum:3.48 cpe:/a:ralph_capper:tinyphpforum:3.49 cpe:/a:ralph_capper:tinyphpforum:3.499 CVE-2006-0102 2006-01-06T06:03:00.000-05:00 2018-10-19T11:42:38.573-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/14/summary.html SREASON 320 SECTRACK 1015436 BUGTRAQ 20060105 [eVuln] TinyPHPForum Multiple Vulnerabilities VUPEN ADV-2006-0054 Cross-site scripting (XSS) vulnerability in TinyPHPForum (TPF) 3.6 and earlier allows remote attackers to inject arbitrary web script via a javascript: scheme in an "[a]" bbcode tag, possibly the txt parameter to action.php. cpe:/a:ralph_capper:tinyphpforum:3.5 cpe:/a:ralph_capper:tinyphpforum:3.6 cpe:/a:ralph_capper:tinyphpforum:3.46 cpe:/a:ralph_capper:tinyphpforum:3.47 cpe:/a:ralph_capper:tinyphpforum:3.48 cpe:/a:ralph_capper:tinyphpforum:3.49 cpe:/a:ralph_capper:tinyphpforum:3.499 CVE-2006-0103 2006-01-06T06:03:00.000-05:00 2018-10-19T11:42:39.027-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://evuln.com/vulns/14/summary.html SREASON 320 SECTRACK 1015436 BUGTRAQ 20060105 [eVuln] TinyPHPForum Multiple Vulnerabilities BUGTRAQ 20060417 Tiny PHP forum - vulns VUPEN ADV-2006-0054 XF tinyphpforum-users-information-disclosure(24016) TinyPHPForum 3.6 and earlier stores the (1) users/[USERNAME].hash and (2) users/[USERNAME].email files under the web root with insufficient access control, which allows remote attackers to list all registered users and possibly obtain other sensitive information. cpe:/a:ralph_capper:tinyphpforum:3.5 cpe:/a:ralph_capper:tinyphpforum:3.6 cpe:/a:ralph_capper:tinyphpforum:3.46 cpe:/a:ralph_capper:tinyphpforum:3.47 cpe:/a:ralph_capper:tinyphpforum:3.48 cpe:/a:ralph_capper:tinyphpforum:3.49 cpe:/a:ralph_capper:tinyphpforum:3.499 CVE-2006-0104 2006-01-06T06:03:00.000-05:00 2018-10-19T11:42:39.730-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/14/exploit.html MISC http://evuln.com/vulns/14/summary.html SREASON 320 SECTRACK 1015436 BUGTRAQ 20060105 [eVuln] TinyPHPForum Multiple Vulnerabilities BID 16163 VUPEN ADV-2006-0054 Directory traversal vulnerability in TinyPHPForum 3.6 and earlier allows remote attackers to create a new user account, create a new topic, or view the profile of a user account, as demonstrated via a .. (dot dot) in the uname parameter to profile.php. cpe:/a:postgresql:postgresql:8.0 cpe:/a:postgresql:postgresql:8.0.1 cpe:/a:postgresql:postgresql:8.0.2 cpe:/a:postgresql:postgresql:8.0.3 cpe:/a:postgresql:postgresql:8.0.4 cpe:/a:postgresql:postgresql:8.0.5 cpe:/a:postgresql:postgresql:8.1.0 cpe:/a:postgresql:postgresql:8.1.1 CVE-2006-0105 2006-01-10T15:03:00.000-05:00 2018-10-19T11:42:40.293-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MLIST [pgsql-announce] 20060109 CRITICAL RELEASE: Minor Releases to Fix DoS Vulnerability SREASON 327 SECTRACK 1015482 CONFIRM http://www.postgresql.org/about/news.456 BUGTRAQ 20060111 PostgreSQL security releases 8.0.6 and 8.1.2 BID 16201 VUPEN ADV-2006-0114 XF postgresql-connection-request-dos(24049) PostgreSQL 8.0.x before 8.0.6 and 8.1.x before 8.1.2, when running on Windows, allows remote attackers to cause a denial of service (postmaster exit and no new connections) via a large number of simultaneous connection requests. cpe:/a:wine:wine:0.9.2 cpe:/a:wine:wine:0.9.4 cpe:/a:wine:wine:0.9.5 cpe:/a:wine:wine:2005-09-30 CVE-2006-0106 2006-01-06T13:03:00.000-05:00 2018-10-19T11:42:40.903-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=346197 MLIST [Dailydave] 20060105 WMF goes away :< DEBIAN DSA-954 GENTOO GLSA-200601-09 MANDRIVA MDKSA-2006:014 SUSE SUSE-SR:2006:002 BUGTRAQ 20060117 ERRATA: [ GLSA 200601-09 ] Wine: Windows Metafile SETABORTPROC vulnerability VUPEN ADV-2006-0098 XF win-wmf-execute-code(23846) gdi/driver.c and gdi/printdrv.c in Wine 20050930, and other versions, implement the SETABORTPROC GDI Escape function call for Windows Metafile (WMF) files, which allows attackers to execute arbitrary code, the same vulnerability as CVE-2005-4560 but in a different codebase. cpe:/a:idea_development_id_oy:timecan_cms CVE-2006-0107 2006-01-06T19:03:00.000-05:00 2017-07-19T21:29:28.440-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BID 16159 XF timecancms-sql-injection(24014) SQL injection vulnerability in Timecan CMS allows remote attackers to execute arbitrary SQL commands via the viewID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Due to the unavailability of the original source, it cannot be determined if this is the same issue as identified by CVE-2006-0108. cpe:/a:idea_development_id_oy:timecan_cms CVE-2006-0108 2006-01-06T19:03:00.000-05:00 2017-07-19T21:29:28.503-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS VUPEN ADV-2006-0078 XF timecancms-sql-injection(24014) SQL injection vulnerability in mcl_login.asp in Timecan CMS allows remote attackers to execute arbitrary SQL commands via the email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Due to the unavailability of the original source, it cannot be determined if this is the same issue as identified by CVE-2006-0107. cpe:/a:modular_merchant:shopping_cart CVE-2006-0109 2006-01-06T19:03:00.000-05:00 2011-03-07T21:29:21.000-05:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov VIM 20060214 vendor ack/fix 22243: Modular Merchant Marketplace Shopping Cart category.php cat Variable XSS (fwd) MISC http://www.modularmerchant.com/forums/viewtopic.php?t=46 BID 16160 VUPEN ADV-2006-0076 Cross-site scripting vulnerability in category.php in Modular Merchant Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the cat parameter. cpe:/a:javier_suarez_sanz:foro_domus:2.10 CVE-2006-0110 2006-01-06T19:03:00.000-05:00 2018-10-19T11:42:41.933-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/16/summary.html BUGTRAQ 20060106 [eVuln] Proyecto Domus 'email' XSS Vulnerability BID 16154 VUPEN ADV-2006-0073 XF domus-escribir-xss(24020) Cross-site scripting (XSS) vulnerability in escribir.php in Foro Domus 2.10 allows remote attackers to inject arbitrary web script via the email parameter. cpe:/a:boxcar_media:shopping_cart CVE-2006-0111 2006-01-06T19:03:00.000-05:00 2017-07-19T21:29:28.613-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov VUPEN ADV-2006-0080 XF boxcar-index-xss(24019) Cross-site scripting vulnerability in index.php in Boxcar Media Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the (1) parent or (2) pg parameter. cpe:/a:enhanced_simple_php_gallery:enhanced_simple_php_gallery:1.7 CVE-2006-0112 2006-01-06T20:03:00.000-05:00 2011-03-07T21:29:21.237-05:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov VUPEN ADV-2006-0036 Cross-site scripting (XSS) vulnerability in index.php in Enhanced Simple PHP Gallery 1.7 allows remote attackers to inject arbitrary web script or HTML via the dir parameter. cpe:/a:enhanced_simple_php_gallery:enhanced_simple_php_gallery:1.7 CVE-2006-0113 2006-01-06T20:03:00.000-05:00 2008-09-05T16:58:23.733-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov 2006-01-11T09:34:00.000-05:00 Enhanced Simple PHP Gallery 1.7 allows remote attackers to obtain the full path of the application via a direct request to sp_helper_functions.php, which leaks the pathname in an error message. cpe:/a:joomla:joomla:1.0.5 CVE-2006-0114 2006-01-09T06:03:00.000-05:00 2017-07-19T21:29:28.690-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://forge.joomla.org/sf/go/artf2950 CONFIRM http://forum.joomla.org/index.php/topic,29031.0.html BID 16185 VUPEN ADV-2006-0097 XF joomla-vcard-information-disclosure(24042) The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses to conduct spam attacks by modifying the contact_id parameter to index2.php. cpe:/a:oneplug_solutions:oneplug_cms CVE-2006-0115 2006-01-09T06:03:00.000-05:00 2011-09-08T00:00:00.000-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-01-09T08:28:00.000-05:00 ALLOWS_OTHER_ACCESS BID 16155 VUPEN ADV-2006-0079 Multiple SQL injection vulnerabilities in OnePlug Solutions OnePlug CMS allow remote attackers to execute arbitrary SQL commands via the (1) Press_Release_ID parameter in press/details.asp, (2) Service_ID parameter in services/details.asp, and (3) Product_ID parameter in products/details.asp. cpe:/a:inetstore:inetstore_online CVE-2006-0116 2006-01-09T06:03:00.000-05:00 2018-10-19T11:42:42.497-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov VIM 20060127 vendor confirms versions: iNETstore E Commerce Solution - Cross Site Scripting (fwd) BUGTRAQ 20060126 Re: [OSVDB Mods] iNETstore E Commerce Solution - Cross Site Scripting BID 16156 VUPEN ADV-2006-0075 Cross-site scripting vulnerability search.inetstore in iNETstore Ebusiness Software 2.0 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter. cpe:/a:ibm:lotus_domino:6.5.0 cpe:/a:ibm:lotus_domino:6.5.1 cpe:/a:ibm:lotus_domino:6.5.2 cpe:/a:ibm:lotus_domino:6.5.3 cpe:/a:ibm:lotus_domino:6.5.4 cpe:/a:ibm:lotus_domino:6.5.4::fp1 cpe:/a:ibm:lotus_domino:6.5.4::fp2 cpe:/a:ibm:lotus_domino_enterprise_server:6.5.2 cpe:/a:ibm:lotus_domino_enterprise_server:6.5.4 cpe:/a:ibm:lotus_notes:6.5 cpe:/a:ibm:lotus_notes:6.5.1 cpe:/a:ibm:lotus_notes:6.5.2 cpe:/a:ibm:lotus_notes:6.5.3 cpe:/a:ibm:lotus_notes:6.5.4 CVE-2006-0117 2006-01-09T06:03:00.000-05:00 2017-07-19T21:29:28.737-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov BID 16158 VUPEN ADV-2006-0081 CONFIRM http://www-1.ibm.com/support/docview.wss?uid=swg27007054 CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/50c634bfe193efa5852570e4001baace?OpenDocument CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/21d8fd7989fdf78d852570e4001bae68?OpenDocument XF lotus-cdtomime-dos(24205) Buffer overflow in IBM Lotus Notes and Domino Server before 6.5.5 allows attackers to cause a denial of service (router crash or hang) via unspecified vectors involving "CD to MIME Conversion". cpe:/a:ibm:lotus_domino:6.5.0 cpe:/a:ibm:lotus_domino:6.5.1 cpe:/a:ibm:lotus_domino:6.5.2 cpe:/a:ibm:lotus_domino:6.5.3 cpe:/a:ibm:lotus_domino:6.5.4 cpe:/a:ibm:lotus_domino:6.5.4::fp1 cpe:/a:ibm:lotus_domino:6.5.4::fp2 cpe:/a:ibm:lotus_domino_enterprise_server:6.5.2 cpe:/a:ibm:lotus_domino_enterprise_server:6.5.4 cpe:/a:ibm:lotus_notes:6.5 cpe:/a:ibm:lotus_notes:6.5.1 cpe:/a:ibm:lotus_notes:6.5.2 cpe:/a:ibm:lotus_notes:6.5.3 cpe:/a:ibm:lotus_notes:6.5.4 CVE-2006-0118 2006-01-09T06:03:00.000-05:00 2017-07-19T21:29:28.800-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov BID 16158 VUPEN ADV-2006-0081 CONFIRM http://www-1.ibm.com/support/docview.wss?uid=swg27007054 CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/50c634bfe193efa5852570e4001baace?OpenDocument CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/21d8fd7989fdf78d852570e4001bae68?OpenDocument XF lotus-long-formula-bo(24206) Unspecified vulnerability in IBM Lotus Notes and Domino Server before 6.5.5, when running on AIX, allows attackers to cause a denial of service (deep recursion leading to stack overflow and crash) via long formulas. cpe:/a:ibm:lotus_domino:6.5.0 cpe:/a:ibm:lotus_domino:6.5.1 cpe:/a:ibm:lotus_domino:6.5.2 cpe:/a:ibm:lotus_domino:6.5.3 cpe:/a:ibm:lotus_domino:6.5.4 cpe:/a:ibm:lotus_domino:6.5.4::fp1 cpe:/a:ibm:lotus_domino:6.5.4::fp2 cpe:/a:ibm:lotus_domino_enterprise_server:6.5.2 cpe:/a:ibm:lotus_domino_enterprise_server:6.5.4 cpe:/a:ibm:lotus_notes:6.5 cpe:/a:ibm:lotus_notes:6.5.1 cpe:/a:ibm:lotus_notes:6.5.2 cpe:/a:ibm:lotus_notes:6.5.3 cpe:/a:ibm:lotus_notes:6.5.4 CVE-2006-0119 2006-01-09T06:03:00.000-05:00 2018-10-19T11:42:42.870-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov SECTRACK 1016390 BUGTRAQ 20060626 SYMSA-2006-006: Lotus Domino SMTP Based Denial of Service BID 16158 BID 18020 VUPEN ADV-2006-0081 VUPEN ADV-2006-2564 CONFIRM http://www-1.ibm.com/support/docview.wss?uid=swg27007054 CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/94a77eb898843aca8525709200001de1?OpenDocument&Highlight=0,JGAN6B6TZ3 CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/9a1650d1a771f3078525702a00420def?OpenDocument&Highlight=0,HSAO6BNL6Y CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/d1150fc9c5dec8b18525709200001da6?OpenDocument&Highlight=0,GPKS6C9J67 CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/de2ab57a5b9547848525701b00420c2c?OpenDocument&Highlight=0,KSPR699NBP CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/e4deb1cbb011c747852570e4001ba9bb?OpenDocument&Highlight=0,GPKS5YQGPT CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/f97fe7cfd9a8113b8525709200001db4?OpenDocument&Highlight=0,GPKS6C9J67 XF lotus-multiple-unspecified(24207) XF lotus-web-unspecified-xss(24211) XF domino-smtp-nrouter-dos(27413) Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 have unknown impact and attack vectors, due to "potential security issues" as identified by SPR numbers (1) GPKS6C9J67 in Agents, (2) JGAN6B6TZ3 and (3) KSPR699NBP in the Router, (4) GPKS5YQGPT in Security, or (5) HSAO6BNL6Y in the Web Server. NOTE: vector 3 is related to an issue in NROUTER in IBM Lotus Notes and Domino Server before 6.5.4 FP1, 6.5.5, and 7.0, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted vCal meeting request sent via SMTP (aka SPR# KSPR699NBP). cpe:/a:ibm:lotus_domino:6.5.0 cpe:/a:ibm:lotus_domino:6.5.1 cpe:/a:ibm:lotus_domino:6.5.2 cpe:/a:ibm:lotus_domino:6.5.3 cpe:/a:ibm:lotus_domino:6.5.4 cpe:/a:ibm:lotus_domino:6.5.4::fp1 cpe:/a:ibm:lotus_domino:6.5.4::fp2 cpe:/a:ibm:lotus_domino_enterprise_server:6.5.2 cpe:/a:ibm:lotus_domino_enterprise_server:6.5.4 cpe:/a:ibm:lotus_notes:6.5 cpe:/a:ibm:lotus_notes:6.5.1 cpe:/a:ibm:lotus_notes:6.5.2 cpe:/a:ibm:lotus_notes:6.5.3 cpe:/a:ibm:lotus_notes:6.5.4 CVE-2006-0120 2006-01-09T06:03:00.000-05:00 2017-07-19T21:29:28.987-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov BID 16158 VUPEN ADV-2006-0081 CONFIRM http://www-1.ibm.com/support/docview.wss?uid=swg27007054 CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/258394eaa824f2c08525708a004209d3?OpenDocument CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/040482aeb1416bb7852570e4001badd6?OpenDocument CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/2bb4f466a9e986ae852570e4001babbb?OpenDocument CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/4118a1f266afb26c852570e4001baf5e?OpenDocument CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/5f166a44ee743b2c852570e4001baf31?OpenDocument CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/ad0dd14aa109f96b852570e4001bb08c?OpenDocument CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/ced5f873baea4e8b852570e4001baa6d?OpenDocument XF lotus-outofoffice-dos(24212) XF lotus-compact-dos(24213) XF lotus-bmp-dos(24214) XF lotus-delete-attachment-dos(24215) XF lotus-certificate-parsing-dos(24216) XF lotus-ssl-keyring-dos(24217) Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (application crash) via multiple vectors, involving (1) a malformed message sent to an "Out Of Office" agent (SPR LPEE6DMQWJ), (2) the compact command (RTIN5U2SAJ), (3) malformed bitmap images (MYAA6FH5HW), (4) the "Delete Attachment" action (YPHG6844LD), (5) parsing certificates from a remote Certificate Table (AELE6DZFJW), and (6) creating a SSL key ring with the Domino Administration client (NSUA4FQPTN). cpe:/a:ibm:lotus_domino:6.5.0 cpe:/a:ibm:lotus_domino:6.5.1 cpe:/a:ibm:lotus_domino:6.5.2 cpe:/a:ibm:lotus_domino:6.5.3 cpe:/a:ibm:lotus_domino:6.5.4 cpe:/a:ibm:lotus_domino:6.5.4::fp1 cpe:/a:ibm:lotus_domino:6.5.4::fp2 cpe:/a:ibm:lotus_domino_enterprise_server:6.5.2 cpe:/a:ibm:lotus_domino_enterprise_server:6.5.4 cpe:/a:ibm:lotus_notes:6.5 cpe:/a:ibm:lotus_notes:6.5.1 cpe:/a:ibm:lotus_notes:6.5.2 cpe:/a:ibm:lotus_notes:6.5.3 cpe:/a:ibm:lotus_notes:6.5.4 CVE-2006-0121 2006-01-09T06:03:00.000-05:00 2017-07-19T21:29:29.080-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov BID 16158 VUPEN ADV-2006-0081 CONFIRM http://www-1.ibm.com/support/docview.wss?uid=swg27007054 CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/20f66e356a76c90f8525702a00420e08?OpenDocument&Highlight=0,MKIN67MQVW CONFIRM http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/2221243535d88a2b8525701b00420cd6?OpenDocument&Highlight=0,MKIN693QUT XF lotus-ssl-handshake-dos(24223) Multiple memory leaks in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (memory consumption and crash) via unknown vectors related to (1) unspecified vectors during the SSL handshake (SPR# MKIN67MQVW), (2) the stash file during the SSL handshake (SPR# MKIN693QUT), and possibly other vectors. NOTE: due to insufficient information in the original vendor advisory, it is not clear whether there is an attacker role in other memory leaks that are specified in the advisory. cpe:/a:aquifer_cms:aquifer_cms CVE-2006-0122 2006-01-09T06:03:00.000-05:00 2011-03-07T21:29:22.097-05:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov VIM 20060124 vendor ack/fix: Aquifer CMS Index.asp Keyword Variable XSS (fwd) BID 16162 VUPEN ADV-2006-0074 Cross-site scripting (XSS) vulnerability in Public/Index.asp in Aquifer CMS allows remote attackers to inject arbitrary web script or HTML via the Keyword parameter. cpe:/a:adn_forum:adn_forum:1.0 cpe:/a:adn_forum:adn_forum:1.0b CVE-2006-0123 2006-01-09T06:03:00.000-05:00 2018-10-19T11:42:44.450-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/15/summary.html SECTRACK 1015445 BUGTRAQ 20060105 [eVuln] ADNForum Multiple Vulnerabilities BID 16157 VUPEN ADV-2006-0077 Multiple SQL injection vulnerabilities in ADN Forum 1.0b allow remote attackers to execute arbitrary SQL commands via the (1) fid parameter in index.php and (2) pagid parameter in verpag.php, and possibly other vectors. cpe:/a:adn_forum:adn_forum:1.0 cpe:/a:adn_forum:adn_forum:1.0b CVE-2006-0124 2006-01-09T06:03:00.000-05:00 2018-10-19T11:42:44.967-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/15/summary.html SECTRACK 1015445 BUGTRAQ 20060105 [eVuln] ADNForum Multiple Vulnerabilities BID 16157 VUPEN ADV-2006-0077 Cross-site scripting (XSS) vulnerability in crear.php in ADN Forum 1.0b allows remote attackers to inject arbitrary web script or HTML via the titulo parameter, which is used by the "Topic name" field. cpe:/a:appserv_open_project:appserv:2.4.5 CVE-2006-0125 2006-01-09T06:03:00.000-05:00 2011-03-07T21:29:22.330-05:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16166 VUPEN ADV-2006-0053 Unspecified vulnerability in appserv/main.php in AppServ 2.4.5 allows remote attackers to include arbitrary files via the appserv_root parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. There is not enough detail from these third party sources to know whether this is directory traversal, remote file include, or another issue. cpe:/a:rxvt-unicode:rxvt-unicode:6.2 CVE-2006-0126 2006-01-09T06:03:00.000-05:00 2011-03-07T21:29:22.437-05:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://dist.schmorp.de/rxvt-unicode/Changes VUPEN ADV-2006-0052 rxvt-unicode before 6.3, on certain platforms that use openpty and non-Unix pty devices such as Linux and most BSD platforms, does not maintain the intended permissions of tty devices, which allows local users to gain read and write access to the devices. cpe:/a:rockliffe:mailsite:6.1.22.0 CVE-2006-0127 2006-01-09T06:03:00.000-05:00 2011-03-07T21:29:22.547-05:00 4.0 NETWORK LOW SINGLE_INSTANCE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060104 Rockliffe Directory Transversal Vulnerability FULLDISC 20060105 Re: Rockliffe Directory Transversal Vulnerability VUPEN ADV-2006-0055 MISC http://zur.homelinux.com/Advisories/RockliffeMailsiteDirTransveral.txt Directory traversal vulnerability in the IMAP service of Rockliffe MailSite before 6.1.22.1 allows remote authenticated users to rename the folders of other users via a .. (dot dot) in the RENAME command. cpe:/a:rockliffe:mailsite:6.1.22.0 CVE-2006-0128 2006-01-09T06:03:00.000-05:00 2017-07-19T21:29:29.127-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov FULLDISC 20060104 Rockliffe Directory Transversal Vulnerability MISC http://zur.homelinux.com/Advisories/RockliffeMailsiteDirTransveral.txt XF rockliffe-imap-unspecified-bo(39991) Buffer overflow in the IMAP service of Rockliffe MailSite before 6.1.22.1 allows remote attackers to have an unknown impact via unknown attack vectors. cpe:/a:rockliffe:mailsite:7.0.3.1 CVE-2006-0129 2006-01-09T06:03:00.000-05:00 2011-03-07T21:29:22.720-05:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov FULLDISC 20060104 Rockliffe Mailsite User Enumeration Flaw VUPEN ADV-2006-0055 MISC http://zur.homelinux.com/Advisories/RockliffeMailsiteUserEnum.txt Mail Management Agent (MAILMA) (aka Mail Management Server) in Rockliffe MailSite 7.0.3.1 and earlier generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames via user requests to TCP port 106. cpe:/a:rockliffe:mailsite:7.0.3.1 CVE-2006-0130 2006-01-09T06:03:00.000-05:00 2008-09-05T16:58:26.420-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-01-11T09:10:00.000-05:00 FULLDISC 20060104 Rockliffe Mailsite User Enumeration Flaw MISC http://zur.homelinux.com/Advisories/RockliffeMailsiteUserEnum.txt Mail Management Agent (MAILMA) (aka Mail Management Server) in Rockliffe MailSite 7.0.3.1 and earlier allows remote attackers to attempt authentication with an unlimited number of user account names and passwords without denying connections, limiting the rate of connections, or locking out an account. cpe:/a:boastmachine:boastmachine:3.1 CVE-2006-0131 2006-01-09T06:03:00.000-05:00 2018-10-19T11:42:45.387-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://echo.or.id/adv/adv26-K-159-2006.txt BUGTRAQ 20060105 [ECHO_ADV_25$2006] Full path disclosure on boastMachine v3.1 boastMachine 3.1 allows remote attackers to obtain sensitive information via a direct request to (1) footer.php and (2) side_menu.php, which reveals the path in an error message. cpe:/a:webftp:webftp:1.2.6 CVE-2006-0132 2006-01-09T06:03:00.000-05:00 2018-10-19T11:42:45.543-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060104 SysCP WebFTP local file inclusion vulnerability BID 16175 VUPEN ADV-2006-0090 XF webftp-language-file-include(24018) Directory traversal vulnerability in webftp.php in SysCP WebFTP 1.2.6 and possibly earlier allows remote attackers to include and execute arbitrary local PHP scripts, and possibly read other types of files, via a .. (dot dot) and a trailing null in the webftp_language parameter. cpe:/o:ibm:aix:5.3_ml03 CVE-2006-0133 2006-01-09T06:03:00.000-05:00 2018-10-19T11:42:45.903-04:00 3.6 LOCAL LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov SECTRACK 1015429 BUGTRAQ 20060101 [xfocus-SD-060101]AIX getCommand&getShell two vulnerabilities BID 16102 BID 16103 Multiple directory traversal vulnerabilities in AIX 5.3 ML03 allow local users to determine the existence of files and read partial contents of certain files via a .. (dot dot) in the argument to (1) getCommand.new (aka getCommand) and (2) getShell, a different vulnerability than CVE-2005-4273. cpe:/a:thewebforum:thewebforum:1.2.1 CVE-2006-0134 2006-01-09T06:03:00.000-05:00 2018-10-19T11:42:46.183-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/17/exploit.html MISC http://evuln.com/vulns/17/summary.html SECTRACK 1015450 BUGTRAQ 20060106 [eVuln] TheWebForum Script Insertion and Authentication Bypass BID 16161 VUPEN ADV-2006-0093 XF thewebforum-register-xss(24007) Cross-site scripting (XSS) vulnerability in register.php in TheWebForum (twf) 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the www parameter. cpe:/a:thewebforum:thewebforum:1.2.1 CVE-2006-0135 2006-01-09T06:03:00.000-05:00 2018-10-19T11:42:46.763-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/17/exploit.html MISC http://evuln.com/vulns/17/summary.html SREASON 321 SECTRACK 1015450 BUGTRAQ 20060106 [eVuln] TheWebForum Script Insertion and Authentication Bypass BID 16161 VUPEN ADV-2006-0093 XF thewebforum-login-sql-injection(24027) SQL injection vulnerability in login.php in TheWebForum (twf) 1.2.1 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the username parameter (aka the u variable). cpe:/a:phanatic_softwares:chimera_web_portal:0.2 CVE-2006-0136 2006-01-09T06:03:00.000-05:00 2018-10-19T11:42:47.433-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/7/exploit.html MISC http://evuln.com/vulns/7/summary.html BUGTRAQ 20060101 [eVuln] Chimera Web Portal System Multiple Vulnerabilities BID 16113 VUPEN ADV-2006-0025 Multiple cross-site scripting (XSS) vulnerabilities in the guestbook module in modules.php in Phanatic Softwares Chimera Web Portal System 0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) comment_poster, (2) comment_poster_email, (3) comment_poster_homepage, and (4) comment_text parameters. cpe:/a:phanatic_softwares:chimera_web_portal:0.2 CVE-2006-0137 2006-01-09T06:03:00.000-05:00 2018-10-19T11:42:47.747-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/7/exploit.html MISC http://evuln.com/vulns/7/summary.html BUGTRAQ 20060101 [eVuln] Chimera Web Portal System Multiple Vulnerabilities BID 16113 VUPEN ADV-2006-0025 XF chimera-linkcategory-sql-injection(23963) SQL injection vulnerability in linkcategory.php in Phanatic Softwares Chimera Web Portal System 0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter. cpe:/a:amsn:amsn CVE-2006-0138 2006-01-09T06:03:00.000-05:00 2008-09-05T16:58:27.607-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov 2006-01-11T09:26:00.000-05:00 MISC http://www.securiteam.com/exploits/5JP090KHFQ.html aMSN (aka Alvaro's Messenger) allows remote attackers to cause a denial of service (client hang and termination of client's instant-messaging session) by repeatedly sending crafted data to the default file-transfer port (TCP 6891). cpe:/a:pd9_software:megabbs:2.0 cpe:/a:pd9_software:megabbs:2.1 CVE-2006-0139 2006-01-09T13:03:00.000-05:00 2017-07-19T21:29:29.410-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SECTRACK 1015452 MISC http://www.hamid.ir/security/megabbs.txt CONFIRM http://www.pd9soft.com/megabbs/forums/thread-view.asp?tid=4924 BID 16168 VUPEN ADV-2006-0095 XF megabbs-sendprivatemessage-disclosure(24050) The send-private-message functionality (send-private-message.asp) in PD9 Software MegaBBS 2.1 allows remote attackers to read private messages of other users via a modified replyid parameter. cpe:/a:navboard:navboard:16 cpe:/a:navboard:navboard:17:beta2 CVE-2006-0140 2006-01-09T14:07:00.000-05:00 2018-10-19T11:42:48.230-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/19/summary.html BUGTRAQ 20060107 [eVuln] NavBoard BBcode XSS Vulnerability BID 16165 VUPEN ADV-2006-0092 XF navboard-post-xss(24021) Cross-site scripting (XSS) vulnerability in post.php in NavBoard V16 Stable(2.6.0) and V17beta2 allows remote attackers to inject arbitrary web script or HTML via the (1) b, (2) textlarge, and (3) url bbcode tags. cpe:/a:eudora:internet_mail_server:3.2.6 cpe:/a:eudora:internet_mail_server:3.2.7 cpe:/a:eudora:internet_mail_server:3.2.8 CVE-2006-0141 2006-01-09T14:07:00.000-05:00 2017-07-19T21:29:29.567-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://www.eudora.co.nz/updates.html BID 16179 VUPEN ADV-2006-0099 XF eims-ntlm-auth-dos(24032) XF eims-corrupted-mail-dos(24033) Qualcomm Eudora Internet Mail Server (EIMS) before 3.2.8 allows remote attackers to cause a denial of service (crash) via (1) malformed NTLM authentication requests, or a malformed (2) Incoming Mail X or (3) Temporary Mail file. cpe:/a:andromeda_software:andromeda:1.9.3.4 CVE-2006-0142 2006-01-09T14:07:00.000-05:00 2017-07-19T21:29:29.613-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16183 VUPEN ADV-2006-0096 XF andromeda-script-xss(24031) Cross-site scripting (XSS) vulnerability in andromeda.php in Andromeda 1.9.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the s parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/o:microsoft:windows_2000 cpe:/o:microsoft:windows_2000::sp1 cpe:/o:microsoft:windows_2000::sp2 cpe:/o:microsoft:windows_2000::sp3 cpe:/o:microsoft:windows_2000::sp4 cpe:/o:microsoft:windows_2003_server:datacenter_64-bit:sp1 cpe:/o:microsoft:windows_2003_server:enterprise::64-bit cpe:/o:microsoft:windows_2003_server:enterprise:sp1 cpe:/o:microsoft:windows_2003_server:enterprise_64-bit cpe:/o:microsoft:windows_2003_server:enterprise_64-bit:sp1 cpe:/o:microsoft:windows_2003_server:r2::64-bit cpe:/o:microsoft:windows_2003_server:r2::datacenter_64-bit cpe:/o:microsoft:windows_2003_server:r2:sp1 cpe:/o:microsoft:windows_2003_server:standard::64-bit cpe:/o:microsoft:windows_2003_server:standard:sp1 cpe:/o:microsoft:windows_2003_server:standard_64-bit cpe:/o:microsoft:windows_2003_server:web cpe:/o:microsoft:windows_2003_server:web:sp1 cpe:/o:microsoft:windows_98::gold cpe:/o:microsoft:windows_98se cpe:/o:microsoft:windows_me cpe:/o:microsoft:windows_xp:::64-bit cpe:/o:microsoft:windows_xp:::home cpe:/o:microsoft:windows_xp:::media_center cpe:/o:microsoft:windows_xp::gold:professional cpe:/o:microsoft:windows_xp::sp1:home cpe:/o:microsoft:windows_xp::sp1:media_center cpe:/o:microsoft:windows_xp::sp2:home cpe:/o:microsoft:windows_xp::sp2:media_center cpe:/o:microsoft:windows_xp::sp2:tablet_pc CVE-2006-0143 2006-01-09T15:03:00.000-05:00 2019-04-30T10:27:13.913-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://blogs.technet.com/msrc/archive/2006/01/09/417198.aspx MISC http://lostmon.blogspot.com/2007/08/windows-extended-file-attributes-buffer.html SECTRACK 1015453 BUGTRAQ 20060107 Microsoft Windows GRE WMF Format Multiple Memory Overrun Vulnerabilities BUGTRAQ 20060109 [UPDATE]Microsoft Windows GRE WMF Format Multiple Unauthorized Memory Access Vulnerabilities BID 16167 VUPEN ADV-2006-0115 XF win-gre-wmf-dos(24044) Microsoft Windows Graphics Rendering Engine (GRE) allows remote attackers to corrupt memory and cause a denial of service (crash) via a WMF file containing (1) ExtCreateRegion or (2) ExtEscape function calls with arguments with inconsistent lengths. cpe:/a:apache2triad:apache2triad cpe:/a:php:pear:0.2.2 CVE-2006-0144 2006-01-09T18:03:00.000-05:00 2018-10-19T11:42:49.433-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://apache2triad.net/forums/viewtopic.php?p=14670 BUGTRAQ 20060109 New PEAR / Apache2Triad Exploit BID 16174 VUPEN ADV-2006-0148 XF gopear-proxy-redirection(24076) The proxy server feature in go-pear.php in PHP PEAR 0.2.2, as used in Apache2Triad, allows remote attackers to execute arbitrary PHP code by redirecting go-pear.php to a malicious proxy server that provides a modified version of Tar.php with a malicious extractModify function. cpe:/o:netbsd:netbsd:1.6 cpe:/o:netbsd:netbsd:1.6:beta cpe:/o:netbsd:netbsd:1.6.1 cpe:/o:netbsd:netbsd:1.6.2 cpe:/o:netbsd:netbsd:2.0 cpe:/o:netbsd:netbsd:2.0.1 cpe:/o:netbsd:netbsd:2.0.2 cpe:/o:netbsd:netbsd:2.0.3 cpe:/o:netbsd:netbsd:2.1 CVE-2006-0145 2006-01-09T18:03:00.000-05:00 2018-10-19T11:42:49.873-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS NETBSD NetBSD-SA2006-001 SREASON 405 BUGTRAQ 20060202 [SLAB] NetBSD / OpenBSD kernfs_xread patch evasion BID 16173 MISC http://www.securitylab.net/research/2006/02/advisory_netbsd_openbsd_kernfs.html XF netbsd-kernfs-memory-disclosure(24035) The kernfs_xread function in kernfs in NetBSD 1.6 through 2.1, and OpenBSD 3.8, does not properly validate file offsets against negative 32-bit values that occur as a result of truncation, which allows local users to read arbitrary kernel memory and gain privileges via the lseek system call. cpe:/a:john_lim:adodb:4.66 cpe:/a:john_lim:adodb:4.68 cpe:/a:mantis:mantis:0.19.4 cpe:/a:mantis:mantis:1.0.0_rc4 cpe:/a:mediabeez:mediabeez cpe:/a:moodle:moodle:1.5.3 cpe:/a:postnuke_software_foundation:postnuke:0.761 cpe:/a:the_cacti_group:cacti:0.8.6g CVE-2006-0146 2006-01-09T18:03:00.000-05:00 2018-10-19T11:42:50.527-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html SREASON 713 DEBIAN DSA-1029 DEBIAN DSA-1030 DEBIAN DSA-1031 GENTOO GLSA-200604-07 CONFIRM http://www.maxdev.com/Article550.phtml BUGTRAQ 20060202 Bug for libs in php link directory 2.0 BUGTRAQ 20060409 PhpOpenChat 3.0.x ADODB Server.php "sql" SQL injection BUGTRAQ 20070418 MediaBeez Sql query Execution .. Wear isn't ?? :) BID 16187 VUPEN ADV-2006-0101 VUPEN ADV-2006-0102 VUPEN ADV-2006-0103 VUPEN ADV-2006-0104 VUPEN ADV-2006-0105 VUPEN ADV-2006-0370 VUPEN ADV-2006-0447 VUPEN ADV-2006-1304 VUPEN ADV-2006-1305 VUPEN ADV-2006-1419 CONFIRM http://www.xaraya.com/index.php/news/569 XF adodb-server-command-execution(24051) The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter. cpe:/a:john_lim:adodb:4.66 cpe:/a:john_lim:adodb:4.68 cpe:/a:mantis:mantis:0.19.4 cpe:/a:mantis:mantis:1.0.0_rc4 cpe:/a:moodle:moodle:1.5.3 cpe:/a:postnuke_software_foundation:postnuke:0.761 cpe:/a:the_cacti_group:cacti:0.8.6g CVE-2006-0147 2006-01-09T18:03:00.000-05:00 2018-10-19T11:42:54.670-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html MISC http://retrogod.altervista.org/simplog_092_incl_xpl.html DEBIAN DSA-1029 DEBIAN DSA-1030 DEBIAN DSA-1031 GENTOO GLSA-200604-07 BUGTRAQ 20060409 PhpOpenChat 3.0.x ADODB Server.php "sql" SQL injection BUGTRAQ 20060412 Simplog <=0.9.2 multiple vulnerabilities VUPEN ADV-2006-0101 VUPEN ADV-2006-0102 VUPEN ADV-2006-0103 VUPEN ADV-2006-0104 VUPEN ADV-2006-1305 VUPEN ADV-2006-1332 XF adodb-tmssql-command-execution(24052) EXPLOIT-DB 1663 Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo. cpe:/a:netsarang:xlpd:2.1 CVE-2006-0148 2006-01-09T18:03:00.000-05:00 2017-07-19T21:29:30.080-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SECTRACK 1015444 MISC http://www.ipomonis.com/advisories/xlpd.txt BID 16164 XF xlpd-connection-dos(24041) NetSarang Xlpd 2.1 allows remote attackers to cause a denial of service (crash) via a large number of connections from the same IP address. cpe:/a:simpbook:simpbook:1.0 CVE-2006-0149 2006-01-09T18:03:00.000-05:00 2008-09-05T16:58:29.403-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov 2006-01-10T08:42:00.000-05:00 FULLDISC 20060106 SimpBook "message" Remote Cross-Site Scripting Vulnerability SECTRACK 1015451 Cross-site scripting (XSS) vulnerability in SimpBook 1.0, with html_enable on (the default), allows remote attackers to inject arbitrary web script or HTML via the message field. cpe:/a:dave_carrigan:auth_ldap:1.2.1 cpe:/a:dave_carrigan:auth_ldap:1.2.2 cpe:/a:dave_carrigan:auth_ldap:1.2.3 cpe:/a:dave_carrigan:auth_ldap:1.2.4 cpe:/a:dave_carrigan:auth_ldap:1.3.0 cpe:/a:dave_carrigan:auth_ldap:1.3.1 cpe:/a:dave_carrigan:auth_ldap:1.3.2 cpe:/a:dave_carrigan:auth_ldap:1.3.3 cpe:/a:dave_carrigan:auth_ldap:1.3.4 cpe:/a:dave_carrigan:auth_ldap:1.4.0 cpe:/a:dave_carrigan:auth_ldap:1.4.2 cpe:/a:dave_carrigan:auth_ldap:1.4.3 cpe:/a:dave_carrigan:auth_ldap:1.6.0 CVE-2006-0150 2006-01-09T18:03:00.000-05:00 2018-10-19T11:42:57.107-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015456 DEBIAN DSA-952 MISC http://www.digitalarmaments.com/2006090173928420.html REDHAT RHSA-2006:0179 CONFIRM http://www.rudedog.org/auth_ldap/Changes.html BUGTRAQ 20060109 Digital Armaments Security Advisory 01.09.2006: Apache auth_ldap module Multiple Format Strings Vulnerability BID 16177 VUPEN ADV-2006-0117 MANDRIVA MDKSA-2006:017 XF apache-authldap-format-string(24030) Multiple format string vulnerabilities in the auth_ldap_log_reason function in Apache auth_ldap 1.6.0 and earlier allows remote attackers to execute arbitrary code via various vectors, including the username. cpe:/a:todd_miller:sudo:1.5.6 cpe:/a:todd_miller:sudo:1.5.7 cpe:/a:todd_miller:sudo:1.5.8 cpe:/a:todd_miller:sudo:1.5.9 cpe:/a:todd_miller:sudo:1.6 cpe:/a:todd_miller:sudo:1.6.1 cpe:/a:todd_miller:sudo:1.6.2 cpe:/a:todd_miller:sudo:1.6.3 cpe:/a:todd_miller:sudo:1.6.3_p1 cpe:/a:todd_miller:sudo:1.6.3_p2 cpe:/a:todd_miller:sudo:1.6.3_p3 cpe:/a:todd_miller:sudo:1.6.3_p4 cpe:/a:todd_miller:sudo:1.6.3_p5 cpe:/a:todd_miller:sudo:1.6.3_p6 cpe:/a:todd_miller:sudo:1.6.3_p7 cpe:/a:todd_miller:sudo:1.6.4 cpe:/a:todd_miller:sudo:1.6.4_p1 cpe:/a:todd_miller:sudo:1.6.4_p2 cpe:/a:todd_miller:sudo:1.6.5 cpe:/a:todd_miller:sudo:1.6.5_p1 cpe:/a:todd_miller:sudo:1.6.5_p2 cpe:/a:todd_miller:sudo:1.6.6 cpe:/a:todd_miller:sudo:1.6.7 cpe:/a:todd_miller:sudo:1.6.7_p5 cpe:/a:todd_miller:sudo:1.6.8 cpe:/a:todd_miller:sudo:1.6.8_p1 cpe:/a:todd_miller:sudo:1.6.8_p2 cpe:/a:todd_miller:sudo:1.6.8_p5 cpe:/a:todd_miller:sudo:1.6.8_p7 cpe:/a:todd_miller:sudo:1.6.8_p8 cpe:/a:todd_miller:sudo:1.6.8_p9 cpe:/a:todd_miller:sudo:1.6.8_p12 cpe:/o:ubuntu:ubuntu_linux:4.1::ia64 cpe:/o:ubuntu:ubuntu_linux:4.1::ppc cpe:/o:ubuntu:ubuntu_linux:5.04::amd64 cpe:/o:ubuntu:ubuntu_linux:5.04::i386 cpe:/o:ubuntu:ubuntu_linux:5.04::powerpc cpe:/o:ubuntu:ubuntu_linux:5.10::amd64 cpe:/o:ubuntu:ubuntu_linux:5.10::i386 cpe:/o:ubuntu:ubuntu_linux:5.10::powerpc CVE-2006-0151 2006-01-09T18:03:00.000-05:00 2018-10-03T17:34:57.397-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SLACKWARE SSA:2006-045-08 DEBIAN DSA-946 MANDRIVA MDKSA-2006:159 SUSE SUSE-SR:2006:002 BID 16184 TRUSTIX 2006-0010 UBUNTU USN-235-2 sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158. cpe:/a:phpchamber:phpchamber:1.2 CVE-2006-0152 2006-01-10T06:03:00.000-05:00 2017-07-19T21:29:30.283-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16180 VUPEN ADV-2006-0094 XF phpchamber-searchresult-xss(24029) Cross-site scripting (XSS) in search_result.php in phpChamber 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the needle parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:427bb:fourtwosevenbb:2.2 cpe:/a:427bb:fourtwosevenbb:2.2.1 CVE-2006-0153 2006-01-10T06:03:00.000-05:00 2018-10-19T11:42:59.137-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/18/summary.html BUGTRAQ 20060107 [eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS) BID 16178 VUPEN ADV-2006-0091 XF 427bb-scripts-security-bypass(24038) 427BB 2.2 and 2.2.1 verifies authentication credentials based on the username, authenticated, and usertype cookies, which allows remote attackers to bypass authentication by using a valid username and usertype and setting the authenticated cookie. cpe:/a:427bb:fourtwosevenbb:2.2 cpe:/a:427bb:fourtwosevenbb:2.2.1 CVE-2006-0154 2006-01-10T06:03:00.000-05:00 2018-10-19T11:42:59.543-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/18/summary.html BUGTRAQ 20060107 [eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS) BID 16169 VUPEN ADV-2006-0091 XF 427bb-showthread-sql-injection(24039) SQL injection vulnerability in showthread.php in 427BB 2.2 and 2.2.1 allows remote attackers to execute arbitrary SQL commands via the ForumID parameter. cpe:/a:427bb:fourtwosevenbb:2.2 cpe:/a:427bb:fourtwosevenbb:2.2.1 CVE-2006-0155 2006-01-10T06:03:00.000-05:00 2018-10-19T11:42:59.967-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/18/summary.html BUGTRAQ 20060107 [eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS) VUPEN ADV-2006-0091 XF 427bb-posts-xss(24040) Cross-site scripting (XSS) vulnerability in posts.php in 427BB 2.2 and 2.2.1 allows remote attackers to inject arbitrary Javascript via a new message with a url bbcode tag containing a javascript URI. cpe:/a:foxrum:foxrum:4.0.4f CVE-2006-0156 2006-01-10T06:03:00.000-05:00 2018-10-19T11:43:00.420-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/20 SREASON 325 BUGTRAQ 20060109 [eVuln] Foxrum BBCode XSS Vulnerabilty BID 16172 VUPEN ADV-2006-0121 XF foxrum-bbcode-xss(24043) Cross-site scripting (XSS) vulnerability in Foxrum 4.0.4f allows remote attackers to inject arbitrary Javascript via the javascript URI in bbcode url tags in (1) addpost1.php and (2) addtopic1.php. cpe:/a:reamday_enterprises:magic_news_plus:1.0.3 CVE-2006-0157 2006-01-10T06:03:00.000-05:00 2008-09-05T16:58:30.717-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov 2006-01-10T08:18:00.000-05:00 MISC http://downloads.securityfocus.com/vulnerabilities/exploits/MagicNewsPlus-pw-change.pl BID 16182 settings.php in Reamday Enterprises Magic News Plus 1.0.3 allows remote attackers to change the administrator password via a change action that specifies identical values for the passwd and admin_password parameters, then declares the new password string in the new_passwd and confirm_passwd parameters. cpe:/a:cyberdoc:sitesuite_cms CVE-2006-0158 2006-01-10T06:03:00.000-05:00 2011-03-07T21:29:27.860-05:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS VUPEN ADV-2006-0038 SQL injection vulnerability in index.php in CyberDoc SiteSuite CMS allows remote attackers to execute arbitrary SQL commands via the page parameter. cpe:/a:javier_suarez_sanz:foro_domus:2.10 CVE-2006-0159 2006-01-10T06:03:00.000-05:00 2017-07-19T21:29:30.567-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS VUPEN ADV-2006-0073 XF domus-escribir-sql-injection(24017) SQL injection vulnerability in escribir.php in Foro Domus 2.10 allows remote attackers to execute arbitrary SQL commands via the email parameter. NOTE: the provenance of this information is unknown, although it may be based on post-disclosure analysis of CVE-2006-0110; the details are obtained solely from third party information. cpe:/a:venom_board:venom_board:1.22 CVE-2006-0160 2006-01-10T06:03:00.000-05:00 2017-07-19T21:29:30.627-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/21/summary.html BUGTRAQ 20060109 [eVuln] Venom Board SQL Injection Vulnerability SREASON 326 BID 16176 VUPEN ADV-2006-0122 XF venomboard-addpost-sql-injection(24046) SQL injection vulnerability in add_post.php3 in Venom Board 1.22 allows remote attackers to execute arbitrary SQL commands via the (1) parent, (2) root, and (3) topic_id parameters to post.php3. cpe:/o:sun:solaris:9.0::sparc cpe:/o:sun:sunos:5.8 CVE-2006-0161 2006-01-10T14:03:00.000-05:00 2018-10-30T12:25:37.090-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015455 SUNALERT 101933 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm VUPEN ADV-2006-0113 Unspecified vulnerability in uucp in Sun Solaris 8 and 9 has unknown impact and attack vectors. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this is related to CVE-2004-0780. cpe:/a:clam_anti-virus:clamav:. cpe:/a:clam_anti-virus:clamav:0.51 cpe:/a:clam_anti-virus:clamav:0.52 cpe:/a:clam_anti-virus:clamav:0.53 cpe:/a:clam_anti-virus:clamav:0.54 cpe:/a:clam_anti-virus:clamav:0.60 cpe:/a:clam_anti-virus:clamav:0.65 cpe:/a:clam_anti-virus:clamav:0.67 cpe:/a:clam_anti-virus:clamav:0.68 cpe:/a:clam_anti-virus:clamav:0.68.1 cpe:/a:clam_anti-virus:clamav:0.70 cpe:/a:clam_anti-virus:clamav:0.75.1 cpe:/a:clam_anti-virus:clamav:0.80 cpe:/a:clam_anti-virus:clamav:0.80_rc1 cpe:/a:clam_anti-virus:clamav:0.80_rc2 cpe:/a:clam_anti-virus:clamav:0.80_rc3 cpe:/a:clam_anti-virus:clamav:0.80_rc4 cpe:/a:clam_anti-virus:clamav:0.81 cpe:/a:clam_anti-virus:clamav:0.82 cpe:/a:clam_anti-virus:clamav:0.83 cpe:/a:clam_anti-virus:clamav:0.84 cpe:/a:clam_anti-virus:clamav:0.84_rc1 cpe:/a:clam_anti-virus:clamav:0.84_rc2 cpe:/a:clam_anti-virus:clamav:0.85 cpe:/a:clam_anti-virus:clamav:0.85.1 cpe:/a:clam_anti-virus:clamav:0.86 cpe:/a:clam_anti-virus:clamav:0.86.1 cpe:/a:clam_anti-virus:clamav:0.86.2 cpe:/a:clam_anti-virus:clamav:0.87 cpe:/a:clam_anti-virus:clamav:0.87.1 CVE-2006-0162 2006-01-10T14:03:00.000-05:00 2017-07-19T21:29:30.690-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS FULLDISC 20060112 ZDI-06-001: Clam AntiVirus UPX Unpacking Code Execution Vulnerability SREASON 342 SECTRACK 1015457 CONFIRM http://www.clamav.net/doc/0.88/ChangeLog DEBIAN DSA-947 GENTOO GLSA-200601-07 CERT-VN VU#385908 MANDRIVA MDKSA-2006:016 BID 16191 TRUSTIX 2006-0002 VUPEN ADV-2006-0116 MISC http://www.zerodayinitiative.com/advisories/ZDI-06-001.html XF clamav-libclamav-upx-bo(24047) Heap-based buffer overflow in libclamav/upx.c in Clam Antivirus (ClamAV) before 0.88 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted UPX files. cpe:/a:francisco_burzi:php-nuke_ev:7.7_r1 CVE-2006-0163 2006-01-11T16:03:00.000-05:00 2017-07-19T21:29:30.737-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://lostmon.blogspot.com/2006/01/phpnuke-ev-77-search-module-query.html BID 16186 VUPEN ADV-2006-0120 XF phpnukeev-search-sql-injection(44978) SQL injection vulnerability in the search module (modules/Search/index.php) of PHPNuke EV 7.7 -R1 allows remote attackers to execute arbitrary SQL commands via the query parameter, which is used by the search field. NOTE: This is a different vulnerability than CVE-2005-3792. cpe:/a:woah-projekt:phgstats:0.1 cpe:/a:woah-projekt:phgstats:0.2 cpe:/a:woah-projekt:phgstats:0.3 cpe:/a:woah-projekt:phgstats:0.3.1 cpe:/a:woah-projekt:phgstats:0.4 cpe:/a:woah-projekt:phgstats:0.4.1 cpe:/a:woah-projekt:phgstats:0.4.2 cpe:/a:woah-projekt:phgstats:0.5 CVE-2006-0164 2006-01-11T16:03:00.000-05:00 2017-07-19T21:29:30.800-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://sourceforge.net/project/shownotes.php?release_id=384232 BID 17469 VUPEN ADV-2006-0123 XF phgstats-php-file-include(24062) phgstats.inc.php in phgstats before 0.5.1, if register_globals is enabled, allows remote attackers to include arbitrary files and execute arbitrary PHP code by modifying the PHGDIR variable. cpe:/a:plain_black:webgui:5.5.8 cpe:/a:plain_black:webgui:6.2.10_gamma cpe:/a:plain_black:webgui:6.2.11_gamma cpe:/a:plain_black:webgui:6.3.0_beta cpe:/a:plain_black:webgui:6.4.0_beta cpe:/a:plain_black:webgui:6.5.0_beta cpe:/a:plain_black:webgui:6.5.1_beta cpe:/a:plain_black:webgui:6.5.2_beta cpe:/a:plain_black:webgui:6.5.3_beta cpe:/a:plain_black:webgui:6.5.4_gamma cpe:/a:plain_black:webgui:6.5.5_gamma cpe:/a:plain_black:webgui:6.5.6_gamma cpe:/a:plain_black:webgui:6.6.0_beta cpe:/a:plain_black:webgui:6.6.1_beta cpe:/a:plain_black:webgui:6.6.2_gamma cpe:/a:plain_black:webgui:6.6.3_gamma cpe:/a:plain_black:webgui:6.6.4_gamma cpe:/a:plain_black:webgui:6.6.5 cpe:/a:plain_black:webgui:6.7.0_beta cpe:/a:plain_black:webgui:6.7.1_beta cpe:/a:plain_black:webgui:6.7.2_beta cpe:/a:plain_black:webgui:6.7.3_gamma cpe:/a:plain_black:webgui:6.7.4_gamma cpe:/a:plain_black:webgui:6.7.5_gamma cpe:/a:plain_black:webgui:6.7.6_gamma cpe:/a:plain_black:webgui:6.7.7_gamma cpe:/a:plain_black:webgui:6.7.8_gamma cpe:/a:plain_black:webgui:6.8.1_beta cpe:/a:plain_black:webgui:6.8.2_beta cpe:/a:plain_black:webgui:6.8.3_gamma CVE-2006-0165 2006-01-11T16:03:00.000-05:00 2017-07-19T21:29:30.847-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://sourceforge.net/project/shownotes.php?release_id=384153&group_id=51417 MISC http://sourceforge.net/tracker/index.php?func=detail&aid=1395371&group_id=51417&atid=463213 VUPEN ADV-2006-0126 XF webgui-forms-xss(24053) Cross-site scripting (XSS) vulnerability in the DataForm Entries functionality in Plain Black WebGUI before 6.8.4 (gamma) allows remote attackers to inject arbitrary Javascript via the (1) url and (2) name field of the default email form. cpe:/a:symantec:norton_system_works:2005 cpe:/a:symantec:norton_system_works:2005_premier cpe:/a:symantec:norton_system_works:2006 cpe:/a:symantec:norton_system_works:2006_premier CVE-2006-0166 2006-01-11T16:03:00.000-05:00 2017-07-19T21:29:30.893-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov CONFIRM http://securityresponse.symantec.com/avcenter/security/Content/2006.01.10.html SECTRACK 1015462 VUPEN ADV-2006-0143 XF systemworks-nprotect-hidden(24061) Symantec Norton SystemWorks and SystemWorks Premier 2005 and 2006 stores temporary copies of files in the Norton Protected Recycle Bin NProtect directory, which is hidden from the FindFirst and FindNext Windows APIs and allows remote attackers to hide arbitrary files from virus scanners and other products. cpe:/a:myphpim:myphpim:01.05 CVE-2006-0167 2006-01-11T16:03:00.000-05:00 2018-10-19T11:43:00.937-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/22/summary.html BUGTRAQ 20060111 [eVuln] MyPhPim Multiple SQL Injection and XSS Vulnerabilities BID 16210 VUPEN ADV-2006-0147 XF myphpim-calendar-sql-injection(24066) XF myphpim-login-sql-injection(24075) SQL injection vulnerability in MyPhPim 01.05 allows remote attackers to execute arbitrary SQL commands via the (1) cal_id parameter in calendar.php3 and the (2) password field on the login page. cpe:/a:myphpim:myphpim:01.05 CVE-2006-0168 2006-01-11T16:03:00.000-05:00 2018-10-19T11:43:01.497-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/22/summary.html BUGTRAQ 20060111 [eVuln] MyPhPim Multiple SQL Injection and XSS Vulnerabilities BID 16210 VUPEN ADV-2006-0147 XF myphpim-todo-xss(24071) Cross-site scripting (XSS) vulnerability in MyPhPim 01.05 allows remote attackers to inject arbitrary web script or HTML via the description field on the "Create New todo" page. cpe:/a:myphpim:myphpim:01.05 CVE-2006-0169 2006-01-11T16:03:00.000-05:00 2018-10-19T11:43:01.873-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/23/summary.html BUGTRAQ 20060111 [eVuln] MyPhPim Arbitrary File Upload BID 16208 VUPEN ADV-2006-0147 XF myphpim-addresses-file-upload(24070) addresses.php3 in MyPhPim 01.05 does not restrict uploaded files, which allows remote attackers to execute arbitrary PHP code via the pdbfile variable, then directly accessing those files from the uploads directory. CVE-2006-0170 2006-01-11T16:03:00.000-05:00 2008-09-10T15:56:39.307-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0035. Reason: This candidate is a duplicate of CVE-2006-0035. Notes: All CVE users should reference CVE-2006-0035 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. cpe:/a:orjinweb:orjinweb_e-commerce CVE-2006-0171 2006-01-11T16:03:00.000-05:00 2018-10-19T11:43:02.233-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060106 Orjinweb E-commerce BID 16199 XF orjinweb-url-file-include(24097) PHP remote file include vulnerability in index.php in OrjinWeb E-commerce allows remote attackers to execute arbitrary code via a URL in the page parameter. NOTE: it is not clear, but OrjinWeb might be an application service, in which case it should not be included in CVE. cpe:/a:hummingbird:enterprise_collaboration:5.2 cpe:/a:hummingbird:enterprise_collaboration:5.21 CVE-2006-0172 2006-01-11T16:03:00.000-05:00 2018-10-19T11:43:02.497-04:00 3.5 NETWORK MEDIUM SINGLE_INSTANCE NONE PARTIAL NONE http://nvd.nist.gov MISC http://www.securenetwork.it/advisories/sn-2006-01.html BUGTRAQ 20060110 Multiple Vulnerabilities in Hummingbird Collaboration BID 16195 VUPEN ADV-2006-0145 XF hummingbird-enterprise-xss(24067) Cross-site scripting (XSS) vulnerability in the file manager utility in Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to inject arbitrary web script or HTML in an uploaded page, which is published without a check for hostile scripting. cpe:/a:hummingbird:enterprise_collaboration:5.2 cpe:/a:hummingbird:enterprise_collaboration:5.21 CVE-2006-0173 2006-01-11T16:03:00.000-05:00 2018-10-19T11:43:02.887-04:00 4.0 NETWORK LOW SINGLE_INSTANCE NONE PARTIAL NONE http://nvd.nist.gov MISC http://www.securenetwork.it/advisories/sn-2006-01.html BUGTRAQ 20060110 Multiple Vulnerabilities in Hummingbird Collaboration BID 16195 VUPEN ADV-2006-0145 XF hummingbird-enterprise-file-download(24068) Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to misrepresent the type and name of a file via modified doc_ext and id parameters, which might trick a user into downloading dangerous or unexpected content. cpe:/a:hummingbird:collaboration:5.2 cpe:/a:hummingbird:collaboration:5.21 cpe:/a:hummingbird:enterprise_collaboration:5.2 cpe:/a:hummingbird:enterprise_collaboration:5.21 CVE-2006-0174 2006-01-11T16:03:00.000-05:00 2018-10-19T11:43:03.247-04:00 4.0 NETWORK LOW SINGLE_INSTANCE PARTIAL NONE NONE http://nvd.nist.gov SREASON 328 MISC http://www.securenetwork.it/advisories/sn-2006-01.html BUGTRAQ 20060110 Multiple Vulnerabilities in Hummingbird Collaboration BID 16195 VUPEN ADV-2006-0145 XF hummingbird-enterprise-information-disclosure(24069) Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to obtain sensitive information (intranet IP addresses and enumerations of valid parameter values) via a direct request to hc, which reveals the information in an error message or a cookie. cpe:/a:webwiz:web_wiz_forums:6.34 CVE-2006-0175 2006-01-11T16:03:00.000-05:00 2018-10-19T11:43:03.700-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060109 Advisory:XSS vulnerability on WebWiz Forums <= 6.34 (search_form.asp) BUGTRAQ 20060111 Advisory:XSS vulnerability on WebWiz Forums <= 6.34(search_form.asp) BID 16196 XF webwizforums-searchform-xss(24048) Cross-site scripting (XSS) vulnerability in search_form.asp in Web Wiz Forums 6.34 allows remote attackers to inject arbitrary web script or HTML via the search parameter. cpe:/a:xmame:xmame:0.102 CVE-2006-0176 2006-01-11T16:03:00.000-05:00 2018-10-19T11:43:04.060-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS FULLDISC 20060110 mysec.org Security Advisory : Xmame buffer overflow, with a possibility of privilege escalation. BUGTRAQ 20060110 mysec.org Security Advisory : Xmame buffer overflow, with a possibility of privilege escalation BID 16203 CONFIRM http://x.mame.net/changes-unix.html XF xmame-multiple-parameters-bo(24102) Buffer overflow in certain functions in src/fileio.c and src/unix/fileio.c in xmame before 11 January 2006 may allow local users to gain privileges via a long (1) -lang, (2) -ctrlr, (3) -pb, or (4) -rec argument on many operating systems, and via a long (5) -jdev argument on Ubuntu Linux. cpe:/o:cray:unicos:9.0.2.2 CVE-2006-0177 2006-01-11T16:03:00.000-05:00 2017-07-19T21:29:31.470-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS FULLDISC 20060110 SUID root overflows in UNICOS and partial shellcode BID 16205 XF unicos-command-line-bo(24276) Multiple buffer overflows in Cray UNICOS 9.0.2.2 might allow local users to gain privileges by (1) invoking /usr/bin/script with a long command line argument or (2) setting the -c option of /etc/nu to the name of a file containing a long line. cpe:/o:cray:unicos:9.0.2.2 CVE-2006-0178 2006-01-11T16:03:00.000-05:00 2017-07-19T21:29:31.533-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov FULLDISC 20060110 SUID root overflows in UNICOS and partial shellcode BID 16205 XF unicos-ftp-format-string(24277) Format string vulnerability in /bin/ftp in UNICOS 9.0.2.2 allows local users to have an unknown impact via format string specifiers in the quote command. NOTE: because the program is not setuid and not normally called from remote programs, there may not be a typical attack vector for the issue that crosses privilege boundaries. Therefore this may not be a vulnerability. cpe:/h:cisco:ip_phone_7940 CVE-2006-0179 2006-01-11T16:03:00.000-05:00 2017-10-18T21:29:02.923-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://downloads.securityfocus.com/vulnerabilities/exploits/cisco_ip7940_dos.pl SECTRACK 1015488 CISCO 20060113 Response to Cisco IP Phone 7940 DoS Exploit posted on milw0rm.com BID 16200 VUPEN ADV-2006-0202 XF cisco-ipphone-synflood-dos(24117) EXPLOIT-DB 1411 The Cisco IP Phone 7940 allows remote attackers to cause a denial of service (reboot) via a large amount of TCP SYN packets (syn flood) to arbitrary ports, as demonstrated to port 80. cpe:/a:calogic:calogic_calendars:1.2.2 CVE-2006-0180 2006-01-12T01:02:00.000-05:00 2018-10-19T11:43:04.387-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/24/summary.html BUGTRAQ 20060116 [eVuln] CaLogic Calendars Multiple XSS Vulnerabilities BID 16206 VUPEN ADV-2006-0149 XF calogic-newevent-xss(24077) Cross-site scripting (XSS) vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the Title field on the "Adding New Event" page, and possibly other vectors, involving iframe tags. cpe:/h:cisco:cs-mars:4.1 cpe:/h:cisco:cs-mars:4.1.2 CVE-2006-0181 2006-01-12T01:02:00.000-05:00 2017-07-19T21:29:31.707-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS BUGTRAQ 20060112 Cisco, haven't we learned anything? (technician reset) SREASON 335 SECTRACK 1015471 CISCO 20060111 Default Administrative Password in Cisco Security Monitoring, Analysis and Response System (CS-MARS) BID 16211 VUPEN ADV-2006-0154 XF cisco-csmars-default-password(24065) Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.1.3 has an undocumented administrative account with a default password, which allows local users to gain privileges via the expert command. cpe:/a:acal:calendar_project:2.2.5 CVE-2006-0182 2006-01-12T01:02:00.000-05:00 2018-10-19T11:43:04.797-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/25/summary.html SREASON 343 BUGTRAQ 20060112 [eVuln] ACal Authentication Bypass & PHP Code Insertion VUPEN ADV-2006-0152 XF acal-login-auth-bypass(24104) login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside". cpe:/a:acal:calendar_project:2.2.5 CVE-2006-0183 2006-01-12T01:02:00.000-05:00 2018-10-19T11:43:05.187-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/25/summary.html SREASON 343 BUGTRAQ 20060112 [eVuln] ACal Authentication Bypass & PHP Code Insertion VUPEN ADV-2006-0152 XF acal-header-footer-code-execute(24107) Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via (1) the edit=header value, which modifies header.php, or (2) the edit=footer value, which modifies footer.php. NOTE: this issue might be resultant from the poor authentication as identified by CVE-2006-0182. Since the design of the product allows the administrator to edit the code, perhaps this issue should not be included in CVE, except as a consequence of CVE-2006-0182. cpe:/a:mainenet_enterprises:asptopsites CVE-2006-0184 2006-01-12T01:02:00.000-05:00 2017-07-19T21:29:31.863-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060110 AspTopSites SQL injection MISC http://www.exploitlabs.com/files/advisories/EXPL-A-2006-001-asptopsites.txt VUPEN ADV-2006-0146 XF asptopsites-goto-sql-injection(24072) Multiple SQL injection vulnerabilities in AspTopSites allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to goto.asp or (2) password parameter to includeloginuser.asp. cpe:/a:php-nuke:news_module cpe:/a:php-nuke:pool_module CVE-2006-0185 2006-01-12T01:02:00.000-05:00 2011-03-07T21:29:32.347-05:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060107 Php-Nuke Pool and News Module IMG Tag Cross Site BID 16192 VUPEN ADV-2006-0125 Multiple cross-site scripting vulnerabilities in the (1) Pool or (2) News Modules in Php-Nuke allow remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag. CVE-2006-0186 2006-01-12T01:02:00.000-05:00 2008-09-10T15:56:42.383-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-4500. Reason: This candidate is a duplicate of CVE-2005-4500. Notes: All CVE users should reference CVE-2005-4500 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. cpe:/a:microsoft:visual_studio_.net:2005 CVE-2006-0187 2006-01-12T01:02:00.000-05:00 2018-10-19T11:43:05.560-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BUGTRAQ 20060113 Visual Studio Remote Code Execution BID 16225 VUPEN ADV-2006-0151 XF visualstudio-usercontrol-code-execution(24116) By design, Microsoft Visual Studio 2005 automatically executes code in the Load event of a user-defined control (UserControl1_Load function), which allows user-assisted attackers to execute arbitrary code by tricking the user into opening a malicious Visual Studio project file. cpe:/a:squirrelmail:squirrelmail:1.4 cpe:/a:squirrelmail:squirrelmail:1.4.1 cpe:/a:squirrelmail:squirrelmail:1.4.2 cpe:/a:squirrelmail:squirrelmail:1.4.3 cpe:/a:squirrelmail:squirrelmail:1.4.3_r3 cpe:/a:squirrelmail:squirrelmail:1.4.3_rc1 cpe:/a:squirrelmail:squirrelmail:1.4.3a cpe:/a:squirrelmail:squirrelmail:1.4.4 cpe:/a:squirrelmail:squirrelmail:1.4.4_rc1 cpe:/a:squirrelmail:squirrelmail:1.4.5 cpe:/a:squirrelmail:squirrelmail:1.4.6_rc1 cpe:/a:squirrelmail:squirrelmail:1.4_rc1 CVE-2006-0188 2006-02-23T19:02:00.000-05:00 2017-10-10T21:30:35.607-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SGI 20060501-01-U SECTRACK 1015662 DEBIAN DSA-988 GENTOO GLSA-200603-09 MANDRIVA MDKSA-2006:049 SUSE SUSE-SR:2006:005 FEDORA FEDORA-2006-133 REDHAT RHSA-2006:0283 BID 16756 CONFIRM http://www.squirrelmail.org/security/issue/2006-02-01 VUPEN ADV-2006-0689 XF squirrelmail-webmail-xss(24847) webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the right_frame parameter. NOTE: this has been called a cross-site scripting (XSS) issue, but it is different than what is normally identified as XSS. cpe:/a:estara:softphone:3.0.1.14 cpe:/a:estara:softphone:3.0.1.46 CVE-2006-0189 2006-01-13T06:03:00.000-05:00 2018-10-19T11:43:05.843-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015481 BUGTRAQ 20060111 eStara Softphone SIP stack Buffer Overflow Vulnerability BID 16213 VUPEN ADV-2006-0167 XF estara-sip-sdp-bo(24090) Buffer overflow in eStara Softphone 3.0.1.14 through 3.0.1.46 allows remote attackers to execute arbitrary code via a long attribute (aka "a") field in the SDP data of a SIP packet on UDP port 5060. cpe:/o:sun:solaris:9.0::sparc cpe:/o:sun:solaris:10.0::sparc CVE-2006-0190 2006-01-13T06:03:00.000-05:00 2017-10-10T21:30:35.687-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015478 SUNALERT 102066 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm BID 16224 VUPEN ADV-2006-0165 XF solaris-unspecified-root-access(24084) Unspecified vulnerability in Sun Solaris 9 and 10 for the x86 platform allows local users to gain privileges or cause a denial of service (panic) via unspecified vectors, possibly involving functions from the mm driver. cpe:/o:sun:solaris:10.0::sparc CVE-2006-0191 2006-01-13T06:03:00.000-05:00 2017-10-10T21:30:35.750-04:00 4.9 LOCAL LOW NONE NONE NONE COMPLETE http://nvd.nist.gov SECTRACK 1015479 SUNALERT 102108 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm BID 16222 VUPEN ADV-2006-0166 XF solaris-find-proc-dos(24085) Unspecified vulnerability in Sun Solaris 10 allows local users to cause a denial of service (null dereference) via unspecified vectors involving the use of the find command on the "/proc" filesystem. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this is related to CVE-2005-3250. cpe:/a:philip_loftin:aspsurvey:1.10 CVE-2006-0192 2006-01-13T06:03:00.000-05:00 2018-10-19T11:43:06.280-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 414 BUGTRAQ 20060204 sql injection in ASP Survey BID 16496 VUPEN ADV-2006-0164 XF aspsurvey-loginvalidate-sql-injection(24087) SQL injection vulnerability in Login_Validate.asp in ASPSurvey 1.10 allows remote attackers to execute arbitrary SQL commands via the Password parameter to login.asp. cpe:/a:positive_software:h-sphere:2.4.1 cpe:/a:positive_software:h-sphere:2.4.1_patch_1 cpe:/a:positive_software:h-sphere:2.4.1_patch_2 cpe:/a:positive_software:h-sphere:2.4.1_patch_3 cpe:/a:positive_software:h-sphere:2.4.1_patch_4 cpe:/a:positive_software:h-sphere:2.4.1_patch_5 cpe:/a:positive_software:h-sphere:2.4.1_patch_6 cpe:/a:positive_software:h-sphere:2.4.1_patch_7 cpe:/a:positive_software:h-sphere:2.4.2 cpe:/a:positive_software:h-sphere:2.4.2_beta_1 cpe:/a:positive_software:h-sphere:2.4.2_beta_2 cpe:/a:positive_software:h-sphere:2.4.2_beta_3 cpe:/a:positive_software:h-sphere:2.4.2_patch_1 cpe:/a:positive_software:h-sphere:2.4.2_patch_2 cpe:/a:positive_software:h-sphere:2.4.2_patch_3 cpe:/a:positive_software:h-sphere:2.4.2_patch_4 cpe:/a:positive_software:h-sphere:2.4.2_patch_5 cpe:/a:positive_software:h-sphere:2.4.2_rc1 cpe:/a:positive_software:h-sphere:2.4.2_rc2 cpe:/a:positive_software:h-sphere:2.4.3 cpe:/a:positive_software:h-sphere:2.4.3_beta_1 cpe:/a:positive_software:h-sphere:2.4.3_beta_2 cpe:/a:positive_software:h-sphere:2.4.3_patch_1 cpe:/a:positive_software:h-sphere:2.4.3_patch_2 cpe:/a:positive_software:h-sphere:2.4.3_patch_3 cpe:/a:positive_software:h-sphere:2.4.3_patch_4 cpe:/a:positive_software:h-sphere:2.4.3_patch_5 cpe:/a:positive_software:h-sphere:2.4.3_patch_6 cpe:/a:positive_software:h-sphere:2.4.3_patch_7 cpe:/a:positive_software:h-sphere:2.4.3_patch_8 cpe:/a:positive_software:h-sphere:2.4.3_rc1 cpe:/a:positive_software:h-sphere:2.4.3_rc2 CVE-2006-0193 2006-01-13T06:03:00.000-05:00 2018-10-19T11:43:06.827-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://www.psoft.net/HSdocumentation/versions/?v=all&p=r CONFIRM http://www.psoft.net/HSdocumentation/versions/index.php?v=243p9&p=r BUGTRAQ 20060112 H-Sphere Security Vulnerability VUPEN ADV-2006-0172 XF hsphere-login-xss(24096) Cross-site scripting (XSS) vulnerability in the Hosting Control Panel (psoft.hsphere.CP) in Positive Software H-Sphere 2.4.3 Patch 8 and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter in a login action. cpe:/a:fog_creek_software:fogbugz:4.029 CVE-2006-0194 2006-01-13T06:03:00.000-05:00 2018-10-19T11:43:07.437-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://www.fogcreek.com/FogBugz/KB/releaseNotes/WhatsNewInFogBugz4.0.33.html BUGTRAQ 20060112 FogBugz Cross Site Scripting Vulnerability BID 16216 VUPEN ADV-2006-0174 XF fogbugz-login-xss(24103) Cross-site scripting (XSS) vulnerability in default.asp in FogBugz 4.029, and other versions before 4.0.33, allows remote attackers to inject arbitrary web script or HTML via the dest parameter in the pgLogon page. cpe:/a:squirrelmail:squirrelmail:1.4 cpe:/a:squirrelmail:squirrelmail:1.4.1 cpe:/a:squirrelmail:squirrelmail:1.4.2 cpe:/a:squirrelmail:squirrelmail:1.4.3 cpe:/a:squirrelmail:squirrelmail:1.4.3_r3 cpe:/a:squirrelmail:squirrelmail:1.4.3_rc1 cpe:/a:squirrelmail:squirrelmail:1.4.3a cpe:/a:squirrelmail:squirrelmail:1.4.4 cpe:/a:squirrelmail:squirrelmail:1.4.4_rc1 cpe:/a:squirrelmail:squirrelmail:1.4.5 cpe:/a:squirrelmail:squirrelmail:1.4.6_rc1 cpe:/a:squirrelmail:squirrelmail:1.4_rc1 CVE-2006-0195 2006-02-23T19:02:00.000-05:00 2017-10-10T21:30:35.843-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SGI 20060501-01-U SECTRACK 1015662 DEBIAN DSA-988 GENTOO GLSA-200603-09 MANDRIVA MDKSA-2006:049 SUSE SUSE-SR:2006:005 FEDORA FEDORA-2006-133 REDHAT RHSA-2006:0283 BID 16756 CONFIRM http://www.squirrelmail.org/security/issue/2006-02-10 VUPEN ADV-2006-0689 XF squirrelmail-magichtml-xss(24848) Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via style sheet specifiers with invalid (1) "/*" and "*/" comments, or (2) a newline in a "url" specifier, which is processed by certain web browsers including Internet Explorer. cpe:/a:serial_line_sniffer:serial_line_sniffer:0.4.4 CVE-2006-0196 2006-01-13T18:03:00.000-05:00 2018-10-19T11:43:07.920-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://shellcoders.com/sintigan/slsnif-ploit.pl BUGTRAQ 20060111 Serial Line Sniffer 0.4.4 Buffer Overflow VUPEN ADV-2006-0212 XF slsnif-home-bo(24082) Unspecified vulnerability in Serial line sniffer (aka slsnif) 0.4.4 allows local users to gain privileges via a long value of the HOME environment variable, possibly because of a buffer overflow. cpe:/a:x.org:x.org:6.8.2 CVE-2006-0197 2006-01-13T18:03:00.000-05:00 2018-10-19T11:43:08.233-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov BUGTRAQ 20060108 xorg server 6.8.2 and below on 64bit arch The XClientMessageEvent struct used in certain components of X.Org 6.8.2 and earlier, possibly including (1) the X server and (2) Xlib, uses a "long" specifier for elements of the l array, which results in inconsistent sizes in the struct on 32-bit versus 64-bit platforms, and might allow attackers to cause a denial of service (application crash) and possibly conduct other attacks. cpe:/a:xoops:xoops_pool_module CVE-2006-0198 2006-01-13T18:03:00.000-05:00 2018-10-19T11:43:08.327-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060107 Xoops Pool Module IMG Tag Cross Site Scripting BID 16189 MISC http://www.xoops.org/modules/newbb/viewtopic.php?topic_id=45637&forum=2&post_id=200481 XF xoops-pool-imagetag-xss(24091) Cross-site scripting (XSS) vulnerability in a certain module, possibly poll or Pool, for XOOPS allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an IMG element in a comment. cpe:/a:mini-nuke:cms_system:1.8.2 CVE-2006-0199 2006-01-13T18:03:00.000-05:00 2018-10-19T11:43:08.607-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060112 Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injection vulnerability SREASON 340 MISC http://www.nukedx.com/?viewdoc=7 BUGTRAQ 20060113 Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injectionvulnerability VUPEN ADV-2006-0173 XF mininuke-news-sql-injection(24098) SQL injection vulnerability in news.asp in Mini-Nuke CMS System 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the hid parameter. cpe:/a:php:php:5.1.0 cpe:/a:php:php:5.1.1 CVE-2006-0200 2006-01-13T18:03:00.000-05:00 2018-10-30T12:25:35.747-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SREASON 337 SECTRACK 1015485 MISC http://www.hardened-php.net/advisory_022006.113.html CONFIRM http://www.php.net/release_5_1_2.php BUGTRAQ 20060112 Advisory 02/2006: PHP ext/mysqli Format String Vulnerability BID 16219 VUPEN ADV-2006-0177 VUPEN ADV-2006-0369 XF php-extmysqli-format-string(24095) Format string vulnerability in the error-reporting feature in the mysqli extension in PHP 5.1.0 and 5.1.1 might allow remote attackers to execute arbitrary code via format string specifiers in MySQL error messages. cpe:/a:paypal:php_toolkit:0.50 CVE-2006-0201 2006-01-13T18:03:00.000-05:00 2011-03-07T21:29:34.347-05:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060112 Multiple PHP Toolkit for PayPal Vulnerabilities BID 16218 MISC http://www.uinc.ru/articles/vuln/ptpaypal050.shtml VUPEN ADV-2006-0183 Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50, and possibly earlier versions, allows remote attackers to enter false payment entries into the log file via HTTP POST requests to ipn_success.php. cpe:/a:paypal:php_toolkit:0.50 CVE-2006-0202 2006-01-13T18:03:00.000-05:00 2011-03-07T21:29:34.437-05:00 3.6 LOCAL LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060112 Multiple PHP Toolkit for PayPal Vulnerabilities BID 16218 MISC http://www.uinc.ru/articles/vuln/ptpaypal050.shtml VUPEN ADV-2006-0183 Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier has (1) world-readable permissions for ipn/logs/ipn_success.txt, which allows local users to view sensitive information (payment data), and (2) world-writable permissions for ipn/logs, which allows local users to delete or replace payment data. cpe:/a:mini-nuke:cms_system:1.8.2 CVE-2006-0203 2006-01-13T18:03:00.000-05:00 2018-10-19T11:43:09.873-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060129 [xpl#2] MiniNuke 1.8.2 - change member's passwrod < Perl > FULLDISC 20060112 Advisory: MiniNuke CMS System <= 1.8.2 (membership.asp) remote user password change exploit FULLDISC 20060112 Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injection vulnerability SREASON 344 BUGTRAQ 20060113 Advisory: MiniNuke CMS System <= 1.8.2 (membership.asp) remoteuser password change exploit VUPEN ADV-2006-0173 XF mininuke-membership-change-password(24101) membership.asp in Mini-Nuke CMS System 1.8.2 and earlier does not verify the old password when changing a password, which allows remote attackers to change the passwords of other members via a lostpassnew action with a modified x parameter. cpe:/a:wordcircle:wordcircle:2.17 CVE-2006-0204 2006-01-13T18:03:00.000-05:00 2018-10-19T11:43:10.547-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/28/summary.html SREASON 345 BUGTRAQ 20060112 [eVuln] Wordcircle Multiple SQL Injection & XSS Vulnerabilities BID 16227 VUPEN ADV-2006-0185 XF wordcircle-index-xss(24106) Multiple cross-site scripting (XSS) vulnerabilities in Wordcircle 2.17 allow remote attackers to inject arbitrary web script or HTML via (1) the "Course name" field in index.php when the frm parameter has the value "mine" and (2) possibly certain other fields in unspecified scripts. cpe:/a:wordcircle:wordcircle:2.17 CVE-2006-0205 2006-01-13T18:03:00.000-05:00 2018-10-19T11:43:11.140-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/27/summary.html MISC http://evuln.com/vulns/28/summary.html SREASON 345 SREASON 346 BUGTRAQ 20060112 [eVuln] Wordcircle Authentication Bypass BUGTRAQ 20060112 [eVuln] Wordcircle Multiple SQL Injection & XSS Vulnerabilities BID 16227 VUPEN ADV-2006-0185 XF wordcircle-sql-injection(24105) XF wordcircle-login-security-bypass(24108) Multiple SQL injection vulnerabilities in Wordcircle 2.17 allow remote attackers to (1) execute arbitrary SQL commands and bypass authentication via the password field in the login action to index.php (involving v_login.php and s_user.php) and (2) have other unknown impact via certain other fields in unspecified scripts. cpe:/a:light_weight_calendar:light_weight_calendar:1.0 CVE-2006-0206 2006-01-13T18:03:00.000-05:00 2017-07-19T21:29:32.847-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS VIM 20060318 Source VERIFY - Light Weight Calendar issue is eval injection MISC http://evuln.com/vulns/29/exploit.html MISC http://evuln.com/vulns/29/summary.html BUGTRAQ 20060113 [eVuln] Light Weight Calendar PHP Code Execution BID 16229 VUPEN ADV-2006-0171 XF lwc-cal-execute-code(24110) Eval injection vulnerability in Light Weight Calendar (LWC) 1.0 (20040909) and earlier allows remote attackers to execute arbitrary PHP code via the date parameter in cal.php, which is included by index.php. cpe:/a:php:php:5.0:rc1 cpe:/a:php:php:5.0:rc2 cpe:/a:php:php:5.0:rc3 cpe:/a:php:php:5.0.0 cpe:/a:php:php:5.0.1 cpe:/a:php:php:5.0.2 cpe:/a:php:php:5.0.3 cpe:/a:php:php:5.0.4 cpe:/a:php:php:5.0.5 cpe:/a:php:php:5.1.0 cpe:/a:php:php:5.1.1 CVE-2006-0207 2006-01-13T18:03:00.000-05:00 2018-10-30T12:25:35.747-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov SUSE SUSE-SR:2006:004 SECTRACK 1015484 DEBIAN DSA-1331 GENTOO GLSA-200603-22 MISC http://www.hardened-php.net/advisory_012006.112.html MANDRIVA MDKSA-2006:028 CONFIRM http://www.php.net/release_5_1_2.php BID 16220 VUPEN ADV-2006-0177 VUPEN ADV-2006-0369 XF php-session-response-splitting(24094) UBUNTU USN-261-1 Multiple HTTP response splitting vulnerabilities in PHP 5.1.1 allow remote attackers to inject arbitrary HTTP headers via a crafted Set-Cookie header, related to the (1) session extension (aka ext/session) and the (2) header function. cpe:/a:php:php:4.0:beta1 cpe:/a:php:php:4.0:beta2 cpe:/a:php:php:4.0:beta3 cpe:/a:php:php:4.0:beta4 cpe:/a:php:php:4.0:beta_4_patch1 cpe:/a:php:php:4.0:rc1 cpe:/a:php:php:4.0:rc2 cpe:/a:php:php:4.0.0 cpe:/a:php:php:4.0.1 cpe:/a:php:php:4.0.2 cpe:/a:php:php:4.0.3 cpe:/a:php:php:4.0.4 cpe:/a:php:php:4.0.5 cpe:/a:php:php:4.0.6 cpe:/a:php:php:4.1.0 cpe:/a:php:php:4.1.1 cpe:/a:php:php:4.1.2 cpe:/a:php:php:4.2.0 cpe:/a:php:php:4.2.1 cpe:/a:php:php:4.2.2 cpe:/a:php:php:4.2.3 cpe:/a:php:php:4.3.0 cpe:/a:php:php:4.3.1 cpe:/a:php:php:4.3.2 cpe:/a:php:php:4.3.3 cpe:/a:php:php:4.3.4 cpe:/a:php:php:4.3.5 cpe:/a:php:php:4.3.6 cpe:/a:php:php:4.3.7 cpe:/a:php:php:4.3.8 cpe:/a:php:php:4.3.9 cpe:/a:php:php:4.3.10 cpe:/a:php:php:4.3.11 cpe:/a:php:php:4.4.1 cpe:/a:php:php:4.4.2 cpe:/a:php:php:5.0.0 cpe:/a:php:php:5.0.0:beta1 cpe:/a:php:php:5.0.0:beta2 cpe:/a:php:php:5.0.0:beta3 cpe:/a:php:php:5.0.0:rc1 cpe:/a:php:php:5.0.0:rc2 cpe:/a:php:php:5.0.0:rc3 cpe:/a:php:php:5.0.1 cpe:/a:php:php:5.0.2 cpe:/a:php:php:5.0.3 cpe:/a:php:php:5.0.4 cpe:/a:php:php:5.0.5 cpe:/a:php:php:5.1.0 cpe:/a:php:php:5.1.1 CVE-2006-0208 2006-01-13T18:03:00.000-05:00 2018-10-30T12:25:35.387-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov SGI 20060501-01-U SUSE SUSE-SR:2006:004 REDHAT RHSA-2006:0276 REDHAT RHSA-2006:0549 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-129.htm CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-160.htm GENTOO GLSA-200603-22 MANDRIVA MDKSA-2006:028 CONFIRM http://www.php.net/ChangeLog-4.php#4.4.2 CONFIRM http://www.php.net/release_5_1_2.php REDHAT RHSA-2006:0501 BID 16803 VUPEN ADV-2006-0177 VUPEN ADV-2006-0369 VUPEN ADV-2006-2685 MISC https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178028 UBUNTU USN-261-1 Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message. cpe:/a:tanklogger:tanklogger:2.4 CVE-2006-0209 2006-01-13T20:03:00.000-05:00 2018-10-19T11:43:12.013-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS VIM 20060113 Verified TankLogger SQl inject by source inspection MISC http://evuln.com/vulns/26/summary.html SREASON 341 BUGTRAQ 20060112 [eVuln] TankLogger SQL Injection Vulnerability BID 16228 VUPEN ADV-2006-0153 XF tanklogger-generalfunctions-sql-injection(24080) SQL injection vulnerability in general_functions.php in TankLogger 2.4 allows remote attackers to execute arbitrary SQL commands via the (1) livestock_id parameter to showInfo.php and (2) tank_id parameter, possibly to livestock.php. cpe:/a:interspire:trackpoint_nx CVE-2006-0210 2006-01-13T20:03:00.000-05:00 2018-10-19T11:43:12.670-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://www.interspire.com/forum/showthread.php?p=29606 BUGTRAQ 20060112 Interspire TrackPoint NX XSS Vulnerability BID 16214 VUPEN ADV-2006-0175 XF trackpointnx-login-xss(24112) Cross-site scripting (XSS) vulnerability in index.php in Interspire TrackPoint NX before 0.1 allows remote attackers to inject arbitrary web script or HTML via the username parameter when using the Login page. cpe:/a:helm_hosting:helm_hosting_control_panel:3.2.8 CVE-2006-0211 2006-01-13T20:03:00.000-05:00 2018-10-19T11:43:13.077-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060112 Helm XSS Vulnerability BID 16234 VUPEN ADV-2006-0203 CONFIRM http://www.webhostautomation.com/webhost-301 XF helm-forgotpassword-xss(24139) Cross-site scripting (XSS) vulnerability in forgotPassword.asp in Helm Hosting Control Panel 3.2.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the txtEmailAddress parameter. cpe:/a:toshiba:bluetooth_stack:3.00.11 cpe:/a:toshiba:bluetooth_stack:3.00.12 cpe:/a:toshiba:bluetooth_stack:3.00.31a cpe:/a:toshiba:bluetooth_stack:3.00.32 cpe:/a:toshiba:bluetooth_stack:3.01.03 cpe:/a:toshiba:bluetooth_stack:3.10.00 cpe:/a:toshiba:bluetooth_stack:3.20.00 cpe:/a:toshiba:bluetooth_stack:3.20.01 cpe:/a:toshiba:bluetooth_stack:3.20.02 cpe:/a:toshiba:bluetooth_stack:3.20.04 cpe:/a:toshiba:bluetooth_stack:4.00.01t cpe:/a:toshiba:bluetooth_stack:4.00.11 cpe:/a:toshiba:bluetooth_stack:4.00.23t CVE-2006-0212 2006-01-13T20:03:00.000-05:00 2018-10-19T11:43:13.437-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://aps.toshiba-tro.de/bluetooth/pages/driverinfo.php?txt=sp2 FULLDISC 20060113 DMA[2006-0112a] - 'Toshiba Bluetooth Stack Directory Transversal' SECTRACK 1015486 MISC http://www.digitalmunition.com/DMA%5B2006-0112a%5D.txt BUGTRAQ 20060113 DMA[2006-0112a] - 'Toshiba Bluetooth Stack Directory Transversal' BID 16236 VUPEN ADV-2006-0184 Directory traversal vulnerability in OBEX Push services in Toshiba Bluetooth Stack 4.00.23(T) and earlier allows remote attackers to upload arbitrary files to arbitrary remote locations specified by .. (dot dot) sequences, as demonstrated by ..\\ sequences in the RFILE argument of ussp-push. cpe:/a:kolab:kolab_groupware_server:2.0.1 cpe:/a:kolab:kolab_groupware_server:2.0.2 cpe:/a:kolab:kolab_groupware_server:2005-12-15_pre2.1 CVE-2006-0213 2006-01-13T20:03:00.000-05:00 2017-07-19T21:29:33.160-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://kolab.org/security/kolab-vendor-notice-08.txt VUPEN ADV-2006-0186 XF kolab-smtp-logging(24123) Kolab Server 2.0.1, 2.0.2 and development versions pre-2.1-20051215 and earlier, when authenticating users via secure SMTP, stores authentication credentials in plaintext in the postfix.log file, which allows local users to gain privileges. cpe:/a:indexcor:ezdatabase:2.0 cpe:/a:indexcor:ezdatabase:2.1.2 CVE-2006-0214 2006-01-15T06:03:00.000-05:00 2017-07-19T21:29:33.220-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://pridels0.blogspot.com/2006/01/ezdatabase-20-and-below.html SREASON 351 BID 16237 XF ezdatabase-visitorupload-file-include(24136) Eval injection vulnerability in ezDatabase 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the db_id parameter to visitorupload.php, as demonstrated using phpinfo and include function calls. cpe:/a:qualityebiz:quality_ppc:1.0_build_1644 CVE-2006-0215 2006-01-16T14:03:00.000-05:00 2008-09-05T16:58:39.667-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov 2006-01-17T09:19:00.000-05:00 Cross-site scripting (XSS) vulnerability in admin.php in QualityEBiz Quality PPC (QPPC) 1.0 build 1644 allows remote attackers to inject arbitrary web script or HTML via the cpage parameter. NOTE: this issue might be resultant from CVE-2006-0216. cpe:/a:qualityebiz:quality_ppc:1.0_build_1644 CVE-2006-0216 2006-01-16T14:03:00.000-05:00 2008-09-05T16:58:39.810-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov 2006-01-17T09:20:00.000-05:00 admin.php in QualityEBiz Quality PPC (QPPC) 1.0 build 1644 allows remote attackers to obtain sensitive information, possibly the installation path of the application, via unspecified "meta characters" to the cpage parameter. cpe:/a:ultimate_auction:ultimate_auction:3.67 CVE-2006-0217 2006-01-16T14:03:00.000-05:00 2017-07-19T21:29:33.267-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060115 Ultimate Auction <=3.67 BID 16239 BID 16254 VUPEN ADV-2006-0187 XF ultimate-auction-item-xss(24138) Multiple cross-site scripting (XSS) vulnerabilities in Ultimate Auction 3.67 allow remote attackers to inject arbitrary web script or HTML via the (1) item parameter in item.pl and (2) category parameter in itemlist.pl, which reflects the XSS in an error message. NOTE: the affected version might be wrong since the current version as of 20060116 is 3.6.1. cpe:/a:mybb:mybb:1.00 cpe:/a:mybb:mybb:1.0:beta4 cpe:/a:mybb:mybb:1.0:pr1 cpe:/a:mybb:mybb:1.0:pr2 cpe:/a:mybb:mybb:1.0:rc1 cpe:/a:mybb:mybb:1.0:rc2 cpe:/a:mybb:mybb:1.0:rc3 cpe:/a:mybb:mybb:1.0:rc4 cpe:/a:mybb:mybb:1.01 CVE-2006-0218 2006-01-16T16:03:00.000-05:00 2013-01-03T00:00:00.000-05:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov 2006-01-17T09:01:00.000-05:00 ALLOWS_ADMIN_ACCESS CONFIRM http://community.mybboard.net/showthread.php?tid=5852 Multiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before 1.0.2 have unspecified impact and attack vectors, related to (1) admin/moderate.php, (2) admin/themes.php, (3) inc/functions.php, (4) inc/functions_upload.php, (5) printthread.php, and (6) usercp.php, and probably related to SQL injection. NOTE: it is likely that this issue subsumes CVE-2005-4602 and CVE-2005-4603. However, since the vendor advisory is vague and additional files are mentioned, is is likely that this contains at least one distinct vulnerability from CVE-2005-4602 and CVE-2005-4603. cpe:/a:mybulletinboard:mybulletinboard:1.0.2 cpe:/a:mybulletinboard:mybulletinboard:1.0_final cpe:/a:mybulletinboard:mybulletinboard:1.0_preview_release_2 cpe:/a:mybulletinboard:mybulletinboard:1.01 CVE-2006-0219 2006-01-16T16:03:00.000-05:00 2017-07-19T21:29:33.317-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://community.mybboard.net/showthread.php?tid=5853&pid=35088#pid35088 MISC http://community.mybboard.net/showthread.php?tid=5853&pid=35151#pid35151 CONFIRM http://community.mybboard.net/showthread.php?tid=5960 BID 16230 XF mybb-usercp-script-sql-injection(24115) The original distribution of MyBulletinBoard (MyBB) to update from older versions to 1.0.2 omits or includes older versions of certain critical files, which allows attackers to conduct (1) SQL injection attacks via an attachment name that is not properly handled by inc/functions_upload.php (CVE-2005-4602), and possibly (2) other attacks related to threadmode in usercp.php. cpe:/a:codeworx_technologies:dcp-portal:5.3 cpe:/a:codeworx_technologies:dcp-portal:5.3.1 cpe:/a:codeworx_technologies:dcp-portal:5.3.2 cpe:/a:codeworx_technologies:dcp-portal:6.0 cpe:/a:codeworx_technologies:dcp-portal:6.1 cpe:/a:codeworx_technologies:dcp-portal:6.1.1 CVE-2006-0220 2006-01-16T16:03:00.000-05:00 2018-10-19T11:43:13.873-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060113 DCP Portal Cross-Site Scripting Vulnerability BID 16232 XF dcpportal-calendar-search-xss(24153) Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5.3 through 6.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the day parameter in calendar.php and (2) the input form in search.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. It is possible that this issue is resultant from an SQL injection problem in CVE-2005-4227.3 and CVE-2005-4227.13. cpe:/a:ddsn:cm3cms CVE-2006-0221 2006-01-16T16:03:00.000-05:00 2018-10-19T11:43:14.047-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060113 DDSN CMS Admin Panel SQL Injection Vulnerability BID 16231 XF cm3-login-sql-injection(24266) SQL injection vulnerability in index.asp in the Admin Panel in Dragon Design Services Network (DDSN) cm3 content manager (CM3CMS) allows remote attackers to execute arbitrary SQL commands via the (1) username or (2) password. cpe:/a:alstrasoft:template_seller:::pro CVE-2006-0222 2006-01-16T16:03:00.000-05:00 2018-10-19T11:43:14.247-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060113 AlstraSoft Template Seller Pro Cross-Site Scripting Vulnerability BID 16233 XF template-seller-fullview-xss(24235) Cross-site scripting (XSS) vulnerability in fullview.php in AlstraSoft Template Seller Pro allows remote attackers to inject arbitrary web script or HTML via the tempid parameter. cpe:/a:topcmm_computing:123_flash_chat_server:5.0 cpe:/a:topcmm_computing:123_flash_chat_server:5.1 CVE-2006-0223 2006-01-16T16:03:00.000-05:00 2017-07-19T21:29:33.533-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://www.123flashchat.com/flash-chat-server-v512.html BID 16235 VUPEN ADV-2006-0198 XF 123flashchat-user-directory-traversal(24137) Directory traversal vulnerability in Shanghai TopCMM 123 Flash Chat Server Software 5.1 allows attackers to create or overwrite arbitrary files on the server via ".." (dot dot) sequences in the username field. cpe:/a:libast:libast:0.4 cpe:/a:libast:libast:0.5 cpe:/a:libast:libast:0.6 cpe:/a:libast:libast:0.6.1 CVE-2006-0224 2006-01-24T21:03:00.000-05:00 2018-10-19T11:43:14.467-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://freshmeat.net/projects/libast/?branch_id=17907&release_id=217840 SREASON 373 DEBIAN DSA-976 GENTOO GLSA-200601-14 MANDRIVA MDKSA-2006:029 MISC http://www.rosiello.org/en/read_bugs.php?id=25 BUGTRAQ 20060125 Rosiello Security - Eterm-LibAST Advisory BUGTRAQ 20060123 [ Rosiello Security ] Eterm-LibAST Advisory BUGTRAQ 20060123 LibAST 0.7 Release Fixes Security Vulnerability BID 16350 VUPEN ADV-2006-0314 XF eterm-libast-filename-bo(24303) Buffer overflow in Library of Assorted Spiffy Things (LibAST) 0.6.1 and earlier, as used in Eterm and possibly other software, allows local users to execute arbitrary code as the utmp user via a long -X command line argument (alternative configuration file name). cpe:/a:openbsd:openssh:3.0 cpe:/a:openbsd:openssh:3.0.1 cpe:/a:openbsd:openssh:3.0.1p1 cpe:/a:openbsd:openssh:3.0.2 cpe:/a:openbsd:openssh:3.0.2p1 cpe:/a:openbsd:openssh:3.0p1 cpe:/a:openbsd:openssh:3.1 cpe:/a:openbsd:openssh:3.1p1 cpe:/a:openbsd:openssh:3.2 cpe:/a:openbsd:openssh:3.2.2p1 cpe:/a:openbsd:openssh:3.2.3p1 cpe:/a:openbsd:openssh:3.3 cpe:/a:openbsd:openssh:3.3p1 cpe:/a:openbsd:openssh:3.4 cpe:/a:openbsd:openssh:3.4p1 cpe:/a:openbsd:openssh:3.5 cpe:/a:openbsd:openssh:3.5p1 cpe:/a:openbsd:openssh:3.6 cpe:/a:openbsd:openssh:3.6.1 cpe:/a:openbsd:openssh:3.6.1p1 cpe:/a:openbsd:openssh:3.6.1p2 cpe:/a:openbsd:openssh:3.7 cpe:/a:openbsd:openssh:3.7.1 cpe:/a:openbsd:openssh:3.7.1p2 cpe:/a:openbsd:openssh:3.8 cpe:/a:openbsd:openssh:3.8.1 cpe:/a:openbsd:openssh:3.8.1p1 cpe:/a:openbsd:openssh:3.9 cpe:/a:openbsd:openssh:3.9.1 cpe:/a:openbsd:openssh:3.9.1p1 cpe:/a:openbsd:openssh:4.0p1 cpe:/a:openbsd:openssh:4.1p1 cpe:/a:openbsd:openssh:4.2p1 CVE-2006-0225 2006-01-25T06:03:00.000-05:00 2018-10-19T11:43:15.763-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS OPENBSD 20060212 [3.8] 005: SECURITY FIX: February 12, 2006 SGI 20060703-01-P CONFIRM http://blogs.sun.com/security/entry/sun_alert_102961_security_vulnerability CONFIRM http://docs.info.apple.com/article.html?artnum=305214 HP HPSBUX02178 APPLE APPLE-SA-2007-03-13 SREASON 462 SECTRACK 1015540 SLACKWARE SSA:2006-045-06 SUNALERT 102961 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-158.htm CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-174.htm CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-262.htm CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2007-246.htm GENTOO GLSA-200602-11 MANDRIVA MDKSA-2006:034 SUSE SUSE-SA:2006:008 OPENPKG OpenPKG-SA-2006.003 FEDORA FEDORA-2006-056 REDHAT RHSA-2006:0044 REDHAT RHSA-2006:0298 REDHAT RHSA-2006:0698 FEDORA FLSA-2006:168935 BID 16369 TRUSTIX 2006-0004 UBUNTU USN-255-1 CERT TA07-072A CONFIRM http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html CONFIRM http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html VUPEN ADV-2006-0306 VUPEN ADV-2006-2490 VUPEN ADV-2006-4869 VUPEN ADV-2007-0930 VUPEN ADV-2007-2120 CONFIRM http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH00688 CONFIRM http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=2751 CONFIRM https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=174026 XF openssh-scp-command-execution(24305) scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice. cpe:/o:freebsd:freebsd:6.0:release cpe:/o:freebsd:freebsd:6.0:stable CVE-2006-0226 2006-01-18T20:03:00.000-05:00 2017-07-19T21:29:33.817-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS FREEBSD FreeBSD-SA-06:05 MISC http://kernelwars.blogspot.com/2007/01/alive.html SECTRACK 1015518 MISC http://www.blackhat.com/html/bh-europe-07/bh-eu-07-speakers.html#Eriksson BID 16296 MISC http://www.signedness.org/advisories/sps-0x1.txt XF bsd-ieee80211-bo(24192) Integer overflow in IEEE 802.11 network subsystem (ieee80211_ioctl.c) in FreeBSD before 6.0-STABLE, while scanning for wireless networks, allows remote attackers to execute arbitrary code by broadcasting crafted (1) beacon or (2) probe response frames. cpe:/o:sun:solaris:9.0::sparc cpe:/o:sun:solaris:10.0::sparc cpe:/o:sun:solaris:10.0::x86 cpe:/o:sun:sunos:5.8 cpe:/o:sun:sunos:5.9 CVE-2006-0227 2006-01-17T15:07:00.000-05:00 2018-10-30T12:26:23.107-04:00 2.6 LOCAL HIGH NONE NONE PARTIAL PARTIAL http://nvd.nist.gov SECTRACK 1015492 SUNALERT 102033 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm BID 16245 VUPEN ADV-2006-0200 XF solaris-lpsched-dos(24127) Multiple unspecified vulnerabilities in lpsched in Sun Solaris 8, 9, and 10 allow local users to delete arbitrary files or disable the LP print service via unknown attack vectors. cpe:/a:grsecurity:grsecurity_kernel_patch:2.0.1 cpe:/a:grsecurity:grsecurity_kernel_patch:2.0.2 cpe:/a:grsecurity:grsecurity_kernel_patch:2.1.0 cpe:/a:grsecurity:grsecurity_kernel_patch:2.1.1 cpe:/a:grsecurity:grsecurity_kernel_patch:2.1.2 cpe:/a:grsecurity:grsecurity_kernel_patch:2.1.3 cpe:/a:grsecurity:grsecurity_kernel_patch:2.1.4 cpe:/a:grsecurity:grsecurity_kernel_patch:2.1.5 cpe:/a:grsecurity:grsecurity_kernel_patch:2.1.6 cpe:/a:grsecurity:grsecurity_kernel_patch:2.1.7 CVE-2006-0228 2006-01-17T16:03:00.000-05:00 2017-07-19T21:29:33.927-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS CONFIRM http://www.grsecurity.org/news.php#grsec218 BID 16261 VUPEN ADV-2006-0199 XF grsecurity-rbac-admin-privileges(24156) The RBAC functionality in grsecurity before 2.1.8 does not properly handle when the admin role creates a service and then exits the shell without unauthenticating, which causes the service to be restarted with the admin role still active. cpe:/a:wehnus:wehntrust CVE-2006-0229 2006-01-17T16:03:00.000-05:00 2018-10-19T11:43:23.687-04:00 2.1 LOCAL LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060116 WehnTrust - When you have to trust Wehntrust BUGTRAQ 20060116 Re: [Full-disclosure] WehnTrust - When you have to trust Wehntrust BID 16268 MISC http://www.wehnus.com/downloads.pl XF wehntrust-service-start-file-execution(24315) Unquoted Windows search path vulnerability in Wehntrust might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run when Wehntrust creates the autostart key. cpe:/a:symantec:antivirus_scan_engine:5.0.0.24 CVE-2006-0230 2006-04-24T21:02:00.000-04:00 2018-10-19T11:43:24.077-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS VULNWATCH 20060421 Rapid7 Advisory R7-0021: Symantec Scan Engine Authentication Fundamental Design Error CERT-VN VU#118388 BUGTRAQ 20060421 Rapid7 Advisory R7-0021: Symantec Scan Engine Authentication Fundamental Design Error BUGTRAQ 20060421 [Symantec Security Advisor] Symantec Scan Engine Multiple Vulnerabilities BID 17637 CONFIRM http://www.symantec.com/avcenter/security/Content/2006.04.21.html VUPEN ADV-2006-1464 XF sse-unauth-admin-access(25972) Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attackers to gain administrator privileges via a modified client that sends certain XML requests. cpe:/a:symantec:antivirus_scan_engine:5.0.0.24 CVE-2006-0231 2006-04-24T21:02:00.000-04:00 2018-10-19T11:43:24.733-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov VULNWATCH 20060421 Rapid7 Advisory R7-0022: Symantec Scan Engine Known Immutable DSA Private Key SECTRACK 1015974 BUGTRAQ 20060421 Rapid7 Advisory R7-0022: Symantec Scan Engine Known Immutable DSA Private Key BUGTRAQ 20060421 [Symantec Security Advisor] Symantec Scan Engine Multiple Vulnerabilities BID 17637 CONFIRM http://www.symantec.com/avcenter/security/Content/2006.04.21.html VUPEN ADV-2006-1464 XF sse-insecure-private-key(25973) Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each installation, which allows remote attackers to conduct man-in-the-middle attacks and decrypt communications. cpe:/a:symantec:antivirus_scan_engine:5.0.0.24 CVE-2006-0232 2006-04-24T21:02:00.000-04:00 2018-10-19T11:43:25.390-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov VULNWATCH 20060421 Rapid7 Advisory R7-0023: Symantec Scan Engine File Disclosure Vulnerability SREASON 758 SREASON 759 SECTRACK 1015974 BUGTRAQ 20060421 Rapid7 Advisory R7-0023: Symantec Scan Engine File Disclosure Vulnerability BUGTRAQ 20060421 [Symantec Security Advisor] Symantec Scan Engine Multiple Vulnerabilities BID 17637 CONFIRM http://www.symantec.com/avcenter/security/Content/2006.04.21.html VUPEN ADV-2006-1464 XF sse-unauth-file-access(25974) Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, stores sensitive log and virus definition files under the web root with insufficient access control, which allows remote attackers to obtain the information via direct requests. cpe:/a:microblog:microblog:2.0_rc10 CVE-2006-0233 2006-01-17T19:07:00.000-05:00 2018-10-19T11:43:26.187-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/36/summary.html SECTRACK 1015496 BUGTRAQ 20060117 [eVuln] microBlog BBCode XSS Vulnerability BID 16272 XF microblog-functions-xss(24140) Cross-site scripting (XSS) vulnerability in functions.php in microBlog 2.0 RC-10 allows remote attackers to inject arbitrary web script and HTML via a javascript: URI in a [url] BBcode tag. cpe:/a:microblog:microblog:2.0_rc10 CVE-2006-0234 2006-01-17T19:07:00.000-05:00 2018-10-19T11:43:26.560-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/35/summary.html SECTRACK 1015496 BUGTRAQ 20060117 [eVuln] microBlog SQL Injection Vulnerability BID 16270 VUPEN ADV-2006-0239 XF microblog-index-sql-injection(24132) SQL injection vulnerability in index.php in microBlog 2.0 RC-10 allows remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters. cpe:/a:white_angle:white_album:2.5 CVE-2006-0235 2006-01-17T20:07:00.000-05:00 2018-10-19T11:43:27.093-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.biyosecurity.be/bugs/whitealbum.txt BUGTRAQ 20060116 White Album Sql &#304;njection biyosecurity.be BID 16247 VUPEN ADV-2006-0241 XF whitealbum-pictures-sql-injection(24271) SQL injection vulnerability in WhiteAlbum 2.5 allows remote attackers to execute arbitrary SQL commands via the dir parameter to pictures.php. cpe:/a:mozilla:thunderbird:1.0 cpe:/a:mozilla:thunderbird:1.0.1 cpe:/a:mozilla:thunderbird:1.0.2 cpe:/a:mozilla:thunderbird:1.0.5 cpe:/a:mozilla:thunderbird:1.0.6 cpe:/a:mozilla:thunderbird:1.0.7 cpe:/a:mozilla:thunderbird:1.5:beta2 CVE-2006-0236 2006-01-17T20:07:00.000-05:00 2018-10-19T11:43:27.563-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MANDRIVA MDKSA-2006:021 BUGTRAQ 20060117 Secunia Research: Mozilla Thunderbird Attachment SpoofingVulnerability BID 16271 VUPEN ADV-2006-0230 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=300246 XF thunderbird-attachment-ext-spoofing(24164) GUI display truncation vulnerability in Mozilla Thunderbird 1.0.2, 1.0.6, and 1.0.7 allows user-assisted attackers to execute arbitrary code via an attachment with a filename containing a large number of spaces ending with a dangerous extension that is not displayed by Thunderbird, along with an inconsistent Content-Type header, which could be used to trick a user into downloading dangerous content by dragging or saving the attachment. cpe:/a:gtp:icommerce CVE-2006-0237 2006-01-17T20:07:00.000-05:00 2017-07-19T21:29:34.473-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16255 VUPEN ADV-2006-0214 XF gtpicommerce-index-xss(24150) Cross-site scripting (XSS) vulnerability in index.php in GTP iCommerce allows remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) subcat parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:gamerz:wp-stats:2.0 CVE-2006-0238 2006-01-17T20:07:00.000-05:00 2017-07-19T21:29:34.517-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://www.lesterchan.net/blogs/ CONFIRM http://www.lesterchan.net/blogs/archives/2006/01/18/wp-stats-sql-injection-vulnerability BID 16241 VUPEN ADV-2006-0192 XF wpstats-script-sql-injection(24163) SQL injection vulnerability in wp-stats.php in GaMerZ WP-Stats 2.0 allows remote attackers to execute arbitrary SQL commands via the author parameter. cpe:/a:8pixel.net:simple_blog:2.1 CVE-2006-0239 2006-01-17T20:07:00.000-05:00 2018-10-19T11:43:28.107-04:00 5.8 NETWORK MEDIUM NONE PARTIAL PARTIAL NONE http://nvd.nist.gov MISC http://www.hackerscenter.com/archive/view.asp?id=21926 BUGTRAQ 20060114 [HSC Security Group] Multiple SQL injection/XSS in SimpleBlog 2.1 BID 16243 VUPEN ADV-2006-0194 XF simpleblog-comment-xss(24154) Multiple cross-site scripting (XSS) vulnerabilities in Simple Blog 2.1 allow remote attackers to inject arbitrary web script or HTML via (1) a comment to comments.asp and (2) possibly certain other fields in unspecified scripts. cpe:/a:8pixel.net:simple_blog:2.1 CVE-2006-0240 2006-01-17T20:07:00.000-05:00 2017-07-19T21:29:34.627-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.hackerscenter.com/archive/view.asp?id=21926 BUGTRAQ 20060114 [HSC Security Group] Multiple SQL injection/XSS in SimpleBlog 2.1 BID 16243 VUPEN ADV-2006-0194 XF simpleblog-month-sql-injection(24155) Multiple SQL injection vulnerabilities in Simple Blog 2.1 allow remote attackers to execute arbitrary SQL commands via the month parameter in an archives view operation and possibly certain other parameters in unspecified scripts. cpe:/a:webmobo:wbnews:1.1.0 CVE-2006-0241 2006-01-17T20:07:00.000-05:00 2018-10-19T11:43:28.563-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060117 XSS in WBNews < = v1.1.0 BID 16277 VUPEN ADV-2006-0237 Cross-site scripting vulnerability in WBNews 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the Name field. cpe:/a:php_fusebox:php_fusebox:4.0.6 CVE-2006-0242 2006-01-17T20:07:00.000-05:00 2018-10-19T11:43:28.813-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov SREASON 355 BUGTRAQ 20060117 IndonesiaHack Advisory HTML injection in PHP Fusebox BID 16274 Cross-site scripting vulnerability in index.php in PHP Fusebox 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter. cpe:/a:smbcms:smbcms:2.1 CVE-2006-0243 2006-01-17T20:51:00.000-05:00 2017-07-19T21:29:34.690-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16281 VUPEN ADV-2006-0229 XF smbcms-sitesearch-xss(24187) Cross-site scripting (XSS) vulnerability in SMBCMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the text parameter, which is used by the "Search Site" field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:phpxplorer:phpxplorer:0.9.33 CVE-2006-0244 2006-01-17T20:51:00.000-05:00 2018-10-19T11:43:29.017-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 353 MISC http://www.arrelnet.com/advisories/adv20060116.html BUGTRAQ 20060116 Directory traversal in phpXplorer BUGTRAQ 20060116 Re: Directory traversal in phpXplorer BID 16263 VUPEN ADV-2006-0232 XF phpxplorer-sshare-directory-traversal(39982) ** DISPUTED ** Directory traversal vulnerability in workspaces.php in phpXplorer 0.9.33 allows remote attackers to include arbitrary files via a .. (dot dot) and trailing null byte (%00) in the sShare parameter. NOTE: a followup post claims that this is not a vulnerability since the functionality of phpXplorer supports the upload of PHP files, which would not cross privilege boundaries since the PHP functionality would support read access outside the web root. cpe:/a:devellion:cubecart:3.0.7-pl1 CVE-2006-0245 2006-01-17T20:51:00.000-05:00 2017-07-19T21:29:34.800-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://bugs.cubecart.com/?do=details&id=459 MISC http://lostmon.blogspot.com/2006/01/cubecart-307-pl1-indexphp-multiple.html BID 16259 VUPEN ADV-2006-0227 XF cubecart-index-script-xss(24177) Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the (3) redir, (4) productId, (5) docId, (6) act, and (7) catId parameters in index.php; and the (8) username field in a login action in index.php. NOTE: the cart.php/redir and index.php/searchStr vectors are already covered by CVE-2005-3152. cpe:/a:widexl:download_tracker:1.0.6 CVE-2006-0246 2006-01-17T20:51:00.000-05:00 2017-07-19T21:29:34.847-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16265 VUPEN ADV-2006-0213 XF downloadtracker-down-xss(24161) Cross-site scripting (XSS) vulnerability in down.pl in Widexl Download Tracker 1.06 allows remote attackers to inject arbitrary web script or HTML via the ID parameter. cpe:/a:netbula:anyboard:9.9.5.6 CVE-2006-0247 2006-01-17T20:51:00.000-05:00 2017-07-19T21:29:34.910-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16264 VUPEN ADV-2006-0188 XF netbula-anyboard-script-xss(24167) Cross-site scripting (XSS) vulnerability in anyboard.cgi in Netbula Anyboard 9.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the tK parameter in a find command. cpe:/a:intracom:jetspeed:500 cpe:/a:intracom:jetspeed:520 CVE-2006-0248 2006-01-17T20:51:00.000-05:00 2017-07-19T21:29:34.957-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://blog.globalnetworks.gr/?p=4 VUPEN ADV-2006-0218 XF virata-emweb-unauth-access(24304) Virata-EmWeb web server 6_1_0, as used in (1) Intracom JetSpeed 500 and 520 and (2) Allied Data Technologies CopperJet 811 RouterPlus, allows remote attackers to access privileged information, such as user lists and configuration settings, via direct HTTP requests. cpe:/a:bitdamaged:geoblog:mod_1.0 CVE-2006-0249 2006-01-17T20:51:00.000-05:00 2017-07-19T21:29:35.017-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/33/summary.html SECTRACK 1015493 BID 16249 VUPEN ADV-2006-0191 XF geoBlog-viewcat-sql-injection(24146) SQL injection vulnerability in viewcat.php in BitDamaged geoBlog MOD_1.0 allows remote attackers to execute arbitrary SQL commands, then steal credentials and upload files, via the cat parameter ($tmpCategory variable). cpe:/a:carnegie_mellon_university:snmptrapd:3.6 cpe:/a:carnegie_mellon_university:snmptrapd:3.7 CVE-2006-0250 2006-01-17T20:51:00.000-05:00 2018-10-19T11:43:29.623-04:00 6.4 NETWORK LOW NONE NONE PARTIAL PARTIAL http://nvd.nist.gov MISC http://www.digitalarmaments.com/2006040164883273.html BUGTRAQ 20060116 Digital Armaments Security Advisory 01.16.2006: CMU SNMP utilities snmptrad Format String Vulnerability BID 16267 VUPEN ADV-2006-0234 XF cmusnmp-snmpinput-format-string(24178) Format string vulnerability in the snmp_input function in snmptrapd in CMU SNMP utilities (cmu-snmp) allows remote attackers to execute arbitrary code by sending crafted SNMP messages to UDP port 162. cpe:/a:faq-o-matic:faq-o-matic:2.711 CVE-2006-0251 2006-01-17T20:51:00.000-05:00 2017-07-19T21:29:35.127-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16251 VUPEN ADV-2006-0189 XF faqomatic-fom-xss(24165) Cross-site scripting (XSS) vulnerability in fom.cgi in Faq-O-Matic 2.711 allows remote attackers to inject arbitrary web script or HTML via the (1) _duration, (2) file, and (3) cmd parameters. cpe:/a:benders_calendar:benders_calendar:1.0 CVE-2006-0252 2006-01-17T20:51:00.000-05:00 2018-10-19T11:43:30.107-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/30/summary.html SECTRACK 1015491 BUGTRAQ 20060115 [eVuln] Benders Calendar SQL Injection BID 16242 VUPEN ADV-2006-0190 XF benderscalendar-sql-injection(24120) SQL injection vulnerability in Benders Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via multiple parameters, as demonstrated by the (1) year, (2) month, and (3) day parameters. cpe:/a:ambicom:blue_neighbors:2.50_build_2500 CVE-2006-0253 2006-01-17T20:51:00.000-05:00 2018-10-19T11:43:30.750-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SREASON 366 MISC http://www.digitalmunition.com/DMA%5B2006-0115a%5D.txt BUGTRAQ 20060120 DMA[2006-0115a] - 'AmbiCom Bluetooth Object Push Overflow' BID 16258 VUPEN ADV-2006-0219 XF ambicom-bluetooth-objectpush-bo(24179) Buffer overflow in the Bluetooth OBEX Object Push service in "Blue Neighbors.EXE" in AmbiCom Blue Neighbors 2.50 Build 2500 and earlier allows remote attackers to execute arbitrary code via a long file name, as demonstrated via a long RFILE argument to ussp-push. cpe:/a:apache:geronimo:1.0 CVE-2006-0254 2006-01-17T20:51:00.000-05:00 2018-10-19T11:43:32.170-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://issues.apache.org/jira/browse/GERONIMO-1474 REDHAT RHSA-2008:0630 MISC http://www.oliverkarow.de/research/geronimo_css.txt REDHAT RHSA-2008:0261 BUGTRAQ 20060115 Apache Geronimo 1.0 - CSS and persistent HTML-Injectionvulnerabilities BID 16260 VUPEN ADV-2006-0217 XF geronimo-jspexamples-xss(24158) XF geronimo-webaccesslog-viewer-xss(24159) CONFIRM https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12310181&styleName=Html&projectId=10220&Create=Create Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer. cpe:/a:checkpoint:vpn-1:::fp1 cpe:/a:checkpoint:vpn-1:4.1 cpe:/a:checkpoint:vpn-1:4.1:sp1 cpe:/a:checkpoint:vpn-1:4.1:sp2 cpe:/a:checkpoint:vpn-1:4.1:sp3 cpe:/a:checkpoint:vpn-1:4.1:sp4 cpe:/a:checkpoint:vpn-1:4.1:sp5 cpe:/a:checkpoint:vpn-1:4.1:sp5a cpe:/a:checkpoint:vpn-1:4.1:sp6 CVE-2006-0255 2006-01-17T20:51:00.000-05:00 2018-10-19T11:43:35.437-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS MISC http://secdev.zoller.lu/research/checkpoint.txt BUGTRAQ 20060117 [ TZO-012006 ] Checkpoint VPN-1 SecureClient insecure usage of CreateProcess() BID 16290 VUPEN ADV-2006-0258 Unquoted Windows search path vulnerability in Check Point VPN-1 SecureClient might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run when SecureClient attempts to launch the Sr_GUI.exe program. cpe:/a:oracle:database_server:8.1.7.4 cpe:/a:oracle:database_server:9.0.1.5 cpe:/a:oracle:database_server:9.2.0.6 cpe:/a:oracle:database_server:10.1.0.3 CVE-2006-0256 2006-01-18T06:03:00.000-05:00 2012-10-22T21:56:02.710-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 Unspecified vulnerability in the Advanced Queuing component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.6, 10.1.0.3 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB01. cpe:/a:oracle:database_server:9.2.0.7 cpe:/a:oracle:database_server:10.1.0.5 cpe:/a:oracle:database_server:10.2.0.1 CVE-2006-0257 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:35.377-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in the Change Data Capture component of Oracle Database server 9.2.0.7, 10.1.0.5, and 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB02. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the CDC_ALLOCATE_LOCK function of the DBMS_CDC_UTILITY package. cpe:/a:oracle:database_server:8.1.7.4 cpe:/a:oracle:database_server:9.0.1.5::fips CVE-2006-0258 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:35.440-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in the Connection Manager component of Oracle Database server 8.1.7.4 and 9.0.1.5 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB03. cpe:/a:oracle:database_server:10.1.0.5 CVE-2006-0259 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:35.503-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Multiple unspecified vulnerabilities in Oracle Database server 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB04 and (2) DB06 in the (a) Data Pump component; (3) DB10 in the (b) Net Listener component; and (4) DB16 in the (c) Oracle Text component. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that DB06 is SQL injection in the GENERATE_JOB_NAME, GET_WORKERSTATUSLIST1010, GET_PARAMVALUES1010, GET_DUMPFILESET1010, GET_JOBSTATUS1010, ATTACH, and ESTABLISH_REMOTE_CONTEXT functions in DBMS_DATAPUMP. cpe:/a:oracle:database_server:9.2.0.7 cpe:/a:oracle:database_server:10.1.0.5 CVE-2006-0260 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:35.550-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Multiple unspecified vulnerabilities in Oracle Database server 9.2.0.7 and 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB05 in the (a) Data Pump component; (2) DB15 in the (b) Oracle Text component; (3) DB22 in the (c) Streams Apply component; (4) DB23 and (5) DB24 in the (d) Streams Capture component; and (6) DB26 in the (e) Streams Subcomponent. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that DB05 involves SQL injection in the (f) LONG2VARCHAR, LONG2VCMAX, LONG2VCNT, and LONG2CLOB functions in the DBMS_METADATA_UTIL package; (g) MAKE_FILTER, FETCH_VIEWS_ERROR, FETCH_FILTERS, FETCH_VIEWS, SET_FILTER_COMMON, DO_FILTER_SCRIPT, SET_TABLE_FILTERS, and MAKE_FILTER_TEXT functions in the DBMS_METADATA_INT package; and (h) GET_PREPOST_TABLE_ACT function in the DBMS_METADATA package. cpe:/a:oracle:database_server:8.1.7.4 cpe:/a:oracle:database_server:9.0.1.5 cpe:/a:oracle:database_server:9.0.1.5::fips cpe:/a:oracle:database_server:9.2.0.7 cpe:/a:oracle:database_server:10.1.0.5 CVE-2006-0261 2006-01-18T06:03:00.000-05:00 2018-10-19T11:43:36.030-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html MISC http://www.red-database-security.com/advisory/oracle_tde_wallet_password.html BUGTRAQ 20060117 Oracle Database 10g Rel. 2 - Event 10053 logs TDE wallet password in cleartext BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-masterkey-plaintext(24168) XF oracle-january2006-update(24321) Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB07 in the Dictionary component and (2) DB14 in the Oracle Label Security component. NOTE: Oracle has not disputed reliable researcher claims that DB07 involves plaintext storage of the TDE wallet password in a trace file by event 10053. cpe:/a:oracle:database_server:8.1.7.4 cpe:/a:oracle:oracle10g:enterprise_10.1.0.4 cpe:/a:oracle:oracle10g:personal_10.1.0.4 cpe:/a:oracle:oracle10g:standard_10.1.0.4 cpe:/a:oracle:oracle8i:enterprise_8.1.7.4 cpe:/a:oracle:oracle8i:standard_8.1.7.4 cpe:/a:oracle:oracle9i:enterprise_9.0.1.5 cpe:/a:oracle:oracle9i:enterprise_9.0.1.5_fips cpe:/a:oracle:oracle9i:standard_9.2.0.6 CVE-2006-0262 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:35.677-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in the Net Foundation Layer component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB08. cpe:/a:oracle:database_server:8.1.7.4 cpe:/a:oracle:database_server:9.0.1.5 cpe:/a:oracle:database_server:9.0.1.5::fips cpe:/a:oracle:database_server:9.2.0.7 cpe:/a:oracle:database_server:10.1.0.5 cpe:/a:oracle:database_server:10.2.0.1 CVE-2006-0263 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:35.737-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CERT-VN VU#870172 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 CERT TA06-018A VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, 10.1.0.5, and 10.2.0.1 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB09 in the (a) Net Listener component; and (2) DB12 and (3) DB13 in the Network Communications (RPC) component. CVE-2006-0264 2006-01-18T06:03:00.000-05:00 2008-09-10T15:57:21.337-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0259. Reason: This candidate is subsumed by CVE-2006-0259. An error during initial CVE analysis used the wrong set of affected versions for "DB10". Notes: All CVE users should reference CVE-2006-0259 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. cpe:/a:oracle:database_server:8.1.7.4 cpe:/a:oracle:database_server:9.0.1.5 cpe:/a:oracle:database_server:9.2.0.7 cpe:/a:oracle:database_server:10.1.0.5 cpe:/a:oracle:database_server:10.2.0.1 CVE-2006-0265 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:35.830-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html MISC http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.1 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB17 in the Oracle Text component and (2) DB18 in the Program Interface Network component. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that DB17 involves SQL injection in the (a) VALIDATE_STATEMENT and BUILD_DML functions in CTXSYS.DRILOAD; (b) CLEAN_DML function in CTXSYS.DRIDML; (c) GET_ROWID function in CTXSYS.CTX_DOC; (d) BROWSE_WORDS function in CTXSYS.CTX_QUERY; and (e) ODCIINDEXTRUNCATE, ODCIINDEXDROP, and ODCIINDEXDELETE functions in CATINDEXMETHODS. cpe:/a:oracle:database_server:9.0.1.5 cpe:/a:oracle:database_server:9.2.0.7 cpe:/a:oracle:database_server:10.1.0.5 CVE-2006-0266 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:35.893-04:00 9.0 NETWORK LOW SINGLE_INSTANCE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in the Query Optimizer component of Oracle Database server 9.0.1.5, 9.2.0.7, and 10.1.0.5 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB19. cpe:/a:oracle:database_server:9.2.0.6 cpe:/a:oracle:database_server:10.1.0.4 CVE-2006-0267 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:35.957-04:00 9.0 NETWORK LOW SINGLE_INSTANCE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in the Query Optimizer component of Oracle Database server 9.2.0.6 and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB20. cpe:/a:oracle:database_server:9.0.1.5 cpe:/a:oracle:database_server:9.0.1.5::fips cpe:/a:oracle:database_server:9.2.0.6 cpe:/a:oracle:database_server:10.1.0.4 CVE-2006-0268 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:36.017-04:00 9.0 NETWORK LOW SINGLE_INSTANCE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in the Security component of Oracle Database server 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB21. cpe:/a:oracle:oracle10g:standard_10.1.0.5 cpe:/a:oracle:oracle10g:standard_10.2.0.1 CVE-2006-0269 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:36.067-04:00 5.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL NONE http://nvd.nist.gov SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html MISC http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in the Streams Capture component of Oracle Database server 10.1.0.5 and 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB25. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the SET_DIRECTORY_ROOT function in the DBMS_CDC_PUBLISH package. cpe:/a:oracle:database_server:10.2.0.1 CVE-2006-0270 2006-01-18T06:03:00.000-05:00 2018-10-19T11:43:37.873-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html MISC http://www.red-database-security.com/advisory/oracle_tde_unencrypted_sga.html BUGTRAQ 20060117 Oracle Database 10g Rel. 2- Transparent Data Encryption plaintext masterkey in SGA BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-sga-masterkey-plaintext(24186) XF oracle-january2006-update(24321) Unspecified vulnerability in the Transparent Data Encryption (TDE) Wallet component of Oracle Database server 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB27. NOTE: Oracle has not disputed a reliable researcher report that TDA stores the master key without encryption, which allows local users to obtain the key via the SGA. cpe:/a:oracle:database_server:8.1.7.4 cpe:/a:oracle:oracle10g:enterprise_10.1.0.4 cpe:/a:oracle:oracle10g:personal_10.1.0.4 cpe:/a:oracle:oracle10g:standard_10.1.0.4 cpe:/a:oracle:oracle8i:enterprise_8.1.7.4 cpe:/a:oracle:oracle8i:standard_8.1.7.4 cpe:/a:oracle:oracle9i:enterprise_9.0.1.5 cpe:/a:oracle:oracle9i:standard_9.2.0.7 CVE-2006-0271 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:36.207-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html MISC http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB28. NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the DBMS_REGISTRY package in certain parameters to the (1) IS_COMPONENT, (2) GET_COMP_OPTION, (3) DISABLE_DDL_TRIGGERS, (4) SCRIPT_EXISTS, (5) COMP_PATH, (6) GATHER_STATS, (7) NOTHING_SCRIPT, and (8) VALIDATE_COMPONENTS functions. cpe:/a:oracle:oracle10g:enterprise_10.1.0.4 cpe:/a:oracle:oracle10g:personal_10.1.0.4 cpe:/a:oracle:oracle10g:standard_10.1.0.4 cpe:/a:oracle:oracle9i:standard_9.2.0.7 CVE-2006-0272 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:36.330-04:00 9.0 NETWORK LOW SINGLE_INSTANCE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS FULLDISC 20060126 [Argeniss] Oracle Database Buffer overflows vulnerabilities in public procedures of XDB.DBMS_XMLSCHEMA{_INT} SECTRACK 1015499 MISC http://www.argeniss.com/research/ARGENISS-ADV-010601.txt MISC http://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdf CERT-VN VU#545804 CERT-VN VU#891644 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html MISC http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html BID 16287 CERT TA06-018A VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) XF oracle-xdbdbmx-xmlschema-bo(24376) Unspecified vulnerability in the XML Database component of Oracle Database server 9.2.0.7 and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB29. NOTE: based on mutual credits by the relevant sources, it is highly likely that this issue is a buffer overflow in the (a) DBMS_XMLSCHEMA and (b) DBMS_XMLSCHEMA_INT packages, as exploitable via long arguments to (1) XDB.DBMS_XMLSCHEMA.GENERATESCHEMA or (2) XDB.DBMS_XMLSCHEMA.GENERATESCHEMAS. cpe:/a:oracle:application_server:9.0.4.2 cpe:/a:oracle:application_server:10.1.2.0 CVE-2006-0273 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:36.377-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in the Portal component of Oracle Application Server 9.0.4.2 and 10.1.2.0 has unspecified impact and attack vectors, as identified by Oracle Vuln# AS01. cpe:/a:oracle:application_server:9.0.4.2 cpe:/a:oracle:application_server:10.1.2.0.2 CVE-2006-0274 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:36.427-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 and 10.1.2.0.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# REP03. cpe:/a:oracle:application_server:9.0.4.2 CVE-2006-0275 2006-01-18T06:03:00.000-05:00 2018-10-19T11:43:38.657-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html MISC http://www.red-database-security.com/advisory/oracle_reports_read_any_xml_file.html BUGTRAQ 20060117 Oracle Reports - Read parts of files via customize(fixed after 875 days) BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# REP04. NOTE: Oracle has not disputed reliable researcher claims that this issue is related to directory traversal that allows reading of portions of arbitrary XML files via the customize parameter. cpe:/a:oracle:collaboration_suite:9.0.4.2:r2 CVE-2006-0276 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:36.550-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Multiple unspecified vulnerabilities in Oracle Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i) have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) OCS01, 2) OCS02, 3) OCS03, 4) OCS04, 5) OCS05, 6) OCS06, 7) OCS07, (8) OCS08, and (9) OCS09 in the (a) Email Server component; 10) OCS10 (and (11) OCS11 in the (b) Oracle Collaboration Suite Wireless & Voice (component; 12) OCS12 and (13) OCS13 in the (c) Oracle Content (Management SDK component; 14) OCS14 and (15) OCS15 in the (d) Oracle (Content Services component. cpe:/a:oracle:e-business_suite:11.5.10 CVE-2006-0277 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:36.613-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) APPS01 in the (a) Application Install component; (2) APPS07 in the (b) Oracle Applications Framework component; (3) APPS08, (4) APPS09, (5) APPS10, and (6) APPS11 in the (c) Oracle Applications Technology Stack component; (7) APPS12 in the (d) Oracle Human Resources component; (8) APPS15 and (9) APPS16 in the (e) Oracle Marketing component; (10) APPS17 in the (f) Marketing Encyclopedia System component; (11) APPS18 in the (g) Oracle Trade Management component; and (12) APPS19 in the (h) Oracle Web Applications Desktop Integration component. cpe:/a:oracle:e-business_suite:11.5.9 CVE-2006-0278 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:36.677-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.9 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) APPS02 in the (a) CRM Technical Foundation component; (2) APPS03 in the (b) iProcurement component; and (3) APPS04, (4) APPS05, and (5) APPS06 in the Oracle Application Object Library component. cpe:/a:oracle:e-business_suite:4.3 CVE-2006-0279 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:36.737-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 4.3 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) APPS13 and (2) APPS14 in the Oracle iLearning component. cpe:/a:oracle:peoplesoft_enterprise_portal:8.4:bundle15 cpe:/a:oracle:peoplesoft_enterprise_portal:8.8:bundle10 cpe:/a:oracle:peoplesoft_enterprise_portal:8.9:bundle2 CVE-2006-0280 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:36.817-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in Oracle PeopleSoft Enterprise Portal 8.4 Bundle 15, 8.8 Bundle 10, and 8.9 Bundle 2 has unspecified impact and attack vectors, as identified by Oracle Vuln# PSE01. cpe:/a:oracle:enterpriseone:8.95.f1 cpe:/a:oracle:enterpriseone:sp23_l1 CVE-2006-0281 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:36.877-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in Oracle JD Edwards HTML Server 8.95.F1 SP23_L1 has unspecified impact and attack vectors, as identified by Oracle Vuln# JDE01. cpe:/a:oracle:application_server:1.0.2.2:r1 cpe:/a:oracle:application_server:9.0.4.2 cpe:/a:oracle:application_server:10.1.2.0.2 cpe:/a:oracle:application_server:10.1.2.0.2:r2 cpe:/a:oracle:collaboration_suite:9.0.4.2:r2 cpe:/a:oracle:database_server:8.1.7.4 cpe:/a:oracle:database_server:9.0.1.5 cpe:/a:oracle:database_server:9.0.1.5::fips cpe:/a:oracle:database_server:9.2.0.7 cpe:/a:oracle:database_server:10.1.0.5 CVE-2006-0282 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:36.927-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.5, Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, and Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i) has unspecified impact and attack vectors, as identified by Oracle Vuln# DBC01 in the Protocol Support component. cpe:/a:oracle:application_server:10.1.2.0.2 cpe:/a:oracle:collaboration_suite:9.0.4.2:r2 cpe:/a:oracle:database_server:10.1.0.4.2 CVE-2006-0283 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:36.987-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in Oracle Database Server 10.1.0.4.2, Application Server 10.1.2.0.2, and Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i) has unspecified impact and attack vectors, as identified by Oracle Vuln# DBC02 in the Reorganize Objects & Convert Tablespace component. cpe:/a:oracle:application_server:9.0.4.2 cpe:/a:oracle:application_server:10.1.2.0.2:r2 cpe:/a:oracle:e-business_suite:11.5.10 CVE-2006-0284 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:37.033-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Multiple unspecified vulnerabilities in Oracle Application Server 9.0.4.2 and 10.1.2.0.2, and E-Business Suite and Applications 11.5.10, have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) FORM01 and (2) FORM02 in the Oracle Forms component. cpe:/a:oracle:application_server:1.0.2.2 cpe:/a:oracle:application_server:9.0.4.2 cpe:/a:oracle:application_server:10.1.2.0.2 cpe:/a:oracle:database_server:8.1.7.4 cpe:/a:oracle:database_server:9.0.1.5 cpe:/a:oracle:database_server:9.0.1.5::fips cpe:/a:oracle:database_server:9.2.0.7 CVE-2006-0285 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:37.097-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in the Java Net component of Oracle Database Server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.4, and Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, has unspecified impact and attack vectors, as identified by Oracle Vuln# JN01. cpe:/a:oracle:application_server:1.0.2.2 cpe:/a:oracle:application_server:9.0.4.2 cpe:/a:oracle:application_server:10.1.2.0.2 cpe:/a:oracle:database_server:9.0.1.5 cpe:/a:oracle:database_server:9.0.1.5::fips cpe:/a:oracle:database_server:9.2.0.7 cpe:/a:oracle:database_server:10.1.0.5 CVE-2006-0286 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:37.143-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, and 10.1.0.5, and Application Server 1.0.2.2, 9.0.4.2, and 10.1.2.0.2, has unspecified impact and attack vectors, as identified by Oracle Vuln# OHS01. cpe:/a:oracle:application_server:10.1.2.0.2 cpe:/a:oracle:database_server:10.1.0.5 CVE-2006-0287 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:37.207-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 10.1.0.5 and Application Server 10.1.2.0.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# OHS02. cpe:/a:oracle:application_server:9.0.4.1 cpe:/a:oracle:e-business_suite:11.5.10 CVE-2006-0288 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:37.267-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Multiple unspecified vulnerabilities in the Oracle Reports Developer component of Oracle Application Server 9.0.4.1 and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) REP01 and (2) REP02. cpe:/a:oracle:application_server:6.0.8.26_ps17 cpe:/a:oracle:e-business_suite:11.5.10 CVE-2006-0289 2006-01-18T06:03:00.000-05:00 2018-10-19T11:43:39.123-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html MISC http://www.red-database-security.com/advisory/oracle_reports_overwrite_any_file.html MISC http://www.red-database-security.com/advisory/oracle_reports_read_any_file.html BUGTRAQ 20060117 Oracle Reports - Read parts of files via desname (fixed after 874 days) BUGTRAQ 20060117 Oracle Reports - Overwrite any application server file via desname (fixed after 889 days) BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Multiple unspecified vulnerabilities in Oracle Application Server 6.0.8.26(PS17) and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) REP05 and (2) REP06 in the Oracle Reports Developer component. NOTE: Oracle has not disputed reliable researcher claims that REP05 is the same as CVE-2005-2378 and REP06 is the same as CVE-2005-2371, both of which involve directory traversal. cpe:/a:oracle:application_server:9.0.4.2 cpe:/a:oracle:application_server:10.1.2.1 cpe:/a:oracle:collaboration_suite:9.0.4.2:r2 cpe:/a:oracle:database_server:9.2.0.7 cpe:/a:oracle:e-business_suite:11.5.10 CVE-2006-0290 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:37.377-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in Oracle Database Server 9.2.0.7, Application Server 9.0.4.2 and 10.1.2.1, Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i), and E-Business Suite and Applications 11.5.10 has unspecified impact and attack vectors, as identified by Oracle Vuln# WF01 in the Oracle Workflow Cartridge component. cpe:/a:oracle:application_server:9.0.4.2 cpe:/a:oracle:application_server:10.1.2.1.0 cpe:/a:oracle:collaboration_suite:9.0.4.2:r2 cpe:/a:oracle:database_server:10.2.0.1 cpe:/a:oracle:e-business_suite:11.5.10 CVE-2006-0291 2006-01-18T06:03:00.000-05:00 2017-07-19T21:29:37.440-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Multiple unspecified vulnerabilities in Oracle Database Server 10.2.0.1, Application Server 9.0.4.2 and 10.1.2.1, Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i), and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) WF02 and (2) WF03 in the Oracle Workflow Cartridge component. cpe:/a:mozilla:firefox:0.8 cpe:/a:mozilla:firefox:0.9 cpe:/a:mozilla:firefox:0.9:rc cpe:/a:mozilla:firefox:0.9.1 cpe:/a:mozilla:firefox:0.9.2 cpe:/a:mozilla:firefox:0.9.3 cpe:/a:mozilla:firefox:0.10 cpe:/a:mozilla:firefox:0.10.1 cpe:/a:mozilla:firefox:1.0 cpe:/a:mozilla:firefox:1.0.1 cpe:/a:mozilla:firefox:1.0.2 cpe:/a:mozilla:firefox:1.0.3 cpe:/a:mozilla:firefox:1.0.4 cpe:/a:mozilla:firefox:1.0.5 cpe:/a:mozilla:firefox:1.0.6 cpe:/a:mozilla:firefox:1.0.6::linux cpe:/a:mozilla:firefox:1.0.7 cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:firefox:1.5:beta1 cpe:/a:mozilla:mozilla:1.4 cpe:/a:mozilla:mozilla:1.4.1 cpe:/a:mozilla:mozilla:1.5 cpe:/a:mozilla:mozilla:1.5:alpha cpe:/a:mozilla:mozilla:1.5:rc1 cpe:/a:mozilla:mozilla:1.5:rc2 CVE-2006-0292 2006-02-02T15:06:00.000-05:00 2018-10-19T11:43:39.873-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SCO SCOSA-2006.26 SGI 20060201-01-U SECTRACK 1015570 SUNALERT 102550 SUNALERT 228526 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm DEBIAN DSA-1044 DEBIAN DSA-1046 DEBIAN DSA-1051 GENTOO GLSA-200604-12 GENTOO GLSA-200604-18 GENTOO GLSA-200605-09 MANDRIVA MDKSA-2006:036 MANDRIVA MDKSA-2006:037 MANDRIVA MDKSA-2006:078 CONFIRM http://www.mozilla.org/security/announce/2006/mfsa2006-01.html SUSE SUSE-SA:2006:022 FEDORA FEDORA-2006-075 FEDORA FEDORA-2006-076 REDHAT RHSA-2006:0199 REDHAT RHSA-2006:0200 REDHAT RHSA-2006:0330 FEDORA FLSA:180036-1 FEDORA FLSA-2006:180036-2 HP HPSBUX02122 HP SSRT061236 BID 16476 VUPEN ADV-2006-0413 VUPEN ADV-2006-3391 VUPEN ADV-2006-3749 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=316885 XF mozilla-javascript-memory-corruption(24430) UBUNTU USN-271-1 UBUNTU USN-275-1 UBUNTU USN-276-1 The Javascript interpreter (jsinterp.c) in Mozilla and Firefox before 1.5.1 does not properly dereference objects, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via unknown attack vectors related to garbage collection. cpe:/a:mozilla:firefox:1.5 CVE-2006-0293 2006-02-02T15:06:00.000-05:00 2018-10-19T11:43:56.313-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015570 SUNALERT 102550 SUNALERT 228526 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm DEBIAN DSA-1044 DEBIAN DSA-1046 DEBIAN DSA-1051 GENTOO GLSA-200604-18 CONFIRM http://www.mozilla.org/security/announce/2006/mfsa2006-01.html HP HPSBUX02122 HP SSRT061236 BID 16476 VUPEN ADV-2006-0413 VUPEN ADV-2006-3391 VUPEN ADV-2006-3749 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=322045 XF mozilla-javascript-memory-corruption(24430) XF firefox-function-allocation-code-execution(42654) The function allocation code (js_NewFunction in jsfun.c) in Firefox 1.5 allows attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via user-defined methods that trigger garbage collection in a way that operates on freed objects. cpe:/a:mozilla:firefox:0.8 cpe:/a:mozilla:firefox:0.9 cpe:/a:mozilla:firefox:0.9:rc cpe:/a:mozilla:firefox:0.9.1 cpe:/a:mozilla:firefox:0.9.2 cpe:/a:mozilla:firefox:0.9.3 cpe:/a:mozilla:firefox:0.10 cpe:/a:mozilla:firefox:0.10.1 cpe:/a:mozilla:firefox:1.0 cpe:/a:mozilla:firefox:1.0.1 cpe:/a:mozilla:firefox:1.0.2 cpe:/a:mozilla:firefox:1.0.3 cpe:/a:mozilla:firefox:1.0.4 cpe:/a:mozilla:firefox:1.0.5 cpe:/a:mozilla:firefox:1.0.6 cpe:/a:mozilla:firefox:1.0.6::linux cpe:/a:mozilla:firefox:1.0.7 cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:firefox:1.5:beta1 cpe:/a:mozilla:seamonkey:1.0::alpha cpe:/a:mozilla:seamonkey:1.0:beta cpe:/a:mozilla:thunderbird:1.5 CVE-2006-0294 2006-02-02T15:06:00.000-05:00 2018-10-19T11:43:57.953-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015570 CONFIRM http://www.mozilla.org/security/announce/2006/mfsa2006-02.html HP SSRT061236 BID 16476 VUPEN ADV-2006-0413 VUPEN ADV-2006-3749 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=317934 XF mozilla-element-change-memory-corruption(24431) Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory. cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:seamonkey:1.0::alpha cpe:/a:mozilla:seamonkey:1.0:beta cpe:/a:mozilla:thunderbird:1.5 CVE-2006-0295 2006-02-02T15:06:00.000-05:00 2018-10-19T11:43:58.517-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015570 CERT-VN VU#759273 CONFIRM http://www.mozilla.org/security/announce/2006/mfsa2006-04.html HP SSRT061236 BID 16476 CERT TA06-038A VUPEN ADV-2006-0413 VUPEN ADV-2006-3749 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=319296 XF mozilla-queryinterface-memory-corruption(24433) Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the QueryInterface method of the built-in Location and Navigator objects, which leads to memory corruption. cpe:/a:mozilla:firefox:0.8 cpe:/a:mozilla:firefox:0.9 cpe:/a:mozilla:firefox:0.9:rc cpe:/a:mozilla:firefox:0.9.1 cpe:/a:mozilla:firefox:0.9.2 cpe:/a:mozilla:firefox:0.9.3 cpe:/a:mozilla:firefox:0.10 cpe:/a:mozilla:firefox:0.10.1 cpe:/a:mozilla:firefox:1.0 cpe:/a:mozilla:firefox:1.0.1 cpe:/a:mozilla:firefox:1.0.2 cpe:/a:mozilla:firefox:1.0.3 cpe:/a:mozilla:firefox:1.0.4 cpe:/a:mozilla:firefox:1.0.5 cpe:/a:mozilla:firefox:1.0.6 cpe:/a:mozilla:firefox:1.0.6::linux cpe:/a:mozilla:firefox:1.0.7 cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:firefox:1.5:beta1 cpe:/a:mozilla:seamonkey:1.0::alpha cpe:/a:mozilla:seamonkey:1.0:beta CVE-2006-0296 2006-02-02T15:06:00.000-05:00 2018-10-19T11:43:59.127-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov SCO SCOSA-2006.26 SGI 20060201-01-U SECTRACK 1015570 SUNALERT 102550 SUNALERT 228526 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm DEBIAN DSA-1044 DEBIAN DSA-1046 DEBIAN DSA-1051 GENTOO GLSA-200604-12 GENTOO GLSA-200604-18 GENTOO GLSA-200605-09 CERT-VN VU#592425 MANDRIVA MDKSA-2006:036 MANDRIVA MDKSA-2006:037 MANDRIVA MDKSA-2006:078 CONFIRM http://www.mozilla.org/security/announce/2006/mfsa2006-05.html SUSE SUSE-SA:2006:022 FEDORA FEDORA-2006-075 FEDORA FEDORA-2006-076 REDHAT RHSA-2006:0199 REDHAT RHSA-2006:0200 REDHAT RHSA-2006:0330 FEDORA FLSA:180036-1 FEDORA FLSA-2006:180036-2 HP HPSBUX02122 HP SSRT061236 BID 16476 CERT TA06-038A VUPEN ADV-2006-0413 VUPEN ADV-2006-3391 VUPEN ADV-2006-3749 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=319847 XF mozilla-xuldocument-command-execution(24434) UBUNTU USN-271-1 UBUNTU USN-275-1 UBUNTU USN-276-1 The XULDocument.persist function in Mozilla, Firefox before 1.5.0.1, and SeaMonkey before 1.0 does not validate the attribute name, which allows remote attackers to execute arbitrary Javascript by injecting RDF data into the user's localstore.rdf file. cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:firefox:1.5:beta1 cpe:/a:mozilla:seamonkey:1.0::alpha cpe:/a:mozilla:seamonkey:1.0:beta cpe:/a:mozilla:thunderbird:1.5 CVE-2006-0297 2006-02-02T17:02:00.000-05:00 2018-10-19T11:44:06.533-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015570 CONFIRM http://www.mozilla.org/security/announce/2006/mfsa2006-06.html HP SSRT061236 BID 16476 VUPEN ADV-2006-0413 VUPEN ADV-2006-3749 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=319872 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=322215 XF mozilla-component-integer-overflow(24435) Multiple integer overflows in Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the (1) EscapeAttributeValue in jsxml.c for E4X, (2) nsSVGCairoSurface::Init in SVG, and (3) nsCanvasRenderingContext2D.cpp in Canvas. cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:firefox:1.5:beta1 cpe:/a:mozilla:seamonkey:1.0::alpha cpe:/a:mozilla:seamonkey:1.0:beta CVE-2006-0298 2006-02-02T17:02:00.000-05:00 2018-10-19T11:44:07.390-04:00 5.8 NETWORK MEDIUM NONE PARTIAL NONE PARTIAL http://nvd.nist.gov SECTRACK 1015570 CONFIRM http://www.mozilla.org/security/announce/2006/mfsa2006-07.html HP SSRT061236 BID 16476 VUPEN ADV-2006-0413 VUPEN ADV-2006-3749 XF mozilla-xml-parser-dos(24436) The XML parser in Mozilla Firefox before 1.5.0.1 and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly read sensitive data via unknown attack vectors that trigger an out-of-bounds read. cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:firefox:1.5:beta1 cpe:/a:mozilla:seamonkey:1.0::alpha cpe:/a:mozilla:seamonkey:1.0:beta cpe:/a:mozilla:thunderbird:1.5 CVE-2006-0299 2006-02-02T18:06:00.000-05:00 2018-10-19T11:44:08.187-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov SECTRACK 1015570 CONFIRM http://www.mozilla.org/security/announce/2006/mfsa2006-08.html HP SSRT061236 BID 16476 VUPEN ADV-2006-0413 VUPEN ADV-2006-3749 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=322312 XF mozilla-e4x-security-bypass(24437) The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions. cpe:/a:gnu:tar:1.14 cpe:/a:gnu:tar:1.14.1 cpe:/a:gnu:tar:1.15 cpe:/a:gnu:tar:1.15.1 cpe:/a:gnu:tar:1.15.90 CVE-2006-0300 2006-02-23T19:02:00.000-05:00 2018-10-19T11:44:09.673-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://docs.info.apple.com/article.html?artnum=305214 CONFIRM http://docs.info.apple.com/article.html?artnum=305391 APPLE APPLE-SA-2007-04-19 APPLE APPLE-SA-2007-03-13 MLIST [Bug-tar] 20060220 tar 1.15.90 released SREASON 480 SREASON 543 SECTRACK 1015705 SUNALERT 241646 DEBIAN DSA-987 GENTOO GLSA-200603-06 SUSE SUSE-SR:2006:005 OPENPKG OpenPKG-SA-2006.006 REDHAT RHSA-2006:0232 FEDORA FLSA:183571-2 BID 16764 TRUSTIX 2006-0010 CERT TA07-072A CERT TA07-109A VUPEN ADV-2006-0684 VUPEN ADV-2007-0930 VUPEN ADV-2007-1470 VUPEN ADV-2008-2518 MANDRIVA MDKSA-2006:046 XF gnu-tar-pax-headers-bo(24855) UBUNTU USN-257-1 Buffer overflow in tar 1.14 through 1.15.90 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute code via unspecified vectors involving PAX extended headers. cpe:/a:xpdf:xpdf CVE-2006-0301 2006-01-30T17:03:00.000-05:00 2018-10-19T11:44:14.393-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SCO SCOSA-2006.15 REDHAT RHSA-2006:0206 SREASON 470 SECTRACK 1015576 SLACKWARE SSA:2006-045-09 SLACKWARE SSA:2006-045-04 DEBIAN DSA-971 DEBIAN DSA-972 DEBIAN DSA-974 GENTOO GLSA-200602-04 GENTOO GLSA-200602-05 GENTOO GLSA-200602-12 MISC http://www.kde.org/info/security/advisory-20060202-1.txt MANDRIVA MDKSA-2006:030 MANDRIVA MDKSA-2006:031 MANDRIVA MDKSA-2006:032 FEDORA FEDORA-2006-103 REDHAT RHSA-2006:0201 BUGTRAQ 20060202 [KDE Security Advisory] kpdf/xpdf heap based buffer overflow FEDORA FLSA:175404 UBUNTU USN-249-1 VUPEN ADV-2006-0389 VUPEN ADV-2006-0422 CONFIRM https://bugzilla.novell.com/show_bug.cgi?id=141242 MISC https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179046 XF xpdf-splash-bo(24391) Heap-based buffer overflow in Splash.cc in xpdf, as used in other products such as (1) poppler, (2) kdegraphics, (3) gpdf, (4) pdfkit.framework, and others, allows attackers to cause a denial of service and possibly execute arbitrary code via crafted splash images that produce certain values that exceed the width or height of the associated bitmap. cpe:/h:zyxel:p2000w_version_2_voip_wifi_phone:wv.00.02 CVE-2006-0302 2006-01-18T19:03:00.000-05:00 2017-07-19T21:29:38.393-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov FULLDISC 20060116 ZyXel P2000W (Version 2) VoIP wireless phone undocumented port UDP/9090 BID 16285 XF zyxel-p2000w-default-port(24145) ZyXel P2000W VoIP 802.11b Wireless Phone running firmware WV.00.02 allows remote attackers to obtain sensitive information, such as MAC address and software version, by directly accessing UDP port 9090. cpe:/a:joomla:joomla:1.0 cpe:/a:joomla:joomla:1.0.1 cpe:/a:joomla:joomla:1.0.2 cpe:/a:joomla:joomla:1.0.3 cpe:/a:joomla:joomla:1.0.4 cpe:/a:joomla:joomla:1.0.5 CVE-2006-0303 2006-01-18T19:03:00.000-05:00 2008-09-05T16:58:53.340-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov 2006-01-19T09:08:00.000-05:00 CONFIRM http://www.joomla.org/content/view/738/66/ Multiple unspecified vulnerabilities in the (1) publishing component, (2) Contact Component, (3) TinyMCE Compressor, and (4) other components in Joomla! 1.0.5 and earlier have unknown impact and attack vectors. cpe:/a:achal_dhir:dual_dhcp_dns_server:1.0 CVE-2006-0304 2006-01-18T19:03:00.000-05:00 2017-07-19T21:29:38.440-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://aluigi.altervista.org/adv/dualsbof-adv.txt SECTRACK 1015495 BID 16298 VUPEN ADV-2006-0245 XF dualdhcpdns-options-field-bo(24191) Buffer overflow in Dual DHCP DNS Server 1.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the DHCP options field. cpe:/h:clipcomm:cp-100e_voip_wifi_phone:1.1.60 cpe:/h:clipcomm:cpw-100e_voip_wifi_phone:1.1.12 CVE-2006-0305 2006-01-18T19:03:00.000-05:00 2017-07-19T21:29:38.503-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060116 Clipcomm CPW-100E VoIP wireless handset phone open debug service TCP/60023 FULLDISC 20060116 Clipcomm CP-100E VoIP wireless desktop phone open debug service TCP/60023 BID 16289 XF clipcomm-cp100e-default-port(24144) Clipcomm CPW-100E VoIP 802.11b Wireless Handset Phone running firmware 1.1.12 (051129) and CP-100E VoIP 802.11b Wireless Phone running firmware 1.1.60 allows remote attackers to gain unauthorized access via the debug service on TCP port 60023. cpe:/a:ca:brightstor_arcserve_backup_laptops_desktops:11.0 cpe:/a:ca:brightstor_arcserve_backup_laptops_desktops:11.1 cpe:/a:ca:brightstor_arcserve_backup_laptops_desktops:11.1:sp1 cpe:/a:ca:brightstor_mobile_backup:r4.0 cpe:/a:ca:business_protection_suite:2.0 cpe:/a:ca:desktop_protection_suite:2.0 cpe:/a:ca:server_protection_suite:2 cpe:/a:ca:unicenter_remote_control:5.2 cpe:/a:ca:unicenter_remote_control:6.0 cpe:/a:ca:unicenter_remote_control:6.0:sp1 cpe:/a:ca:unicenter_remote_control:6.0:sp1::en cpe:/a:ca:unicenter_remote_control:6.0:sp1::fr cpe:/a:ca:unicenter_remote_control:6.0_build_6.0.56.3:::en cpe:/a:ca:unicenter_remote_control:6.0_build_6.0.74:::de cpe:/a:ca:unicenter_remote_control:6.0_build_6.0.74:::en cpe:/a:ca:unicenter_remote_control:6.0_build_6.0.74:::fr CVE-2006-0306 2006-01-18T19:03:00.000-05:00 2018-10-19T11:44:18.720-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SECTRACK 1015504 CONFIRM http://supportconnectw.ca.com/public/ca_common_docs/dmdeploysecurity_notice.asp MISC http://www.designfolks.com.au/karma/DMPrimer/ BUGTRAQ 20060118 CAID 33756 - DM Deployment Common Component Vulnerabilities BID 16276 VUPEN ADV-2006-0236 CONFIRM http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33756 The DM Primer (dmprimer.exe) in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0, BrightStor ARCserve Backup for Laptops & Desktops r11.0, r11.1, r11.1 SP1, Unicenter Remote Control 6.0, 6.0 SP1, CA Desktop Protection Suite r2, CA Server Protection Suite r2, and CA Business Protection Suite r2 allows remote attackers to cause a denial of service (CPU consumption or application hang) via a large network packet, which causes a WSAEMESGSIZE error code that is not handled, leading to a thread exit. cpe:/a:ca:brightstor_arcserve_backup_laptops_desktops:11.0 cpe:/a:ca:brightstor_arcserve_backup_laptops_desktops:11.1 cpe:/a:ca:brightstor_arcserve_backup_laptops_desktops:11.1:sp1 cpe:/a:ca:brightstor_mobile_backup:r4.0 cpe:/a:ca:business_protection_suite:2.0 cpe:/a:ca:desktop_protection_suite:2.0 cpe:/a:ca:server_protection_suite:2 cpe:/a:ca:unicenter_remote_control:5.2 cpe:/a:ca:unicenter_remote_control:6.0 cpe:/a:ca:unicenter_remote_control:6.0:sp1 cpe:/a:ca:unicenter_remote_control:6.0:sp1::en cpe:/a:ca:unicenter_remote_control:6.0:sp1::fr cpe:/a:ca:unicenter_remote_control:6.0_build_6.0.56.3:::en cpe:/a:ca:unicenter_remote_control:6.0_build_6.0.74:::de cpe:/a:ca:unicenter_remote_control:6.0_build_6.0.74:::en cpe:/a:ca:unicenter_remote_control:6.0_build_6.0.74:::fr CVE-2006-0307 2006-01-18T19:03:00.000-05:00 2018-10-19T11:44:19.330-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SECTRACK 1015504 CONFIRM http://supportconnectw.ca.com/public/ca_common_docs/dmdeploysecurity_notice.asp BUGTRAQ 20060118 CAID 33756 - DM Deployment Common Component Vulnerabilities BID 16276 VUPEN ADV-2006-0236 CONFIRM http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33756 The DM Primer in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0, BrightStor ARCserve Backup for Laptops & Desktops r11.0, r11.1, r11.1 SP1, Unicenter Remote Control 6.0, 6.0 SP1, CA Desktop Protection Suite r2, CA Server Protection Suite r2, and CA Business Protection Suite r2 allows remote attackers to cause a denial of service (CPU consumption and log file consumption) via unspecified "unrecognized network messages" that are not properly handled. cpe:/a:htmltonuke:htmltonuke:2.0_alpha CVE-2006-0308 2006-01-18T19:03:00.000-05:00 2017-10-10T21:30:37.157-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BID 16282 XF htmltonuke-htmltonuke-file-include(33092) EXPLOIT-DB 3524 PHP remote file inclusion vulnerability in htmltonuke.php in the htmltonuke 2.0 alpha, and possibly other versions, module for PHP-Nuke allows remote attackers to execute arbitrary PHP code via a URL in the filnavn parameter. cpe:/h:linksys:befvp41:1.01.04 CVE-2006-0309 2006-01-18T20:03:00.000-05:00 2018-10-19T11:44:19.940-04:00 4.0 NETWORK LOW SINGLE_INSTANCE NONE NONE PARTIAL http://nvd.nist.gov SECTRACK 1015490 BUGTRAQ 20060113 Linksys VPN Router (BEFVP41) DoS Vulnerability BUGTRAQ 20060116 Re: Linksys VPN Router (BEFVP41) DoS Vulnerability BUGTRAQ 20060117 Re: Linksys VPN Router (BEFVP41) DoS Vulnerability BID 16307 VUPEN ADV-2006-0238 XF linksys-null-length-dos(24125) Linksys BEFVP41 VPN Router 2.0 with firmware 1.01.04 allows remote attackers on the local network, to cause a denial of service via IP packets with a null IP option length. cpe:/a:mike_helton:aoblogger:2.3 CVE-2006-0310 2006-01-18T20:03:00.000-05:00 2017-07-19T21:29:38.660-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060117 [eVuln] aoblogger Multiple Vulnerabilities MISC http://evuln.com/vulns/37/summary.html CONFIRM http://mikeheltonisawesome.com/viewcomments.php?idd=46 BID 16286 VUPEN ADV-2006-0240 XF aoblogger-url-xss(24141) Cross-site scripting (XSS) vulnerability in aoblogger 2.3 allows remote attackers to inject arbitrary Javascript via a javascript URI in the BBcode url tag. cpe:/a:mike_helton:aoblogger:2.3 CVE-2006-0311 2006-01-18T20:03:00.000-05:00 2017-07-19T21:29:38.723-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060117 [eVuln] aoblogger Multiple Vulnerabilities MISC http://evuln.com/vulns/37/summary.html CONFIRM http://mikeheltonisawesome.com/viewcomments.php?idd=46 BID 16286 VUPEN ADV-2006-0240 XF aoblogger-login-sql-injection(24142) SQL injection vulnerability in login.php in aoblogger 2.3 allows remote attackers to execute arbitrary SQL commands via the username parameter. cpe:/a:mike_helton:aoblogger:2.3 CVE-2006-0312 2006-01-18T20:03:00.000-05:00 2017-07-19T21:29:38.770-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060117 [eVuln] aoblogger Multiple Vulnerabilities MISC http://evuln.com/vulns/37/summary.html CONFIRM http://mikeheltonisawesome.com/viewcomments.php?idd=46 BID 16286 VUPEN ADV-2006-0240 XF aoblogger-create-security-bypass(24143) create.php in aoblogger 2.3 allows remote attackers to bypass authentication and create new blog entries by setting the uza parameter to 1. cpe:/a:pdfdirectory:pdfdirectory:0.2.2 cpe:/a:pdfdirectory:pdfdirectory:0.2.3 cpe:/a:pdfdirectory:pdfdirectory:0.2.4 cpe:/a:pdfdirectory:pdfdirectory:0.2.5 cpe:/a:pdfdirectory:pdfdirectory:0.2.6 cpe:/a:pdfdirectory:pdfdirectory:0.2.7 cpe:/a:pdfdirectory:pdfdirectory:0.2.8 cpe:/a:pdfdirectory:pdfdirectory:0.2.9 cpe:/a:pdfdirectory:pdfdirectory:0.2.10 cpe:/a:pdfdirectory:pdfdirectory:0.2.11 CVE-2006-0313 2006-01-18T20:03:00.000-05:00 2011-03-07T21:29:46.110-05:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://sourceforge.net/project/shownotes.php?release_id=382411&group_id=122682 BID 16273 VUPEN ADV-2006-0231 Multiple SQL injection vulnerabilities in PDFdirectory before 1.0 allow remote attackers to execute arbitrary SQL commands via multiple unspecified vectors involving (1) util.php, (2) userpref.php, (3) user.php, (4) uploadfrm.php, (5) title.php, (6) team.php, (7) stats.php, (8) page.php, (9) org.php, (10) member.php, (11) index.php, (12) group.php, or (13) anniv.php. cpe:/a:pdfdirectory:pdfdirectory:0.2.2 cpe:/a:pdfdirectory:pdfdirectory:0.2.3 cpe:/a:pdfdirectory:pdfdirectory:0.2.4 cpe:/a:pdfdirectory:pdfdirectory:0.2.5 cpe:/a:pdfdirectory:pdfdirectory:0.2.6 cpe:/a:pdfdirectory:pdfdirectory:0.2.7 cpe:/a:pdfdirectory:pdfdirectory:0.2.8 cpe:/a:pdfdirectory:pdfdirectory:0.2.9 cpe:/a:pdfdirectory:pdfdirectory:0.2.10 cpe:/a:pdfdirectory:pdfdirectory:0.2.11 CVE-2006-0314 2006-01-18T20:03:00.000-05:00 2011-03-07T21:29:46.203-05:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-01-19T08:25:00.000-05:00 ALLOWS_OTHER_ACCESS CONFIRM http://sourceforge.net/project/shownotes.php?release_id=382411&group_id=122682 PDFdirectory before 1.0 stores sensitive data in plaintext, which allows remote attackers to obtain arbitrary users' passwords by direct queries to the database, possibly via one of the SQL injection vulnerabilities. cpe:/a:indexcor:ezdatabase:2.1.1 CVE-2006-0315 2006-01-18T20:03:00.000-05:00 2018-10-19T11:44:20.597-04:00 5.8 NETWORK MEDIUM NONE PARTIAL PARTIAL NONE http://nvd.nist.gov FULLDISC 20060115 EZDatabase Directory Transversal, XSS and Path Disclosure Vulnerability BUGTRAQ 20060115 EZDatabase Directory Transversal, XSS and Path Disclosure Vulnerability BID 16257 MISC http://zur.homelinux.com/Advisories/ezdatabase_dir_trans.txt XF ezdatabase-index-p-xss(24134) XF ezdatabase-index-p-path-disclosure(24135) index.php in EZDatabase before 2.1.2 does not properly cleanse the p parameter before constructing and including a .php filename, which allows remote attackers to conduct directory traversal attacks, and produces resultant cross-site scripting (XSS) and path disclosure. cpe:/a:aol:aol_client_software:8.0 cpe:/a:aol:aol_client_software:8.0::plus cpe:/a:aol:aol_client_software:9.0::classic CVE-2006-0316 2006-01-18T20:03:00.000-05:00 2017-07-19T21:29:38.893-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS MISC http://news.com.com/2061-10789_3-6027865.html?part=rss&tag=6027865&subj=news SECTRACK 1015494 CERT-VN VU#715730 CONFIRM http://www.kb.cert.org/vuls/id/MIMG-6KRSQP BID 16262 VUPEN ADV-2006-0221 XF aol-youvegotpictures-activex-bo(24160) Buffer overflow in YGPPicFinder.DLL in AOL You've Got Pictures (YGP) Picture Finder Tool ActiveX Control, as used in AOL 8.0, 8.0 Plus, and 9.0 Classic, allows remote attackers to execute arbitrary code via unspecified vectors. cpe:/a:redkernel:referrer_tracker:1.1.0_3 CVE-2006-0317 2006-01-18T20:03:00.000-05:00 2017-07-19T21:29:38.973-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16266 VUPEN ADV-2006-0197 XF referertracker-rkrtstats-xss(24151) Cross-site scripting (XSS) vulnerability in rkrt_stats.php in RedKernel Referrer Tracker 1.1.0-3 allows remote attackers to inject arbitrary web script or HTML via a query string value as a GET, which is stored in the $QUERY_STRING variable. NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information. cpe:/a:insane_visions:blogphp:1.0 CVE-2006-0318 2006-01-18T20:03:00.000-05:00 2018-10-19T11:44:21.173-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/34/summary BUGTRAQ 20060117 [eVuln] BlogPHP Authentication Bypass BID 16269 VUPEN ADV-2006-0204 XF blogphp-index-bypass-security(24131) SQL injection vulnerability in index.php in BlogPHP 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in a login action. cpe:/a:farmers_wife:farmers_wife:4.4_sp1 CVE-2006-0319 2006-01-18T20:03:00.000-05:00 2017-07-19T21:29:39.113-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060113 Farmers wife 4.4 sp1 remote SYSTEM access MISC http://www.lort.dk/DSR-farmerswife44sp1.pl BID 16321 XF farmerswife-ftp-directory-traversal(24190) Directory traversal vulnerability in the FTP server (port 22003/tcp) in Farmers WIFE 4.4 SP1 allows remote attackers to create arbitrary files via ".." (dot dot) sequences in a (1) PUT, (2) SIZE, and possibly other commands. cpe:/a:bit_5_blog:bit_5_blog:8.01 CVE-2006-0320 2006-01-18T20:03:00.000-05:00 2018-10-19T11:44:21.690-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/31/summary BUGTRAQ 20060115 [eVuln] Bit 5 Blog SQL Injection & Authentication Bypass Vulnerability BID 16244 VUPEN ADV-2006-0195 XF bit5blog-processlogin-sql-injection(24124) SQL injection vulnerability in admin/processlogin.php in Bit 5 Blog 8.01 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password parameter. cpe:/a:fetchmail:fetchmail:6.3.0 cpe:/a:fetchmail:fetchmail:6.3.1 CVE-2006-0321 2006-01-23T19:03:00.000-05:00 2018-10-19T11:44:22.190-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=348747 CONFIRM http://developer.berlios.de/project/shownotes.php?release_id=8784 CONFIRM http://fetchmail.berlios.de/fetchmail-SA-2006-01.txt APPLE APPLE-SA-2006-08-01 SECTRACK 1015527 SLACKWARE SSA:2006-045-01 BUGTRAQ 20060122 fetchmail security announcement fetchmail-SA-2006-01 (CVE-2006-0321) BID 16365 BID 19289 CERT TA06-214A VUPEN ADV-2006-0300 VUPEN ADV-2006-3101 XF fetchmail-message-bounce-dos(24265) fetchmail 6.3.0 and other versions before 6.3.2 allows remote attackers to cause a denial of service (crash) via crafted e-mail messages that cause a free of an invalid pointer when fetchmail bounces the message to the originator or local postmaster. cpe:/a:mediawiki:mediawiki:1.4.1 cpe:/a:mediawiki:mediawiki:1.4.2 cpe:/a:mediawiki:mediawiki:1.4.3 cpe:/a:mediawiki:mediawiki:1.4.4 cpe:/a:mediawiki:mediawiki:1.4.5 cpe:/a:mediawiki:mediawiki:1.4.6 cpe:/a:mediawiki:mediawiki:1.4.7 cpe:/a:mediawiki:mediawiki:1.4.8 cpe:/a:mediawiki:mediawiki:1.4.9 cpe:/a:mediawiki:mediawiki:1.4.10 cpe:/a:mediawiki:mediawiki:1.4.11 cpe:/a:mediawiki:mediawiki:1.4.12 cpe:/a:mediawiki:mediawiki:1.4.13 cpe:/a:mediawiki:mediawiki:1.4.14 cpe:/a:mediawiki:mediawiki:1.4_beta1 cpe:/a:mediawiki:mediawiki:1.4_beta2 cpe:/a:mediawiki:mediawiki:1.4_beta3 cpe:/a:mediawiki:mediawiki:1.4_beta4 cpe:/a:mediawiki:mediawiki:1.4_beta5 cpe:/a:mediawiki:mediawiki:1.4_beta6 cpe:/a:mediawiki:mediawiki:1.5.0 cpe:/a:mediawiki:mediawiki:1.5.1 cpe:/a:mediawiki:mediawiki:1.5.2 cpe:/a:mediawiki:mediawiki:1.5.3 cpe:/a:mediawiki:mediawiki:1.5.4 cpe:/a:mediawiki:mediawiki:1.5.5 cpe:/a:mediawiki:mediawiki:1.5_alpha1 cpe:/a:mediawiki:mediawiki:1.5_alpha2 cpe:/a:mediawiki:mediawiki:1.5_beta1 cpe:/a:mediawiki:mediawiki:1.5_beta2 cpe:/a:mediawiki:mediawiki:1.5_beta3 cpe:/a:mediawiki:mediawiki:1.5_beta4 cpe:/a:mediawiki:mediawiki:1.5_rc2 cpe:/a:mediawiki:mediawiki:1.5_rc3 cpe:/a:mediawiki:mediawiki:1.5_rc4 CVE-2006-0322 2006-01-19T16:03:00.000-05:00 2017-07-19T21:29:39.317-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SUSE SUSE-SR:2006:003 CONFIRM http://sourceforge.net/project/shownotes.php?release_id=386609 VUPEN ADV-2006-0392 XF mediawiki-comment-format-dos(24478) Unspecified vulnerability the edit comment formatting functionality in MediaWiki 1.5.x before 1.5.6 and 1.4.x before 1.4.14 allows attackers to cause a denial of service (infinite loop) via "certain malformed links." cpe:/a:realnetworks:helix_player cpe:/a:realnetworks:realone_player cpe:/a:realnetworks:realplayer:10.0:gold cpe:/a:realnetworks:realplayer:10.0.6 cpe:/a:realnetworks:realplayer:10.5 cpe:/a:realnetworks:rhapsody:3 CVE-2006-0323 2006-03-23T18:06:00.000-05:00 2018-10-19T11:44:23.457-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SREASON 690 SECTRACK 1015806 GENTOO GLSA-200603-24 CERT-VN VU#231028 SUSE SUSE-SA:2006:018 REDHAT RHSA-2006:0257 BUGTRAQ 20060411 Realplayer .SWF Multiple Remote Memory Corruption Vulnerabilities BID 17202 CONFIRM http://www.service.real.com/realplayer/security/03162006_player/en/ VUPEN ADV-2006-1057 XF realnetworks-swf-bo(25408) Buffer overflow in swfformat.dll in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, Rhapsody 3, and Helix Player allows remote attackers to execute arbitrary code via a crafted SWF (Flash) file with (1) a size value that is less than the actual size, or (2) other unspecified manipulations. cpe:/a:webspot:webspotblogging:3.0 CVE-2006-0324 2006-01-19T16:03:00.000-05:00 2018-10-19T11:44:24.610-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/41/summary.html SREASON 356 SECTRACK 1015522 BUGTRAQ 20060119 [eVuln] WebspotBlogging Authentication Bypass Vulnerability BID 16319 VUPEN ADV-2006-0268 XF webspotblogging-login-sql-injection(24222) CONFIRM https://sourceforge.net/forum/forum.php?forum_id=532233 CONFIRM https://sourceforge.net/project/shownotes.php?release_id=387180&group_id=156586 SQL injection vulnerability in WebspotBlogging 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter to login.php. cpe:/a:etomite:etomite:0.6 CVE-2006-0325 2006-01-20T16:03:00.000-05:00 2018-10-19T11:44:25.377-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://www.etomite.org/forums/index.php?showtopic=4185 CONFIRM http://www.etomite.org/forums/index.php?showtopic=4291 MISC http://www.lucaercoli.it/advs/etomite.txt BUGTRAQ 20060127 Etomite CMS "Backdoored" BUGTRAQ 20060130 Etomite followup information BID 16336 VUPEN ADV-2006-0283 XF etomite-default-backdoor(24254) Etomite Content Management System 0.6, and possibly earlier versions, when downloaded from the web site in January 2006 after January 10, contains a back door in manager/includes/todo.inc.php, which allows remote attackers to execute arbitrary commands via the "cij" parameter. cpe:/a:typo3:typo3:3.7.1 cpe:/a:typo3:typo3:3.8.1 CVE-2006-0327 2006-01-20T19:03:00.000-05:00 2018-10-19T11:44:26.127-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://bugs.typo3.org/view.php?id=2248 SREASON 361 MISC http://www.irmplc.com/advisory015.htm BUGTRAQ 20060119 IRM 015: File system path disclosure on TYPO3 Web Content Manager BUGTRAQ 20060119 Re: IRM 015: File system path disclosure on TYPO3 Web Content Manager VUPEN ADV-2006-0269 XF typo3-multiple-path-disclosure(24244) TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to (1) thumbs.php, (2) showpic.php, or (3) tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails. cpe:/a:philippe_jounin:tftpd32:2.81 CVE-2006-0328 2006-01-20T19:03:00.000-05:00 2018-10-19T11:44:26.940-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SREASON 362 MISC http://www.critical.lt/?vulnerabilities/200 MISC http://www.critical.lt/research/tftpd32_281_dos.txt CERT-VN VU#632633 BUGTRAQ 20060119 Critical security advisory #006 tftpd32 Format string BID 16333 VUPEN ADV-2006-0263 XF tftpd32-request-format-string(24250) Format string vulnerability in Tftpd32 2.81 allows remote attackers to cause a denial of service via format string specifiers in a filename in a (1) GET or (2) SEND request. cpe:/a:hitachi:hitsenser_data_mart_server:bs cpe:/a:hitachi:hitsenser_data_mart_server:bs_l cpe:/a:hitachi:hitsenser_data_mart_server:bs_m cpe:/a:hitachi:hitsenser_data_mart_server:bs_s cpe:/a:hitachi:hitsenser_data_mart_server:ex CVE-2006-0329 2006-01-20T19:03:00.000-05:00 2017-07-19T21:29:39.753-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1015519 CONFIRM http://www.hitachi-support.com/security_e/vuls_e/HS05-026_e/index-e.html BID 16326 VUPEN ADV-2006-0266 XF hitachi-hitsenser-sql-injection(24240) SQL injection vulnerability in HITSENSER Data Mart Server BS, BS-S, BS-M, BS-L, and EX allows remote attackers to execute arbitrary SQL commands via unknown attack vectors. cpe:/a:gallery_project:gallery:1.3.4 cpe:/a:gallery_project:gallery:1.4 cpe:/a:gallery_project:gallery:1.4.1 cpe:/a:gallery_project:gallery:1.4.2 cpe:/a:gallery_project:gallery:1.4.3_pl1 cpe:/a:gallery_project:gallery:1.4.3_pl2 cpe:/a:gallery_project:gallery:1.4.4_pl2 cpe:/a:gallery_project:gallery:1.4.4_pl3 cpe:/a:gallery_project:gallery:1.4.4_pl4 cpe:/a:gallery_project:gallery:1.4.4_pl5 cpe:/a:gallery_project:gallery:1.4_pl1 cpe:/a:gallery_project:gallery:1.4_pl2 cpe:/a:gallery_project:gallery:1.5 cpe:/a:gallery_project:gallery:1.5.1 cpe:/a:gallery_project:gallery:1.5.1_rc2 cpe:/a:gallery_project:gallery:1.5.2_rc2 CVE-2006-0330 2006-01-20T19:03:00.000-05:00 2017-07-19T21:29:39.817-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=325285 CONFIRM http://gallery.menalto.com/page/gallery_1_5_2_release GENTOO GLSA-200601-13 BID 16334 DEBIAN DSA-1148 VUPEN ADV-2006-0282 XF gallery-unknown-xss(24247) Cross-site scripting (XSS) vulnerability in Gallery before 1.5.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, possibly involving the user name (fullname). cpe:/a:thiago_melo_de_paula:change_passwd:3.1 CVE-2006-0331 2006-01-20T19:03:00.000-05:00 2018-10-19T11:44:27.657-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SREASON 363 BUGTRAQ 20060119 Change passwd 3.1 (SquirrelMail plugin ) MISC http://www.squirrelmail.org/plugin_view.php?id=117 XF changepassword-changepasswd-bo(24258) Buffer overflow in Change passwd 3.1 (chpasswd) SquirrelMail plugin allows local users to execute arbitrary code via long command line arguments. cpe:/a:ecartis:ecartis:1.0.0_snapshot_2005-09-09 CVE-2006-0332 2006-01-20T19:03:00.000-05:00 2017-07-19T21:29:39.927-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov MLIST [listar-dev] 20060115 [EDev] Re: Potential vulnerability -- who to contact? MLIST [listar-dev] 20060119 [EDev] Re: Potential vulnerability -- who to contact? BID 16317 VUPEN ADV-2006-0260 XF ecartis-pantomime-bypass-security(24220) Pantomime in Ecartis 1.0.0 snapshot 20050909 stores e-mail attachments in a publicly accessible directory, which may allow remote attackers to upload arbitrary files. cpe:/a:ar-blog:ar-blog:5.2 CVE-2006-0333 2006-01-20T19:03:00.000-05:00 2018-10-19T11:44:27.970-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060118 -2- [XSS] in ar-blog v 5.2 BUGTRAQ 20060527 Multiple Xss exploits in ar-blog v 5.2 XF arblog-index-xss(24246) Cross-site scripting (XSS) vulnerability in ar-blog 5.2 allows remote attackers to inject arbitrary web script or HTML via the (1) month or (2) year parameter to index.php. cpe:/a:freekrai.net:my_amazon_store_manager:1.0 CVE-2006-0334 2006-01-20T19:03:00.000-05:00 2017-07-19T21:29:40.033-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16312 VUPEN ADV-2006-0252 XF masm-search-xss(24230) Cross-site scripting (XSS) vulnerability in search.php in My Amazon Store Manager 1.0 allows remote attackers to inject arbitrary web script or HTML via the Keywords parameter. NOTE: some sources claim that the affected parameter is "q", but the only public archive of the original researcher notification shows an XSS manipulation in "Keywords". cpe:/a:kerio:winroute_firewall:5.0.1 cpe:/a:kerio:winroute_firewall:5.0.2 cpe:/a:kerio:winroute_firewall:5.0.3 cpe:/a:kerio:winroute_firewall:5.0.4 cpe:/a:kerio:winroute_firewall:5.0.5 cpe:/a:kerio:winroute_firewall:5.0.6 cpe:/a:kerio:winroute_firewall:5.0.7 cpe:/a:kerio:winroute_firewall:5.0.8 cpe:/a:kerio:winroute_firewall:5.0.9 cpe:/a:kerio:winroute_firewall:5.1 cpe:/a:kerio:winroute_firewall:5.1.1 cpe:/a:kerio:winroute_firewall:5.1.2 cpe:/a:kerio:winroute_firewall:5.1.3 cpe:/a:kerio:winroute_firewall:5.1.4 cpe:/a:kerio:winroute_firewall:5.1.5 cpe:/a:kerio:winroute_firewall:5.1.6 cpe:/a:kerio:winroute_firewall:5.1.7 cpe:/a:kerio:winroute_firewall:5.1.8 cpe:/a:kerio:winroute_firewall:5.1.9 cpe:/a:kerio:winroute_firewall:5.1.10 cpe:/a:kerio:winroute_firewall:5.10 cpe:/a:kerio:winroute_firewall:6.0.0 cpe:/a:kerio:winroute_firewall:6.0.1 cpe:/a:kerio:winroute_firewall:6.0.2 cpe:/a:kerio:winroute_firewall:6.0.3 cpe:/a:kerio:winroute_firewall:6.0.4 cpe:/a:kerio:winroute_firewall:6.0.5 cpe:/a:kerio:winroute_firewall:6.0.6 cpe:/a:kerio:winroute_firewall:6.0.7 cpe:/a:kerio:winroute_firewall:6.0.8 cpe:/a:kerio:winroute_firewall:6.0.9 cpe:/a:kerio:winroute_firewall:6.0.10 cpe:/a:kerio:winroute_firewall:6.0.11 cpe:/a:kerio:winroute_firewall:6.1.0 cpe:/a:kerio:winroute_firewall:6.1.1 cpe:/a:kerio:winroute_firewall:6.1.2 cpe:/a:kerio:winroute_firewall:6.1.3 cpe:/a:kerio:winroute_firewall:6.1.3_patch1 cpe:/a:kerio:winroute_firewall:6.1.4 CVE-2006-0335 2006-01-20T19:03:00.000-05:00 2017-07-19T21:29:40.097-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://www.kerio.com/kwf_history.html BID 16314 VUPEN ADV-2006-0247 XF kerio-winroute-html-dos(24232) XF kerio-winroute-activedirectory-dos(24233) Multiple unspecified vulnerabilities in Kerio WinRoute Firewall before 6.1.4 Patch 1 allow remote attackers to cause a denial of service via multiple unspecified vectors involving (1) long strings received from Active Directory and (2) the filtering of HTML. cpe:/a:kerio:winroute_firewall:5.0.1 cpe:/a:kerio:winroute_firewall:5.0.2 cpe:/a:kerio:winroute_firewall:5.0.3 cpe:/a:kerio:winroute_firewall:5.0.4 cpe:/a:kerio:winroute_firewall:5.0.5 cpe:/a:kerio:winroute_firewall:5.0.6 cpe:/a:kerio:winroute_firewall:5.0.7 cpe:/a:kerio:winroute_firewall:5.0.8 cpe:/a:kerio:winroute_firewall:5.0.9 cpe:/a:kerio:winroute_firewall:5.1 cpe:/a:kerio:winroute_firewall:5.1.1 cpe:/a:kerio:winroute_firewall:5.1.2 cpe:/a:kerio:winroute_firewall:5.1.3 cpe:/a:kerio:winroute_firewall:5.1.4 cpe:/a:kerio:winroute_firewall:5.1.5 cpe:/a:kerio:winroute_firewall:5.1.6 cpe:/a:kerio:winroute_firewall:5.1.7 cpe:/a:kerio:winroute_firewall:5.1.8 cpe:/a:kerio:winroute_firewall:5.1.9 cpe:/a:kerio:winroute_firewall:5.1.10 cpe:/a:kerio:winroute_firewall:5.10 cpe:/a:kerio:winroute_firewall:6.0.0 cpe:/a:kerio:winroute_firewall:6.0.1 cpe:/a:kerio:winroute_firewall:6.0.2 cpe:/a:kerio:winroute_firewall:6.0.3 cpe:/a:kerio:winroute_firewall:6.0.4 cpe:/a:kerio:winroute_firewall:6.0.5 cpe:/a:kerio:winroute_firewall:6.0.6 cpe:/a:kerio:winroute_firewall:6.0.7 cpe:/a:kerio:winroute_firewall:6.0.8 cpe:/a:kerio:winroute_firewall:6.0.9 cpe:/a:kerio:winroute_firewall:6.0.10 cpe:/a:kerio:winroute_firewall:6.0.11 cpe:/a:kerio:winroute_firewall:6.1.0 cpe:/a:kerio:winroute_firewall:6.1.1 cpe:/a:kerio:winroute_firewall:6.1.2 cpe:/a:kerio:winroute_firewall:6.1.3 cpe:/a:kerio:winroute_firewall:6.1.3_patch1 cpe:/a:kerio:winroute_firewall:6.1.4 cpe:/a:kerio:winroute_firewall:6.1.4_patch_1 CVE-2006-0336 2006-01-20T19:03:00.000-05:00 2017-07-19T21:29:40.160-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://www.kerio.com/kwf_history.html BID 16385 VUPEN ADV-2006-0324 XF kerio-winroute-browsing-dos(24317) Kerio WinRoute Firewall before 6.1.4 Patch 2 allows attackers to cause a denial of service (CPU consumption and hang) via unknown vectors involving "browsing the web". cpe:/a:f-secure:f-secure_anti-virus:2.16::linux_gateways cpe:/a:f-secure:f-secure_anti-virus:4.51::linux_gateways cpe:/a:f-secure:f-secure_anti-virus:4.51::linux_servers cpe:/a:f-secure:f-secure_anti-virus:4.51::linux_workstations cpe:/a:f-secure:f-secure_anti-virus:4.52::linux_gateways cpe:/a:f-secure:f-secure_anti-virus:4.52::linux_servers cpe:/a:f-secure:f-secure_anti-virus:4.52::linux_workstations cpe:/a:f-secure:f-secure_anti-virus:4.61::linux_gateways cpe:/a:f-secure:f-secure_anti-virus:4.61::linux_servers cpe:/a:f-secure:f-secure_anti-virus:4.62::samba_servers cpe:/a:f-secure:f-secure_anti-virus:4.64::linux_gateways cpe:/a:f-secure:f-secure_anti-virus:4.64::linux_servers cpe:/a:f-secure:f-secure_anti-virus:5.0::linux_client_security cpe:/a:f-secure:f-secure_anti-virus:5.0::linux_server_security cpe:/a:f-secure:f-secure_anti-virus:5.01::linux_client_security cpe:/a:f-secure:f-secure_anti-virus:5.01::linux_server_security cpe:/a:f-secure:f-secure_anti-virus:5.5::citrix_servers cpe:/a:f-secure:f-secure_anti-virus:5.5::client_security cpe:/a:f-secure:f-secure_anti-virus:5.5::mimesweeper cpe:/a:f-secure:f-secure_anti-virus:5.5::windows_servers cpe:/a:f-secure:f-secure_anti-virus:5.11::linux_client_security cpe:/a:f-secure:f-secure_anti-virus:5.11::linux_server_security cpe:/a:f-secure:f-secure_anti-virus:5.40::workstations cpe:/a:f-secure:f-secure_anti-virus:5.41::mimesweeper cpe:/a:f-secure:f-secure_anti-virus:5.41::windows_servers cpe:/a:f-secure:f-secure_anti-virus:5.41::workstations cpe:/a:f-secure:f-secure_anti-virus:5.42::mimesweeper cpe:/a:f-secure:f-secure_anti-virus:5.42::windows_servers cpe:/a:f-secure:f-secure_anti-virus:5.42::workstations cpe:/a:f-secure:f-secure_anti-virus:5.43::workstations cpe:/a:f-secure:f-secure_anti-virus:5.44::workstations cpe:/a:f-secure:f-secure_anti-virus:5.51::mimesweeper cpe:/a:f-secure:f-secure_anti-virus:5.52::citrix_servers cpe:/a:f-secure:f-secure_anti-virus:5.52::client_security cpe:/a:f-secure:f-secure_anti-virus:5.52::windows_servers cpe:/a:f-secure:f-secure_anti-virus:5.54::client_security cpe:/a:f-secure:f-secure_anti-virus:5.55::client_security cpe:/a:f-secure:f-secure_anti-virus:5.61::mimesweeper cpe:/a:f-secure:f-secure_anti-virus:6.01::client_security cpe:/a:f-secure:f-secure_anti-virus:6.01::ms_exchange cpe:/a:f-secure:f-secure_anti-virus:6.2::firewalls cpe:/a:f-secure:f-secure_anti-virus:6.2::ms_exchange cpe:/a:f-secure:f-secure_anti-virus:6.21::ms_exchange cpe:/a:f-secure:f-secure_anti-virus:6.30::ms_exchange cpe:/a:f-secure:f-secure_anti-virus:6.30_sr1::ms_exchange cpe:/a:f-secure:f-secure_anti-virus:6.31::ms_exchange cpe:/a:f-secure:f-secure_anti-virus:6.40::ms_exchange cpe:/a:f-secure:f-secure_anti-virus:2004 cpe:/a:f-secure:f-secure_anti-virus:2005 cpe:/a:f-secure:f-secure_anti-virus:2006 cpe:/a:f-secure:f-secure_internet_security:2004 cpe:/a:f-secure:f-secure_internet_security:2005 cpe:/a:f-secure:f-secure_internet_security:2006 cpe:/a:f-secure:internet_gatekeeper:2.06::linux cpe:/a:f-secure:internet_gatekeeper:2.14::linux cpe:/a:f-secure:internet_gatekeeper:6.3 cpe:/a:f-secure:internet_gatekeeper:6.4 cpe:/a:f-secure:internet_gatekeeper:6.31 cpe:/a:f-secure:internet_gatekeeper:6.32 cpe:/a:f-secure:internet_gatekeeper:6.41 cpe:/a:f-secure:internet_gatekeeper:6.42 cpe:/a:f-secure:solutions_based_on_f-secure_personal_express:6.20 CVE-2006-0337 2006-01-20T19:03:00.000-05:00 2017-07-19T21:29:40.237-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015507 SECTRACK 1015508 SECTRACK 1015509 SECTRACK 1015510 CIAC Q-103 CONFIRM http://www.f-secure.com/security/fsc-2006-1.shtml BID 16309 VUPEN ADV-2006-0257 XF fsecure-zip-bo(24198) Buffer overflow in multiple F-Secure Anti-Virus products and versions for Windows and Linux, including Anti-Virus for Windows Servers 5.52 and earlier, Internet Security 2004, 2005 and 2006, and Anti-Virus for Linux Servers 4.64 and earlier, allows remote attackers to execute arbitrary code via crafted ZIP archives. cpe:/a:f-secure:f-secure_anti-virus:4.51::linux_gateways cpe:/a:f-secure:f-secure_anti-virus:4.51::linux_servers cpe:/a:f-secure:f-secure_anti-virus:4.52::linux_gateways cpe:/a:f-secure:f-secure_anti-virus:4.52::linux_servers cpe:/a:f-secure:f-secure_anti-virus:4.52::linux_workstations cpe:/a:f-secure:f-secure_anti-virus:4.60::samba_servers cpe:/a:f-secure:f-secure_anti-virus:4.61::linux_gateways cpe:/a:f-secure:f-secure_anti-virus:4.61::linux_servers cpe:/a:f-secure:f-secure_anti-virus:4.62::samba_servers cpe:/a:f-secure:f-secure_anti-virus:4.64::linux_gateways cpe:/a:f-secure:f-secure_anti-virus:4.64::linux_servers cpe:/a:f-secure:f-secure_anti-virus:5.0::linux_client_security cpe:/a:f-secure:f-secure_anti-virus:5.0::linux_server_security cpe:/a:f-secure:f-secure_anti-virus:5.5::client_security cpe:/a:f-secure:f-secure_anti-virus:5.5::mimesweeper cpe:/a:f-secure:f-secure_anti-virus:5.5::windows_servers cpe:/a:f-secure:f-secure_anti-virus:5.11::linux_client_security cpe:/a:f-secure:f-secure_anti-virus:5.11::linux_server_security cpe:/a:f-secure:f-secure_anti-virus:5.41::mimesweeper cpe:/a:f-secure:f-secure_anti-virus:5.41::workstations cpe:/a:f-secure:f-secure_anti-virus:5.42::mimesweeper cpe:/a:f-secure:f-secure_anti-virus:5.42::windows_servers cpe:/a:f-secure:f-secure_anti-virus:5.42::workstations cpe:/a:f-secure:f-secure_anti-virus:5.43::workstations cpe:/a:f-secure:f-secure_anti-virus:5.44::workstations cpe:/a:f-secure:f-secure_anti-virus:5.52::citrix_servers cpe:/a:f-secure:f-secure_anti-virus:5.52::client_security cpe:/a:f-secure:f-secure_anti-virus:5.52::mimesweeper cpe:/a:f-secure:f-secure_anti-virus:5.52::windows_servers cpe:/a:f-secure:f-secure_anti-virus:5.55::client_security cpe:/a:f-secure:f-secure_anti-virus:6.01::client_security cpe:/a:f-secure:f-secure_anti-virus:6.01::ms_exchange cpe:/a:f-secure:f-secure_anti-virus:6.2::firewalls cpe:/a:f-secure:f-secure_anti-virus:6.2::ms_exchange cpe:/a:f-secure:f-secure_anti-virus:6.21::ms_exchange cpe:/a:f-secure:f-secure_anti-virus:6.30::ms_exchange cpe:/a:f-secure:f-secure_anti-virus:6.30_sr1::ms_exchange cpe:/a:f-secure:f-secure_anti-virus:6.31::ms_exchange cpe:/a:f-secure:f-secure_anti-virus:6.40::ms_exchange cpe:/a:f-secure:f-secure_anti-virus:2003 cpe:/a:f-secure:f-secure_anti-virus:2004 cpe:/a:f-secure:f-secure_anti-virus:2005 cpe:/a:f-secure:f-secure_internet_security:2004 cpe:/a:f-secure:f-secure_internet_security:2005 cpe:/a:f-secure:f-secure_internet_security:2006 cpe:/a:f-secure:f-secure_personal_express:4.5 cpe:/a:f-secure:f-secure_personal_express:4.6 cpe:/a:f-secure:f-secure_personal_express:4.7 cpe:/a:f-secure:f-secure_personal_express:5.0 cpe:/a:f-secure:internet_gatekeeper:2.06::linux cpe:/a:f-secure:internet_gatekeeper:2.14::linux cpe:/a:f-secure:internet_gatekeeper:6.32 cpe:/a:f-secure:internet_gatekeeper:6.41 cpe:/a:f-secure:internet_gatekeeper:6.42 CVE-2006-0338 2006-01-20T19:03:00.000-05:00 2017-07-19T21:29:40.317-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015507 SECTRACK 1015508 SECTRACK 1015509 SECTRACK 1015510 CIAC Q-103 CONFIRM http://www.f-secure.com/security/fsc-2006-1.shtml BID 16309 VUPEN ADV-2006-0257 XF fsecure-rar-zip-scan-bypass(24199) Multiple F-Secure Anti-Virus products and versions for Windows and Linux, including Anti-Virus for Windows Servers 5.52 and earlier, Internet Security 2004, 2005 and 2006, and Anti-Virus for Linux Servers 4.64 and earlier, allow remote attackers to hide arbitrary files and data via malformed (1) RAR and (2) ZIP archives, which are not properly scanned. cpe:/a:bitcomet:bitcomet:0.60 CVE-2006-0339 2006-01-20T19:03:00.000-05:00 2018-10-19T11:44:28.313-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BUGTRAQ 20060122 BitComet URI Proof of Concept FULLDISC 20060118 Fortinet Advisory: BitComet URI Buffer Overflow Vulnerability SREASON 357 CONFIRM http://www.bitcomet.com/doc/changelog.htm MISC http://www.fortinet.com/FortiGuardCenter/FSA-2006-07.html BUGTRAQ 20060118 Fortinet Advisory: BitComet URI Buffer Overflow Vulnerability BID 16311 VUPEN ADV-2006-0251 XF bitcomet-torrent-publisher-bo(24229) Buffer overflow in BitComet Client 0.60 allows remote attackers to execute arbitrary code, when the publisher's name link is clicked, via a long publisher URI in a torrent file. cpe:/o:cisco:ios:12.0 cpe:/o:cisco:ios:12.0s cpe:/o:cisco:ios:12.0sc cpe:/o:cisco:ios:12.0t cpe:/o:cisco:ios:12.0xa cpe:/o:cisco:ios:12.0xc cpe:/o:cisco:ios:12.0xd cpe:/o:cisco:ios:12.0xe cpe:/o:cisco:ios:12.0xg cpe:/o:cisco:ios:12.0xh cpe:/o:cisco:ios:12.0xi cpe:/o:cisco:ios:12.0xj cpe:/o:cisco:ios:12.0xk cpe:/o:cisco:ios:12.0xl cpe:/o:cisco:ios:12.0xn cpe:/o:cisco:ios:12.0xr cpe:/o:cisco:ios:12.1 cpe:/o:cisco:ios:12.1aa cpe:/o:cisco:ios:12.1e cpe:/o:cisco:ios:12.1ec cpe:/o:cisco:ios:12.1ex cpe:/o:cisco:ios:12.1ez cpe:/o:cisco:ios:12.1ga cpe:/o:cisco:ios:12.1gb cpe:/o:cisco:ios:12.1t cpe:/o:cisco:ios:12.1xa cpe:/o:cisco:ios:12.1xd cpe:/o:cisco:ios:12.1xh cpe:/o:cisco:ios:12.1xi cpe:/o:cisco:ios:12.1xl cpe:/o:cisco:ios:12.1xm cpe:/o:cisco:ios:12.1xq cpe:/o:cisco:ios:12.1xs cpe:/o:cisco:ios:12.1xu cpe:/o:cisco:ios:12.1xw cpe:/o:cisco:ios:12.1xx cpe:/o:cisco:ios:12.1xy cpe:/o:cisco:ios:12.1xz cpe:/o:cisco:ios:12.1ya cpe:/o:cisco:ios:12.1yb cpe:/o:cisco:ios:12.1yd cpe:/o:cisco:ios:12.2 cpe:/o:cisco:ios:12.2b cpe:/o:cisco:ios:12.2bc cpe:/o:cisco:ios:12.2bw cpe:/o:cisco:ios:12.2by cpe:/o:cisco:ios:12.2cx cpe:/o:cisco:ios:12.2dd cpe:/o:cisco:ios:12.2dx cpe:/o:cisco:ios:12.2mc cpe:/o:cisco:ios:12.2s cpe:/o:cisco:ios:12.2su cpe:/o:cisco:ios:12.2sy cpe:/o:cisco:ios:12.2sz cpe:/o:cisco:ios:12.2t cpe:/o:cisco:ios:12.2xa cpe:/o:cisco:ios:12.2xb cpe:/o:cisco:ios:12.2xc cpe:/o:cisco:ios:12.2xf cpe:/o:cisco:ios:12.2xg cpe:/o:cisco:ios:12.2xk cpe:/o:cisco:ios:12.2xl cpe:/o:cisco:ios:12.2xs cpe:/o:cisco:ios:12.2xt cpe:/o:cisco:ios:12.2xv cpe:/o:cisco:ios:12.2yd cpe:/o:cisco:ios:12.2ye cpe:/o:cisco:ios:12.2yn cpe:/o:cisco:ios:12.2yt cpe:/o:cisco:ios:12.2yw cpe:/o:cisco:ios:12.2yx cpe:/o:cisco:ios:12.2yy cpe:/o:cisco:ios:12.2yz cpe:/o:cisco:ios:12.2za cpe:/o:cisco:ios:12.2zb cpe:/o:cisco:ios:12.2zd cpe:/o:cisco:ios:12.2ze cpe:/o:cisco:ios:12.2zj cpe:/o:cisco:ios:12.2zn cpe:/o:cisco:ios:12.3 cpe:/o:cisco:ios:12.3b cpe:/o:cisco:ios:12.3bc cpe:/o:cisco:ios:12.3bw cpe:/o:cisco:ios:12.3t cpe:/o:cisco:ios:12.3xb cpe:/o:cisco:ios:12.3xd cpe:/o:cisco:ios:12.3xf cpe:/o:cisco:ios:12.3xh cpe:/o:cisco:ios:12.3xi cpe:/o:cisco:ios:12.3xj cpe:/o:cisco:ios:12.3xm cpe:/o:cisco:ios:12.3xq cpe:/o:cisco:ios:12.3xu cpe:/o:cisco:ios:12.3xw cpe:/o:cisco:ios:12.3yf cpe:/o:cisco:ios:12.3yg cpe:/o:cisco:ios:12.3yj cpe:/o:cisco:ios:12.3yk cpe:/o:cisco:ios:12.3ym cpe:/o:cisco:ios:12.3yq cpe:/o:cisco:ios:12.3yt cpe:/o:cisco:ios:12.3yu cpe:/o:cisco:ios:12.3yx cpe:/o:cisco:ios:12.4 cpe:/o:cisco:ios:12.4mr cpe:/o:cisco:ios:12.4t cpe:/o:cisco:ios:12.4xa cpe:/o:cisco:ios:12.4xb CVE-2006-0340 2006-01-20T19:03:00.000-05:00 2017-07-19T21:29:40.457-04:00 7.1 NETWORK MEDIUM NONE NONE NONE COMPLETE http://nvd.nist.gov SREASON 358 SECTRACK 1015501 CISCO 20060118 IOS Stack Group Bidding Protocol Crafted Packet DoS BID 16303 VUPEN ADV-2006-0248 XF cisco-ios-sgbp-dos(24182) Unspecified vulnerability in Stack Group Bidding Protocol (SGBP) support in Cisco IOS 12.0 through 12.4 running on various Cisco products, when SGBP is enabled, allows remote attackers on the local network to cause a denial of service (device hang and network traffic loss) via a crafted UDP packet to port 9900. cpe:/a:rockliffe:mailsite:6.1.22 cpe:/a:rockliffe:mailsite:7.0.3.1 CVE-2006-0341 2006-01-06T00:00:00.000-05:00 2017-07-19T21:29:40.520-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060120 RockLiffe MailSite wconsole.dll Denial of Service/Script Injection Vulnerability BID 16330 VUPEN ADV-2006-0284 XF mailsite-wconsole-xss(24256) Cross-site scripting (XSS) vulnerability in WCONSOLE.DLL in Rockliffe MailSite 5.x and 6.1.22 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string. cpe:/a:rockliffe:mailsite:7.0.3.1 CVE-2006-0342 2006-01-20T19:03:00.000-05:00 2017-07-19T21:29:40.627-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov FULLDISC 20060120 RockLiffe MailSite wconsole.dll Denial of Service/Script Injection Vulnerability BID 16331 VUPEN ADV-2006-0284 XF mailsite-wconsole-dos(24255) RockLiffe MailSite HTTP Mail management agent (httpma) 7.0.3.1 allows remote attackers to cause a denial of service (CPU consumption and crash) via a malformed query string containing special characters such as "|". cpe:/a:hitachi:jpi_netsight_ii_port_discovery_advance:r_15237_9154_07_50 cpe:/a:hitachi:jpi_netsight_ii_port_discovery_standard:r_15237_9164_07_00 cpe:/a:hitachi:jpi_netsight_ii_port_discovery_standard:r_15237_9164_07_01 cpe:/a:hitachi:jpi_netsight_ii_port_discovery_standard:r_15237_9164_07_02 cpe:/a:hitachi:jpi_netsight_ii_port_discovery_standard:r_15237_9164_07_03 cpe:/a:hitachi:jpi_netsight_ii_port_discovery_standard:r_15237_9164_07_04 cpe:/a:hitachi:jpi_netsight_ii_port_discovery_standard:r_15237_9164_07_05 cpe:/a:hitachi:jpi_netsight_ii_port_discovery_standard:r_15237_9164_07_06 cpe:/a:hitachi:jpi_netsight_ii_port_discovery_standard:r_15237_9164_07_07 cpe:/a:hitachi:jpi_netsight_ii_port_discovery_standard:r_15237_9164_07_08 cpe:/a:hitachi:jpi_netsight_ii_port_discovery_standard:r_15237_9164_07_09 cpe:/a:hitachi:jpi_netsight_ii_port_discovery_standard:r_15237_9164_07_10 cpe:/a:hitachi:jpi_netsight_ii_port_discovery_standard:r_15237_9164_07_11 CVE-2006-0343 2006-01-20T19:03:00.000-05:00 2017-07-19T21:29:40.690-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SECTRACK 1015520 CONFIRM http://www.hitachi-support.com/security_e/vuls_e/HS05-027_e/index-e.html BID 16327 VUPEN ADV-2006-0267 XF hitachi-jp1netinsight-port-dos(24243) Unspecified vulnerability in the Port Discovery Standard and Advanced features in Hitachi JP1/NetInsight II allows attackers to stop the Port Discovery service via unknown vectors involving "invalid format data". cpe:/a:intervations:filecopa:1.01 CVE-2006-0344 2006-01-20T19:03:00.000-05:00 2017-07-19T21:29:40.737-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov MISC http://www.nii.co.in/vuln/filecopa.html BID 16335 VUPEN ADV-2006-0285 XF filecopa-ftp-directory-traversal(24257) Directory traversal vulnerability in Intervations FileCOPA FTP Server 1.01 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the (1) STOR and (2) RETR commands. cpe:/a:saral_kaushik:saralblog:1.0 CVE-2006-0345 2006-01-20T20:03:00.000-05:00 2017-07-19T21:29:40.783-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060118 [eVuln] SaralBlog XSS & Multiple SQL Injection Vulnerabilities MISC http://evuln.com/vulns/40/summary.html SECTRACK 1015517 BID 16306 XF saralblog-search-sql-injection(24218) Multiple SQL injection vulnerabilities in SaralBlog 1.0 allow remote attackers to execute arbitrary SQL commands via the search parameter to search.php. NOTE: the id/viewprofile.php issue is already covered by CVE-2005-4058. cpe:/a:saral_kaushik:saralblog:1.0 CVE-2006-0346 2006-01-20T20:03:00.000-05:00 2017-07-19T21:29:40.847-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060118 [eVuln] SaralBlog XSS & Multiple SQL Injection Vulnerabilities MISC http://evuln.com/vulns/40/summary.html SECTRACK 1015517 BID 16306 XF saralblog-view-xss(24219) Cross-site scripting (XSS) vulnerability in SaralBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via a website field in a new comment to view.php, which is not properly handled in the comment function in functions.php. cpe:/a:stefan_ritt:elog_web_logbook:2.0.0 cpe:/a:stefan_ritt:elog_web_logbook:2.0.1 cpe:/a:stefan_ritt:elog_web_logbook:2.0.2 cpe:/a:stefan_ritt:elog_web_logbook:2.0.3 cpe:/a:stefan_ritt:elog_web_logbook:2.0.4 cpe:/a:stefan_ritt:elog_web_logbook:2.0.5 cpe:/a:stefan_ritt:elog_web_logbook:2.1.0 cpe:/a:stefan_ritt:elog_web_logbook:2.1.1 cpe:/a:stefan_ritt:elog_web_logbook:2.1.2 cpe:/a:stefan_ritt:elog_web_logbook:2.1.3 cpe:/a:stefan_ritt:elog_web_logbook:2.2.0 cpe:/a:stefan_ritt:elog_web_logbook:2.2.1 cpe:/a:stefan_ritt:elog_web_logbook:2.2.2 cpe:/a:stefan_ritt:elog_web_logbook:2.2.3 cpe:/a:stefan_ritt:elog_web_logbook:2.2.4 cpe:/a:stefan_ritt:elog_web_logbook:2.4 cpe:/a:stefan_ritt:elog_web_logbook:2.5 cpe:/a:stefan_ritt:elog_web_logbook:2.5.6 cpe:/a:stefan_ritt:elog_web_logbook:2.5.7 cpe:/a:stefan_ritt:elog_web_logbook:2.6.0 CVE-2006-0347 2006-01-20T20:03:00.000-05:00 2017-07-19T21:29:40.910-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://midas.psi.ch/elog/download/ChangeLog DEBIAN DSA-967 BID 16315 VUPEN ADV-2006-0262 XF elog-dotdot-directory-traversal(24224) Directory traversal vulnerability in ELOG before 2.6.1 allows remote attackers to access arbitrary files outside of the elog directory via "../" (dot dot) sequences in the URL. cpe:/a:stefan_ritt:elog_web_logbook:2.0.0 cpe:/a:stefan_ritt:elog_web_logbook:2.0.1 cpe:/a:stefan_ritt:elog_web_logbook:2.0.2 cpe:/a:stefan_ritt:elog_web_logbook:2.0.3 cpe:/a:stefan_ritt:elog_web_logbook:2.0.4 cpe:/a:stefan_ritt:elog_web_logbook:2.0.5 cpe:/a:stefan_ritt:elog_web_logbook:2.1.0 cpe:/a:stefan_ritt:elog_web_logbook:2.1.1 cpe:/a:stefan_ritt:elog_web_logbook:2.1.2 cpe:/a:stefan_ritt:elog_web_logbook:2.1.3 cpe:/a:stefan_ritt:elog_web_logbook:2.2.0 cpe:/a:stefan_ritt:elog_web_logbook:2.2.1 cpe:/a:stefan_ritt:elog_web_logbook:2.2.2 cpe:/a:stefan_ritt:elog_web_logbook:2.2.3 cpe:/a:stefan_ritt:elog_web_logbook:2.2.4 cpe:/a:stefan_ritt:elog_web_logbook:2.4 cpe:/a:stefan_ritt:elog_web_logbook:2.5 cpe:/a:stefan_ritt:elog_web_logbook:2.5.6 cpe:/a:stefan_ritt:elog_web_logbook:2.5.7 cpe:/a:stefan_ritt:elog_web_logbook:2.6.0 CVE-2006-0348 2006-01-20T20:03:00.000-05:00 2017-07-19T21:29:40.973-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://midas.psi.ch/elog/download/ChangeLog DEBIAN DSA-967 BID 16315 VUPEN ADV-2006-0262 XF elog-elogd-format-string(24221) Format string vulnerability in the write_logfile function in ELOG before 2.6.1 allows remote attackers to cause a denial of service (server crash) via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:epic_designs:eggblog:2.0 CVE-2006-0349 2006-01-20T20:03:00.000-05:00 2017-07-19T21:29:41.020-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060118 [eVuln] eggblog Multiple SQL Injection & XSS Vulnerabilities MISC http://evuln.com/vulns/39/summary.html SECTRACK 1015505 BID 16305 XF eggblog-blog-sql-injection(24210) SQL injection vulnerability in eggblog 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to blog.php. cpe:/a:epic_designs:eggblog:2.0 CVE-2006-0350 2006-01-20T20:03:00.000-05:00 2017-07-19T21:29:41.097-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060118 [eVuln] eggblog Multiple SQL Injection & XSS Vulnerabilities MISC http://evuln.com/vulns/39/summary.html SECTRACK 1015505 BID 16305 XF eggblog-topic-xss(24209) Cross-site scripting (XSS) vulnerability in eggblog 2.0 allow remote attackers to inject arbitrary web script or HTML via the message field to topic.php. cpe:/a:don_moore:mydns:0.6 cpe:/a:don_moore:mydns:0.7 cpe:/a:don_moore:mydns:0.7.1 cpe:/a:don_moore:mydns:0.8 cpe:/a:don_moore:mydns:0.8.1 cpe:/a:don_moore:mydns:0.8.2 cpe:/a:don_moore:mydns:0.8.3 cpe:/a:don_moore:mydns:0.9.0 cpe:/a:don_moore:mydns:0.9.1 cpe:/a:don_moore:mydns:0.9.2 cpe:/a:don_moore:mydns:0.9.3 cpe:/a:don_moore:mydns:0.9.5 cpe:/a:don_moore:mydns:0.9.6 cpe:/a:don_moore:mydns:0.9.7 cpe:/a:don_moore:mydns:0.9.8 cpe:/a:don_moore:mydns:0.9.9 cpe:/a:don_moore:mydns:0.9.10 cpe:/a:don_moore:mydns:0.9.12 cpe:/a:don_moore:mydns:0.9.13 cpe:/a:don_moore:mydns:0.10.0 cpe:/a:don_moore:mydns:0.10.1 cpe:/a:don_moore:mydns:0.10.2 cpe:/a:don_moore:mydns:0.10.3 cpe:/a:don_moore:mydns:0.10.4 cpe:/a:don_moore:mydns:0.11.0 cpe:/a:don_moore:mydns:1.0.0 CVE-2006-0351 2006-01-20T20:03:00.000-05:00 2017-07-19T21:29:41.160-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://mydns.bboy.net/download/changelog.html SECTRACK 1015521 DEBIAN DSA-963 GENTOO GLSA-200601-16 BID 16431 VUPEN ADV-2006-0256 XF mydns-query-dos(24228) Unspecified "critical denial-of-service vulnerability" in MyDNS before 1.1.0 has unknown impact and attack vectors. cpe:/a:fluffington:flog:1.01 cpe:/a:fluffington:flog:1.1.2 CVE-2006-0352 2006-01-20T20:03:00.000-05:00 2018-10-19T11:44:29.097-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://evuln.com/vulns/38/summary/bt/ BUGTRAQ 20060117 [eVuln] Flog Information Disclosure Vulnerability BUGTRAQ 20070105 Flog 1.1.2 Remote Admin Password Disclosure XF flog-data-directory-insecure(24193) XF flog-admin-info-disclosure(31307) The default configuration of Fluffington FLog 1.01 installs users.0.dat under the web document root with insufficient access control, which might allow remote attackers to obtain sensitive information (login credentials) via a direct request. NOTE: It was later reported that 1.1.2 is also affected. cpe:/a:gnu:lsh:2.0.1 CVE-2006-0353 2006-01-22T14:03:00.000-05:00 2017-07-19T21:29:41.317-04:00 3.6 LOCAL LOW NONE PARTIAL NONE PARTIAL http://nvd.nist.gov MLIST [lsh-bugs] SECURITY: lshd leaks fd:s to user shells DEBIAN DSA-956 BID 16357 VUPEN ADV-2006-0301 XF lsh-file-descriptor-leak(24263) unix_random.c in lshd for lsh 2.0.1 leaks file descriptors related to the randomness generator, which allows local users to cause a denial of service by truncating the seed file, which prevents the server from starting, or obtain sensitive seed information that could be used to crack keys. cpe:/h:cisco:aironet_ap1100 cpe:/h:cisco:aironet_ap1130ag cpe:/h:cisco:aironet_ap1200 cpe:/h:cisco:aironet_ap1230ag cpe:/h:cisco:aironet_ap1240ag cpe:/h:cisco:aironet_ap1300 cpe:/h:cisco:aironet_ap1400 cpe:/h:cisco:aironet_ap350 CVE-2006-0354 2006-01-22T15:03:00.000-05:00 2017-10-10T21:30:37.233-04:00 5.5 ADJACENT_NETWORK LOW SINGLE_INSTANCE NONE NONE COMPLETE http://nvd.nist.gov SREASON 339 SECTRACK 1015483 CISCO 20060112 Access Point Memory Exhaustion from ARP Attacks BID 16217 VUPEN ADV-2006-0176 XF cisco-aironet-arp-dos(24086) Cisco IOS before 12.3-7-JA2 on Aironet Wireless Access Points (WAP) allows remote authenticated users to cause a denial of service (termination of packet passing or termination of client connections) by sending the management interface a large number of spoofed ARP packets, which creates a large ARP table that exhausts memory, aka Bug ID CSCsc16644. cpe:/a:helmsman_research:homeftp:1.1 CVE-2006-0355 2006-01-22T15:03:00.000-05:00 2018-10-19T11:44:29.597-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SREASON 350 MISC http://www.kapda.ir/advisory-202.html BUGTRAQ 20060114 [KAPDA::#21] - HomeFtp v1.1 Denial of Service BID 16238 XF homeftp-long-command-dos(24152) Helmsman Research (aka CoolUtils) HomeFtp 1.1 allows remote attackers to cause an unspecified denial of service via a long USER command combined with a long PASS command and an NLST command. cpe:/a:ari_pikivirta:home_ftp_server:1.0.7 CVE-2006-0356 2006-01-22T15:03:00.000-05:00 2018-10-19T11:44:29.940-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://www.kapda.ir/advisory-211.html BUGTRAQ 20060115 Homeftp r1.0.7 Denial of Service XF homeftpserver-long-command-dos(24227) Ari Pikivirta Home Ftp Server 1.0.7 allows remote attackers to cause an unspecified denial of service via a long USER command combined with a long PASS command. cpe:/a:grant_averett:cerberus_ftp_server:2.32 CVE-2006-0357 2006-01-22T15:03:00.000-05:00 2018-10-19T11:44:30.207-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://www.cerberusftp.com/cerberus-releasenotes.htm MISC http://www.kapda.ir/advisory-210.html BUGTRAQ 20060115 Cerberus FTP Server 2.32 Denial of Service XF cerberus-long-command-dos(24226) Grant Averett Cerberus FTP Server 2.32, and possibly earlier versions, allows remote attackers to cause an unspecified denial of service via a long string that does not contain a valid FTP command. cpe:/a:powerportal:powerportal:1.1b cpe:/a:powerportal:powerportal:1.3 cpe:/a:powerportal:powerportal:1.3b CVE-2006-0358 2006-01-22T15:03:00.000-05:00 2018-10-19T11:44:30.517-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://web.archive.org/web/20050303003128/http://powerportal.sourceforge.net/ BUGTRAQ 20060117 PowerPortal Cross-Site Scripting Vulnerability BID 16279 XF powerportal-search-index-xss(24196) Multiple SQL injection vulnerabilities in PowerPortal, possibly 1.1 beta through 1.3, allow remote attackers to execute arbitrary SQL commands via the search parameter in (1) index.php and (2) search.php. NOTE: This issue might overlap CVE-2004-0663.2. cpe:/a:counterpath:eyebeam_sip_softphone CVE-2006-0359 2006-01-22T15:03:00.000-05:00 2018-10-19T11:44:31.033-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://blog.donews.com/zwell/archive/2006/01/17/698810.aspx SREASON 354 BUGTRAQ 20060116 CounterPath eyeBeam Handing SIP header Vulnerabilities BUGTRAQ 20060921 Re: CounterPath eyeBeam Handing SIP header Vulnerabilities BID 16253 VUPEN ADV-2006-0259 XF eyebeam-sip-header-bo(24181) Buffer overflow in CounterPath eyeBeam SIP Softphone allows remote attackers to (1) cause a denial of service (device crash) via SIP INVITE commands with a long header field name sent during startup and (2) cause a denial of service (device hang or crash) via SIP INVITE commands with a long header field name sent during a call. cpe:/h:mpm:hp-180w_voip_wifi_phone:we.00.17 CVE-2006-0360 2006-01-22T15:03:00.000-05:00 2017-07-19T21:29:41.737-04:00 6.4 NETWORK LOW NONE PARTIAL NONE PARTIAL http://nvd.nist.gov FULLDISC 20060116 MPM HP-180W VoIP wireless desktop phone undocumented port UDP/9090 BID 16285 XF mpn-hp180w-default-port(24147) MPM SIP HP-180W Wireless IP Phone WE.00.17 allows remote attackers to obtain sensitive information and possibly cause a denial of service via a direct connection to UDP port 9090, which is undocumented and does not require authentication. cpe:/a:bit_5_blog:bit_5_blog:8.01 CVE-2006-0361 2006-01-22T15:03:00.000-05:00 2018-10-19T11:44:31.737-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/32/exploit MISC http://evuln.com/vulns/32/summary/ BUGTRAQ 20060115 [eVuln] Bit 5 Blog JavaScript Insertion Vulnerability BID 16246 VUPEN ADV-2006-0195 XF bit5blog-addcomment-xss(24129) Cross-site scripting (XSS) vulnerability in addcomment.php in Bit 5 Blog 8.01 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in an <a> tag in the comment parameter, which strips most tags but not <a>. cpe:/o:3com:tippingpoint_ips_tos:2.1.3.6323 cpe:/o:3com:tippingpoint_ips_tos:2.2.0.6504 CVE-2006-0362 2006-01-22T15:03:00.000-05:00 2017-07-19T21:29:41.877-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://isc.sans.org/diary.php?storyid=1042 SECTRACK 1015511 CONFIRM http://www.eweek.com/article2/0,1759,1912048,00.asp BID 16299 XF tippingpoint-ips-http-traffic-dos(24200) TippingPoint Intrusion Prevention System (IPS) TOS before 2.1.4.6324, and TOS 2.2.x before 2.2.1.6506, allow remote attackers to cause a denial of service (CPU consumption) via an unknown vector, probably involving an HTTP request with a negative number in the Content-Length header. cpe:/a:microsoft:msn_messenger:7.5 CVE-2006-0363 2006-01-22T15:03:00.000-05:00 2018-10-19T11:44:32.267-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://www.msn-password-recovery.com/ BUGTRAQ 20060113 Re: MSN Messenger Password Decrypter for WinXP/2003 BUGTRAQ 20060117 Re: MSN Messenger Password Decrypter for WinXP/2003 The "Remember my Password" feature in MSN Messenger 7.5 stores passwords in an encrypted format under the HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds registry key, which might allow local users to obtain the original passwords via a program that calls CryptUnprotectData, as demonstrated by the "MSN Password Recovery.exe" program. NOTE: it could be argued that local-only password recovery is inherently insecure because the decryption methods and keys must be stored somewhere on the local system, and are thus inherently accessible with varying degrees of effort. Perhaps this issue should not be included in CVE. cpe:/a:mybulletinboard:mybulletinboard:1.0.1 cpe:/a:mybulletinboard:mybulletinboard:1.0.2 cpe:/a:mybulletinboard:mybulletinboard:1.0_final cpe:/a:mybulletinboard:mybulletinboard:1.0_pr2 cpe:/a:mybulletinboard:mybulletinboard:1.0_preview_release_2 cpe:/a:mybulletinboard:mybulletinboard:1.0_rc2 cpe:/a:mybulletinboard:mybulletinboard:1.0_rc4 CVE-2006-0364 2006-01-22T15:03:00.000-05:00 2017-07-19T21:29:41.940-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060118 MyBB Signature HTML Code Injection BID 16308 VUPEN ADV-2006-0255 XF mybb-html-signature-xss(24225) Cross-site scripting (XSS) vulnerability in MyBulletinBoard (MyBB) allows remote attackers to inject arbitrary web script or HTML via a signature containing a JavaScript URI in the SRC attribute of an IMG element, in which the URI uses SGML numeric character references without trailing semicolons, as demonstrated by "&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116". cpe:/a:xmb_software:xmb_forum CVE-2006-0365 2006-01-22T15:03:00.000-05:00 2018-10-19T11:44:32.487-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060118 XMB Forum HTML Code Injection XF xmbforum-imgsrc-xss(24208) Cross-site scripting (XSS) vulnerability in XMB (aka extreme message board) allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an IMG element. cpe:/a:phpclanwebsite:phpclanwebsite:1.23.1 CVE-2006-0366 2006-01-22T15:03:00.000-05:00 2018-10-19T11:44:32.707-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060117 Phpclanwebsite BBCode IMG Tag XSS Vulnerability BID 16300 VUPEN ADV-2006-0254 BUGTRAQ 20060118 Phpclanwebsite BBCode IMG Tag XSS Vulnerability Cross-site scripting (XSS) vulnerability in Phpclanwebsite (aka PCW) allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a BBCode img tag. cpe:/h:cisco:call_manager:1.0 cpe:/h:cisco:call_manager:2.0 cpe:/h:cisco:call_manager:3.0 cpe:/h:cisco:call_manager:3.1 cpe:/h:cisco:call_manager:3.1%282%29 cpe:/h:cisco:call_manager:3.1%283a%29 cpe:/h:cisco:call_manager:3.2 cpe:/h:cisco:call_manager:3.3 cpe:/h:cisco:call_manager:3.3%283%29 cpe:/h:cisco:call_manager:3.3%283%29es61 cpe:/h:cisco:call_manager:3.3%284%29es25 cpe:/h:cisco:call_manager:3.3%285%29 cpe:/h:cisco:call_manager:4.0 cpe:/h:cisco:call_manager:4.0%282a%29es40 cpe:/h:cisco:call_manager:4.0%282a%29sr2b cpe:/h:cisco:call_manager:4.1%282%29es33 cpe:/h:cisco:call_manager:4.1%283%29es07 cpe:/h:cisco:call_manager:4.1%283%29sr1 CVE-2006-0367 2006-01-22T15:03:00.000-05:00 2017-07-19T21:29:42.033-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1015502 CISCO 20060118 Cisco Call Manager Privilege Escalation BID 16293 VUPEN ADV-2006-0250 XF cisco-callmanager-ccmadmin-gain-priv(24172) Unspecified vulnerability in Cisco CallManager 3.2 and earlier, 3.3 before 3.3(5)SR1, 4.0 before 4.0(2a)SR2c, and 4.1 before 4.1(3)SR2 allows remote authenticated users with read-only administrative privileges to obtain full administrative privileges via a "crafted URL on the CCMAdmin web page." cpe:/h:cisco:call_manager cpe:/h:cisco:call_manager:1.0 cpe:/h:cisco:call_manager:2.0 cpe:/h:cisco:call_manager:3.0 cpe:/h:cisco:call_manager:3.1 cpe:/h:cisco:call_manager:3.1%282%29 cpe:/h:cisco:call_manager:3.1%283a%29 cpe:/h:cisco:call_manager:3.2 cpe:/h:cisco:call_manager:3.3 cpe:/h:cisco:call_manager:3.3%283%29 cpe:/h:cisco:call_manager:3.3%283%29es61 cpe:/h:cisco:call_manager:3.3%284%29es25 cpe:/h:cisco:call_manager:3.3%285%29 cpe:/h:cisco:call_manager:3.3%285%29es30 cpe:/h:cisco:call_manager:4.0 cpe:/h:cisco:call_manager:4.0%282a%29es40 cpe:/h:cisco:call_manager:4.0%282a%29es62 cpe:/h:cisco:call_manager:4.0%282a%29sr2b cpe:/h:cisco:call_manager:4.1%282%29es33 cpe:/h:cisco:call_manager:4.1%282%29es55 cpe:/h:cisco:call_manager:4.1%283%29es07 cpe:/h:cisco:call_manager:4.1%283%29es32 cpe:/h:cisco:call_manager:4.1%283%29sr1 CVE-2006-0368 2006-01-22T15:03:00.000-05:00 2017-07-19T21:29:42.097-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov SREASON 359 SECTRACK 1015503 CISCO 20060118 Cisco Call Manager Denial of Service BID 16295 VUPEN ADV-2006-0249 XF cisco-callmanager-port-connection-dos(24180) Cisco CallManager 3.2 and earlier, 3.3 before 3.3(5)SR1, 4.0 before 4.0(2a)SR2c, and 4.1 before 4.1(3)SR2 allow remote attackers to (1) cause a denial of service (CPU and memory consumption) via a large number of open TCP connections to port 2000 and (2) cause a denial of service (fill the Windows Service Manager communication queue) via a large number of TCP connections to port 2001, 2002, or 7727. cpe:/a:mysql:mysql:5.0.18 CVE-2006-0369 2006-01-22T15:03:00.000-05:00 2018-10-19T11:44:32.987-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BUGTRAQ 20060120 MySQL 5.0 information leak? BUGTRAQ 20060121 RE: MySQL 5.0 information leak? BUGTRAQ 20060121 Re: MySQL 5.0 information leak? BUGTRAQ 20060122 Re: MySQL 5.0 information leak? BUGTRAQ 20060124 Re: MySQL 5.0 information leak? BUGTRAQ 20060123 RE: MySQL 5.0 information leak? BUGTRAQ 20060128 Re: MySQL 5.0 information leak? ** DISPUTED ** MySQL 5.0.18 allows local users with access to a VIEW to obtain sensitive information via the "SELECT * FROM information_schema.views;" query, which returns the query that created the VIEW. NOTE: this issue has been disputed by third parties, saying that the availability of the schema is a normal and sometimes desired aspect of database access. cpe:/a:noah_medling:rcblog:1.03 CVE-2006-0370 2006-01-22T15:03:00.000-05:00 2018-10-19T11:44:33.457-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://evuln.com/vulns/42/summary.html SECTRACK 1015523 MISC http://www.fluffington.com/index.php?page=rcblog BUGTRAQ 20060120 [eVuln] RCBlog Directory Traversal & Sensitive Information Disclosure XF rcblog-data-config-insecure-directories(24249) Noah Medling RCBlog 1.03 stores the data and config directories under the web root with insufficient access control, which allows remote attackers to view account names and MD5 password hashes. cpe:/a:noah_medling:rcblog:1.03 CVE-2006-0371 2006-01-22T15:03:00.000-05:00 2018-10-19T11:44:33.753-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://evuln.com/vulns/42/summary.html SECTRACK 1015523 MISC http://www.fluffington.com/index.php?page=rcblog BUGTRAQ 20060120 [eVuln] RCBlog Directory Traversal & Sensitive Information Disclosure BUGTRAQ 20060218 RCblog exploit [fun] BUGTRAQ 20060611 RCblog 1.03 Directory Traversal [index.php] BID 16342 XF rcblog-index-directory-traversal(24248) XF rcblog-index-file-include(27042) Directory traversal vulnerability in index.php in Noah Medling RCBlog 1.03 allows remote attackers to read arbitrary .txt files, possibly including one that stores the administrator's account name and password, via a .. (dot dot) in the post parameter. cpe:/a:insane_visions:blogphp:1.0 CVE-2006-0372 2006-01-22T15:03:00.000-05:00 2018-10-19T11:44:34.363-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 365 BUGTRAQ 20060120 BlogPHP config.php SQL injection login bypass BUGTRAQ 20060120 BlogPHP config.php SQL injection login bypass BUGTRAQ 20060121 BlogPHP config.php SQL injection login bypassed BID 16340 XF blogphp-index-bypass-security(24131) Multiple SQL injection vulnerabilities in config.php in Insane Visions BlogPHP, possibly 1.0, allow remote attackers to execute arbitrary SQL commands via the (1) blogphp_username or (2) blogphp_password parameter in a cookie. cpe:/a:douran:followweb CVE-2006-0373 2006-01-22T15:03:00.000-05:00 2008-09-05T16:59:05.073-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov 2006-01-23T08:55:00.000-05:00 BID 16302 Cross-site scripting (XSS) vulnerability in register.aspx in Douran FollowWeb allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/h:advantage_century_telecommunication:p202s:1.01.21_firmware_1.1.21 CVE-2006-0374 2006-01-22T15:03:00.000-05:00 2017-07-19T21:29:42.317-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060116 ACT P202S VoIP wireless phone multiple undocumented ports/services BID 16288 XF act-p202s-default-port(24149) Advantage Century Telecommunication (ACT) P202S IP Phone 1.01.21 running firmware 1.1.21 has multiple undocumented ports available, which (1) might allow remote attackers to obtain sensitive information, such as memory contents and internal operating-system data, by directly accessing the VxWorks WDB remote debugging ONCRPC (aka wdbrpc) on UDP 17185, (2) reflect network data using echo (TCP 7), or (3) gain access without authentication using rlogin (TCP 513). cpe:/h:advantage_century_telecommunication:p202s:1.01.21_firmware_1.1.21 CVE-2006-0375 2006-01-22T15:03:00.000-05:00 2017-07-19T21:29:42.363-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060116 ACT P202S VoIP wireless phone multiple undocumented ports/services BID 16288 XF act-p202s-default-port(24149) Advantage Century Telecommunication (ACT) P202S IP Phone 1.01.21 running firmware 1.1.21 on VxWorks uses a hardcoded Network Time Protocol (NTP) server in Taiwan, which could allow remote attackers to provide false time information, block access to time information, or conduct other attacks. cpe:/o:microsoft:windows_2000::sp2 cpe:/o:microsoft:windows_2000::sp3 cpe:/o:microsoft:windows_2000::sp4::fr cpe:/o:microsoft:windows_2003_server:r2 cpe:/o:microsoft:windows_xp::gold:home cpe:/o:microsoft:windows_xp::gold:professional CVE-2006-0376 2006-01-22T15:03:00.000-05:00 2018-10-19T11:44:34.863-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 349 SECTRACK 1015489 MISC http://www.nmrc.org/pub/advise/20060114.txt MISC http://www.securiteam.com/windowsntfocus/5YP0D2KHHO.html BUGTRAQ 20060114 [NMRC Advisory] Microsoft Windows Wireless Exposure on Laptops MISC http://www.theta44.org/karma/ XF windows-wireless-adhoc-unauth-access(24157) The 802.11 wireless client in certain operating systems including Windows 2000, Windows XP, and Windows Server 2003 does not warn the user when (1) it establishes an association with a station in ad hoc (aka peer-to-peer) mode or (2) a station in ad hoc mode establishes an association with it, which allows remote attackers to put unexpected wireless communication into place. cpe:/a:squirrelmail:squirrelmail:1.4 cpe:/a:squirrelmail:squirrelmail:1.4.1 cpe:/a:squirrelmail:squirrelmail:1.4.2 cpe:/a:squirrelmail:squirrelmail:1.4.3 cpe:/a:squirrelmail:squirrelmail:1.4.3_r3 cpe:/a:squirrelmail:squirrelmail:1.4.3_rc1 cpe:/a:squirrelmail:squirrelmail:1.4.3a cpe:/a:squirrelmail:squirrelmail:1.4.4 cpe:/a:squirrelmail:squirrelmail:1.4.4_rc1 cpe:/a:squirrelmail:squirrelmail:1.4.5 cpe:/a:squirrelmail:squirrelmail:1.4.6_rc1 cpe:/a:squirrelmail:squirrelmail:1.4_rc1 CVE-2006-0377 2006-02-23T19:02:00.000-05:00 2017-10-10T21:30:37.313-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov SGI 20060501-01-U SECTRACK 1015662 DEBIAN DSA-988 GENTOO GLSA-200603-09 MANDRIVA MDKSA-2006:049 SUSE SUSE-SR:2006:005 FEDORA FEDORA-2006-133 REDHAT RHSA-2006:0283 BID 16756 CONFIRM http://www.squirrelmail.org/security/issue/2006-02-15 VUPEN ADV-2006-0689 XF squirrelmail-mailbox-imap-injection(24849) CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox parameter of the sqimap_mailbox_select command, aka "IMAP injection." cpe:/a:netrix:x-site_manager CVE-2006-0378 2006-01-23T15:03:00.000-05:00 2017-07-19T21:29:42.533-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16313 VUPEN ADV-2006-0253 XF xsitemanager-productdetails-xss(24234) Cross-site scripting (XSS) vulnerability in Netrix X-Site Manager allows remote attackers to inject arbitrary web script or HTML via the product_id parameter, as originally demonstrated for a custom mp3players_details.php program. NOTE: the name of the affected program might be installation-dependent, but it has been identified as "product_details.php" by some sources. cpe:/o:freebsd:freebsd:5.4:stable cpe:/o:freebsd:freebsd:6.0:stable CVE-2006-0379 2006-01-25T17:03:00.000-05:00 2017-07-19T21:29:42.597-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov FREEBSD FreeBSD-SA-06:06 SECTRACK 1015541 BID 16373 XF bsd-buffer-initialization-disclosure(24338) FreeBSD kernel 5.4-STABLE and 6.0 does not completely initialize a buffer before making it available to userland, which could allow local users to read portions of kernel memory. cpe:/o:freebsd:freebsd:5.4:stable cpe:/o:freebsd:freebsd:6.0:stable CVE-2006-0380 2006-01-25T17:03:00.000-05:00 2017-07-19T21:29:42.643-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov FREEBSD FreeBSD-SA-06:06 SECTRACK 1015541 BID 16373 XF bsd-buffer-length-disclosure(24340) A logic error in FreeBSD kernel 5.4-STABLE and 6.0 causes the kernel to calculate an incorrect buffer length, which causes more data to be copied to userland than intended, which could allow local users to read portions of kernel memory. cpe:/o:freebsd:freebsd:5.3 cpe:/o:freebsd:freebsd:5.3:release cpe:/o:freebsd:freebsd:5.3:releng cpe:/o:freebsd:freebsd:5.3:stable cpe:/o:freebsd:freebsd:5.4:pre-release cpe:/o:freebsd:freebsd:5.4:release cpe:/o:freebsd:freebsd:5.4:releng cpe:/o:freebsd:freebsd:6.0:release cpe:/o:freebsd:freebsd:6.0:stable CVE-2006-0381 2006-01-25T17:03:00.000-05:00 2017-07-19T21:29:42.690-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov FREEBSD FreeBSD-SA-06:07 NETBSD NetBSD-SA2006-004 SECTRACK 1015542 CONFIRM http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net/pf_norm.c.diff?r1=1.103&r2=1.104 BID 16375 XF bsd-pf-fragment-dos(24337) A logic error in the IP fragment cache functionality in pf in FreeBSD 5.3, 5.4, and 6.0, and OpenBSD, when a 'scrub fragment crop' or 'scrub fragment drop-ovl' rule is being used, allows remote attackers to cause a denial of service (crash) via crafted packets that cause a packet fragment to be inserted twice. cpe:/o:apple:mac_os_x:10.4.5 CVE-2006-0382 2006-02-14T17:06:00.000-05:00 2017-07-19T21:29:42.753-04:00 2.1 LOCAL LOW NONE NONE NONE PARTIAL http://nvd.nist.gov APPLE APPLE-SA-2006-02-14 SECTRACK 1015634 BID 16654 VUPEN ADV-2006-0597 XF macosx-system-call-dos(24682) Apple Mac OS X 10.4.5 and allows local users to cause a denial of service (crash) via an undocumented system call. cpe:/o:apple:mac_os_x:10.3 cpe:/o:apple:mac_os_x:10.3.1 cpe:/o:apple:mac_os_x:10.3.2 cpe:/o:apple:mac_os_x:10.3.3 cpe:/o:apple:mac_os_x:10.3.4 cpe:/o:apple:mac_os_x:10.3.5 cpe:/o:apple:mac_os_x:10.3.6 cpe:/o:apple:mac_os_x:10.3.7 cpe:/o:apple:mac_os_x:10.3.8 cpe:/o:apple:mac_os_x:10.3.9 cpe:/o:apple:mac_os_x:10.4 cpe:/o:apple:mac_os_x:10.4.1 cpe:/o:apple:mac_os_x:10.4.2 cpe:/o:apple:mac_os_x:10.4.3 cpe:/o:apple:mac_os_x:10.4.4 cpe:/o:apple:mac_os_x:10.4.5 cpe:/o:apple:mac_os_x_server:10.3 cpe:/o:apple:mac_os_x_server:10.3.1 cpe:/o:apple:mac_os_x_server:10.3.2 cpe:/o:apple:mac_os_x_server:10.3.3 cpe:/o:apple:mac_os_x_server:10.3.4 cpe:/o:apple:mac_os_x_server:10.3.5 cpe:/o:apple:mac_os_x_server:10.3.6 cpe:/o:apple:mac_os_x_server:10.3.7 cpe:/o:apple:mac_os_x_server:10.3.8 cpe:/o:apple:mac_os_x_server:10.3.9 cpe:/o:apple:mac_os_x_server:10.4 cpe:/o:apple:mac_os_x_server:10.4.1 cpe:/o:apple:mac_os_x_server:10.4.2 cpe:/o:apple:mac_os_x_server:10.4.3 cpe:/o:apple:mac_os_x_server:10.4.4 cpe:/o:apple:mac_os_x_server:10.4.5 CVE-2006-0383 2006-03-02T14:06:00.000-05:00 2017-07-19T21:29:42.817-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://docs.info.apple.com/article.html?artnum=303382 APPLE APPLE-SA-2006-03-01 BID 16907 CERT TA06-062A VUPEN ADV-2006-0791 XF macosx-vpn-dos(25025) IPSec when used with VPN networks in Mac OS X 10.4 through 10.4.5 allows remote attackers to cause a denial of service (application crash) via unspecified vectors involving the "incorrect handling of error conditions". cpe:/o:apple:mac_os_x:10.3 cpe:/o:apple:mac_os_x:10.3.1 cpe:/o:apple:mac_os_x:10.3.2 cpe:/o:apple:mac_os_x:10.3.3 cpe:/o:apple:mac_os_x:10.3.4 cpe:/o:apple:mac_os_x:10.3.5 cpe:/o:apple:mac_os_x:10.3.6 cpe:/o:apple:mac_os_x:10.3.7 cpe:/o:apple:mac_os_x:10.3.8 cpe:/o:apple:mac_os_x:10.3.9 cpe:/o:apple:mac_os_x:10.4 cpe:/o:apple:mac_os_x:10.4.1 cpe:/o:apple:mac_os_x:10.4.2 cpe:/o:apple:mac_os_x:10.4.3 cpe:/o:apple:mac_os_x:10.4.4 cpe:/o:apple:mac_os_x:10.4.5 cpe:/o:apple:mac_os_x_server:10.3 cpe:/o:apple:mac_os_x_server:10.3.1 cpe:/o:apple:mac_os_x_server:10.3.2 cpe:/o:apple:mac_os_x_server:10.3.3 cpe:/o:apple:mac_os_x_server:10.3.4 cpe:/o:apple:mac_os_x_server:10.3.5 cpe:/o:apple:mac_os_x_server:10.3.6 cpe:/o:apple:mac_os_x_server:10.3.7 cpe:/o:apple:mac_os_x_server:10.3.8 cpe:/o:apple:mac_os_x_server:10.3.9 cpe:/o:apple:mac_os_x_server:10.4 cpe:/o:apple:mac_os_x_server:10.4.1 cpe:/o:apple:mac_os_x_server:10.4.2 cpe:/o:apple:mac_os_x_server:10.4.3 cpe:/o:apple:mac_os_x_server:10.4.4 cpe:/o:apple:mac_os_x_server:10.4.5 CVE-2006-0384 2006-03-02T14:06:00.000-05:00 2017-07-19T21:29:42.863-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://docs.info.apple.com/article.html?artnum=303382 APPLE APPLE-SA-2006-03-01 SECTRACK 1015709 BID 16907 CERT TA06-062A VUPEN ADV-2006-0791 XF macosx-automount-execute-code(25021) automount in Mac OS X 10.4.5 and earlier allows remote file servers to cause a denial of service (unresponsiveness) or execute arbitrary code via unspecified vectors that cause automount to "mount file systems with reserved names". cpe:/o:apple:mac_os_x:10.3 cpe:/o:apple:mac_os_x:10.3.1 cpe:/o:apple:mac_os_x:10.3.2 cpe:/o:apple:mac_os_x:10.3.3 cpe:/o:apple:mac_os_x:10.3.4 cpe:/o:apple:mac_os_x:10.3.5 cpe:/o:apple:mac_os_x:10.3.6 cpe:/o:apple:mac_os_x:10.3.7 cpe:/o:apple:mac_os_x:10.3.8 cpe:/o:apple:mac_os_x:10.3.9 cpe:/o:apple:mac_os_x:10.4 cpe:/o:apple:mac_os_x:10.4.1 cpe:/o:apple:mac_os_x:10.4.2 cpe:/o:apple:mac_os_x:10.4.3 cpe:/o:apple:mac_os_x:10.4.4 cpe:/o:apple:mac_os_x:10.4.5 cpe:/o:apple:mac_os_x_server:10.3 cpe:/o:apple:mac_os_x_server:10.3.1 cpe:/o:apple:mac_os_x_server:10.3.2 cpe:/o:apple:mac_os_x_server:10.3.3 cpe:/o:apple:mac_os_x_server:10.3.4 cpe:/o:apple:mac_os_x_server:10.3.5 cpe:/o:apple:mac_os_x_server:10.3.6 cpe:/o:apple:mac_os_x_server:10.3.7 cpe:/o:apple:mac_os_x_server:10.3.8 cpe:/o:apple:mac_os_x_server:10.3.9 cpe:/o:apple:mac_os_x_server:10.4 cpe:/o:apple:mac_os_x_server:10.4.1 cpe:/o:apple:mac_os_x_server:10.4.2 cpe:/o:apple:mac_os_x_server:10.4.3 cpe:/o:apple:mac_os_x_server:10.4.4 cpe:/o:apple:mac_os_x_server:10.4.5 CVE-2006-0386 2006-03-03T17:02:00.000-05:00 2017-07-19T21:29:42.927-04:00 1.7 LOCAL LOW SINGLE_INSTANCE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://docs.info.apple.com/article.html?artnum=303382 APPLE APPLE-SA-2006-03-01 BID 16907 CERT TA06-062A VUPEN ADV-2006-0791 XF macosx-filevault-file-access(25024) FileVault in Mac OS X 10.4.5 and earlier does not properly mount user directories when creating a FileVault image, which allows local users to access protected files when FileVault is enabled. cpe:/o:apple:mac_os_x:10.3 cpe:/o:apple:mac_os_x:10.3.1 cpe:/o:apple:mac_os_x:10.3.2 cpe:/o:apple:mac_os_x:10.3.3 cpe:/o:apple:mac_os_x:10.3.4 cpe:/o:apple:mac_os_x:10.3.5 cpe:/o:apple:mac_os_x:10.3.6 cpe:/o:apple:mac_os_x:10.3.7 cpe:/o:apple:mac_os_x:10.3.8 cpe:/o:apple:mac_os_x:10.3.9 cpe:/o:apple:mac_os_x:10.4 cpe:/o:apple:mac_os_x:10.4.1 cpe:/o:apple:mac_os_x:10.4.2 cpe:/o:apple:mac_os_x:10.4.3 cpe:/o:apple:mac_os_x:10.4.4 cpe:/o:apple:mac_os_x:10.4.5 cpe:/o:apple:mac_os_x_server:10.3 cpe:/o:apple:mac_os_x_server:10.3.1 cpe:/o:apple:mac_os_x_server:10.3.2 cpe:/o:apple:mac_os_x_server:10.3.3 cpe:/o:apple:mac_os_x_server:10.3.4 cpe:/o:apple:mac_os_x_server:10.3.5 cpe:/o:apple:mac_os_x_server:10.3.6 cpe:/o:apple:mac_os_x_server:10.3.7 cpe:/o:apple:mac_os_x_server:10.3.8 cpe:/o:apple:mac_os_x_server:10.3.9 cpe:/o:apple:mac_os_x_server:10.4 cpe:/o:apple:mac_os_x_server:10.4.1 cpe:/o:apple:mac_os_x_server:10.4.2 cpe:/o:apple:mac_os_x_server:10.4.3 cpe:/o:apple:mac_os_x_server:10.4.4 cpe:/o:apple:mac_os_x_server:10.4.5 CVE-2006-0387 2006-03-06T15:06:00.000-05:00 2017-07-19T21:29:42.987-04:00 6.4 NETWORK LOW NONE NONE PARTIAL PARTIAL http://nvd.nist.gov CONFIRM http://docs.info.apple.com/article.html?artnum=303382 APPLE APPLE-SA-2006-03-01 SECTRACK 1015713 CERT-VN VU#176732 BID 16907 CERT TA06-062A VUPEN ADV-2006-0791 XF macosx-safari-bo(25032) Stack-based buffer overflow in Safari in Mac OS X 10.4.5 and earlier, and 10.3.9 and earlier, allows remote attackers to execute arbitrary code via unspecified vectors involving a web page with crafted JavaScript, a different vulnerability than CVE-2005-4504. cpe:/o:apple:mac_os_x:10.3 cpe:/o:apple:mac_os_x:10.3.1 cpe:/o:apple:mac_os_x:10.3.2 cpe:/o:apple:mac_os_x:10.3.3 cpe:/o:apple:mac_os_x:10.3.4 cpe:/o:apple:mac_os_x:10.3.5 cpe:/o:apple:mac_os_x:10.3.6 cpe:/o:apple:mac_os_x:10.3.7 cpe:/o:apple:mac_os_x:10.3.8 cpe:/o:apple:mac_os_x:10.3.9 cpe:/o:apple:mac_os_x:10.4 cpe:/o:apple:mac_os_x:10.4.1 cpe:/o:apple:mac_os_x:10.4.2 cpe:/o:apple:mac_os_x:10.4.3 cpe:/o:apple:mac_os_x:10.4.4 cpe:/o:apple:mac_os_x:10.4.5 cpe:/o:apple:mac_os_x_server:10.3 cpe:/o:apple:mac_os_x_server:10.3.1 cpe:/o:apple:mac_os_x_server:10.3.2 cpe:/o:apple:mac_os_x_server:10.3.3 cpe:/o:apple:mac_os_x_server:10.3.4 cpe:/o:apple:mac_os_x_server:10.3.5 cpe:/o:apple:mac_os_x_server:10.3.6 cpe:/o:apple:mac_os_x_server:10.3.7 cpe:/o:apple:mac_os_x_server:10.3.8 cpe:/o:apple:mac_os_x_server:10.3.9 cpe:/o:apple:mac_os_x_server:10.4 cpe:/o:apple:mac_os_x_server:10.4.1 cpe:/o:apple:mac_os_x_server:10.4.2 cpe:/o:apple:mac_os_x_server:10.4.3 cpe:/o:apple:mac_os_x_server:10.4.4 cpe:/o:apple:mac_os_x_server:10.4.5 CVE-2006-0388 2006-03-03T17:02:00.000-05:00 2017-07-19T21:29:43.067-04:00 2.6 LOCAL HIGH NONE NONE PARTIAL PARTIAL http://nvd.nist.gov CONFIRM http://docs.info.apple.com/article.html?artnum=303382 APPLE APPLE-SA-2006-03-01 SECTRACK 1015713 BID 16907 CERT TA06-062A VUPEN ADV-2006-0791 XF macosx-safari-http-redirect(25038) Safari in Mac OS X 10.3 before 10.3.9 and 10.4 before 10.4.5 allows remote attackers to redirect users to local files and execute arbitrary JavaScript via unspecified vectors involving HTTP redirection to local resources. cpe:/o:apple:mac_os_x:10.4 cpe:/o:apple:mac_os_x:10.4.1 cpe:/o:apple:mac_os_x:10.4.2 cpe:/o:apple:mac_os_x:10.4.3 cpe:/o:apple:mac_os_x:10.4.4 cpe:/o:apple:mac_os_x:10.4.5 cpe:/o:apple:mac_os_x_server:10.4 cpe:/o:apple:mac_os_x_server:10.4.1 cpe:/o:apple:mac_os_x_server:10.4.2 cpe:/o:apple:mac_os_x_server:10.4.3 cpe:/o:apple:mac_os_x_server:10.4.4 cpe:/o:apple:mac_os_x_server:10.4.5 CVE-2006-0389 2006-03-03T17:02:00.000-05:00 2017-07-19T21:29:43.377-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://docs.info.apple.com/article.html?artnum=303382 APPLE APPLE-SA-2006-03-01 BID 16907 CERT TA06-062A VUPEN ADV-2006-0791 XF macosx-syndication-xss(25040) Cross-site scripting (XSS) vulnerability in Syndication (Safari RSS) in Mac OS X 10.4 through 10.4.5 allows remote attackers to execute arbitrary JavaScript via unspecified vectors involving RSS feeds. CVE-2006-0390 2006-03-06T15:06:00.000-05:00 2008-09-10T15:58:04.867-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-4504. Reason: This candidate is a duplicate of CVE-2005-4504. Notes: All CVE users should reference CVE-2005-4504 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. cpe:/o:apple:mac_os_x:10.3.1 cpe:/o:apple:mac_os_x:10.3.3 cpe:/o:apple:mac_os_x:10.3.4 cpe:/o:apple:mac_os_x:10.3.5 cpe:/o:apple:mac_os_x:10.3.6 cpe:/o:apple:mac_os_x:10.3.7 cpe:/o:apple:mac_os_x:10.3.8 cpe:/o:apple:mac_os_x:10.4 cpe:/o:apple:mac_os_x:10.4.1 cpe:/o:apple:mac_os_x:10.4.2 cpe:/o:apple:mac_os_x:10.4.3 cpe:/o:apple:mac_os_x:10.4.4 CVE-2006-0391 2006-03-03T17:02:00.000-05:00 2017-07-19T21:29:43.440-04:00 1.7 LOCAL LOW SINGLE_INSTANCE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://docs.info.apple.com/article.html?artnum=303382 APPLE APPLE-SA-2006-03-01 IDEFENSE 20060302 Apple MacOS X BOMArchiveHelper Directory Traversal Vulnerability BID 16907 CERT TA06-062A VUPEN ADV-2006-0791 XF macosx-bom-directory-traversal(25023) Directory traversal vulnerability in the BOM framework in Mac OS X 10.x before 10.3.9 and 10.4 before 10.4.5 allows user-assisted attackers to overwrite or create arbitrary files via an archive that is handled by BOMArchiveHelper. cpe:/o:apple:mac_os_x:10.4.7 cpe:/o:apple:mac_os_x_server:10.4.7 CVE-2006-0392 2006-08-02T21:04:00.000-04:00 2017-07-19T21:29:43.503-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS APPLE APPLE-SA-2006-08-01 CERT-VN VU#527236 BID 19289 CERT TA06-214A VUPEN ADV-2006-3101 XF macosx-raw-image-bo(28142) Buffer overflow in Apple Mac OS X 10.4.7 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Canon RAW image. cpe:/o:apple:mac_os_x:10.4.7 cpe:/o:apple:mac_os_x_server:10.4.7 CVE-2006-0393 2006-08-02T21:04:00.000-04:00 2017-07-19T21:29:43.567-04:00 4.0 NETWORK HIGH NONE PARTIAL NONE PARTIAL http://nvd.nist.gov APPLE APPLE-SA-2006-08-01 SECTRACK 1016672 BID 19289 CERT TA06-214A VUPEN ADV-2006-3101 XF macosx-openssh-nonexistent-user-dos(28147) OpenSSH in Apple Mac OS X 10.4.7 allows remote attackers to cause a denial of service or determine account existence by attempting to log in using an invalid user, which causes the server to hang. CVE-2006-0394 2006-03-01T20:02:00.000-05:00 2008-09-10T15:58:05.337-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0848. Reason: This candidate is a duplicate of CVE-2006-0848. Notes: All CVE users should reference CVE-2006-0848 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. cpe:/o:apple:mac_os_x:10.4.5 cpe:/o:apple:mac_os_x_server:10.4.5 CVE-2006-0395 2006-08-04T21:04:00.000-04:00 2017-07-19T21:29:43.627-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://docs.info.apple.com/article.html?artnum=303382 APPLE APPLE-SA-2006-03-01 BID 16907 CERT TA06-062A VUPEN ADV-2006-0791 XF macosx-mail-bypass-security(25027) The Download Validation in Mail in Mac OS X 10.4 does not properly recognize attachment file types to warn a user of an unsafe type, which allows user-assisted remote attackers to execute arbitrary code via crafted file types. cpe:/o:apple:mac_os_x:10.4 cpe:/o:apple:mac_os_x:10.4.1 cpe:/o:apple:mac_os_x:10.4.2 cpe:/o:apple:mac_os_x:10.4.3 cpe:/o:apple:mac_os_x:10.4.4 cpe:/o:apple:mac_os_x:10.4.5 cpe:/o:apple:mac_os_x_server:10.4 cpe:/o:apple:mac_os_x_server:10.4.1 cpe:/o:apple:mac_os_x_server:10.4.2 cpe:/o:apple:mac_os_x_server:10.4.3 cpe:/o:apple:mac_os_x_server:10.4.4 cpe:/o:apple:mac_os_x_server:10.4.5 CVE-2006-0396 2006-03-14T06:02:00.000-05:00 2018-10-19T11:44:35.457-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://docs.info.apple.com/article.html?artnum=303453 APPLE APPLE-SA-2006-03-13 SECTRACK 1015762 MISC http://www.digitalmunition.com/DMA%5B2006-0313a%5D.txt CERT-VN VU#980084 BUGTRAQ 20060314 DMA[2006-0313a] - 'Apple OSX Mail.app RFC1740 Real Name Buffer Overflow' BID 17081 VUPEN ADV-2006-0949 XF macosx-mail-attachment-bo(25209) Buffer overflow in Mail in Apple Mac OS X 10.4 up to 10.4.5, when patched with Security Update 2006-001, allows remote attackers to execute arbitrary code via a long Real Name value in an e-mail attachment sent in AppleDouble format, which triggers the overflow when the user double-clicks on an attachment. cpe:/o:apple:mac_os_x:10.4 cpe:/o:apple:mac_os_x:10.4.1 cpe:/o:apple:mac_os_x:10.4.2 cpe:/o:apple:mac_os_x:10.4.3 cpe:/o:apple:mac_os_x:10.4.4 cpe:/o:apple:mac_os_x:10.4.5 cpe:/o:apple:mac_os_x_server:10.4 cpe:/o:apple:mac_os_x_server:10.4.1 cpe:/o:apple:mac_os_x_server:10.4.2 cpe:/o:apple:mac_os_x_server:10.4.3 cpe:/o:apple:mac_os_x_server:10.4.4 cpe:/o:apple:mac_os_x_server:10.4.5 CVE-2006-0397 2006-03-14T06:02:00.000-05:00 2017-07-19T21:29:43.753-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://docs.info.apple.com/article.html?artnum=303453 APPLE APPLE-SA-2006-03-13 SECTRACK 1015760 VUPEN ADV-2006-0949 XF macosx-safefiletype-command-execution(25269) Unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. NOTE: due to the lack of specific information in the vendor advisory, it is not clear how CVE-2006-0397, CVE-2006-0398, and CVE-2006-0399 are different. cpe:/o:apple:mac_os_x:10.4 cpe:/o:apple:mac_os_x:10.4.1 cpe:/o:apple:mac_os_x:10.4.2 cpe:/o:apple:mac_os_x:10.4.3 cpe:/o:apple:mac_os_x:10.4.4 cpe:/o:apple:mac_os_x:10.4.5 cpe:/o:apple:mac_os_x_server:10.4 cpe:/o:apple:mac_os_x_server:10.4.1 cpe:/o:apple:mac_os_x_server:10.4.2 cpe:/o:apple:mac_os_x_server:10.4.3 cpe:/o:apple:mac_os_x_server:10.4.4 cpe:/o:apple:mac_os_x_server:10.4.5 CVE-2006-0398 2006-03-14T06:02:00.000-05:00 2017-07-19T21:29:43.817-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://docs.info.apple.com/article.html?artnum=303453 APPLE APPLE-SA-2006-03-13 SECTRACK 1015760 VUPEN ADV-2006-0949 XF macosx-safefiletype-command-execution(25269) Unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. NOTE: due to the lack of specific information in the vendor advisory, it is not clear how CVE-2006-0397, CVE-2006-0398, and CVE-2006-0399 are different. cpe:/o:apple:mac_os_x:10.4 cpe:/o:apple:mac_os_x:10.4.1 cpe:/o:apple:mac_os_x:10.4.2 cpe:/o:apple:mac_os_x:10.4.3 cpe:/o:apple:mac_os_x:10.4.4 cpe:/o:apple:mac_os_x:10.4.5 cpe:/o:apple:mac_os_x_server:10.4 cpe:/o:apple:mac_os_x_server:10.4.1 cpe:/o:apple:mac_os_x_server:10.4.2 cpe:/o:apple:mac_os_x_server:10.4.3 cpe:/o:apple:mac_os_x_server:10.4.4 cpe:/o:apple:mac_os_x_server:10.4.5 CVE-2006-0399 2006-03-14T06:02:00.000-05:00 2017-07-19T21:29:43.863-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://docs.info.apple.com/article.html?artnum=303453 APPLE APPLE-SA-2006-03-13 SECTRACK 1015760 VUPEN ADV-2006-0949 XF macosx-safefiletype-command-execution(25269) Unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. NOTE: due to the lack of specific information in the vendor advisory, it is not clear how CVE-2006-0397, CVE-2006-0398, and CVE-2006-0399 are different. cpe:/o:apple:mac_os_x:10.4 cpe:/o:apple:mac_os_x:10.4.1 cpe:/o:apple:mac_os_x:10.4.2 cpe:/o:apple:mac_os_x:10.4.3 cpe:/o:apple:mac_os_x:10.4.4 cpe:/o:apple:mac_os_x:10.4.5 cpe:/o:apple:mac_os_x_server:10.4 cpe:/o:apple:mac_os_x_server:10.4.1 cpe:/o:apple:mac_os_x_server:10.4.2 cpe:/o:apple:mac_os_x_server:10.4.3 cpe:/o:apple:mac_os_x_server:10.4.4 cpe:/o:apple:mac_os_x_server:10.4.5 CVE-2006-0400 2006-03-14T06:02:00.000-05:00 2017-07-19T21:29:43.927-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://docs.info.apple.com/article.html?artnum=303453 APPLE APPLE-SA-2006-03-13 SECTRACK 1015763 BID 17082 VUPEN ADV-2006-0949 XF macosx-sameorigin-policy-bypass(25208) CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows remote attackers to bypass the same-origin policy and execute Javascript in other domains via unknown vectors involving "crafted archives." cpe:/o:apple:mac_os_x:10.4.5 cpe:/o:apple:mac_os_x_server:10.4.5 CVE-2006-0401 2006-04-05T06:04:00.000-04:00 2017-07-19T21:29:43.973-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://docs.info.apple.com/article.html?artnum=303567 SECTRACK 1015859 BID 17364 VUPEN ADV-2006-1215 XF macosx-firmware-password-bypass(25620) Unspecified vulnerability in Mac OS X before 10.4.6, when running on an Intel-based computer, allows attackers with physical access to bypass the firmware password and log on in Single User Mode via unspecified vectors. cpe:/a:jason_geiger:zoph:0.3.3 cpe:/a:jason_geiger:zoph:0.4 CVE-2006-0402 2006-01-24T21:03:00.000-05:00 2017-07-19T21:29:44.020-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://sourceforge.net/project/shownotes.php?group_id=69353&release_id=387320 DEBIAN DSA-989 BID 16347 VUPEN ADV-2006-0297 XF zoph-sql-injection(24264) SQL injection vulnerability in Zoph before 0.5pre1 allows remote attackers to execute arbitrary SQL commands. cpe:/a:e-moblog:e-moblog:1.3 CVE-2006-0403 2006-01-24T21:03:00.000-05:00 2018-10-19T11:44:37.720-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS VIM 20060125 The parameter in e-moBLOG is "monthy" [sic] MISC http://evuln.com/vulns/43/summary.html SREASON 370 SECTRACK 1015524 BUGTRAQ 20060122 [eVuln] e-moBLOG SQL Injection Vulnerability BID 16344 VUPEN ADV-2006-0296 XF emoblog-index-sql-injection(24245) Multiple SQL injection vulnerabilities in e-moBLOG 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) monthy parameter to index.php or (2) login parameter to admin/index.php. NOTE: some sources have reported item 1 as involving the "monthly" parameter, but this is incorrect. cpe:/a:mike_macgirvin:note-a-day_weblog:2.2 CVE-2006-0404 2006-01-24T21:03:00.000-05:00 2017-07-19T21:29:44.143-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BUGTRAQ 20060122 [eVuln] Note-A-Day Weblog Sensitive Information Disclosure MISC http://evuln.com/vulns/44/summary.html SREASON 371 SECTRACK 1015539 VUPEN ADV-2006-0299 XF noteaday-archive-information-disclosure(24270) Note-A-Day Weblog 2.2 stores sensitive data under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to archive/.phpass-admin, which contains encrypted passwords. cpe:/a:libtiff:libtiff:3.8.0 CVE-2006-0405 2006-01-24T21:03:00.000-05:00 2017-07-19T21:29:44.253-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://bugzilla.remotesensing.org/show_bug.cgi?id=1029 MISC http://bugzilla.remotesensing.org/show_bug.cgi?id=1034 GENTOO GLSA-200605-17 BID 18172 VUPEN ADV-2006-0302 XF libtiff-tiffvsetfield-dos(24275) The TIFFFetchShortPair function in tif_dirread.c in libtiff 3.8.0 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a NULL pointer dereference, possibly due to changes in type declarations and/or the TIFFVSetField function. cpe:/a:mybulletinboard:mybulletinboard:1.0.2 CVE-2006-0406 2006-01-24T21:03:00.000-05:00 2018-10-19T11:44:38.567-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BUGTRAQ 20060114 MyBB 1.0.2 Sniffing table perfix bug in search.php XF mybb-search-information-disclosure(24272) search.php in MyBB 1.0.2 allows remote attackers to obtain sensitive information via a certain search request that reveals the table prefix in a SQL error message, possibly due to invalid parameters. cpe:/a:azbb:az_bulletin_board:1.0.0 cpe:/a:azbb:az_bulletin_board:1.0.0rc1 cpe:/a:azbb:az_bulletin_board:1.0.0rc2 cpe:/a:azbb:az_bulletin_board:1.0.1 cpe:/a:azbb:az_bulletin_board:1.0.2 cpe:/a:azbb:az_bulletin_board:1.0.3 cpe:/a:azbb:az_bulletin_board:1.0.4 cpe:/a:azbb:az_bulletin_board:1.0.5 cpe:/a:azbb:az_bulletin_board:1.0.6 cpe:/a:azbb:az_bulletin_board:1.0.7 cpe:/a:azbb:az_bulletin_board:1.0.8 cpe:/a:azbb:az_bulletin_board:1.0.9 cpe:/a:azbb:az_bulletin_board:1.0.10 cpe:/a:azbb:az_bulletin_board:1.0.11 cpe:/a:azbb:az_bulletin_board:1.0.12 cpe:/a:azbb:az_bulletin_board:1.1.00 CVE-2006-0407 2006-01-24T21:03:00.000-05:00 2018-10-19T11:44:38.940-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://kapda.ir/advisory-236.html BUGTRAQ 20060123 Azbb v1.1.00 Cross-Site Scripting BUGTRAQ 20060128 [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting BUGTRAQ 20060308 Re: [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting BUGTRAQ 20060308 Re: [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting BUGTRAQ 20060309 Re: Re: [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting BID 16351 VUPEN ADV-2006-0298 XF azbulletinboard-post-xss(24274) Cross-site scripting (XSS) vulnerability in post.php in AZ Bulletin Board (AZbb) 1.1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) nickname parameter and (2) an iframe tag in the topic parameter. NOTE: the original disclosure specified the name parameter, but a correction was later provided. NOTE: followup posts have both disputed and confirmed the original claim. cpe:/a:sun:grid_engine:6.0 cpe:/a:sun:grid_engine:6.0:update1 cpe:/a:sun:grid_engine:6.0:update2 cpe:/a:sun:grid_engine:6.0:update3 cpe:/a:sun:grid_engine:6.0:update4 cpe:/a:sun:grid_engine:6.0:update5 cpe:/a:sun:grid_engine:6.0:update6 cpe:/a:sun:grid_engine:6.0:update7 CVE-2006-0408 2006-01-24T21:03:00.000-05:00 2017-07-19T21:29:44.427-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS CONFIRM http://gridengine.sunsource.net/project/gridengine/60patches.txt SECTRACK 1015531 BID 16366 VUPEN ADV-2006-0308 XF sge-rsh-gain-privileges(24281) rsh utility in Sun Grid Engine (SGE) before 6.0u7_1 allows local users to gain privileges and execute arbitrary code via unspecified vectors, possibly involving command line arguments. cpe:/a:pixelpost:photoblog:1.4.3 CVE-2006-0409 2006-01-24T21:03:00.000-05:00 2018-10-19T11:44:41.580-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/45/summary.html SECTRACK 1015529 BUGTRAQ 20060123 [eVuln] Pixelpost Photoblog XSS Vulnerability BID 16362 VUPEN ADV-2006-0309 XF pixelpost-index-xss(24261) Cross-site scripting (XSS) vulnerability in index.php in Pixelpost Photoblog 1.4.3 allows remote attackers to inject arbitrary web script or HTML via the "Add Comment" field in a comment popup. cpe:/a:john_lim:adodb:4.66 cpe:/a:john_lim:adodb:4.68 cpe:/a:john_lim:adodb:4.70 CVE-2006-0410 2006-01-24T21:03:00.000-05:00 2017-07-19T21:29:44.533-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://sourceforge.net/project/shownotes.php?release_id=387862&group_id=42718 DEBIAN DSA-1029 DEBIAN DSA-1030 DEBIAN DSA-1031 GENTOO GLSA-200602-02 GENTOO GLSA-200604-07 BID 16364 VUPEN ADV-2006-0315 VUPEN ADV-2006-0448 XF adodb-postgresql-sql-injection(24314) SQL injection vulnerability in ADOdb before 4.71, when using PostgreSQL, allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors involving binary strings. cpe:/a:claroline:claroline:1.7.2 CVE-2006-0411 2006-01-25T06:03:00.000-05:00 2017-07-19T21:29:44.580-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS BUGTRAQ 20060120 Claroline 1.7.2, sso identification vulnerability BID 16341 VUPEN ADV-2006-0320 XF claroline-cookie-bypass-security(24326) claro_init_local.inc.php in Claroline 1.7.2 uses guessable session cookies (MD5 hash of connection time), which allows remote attackers to hijack sessions and possibly gain administrative privileges. cpe:/a:gencbeyin_web_programlama:cybershop:- CVE-2006-0412 2006-01-25T06:03:00.000-05:00 2017-07-19T21:29:44.660-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060105 CyberShop User Login Sql Injection XF cybershop-login-sql-injection(24005) SQL injection vulnerability in CyberShop allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in a login action. cpe:/a:newsphp:newsphp CVE-2006-0413 2006-01-25T06:03:00.000-05:00 2018-10-19T11:44:41.940-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060122 Newsphp Multiple SQL Injection Vulnerabilities BID 16339 VUPEN ADV-2006-0341 XF newsphp-index-sql-injection(24320) Multiple SQL injection vulnerabilities in index.php in NewsPHP allow remote attackers to execute arbitrary SQL commands via the (1) discuss, (2) tim, (3) id, (4) last, and (5) limit parameter. cpe:/a:tor:tor:0.0.2 cpe:/a:tor:tor:0.0.2_pre13 cpe:/a:tor:tor:0.0.2_pre14 cpe:/a:tor:tor:0.0.2_pre15 cpe:/a:tor:tor:0.0.2_pre16 cpe:/a:tor:tor:0.0.2_pre17 cpe:/a:tor:tor:0.0.2_pre18 cpe:/a:tor:tor:0.0.2_pre19 cpe:/a:tor:tor:0.0.2_pre20 cpe:/a:tor:tor:0.0.2_pre21 cpe:/a:tor:tor:0.0.2_pre22 cpe:/a:tor:tor:0.0.2_pre23 cpe:/a:tor:tor:0.0.2_pre24 cpe:/a:tor:tor:0.0.2_pre25 cpe:/a:tor:tor:0.0.2_pre26 cpe:/a:tor:tor:0.0.2_pre27 cpe:/a:tor:tor:0.0.3 cpe:/a:tor:tor:0.0.4 cpe:/a:tor:tor:0.0.5 cpe:/a:tor:tor:0.0.6 cpe:/a:tor:tor:0.0.6.1 cpe:/a:tor:tor:0.0.6.2 cpe:/a:tor:tor:0.0.7 cpe:/a:tor:tor:0.0.7.1 cpe:/a:tor:tor:0.0.7.2 cpe:/a:tor:tor:0.0.7.3 cpe:/a:tor:tor:0.0.8 cpe:/a:tor:tor:0.0.8.1 cpe:/a:tor:tor:0.0.9 cpe:/a:tor:tor:0.0.9.1 cpe:/a:tor:tor:0.0.9.2 cpe:/a:tor:tor:0.0.9.3 cpe:/a:tor:tor:0.0.9.4 cpe:/a:tor:tor:0.0.9.5 cpe:/a:tor:tor:0.0.9.6 cpe:/a:tor:tor:0.0.9.7 cpe:/a:tor:tor:0.0.9.8 cpe:/a:tor:tor:0.0.9.9 cpe:/a:tor:tor:0.0.9.10 cpe:/a:tor:tor:0.1.0.10 cpe:/a:tor:tor:0.1.0.11 cpe:/a:tor:tor:0.1.0.12 cpe:/a:tor:tor:0.1.0.13 cpe:/a:tor:tor:0.1.0.14 cpe:/a:tor:tor:0.1.0.15 cpe:/a:tor:tor:0.1.0.16 cpe:/a:tor:tor:0.1.0.17 cpe:/a:tor:tor:0.1.1.1_alpha cpe:/a:tor:tor:0.1.1.2_alpha cpe:/a:tor:tor:0.1.1.3_alpha cpe:/a:tor:tor:0.1.1.4_alpha cpe:/a:tor:tor:0.1.1.5_alpha cpe:/a:tor:tor:0.1.1.6_alpha cpe:/a:tor:tor:0.1.1.7_alpha cpe:/a:tor:tor:0.1.1.8_alpha cpe:/a:tor:tor:0.1.1.9_alpha cpe:/a:tor:tor:0.1.1.10_alpha CVE-2006-0414 2006-01-25T06:03:00.000-05:00 2017-07-19T21:29:44.783-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://archives.seul.org/or/announce/Jan-2006/msg00001.html GENTOO GLSA-200606-04 CONFIRM http://tor.eff.org/cvs/tor/ChangeLog BID 18323 BID 19795 XF tor-service-information-disclosure(24285) Tor before 0.1.1.20 allows remote attackers to identify hidden services via a malicious Tor server that attempts a large number of accesses of the hidden service, which eventually causes a circuit to be built through the malicious server. cpe:/a:sleeperchat:sleeperchat:0.3f CVE-2006-0415 2006-01-25T06:03:00.000-05:00 2017-07-19T21:29:44.830-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015525 BID 16363 XF sleeperchat-index-xss(24300) Cross-site scripting (XSS) vulnerability in index.php in SleeperChat 0.3f and earlier allows remote attackers to inject arbitrary web script or HTML via the pseudo parameter. cpe:/a:sleeperchat:sleeperchat:0.3f CVE-2006-0416 2006-01-25T06:03:00.000-05:00 2017-07-19T21:29:44.893-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015525 XF sleeperchat-txt-security-bypass(24357) SleeperChat 0.3f and earlier allows remote attackers to bypass authentication and create new entries via the txt parameter to (1) chat_no.php and (2) chat_if.php. cpe:/a:mywebland:minibloggie:1.0 CVE-2006-0417 2006-01-25T06:03:00.000-05:00 2018-10-19T11:44:42.347-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/47/summary.html SECTRACK 1015534 BUGTRAQ 20060124 [eVuln] miniBloggie Authentication Bypass BID 16367 VUPEN ADV-2006-0310 XF minibloggie-login-sql-injection(24280) SQL injection vulnerability in login.php in miniBloggie 1.0 and earlier, when gpc_magic_quotes is disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password parameters. cpe:/a:topcmm_computing:123_flash_chat_server:5.0 cpe:/a:topcmm_computing:123_flash_chat_server:5.1 CVE-2006-0418 2006-01-25T06:03:00.000-05:00 2018-10-19T11:44:42.957-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BUGTRAQ 20060124 [ISecAuditors Advisories] Arbitrary flash code remote execution in 123flashchat BID 16360 Eval injection vulnerability in 123 Flash Chat Server 5.0 and 5.1 allows attackers to execute arbitrary code via a crafted username. cpe:/a:bea:weblogic_server:7.0:sp1 cpe:/a:bea:weblogic_server:7.0:sp1:express cpe:/a:bea:weblogic_server:7.0:sp2 cpe:/a:bea:weblogic_server:7.0:sp2:express cpe:/a:bea:weblogic_server:7.0:sp3 cpe:/a:bea:weblogic_server:7.0:sp3:express cpe:/a:bea:weblogic_server:7.0:sp4 cpe:/a:bea:weblogic_server:7.0:sp4:express cpe:/a:bea:weblogic_server:7.0:sp5 cpe:/a:bea:weblogic_server:7.0:sp5:express cpe:/a:bea:weblogic_server:7.0:sp6 cpe:/a:bea:weblogic_server:7.0:sp6:express cpe:/a:bea:weblogic_server:8.1:sp1 cpe:/a:bea:weblogic_server:8.1:sp1:express cpe:/a:bea:weblogic_server:8.1:sp2 cpe:/a:bea:weblogic_server:8.1:sp2:express cpe:/a:bea:weblogic_server:8.1:sp3 cpe:/a:bea:weblogic_server:8.1:sp3:express cpe:/a:bea:weblogic_server:8.1:sp4 cpe:/a:bea:weblogic_server:8.1:sp4:express cpe:/a:bea:weblogic_server:8.1:sp5 cpe:/a:bea:weblogic_server:8.1:sp5:express cpe:/a:bea:weblogic_server:9.0 cpe:/a:bea:weblogic_server:9.0::express CVE-2006-0419 2006-01-25T18:07:00.000-05:00 2008-09-05T16:59:12.510-04:00 6.4 NETWORK LOW NONE PARTIAL NONE PARTIAL http://nvd.nist.gov 2006-01-26T23:00:00.000-05:00 BEA BEA06-81.01 SECTRACK 1015528 BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which allows remote attackers to read user entries or cause a denial of service (unspecified) via a large number of connections. cpe:/a:bea:weblogic_server:7.0:sp1 cpe:/a:bea:weblogic_server:7.0:sp1:express cpe:/a:bea:weblogic_server:7.0:sp2 cpe:/a:bea:weblogic_server:7.0:sp2:express cpe:/a:bea:weblogic_server:7.0:sp3 cpe:/a:bea:weblogic_server:7.0:sp3:express cpe:/a:bea:weblogic_server:7.0:sp4 cpe:/a:bea:weblogic_server:7.0:sp4:express cpe:/a:bea:weblogic_server:7.0:sp5 cpe:/a:bea:weblogic_server:7.0:sp5:express cpe:/a:bea:weblogic_server:7.0:sp6 cpe:/a:bea:weblogic_server:7.0:sp6:express cpe:/a:bea:weblogic_server:8.1:sp1 cpe:/a:bea:weblogic_server:8.1:sp1:express cpe:/a:bea:weblogic_server:8.1:sp2 cpe:/a:bea:weblogic_server:8.1:sp2:express cpe:/a:bea:weblogic_server:8.1:sp3 cpe:/a:bea:weblogic_server:8.1:sp3:express cpe:/a:bea:weblogic_server:8.1:sp4 cpe:/a:bea:weblogic_server:8.1:sp4:express CVE-2006-0420 2006-01-25T18:07:00.000-05:00 2008-09-05T16:59:12.713-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov 2006-01-26T08:36:00.000-05:00 BEA BEA06-106.01 SECTRACK 1015528 BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when servlets use relative forwarding, which allows remote attackers to cause a denial of service (slowdown) via unknown attack vectors that cause "looping stack overflow errors." cpe:/a:bea:weblogic_server:6.1 cpe:/a:bea:weblogic_server:6.1::express cpe:/a:bea:weblogic_server:7.0 cpe:/a:bea:weblogic_server:7.0::express CVE-2006-0421 2006-01-25T18:07:00.000-05:00 2017-07-19T21:29:44.987-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BEA BEA06-108.00 SECTRACK 1015528 BID 16358 VUPEN ADV-2006-0313 XF weblogic-cross-domain-management(24286) By design, BEA WebLogic Server and WebLogic Express 7.0 and 6.1, when creating multiple domains from the same WebLogic instance on the same machine, allows administrators of any created domain to access other created domains, which could allow administrators to gain privileges that were not intended. cpe:/a:bea:weblogic_server:6.1:sp1 cpe:/a:bea:weblogic_server:6.1:sp1:express cpe:/a:bea:weblogic_server:6.1:sp2 cpe:/a:bea:weblogic_server:6.1:sp2:express cpe:/a:bea:weblogic_server:6.1:sp3 cpe:/a:bea:weblogic_server:6.1:sp3:express cpe:/a:bea:weblogic_server:6.1:sp4 cpe:/a:bea:weblogic_server:6.1:sp4:express cpe:/a:bea:weblogic_server:6.1:sp5 cpe:/a:bea:weblogic_server:6.1:sp5:express cpe:/a:bea:weblogic_server:6.1:sp6 cpe:/a:bea:weblogic_server:6.1:sp7 cpe:/a:bea:weblogic_server:6.1:sp7:express cpe:/a:bea:weblogic_server:7.0:sp1 cpe:/a:bea:weblogic_server:7.0:sp1:express cpe:/a:bea:weblogic_server:7.0:sp2 cpe:/a:bea:weblogic_server:7.0:sp2:express cpe:/a:bea:weblogic_server:7.0:sp3 cpe:/a:bea:weblogic_server:7.0:sp3:express cpe:/a:bea:weblogic_server:7.0:sp4 cpe:/a:bea:weblogic_server:7.0:sp4:express cpe:/a:bea:weblogic_server:7.0:sp5 cpe:/a:bea:weblogic_server:7.0:sp5:express cpe:/a:bea:weblogic_server:7.0:sp6 cpe:/a:bea:weblogic_server:7.0:sp6:express cpe:/a:bea:weblogic_server:8.1:sp1 cpe:/a:bea:weblogic_server:8.1:sp1:express cpe:/a:bea:weblogic_server:8.1:sp2 cpe:/a:bea:weblogic_server:8.1:sp2:express cpe:/a:bea:weblogic_server:8.1:sp3 cpe:/a:bea:weblogic_server:8.1:sp3:express cpe:/a:bea:weblogic_server:8.1:sp4 cpe:/a:bea:weblogic_server:8.1:sp4:express CVE-2006-0422 2006-01-25T18:07:00.000-05:00 2017-07-19T21:29:45.050-04:00 6.4 NETWORK LOW NONE PARTIAL NONE PARTIAL http://nvd.nist.gov BEA BEA06-109.00 SECTRACK 1015528 BID 16358 VUPEN ADV-2006-0313 XF weblogic-java-mbean-access(24294) Multiple unspecified vulnerabilities in BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allow remote attackers to access MBean attributes or cause an unspecified denial of service via unknown attack vectors. cpe:/a:oracle:weblogic_portal:8.1 cpe:/a:oracle:weblogic_portal:8.1:sp1 cpe:/a:oracle:weblogic_portal:8.1:sp2 cpe:/a:oracle:weblogic_portal:8.1:sp3 CVE-2006-0423 2006-01-25T18:07:00.000-05:00 2018-10-30T12:25:03.920-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BEA BEA06-110.00 BEA BEA08-110.01 SECTRACK 1015528 BID 16358 VUPEN ADV-2006-0312 VUPEN ADV-2008-0613 XF weblogicportal-config-info-disclosure(24284) XF weblogic-portal-config-info-disclosure(40705) BEA WebLogic Portal 8.1 through SP3 stores the password for the RDBMS Authentication provider in cleartext in the config.xml file, which allows attackers to gain privileges. cpe:/a:bea:weblogic_server:6.1:sp1 cpe:/a:bea:weblogic_server:6.1:sp1:express cpe:/a:bea:weblogic_server:6.1:sp2 cpe:/a:bea:weblogic_server:6.1:sp2:express cpe:/a:bea:weblogic_server:6.1:sp3 cpe:/a:bea:weblogic_server:6.1:sp3:express cpe:/a:bea:weblogic_server:6.1:sp4 cpe:/a:bea:weblogic_server:6.1:sp4:express cpe:/a:bea:weblogic_server:6.1:sp5 cpe:/a:bea:weblogic_server:6.1:sp5:express cpe:/a:bea:weblogic_server:6.1:sp6 cpe:/a:bea:weblogic_server:6.1:sp7 cpe:/a:bea:weblogic_server:6.1:sp7:express cpe:/a:bea:weblogic_server:7.0:sp1 cpe:/a:bea:weblogic_server:7.0:sp1:express cpe:/a:bea:weblogic_server:7.0:sp2 cpe:/a:bea:weblogic_server:7.0:sp2:express cpe:/a:bea:weblogic_server:7.0:sp3 cpe:/a:bea:weblogic_server:7.0:sp3:express cpe:/a:bea:weblogic_server:7.0:sp4 cpe:/a:bea:weblogic_server:7.0:sp4:express cpe:/a:bea:weblogic_server:7.0:sp5 cpe:/a:bea:weblogic_server:7.0:sp5:express cpe:/a:bea:weblogic_server:7.0:sp6 cpe:/a:bea:weblogic_server:7.0:sp6:express cpe:/a:bea:weblogic_server:8.1:sp1 cpe:/a:bea:weblogic_server:8.1:sp1:express cpe:/a:bea:weblogic_server:8.1:sp2 cpe:/a:bea:weblogic_server:8.1:sp2:express cpe:/a:bea:weblogic_server:8.1:sp3 cpe:/a:bea:weblogic_server:8.1:sp3:express cpe:/a:bea:weblogic_server:8.1:sp4 cpe:/a:bea:weblogic_server:8.1:sp4:express CVE-2006-0424 2006-01-25T18:07:00.000-05:00 2017-07-19T21:29:45.207-04:00 4.0 NETWORK LOW SINGLE_INSTANCE PARTIAL NONE NONE http://nvd.nist.gov BEA BEA06-111.00 SECTRACK 1015528 BID 16358 VUPEN ADV-2006-0313 XF weblogic-server-log-disclosure(24295) BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allows remote authenticated guest users to read the server log and obtain sensitive configuration information. cpe:/a:oracle:weblogic_portal:8.1 cpe:/a:oracle:weblogic_portal:8.1:sp1 cpe:/a:oracle:weblogic_portal:8.1:sp2 cpe:/a:oracle:weblogic_portal:8.1:sp3 CVE-2006-0425 2006-01-25T18:07:00.000-05:00 2018-10-30T12:25:03.920-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BEA BEA06-112.00 SECTRACK 1015528 BID 16358 VUPEN ADV-2006-0312 XF weblogic-deployment-descriptor-disclosure(24297) BEA WebLogic Portal 8.1 through SP4 allows remote attackers to obtain the source for a deployment descriptor file via unknown vectors. cpe:/a:bea:weblogic_server:8.1:sp1 cpe:/a:bea:weblogic_server:8.1:sp1:express cpe:/a:bea:weblogic_server:8.1:sp2 cpe:/a:bea:weblogic_server:8.1:sp2:express cpe:/a:bea:weblogic_server:8.1:sp3 cpe:/a:bea:weblogic_server:8.1:sp3:express cpe:/a:bea:weblogic_server:8.1:sp4 cpe:/a:bea:weblogic_server:8.1:sp4:express CVE-2006-0426 2006-01-25T18:07:00.000-05:00 2017-07-19T21:29:45.317-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BEA BEA06-113.00 SECTRACK 1015528 BID 16358 VUPEN ADV-2006-0313 XF weblogic-password-information-disclosure(24290) BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges. cpe:/a:bea:weblogic_server:8.1:sp1 cpe:/a:bea:weblogic_server:8.1:sp1:express cpe:/a:bea:weblogic_server:8.1:sp2 cpe:/a:bea:weblogic_server:8.1:sp2:express cpe:/a:bea:weblogic_server:8.1:sp3 cpe:/a:bea:weblogic_server:8.1:sp3:express cpe:/a:bea:weblogic_server:8.1:sp4 cpe:/a:bea:weblogic_server:8.1:sp4:express cpe:/a:bea:weblogic_server:8.1:sp5 cpe:/a:bea:weblogic_server:8.1:sp5:express cpe:/a:bea:weblogic_server:9.0:sp1 cpe:/a:bea:weblogic_server:9.0:sp1:express cpe:/a:bea:weblogic_server:9.0:sp2 cpe:/a:bea:weblogic_server:9.0:sp2:express cpe:/a:bea:weblogic_server:9.0:sp3 cpe:/a:bea:weblogic_server:9.0:sp3:express cpe:/a:bea:weblogic_server:9.0:sp4 cpe:/a:bea:weblogic_server:9.0:sp4:express cpe:/a:bea:weblogic_server:9.0:sp5 cpe:/a:bea:weblogic_server:9.0:sp5:express CVE-2006-0427 2006-01-25T18:07:00.000-05:00 2017-07-19T21:29:45.377-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BEA BEA06-114.00 SECTRACK 1015528 BID 16358 VUPEN ADV-2006-0313 XF weblogic-servlets-obtain-information(24291) Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing functionality that should have been restricted. cpe:/a:oracle:weblogic_portal:8.1:sp3 cpe:/a:oracle:weblogic_portal:8.1:sp4 cpe:/a:oracle:weblogic_portal:8.1:sp5 CVE-2006-0428 2006-01-25T18:07:00.000-05:00 2018-10-30T12:25:28.887-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BEA BEA06-115.00 SECTRACK 1015528 BID 16358 VUPEN ADV-2006-0312 XF weblogic-wsrp-gain-access(24293) Unspecified vulnerability in BEA WebLogic Portal 8.1 SP3 through SP5, when using Web Services Remote Portlets (WSRP), allows remote attackers to access restricted web resources via crafted URLs. cpe:/a:bea:weblogic_server:9.0 cpe:/a:bea:weblogic_server:9.0::express CVE-2006-0429 2006-01-25T18:07:00.000-05:00 2017-07-19T21:29:45.503-04:00 2.1 LOCAL LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BEA BEA06-116.00 SECTRACK 1015528 BID 16358 VUPEN ADV-2006-0313 XF weblogic-security-provider-weakness(24298) BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have not been activated by a server reboot, which could cause an administrator to perform inappropriate, security-relevant actions. cpe:/a:bea:weblogic_server:7.0:sp1 cpe:/a:bea:weblogic_server:7.0:sp1:express cpe:/a:bea:weblogic_server:7.0:sp2 cpe:/a:bea:weblogic_server:7.0:sp2:express cpe:/a:bea:weblogic_server:7.0:sp3 cpe:/a:bea:weblogic_server:7.0:sp3:express cpe:/a:bea:weblogic_server:7.0:sp4 cpe:/a:bea:weblogic_server:7.0:sp4:express cpe:/a:bea:weblogic_server:7.0:sp5 cpe:/a:bea:weblogic_server:7.0:sp5:express cpe:/a:bea:weblogic_server:7.0:sp6 cpe:/a:bea:weblogic_server:7.0:sp6:express cpe:/a:bea:weblogic_server:8.1:sp1 cpe:/a:bea:weblogic_server:8.1:sp1:express cpe:/a:bea:weblogic_server:8.1:sp2 cpe:/a:bea:weblogic_server:8.1:sp2:express cpe:/a:bea:weblogic_server:8.1:sp3 cpe:/a:bea:weblogic_server:8.1:sp3:express cpe:/a:bea:weblogic_server:8.1:sp4 cpe:/a:bea:weblogic_server:8.1:sp4:express cpe:/a:bea:weblogic_server:9.0:sp1 cpe:/a:bea:weblogic_server:9.0:sp1:express cpe:/a:bea:weblogic_server:9.0:sp2 cpe:/a:bea:weblogic_server:9.0:sp2:express cpe:/a:bea:weblogic_server:9.0:sp3 cpe:/a:bea:weblogic_server:9.0:sp3:express cpe:/a:bea:weblogic_server:9.0:sp4 cpe:/a:bea:weblogic_server:9.0:sp4:express cpe:/a:bea:weblogic_server:9.0:sp5 cpe:/a:bea:weblogic_server:9.0:sp5:express CVE-2006-0430 2006-01-25T18:07:00.000-05:00 2017-07-19T21:29:45.550-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov BEA BEA06-117.00 SECTRACK 1015528 BID 16358 VUPEN ADV-2006-0313 XF weblogic-connection-filter-dos(24301) Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are enabled, cause the server to run more slowly, which makes it easier for remote attackers to cause a denial of service (server slowdown). cpe:/a:bea:weblogic_server:8.1:sp5 cpe:/a:bea:weblogic_server:8.1:sp5:express CVE-2006-0431 2006-01-25T18:07:00.000-05:00 2017-07-19T21:29:45.613-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BEA BEA06-118.00 SECTRACK 1015528 BID 16358 VUPEN ADV-2006-0313 XF weblogic-ssl-identity-exposure(24302) Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server's SSL identity via unknown attack vectors. cpe:/a:bea:weblogic_server:9.0 cpe:/a:bea:weblogic_server:9.0::express CVE-2006-0432 2006-01-25T18:07:00.000-05:00 2017-07-19T21:29:45.660-04:00 2.1 LOCAL LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BEA BEA06-119.00 SECTRACK 1015528 BID 16358 VUPEN ADV-2006-0313 XF weblogic-jdni-security-weakness(24299) Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to add custom security policies, causes incorrect policies to be created, which prevents the server from properly protecting JNDI resources. cpe:/o:freebsd:freebsd:5.3 cpe:/o:freebsd:freebsd:5.4 CVE-2006-0433 2006-02-02T06:02:00.000-05:00 2017-07-19T21:29:45.723-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov FREEBSD FreeBSD-SA-06:08 SREASON 399 SECTRACK 1015566 BID 16466 VUPEN ADV-2006-0409 XF bsd-sack-handling-dos(24453) Selective Acknowledgement (SACK) in FreeBSD 5.3 and 5.4 does not properly handle an incoming selective acknowledgement when there is insufficient memory, which might allow remote attackers to cause a denial of service (infinite loop). cpe:/a:phpxplorer:phpxplorer:- CVE-2006-0434 2006-01-26T06:07:00.000-05:00 2018-10-19T11:44:43.127-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BUGTRAQ 20060118 phpXplorer file inclusion biyosecurity.be BID 16292 XF phpxplorer-sshare-directory-traversal(39982) Directory traversal vulnerability in action.php in phpXplorer allows remote attackers to read arbitrary files via ".." (dot dot) sequences and null bytes in the sAction parameter, a different vulnerability than CVE-2006-0244. NOTE: if the functionality of phpXplorer supports the upload of PHP files, then this issue would not cross privilege boundaries and would not be a vulnerability. cpe:/a:oracle:application_server cpe:/a:oracle:application_server:1.0.2 cpe:/a:oracle:application_server:1.0.2.0 cpe:/a:oracle:application_server:1.0.2.1 cpe:/a:oracle:application_server:1.0.2.1s cpe:/a:oracle:application_server:1.0.2.2 cpe:/a:oracle:application_server:1.0.2.2.2 cpe:/a:oracle:application_server:9.0.2 cpe:/a:oracle:application_server:9.0.2.0.0 cpe:/a:oracle:application_server:9.0.2.0.1 cpe:/a:oracle:application_server:9.0.2.1 cpe:/a:oracle:application_server:9.0.2.2 cpe:/a:oracle:application_server:9.0.2.3 cpe:/a:oracle:application_server:9.0.3 cpe:/a:oracle:application_server:9.0.3.1 cpe:/a:oracle:application_server:9.0.4.0 cpe:/a:oracle:application_server:9.0.4.1 cpe:/a:oracle:application_server:9.0.4.2 cpe:/a:oracle:application_server:9.2.0.6 cpe:/a:oracle:application_server:9.2.0.7 cpe:/a:oracle:application_server:10.1.0.2 cpe:/a:oracle:application_server:10.1.0.3 cpe:/a:oracle:application_server:10.1.0.3.1 cpe:/a:oracle:application_server:10.1.0.4 cpe:/a:oracle:application_server:10.1.2 cpe:/a:oracle:application_server:10.1.2.0.2 cpe:/a:oracle:application_server:10.1.2.1.0 cpe:/a:oracle:application_server:10.1.2_.0.1 cpe:/a:oracle:http_server:1.0.2.0 cpe:/a:oracle:http_server:1.0.2.1 cpe:/a:oracle:http_server:1.0.2.1s_for_apps cpe:/a:oracle:http_server:1.0.2.2 cpe:/a:oracle:http_server:1.0.2.2_roll_up_2 cpe:/a:oracle:http_server:8.1.7 cpe:/a:oracle:http_server:9.0.1 cpe:/a:oracle:http_server:9.0.2 cpe:/a:oracle:http_server:9.0.2.3 cpe:/a:oracle:http_server:9.0.3.1 cpe:/a:oracle:http_server:9.1 cpe:/a:oracle:http_server:9.2.0 CVE-2006-0435 2006-01-26T06:07:00.000-05:00 2018-10-19T11:44:43.410-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060202 The History of the Oracle PLSQL Gateway Flaw FULLDISC 20060202 More on the workaround for the unpatched Oracle PLSQL Gateway flaw FULLDISC 20060125 Workaround for unpatched Oracle PLSQL Gateway flaw SREASON 402 SREASON 403 SECTRACK 1015544 SECTRACK 1015961 CERT-VN VU#169164 CONFIRM http://www.oracle.com/technetwork/topics/security/cpuapr2006-090826.html MISC http://www.oracle.com/technology/deploy/security/pdf/public_vuln_to_advisory_mapping.html BUGTRAQ 20060125 Workaround for unpatched Oracle PLSQL Gateway flaw BUGTRAQ 20060131 Re: Workaround for unpatched Oracle PLSQL Gateway flaw BUGTRAQ 20060202 The History of the Oracle PLSQL Gateway Flaw BUGTRAQ 20060202 More on the workaround for the unpatched Oracle PLSQL Gateway flaw BUGTRAQ 20060208 Re: Workaround for unpatched Oracle PLSQL Gateway flaw HP SSRT061148 BID 16384 VUPEN ADV-2006-0338 VUPEN ADV-2006-1397 VUPEN ADV-2006-1571 XF oracle-plsql-command-execution(24363) Unspecified vulnerability in Oracle PL/SQL (PLSQL), as used in Database Server DS 9.2.0.7 and 10.1.0.5, Application Server 1.0.2.2, 9.0.4.2, 10.1.2.0.2, 10.1.2.1.0, and 10.1.3.0.0, E-Business Suite and Applications 11.5.10, and Collaboration Suite 10.1.1, 10.1.2.0, 10.1.2.1, and 9.0.4.2, allows attackers to bypass the PLSQLExclusion list and access excluded packages and procedures, aka Vuln# PLSQL01. cpe:/o:hp:hp-ux:11.00 cpe:/o:hp:hp-ux:11.4 cpe:/o:hp:hp-ux:11.11 CVE-2006-0436 2006-01-26T06:07:00.000-05:00 2017-10-10T21:30:37.390-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015530 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-025.htm VUPEN ADV-2006-0322 HP SSRT061099 XF hpux-unspecified-privilege-escalation(24318) Unspecified vulnerability in HP HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain privileges via unknown attack vectors. cpe:/a:phpbb_group:phpbb:2.0.6c cpe:/a:phpbb_group:phpbb:2.0.6d cpe:/a:phpbb_group:phpbb:2.0.7 cpe:/a:phpbb_group:phpbb:2.0.7a cpe:/a:phpbb_group:phpbb:2.0.8 cpe:/a:phpbb_group:phpbb:2.0.8a cpe:/a:phpbb_group:phpbb:2.0.9 cpe:/a:phpbb_group:phpbb:2.0.10 cpe:/a:phpbb_group:phpbb:2.0.11 cpe:/a:phpbb_group:phpbb:2.0.12 cpe:/a:phpbb_group:phpbb:2.0.13 cpe:/a:phpbb_group:phpbb:2.0.14 cpe:/a:phpbb_group:phpbb:2.0.15 cpe:/a:phpbb_group:phpbb:2.0.16 cpe:/a:phpbb_group:phpbb:2.0.17 cpe:/a:phpbb_group:phpbb:2.0.18 cpe:/a:phpbb_group:phpbb:2.0.19 CVE-2006-0437 2006-02-06T17:02:00.000-05:00 2017-07-19T21:29:45.957-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin SREASONRES 20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin SREASON 406 VUPEN ADV-2006-0445 XF phpbb-referer-header-http-xss(24497) Cross-site scripting (XSS) vulnerability in admin_smilies.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as "onmouseover" in the (1) smile_url or (2) smile_emotion parameters, which bypasses a check for "<" and ">" characters. cpe:/a:phpbb_group:phpbb:2.0.0 cpe:/a:phpbb_group:phpbb:2.0.1 cpe:/a:phpbb_group:phpbb:2.0.2 cpe:/a:phpbb_group:phpbb:2.0.3 cpe:/a:phpbb_group:phpbb:2.0.4 cpe:/a:phpbb_group:phpbb:2.0.5 cpe:/a:phpbb_group:phpbb:2.0.6 cpe:/a:phpbb_group:phpbb:2.0.6c cpe:/a:phpbb_group:phpbb:2.0.6d cpe:/a:phpbb_group:phpbb:2.0.7 cpe:/a:phpbb_group:phpbb:2.0.7a cpe:/a:phpbb_group:phpbb:2.0.8 cpe:/a:phpbb_group:phpbb:2.0.8a cpe:/a:phpbb_group:phpbb:2.0.9 cpe:/a:phpbb_group:phpbb:2.0.10 cpe:/a:phpbb_group:phpbb:2.0.11 cpe:/a:phpbb_group:phpbb:2.0.12 cpe:/a:phpbb_group:phpbb:2.0.13 cpe:/a:phpbb_group:phpbb:2.0.14 cpe:/a:phpbb_group:phpbb:2.0.15 cpe:/a:phpbb_group:phpbb:2.0.16 cpe:/a:phpbb_group:phpbb:2.0.17 cpe:/a:phpbb_group:phpbb:2.0.18 cpe:/a:phpbb_group:phpbb:2.0.19 cpe:/a:phpbb_group:phpbb:2.0_beta1 cpe:/a:phpbb_group:phpbb:2.0_rc1 cpe:/a:phpbb_group:phpbb:2.0_rc2 cpe:/a:phpbb_group:phpbb:2.0_rc3 cpe:/a:phpbb_group:phpbb:2.0_rc4 CVE-2006-0438 2006-02-06T17:02:00.000-05:00 2017-07-19T21:29:46.020-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin SREASONRES 20060203 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin SREASON 406 VUPEN ADV-2006-0445 XF phpbb-referer-header-http-xss(24497) Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode (IMG) are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to (1) admin/admin_users.php and (2) modcp.php. cpe:/a:text_rider:text_rider:2.4 CVE-2006-0439 2006-01-26T17:03:00.000-05:00 2018-10-19T11:44:46.830-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://evuln.com/vulns/46/summary.html SECTRACK 1015533 BUGTRAQ 20060124 [eVuln] Text Rider Sensitive Information Disclosure VUPEN ADV-2006-0321 XF textrider-data-information-disclosure(24279) Text Rider 2.4 stores sensitive data in the data directory under the web document root with insufficient access control, which allows remote attackers to obtain usernames and password hashes by directly accessing data/userlist.txt. cpe:/a:text_rider:text_rider:2.4 CVE-2006-0440 2006-01-26T17:03:00.000-05:00 2018-10-19T11:44:47.237-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/46/summary.html SECTRACK 1015533 BUGTRAQ 20060124 [eVuln] Text Rider Sensitive Information Disclosure Text Rider 2.4 allows attackers to bypass authentication and upload files without providing a valid password by obtaining the MD5 hash of the password (possibly via another vulnerability that reads it from a data file), then including the hash in a cookie. cpe:/a:karjasoft:sami_ftp_server:2.0.1 CVE-2006-0441 2006-01-26T17:03:00.000-05:00 2018-10-19T11:44:47.440-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://downloads.securityfocus.com/vulnerabilities/exploits/sami_ftp_poc.pl MISC http://www.critical.lt/?vulnerabilities/208 CONFIRM http://www.karjasoft.com/samiftp/news BUGTRAQ 20060124 SamiFTPd buffer overflow BID 16370 VUPEN ADV-2006-0317 XF samiftpserver-user-bo(24325) EXPLOIT-DB 40675 Stack-based buffer overflow in Sami FTP Server 2.0.1 allows remote attackers to execute arbitrary code via a long USER command, which triggers the overflow when the log is viewed. cpe:/a:mybb:mybb:1.0.2 CVE-2006-0442 2006-01-26T17:03:00.000-05:00 2018-10-19T11:44:48.160-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://kapda.ir/advisory-241.html SECTRACK 1015535 BUGTRAQ 20060124 [KAPDA::#25] - MyBB 1.x Cross_Site_Scripting BID 16361 VUPEN ADV-2006-0316 Multiple cross-site scripting (XSS) vulnerabilities in usercp.php in MyBulletinBoard (MyBB) 1.02 allow remote attackers to inject arbitrary web script or HTML via the (1) notepad parameter in a notepad action and (2) signature parameter in an editsig action. NOTE: These are different attack vectors, and probably a different vulnerability, than CVE-2006-0218 and CVE-2006-0219. cpe:/a:cheesyblog:cheesyblog:1.0 CVE-2006-0443 2006-01-26T17:03:00.000-05:00 2018-10-19T11:44:49.253-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/49/summary.html SREASON 369 BUGTRAQ 20060125 [eVuln] CheesyBlog XSS Vulnerability BID 16376 VUPEN ADV-2006-0326 XF cheesyblog-archive-xss(24292) Cross-site scripting (XSS) vulnerability in archive.php in CheesyBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) realname and (2) comment parameters, or (3) via a javascript URI in the url parameter, when adding a comment. cpe:/a:phpclanwebsite:phpclanwebsite:1.23.1 CVE-2006-0444 2006-01-26T17:03:00.000-05:00 2018-10-19T11:44:50.253-04:00 6.8 NETWORK MEDIUM NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt BUGTRAQ 20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities BID 16391 VUPEN ADV-2006-0342 XF phpclanwebsite-index-sql-injection(24355) SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page. NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax. cpe:/a:phpclanwebsite:phpclanwebsite:1.23.1 CVE-2006-0445 2006-01-26T17:03:00.000-05:00 2018-10-19T11:44:50.660-04:00 4.0 NETWORK LOW SINGLE_INSTANCE PARTIAL NONE NONE http://nvd.nist.gov MISC http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt BUGTRAQ 20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities BID 16391 index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by "\", which will display the full path of uploader.php. NOTE: this might be the result of a file inclusion vulnerability. cpe:/a:webwork:webwork:2.1.3 cpe:/a:webwork:webwork:2.2-pre1 CVE-2006-0446 2006-01-26T19:03:00.000-05:00 2017-07-19T21:29:46.317-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://devel.webwork.rochester.edu/twiki/bin/view/Webwork/WeBWorKRelease2pt1pt4 BID 16371 VUPEN ADV-2006-0319 XF webwork-unknown-command-execution(24322) Unspecified vulnerability in WeBWorK 2.1.3 and 2.2-pre1 allows remote privileged attackers to execute arbitrary commands as the web server via unknown attack vectors. cpe:/a:e-post_corporation:mail_server:4.10 cpe:/a:e-post_corporation:mail_server:enterprise_4.10 cpe:/a:e-post_corporation:smtp_server:4.10 cpe:/a:e-post_corporation:smtp_server:enterprise_4.10 cpe:/a:e-post_corporation:spa-pro_mail_atsolomon:4.00 cpe:/a:e-post_corporation:spa-pro_mail_atsolomon:enterprise_4.00 CVE-2006-0447 2006-01-26T19:03:00.000-05:00 2017-07-19T21:29:46.377-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BID 16379 VUPEN ADV-2006-0318 XF epost-smtp-username-bo(24331) XF epost-pop3-username-bo(24333) XF epost-imap-mailbox-dos(24334) Multiple buffer overflows in E-Post Mail Server 4.10 and SPA-PRO Mail @Solomon 4.00 allow remote attackers to execute arbitrary code via a long username to the (1) AUTH PLAIN or (2) AUTH LOGIN SMTP commands, which is not properly handled by (a) EPSTRS.EXE or (b) SPA-RS.EXE; (3) a long username in the APOP POP3 command, which is not properly handled by (c) EPSTPOP4S.EXE or (d) SPA-POP3S.EXE; (4) a long IMAP DELETE command, which is not properly handled by (e) EPSTIMAP4S.EXE or (f) SPA-IMAP4S.EXE. cpe:/a:e-post_corporation:mail_server:4.05 cpe:/a:e-post_corporation:spa-pro_mail_atsolomon:4.05 CVE-2006-0448 2006-01-26T19:03:00.000-05:00 2017-07-19T21:29:46.440-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov BID 16379 VUPEN ADV-2006-0318 XF epost-append-copy-rename-file-creation(24336) Multiple directory traversal vulnerabilities in (1) EPSTIMAP4S.EXE and (2) SPA-IMAP4S.EXE in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allow remote attackers to (a) list arbitrary directories or cause a denial of service via the LIST command; or create arbitrary files via the (b) APPEND, (c) COPY, or (d) RENAME commands. cpe:/a:e-post_corporation:mail_server:4.05 cpe:/a:e-post_corporation:spa-pro_mail_atsolomon:4.05 CVE-2006-0449 2006-01-26T19:03:00.000-05:00 2017-07-19T21:29:46.487-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov BID 16379 VUPEN ADV-2006-0318 XF epost-imap-append-dos(24341) Early termination vulnerability in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allows remote attackers to cause a denial of service (infinite loop) by sending an APPEND command and disconnecting before the expected amount of data is sent. cpe:/a:phpbb_group:phpbb:2.0.0 cpe:/a:phpbb_group:phpbb:2.0.1 cpe:/a:phpbb_group:phpbb:2.0.2 cpe:/a:phpbb_group:phpbb:2.0.3 cpe:/a:phpbb_group:phpbb:2.0.4 cpe:/a:phpbb_group:phpbb:2.0.5 cpe:/a:phpbb_group:phpbb:2.0.6 cpe:/a:phpbb_group:phpbb:2.0.6c cpe:/a:phpbb_group:phpbb:2.0.6d cpe:/a:phpbb_group:phpbb:2.0.7 cpe:/a:phpbb_group:phpbb:2.0.7a cpe:/a:phpbb_group:phpbb:2.0.8 cpe:/a:phpbb_group:phpbb:2.0.8a cpe:/a:phpbb_group:phpbb:2.0.9 cpe:/a:phpbb_group:phpbb:2.0.10 cpe:/a:phpbb_group:phpbb:2.0.11 cpe:/a:phpbb_group:phpbb:2.0.12 cpe:/a:phpbb_group:phpbb:2.0.13 cpe:/a:phpbb_group:phpbb:2.0.14 cpe:/a:phpbb_group:phpbb:2.0.15 cpe:/a:phpbb_group:phpbb:2.0.16 cpe:/a:phpbb_group:phpbb:2.0.17 cpe:/a:phpbb_group:phpbb:2.0.18 cpe:/a:phpbb_group:phpbb:2.0.19 cpe:/a:phpbb_group:phpbb:2.0_beta1 cpe:/a:phpbb_group:phpbb:2.0_rc1 cpe:/a:phpbb_group:phpbb:2.0_rc2 cpe:/a:phpbb_group:phpbb:2.0_rc3 cpe:/a:phpbb_group:phpbb:2.0_rc4 CVE-2006-0450 2006-01-26T19:03:00.000-05:00 2018-10-19T11:44:50.830-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://h4cky0u.org/viewtopic.php?t=637 SREASON 368 MISC http://www.h4cky0u.org/advisories/HYSA-2006-001-phpbb.txt BUGTRAQ 20060125 HYSA-2006-001 phpBB 2.0.19 search.php and profile.php DOS Vulnerability XF phpbb-search-profile-dos(24327) phpBB 2.0.19 and earlier allows remote attackers to cause a denial of service (application crash) by (1) registering many users through profile.php or (2) using search.php to search in a certain way that confuses the database. cpe:/o:redhat:fedora_core:1.0::directory_server CVE-2006-0451 2006-02-14T17:06:00.000-05:00 2017-07-19T21:29:46.613-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179135 BID 16677 XF fedora-ber-memory-leak-dos(24794) Multiple memory leaks in the LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (memory consumption) via invalid BER packets that trigger an error, which might prevent memory from being freed if it was allocated during the ber_scanf call, as demonstrated using the ProtoVer LDAP test suite. cpe:/o:redhat:fedora_core:1.0::directory_server CVE-2006-0452 2006-02-14T17:06:00.000-05:00 2017-07-19T21:29:46.660-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179137 BID 16677 XF fedora-dn2ancestor-dos(24796) dn2ancestor in the LDAP component in Fedora Directory Server 1.0 allows remote attackers to cause a denial of service (CPU and memory consumption) via a ModDN operation with a DN that contains a large number of "," (comma) characters, which results in a large amount of recursion, as demonstrated using the ProtoVer LDAP test suite. cpe:/o:redhat:fedora_core:1.0::directory_server CVE-2006-0453 2006-02-14T17:06:00.000-05:00 2017-07-19T21:29:46.707-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov CONFIRM http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179135 BID 16677 XF fedora-ber-bad-sequence-dos(24795) The LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (crash) via a certain "bad BER sequence" that results in a free of uninitialized memory, as demonstrated using the ProtoVer LDAP test suite. cpe:/o:linux:linux_kernel:2.6.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc2 cpe:/o:linux:linux_kernel:2.6.12:rc3 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12:rc6 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc2 cpe:/o:linux:linux_kernel:2.6.13:rc3 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc5 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.13.5 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14:rc5 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.14.5 cpe:/o:linux:linux_kernel:2.6.14.6 cpe:/o:linux:linux_kernel:2.6.14.7 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15.1 cpe:/o:linux:linux_kernel:2.6.15.2 CVE-2006-0454 2006-02-07T13:06:00.000-05:00 2018-10-19T11:44:52.223-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MLIST [dailydave] 20060207 Fun with Linux (2.6.12 -> 2.6.15.2) MLIST [linux-kernel] 20060207 Linux 2.6.15.3 MLIST [linux-kernel] 20060207 Re: Linux 2.6.15.3 CONFIRM http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.3 MANDRIVA MDKSA-2006:040 SUSE SUSE-SA:2006:006 FEDORA FEDORA-2006-102 FEDORA FLSA:157459-4 BID 16532 TRUSTIX 2006-0006 UBUNTU USN-250-1 VUPEN ADV-2006-0464 XF kernel-icmp-ipoptionsecho-dos(24575) Linux kernel before 2.6.15.3 down to 2.6.12, while constructing an ICMP response in icmp_send, does not properly handle when the ip_options_echo function in icmp.c fails, which allows remote attackers to cause a denial of service (crash) via vectors such as (1) record-route and (2) timestamp IP options with the needaddr bit set and a truncated value. cpe:/a:gnu:privacy_guard:1.0 cpe:/a:gnu:privacy_guard:1.0.1 cpe:/a:gnu:privacy_guard:1.0.2 cpe:/a:gnu:privacy_guard:1.0.3 cpe:/a:gnu:privacy_guard:1.0.3b cpe:/a:gnu:privacy_guard:1.0.4 cpe:/a:gnu:privacy_guard:1.0.5 cpe:/a:gnu:privacy_guard:1.0.6 cpe:/a:gnu:privacy_guard:1.0.7 cpe:/a:gnu:privacy_guard:1.2 cpe:/a:gnu:privacy_guard:1.2.1 cpe:/a:gnu:privacy_guard:1.2.2 cpe:/a:gnu:privacy_guard:1.2.2:rc1 cpe:/a:gnu:privacy_guard:1.2.3 cpe:/a:gnu:privacy_guard:1.2.4 cpe:/a:gnu:privacy_guard:1.2.5 cpe:/a:gnu:privacy_guard:1.2.6 cpe:/a:gnu:privacy_guard:1.2.7 cpe:/a:gnu:privacy_guard:1.3.3 cpe:/a:gnu:privacy_guard:1.3.4 cpe:/a:gnu:privacy_guard:1.4 cpe:/a:gnu:privacy_guard:1.4.1 cpe:/a:gnu:privacy_guard:1.4.2 CVE-2006-0455 2006-02-15T17:06:00.000-05:00 2018-10-19T11:44:54.643-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SGI 20060401-01-U FEDORA FEDORA-2006-116 MLIST [gnupg-announce] 20060215 False positive signature verification in GnuPG MLIST [gnupg-devel] 20060215 [Announce] False positive signature verification in GnuPG GENTOO GLSA-200602-10 MANDRIVA MDKSA-2006:043 SUSE SUSE-SR:2006:005 SUSE SUSE-SA:2006:009 SUSE SUSE-SA:2006:013 OPENPKG OpenPKG-SA-2006.001 REDHAT RHSA-2006:0266 BUGTRAQ 20060215 False positive signature verification in GnuPG FEDORA FLSA-2006:185355 BID 16663 SLACKWARE SSA:2006-072-02 TRUSTIX 2006-0008 UBUNTU USN-252-1 DEBIAN DSA-978 VUPEN ADV-2006-0610 XF gnupg-gpgv-improper-verification(24744) gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify". cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.0:test1 cpe:/o:linux:linux_kernel:2.6.0:test10 cpe:/o:linux:linux_kernel:2.6.0:test11 cpe:/o:linux:linux_kernel:2.6.0:test2 cpe:/o:linux:linux_kernel:2.6.0:test3 cpe:/o:linux:linux_kernel:2.6.0:test4 cpe:/o:linux:linux_kernel:2.6.0:test5 cpe:/o:linux:linux_kernel:2.6.0:test6 cpe:/o:linux:linux_kernel:2.6.0:test7 cpe:/o:linux:linux_kernel:2.6.0:test8 cpe:/o:linux:linux_kernel:2.6.0:test9 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.2 cpe:/o:linux:linux_kernel:2.6.2:rc1 cpe:/o:linux:linux_kernel:2.6.2:rc2 cpe:/o:linux:linux_kernel:2.6.2:rc3 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.3:rc1 cpe:/o:linux:linux_kernel:2.6.3:rc2 cpe:/o:linux:linux_kernel:2.6.3:rc3 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.4:rc1 cpe:/o:linux:linux_kernel:2.6.4:rc2 cpe:/o:linux:linux_kernel:2.6.4:rc3 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.5:rc1 cpe:/o:linux:linux_kernel:2.6.5:rc2 cpe:/o:linux:linux_kernel:2.6.5:rc3 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.6:rc2 cpe:/o:linux:linux_kernel:2.6.6:rc3 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.7:rc2 cpe:/o:linux:linux_kernel:2.6.7:rc3 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.8:rc4 cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.9:rc1 cpe:/o:linux:linux_kernel:2.6.9:rc2 cpe:/o:linux:linux_kernel:2.6.9:rc3 cpe:/o:linux:linux_kernel:2.6.9:rc4 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc1 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.10:rc3 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11:rc1 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11:rc5 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc2 cpe:/o:linux:linux_kernel:2.6.12:rc3 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12:rc6 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc2 cpe:/o:linux:linux_kernel:2.6.13:rc3 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc5 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14:rc5 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.14.5 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15:rc4 cpe:/o:linux:linux_kernel:2.6.15:rc5 cpe:/o:linux:linux_kernel:2.6.15:rc6 cpe:/o:linux:linux_kernel:2.6.15:rc7 cpe:/o:linux:linux_kernel:2.6.15.1 cpe:/o:linux:linux_kernel:2.6.15.2 cpe:/o:linux:linux_kernel:2.6.15.3 cpe:/o:linux:linux_kernel:2.6.15.4 cpe:/o:linux:linux_kernel:2.6.15.5 cpe:/o:linux:linux_kernel:2.6_test9_cvs CVE-2006-0456 2006-06-27T19:05:00.000-04:00 2017-10-10T21:30:37.597-04:00 2.1 LOCAL LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm DEBIAN DSA-1103 CONFIRM http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=331c46591414f7f92b1cec048009abe89892ee79 CONFIRM http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=331c46591414f7f92b1cec048009abe89892ee79 CONFIRM http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.16-rc6 CONFIRM http://www.mail-archive.com/kernel-svn-changes@lists.alioth.debian.org/msg01631.html REDHAT RHSA-2006:0575 BID 18687 VUPEN ADV-2006-2554 The strnlen_user function in Linux kernel before 2.6.16 on IBM S/390 can return an incorrect value, which allows local users to cause a denial of service via unknown vectors. cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.0:test1 cpe:/o:linux:linux_kernel:2.6.0:test10 cpe:/o:linux:linux_kernel:2.6.0:test11 cpe:/o:linux:linux_kernel:2.6.0:test2 cpe:/o:linux:linux_kernel:2.6.0:test3 cpe:/o:linux:linux_kernel:2.6.0:test4 cpe:/o:linux:linux_kernel:2.6.0:test5 cpe:/o:linux:linux_kernel:2.6.0:test6 cpe:/o:linux:linux_kernel:2.6.0:test7 cpe:/o:linux:linux_kernel:2.6.0:test8 cpe:/o:linux:linux_kernel:2.6.0:test9 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.8.1 cpe:/o:linux:linux_kernel:2.6.8.1.5 cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11:rc1 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11.1 cpe:/o:linux:linux_kernel:2.6.11.2 cpe:/o:linux:linux_kernel:2.6.11.3 cpe:/o:linux:linux_kernel:2.6.11.4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.9 cpe:/o:linux:linux_kernel:2.6.11.10 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.11_rc1_bk6 cpe:/o:linux:linux_kernel:2.6.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15:rc4 cpe:/o:linux:linux_kernel:2.6.15:rc5 cpe:/o:linux:linux_kernel:2.6.15:rc6 cpe:/o:linux:linux_kernel:2.6.15:rc7 cpe:/o:linux:linux_kernel:2.6.15.1 cpe:/o:linux:linux_kernel:2.6.15.2 cpe:/o:linux:linux_kernel:2.6.15.3 cpe:/o:linux:linux_kernel:2.6.15.4 cpe:/o:linux:linux_kernel:2.6.15.5 CVE-2006-0457 2006-03-13T21:02:00.000-05:00 2018-10-03T17:35:32.963-04:00 7.1 NETWORK HIGH NONE COMPLETE NONE COMPLETE http://nvd.nist.gov CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm MANDRIVA MDKSA-2006:059 SUSE SUSE-SA:2006:028 REDHAT RHSA-2006:0575 BID 17084 XF kernel-addkey-dos(25354) UBUNTU USN-263-1 Race condition in the (1) add_key, (2) request_key, and (3) keyctl functions in Linux kernel 2.6.x allows local users to cause a denial of service (crash) or read sensitive kernel memory by modifying the length of a string argument between the time that the kernel calculates the length and when it copies the data into kernel memory. cpe:/a:irssi:irssi:0.8.9 cpe:/a:irssi:irssi:0.8.10rc5 CVE-2006-0458 2006-03-06T18:02:00.000-05:00 2018-10-03T17:35:34.617-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov BID 16913 XF irssi-dcc-accept-dos(25147) UBUNTU USN-259-1 The DCC ACCEPT command handler in irssi before 0.8.9+0.8.10rc5-0ubuntu4.1 in Ubuntu Linux, and possibly other distributions, allows remote attackers to cause a denial of service (application crash) via certain crafted arguments in a DCC command. cpe:/a:will_estes_and_john_millaway:flex:2.5.30 cpe:/a:will_estes_and_john_millaway:flex:2.5.32 CVE-2006-0459 2006-03-29T18:02:00.000-05:00 2018-10-03T17:35:35.057-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://prdownloads.sourceforge.net/flex/flex-2.5.33.tar.bz2?download SREASON 570 MLIST [flex-announce] 20060222 flex 2.5.33 released GENTOO GLSA-200603-07 BID 16896 DEBIAN DSA-1020 VUPEN ADV-2006-0770 XF flex-bypass-security(24995) UBUNTU USN-260-1 flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependent attackers to execute arbitrary code. cpe:/a:bomberclone:bomberclone:0.1 cpe:/a:bomberclone:bomberclone:0.2 cpe:/a:bomberclone:bomberclone:0.3 cpe:/a:bomberclone:bomberclone:0.4 cpe:/a:bomberclone:bomberclone:0.5 cpe:/a:bomberclone:bomberclone:0.6 cpe:/a:bomberclone:bomberclone:0.7 cpe:/a:bomberclone:bomberclone:0.8 cpe:/a:bomberclone:bomberclone:0.9.5 cpe:/a:bomberclone:bomberclone:0.9.6 cpe:/a:bomberclone:bomberclone:0.9.7 cpe:/a:bomberclone:bomberclone:0.9.8 cpe:/a:bomberclone:bomberclone:0.9.9 cpe:/a:bomberclone:bomberclone:0.10.0 cpe:/a:bomberclone:bomberclone:0.11.3 cpe:/a:bomberclone:bomberclone:0.11.4 cpe:/a:bomberclone:bomberclone:0.11.5 cpe:/a:bomberclone:bomberclone:0.11.6 CVE-2006-0460 2006-02-16T20:02:00.000-05:00 2017-07-19T21:29:47.190-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS DEBIAN DSA-997 GENTOO GLSA-200602-09 BID 16697 VUPEN ADV-2006-0643 XF bomberclone-error-message-bo(24764) Multiple buffer overflows in BomberClone before 0.11.6.2 allow remote attackers to execute arbitrary code via long error messages. cpe:/a:pmachine:expressionengine:1.4.1 CVE-2006-0461 2006-01-27T18:03:00.000-05:00 2018-10-19T11:44:57.957-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/48/summary.html SREASON 372 BUGTRAQ 20060125 [eVuln] ExpressionEngine 'Referer' XSS Vulnerability BID 16377 VUPEN ADV-2006-0325 XF expressionengine-coreinput-xss(24296) Cross-site scripting (XSS) vulnerability in core.input.php in ExpressionEngine 1.4.1 allows remote attackers to inject arbitrary web script or HTML via HTTP_REFERER (referer). cpe:/a:andonet:andonet_blog:2004.09.02 CVE-2006-0462 2006-01-27T18:03:00.000-05:00 2017-07-19T21:29:47.300-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/50/summary.html SREASON 377 BUGTRAQ 20060126 [eVuln] AndoNET Blog SQL Injection Vulnerability BID 16393 VUPEN ADV-2006-0327 XF andonetblog-index-sql-injection(24309) SQL injection vulnerability in comentarios.php in AndoNET Blog 2004.09.02 allows remote attackers to execute arbitrary SQL commands via the entrada parameter. cpe:/a:ideosoft_design:ideocontent_manager CVE-2006-0463 2006-01-27T18:03:00.000-05:00 2008-09-05T16:59:20.417-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov 2006-01-30T08:26:00.000-05:00 Cross-site scripting (XSS) vulnerability in IdeoContent Manager allows remote attackers to inject arbitrary web script or HTML via the (1) goto_id parameter to index.php or (2) page parameter to news_full.php. cpe:/a:ideosoft_design:ideocontent_manager CVE-2006-0464 2006-01-27T18:03:00.000-05:00 2008-09-05T16:59:20.557-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-01-30T08:27:00.000-05:00 ALLOWS_OTHER_ACCESS Multiple SQL injection vulnerabilities in index.php in IdeoContent Manager allow remote attackers to execute arbitrary SQL commands via the (1) goto_id or (2) mid parameter. cpe:/a:active121:site_manager CVE-2006-0465 2006-01-27T18:03:00.000-05:00 2008-09-05T16:59:20.713-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov 2006-01-30T08:28:00.000-05:00 Cross-site scripting (XSS) vulnerability in risultati_ricerca.php in active121 Site Manager allows remote attackers to inject arbitrary web script or HTML via the cerca parameter. cpe:/a:goldstag:goldstag_content_management_system CVE-2006-0466 2006-01-27T18:03:00.000-05:00 2017-07-19T21:29:47.347-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov XF goldstag-search-xss(25198) Cross-site scripting (XSS) vulnerability in search.asp in Goldstag Content Management System allows remote attackers to inject arbitrary web script or HTML via the text parameter. cpe:/a:pioneers:pioneers:0.9.49 CVE-2006-0467 2006-01-30T21:03:00.000-05:00 2017-07-19T21:29:47.393-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350237 DEBIAN DSA-964 BID 16429 VUPEN ADV-2006-0376 XF pioneers-chat-message-dos(24383) Unspecified vulnerability in Pioneers (formerly gnocatan) before 0.9.49 allows remote attackers to cause a denial of service (application crash) via long chat messages. cpe:/a:stalker:communigate_pro:5.0 cpe:/a:stalker:communigate_pro:5.0.1 cpe:/a:stalker:communigate_pro:5.0.2 cpe:/a:stalker:communigate_pro:5.0.3 cpe:/a:stalker:communigate_pro:5.0.4 cpe:/a:stalker:communigate_pro:5.0.5 cpe:/a:stalker:communigate_pro:5.0.6 cpe:/a:stalker:communigate_pro:5.0c1 cpe:/a:stalker:communigate_pro:5.0c2 cpe:/a:stalker:communigate_pro:5.0c3 cpe:/a:stalker:communigate_pro:5.0c4 cpe:/a:stalker:communigate_pro:5.0c5 cpe:/a:stalker:communigate_pro:5.0c6 cpe:/a:stalker:communigate_pro:5.0c7 CVE-2006-0468 2006-01-30T13:03:00.000-05:00 2018-10-19T11:44:58.440-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://www.gleg.net/advisory_cg.shtml BUGTRAQ 20060128 Multiple vulnerabilities in CommuniGate Pro Server BID 16407 CONFIRM http://www.stalker.com/CommuniGatePro/History.html VUPEN ADV-2006-0364 XF communigate-ldap-bo(24409) CommuniGate Pro Core Server before 5.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via LDAP messages with negative BER lengths, and possibly other vectors, as demonstrated by the ProtoVer LDAP test suite. cpe:/a:uebimiau:uebimiau:2.7.9 CVE-2006-0469 2006-01-30T13:03:00.000-05:00 2018-10-19T11:44:58.910-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 387 BUGTRAQ 20060129 UebiMiau Webmail System Security Vulnerability BID 16413 CONFIRM http://www.uebimiau.org/news.php VUPEN ADV-2006-0388 XF uebimiau-html-xss(24375) Cross-site scripting (XSS) vulnerability in UebiMiau 2.7.9, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG tag. cpe:/a:mybulletinboard:mybulletinboard:1.0.1 cpe:/a:mybulletinboard:mybulletinboard:1.0.2 cpe:/a:mybulletinboard:mybulletinboard:1.0_final cpe:/a:mybulletinboard:mybulletinboard:1.0_pr2 cpe:/a:mybulletinboard:mybulletinboard:1.0_preview_release_2 cpe:/a:mybulletinboard:mybulletinboard:1.0_rc2 cpe:/a:mybulletinboard:mybulletinboard:1.0_rc4 CVE-2006-0470 2006-01-31T06:03:00.000-05:00 2017-07-19T21:29:47.567-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://community.mybboard.net/attachment.php?aid=2181 CONFIRM http://community.mybboard.net/showthread.php?tid=6418 BUGTRAQ 20060125 MyBB 1.0.2 XSS attack in search.php redirection SREASON 374 BID 16387 VUPEN ADV-2006-0350 XF mybb-search-xss(24466) Cross-site scripting (XSS) vulnerability in search.php in MyBulletinBoard (MyBB) 1.02 allows remote attackers to inject arbitrary web script or HTML via the (1) sortby and (2) sortordr parameters, which are not properly handled in a redirection. cpe:/a:my_little_homepage:my_little_forum:2004-04-20 CVE-2006-0471 2006-01-31T06:03:00.000-05:00 2018-10-19T11:44:59.287-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov VIM 20060130 My Little Homepage - source verify of different products MISC http://evuln.com/vulns/51/ MISC http://evuln.com/vulns/51/summary.html BUGTRAQ 20060126 [eVuln] "my little homepage" products [link] BBCode XSS Vulnerability BID 16395 VUPEN ADV-2006-0349 XF mylittlehomepage-link-tag-xss(24310) Cross-site scripting (XSS) vulnerability in the bbcode function in functions.php in my little homepage my little forum, as last modified in June 2005, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags. cpe:/a:my_little_homepage:my_little_guestbook:2004-04-20 CVE-2006-0472 2006-01-31T06:03:00.000-05:00 2018-10-19T11:44:59.737-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov VIM 20060130 My Little Homepage - source verify of different products MISC http://evuln.com/vulns/51/ MISC http://evuln.com/vulns/51/summary.html BUGTRAQ 20060126 [eVuln] "my little homepage" products [link] BBCode XSS Vulnerability BID 16395 VUPEN ADV-2006-0349 XF mylittlehomepage-link-tag-xss(24310) Cross-site scripting (XSS) vulnerability in guestbook.php in my little homepage my little guestbook, as last modified in March 2004, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags. cpe:/a:my_little_homepage:my_little_weblog:2004-04-20 CVE-2006-0473 2006-01-31T06:03:00.000-05:00 2018-10-19T11:45:00.223-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov VIM 20060130 My Little Homepage - source verify of different products MISC http://evuln.com/vulns/51/ MISC http://evuln.com/vulns/51/summary.html SREASON 378 BUGTRAQ 20060126 [eVuln] "my little homepage" products [link] BBCode XSS Vulnerability BID 16395 VUPEN ADV-2006-0349 XF mylittlehomepage-link-tag-xss(24310) Cross-site scripting (XSS) vulnerability in the bbcode function in weblog.php in my little homepage my little weblog, as last modified in April 2004, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags. cpe:/a:shareaza:shareaza:2.2.1.0 CVE-2006-0474 2006-01-31T06:03:00.000-05:00 2018-10-19T11:45:00.833-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS FULLDISC 20060126 Shareaza Remote Vulnerability CONFIRM http://cvs.sourceforge.net/viewcvs.py/shareaza/shareaza/BTPacket.cpp?r1=1.5&r2=1.5.4.1 CONFIRM http://cvs.sourceforge.net/viewcvs.py/shareaza/shareaza/EDPacket.cpp?r1=1.15&r2=1.15.2.1 SREASON 382 MISC http://www.hustlelabs.com/shareaza_advisory.pdf BUGTRAQ 20060127 Shareaza P2P Remote Vulnerability BID 16399 XF shareaza-btpacket-bo(24342) XF shareaza-cedpacket-bo(24343) XF shareaza-cpacket-bo(24344) Multiple integer overflows in Shareaza 2.2.1.0 allow remote attackers to execute arbitrary code via (1) a large packet length field, which causes an overflow in the ReadBuffer function in (a) BTPacket.cpp and (b) EDPacket.cpp, or (2) a large packet, which causes a heap-based overflow in the Write function in (c) Packet.h. cpe:/a:theworldsend.net:php-ping:1.3 CVE-2006-0475 2006-01-31T06:03:00.000-05:00 2017-07-19T21:29:47.877-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://www.kapda.ir/advisory-231.html VUPEN ADV-2006-0368 XF phpping-negative-count-dos(24382) PHP-Ping 1.3 does not properly validate ping counts, which allows remote attackers to cause a denial of service (ping flood) via a negative count parameter. cpe:/a:nullsoft:winamp:5.12 CVE-2006-0476 2006-01-31T06:03:00.000-05:00 2018-10-19T11:45:01.473-04:00 7.6 NETWORK HIGH NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SREASON 386 SREASON 398 SECTRACK 1015552 MISC http://www.heise.de/newsticker/meldung/68981 CERT-VN VU#604745 BUGTRAQ 20060130 Winamp 5.12 - 0day exploit - code execution through playlist BUGTRAQ 20060131 Re: Re: Winamp 5.12 - 0day exploit - code execution through playlist BID 16410 CERT TA06-032A VUPEN ADV-2006-0361 MISC http://www.winamp.com/player/version_history.php XF winamp-playlist-filename-bo(24361) EXPLOIT-DB 3422 Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field). cpe:/a:git:git:1.0.0 cpe:/a:git:git:1.0.0b cpe:/a:git:git:1.0.3 cpe:/a:git:git:1.0.4 cpe:/a:git:git:1.0.5 cpe:/a:git:git:1.0.6 cpe:/a:git:git:1.0.7 cpe:/a:git:git:1.0.8 cpe:/a:git:git:1.1.0 cpe:/a:git:git:1.1.1 cpe:/a:git:git:1.1.2 cpe:/a:git:git:1.1.3 cpe:/a:git:git:1.1.4 CVE-2006-0477 2006-01-31T06:03:00.000-05:00 2017-07-19T21:29:47.987-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://lwn.net/Articles/169623/ BID 16417 VUPEN ADV-2006-0367 XF git-gitcheckoutindex-bo(24360) Buffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to execute arbitrary code via an index file with a long symbolic link. cpe:/a:cre_loaded:cre_loaded:6.15 CVE-2006-0478 2006-01-31T06:03:00.000-05:00 2017-07-19T21:29:48.050-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS VIM 20060203 vendor ack/fix: 22793: CRE Loaded files.php Unauthenticated Arbitrary File Upload (fwd) BID 16415 VUPEN ADV-2006-0373 XF creloaded-files-auth-bypass(24377) CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php. NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the vulnerability on all known 6.0x and 6.1x releases. We strongly encourage users of CRE Loaded 6.x, osCMax, and other users of osCommerce who have installed HTMLArea based WYSIWYG editors and Admin Access with Levels to modify thier installations at the earliest possible moment." cpe:/a:pmwiki:pmwiki:2.1_beta_20 CVE-2006-0479 2006-01-31T06:03:00.000-05:00 2017-07-19T21:29:48.113-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060128 PmWiki Multiple Vulnerabilities SECTRACK 1015550 BID 16421 MISC http://www.ush.it/2006/01/24/pmwiki-multiple-vulnerabilities/ VUPEN ADV-2006-0375 XF pmwiki-path-disclosure(24366) XF pmwiki-file-include(24367) XF pmwiki-multiple-xss(24368) pmwiki.php in PmWiki 2.1 beta 20, with register_globals enabled, allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GPC variable and a GLOBALS[] variable with the same name, which causes PmWiki to unset the GLOBALS[] variable but not the GPC variable, which creates resultant vulnerabilities such as remote file inclusion and cross-site scripting (XSS). cpe:/a:spaiz:spaiz-nuke_cms:0 CVE-2006-0480 2006-01-31T06:03:00.000-05:00 2018-10-19T11:45:02.660-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 384 BUGTRAQ 20060129 sPaiz-Nuke Cross-Site Scripting Vulnerability BID 16412 VUPEN ADV-2006-0386 XF spaiznuke-modules-xss(24389) Cross-site scripting (XSS) vulnerability in the Articles module in sPaiz-Nuke allows remote attackers to inject arbitrary web script or HTML via the query parameter in the search file. cpe:/a:greg_roelofs:libpng:1.2.7 CVE-2006-0481 2006-01-31T13:03:00.000-05:00 2017-10-10T21:30:37.827-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM ftp://ftp.simplesystems.org/pub/libpng/png/src/libpng-1.2.8-README.txt GENTOO GLSA-200812-15 SECTRACK 1015615 SECTRACK 1015617 REDHAT RHSA-2006:0205 BID 16626 VUPEN ADV-2006-0393 CONFIRM https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179455 XF libpng-pngsetstripalpha-bo(24396) Heap-based buffer overflow in the alpha strip capability in libpng 1.2.7 allows context-dependent attackers to cause a denial of service (crash) when the png_do_strip_filler function is used to strip alpha channels out of the image. cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.0::64-bit_x86 cpe:/o:linux:linux_kernel:2.6.0::itanium_ia64_montecito cpe:/o:linux:linux_kernel:2.6.0:test1 cpe:/o:linux:linux_kernel:2.6.0:test10 cpe:/o:linux:linux_kernel:2.6.0:test11 cpe:/o:linux:linux_kernel:2.6.0:test2 cpe:/o:linux:linux_kernel:2.6.0:test3 cpe:/o:linux:linux_kernel:2.6.0:test4 cpe:/o:linux:linux_kernel:2.6.0:test5 cpe:/o:linux:linux_kernel:2.6.0:test6 cpe:/o:linux:linux_kernel:2.6.0:test7 cpe:/o:linux:linux_kernel:2.6.0:test8 cpe:/o:linux:linux_kernel:2.6.0:test9 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.2 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.8.1 cpe:/o:linux:linux_kernel:2.6.8.1.5 cpe:/o:linux:linux_kernel:2.6.8.1.5::386 cpe:/o:linux:linux_kernel:2.6.8.1.5::686 cpe:/o:linux:linux_kernel:2.6.8.1.5::686_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64 cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64_k8 cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64_k8_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64_xeon cpe:/o:linux:linux_kernel:2.6.8.1.5::k7 cpe:/o:linux:linux_kernel:2.6.8.1.5::k7_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::power3 cpe:/o:linux:linux_kernel:2.6.8.1.5::power3_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::power4 cpe:/o:linux:linux_kernel:2.6.8.1.5::power4_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::powerpc cpe:/o:linux:linux_kernel:2.6.8.1.5::powerpc_smp cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11:rc1 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11.1 cpe:/o:linux:linux_kernel:2.6.11.2 cpe:/o:linux:linux_kernel:2.6.11.3 cpe:/o:linux:linux_kernel:2.6.11.4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.9 cpe:/o:linux:linux_kernel:2.6.11.10 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.11_rc1_bk6 cpe:/o:linux:linux_kernel:2.6.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15:rc4 cpe:/o:linux:linux_kernel:2.6.15:rc5 cpe:/o:linux:linux_kernel:2.6.15:rc6 cpe:/o:linux:linux_kernel:2.6.15:rc7 cpe:/o:linux:linux_kernel:2.6_test9_cvs CVE-2006-0482 2006-01-31T14:03:00.000-05:00 2017-07-19T21:29:48.627-04:00 2.1 LOCAL LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MLIST [debian-sparc] 20060128 `date -s' on sparc64 MLIST [linux-sparc] 20060130 Attempts to set date with 'date -s' hang the machine MLIST [linux-sparc] 20060130 Re: Attempts to set date with 'date -s' hang the machine DEBIAN DSA-1017 BID 17216 VUPEN ADV-2006-0418 XF kernel-date-s-dos(24475) Linux kernel 2.6.15.1 and earlier, when running on SPARC architectures, allows local users to cause a denial of service (hang) via a "date -s" command, which causes invalid sign extended arguments to be provided to the get_compat_timespec function call. cpe:/o:cisco:vpn_3000_concentrator_series_software:4.7 cpe:/o:cisco:vpn_3000_concentrator_series_software:4.7%28rel%29 cpe:/o:cisco:vpn_3000_concentrator_series_software:4.7.1 cpe:/o:cisco:vpn_3000_concentrator_series_software:4.7.1.f cpe:/o:cisco:vpn_3000_concentrator_series_software:4.7.2 cpe:/o:cisco:vpn_3000_concentrator_series_software:4.7.2.a cpe:/o:cisco:vpn_3030_concentator:4.7%28rel%29 cpe:/o:cisco:vpn_3030_concentator:4.7.1 cpe:/o:cisco:vpn_3030_concentator:4.7.1.f cpe:/o:cisco:vpn_3030_concentator:4.7.2 cpe:/o:cisco:vpn_3030_concentator:4.7.2.a CVE-2006-0483 2006-01-31T15:03:00.000-05:00 2018-10-30T12:26:19.653-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov SREASON 375 SECTRACK 1015546 CISCO 20060126 Cisco VPN 3000 Concentrator Vulnerable to Crafted HTTP Attack BID 16394 VUPEN ADV-2006-0346 XF cisco-vpn-http-dos(24330) Cisco VPN 3000 series concentrators running software 4.7.0 through 4.7.2.A allow remote attackers to cause a denial of service (device reload or user disconnect) via a crafted HTTP packet. cpe:/a:elido:face_control CVE-2006-0484 2006-01-31T15:03:00.000-05:00 2018-10-19T11:45:03.067-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SREASON 376 SECTRACK 1015547 MISC http://www.hackerscenter.com/archive/view.asp?id=22236 BUGTRAQ 20060126 [HSC] Multiple transversal bug in vis BID 16401 XF facecontrol-vis-directory-traversal(24374) Directory traversal vulnerability in Vis.pl, as part of the FACE CONTROL product, allows remote attackers to read arbitrary files via a .. (dot dot) in any parameter that opens a file, such as (1) s or (2) p. cpe:/o:cisco:ios:12.0t cpe:/o:cisco:ios:12.0xh cpe:/o:cisco:ios:12.0xk cpe:/o:cisco:ios:12.0xl cpe:/o:cisco:ios:12.0xn cpe:/o:cisco:ios:12.0xr cpe:/o:cisco:ios:12.1 cpe:/o:cisco:ios:12.1aa cpe:/o:cisco:ios:12.1e cpe:/o:cisco:ios:12.1ec cpe:/o:cisco:ios:12.1ez cpe:/o:cisco:ios:12.1ga cpe:/o:cisco:ios:12.1gb cpe:/o:cisco:ios:12.1t cpe:/o:cisco:ios:12.1xa cpe:/o:cisco:ios:12.1xe cpe:/o:cisco:ios:12.1xh cpe:/o:cisco:ios:12.1xi cpe:/o:cisco:ios:12.1xj cpe:/o:cisco:ios:12.1xl cpe:/o:cisco:ios:12.1xm cpe:/o:cisco:ios:12.1xp cpe:/o:cisco:ios:12.1xq cpe:/o:cisco:ios:12.1xs cpe:/o:cisco:ios:12.1xt cpe:/o:cisco:ios:12.1xu cpe:/o:cisco:ios:12.1xv cpe:/o:cisco:ios:12.1xw cpe:/o:cisco:ios:12.1xy cpe:/o:cisco:ios:12.1xz cpe:/o:cisco:ios:12.1ya cpe:/o:cisco:ios:12.1yb cpe:/o:cisco:ios:12.1yd cpe:/o:cisco:ios:12.1ye cpe:/o:cisco:ios:12.1yf cpe:/o:cisco:ios:12.1yh cpe:/o:cisco:ios:12.1yi cpe:/o:cisco:ios:12.2 cpe:/o:cisco:ios:12.2b cpe:/o:cisco:ios:12.2bw cpe:/o:cisco:ios:12.2by cpe:/o:cisco:ios:12.2dd cpe:/o:cisco:ios:12.2dx cpe:/o:cisco:ios:12.2mx cpe:/o:cisco:ios:12.2n cpe:/o:cisco:ios:12.2s cpe:/o:cisco:ios:12.2su cpe:/o:cisco:ios:12.2sw cpe:/o:cisco:ios:12.2sxb cpe:/o:cisco:ios:12.2sxd cpe:/o:cisco:ios:12.2sxe cpe:/o:cisco:ios:12.2sz cpe:/o:cisco:ios:12.2xa cpe:/o:cisco:ios:12.2xb cpe:/o:cisco:ios:12.2xc cpe:/o:cisco:ios:12.2xd cpe:/o:cisco:ios:12.2xg cpe:/o:cisco:ios:12.2xh cpe:/o:cisco:ios:12.2xj cpe:/o:cisco:ios:12.2xk cpe:/o:cisco:ios:12.2xl cpe:/o:cisco:ios:12.2xm cpe:/o:cisco:ios:12.2xq cpe:/o:cisco:ios:12.2xs cpe:/o:cisco:ios:12.2xt cpe:/o:cisco:ios:12.2xu cpe:/o:cisco:ios:12.2xv cpe:/o:cisco:ios:12.2xw cpe:/o:cisco:ios:12.2yb cpe:/o:cisco:ios:12.2yc cpe:/o:cisco:ios:12.2yd cpe:/o:cisco:ios:12.2ye cpe:/o:cisco:ios:12.2yh cpe:/o:cisco:ios:12.2yk cpe:/o:cisco:ios:12.2yl cpe:/o:cisco:ios:12.2ym cpe:/o:cisco:ios:12.2yn cpe:/o:cisco:ios:12.2yt cpe:/o:cisco:ios:12.2yu cpe:/o:cisco:ios:12.2yw cpe:/o:cisco:ios:12.2yx cpe:/o:cisco:ios:12.2yy cpe:/o:cisco:ios:12.2yz cpe:/o:cisco:ios:12.2zb cpe:/o:cisco:ios:12.2zc cpe:/o:cisco:ios:12.2zd cpe:/o:cisco:ios:12.2ze cpe:/o:cisco:ios:12.2zf cpe:/o:cisco:ios:12.2zh cpe:/o:cisco:ios:12.2zj cpe:/o:cisco:ios:12.2zl cpe:/o:cisco:ios:12.2zn cpe:/o:cisco:ios:12.2zp cpe:/o:cisco:ios:12.3 cpe:/o:cisco:ios:12.3%2811%29yk2 cpe:/o:cisco:ios:12.3%2811%29yl cpe:/o:cisco:ios:12.3b cpe:/o:cisco:ios:12.3t cpe:/o:cisco:ios:12.3xa cpe:/o:cisco:ios:12.3xb cpe:/o:cisco:ios:12.3xd cpe:/o:cisco:ios:12.3xe cpe:/o:cisco:ios:12.3xf cpe:/o:cisco:ios:12.3xg cpe:/o:cisco:ios:12.3xh cpe:/o:cisco:ios:12.3xi cpe:/o:cisco:ios:12.3xj cpe:/o:cisco:ios:12.3xk cpe:/o:cisco:ios:12.3xm cpe:/o:cisco:ios:12.3xq cpe:/o:cisco:ios:12.3xr cpe:/o:cisco:ios:12.3xw cpe:/o:cisco:ios:12.3xy cpe:/o:cisco:ios:12.3ya cpe:/o:cisco:ios:12.3yb cpe:/o:cisco:ios:12.3yf cpe:/o:cisco:ios:12.3yg cpe:/o:cisco:ios:12.3yh cpe:/o:cisco:ios:12.3yi cpe:/o:cisco:ios:12.3yj cpe:/o:cisco:ios:12.3yk cpe:/o:cisco:ios:12.3ym cpe:/o:cisco:ios:12.3yq cpe:/o:cisco:ios:12.3ys cpe:/o:cisco:ios:12.3yt cpe:/o:cisco:ios:12.3yu cpe:/o:cisco:ios:12.3yx cpe:/o:cisco:ios:12.4 cpe:/o:cisco:ios:12.4mr cpe:/o:cisco:ios:12.4t CVE-2006-0485 2006-01-31T21:02:00.000-05:00 2017-10-10T21:30:37.907-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015543 CISCO 20060125 Response to AAA Command Authorization by-pass BID 16383 VUPEN ADV-2006-0337 XF cisco-aaa-tcl-auth-bypass(24308) The TCL shell in Cisco IOS 12.2(14)S before 12.2(14)S16, 12.2(18)S before 12.2(18)S11, and certain other releases before 25 January 2006 does not perform Authentication, Authorization, and Accounting (AAA) command authorization checks, which may allow local users to execute IOS EXEC commands that were prohibited via the AAA configuration, aka Bug ID CSCeh73049. cpe:/o:cisco:ios:12.2%2825%29s cpe:/o:cisco:ios:12.3t cpe:/o:cisco:ios:12.4 CVE-2006-0486 2006-01-31T21:02:00.000-05:00 2017-10-10T21:30:37.967-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015543 CISCO 20060125 Response to AAA Command Authorization by-pass XF cisco-aaa-tcl-auth-bypass(24308) Certain Cisco IOS releases in 12.2S based trains with maintenance release number 25 and later, 12.3T based trains, and 12.4 based trains reuse a Tcl Shell process across login sessions of different local users on the same terminal if the first user does not use tclquit before exiting, which may cause subsequent local users to execute unintended commands or bypass AAA command authorization checks, aka Bug ID CSCef77770. cpe:/a:tumbleweed:mailgate_email_firewall:6.0 cpe:/a:tumbleweed:mailgate_email_firewall:6.1 cpe:/a:tumbleweed:mailgate_email_firewall:6.2 CVE-2006-0487 2006-01-31T21:02:00.000-05:00 2018-10-19T11:45:03.503-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060121 Tumbleweed EMF 6.x Processing Issues Multiple unspecified vulnerabilities in Tumbleweed MailGate Email Firewall (EMF) 6.x allow remote attackers to (1) trigger temporarily incorrect processing of an e-mail message under "extremely heavy loads" and (2) cause an "increased number of missed spam" during "spam outbreaks." cpe:/o:microsoft:windows_2000 cpe:/o:microsoft:windows_2003_server:r2 cpe:/o:microsoft:windows_xp::sp2:tablet_pc CVE-2006-0488 2006-01-31T21:02:00.000-05:00 2018-10-19T11:45:03.613-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BUGTRAQ 20060124 Windows mem leakage XF windows-vdm-obtain-information(24471) The VDM (Virtual DOS Machine) emulation environment for MS-DOS applications in Windows 2000, Windows XP SP2, and Windows Server 2003 allows local users to read the first megabyte of memory and possibly obtain sensitive information, as demonstrated by dumper.asm. cpe:/a:khaled_mardam-bey:mirc:6.16 CVE-2006-0489 2006-01-31T21:02:00.000-05:00 2018-10-19T11:45:03.833-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SREASON 383 MISC http://trout.snt.utwente.nl/ubbthreads/showflat.php?Cat=0&Board=bugreports&Number=118751 MISC http://www.securiteam.com/windowsntfocus/5IP080AHPQ.html BUGTRAQ 20060124 Buffer Overflow /Font on mIRC BUGTRAQ 20060201 Re: Buffer Overflow /Font on mIRC ** DISPUTED ** Buffer overflow in the font command of mIRC, probably 6.16, allows local users to execute arbitrary code via a long string. NOTE: the original researcher claims that issue has been disputed by the vendor, and that the vendor stated "as far as I can tell, this is neither an exploit nor a vulnerability. The above report describes a local bug in mIRC." It could be that this is only exploitable by the user of the application, and thus would not cross privilege boundaries unless under an otherwise restrictive environment such as a kiosk. cpe:/a:aspthai.net:aspthai_forums:8.0 CVE-2006-0490 2006-01-31T21:02:00.000-05:00 2017-07-19T21:29:49.003-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060127 hello SREASON 381 SECTRACK 1015548 BID 16404 VUPEN ADV-2006-0372 XF aspthai-login-sql-injection(24359) SQL injection vulnerability in login.asp in ASPThai.Net ASPThai Forums 8.0 and earlier allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the password field. cpe:/a:subzane:szusermgnt:1.4 CVE-2006-0491 2006-01-31T21:02:00.000-05:00 2018-10-19T11:45:04.223-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 396 SECTRACK 1015569 MISC http://www.evuln.com/vulns/53/summary.html BUGTRAQ 20060201 [eVuln] SZUserMgnt Authentication Bypass BID 16454 VUPEN ADV-2006-0366 XF szusermgnt-username-sql-injection(24339) SQL injection vulnerability in SZUserMgnt.class.php in SZUserMgnt 1.4 allows remote attackers to execute arbitrary SQL commands via the username parameter. cpe:/a:vincent_hor:calendarix:0.6.2005-08-30 CVE-2006-0492 2006-01-31T21:02:00.000-05:00 2018-10-19T11:45:04.817-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 394 SECTRACK 1015560 MISC http://www.evuln.com/vulns/52/summary.html BUGTRAQ 20060201 [eVuln] Calendarix SQL Injection & Authorization Bypass Vulnerabilities BID 16456 VUPEN ADV-2006-0365 XF calendarix-multiple-sql-injection(24332) Multiple SQL injection vulnerabilities in Calendarix allow remote attackers to execute arbitrary SQL commands via (1) the catview parameter in cal_functions.inc.php and (2) the login parameter in cal_login.php. NOTE: the catview vector might overlap CVE-2005-1865. cpe:/a:thomas_rybak:mg2:0.5.1 CVE-2006-0493 2006-01-31T21:02:00.000-05:00 2018-10-19T11:45:05.363-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 389 BUGTRAQ 20060130 XSS flaw in MG2 Image Gallery (v.0.5.1) BID 16428 XF mg2-name-xss(24378) Cross-site scripting (XSS) vulnerability in MG2 (formerly known as Minigal) 0.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field in a comment associated with a picture. cpe:/a:mybulletinboard:mybulletinboard:1.0.2 CVE-2006-0494 2006-01-31T21:02:00.000-05:00 2018-10-19T11:45:05.660-04:00 4.3 LOCAL LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060130 MyBB 1.2 Local File Incusion XF mybb-plugins-file-include(24461) Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.02 allows local users with MyBB administrative privileges to include and possibly execute arbitrary local files via directory traversal sequences and a nul (%00) character in the plugin parameter. cpe:/a:mybulletinboard:mybulletinboard:1.0.2 CVE-2006-0495 2006-01-31T21:02:00.000-05:00 2018-10-19T11:45:05.800-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060129 MyBB 1.2 usercp2.php [ $url ] CrossSiteScripting ( XSS ) BID 16419 XF mybb-usercp2-xss(24392) Cross-site scripting (XSS) vulnerability in the Add Thread to Favorites feature in usercp2.php in MyBB (aka MyBulletinBoard) 1.02 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer header ($url variable). cpe:/a:mozilla:firefox:1.0 cpe:/a:mozilla:firefox:1.0.1 cpe:/a:mozilla:firefox:1.0.2 cpe:/a:mozilla:firefox:1.0.3 cpe:/a:mozilla:firefox:1.0.4 cpe:/a:mozilla:firefox:1.0.5 cpe:/a:mozilla:firefox:1.0.6 cpe:/a:mozilla:firefox:1.0.7 cpe:/a:mozilla:mozilla:1.7 cpe:/a:mozilla:mozilla:1.7:alpha cpe:/a:mozilla:mozilla:1.7:beta cpe:/a:mozilla:mozilla:1.7:rc1 cpe:/a:mozilla:mozilla:1.7:rc2 cpe:/a:mozilla:mozilla:1.7:rc3 cpe:/a:mozilla:mozilla:1.7.1 cpe:/a:mozilla:mozilla:1.7.2 cpe:/a:mozilla:mozilla:1.7.3 cpe:/a:mozilla:mozilla:1.7.5 cpe:/a:mozilla:mozilla:1.7.6 cpe:/a:mozilla:mozilla:1.7.7 cpe:/a:mozilla:mozilla:1.7.8 cpe:/a:mozilla:mozilla:1.7.10 cpe:/a:mozilla:mozilla:1.7.11 cpe:/a:mozilla:mozilla:1.7.12 CVE-2006-0496 2006-01-31T21:02:00.000-05:00 2017-07-19T21:29:49.487-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://community.livejournal.com/lj_dev/708069.html FULLDISC 20060128 -moz-binding CSS property: more XSS fun SECTRACK 1015553 SECTRACK 1015563 MISC http://www.davidpashley.com/cgi/pyblosxom.cgi/computing/livejournal-mozilla-bug.html BID 16427 VUPEN ADV-2006-0403 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=324253 XF mozilla-mozbinding-xss(24427) Cross-site scripting (XSS) vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8.1 and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the -moz-binding (Cascading Style Sheets) CSS property, which does not require that the style sheet have the same origin as the web page, as demonstrated by the compromise of a large number of LiveJournal accounts. cpe:/a:php_gen:php_gen:0.5 cpe:/a:php_gen:php_gen:0.6 cpe:/a:php_gen:php_gen:0.7 cpe:/a:php_gen:php_gen:0.8 cpe:/a:php_gen:php_gen:1.0 cpe:/a:php_gen:php_gen:1.1 cpe:/a:php_gen:php_gen:1.2 cpe:/a:php_gen:php_gen:1.3 CVE-2006-0497 2006-02-01T15:46:00.000-05:00 2017-07-19T21:29:49.550-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://www.eyce.be/php_gen/NEWS BID 15458 VUPEN ADV-2006-0408 XF phpgen-multiple-sql-injection(24441) Multiple SQL injection vulnerabilities in PHP GEN before 1.4 allow remote attackers to inject arbitrary SQL commands via unknown attack vectors. cpe:/a:php_gen:php_gen:0.5 cpe:/a:php_gen:php_gen:0.6 cpe:/a:php_gen:php_gen:0.7 cpe:/a:php_gen:php_gen:0.8 cpe:/a:php_gen:php_gen:1.0 cpe:/a:php_gen:php_gen:1.1 cpe:/a:php_gen:php_gen:1.2 cpe:/a:php_gen:php_gen:1.3 CVE-2006-0498 2006-02-01T15:46:00.000-05:00 2017-07-19T21:29:49.597-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://www.eyce.be/php_gen/NEWS VUPEN ADV-2006-0408 XF phpgen-parameters-xss(24443) Multiple cross-site scripting (XSS) vulnerabilities in PHP GEN before 1.4 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors. cpe:/a:yourboard:rlink:1.0 CVE-2006-0499 2006-02-01T17:02:00.000-05:00 2017-07-19T21:29:49.643-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16448 VUPEN ADV-2006-0390 XF phpbb-rlink-xss(24410) Cross-site scripting (XSS) vulnerability in rlink.php in Rlink 1.0.0 module for phpBB allows remote attackers to inject arbitrary web script or HTML via the url parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:punctweb:myco_guestbook:1.0 CVE-2006-0500 2006-02-01T17:02:00.000-05:00 2018-10-19T11:45:05.987-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060131 MyCO multiple vulnerabilities XF myco-admin-information-disclosure(24438) MyCO Guestbook 1.0 stores the admin directory under the web document root with insufficient access control, which allows remote attackers to perform unspecified privileged actions by directly accessing files via a URL. cpe:/a:punctweb:myco_guestbook:1.0 CVE-2006-0501 2006-02-01T17:02:00.000-05:00 2018-10-19T11:45:06.190-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060131 MyCO multiple vulnerabilities BUGTRAQ 20060201 Re: MyCO multiple vulnerabilities BID 16444 XF myco-name-xss(24439) Cross-site scripting (XSS) vulnerability in MyCO Guestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the Name field, when registering a user. cpe:/a:farsinews:farsinews:2.1_beta2 CVE-2006-0502 2006-02-01T17:02:00.000-05:00 2018-10-19T11:45:06.567-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 390 SECTRACK 1015554 MISC http://www.hamid.ir/security/farsinews.txt BUGTRAQ 20060131 FarsiNews 2.1 PHP Remote File Inclusion BID 16440 VUPEN ADV-2006-0411 XF farsinews-loginout-file-include(24419) PHP remote file inclusion vulnerability in loginout.php in FarsiNews 2.1 Beta 2 and earlier, with register_globals enabled, allows remote attackers to include arbitrary files via a URL in the cutepath parameter. cpe:/a:mailenable:mailenable_professional:1.2 cpe:/a:mailenable:mailenable_professional:1.2a cpe:/a:mailenable:mailenable_professional:1.5 cpe:/a:mailenable:mailenable_professional:1.6 cpe:/a:mailenable:mailenable_professional:1.7 cpe:/a:mailenable:mailenable_professional:1.17 cpe:/a:mailenable:mailenable_professional:1.18 cpe:/a:mailenable:mailenable_professional:1.19 cpe:/a:mailenable:mailenable_professional:1.51 cpe:/a:mailenable:mailenable_professional:1.52 cpe:/a:mailenable:mailenable_professional:1.53 cpe:/a:mailenable:mailenable_professional:1.54 cpe:/a:mailenable:mailenable_professional:1.71 CVE-2006-0503 2006-02-01T17:02:00.000-05:00 2017-07-19T21:29:49.847-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SECTRACK 1015558 CONFIRM http://www.mailenable.com/professionalhistory.asp BID 16457 VUPEN ADV-2006-0397 XF mailenable-imap-examine-dos(24424) IMAP service in MailEnable Professional Edition before 1.72 allows remote attackers to cause a denial of service (service crash) via unspecified vectors involving the EXAMINE command. cpe:/a:mailenable:mailenable_enterprise:1.00 cpe:/a:mailenable:mailenable_enterprise:1.01 cpe:/a:mailenable:mailenable_enterprise:1.02 cpe:/a:mailenable:mailenable_enterprise:1.03 cpe:/a:mailenable:mailenable_enterprise:1.04 CVE-2006-0504 2006-02-01T17:02:00.000-05:00 2017-07-19T21:29:49.893-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://www.mailenable.com/enterprisehistory.asp XF mailenable-webmail-dos(24517) Unspecified vulnerability in MailEnable Enterprise Edition before 1.2 allows remote attackers to cause a denial of service (CPU utilization) by viewing "formatted quoted-printable emails" via webmail. cpe:/a:zbattle.net:zbattle_client:1.09_sr-1_beta CVE-2006-0505 2006-02-01T18:02:00.000-05:00 2018-10-19T11:45:07.083-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov BUGTRAQ 20060128 zbattle.net XF zbattle-command-dos(24369) zbattle.net Zbattle client 1.09 SR-1 beta allows remote attackers to cause an unspecified denial of service by rapidly creating and closing a game. cpe:/a:nuked-klan:nuked-klan:1.7 CVE-2006-0506 2006-02-01T18:02:00.000-05:00 2018-10-19T11:45:07.253-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 385 BUGTRAQ 20060130 Nuked-klaN Cross-Site Scripting Vulnerability BID 16424 VUPEN ADV-2006-0387 XF nukedklan-index-xss(24387) Cross-site scripting (XSS) vulnerability in index.php in Nuked-klaN 1.7 allows remote attackers to inject arbitrary web script or HTML via the letter parameter. cpe:/a:easy_cms:easy_cms CVE-2006-0507 2006-02-01T18:02:00.000-05:00 2018-10-19T11:45:07.677-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060129 EasyCMS vulnerable to XSS injection. BUGTRAQ 20060131 Re: EasyCMS vulnerable to XSS injection. BUGTRAQ 20060208 Re: Re: EasyCMS vulnerable to XSS injection. BID 16430 VUPEN ADV-2006-0385 XF easycms-xss(24371) Multiple cross-site scripting (XSS) vulnerabilities in Easy CMS allow remote attackers to inject arbitrary web script or HTML via (1) unknown attack vectors in the administrative interface and (2) input fields of the contact form. cpe:/a:easy_cms:easy_cms CVE-2006-0508 2006-02-01T18:02:00.000-05:00 2018-10-19T11:45:08.253-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BUGTRAQ 20060129 EasyCMS vulnerable to XSS injection. BUGTRAQ 20060208 Re: Re: EasyCMS vulnerable to XSS injection. XF easycms-insecure-directories(24373) Easy CMS stores the images directory under the web document root with insufficient access control and browsing enabled, which allows remote attackers to list and possibly read images that are stored in that directory. cpe:/a:cerberus:cerberus_helpdesk:2.7 cpe:/a:cerberus:cerberus_helpdesk:2.7.1_development_release CVE-2006-0509 2006-02-01T18:02:00.000-05:00 2017-07-19T21:29:50.160-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 391 BUGTRAQ 20060130 Cerberus Helpdesk vulnerable to XSS BID 16439 VUPEN ADV-2006-0395 XF cerberus-clients-xss(24388) Multiple cross-site scripting (XSS) vulnerabilities in clients.php in Cerberus Helpdesk, possibly 2.7, allow remote attackers to inject arbitrary web script or HTML via (1) the contact_search parameter and (2) unspecified url fields. cpe:/a:daffodil_software:daffodil_crm:1.5 CVE-2006-0510 2006-02-01T18:02:00.000-05:00 2018-10-19T11:45:08.613-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060130 Daffodil CRM - vulnerable to SQL-injection. BID 16433 VUPEN ADV-2006-0412 XF daffodilcrm-userlogin-sql-injection(24450) SQL injection vulnerability in userlogin.jsp in Daffodil CRM 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified parameters in a login action. cpe:/a:blackboard:blackboard:5.0 cpe:/a:blackboard:blackboard:5.0.2 cpe:/a:blackboard:blackboard:5.5 cpe:/a:blackboard:blackboard:5.5.1 cpe:/a:blackboard:blackboard:6.0 cpe:/a:blackboard:blackboard_academic_suite:6.0 CVE-2006-0511 2006-02-01T18:02:00.000-05:00 2018-10-19T11:45:09.020-04:00 4.3 LOCAL LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060201 Blackboard Authentication Error BUGTRAQ 20060201 Re: Blackboard Authentication Error BUGTRAQ 20060202 Re: Blackboard Authentication Error BID 16438 ** DISPUTED ** Blackboard Academic Suite 6.0 and earlier does not properly clear session information when de-authenticating a user who is idle, which allows subsequent users to log in as the previous user and gain privileges. NOTE: the vendor has disputed this issue, saying that "This is a customer specific issue related to their Kerberos authentication single sign-on application and not a vulnerability in the Blackboard product." cpe:/a:padl_software:migrationtools:46 CVE-2006-0512 2006-02-02T06:02:00.000-05:00 2016-12-07T22:00:21.997-05:00 2.1 LOCAL LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=338920 VUPEN ADV-2005-2427 DEBIAN DSA-1187 PADL MigrationTools 46 creates temporary files insecurely, which allows local users to overwrite arbitrary files via a symlink attack on the temporary files, which are not properly created by (1) migrate_all_online.sh, (2) migrate_all_offline.sh, (3) migrate_all_netinfo_online.sh, (4) migrate_all_netinfo_offline.sh, (5) migrate_all_nis_online.sh, (6) migrate_all_nis_offline.sh, (7) migrate_all_nisplus_online.sh, and (8) migrate_all_nisplus_offline.sh. cpe:/a:ibm:tivoli_access_manager_for_e-business:5.1.0.10 cpe:/a:ibm:tivoli_access_manager_for_e-business:6.0.0 CVE-2006-0513 2006-02-06T18:02:00.000-05:00 2018-10-19T11:45:09.347-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov FULLDISC 20060203 VSR Advisory: IBM Tivoli Access Manager - Web Server Plug-in File Retrieval Vulnerability SREASON 412 SECTRACK 1015582 BUGTRAQ 20060203 VSR Advisory: IBM Tivoli Access Manager - Web Server Plug-in File Retrieval Vulnerability BID 16494 MISC http://www.vsecurity.com/bulletins/advisories/2006/tam-file-retrieval.txt VUPEN ADV-2006-0442 AIXAPAR IY79724 XF tivoli-pkmslogout-directory-traversal(24485) Directory traversal vulnerability in pkmslogout in Tivoli Web Server Plug-in 5.1.0.10 in Tivoli Access Manager (TAM) 5.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter. cpe:/a:cisco:adaptive_security_appliance_software:7.0 cpe:/a:cisco:adaptive_security_appliance_software:7.0%284%29 cpe:/a:cisco:adaptive_security_appliance_software:7.0.1.4 cpe:/a:cisco:adaptive_security_appliance_software:7.0.4.3 cpe:/a:cisco:pix_firewall:6.2.2.111 cpe:/a:cisco:pix_firewall:6.2.3_%28110%29 cpe:/a:cisco:pix_firewall:6.3.3_%28133%29 cpe:/h:cisco:firewall_services_module:2.3 cpe:/h:cisco:firewall_services_module:3.1 cpe:/o:cisco:pix_firewall:6.1.5%28104%29 cpe:/o:cisco:pix_firewall_software:2.7 cpe:/o:cisco:pix_firewall_software:3.0 cpe:/o:cisco:pix_firewall_software:3.1 cpe:/o:cisco:pix_firewall_software:4.0 cpe:/o:cisco:pix_firewall_software:4.1%286%29 cpe:/o:cisco:pix_firewall_software:4.1%286b%29 cpe:/o:cisco:pix_firewall_software:4.2 cpe:/o:cisco:pix_firewall_software:4.2%281%29 cpe:/o:cisco:pix_firewall_software:4.2%282%29 cpe:/o:cisco:pix_firewall_software:4.2%285%29 cpe:/o:cisco:pix_firewall_software:4.3 cpe:/o:cisco:pix_firewall_software:4.4 cpe:/o:cisco:pix_firewall_software:4.4%284%29 cpe:/o:cisco:pix_firewall_software:4.4%287.202%29 cpe:/o:cisco:pix_firewall_software:4.4%288%29 cpe:/o:cisco:pix_firewall_software:5.0 cpe:/o:cisco:pix_firewall_software:5.1 cpe:/o:cisco:pix_firewall_software:5.1%284%29 cpe:/o:cisco:pix_firewall_software:5.1%284.206%29 cpe:/o:cisco:pix_firewall_software:5.2 cpe:/o:cisco:pix_firewall_software:5.2%281%29 cpe:/o:cisco:pix_firewall_software:5.2%282%29 cpe:/o:cisco:pix_firewall_software:5.2%283.210%29 cpe:/o:cisco:pix_firewall_software:5.2%285%29 cpe:/o:cisco:pix_firewall_software:5.2%286%29 cpe:/o:cisco:pix_firewall_software:5.2%287%29 cpe:/o:cisco:pix_firewall_software:5.2%289%29 cpe:/o:cisco:pix_firewall_software:5.3 cpe:/o:cisco:pix_firewall_software:5.3%281%29 cpe:/o:cisco:pix_firewall_software:5.3%281.200%29 cpe:/o:cisco:pix_firewall_software:5.3%282%29 cpe:/o:cisco:pix_firewall_software:5.3%283%29 cpe:/o:cisco:pix_firewall_software:6.0 cpe:/o:cisco:pix_firewall_software:6.0%281%29 cpe:/o:cisco:pix_firewall_software:6.0%282%29 cpe:/o:cisco:pix_firewall_software:6.0%283%29 cpe:/o:cisco:pix_firewall_software:6.0%284%29 cpe:/o:cisco:pix_firewall_software:6.0%284.101%29 cpe:/o:cisco:pix_firewall_software:6.1 cpe:/o:cisco:pix_firewall_software:6.1%281%29 cpe:/o:cisco:pix_firewall_software:6.1%282%29 cpe:/o:cisco:pix_firewall_software:6.1%283%29 cpe:/o:cisco:pix_firewall_software:6.1%284%29 cpe:/o:cisco:pix_firewall_software:6.1%285%29 cpe:/o:cisco:pix_firewall_software:6.2 cpe:/o:cisco:pix_firewall_software:6.2%281%29 cpe:/o:cisco:pix_firewall_software:6.2%282%29 cpe:/o:cisco:pix_firewall_software:6.2%283%29 cpe:/o:cisco:pix_firewall_software:6.2%283.100%29 cpe:/o:cisco:pix_firewall_software:6.3 cpe:/o:cisco:pix_firewall_software:6.3%281%29 cpe:/o:cisco:pix_firewall_software:6.3%282%29 cpe:/o:cisco:pix_firewall_software:6.3%283%29 cpe:/o:cisco:pix_firewall_software:6.3%283.102%29 cpe:/o:cisco:pix_firewall_software:6.3%283.109%29 cpe:/o:cisco:pix_firewall_software:6.3%285%29 CVE-2006-0515 2006-05-09T06:02:00.000-04:00 2018-10-30T12:26:18.123-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060508 VSR Advisory: WebSense content filter bypass when deployed in conjunction with Cisco filtering devices SECTRACK 1016039 SECTRACK 1016040 CISCO 20060508 PIX/ASA/FWSM Websense/N2H2 Content Filter Bypass BUGTRAQ 20060508 VSR Advisory: WebSense content filter bypass when deployed in conjunction with Cisco filtering devices BID 17883 MISC http://www.vsecurity.com/bulletins/advisories/2006/cisco-websense-bypass.txt VUPEN ADV-2006-1738 XF cisco-websense-content-filtering-bypass(26308) Cisco PIX/ASA 7.1.x before 7.1(2) and 7.0.x before 7.0(5), PIX 6.3.x before 6.3.5(112), and FWSM 2.3.x before 2.3(4) and 3.x before 3.1(7), when used with Websense/N2H2, allows remote attackers to bypass HTTP access restrictions by splitting the GET method of an HTTP request into multiple packets, which prevents the request from being sent to Websense for inspection, aka bugs CSCsc67612, CSCsc68472, and CSCsd81734. cpe:/o:sun:solaris:10.0::64_bit CVE-2006-0516 2006-02-02T06:02:00.000-05:00 2017-10-10T21:30:38.047-04:00 2.1 LOCAL LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SECTRACK 1015557 SUNALERT 102149 BID 16460 VUPEN ADV-2006-0394 XF solaris-x64-kernel-dos(24395) Unspecified vulnerability in the kernel processing in Solaris 10 64 bit platform, when running in 64-bit mode, allows local users to cause a denial of service (system panic) via unknown attack vectors. cpe:/a:spip:spip:1.8.2e cpe:/a:spip:spip:1.9_alpha2_5539 CVE-2006-0517 2006-02-02T06:02:00.000-05:00 2018-10-19T11:45:10.880-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060131 ZRCSA-200601: SPIP - Multiple Vulnerabilities SREASON 395 SECTRACK 1015556 BUGTRAQ 20060131 ZRCSA-200601: SPIP - Multiple Vulnerabilities BID 16458 BID 24397 VUPEN ADV-2006-0398 MISC http://www.zone-h.org/en/advisories/read/id=8650/ XF spip-forum-sql-injection(24397) Multiple SQL injection vulnerabilities in formulaires/inc-formulaire_forum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id_forum, (2) id_article, or (3) id_breve parameters to forum.php3; (4) unspecified vectors related to "session handling"; and (5) when posting "petitions". cpe:/a:spip:spip:1.8.2e cpe:/a:spip:spip:1.9_alpha2_5539 CVE-2006-0518 2006-02-02T06:02:00.000-05:00 2017-07-19T21:29:50.533-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16461 VUPEN ADV-2006-0398 MISC http://www.zone-h.org/en/advisories/read/id=8650/ XF spip-index-xss(24401) Cross-site scripting (XSS) vulnerability in index.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter. cpe:/a:spip:spip:1.8.2e cpe:/a:spip:spip:1.9_alpha2_5539 CVE-2006-0519 2006-02-02T06:02:00.000-05:00 2017-07-19T21:29:50.580-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov VUPEN ADV-2006-0398 MISC http://www.zone-h.org/en/advisories/read/id=8650/ XF spip-incmessforum-path-disclosure(24399) SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to obtain sensitive information via a direct request to inc-messforum.php3, which reveals the path in an error message. cpe:/a:dragoran:portal_module:1.3 CVE-2006-0520 2006-02-02T06:02:00.000-05:00 2017-07-19T21:29:50.643-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BID 16447 VUPEN ADV-2006-0396 XF portal-index-sql-injection(24404) SQL injection vulnerability index.php in Dragoran Portal module 1.3 for Invision Power Board (IPB) allows remote attackers to execute arbitrary SQL commands via the site parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:browsercrm:browsercrm CVE-2006-0521 2006-02-02T06:02:00.000-05:00 2018-10-19T11:45:11.583-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 393 BUGTRAQ 20060131 BrowserCRM vulnerable for XSS BID 16435 VUPEN ADV-2006-0391 XF browsercrm-results-xss(24390) Cross-site scripting (XSS) vulnerability in results.php in BrowserCRM allows remote attackers to inject arbitrary web script or HTML via certain manipulations of the query parameter, as demonstrated using an IMG SRC tag. cpe:/a:symantec:sygate_management_server:3.5_mr_3_build_894_english cpe:/a:symantec:sygate_management_server:4.0_mr_1_build_1104_english cpe:/a:symantec:sygate_management_server:4.1_ga_build_1258_japanese cpe:/a:symantec:sygate_management_server:4.1_mr1_build_1351_chinese cpe:/a:symantec:sygate_management_server:4.1_mr_2_build_1417_english CVE-2006-0522 2006-02-02T06:02:00.000-05:00 2017-07-19T21:29:50.737-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://securityresponse.symantec.com/avcenter/security/Content/2006.02.01.html SECTRACK 1015561 BID 16452 VUPEN ADV-2006-0402 XF symantec-sms-sql-injection(24413) SQL injection vulnerability in the Authentication Servlet in Symantec Sygate Management Server (SMS) version 4.1 build 1417 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via unknown attack vectors related to a URL. cpe:/a:mybulletinboard:mybulletinboard:1.0.1 cpe:/a:mybulletinboard:mybulletinboard:1.0.2 cpe:/a:mybulletinboard:mybulletinboard:1.0_final cpe:/a:mybulletinboard:mybulletinboard:1.0_pr2 cpe:/a:mybulletinboard:mybulletinboard:1.0_preview_release_2 cpe:/a:mybulletinboard:mybulletinboard:1.0_rc2 cpe:/a:mybulletinboard:mybulletinboard:1.0_rc4 CVE-2006-0523 2006-02-02T06:02:00.000-05:00 2017-07-19T21:29:50.800-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://community.mybboard.net/showthread.php?tid=6418 VUPEN ADV-2006-0400 XF mybb-global-sql-injection(24416) SQL injection vulnerability in global.php in MyBB before 1.03 allows remote attackers to execute arbitrary SQL commands via the templatelist variable. cpe:/a:ashwebstudio:ashnews:0.83 CVE-2006-0524 2006-02-02T06:02:00.000-05:00 2017-07-19T21:29:50.847-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060130 ashnews Cross-Site Scripting Vulnerability FULLDISC 20060130 Re: ashnews Cross-Site Scripting Vulnerability FULLDISC 20060131 Re: ashnews Cross-Site Scripting Vulnerability BID 16426 XF ashnews-ashnews-xss(24365) Cross-site scripting (XSS) vulnerability in ashnews.php in Derek Ashauer ashNews 0.83 allows remote attackers to inject arbitrary web script or HTML via the id parameter. cpe:/a:adobe:acrobat:3.0 cpe:/a:adobe:acrobat:3.1 cpe:/a:adobe:acrobat:4.0 cpe:/a:adobe:acrobat:4.0.5 cpe:/a:adobe:acrobat:4.0.5a cpe:/a:adobe:acrobat:4.0.5c cpe:/a:adobe:acrobat:5.0 cpe:/a:adobe:acrobat:5.0.5 cpe:/a:adobe:acrobat:5.0.10 cpe:/a:adobe:acrobat:6.0 cpe:/a:adobe:acrobat:6.0.1 cpe:/a:adobe:acrobat:6.0.2 cpe:/a:adobe:acrobat:6.0.3 cpe:/a:adobe:acrobat:6.0.4 cpe:/a:adobe:acrobat:7.0 cpe:/a:adobe:acrobat:7.0.1 cpe:/a:adobe:acrobat:7.0.2 cpe:/a:adobe:acrobat:7.0.3 cpe:/a:adobe:acrobat_reader:3.0 cpe:/a:adobe:acrobat_reader:4.0 cpe:/a:adobe:acrobat_reader:4.0.5 cpe:/a:adobe:acrobat_reader:4.0.5a cpe:/a:adobe:acrobat_reader:4.0.5c cpe:/a:adobe:acrobat_reader:4.5 cpe:/a:adobe:acrobat_reader:5.0 cpe:/a:adobe:acrobat_reader:5.0.5 cpe:/a:adobe:acrobat_reader:5.0.10 cpe:/a:adobe:acrobat_reader:5.1 cpe:/a:adobe:acrobat_reader:6.0 cpe:/a:adobe:acrobat_reader:6.0.1 cpe:/a:adobe:acrobat_reader:6.0.2 cpe:/a:adobe:acrobat_reader:6.0.3 cpe:/a:adobe:acrobat_reader:6.0.4 cpe:/a:adobe:acrobat_reader:7.0 cpe:/a:adobe:acrobat_reader:7.0.1 cpe:/a:adobe:acrobat_reader:7.0.2 cpe:/a:adobe:acrobat_reader:7.0.3 cpe:/a:adobe:creative_suite:1.0 cpe:/a:adobe:creative_suite:1.3 cpe:/a:adobe:creative_suite:2.0 cpe:/a:adobe:illustrator:7.0 cpe:/a:adobe:illustrator:8.0 cpe:/a:adobe:illustrator:9.0 cpe:/a:adobe:illustrator:10.0 cpe:/a:adobe:illustrator:cs cpe:/a:adobe:illustrator:cs3 cpe:/a:adobe:indesign:cs cpe:/a:adobe:indesign:cs3 cpe:/a:adobe:pagemaker:6.5 cpe:/a:adobe:pagemaker:6.5::plus cpe:/a:adobe:pagemaker:7.0 cpe:/a:adobe:pagemaker:7.0::plus cpe:/a:adobe:photoshop:7.0 cpe:/a:adobe:photoshop:8.0 cpe:/a:adobe:photoshop:9.0.2 cpe:/a:adobe:photoshop:le cpe:/a:adobe:premiere:1.5::pro cpe:/a:adobe:version_cue:1.0 cpe:/a:adobe:version_cue:1.0.1 cpe:/a:adobe:version_cue:gold::mac_os_x CVE-2006-0525 2006-02-02T06:02:00.000-05:00 2018-10-19T11:45:12.020-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015577 SECTRACK 1015578 SECTRACK 1015579 CONFIRM http://www.adobe.com/support/techdocs/332644.html MISC http://www.cs.princeton.edu/~sudhakar/papers/winval.pdf CERT-VN VU#953860 BUGTRAQ 20060131 Windows Access Control Demystified BID 16451 VUPEN ADV-2006-0431 XF adobe-insecure-default-permissions(24464) Multiple Adobe products, including (1) Photoshop CS2, (2) Illustrator CS2, and (3) Adobe Help Center, install a large number of .EXE and .DLL files with write-access permission for the Everyone group, which allows local users to gain privileges via Trojan horse programs. cpe:/a:aol:aol_client_software:8.0 cpe:/a:aol:aol_client_software:8.0::plus cpe:/a:aol:aol_client_software:9.0 cpe:/a:aol:aol_client_software:9.0::optimized cpe:/a:aol:aol_client_software:9.0::security CVE-2006-0526 2006-02-02T06:02:00.000-05:00 2018-10-19T11:45:13.083-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS MISC http://www.cs.princeton.edu/~sudhakar/papers/winval.pdf CERT-VN VU#953860 BUGTRAQ 20060131 Windows Access Control Demystified BID 16453 XF aol-insecure-default-permissions(24498) The default configuration of the America Online (AOL) client software allows all users to modify a certain registry value that specifies a DLL file name, which might allow local users to gain privileges via a Trojan horse program. cpe:/a:isc:bind:4 cpe:/a:isc:bind:8 CVE-2006-0527 2006-02-02T06:02:00.000-05:00 2018-10-19T11:45:13.457-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS VIM 20060216 Recent HP advisories outline BIND problems MISC http://computerworld.com/networkingtopics/networking/story/0,10801,103744,00.html SREASON 438 SREASON 748 SECTRACK 1015551 SECTRACK 1015606 HP SSRT051045 BID 16455 VUPEN ADV-2006-0399 HP HPSBTU02095 XF tru64-dns-bind-unauth-access(24414) BIND 4 (BIND4) and BIND 8 (BIND8), if used as a target forwarder, allows remote attackers to gain privileged access via a "Kashpureff-style DNS cache corruption" attack. cpe:/a:gnome:evolution:2.3.1 cpe:/a:gnome:evolution:2.3.2 cpe:/a:gnome:evolution:2.3.3 cpe:/a:gnome:evolution:2.3.4 cpe:/a:gnome:evolution:2.3.5 cpe:/a:gnome:evolution:2.3.6 cpe:/a:gnome:evolution:2.3.6.1 cpe:/a:gnome:evolution:2.3.7 CVE-2006-0528 2006-02-02T06:02:00.000-05:00 2018-10-03T17:35:36.417-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov FULLDISC 20060128 gnome evolution mail client inline text file DoS issue SREASON 610 MANDRIVA MDKSA-2006:057 SUSE SUSE-SR:2006:007 BID 16408 UBUNTU USN-265-1 The cairo library (libcairo), as used in GNOME Evolution and possibly other products, allows remote attackers to cause a denial of service (persistent client crash) via an attached text file that contains "Content-Disposition: inline" in the header, and a very long line in the body, which causes the client to repeatedly crash until the e-mail message is manually removed, possibly due to a buffer overflow, as demonstrated using an XML attachment. cpe:/a:ca:messaging:1.05::aix cpe:/a:ca:messaging:1.05::linux cpe:/a:ca:messaging:1.05::solaris cpe:/a:ca:messaging:1.05::windows cpe:/a:ca:messaging:1.07.210.0::aix cpe:/a:ca:messaging:1.07.210.0::solaris cpe:/a:ca:messaging:1.07.220.0::solaris cpe:/a:ca:messaging:1.07.220.0::windows cpe:/a:ca:messaging:1.07.220.3::windows cpe:/a:ca:messaging:1.07.220.4::windows cpe:/a:ca:messaging:1.07.220.5::aix cpe:/a:ca:messaging:1.07.220.5::hp_ux cpe:/a:ca:messaging:1.07.220.5::solaris cpe:/a:ca:messaging:1.07.220.5::windows cpe:/a:ca:messaging:1.07.220.6::windows cpe:/a:ca:messaging:1.07.220.7::aix cpe:/a:ca:messaging:1.07.220.7::hp_ux cpe:/a:ca:messaging:1.07.220.7::windows cpe:/a:ca:messaging:1.07.220.8::aix cpe:/a:ca:messaging:1.07.220.8::hp_ux cpe:/a:ca:messaging:1.07.220.8::solaris cpe:/a:ca:messaging:1.07.220.9::solaris cpe:/a:ca:messaging:1.07.220.9::windows cpe:/a:ca:messaging:1.07.220.10::windows cpe:/a:ca:messaging:1.07.220.11::aix cpe:/a:ca:messaging:1.07.220.11::hp_ux cpe:/a:ca:messaging:1.07.220.11::linux cpe:/a:ca:messaging:1.07.220.11::solaris cpe:/a:ca:messaging:1.07.220.11::windows cpe:/a:ca:messaging:1.07.220.13::aix cpe:/a:ca:messaging:1.07.220.13::hp_ux cpe:/a:ca:messaging:1.07.220.13::linux cpe:/a:ca:messaging:1.07.220.13::solaris cpe:/a:ca:messaging:1.07.220.13::windows cpe:/a:ca:messaging:1.07.220.14::aix cpe:/a:ca:messaging:1.07.220.14::hp_ux cpe:/a:ca:messaging:1.07.220.14::linux cpe:/a:ca:messaging:1.07.220.14::solaris cpe:/a:ca:messaging:1.07.220.14::windows cpe:/a:ca:messaging:1.07.220.15::aix cpe:/a:ca:messaging:1.07.220.15::hp_ux cpe:/a:ca:messaging:1.07.220.15::linux cpe:/a:ca:messaging:1.07.220.15::solaris cpe:/a:ca:messaging:1.07.220.15::windows cpe:/a:ca:messaging:1.11.18.0::hp_ux cpe:/a:ca:messaging:1.11.19.0::aix cpe:/a:ca:messaging:1.11.19.0::solaris cpe:/a:ca:messaging:1.11.21::windows cpe:/a:ca:messaging:1.11.22::windows cpe:/a:ca:messaging:1.11.23::windows cpe:/a:ca:messaging:1.11.24::windows cpe:/a:ca:messaging:1.11.25::windows cpe:/a:ca:messaging:1.11.26::windows cpe:/a:ca:messaging:1.11.26.1::windows cpe:/a:ca:messaging:1.11.26.2::windows cpe:/a:ca:messaging:1.11.26.6::windows cpe:/a:ca:messaging:1.11.26.7::windows cpe:/a:ca:messaging:1.11.26.8::windows cpe:/a:ca:messaging:1.11.26.9::windows cpe:/a:ca:messaging:1.11.26.10::windows cpe:/a:ca:messaging:1.11.27.0::aix cpe:/a:ca:messaging:1.11.27.0::hp_ux cpe:/a:ca:messaging:1.11.27.0::solaris cpe:/a:ca:messaging:1.11.27.1::aix cpe:/a:ca:messaging:1.11.27.1::hp_ux cpe:/a:ca:messaging:1.11.27.1::solaris cpe:/a:ca:messaging:1.11.27.1::windows cpe:/a:ca:messaging:1.11.27.2::windows cpe:/a:ca:messaging:1.11.27.3::windows cpe:/a:ca:messaging:1.11.28.0::linux cpe:/a:ca:messaging:1.11.29.0::windows cpe:/a:ca:messaging:1.11.29.2::aix cpe:/a:ca:messaging:1.11.29.2::hp_ux cpe:/a:ca:messaging:1.11.29.2::solaris cpe:/a:ca:messaging:1.11.29.2::windows cpe:/a:ca:messaging:1.11.29.3::aix cpe:/a:ca:messaging:1.11.29.3::hp_ux cpe:/a:ca:messaging:1.11.29.3::solaris cpe:/a:ca:messaging:1.11.29.3::windows cpe:/a:ca:messaging:1.11.29.4::aix cpe:/a:ca:messaging:1.11.29.4::hp_ux cpe:/a:ca:messaging:1.11.29.4::solaris cpe:/a:ca:messaging:1.11.29.4::windows cpe:/a:ca:messaging:1.11.29.5::aix cpe:/a:ca:messaging:1.11.29.5::hp_ux cpe:/a:ca:messaging:1.11.29.5::linux cpe:/a:ca:messaging:1.11.29.5::solaris cpe:/a:ca:messaging:1.11.29.5::windows cpe:/a:ca:messaging:1.11.29.6::windows cpe:/a:ca:messaging:1.11.29.7::windows cpe:/a:ca:messaging:1.11.29.8::aix cpe:/a:ca:messaging:1.11.29.8::hp_ux cpe:/a:ca:messaging:1.11.29.8::linux cpe:/a:ca:messaging:1.11.29.8::solaris cpe:/a:ca:messaging:1.11.29.8::windows cpe:/a:ca:messaging:1.11.29.9::aix cpe:/a:ca:messaging:1.11.29.9::hp_ux cpe:/a:ca:messaging:1.11.29.9::linux cpe:/a:ca:messaging:1.11.29.9::solaris cpe:/a:ca:messaging:1.11.29.9::windows cpe:/a:ca:messaging:1.11.29.13::aix cpe:/a:ca:messaging:1.11.29.13::hp_ux cpe:/a:ca:messaging:1.11.29.13::linux cpe:/a:ca:messaging:1.11.29.13::solaris cpe:/a:ca:messaging:1.11.29.13::windows cpe:/a:ca:messaging:1.11.29.14::aix cpe:/a:ca:messaging:1.11.29.14::hp_ux cpe:/a:ca:messaging:1.11.29.14::linux cpe:/a:ca:messaging:1.11.29.14::solaris cpe:/a:ca:messaging:1.11.29.14::windows cpe:/a:ca:messaging:1.11.29.15::aix cpe:/a:ca:messaging:1.11.29.15::hp_ux cpe:/a:ca:messaging:1.11.29.15::linux cpe:/a:ca:messaging:1.11.29.15::solaris cpe:/a:ca:messaging:1.11.29.15::windows cpe:/a:ca:messaging:1.11.29.16::aix cpe:/a:ca:messaging:1.11.29.16::hp_ux cpe:/a:ca:messaging:1.11.29.16::linux cpe:/a:ca:messaging:1.11.29.16::solaris cpe:/a:ca:messaging:1.11.29.16::windows cpe:/a:ca:messaging:1.11.29.17::aix cpe:/a:ca:messaging:1.11.29.17::hp_ux cpe:/a:ca:messaging:1.11.29.17::linux cpe:/a:ca:messaging:1.11.29.17::solaris cpe:/a:ca:messaging:1.11.29.17::windows cpe:/a:ca:messaging:1.11.29.18::aix cpe:/a:ca:messaging:1.11.29.18::hp_ux cpe:/a:ca:messaging:1.11.29.18::linux cpe:/a:ca:messaging:1.11.29.18::solaris cpe:/a:ca:messaging:1.11.29.18::windows cpe:/a:ca:messaging:1.11.29.19::aix cpe:/a:ca:messaging:1.11.29.19::hp_ux cpe:/a:ca:messaging:1.11.29.19::linux cpe:/a:ca:messaging:1.11.29.19::solaris cpe:/a:ca:messaging:1.11.29.19::windows CVE-2006-0529 2006-02-02T15:06:00.000-05:00 2018-10-19T11:45:14.380-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SECTRACK 1015571 CONFIRM http://supportconnectw.ca.com/public/ca_common_docs/camessagsecurity_notice.asp BUGTRAQ 20060202 CAID 33581 - CA Message Queuing Denial of Service Vulnerabilities BID 16475 VUPEN ADV-2006-0414 MISC http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33581 XF ca-cam-port4105-dos(24448) Computer Associates (CA) Message Queuing (CAM / CAFT) before 1.07 Build 220_16 and 1.11 Build 29_20, as used in multiple CA products, allows remote attackers to cause a denial of service via a crafted message to TCP port 4105. cpe:/a:ca:messaging:1.05::aix cpe:/a:ca:messaging:1.05::hp_ux cpe:/a:ca:messaging:1.05::linux cpe:/a:ca:messaging:1.05::solaris cpe:/a:ca:messaging:1.05::windows cpe:/a:ca:messaging:1.07.210.0::aix cpe:/a:ca:messaging:1.07.210.0::solaris cpe:/a:ca:messaging:1.07.220.0::solaris cpe:/a:ca:messaging:1.07.220.0::windows cpe:/a:ca:messaging:1.07.220.3::windows cpe:/a:ca:messaging:1.07.220.4::windows cpe:/a:ca:messaging:1.07.220.5::aix cpe:/a:ca:messaging:1.07.220.5::hp_ux cpe:/a:ca:messaging:1.07.220.5::solaris cpe:/a:ca:messaging:1.07.220.5::windows cpe:/a:ca:messaging:1.07.220.6::windows cpe:/a:ca:messaging:1.07.220.7::aix cpe:/a:ca:messaging:1.07.220.7::hp_ux cpe:/a:ca:messaging:1.07.220.7::windows cpe:/a:ca:messaging:1.07.220.8::aix cpe:/a:ca:messaging:1.07.220.8::hp_ux cpe:/a:ca:messaging:1.07.220.8::solaris cpe:/a:ca:messaging:1.07.220.9::solaris cpe:/a:ca:messaging:1.07.220.9::windows cpe:/a:ca:messaging:1.07.220.10::windows cpe:/a:ca:messaging:1.07.220.11::aix cpe:/a:ca:messaging:1.07.220.11::hp_ux cpe:/a:ca:messaging:1.07.220.11::linux cpe:/a:ca:messaging:1.07.220.11::solaris cpe:/a:ca:messaging:1.07.220.11::windows cpe:/a:ca:messaging:1.07.220.13::aix cpe:/a:ca:messaging:1.07.220.13::hp_ux cpe:/a:ca:messaging:1.07.220.13::linux cpe:/a:ca:messaging:1.07.220.13::solaris cpe:/a:ca:messaging:1.07.220.13::windows cpe:/a:ca:messaging:1.07.220.14::aix cpe:/a:ca:messaging:1.07.220.14::hp_ux cpe:/a:ca:messaging:1.07.220.14::linux cpe:/a:ca:messaging:1.07.220.14::solaris cpe:/a:ca:messaging:1.07.220.14::windows cpe:/a:ca:messaging:1.07.220.15::aix cpe:/a:ca:messaging:1.07.220.15::hp_ux cpe:/a:ca:messaging:1.07.220.15::linux cpe:/a:ca:messaging:1.07.220.15::solaris cpe:/a:ca:messaging:1.07.220.15::windows cpe:/a:ca:messaging:1.11.18.0::hp_ux cpe:/a:ca:messaging:1.11.19.0::aix cpe:/a:ca:messaging:1.11.19.0::solaris cpe:/a:ca:messaging:1.11.21::windows cpe:/a:ca:messaging:1.11.22::windows cpe:/a:ca:messaging:1.11.23::windows cpe:/a:ca:messaging:1.11.24::windows cpe:/a:ca:messaging:1.11.25::windows cpe:/a:ca:messaging:1.11.26::windows cpe:/a:ca:messaging:1.11.26.1::windows cpe:/a:ca:messaging:1.11.26.2::windows cpe:/a:ca:messaging:1.11.26.6::windows cpe:/a:ca:messaging:1.11.26.7::windows cpe:/a:ca:messaging:1.11.26.8::windows cpe:/a:ca:messaging:1.11.26.9::windows cpe:/a:ca:messaging:1.11.26.10::windows cpe:/a:ca:messaging:1.11.27.0::aix cpe:/a:ca:messaging:1.11.27.0::hp_ux cpe:/a:ca:messaging:1.11.27.0::solaris cpe:/a:ca:messaging:1.11.27.1::aix cpe:/a:ca:messaging:1.11.27.1::hp_ux cpe:/a:ca:messaging:1.11.27.1::solaris cpe:/a:ca:messaging:1.11.27.1::windows cpe:/a:ca:messaging:1.11.27.2::windows cpe:/a:ca:messaging:1.11.27.3::windows cpe:/a:ca:messaging:1.11.28.0::linux cpe:/a:ca:messaging:1.11.29.0::windows cpe:/a:ca:messaging:1.11.29.2::aix cpe:/a:ca:messaging:1.11.29.2::hp_ux cpe:/a:ca:messaging:1.11.29.2::solaris cpe:/a:ca:messaging:1.11.29.2::windows cpe:/a:ca:messaging:1.11.29.3::aix cpe:/a:ca:messaging:1.11.29.3::hp_ux cpe:/a:ca:messaging:1.11.29.3::solaris cpe:/a:ca:messaging:1.11.29.3::windows cpe:/a:ca:messaging:1.11.29.4::aix cpe:/a:ca:messaging:1.11.29.4::hp_ux cpe:/a:ca:messaging:1.11.29.4::solaris cpe:/a:ca:messaging:1.11.29.4::windows cpe:/a:ca:messaging:1.11.29.5::aix cpe:/a:ca:messaging:1.11.29.5::hp_ux cpe:/a:ca:messaging:1.11.29.5::linux cpe:/a:ca:messaging:1.11.29.5::solaris cpe:/a:ca:messaging:1.11.29.5::windows cpe:/a:ca:messaging:1.11.29.6::windows cpe:/a:ca:messaging:1.11.29.7::windows cpe:/a:ca:messaging:1.11.29.8::aix cpe:/a:ca:messaging:1.11.29.8::hp_ux cpe:/a:ca:messaging:1.11.29.8::linux cpe:/a:ca:messaging:1.11.29.8::solaris cpe:/a:ca:messaging:1.11.29.8::windows cpe:/a:ca:messaging:1.11.29.9::aix cpe:/a:ca:messaging:1.11.29.9::hp_ux cpe:/a:ca:messaging:1.11.29.9::linux cpe:/a:ca:messaging:1.11.29.9::solaris cpe:/a:ca:messaging:1.11.29.9::windows cpe:/a:ca:messaging:1.11.29.13::aix cpe:/a:ca:messaging:1.11.29.13::hp_ux cpe:/a:ca:messaging:1.11.29.13::linux cpe:/a:ca:messaging:1.11.29.13::solaris cpe:/a:ca:messaging:1.11.29.13::windows cpe:/a:ca:messaging:1.11.29.14::aix cpe:/a:ca:messaging:1.11.29.14::hp_ux cpe:/a:ca:messaging:1.11.29.14::linux cpe:/a:ca:messaging:1.11.29.14::solaris cpe:/a:ca:messaging:1.11.29.14::windows cpe:/a:ca:messaging:1.11.29.15::aix cpe:/a:ca:messaging:1.11.29.15::hp_ux cpe:/a:ca:messaging:1.11.29.15::linux cpe:/a:ca:messaging:1.11.29.15::solaris cpe:/a:ca:messaging:1.11.29.15::windows cpe:/a:ca:messaging:1.11.29.16::aix cpe:/a:ca:messaging:1.11.29.16::hp_ux cpe:/a:ca:messaging:1.11.29.16::linux cpe:/a:ca:messaging:1.11.29.16::solaris cpe:/a:ca:messaging:1.11.29.16::windows cpe:/a:ca:messaging:1.11.29.17::aix cpe:/a:ca:messaging:1.11.29.17::hp_ux cpe:/a:ca:messaging:1.11.29.17::linux cpe:/a:ca:messaging:1.11.29.17::solaris cpe:/a:ca:messaging:1.11.29.17::windows cpe:/a:ca:messaging:1.11.29.18::aix cpe:/a:ca:messaging:1.11.29.18::hp_ux cpe:/a:ca:messaging:1.11.29.18::linux cpe:/a:ca:messaging:1.11.29.18::solaris cpe:/a:ca:messaging:1.11.29.18::windows cpe:/a:ca:messaging:1.11.29.19::aix cpe:/a:ca:messaging:1.11.29.19::hp_ux cpe:/a:ca:messaging:1.11.29.19::linux cpe:/a:ca:messaging:1.11.29.19::solaris cpe:/a:ca:messaging:1.11.29.19::windows CVE-2006-0530 2006-02-02T15:06:00.000-05:00 2018-10-19T11:45:15.397-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SREASON 404 SECTRACK 1015571 BUGTRAQ 20060202 CAID 33581 - CA Message Queuing Denial of Service Vulnerabilities BID 16475 VUPEN ADV-2006-0414 MISC http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33581 XF ca-cam-spoofed-message-dos(24449) Computer Associates (CA) Message Queuing (CAM / CAFT) before 1.07 Build 220_16 and 1.11 Build 29_20, as used in multiple CA products, allows remote attackers to cause a denial of service via spoofed CAM control messages. cpe:/a:sun:java_system_access_manager:7.0::linux cpe:/a:sun:java_system_access_manager:7.0::solaris_s cpe:/a:sun:java_system_access_manager:7.0::solaris_x CVE-2006-0531 2006-02-03T19:06:00.000-05:00 2017-10-10T21:30:38.107-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015567 SUNALERT 102140 BID 16474 VUPEN ADV-2006-0430 XF sun-jsam-admin-access(24423) Unspecified vulnerability in Sun Java System Access Manager 7.0 allows local users logged in as "root" to bypass authentication and gain top-level administrator privileges via the amadmin CLI tool. cpe:/a:media2_cms:shop CVE-2006-0532 2006-02-03T19:06:00.000-05:00 2017-07-19T21:29:51.363-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 400 BUGTRAQ 20060201 SoftMaker Shop is vulnerable to XSS BID 16471 VUPEN ADV-2006-0434 XF softmakershop-image-xss(24451) Cross-site scripting (XSS) vulnerability in resultat.asp in SoftMaker Shop allows remote attackers to inject arbitrary web script or HTML via a strSok parameter containing a javascript: URI in an IMG SRC attribute. cpe:/a:cpanel:cpanel:- CVE-2006-0533 2006-02-03T19:06:00.000-05:00 2017-07-19T21:29:51.427-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060203 Re: cPanel Multiple Cross Site Scripting VUPEN ADV-2006-0433 XF cpanel-scripts-xss(24468) Cross-site scripting (XSS) vulnerability in webmailaging.cgi in cPanel allows remote attackers to inject arbitrary web script or HTML via the numdays parameter. cpe:/a:cybershop:asp_ultimate_e-commerce_script CVE-2006-0534 2006-02-03T19:06:00.000-05:00 2018-10-19T11:45:16.363-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 401 BUGTRAQ 20060202 CyberShop Ultimate E-commerce Script Cross Site Scripting BID 16473 XF cybershop-xss(24454) Multiple cross-site scripting (XSS) vulnerabilities in default.asp in CyberShop Ultimate E-commerce allow remote attackers to inject arbitrary web script or HTML via the (1) ortak or (2) kat parameter. cpe:/a:communityserver.org:community_server CVE-2006-0535 2006-02-03T19:06:00.000-05:00 2008-09-05T16:59:33.010-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov 2006-02-07T11:40:00.000-05:00 BID 16478 Multiple cross-site scripting (XSS) vulnerabilities in Community Server allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NOTE: this candidate does not contain any actionable or distinguishing information. Perhaps it should not be included in CVE. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:neomail:neomail:1.27 CVE-2006-0536 2006-02-03T19:06:00.000-05:00 2018-10-19T11:45:16.740-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015581 BUGTRAQ 20060203 Neomail Cross Site Scripting Vulnerability VUPEN ADV-2006-0449 XF neomail-neomail-script-xss(24470) Cross-site scripting (XSS) vulnerability in neomail.pl in NeoMail 1.27 allows remote attackers to inject arbitrary web script or HTML via the sort parameter. NOTE: some sources say that the affected parameter is "date," but the demonstration URL shows that it is "sort". cpe:/a:kinesphere_corporation:exchange_pop3:5.0_build_050203 CVE-2006-0537 2006-02-03T19:06:00.000-05:00 2017-10-10T21:30:38.187-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BUGTRAQ 20060203 Exchangepop3 rcpt buffer overflow vulnerability MISC http://downloads.securityfocus.com/vulnerabilities/exploits/exchangepop3.pl SREASON 408 SECTRACK 1015580 BID 16485 VUPEN ADV-2006-0437 XF exchangepop3-rcptto-bo(24477) EXPLOIT-DB 1466 Buffer overflow in the POP3 server in Kinesphere Corporation eXchange before 5.0.060125 allows remote attackers to execute arbitrary code via a long RCPT TO argument. cpe:/a:ciphertrust:ironmail:5.0.1 CVE-2006-0538 2006-02-03T19:06:00.000-05:00 2018-10-19T11:45:17.113-04:00 2.6 NETWORK HIGH NONE NONE NONE PARTIAL http://nvd.nist.gov SREASON 407 SECTRACK 1015555 BUGTRAQ 20060203 IronMail-5.0.1-Denial of-Service-Protection-Lets-Remote-Users-Deny-Service BID 16465 XF ironmail-tcpsyn-flood-dos(24445) CipherTrust IronMail 5.0.1, when "Denial of Service Protection" is enabled, allows remote attackers to cause a denial of service (possibly CPU consumption) via a SYN flood with malformed TCP packets from multiple connections. cpe:/a:thibault_godouet:fcron:3.0.0 CVE-2006-0539 2006-02-03T21:02:00.000-05:00 2018-10-19T11:45:17.457-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS FULLDISC 20060201 Fcrontab - memory corruption on heap. CONFIRM http://fcron.free.fr/doc/en/changes.html CONFIRM http://fcron.free.fr/news.php#a20060206a.xml BUGTRAQ 20060201 Fcrontab - memory corruption on heap. BID 16467 TRUSTIX 2006-0036 VUPEN ADV-2006-0435 CONFIRM https://bugs.trustix.org/show_bug.cgi?id=1754 XF fcron-syslog-bo(24444) The convert-fcrontab program in fcron 3.0.0 might allow local users to gain privileges via a long command-line argument, which causes Linux glibc to report heap memory corruption, possibly because a strcpy in the strdup2 function can "overwrite some data." cpe:/a:tachyon:vanilla_guestbook:1.0_beta CVE-2006-0540 2006-02-03T21:02:00.000-05:00 2018-10-19T11:45:18.050-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.evuln.com/vulns/54/summary.html BUGTRAQ 20060201 [eVuln] Vanilla Guestbook Multiple XSS & SQL Injection Vulnerabilities BID 16464 XF vanillaguestbook-messages-sql-injection(24412) Multiple SQL injection vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to execute arbitrary SQL commands via unspecified vectors. cpe:/a:tachyon:vanilla_guestbook:1.0_beta CVE-2006-0541 2006-02-03T21:02:00.000-05:00 2018-10-19T11:45:18.333-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://www.evuln.com/vulns/54/summary.html BUGTRAQ 20060201 [eVuln] Vanilla Guestbook Multiple XSS & SQL Injection Vulnerabilities BUGTRAQ 20060227 Re: [eVuln] Vanilla Guestbook Multiple XSS & SQL Injection Vulnerabilities BID 16464 XF vanillaguestbook-name-xss(24411) Multiple cross-site scripting (XSS) vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to "posting new messages." cpe:/a:nukedweb:guestbookhost:2005-04-25 CVE-2006-0542 2006-02-03T21:02:00.000-05:00 2018-10-19T11:45:18.740-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.evuln.com/vulns/56/summary.html BUGTRAQ 20060209 [eVuln] GuestBookHost Authentication Bypass BID 16545 VUPEN ADV-2006-0465 XF guestbookhost-login-sql-injection(24406) Multiple SQL injection vulnerabilities in config.php in NukedWeb GuestBookHost 2005.04.25 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameters. cpe:/a:cerulean_studios:trillian:3.1.0.120 CVE-2006-0543 2006-02-03T21:02:00.000-05:00 2008-09-05T16:59:34.197-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov 2006-02-06T20:50:00.000-05:00 Cerulean Trillian 3.1.0.120 allows remote attackers to cause a denial of service (client crash) via an AIM message containing the Mac encoded Rich Text Format (RTF) escape sequences (1) \'d1, (2) \'d2, (3) \'d3, (4) \'d4, and (5) \'d5. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:microsoft:ie:7.0:beta_2 CVE-2006-0544 2006-02-03T21:02:00.000-05:00 2008-09-05T16:59:34.353-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-02-06T20:51:00.000-05:00 ALLOWS_USER_ACCESS BID 16463 MISC http://www.security-protocols.com/advisory/sp-x23-advisory.txt urlmon.dll in Microsoft Internet Explorer 7.0 beta 2 (aka 7.0.5296.0) allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a BGSOUND element with its SRC attribute set to "file://" followed by a large number of "-" (dash of hyphen) characters. cpe:/a:ubbcentral:ubb.threads:6.0 cpe:/a:ubbcentral:ubb.threads:6.0.1 cpe:/a:ubbcentral:ubb.threads:6.0.2 cpe:/a:ubbcentral:ubb.threads:6.0.3 cpe:/a:ubbcentral:ubb.threads:6.1 cpe:/a:ubbcentral:ubb.threads:6.1.1 cpe:/a:ubbcentral:ubb.threads:6.2 cpe:/a:ubbcentral:ubb.threads:6.2.1 cpe:/a:ubbcentral:ubb.threads:6.2.2 cpe:/a:ubbcentral:ubb.threads:6.2.3 cpe:/a:ubbcentral:ubb.threads:6.3 CVE-2006-0545 2006-02-03T21:02:00.000-05:00 2017-07-19T21:29:51.940-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060325 UBBThreads<=5.5.1+6.0.2+6.0 br5+6.0.1 SQL injection SECTRACK 1015549 MISC http://www.cyberlords.net/advisories/cl_ubb.txt BID 16520 XF ubbthreads-showflat-sql-injection(24381) SQL injection vulnerability in showflat.php in Groupee (formerly known as Infopop) UBB.threads 6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Number parameter. cpe:/a:egeinternet:egeinternet CVE-2006-0546 2006-02-03T21:02:00.000-05:00 2018-10-19T11:45:19.130-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BUGTRAQ 20060128 Ege Internet Web Desing Remote Command Exucetion Unspecified vulnerability in index.php in a certain application available from /v1/tr/portfoy.php on www.egeinternet.com allows remote attackers to execute arbitrary code via "evilcode" in the key parameter, possibly a PHP remote file include vulnerability in which the attack vector is a URL in the key parameter. NOTE: it is not clear whether this vulnerability is associated with an online service or application service provider. If so, then it should not be included in CVE. cpe:/a:oracle:database_server:8.1.7.4:r3 cpe:/a:oracle:database_server:9.2.0.6:r2 cpe:/a:oracle:database_server:9.2.0.7:r2 cpe:/a:oracle:database_server:10.1.0.3:r1 cpe:/a:oracle:database_server:10.1.0.4:r1 cpe:/a:oracle:database_server:10.1.0.5:r1 cpe:/a:oracle:database_server:10.2.0.1:r2 CVE-2006-0547 2006-02-03T21:02:00.000-05:00 2017-07-19T21:29:52.003-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060117 Oracle DBMS - Access Control Bypass in Login MISC http://www.imperva.com/application_defense_center/papers/oracle-dbms-01172006.html MISC http://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdf CERT-VN VU#871756 MISC http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html MISC http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html CERT TA06-018A XF oracle-login-command-execute(24184) Oracle Database 8i, 9i, and 10g allow remote authenticated users to execute arbitrary SQL statements in the context of the SYS user and bypass audit logging, including statements to create new privileged database accounts, via a modified AUTH_ALTER_SESSION attribute in the authentication phase of the Transparent Network Substrate (TNS) protocol. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB18 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0265. cpe:/a:oracle:database_server:10.1.0.4.2:r1 CVE-2006-0548 2006-02-03T21:02:00.000-05:00 2017-07-19T21:29:52.050-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdf CERT-VN VU#150332 MISC http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html MISC http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html CERT TA06-018A XF oracle-january2006-update(24321) SQL injection vulnerability in the Oracle Text component of Oracle Database 10g, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB15 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0260. cpe:/a:oracle:database_server:10.1.0.5:r1 CVE-2006-0549 2006-02-03T21:02:00.000-05:00 2017-07-19T21:29:52.113-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdf CERT-VN VU#629316 MISC http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html MISC http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html MISC http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_metadata_util.html CERT TA06-018A XF oracle-january2006-update(24321) SQL injection vulnerability in the SYS.DBMS_METADATA_UTIL package in Oracle Database 10g, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB05 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0260. However, there are some inconsistencies that make this unclear, and there is also a possibility that this is related to DB06, which is subsumed by CVE-2006-0259. cpe:/a:oracle:oracle_client CVE-2006-0550 2006-02-03T21:02:00.000-05:00 2017-07-19T21:29:52.160-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdf CERT-VN VU#999268 MISC http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html MISC http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html CERT TA06-018A XF oracle-january2006-update(24321) Buffer overflow in an unspecified Oracle Client utility might allow remote attackers to execute arbitrary code or cause a denial of service. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DBC02 from the January 2006 CPU, in which case this would be a duplicate of CVE-2006-0283. However, there are enough inconsistencies that the mapping can not be made authoritatively. cpe:/a:oracle:database_server:10.1.0.3 cpe:/a:oracle:database_server:10.1.0.4 cpe:/a:oracle:database_server:10.1.0.5 cpe:/a:oracle:database_server:10.2.0.1 CVE-2006-0551 2006-02-03T21:02:00.000-05:00 2017-07-19T21:29:52.223-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdf CERT-VN VU#983340 MISC http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html MISC http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html CERT TA06-018A XF oracle-january2006-update(24321) SQL injection vulnerability in the Data Pump Metadata API in Oracle Database 10g and possibly earlier might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle. It is possible that this is the same issue as Oracle Vuln# DB06 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0259 or, if it is DB05, subsumed by CVE-2006-0260. cpe:/a:oracle:10g_enterprise_manager_grid_control:10.1_.0.3 cpe:/a:oracle:10g_enterprise_manager_grid_control:10.1_.0.4 cpe:/a:oracle:application_server:1.0.2.2 cpe:/a:oracle:application_server:1.0.2.2:r1 cpe:/a:oracle:application_server:9.0.4 cpe:/a:oracle:application_server:9.0.4.1 cpe:/a:oracle:application_server:9.0.4.2 cpe:/a:oracle:application_server:10.1.2 cpe:/a:oracle:application_server:10.1.2.0.0:r2 cpe:/a:oracle:application_server:10.1.2.0.1 cpe:/a:oracle:application_server:10.1.2.0.1:r2 cpe:/a:oracle:application_server:10.1.2.0.2 cpe:/a:oracle:application_server:10.1.2.0.2:r2 cpe:/a:oracle:application_server:10.1.2.1.0 cpe:/a:oracle:collaboration_suite:9.0.4.2:r2 cpe:/a:oracle:collaboration_suite:10.1.1:r1 cpe:/a:oracle:collaboration_suite:10.1.2:r1 cpe:/a:oracle:collaboration_suite:release_1 cpe:/a:oracle:database_server:8.0.6 cpe:/a:oracle:database_server:8.0.6.3 cpe:/a:oracle:database_server:8.1.7.4 cpe:/a:oracle:developer_suite:9.0.2.1 cpe:/a:oracle:developer_suite:9.0.4.1 cpe:/a:oracle:developer_suite:9.0.4.2 cpe:/a:oracle:developer_suite:10.1.2 cpe:/a:oracle:e-business_suite:11.5.1 cpe:/a:oracle:e-business_suite:11.5.2 cpe:/a:oracle:e-business_suite:11.5.3 cpe:/a:oracle:e-business_suite:11.5.4 cpe:/a:oracle:e-business_suite:11.5.5 cpe:/a:oracle:e-business_suite:11.5.6 cpe:/a:oracle:e-business_suite:11.5.7 cpe:/a:oracle:e-business_suite:11.5.8 cpe:/a:oracle:e-business_suite:11.5.9 cpe:/a:oracle:e-business_suite:11.5.10 cpe:/a:oracle:enterpriseone:8.95.f1 cpe:/a:oracle:enterpriseone:sp23_l1 cpe:/a:oracle:oracle10g:enterprise_10.1.0.3 cpe:/a:oracle:oracle10g:enterprise_10.1.0.4 cpe:/a:oracle:oracle10g:personal_10.1.0.3 cpe:/a:oracle:oracle10g:personal_10.1.0.4 cpe:/a:oracle:oracle10g:standard_10.1.0.3 cpe:/a:oracle:oracle10g:standard_10.1.0.4 cpe:/a:oracle:oracle10g:standard_10.1.0.4.2 cpe:/a:oracle:oracle10g:standard_10.1.0.5 cpe:/a:oracle:oracle10g:standard_10.2.0.1 cpe:/a:oracle:oracle8i:enterprise_8.1.7.4 cpe:/a:oracle:oracle8i:standard_8.0.6 cpe:/a:oracle:oracle8i:standard_8.0.6.3 cpe:/a:oracle:oracle8i:standard_8.1.7.4 cpe:/a:oracle:oracle9i:enterprise_9.0.1.4 cpe:/a:oracle:oracle9i:enterprise_9.0.1.5 cpe:/a:oracle:oracle9i:enterprise_9.0.1.5_fips cpe:/a:oracle:oracle9i:standard_9.2.0.6 cpe:/a:oracle:oracle9i:standard_9.2.0.7 cpe:/a:oracle:peoplesoft_enterprise_portal:8.4 cpe:/a:oracle:peoplesoft_enterprise_portal:8.8 cpe:/a:oracle:peoplesoft_enterprise_portal:8.9 cpe:/a:oracle:workflow:11.5.1 cpe:/a:oracle:workflow:11.5.9.5 CVE-2006-0552 2006-02-04T06:02:00.000-05:00 2017-07-19T21:29:52.283-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov SECTRACK 1015499 CERT-VN VU#545804 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html BID 16287 VUPEN ADV-2006-0243 VUPEN ADV-2006-0323 XF oracle-january2006-update(24321) Unspecified vulnerability in the Net Listener component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, and 9.2.0.7 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB11. cpe:/a:postgresql:postgresql:8.1.0 cpe:/a:postgresql:postgresql:8.1.1 cpe:/a:postgresql:postgresql:8.1.2 CVE-2006-0553 2006-02-14T14:06:00.000-05:00 2018-10-19T11:45:19.240-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MLIST [pgsql-announce] 20060214 Minor Releases 7.3 thru 8.1 Available to Fix Security Issue SECTRACK 1015636 CERT-VN VU#567452 OPENPKG OpenPKG-SA-2006.004 CONFIRM http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3 BUGTRAQ 20060215 PostgreSQL security releases 8.1.3, 8.0.7, 7.4.12, 7.3.14 BID 16649 VUPEN ADV-2006-0605 XF postgresql-setrole-privilege-elevation(24718) PostgreSQL 8.1.0 through 8.1.2 allows authenticated database users to gain additional privileges via "knowledge of the backend protocol" using a crafted SET ROLE to other database users, a different vulnerability than CVE-2006-0678. cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.0::64-bit_x86 cpe:/o:linux:linux_kernel:2.6.0::itanium_ia64_montecito cpe:/o:linux:linux_kernel:2.6.0:test1 cpe:/o:linux:linux_kernel:2.6.0:test10 cpe:/o:linux:linux_kernel:2.6.0:test11 cpe:/o:linux:linux_kernel:2.6.0:test2 cpe:/o:linux:linux_kernel:2.6.0:test3 cpe:/o:linux:linux_kernel:2.6.0:test4 cpe:/o:linux:linux_kernel:2.6.0:test5 cpe:/o:linux:linux_kernel:2.6.0:test6 cpe:/o:linux:linux_kernel:2.6.0:test7 cpe:/o:linux:linux_kernel:2.6.0:test8 cpe:/o:linux:linux_kernel:2.6.0:test9 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.8.1 cpe:/o:linux:linux_kernel:2.6.8.1.5 cpe:/o:linux:linux_kernel:2.6.8.1.5::386 cpe:/o:linux:linux_kernel:2.6.8.1.5::686 cpe:/o:linux:linux_kernel:2.6.8.1.5::686_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64 cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64_k8 cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64_k8_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64_xeon cpe:/o:linux:linux_kernel:2.6.8.1.5::k7 cpe:/o:linux:linux_kernel:2.6.8.1.5::k7_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::power3 cpe:/o:linux:linux_kernel:2.6.8.1.5::power3_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::power4 cpe:/o:linux:linux_kernel:2.6.8.1.5::power4_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::powerpc cpe:/o:linux:linux_kernel:2.6.8.1.5::powerpc_smp cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11:rc1 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11.1 cpe:/o:linux:linux_kernel:2.6.11.2 cpe:/o:linux:linux_kernel:2.6.11.3 cpe:/o:linux:linux_kernel:2.6.11.4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.9 cpe:/o:linux:linux_kernel:2.6.11.10 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.11_rc1_bk6 cpe:/o:linux:linux_kernel:2.6.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15:rc4 cpe:/o:linux:linux_kernel:2.6.15:rc5 cpe:/o:linux:linux_kernel:2.6.15:rc6 cpe:/o:linux:linux_kernel:2.6.15:rc7 CVE-2006-0554 2006-03-06T21:02:00.000-05:00 2018-10-03T17:35:37.040-04:00 1.7 LOCAL LOW SINGLE_INSTANCE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.5 DEBIAN DSA-1103 MANDRIVA MDKSA-2006:059 MANDRIVA MDKSA-2006:150 SUSE SUSE-SA:2006:028 BID 16921 VUPEN ADV-2006-0804 VUPEN ADV-2006-2554 XF kernel-ftruncate-information-disclosure(24999) UBUNTU USN-263-1 Linux kernel 2.6 before 2.6.15.5 allows local users to obtain sensitive information via a crafted XFS ftruncate call, which may return stale data. cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.0::64-bit_x86 cpe:/o:linux:linux_kernel:2.6.0::itanium_ia64_montecito cpe:/o:linux:linux_kernel:2.6.0:test1 cpe:/o:linux:linux_kernel:2.6.0:test10 cpe:/o:linux:linux_kernel:2.6.0:test11 cpe:/o:linux:linux_kernel:2.6.0:test2 cpe:/o:linux:linux_kernel:2.6.0:test3 cpe:/o:linux:linux_kernel:2.6.0:test4 cpe:/o:linux:linux_kernel:2.6.0:test5 cpe:/o:linux:linux_kernel:2.6.0:test6 cpe:/o:linux:linux_kernel:2.6.0:test7 cpe:/o:linux:linux_kernel:2.6.0:test8 cpe:/o:linux:linux_kernel:2.6.0:test9 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.8.1 cpe:/o:linux:linux_kernel:2.6.8.1.5 cpe:/o:linux:linux_kernel:2.6.8.1.5::386 cpe:/o:linux:linux_kernel:2.6.8.1.5::686 cpe:/o:linux:linux_kernel:2.6.8.1.5::686_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64 cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64_k8 cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64_k8_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64_xeon cpe:/o:linux:linux_kernel:2.6.8.1.5::k7 cpe:/o:linux:linux_kernel:2.6.8.1.5::k7_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::power3 cpe:/o:linux:linux_kernel:2.6.8.1.5::power3_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::power4 cpe:/o:linux:linux_kernel:2.6.8.1.5::power4_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::powerpc cpe:/o:linux:linux_kernel:2.6.8.1.5::powerpc_smp cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11:rc1 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11.1 cpe:/o:linux:linux_kernel:2.6.11.2 cpe:/o:linux:linux_kernel:2.6.11.3 cpe:/o:linux:linux_kernel:2.6.11.4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.9 cpe:/o:linux:linux_kernel:2.6.11.10 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.11_rc1_bk6 cpe:/o:linux:linux_kernel:2.6.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15:rc4 cpe:/o:linux:linux_kernel:2.6.15:rc5 cpe:/o:linux:linux_kernel:2.6.15:rc6 cpe:/o:linux:linux_kernel:2.6.15:rc7 CVE-2006-0555 2006-03-06T21:02:00.000-05:00 2018-10-03T17:35:38.807-04:00 2.1 LOCAL LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.5 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-161.htm DEBIAN DSA-1103 MANDRIVA MDKSA-2006:059 SUSE SUSE-SA:2006:028 FEDORA FEDORA-2006-131 REDHAT RHSA-2006:0493 BID 16922 VUPEN ADV-2006-0804 VUPEN ADV-2006-2554 XF kernel-odirect-dos(25000) UBUNTU USN-263-1 The Linux Kernel before 2.6.15.5 allows local users to cause a denial of service (NFS client panic) via unknown attack vectors related to the use of O_DIRECT (direct I/O). CVE-2006-0556 2017-05-11T10:29:03.510-04:00 2017-05-11T10:29:03.510-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2006. Notes: none. cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.1:rc3 cpe:/o:linux:linux_kernel:2.6.2 cpe:/o:linux:linux_kernel:2.6.2:rc1 cpe:/o:linux:linux_kernel:2.6.2:rc2 cpe:/o:linux:linux_kernel:2.6.2:rc3 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.3:rc1 cpe:/o:linux:linux_kernel:2.6.3:rc2 cpe:/o:linux:linux_kernel:2.6.3:rc3 cpe:/o:linux:linux_kernel:2.6.3:rc4 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.4:rc1 cpe:/o:linux:linux_kernel:2.6.4:rc2 cpe:/o:linux:linux_kernel:2.6.4:rc3 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.5:rc1 cpe:/o:linux:linux_kernel:2.6.5:rc2 cpe:/o:linux:linux_kernel:2.6.5:rc3 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.6:rc2 cpe:/o:linux:linux_kernel:2.6.6:rc3 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.7:rc2 cpe:/o:linux:linux_kernel:2.6.7:rc3 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.8:rc4 cpe:/o:linux:linux_kernel:2.6.8.1 cpe:/o:linux:linux_kernel:2.6.9 cpe:/o:linux:linux_kernel:2.6.9:rc1 cpe:/o:linux:linux_kernel:2.6.9:rc2 cpe:/o:linux:linux_kernel:2.6.9:rc3 cpe:/o:linux:linux_kernel:2.6.9:rc4 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc1 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.10:rc3 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11:rc1 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11:rc5 cpe:/o:linux:linux_kernel:2.6.11.1 cpe:/o:linux:linux_kernel:2.6.11.2 cpe:/o:linux:linux_kernel:2.6.11.3 cpe:/o:linux:linux_kernel:2.6.11.4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.9 cpe:/o:linux:linux_kernel:2.6.11.10 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc2 cpe:/o:linux:linux_kernel:2.6.12:rc3 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12:rc6 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc2 cpe:/o:linux:linux_kernel:2.6.13:rc3 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc5 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.13.5 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14:rc5 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.14.5 cpe:/o:linux:linux_kernel:2.6.14.6 cpe:/o:linux:linux_kernel:2.6.14.7 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc2 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15:rc4 cpe:/o:linux:linux_kernel:2.6.15:rc5 cpe:/o:linux:linux_kernel:2.6.15:rc6 cpe:/o:linux:linux_kernel:2.6.15:rc7 cpe:/o:linux:linux_kernel:2.6.15.1 cpe:/o:linux:linux_kernel:2.6.15.2 cpe:/o:linux:linux_kernel:2.6.15.3 cpe:/o:linux:linux_kernel:2.6.15.4 cpe:/o:linux:linux_kernel:2.6.15.5 cpe:/o:linux:linux_kernel:2.6.15.6 cpe:/o:linux:linux_kernel:2.6.15.7 cpe:/o:linux:linux_kernel:2.6.16 cpe:/o:linux:linux_kernel:2.6.16:rc1 cpe:/o:linux:linux_kernel:2.6.16:rc2 cpe:/o:linux:linux_kernel:2.6.16:rc3 cpe:/o:linux:linux_kernel:2.6.16:rc4 cpe:/o:linux:linux_kernel:2.6.16:rc5 cpe:/o:linux:linux_kernel:2.6.16:rc6 CVE-2006-0557 2006-03-12T16:02:00.000-05:00 2018-10-03T17:35:41.650-04:00 4.9 LOCAL LOW NONE NONE NONE COMPLETE http://nvd.nist.gov CONFIRM http://lkml.org/lkml/2006/2/27/355 REDHAT RHBA-2007-0304 SECTRACK 1015752 DEBIAN DSA-1103 CONFIRM http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=636f13c174dd7c84a437d3c3e8fa66f03f7fda63 CONFIRM http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=636f13c174dd7c84a437d3c3e8fa66f03f7fda63 MANDRIVA MDKSA-2006:059 SUSE SUSE-SA:2006:028 BID 16924 VUPEN ADV-2006-2554 CONFIRM https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=184510 XF linux-get-nodes-dos(25204) UBUNTU USN-281-1 sys_mbind in mempolicy.c in Linux kernel 2.6.16 and earlier does not sanity check the maxnod variable before making certain computations for the get_nodes function, which has unknown impact and attack vectors. cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.0:test1 cpe:/o:linux:linux_kernel:2.6.0:test10 cpe:/o:linux:linux_kernel:2.6.0:test11 cpe:/o:linux:linux_kernel:2.6.0:test2 cpe:/o:linux:linux_kernel:2.6.0:test3 cpe:/o:linux:linux_kernel:2.6.0:test4 cpe:/o:linux:linux_kernel:2.6.0:test5 cpe:/o:linux:linux_kernel:2.6.0:test6 cpe:/o:linux:linux_kernel:2.6.0:test7 cpe:/o:linux:linux_kernel:2.6.0:test8 cpe:/o:linux:linux_kernel:2.6.0:test9 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.2 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.14.5 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15.1 cpe:/o:linux:linux_kernel:2.6.15.2 cpe:/o:linux:linux_kernel:2.6.15.3 cpe:/o:linux:linux_kernel:2.6.15.4 cpe:/o:linux:linux_kernel:2.6.15.5 cpe:/o:linux:linux_kernel:2.6.16 cpe:/o:linux:linux_kernel:2.6.16:rc1 cpe:/o:linux:linux_kernel:2.6.16.1 cpe:/o:linux:linux_kernel:2.6_test9_cvs CVE-2006-0558 2006-04-14T17:02:00.000-04:00 2017-10-10T21:30:38.780-04:00 4.9 LOCAL LOW NONE NONE NONE COMPLETE http://nvd.nist.gov MLIST [linux-ia64] [PATCH 1/1] ia64: perfmon.c trips BUG_ON in put_page_testzero DEBIAN DSA-1103 REDHAT RHSA-2007:0774 BID 17482 VUPEN ADV-2006-1444 VUPEN ADV-2006-2554 CONFIRM https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=185082 perfmon (perfmon.c) in Linux kernel on IA64 architectures allows local users to cause a denial of service (crash) by interrupting a task while another process is accessing the mm_struct, which triggers a BUG_ON action in the put_page_testzero function. cpe:/a:mcafee:webshield_smtp:4.5:mr2_patch CVE-2006-0559 2006-04-04T10:04:00.000-04:00 2018-10-19T11:45:19.817-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SREASON 671 SECTRACK 1015861 BUGTRAQ 20060404 SYMSA-2006-002: McAfee WebShield SMTP Format String Vulnerability BID 16742 VUPEN ADV-2006-1219 XF webshield-smtp-format-string(25621) Format string vulnerability in the SMTP server for McAfee WebShield 4.5 MR2 and earlier allows remote attackers to execute arbitrary code via format strings in the domain name portion of a destination address, which are not properly handled when a bounce message is constructed. CVE-2006-0560 2017-05-11T10:29:03.540-04:00 2017-05-11T10:29:03.540-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2006. Notes: none. cpe:/a:cisco:secure_access_control_server:3.0::windows_nt cpe:/a:cisco:secure_access_control_server:3.0.1::windows_nt cpe:/a:cisco:secure_access_control_server:3.0.3::windows_nt cpe:/a:cisco:secure_access_control_server:3.1::windows_nt cpe:/a:cisco:secure_access_control_server:3.1.1::windows_nt cpe:/a:cisco:secure_access_control_server:3.2::windows_nt cpe:/a:cisco:secure_access_control_server:3.2::windows_server cpe:/a:cisco:secure_access_control_server:3.3::windows_nt CVE-2006-0561 2006-05-09T22:14:00.000-04:00 2017-07-19T21:29:52.737-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1016042 CISCO 20060508 Response to Symantec SYMSA-2006-003 Cisco Secure ACS for Windows - Administrator Password Disclosure BUGTRAQ 20060508 SYMSA-2006-003: Cisco Secure ACS for Windows - Administrator Password Disclosure BUGTRAQ 20060508 Re: SYMSA-2006-003: Cisco Secure ACS for Windows - Administrator Password Disclosure BID 16743 MISC http://www.symantec.com/enterprise/research/SYMSA-2006-003.txt VUPEN ADV-2006-1741 XF cisco-acs-admin-password-disclosure(26307) Cisco Secure Access Control Server (ACS) 3.x for Windows stores ACS administrator passwords and the master key in the registry with insecure permissions, which allows local users and remote administrators to decrypt the passwords by using Microsoft's cryptographic API functions to obtain the plaintext version of the master key. cpe:/a:pluggedout:pluggedout_blog:1.9.9c CVE-2006-0562 2006-02-06T18:02:00.000-05:00 2018-10-19T11:45:20.207-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov VIM 20060206 VERIFY Pluggedout Blog 1.9.9c problem.php XSS MISC http://hamid.ir/security/pluggedoutblog.txt SECTRACK 1015586 BUGTRAQ 20060204 PluggedOut Blog SQL injection and XSS VUPEN ADV-2006-0440 XF pluggedoutblog-problem-xss(24482) Cross-site scripting (XSS) vulnerability in problem.php in PluggedOut Blog 1.9.9c allows remote attackers to inject arbitrary web script or HTML via the data parameter. cpe:/a:pluggedout:pluggedout_blog:1.9.9c CVE-2006-0563 2006-02-06T18:02:00.000-05:00 2018-10-19T11:45:20.647-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS VIM 20060206 VERIFY Pluggedout Blog 1.9.9c exec.php SQL injection MISC http://hamid.ir/security/pluggedoutblog.txt SREASON 415 SECTRACK 1015586 BUGTRAQ 20060204 PluggedOut Blog SQL injection and XSS VUPEN ADV-2006-0440 XF pluggedoutblog-exec-sql-injection(24480) SQL injection vulnerability in exec.php in PluggedOut Blog 1.9.9c allows remote attackers to execute arbitrary SQL commands via the entryid parameter in a comment_add action. cpe:/a:microsoft:html_help:1.4::sdk cpe:/a:microsoft:html_help_workshop:4.74.8702.0 CVE-2006-0564 2006-02-06T18:02:00.000-05:00 2017-07-19T21:29:52.893-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015585 MISC http://users.pandora.be/bratax/advisories/b008.html CERT-VN VU#124460 VUPEN ADV-2006-0446 XF mshtmlhelp-workshop-hhp-bo(24481) Stack-based buffer overflow in Microsoft HTML Help Workshop 4.74.8702.0, and possibly earlier versions, and as included in the Microsoft HTML Help 1.4 SDK, allows context-dependent attackers to execute arbitrary code via a .hhp file with a long Contents file field. cpe:/a:gerrit_van_aaken:loudblog:0.1 cpe:/a:gerrit_van_aaken:loudblog:0.2 cpe:/a:gerrit_van_aaken:loudblog:0.3 cpe:/a:gerrit_van_aaken:loudblog:0.4 CVE-2006-0565 2006-02-06T18:02:00.000-05:00 2018-10-19T11:45:21.160-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://retrogod.altervista.org/loudblog_04_incl_xpl.html SREASON 410 SREASON 556 SECTRACK 1015583 BUGTRAQ 20060204 LoudBlog <= 0.4 arbitrary remote inclusion BID 16495 VUPEN ADV-2006-0441 XF loudblog-backendsettings-file-include(24479) PHP remote file include vulnerability in inc/backend_settings.php in Loudblog 0.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the $GLOBALS[path] parameter. cpe:/a:communigate:communigate_pro_core_server:5.0.7 CVE-2006-0566 2006-02-06T18:02:00.000-05:00 2018-10-19T11:45:21.723-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SREASON 416 SECTRACK 1015587 MISC http://www.gleg.net/advisory_cg2.shtml BUGTRAQ 20060204 ProtoVer LDAP vs CommuniGate Pro 5.0.7 CONFIRM http://www.stalker.com/CommuniGatePro/History.html VUPEN ADV-2006-0444 XF communigate-ldap-bo(24409) The LDAP component in CommuniGate Pro Core Server 5.0.7 allows remote attackers to cause a denial of service (application crash) via LDAP messages that contain Distinguished Names (DN) fields with a large number of elements. cpe:/a:curtis_farnham:files_xaraya_module:0.3.0 cpe:/a:curtis_farnham:files_xaraya_module:0.4.0 CVE-2006-0567 2006-02-07T13:06:00.000-05:00 2017-07-19T21:29:53.050-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov VUPEN ADV-2006-0371 CONFIRM http://xaraya.curtisfarnham.com/articles/Files_0.5.1_-_Security_Fix_and_other_things XF files-archive-directory-directory-traversal(24393) Directory traversal vulnerability in Files Xaraya module before 0.5.1, when the Archive Directory field on the Modify Config page is blank, allows remote attackers to access files outside of the web root via ".." (dot dot) sequences. cpe:/a:outblaze:outblaze CVE-2006-0568 2006-02-07T13:06:00.000-05:00 2018-10-19T11:45:22.317-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060202 Outblaze Cross Site Scripting Vulnerability SREASON 411 MISC http://www.morx.org/outblazeXSS.txt BUGTRAQ 20060203 Outblaze Cross Site Scripting Vulnerability VUPEN ADV-2006-0439 XF outblaze-email-thrownmain-xss(24476) Cross-site scripting (XSS) vulnerability in throw.main in Outblaze allows remote attackers to inject arbitrary web script or HTML via the file parameter. cpe:/a:papoo:papoo:2.1.4 CVE-2006-0569 2006-02-07T13:06:00.000-05:00 2017-07-19T21:29:53.223-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov VUPEN ADV-2006-0438 XF papoo-username-xss(24500) Cross-site scripting (XSS) vulnerability in user_class.php in Papoo 2.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the username field during the registration of a new account. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:hinton_design:phpstatus:1.0 CVE-2006-0570 2006-02-07T13:06:00.000-05:00 2018-10-19T11:45:22.833-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/61/summary.html SREASON 427 BUGTRAQ 20060212 [eVuln] phpstatus Authentication Bypass BID 16587 VUPEN ADV-2006-0450 Multiple SQL injection vulnerabilities in phpstatus 1.0, when gpc_magic_quotes is disabled, allow remote attackers to execute arbitrary SQL commands and bypass authentication via (1) the username parameter in check.php and (2) unknown attack vectors in the administrative interface. cpe:/a:hinton_design:phpstatus:1.0 CVE-2006-0571 2006-02-07T13:06:00.000-05:00 2018-10-19T11:45:23.130-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/61/summary.html SREASON 427 BUGTRAQ 20060212 [eVuln] phpstatus Authentication Bypass BID 16587 VUPEN ADV-2006-0450 Multiple cross-site scripting (XSS) vulnerabilities in phpstatus 1.0 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in the administrative interface. cpe:/a:hinton_design:phpstatus:1.0 CVE-2006-0572 2006-02-07T13:06:00.000-05:00 2018-10-19T11:45:23.443-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/61/summary.html SREASON 427 BUGTRAQ 20060212 [eVuln] phpstatus Authentication Bypass BID 16587 phpstatus 1.0 does not require passwords when using cookies to identify a user, which allows remote attackers to bypass authentication. cpe:/a:cpanel:cpanel:5.0 cpe:/a:cpanel:cpanel:5.3 cpe:/a:cpanel:cpanel:6.0 cpe:/a:cpanel:cpanel:6.2 cpe:/a:cpanel:cpanel:6.4 cpe:/a:cpanel:cpanel:6.4.1 cpe:/a:cpanel:cpanel:6.4.2 cpe:/a:cpanel:cpanel:6.4.2_stable_48 cpe:/a:cpanel:cpanel:7.0 cpe:/a:cpanel:cpanel:8.0 cpe:/a:cpanel:cpanel:9.0 cpe:/a:cpanel:cpanel:9.1 cpe:/a:cpanel:cpanel:10 CVE-2006-0573 2006-02-07T13:06:00.000-05:00 2017-07-19T21:29:53.520-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060202 cPanel Multiple Cross Site Scripting Vulnerability BUGTRAQ 20060203 cPanel Multiple Cross Site Scripting Vulnerability VUPEN ADV-2006-0433 XF cpanel-scripts-xss(24468) Multiple cross-site scripting (XSS) vulnerabilies in cPanel 10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to (a) editquota.html or (b) dodelpop.html; (2) showtree parameter to (c) diskusage.html; or the (3) mon, (4) year, (5) target, or (6) domain parameter to (d) stats/detailbw.html. cpe:/a:cpanel:cpanel:10 CVE-2006-0574 2006-02-07T13:06:00.000-05:00 2018-10-19T11:45:23.740-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060204 cPanel 10 mime/handle.html XSS Vulnerability SECTRACK 1015589 BUGTRAQ 20060205 cPanel 10 handle.html XSS Vulnerability VUPEN ADV-2006-0433 Cross-site scripting (XSS) vulnerability in mime/handle.html in cPanel 10 allows remote attackers to inject arbitrary web script or HTML via the (1) file extension or (2) mime-type. cpe:/a:thibault_godouet:fcron:2.9.5 cpe:/a:thibault_godouet:fcron:3.0.0 CVE-2006-0575 2006-02-07T15:02:00.000-05:00 2017-07-19T21:29:53.580-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060202 Re: Fcrontab - memory corruption on heap. BID 25693 TRUSTIX 2006-0006 VUPEN ADV-2006-0435 XF fcron-dotdot-directory-traversal(24504) convert-fcrontab in Fcron 2.9.5 and 3.0.0 allows remote attackers to create or overwrite arbitrary files via ".." sequences and a symlink attack on the temporary file that is used during conversion. cpe:/a:maynard_johnson:oprofile:0.1 cpe:/a:maynard_johnson:oprofile:0.2 cpe:/a:maynard_johnson:oprofile:0.3 cpe:/a:maynard_johnson:oprofile:0.4 cpe:/a:maynard_johnson:oprofile:0.5 cpe:/a:maynard_johnson:oprofile:0.5.1 cpe:/a:maynard_johnson:oprofile:0.5.2 cpe:/a:maynard_johnson:oprofile:0.5.3 cpe:/a:maynard_johnson:oprofile:0.5.4 cpe:/a:maynard_johnson:oprofile:0.6 cpe:/a:maynard_johnson:oprofile:0.6.1 cpe:/a:maynard_johnson:oprofile:0.7 cpe:/a:maynard_johnson:oprofile:0.7.1 cpe:/a:maynard_johnson:oprofile:0.8 cpe:/a:maynard_johnson:oprofile:0.8.1 cpe:/a:maynard_johnson:oprofile:0.8.2 cpe:/a:maynard_johnson:oprofile:0.9 cpe:/a:maynard_johnson:oprofile:0.9.1 CVE-2006-0576 2006-02-07T19:06:00.000-05:00 2018-10-19T11:45:24.067-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS MISC http://www.redhat.com/magazine/012oct05/features/oprofile/ BUGTRAQ 20060207 Arbitrary code execution via OProfile BID 16536 Untrusted search path vulnerability in opcontrol in OProfile 0.9.1 and earlier allows local users to execute arbitrary commands via a modified PATH that references malicious (1) which or (2) dirname programs. NOTE: while opcontrol normally is not run setuid, a common configuration suggests accessing opcontrol using sudo. In such a context, this is a vulnerability. cpe:/h:lexmark:x1185 CVE-2006-0577 2006-02-07T19:06:00.000-05:00 2018-10-19T11:45:24.490-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS BUGTRAQ 20060207 Re: High Risk Vulnerability in Lexmark Printer Sharing Service BID 16534 VUPEN ADV-2006-0482 XF lexmark-x1185-privilege-elevation(24596) Lexmark X1185 printer allows local users to gain SYSTEM privileges by navigating to the "Appearance" dialog and selecting the "Additional styles (skins) are available on the Lexmark web site" option, which launches a web browser that is running with SYSTEM privileges. cpe:/o:bluecoat:sgos:4.1.2.1 CVE-2006-0578 2006-02-07T20:02:00.000-05:00 2018-10-30T12:25:17.857-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1015644 CONFIRM http://www.bluecoat.com/support/knowledge/advisory_connect_denial_ignore.html MISC http://www.secumind.net/content/french/modules/news/article.php?storyid=8 VUPEN ADV-2006-0401 XF proxysg-connect-bypass-security(24446) Blue Coat Proxy Security Gateway OS (SGOS) 4.1.2.1 does not enforce CONNECT rules when using Deep Content Inspection, which allows remote attackers to bypass connection filters. cpe:/a:mplayer:mplayer:1.0_pre7try2 CVE-2006-0579 2006-02-07T20:02:00.000-05:00 2017-07-19T21:29:53.800-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS GENTOO GLSA-200603-03 MANDRIVA MDKSA-2006:048 VUPEN ADV-2006-0457 XF mplayer-asf-integer-overflow(24531) Multiple integer overflows in (1) the new_demux_packet function in demuxer.h and (2) the demux_asf_read_packet function in demux_asf.c in MPlayer 1.0pre7try2 and earlier allow remote attackers to execute arbitrary code via an ASF file with a large packet length value. NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information. cpe:/a:ibm:lotus_domino_server:7.0 CVE-2006-0580 2006-02-07T20:02:00.000-05:00 2017-07-19T21:29:53.847-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MLIST [Dailydave] 20060203 ProtoVer vs Lotus Domino Server 7.0 SECTRACK 1015592 BID 16523 VUPEN ADV-2006-0458 XF lotus-domino-ldap-dos(24518) IBM Lotus Domino Server 7.0 allows remote attackers to cause a denial of service (segmentation fault) via a crafted packet to the LDAP port (389/TCP). cpe:/a:hosting_controller:hosting_controller:6.1_hotfix_2.8 CVE-2006-0581 2006-02-07T20:02:00.000-05:00 2017-07-19T21:29:53.910-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1015584 VUPEN ADV-2006-0460 XF hosting-controller-sql-injection(24537) SQL injection vulnerability in Hosting Controller 6.1 Hotfix 2.8 allows remote authenticated users to execute arbitrary SQL commands via the (1) GatewayID parameter in an add action in AddGatewaySettings.asp and (2) IP parameter in IPManager.asp. cpe:/a:kth:heimdal:0.6.1 cpe:/a:kth:heimdal:0.6.2 cpe:/a:kth:heimdal:0.6.3 cpe:/a:kth:heimdal:0.6.4 cpe:/a:kth:heimdal:0.6.5 cpe:/a:kth:heimdal:0.7.1 cpe:/a:kth:heimdal:0.7.1.1 cpe:/a:kth:heimdal:0.7.1.2 cpe:/a:kth:heimdal:0.7.1.3 CVE-2006-0582 2006-02-07T20:02:00.000-05:00 2018-10-19T11:45:24.850-04:00 2.1 LOCAL LOW NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015591 DEBIAN DSA-977 GENTOO GLSA-200603-14 CONFIRM http://www.pdc.kth.se/heimdal/advisory/2006-02-06/ SUSE SUSE-SA:2006:011 BID 16524 MLIST [heimdal-discuss] 20060206 Heimdal 0.7.2 and 0.6.6 UBUNTU USN-253-1 VUPEN ADV-2006-0456 VUPEN ADV-2006-0628 XF heimdal-rshd-privilege-elevation(24532) UBUNTU USN-247-1 Unspecified vulnerability in rshd in Heimdal 0.6.x before 0.6.6 and 0.7.x before 0.7.2, when storing forwarded credentials, allows attackers to overwrite arbitrary files and change file ownership via unknown vectors. cpe:/a:clever_copy:clever_copy:1.0.0 cpe:/a:clever_copy:clever_copy:1.0.1 cpe:/a:clever_copy:clever_copy:1.0.2 cpe:/a:clever_copy:clever_copy:1.0.3 cpe:/a:clever_copy:clever_copy:2.0 cpe:/a:clever_copy:clever_copy:2.0a cpe:/a:clever_copy:clever_copy:3.0 CVE-2006-0583 2006-02-07T20:02:00.000-05:00 2017-07-19T21:29:54.050-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://retrogod.altervista.org/Clever_Copy_V3_sql_xpl.html SECTRACK 1015590 VUPEN ADV-2006-0462 XF clevercopy-mailarticle-sql-injection(24545) SQL injection vulnerability in mailarticle.php in Clever Copy 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter. cpe:/a:peoplesoft:peopletools:8.4 cpe:/a:peoplesoft:peopletools:8.40 cpe:/a:peoplesoft:peopletools:8.41 cpe:/a:peoplesoft:peopletools:8.42 cpe:/a:peoplesoft:peopletools:8.43 cpe:/a:peoplesoft:peopletools:8.45.5 cpe:/a:peoplesoft:peopletools:8.46.3 CVE-2006-0584 2006-02-07T20:02:00.000-05:00 2018-10-19T11:45:26.223-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BUGTRAQ 20060204 PeopleSoft (Oracle) PSCipher Encryption Weakness BID 16507 The PSCipher function in PeopleSoft People Tools 8.4x uses PKCS #5 with a fixed DES key to store user passwords, which makes it easier for local users to guess passwords using a dictionary attack that compares output strings. cpe:/a:microsoft:ie:3.0 cpe:/a:microsoft:ie:3.0.1 cpe:/a:microsoft:ie:3.0.2 cpe:/a:microsoft:ie:3.1 cpe:/a:microsoft:ie:3.2 cpe:/a:microsoft:ie:4.0 cpe:/a:microsoft:ie:4.0.1 cpe:/a:microsoft:ie:4.0.1:sp1 cpe:/a:microsoft:ie:4.0.1:sp2 cpe:/a:microsoft:ie:4.1 cpe:/a:microsoft:ie:4.01:sp1 cpe:/a:microsoft:ie:4.5 cpe:/a:microsoft:ie:4.40.308 cpe:/a:microsoft:ie:4.40.520 cpe:/a:microsoft:ie:4.70.1155 cpe:/a:microsoft:ie:4.70.1158 cpe:/a:microsoft:ie:4.70.1215 cpe:/a:microsoft:ie:4.70.1300 cpe:/a:microsoft:ie:4.71.544 cpe:/a:microsoft:ie:4.71.1008.3 cpe:/a:microsoft:ie:4.71.1712.6 cpe:/a:microsoft:ie:4.72.2106.8 cpe:/a:microsoft:ie:4.72.3110.8 cpe:/a:microsoft:ie:4.72.3612.1713 cpe:/a:microsoft:ie:5.0 cpe:/a:microsoft:ie:5.0.1 cpe:/a:microsoft:ie:5.0.1:sp1 cpe:/a:microsoft:ie:5.0.1:sp2 cpe:/a:microsoft:ie:5.0.1:sp3 cpe:/a:microsoft:ie:5.0.1:sp4 cpe:/a:microsoft:ie:5.00.0518.10 cpe:/a:microsoft:ie:5.00.0910.1309 cpe:/a:microsoft:ie:5.00.2014.0216 cpe:/a:microsoft:ie:5.00.2314.1003 cpe:/a:microsoft:ie:5.00.2516.1900 cpe:/a:microsoft:ie:5.00.2614.3500 cpe:/a:microsoft:ie:5.00.2919.800 cpe:/a:microsoft:ie:5.00.2919.3800 cpe:/a:microsoft:ie:5.00.2919.6307 cpe:/a:microsoft:ie:5.00.2920.0000 cpe:/a:microsoft:ie:5.00.3103.1000 cpe:/a:microsoft:ie:5.00.3105.0106 cpe:/a:microsoft:ie:5.00.3314.2101 cpe:/a:microsoft:ie:5.00.3315.1000 cpe:/a:microsoft:ie:5.00.3502.1000 cpe:/a:microsoft:ie:5.00.3700.1000 cpe:/a:microsoft:ie:5.01 cpe:/a:microsoft:ie:5.01:sp1 cpe:/a:microsoft:ie:5.01:sp2 cpe:/a:microsoft:ie:5.01:sp3 cpe:/a:microsoft:ie:5.01:sp4 cpe:/a:microsoft:ie:5.2.3 cpe:/a:microsoft:ie:5.5 cpe:/a:microsoft:ie:5.5:preview cpe:/a:microsoft:ie:5.5:sp1 cpe:/a:microsoft:ie:5.5:sp2 cpe:/a:microsoft:ie:5.50.3825.1300 cpe:/a:microsoft:ie:5.50.4030.2400 cpe:/a:microsoft:ie:5.50.4134.0100 cpe:/a:microsoft:ie:5.50.4134.0600 cpe:/a:microsoft:ie:5.50.4308.2900 cpe:/a:microsoft:ie:5.50.4522.1800 cpe:/a:microsoft:ie:5.50.4807.2300 cpe:/a:microsoft:ie:6:sp1 CVE-2006-0585 2006-02-07T20:02:00.000-05:00 2018-10-19T11:45:26.457-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SECTRACK 1015559 BUGTRAQ 20060131 Internet Explorer remotely exploitable vulnerability in JScript's document.write() method BUGTRAQ 20060217 Re: Internet Explorer remotely exploitable vulnerability in JScript's document.write() method BID 16441 jscript.dll in Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service (application crash) via a Shockwave Flash object that contains ActionScript code that calls VBScript, which in turn calls the Javascript document.write function, which triggers a null dereference. cpe:/a:oracle:application_server:10.1.0.2 cpe:/a:oracle:application_server:10.1.0.3 cpe:/a:oracle:application_server:10.1.0.3.1 cpe:/a:oracle:application_server:10.1.0.4 cpe:/a:oracle:application_server:10.1.2 cpe:/a:oracle:application_server:10.1.2.0.1 cpe:/a:oracle:application_server:10.1.2.0.2 cpe:/a:oracle:application_server:10.1.2.1.0 cpe:/a:oracle:oracle10g:enterprise_10.1.0.2 cpe:/a:oracle:oracle10g:enterprise_10.1.0.3 cpe:/a:oracle:oracle10g:enterprise_10.1.0.3.1 cpe:/a:oracle:oracle10g:enterprise_10.1.0.4 cpe:/a:oracle:oracle10g:personal_10.1.0.2 cpe:/a:oracle:oracle10g:personal_10.1.0.3 cpe:/a:oracle:oracle10g:personal_10.1.0.4 cpe:/a:oracle:oracle10g:personal_10.10.3.1 cpe:/a:oracle:oracle10g:standard_10.1.0.2 cpe:/a:oracle:oracle10g:standard_10.1.0.3 cpe:/a:oracle:oracle10g:standard_10.1.0.3.1 cpe:/a:oracle:oracle10g:standard_10.1.0.4 cpe:/a:oracle:oracle10g:standard_10.1.0.4.2 cpe:/a:oracle:oracle10g:standard_10.1.0.5 CVE-2006-0586 2006-02-07T20:02:00.000-05:00 2018-10-19T11:45:26.897-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060118 Oracle Database 10g Rel. 1 - SQL Injection in SYS.KUPV$FT_INT FULLDISC 20060118 Oracle Database 10g Rel. 1 - SQL Injection in SYS.KUPV$FT MISC http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html MISC http://www.red-database-security.com/advisory/oracle_sql_injection_kupv$ft.html MISC http://www.red-database-security.com/advisory/oracle_sql_injection_kupv$ft_int.html BUGTRAQ 20060117 Oracle Database 10g Rel. 1 - SQL Injection in SYS.KUPV$FT BUGTRAQ 20060117 Oracle Database 10g Rel. 1 - SQL Injection in SYS.KUPV$FT_INT BID 16294 XF oracle-syskupv$ft-sql-injection(24195) XF oracle-syskupv$ftint-sql-injection(24197) Multiple SQL injection vulnerabilities in Oracle 10g Release 1 before CPU Jan 2006 allow remote attackers to execute arbitrary SQL commands via multiple parameters in (1) ATTACH_JOB, (2) HAS_PRIVS, and (3) OPEN_JOB functions in the SYS.KUPV$FT package; and (4) UPDATE_JOB, (5) ACTIVE_JOB, (6) ATTACH_POSSIBLE, (7) ATTACH_TO_JOB, (8) CREATE_NEW_JOB, (9) DELETE_JOB, (10) DELETE_MASTER_TABLE, (11) DETACH_JOB, (12) GET_JOB_INFO, (13) GET_JOB_QUEUES, (14) GET_SOLE_JOBNAME, (15) MASTER_TBL_LOCK, and (16) VALID_HANDLE functions in the SYS.KUPV$FT_INT package. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that these issues has been addressed by Oracle. It is unclear which, if any, Oracle Vuln# identifiers apply to these issues. cpe:/a:gallery_project:gallery:1.3.4 cpe:/a:gallery_project:gallery:1.4 cpe:/a:gallery_project:gallery:1.4.1 cpe:/a:gallery_project:gallery:1.4.2 cpe:/a:gallery_project:gallery:1.4.3_pl1 cpe:/a:gallery_project:gallery:1.4.3_pl2 cpe:/a:gallery_project:gallery:1.4.4_pl2 cpe:/a:gallery_project:gallery:1.4.4_pl3 cpe:/a:gallery_project:gallery:1.4.4_pl4 cpe:/a:gallery_project:gallery:1.4.4_pl5 cpe:/a:gallery_project:gallery:1.4_pl1 cpe:/a:gallery_project:gallery:1.4_pl2 cpe:/a:gallery_project:gallery:1.5 cpe:/a:gallery_project:gallery:1.5.1 cpe:/a:gallery_project:gallery:1.5.1_rc2 cpe:/a:gallery_project:gallery:1.5.2_rc2 CVE-2006-0587 2006-02-07T20:02:00.000-05:00 2017-07-19T21:29:54.190-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BUGTRAQ 20060214 Digital Armaments Security Advisory 02.14.2006: Gallery web-based photo gallery remote file execution BUGTRAQ 20060216 Re: Digital Armaments Security Advisory 02.14.2006: Gallery web-based photo gallery remote file execution CONFIRM http://gallery.menalto.com/gallery_1_5_2_pl2_security_release SECTRACK 1015641 MISC http://www.digitalarmaments.com/2006140293402395.html BID 16533 XF gallery-album-data-modification(24538) XF gallery-util-file-include(24768) Unspecified vulnerability in util.php in Gallery before 1.5.2-pl2 allows remote authenticated users with trick an owner into modifying stored album data and possibly executing arbitrary code via unspecified vectors involving a crafted link to a crafted file. cpe:/a:jaia_interactive:mytopix:1.2.3 CVE-2006-0588 2006-02-07T20:02:00.000-05:00 2018-10-19T11:45:28.007-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://kapda.ir/advisory-249.html SREASON 413 BUGTRAQ 20060204 [KAPDA::#26] - MyTopix Sql Injection & Path Disclosure XF mytopix-search-sql-injection(24502) SQL injection vulnerability in search.php in MyTopix 1.2.3 allows remote attackers to execute arbitrary SQL commands via the (1) mid and (2) keywords parameters. cpe:/a:jaia_interactive:mytopix:1.2.3 CVE-2006-0589 2006-02-07T20:02:00.000-05:00 2018-10-19T11:45:28.333-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://kapda.ir/advisory-249.html SREASON 413 BUGTRAQ 20060204 [KAPDA::#26] - MyTopix Sql Injection & Path Disclosure MyTopix 1.2.3 allows remote attackers to obtain the installation path via a direct request to logon.mod.php, which leaks the path in an error message. cpe:/a:jaia_interactive:mytopix:1.2.3 CVE-2006-0590 2006-02-07T20:02:00.000-05:00 2018-10-19T11:45:28.553-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://kapda.ir/advisory-249.html SREASON 413 BUGTRAQ 20060204 [KAPDA::#26] - MyTopix Sql Injection & Path Disclosure MyTopix 1.2.3 allows remote attackers to obtain the installation path via an invalid hl parameter to index.php, which leads to path disclosure, possibly related to invalid SQL syntax. cpe:/a:solar_designer:crypt_blowfish:0.4.7 CVE-2006-0591 2006-02-07T20:02:00.000-05:00 2018-10-19T11:45:29.223-04:00 1.2 LOCAL HIGH NONE PARTIAL NONE NONE http://nvd.nist.gov SGI 20060602-01-U MISC http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/glibc/crypt_blowfish/crypt_gensalt.c?only_with_tag=CRYPT_BLOWFISH_1_0 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-113.htm REDHAT RHSA-2006:0526 BUGTRAQ 20060207 crypt_blowfish 1.0 VUPEN ADV-2006-0477 XF cryptblowfish-salt-information-disclosure(24590) The crypt_gensalt functions for BSDI-style extended DES-based and FreeBSD-sytle MD5-based password hashes in crypt_blowfish 0.4.7 and earlier do not evenly and randomly distribute salts, which makes it easier for attackers to guess passwords from a stolen password file due to the increased number of collisions. cpe:/a:lexmark:printer_sharing:8.29 cpe:/a:lexmark:printer_sharing:9.41 CVE-2006-0592 2006-02-07T20:02:00.000-05:00 2018-10-19T11:45:30.193-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015593 BUGTRAQ 20060207 High Risk Vulnerability in Lexmark Printer Sharing Service VUPEN ADV-2006-0481 XF lexmark-lexpps-code-execution(24581) Unspecified vulnerability in the Lexmark Printer Sharing LexBce Server Service (LexPPS), possibly 8.29 and 9.41, allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based on a vague initial disclosure; details will be updated after the grace period has ended. cpe:/a:php_fusion:php_fusion:6.00.100 cpe:/a:php_fusion:php_fusion:6.00.101 cpe:/a:php_fusion:php_fusion:6.00.102 cpe:/a:php_fusion:php_fusion:6.00.103 cpe:/a:php_fusion:php_fusion:6.00.104 cpe:/a:php_fusion:php_fusion:6.00.105 cpe:/a:php_fusion:php_fusion:6.00.106 cpe:/a:php_fusion:php_fusion:6.00.107 cpe:/a:php_fusion:php_fusion:6.00.108 cpe:/a:php_fusion:php_fusion:6.00.109 cpe:/a:php_fusion:php_fusion:6.00.110 cpe:/a:php_fusion:php_fusion:6.00.200 cpe:/a:php_fusion:php_fusion:6.00.204 cpe:/a:php_fusion:php_fusion:6.00.205 cpe:/a:php_fusion:php_fusion:6.00.206 cpe:/a:php_fusion:php_fusion:6.00.207 cpe:/a:php_fusion:php_fusion:6.00.300 cpe:/a:php_fusion:php_fusion:6.00.303 CVE-2006-0593 2006-02-07T20:02:00.000-05:00 2017-07-19T21:29:54.487-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://www.php-fusion.co.uk/downloads.php?cat_id=3 CONFIRM http://www.php-fusion.co.uk/news.php?readmore=307 BID 16548 VUPEN ADV-2006-0463 XF phpfusion-multiple-xss(24548) Cross-site scripting (XSS) vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the (1) shout_name field in shoutbox_panel.php and the (2) comments field in comments_include.php. cpe:/a:stefan_ritt:elog_web_logbook:2.0.0 cpe:/a:stefan_ritt:elog_web_logbook:2.0.1 cpe:/a:stefan_ritt:elog_web_logbook:2.0.2 cpe:/a:stefan_ritt:elog_web_logbook:2.0.3 cpe:/a:stefan_ritt:elog_web_logbook:2.0.4 cpe:/a:stefan_ritt:elog_web_logbook:2.0.5 cpe:/a:stefan_ritt:elog_web_logbook:2.1.0 cpe:/a:stefan_ritt:elog_web_logbook:2.1.1 cpe:/a:stefan_ritt:elog_web_logbook:2.1.2 cpe:/a:stefan_ritt:elog_web_logbook:2.1.3 cpe:/a:stefan_ritt:elog_web_logbook:2.2.0 cpe:/a:stefan_ritt:elog_web_logbook:2.2.1 cpe:/a:stefan_ritt:elog_web_logbook:2.2.2 cpe:/a:stefan_ritt:elog_web_logbook:2.2.3 cpe:/a:stefan_ritt:elog_web_logbook:2.2.4 cpe:/a:stefan_ritt:elog_web_logbook:2.4 cpe:/a:stefan_ritt:elog_web_logbook:2.5 cpe:/a:stefan_ritt:elog_web_logbook:2.5.6 CVE-2006-0597 2006-02-13T06:06:00.000-05:00 2017-07-19T21:29:54.550-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://bugs.debian.org/cgi-bin/bugreport.cgi/0001-r1333-Fixed-crashes-with-very-long-revisions-attributes.txt?bug=349528;msg=15;att=1 MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349528 DEBIAN DSA-967 BID 16579 XF elog-elogd-bo(24704) Multiple stack-based buffer overflows in elogd.c in elog before 2.5.7 r1558-4 allow attackers to cause a denial of service (application crash) and possibly execute code via long "revision attributes". cpe:/a:stefan_ritt:elog_web_logbook:2.0.0 cpe:/a:stefan_ritt:elog_web_logbook:2.0.1 cpe:/a:stefan_ritt:elog_web_logbook:2.0.2 cpe:/a:stefan_ritt:elog_web_logbook:2.0.3 cpe:/a:stefan_ritt:elog_web_logbook:2.0.4 cpe:/a:stefan_ritt:elog_web_logbook:2.0.5 cpe:/a:stefan_ritt:elog_web_logbook:2.1.0 cpe:/a:stefan_ritt:elog_web_logbook:2.1.1 cpe:/a:stefan_ritt:elog_web_logbook:2.1.2 cpe:/a:stefan_ritt:elog_web_logbook:2.1.3 cpe:/a:stefan_ritt:elog_web_logbook:2.2.0 cpe:/a:stefan_ritt:elog_web_logbook:2.2.1 cpe:/a:stefan_ritt:elog_web_logbook:2.2.2 cpe:/a:stefan_ritt:elog_web_logbook:2.2.3 cpe:/a:stefan_ritt:elog_web_logbook:2.2.4 cpe:/a:stefan_ritt:elog_web_logbook:2.4 cpe:/a:stefan_ritt:elog_web_logbook:2.5 cpe:/a:stefan_ritt:elog_web_logbook:2.5.6 CVE-2006-0598 2006-02-13T06:06:00.000-05:00 2017-07-19T21:29:54.613-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://bugs.debian.org/cgi-bin/bugreport.cgi/0002-r1335-Applied-patch-from-Emiliano-to-fix-possible-buffer-overflow.txt?bug=349528;msg=15;att=2 MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349528 DEBIAN DSA-967 BID 16579 XF elog-elogd-log-bo(24705) Buffer overflow in elogd.c in elog before 2.5.7 r1558-4 allows attackers to execute code via unspecified variables, when writing to the log file. cpe:/a:stefan_ritt:elog_web_logbook:2.0.0 cpe:/a:stefan_ritt:elog_web_logbook:2.0.1 cpe:/a:stefan_ritt:elog_web_logbook:2.0.2 cpe:/a:stefan_ritt:elog_web_logbook:2.0.3 cpe:/a:stefan_ritt:elog_web_logbook:2.0.4 cpe:/a:stefan_ritt:elog_web_logbook:2.0.5 cpe:/a:stefan_ritt:elog_web_logbook:2.1.0 cpe:/a:stefan_ritt:elog_web_logbook:2.1.1 cpe:/a:stefan_ritt:elog_web_logbook:2.1.2 cpe:/a:stefan_ritt:elog_web_logbook:2.1.3 cpe:/a:stefan_ritt:elog_web_logbook:2.2.0 cpe:/a:stefan_ritt:elog_web_logbook:2.2.1 cpe:/a:stefan_ritt:elog_web_logbook:2.2.2 cpe:/a:stefan_ritt:elog_web_logbook:2.2.3 cpe:/a:stefan_ritt:elog_web_logbook:2.2.4 cpe:/a:stefan_ritt:elog_web_logbook:2.4 cpe:/a:stefan_ritt:elog_web_logbook:2.5 cpe:/a:stefan_ritt:elog_web_logbook:2.5.6 CVE-2006-0599 2006-02-13T06:06:00.000-05:00 2017-07-19T21:29:54.677-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://bugs.debian.org/cgi-bin/bugreport.cgi/0003-r1472-Do-not-distinguish-between-invalid-user-name-and-invalid-password.txt?bug=349528;msg=15;att=3 MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349528 DEBIAN DSA-967 BID 16579 XF elog-elog-elogd-user-enumeration(24706) The (1) elog.c and (2) elogd.c components in elog before 2.5.7 r1558-4 generate different responses depending on whether or not a username is valid, which allows remote attackers to determine valid usernames. cpe:/a:stefan_ritt:elog_web_logbook:2.0.0 cpe:/a:stefan_ritt:elog_web_logbook:2.0.1 cpe:/a:stefan_ritt:elog_web_logbook:2.0.2 cpe:/a:stefan_ritt:elog_web_logbook:2.0.3 cpe:/a:stefan_ritt:elog_web_logbook:2.0.4 cpe:/a:stefan_ritt:elog_web_logbook:2.0.5 cpe:/a:stefan_ritt:elog_web_logbook:2.1.0 cpe:/a:stefan_ritt:elog_web_logbook:2.1.1 cpe:/a:stefan_ritt:elog_web_logbook:2.1.2 cpe:/a:stefan_ritt:elog_web_logbook:2.1.3 cpe:/a:stefan_ritt:elog_web_logbook:2.2.0 cpe:/a:stefan_ritt:elog_web_logbook:2.2.1 cpe:/a:stefan_ritt:elog_web_logbook:2.2.2 cpe:/a:stefan_ritt:elog_web_logbook:2.2.3 cpe:/a:stefan_ritt:elog_web_logbook:2.2.4 cpe:/a:stefan_ritt:elog_web_logbook:2.4 cpe:/a:stefan_ritt:elog_web_logbook:2.5 cpe:/a:stefan_ritt:elog_web_logbook:2.5.6 CVE-2006-0600 2006-02-13T06:06:00.000-05:00 2017-07-19T21:29:54.753-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349528 MISC http://savannah.psi.ch/viewcvs/trunk/src/elogd.c?root=elog&rev=1487&view=diff&r1=1487&r2=1486&p1=trunk/src/elogd.c&p2=/trunk/src/elogd.c DEBIAN DSA-967 BID 16579 XF elog-fail-redirect-dos(24707) elog before 2.5.7 r1558-4 allows remote attackers to cause a denial of service (infinite redirection) via a request with the fail parameter set to 1, which redirects to the same request. cpe:/a:hinton_design:phphg_guestbook:1.2 CVE-2006-0602 2006-02-08T18:02:00.000-05:00 2018-10-19T11:45:30.457-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/58/summary.html SECTRACK 1015620 BUGTRAQ 20060211 [eVuln] phphg Guestbook Multiple Vulnerabilities BID 16541 VUPEN ADV-2006-0480 Multiple SQL injection vulnerabilities in Hinton Design phphg Guestbook 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) username parameter to check.php or the id parameter to (2) admin/edit_smilie.php, (3) admin/add_theme.php, (4) admin/ban_ip.php, (5) admin/add_lang.php, or (6) admin/edit_filter.php. cpe:/a:hinton_design:phphg_guestbook:1.2 CVE-2006-0603 2006-02-08T18:02:00.000-05:00 2018-10-19T11:45:30.707-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/58/summary.html SECTRACK 1015620 BUGTRAQ 20060211 [eVuln] phphg Guestbook Multiple Vulnerabilities BID 16541 VUPEN ADV-2006-0480 Multiple cross-site scripting vulnerabilities in signed.php in Hinton Design phphg Guestbook 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) location, (2) website, or (3) message parameter. cpe:/a:hinton_design:phphg_guestbook:1.2 CVE-2006-0604 2006-02-08T18:02:00.000-05:00 2018-10-19T11:45:30.990-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/58/description.html SECTRACK 1015620 BUGTRAQ 20060211 [eVuln] phphg Guestbook Multiple Vulnerabilities BID 16541 VUPEN ADV-2006-0480 check.php in Hinton Design phphg Guestbook 1.2 does not check the user password when authenticating via cookies, which allows remote attackers to gain unauthorized access. cpe:/a:unknown_domain:shoutbox:2005-07-21 CVE-2006-0605 2006-02-08T18:02:00.000-05:00 2018-10-19T11:45:31.270-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/55/summary.html BUGTRAQ 20060209 [eVuln] Unknown Domain Shoutbox multiple XSS & SQL Injection Vulnerabilities BID 16543 VUPEN ADV-2006-0476 XF shoutbox-multiple-xss(24440) Multiple cross-site scripting (XSS) vulnerabilities in Unknown Domain Shoutbox 2005.07.21 allow remote attackers to inject arbitrary web script or HTML, possibly via the (1) Handle or (2) Message fields. cpe:/a:unknown_domain:shoutbox:2005-07-21 CVE-2006-0606 2006-02-08T18:02:00.000-05:00 2018-10-19T11:45:31.693-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/55/summary.html BUGTRAQ 20060209 [eVuln] Unknown Domain Shoutbox multiple XSS & SQL Injection Vulnerabilities BID 16543 VUPEN ADV-2006-0476 SQL injection vulnerability in Unknown Domain Shoutbox 2005.07.21 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors. cpe:/a:hinton_design:phphd:1.0 CVE-2006-0607 2006-02-08T18:02:00.000-05:00 2018-10-19T11:45:31.973-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.evuln.com/vulns/60/summary.html BUGTRAQ 20060212 [eVuln] phphd Multiple Vulnerabilities BID 16586 XF phphd-check-security-bypass(24510) check.php in Hinton Design phphd 1.0 does not check passwords when certain cookies are provided, which allows remote attackers to bypass authentication. cpe:/a:hinton_design:phphd:1.0 CVE-2006-0608 2006-02-08T18:02:00.000-05:00 2018-10-19T11:45:32.350-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.evuln.com/vulns/60/summary.html BUGTRAQ 20060212 [eVuln] phphd Multiple Vulnerabilities BID 16586 XF phphd-check-sql-injection(24508) XF phphd-multiple-sql-injection(24515) Multiple SQL injection vulnerabilities in Hinton Design phphd 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the username parameter to check.php or (2) unknown attack vectors to scripts that display information from the database. cpe:/a:hinton_design:phphd:1.0 CVE-2006-0609 2006-02-08T18:02:00.000-05:00 2018-10-19T11:45:32.927-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://www.evuln.com/vulns/60/summary.html BUGTRAQ 20060212 [eVuln] phphd Multiple Vulnerabilities BID 16586 XF phphd-add-xss(24513) Cross-site scripting (XSS) vulnerability in add.php in Hinton Design phphd 1.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. cpe:/a:2200net:2200net_calendar:1.2 CVE-2006-0610 2006-02-08T19:02:00.000-05:00 2018-10-19T11:45:33.367-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060215 [eVuln] 2200net Calendar system SQL Injection and Authentication MISC http://www.evuln.com/vulns/62/summary.html BUGTRAQ 20060215 [eVuln] 2200net Calendar system SQL Injection and Authentication Bypass Vulnerabilities BID 16569 VUPEN ADV-2006-0486 XF 2200net-calendar-sql-injection(24483) XF 2200net-adminlogin-sql-injection(24484) Multiple SQL injection vulnerabilities in 2200net Calendar system 1.2, with gpc_magic_quotes disabled, allow remote attackers to execute arbitrary SQL commands and bypass authentication via (1) the fm_data[id] parameter to calendar.php and (2) the $ad['acc'] variable in adminlogin.php. cpe:/a:atmail:atmail:4.3 CVE-2006-0611 2006-02-08T19:02:00.000-05:00 2017-07-19T21:29:55.097-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://kb.atmail.com/view_article.php?num=374 BID 16470 VUPEN ADV-2006-0415 XF @mail-compose-directory-traversal(24459) Directory traversal vulnerability in compose.pl in @Mail 4.3 and earlier for Windows allows remote attackers to upload arbitrary files to arbitrary locations via a .. (dot dot) in the unique parameter. cpe:/a:powersave:powersave:0.10.10 CVE-2006-0612 2006-02-08T19:02:00.000-05:00 2017-07-19T21:29:55.160-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://sourceforge.net/project/shownotes.php?release_id=379792&group_id=124576 BID 16469 VUPEN ADV-2006-0416 XF powersave-daemon-gain-privileges(24458) Powersave daemon before 0.10.15.2 allows local users to gain privileges (unauthorized access to an X session) via unspecified vectors. NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information. cpe:/a:sun:j2se:5.0_update5 CVE-2006-0613 2006-02-08T21:02:00.000-05:00 2017-07-19T21:29:55.237-04:00 4.0 NETWORK HIGH NONE PARTIAL PARTIAL NONE http://nvd.nist.gov CONFIRM http://docs.info.apple.com/article.html?artnum=303658 SECTRACK 1015597 SUNALERT 102170 CERT-VN VU#652636 BID 16540 VUPEN ADV-2006-0468 VUPEN ADV-2006-1398 XF javawebstart-jnlp-privilege-elevation(24568) Unspecified vulnerability in Java Web Start after 1.0.1_02, as used in J2SE 5.0 Update 5 and earlier, allows remote attackers to obtain privileges via unspecified vectors involving untrusted applications. cpe:/a:sun:jdk:5.0 cpe:/a:sun:jdk:5.0:update1 cpe:/a:sun:jdk:5.0:update2 cpe:/a:sun:jdk:5.0:update3 cpe:/a:sun:jre:1.3.0 cpe:/a:sun:jre:1.3.0:- cpe:/a:sun:jre:1.3.0:update1 cpe:/a:sun:jre:1.3.0:update2 cpe:/a:sun:jre:1.3.0:update3 cpe:/a:sun:jre:1.3.0:update4 cpe:/a:sun:jre:1.3.0:update5 cpe:/a:sun:jre:1.3.1 cpe:/a:sun:jre:1.3.1:- cpe:/a:sun:jre:1.3.1:update1 cpe:/a:sun:jre:1.3.1:update12 cpe:/a:sun:jre:1.3.1:update15 cpe:/a:sun:jre:1.3.1:update16 cpe:/a:sun:jre:1.3.1:update17 cpe:/a:sun:jre:1.3.1:update18 cpe:/a:sun:jre:1.3.1:update19 cpe:/a:sun:jre:1.3.1:update1a cpe:/a:sun:jre:1.3.1:update2 cpe:/a:sun:jre:1.3.1:update20 cpe:/a:sun:jre:1.3.1:update4 cpe:/a:sun:jre:1.3.1:update8 cpe:/a:sun:jre:1.3.1_2 cpe:/a:sun:jre:1.3.1_03 cpe:/a:sun:jre:1.3.1_04 cpe:/a:sun:jre:1.3.1_05 cpe:/a:sun:jre:1.3.1_06 cpe:/a:sun:jre:1.3.1_07 cpe:/a:sun:jre:1.3.1_08 cpe:/a:sun:jre:1.3.1_09 cpe:/a:sun:jre:1.3.1_10 cpe:/a:sun:jre:1.3.1_11 cpe:/a:sun:jre:1.3.1_12 cpe:/a:sun:jre:1.3.1_13 cpe:/a:sun:jre:1.3.1_14 cpe:/a:sun:jre:1.3.1_15 cpe:/a:sun:jre:1.3.1_16 cpe:/a:sun:jre:1.4.1 cpe:/a:sun:jre:1.4.1:- cpe:/a:sun:jre:1.4.1:update1 cpe:/a:sun:jre:1.4.1:update2 cpe:/a:sun:jre:1.4.1:update3 cpe:/a:sun:jre:1.4.1:update4 cpe:/a:sun:jre:1.4.1:update7 cpe:/a:sun:jre:1.4.2 cpe:/a:sun:jre:1.4.2:- cpe:/a:sun:jre:1.4.2:update1 cpe:/a:sun:jre:1.4.2:update10 cpe:/a:sun:jre:1.4.2:update11 cpe:/a:sun:jre:1.4.2:update12 cpe:/a:sun:jre:1.4.2:update13 cpe:/a:sun:jre:1.4.2:update14 cpe:/a:sun:jre:1.4.2:update15 cpe:/a:sun:jre:1.4.2:update19 cpe:/a:sun:jre:1.4.2:update2 cpe:/a:sun:jre:1.4.2:update21 cpe:/a:sun:jre:1.4.2:update28 cpe:/a:sun:jre:1.4.2:update3 cpe:/a:sun:jre:1.4.2:update4 cpe:/a:sun:jre:1.4.2:update5 cpe:/a:sun:jre:1.4.2:update6 cpe:/a:sun:jre:1.4.2:update7 cpe:/a:sun:jre:1.4.2:update8 cpe:/a:sun:jre:1.4.2:update9 cpe:/a:sun:jre:1.4.2_1 cpe:/a:sun:jre:1.4.2_2 cpe:/a:sun:jre:1.4.2_3 cpe:/a:sun:jre:1.4.2_4 cpe:/a:sun:jre:1.4.2_5 cpe:/a:sun:jre:1.4.2_6 cpe:/a:sun:jre:1.4.2_7 cpe:/a:sun:jre:1.4.2_8 cpe:/a:sun:jre:5.0 cpe:/a:sun:jre:5.0:update1 cpe:/a:sun:jre:5.0:update2 cpe:/a:sun:jre:5.0:update3 cpe:/a:sun:sdk:1.3.0 cpe:/a:sun:sdk:1.3.0_01 cpe:/a:sun:sdk:1.3.0_02 cpe:/a:sun:sdk:1.3.0_03 cpe:/a:sun:sdk:1.3.0_04 cpe:/a:sun:sdk:1.3.0_05 cpe:/a:sun:sdk:1.3.1 cpe:/a:sun:sdk:1.3.1_01 cpe:/a:sun:sdk:1.3.1_01a cpe:/a:sun:sdk:1.3.1_02 cpe:/a:sun:sdk:1.3.1_03 cpe:/a:sun:sdk:1.3.1_04 cpe:/a:sun:sdk:1.3.1_05 cpe:/a:sun:sdk:1.3.1_06 cpe:/a:sun:sdk:1.3.1_07 cpe:/a:sun:sdk:1.3.1_08 cpe:/a:sun:sdk:1.3.1_09 cpe:/a:sun:sdk:1.3.1_10 cpe:/a:sun:sdk:1.3.1_11 cpe:/a:sun:sdk:1.3.1_12 cpe:/a:sun:sdk:1.3.1_13 cpe:/a:sun:sdk:1.3.1_14 cpe:/a:sun:sdk:1.3.1_15 cpe:/a:sun:sdk:1.3.1_16 cpe:/a:sun:sdk:1.4.1 cpe:/a:sun:sdk:1.4.2 cpe:/a:sun:sdk:1.4.2_1 cpe:/a:sun:sdk:1.4.2_02 cpe:/a:sun:sdk:1.4.2_03 cpe:/a:sun:sdk:1.4.2_04 cpe:/a:sun:sdk:1.4.2_5 cpe:/a:sun:sdk:1.4.2_6 cpe:/a:sun:sdk:1.4.2_7 cpe:/a:sun:sdk:1.4.2_08 CVE-2006-0614 2006-02-08T21:02:00.000-05:00 2018-10-04T18:11:53.863-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov 2018-10-04T13:18:24.617-04:00 CONFIRM http://docs.info.apple.com/article.html?artnum=303658 SECTRACK 1015596 SUNALERT 102171 GENTOO GLSA-200602-07 CERT-VN VU#759996 VUPEN ADV-2006-0467 VUPEN ADV-2006-0828 VUPEN ADV-2006-1398 XF sun-jre-reflection-privilege-elevation(24561) Unspecified vulnerability in Sun Java JDK and JRE 5.0 Update 3 and earlier, SDK and JRE 1.3.x through 1.3.1_16 and 1.4.x through 1.4.2_08 allows remote attackers to bypass Java sandbox security and obtain privileges via unspecified vectors involving the reflection APIs, aka the "first issue." cpe:/a:sun:jdk:1.5.0:- cpe:/a:sun:jdk:1.5.0:update1 cpe:/a:sun:jdk:1.5.0:update2 cpe:/a:sun:jdk:1.5.0:update3 cpe:/a:sun:jdk:1.5.0:update4 cpe:/a:sun:jre:1.4.2:- cpe:/a:sun:jre:1.4.2_1 cpe:/a:sun:jre:1.4.2_2 cpe:/a:sun:jre:1.4.2_3 cpe:/a:sun:jre:1.4.2_4 cpe:/a:sun:jre:1.4.2_5 cpe:/a:sun:jre:1.4.2_6 cpe:/a:sun:jre:1.4.2_7 cpe:/a:sun:jre:1.4.2_8 cpe:/a:sun:jre:1.4.2_9 cpe:/a:sun:jre:1.5.0:- cpe:/a:sun:jre:1.5.0:update1 cpe:/a:sun:jre:1.5.0:update2 cpe:/a:sun:jre:1.5.0:update4 cpe:/a:sun:jre:1.5.0:update5 cpe:/a:sun:sdk:1.4.2 cpe:/a:sun:sdk:1.4.2_1 cpe:/a:sun:sdk:1.4.2_2 cpe:/a:sun:sdk:1.4.2_3 cpe:/a:sun:sdk:1.4.2_4 cpe:/a:sun:sdk:1.4.2_5 cpe:/a:sun:sdk:1.4.2_6 cpe:/a:sun:sdk:1.4.2_7 cpe:/a:sun:sdk:1.4.2_8 cpe:/a:sun:sdk:1.4.2_9 CVE-2006-0615 2006-02-08T21:02:00.000-05:00 2019-07-31T08:44:42.630-04:00 4.0 NETWORK HIGH NONE PARTIAL PARTIAL NONE http://nvd.nist.gov 2019-07-30T12:33:40.787-04:00 CONFIRM http://docs.info.apple.com/article.html?artnum=303658 SECTRACK 1015596 SUNALERT 102171 GENTOO GLSA-200602-07 CERT-VN VU#759996 VUPEN ADV-2006-0467 VUPEN ADV-2006-0828 VUPEN ADV-2006-1398 XF sun-jre-reflection-privilege-elevation(24561) Multiple unspecified vulnerabilities in Sun Java JDK and JRE 5.0 Update 4 and earlier, SDK and JRE 1.4.x through 1.4.2_09 allow remote attackers to bypass Java sandbox security and obtain privileges via unspecified vectors involving the reflection APIs, aka the "second and third issues." cpe:/a:sun:jdk:1.5.0:update4 cpe:/a:sun:jre:1.5.0:update4 CVE-2006-0616 2006-02-08T21:02:00.000-05:00 2017-07-19T21:29:55.427-04:00 4.0 NETWORK HIGH NONE PARTIAL PARTIAL NONE http://nvd.nist.gov CONFIRM http://docs.info.apple.com/article.html?artnum=303658 SECTRACK 1015596 SUNALERT 102171 GENTOO GLSA-200602-07 CERT-VN VU#759996 VUPEN ADV-2006-0467 VUPEN ADV-2006-0828 VUPEN ADV-2006-1398 XF sun-jre-reflection-privilege-elevation(24561) Unspecified vulnerability in Sun Java JDK and JRE 5.0 Update 4 and earlier allows remote attackers to bypass Java sandbox security and obtain privileges via unspecified vectors involving the reflection APIs, aka the "fourth issue." cpe:/a:sun:jdk:1.5.0:update5 cpe:/a:sun:jre:1.5.0:update5 CVE-2006-0617 2006-02-08T21:02:00.000-05:00 2017-07-19T21:29:55.487-04:00 4.0 NETWORK HIGH NONE PARTIAL PARTIAL NONE http://nvd.nist.gov CONFIRM http://docs.info.apple.com/article.html?artnum=303658 SECTRACK 1015596 SUNALERT 102171 GENTOO GLSA-200602-07 CERT-VN VU#759996 VUPEN ADV-2006-0467 VUPEN ADV-2006-0828 VUPEN ADV-2006-1398 XF sun-jre-reflection-privilege-elevation(24561) Multiple unspecified vulnerabilities in Sun Java JDK and JRE 5.0 Update 5 and earlier allow remote attackers to bypass Java sandbox security and obtain privileges via unspecified vectors involving the reflection APIs, aka the "fifth, sixth, and seventh issues." cpe:/a:qnx:neutrino_rtos:6.3.0 CVE-2006-0618 2006-02-08T21:02:00.000-05:00 2017-07-19T21:29:55.537-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015599 IDEFENSE 20060207 QNX Neutrino RTOS fontsleuth Command Format String Vulnerability BID 16539 VUPEN ADV-2006-0474 XF qnx-fontsleuth-format-string(24559) Format string vulnerability in fontsleuth in QNX Neutrino RTOS 6.3.0 allows local users to execute arbitrary code via format string specifiers in the zeroth argument (program name). cpe:/a:qnx:rtos:6.3.0 CVE-2006-0619 2006-02-08T21:02:00.000-05:00 2017-07-19T21:29:55.597-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015599 IDEFENSE 20060207 QNX Neutrino RTOS libAp ABLPATH Buffer Overflow Vulnerability IDEFENSE 20060207 QNX Neutrino RTOS libph PHOTON_PATH Buffer Overflow Vulnerability BID 16539 VUPEN ADV-2006-0474 XF qnx-libph-bo(24557) XF qnx-libap-bo(24558) Multiple stack-based buffer overflows in QNX Neutrino RTOS 6.3.0 allow local users to execute arbitrary code via long (1) ABLPATH or (2) ABLANG environment variables in the libAP library (libAp.so.2) or (3) a long PHOTON_PATH environment variable to the setitem function in the libph library. cpe:/a:qnx:rtos:6.2.1 cpe:/a:qnx:rtos:6.2.1a cpe:/a:qnx:rtos:6.2.1b CVE-2006-0620 2006-02-08T21:02:00.000-05:00 2017-07-19T21:29:55.660-04:00 6.2 LOCAL HIGH NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015599 IDEFENSE 20060207 QNX Neutrino RTOS phfont Race Condition Vulnerability BID 16539 VUPEN ADV-2006-0474 XF qnx-phfont-race-condition(24555) Race condition in phfont in QNX Neutrino RTOS 6.2.1 allows local users to execute arbitrary code via unspecified manipulations of the PHFONT and PHOTON2_PATH environment variables. cpe:/a:qnx:rtos:6.2.0 CVE-2006-0621 2006-02-08T21:02:00.000-05:00 2017-07-19T21:29:55.707-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015599 IDEFENSE 20060207 QNX Neutrino RTOS su Command Buffer Overflow IDEFENSE 20060207 QNX Neutrino RTOS passwd Command Buffer Overflow BID 16539 VUPEN ADV-2006-0474 XF qnx-passwd-bo(24551) XF qnx-su-bo(24554) Multiple buffer overflows in QNX Neutrino RTOS 6.2.0 allow local users to execute arbitrary code via a long first argument to the (1) su or (2) passwd commands. cpe:/a:qnx:rtos:6.3.0 CVE-2006-0622 2006-02-08T21:02:00.000-05:00 2017-07-19T21:29:55.787-04:00 4.9 LOCAL LOW NONE NONE NONE COMPLETE http://nvd.nist.gov SECTRACK 1015598 IDEFENSE 20060207 QNX RTOS 6.3.0 Local Denial of Service Vulnerability BID 16539 VUPEN ADV-2006-0474 XF qnx-gdb-dos(24553) QNX Neutrino RTOS 6.3.0 allows local users to cause a denial of service (hang) by supplying a "break *0xb032d59f" command to gdb. cpe:/a:qnx:rtos:6.3.0 CVE-2006-0623 2006-02-08T21:02:00.000-05:00 2017-07-19T21:29:55.830-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015598 IDEFENSE 20060207 QNX RTOS 6.3.0 rc.local Insecure File Permissions Vulnerability BID 16539 VUPEN ADV-2006-0474 XF qnx-rclocal-root-privileges(24552) QNX Neutrino RTOS 6.3.0 ships /etc/rc.d/rc.local with world-writable permissions, which allows local users to modify the file and execute arbitrary code at system startup. cpe:/a:webeveyn:whomp_real_estate_manager_xp_2005 CVE-2006-0624 2006-02-08T21:02:00.000-05:00 2018-10-19T11:45:34.163-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 418 BUGTRAQ 20060208 Whomp Real Estate Manager XP 2005 Sql Injection BID 16544 VUPEN ADV-2006-0489 XF whomp-login-sql-injection(24592) SQL injection vulnerability in check.asp in Whomp Real Estate Manager XP 2005 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters. cpe:/a:spip:spip:1.8.2d cpe:/a:spip:spip:1.8.2e cpe:/a:spip:spip:1.8.2g CVE-2006-0625 2006-02-09T13:06:00.000-05:00 2017-07-19T21:29:55.957-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov MISC http://retrogod.altervista.org/spip_182g_shell_inj_xpl.html SECTRACK 1015602 BID 16556 VUPEN ADV-2006-0483 XF spip-rss-file-include(24600) Directory traversal vulnerability in Spip_RSS.PHP in SPIP 1.8.2g and earlier allows remote attackers to read or include arbitrary files via ".." sequences in the GLOBALS[type_urls] parameter, which could then be used to execute arbitrary code via resultant direct static code injection in the file parameter to spip_acces_doc.php3. cpe:/a:spip:spip:1.8.2g CVE-2006-0626 2006-02-09T13:06:00.000-05:00 2017-07-19T21:29:56.003-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://retrogod.altervista.org/spip_182g_shell_inj_xpl.html SECTRACK 1015602 BID 16551 VUPEN ADV-2006-0483 XF spip-access-doc-sql-injection(24599) SQL injection vulnerability in spip_acces_doc.php3 in SPIP 1.8.2g and earlier allows remote attackers to execute arbitrary SQL commands via the file parameter. cpe:/a:clever_copy:clever_copy:2.0 cpe:/a:clever_copy:clever_copy:2.0a cpe:/a:clever_copy:clever_copy:23.0 CVE-2006-0627 2006-02-09T14:06:00.000-05:00 2018-10-19T11:45:34.630-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://www.evuln.com/vulns/64/summary.html BUGTRAQ 20060212 [eVuln] Clever Copy 'Referer' & 'X-Forwarded-For' XSS Vulnerabilities BID 16607 VUPEN ADV-2006-0495 XF clevercopy-script-xss(24524) Cross-site scripting (XSS) vulnerability in Clever Copy 2.0, 2.0a, and 3.0 allows remote attackers to inject arbitrary web script or HTML via the (1) Referer or (2) X-Forwarded-For headers in an HTTP request, which are not properly handled when the administrator accesses Site Stats. cpe:/a:dale_ray:myquiz:1.01 CVE-2006-0628 2006-02-10T06:02:00.000-05:00 2018-10-19T11:45:35.007-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS VIM 20060209 Vendor ACK for MyQuiz SREASON 409 MISC http://www.corantodemo.net/coranto/viewnews.cgi?id=EpApAAAVkyirPGThSf&style=dldetails MISC http://www.evuln.com/vulns/57/summary.html BUGTRAQ 20060203 [eVuln] MyQuiz Arbitrary Command Execution Vulnerability BUGTRAQ 20060207 MyQuiz Arbitrary Command Execution Exploit (perl) VUPEN ADV-2006-0443 XF myquiz-pathinfo-command-execution(24501) myquiz.pl in Dale Ray MyQuiz 1.01 allows remote attackers to execute arbitrary commands via shell metacharacters in the URL, which are not properly handled as part of the PATH_INFO environment variable. cpe:/a:aol:instant_messenger:5.9.3861 CVE-2006-0629 2006-02-10T06:02:00.000-05:00 2018-10-19T11:45:35.567-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS FULLDISC 20060129 AOL Instant Messenger 5.9.3861 Local Buffer Overrun Vulnerability BUGTRAQ 20060203 AOL Instant Messenger Version 5.9.3861 Local Buffer Overrun Vulnerability BUGTRAQ 20060203 Re: AOL Instant Messenger Version 5.9.3861 Local Buffer Overrun Vulnerability XF aim-buddy-info-bo(24362) Unspecified vulnerability in AOL Instant Messenger (AIM) 5.9.3861 allows user-assisted remote attackers to cause a denial of service (client crash) and possibly execute arbitrary code by tricking the user into requesting Buddy Info about a long screen name, which might cause a buffer overflow. cpe:/a:ritlabs:the_bat:3.0 cpe:/a:ritlabs:the_bat:3.0.0.7 cpe:/a:ritlabs:the_bat:3.0.0.8 cpe:/a:ritlabs:the_bat:3.0.0.9 cpe:/a:ritlabs:the_bat:3.0.0.10 cpe:/a:ritlabs:the_bat:3.0.0.11 cpe:/a:ritlabs:the_bat:3.0.0.12 cpe:/a:ritlabs:the_bat:3.0.0.14 CVE-2006-0630 2006-02-10T06:02:00.000-05:00 2018-10-19T11:45:35.913-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060206 SECURITY.NNOV: The Bat! 2.x message headers spoofing MISC http://www.security.nnov.ru/advisories/thebatspoof.asp BUGTRAQ 20060206 SECURITY.NNOV: The Bat! 2.x message headers spoofing BID 16515 XF thebat-message-header-spoofing(24535) CONFIRM https://www.ritlabs.com/bt/bug_view_advanced_page.php?bug_id=0003029 RITLabs The Bat! before 3.0.0.15 displays certain important headers from encapsulated data in message/partial MIME messages, instead of the real headers, which is in violation of RFC2046 header merging rules and allows remote attackers to spoof the origin of e-mail by sending a fragmented message, as demonstrated using spoofed Received: and Message-ID: headers. cpe:/a:erik_c._thauvin:mailback CVE-2006-0631 2006-02-10T06:02:00.000-05:00 2017-07-19T21:29:56.317-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060205 mailback script exploit BUGTRAQ 20060210 Re: mailback script exploit CONFIRM http://vc.thauvin.net/cvs/cgi/mailback/mailback.pl?view=log VUPEN ADV-2006-0459 XF mailback-mail-relay(24540) CRLF injection vulnerability in mailback.pl in Erik C. Thauvin mailback allows remote attackers to use mailback as a "spam proxy" by modifying mail headers, including recipient e-mail addresses, via newline characters in the Subject field. cpe:/a:phpbb_group:phpbb:2.0.0 cpe:/a:phpbb_group:phpbb:2.0.1 cpe:/a:phpbb_group:phpbb:2.0.2 cpe:/a:phpbb_group:phpbb:2.0.3 cpe:/a:phpbb_group:phpbb:2.0.4 cpe:/a:phpbb_group:phpbb:2.0.5 cpe:/a:phpbb_group:phpbb:2.0.6 cpe:/a:phpbb_group:phpbb:2.0.6c cpe:/a:phpbb_group:phpbb:2.0.6d cpe:/a:phpbb_group:phpbb:2.0.7 cpe:/a:phpbb_group:phpbb:2.0.7a cpe:/a:phpbb_group:phpbb:2.0.8 cpe:/a:phpbb_group:phpbb:2.0.8a cpe:/a:phpbb_group:phpbb:2.0.9 cpe:/a:phpbb_group:phpbb:2.0.10 cpe:/a:phpbb_group:phpbb:2.0.11 cpe:/a:phpbb_group:phpbb:2.0.12 cpe:/a:phpbb_group:phpbb:2.0.13 cpe:/a:phpbb_group:phpbb:2.0.14 cpe:/a:phpbb_group:phpbb:2.0.15 cpe:/a:phpbb_group:phpbb:2.0.16 cpe:/a:phpbb_group:phpbb:2.0.17 cpe:/a:phpbb_group:phpbb:2.0.18 cpe:/a:phpbb_group:phpbb:2.0.19 cpe:/a:phpbb_group:phpbb:2.0_beta1 cpe:/a:phpbb_group:phpbb:2.0_rc1 cpe:/a:phpbb_group:phpbb:2.0_rc2 cpe:/a:phpbb_group:phpbb:2.0_rc3 cpe:/a:phpbb_group:phpbb:2.0_rc4 CVE-2006-0632 2006-02-10T06:02:00.000-05:00 2018-10-19T11:45:36.380-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov MISC http://www.r-security.net/tutorials/view/readtutorial.php?id=4 BUGTRAQ 20060205 Easily exploitable Pseudo Random Number generator in phpbb version 2.0.19 and under. VUPEN ADV-2006-0461 XF phpbb-weak-rnd(24573) The gen_rand_string function in phpBB 2.0.19 uses insufficiently random data (small value space) to create the activation key ("validation ID") that is sent by e-mail when establishing a password, which makes it easier for remote attackers to obtain the key and modify passwords for existing accounts or create new accounts. cpe:/a:invisionpower:invision_power_board:2.1.4 CVE-2006-0633 2006-02-10T06:02:00.000-05:00 2013-01-03T00:00:00.000-05:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov 2006-02-10T08:15:00.000-05:00 MISC http://forums.invisionpower.com/lofiversion/index.php/t200085.html MISC http://www.r-security.net/tutorials/view/readtutorial.php?id=4 The make_password function in ipsclass.php in Invision Power Board (IPB) 2.1.4 uses random data generated from partially predictable seeds to create the authentication code that is sent by e-mail to a user with a lost password, which might make it easier for remote attackers to guess the code and change the password for an IPB account, possibly involving millions of requests. cpe:/a:borland_software:c%2b%2b_builder:6:enterprise_update_4 CVE-2006-0634 2006-02-10T06:02:00.000-05:00 2018-10-19T11:45:36.880-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015588 BUGTRAQ 20060206 [xfocus-SD-060206]BCB compiler incorrect deal sizeof operator vulnerability MISC http://www.xfocus.net/releases/200602/a849.html XF bcb-compiler-integer-overflow(24514) Borland C++Builder 6 (BCB6) with Update Pack 4 Enterprise edition (ent_upd4) evaluates the "i>sizeof(int)" expression to false when i equals -1, which might introduce integer overflow vulnerabilities into applications that could be exploited by context-dependent attackers. cpe:/a:fabrice_bellard:tiny_c_compiler:0.9.23 CVE-2006-0635 2006-02-10T06:02:00.000-05:00 2018-10-19T11:45:37.210-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BUGTRAQ 20060207 Re: [xfocus-SD-060206]BCB compiler incorrect deal sizeof operator vulnerability Tiny C Compiler (TCC) 0.9.23 (aka TinyCC) evaluates the "i>sizeof(int)" expression to false when i equals -1, which might introduce integer overflow vulnerabilities into applications that could be exploited by context-dependent attackers. cpe:/o:eyeos_project:eyeos:0.8 cpe:/o:eyeos_project:eyeos:0.8.1 cpe:/o:eyeos_project:eyeos:0.8.1_r1 cpe:/o:eyeos_project:eyeos:0.8.2 cpe:/o:eyeos_project:eyeos:0.8.2_r1 cpe:/o:eyeos_project:eyeos:0.8.2_r2 cpe:/o:eyeos_project:eyeos:0.8.2_r3 cpe:/o:eyeos_project:eyeos:0.8.3 cpe:/o:eyeos_project:eyeos:0.8.3_r1 cpe:/o:eyeos_project:eyeos:0.8.3_r2 cpe:/o:eyeos_project:eyeos:0.8.4 cpe:/o:eyeos_project:eyeos:0.8.4_r1 cpe:/o:eyeos_project:eyeos:0.8.5 cpe:/o:eyeos_project:eyeos:0.8.5_r1 cpe:/o:eyeos_project:eyeos:0.8.6 cpe:/o:eyeos_project:eyeos:0.8.7 cpe:/o:eyeos_project:eyeos:0.8.8 cpe:/o:eyeos_project:eyeos:0.8.9 CVE-2006-0636 2006-02-10T06:02:00.000-05:00 2018-10-19T11:45:37.350-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 419 SECTRACK 1015609 MISC http://www.gulftech.org/?node=research&article_id=00096-02072006 BUGTRAQ 20060207 eyeOS <= 0.8.9 Remote Code Execution BID 16537 VUPEN ADV-2006-0466 XF eyeos-desktop-file-include(24569) desktop.php in eyeOS 0.8.9 and earlier tests for the existence of the _SESSION variable before calling the session_start function, which allows remote attackers to execute arbitrary PHP code and possibly conduct other attacks by modifying critical assumed-immutable variables, as demonstrated using PHP code in the _SESSION[apps][eyeOptions.eyeapp][wrapup] variable. cpe:/a:qualcomm:eudora_worldmail:3.0 CVE-2006-0637 2006-02-10T06:02:00.000-05:00 2018-10-19T11:45:37.817-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BUGTRAQ 20060204 (OLD) Eudora WorldMail 3.0 Windows 2000 Remote System Exploit Buffer overflow in cram.dll in QUALCOMM Eudora WorldMail 3.0 allows remote attackers to execute arbitrary code via an IMAP APPEND command with a long message literal argument, as demonstrated by Worldmail.pl. NOTE: this is a different vector and a different manipulation than CVE-2005-4267, so it might be a different vulnerability than CVE-2005-4267. cpe:/a:mybulletinboard:mybulletinboard:1.0.3 CVE-2006-0638 2006-02-10T06:02:00.000-05:00 2018-10-19T11:45:37.943-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://myimei.com/security/2006-02-07/mybb103moderationphpsqlinject-while-merging-posts.html BUGTRAQ 20060207 [myimei]MyBB1.0.3~moderation.php~SqlInject while merging posts BID 16538 VUPEN ADV-2006-0475 SQL injection vulnerability in moderation.php in MyBB (aka MyBulletinBoard) 1.0.3 allows remote authenticated users, with certain privileges for moderating and merging posts, to execute arbitrary SQL commands via the posts parameter. cpe:/a:mybulletinboard:mybulletinboard:1.0.2 CVE-2006-0639 2006-02-10T06:02:00.000-05:00 2018-10-19T11:45:38.317-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://myimei.com/security/2006-01-14/mybb-102searchphpxss-attackandmore.html BUGTRAQ 20060207 [myimei]MyBB 1.0.2 XSS attack in search.php BUGTRAQ 20060208 Re: [myimei]MyBB 1.0.2 XSS attack in search.php XF mybb-search-xss(24466) Cross-site scripting (XSS) vulnerability in search.php in MyBB (aka MyBulletinBoard) 1.0.2 allows remote attackers with knowledge of the table prefix to inject arbitrary web script or HTML via a URL encoded value of the keywords parameter, as demonstrated by %3Cscript%3E. cpe:/a:orbicule:undercover CVE-2006-0640 2006-02-10T06:02:00.000-05:00 2018-10-19T11:45:38.663-04:00 2.1 LOCAL LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060202 Issues with security software: orbicule.com "Undercover" Orbicule Undercover allows attackers with physical or root access to disable the protection by using the chmod command to change the permissions of the /private/etc/uc.app/Contents/MacOS/uc file, which prevents the service from being started in LaunchDaemon. cpe:/a:orbicule:undercover CVE-2006-0641 2006-02-10T06:02:00.000-05:00 2018-10-19T11:45:38.770-04:00 2.6 NETWORK HIGH NONE PARTIAL NONE NONE http://nvd.nist.gov BUGTRAQ 20060202 Issues with security software: orbicule.com "Undercover" Orbicule Undercover uses a third-party web server to determine the IP address through which the computer is accessing the Internet, but does not document this third-party disclosure, which leads to a potential privacy leak that might allow transmission of sensitive information to an unintended remote destination. cpe:/a:trend_micro:interscan_messaging_security_suite cpe:/a:trend_micro:interscan_web_security_suite cpe:/a:trend_micro:serverprotect:5.58::emc CVE-2006-0642 2006-02-10T06:02:00.000-05:00 2018-10-19T11:45:38.897-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov MISC http://www.packetstormsecurity.org/0602-advisories/Bypass.pdf MISC http://www.packetstormsecurity.org/filedesc/Bypass.pdf.html BUGTRAQ 20060203 Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to scan. BUGTRAQ 20060203 Re: Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to scan. BUGTRAQ 20060203 Re: Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to scan. BUGTRAQ 20060205 RE: Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to scan. BUGTRAQ 20060206 Fwd: Trend Micro ServerProtect version 5.58 can be easily circumvented via the mechanism that limits how many files to scan. BID 16483 XF serverprotect-file-scanning-bypass(24658) Trend Micro ServerProtect 5.58, and possibly InterScan Messaging Security Suite and InterScan Web Security Suite, have a default configuration setting of "Do not scan compressed files when Extracted file count exceeds 500 files," which may be too low in certain circumstances, which allows remote attackers to bypass anti-virus checks by sending compressed archives containing many small files. NOTE: since this is related to a configuration setting that has an operational impact that might vary depending on the environment, and the product is claimed to report a message when the compressed file exceeds specified limits, perhaps this should not be included in CVE. cpe:/a:wiredred:e_pop_web_conferencing:4.1.0.755 CVE-2006-0643 2006-02-10T06:02:00.000-05:00 2018-10-19T11:45:39.757-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 421 BUGTRAQ 20060208 WiredRed EPOP XSS Vulnerability BID 16542 VUPEN ADV-2006-0505 XF epop-topic-xss(24609) Cross-site scripting (XSS) vulnerability in WiredRed e/pop Web Conferencing 4.1.0.755 allows remote authenticated users to inject arbitrary web script or HTML via the topic name of a conference. cpe:/a:cpg-nuke:dragonfly_cms:9.0.6_.1 CVE-2006-0644 2006-02-10T06:02:00.000-05:00 2018-10-19T11:45:40.803-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://dragonflycms.org/Forums/viewtopic/p=98034.html CONFIRM http://dragonflycms.org/Forums/viewtopic/p=98034.html#98034 MISC http://retrogod.altervista.org/dragonfly9.0.6.1_incl_xpl.html SECTRACK 1015601 BUGTRAQ 20060208 CPGNuke Dragonfly 9.0.6.1 remote commands execution through arbitrary local inclusion BID 16546 XF cpg-dragonfly-file-include(24660) Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS (aka CPG Dragonfly CMS) 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in (1) the newlang parameter and (2) the installlang parameter in a cookie, as demonstrated by using error.php to insert malicious code into a log file, or uploading a malicious .png file, which is then included using install.php. cpe:/a:free_software_foundation_inc.:libtasn1:0.1.0 cpe:/a:free_software_foundation_inc.:libtasn1:0.1.1 cpe:/a:free_software_foundation_inc.:libtasn1:0.1.2 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.0 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.1 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.2 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.3 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.4 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.5 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.6 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.7 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.8 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.9 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.10 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.11 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.12 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.13 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.14 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.15 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.16 cpe:/a:free_software_foundation_inc.:libtasn1:0.2.17 CVE-2006-0645 2006-02-10T13:06:00.000-05:00 2018-10-19T11:45:41.427-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://josefsson.org/cgi-bin/viewcvs.cgi/gnutls/tests/certder.c?view=markup CONFIRM http://josefsson.org/cgi-bin/viewcvs.cgi/libtasn1/NEWS?root=gnupg-mirror&view=markup MISC http://josefsson.org/gnutls/releases/libtasn1/libtasn1-0.2.18-from-0.2.17.patch MLIST [gnutls-dev] 20060209 Libtasn1 0.2.18 - Tiny ASN.1 Library - Security release MLIST [gnutls-dev] 20060209 GnuTLS 1.2.10 - Security release MLIST [gnutls-dev] 20060209 GnuTLS 1.3.4 - Experimental - Security release REDHAT RHSA-2006:0207 SREASON 446 SECTRACK 1015612 DEBIAN DSA-985 DEBIAN DSA-986 GENTOO GLSA-200602-08 MISC http://www.gleg.net/protover_ssl.shtml MANDRIVA MDKSA-2006:039 FEDORA FEDORA-2006-107 BUGTRAQ 20060209 ProtoVer SSL: GnuTLS BID 16568 TRUSTIX 2006-0008 VUPEN ADV-2006-0496 XF gnutls-libtasn1-der-dos(24606) UBUNTU USN-251-1 Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via "out-of-bounds access" caused by invalid input, as demonstrated by the ProtoVer SSL test suite. cpe:/o:suse:suse_linux:9.0::enterprise_server cpe:/o:suse:suse_linux:9.1::personal cpe:/o:suse:suse_linux:9.1::professional cpe:/o:suse:suse_linux:9.1::x86_64 cpe:/o:suse:suse_linux:9.2::personal cpe:/o:suse:suse_linux:9.2::professional cpe:/o:suse:suse_linux:9.2::x86_64 cpe:/o:suse:suse_linux:9.3::personal cpe:/o:suse:suse_linux:9.3::professional cpe:/o:suse:suse_linux:9.3::x86_64 cpe:/o:suse:suse_linux:10.0::professional CVE-2006-0646 2006-02-11T06:02:00.000-05:00 2008-09-05T16:59:50.320-04:00 4.4 LOCAL MEDIUM NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-02-12T15:51:00.000-05:00 ALLOWS_USER_ACCESS SUSE SUSE-SA:2006:007 BID 16581 ld in SUSE Linux 9.1 through 10.0, and SLES 9, in certain circumstances when linking binaries, can leave an empty RPATH or RUNPATH, which allows local attackers to execute arbitrary code as other users via by running an ld-linked application from the current directory, which could contain an attacker-controlled library file. cpe:/a:sun:java_system_directory_server:5.2 CVE-2006-0647 2006-02-13T06:06:00.000-05:00 2017-07-19T21:29:56.877-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MLIST [Dailydave] 20060208 Sun Directory Server 5.2 fun MLIST [Dailydave] 20060210 ??? Sun Directory Server 5.2 fun ??? SECTRACK 1015604 SUNALERT 102294 BID 16550 VUPEN ADV-2006-0492 XF sun-java-ldap-dos(24605) LDAP service in Sun Java System Directory Server 5.2, running on Linux and possibly other platforms, allows remote attackers to cause a denial of service (memory allocation error) via an LDAP packet with a crafted subtree search request, as demonstrated using the ProtoVer LDAP test suite. cpe:/a:php_icalendar:php_icalendar:2.0 cpe:/a:php_icalendar:php_icalendar:2.0.1 cpe:/a:php_icalendar:php_icalendar:2.1 CVE-2006-0648 2006-02-13T06:06:00.000-05:00 2018-10-19T11:45:44.443-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/70/summary.html CONFIRM http://phpicalendar.net/forums/viewtopic.php?t=396 SREASON 420 BUGTRAQ 20060208 [eVuln] PHP iCalendar File Inclusion Vulnerability BID 16557 VUPEN ADV-2006-0493 XF phpicalendar-template-search-file-include(24591) Multiple directory traversal vulnerabilities in PHP iCalendar 2.0.1, 2.1, and 2.2 allow remote attackers to include arbitrary files via the (1) getdate and possibly other parameters used in the replace_files function in search.php and (2) $file variable as used in the parse function in functions/template.php. cpe:/a:dataparksearch:dataparksearch:4.16 cpe:/a:dataparksearch:dataparksearch:4.17 cpe:/a:dataparksearch:dataparksearch:4.18 cpe:/a:dataparksearch:dataparksearch:4.19 cpe:/a:dataparksearch:dataparksearch:4.20 cpe:/a:dataparksearch:dataparksearch:4.21 cpe:/a:dataparksearch:dataparksearch:4.22 cpe:/a:dataparksearch:dataparksearch:4.23 cpe:/a:dataparksearch:dataparksearch:4.24 cpe:/a:dataparksearch:dataparksearch:4.25 cpe:/a:dataparksearch:dataparksearch:4.26 cpe:/a:dataparksearch:dataparksearch:4.27 cpe:/a:dataparksearch:dataparksearch:4.28 cpe:/a:dataparksearch:dataparksearch:4.29 cpe:/a:dataparksearch:dataparksearch:4.30 cpe:/a:dataparksearch:dataparksearch:4.31 cpe:/a:dataparksearch:dataparksearch:4.32 cpe:/a:dataparksearch:dataparksearch:4.33 cpe:/a:dataparksearch:dataparksearch:4.34 cpe:/a:dataparksearch:dataparksearch:4.35 cpe:/a:dataparksearch:dataparksearch:4.36 CVE-2006-0649 2006-02-13T06:06:00.000-05:00 2017-07-19T21:29:56.987-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://www.dataparksearch.org/ChangeLog BID 16572 VUPEN ADV-2006-0488 XF dataparksearch-scripts-xss(24627) Cross-site scripting (XSS) vulnerability in DataparkSearch before 4.37 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. cpe:/a:cpaint:cpaint:1.0 cpe:/a:cpaint:cpaint:1.01 cpe:/a:cpaint:cpaint:1.2 cpe:/a:cpaint:cpaint:1.3 cpe:/a:cpaint:cpaint:1.3_sp cpe:/a:cpaint:cpaint:1.3_sp1 cpe:/a:cpaint:cpaint:2.0.0 cpe:/a:cpaint:cpaint:2.0.1 cpe:/a:cpaint:cpaint:2.0.2 cpe:/a:cpaint:cpaint:pre1.0 CVE-2006-0650 2006-02-13T06:06:00.000-05:00 2018-10-19T11:45:44.927-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://cpaint.booleansystems.com/forums/viewtopic.php?t=98 SECTRACK 1015608 MISC http://www.gulftech.org/?node=research&article_id=00097-02092006 BUGTRAQ 20060210 CPAINT AJAX Library Cross Site Scripting BID 16559 VUPEN ADV-2006-0487 XF cpaint-response-type-xss(24594) Cross-site scripting (XSS) vulnerability in cpaint2.inc.php in the CPAINT library before 2.0.3, as used in multiple scripts, allows remote attackers to inject arbitrary web script or HTML via the cpaint_response_type parameter, which is displayed in a resulting error message, as demonstrated using a hex-encoded IFRAME tag. cpe:/a:vwdev:vwdev CVE-2006-0651 2006-02-13T06:06:00.000-05:00 2017-07-19T21:29:57.097-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1015594 BID 16547 XF vwdev-uid-sql-injection(24583) SQL injection vulnerability in index.php in vwdev allows remote attackers to execute arbitrary SQL commands via the UID parameter in the definition Page. cpe:/a:whmcompletesolution:whmcompletesolution:2.0 cpe:/a:whmcompletesolution:whmcompletesolution:2.1 cpe:/a:whmcompletesolution:whmcompletesolution:2.2 CVE-2006-0652 2006-02-13T06:06:00.000-05:00 2017-07-19T21:29:57.143-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BID 16560 VUPEN ADV-2006-0484 CONFIRM http://www.whmcs.com/changelog.php XF whmcs-resellers-insecure-permissions(24597) WHMCompleteSolution (WHMCS) before 2.3 assigns incorrect permissions to "resellers", which allows remote authenticated users to perform privileged actions or obtain sensitive information. NOTE: this report is based on a vendor bug report that identified "incorrect permissions." However, the vendor did not label it a security issue, and there was no statement regarding whether or not the permissions were actually more permissive than intended. If in fact the permissions were more restrictive than intended, then this would be a functional problem but not a vulnerability. cpe:/a:hinton_design:phpht_topsites:1.3 CVE-2006-0653 2006-02-13T06:06:00.000-05:00 2018-10-19T11:45:45.367-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/59/summary.html BUGTRAQ 20060211 [eVuln] phpht Topsites Multiple Vulnerabilities BID 16562 Multiple SQL injection vulnerabilities in Hinton Design phpht Topsites 1.3 allow remote attackers to execute arbitrary SQL commands via multiple vectors including the username parameter. cpe:/a:hinton_design:phpht_topsites:1.3 CVE-2006-0654 2006-02-13T06:06:00.000-05:00 2018-10-19T11:45:45.583-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/59/summary.html BUGTRAQ 20060211 [eVuln] phpht Topsites Multiple Vulnerabilities BID 16562 check.php in Hinton Design phpht Topsites 1.3 does not validate passwords when using cookies, which allows remote attackers to bypass authentication via unspecified cookies. cpe:/a:hinton_design:phpht_topsites:1.3 CVE-2006-0655 2006-02-13T06:06:00.000-05:00 2018-10-19T11:45:45.803-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/59/summary.html BUGTRAQ 20060211 [eVuln] phpht Topsites Multiple Vulnerabilities BID 16562 Multiple cross-site scripting (XSS) vulnerabilities in (1) link_edited.php and (2) link_added.php in Hinton Design phpht Topsites 1.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. cpe:/a:hp:systems_insight_manager:4.2 cpe:/a:hp:systems_insight_manager:4.2:sp1 cpe:/a:hp:systems_insight_manager:4.2:sp2 cpe:/a:hp:systems_insight_manager:5.0 cpe:/a:hp:systems_insight_manager:5.0:sp1 cpe:/a:hp:systems_insight_manager:5.0:sp2 cpe:/a:hp:systems_insight_manager:5.0:sp3 CVE-2006-0656 2006-02-13T06:06:00.000-05:00 2011-03-07T21:30:30.830-05:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SECTRACK 1015605 BID 16571 VUPEN ADV-2006-0497 HP SSRT061108 Directory traversal vulnerability in HP Systems Insight Manager 4.2 through 5.0 SP3 for Windows allows remote attackers to access arbitrary files via unspecified vectors, a different vulnerability than CVE-2005-2006. cpe:/a:softcomplex:php_event_calendar:1.5 CVE-2006-0657 2006-02-13T06:06:00.000-05:00 2017-07-19T21:29:57.207-04:00 3.5 NETWORK MEDIUM SINGLE_INSTANCE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/63/summary.html SREASON 442 BID 16588 VUPEN ADV-2006-0507 XF phpeventcalendar-users-xss(24523) Cross-site scripting (XSS) vulnerability in Softcomplex PHP Event Calendar 1.5 allows remote authenticated users to inject arbitrary web script or HTML, and corrupt data, via the (1) username and (2) password parameters, which are not sanitized before being written to users.php. NOTE: while this issue was originally reported as XSS, the primary issue might be direct static code injection with resultant XSS. cpe:/a:fckeditor:fckeditor:2.0 cpe:/a:fckeditor:fckeditor:2.2 CVE-2006-0658 2006-02-13T06:06:00.000-05:00 2017-10-10T21:30:39.017-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://retrogod.altervista.org/fckeditor_22_xpl.html BUGTRAQ 20060209 runCMS <= 1.3a2 possible remote code execution through the integrated FCKEditor package VUPEN ADV-2006-0502 EXPLOIT-DB 3702 Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt. cpe:/a:runcms:runcms:1.1 cpe:/a:runcms:runcms:1.1a cpe:/a:runcms:runcms:1.2 CVE-2006-0659 2006-02-13T06:06:00.000-05:00 2011-09-08T00:00:00.000-04:00 6.8 NETWORK MEDIUM NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-02-13T10:28:00.000-05:00 ALLOWS_OTHER_ACCESS MISC http://retrogod.altervista.org/runcms_13a_xpl.html BUGTRAQ 20060209 runCMS <= 1.3a2 possible remote code execution through the integrated FCKEditor package BID 16578 VUPEN ADV-2006-0503 Multiple PHP remote file include vulnerabilities in RunCMS 1.2 and earlier, with register_globals and allow_url_fopen enabled, allow remote attackers to execute arbitrary code via the bbPath[path] parameter in (1) class.forumposts.php and (2) forumpollrenderer.php. cpe:/a:farsinews:farsinews:2.1 cpe:/a:farsinews:farsinews:2.1_beta2 cpe:/a:farsinews:farsinews:2.5 CVE-2006-0660 2006-02-13T06:06:00.000-05:00 2018-10-19T11:45:46.037-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov MISC http://forum.farsinewsteam.com/index.php?showtopic=71 MISC http://forum.farsinewsteam.com/index.php?showtopic=76 MISC http://www.hamid.ir/security/farsinews2-5.txt BUGTRAQ 20060210 FarsiNews 2.5 Multiple Vulnerabilities BID 16580 VUPEN ADV-2006-0506 XF farsinews-showarchives-file-include(24598) XF farsinews-index-directory-traversal(24602) Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to (1) read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or (2) include arbitrary files via the template parameter to show_archives.php. cpe:/a:scriptme:sme_blog_host cpe:/a:scriptme:sme_gb_host:1.21 CVE-2006-0661 2006-02-13T06:06:00.000-05:00 2017-07-19T21:29:57.317-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/65/summary.html SREASON 447 BID 16585 VUPEN ADV-2006-0504 XF sme-bbcode-xss(24543) Cross-site scripting (XSS) vulnerability in Scriptme SmE GB Host 1.21 and SmE Blog Host allows remote attackers to inject arbitrary web script or HTML via the BBcode url tag. cpe:/a:ibm:lotus_domino_inotes_client:6.5.4 CVE-2006-0662 2006-02-13T06:06:00.000-05:00 2017-07-19T21:29:57.377-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015610 BID 16577 VUPEN ADV-2006-0499 CONFIRM http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21229919 XF domino-webaccess-subject-xss(24612) Cross-site scripting (XSS) vulnerability in Lotus Domino iNotes Client 6.5.4 allows remote attackers to inject arbitrary web script or HTML via email with attached html files, which are directly rendered in the browser. cpe:/a:ibm:lotus_domino_inotes_client:6.5.4 cpe:/a:ibm:lotus_domino_inotes_client:7.0 CVE-2006-0663 2006-02-13T06:06:00.000-05:00 2017-07-19T21:29:57.473-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015610 BID 16577 VUPEN ADV-2006-0499 CONFIRM http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21229919 XF domino-webaccess-attachment-xss(24611) XF domino-webaccess-javascript-xss(24613) XF domino-webaccess-filename-xss(24614) Multiple cross-site scripting (XSS) vulnerabilities in Lotus Domino iNotes Client 6.5.4 and 7.0 allow remote attackers to inject arbitrary web script or HTML via (1) an email subject; (2) an encoded javascript URI, as demonstrated using "java&#13;script:"; or (3) when the Domino Web Access ActiveX control is not installed, via an email attachment filename. cpe:/a:mantis:mantis:0.17.1 cpe:/a:mantis:mantis:0.17.2 cpe:/a:mantis:mantis:0.17.3 cpe:/a:mantis:mantis:0.17.4 cpe:/a:mantis:mantis:0.17.4a cpe:/a:mantis:mantis:0.17.5 cpe:/a:mantis:mantis:0.18 cpe:/a:mantis:mantis:0.18.0_rc1 cpe:/a:mantis:mantis:0.18.0a2 cpe:/a:mantis:mantis:0.18.0a3 cpe:/a:mantis:mantis:0.18.0a4 cpe:/a:mantis:mantis:0.18.2 cpe:/a:mantis:mantis:0.18.3 cpe:/a:mantis:mantis:0.18a1 cpe:/a:mantis:mantis:0.19.0 cpe:/a:mantis:mantis:0.19.0_rc1 cpe:/a:mantis:mantis:0.19.0a cpe:/a:mantis:mantis:0.19.0a1 cpe:/a:mantis:mantis:0.19.0a2 cpe:/a:mantis:mantis:0.19.1 cpe:/a:mantis:mantis:0.19.2 cpe:/a:mantis:mantis:0.19.3 cpe:/a:mantis:mantis:0.19.4 cpe:/a:mantis:mantis:1.0.0_rc1 cpe:/a:mantis:mantis:1.0.0_rc2 cpe:/a:mantis:mantis:1.0.0_rc3 cpe:/a:mantis:mantis:1.0.0_rc4 cpe:/a:mantis:mantis:1.0.0a1 cpe:/a:mantis:mantis:1.0.0a2 cpe:/a:mantis:mantis:1.0.0a3 CVE-2006-0664 2006-02-13T06:06:00.000-05:00 2017-07-19T21:29:57.537-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov DEBIAN DSA-1133 BID 16561 VUPEN ADV-2006-0485 XF mantis-configdefaultsinc-xss(24585) Cross-site scripting (XSS) vulnerability in config_defaults_inc.php in Mantis before 1.0 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. An original vendor bug report is referenced, but not accessible to the general public. cpe:/a:mantis:mantis:0.17.1 cpe:/a:mantis:mantis:0.17.2 cpe:/a:mantis:mantis:0.17.3 cpe:/a:mantis:mantis:0.17.4 cpe:/a:mantis:mantis:0.17.4a cpe:/a:mantis:mantis:0.17.5 cpe:/a:mantis:mantis:0.18 cpe:/a:mantis:mantis:0.18.0_rc1 cpe:/a:mantis:mantis:0.18.0a2 cpe:/a:mantis:mantis:0.18.0a3 cpe:/a:mantis:mantis:0.18.0a4 cpe:/a:mantis:mantis:0.18.2 cpe:/a:mantis:mantis:0.18.3 cpe:/a:mantis:mantis:0.18a1 cpe:/a:mantis:mantis:0.19.0 cpe:/a:mantis:mantis:0.19.0_rc1 cpe:/a:mantis:mantis:0.19.0a cpe:/a:mantis:mantis:0.19.0a1 cpe:/a:mantis:mantis:0.19.0a2 cpe:/a:mantis:mantis:0.19.1 cpe:/a:mantis:mantis:0.19.2 cpe:/a:mantis:mantis:0.19.3 cpe:/a:mantis:mantis:0.19.4 cpe:/a:mantis:mantis:1.0.0_rc1 cpe:/a:mantis:mantis:1.0.0_rc2 cpe:/a:mantis:mantis:1.0.0_rc3 cpe:/a:mantis:mantis:1.0.0_rc4 cpe:/a:mantis:mantis:1.0.0a1 cpe:/a:mantis:mantis:1.0.0a2 cpe:/a:mantis:mantis:1.0.0a3 CVE-2006-0665 2006-02-13T06:06:00.000-05:00 2011-03-07T21:30:33.847-05:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov DEBIAN DSA-1133 BID 16561 VUPEN ADV-2006-0485 Unspecified vulnerability in (1) query_store.php and (2) manage_proj_create.php in Mantis before 1.0.0 has unknown impact and attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. An original vendor bug report is referenced, but not accessible to the general public. cpe:/o:ibm:aix:5.3 cpe:/o:ibm:aix:5.3_l CVE-2006-0666 2006-02-15T06:06:00.000-05:00 2017-07-19T21:29:57.580-04:00 4.9 LOCAL LOW NONE NONE NONE COMPLETE http://nvd.nist.gov BID 16624 VUPEN ADV-2006-0573 AIXAPAR IY79595 XF aix-kernel-dos(24711) Unspecified vulnerability in the (1) unix_mp and (2) unix_64 kernels in IBM AIX 5.3 VRMF 5.3.0.30 through 5.3.0.33 allows local users to cause a denial of service (system crash) via unknown vectors related to EMULATE_VMX. cpe:/o:ibm:aix:5.2 cpe:/o:ibm:aix:5.3 CVE-2006-0667 2006-03-09T20:02:00.000-05:00 2011-03-07T21:30:34.313-05:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015622 VUPEN ADV-2005-2096 AIXAPAR IY77624 AIXAPAR IY77638 lscfg in IBM AIX 5.2 and 5.3 allows local users to modify arbitrary files via a symlink attack. cpe:/a:pwsphp:pwsphp:1.2.3 CVE-2006-0668 2006-02-13T17:02:00.000-05:00 2008-09-05T16:59:53.883-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-02-14T07:51:00.000-05:00 ALLOWS_OTHER_ACCESS BID 16567 MISC http://www.securityfocus.com/bid/16567/exploit SQL injection vulnerability in index.php in PwsPHP 1.2.3 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in message.php in the espace_membre module. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:gasoft:gas_forum_light CVE-2006-0669 2006-02-13T17:02:00.000-05:00 2017-07-19T21:29:57.643-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1015600 VIM 20060220 vendor dispute for CVE-2006-0669 BID 16563 XF gasforumlight-archive-sql-injection(24616) ** DISPUTED ** Multiple SQL injection vulnerabilities in archive.asp in GA's Forum Light allow remote attackers to execute arbitrary SQL commands via the (1) Forum and (2) pages parameter. NOTE: SecurityTracker says that the vendor has disputed this issue, saying that GA Forum Light does not use an SQL database. SecurityTracker's research indicates that the original problem could be due to a vbscript parsing error based on invalid arguments. cpe:/a:bluez_project:hcidump:1.29 CVE-2006-0670 2006-02-13T17:02:00.000-05:00 2018-10-19T11:45:47.037-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov FULLDISC 20060206 [ Secuobs - Advisory ] Bluetooth : DoS on hcidump SREASON 465 DEBIAN DSA-990 MANDRIVA MDKSA-2006:041 MISC http://www.secuobs.com/news/05022006-bluetooth9.shtml#english BUGTRAQ 20060206 [ Secuobs - Advisory ] Bluetooth : DoS on hcidump 1.29 + PoC UBUNTU USN-256-1 VUPEN ADV-2006-0479 XF hcidump-bluetooth-dos(24533) Buffer overflow in l2cap.c in hcidump 1.29 allows remote attackers to cause a denial of service (crash) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet. cpe:/h:sony_ericsson:k600i cpe:/h:sony_ericsson:t68i cpe:/h:sony_ericsson:v600i cpe:/h:sony_ericsson:w800i CVE-2006-0671 2006-02-13T17:02:00.000-05:00 2017-07-19T21:29:57.753-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov BUGTRAQ 20060206 [ Secuobs - Advisory ] Bluetooth : DoS on Sony/Ericsson cell phones FULLDISC 20060206 [Full-disclosure] [ Secuobs - Advisory ] Bluetooth : DoS on MISC http://www.secuobs.com/news/05022006-bluetooth7.shtml#english BID 16512 VUPEN ADV-2006-0478 XF sony-bluetooth-dos(24534) Buffer overflow in Sony Ericsson K600i, V600i, W800i, and T68i cell phone allows remote attackers to cause a denial of service (reboot or shutdown) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet whose length field is less than the actual length of the packet. cpe:/h:hp:psc_1210_all-in-one cpe:/h:hp:psc_1210_all-in-one:1.0 cpe:/h:hp:psc_1210_all-in-one:1.0.0.1 CVE-2006-0672 2006-02-13T17:02:00.000-05:00 2011-03-07T00:00:00.000-05:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov 2006-02-14T08:02:00.000-05:00 CONFIRM http://h10025.www1.hp.com/ewfrf/wc/softwareDownloadIndex?dlc=en&lc=en&os=228%20&product=90764&lang=en&cc=us&softwareitem=oj-37641-1 BID 16583 VUPEN ADV-2006-0498 Unspecified vulnerability in HP PSC 1210 All-in-One Drivers before 1.0.06 has unknown impact and attack vectors. cpe:/a:reamday_enterprises:magic_calendar_lite:1.02 CVE-2006-0673 2006-02-13T17:02:00.000-05:00 2018-10-19T11:45:47.913-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/71/summary.html SREASON 459 SECTRACK 1015650 BUGTRAQ 20060220 [eVuln] Magic Calendar Lite Authentication Bypass BID 16646 BID 16734 VUPEN ADV-2006-0525 XF magiccalendar-index-sql-injection(24588) Multiple SQL injection vulnerabilities in cms/index.php in Magic Calendar Lite 1.02, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) $total_login and (2) $total_password parameter. cpe:/o:ibm:aix:5.2 cpe:/o:ibm:aix:5.2.2 cpe:/o:ibm:aix:5.2_l cpe:/o:ibm:aix:5.3 cpe:/o:ibm:aix:5.3_l CVE-2006-0674 2006-02-13T17:02:00.000-05:00 2017-07-19T21:29:57.863-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BID 16584 VUPEN ADV-2006-0531 AIXAPAR IY81424 AIXAPAR IY81476 XF aix-arp-iftype-bo(24628) Buffer overflow in the arp command of IBM AIX 5.3 L, 5.3, 5.2.2, 5.2 L, and 5.2 allows local users to cause a denial of service (crash) via a long iftype argument. cpe:/a:glen_campbell:siteframe:5.0.1 CVE-2006-0675 2006-02-13T17:02:00.000-05:00 2018-10-19T11:45:48.367-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://kiki91.altervista.org/exploit/siteframe5.0.1a_xss.txt CONFIRM http://siteframe.org/p/xss_vulnerability_in_siteframe_501 BUGTRAQ 20060212 Siteframe Beaumont 5.0.1a <== Cross-Site Scripting Vulnerability BID 16596 VUPEN ADV-2006-0533 XF siteframe-search-request-xss(24649) Cross-site scripting (XSS) vulnerability in search.php in Siteframe 5.0.1 allows remote attackers to inject arbitrary web script or HTML via the q parameter. cpe:/a:francisco_burzi:php-nuke:6.0 cpe:/a:francisco_burzi:php-nuke:6.5 cpe:/a:francisco_burzi:php-nuke:6.5_beta1 cpe:/a:francisco_burzi:php-nuke:6.5_final cpe:/a:francisco_burzi:php-nuke:6.5_rc1 cpe:/a:francisco_burzi:php-nuke:6.5_rc2 cpe:/a:francisco_burzi:php-nuke:6.5_rc3 cpe:/a:francisco_burzi:php-nuke:6.6 cpe:/a:francisco_burzi:php-nuke:6.7 cpe:/a:francisco_burzi:php-nuke:6.9 cpe:/a:francisco_burzi:php-nuke:7.0 cpe:/a:francisco_burzi:php-nuke:7.1 cpe:/a:francisco_burzi:php-nuke:7.2 cpe:/a:francisco_burzi:php-nuke:7.3 cpe:/a:francisco_burzi:php-nuke:7.6 cpe:/a:francisco_burzi:php-nuke:7.7 cpe:/a:francisco_burzi:php-nuke:7.8 cpe:/a:francisco_burzi:php-nuke:7.9 CVE-2006-0676 2006-02-13T17:02:00.000-05:00 2018-10-19T11:45:48.677-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 425 BUGTRAQ 20060214 [waraxe-2006-SA#044] - XSS in phpNuke 7.8 and older versions BID 16608 VUPEN ADV-2006-0542 MISC http://www.waraxe.us/advisory-44.html XF phpnuke-header-xss(24650) Cross-site scripting (XSS) vulnerability in header.php in PHP-Nuke 6.0 to 7.8 allows remote attackers to inject arbitrary web script or HTML via the pagetitle parameter. cpe:/a:kth:heimdal:0.6.1 cpe:/a:kth:heimdal:0.6.2 cpe:/a:kth:heimdal:0.6.3 cpe:/a:kth:heimdal:0.6.4 cpe:/a:kth:heimdal:0.6.5 cpe:/a:kth:heimdal:0.7.1 cpe:/a:kth:heimdal:0.7.1.1 cpe:/a:kth:heimdal:0.7.1.2 cpe:/a:kth:heimdal:0.7.1.3 CVE-2006-0677 2006-02-14T06:06:00.000-05:00 2018-10-19T11:45:49.023-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov SREASON 449 DEBIAN DSA-977 SUSE SUSE-SA:2006:011 BID 16676 MLIST [heimdal-discuss] 20060206 Heimdal 0.7.2 and 0.6.6 UBUNTU USN-253-1 VUPEN ADV-2006-0456 VUPEN ADV-2006-0628 VUPEN ADV-2006-0653 XF heimdal-telnetd-dos(24763) telnetd in Heimdal 0.6.x before 0.6.6 and 0.7.x before 0.7.2 allows remote unauthenticated attackers to cause a denial of service (server crash) via unknown vectors that trigger a null dereference. cpe:/a:postgresql:postgresql:7.3 cpe:/a:postgresql:postgresql:7.3.1 cpe:/a:postgresql:postgresql:7.3.2 cpe:/a:postgresql:postgresql:7.3.3 cpe:/a:postgresql:postgresql:7.3.4 cpe:/a:postgresql:postgresql:7.3.5 cpe:/a:postgresql:postgresql:7.3.6 cpe:/a:postgresql:postgresql:7.3.7 cpe:/a:postgresql:postgresql:7.3.8 cpe:/a:postgresql:postgresql:7.3.9 cpe:/a:postgresql:postgresql:7.3.10 cpe:/a:postgresql:postgresql:7.3.11 cpe:/a:postgresql:postgresql:7.3.12 cpe:/a:postgresql:postgresql:7.3.13 cpe:/a:postgresql:postgresql:7.4 cpe:/a:postgresql:postgresql:7.4.1 cpe:/a:postgresql:postgresql:7.4.2 cpe:/a:postgresql:postgresql:7.4.3 cpe:/a:postgresql:postgresql:7.4.4 cpe:/a:postgresql:postgresql:7.4.5 cpe:/a:postgresql:postgresql:7.4.6 cpe:/a:postgresql:postgresql:7.4.7 cpe:/a:postgresql:postgresql:7.4.8 cpe:/a:postgresql:postgresql:7.4.9 cpe:/a:postgresql:postgresql:7.4.10 cpe:/a:postgresql:postgresql:7.4.11 cpe:/a:postgresql:postgresql:8.0 cpe:/a:postgresql:postgresql:8.0.1 cpe:/a:postgresql:postgresql:8.0.2 cpe:/a:postgresql:postgresql:8.0.3 cpe:/a:postgresql:postgresql:8.0.4 cpe:/a:postgresql:postgresql:8.0.5 cpe:/a:postgresql:postgresql:8.0.6 cpe:/a:postgresql:postgresql:8.1 cpe:/a:postgresql:postgresql:8.1.1 cpe:/a:postgresql:postgresql:8.1.2 CVE-2006-0678 2006-02-14T14:06:00.000-05:00 2018-10-19T11:45:49.693-04:00 1.5 LOCAL MEDIUM SINGLE_INSTANCE NONE NONE PARTIAL http://nvd.nist.gov SREASON 498 OPENPKG OpenPKG-SA-2006.004 CONFIRM http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3 BUGTRAQ 20060215 PostgreSQL security releases 8.1.3, 8.0.7, 7.4.12, 7.3.14 BID 16650 TRUSTIX 2006-0008 UBUNTU USN-258-1 VUPEN ADV-2006-0605 XF postgresql-setsessionauth-dos(24719) PostgreSQL 7.3.x before 7.3.14, 7.4.x before 7.4.12, 8.0.x before 8.0.7, and 8.1.x before 8.1.3, when compiled with Asserts enabled, allows local users to cause a denial of service (server crash) via a crafted SET SESSION AUTHORIZATION command, a different vulnerability than CVE-2006-0553. cpe:/a:francisco_burzi:php-nuke_ev:7.8 CVE-2006-0679 2006-02-16T15:06:00.000-05:00 2018-10-19T11:45:50.427-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060216 Critical SQL Injection PHPNuke <= 7.8 - Your_Account module SREASONRES 20060216 Critical SQL Injection PHPNuke <= 7.8 - Your_Account module SREASON 440 BUGTRAQ 20060216 Critical SQL Injection PHPNuke <= 7.8 - Your_Account module BID 16691 VUPEN ADV-2006-0636 XF phpnuke-youraccount-sql-injection(24769) SQL injection vulnerability in index.php in the Your_Account module in PHP-Nuke 7.8 and earlier allows remote attackers to execute arbitrary SQL commands via the username variable (Nickname field). cpe:/a:plain_black:webgui:6.0.0 cpe:/a:plain_black:webgui:6.0.1 cpe:/a:plain_black:webgui:6.0.2 cpe:/a:plain_black:webgui:6.0.3 cpe:/a:plain_black:webgui:6.1.0 cpe:/a:plain_black:webgui:6.1.1 cpe:/a:plain_black:webgui:6.2.0_beta cpe:/a:plain_black:webgui:6.2.1_beta cpe:/a:plain_black:webgui:6.2.2_beta cpe:/a:plain_black:webgui:6.2.3_beta cpe:/a:plain_black:webgui:6.2.4_beta cpe:/a:plain_black:webgui:6.2.5_beta cpe:/a:plain_black:webgui:6.2.6_gamma cpe:/a:plain_black:webgui:6.2.7_gamma cpe:/a:plain_black:webgui:6.2.8_gamma cpe:/a:plain_black:webgui:6.2.9_gamma cpe:/a:plain_black:webgui:6.2.10_gamma cpe:/a:plain_black:webgui:6.2.11_gamma cpe:/a:plain_black:webgui:6.3.0_beta cpe:/a:plain_black:webgui:6.4.0_beta cpe:/a:plain_black:webgui:6.5.0_beta cpe:/a:plain_black:webgui:6.5.1_beta cpe:/a:plain_black:webgui:6.5.2_beta cpe:/a:plain_black:webgui:6.5.3_beta cpe:/a:plain_black:webgui:6.5.4_gamma cpe:/a:plain_black:webgui:6.5.5_gamma cpe:/a:plain_black:webgui:6.5.6_gamma cpe:/a:plain_black:webgui:6.6.0_beta cpe:/a:plain_black:webgui:6.6.1_beta cpe:/a:plain_black:webgui:6.6.2_gamma cpe:/a:plain_black:webgui:6.6.3_gamma cpe:/a:plain_black:webgui:6.6.4_gamma cpe:/a:plain_black:webgui:6.6.5_gamma cpe:/a:plain_black:webgui:6.7.0_beta cpe:/a:plain_black:webgui:6.7.1_beta cpe:/a:plain_black:webgui:6.7.2_beta cpe:/a:plain_black:webgui:6.7.3_gamma cpe:/a:plain_black:webgui:6.7.4_gamma cpe:/a:plain_black:webgui:6.7.5_gamma cpe:/a:plain_black:webgui:6.7.6_gamma cpe:/a:plain_black:webgui:6.7.7_gamma cpe:/a:plain_black:webgui:6.7.8_gamma cpe:/a:plain_black:webgui:6.8.1_beta cpe:/a:plain_black:webgui:6.8.2_beta cpe:/a:plain_black:webgui:6.8.3_gamma cpe:/a:plain_black:webgui:6.8.4_gamma cpe:/a:plain_black:webgui:6.8.5_gamma CVE-2006-0680 2006-02-14T19:02:00.000-05:00 2017-07-19T21:29:58.333-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://www.plainblack.com/getwebgui/advisories/webgui-6.8.6-gamma-released BID 16612 VUPEN ADV-2006-0541 XF webgui-anonymous-bypass-security(24695) Unspecified vulnerability in WebGUI before 6.8.6-gamma allows remote attackers to create an account, when anonymous registration is disabled, via a certain URL. cpe:/a:power_daemon:power_daemon:2.0.0 cpe:/a:power_daemon:power_daemon:2.0.0.1 cpe:/a:power_daemon:power_daemon:2.0.1 cpe:/a:power_daemon:power_daemon:2.0.1.1 cpe:/a:power_daemon:power_daemon:2.0.2 CVE-2006-0681 2006-02-14T19:02:00.000-05:00 2017-07-19T21:29:58.427-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://gotfault.net/research/advisory/gadv-powerd.txt BID 16582 VUPEN ADV-2006-0545 XF powerdaemon-syslog-format-string(24713) Format string vulnerability in powerd.c in Power Daemon (powerd) 2.0.2 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the WHATIDO variable. cpe:/a:e107:e107:0.7 cpe:/a:e107:e107:0.7.1 cpe:/a:e107:e107:0.547_beta cpe:/a:e107:e107:0.548_beta cpe:/a:e107:e107:0.549_beta cpe:/a:e107:e107:0.551_beta cpe:/a:e107:e107:0.552_beta cpe:/a:e107:e107:0.553_beta cpe:/a:e107:e107:0.554_beta cpe:/a:e107:e107:0.555_beta cpe:/a:e107:e107:0.600 cpe:/a:e107:e107:0.601 cpe:/a:e107:e107:0.602 cpe:/a:e107:e107:0.603 cpe:/a:e107:e107:0.604 cpe:/a:e107:e107:0.605 cpe:/a:e107:e107:0.606 cpe:/a:e107:e107:0.607 cpe:/a:e107:e107:0.608 cpe:/a:e107:e107:0.609 cpe:/a:e107:e107:0.610 cpe:/a:e107:e107:0.611 cpe:/a:e107:e107:0.612 cpe:/a:e107:e107:0.613 cpe:/a:e107:e107:0.614 cpe:/a:e107:e107:0.615 cpe:/a:e107:e107:0.615a cpe:/a:e107:e107:0.616 cpe:/a:e107:e107:0.617 cpe:/a:e107:e107:0.6171 cpe:/a:e107:e107:0.6172 cpe:/a:e107:e107:0.6173 cpe:/a:e107:e107:0.6174 cpe:/a:e107:e107:0.6175 cpe:/a:e107:e107:5.1 cpe:/a:e107:e107:5.2 cpe:/a:e107:e107:5.3_beta cpe:/a:e107:e107:5.3_beta2 cpe:/a:e107:e107:5.04 cpe:/a:e107:e107:5.4_beta1 cpe:/a:e107:e107:5.4_beta3 cpe:/a:e107:e107:5.4_beta4 cpe:/a:e107:e107:5.4_beta5 cpe:/a:e107:e107:5.4_beta6 cpe:/a:e107:e107:5.05 CVE-2006-0682 2006-02-14T19:02:00.000-05:00 2017-07-19T21:29:58.503-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://e107.org/comment.php?comment.news.776 BID 16614 VUPEN ADV-2006-0540 XF e107-bbcode-xss(24625) Multiple cross-site scripting (XSS) vulnerabilities in bbcodes system in e107 before 0.7.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors. cpe:/a:virtual_hosting_control_system:virtual_hosting_control_system:2.4.6.2 cpe:/a:virtual_hosting_control_system:virtual_hosting_control_system:2.4.7.1_patch_v.1 CVE-2006-0683 2006-02-14T19:02:00.000-05:00 2018-10-19T11:45:50.913-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txt BUGTRAQ 20060211 RS-2006-1: Multiple flaws in VHCS 2.x BID 16600 VUPEN ADV-2006-0534 XF vhcs-admin-xss(24664) Cross-site scripting (XSS) vulnerability in Virtual Hosting Control System (VHCS) 2.4.7.1 with v.1 patch and earlier allows remote attackers to inject arbitrary web script or HTML via the username, which is recorded in a log file but not properly handled when the administrator uses the admin log utility to read the log file. cpe:/a:virtual_hosting_control_system:virtual_hosting_control_system:2.4.7.1 CVE-2006-0684 2006-02-14T19:02:00.000-05:00 2018-10-19T11:45:51.240-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txt BUGTRAQ 20060211 RS-2006-1: Multiple flaws in VHCS 2.x BID 16600 VUPEN ADV-2006-0534 XF vhcs-change-password-weakness(24665) change_password.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not verify the old password when a user changes the password, which may allow remote attackers to gain unauthorized access. cpe:/a:virtual_hosting_control_system:virtual_hosting_control_system:2.4.7.1 CVE-2006-0685 2006-02-14T19:02:00.000-05:00 2018-10-19T11:45:51.583-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS MISC http://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txt BUGTRAQ 20060211 RS-2006-1: Multiple flaws in VHCS 2.x BID 16600 VUPEN ADV-2006-0534 XF vhcs-checklogin-auth-bypass(24666) The check_login function in login.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not exit when authentication fails, which allows remote attackers to gain unauthorized access. cpe:/a:virtual_hosting_control_system:virtual_hosting_control_system:2.4.7.1 CVE-2006-0686 2006-02-14T19:02:00.000-05:00 2018-10-19T11:45:51.943-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SREASON 430 MISC http://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txt BUGTRAQ 20060211 RS-2006-1: Multiple flaws in VHCS 2.x BID 16600 VUPEN ADV-2006-0534 XF vhcs-adduser-privilege-escalation(24667) add_user.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not check user privileges when adding a new administrative user, which allows remote attackers to gain unauthorized access. cpe:/a:docmgr:docmgr:0.54.2 CVE-2006-0687 2006-02-14T19:02:00.000-05:00 2018-10-19T11:45:52.273-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://retrogod.altervista.org/docmgr_0542_incl_xpl.html SREASON 428 BUGTRAQ 20060212 DocMGR <= 0.54.2 arbitrary remote inclusion BID 16601 VUPEN ADV-2006-0544 XF docmgr-process-file-include(24694) process.php in DocMGR 0.54.2 does not initialize the $siteModInfo variable when a direct request is made, which allows remote attackers to include arbitrary local files or possibly remote files via a modified includeModule and siteModInfo variable. cpe:/a:nicecoder:indexu:5.0.0 cpe:/a:nicecoder:indexu:5.0.1 CVE-2006-0688 2006-02-15T06:06:00.000-05:00 2018-10-19T11:45:52.630-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://echo.or.id/adv/adv26-K-159-2006.txt MISC http://echo.or.id/adv/adv27-K-159-2006.txt SECTRACK 1015607 BUGTRAQ 20060209 [ECHO_ADV_27$2006] Indexu <= 5.0.1 Remote File Inclusion BID 16565 VUPEN ADV-2006-0494 XF indexu-application-file-include(24603) PHP remote file include vulnerability in application.php in nicecoder.com indexu 5.0.0 and 5.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter. cpe:/a:scheduling_management.com:time_tracking_software:3.0 CVE-2006-0689 2006-02-15T06:06:00.000-05:00 2018-10-19T11:45:53.037-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://www.evuln.com/vulns/69/summary.html BUGTRAQ 20060219 [eVuln] Time Tracking Software Multiple Vulnerabilities BID 16630 VUPEN ADV-2006-0524 XF timetracking-registration-xss(24572) Cross-site scripting (XSS) vulnerability in the Registration Form in TTS Time Tracking Software 3.0 allows remote attackers to inject arbitrary web script or HTML via the UserName parameter. cpe:/a:scheduling_management.com:time_tracking_software:3.0 CVE-2006-0690 2006-02-15T06:06:00.000-05:00 2018-10-19T11:45:53.320-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.evuln.com/vulns/69/summary.html BUGTRAQ 20060219 [eVuln] Time Tracking Software Multiple Vulnerabilities BID 16630 VUPEN ADV-2006-0524 XF timetracking-multiple-sql-injection(24571) Multiple SQL injection vulnerabilities in TTS Time Tracking Software 3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors. cpe:/a:scheduling_management.com:time_tracking_software:3.0 CVE-2006-0691 2006-02-15T06:06:00.000-05:00 2018-10-19T11:45:53.600-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://www.evuln.com/vulns/69/summary.html BUGTRAQ 20060219 [eVuln] Time Tracking Software Multiple Vulnerabilities BID 16630 BID 16731 VUPEN ADV-2006-0524 XF timetracking-edituser-auth-bypass(24570) edituser.php in TTS Time Tracking Software 3.0 does not verify that the name and password are correct, which allows remote attackers to overwrite arbitrary data belonging to any account. cpe:/a:carey_briggs:php_mysql_timesheet:1 cpe:/a:carey_briggs:php_mysql_timesheet:2 CVE-2006-0692 2006-02-15T06:06:00.000-05:00 2018-10-19T11:45:53.913-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 451 MISC http://www.evuln.com/vulns/67/summary.html BUGTRAQ 20060217 [eVuln] PHP/MYSQL Timesheet Multiple SQL Injection Vulnerabilities BID 16620 VUPEN ADV-2006-0522 XF phpmysqltimesheet-multiple-sql-injection(24567) Multiple SQL injection vulnerabilities in Carey Briggs PHP/MYSQL Timesheet 1 and 2 allow remote attackers to execute arbitrary SQL commands via the (1) yr, (2) month, (3) day, and (4) job parameters in (a) index.php and (b) changehrs.php. cpe:/a:roberto_butti:calimba:0.99.1 cpe:/a:roberto_butti:calimba:0.99.2_beta CVE-2006-0693 2006-02-15T06:06:00.000-05:00 2018-10-19T11:45:54.240-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 453 MISC http://www.evuln.com/vulns/68/summary.html BUGTRAQ 20060217 [eVuln] CALimba Authentication Bypass Vulnerability BID 16632 VUPEN ADV-2006-0523 XF calimba-rbauth-sql-injection(24578) Multiple SQL injection vulnerabilities in rb_auth.php in Roberto Butti CALimba 0.99.2 beta and earlier allow remote attackers to execute arbitrary SQL commands and bypass login authentication via the (1) login and (2) password parameters. cpe:/a:ansilove:ansilove:1.01 cpe:/a:ansilove:ansilove:1.02 CVE-2006-0694 2006-02-15T06:06:00.000-05:00 2017-07-19T21:29:59.143-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://sourceforge.net/project/shownotes.php?release_id=392826 BID 16603 VUPEN ADV-2006-0536 XF ansilove-load-information-disclosure(24681) Unspecified vulnerability in the loaders (load_*.php) in Ansilove before 1.03 allows remote attackers to read arbitrary files via unspecified vectors involving "converting files accessible by the webserver". cpe:/a:ansilove:ansilove:1.01 cpe:/a:ansilove:ansilove:1.02 CVE-2006-0695 2006-02-15T06:06:00.000-05:00 2017-07-19T21:29:59.207-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://sourceforge.net/project/shownotes.php?release_id=392826 BID 16603 VUPEN ADV-2006-0536 XF ansilove-filename-code-execution(24684) Ansilove before 1.03 does not filter uploaded file extensions, which allows remote attackers to execute arbitrary code by uploading arbitrary files with dangerous extensions, then accessing them directly in the upload directory. cpe:/a:zen_cart:zen_cart:1.1.0 cpe:/a:zen_cart:zen_cart:1.1.1d cpe:/a:zen_cart:zen_cart:1.1.2d cpe:/a:zen_cart:zen_cart:1.1.3d cpe:/a:zen_cart:zen_cart:1.1.4d cpe:/a:zen_cart:zen_cart:1.2.0d cpe:/a:zen_cart:zen_cart:1.2.1_patch1 cpe:/a:zen_cart:zen_cart:1.2.1d cpe:/a:zen_cart:zen_cart:1.2.2d cpe:/a:zen_cart:zen_cart:1.2.3d cpe:/a:zen_cart:zen_cart:1.2.4.1 cpe:/a:zen_cart:zen_cart:1.2.4d cpe:/a:zen_cart:zen_cart:1.2.5d cpe:/a:zen_cart:zen_cart:1.2.6d CVE-2006-0696 2006-02-15T06:06:00.000-05:00 2017-07-19T21:29:59.253-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://sourceforge.net/project/shownotes.php?release_id=392886 VUPEN ADV-2006-0546 XF zencart-multiple-sql-injection(24701) SQL injection vulnerability in Zen Cart before 1.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. cpe:/a:zen-cart:zen_cart:1.1.0 cpe:/a:zen-cart:zen_cart:1.1.3 cpe:/a:zen-cart:zen_cart:1.2.0d cpe:/a:zen-cart:zen_cart:1.2.1:patch1 cpe:/a:zen-cart:zen_cart:1.2.1d cpe:/a:zen-cart:zen_cart:1.2.2d cpe:/a:zen-cart:zen_cart:1.2.3d cpe:/a:zen-cart:zen_cart:1.2.4.1 cpe:/a:zen-cart:zen_cart:1.2.4d cpe:/a:zen-cart:zen_cart:1.2.5d cpe:/a:zen-cart:zen_cart:1.2.6d CVE-2006-0697 2006-02-15T06:06:00.000-05:00 2013-01-03T00:00:00.000-05:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov 2006-02-16T11:08:00.000-05:00 CONFIRM http://sourceforge.net/project/shownotes.php?release_id=392886 VUPEN ADV-2006-0546 Zen Cart before 1.2.7 does not protect the admin/includes directory, which allows remote attackers to cause unknown impact via unspecified vectors, probably direct requests. cpe:/a:zen_cart:zen_cart:1.1.0 cpe:/a:zen_cart:zen_cart:1.1.1d cpe:/a:zen_cart:zen_cart:1.1.2d cpe:/a:zen_cart:zen_cart:1.1.3d cpe:/a:zen_cart:zen_cart:1.1.4d cpe:/a:zen_cart:zen_cart:1.2.0d cpe:/a:zen_cart:zen_cart:1.2.1_patch1 cpe:/a:zen_cart:zen_cart:1.2.1d cpe:/a:zen_cart:zen_cart:1.2.2d cpe:/a:zen_cart:zen_cart:1.2.3d cpe:/a:zen_cart:zen_cart:1.2.4.1 cpe:/a:zen_cart:zen_cart:1.2.4d cpe:/a:zen_cart:zen_cart:1.2.5d cpe:/a:zen_cart:zen_cart:1.2.6d CVE-2006-0698 2006-02-15T06:06:00.000-05:00 2017-07-19T21:29:59.333-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov CONFIRM http://sourceforge.net/project/shownotes.php?release_id=392886 VUPEN ADV-2006-0546 XF zencart-multiple-sql-injection(24701) Unspecified vulnerabilities in Zen Cart before 1.2.7 allow remote attackers to cause unknown impact via unspecified vectors related to "other attempted exploits" other than SQL injection. cpe:/a:david_barrett:qwikiwiki:1.0 cpe:/a:david_barrett:qwikiwiki:1.2 cpe:/a:david_barrett:qwikiwiki:1.3 cpe:/a:david_barrett:qwikiwiki:1.4 cpe:/a:david_barrett:qwikiwiki:1.4.1 cpe:/a:david_barrett:qwikiwiki:1.4.2 cpe:/a:david_barrett:qwikiwiki:1.5 cpe:/a:david_barrett:qwikiwiki:1.5.1 CVE-2006-0699 2006-02-15T06:06:00.000-05:00 2017-07-19T21:29:59.377-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://insecurity.altervista.org/index.php?m=02&y=06&entry=entry060213-221217 BID 16638 VUPEN ADV-2006-0562 XF qwikiwiki-search-xss(24669) Cross-site scripting (XSS) vulnerability in search.php in QWikiWiki 1.5, and possibly 1.5.1 and other versions, allows remote attackers to inject arbitrary web script or HTML via the query parameter. cpe:/a:imagevue:imagevue:0.16.1 CVE-2006-0700 2006-02-15T06:06:00.000-05:00 2017-07-19T21:29:59.457-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BUGTRAQ 20060211 imageVue16.1 upload vulnerability BID 16594 VUPEN ADV-2006-0570 XF imagevue-multiple-information-disclosure(24641) imageVue 16.1 allows remote attackers to obtain folder permission settings via a direct request to dir.php, which returns an XML document that lists folders and their permissions. cpe:/a:imagevue:imagevue:0.16.1 CVE-2006-0701 2006-02-15T06:06:00.000-05:00 2017-07-19T21:29:59.537-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BUGTRAQ 20060211 imageVue16.1 upload vulnerability BID 16594 VUPEN ADV-2006-0570 XF imagevue-multiple-information-disclosure(24641) readfolder.php in imageVue 16.1 allows remote attackers to list directories via modified path and ext parameters. cpe:/a:imagevue:imagevue:0.16.1 CVE-2006-0702 2006-02-15T06:06:00.000-05:00 2017-07-19T21:29:59.613-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060211 imageVue16.1 upload vulnerability BID 16594 VUPEN ADV-2006-0570 XF imagevue-upload-file-upload(24633) admin/upload.php in imageVue 16.1 allows remote attackers to upload arbitrary files to certain allowed folders via .. (dot dot) sequences in the path parameter. NOTE: due to the lack of details, the specific vulnerability type cannot be determined, although it might be due to directory traversal. cpe:/a:imagevue:imagevue:0.16.1 CVE-2006-0703 2006-02-15T06:06:00.000-05:00 2018-10-19T11:45:54.553-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 429 BUGTRAQ 20060211 imageVue16.1 upload vulnerability BUGTRAQ 20060719 Re: imageVue16.1 upload vulnerability BUGTRAQ 20061029 Re: imageVue16.1 upload vulnerability BID 16594 VUPEN ADV-2006-0570 XF imagevue-index-sql-injection(24642) Unspecified vulnerability in index.php in imageVue 16.1 has unknown impact, probably a cross-site scripting (XSS) vulnerability involving the query string that is not quoted when inserted into style and body tags, as demonstrated using a bgcol parameter. cpe:/a:ie:ie_integrator:4.4.220114 CVE-2006-0704 2006-02-15T06:06:00.000-05:00 2017-07-19T21:29:59.723-04:00 2.6 NETWORK HIGH NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://www.irmplc.com/advisory016.htm VUPEN ADV-2006-0568 XF ieintegrator-error-information-disclosure(24714) iE Integrator 4.4.220114, when configured without a "bespoke error page" in acm.ini, allows remote attackers to obtain sensitive information via a URL that calls a non-existent .aspx script in the integrator/apps directory, which results in an error message that displays the installation path, web server name, IP, and port, session cookie information, and the IIS system username. cpe:/a:attachmatewrq:reflection_for_secure_it_server:6.0::unix cpe:/a:attachmatewrq:reflection_for_secure_it_server:6.0::win cpe:/a:f-secure:f-secure_ssh_server:3.0.0 cpe:/a:f-secure:f-secure_ssh_server:3.0.1 cpe:/a:f-secure:f-secure_ssh_server:3.0.1::unix cpe:/a:f-secure:f-secure_ssh_server:3.0.2 cpe:/a:f-secure:f-secure_ssh_server:3.0.3 cpe:/a:f-secure:f-secure_ssh_server:3.0.4 cpe:/a:f-secure:f-secure_ssh_server:3.0.5 cpe:/a:f-secure:f-secure_ssh_server:3.0.6 cpe:/a:f-secure:f-secure_ssh_server:3.0.7 cpe:/a:f-secure:f-secure_ssh_server:3.0.8 cpe:/a:f-secure:f-secure_ssh_server:3.0.9 cpe:/a:f-secure:f-secure_ssh_server:3.1.0 cpe:/a:f-secure:f-secure_ssh_server:3.1.0::unix cpe:/a:f-secure:f-secure_ssh_server:3.1.0_build9 cpe:/a:f-secure:f-secure_ssh_server:3.2.0::unix cpe:/a:f-secure:f-secure_ssh_server:3.2.3::unix cpe:/a:f-secure:f-secure_ssh_server:5.0 cpe:/a:f-secure:f-secure_ssh_server:5.1::win cpe:/a:f-secure:f-secure_ssh_server:5.2::win cpe:/a:f-secure:f-secure_ssh_server:5.3::win CVE-2006-0705 2006-02-15T06:06:00.000-05:00 2017-07-19T21:29:59.800-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov HP HPSBTU02322 GENTOO GLSA-200703-13 SECTRACK 1015619 CONFIRM http://support.wrq.com/techdocs/1882.html CERT-VN VU#419241 BID 16625 BID 16640 VUPEN ADV-2006-0554 VUPEN ADV-2006-0555 VUPEN ADV-2008-1008 XF sftp-logging-format-string(24651) Format string vulnerability in a logging function as used by various SFTP servers, including (1) AttachmateWRQ Reflection for Secure IT UNIX Server before 6.0.0.9, (2) Reflection for Secure IT Windows Server before 6.0 build 38, (3) F-Secure SSH Server for Windows before 5.3 build 35, (4) F-Secure SSH Server for UNIX 3.0 through 5.0.8, (5) SSH Tectia Server 4.3.6 and earlier and 4.4.0, and (6) SSH Shell Server 3.2.9 and earlier, allows remote authenticated users to execute arbitrary commands via unspecified vectors, involving crafted filenames and the stat command. cpe:/a:gastebuch:gastebuch:1.3.2 CVE-2006-0706 2006-02-15T06:06:00.000-05:00 2019-10-10T07:21:10.390-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060213 XSS vulnerability in guestbook-php-script CONFIRM http://www.php4scripte.de/index.php BID 16615 VUPEN ADV-2006-0566 XF gastebuch-homepage-xss(24670) Cross-site scripting vulnerability in eintrag.php in G?stebuch (Gastebuch) before 1.3.3 allows remote attackers to inject arbitrary web script or HTML via the URL, which is used in the homepage parameter. cpe:/a:pyblosxom:pyblosxom:1.2.1 cpe:/a:pyblosxom:pyblosxom:1.3 cpe:/a:pyblosxom:pyblosxom:1.3.1 CVE-2006-0707 2006-02-15T06:06:00.000-05:00 2017-07-19T21:29:59.927-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://sourceforge.net/project/shownotes.php?release_id=391800 BID 16641 VUPEN ADV-2006-0571 XF pyblosxom-pathinfo-information-disclosure(24730) PyBlosxom before 1.3.2, when running on certain webservers, allows remote attackers to read arbitrary files via an HTTP request with multiple leading / (slash) characters, which is accessed using the PATH_INFO variable. cpe:/a:nullsoft:winamp:5.0 cpe:/a:nullsoft:winamp:5.01 cpe:/a:nullsoft:winamp:5.02 cpe:/a:nullsoft:winamp:5.03 cpe:/a:nullsoft:winamp:5.04 cpe:/a:nullsoft:winamp:5.05 cpe:/a:nullsoft:winamp:5.06 cpe:/a:nullsoft:winamp:5.07 cpe:/a:nullsoft:winamp:5.08c cpe:/a:nullsoft:winamp:5.08d cpe:/a:nullsoft:winamp:5.08e cpe:/a:nullsoft:winamp:5.09 cpe:/a:nullsoft:winamp:5.11 cpe:/a:nullsoft:winamp:5.12 cpe:/a:nullsoft:winamp:5.13 cpe:/a:nullsoft:winamp:5.091 cpe:/a:nullsoft:winamp:5.093 cpe:/a:nullsoft:winamp:5.094 CVE-2006-0708 2006-02-15T06:06:00.000-05:00 2018-10-19T11:45:54.927-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS MISC http://forums.winamp.com/showthread.php?s=&threadid=238648 SREASON 444 SREASON 492 SECTRACK 1015621 BUGTRAQ 20060213 New winamp m3u/pls .WMA & .M3U Extension overflows BID 16623 VUPEN ADV-2006-0613 XF winamp-pls-file1-bo(24739) XF winamp-m3u-wma-bo(24740) XF winamp-m3u-filename-bo(24741) Multiple buffer overflows in NullSoft Winamp 5.13 and earlier allow remote attackers to execute arbitrary code via (1) an m3u file containing a long URL ending in .wma, (2) a pls file containing a File1 field with a long URL ending in .wma, or (3) an m3u file with a long filename, variants of CVE-2005-3188 and CVE-2006-0476. cpe:/a:metamail_corporation:metamail:2.7.50 CVE-2006-0709 2006-02-15T06:06:00.000-05:00 2017-07-19T21:30:00.083-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=352482 SECTRACK 1015654 DEBIAN DSA-995 GENTOO GLSA-200603-16 SUSE SUSE-SR:2006:005 REDHAT RHSA-2006:0217 BID 16611 VUPEN ADV-2006-0565 MANDRIVA MDKSA-2006:047 XF metamail-boundary-bo(24702) Buffer overflow in Metamail 2.7-50 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via e-mail messages with a long boundary attribute, a different vulnerability than CVE-2004-0105. cpe:/a:isode:m-vault_server:11.3 CVE-2006-0710 2006-02-15T06:06:00.000-05:00 2017-07-19T21:30:00.143-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MLIST [Dailydave] 20060213 eddy 0day BID 16635 VUPEN ADV-2006-0567 XF isode-mvault-ldap-dos(24700) Double free vulnerability in isode.eddy in Isode M-Vault Server 11.3 allows remote attackers to execute arbitrary code via a crafted LDAP request, as demonstrated by ProtoVer Sample LDAP. cpe:/a:neomail:neomail:1.28 CVE-2006-0711 2006-02-15T06:06:00.000-05:00 2017-07-19T21:30:00.190-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://sourceforge.net/project/shownotes.php?release_id=392562&group_id=2874 BID 16651 VUPEN ADV-2006-0564 XF neomail-neomailprefs-bypass-security(24737) The (1) addfolder and (2) deletefolder functions in neomail-prefs.pl in NeoMail 1.28 do not validate the Session ID, which allows remote attackers to add and delete arbitrary files, when configured with homedirfolders and homedirspools disabled. cpe:/a:squishdot:squishdot:0.7.2 cpe:/a:squishdot:squishdot:1.0.0 cpe:/a:squishdot:squishdot:1.1.0 cpe:/a:squishdot:squishdot:1.2.1 cpe:/a:squishdot:squishdot:1.4.0 cpe:/a:squishdot:squishdot:1.4.1 cpe:/a:squishdot:squishdot:1.5.0 CVE-2006-0712 2006-02-15T06:06:00.000-05:00 2017-07-19T21:30:00.253-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16667 CONFIRM http://www.squishdot.org/1139510883 VUPEN ADV-2006-0551 XF squishdot-mailhtml-header-injection(24659) mail_html template in Squishdot 1.5.0 and earlier does not properly validate the (1) email and (2) title variables, which allows remote attackers to bypass spam filters by injecting SMTP headers, probably due to a CRLF injection vulnerability. cpe:/a:linpha:linpha:0.9.0 cpe:/a:linpha:linpha:0.9.1 cpe:/a:linpha:linpha:0.9.2 cpe:/a:linpha:linpha:0.9.3 cpe:/a:linpha:linpha:0.9.4 cpe:/a:linpha:linpha:1.0 CVE-2006-0713 2006-02-15T06:06:00.000-05:00 2018-10-19T11:45:55.523-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://retrogod.altervista.org/linpha_10_local.html SREASON 426 BUGTRAQ 20060211 Linpha <= 1.0 multiple arbitrary local inclusion BID 16592 VUPEN ADV-2006-0535 XF linpha-index-file-include(24663) Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php, (3) install/sec_stage_install.php, (4) install/third_stage_install.php, and (5) install/forth_stage_install.php. NOTE: direct static code injection is resultant from this issue, as demonstrated by inserting PHP code into the username, which is inserted into linpha.log, which is accessible from the directory traversal. cpe:/a:flyspray:flyspray:0.9.7 CVE-2006-0714 2006-02-15T06:06:00.000-05:00 2018-10-19T11:45:55.837-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://retrogod.altervista.org/egs_10rc4_php5_incl_xpl.html SREASON 432 BUGTRAQ 20060213 EGS Enterprise Groupware System 1.0 rc4 remote commands execution & FlySpray 0.9.7 remote commands execution BID 16618 VUPEN ADV-2006-0569 XF flyspray-adodbpath-file-include(24735) Directory traversal vulnerability in the installation file (sql/install-0.9.7.php) in Flyspray 0.9.7 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the adodbpath parameter. cpe:/a:solucija:snews:1.3 CVE-2006-0715 2006-02-15T06:06:00.000-05:00 2018-10-19T11:45:56.163-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060214 XSS and SQL injection in sNews BUGTRAQ 20060214 XSS bugs and SQL injection in sNews BID 16647 XF snews-comment-xss(24674) Cross-site scripting (XSS) vulnerability in sNews 1.3 allows remote attackers to inject arbitrary web script or HTML via the comment field. cpe:/a:solucija:snews:1.3 CVE-2006-0716 2006-02-15T06:06:00.000-05:00 2018-10-19T11:45:56.380-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060214 XSS and SQL injection in sNews SREASON 431 BUGTRAQ 20060214 XSS bugs and SQL injection in sNews BID 16647 XF snews-index-sql-injection(24675) SQL injection vulnerability in index.php in sNews 1.3 allows remote attackers to execute arbitrary SQL commands via the (1) category and (2) id parameters. cpe:/a:ibm:tivoli_directory_server:6.0 CVE-2006-0717 2006-02-15T06:06:00.000-05:00 2017-07-19T21:30:00.537-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MLIST [Dailydave] 20060211 IBM Tivoli Directory Server 0day SECTRACK 1015653 BID 16593 VUPEN ADV-2006-0537 CONFIRM http://www-1.ibm.com/support/docview.wss?uid=swg21230820 XF tivoli-directory-ldap-dos(24619) IBM Tivoli Directory Server 6.0 allows remote attackers to cause a denial of service (crash) via a crafted LDAP request, as demonstrated by test 2532 in the ProtoVer Sample LDAP test suite. cpe:/a:avaya:vsu_100:3.2.40 cpe:/a:avaya:vsu_10000:3.2.40 cpe:/a:avaya:vsu_2000:3.2.40 cpe:/a:avaya:vsu_7500:3.2.40 cpe:/h:avaya:csu_5000:3.2.40 CVE-2006-0718 2006-02-15T16:02:00.000-05:00 2008-09-05T17:00:01.837-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov 2006-02-16T11:05:00.000-05:00 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-043.htm CERT-VN VU#226364 BID 16613 The Internet Key Exchange version 1 (IKEv1) implementation in Avaya VSU 100, 2000, 7500, 10000, and CSU 5000, when running IPSec, allows remote attackers to cause a denial of service (crash) via certain IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the advisory, it is unclear which of CVE-2005-3666, CVE-2005-3667, and/or CVE-2005-3668 this issue applies to. cpe:/a:deltascripts:php_classifieds:6.18 cpe:/a:deltascripts:php_classifieds:6.19 cpe:/a:deltascripts:php_classifieds:6.20 CVE-2006-0719 2006-02-15T17:06:00.000-05:00 2018-10-19T11:45:56.617-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 424 CONFIRM http://www.deltascripts.com/board/viewtopic.php?id=7234 BUGTRAQ 20060214 SQL injection in PHP Classifieds 6.20 BID 16642 VUPEN ADV-2006-0600 SQL injection vulnerability in member_login.php in PHP Classifieds 6.18 through 6.20 allows remote attackers to execute arbitrary SQL commands via the (1) username parameter, which is used by the E-mail address field, and (2) password parameter. cpe:/a:nullsoft:winamp:5.12 cpe:/a:nullsoft:winamp:5.13 CVE-2006-0720 2006-02-23T16:02:00.000-05:00 2018-10-19T11:45:56.850-04:00 7.6 NETWORK HIGH NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS CONFIRM http://forums.winamp.com/showthread.php?threadid=238648 SREASON 476 SECTRACK 1015675 MISC http://www.nsfocus.com/english/homepage/research/0601.htm BUGTRAQ 20060223 NSFOCUS SA2006-01 : Winamp m3u File Processing Buffer Overflow Vulnerability BID 16785 XF winamp-m3u-wma-bo(24740) Stack-based buffer overflow in Nullsoft Winamp 5.12 and 5.13 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted .m3u file that causes an incorrect strncpy function call when the player pauses or stops the file. cpe:/a:runcms:runcms:1.2 cpe:/a:runcms:runcms:1.3a cpe:/a:runcms:runcms:1.3a2 CVE-2006-0721 2006-02-16T06:02:00.000-05:00 2018-10-19T11:45:57.193-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://hamid.ir/security/runcms.txt SECTRACK 1015626 CONFIRM http://www.runcms.org/public/modules/forum/viewtopic.php?topic_id=4003&forum=18 BUGTRAQ 20060216 RUNCMS 1.3a SQL injection BID 16652 VUPEN ADV-2006-0572 XF runcms-pmlite-sql-injection(24676) SQL injection vulnerability in pmlite.php in RunCMS 1.2 and 1.3a allows remote attackers to execute arbitrary SQL commands via the to_userid parameter. cpe:/a:reamday_enterprises:magic_downloads:1.1.3 CVE-2006-0722 2006-02-16T06:02:00.000-05:00 2018-10-19T11:45:57.553-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/73/summary.html SREASON 468 BUGTRAQ 20060221 [eVuln] Magic Downloads Unauthorized Data Modification BID 16665 VUPEN ADV-2006-0602 XF magicdownloads-settings-access(24615) settings.php in Reamday Enterprises Magic Downloads 1.1.3, when register_globals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified (1) action, (2) passwd, (3) admin_password, (4) new_passwd, and (5) confirm_passwd variables, which are not initialized. cpe:/a:reamday_enterprises:magic_news_lite:1.2.3 CVE-2006-0723 2006-02-16T06:02:00.000-05:00 2017-07-19T21:30:00.800-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/72/summary.html BID 16660 BID 16665 VUPEN ADV-2006-0603 XF magicnewslite-preview-file-include(24608) PHP remote file inclusion vulnerability in preview.php in Reamday Enterprises Magic News Lite 1.2.3, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the php_script_path parameter. cpe:/a:reamday_enterprises:magic_news_lite:1.2.3 CVE-2006-0724 2006-02-16T06:02:00.000-05:00 2017-07-19T21:30:00.863-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/72/summary.html BID 16665 VUPEN ADV-2006-0603 XF magicnewslite-profile-access(24610) profile.php in Reamday Enterprises Magic News Lite 1.2.3, when register_globals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified (1) action, (2) passwd, (3) admin_password, (4) new_passwd, and (5) confirm_passwd variables, which are not initialized. cpe:/a:plume-cms:plume_cms:1.0.2 CVE-2006-0725 2006-02-16T06:02:00.000-05:00 2017-07-19T21:30:00.940-04:00 6.8 NETWORK MEDIUM NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://plume-cms.net/news/77-Security-Notice-Please-Update-Your-Prependphp-File SECTRACK 1015624 BID 16662 VUPEN ADV-2006-0599 XF plumecms-prepend-file-include(24697) XF plumecms-frontinc-prepend-file-include(27699) PHP remote file inclusion vulnerability in prepend.php in Plume CMS 1.0.2, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the _PX_config[manager_path] parameter. NOTE: this is a different executable and affected version than CVE-2006-2645. cpe:/a:cpg-nuke:dragonfly_cms:9.0.6.1 CVE-2006-0726 2006-02-16T06:02:00.000-05:00 2017-07-19T21:30:01.003-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://dragonflycms.org/cvs/html/includes/functions/linking.php?b=9.19.2 CONFIRM http://dragonflycms.org/cvs/html/includes/functions/linking.php?d=9.23-9.22 CONFIRM http://dragonflycms.org/Forums/viewtopic/t=14751.html CONFIRM http://dragonflycms.org/Forums/viewtopic/t=14877/postdays=0/postorder=asc/start=15.html BID 16781 VUPEN ADV-2006-0688 XF cpg-dragonfly-linking-xss(24842) Cross-site scripting (XSS) vulnerability in linking.php in CPG-Nuke Dragonfly CMS 9.0.6.1 allows remote attackers to inject arbitrary web script or HTML via a URI that is generated when creating a list of online users. cpe:/a:musox:df_msanalysis:1.0.1 CVE-2006-0727 2006-02-16T06:02:00.000-05:00 2011-03-07T21:30:42.703-05:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://dragonflycms.org/cvs/html/includes/functions/linking.php?b=9.19.2 CONFIRM http://dragonflycms.org/cvs/html/includes/functions/linking.php?d=9.23-9.22 CONFIRM http://dragonflycms.org/Forums/viewtopic/t=14751.html CONFIRM http://dragonflycms.org/Forums/viewtopic/t=14877/postdays=0/postorder=asc/start=15.html BID 16783 VUPEN ADV-2006-0688 SQL injection vulnerability in mstrack.php in MusOX DF MSAnalysis (DFMSA), as used in some environments that use CPG-Nuke Dragonfly CMS, allows remote attackers to trigger path disclosure from a SQL syntax error, and possibly execute arbitrary SQL commands, via certain query data, probably involving the profile name. cpe:/a:webspell:webspell:4.01.00 CVE-2006-0728 2006-02-16T06:02:00.000-05:00 2017-07-19T21:30:01.067-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BID 16673 VUPEN ADV-2006-0606 CONFIRM http://www.webspell.org/index.php?site=news_comments&newsID=49&lang=en XF webspell-search-sql-injection(24708) SQL injection vulnerability in search.php in webSPELL 4.01.00 and earlier allows remote attackers to inject arbitrary SQL commands via the title_op parameter. cpe:/a:teca_scripts:teca_diary:personal_1.0 CVE-2006-0729 2006-02-16T06:02:00.000-05:00 2018-10-19T11:45:57.897-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 477 SECTRACK 1015674 MISC http://www.evuln.com/vulns/75/summary.html BUGTRAQ 20060223 [eVuln] Teca Diary PE SQL Injection Vulnerability BID 16686 VUPEN ADV-2006-0615 XF tecadiary-functions-sql-injection(24643) SQL injection vulnerability in functions.php in Teca Diary PE 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) yy, (2) mm, and (3) dd parameters. cpe:/a:timo_sirainen:dovecot:1.0beta2 CVE-2006-0730 2006-02-16T06:02:00.000-05:00 2017-07-19T21:30:01.177-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MLIST [Dovecot] 20060208 1.0beta3 released BID 16672 VUPEN ADV-2006-0549 XF dovecot-append-dos(24709) Multiple unspecified vulnerabilities in Dovecot before 1.0beta3 allow remote attackers to cause a denial of service (application crash or hang) via unspecified vectors involving (1) "potential hangs" in the APPEND command and "potential crashes" in (2) dovecot-auth and (3) imap/pop3-login. NOTE: vector 2 might be related to a double free vulnerability. cpe:/a:sap:business_connector:core_fix_7 CVE-2006-0731 2006-02-16T06:02:00.000-05:00 2018-10-19T11:45:58.303-04:00 4.0 NETWORK HIGH NONE PARTIAL PARTIAL NONE http://nvd.nist.gov SECTRACK 1015639 MISC http://www.cybsec.com/vuln/CYBSEC_Security_Pre-Advisory_Phishing_Vector_in_SAP_BC.pdf BUGTRAQ 20060215 CYBSEC - Security Pre-Advisory: Phishing Vector in SAP BC BUGTRAQ 20060515 CYBSEC - Security Advisory: Phishing Vector in SAP BC (BusinessConnector) BID 16671 VUPEN ADV-2006-0611 XF sapbc-admin-spoofing(24751) WmRoot/adapter-index.dsp in SAP Business Connector Core Fix 7 and earlier allows remote attackers to conduct spoofing (phishing) attacks via an absolute URL in the url parameter, which loads the URL inside a frame. cpe:/a:sap:business_connector:4.6 cpe:/a:sap:business_connector:4.7 CVE-2006-0732 2006-02-16T06:02:00.000-05:00 2018-10-19T11:45:58.787-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov SECTRACK 1015639 SECTRACK 1016090 SECTRACK 1016122 MISC http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Arbitrary_File_Read_or_Delete_in_SAP_BC.pdf MISC http://www.cybsec.com/vuln/CYBSEC_Security_Pre-Advisory_Arbitrary_File_Read_or_Delete_in_SAP_BC.pdf BUGTRAQ 20060215 CYBSEC - Security Pre-Advisory: Arbitrary File Read/Delete in SAPBC BUGTRAQ 20060515 CYBSEC - Security Advisory: Arbitrary File Read/Delete in SAP BC(Business Connector) BID 16668 VUPEN ADV-2006-0611 Directory traversal vulnerability in SAP Business Connector (BC) 4.6 and 4.7 allows remote attackers to read or delete arbitrary files via the fullName parameter to (1) sapbc/SAP/chopSAPLog.dsp or (2) invoke/sap.monitor.rfcTrace/deleteSingle. Details will be updated after the grace period has ended. NOTE: SAP Business Connector is an OEM version of webMethods Integration Server. webMethods states that this issue can only occur when the product is installed as root/admin, and if the attacker has access to a general purpose port; however, both are discouraged in the documentation. In addition, the attacker must already have acquired administrative privileges through other means. cpe:/a:wordpress:wordpress:2.0 CVE-2006-0733 2006-02-16T06:02:00.000-05:00 2018-10-19T11:45:59.240-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://myimei.com/security/2006-02-15/wordpress200autors-websitexss-attack.html BUGTRAQ 20060214 [myimei]WordPress2.0.0~autors?website~XSS attack BID 16656 XF wordpress-authorswebsite-xss(24736) ** DISPUTED ** Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2) onblur in the "author's website" field. NOTE: followup comments to the researcher's web log suggest that this issue is only exploitable by the same user who injects the XSS, so this might not be a vulnerability. cpe:/a:valve_software:half-life_cstrike_dedicated_server:1.6_linux cpe:/a:valve_software:half-life_cstrike_dedicated_server:1.6_windows CVE-2006-0734 2006-02-16T06:02:00.000-05:00 2017-07-19T21:30:01.393-04:00 4.0 NETWORK LOW SINGLE_INSTANCE NONE NONE PARTIAL http://nvd.nist.gov MISC http://aluigi.altervista.org/adv/csdos.txt BID 16619 XF halflife-svcheckforduplicatenames-dos(33505) The SV_CheckForDuplicateNames function in Valve Software Half-Life CSTRIKE Dedicated Server 1.6 and earlier allows remote authenticated users to cause a denial of service (infinite loop and daemon hang) via a backslash character at the end of a connection string to UDP port 27015. cpe:/a:fuzzymonkey:my_blog:1.0 cpe:/a:fuzzymonkey:my_blog:1.2 cpe:/a:fuzzymonkey:my_blog:1.3 cpe:/a:fuzzymonkey:my_blog:1.4 cpe:/a:fuzzymonkey:my_blog:1.5 cpe:/a:fuzzymonkey:my_blog:1.6 cpe:/a:fuzzymonkey:my_blog:1.21 cpe:/a:fuzzymonkey:my_blog:1.22 cpe:/a:fuzzymonkey:my_blog:1.23 cpe:/a:fuzzymonkey:my_blog:1.31 cpe:/a:fuzzymonkey:my_blog:1.51 cpe:/a:fuzzymonkey:my_blog:1.52 cpe:/a:fuzzymonkey:my_blog:1.61 cpe:/a:fuzzymonkey:my_blog:1.62 cpe:/a:fuzzymonkey:my_blog:1.63 cpe:/a:fuzzymonkey:my_blog:1.64 cpe:/a:m_blom:html-bbcode:1.03 cpe:/a:m_blom:html-bbcode:1.04 CVE-2006-0735 2006-02-16T06:02:00.000-05:00 2018-10-19T11:45:59.443-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/79/summary.html CONFIRM http://evuln.com/vulns/80/summary.html CONFIRM http://fuzzymonkey.net/forum/viewtopic.php?t=856 CONFIRM http://menno.b10m.net/perl/dists/HTML-BBCode-1.05.tar.gz CONFIRM http://menno.b10m.net/perl/HTML-BBCode/Changes MISC http://www.evuln.com/vulns/80/summary.html BUGTRAQ 20060215 [eVuln] My Blog BBCode XSS Vulnerabilities BUGTRAQ 20060215 [eVuln] M. Blom HTML::BBCode perl module XSS Vulnerabilities BID 16659 VUPEN ADV-2006-0614 VUPEN ADV-2006-0642 XF myblog-bbcode-xss(24668) Cross-site scripting (XSS) vulnerability in BBcode.pm in M. Blom HTML::BBCode 1.04 and earlier, as used in products such as My Blog before 1.65, allows remote attackers to inject arbitrary Javascript via a javascript URI in an (1) img or (2) url BBcode tag. cpe:/a:novell:open_enterprise_server:1 cpe:/o:novell:linux_desktop:9 CVE-2006-0736 2006-02-27T15:06:00.000-05:00 2011-03-07T21:30:43.500-05:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SUSE SUSE-SA:2006:010 BID 16779 VUPEN ADV-2006-0693 Stack-based buffer overflow in the pam_micasa PAM authentication module in CASA on Novell Linux Desktop 9 and Open Enterprise Server 1 allows remote attackers to execute arbitrary code via unspecified vectors. cpe:/a:estara:softphone:3.0.1.47 CVE-2006-0737 2006-02-16T20:02:00.000-05:00 2018-10-19T11:46:00.273-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov BUGTRAQ 20060214 eStara SIP softphone several message-processing vulnerabilities BID 16629 VUPEN ADV-2006-0607 XF estara-neg-integer-dos(24677) eStara SIP softphone allows remote attackers to cause a denial of service (crash) via a SIP OPTIONS request with a negative Expires field. cpe:/a:estara:softphone:3.0.1.47 CVE-2006-0738 2006-02-16T20:02:00.000-05:00 2018-10-19T11:46:00.523-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov BUGTRAQ 20060214 eStara SIP softphone several message-processing vulnerabilities BID 16629 VUPEN ADV-2006-0607 XF estara-sdp-format-string(24678) Multiple format string vulnerabilities in eStara SIP softphone allow remote attackers to cause a denial of service (hang) via SIP INVITE requests with format string specifiers in the SDP session description, as demonstrated using (1) the field name, (2) the o field (owner/creator and session identifier), or (3) the m field (media name and transport address). cpe:/a:estara:softphone:3.0.1.47 CVE-2006-0739 2006-02-16T20:02:00.000-05:00 2018-10-19T11:46:00.773-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov BUGTRAQ 20060214 eStara SIP softphone several message-processing vulnerabilities BID 16629 VUPEN ADV-2006-0607 XF estara-content-length-dos(24679) eStara SIP softphone allows remote attackers to cause a denial of service (crash) via an INVITE request with a Content-Length field that has more than 9 digits. cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.0:test1 cpe:/o:linux:linux_kernel:2.6.0:test10 cpe:/o:linux:linux_kernel:2.6.0:test11 cpe:/o:linux:linux_kernel:2.6.0:test2 cpe:/o:linux:linux_kernel:2.6.0:test3 cpe:/o:linux:linux_kernel:2.6.0:test4 cpe:/o:linux:linux_kernel:2.6.0:test5 cpe:/o:linux:linux_kernel:2.6.0:test6 cpe:/o:linux:linux_kernel:2.6.0:test7 cpe:/o:linux:linux_kernel:2.6.0:test8 cpe:/o:linux:linux_kernel:2.6.0:test9 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.8.1 cpe:/o:linux:linux_kernel:2.6.8.1.5 cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11:rc1 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11.1 cpe:/o:linux:linux_kernel:2.6.11.2 cpe:/o:linux:linux_kernel:2.6.11.3 cpe:/o:linux:linux_kernel:2.6.11.4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.9 cpe:/o:linux:linux_kernel:2.6.11.10 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.11_rc1_bk6 cpe:/o:linux:linux_kernel:2.6.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15:rc4 cpe:/o:linux:linux_kernel:2.6.15:rc5 cpe:/o:linux:linux_kernel:2.6.15:rc6 cpe:/o:linux:linux_kernel:2.6.15:rc7 CVE-2006-0741 2006-03-06T21:02:00.000-05:00 2018-10-03T17:35:50.167-04:00 1.2 LOCAL HIGH NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.5 SECTRACK 1015724 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-161.htm CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-180.htm DEBIAN DSA-1097 DEBIAN DSA-1103 MANDRIVA MDKSA-2006:059 MANDRIVA MDKSA-2007:025 SUSE SUSE-SA:2006:028 FEDORA FEDORA-2006-131 REDHAT RHSA-2006:0437 REDHAT RHSA-2006:0493 BID 16925 VUPEN ADV-2006-0804 VUPEN ADV-2006-2554 XF kernel-elf-dos(25001) UBUNTU USN-263-1 Linux kernel before 2.6.15.5, when running on Intel processors, allows local users to cause a denial of service ("endless recursive fault") via unknown attack vectors related to a "bad elf entry address." cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.0::64-bit_x86 cpe:/o:linux:linux_kernel:2.6.0::itanium_ia64_montecito cpe:/o:linux:linux_kernel:2.6.0:test1 cpe:/o:linux:linux_kernel:2.6.0:test10 cpe:/o:linux:linux_kernel:2.6.0:test11 cpe:/o:linux:linux_kernel:2.6.0:test2 cpe:/o:linux:linux_kernel:2.6.0:test3 cpe:/o:linux:linux_kernel:2.6.0:test4 cpe:/o:linux:linux_kernel:2.6.0:test5 cpe:/o:linux:linux_kernel:2.6.0:test6 cpe:/o:linux:linux_kernel:2.6.0:test7 cpe:/o:linux:linux_kernel:2.6.0:test8 cpe:/o:linux:linux_kernel:2.6.0:test9 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.8.1 cpe:/o:linux:linux_kernel:2.6.8.1.5 cpe:/o:linux:linux_kernel:2.6.8.1.5::386 cpe:/o:linux:linux_kernel:2.6.8.1.5::686 cpe:/o:linux:linux_kernel:2.6.8.1.5::686_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64 cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64_k8 cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64_k8_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64_xeon cpe:/o:linux:linux_kernel:2.6.8.1.5::k7 cpe:/o:linux:linux_kernel:2.6.8.1.5::k7_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::power3 cpe:/o:linux:linux_kernel:2.6.8.1.5::power3_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::power4 cpe:/o:linux:linux_kernel:2.6.8.1.5::power4_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::powerpc cpe:/o:linux:linux_kernel:2.6.8.1.5::powerpc_smp cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11:rc1 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11.1 cpe:/o:linux:linux_kernel:2.6.11.2 cpe:/o:linux:linux_kernel:2.6.11.3 cpe:/o:linux:linux_kernel:2.6.11.4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.9 cpe:/o:linux:linux_kernel:2.6.11.10 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.11_rc1_bk6 cpe:/o:linux:linux_kernel:2.6.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15:rc4 cpe:/o:linux:linux_kernel:2.6.15:rc5 CVE-2006-0742 2006-03-09T08:06:00.000-05:00 2018-10-03T17:35:54.243-04:00 4.6 LOCAL LOW SINGLE_INSTANCE NONE NONE COMPLETE http://nvd.nist.gov SGI 20060402-01-U CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-180.htm CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm DEBIAN DSA-1097 DEBIAN DSA-1103 CONFIRM http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.15.6 MANDRIVA MDKSA-2006:059 SUSE SUSE-SA:2006:028 REDHAT RHSA-2006:0437 REDHAT RHSA-2006:0575 BID 16993 VUPEN ADV-2006-0856 VUPEN ADV-2006-2554 XF kernel-dieifkernel-dos(25068) UBUNTU USN-263-1 The die_if_kernel function in arch/ia64/kernel/unaligned.c in Linux kernel 2.6.x before 2.6.15.6, possibly when compiled with certain versions of gcc, has the "noreturn" attribute set, which allows local users to cause a denial of service by causing user faults on Itanium systems. cpe:/a:apache:log4net:1.2.9_beta CVE-2006-0743 2006-03-09T15:02:00.000-05:00 2017-07-19T21:30:01.847-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://issues.apache.org/jira/browse/LOG4NET-67 SUSE SUSE-SR:2006:026 BID 17095 VUPEN ADV-2006-0955 XF log4net-localsyslogappender-dos(25196) Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors. cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.0:test1 cpe:/o:linux:linux_kernel:2.6.0:test10 cpe:/o:linux:linux_kernel:2.6.0:test11 cpe:/o:linux:linux_kernel:2.6.0:test2 cpe:/o:linux:linux_kernel:2.6.0:test3 cpe:/o:linux:linux_kernel:2.6.0:test4 cpe:/o:linux:linux_kernel:2.6.0:test5 cpe:/o:linux:linux_kernel:2.6.0:test6 cpe:/o:linux:linux_kernel:2.6.0:test7 cpe:/o:linux:linux_kernel:2.6.0:test8 cpe:/o:linux:linux_kernel:2.6.0:test9 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.1:rc3 cpe:/o:linux:linux_kernel:2.6.2 cpe:/o:linux:linux_kernel:2.6.2:rc1 cpe:/o:linux:linux_kernel:2.6.2:rc2 cpe:/o:linux:linux_kernel:2.6.2:rc3 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.3:rc1 cpe:/o:linux:linux_kernel:2.6.3:rc2 cpe:/o:linux:linux_kernel:2.6.3:rc3 cpe:/o:linux:linux_kernel:2.6.3:rc4 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.4:rc1 cpe:/o:linux:linux_kernel:2.6.4:rc2 cpe:/o:linux:linux_kernel:2.6.4:rc3 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.5:rc1 cpe:/o:linux:linux_kernel:2.6.5:rc2 cpe:/o:linux:linux_kernel:2.6.5:rc3 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.6:rc2 cpe:/o:linux:linux_kernel:2.6.6:rc3 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.7:rc2 cpe:/o:linux:linux_kernel:2.6.7:rc3 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.8:rc4 cpe:/o:linux:linux_kernel:2.6.9 cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.9:rc1 cpe:/o:linux:linux_kernel:2.6.9:rc2 cpe:/o:linux:linux_kernel:2.6.9:rc3 cpe:/o:linux:linux_kernel:2.6.9:rc4 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc1 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.10:rc3 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11:rc1 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11:rc5 cpe:/o:linux:linux_kernel:2.6.11.1 cpe:/o:linux:linux_kernel:2.6.11.2 cpe:/o:linux:linux_kernel:2.6.11.3 cpe:/o:linux:linux_kernel:2.6.11.4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.9 cpe:/o:linux:linux_kernel:2.6.11.10 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc2 cpe:/o:linux:linux_kernel:2.6.12:rc3 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12:rc6 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc2 cpe:/o:linux:linux_kernel:2.6.13:rc3 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc5 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14:rc5 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.14.5 cpe:/o:linux:linux_kernel:2.6.14.6 cpe:/o:linux:linux_kernel:2.6.14.7 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15:rc4 cpe:/o:linux:linux_kernel:2.6.15:rc5 cpe:/o:linux:linux_kernel:2.6.15:rc6 cpe:/o:linux:linux_kernel:2.6.15:rc7 cpe:/o:linux:linux_kernel:2.6.15.1 cpe:/o:linux:linux_kernel:2.6.15.2 cpe:/o:linux:linux_kernel:2.6.15.3 cpe:/o:linux:linux_kernel:2.6.15.4 cpe:/o:linux:linux_kernel:2.6.15.5 cpe:/o:linux:linux_kernel:2.6.15.6 cpe:/o:linux:linux_kernel:2.6.15.7 cpe:/o:linux:linux_kernel:2.6.16 cpe:/o:linux:linux_kernel:2.6.16:rc1 cpe:/o:linux:linux_kernel:2.6.16:rc2 cpe:/o:linux:linux_kernel:2.6.16:rc3 cpe:/o:linux:linux_kernel:2.6.16:rc4 cpe:/o:linux:linux_kernel:2.6.16:rc5 cpe:/o:linux:linux_kernel:2.6.16:rc6 cpe:/o:linux:linux_kernel:2.6.16.1 cpe:/o:linux:linux_kernel:2.6.16.2 cpe:/o:linux:linux_kernel:2.6.16.3 cpe:/o:linux:linux_kernel:2.6.16.4 cpe:/o:linux:linux_kernel:2.6.16_rc7 cpe:/o:linux:linux_kernel:2.6_test9_cvs CVE-2006-0744 2006-04-18T06:02:00.000-04:00 2018-10-30T12:26:20.390-04:00 4.9 LOCAL LOW NONE NONE NONE COMPLETE http://nvd.nist.gov CONFIRM http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.5 FEDORA FEDORA-2006-423 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-161.htm CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-180.htm DEBIAN DSA-1103 MANDRIVA MDKSA-2006:086 MANDRIVA MDKSA-2006:150 SUSE SUSE-SA:2006:042 SUSE SUSE-SA:2006:047 SUSE SUSE-SA:2006:028 REDHAT RHSA-2006:0437 REDHAT RHSA-2006:0493 BID 17541 UBUNTU USN-302-1 VUPEN ADV-2006-1390 VUPEN ADV-2006-1475 VUPEN ADV-2006-2554 XF linux-uncanonical-addr-dos(25869) Linux kernel before 2.6.16.5 does not properly handle uncanonical return addresses on Intel EM64T CPUs, which reports an exception in the SYSRET instead of the next instruction, which causes the kernel exception handler to run on the user stack with the wrong GS. cpe:/a:x.org:x11r6:6.9 cpe:/a:x.org:x11r7:1.0 cpe:/a:x.org:x11r7:1.0.1 cpe:/o:mandrakesoft:mandrake_linux:2006 cpe:/o:mandrakesoft:mandrake_linux:2006::x86_64 cpe:/o:redhat:fedora_core:core_5.0 cpe:/o:sun:solaris:10.0::x86 cpe:/o:suse:suse_linux:10.0::oss CVE-2006-0745 2006-03-20T21:06:00.000-05:00 2018-10-19T11:46:01.037-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SREASON 606 SECTRACK 1015793 SUNALERT 102252 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-078.htm MANDRIVA MDKSA-2006:056 SUSE SUSE-SA:2006:016 FEDORA FEDORA-2006-172 BUGTRAQ 20060320 [CVE-2006-0745] X.Org Security Advisory: privilege escalation and DoS in X11R6.9, X11R7.0 BUGTRAQ 20060320 Re: [CVE-2006-0745] X.Org Security Advisory: privilege escalation and DoS in X11R6.9, X11R7.0 BID 17169 VUPEN ADV-2006-1017 VUPEN ADV-2006-1028 XF xorg-geteuid-privilege-escalation(25341) X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently treats the address of the geteuid function as if it is the return value of a call to geteuid, which allows local users to bypass intended restrictions and (1) execute arbitrary code via the -modulepath command line option or (2) overwrite arbitrary files via -logfile. cpe:/a:xpdf:xpdf CVE-2006-0746 2006-03-08T19:02:00.000-05:00 2018-10-19T11:46:02.210-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SREASON 566 SECTRACK 1015751 DEBIAN DSA-1008 CONFIRM http://www.kde.org/info/security/advisory-20060202-1.txt MANDRIVA MDKSA-2006:054 REDHAT RHSA-2006:0262 BUGTRAQ 20060310 [KDE Security Advisory] kpdf of KDE 3.3.x heap based buffer overflow BID 17039 XF kde-kpdf-patch-bo(25146) Certain patches for kpdf do not include all relevant patches from xpdf that were associated with CVE-2005-3627, which allows context-dependent attackers to exploit vulnerabilities that were present in CVE-2005-3627. cpe:/a:freetype:freetype:2.1 CVE-2006-0747 2006-05-23T06:06:00.000-04:00 2018-10-19T11:46:02.850-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SGI 20060701-01-U APPLE APPLE-SA-2009-05-12 SUSE SUSE-SA:2006:037 SECTRACK 1016522 SUNALERT 102705 CONFIRM http://support.apple.com/kb/HT3549 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-176.htm DEBIAN DSA-1095 MANDRIVA MDKSA-2006:099 REDHAT RHSA-2006:0500 BUGTRAQ 20060612 rPSA-2006-0100-1 freetype BID 18326 CERT TA09-133A VUPEN ADV-2007-0381 VUPEN ADV-2009-1297 CONFIRM https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=183676 CONFIRM https://issues.rpath.com/browse/RPL-429 UBUNTU USN-291-1 Integer underflow in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a font file with an odd number of blue values, which causes the underflow when decrementing by 2 in a context that assumes an even number of values. cpe:/a:mozilla:firefox:1.0 cpe:/a:mozilla:firefox:1.0.1 cpe:/a:mozilla:firefox:1.0.2 cpe:/a:mozilla:firefox:1.0.3 cpe:/a:mozilla:firefox:1.0.4 cpe:/a:mozilla:firefox:1.0.5 cpe:/a:mozilla:firefox:1.0.6 cpe:/a:mozilla:firefox:1.0.7 cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:firefox:1.5:beta1 cpe:/a:mozilla:firefox:1.5:beta2 cpe:/a:mozilla:firefox:1.5.0.1 cpe:/a:mozilla:firefox:preview_release cpe:/a:mozilla:seamonkey:1.0::alpha cpe:/a:mozilla:seamonkey:1.0:beta cpe:/a:mozilla:thunderbird:1.0 cpe:/a:mozilla:thunderbird:1.0.1 cpe:/a:mozilla:thunderbird:1.0.2 cpe:/a:mozilla:thunderbird:1.0.3 cpe:/a:mozilla:thunderbird:1.0.4 cpe:/a:mozilla:thunderbird:1.0.5 cpe:/a:mozilla:thunderbird:1.0.5:beta cpe:/a:mozilla:thunderbird:1.0.6 cpe:/a:mozilla:thunderbird:1.0.7 cpe:/a:mozilla:thunderbird:1.5 cpe:/a:mozilla:thunderbird:1.5:beta2 cpe:/a:mozilla:thunderbird:1.5.0.1 CVE-2006-0748 2006-04-14T06:02:00.000-04:00 2018-10-19T11:46:04.587-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov SCO SCOSA-2006.26 SGI 20060404-01-U SUNALERT 102550 SUNALERT 228526 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm DEBIAN DSA-1044 DEBIAN DSA-1046 DEBIAN DSA-1051 GENTOO GLSA-200604-12 GENTOO GLSA-200604-18 GENTOO GLSA-200605-09 MANDRIVA MDKSA-2006:075 MANDRIVA MDKSA-2006:076 MANDRIVA MDKSA-2006:078 SUSE SUSE-SA:2006:022 REDHAT RHSA-2006:0329 REDHAT RHSA-2006:0330 BUGTRAQ 20060426 ZDI-06-011: Mozilla Firefox Table Rebuilding Code Execution Vulnerability FEDORA FLSA:189137-1 FEDORA FLSA:189137-2 HP HPSBUX02122 HP SSRT061236 HP SSRT061181 BID 17516 VUPEN ADV-2006-1356 VUPEN ADV-2006-3391 VUPEN ADV-2006-3748 VUPEN ADV-2006-3749 VUPEN ADV-2008-0083 MISC http://www.zerodayinitiative.com/advisories/ZDI-06-011/ XF mozilla-table-rebuilding-code-execution(25985) UBUNTU USN-275-1 UBUNTU USN-276-1 Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via "an invalid and non-sensical ordering of table-related tags" that results in a negative array index. cpe:/a:mozilla:firefox:1.0 cpe:/a:mozilla:firefox:1.0:preview_release cpe:/a:mozilla:firefox:1.0.1 cpe:/a:mozilla:firefox:1.0.2 cpe:/a:mozilla:firefox:1.0.3 cpe:/a:mozilla:firefox:1.0.4 cpe:/a:mozilla:firefox:1.0.5 cpe:/a:mozilla:firefox:1.0.6 cpe:/a:mozilla:firefox:1.0.7 cpe:/a:mozilla:firefox:1.0.8 cpe:/a:mozilla:firefox:1.4.1 cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:firefox:1.5:beta1 cpe:/a:mozilla:firefox:1.5:beta2 cpe:/a:mozilla:mozilla_suite:- cpe:/a:mozilla:mozilla_suite:1.7.6 cpe:/a:mozilla:mozilla_suite:1.7.7 cpe:/a:mozilla:mozilla_suite:1.7.8 cpe:/a:mozilla:mozilla_suite:1.7.10 cpe:/a:mozilla:mozilla_suite:1.7.11 cpe:/a:mozilla:mozilla_suite:1.7.12 cpe:/a:mozilla:seamonkey:- cpe:/a:mozilla:thunderbird:1.0 cpe:/a:mozilla:thunderbird:1.0:- cpe:/a:mozilla:thunderbird:1.0:rc cpe:/a:mozilla:thunderbird:1.0.2 cpe:/a:mozilla:thunderbird:1.0.5 cpe:/a:mozilla:thunderbird:1.0.6 cpe:/a:mozilla:thunderbird:1.0.7 CVE-2006-0749 2006-04-14T06:02:00.000-04:00 2018-10-19T11:46:14.507-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SCO SCOSA-2006.26 SGI 20060404-01-U SUSE SUSE-SA:2006:021 SREASON 729 SUNALERT 102550 SUNALERT 228526 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm DEBIAN DSA-1044 DEBIAN DSA-1046 DEBIAN DSA-1051 GENTOO GLSA-200604-12 GENTOO GLSA-200604-18 GENTOO GLSA-200605-09 CERT-VN VU#736934 MANDRIVA MDKSA-2006:075 MANDRIVA MDKSA-2006:076 MANDRIVA MDKSA-2006:078 CONFIRM http://www.mozilla.org/security/announce/2006/mfsa2006-18.html SUSE SUSE-SA:2006:022 FEDORA FEDORA-2006-410 FEDORA FEDORA-2006-411 REDHAT RHSA-2006:0328 REDHAT RHSA-2006:0329 REDHAT RHSA-2006:0330 BUGTRAQ 20060417 ZDI-06-009: Mozilla Firefox Tag Parsing Code Execution Vulnerability HP SSRT061145 FEDORA FLSA:189137-1 FEDORA FLSA:189137-2 HP HPSBUX02122 BID 17516 CERT TA06-107A VUPEN ADV-2006-1356 VUPEN ADV-2006-3391 MISC http://www.zerodayinitiative.com/advisories/ZDI-06-009.html XF mozilla-nshtmlcontentsink-memory-corruption(25819) UBUNTU USN-271-1 UBUNTU USN-275-1 UBUNTU USN-276-1 nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors involving a "particular sequence of HTML tags" that leads to memory corruption. cpe:/a:supersmashbrothers:army_system:2.1.0_for_ipb CVE-2006-0750 2006-02-17T21:02:00.000-05:00 2018-10-19T11:46:22.163-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://secubox.shadock.net/Invision_Power_Board_Army_System_Mod_2.1_and_prior_SQL_Injection_Exploit.html BUGTRAQ 20060212 Invision Power Board Army System Mod <= 2.1 SQL Injection Exploit BID 16606 VUPEN ADV-2006-0561 XF ipb-armysystem-sql-injection(24654) SQL injection vulnerability in army.php in supersmashbrothers (SSB) Army System 2.1.0 for Invision Power Board (IPB) allows remote attackers to execute arbitrary SQL commands via the userstat parameter in an army action to index.php. cpe:/a:noofs_team:network_object_oriented_file_system:0.7 cpe:/a:noofs_team:network_object_oriented_file_system:0.8 cpe:/a:noofs_team:network_object_oriented_file_system:0.8.1 CVE-2006-0751 2006-02-17T21:02:00.000-05:00 2011-03-07T21:30:45.687-05:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov 2006-02-27T10:33:00.000-05:00 ALLOWS_ADMIN_ACCESS MLIST [fm-news] 20060204 Newsletter for Friday, February 03rd 2006 CONFIRM http://freshmeat.net/projects/noofs/?branch_id=60557&release_id=218852 Multiple unspecified vulnerabilities in the (1) Filesystem in USErspace (FUSE) client and (2) NOOFS daemon in in Network Object Oriented File System (NOOFS) before 0.9.0 have unspecified impact and attack vectors. cpe:/a:niels_provos:honeyd:0.5 cpe:/a:niels_provos:honeyd:0.6 cpe:/a:niels_provos:honeyd:0.6a cpe:/a:niels_provos:honeyd:0.7 cpe:/a:niels_provos:honeyd:0.7a cpe:/a:niels_provos:honeyd:0.8 cpe:/a:niels_provos:honeyd:0.8a cpe:/a:niels_provos:honeyd:0.8b cpe:/a:niels_provos:honeyd:1.0 cpe:/a:niels_provos:honeyd:1.5a CVE-2006-0752 2006-02-17T21:02:00.000-05:00 2018-10-19T11:46:22.603-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://www.honeyd.org/adv.2006-01 CONFIRM http://www.honeyd.org/phpBB2/viewtopic.php?t=106 BUGTRAQ 20060212 honeyd security advisory: remote detection BID 16595 VUPEN ADV-2006-0552 XF honeyd-ipfrag-obtain-information(24728) Niels Provos Honeyd before 1.5 replies to certain illegal IP packet fragments that other IP stack implementations would drop, which allows remote attackers to identify IP addresses that are being simulated using honeyd. cpe:/a:microsoft:ie:6:windows_xp_sp2 CVE-2006-0753 2006-02-17T21:02:00.000-05:00 2018-10-19T11:46:23.087-04:00 2.6 NETWORK HIGH NONE NONE NONE PARTIAL http://nvd.nist.gov BUGTRAQ 20060214 memory leak in IE? XF ie-windowstatus-dos(24846) Memory leak in Microsoft Internet Explorer 6 for Windows XP Service Pack 2 allows remote attackers to cause a denial of service (memory consumption) via JavaScript that uses setInterval to repeatedly call a function to set the value of window.status. cpe:/a:dotproject:dotproject:2.0 cpe:/a:dotproject:dotproject:2.0.1 CVE-2006-0754 2006-02-17T21:02:00.000-05:00 2018-10-19T11:46:23.320-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BUGTRAQ 20060214 dotproject <= 2.0.1 remote code execution BUGTRAQ 20060215 Re: dotproject <= 2.0.1 remote code execution BID 16648 VUPEN ADV-2006-0604 XF dotproject-phpinfo-check-obtain-info(24745) ** DISPUTED ** dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php. cpe:/a:dotproject:dotproject:2.0 cpe:/a:dotproject:dotproject:2.0.1 CVE-2006-0755 2006-02-17T21:02:00.000-05:00 2018-10-19T11:46:23.790-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060214 dotproject <= 2.0.1 remote code execution BUGTRAQ 20060215 Re: dotproject <= 2.0.1 remote code execution BID 16648 VUPEN ADV-2006-0604 XF dotproject-multiple-basedir-file-include(24738) ** DISPUTED ** Multiple PHP remote file include vulnerabilities in dotProject 2.0.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary commands via the baseDir parameter in (1) db_adodb.php, (2) db_connect.php, (3) session.php, (4) vw_usr_roles.php, (5) calendar.php, (6) date_format.php, and (7) tasks/gantt.php; and the dPconfig[root_dir] parameter in (8) projects/gantt.php, (9) gantt2.php, and (10) vw_files.php. NOTE: the vendor disputes this issue, stating that the product documentation clearly recommends that the system administrator disable register_globals, and that the check.php script warns against this setting. Also, the vendor says that the protection.php/siteurl vector is incorrect because protection.php does not exist in the product. cpe:/a:dotproject:dotproject:2.0 cpe:/a:dotproject:dotproject:2.0.1 CVE-2006-0756 2006-02-17T21:02:00.000-05:00 2018-10-19T11:46:24.913-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SREASON 434 BUGTRAQ 20060214 dotproject <= 2.0.1 remote code execution BUGTRAQ 20060215 Re: dotproject <= 2.0.1 remote code execution BID 16648 VUPEN ADV-2006-0604 XF dotproject-phpinfo-check-obtain-info(24745) ** DISPUTED ** dotProject 2.0.1 and earlier leaves (1) phpinfo.php and (2) check.php accessible under the /docs/ directory after installation, which allows remote attackers to obtain sensitive configuration information. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php. cpe:/a:hivemail:hivemail:1.1 cpe:/a:hivemail:hivemail:1.1.1 cpe:/a:hivemail:hivemail:1.2 cpe:/a:hivemail:hivemail:1.2.1_beta1 cpe:/a:hivemail:hivemail:1.2.1_rc cpe:/a:hivemail:hivemail:1.2.2 cpe:/a:hivemail:hivemail:1.2_sp1 cpe:/a:hivemail:hivemail:1.3 cpe:/a:hivemail:hivemail:1.3_beta1 cpe:/a:hivemail:hivemail:1.3_rc1 CVE-2006-0757 2006-02-17T21:02:00.000-05:00 2017-07-19T21:30:02.787-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060210 HiveMail <= 1.3 Multiple Vulnerabilities MISC http://forum.hivemail.com/showthread.php?p=26745 MISC http://www.gulftech.org/?node=research&article_id=00098-02102006 BID 16591 VUPEN ADV-2006-0527 XF hivemail-multiple-file-include(24618) Multiple eval injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary PHP code via (1) the contactgroupid parameter in addressbook.update.php, (2) the messageid parameter in addressbook.add.php, (3) the folderid parameter in folders.update.php, and possibly certain parameters in (4) calendar.event.php, (5) index.php, (6) pop.download.php, (7) read.bounce.php, (8) rules.block.php, (9) language.php, and (10) certain other scripts, as demonstrated by an addressbook.update.php request with a contactgroupid value of phpinfo() preceded by facilitators. cpe:/a:hivemail:hivemail:1.1 cpe:/a:hivemail:hivemail:1.1.1 cpe:/a:hivemail:hivemail:1.2 cpe:/a:hivemail:hivemail:1.2.1_beta1 cpe:/a:hivemail:hivemail:1.2.1_rc cpe:/a:hivemail:hivemail:1.2.2 cpe:/a:hivemail:hivemail:1.2_sp1 cpe:/a:hivemail:hivemail:1.3 cpe:/a:hivemail:hivemail:1.3_beta1 cpe:/a:hivemail:hivemail:1.3_rc1 CVE-2006-0758 2006-02-17T21:02:00.000-05:00 2017-07-19T21:30:02.847-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060210 HiveMail <= 1.3 Multiple Vulnerabilities MISC http://forum.hivemail.com/showthread.php?p=26745 MISC http://www.gulftech.org/?node=research&article_id=00098-02102006 BID 16591 VUPEN ADV-2006-0527 XF hivemail-index-xss(24622) Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via a URL encoded expression in the query string in (1) index.php and (2) possibly certain other scripts, which is not properly cleansed when accessed from the $_SERVER['PHP_SELF'] variable. cpe:/a:hivemail:hivemail:1.1 cpe:/a:hivemail:hivemail:1.1.1 cpe:/a:hivemail:hivemail:1.2 cpe:/a:hivemail:hivemail:1.2.1_beta1 cpe:/a:hivemail:hivemail:1.2.1_rc cpe:/a:hivemail:hivemail:1.2.2 cpe:/a:hivemail:hivemail:1.2_sp1 cpe:/a:hivemail:hivemail:1.3 cpe:/a:hivemail:hivemail:1.3_beta1 cpe:/a:hivemail:hivemail:1.3_rc1 CVE-2006-0759 2006-02-17T21:02:00.000-05:00 2017-07-19T21:30:02.910-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060210 HiveMail <= 1.3 Multiple Vulnerabilities MISC http://forum.hivemail.com/showthread.php?p=26745 SREASON 422 MISC http://www.gulftech.org/?node=research&article_id=00098-02102006 BID 16591 VUPEN ADV-2006-0527 XF hivemail-index-sql-injection(24623) Multiple SQL injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the contactgroupid parameter in addressbook.update.php, (2) the messageid parameter in addressbook.add.php, (3) the folderid parameter in folders.update.php, and possibly certain parameters in (4) calendar.event.php, (5) index.php, (6) pop.download.php, (7) read.bounce.php, (8) rules.block.php, (9) language.php, and (10) certain other scripts; and allow remote authenticated users to execute arbitrary SQL commands via (11) the folderid parameter in index.php and (12) possibly other parameters in certain other scripts, because $_SERVER['PHP_SELF'] is improperly handled. cpe:/a:lighttpd:lighttpd:1.0.2 cpe:/a:lighttpd:lighttpd:1.0.3 cpe:/a:lighttpd:lighttpd:1.1.0 cpe:/a:lighttpd:lighttpd:1.1.1 cpe:/a:lighttpd:lighttpd:1.1.2 cpe:/a:lighttpd:lighttpd:1.1.3 cpe:/a:lighttpd:lighttpd:1.1.4 cpe:/a:lighttpd:lighttpd:1.1.5 cpe:/a:lighttpd:lighttpd:1.1.6 cpe:/a:lighttpd:lighttpd:1.1.7 cpe:/a:lighttpd:lighttpd:1.1.8 cpe:/a:lighttpd:lighttpd:1.1.9 cpe:/a:lighttpd:lighttpd:1.2.0 cpe:/a:lighttpd:lighttpd:1.2.1 cpe:/a:lighttpd:lighttpd:1.2.2 cpe:/a:lighttpd:lighttpd:1.2.3 cpe:/a:lighttpd:lighttpd:1.2.4 cpe:/a:lighttpd:lighttpd:1.2.5 cpe:/a:lighttpd:lighttpd:1.2.6 cpe:/a:lighttpd:lighttpd:1.2.7 cpe:/a:lighttpd:lighttpd:1.2.8 cpe:/a:lighttpd:lighttpd:1.3.0 cpe:/a:lighttpd:lighttpd:1.3.1 cpe:/a:lighttpd:lighttpd:1.3.2 cpe:/a:lighttpd:lighttpd:1.3.3 cpe:/a:lighttpd:lighttpd:1.3.4 cpe:/a:lighttpd:lighttpd:1.3.5 cpe:/a:lighttpd:lighttpd:1.3.6 cpe:/a:lighttpd:lighttpd:1.3.7 cpe:/a:lighttpd:lighttpd:1.3.8 cpe:/a:lighttpd:lighttpd:1.3.9 cpe:/a:lighttpd:lighttpd:1.3.10 cpe:/a:lighttpd:lighttpd:1.3.11 cpe:/a:lighttpd:lighttpd:1.3.12 cpe:/a:lighttpd:lighttpd:1.3.13 cpe:/a:lighttpd:lighttpd:1.3.14 cpe:/a:lighttpd:lighttpd:1.3.15 cpe:/a:lighttpd:lighttpd:1.3.16 cpe:/a:lighttpd:lighttpd:1.4.0 cpe:/a:lighttpd:lighttpd:1.4.1 cpe:/a:lighttpd:lighttpd:1.4.2 cpe:/a:lighttpd:lighttpd:1.4.3 cpe:/a:lighttpd:lighttpd:1.4.4 cpe:/a:lighttpd:lighttpd:1.4.5 cpe:/a:lighttpd:lighttpd:1.4.6 cpe:/a:lighttpd:lighttpd:1.4.7 cpe:/a:lighttpd:lighttpd:1.4.8 CVE-2006-0760 2006-02-17T21:02:00.000-05:00 2017-07-19T21:30:02.973-04:00 2.6 NETWORK HIGH NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://www.lighttpd.net/news/ CONFIRM http://lighttpd.net/news/ VUPEN ADV-2006-0550 XF lighttpd-ext-source-disclosure(24699) LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names. cpe:/a:rim:blackberry_enterprise_server:2.2 cpe:/a:rim:blackberry_enterprise_server:2.2_sp2 cpe:/a:rim:blackberry_enterprise_server:2.2_sp2a cpe:/a:rim:blackberry_enterprise_server:2.2_sp3a cpe:/a:rim:blackberry_enterprise_server:2.2_sp4 cpe:/a:rim:blackberry_enterprise_server:2.2_sp4_hotfix2 cpe:/a:rim:blackberry_enterprise_server:3.6::exchange cpe:/a:rim:blackberry_enterprise_server:3.6.1::exchange cpe:/a:rim:blackberry_enterprise_server:3.6_sp1a::exchange cpe:/a:rim:blackberry_enterprise_server:3.6_sp4_hotfix2::exchange cpe:/a:rim:blackberry_enterprise_server:4.0::domino cpe:/a:rim:blackberry_enterprise_server:4.0::novell_groupwise cpe:/a:rim:blackberry_enterprise_server:4.0_sp1::domino cpe:/a:rim:blackberry_enterprise_server:4.0_sp1::novell_groupwise cpe:/a:rim:blackberry_enterprise_server:4.0_sp2::domino cpe:/a:rim:blackberry_enterprise_server:4.0_sp2::novell_groupwise cpe:/a:rim:blackberry_enterprise_server:4.0_sp3::domino cpe:/a:rim:blackberry_enterprise_server:4.0_sp3::novell_groupwise CVE-2006-0761 2006-02-17T21:02:00.000-05:00 2018-10-19T11:46:25.507-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8021/8149/8052/Support_-_Corrupt_Word_file_may_cause_buffer_overflow_in_the_BlackBerry_Attachment_Service.html?nodeid=1181753&vernum=2 BUGTRAQ 20060210 Corrupt Word file may cause buffer overflow in the Blackberry Attachment Service BID 16590 VUPEN ADV-2006-0530 XF blackberry-attachment-word-bo(24629) Buffer overflow in BlackBerry Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server 2.2 and 4.0 before SP3 Hotfix 4 for IBM Lotus Domino, 3.6 before SP7 and 5.0 before SP3 Hotfix 3 for Microsoft Exchangem, and 4.0 for Novell GroupWise before SP3 Hotfix 1 might allow user-assisted remote attackers to execute arbitrary code on the server via a crafted Microsoft Word document that is opened on a wireless device. cpe:/a:winability:folder_guard:4.11 CVE-2006-0762 2006-02-17T21:02:00.000-05:00 2018-10-19T11:46:25.913-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060213 Folder Guard password protection bypass BUGTRAQ 20060213 Re: Folder Guard password protection bypass XF folderguard-fguard-bypass-authentication(24725) WinAbility Folder Guard 4.11 allows local users to gain unauthorized access to certain capabilities of the application by renaming or moving the password file (FGuard.FGP), which disables the password requirement. cpe:/a:cpanel:cpanel CVE-2006-0763 2006-02-17T21:02:00.000-05:00 2017-07-19T21:30:03.130-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060207 Re: cPanel Multiple Cross Site Scripting Vulnerability XF cpanel-dowebmailforward-xss(24839) Cross-site scripting (XSS) vulnerability in dowebmailforward.cgi in cPanel allows remote attackers to inject arbitrary web script or HTML via a URL encoded value in the fwd parameter. cpe:/h:cisco:anomaly_guard_module:5.0%281%29 cpe:/h:cisco:anomaly_guard_module:5.0%283%29 cpe:/h:cisco:guard:5.0%281%29 cpe:/h:cisco:guard:5.0%283%29 cpe:/h:cisco:traffic_anomaly_detector_module:5.0%281%29 cpe:/h:cisco:traffic_anomaly_detector_module:5.0%283%29 CVE-2006-0764 2006-02-17T21:02:00.000-05:00 2017-07-19T21:30:03.190-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SREASON 435 SECTRACK 1015637 SECTRACK 1015638 CISCO 20060215 TACACS+ Authentication Bypass in Cisco Anomaly Detection and Mitigation Products BID 16661 VUPEN ADV-2006-0612 XF cisco-tacacs-auth-bypass(24689) The Authentication, Authorization, and Accounting (AAA) capability in versions 5.0(1) and 5.0(3) of the software used by multiple Cisco Anomaly Detection and Mitigation products, when running with an incomplete TACACS+ configuration without a "tacacs-server host" command, allows remote attackers to bypass authentication and gain privileges, aka Bug ID CSCsd21455. cpe:/a:mirabilis:icq:2003a cpe:/a:mirabilis:icq:2003b cpe:/a:mirabilis:icq_lite:4.0 cpe:/a:mirabilis:icq_lite:4.1 CVE-2006-0765 2006-02-17T21:02:00.000-05:00 2018-10-19T11:46:26.227-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BUGTRAQ 20060215 Mirabiliz ICQ 2002/2003/ LITE 4.0/4.1 LONG (DIRECTORY + FILENAME) EXPLOIT BID 16655 GUI display truncation vulnerability in ICQ Inc. (formerly Mirabilis) ICQ 2003a, 2003b, Lite 4.0, Lite 4.1, and possibly other Windows versions allows user-assisted remote attackers to hide malicious file extensions, bypass Windows security warnings via a filename that is all uppercase and of a specific length, which truncates the malicious extension from the display and could trick a user into executing arbitrary programs. cpe:/a:mirabilis:icq:2003a cpe:/a:mirabilis:icq:2003b cpe:/a:mirabilis:icq_lite:4.0 cpe:/a:mirabilis:icq_lite:4.1 CVE-2006-0766 2006-02-17T21:02:00.000-05:00 2018-10-19T11:46:26.507-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BUGTRAQ 20060215 Mirabiliz ICQ 2002/2003/ LITE 4.0/4.1 LONG (DIRECTORY + FILENAME) EXPLOIT BID 16655 ICQ Inc. (formerly Mirabilis) ICQ 2003a, 2003b, Lite 4.0, Lite 4.1, and possibly other Windows versions allows user-assisted remote attackers to hide malicious file extensions and bypass Windows security warnings via a filename that ends in an assumed-safe extension such as JPG, and possibly containing other modified properties such as company name, icon, and description, which could trick a user into executing arbitrary programs. cpe:/a:nathan_neulinger:cgiwrap:3.0 cpe:/a:nathan_neulinger:cgiwrap:3.1 cpe:/a:nathan_neulinger:cgiwrap:3.2 cpe:/a:nathan_neulinger:cgiwrap:3.3 cpe:/a:nathan_neulinger:cgiwrap:3.4 cpe:/a:nathan_neulinger:cgiwrap:3.5 cpe:/a:nathan_neulinger:cgiwrap:3.5_beta cpe:/a:nathan_neulinger:cgiwrap:3.6 cpe:/a:nathan_neulinger:cgiwrap:3.6.1 cpe:/a:nathan_neulinger:cgiwrap:3.6.2 cpe:/a:nathan_neulinger:cgiwrap:3.6.3 cpe:/a:nathan_neulinger:cgiwrap:3.6.4 cpe:/a:nathan_neulinger:cgiwrap:3.6_beta1 cpe:/a:nathan_neulinger:cgiwrap:3.6_beta2 cpe:/a:nathan_neulinger:cgiwrap:3.6_beta3 cpe:/a:nathan_neulinger:cgiwrap:3.6_beta4 cpe:/a:nathan_neulinger:cgiwrap:3.6_beta5 cpe:/a:nathan_neulinger:cgiwrap:3.6_beta6 cpe:/a:nathan_neulinger:cgiwrap:3.6_beta7 cpe:/a:nathan_neulinger:cgiwrap:3.6_beta8 cpe:/a:nathan_neulinger:cgiwrap:3.7 cpe:/a:nathan_neulinger:cgiwrap:3.8 cpe:/a:nathan_neulinger:cgiwrap:3.8_rc1 cpe:/a:nathan_neulinger:cgiwrap:3.9 cpe:/a:nathan_neulinger:cgiwrap:3.11 cpe:/a:nathan_neulinger:cgiwrap:3.21 cpe:/a:nathan_neulinger:cgiwrap:3.22 cpe:/a:nathan_neulinger:cgiwrap:3.23 cpe:/a:nathan_neulinger:cgiwrap:3.24 CVE-2006-0767 2006-02-18T16:02:00.000-05:00 2017-07-19T21:30:03.253-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://sourceforge.net/project/showfiles.php?group_id=8209 CONFIRM http://sourceforge.net/project/shownotes.php?release_id=393274&group_id=8209 BID 16669 VUPEN ADV-2006-0601 XF cgiwrap-error-information-disclosure(24717) CGIWrap before 3.10 allows remote attackers to obtain sensitive information via unknown attack vectors that cause errors in scripts that reveal system information. cpe:/a:kadu:kadu:0.4.3 CVE-2006-0768 2006-02-18T16:02:00.000-05:00 2018-10-19T11:46:26.697-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov FULLDISC 20060215 Kadu Remote Denial Of Service Fun MISC http://www.piotrbania.com/all/adv/kadu-fun.txt BUGTRAQ 20060215 Kadu Remote Denial Of Service Fun VUPEN ADV-2006-0609 XF kadu-image-request-dos(24720) Kadu 0.4.3 allows remote attackers to cause a denial of service (application crash) via a large number of image send requests. cpe:/o:sun:solaris:10.0::sparc CVE-2006-0769 2006-02-18T16:02:00.000-05:00 2017-10-10T21:30:39.953-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015635 SUNALERT 102186 CIAC Q-126 BID 16658 VUPEN ADV-2006-0608 XF solaris-kerberos-command-execution(24680) Unspecified vulnerability in in.rexecd in Solaris 10 allows local users to gain privileges on Kerberos systems via unknown attack vectors. cpe:/a:mybulletinboard:mybulletinboard:1.0.1 cpe:/a:mybulletinboard:mybulletinboard:1.0.2 cpe:/a:mybulletinboard:mybulletinboard:1.0.3 cpe:/a:mybulletinboard:mybulletinboard:1.0.4 cpe:/a:mybulletinboard:mybulletinboard:1.0_final cpe:/a:mybulletinboard:mybulletinboard:1.0_pr2 cpe:/a:mybulletinboard:mybulletinboard:1.0_preview_release_2 cpe:/a:mybulletinboard:mybulletinboard:1.0_rc2 cpe:/a:mybulletinboard:mybulletinboard:1.0_rc4 CVE-2006-0770 2006-02-18T16:02:00.000-05:00 2017-07-19T21:30:03.427-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov VUPEN ADV-2006-0635 XF mybb-advanceddetails-xss(24748) Cross-site scripting (XSS) vulnerability in calendar.php in MyBulletinBoard (MyBB) 1.0.4 allows remote attackers to inject arbitrary web script or HTML via a URL that is not sanitized before being returned as a link in "advanced details". NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:even_balance:punkbuster:1.180 CVE-2006-0771 2006-02-18T16:02:00.000-05:00 2018-10-19T11:46:27.210-04:00 6.4 NETWORK LOW NONE NONE PARTIAL PARTIAL http://nvd.nist.gov MISC http://aluigi.altervista.org/adv/sof2pbfs-adv.txt FULLDISC 20060216 Soldier of Fortune II format string through PunkBuster 1.180 SREASON 448 BUGTRAQ 20060216 Soldier of Fortune II format string through PunkBuster 1.180 BID 16703 XF punkbuster-cvars-format-string(24792) Format string vulnerability in PunkBuster 1.180 and earlier, as used by Soldier of Fortune II and possibly other games, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in invalid cvar values, which are not properly handled when the server kicks the player and records the reason. cpe:/a:hitachi:business_logic:02_03::windows cpe:/a:hitachi:business_logic:03_00::linux cpe:/a:hitachi:business_logic:03_00_b::linux cpe:/a:hitachi:business_logic:03_00_b::windows CVE-2006-0772 2006-02-18T19:02:00.000-05:00 2017-07-19T21:30:03.537-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://www.hitachi-support.com/security_e/vuls_e/HS06-002_e/index-e.html BID 16602 VUPEN ADV-2006-0532 XF hitachi-businesslogic-input-sql-injection(23877) XF hitachi-businesslogic-recbox-sql-injection(24621) SQL injection vulnerability in Hitachi Business Logic - Container 02-03 through 03-00-/B on Windows, and 03-00 through 03-00-/B on Linux, allows remote attackers to execute arbitrary SQL commands via unspecified vectors in the extended receiving box function. cpe:/a:hitachi:business_logic:02_03::windows cpe:/a:hitachi:business_logic:03_00::linux cpe:/a:hitachi:business_logic:03_00_b::linux cpe:/a:hitachi:business_logic:03_00_b::windows CVE-2006-0773 2006-02-18T19:02:00.000-05:00 2017-07-19T21:30:03.597-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://www.hitachi-support.com/security_e/vuls_e/HS06-002_e/index-e.html BID 16602 VUPEN ADV-2006-0532 XF hitachi-businesslogic-recbox-xss(24620) Cross-site scripting (XSS) vulnerability in Hitachi Business Logic - Container 02-03 through 03-00-/B on Windows, and 03-00 through 03-00-/B on Linux, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the extended receiving box function. cpe:/a:lawrence_osiris:db_esession:1.0.2 CVE-2006-0774 2006-02-18T19:02:00.000-05:00 2018-10-19T11:46:27.680-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.gulftech.org/?node=research&article_id=00099-02112006 BUGTRAQ 20060211 DB_eSession deleteSession() SQL injection BUGTRAQ 20060501 Re: DB_eSession deleteSession() SQL injection BID 16598 VUPEN ADV-2006-0528 XF dbesession-deletesession-sql-injection(24673) SQL injection vulnerability in deleteSession() in DB_eSession library 1.0.2 and earlier, as used in multiple products, allows remote attackers to execute arbitrary SQL commands via the $_sess_id_set variable, which is usually derived from PHPSESSID. cpe:/a:ridder_roeland:birthsys:3.1 CVE-2006-0775 2006-02-18T19:02:00.000-05:00 2017-07-19T21:30:03.723-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS VIM 20060215 EV0074 BirthSys 3.1 SQL injection (fwd) SREASON 467 MISC http://www.evuln.com/vulns/74/summary.html BID 16684 VUPEN ADV-2006-0621 XF birthsys-show-date-sql-injection(24617) Multiple SQL injection vulnerabilities in show.php in BirthSys 3.1 allow remote attackers to execute arbitrary SQL commands via the $month variable. NOTE: a vector regarding the $date parameter and data.php (date.php) was originally reported, but this appears to be in error. cpe:/a:teca_scripts:guestex:1.0 CVE-2006-0776 2006-02-18T19:02:00.000-05:00 2018-10-19T11:46:28.273-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 490 SECTRACK 1015678 MISC http://www.evuln.com/vulns/77/summary.html BUGTRAQ 20060224 [eVuln] Guestex XSS Vulnerability BID 16711 VUPEN ADV-2006-0640 XF guestex-script-xss(24644) Cross-site scripting (XSS) vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter. cpe:/a:teca_scripts:guestex:1.0 CVE-2006-0777 2006-02-18T19:02:00.000-05:00 2018-10-19T11:46:28.820-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SREASON 489 MISC http://www.evuln.com/vulns/76/summary.html BUGTRAQ 20060224 [eVuln] Guestex Shell Command Execution Vulnerability BID 16711 VUPEN ADV-2006-0640 XF guestex-script-execute-code(24645) Unspecified vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to execute arbitrary shell commands via the email parameter, possibly involving shell metacharacters. cpe:/a:xmb_forum:xmb:1.9.3 CVE-2006-0778 2006-02-18T19:02:00.000-05:00 2018-10-18T12:29:01.477-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.gulftech.org/?node=research&article_id=00100-02122006 BUGTRAQ 20060212 XMB Forums Multiple Vulnerabilities BID 16604 VUPEN ADV-2006-0529 MISC http://www.xmbforum.com/ XF xmbforum-multiple-sql-injection(24646) Multiple SQL injection vulnerabilities in XMB Forums 1.9.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) $u2u_select array parameter to u2u.inc.php and (2) $val variable (fidpw0 cookie value) in today.php. cpe:/a:xmb_forum:xmb:1.9.3 CVE-2006-0779 2006-02-18T19:02:00.000-05:00 2018-10-18T12:29:02.117-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://www.gulftech.org/?node=research&article_id=00100-02122006 BUGTRAQ 20060212 XMB Forums Multiple Vulnerabilities BID 16604 VUPEN ADV-2006-0529 MISC http://www.xmbforum.com/ XF xmbforum-u2u-xss(24647) Cross-site scripting (XSS) vulnerability in u2u.php in XMB Forums 1.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter, as demonstrated using a URL-encoded iframe tag. cpe:/a:perlblog:perlblog:1.08 cpe:/a:perlblog:perlblog:1.09 cpe:/a:perlblog:perlblog:1.09b CVE-2006-0780 2006-02-19T06:02:00.000-05:00 2018-10-18T12:29:02.617-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/81/summary.html SREASON 508 BUGTRAQ 20060227 [eVuln] PerlBlog Multiple Vulnerabilities BID 16707 XF perlblog-weblog-xss(24691) Multiple cross-site scripting (XSS) vulnerabilities in weblog.pl in PerlBlog 1.09b and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) email parameters. cpe:/a:perlblog:perlblog:1.08 cpe:/a:perlblog:perlblog:1.09 cpe:/a:perlblog:perlblog:1.09b CVE-2006-0781 2006-02-19T06:02:00.000-05:00 2018-10-18T12:29:03.023-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://evuln.com/vulns/81/summary.html SREASON 508 BUGTRAQ 20060227 [eVuln] PerlBlog Multiple Vulnerabilities BID 16707 XF perlblog-weblog-directory-traversal(24690) Directory traversal vulnerability in weblog.pl in PerlBlog 1.09b and earlier allows remote attackers to read certain files via the month parameter. cpe:/a:perlblog:perlblog:1.08 cpe:/a:perlblog:perlblog:1.09 cpe:/a:perlblog:perlblog:1.09b CVE-2006-0782 2006-02-19T06:02:00.000-05:00 2018-10-18T12:29:03.447-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://evuln.com/vulns/81/summary.html SREASON 508 BUGTRAQ 20060227 [eVuln] PerlBlog Multiple Vulnerabilities BID 16707 XF perlblog-weblog-command-execution(24692) Unspecified vulnerability in weblog.pl in PerlBlog 1.09b and earlier allows remote attackers to create arbitrary files and possibly execute arbitrary code via unspecified attack vectors related to improper handling of (1) the reply parameter, possibly involving injection of (2) the name parameter and (3) the body parameter. cpe:/a:siteframe:siteframe_beaumont:5.0.1 cpe:/a:siteframe:siteframe_beaumont:5.0.1a cpe:/a:siteframe:siteframe_beaumont:5.0.2 CVE-2006-0783 2006-02-19T06:02:00.000-05:00 2018-10-18T12:29:03.883-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 443 BUGTRAQ 20060216 Siteframe Beaumont 5.0.2 <== User Comment Cross-Site Scripting Vulnerability BID 16695 XF siteframe-comment-xss(24836) Cross-site scripting (XSS) vulnerability in page.php in in Siteframe Beaumont, possibly 5.0.2 or 5.0.1a, allows remote attackers to inject arbitrary web script or HTML via the comment_text parameter to the user comment page (/edit/Comment). cpe:/h:d-link:dwl-g700ap:2.00 cpe:/h:d-link:dwl-g700ap:2.01 CVE-2006-0784 2006-02-19T06:02:00.000-05:00 2018-10-18T12:29:04.320-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SREASON 441 BUGTRAQ 20060216 D-Link DWL-G700AP httpd DoS BID 16690 VUPEN ADV-2006-0637 XF dlink-admin-interface-dos(24762) D-Link DWL-G700AP with firmware 2.00 and 2.01 allows remote attackers to cause a denial of service (CAMEO HTTP service crash) via a request composed of "GET" followed by a space and two newlines, possibly triggering the crash due to missing arguments. cpe:/a:phpkit:phpkit:1.6.1:rc2 CVE-2006-0785 2006-02-19T06:02:00.000-05:00 2018-10-18T12:29:04.773-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov MISC http://retrogod.altervista.org/phpkit_161r2_incl_xpl.html SECTRACK 1015640 BUGTRAQ 20060216 PHPKIT >= 1.6.1r2 arbitrary local/remote inclusion (unproperly patched in previous versions) Absolute path traversal vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier allows remote attackers to include and execute arbitrary local files via a direct request with a path parameter with a null character and beginning with (1) '/' (slash) for an absolute pathname or (2) a drive letter (such as "C:"), which bypasses checks for ".." sequences and trailing ".php" extensions. cpe:/a:phpkit:phpkit:1.6.1:rc2 CVE-2006-0786 2006-02-19T06:02:00.000-05:00 2018-10-18T12:29:04.977-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://retrogod.altervista.org/phpkit_161r2_incl_xpl.html SREASON 445 SECTRACK 1015640 BUGTRAQ 20060216 PHPKIT >= 1.6.1r2 arbitrary local/remote inclusion (unproperly patched in previous versions) Incomplete blacklist vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier, with allow_url_fopen enabled, allows remote attackers to conduct PHP remote file include attacks via a path parameter that specifies a (1) UNC share or (2) ftps URL, which bypasses the check for "http://", "ftp://", and "https://" URLs. cpe:/a:plaino:wimpy_mp3:5.2 CVE-2006-0787 2006-02-19T06:02:00.000-05:00 2017-07-19T21:30:04.237-04:00 4.0 NETWORK HIGH NONE NONE PARTIAL PARTIAL http://nvd.nist.gov BID 16696 MISC http://www.xorcrew.net/xpa/XPA-WimpyMP3Player.txt XF wimpy-wimpytrackplays-no-auth(24770) wimpy_trackplays.php in Plaino Wimpy MP3 Player, possibly 5.2 and earlier, allows remote attackers to insert arbitrary strings into trackme.txt via the (1) trackFile, (2) trackArtist, and (3) trackTitle parameters, which can result in providing false information about songs, occupying excessive disk space with very long parameter values, and storing executable code that might be invoked through a different vulnerability. NOTE: since this issue, as described by the original researcher, is entirely dependent on the presence of another vulnerability, it could be argued that Wimpy cannot be responsible for how its data file is processed by applications outside of its control. Since this issue might only be useful as a facilitator manipulation in another vulnerability, perhaps it should not be included in CVE. cpe:/h:kyocera:fs-3830n CVE-2006-0788 2006-02-19T06:02:00.000-05:00 2017-07-19T21:30:04.287-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060215 Kyocera Network Printers MISC http://evader.wordpress.com/2006/02/16/kyocera-printers/ BID 16685 VUPEN ADV-2006-0620 XF kyocera-fs3830n-no-auth(24772) Kyocera 3830 (aka FS-3830N) printers have a back door that allows remote attackers to read and alter configuration settings via strings that begin with "!R!SIOP0", as demonstrated using (1) a connection to to TCP port 9100 or (2) the UNIX lp command. cpe:/h:kyocera:fs-3830n CVE-2006-0789 2006-02-19T06:02:00.000-05:00 2017-07-19T21:30:04.347-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS FULLDISC 20060215 Kyocera Network Printers MISC http://evader.wordpress.com/2006/02/16/kyocera-printers/ VUPEN ADV-2006-0620 XF kyocera-fs3830n-blank-password(24774) Certain unspecified Kyocera printers have a default "admin" account with a blank password, which allows remote attackers to access an administrative menu via a telnet session. cpe:/a:rockliffe:mailsite:4.2.10 cpe:/a:rockliffe:mailsite:5 cpe:/a:rockliffe:mailsite:5.3.4 cpe:/a:rockliffe:mailsite:6.1.22 cpe:/a:rockliffe:mailsite:7.0.31 CVE-2006-0790 2006-02-19T16:02:00.000-05:00 2017-07-19T21:30:04.410-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MLIST [Dailydave] 20060214 MailSite (WorldMail) fun BID 16675 VUPEN ADV-2006-0598 XF mailsite-ldap-dos(24686) Rockliffe MailSite 7.0 and earlier allows remote attackers to cause a denial of service by sending crafted LDAP packets to port 389/TCP, as demonstrated by the ProtoVer LDAP testsuite. cpe:/a:dreamcost:hostadmin:3.0 CVE-2006-0791 2006-02-19T16:02:00.000-05:00 2018-10-18T12:29:05.243-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060215 HostAdmin - Remote Command Execution Vulnerability SECTRACK 1016273 BUGTRAQ 20060605 [MajorSecurity #9]HostAdmin <= 3.1 - Remote File Include Vulnerability BUGTRAQ 20081007 HostAdmin 3.* Remote File Include Vulnerabilities BUGTRAQ 20081007 Re: HostAdmin 3.* Remote File Include Vulnerabilities BID 16682 VUPEN ADV-2006-0618 MISC http://www.xorcrew.net/xpa/XPA-HostAdmin.txt XF hostadmin-path-file-include(24723) PHP remote file inclusion vulnerability in index.php in DreamCost HostAdmin allows remote attackers to include arbitrary files via the $path variable, which is not initialized before use. cpe:/a:v-webmail:v-webmail:1.6.1 cpe:/a:v-webmail:v-webmail:1.6.2 CVE-2006-0792 2006-02-19T16:02:00.000-05:00 2017-07-19T21:30:04.537-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16706 VUPEN ADV-2006-0639 XF vwebmail-preferencespersonal-xss(24749) Cross-site scripting (XSS) vulnerability in preferences.personal.php in V-webmail 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the newid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:v-webmail:v-webmail:1.6.1 cpe:/a:v-webmail:v-webmail:1.6.2 CVE-2006-0793 2006-02-19T16:02:00.000-05:00 2017-07-19T21:30:04.583-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16706 VUPEN ADV-2006-0639 XF vwebmail-frameset-spoofing(24753) frameset.php in V-webmail 1.6.2 allows remote attackers to conduct phishing attacks by referencing arbitrary websites in the rframe parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:v-webmail:v-webmail:1.6.1 cpe:/a:v-webmail:v-webmail:1.6.2 CVE-2006-0794 2006-02-19T16:02:00.000-05:00 2017-07-19T21:30:04.660-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov VUPEN ADV-2006-0639 XF vwebmail-help-path-disclosure(24754) help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:thomastsoi:quirex:2.0 cpe:/a:thomastsoi:quirex:2.0.2 CVE-2006-0795 2006-02-19T16:02:00.000-05:00 2018-10-18T12:29:06.087-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://evuln.com/vulns/78/summary.html BUGTRAQ 20060226 [eVuln] Quirex Arbitrary File Disclosure Vulnerability BID 16709 VUPEN ADV-2006-0641 XF quirex-convert-information-disclosure(24672) Absolute path traversal vulnerability in convert.cgi in Quirex 2.0.2 and earlier allows remote attackers to read arbitrary files, and possibly execute arbitrary code, via the (1) quiz_head, (2) quiz_foot, and (3) template variables. cpe:/a:clever_copy:clever_copy:3.0 CVE-2006-0796 2006-02-19T16:02:00.000-05:00 2017-07-19T21:30:04.800-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16681 VUPEN ADV-2006-0616 XF clevercopy-subject-xss(24747) Cross-site scripting (XSS) vulnerability in default.php in Clever Copy 3.0 allows remote attackers to inject arbitrary web script or HTML via the Subject field when sending private messages (privatemessages.php). NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/h:nokia:n70 CVE-2006-0797 2006-02-19T16:02:00.000-05:00 2017-07-19T21:30:04.847-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov FULLDISC 20060215 [ Secuobs - Advisory ] Another kind of DoS on Nokia cell phones MISC http://www.secuobs.com/news/15022006-nokia_n70.shtml#english BID 16666 VUPEN ADV-2006-0538 XF nokia-bluetooth-l2cap-dos(24688) Nokia N70 cell phone allows remote attackers to cause a denial of service (reboot or shutdown) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet whose length field is less than the actual length of the packet, possibly triggering a buffer overflow, as demonstrated using the Bluetooth Stack Smasher (BSS). cpe:/a:macallan:mail_solution:4.8.03.025 CVE-2006-0798 2006-02-19T16:02:00.000-05:00 2017-07-19T21:30:04.910-04:00 5.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL NONE http://nvd.nist.gov MISC http://macallan.club.fr/MMS/index.html SECTRACK 1015647 BID 16704 VUPEN ADV-2006-0644 XF macallan-imap-directory-traversal(24761) Multiple directory traversal vulnerabilities in the IMAP service in Macallan Mail Solution before 4.8.05.004 allow remote authenticated users to read e-mails of other users or create, modify, or delete directories via a .. (dot dot) in the argument to the (1) CREATE, (2) SELECT, (3) DELETE, or (4) RENAME commands. cpe:/a:microsoft:ie:6.0.2900 CVE-2006-0799 2006-02-19T16:02:00.000-05:00 2018-10-18T12:29:06.507-04:00 4.0 NETWORK HIGH NONE PARTIAL PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060216 Internet Explorer Phishing mouseover issue BUGTRAQ 20060218 Re: Internet Explorer Phishing mouseover issue BUGTRAQ 20060223 Re: Internet Explorer Phishing mouseover issue XF ie-ahref-status-spoofing(17938) Microsoft Internet Explorer allows remote attackers to spoof a legitimate URL in the status bar and conduct a phishing attack via a web page with an anchor element with a legitimate "href" attribute, a form whose action points to a malicious URL, and an INPUT submit element that is modified to look like a legitimate URL. NOTE: this issue is very similar to CVE-2004-1104, although the manipulations are slightly different. cpe:/a:postnuke_software_foundation:postnuke:0.7 cpe:/a:postnuke_software_foundation:postnuke:0.62 cpe:/a:postnuke_software_foundation:postnuke:0.63 cpe:/a:postnuke_software_foundation:postnuke:0.64 cpe:/a:postnuke_software_foundation:postnuke:0.70 cpe:/a:postnuke_software_foundation:postnuke:0.71 cpe:/a:postnuke_software_foundation:postnuke:0.72 cpe:/a:postnuke_software_foundation:postnuke:0.73 cpe:/a:postnuke_software_foundation:postnuke:0.74 cpe:/a:postnuke_software_foundation:postnuke:0.75 cpe:/a:postnuke_software_foundation:postnuke:0.75_rc3 cpe:/a:postnuke_software_foundation:postnuke:0.76_rc4 cpe:/a:postnuke_software_foundation:postnuke:0.76_rc4a cpe:/a:postnuke_software_foundation:postnuke:0.76_rc4b cpe:/a:postnuke_software_foundation:postnuke:0.703 cpe:/a:postnuke_software_foundation:postnuke:0.721 cpe:/a:postnuke_software_foundation:postnuke:0.726.3 cpe:/a:postnuke_software_foundation:postnuke:0.761 cpe:/a:postnuke_software_foundation:postnuke:0.761a CVE-2006-0800 2006-02-20T17:02:00.000-05:00 2017-07-19T21:30:05.050-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060219 Multiple vulnerabilities in PostNuke <= 0.761 CONFIRM http://news.postnuke.com/index.php?name=News&file=article&sid=2754 SREASON 454 BID 16752 VUPEN ADV-2006-0673 XF postnuke-user-nslanguages-xss(24823) Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing "<" character, which is interpreted as a ">" character by some web browsers but bypasses the blacklist protection in (1) the pnVarCleanFromInput function in pnAPI.php, (2) the pnSecureInput function in pnAntiCracker.php, and (3) the htmltext parameter in an edituser operation to user.php. cpe:/a:postnuke_software_foundation:postnuke:0.761 CVE-2006-0801 2006-02-20T17:02:00.000-05:00 2017-07-19T21:30:05.130-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060219 Multiple vulnerabilities in PostNuke <= 0.761 CONFIRM http://news.postnuke.com/index.php?name=News&file=article&sid=2754 SREASON 454 BID 16752 VUPEN ADV-2006-0673 XF postnuke-nslanguages-sql-injection(24827) SQL injection vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is off, allows remote attackers to execute arbitrary SQL commands via the language parameter to admin.php. cpe:/a:postnuke_software_foundation:postnuke:0.761 CVE-2006-0802 2006-02-20T17:02:00.000-05:00 2017-07-19T21:30:05.177-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060219 Multiple vulnerabilities in PostNuke <= 0.761 CONFIRM http://news.postnuke.com/index.php?name=News&file=article&sid=2754 MISC http://securityreason.com/securityalert/454 BID 16752 VUPEN ADV-2006-0673 XF postnuke-user-nslanguages-xss(24823) Cross-site scripting (XSS) vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is enabled, allows remote attackers to inject arbitrary web script or HTML via the language parameter in a missing or translation operation. cpe:/o:novell:suse_linux:10.0 cpe:/o:suse:suse_linux:9.3 CVE-2006-0803 2006-02-23T15:02:00.000-05:00 2018-10-30T12:25:12.513-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov 2006-02-24T12:17:00.000-05:00 SUSE SUSE-SA:2006:009 SUSE SUSE-SA:2006:013 BID 16889 The signature verification functionality in the YaST Online Update (YOU) script handling relies on a gpg feature that is not intended for signature verification, which prevents YOU from detecting malicious scripts or code that do not pass the signature check when gpg 1.4.x is being used. cpe:/a:tin:tin:1.0_pl0 cpe:/a:tin:tin:1.0_pl1 cpe:/a:tin:tin:1.0_pl2 cpe:/a:tin:tin:1.0_pl3 cpe:/a:tin:tin:1.0_pl4 cpe:/a:tin:tin:1.0_pl5 cpe:/a:tin:tin:1.1_pl0 cpe:/a:tin:tin:1.1_pl1 cpe:/a:tin:tin:1.1_pl2 cpe:/a:tin:tin:1.1_pl3 cpe:/a:tin:tin:1.1_pl4 cpe:/a:tin:tin:1.1_pl5 cpe:/a:tin:tin:1.1_pl6 cpe:/a:tin:tin:1.1_pl7 cpe:/a:tin:tin:1.1_pl8 cpe:/a:tin:tin:1.1_pl9 cpe:/a:tin:tin:1.2_pl0 cpe:/a:tin:tin:1.2_pl1 cpe:/a:tin:tin:1.2_pl2 cpe:/a:tin:tin:1.4.0 cpe:/a:tin:tin:1.4.1 cpe:/a:tin:tin:1.4.2 cpe:/a:tin:tin:1.4.3 cpe:/a:tin:tin:1.4.4 cpe:/a:tin:tin:1.4.5 cpe:/a:tin:tin:1.4.6 cpe:/a:tin:tin:1.4.7 cpe:/a:tin:tin:1.6.0 cpe:/a:tin:tin:1.6.1 cpe:/a:tin:tin:1.6.2 cpe:/a:tin:tin:1.8.0 CVE-2006-0804 2006-02-20T20:02:00.000-05:00 2017-07-19T21:30:05.270-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS GENTOO GLSA-200611-18 SUSE SUSE-SR:2006:005 OPENPKG OpenPKG-SA-2006.005 BID 16728 VUPEN ADV-2006-0702 XF tin-offbyone-bo(24841) Off-by-one error in TIN 1.8.0 and earlier might allow attackers to execute arbitrary code via unknown vectors that trigger a buffer overflow. cpe:/a:francisco_burzi:php-nuke:6.0 cpe:/a:francisco_burzi:php-nuke:6.5 cpe:/a:francisco_burzi:php-nuke:6.5_beta1 cpe:/a:francisco_burzi:php-nuke:6.5_final cpe:/a:francisco_burzi:php-nuke:6.5_rc1 cpe:/a:francisco_burzi:php-nuke:6.5_rc2 cpe:/a:francisco_burzi:php-nuke:6.5_rc3 cpe:/a:francisco_burzi:php-nuke:6.6 cpe:/a:francisco_burzi:php-nuke:6.7 cpe:/a:francisco_burzi:php-nuke:6.9 cpe:/a:francisco_burzi:php-nuke:7.0 cpe:/a:francisco_burzi:php-nuke:7.0_final cpe:/a:francisco_burzi:php-nuke:7.1 cpe:/a:francisco_burzi:php-nuke:7.2 cpe:/a:francisco_burzi:php-nuke:7.3 cpe:/a:francisco_burzi:php-nuke:7.4 cpe:/a:francisco_burzi:php-nuke:7.5 cpe:/a:francisco_burzi:php-nuke:7.6 cpe:/a:francisco_burzi:php-nuke:7.7 cpe:/a:francisco_burzi:php-nuke:7.8 cpe:/a:francisco_burzi:php-nuke:7.9 CVE-2006-0805 2006-02-20T21:02:00.000-05:00 2018-10-18T12:29:06.977-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 455 BUGTRAQ 20060218 [waraxe-2006-SA#045] - Bypassing CAPTCHA in phpNuke 6.x-7.9 BID 16722 MISC http://www.waraxe.us/advisory-45.html The CAPTCHA functionality in php-Nuke 6.0 through 7.9 uses fixed challenge/response pairs that only vary once per day based on the User Agent (HTTP_USER_AGENT), which allows remote attackers to bypass CAPTCHA controls by fixing the User Agent, performing a valid challenge/response, then replaying that pair in the random_num and gfx_check parameters. cpe:/a:john_lim:adodb:4.66 cpe:/a:john_lim:adodb:4.68 cpe:/a:john_lim:adodb:4.70 cpe:/a:john_lim:adodb:4.71 CVE-2006-0806 2006-02-20T21:02:00.000-05:00 2018-10-18T12:29:07.320-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://phpesp.cvs.sourceforge.net/phpesp/phpESP/admin/include/lib/adodb/adodb-pager.inc.php?r1=1.1&r2=1.2 SREASON 452 CONFIRM http://sourceforge.net/project/shownotes.php?release_id=419843&group_id=8956 DEBIAN DSA-1029 DEBIAN DSA-1030 DEBIAN DSA-1031 GENTOO GLSA-200604-07 MISC http://www.gulftech.org/?node=research&article_id=00101-02182006 BUGTRAQ 20060218 ADOdb Library Cross Site Scripting BID 16720 VUPEN ADV-2006-0664 VUPEN ADV-2006-2021 Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via (1) the next_page parameter in adodb-pager.inc.php and (2) other unspecified vectors related to PHP_SELF. cpe:/a:njstar:chinese_word_processor:5.01.41108 cpe:/a:njstar:japanese_word_processor:5.01.41108 CVE-2006-0807 2006-02-20T21:02:00.000-05:00 2018-10-18T12:29:08.553-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SREASON 461 SECTRACK 1015649 CONFIRM http://www.njstar.com/njstar/chinese/ CONFIRM http://www.njstar.com/njstar/japanese/ BUGTRAQ 20060220 Secunia Research: NJStar Word Processor Font Name Buffer Overflow BID 16737 VUPEN ADV-2006-0670 XF njstar-font-name-bo(24773) Stack-based buffer overflow in NJStar Chinese and Japanese Word Processor 4.x and 5.x before 5.10 allows user-assisted attackers to execute arbitrary code via font names in NJStar (.njx) documents. cpe:/a:mute:mute:0.4 CVE-2006-0808 2006-02-20T21:02:00.000-05:00 2017-07-19T21:30:05.410-04:00 6.4 NETWORK LOW NONE PARTIAL NONE PARTIAL http://nvd.nist.gov CONFIRM http://cvs.sourceforge.net/viewcvs.py/mute-net/MUTE/doc/notes/notes.txt?view=markup XF mute-mwebcache-security-bypass(24931) MUTE 0.4 allows remote attackers to cause a denial of service (messages not forwarded) and obtain sensitive information about a target by filling a client's mWebCache cache with malicious "zombie" nodes. cpe:/a:skate_board:skate_board:0.9 CVE-2006-0809 2006-02-20T21:02:00.000-05:00 2017-07-19T21:30:05.473-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/84/summary.html SREASON 540 BUGTRAQ 20060303 [eVuln] Skate Board Multimple Vulnerabilities BID 16936 XF skateboard-sendpass-sql-injection(24778) XF skateboard-authentication-bypass(24779) Multiple SQL injection vulnerabilities in Skate Board 0.9 allow remote attackers to execute arbitrary SQL commands via the (1) usern parameter in (a) sendpass.php, and the (2) usern and (3) passwd parameters and (4) sf_cookie cookie in (b) login.php and (c) logged.php. cpe:/a:skate_board:skate_board:0.9 CVE-2006-0810 2006-02-20T21:02:00.000-05:00 2017-07-19T21:30:05.520-04:00 3.5 NETWORK MEDIUM SINGLE_INSTANCE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/84/summary.html SREASON 540 BUGTRAQ 20060303 [eVuln] Skate Board Multimple Vulnerabilities BID 16936 XF skateboard-config-file-include(24780) Unspecified vulnerability in config.php in Skate Board 0.9 allows remote authenticated administrators to execute arbitrary PHP code by causing certain variables in config.php to be modified, possibly due to XSS or direct static code injection. cpe:/a:skate_board:skate_board:0.9 CVE-2006-0811 2006-02-20T21:02:00.000-05:00 2017-07-19T21:30:05.567-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/84/summary.html SREASON 540 BUGTRAQ 20060303 [eVuln] Skate Board Multimple Vulnerabilities BID 16936 XF skateboard-registration-xss(24781) Cross-site scripting (XSS) vulnerability in reguser.php in Skate Board 0.9 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters involved with the registration form. cpe:/a:visnetic:visnetic_antivirus_plug-in_for_mail_server:4.6.0.4 cpe:/a:visnetic:visnetic_antivirus_plug-in_for_mail_server:4.6.1.1 CVE-2006-0812 2006-02-23T15:02:00.000-05:00 2018-10-18T12:29:09.290-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015670 BUGTRAQ 20060223 Secunia Research: Visnetic AntiVirus Plug-in for MailServerPrivilege Escalation BID 16788 VUPEN ADV-2006-0701 XF visnetic-av-plugin-privilege-elevation(24928) The VisNetic AntiVirus Plug-in (DKAVUpSch.exe) for Mail Server 4.6.0.4, 4.6.1.1, and possibly other versions before 4.6.1.2, does not drop privileges before executing other programs, which allows local users to gain privileges. cpe:/a:winace:winace:2.60 CVE-2006-0813 2006-02-24T06:02:00.000-05:00 2018-10-18T12:29:09.790-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SREASON 479 SECTRACK 1015672 BUGTRAQ 20060223 Secunia Research: WinACE ARJ Archive Handling Buffer Overflow BID 16786 VUPEN ADV-2006-0709 XF winace-arj-header-bo(24872) Heap-based buffer overflow in WinACE 2.60 allows user-assisted attackers to execute arbitrary code via a large header block in an ARJ archive. cpe:/a:lighttpd:lighttpd:1.0.2 cpe:/a:lighttpd:lighttpd:1.0.3 cpe:/a:lighttpd:lighttpd:1.1.0 cpe:/a:lighttpd:lighttpd:1.1.1 cpe:/a:lighttpd:lighttpd:1.1.2 cpe:/a:lighttpd:lighttpd:1.1.3 cpe:/a:lighttpd:lighttpd:1.1.4 cpe:/a:lighttpd:lighttpd:1.1.5 cpe:/a:lighttpd:lighttpd:1.1.6 cpe:/a:lighttpd:lighttpd:1.1.7 cpe:/a:lighttpd:lighttpd:1.1.8 cpe:/a:lighttpd:lighttpd:1.1.9 cpe:/a:lighttpd:lighttpd:1.2.0 cpe:/a:lighttpd:lighttpd:1.2.1 cpe:/a:lighttpd:lighttpd:1.2.2 cpe:/a:lighttpd:lighttpd:1.2.3 cpe:/a:lighttpd:lighttpd:1.2.4 cpe:/a:lighttpd:lighttpd:1.2.5 cpe:/a:lighttpd:lighttpd:1.2.6 cpe:/a:lighttpd:lighttpd:1.2.7 cpe:/a:lighttpd:lighttpd:1.2.8 cpe:/a:lighttpd:lighttpd:1.3.0 cpe:/a:lighttpd:lighttpd:1.3.1 cpe:/a:lighttpd:lighttpd:1.3.2 cpe:/a:lighttpd:lighttpd:1.3.3 cpe:/a:lighttpd:lighttpd:1.3.4 cpe:/a:lighttpd:lighttpd:1.3.5 cpe:/a:lighttpd:lighttpd:1.3.6 cpe:/a:lighttpd:lighttpd:1.3.7 cpe:/a:lighttpd:lighttpd:1.3.8 cpe:/a:lighttpd:lighttpd:1.3.9 cpe:/a:lighttpd:lighttpd:1.3.10 cpe:/a:lighttpd:lighttpd:1.3.11 cpe:/a:lighttpd:lighttpd:1.3.12 cpe:/a:lighttpd:lighttpd:1.3.13 cpe:/a:lighttpd:lighttpd:1.3.14 cpe:/a:lighttpd:lighttpd:1.3.15 cpe:/a:lighttpd:lighttpd:1.3.16 cpe:/a:lighttpd:lighttpd:1.4.0 cpe:/a:lighttpd:lighttpd:1.4.1 cpe:/a:lighttpd:lighttpd:1.4.2 cpe:/a:lighttpd:lighttpd:1.4.3 cpe:/a:lighttpd:lighttpd:1.4.4 cpe:/a:lighttpd:lighttpd:1.4.5 cpe:/a:lighttpd:lighttpd:1.4.6 cpe:/a:lighttpd:lighttpd:1.4.7 cpe:/a:lighttpd:lighttpd:1.4.8 cpe:/a:lighttpd:lighttpd:1.4.9 cpe:/a:lighttpd:lighttpd:1.4.10 CVE-2006-0814 2006-03-06T16:02:00.000-05:00 2018-10-18T12:29:10.397-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SREASON 523 SECTRACK 1015703 CONFIRM http://trac.lighttpd.net/trac/changeset/1005 BUGTRAQ 20060301 Secunia Research: Lighttpd Script Source Disclosure Vulnerability BID 16893 VUPEN ADV-2006-0782 XF lighttpd-source-code-disclosure(24976) response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files. cpe:/a:networkactiv:networkactiv_web_server:3.5.15 CVE-2006-0815 2006-03-06T18:02:00.000-05:00 2018-10-18T12:29:11.243-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://www.networkactiv.com/WebServer.html BUGTRAQ 20060301 Secunia Research: NetworkActiv Web Server Script Source DisclosureVulnerability BID 16895 VUPEN ADV-2006-0783 XF networkactiv-script-source-disclosure(24979) NetworkActiv Web Server 3.5.15 allows remote attackers to read script source code via a crafted URL with a "/" (forward slash) after the file extension. cpe:/a:orionserver:orion_application_server:2.0.6 CVE-2006-0816 2006-03-24T06:02:00.000-05:00 2018-10-18T12:29:11.697-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov FULLDISC 20060323 Secunia Research: Orion Application Server JSP Source Disclosure Vulnerability MISC http://secunia.com/secunia_research/2006-11/advisory/ SECTRACK 1015823 BUGTRAQ 20060323 Secunia Research: Orion Application Server JSP Source DisclosureVulnerability BID 17204 VUPEN ADV-2006-1055 XF orion-jsp-source-disclosure(25405) Orion Application Server before 2.0.7, when running on Windows, allows remote attackers to obtain the source code of JSP files via (1) . (dot) and (2) space characters in the extension of a URL. cpe:/a:deerfield:visnetic_mail_server:8.3.5 cpe:/a:icewarp:web_mail:5.6.0 cpe:/a:merak:mail_server:8.3.8r::windows CVE-2006-0817 2006-07-21T10:03:00.000-04:00 2018-10-18T12:29:12.303-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1016513 SECTRACK 1016514 BUGTRAQ 20060717 Secunia Research: IceWarp Web Mail Two File InclusionVulnerabilities BUGTRAQ 20060717 Secunia Research: VisNetic Mail Server Two File InclusionVulnerabilities BID 19002 BID 19007 VUPEN ADV-2006-2825 VUPEN ADV-2006-2826 XF visnetic-include-file-include(27773) Absolute path directory traversal vulnerability in (a) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (b) VisNetic MailServer before 8.5.0.5 allows remote attackers to include arbitrary files via a full Windows path and drive letter in the (1) language parameter in accounts/inc/include.php and (2) lang_settings parameter in admin/inc/include.php, which is not properly sanitized by the securepath function, a related issue to CVE-2005-4556. cpe:/a:deerfield:visnetic_mail_server:8.3.5 cpe:/a:icewarp:web_mail:5.6.0 cpe:/a:merak:mail_server:8.3.8r::windows CVE-2006-0818 2006-07-21T10:03:00.000-04:00 2018-10-18T12:29:13.320-04:00 4.0 NETWORK LOW SINGLE_INSTANCE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1016513 SECTRACK 1016514 BUGTRAQ 20060717 Secunia Research: IceWarp Web Mail Two File InclusionVulnerabilities BUGTRAQ 20060717 Secunia Research: VisNetic Mail Server Two File InclusionVulnerabilities BID 19002 BID 19007 VUPEN ADV-2006-2825 XF visnetic-language-file-include(27780) Absolute path directory traversal vulnerability in (1) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (2) VisNetic MailServer before 8.5.0.5 allows remote authenticated users to include arbitrary files via a modified language parameter and a full Windows or UNC pathname in the lang_settings parameter to mail/index.html, which is not properly sanitized by the validatefolder PHP function, possibly due to an incomplete fix for CVE-2005-4558. cpe:/a:gnome:dwarf_http_server:1.3.2 CVE-2006-0819 2006-03-13T14:34:00.000-05:00 2018-10-18T12:29:14.180-04:00 7.8 NETWORK LOW NONE COMPLETE NONE NONE http://nvd.nist.gov SREASON 576 SECTRACK 1015779 BUGTRAQ 20060313 Secunia Research: Dwarf HTTP Server Source Disclosure andCross-Site Scripting BID 17123 VUPEN ADV-2006-0937 XF dwarfhttp-extension-information-disclosure(25178) Dwarf HTTP Server 1.3.2 allows remote attackers to obtain the source code of JSP files via (1) dot, (2) space, (3) slash, or (4) NULL characters in the filename extension of an HTTP request. cpe:/a:gnome:dwarf_http_server:1.3.2 CVE-2006-0820 2006-03-13T14:34:00.000-05:00 2018-10-18T12:29:14.897-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015779 BUGTRAQ 20060313 Secunia Research: Dwarf HTTP Server Source Disclosure andCross-Site Scripting BID 17123 VUPEN ADV-2006-0937 XF dwarfhttp-url-xss(25179) Cross-site scripting (XSS) vulnerability in Dwarf HTTP Server 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified error messages. cpe:/a:bxcp:bxcp:0.299 CVE-2006-0821 2006-02-21T18:02:00.000-05:00 2017-10-18T21:29:03.080-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS VUPEN ADV-2006-0660 XF bxcp-tid-sql-injection(24783) EXPLOIT-DB 1513 SQL injection vulnerability in index.php in BXCP 0.299 allows remote attackers to execute arbitrary SQL commands via the tid parameter. cpe:/a:emulinker_kaillera_server:emulinker_kaillera_server:0.97.6 cpe:/a:emulinker_kaillera_server:emulinker_kaillera_server:0.98.2 cpe:/a:emulinker_kaillera_server:emulinker_kaillera_server:0.98.5 CVE-2006-0822 2006-02-21T18:02:00.000-05:00 2017-07-19T21:30:06.207-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://sourceforge.net/project/shownotes.php?release_id=394690&group_id=127754 BID 16733 VUPEN ADV-2006-0665 XF emulinker-packet-handling-dos(24784) Unspecified vulnerability in EmuLinker Kaillera Server before 0.99.17 allows remote attackers to cause a denial of service (probably resource consumption) via a crafted packet that causes a "ghost game" to be left on the server. cpe:/a:geeklog:geeklog:1.3.11 cpe:/a:geeklog:geeklog:1.3.11_sr1 cpe:/a:geeklog:geeklog:1.3.11_sr2 cpe:/a:geeklog:geeklog:1.3.11_sr3 cpe:/a:geeklog:geeklog:1.4.0 CVE-2006-0823 2006-02-21T18:02:00.000-05:00 2018-10-18T12:29:17.413-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://www.geeklog.net/article.php/geeklog-1.4.0sr1 MISC http://www.gulftech.org/?node=research&article_id=00102-02192006 BUGTRAQ 20060219 Geeklog Remote Code Execution BID 16755 VUPEN ADV-2006-0661 XF geeklog-users-sessions-sql-injection(24775) Multiple SQL injection vulnerabilities in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to inject arbitrary SQL commands via the (1) userid variable to users.php or (2) sessid variable to lib-sessions.php. cpe:/a:geeklog:geeklog:1.3.11 cpe:/a:geeklog:geeklog:1.3.11_sr1 cpe:/a:geeklog:geeklog:1.3.11_sr2 cpe:/a:geeklog:geeklog:1.3.11_sr3 cpe:/a:geeklog:geeklog:1.4.0 CVE-2006-0824 2006-02-21T18:02:00.000-05:00 2018-10-18T12:29:19.993-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://www.geeklog.net/article.php/geeklog-1.4.0sr1 MISC http://www.gulftech.org/?node=research&article_id=00102-02192006 BUGTRAQ 20060219 Geeklog Remote Code Execution BID 16755 VUPEN ADV-2006-0661 Multiple unspecified vulnerabilities in lib-common.php in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to include arbitrary local files and execute arbitrary code via (1) absolute paths in unspecified parameters and (2) the language cookie, as demonstrated for code execution using error.log. cpe:/h:xerox:workcentre_232 cpe:/h:xerox:workcentre_232:::pro cpe:/h:xerox:workcentre_238 cpe:/h:xerox:workcentre_238:::pro cpe:/h:xerox:workcentre_245 cpe:/h:xerox:workcentre_245:::pro cpe:/h:xerox:workcentre_255 cpe:/h:xerox:workcentre_255:::pro cpe:/h:xerox:workcentre_265 cpe:/h:xerox:workcentre_265:::pro cpe:/h:xerox:workcentre_275 cpe:/h:xerox:workcentre_275:::pro CVE-2006-0825 2006-02-21T18:02:00.000-05:00 2017-07-19T21:30:06.317-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015648 BID 16726 VUPEN ADV-2006-0668 CONFIRM http://www.xerox.com/downloads/usa/en/c/cert_XRX06_001.pdf XF xerox-workcentre-auth-bypass(24804) Multiple unspecified vulnerabilities in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allow remote attackers to bypass authentication or gain "unauthorized network access" via unknown attack vectors. cpe:/h:xerox:workcentre_232 cpe:/h:xerox:workcentre_232:::pro cpe:/h:xerox:workcentre_238 cpe:/h:xerox:workcentre_238:::pro cpe:/h:xerox:workcentre_245 cpe:/h:xerox:workcentre_245:::pro cpe:/h:xerox:workcentre_255 cpe:/h:xerox:workcentre_255:::pro cpe:/h:xerox:workcentre_265 cpe:/h:xerox:workcentre_265:::pro cpe:/h:xerox:workcentre_275 cpe:/h:xerox:workcentre_275:::pro CVE-2006-0826 2006-02-21T18:02:00.000-05:00 2017-07-19T21:30:06.380-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SECTRACK 1015648 BID 16723 VUPEN ADV-2006-0668 CONFIRM http://www.xerox.com/downloads/usa/en/c/cert_XRX06_001.pdf XF xerox-workcentre-postscript-dos(24805) Unspecified vulnerability in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allows remote attackers to cause a denial of service via a crafted Postscript request. cpe:/h:xerox:workcentre_232 cpe:/h:xerox:workcentre_232:::pro cpe:/h:xerox:workcentre_238 cpe:/h:xerox:workcentre_238:::pro cpe:/h:xerox:workcentre_245 cpe:/h:xerox:workcentre_245:::pro cpe:/h:xerox:workcentre_255 cpe:/h:xerox:workcentre_255:::pro cpe:/h:xerox:workcentre_265 cpe:/h:xerox:workcentre_265:::pro cpe:/h:xerox:workcentre_275 cpe:/h:xerox:workcentre_275:::pro CVE-2006-0827 2006-02-21T18:02:00.000-05:00 2017-07-19T21:30:06.440-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16727 VUPEN ADV-2006-0668 CONFIRM http://www.xerox.com/downloads/usa/en/c/cert_XRX06_001.pdf XF xerox-workcentre-xss(24806) Cross-site scripting vulnerability in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. cpe:/h:xerox:workcentre_232 cpe:/h:xerox:workcentre_232:::pro cpe:/h:xerox:workcentre_238 cpe:/h:xerox:workcentre_238:::pro cpe:/h:xerox:workcentre_245 cpe:/h:xerox:workcentre_245:::pro cpe:/h:xerox:workcentre_255 cpe:/h:xerox:workcentre_255:::pro cpe:/h:xerox:workcentre_265 cpe:/h:xerox:workcentre_265:::pro cpe:/h:xerox:workcentre_275 cpe:/h:xerox:workcentre_275:::pro CVE-2006-0828 2006-02-21T18:02:00.000-05:00 2011-03-07T21:30:52.597-05:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015648 VUPEN ADV-2006-0668 CONFIRM http://www.xerox.com/downloads/usa/en/c/cert_XRX06_001.pdf Unspecified vulnerability in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allows remote attackers to "reduce effectiveness of security features" via unknown attack vectors. cpe:/a:e-blah:platinum:9.7 CVE-2006-0829 2006-02-21T18:02:00.000-05:00 2018-10-18T12:29:20.837-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/83/summary.html SREASON 528 CONFIRM http://www.eblah.com/forum/m-1140116897/ BUGTRAQ 20060302 [eVuln] E-Blah Platinum 'Referer' XSS Vulnerability BID 16713 VUPEN ADV-2006-0638 XF eblah-httpreferer-xss(24777) Cross-site scripting vulnerability in E-Blah Platinum 9.7 allows remote attackers to inject arbitrary web script or HTML via the referer (HTTP_REFERER), which is not sanitized when the log file is viewed by the administrator using "Click Log". cpe:/a:microsoft:ie:6.0.2900 CVE-2006-0830 2006-02-21T18:02:00.000-05:00 2018-10-18T12:29:21.257-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BUGTRAQ 20060216 Stack overflow vulnerability in Internet Explorer exploitable trough VBScript and JScript scripting engines. BUGTRAQ 20060218 Re: Stack overflow vulnerability in Internet Explorer exploitable trough VBScript and JScript scripting engines. BID 16687 XF ie-script-engine-stack-dos(24788) The scripting engine in Internet Explorer allows remote attackers to cause a denial of service (resource consumption) and possibly execute arbitrary code via a web page that contains a recurrent call to an infinite loop in Javascript or VBscript, which consumes the stack, as demonstrated by resetting the "location" variable within the loop. cpe:/a:tasarim_rehberi:tasarim_rehberi CVE-2006-0831 2006-02-21T18:02:00.000-05:00 2018-10-18T12:29:21.460-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060218 Tasarim Rehberi Index.PHP Remote Command Exucetion PHP remote file include vulnerability in index.php in Tasarim Rehberi allows remote attackers to execute arbitrary PHP code via a URL in the (1) sayfaadi or (2) sayfa parameter. NOTE: this might be a site-specific issue. If so, it should not be included in CVE. cpe:/a:wpc.easy:wpc.easy CVE-2006-0832 2006-02-21T19:02:00.000-05:00 2018-10-18T12:29:21.523-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 456 BUGTRAQ 20060218 SLQ Injection vulnerability in WPCeasy BID 16721 VUPEN ADV-2006-0662 Multiple SQL injection vulnerabilities in admin.asp in WPC.easy allow remote attackers to execute arbitrary SQL commands via the (1) uid and (2) pwd parameter. cpe:/a:boonex:barracuda_directory:1.1 CVE-2006-0833 2006-02-21T19:02:00.000-05:00 2017-07-19T21:30:06.613-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16746 VUPEN ADV-2006-0674 XF barracuda-multiple-xss(24807) Multiple cross-site scripting (XSS) vulnerabilities in Barracuda Directory 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) Add URL and (2) Suggest Category module. NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information. cpe:/h:uniden:uip1868p CVE-2006-0834 2006-02-21T21:02:00.000-05:00 2018-10-18T12:29:21.710-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060216 Uniden UIP1868P (VoIP phone/gateway) default easy-to-guess password vulnerability XF uniden-uip1868p-default-account(24786) Uniden UIP1868P VoIP Telephone and Router has a default password of admin for the web-based configuration utility, which allows remote attackers to obtain sensitive information on the device such as telephone numbers called, and possibly connect to other hosts. NOTE: it is possible that this password was configured by a reseller, not the original vendor; if so, then this is not a vulnerability in the product. cpe:/a:mitridat:web_calendar_pro CVE-2006-0835 2006-02-21T21:02:00.000-05:00 2017-07-19T21:30:06.707-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060215 Web Calendar Pro - Denial of Service SQL Injection Vulnerability BID 16789 VUPEN ADV-2006-0700 MISC http://www.xorcrew.net/xpa/XPA-WebCalendarPro.txt XF webcalendarpro-dropbase-sql-injection(24729) SQL injection vulnerability in dropbase.php in MitriDAT Web Calendar Pro allows remote attackers to modify internal SQL queries and cause a denial of service (inaccessible database) via the tabls parameter. cpe:/a:mozilla:thunderbird:1.5 CVE-2006-0836 2006-02-21T21:02:00.000-05:00 2018-10-18T12:29:21.853-04:00 2.6 NETWORK HIGH NONE NONE NONE PARTIAL http://nvd.nist.gov FULLDISC 20060217 Mozila Thunderbird 1.5 Address Book DoS SREASON 469 BUGTRAQ 20060221 Mozila Thunderbird 1.5 Address Book DoS BID 16716 XF thunderbird-address-book-dos(24810) Mozilla Thunderbird 1.5 allows user-assisted attackers to cause an unspecified denial of service by tricking the user into importing an LDIF file with a long field into the address book, as demonstrated by a long homePhone field. cpe:/a:micromuse:netcool_neusecure:3.0.236 CVE-2006-0837 2006-02-21T21:02:00.000-05:00 2018-10-18T12:29:22.103-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov FULLDISC 20060216 Password disclosure and remote access in Netcool/NeuSecure Security information management platform SECTRACK 1015642 BUGTRAQ 20060216 Password disclosure and remote access in Netcool/NeuSecure Security information management platform BID 16693 BID 16700 XF netcool-neosecure-config-weak-permission(24785) IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 has world-readable permissions for (1) /etc/neusecure.conf, (2) /opt/NeuSecure/etc/cms-3.0.236.buildconf, and (3) /opt/NeuSecure/bin/ns_archiver.log, which allows local users to read sensitive information such as passwords. NOTE: IBM has privately confirmed to CVE that a fix is available for these issues. cpe:/a:micromuse:netcool_neusecure:3.0.236 CVE-2006-0838 2006-02-21T21:02:00.000-05:00 2018-10-18T12:29:22.570-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov FULLDISC 20060216 Password disclosure and remote access in Netcool/NeuSecure Security information management platform SECTRACK 1015642 BUGTRAQ 20060216 Password disclosure and remote access in Netcool/NeuSecure Security information management platform BID 16693 BID 16698 XF netcool-neosecure-config-weak-permission(24785) XF netcool-neosecure-plaintext-password(24787) IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 stores cleartext passwords in the (1) CMS_DBPASS, (2) CMSM_DBPASS, and (3) RPT_DBPASS fields in /etc/neusecure.conf, and in (4) /opt/NeuSecure/bin/ns_archiver.log, which allows local users to gain privileges. NOTE: IBM has privately confirmed to CVE that a fix is available for these issues. cpe:/a:sourcefire:snort:2.4.3 CVE-2006-0839 2006-02-21T21:02:00.000-05:00 2018-10-18T12:29:23.023-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060217 SNORT Incorrect fragmented packet reassembly BID 16705 XF snort-frag3-detection-bypass(24811) The frag3 preprocessor in Sourcefire Snort 2.4.3 does not properly reassemble certain fragmented packets with IP options, which allows remote attackers to evade detection of certain attacks, possibly related to IP option lengths. cpe:/a:mantis:mantis:0.9 cpe:/a:mantis:mantis:0.9.0 cpe:/a:mantis:mantis:0.9.1 cpe:/a:mantis:mantis:0.10 cpe:/a:mantis:mantis:0.10.0 cpe:/a:mantis:mantis:0.10.1 cpe:/a:mantis:mantis:0.10.2 cpe:/a:mantis:mantis:0.11 cpe:/a:mantis:mantis:0.11.0 cpe:/a:mantis:mantis:0.11.1 cpe:/a:mantis:mantis:0.12 cpe:/a:mantis:mantis:0.12.0 cpe:/a:mantis:mantis:0.13 cpe:/a:mantis:mantis:0.13.0 cpe:/a:mantis:mantis:0.13.1 cpe:/a:mantis:mantis:0.14 cpe:/a:mantis:mantis:0.14.0 cpe:/a:mantis:mantis:0.14.1 cpe:/a:mantis:mantis:0.14.2 cpe:/a:mantis:mantis:0.14.3 cpe:/a:mantis:mantis:0.14.4 cpe:/a:mantis:mantis:0.14.5 cpe:/a:mantis:mantis:0.14.6 cpe:/a:mantis:mantis:0.14.7 cpe:/a:mantis:mantis:0.14.8 cpe:/a:mantis:mantis:0.15 cpe:/a:mantis:mantis:0.15.0 cpe:/a:mantis:mantis:0.15.1 cpe:/a:mantis:mantis:0.15.2 cpe:/a:mantis:mantis:0.16 cpe:/a:mantis:mantis:0.16.0 cpe:/a:mantis:mantis:0.17 cpe:/a:mantis:mantis:0.17.0 cpe:/a:mantis:mantis:0.17.4a cpe:/a:mantis:mantis:0.18 cpe:/a:mantis:mantis:0.18.0 cpe:/a:mantis:mantis:0.18.0_rc1 cpe:/a:mantis:mantis:0.18.0a1 cpe:/a:mantis:mantis:0.18.0a2 cpe:/a:mantis:mantis:0.18.0a3 cpe:/a:mantis:mantis:0.18.0a4 cpe:/a:mantis:mantis:0.18.1 cpe:/a:mantis:mantis:0.18.2 cpe:/a:mantis:mantis:0.18.3 cpe:/a:mantis:mantis:0.18a1 cpe:/a:mantis:mantis:0.19.0 cpe:/a:mantis:mantis:0.19.0_rc1 cpe:/a:mantis:mantis:0.19.0a cpe:/a:mantis:mantis:0.19.0a1 cpe:/a:mantis:mantis:0.19.0a2 cpe:/a:mantis:mantis:0.19.1 cpe:/a:mantis:mantis:0.19.2 cpe:/a:mantis:mantis:0.19.3 cpe:/a:mantis:mantis:0.19.4 cpe:/a:mantis:mantis:1.0.0_rc1 cpe:/a:mantis:mantis:1.0.0_rc2 cpe:/a:mantis:mantis:1.0.0_rc3 cpe:/a:mantis:mantis:1.0.0_rc4 cpe:/a:mantis:mantis:1.0.0a1 cpe:/a:mantis:mantis:1.0.0a2 cpe:/a:mantis:mantis:1.0.0a3 CVE-2006-0840 2006-02-21T21:02:00.000-05:00 2018-10-18T12:29:23.227-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://morph3us.org/advisories/20060214-mantis-100rc4.txt MISC http://sourceforge.net/project/showfiles.php?group_id=14963&package_id=12175&release_id=386059 MISC http://sourceforge.net/project/shownotes.php?release_id=386059&group_id=14963 BUGTRAQ 20060215 [BuHa-Security] Multiple Vulnerabilities in Mantis 1.00rc4 BID 16657 XF mantis-manageuserpagesql-injection(24726) manage_user_page.php in Mantis 1.00rc4 and earlier does not properly handle a sort parameter containing a ' (quote) character, which allows remote attackers to trigger a SQL error that may be repeatedly reported to a user who makes subsequent web accesses with the MANTIS_MANAGE_COOKIE cookie. NOTE: this issue might be the same as vector 2 in CVE-2005-4519. cpe:/a:mantis:mantis:0.9 cpe:/a:mantis:mantis:0.9.0 cpe:/a:mantis:mantis:0.9.1 cpe:/a:mantis:mantis:0.10 cpe:/a:mantis:mantis:0.10.0 cpe:/a:mantis:mantis:0.10.1 cpe:/a:mantis:mantis:0.10.2 cpe:/a:mantis:mantis:0.11 cpe:/a:mantis:mantis:0.11.0 cpe:/a:mantis:mantis:0.11.1 cpe:/a:mantis:mantis:0.12 cpe:/a:mantis:mantis:0.12.0 cpe:/a:mantis:mantis:0.13 cpe:/a:mantis:mantis:0.13.0 cpe:/a:mantis:mantis:0.13.1 cpe:/a:mantis:mantis:0.14 cpe:/a:mantis:mantis:0.14.0 cpe:/a:mantis:mantis:0.14.1 cpe:/a:mantis:mantis:0.14.2 cpe:/a:mantis:mantis:0.14.3 cpe:/a:mantis:mantis:0.14.4 cpe:/a:mantis:mantis:0.14.5 cpe:/a:mantis:mantis:0.14.6 cpe:/a:mantis:mantis:0.14.7 cpe:/a:mantis:mantis:0.14.8 cpe:/a:mantis:mantis:0.15 cpe:/a:mantis:mantis:0.15.0 cpe:/a:mantis:mantis:0.15.1 cpe:/a:mantis:mantis:0.15.2 cpe:/a:mantis:mantis:0.16 cpe:/a:mantis:mantis:0.16.0 cpe:/a:mantis:mantis:0.17 cpe:/a:mantis:mantis:0.17.0 cpe:/a:mantis:mantis:0.17.4a cpe:/a:mantis:mantis:0.18 cpe:/a:mantis:mantis:0.18.0 cpe:/a:mantis:mantis:0.18.0_rc1 cpe:/a:mantis:mantis:0.18.0a1 cpe:/a:mantis:mantis:0.18.0a2 cpe:/a:mantis:mantis:0.18.0a3 cpe:/a:mantis:mantis:0.18.0a4 cpe:/a:mantis:mantis:0.18.1 cpe:/a:mantis:mantis:0.18.2 cpe:/a:mantis:mantis:0.18.3 cpe:/a:mantis:mantis:0.18a1 cpe:/a:mantis:mantis:0.19.0 cpe:/a:mantis:mantis:0.19.0_rc1 cpe:/a:mantis:mantis:0.19.0a cpe:/a:mantis:mantis:0.19.0a1 cpe:/a:mantis:mantis:0.19.0a2 cpe:/a:mantis:mantis:0.19.1 cpe:/a:mantis:mantis:0.19.2 cpe:/a:mantis:mantis:0.19.3 cpe:/a:mantis:mantis:0.19.4 cpe:/a:mantis:mantis:1.0.0_rc1 cpe:/a:mantis:mantis:1.0.0_rc2 cpe:/a:mantis:mantis:1.0.0_rc3 cpe:/a:mantis:mantis:1.0.0_rc4 cpe:/a:mantis:mantis:1.0.0a1 cpe:/a:mantis:mantis:1.0.0a2 cpe:/a:mantis:mantis:1.0.0a3 CVE-2006-0841 2006-02-21T21:02:00.000-05:00 2018-10-18T12:29:23.603-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://morph3us.org/advisories/20060214-mantis-100rc4.txt MISC http://sourceforge.net/project/showfiles.php?group_id=14963&package_id=12175&release_id=386059 MISC http://sourceforge.net/project/shownotes.php?release_id=386059&group_id=14963 DEBIAN DSA-1133 BUGTRAQ 20060215 [BuHa-Security] Multiple Vulnerabilities in Mantis 1.00rc4 BID 16657 Multiple cross-site scripting (XSS) vulnerabilities in Mantis 1.00rc4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) hide_status, (2) handler_id, (3) user_monitor, (4) reporter_id, (5) view_type, (6) show_severity, (7) show_category, (8) show_status, (9) show_resolution, (10) show_build, (11) show_profile, (12) show_priority, (13) highlight_changed, (14) relationship_type, and (15) relationship_bug parameters in (a) view_all_set.php; the (16) sort parameter in (b) manage_user_page.php; the (17) view_type parameter in (c) view_filters_page.php; and the (18) title parameter in (d) proj_doc_delete.php. NOTE: item 17 might be subsumed by CVE-2005-4522. cpe:/a:calacode:atmail_webmail_system:4.3 CVE-2006-0842 2006-02-21T21:02:00.000-05:00 2017-07-19T21:30:07.083-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16683 VUPEN ADV-2006-0617 XF @mail-html-image-xss(24742) Cross-site scripting (XSS) vulnerability in Calacode @Mail 4.3 allows remote attackers to inject arbitrary web script or HTML via a modified javascript: string in the SRC attribute of an IMG element in an e-mail message, as demonstrated by "java&#09;script:." NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:leif_m._wright:web_blog:3.5 CVE-2006-0843 2006-02-21T21:02:00.000-05:00 2017-07-19T21:30:07.143-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SREASON 522 MISC http://www.evuln.com/vulns/82/summary.html BID 16712 XF webblog-txt-obtain-information(24752) Leif M. Wright's Blog 3.5 stores the config file and other txt files under the web root with insufficient access control, which allows remote attackers to read the administrator's password. cpe:/a:leif_m._wright:web_blog:3.5 CVE-2006-0844 2006-02-21T21:02:00.000-05:00 2017-07-19T21:30:07.190-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 522 MISC http://www.evuln.com/vulns/82/summary.html BID 16714 XF webblog-cookie-auth-bypass(24755) Leif M. Wright's Blog 3.5 does not make a password comparison when authenticating an administrator via a cookie, which allows remote attackers to bypass login authentication, probably by setting the blogAdmin cookie. cpe:/a:leif_m._wright:web_blog:3.5 CVE-2006-0845 2006-02-21T21:02:00.000-05:00 2017-07-19T21:30:07.237-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 522 MISC http://www.evuln.com/vulns/82/summary.html XF webblog-sendmail-command-execution(24757) Leif M. Wright's Blog 3.5 allows remote authenticated users with administrative privileges to execute arbitrary programs, including shell commands, by configuring the sendmail path to a malicious pathname. cpe:/a:leif_m._wright:web_blog:3.5 CVE-2006-0846 2006-02-21T21:02:00.000-05:00 2017-07-19T21:30:07.287-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 522 MISC http://www.evuln.com/vulns/82/summary.html BID 16715 XF webblog-headers-xss(24758) Multiple cross-site scripting (XSS) vulnerabilities in Leif M. Wright's Blog 3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) Referer and (2) User-Agent HTTP headers, which are stored in a log file and not sanitized when the administrator views the "Log" page, possibly using the ViewCommentsLog function. cpe:/a:cherrypy:cherrypy:0.1 cpe:/a:cherrypy:cherrypy:0.2 cpe:/a:cherrypy:cherrypy:0.3 cpe:/a:cherrypy:cherrypy:0.4 cpe:/a:cherrypy:cherrypy:0.5 cpe:/a:cherrypy:cherrypy:0.6 cpe:/a:cherrypy:cherrypy:0.7 cpe:/a:cherrypy:cherrypy:0.8 cpe:/a:cherrypy:cherrypy:0.8_beta cpe:/a:cherrypy:cherrypy:0.9 cpe:/a:cherrypy:cherrypy:0.9_beta cpe:/a:cherrypy:cherrypy:0.9_gamma cpe:/a:cherrypy:cherrypy:0.9_rc1 cpe:/a:cherrypy:cherrypy:0.10 cpe:/a:cherrypy:cherrypy:0.10_beta cpe:/a:cherrypy:cherrypy:0.10_rc1 cpe:/a:cherrypy:cherrypy:2.0.0 cpe:/a:cherrypy:cherrypy:2.0.0a1 cpe:/a:cherrypy:cherrypy:2.1.0 cpe:/a:cherrypy:cherrypy:2.1.0_beta cpe:/a:cherrypy:cherrypy:2.1.0_rc1 cpe:/a:cherrypy:cherrypy:2.1.0_rc2 CVE-2006-0847 2006-02-21T21:02:00.000-05:00 2017-07-19T21:30:07.347-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://groups.google.com/group/cherrypy-announce/browse_thread/thread/92b2972f774fe6df/2f63afc9433dc306#2f63afc9433dc306 CONFIRM http://sourceforge.net/project/shownotes.php?release_id=384316&group_id=56099 CONFIRM http://www.cherrypy.org/ GENTOO GLSA-200605-16 BID 16760 VUPEN ADV-2006-0677 XF cherrypy-staticfilter-directory-traversal(24809) Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors. cpe:/o:apple:mac_os_x:10.4.5 cpe:/o:apple:mac_os_x_server:10.4.5 CVE-2006-0848 2006-02-22T18:02:00.000-05:00 2017-07-19T21:30:07.427-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://docs.info.apple.com/article.html?artnum=303382 SECTRACK 1015652 MISC http://www.frsirt.com/exploits/20060222.safari_safefiles_exec.pm.php MISC http://www.heise.de/english/newsticker/news/69862 CERT-VN VU#999708 MISC http://www.mathematik.uni-ulm.de/numerik/staff/lehn/macosx.html BID 16736 CERT TA06-053A CERT TA06-062A VUPEN ADV-2006-0671 XF macosx-zip-command-execution(24808) The "Open 'safe' files after downloading" option in Safari on Apple Mac OS X allows remote user-assisted attackers to execute arbitrary commands by tricking a user into downloading a __MACOSX folder that contains metadata (resource fork) that invokes the Terminal, which automatically interprets the script using bash, as demonstrated using a ZIP file that contains a script with a safe file extension. cpe:/a:ilch.de:ilchclan:0.0.1 cpe:/a:ilch.de:ilchclan:1.0.0 cpe:/a:ilch.de:ilchclan:1.0.1 cpe:/a:ilch.de:ilchclan:1.0.2 cpe:/a:ilch.de:ilchclan:1.0.3 cpe:/a:ilch.de:ilchclan:1.0.4 CVE-2006-0850 2006-02-22T21:06:00.000-05:00 2017-07-19T21:30:07.473-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://www.ilch.de/news-134.html VUPEN ADV-2006-0676 XF ilchclan-login-sql-injection(24830) SQL injection vulnerability in include/includes/user/login.php in ilchClan before 1.05g allows remote attackers to execute arbitrary SQL commands via the login_name parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:ilch.de:ilchclan:0.0.1 cpe:/a:ilch.de:ilchclan:1.0.0 cpe:/a:ilch.de:ilchclan:1.0.1 cpe:/a:ilch.de:ilchclan:1.0.2 cpe:/a:ilch.de:ilchclan:1.0.3 cpe:/a:ilch.de:ilchclan:1.0.4 CVE-2006-0851 2006-02-22T21:06:00.000-05:00 2017-10-18T21:29:03.157-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BID 16735 VUPEN ADV-2006-0672 XF ilchclan-index-sql-injection(24829) EXPLOIT-DB 1516 SQL injection vulnerability in the forum module of ilchClan 1.05g and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter, when creating a newpost. cpe:/a:devscripts:admbook:1.2.2 CVE-2006-0852 2006-02-22T21:06:00.000-05:00 2017-10-18T21:29:03.237-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BID 16753 VUPEN ADV-2006-0663 XF admbook-index-command-execution(24771) EXPLOIT-DB 1512 Direct static code injection vulnerability in write.php in Admbook 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via the X-Forwarded-For HTTP header field, which is inserted into content-data.php. cpe:/a:truenorth_software:ia_emailserver:corporate_5.3.4 CVE-2006-0853 2006-02-22T21:06:00.000-05:00 2018-10-18T12:29:24.057-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015664 BUGTRAQ 20060220 [AJECT] TrueNorth IA eMailserver 5.3.4 buffer overflow vulnerability BID 16744 VUPEN ADV-2006-0686 XF ia-emailserver-imap-bo(24812) Buffer overflow in the IMAP service of TrueNorth Internet Anywhere (IA) eMailserver 5.3.4 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long SEARCH argument. cpe:/a:intensive_point:iuser_ecommerce CVE-2006-0854 2006-02-22T21:06:00.000-05:00 2017-07-19T21:30:07.690-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060215 iUser Ecommerce - Remote Command Execution Vulnerability BID 16787 VUPEN ADV-2006-0699 MISC http://www.xorcrew.net/xpa/XPA-iUser.txt XF iuser-ecommerce-file-include(24724) PHP remote file inclusion vulnerability in common.php in Intensive Point iUser Ecommerce allows remote attackers to include arbitrary files via a URL in the include_path variable, which is not initialized before being used. cpe:/a:rahul_dhesi:zoo:2.10 CVE-2006-0855 2006-02-23T16:02:00.000-05:00 2018-10-18T12:29:24.383-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BUGTRAQ 20060403 Barracuda ZOO archiver security bug leads to remote compromise SREASON 546 SECTRACK 1015668 SECTRACK 1015866 DEBIAN DSA-991 GENTOO GLSA-200603-05 MISC http://www.guay-leroux.com/projects/barracuda-advisory-ZOO.txt MISC http://www.guay-leroux.com/projects/zoo-advisory.txt SUSE SUSE-SR:2006:005 SUSE SUSE-SR:2006:006 BUGTRAQ 20060223 zoo contains exploitable buffer overflows BID 16790 VUPEN ADV-2006-0705 VUPEN ADV-2006-1220 XF zoo-misc-bo(24904) Stack-based buffer overflow in the fullpath function in misc.c for zoo 2.10 and earlier, as used in products such as Barracuda Spam Firewall, allows user-assisted attackers to execute arbitrary code via a crafted ZOO file that causes the combine function to return a longer string than expected. cpe:/a:scriptme:sme_gb_host:1.21 CVE-2006-0856 2006-02-23T18:02:00.000-05:00 2018-10-18T12:29:25.353-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.evuln.com/vulns/66/summary.html BUGTRAQ 20060216 [eVuln] SmE GB Host Authentication Bypass Vulnerability BID 16609 VUPEN ADV-2006-0543 XF smegbhost-login-sql-injection(24544) SQL injection vulnerability in login.php in Scriptme SmE GB Host 1.21 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the Username parameter. cpe:/a:e107:chatbox_plugin:1.0 cpe:/a:e107:e107:0.7.2 CVE-2006-0857 2006-02-23T18:02:00.000-05:00 2018-10-18T12:29:25.603-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060218 e107 CMS 0.7.2 Chatbox plugin XSS vulnerability BID 16719 XF e107-chatbox-xss(24815) Cross-site scripting (XSS) vulnerability in Chatbox Plugin 1.0 in e107 0.7.2 allows remote attackers to inject arbitrary HTML or web script via a Chatbox, as demonstrated using a SCRIPT element. cpe:/a:starforce:safe_n_sec_personal_%2b_anti-spyware:2.0 CVE-2006-0858 2006-02-23T18:02:00.000-05:00 2018-10-18T12:29:25.773-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS MISC http://secdev.zoller.lu/research/safnsec.htm BUGTRAQ 20060219 [TZO-062006] Safe'nVulnerable BID 16762 Unquoted Windows search path vulnerability in (1) snsmcon.exe, (2) the autostartup mechanism, and (3) an unspecified installation component in StarForce Safe'n'Sec Personal + Anti-Spyware 2.0 and earlier, and possibly other StarForce Safe'n'Sec products, might allow local users to gain privileges via a malicious "program" file in the C: folder. cpe:/a:michael_salzer:guestbox:0.6 CVE-2006-0859 2006-02-23T18:02:00.000-05:00 2018-10-18T12:29:25.930-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060220 Guestbox XSS/an admin bypass BUGTRAQ 20060302 Re: Guestbox XSS/an admin bypass VUPEN ADV-2006-0675 XF guestbox-admin-access(24797) Michael Salzer Guestbox 0.6, and other versions before 0.8, allows remote attackers to post an admin comment to a guestbook entry via a certain modified form, possibly related to the nummer parameter. cpe:/a:michael_salzer:guestbox:0.6 CVE-2006-0860 2006-02-23T18:02:00.000-05:00 2018-10-18T12:29:26.273-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060220 Guestbox XSS/an admin bypass BUGTRAQ 20060302 Re: Guestbox XSS/an admin bypass BID 16751 VUPEN ADV-2006-0675 XF guestbox-gbshow-xss(24798) Multiple cross-site scripting (XSS) vulnerabilities in Michael Salzer Guestbox 0.6, and other versions before 0.8, allow remote attackers to inject arbitrary web script or HTML via (1) HTML tags that follow a "http://" string, which bypasses a regular expression check, and (2) other unspecified attack vectors. cpe:/a:michael_salzer:guestbox:0.6 CVE-2006-0861 2006-02-23T18:02:00.000-05:00 2018-10-19T13:29:00.280-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SREASON 460 BUGTRAQ 20060220 Guestbox XSS/an admin bypass BUGTRAQ 20060302 Re: Guestbox XSS/an admin bypass VUPEN ADV-2006-0675 XF guestbox-gblog-obtain-information(24799) Michael Salzer Guestbox 0.6, and other versions before 0.8, allows remote attackers to obtain the source IP addresses of guestbook entries via a direct request to /gb/gblog. cpe:/a:infovista:portalse:2.0_build_20087 CVE-2006-0862 2006-02-23T18:02:00.000-05:00 2018-10-18T12:29:26.993-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SECTRACK 1015669 MISC http://www.irmplc.com/advisory017.htm BUGTRAQ 20060222 IRM 017: Multiple Vulnerabilities in Infovista Portal SE BID 16776 VUPEN ADV-2006-0695 XF vistaportal-parameter-directory-traversal(24893) Unspecified vulnerability in InfoVista PortalSE 2.0 Build 20087 on Solaris 8 without the IV00038969 hotfix allows remote attackers to read arbitrary files via a crafted URL. cpe:/a:infovista:portalse:2.0_build_20087 CVE-2006-0863 2006-02-23T18:02:00.000-05:00 2018-10-18T12:29:27.290-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SREASON 473 SECTRACK 1015669 MISC http://www.irmplc.com/advisory017.htm BUGTRAQ 20060222 IRM 017: Multiple Vulnerabilities in Infovista Portal SE BID 16776 VUPEN ADV-2006-0695 XF vistaportal-server-path-disclosure(24894) InfoVista PortalSE 2.0 Build 20087 on Solaris 8 allows remote attackers to obtain sensitive information by specifying a nonexistent server in the server field, which reveals the path in an error message. cpe:/a:hauri:virobot:2.0_2005-08-17 CVE-2006-0864 2006-02-23T18:02:00.000-05:00 2018-10-18T12:29:27.617-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015658 BUGTRAQ 20060222 [INetCop Security Advisory] Global Hauri Virobot cookie exploit BID 16768 VUPEN ADV-2006-0691 MISC http://x82.inetcop.org/h0me/adv1sor1es/INCSA.2006-0x82-028-VIROBOT.txt XF virobot-filescan-auth-bypass(24850) filescan in Global Hauri ViRobot 2.0 20050817 does not verify the Cookie HTTP header, which allows remote attackers to gain administrative privileges via an arbitrary cookie value. cpe:/a:punbb:punbb:1.0 cpe:/a:punbb:punbb:1.0.1 cpe:/a:punbb:punbb:1.0_alpha cpe:/a:punbb:punbb:1.0_beta1 cpe:/a:punbb:punbb:1.0_beta1a cpe:/a:punbb:punbb:1.0_beta2 cpe:/a:punbb:punbb:1.0_beta3 cpe:/a:punbb:punbb:1.0_rc1 cpe:/a:punbb:punbb:1.0_rc2 cpe:/a:punbb:punbb:1.1 cpe:/a:punbb:punbb:1.1.1 cpe:/a:punbb:punbb:1.1.2 cpe:/a:punbb:punbb:1.1.3 cpe:/a:punbb:punbb:1.1.4 cpe:/a:punbb:punbb:1.1.5 cpe:/a:punbb:punbb:1.2 cpe:/a:punbb:punbb:1.2.1 cpe:/a:punbb:punbb:1.2.2 cpe:/a:punbb:punbb:1.2.3 cpe:/a:punbb:punbb:1.2.4 cpe:/a:punbb:punbb:1.2.5 cpe:/a:punbb:punbb:1.2.6 cpe:/a:punbb:punbb:1.2.7 cpe:/a:punbb:punbb:1.2.8 cpe:/a:punbb:punbb:1.2.9 cpe:/a:punbb:punbb:1.2.10 CVE-2006-0865 2006-02-23T18:02:00.000-05:00 2018-10-18T12:29:27.913-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://www.neosecurityteam.net/advisories/Advisory-15.txt BUGTRAQ 20060219 PunBB 1.2.10 Multiple DoS Vulnerabilities XF punbb-register-ip-dos(24837) PunBB 1.2.10 and earlier allows remote attackers to cause a denial of service (resource consumption) by registering many user accounts quickly. cpe:/a:punbb:punbb:1.0 cpe:/a:punbb:punbb:1.0.1 cpe:/a:punbb:punbb:1.0_alpha cpe:/a:punbb:punbb:1.0_beta1 cpe:/a:punbb:punbb:1.0_beta1a cpe:/a:punbb:punbb:1.0_beta2 cpe:/a:punbb:punbb:1.0_beta3 cpe:/a:punbb:punbb:1.0_rc1 cpe:/a:punbb:punbb:1.0_rc2 cpe:/a:punbb:punbb:1.1 cpe:/a:punbb:punbb:1.1.1 cpe:/a:punbb:punbb:1.1.2 cpe:/a:punbb:punbb:1.1.3 cpe:/a:punbb:punbb:1.1.4 cpe:/a:punbb:punbb:1.1.5 cpe:/a:punbb:punbb:1.2 cpe:/a:punbb:punbb:1.2.1 cpe:/a:punbb:punbb:1.2.2 cpe:/a:punbb:punbb:1.2.3 cpe:/a:punbb:punbb:1.2.4 cpe:/a:punbb:punbb:1.2.5 cpe:/a:punbb:punbb:1.2.6 cpe:/a:punbb:punbb:1.2.7 cpe:/a:punbb:punbb:1.2.8 cpe:/a:punbb:punbb:1.2.9 cpe:/a:punbb:punbb:1.2.10 CVE-2006-0866 2006-02-23T18:02:00.000-05:00 2018-10-18T12:29:28.103-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://www.neosecurityteam.net/advisories/Advisory-15.txt BUGTRAQ 20060219 PunBB 1.2.10 Multiple DoS Vulnerabilities XF punbb-login-bruteforce(24838) PunBB 1.2.10 and earlier allows remote attackers to conduct brute force guessing attacks for an account's password, which may be as short as 4 characters. cpe:/a:south_river:webdrive:6.08_build_1131 cpe:/a:south_river:webdrive:8 CVE-2006-0867 2006-02-23T18:02:00.000-05:00 2018-10-18T12:29:28.290-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov BUGTRAQ 20060222 South River WebDrive Buffer Overflow Vulnerability XF webdrive-name-bo(24903) Buffer overflow in certain versions of South River (aka SRT) WebDrive, possibly version 6.08 build 1131 and version 8, allows remote attackers to cause a denial of service (application crash and persistent erratic behavior) via a long string in the name entry field. cpe:/a:pear:xml_rpc:1.0.2 cpe:/a:pear:xml_rpc:1.0.3 cpe:/a:pear:xml_rpc:1.0.4 cpe:/a:pear:xml_rpc:1.1.0 cpe:/a:pear:xml_rpc:1.2.0 cpe:/a:pear:xml_rpc:1.2.0rc1 cpe:/a:pear:xml_rpc:1.2.0rc2 cpe:/a:pear:xml_rpc:1.2.0rc3 cpe:/a:pear:xml_rpc:1.2.0rc4 cpe:/a:pear:xml_rpc:1.2.0rc5 cpe:/a:pear:xml_rpc:1.2.0rc6 cpe:/a:pear:xml_rpc:1.2.0rc7 cpe:/a:pear:xml_rpc:1.2.1 cpe:/a:pear:xml_rpc:1.2.2 cpe:/a:pear:xml_rpc:1.3.0rc1 cpe:/a:pear:xml_rpc:1.3.0rc2 cpe:/a:pear:xml_rpc:1.3.0rc3 CVE-2006-0868 2006-02-23T18:02:00.000-05:00 2018-10-18T12:29:28.413-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://pear.php.net/package/Auth/download/1.2.4 CONFIRM http://pear.php.net/package/Auth/download/1.3.0r4 SECTRACK 1015666 GENTOO GLSA-200603-13 BUGTRAQ 20060222 Multiple Injection Vulnerabilities in PHP PEAR::Auth Module BID 16758 VUPEN ADV-2006-0696 XF auth-multiple-injections(24854) Multiple unspecified injection vulnerabilities in unspecified Auth Container back ends for PEAR::Auth before 1.2.4, and 1.3.x before 1.3.0r4, allow remote attackers to "falsify authentication credentials," related to the "underlying storage containers." cpe:/a:pear:pear_liveuser:0.3 cpe:/a:pear:pear_liveuser:0.5 cpe:/a:pear:pear_liveuser:0.5.1 cpe:/a:pear:pear_liveuser:0.6 cpe:/a:pear:pear_liveuser:0.6.1 cpe:/a:pear:pear_liveuser:0.7 cpe:/a:pear:pear_liveuser:0.8 cpe:/a:pear:pear_liveuser:0.8.1 cpe:/a:pear:pear_liveuser:0.9 cpe:/a:pear:pear_liveuser:0.10.0 cpe:/a:pear:pear_liveuser:0.11.0 cpe:/a:pear:pear_liveuser:0.11.1 cpe:/a:pear:pear_liveuser:0.12.0 cpe:/a:pear:pear_liveuser:0.13.0 cpe:/a:pear:pear_liveuser:0.13.1 cpe:/a:pear:pear_liveuser:0.13.2 cpe:/a:pear:pear_liveuser:0.13.3 cpe:/a:pear:pear_liveuser:0.14.0 cpe:/a:pear:pear_liveuser:0.15.0 cpe:/a:pear:pear_liveuser:0.15.1 cpe:/a:pear:pear_liveuser:0.16.0 cpe:/a:pear:pear_liveuser:0.16.1 cpe:/a:pear:pear_liveuser:0.16.2 cpe:/a:pear:pear_liveuser:0.16.3 cpe:/a:pear:pear_liveuser:0.16.4 cpe:/a:pear:pear_liveuser:0.16.5 cpe:/a:pear:pear_liveuser:0.16.6 cpe:/a:pear:pear_liveuser:0.16.7 cpe:/a:pear:pear_liveuser:0.16.8 CVE-2006-0869 2006-02-23T18:02:00.000-05:00 2018-10-18T12:29:28.913-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov CONFIRM http://pear.php.net/package/LiveUser/download/ SREASON 466 SECTRACK 1015659 MISC http://www.gulftech.org/?node=research&article_id=00103-02212006 BUGTRAQ 20060221 PEAR LiveUser File Access Vulnerabilities BID 16761 VUPEN ADV-2006-0697 XF liveuser-liveuser-file-access(24852) XF liveuser-liveuser-file-deletion(24853) Directory traversal vulnerability in the "remember me" feature in liveuser.php in PHP Extension and Application Repository (PEAR) LiveUser 0.16.8 and earlier allows remote attackers to determine file existence, and possibly delete arbitrary files with short pathnames or possibly read arbitrary files, via a .. (dot dot) in the store_id value of a cookie. cpe:/a:mini-nuke:mini-nuke_cms:1.8.2 CVE-2006-0870 2006-02-23T18:02:00.000-05:00 2018-10-18T12:29:29.447-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.nukedx.com/?viewdoc=9 BUGTRAQ 20060220 MiniNuke CMS System all versions (pages.asp) SQL Injection BUGTRAQ 20060321 Mini-Nuke<=1.8.2 SQL injection (6) BUGTRAQ 20060420 Mini-NUKE v2.3<<--- SQL Injection BUGTRAQ 20060421 Re: Mini-NUKE v2.3<<--- SQL Injection BID 16730 BID 17636 XF mininuke-pages-sql-injection(24803) SQL injection vulnerability in pages.asp in Mini-Nuke CMS System 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: version 2.3 was later reported to be vulnerable as well. cpe:/a:mambo:mambo:4.5.3h cpe:/a:mambo:mambo:4.5.3h:h CVE-2006-0871 2006-02-24T06:02:00.000-05:00 2011-03-07T00:00:00.000-05:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov 2006-02-24T07:52:00.000-05:00 BUGTRAQ 20060224 Mambo Multiple Vulnerabilities SREASON 493 CONFIRM http://source.mambo-foundation.org/view/news/Announcements/Security_Patch_Released/ MISC http://www.gulftech.org/?node=research&article_id=00104-02242006 VUPEN ADV-2006-0719 Directory traversal vulnerability in the _setTemplate function in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to read and include arbitrary files via the mos_change_template parameter. NOTE: CVE-2006-1794 has been assigned to the SQL injection vector. cpe:/a:coppermine:coppermine_photo_gallery:1.4.3 CVE-2006-0872 2006-02-24T06:02:00.000-05:00 2017-07-19T21:30:08.690-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://coppermine-gallery.net/forum/index.php?topic=28062.0 MISC http://retrogod.altervista.org/cpg_143_adv.html MISC http://retrogod.altervista.org/cpg_143_incl_xpl.html SECTRACK 1015646 BUGTRAQ 20060218 Coppermine Photo Gallery <=1.4.3 remote code execution BID 16718 VUPEN ADV-2006-0669 XF coppermine-init-file-include(24814) Directory traversal vulnerability in init.inc.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the lang parameter. cpe:/a:coppermine:coppermine_photo_gallery:1.4.3 CVE-2006-0873 2006-02-24T06:02:00.000-05:00 2017-07-19T21:30:08.737-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://coppermine-gallery.net/forum/index.php?topic=28062.0 MISC http://retrogod.altervista.org/cpg_143_adv.html SECTRACK 1015646 BUGTRAQ 20060218 Coppermine Photo Gallery <=1.4.3 remote code execution BID 16718 VUPEN ADV-2006-0669 XF coppermine-showdoc-file-include(24816) Absolute path traversal vulnerability in docs/showdocs.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via the f parameter, and possibly remote files using UNC share pathnames. cpe:/a:intensive_point:iuser_ecommerce:2.1 CVE-2006-0874 2006-02-24T06:02:00.000-05:00 2017-07-19T21:30:08.787-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS CONFIRM http://www.intensivepoint.com/iuser-document.shtml BID 16787 XF iuser-ecommerce-undisclosed(24906) Multiple unspecified vulnerabilities in Intensive Point iUser Ecommerce before 2.2 have unspecified vectors and impact, as addressed by "Urgent secure fixes". NOTE: this might be a duplicate of CVE-2006-0854, but the vendor announcement for this issue (from January 8, 2005) is too vague to be sure, and CVE-2006-0854 does not provide version information. cpe:/a:runcms:runcms:1.1 cpe:/a:runcms:runcms:1.1a cpe:/a:runcms:runcms:1.2 cpe:/a:runcms:runcms:1.3a cpe:/a:runcms:runcms:1.3a2 cpe:/a:runcms:runcms:1.3a5 CVE-2006-0875 2006-02-24T06:02:00.000-05:00 2018-10-18T12:29:30.150-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://kapda.ir/advisory-267.html SECTRACK 1015663 BUGTRAQ 20060222 [KAPDA::#27] - Runcms 1.x Cross_Site_Scripting vulnerability BID 16769 VUPEN ADV-2006-0694 XF runcms-ratefile-xss(24871) Cross-site scripting vulnerability in ratefile.php in RunCMS 1.3a5 allows remote attackers to inject arbitrary web script or HTML via the lid parameter. cpe:/a:popfile:popfile:0.18.3 cpe:/a:popfile:popfile:0.19.1 cpe:/a:popfile:popfile:0.20.1 cpe:/a:popfile:popfile:0.21.2 CVE-2006-0876 2006-02-24T06:02:00.000-05:00 2011-03-07T21:30:59.377-05:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://popfile.sourceforge.net/cgi-bin/wiki.pl?ReleaseNotes/0.22.4 DEBIAN DSA-1061 BID 16792 VUPEN ADV-2006-0698 POPFile before 0.22.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors involving character sets within e-mail messages. cpe:/a:easy_forum:easy_forum:2.5 CVE-2006-0877 2006-02-24T06:02:00.000-05:00 2018-10-18T12:29:30.523-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/85/summary.html CONFIRM http://hot-things.net/forum/show.php?f=2&topic=20060224080919 BUGTRAQ 20060304 [eVuln] Easy Forum XSS Vulnerability BID 16958 VUPEN ADV-2006-0706 XF easyforum-join-xss(24831) Cross-site scripting vulnerability in Easy Forum 2.5 allows remote attackers to inject arbitrary web script or HTML via the image variable. cpe:/a:phpoutsourcing:noahs_classifieds:1.2 cpe:/a:phpoutsourcing:noahs_classifieds:1.3 CVE-2006-0878 2006-02-24T06:02:00.000-05:00 2018-10-18T12:29:31.307-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SECTRACK 1015667 MISC http://www.kapda.ir/advisory-268.html BUGTRAQ 20060222 [KAPDA::#29]Noah's classifieds multiple vulnerabilities VUPEN ADV-2006-0703 XF noahs-category-path-disclosure(24898) Noah's Classifieds 1.3 allows remote attackers to obtain the installation path via a direct request to include files, as demonstrated by classifieds/gorum/category.php. cpe:/a:phpoutsourcing:noahs_classifieds:1.2 cpe:/a:phpoutsourcing:noahs_classifieds:1.3 CVE-2006-0879 2006-02-24T06:02:00.000-05:00 2018-10-18T12:29:31.710-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1015667 MISC http://www.kapda.ir/advisory-268.html BUGTRAQ 20060222 [KAPDA::#29]Noah's classifieds multiple vulnerabilities BID 16773 VUPEN ADV-2006-0703 XF noahs-search-sql-injection(24896) SQL injection vulnerability in the search tool in Noah's Classifieds 1.3 allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors. cpe:/a:phpoutsourcing:noahs_classifieds:1.2 cpe:/a:phpoutsourcing:noahs_classifieds:1.3 CVE-2006-0880 2006-02-24T06:02:00.000-05:00 2018-10-18T12:29:32.163-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015667 MISC http://www.kapda.ir/advisory-268.html BUGTRAQ 20060222 [KAPDA::#29]Noah's classifieds multiple vulnerabilities BID 16772 VUPEN ADV-2006-0703 XF noahs-indexphp-xss(24895) Multiple cross-site scripting (XSS) vulnerabilities in index.php in Noah's Classifieds 1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) inf parameter; or, when register_globals is enabled, the (2) upperTemplate and (3) lowerTemplate parameters. cpe:/a:phpoutsourcing:noahs_classifieds:1.2 cpe:/a:phpoutsourcing:noahs_classifieds:1.3 CVE-2006-0881 2006-02-24T06:02:00.000-05:00 2018-10-18T12:29:32.617-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1015667 MISC http://www.kapda.ir/advisory-268.html BUGTRAQ 20060222 [KAPDA::#29]Noah's classifieds multiple vulnerabilities BID 16780 VUPEN ADV-2006-0703 XF noahs-gorumlib-file-include(24899) Multiple PHP remote file include vulnerabilities in gorum/gorumlib.php in Noah's Classifieds 1.3, when register_globals is enabled, allow remote attackers to include arbitrary PHP files via the (1) upperTemplate and (2) lowerTemplate parameters, as demonstrated using the lowerTemplate parameter to index.php. cpe:/a:phpoutsourcing:noahs_classifieds:1.2 cpe:/a:phpoutsourcing:noahs_classifieds:1.3 CVE-2006-0882 2006-02-24T06:02:00.000-05:00 2018-10-18T12:29:33.070-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015667 MISC http://www.kapda.ir/advisory-268.html BUGTRAQ 20060222 [KAPDA::#29]Noah's classifieds multiple vulnerabilities BID 16778 VUPEN ADV-2006-0703 XF noahs-include-directory-traversal(24900) Directory traversal vulnerability in include.php in Noah's Classifieds 1.3 allows remote attackers to include arbitrary local files via the otherTemplate parameter to index.php. cpe:/a:openbsd:openssh:3.8.1p1 cpe:/o:freebsd:freebsd:5.3 cpe:/o:freebsd:freebsd:5.3:release cpe:/o:freebsd:freebsd:5.3:releng cpe:/o:freebsd:freebsd:5.3:stable cpe:/o:freebsd:freebsd:5.4:pre-release cpe:/o:freebsd:freebsd:5.4:release cpe:/o:freebsd:freebsd:5.4:releng cpe:/o:freebsd:freebsd:5.4:stable CVE-2006-0883 2006-03-06T21:02:00.000-05:00 2017-07-19T21:30:09.237-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov FREEBSD FreeBSD-SA-06:09 CONFIRM http://bugzilla.mindrot.org/show_bug.cgi?id=839 SREASON 520 SECTRACK 1015706 BID 16892 VUPEN ADV-2006-0805 XF openssh-openpam-dos(25116) OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server, waiting for the password prompt, then disconnecting. cpe:/a:mozilla:thunderbird:0.1 cpe:/a:mozilla:thunderbird:0.2 cpe:/a:mozilla:thunderbird:0.3 cpe:/a:mozilla:thunderbird:0.4 cpe:/a:mozilla:thunderbird:0.5 cpe:/a:mozilla:thunderbird:0.6 cpe:/a:mozilla:thunderbird:0.7 cpe:/a:mozilla:thunderbird:0.7.1 cpe:/a:mozilla:thunderbird:0.7.2 cpe:/a:mozilla:thunderbird:0.7.3 cpe:/a:mozilla:thunderbird:0.8 cpe:/a:mozilla:thunderbird:0.9 cpe:/a:mozilla:thunderbird:1.0 cpe:/a:mozilla:thunderbird:1.0.1 cpe:/a:mozilla:thunderbird:1.0.2 cpe:/a:mozilla:thunderbird:1.0.5 cpe:/a:mozilla:thunderbird:1.0.6 cpe:/a:mozilla:thunderbird:1.0.7 CVE-2006-0884 2006-02-24T17:02:00.000-05:00 2018-10-18T12:29:33.570-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov SCO SCOSA-2006.26 SGI 20060404-01-U SUSE SUSE-SA:2006:021 SECTRACK 1015665 SUNALERT 102550 SUNALERT 228526 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm DEBIAN DSA-1046 DEBIAN DSA-1051 GENTOO GLSA-200604-18 GENTOO GLSA-200605-09 MANDRIVA MDKSA-2006:052 MANDRIVA MDKSA-2006:076 MANDRIVA MDKSA-2006:078 CONFIRM http://www.mozilla.org/security/announce/2006/mfsa2006-21.html SUSE SUSE-SA:2006:022 REDHAT RHSA-2006:0329 REDHAT RHSA-2006:0330 BUGTRAQ 20060222 Mozilla Thunderbird : Remote Code Execution & Denial of Service FEDORA FLSA:189137-1 HP HPSBUX02122 HP SSRT061236 BID 16770 VUPEN ADV-2006-3749 XF mozilla-inline-fwd-code-execution(25983) UBUNTU USN-276-1 The WYSIWYG rendering engine ("rich mail" editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass javascript security settings and obtain sensitive information or cause a crash via an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag, which is executed when the user edits the e-mail. cpe:/a:cutephp:cutenews:1.4.1 CVE-2006-0885 2006-02-25T06:02:00.000-05:00 2017-07-19T21:30:09.380-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://myimei.com/security/2006-02-20/cutenews141addcommentforprotectedusernamesxss-attack.html BUGTRAQ 20060221 [myimei]CuteNews1.4.1~ Add Comment For Protected UserNames~ XSS Attack BID 16740 VUPEN ADV-2006-0685 XF cutenews-shownews-xss(24835) Cross-site scripting (XSS) vulnerability in show_news.php in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the show parameter. cpe:/a:dev:dev_web_management_system:1.5 CVE-2006-0886 2006-02-25T06:02:00.000-05:00 2017-07-19T21:30:09.427-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16812 VUPEN ADV-2006-0723 XF dev-cityregion-xss(24875) Cross-site scripting (XSS) vulnerability in register.php in DEV web management system 1.5 allows remote attackers to inject arbitrary web script or HTML via the "City/Region" field (mesto variable). NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:phplib_team:phplib:7.4 CVE-2006-0887 2006-02-25T06:02:00.000-05:00 2017-07-19T21:30:09.487-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1016123 CONFIRM http://sourceforge.net/project/shownotes.php?group_id=31885&release_id=396091 MISC http://www.gulftech.org/?node=research&article_id=00107-03052006 BID 16801 VUPEN ADV-2006-0720 XF phplib-code-execution(24873) Eval injection vulnerability in sessions.inc in PHP Base Library (PHPLib) before 7.4a, when index.php3 from the PHPLib distribution is available on the server, allows remote attackers to execute arbitrary PHP code by including a base64-encoded representation of the code in a cookie. NOTE: this description was significantly updated on 20060605 to reflect new details after an initial vague advisory. cpe:/a:invision_power_services:invision_power_board:2.0.1 CVE-2006-0888 2006-02-25T06:02:00.000-05:00 2017-10-18T21:29:03.283-04:00 2.6 NETWORK HIGH NONE NONE NONE PARTIAL http://nvd.nist.gov BID 16616 EXPLOIT-DB 1489 index.php in Invision Power Board (IPB) 2.0.1, with Code Confirmation disabled, allows remote attackers to cause an unspecified denial of service by registering a large number of users. cpe:/a:brown_bear_software:calcium:3.10.1 CVE-2006-0889 2006-02-25T06:02:00.000-05:00 2017-07-19T21:30:09.537-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16851 VUPEN ADV-2006-0724 XF calcium-eventtext-xss(24907) Cross-site scripting (XSS) vulnerability in Calcium 3.10.1 allows remote attackers to inject arbitrary web script or HTML via the EventText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:speedproject:speedcommander:11.01_build4450 cpe:/a:speedproject:squeez:5.1 cpe:/a:speedproject:zipstar:5.1 CVE-2006-0890 2006-02-25T06:02:00.000-05:00 2018-10-18T12:29:38.163-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060224 SpeedCommander 11.0 & ZipStar 5.1 & Squeez 5.1 Directory traversal BID 16807 VUPEN ADV-2006-0731 XF speedproject-zip-jar-directory-traversal(24909) Directory traversal vulnerability in SpeedProject Squeez 5.1, as used in (1) ZipStar 5.1 and (2) SpeedCommander 11.01.4450, allows remote attackers to overwrite arbitrary files via unspecified manipulations in a (1) JAR or (2) ZIP archive. cpe:/a:nocc:nocc:1.0 CVE-2006-0891 2006-02-25T06:02:00.000-05:00 2017-07-19T21:30:09.643-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060223 NOCC Webmail <= 1.0 multiple vulnerabilities MISC http://retrogod.altervista.org/noccw_10_incl_xpl.html SECTRACK 1015671 BID 16793 XF nocc-index-file-include(24934) Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing NULL (%00) byte in (1) the _SESSION['nocc_theme'] parameter in (a) html/footer.php; and (2) the lang and (3) theme parameters and the (4) Accept-Language HTTP header field, when force_default_lang is disabled, in (b) index.php, as demonstrated by injecting PHP code into a profile and accessing it using the lang parameter in index.php. cpe:/a:nocc:nocc:1.0 CVE-2006-0892 2006-02-25T06:02:00.000-05:00 2008-09-05T17:00:29.647-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-02-27T08:27:00.000-05:00 ALLOWS_USER_ACCESS BUGTRAQ 20060223 NOCC Webmail <= 1.0 multiple vulnerabilities MISC http://retrogod.altervista.org/noccw_10_incl_xpl.html SECTRACK 1015671 BID 16793 NOCC Webmail 1.0 stores e-mail attachments in temporary files with predictable filenames, which makes it easier for remote attackers to execute arbitrary code by accessing the e-mail attachment via directory traversal vulnerabilities. cpe:/a:nocc:nocc:1.0 CVE-2006-0893 2006-02-25T06:02:00.000-05:00 2008-09-05T17:00:29.803-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov 2006-02-27T08:32:00.000-05:00 BUGTRAQ 20060223 NOCC Webmail <= 1.0 multiple vulnerabilities MISC http://retrogod.altervista.org/noccw_10_incl_xpl.html SECTRACK 1015671 BID 16793 NOCC Webmail 1.0 allows remote attackers to obtain sensitive information via a direct request to (1) the profiles directory, which leaks e-mail addresses contained in filenames of profiles, and (2) the tmp directory, which lists names of uploaded attachments. cpe:/a:nocc:nocc:1.0 CVE-2006-0894 2006-02-25T06:02:00.000-05:00 2008-09-05T17:00:29.960-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov 2006-02-27T09:03:00.000-05:00 BUGTRAQ 20060223 NOCC Webmail <= 1.0 multiple vulnerabilities MISC http://retrogod.altervista.org/noccw_10_incl_xpl.html SECTRACK 1015671 BID 16793 Multiple cross-site scripting (XSS) vulnerabilities in NOCC Webmail 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the html_error_occurred parameter in error.php, (2) html_filter_select parameter in filter_prefs.php, (3) html_no_mail parameter in no_mail.php, the (4) page_line, (5) prev, and (6) next parameters in html_bottom_table.php, and the (7) _SESSION['nocc_theme'] parameter in footer.php. cpe:/a:nocc:nocc:1.0 CVE-2006-0895 2006-02-25T06:02:00.000-05:00 2008-09-05T17:00:30.100-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov 2006-02-27T09:04:00.000-05:00 BUGTRAQ 20060223 NOCC Webmail <= 1.0 multiple vulnerabilities MISC http://retrogod.altervista.org/noccw_10_incl_xpl.html SREASON 478 SECTRACK 1015671 BID 16793 NOCC Webmail 1.0 allows remote attackers to obtain the installation path via a direct request to html/header.php. cpe:/a:simple_machines:simple_machines_forum:1.0.6 CVE-2006-0896 2006-02-25T06:02:00.000-05:00 2018-10-18T12:29:38.603-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov VIM 20060410 VEndor ACK: Simple Machines Forum Register.php X-Forwarded-For XSS MISC http://evuln.com/vulns/86/summary.html SREASON 545 BUGTRAQ 20060306 [eVuln] Simple Machines Forum - SMF 'X-Forwarded-For' XSS Vulnerability BID 16841 CONFIRM http://www.simplemachines.org/community/index.php?topic=78841.0 VUPEN ADV-2006-0726 XF smf-register-xss(24915) Cross-site scripting (XSS) vulnerability in Sources/Register.php in Simple Machine Forum (SMF) 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For HTTP header field. cpe:/a:virtual_communication_services:vpmi_enterprise:3.3 CVE-2006-0897 2006-02-25T06:02:00.000-05:00 2017-07-19T21:30:09.833-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS VIM 20060310 vendor dispute: VCS VIM 20060310 Re: vendor dispute: VCS BID 16798 VUPEN ADV-2006-0725 XF vpmi-servicerequests-sql-injection(24885) ** DISPUTED ** SQL injection vulnerability in VCS Virtual Program Management Intranet (VPMi) Enterprise 3.3 allows remote attackers to execute arbitrary SQL commands via the UpdateID0 parameter to Service_Requests.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: the vendor has disputed this issue, saying that "[we] have a behind the scenes complex state management system that uses a combination of keys placed in JavaScript and Session State (server side) that protects against the type of SQL injection you describe. We have tested for many of the cases and have not found it to be an issue." Further investigation suggests that the original researcher might have triggered errors using invalid field values, which is not proof of SQL injection; however, the vendor did not receive a response from the original researcher. cpe:/a:lincoln_d._stein:crypt_cbc:1.00 cpe:/a:lincoln_d._stein:crypt_cbc:1.10 cpe:/a:lincoln_d._stein:crypt_cbc:1.20 cpe:/a:lincoln_d._stein:crypt_cbc:1.21 cpe:/a:lincoln_d._stein:crypt_cbc:1.22 cpe:/a:lincoln_d._stein:crypt_cbc:1.24 cpe:/a:lincoln_d._stein:crypt_cbc:1.25 cpe:/a:lincoln_d._stein:crypt_cbc:2.00 cpe:/a:lincoln_d._stein:crypt_cbc:2.01 cpe:/a:lincoln_d._stein:crypt_cbc:2.02 cpe:/a:lincoln_d._stein:crypt_cbc:2.03 cpe:/a:lincoln_d._stein:crypt_cbc:2.04 cpe:/a:lincoln_d._stein:crypt_cbc:2.05 cpe:/a:lincoln_d._stein:crypt_cbc:2.07 cpe:/a:lincoln_d._stein:crypt_cbc:2.08 cpe:/a:lincoln_d._stein:crypt_cbc:2.09 cpe:/a:lincoln_d._stein:crypt_cbc:2.10 cpe:/a:lincoln_d._stein:crypt_cbc:2.11 cpe:/a:lincoln_d._stein:crypt_cbc:2.12 cpe:/a:lincoln_d._stein:crypt_cbc:2.13 cpe:/a:lincoln_d._stein:crypt_cbc:2.14 cpe:/a:lincoln_d._stein:crypt_cbc:2.15 cpe:/a:lincoln_d._stein:crypt_cbc:2.16 CVE-2006-0898 2006-02-25T06:02:00.000-05:00 2018-10-18T12:29:39.320-04:00 2.6 NETWORK HIGH NONE PARTIAL NONE NONE http://nvd.nist.gov REDHAT RHSA-2008:0630 SREASON 488 DEBIAN DSA-996 GENTOO GLSA-200603-15 SUSE SUSE-SR:2006:015 REDHAT RHSA-2008:0261 BUGTRAQ 20060223 Vulnerability in Crypt::CBC Perl module, versions <= 2.16 BID 16802 XF crypt-cbc-header-weak-encryption(24954) Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael. cpe:/a:4images:image_gallery_management_system:1.7.1 CVE-2006-0899 2006-02-27T14:06:00.000-05:00 2018-10-18T12:29:40.367-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov MISC http://retrogod.altervista.org/4images_171_adv.html SREASON 518 BUGTRAQ 20060301 4images <=1.7.1 remote code execution BID 16855 VUPEN ADV-2006-0754 XF 4images-template-file-include(24938) EXPLOIT-DB 1533 Directory traversal vulnerability in index.php in 4Images 1.7.1 and earlier allows remote attackers to read and include arbitrary files via ".." (dot dot) sequences in the template parameter. cpe:/o:freebsd:freebsd:6.0 CVE-2006-0900 2006-02-27T14:06:00.000-05:00 2017-07-19T21:30:10.003-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov FREEBSD FreeBSD-SA-06:10 MLIST [Dailydave] 20060226 fun with FreeBSD kernel SREASON 521 BID 16838 XF freebsd-nfsd-kernel-dos(24918) nfsd in FreeBSD 6.0 kernel allows remote attackers to cause a denial of service via a crafted NFS mount request, as demonstrated by the ProtoVer NFS test suite. cpe:/o:sun:solaris:8.0::x86 cpe:/o:sun:solaris:9.0::sparc cpe:/o:sun:solaris:9.0::x86 cpe:/o:sun:solaris:10.0::sparc cpe:/o:sun:solaris:10.0::x86 cpe:/o:sun:sunos:5.8 CVE-2006-0901 2006-02-27T14:06:00.000-05:00 2018-10-30T12:25:37.090-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015680 SUNALERT 102161 BID 16826 VUPEN ADV-2006-0756 XF solaris-hsfs-privilege-elevation(24911) Unspecified vulnerability in the hsfs filesystem in Solaris 8, 9, and 10 allows unspecified attackers to cause a denial of service (panic) or execute arbitrary code. cpe:/a:mysql:mysql:4.0.20 cpe:/a:mysql:mysql:4.0.21 cpe:/a:mysql:mysql:4.0.23 cpe:/a:mysql:mysql:4.0.24 cpe:/a:mysql:mysql:4.0.25 cpe:/a:mysql:mysql:4.0.26 cpe:/a:mysql:mysql:4.0.27 cpe:/a:mysql:mysql:4.1.0:alpha cpe:/a:mysql:mysql:4.1.0.0 cpe:/a:mysql:mysql:4.1.2:alpha cpe:/a:mysql:mysql:4.1.3 cpe:/a:mysql:mysql:4.1.3:beta cpe:/a:mysql:mysql:4.1.4 cpe:/a:mysql:mysql:4.1.5 cpe:/a:mysql:mysql:4.1.6 cpe:/a:mysql:mysql:4.1.7 cpe:/a:mysql:mysql:4.1.8 cpe:/a:mysql:mysql:4.1.9 cpe:/a:mysql:mysql:4.1.10 cpe:/a:mysql:mysql:4.1.11 cpe:/a:mysql:mysql:4.1.12 cpe:/a:mysql:mysql:4.1.13 cpe:/a:mysql:mysql:4.1.14 cpe:/a:mysql:mysql:4.1.15 cpe:/a:mysql:mysql:4.1.16 cpe:/a:mysql:mysql:4.1.17 cpe:/a:mysql:mysql:4.1.18 cpe:/a:mysql:mysql:4.1.19 cpe:/a:mysql:mysql:5.0.0:alpha cpe:/a:mysql:mysql:5.0.1 cpe:/a:mysql:mysql:5.0.2 cpe:/a:mysql:mysql:5.0.3:beta cpe:/a:mysql:mysql:5.0.4 cpe:/a:mysql:mysql:5.0.5 cpe:/a:mysql:mysql:5.0.6 cpe:/a:mysql:mysql:5.0.7 cpe:/a:mysql:mysql:5.0.8 cpe:/a:mysql:mysql:5.0.9 cpe:/a:mysql:mysql:5.0.10 cpe:/a:mysql:mysql:5.0.11 cpe:/a:mysql:mysql:5.0.12 cpe:/a:mysql:mysql:5.0.13 cpe:/a:mysql:mysql:5.0.14 cpe:/a:mysql:mysql:5.0.15 cpe:/a:mysql:mysql:5.0.16 cpe:/a:mysql:mysql:5.0.17 cpe:/a:mysql:mysql:5.0.18 cpe:/a:oracle:mysql:3.23 cpe:/a:oracle:mysql:3.23.0:alpha cpe:/a:oracle:mysql:3.23.1 cpe:/a:oracle:mysql:3.23.2 cpe:/a:oracle:mysql:3.23.3 cpe:/a:oracle:mysql:3.23.4 cpe:/a:oracle:mysql:3.23.5 cpe:/a:oracle:mysql:3.23.6 cpe:/a:oracle:mysql:3.23.7 cpe:/a:oracle:mysql:3.23.8 cpe:/a:oracle:mysql:3.23.9 cpe:/a:oracle:mysql:3.23.10 cpe:/a:oracle:mysql:3.23.11 cpe:/a:oracle:mysql:3.23.12 cpe:/a:oracle:mysql:3.23.13 cpe:/a:oracle:mysql:3.23.14 cpe:/a:oracle:mysql:3.23.15 cpe:/a:oracle:mysql:3.23.16 cpe:/a:oracle:mysql:3.23.17 cpe:/a:oracle:mysql:3.23.18 cpe:/a:oracle:mysql:3.23.19 cpe:/a:oracle:mysql:3.23.20:beta cpe:/a:oracle:mysql:3.23.21 cpe:/a:oracle:mysql:3.23.22 cpe:/a:oracle:mysql:3.23.23 cpe:/a:oracle:mysql:3.23.24 cpe:/a:oracle:mysql:3.23.25 cpe:/a:oracle:mysql:3.23.26 cpe:/a:oracle:mysql:3.23.27 cpe:/a:oracle:mysql:3.23.28:gamma cpe:/a:oracle:mysql:3.23.29 cpe:/a:oracle:mysql:3.23.30 cpe:/a:oracle:mysql:3.23.31 cpe:/a:oracle:mysql:3.23.32 cpe:/a:oracle:mysql:3.23.33 cpe:/a:oracle:mysql:3.23.34 cpe:/a:oracle:mysql:3.23.35 cpe:/a:oracle:mysql:3.23.36 cpe:/a:oracle:mysql:3.23.37 cpe:/a:oracle:mysql:3.23.38 cpe:/a:oracle:mysql:3.23.39 cpe:/a:oracle:mysql:3.23.40 cpe:/a:oracle:mysql:3.23.41 cpe:/a:oracle:mysql:3.23.42 cpe:/a:oracle:mysql:3.23.43 cpe:/a:oracle:mysql:3.23.44 cpe:/a:oracle:mysql:3.23.45 cpe:/a:oracle:mysql:3.23.46 cpe:/a:oracle:mysql:3.23.47 cpe:/a:oracle:mysql:3.23.48 cpe:/a:oracle:mysql:3.23.49 cpe:/a:oracle:mysql:3.23.50 cpe:/a:oracle:mysql:3.23.51 cpe:/a:oracle:mysql:3.23.52 cpe:/a:oracle:mysql:3.23.53 cpe:/a:oracle:mysql:3.23.54 cpe:/a:oracle:mysql:3.23.55 cpe:/a:oracle:mysql:3.23.56 cpe:/a:oracle:mysql:3.23.57 cpe:/a:oracle:mysql:3.23.58 cpe:/a:oracle:mysql:3.23.59 cpe:/a:oracle:mysql:4.0.0 cpe:/a:oracle:mysql:4.0.1 cpe:/a:oracle:mysql:4.0.2 cpe:/a:oracle:mysql:4.0.3 cpe:/a:oracle:mysql:4.0.4 cpe:/a:oracle:mysql:4.0.5 cpe:/a:oracle:mysql:4.0.5a cpe:/a:oracle:mysql:4.0.6 cpe:/a:oracle:mysql:4.0.7 cpe:/a:oracle:mysql:4.0.7:gamma cpe:/a:oracle:mysql:4.0.8 cpe:/a:oracle:mysql:4.0.8:gamma cpe:/a:oracle:mysql:4.0.9 cpe:/a:oracle:mysql:4.0.9:gamma cpe:/a:oracle:mysql:4.0.10 cpe:/a:oracle:mysql:4.0.11 cpe:/a:oracle:mysql:4.0.11:gamma cpe:/a:oracle:mysql:4.0.12 cpe:/a:oracle:mysql:4.0.13 cpe:/a:oracle:mysql:4.0.14 cpe:/a:oracle:mysql:4.0.15 cpe:/a:oracle:mysql:4.0.16 cpe:/a:oracle:mysql:4.0.17 cpe:/a:oracle:mysql:4.0.18 cpe:/a:oracle:mysql:4.0.19 CVE-2006-0903 2006-02-27T18:02:00.000-05:00 2019-10-07T12:42:35.120-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060225 mysql <= 5.0.18 CONFIRM http://bugs.mysql.com/bug.php?id=17667 MISC http://rst.void.ru/papers/advisory39.txt SECTRACK 1015693 DEBIAN DSA-1071 DEBIAN DSA-1073 DEBIAN DSA-1079 MANDRIVA MDKSA-2006:064 REDHAT RHSA-2006:0544 REDHAT RHSA-2007:0083 REDHAT RHSA-2008:0364 BID 16850 UBUNTU USN-274-2 VUPEN ADV-2006-0752 XF mysql-query-log-bypass-security(24966) UBUNTU USN-274-1 MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function. NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query. CVE-2006-0904 2017-05-11T10:29:03.557-04:00 2017-05-11T10:29:03.573-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2006. Notes: none. cpe:/o:freebsd:freebsd:4.8 cpe:/o:freebsd:freebsd:4.8:pre-release cpe:/o:freebsd:freebsd:4.8:release_p7 cpe:/o:freebsd:freebsd:4.8:releng cpe:/o:freebsd:freebsd:4.9 cpe:/o:freebsd:freebsd:4.9:pre-release cpe:/o:freebsd:freebsd:4.9:releng cpe:/o:freebsd:freebsd:4.10 cpe:/o:freebsd:freebsd:4.10:release cpe:/o:freebsd:freebsd:4.10:release_p8 cpe:/o:freebsd:freebsd:4.10:releng cpe:/o:freebsd:freebsd:4.11:release_p3 cpe:/o:freebsd:freebsd:4.11:releng cpe:/o:freebsd:freebsd:4.11:stable cpe:/o:freebsd:freebsd:5.0 cpe:/o:freebsd:freebsd:5.0:alpha cpe:/o:freebsd:freebsd:5.0:release_p14 cpe:/o:freebsd:freebsd:5.0:releng cpe:/o:freebsd:freebsd:5.1 cpe:/o:freebsd:freebsd:5.1:alpha cpe:/o:freebsd:freebsd:5.1:release cpe:/o:freebsd:freebsd:5.1:release_p5 cpe:/o:freebsd:freebsd:5.1:releng cpe:/o:freebsd:freebsd:5.2 cpe:/o:freebsd:freebsd:5.2.1:release cpe:/o:freebsd:freebsd:5.2.1:releng cpe:/o:freebsd:freebsd:5.3 cpe:/o:freebsd:freebsd:5.3:release cpe:/o:freebsd:freebsd:5.3:releng cpe:/o:freebsd:freebsd:5.3:stable cpe:/o:freebsd:freebsd:5.4:pre-release cpe:/o:freebsd:freebsd:5.4:release cpe:/o:freebsd:freebsd:5.4:releng cpe:/o:freebsd:freebsd:5.4:stable cpe:/o:freebsd:freebsd:6.0:release cpe:/o:freebsd:freebsd:6.0:stable cpe:/o:netbsd:netbsd:2.0 cpe:/o:netbsd:netbsd:3.0 CVE-2006-0905 2006-03-23T06:06:00.000-05:00 2017-07-19T21:30:10.207-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FREEBSD FreeBSD-SA-06:11 NETBSD NetBSD-SA2006-011 SECTRACK 1015809 BID 17191 XF bsd-ipsec-replay(25398) A "programming error" in fast_ipsec in FreeBSD 4.8-RELEASE through 6.1-STABLE and NetBSD 2 through 3 does not properly update the sequence number associated with a Security Association, which allows packets to pass sequence number checks and allows remote attackers to capture IPSec packets and conduct replay attacks. cpe:/a:top_line:d3jeeb_pro:3 CVE-2006-0906 2006-02-27T21:02:00.000-05:00 2018-10-18T12:29:41.057-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1015687 BUGTRAQ 20060226 2 SQL Injection in d3jeeb BID 16853 VUPEN ADV-2006-0757 XF d3jeeb-catid-sql-injection(24941) SQL injection vulnerability in D3Jeeb Pro 3 allows remote attackers to execute arbitrary SQL commands via the catid parameter in (1) fastlinks.php and (2) catogary.php. cpe:/a:francisco_burzi:php-nuke:7.8 CVE-2006-0907 2006-02-27T21:02:00.000-05:00 2018-10-18T12:29:41.477-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060225 [waraxe-2006-SA#047] - Evading sql-injection filters in phpNuke 7.8 MISC http://www.waraxe.us/advisory-47.html SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter. cpe:/a:francisco_burzi:php-nuke:7.8_patched_3.2 CVE-2006-0908 2006-02-27T21:02:00.000-05:00 2018-10-18T12:29:41.617-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 497 BUGTRAQ 20060225 [waraxe-2006-SA#047] - Evading sql-injection filters in phpNuke 7.8 MISC http://www.waraxe.us/advisory-47.html PHP-Nuke 7.8 Patched 3.2 allows remote attackers to bypass SQL injection protection mechanisms via /%2a (/*) sequences with the "ad_click" word in the query string, as demonstrated via the kala parameter. cpe:/a:invision_power_services:invision_power_board:2.0.0 cpe:/a:invision_power_services:invision_power_board:2.0.1 cpe:/a:invision_power_services:invision_power_board:2.0.2 cpe:/a:invision_power_services:invision_power_board:2.0.3 cpe:/a:invision_power_services:invision_power_board:2.0.4 cpe:/a:invision_power_services:invision_power_board:2.1.0 cpe:/a:invision_power_services:invision_power_board:2.1.1 cpe:/a:invision_power_services:invision_power_board:2.1.2 cpe:/a:invision_power_services:invision_power_board:2.1.3 cpe:/a:invision_power_services:invision_power_board:2.1.4 cpe:/a:invision_power_services:invision_power_board:2.1_beta2 cpe:/a:invision_power_services:invision_power_board:2.1_beta3 cpe:/a:invision_power_services:invision_power_board:2.1_beta4 cpe:/a:invision_power_services:invision_power_board:2.1_beta5 cpe:/a:invision_power_services:invision_power_board:2.1_rc1 CVE-2006-0909 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:41.837-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://neosecurityteam.net/advisories/Advisory-16.txt MISC http://neosecurityteam.net/index.php?action=advisories&id=16 BUGTRAQ 20060221 Invision Power Board 2.1.4 Multiple Vulnerabilities BUGTRAQ 20070419 IPB (Invision Power Board) Full Path Disclusure XF invisionpowerboard-multiple-info-disclosure(24840) Invision Power Board (IPB) 2.1.4 and earlier allows remote attackers to view sensitive information via a direct request to multiple PHP scripts that include the full path in error messages, including (1) PEAR/Text/Diff/Renderer/inline.php, (2) PEAR/Text/Diff/Renderer/unified.php, (3) PEAR/Text/Diff3.php, (4) class_db.php, (5) class_db_mysql.php, and (6) class_xml.php in the ips_kernel/ directory; (7) mysql_admin_queries.php, (8) mysql_extra_queries.php, (9) mysql_queries.php, and (10) mysql_subsm_queries.php in the sources/sql directory; (11) sources/acp_loaders/acp_pages_components.php; (12) sources/action_admin/member.php and (13) sources/action_admin/paysubscriptions.php; (14) login.php, (15) messenger.php, (16) moderate.php, (17) paysubscriptions.php, (18) register.php, (19) search.php, (20) topics.php, (21) and usercp.php in the sources/action_public directory; (22) bbcode/class_bbcode.php, (23) bbcode/class_bbcode_legacy.php, (24) editor/class_editor_rte.php, (25) editor/class_editor_std.php, (26) post/class_post.php, (27) post/class_post_edit.php, (28) post/class_post_new.php, (29) and post/class_post_reply.php in the sources/classes directory; (30) sources/components_acp/registration_DEPR.php; (31) sources/handlers/han_paysubscriptions.php; (32) func_usercp.php; (33) search_mysql_ftext.php, and (34) search_mysql_man.php in the sources/lib/ directory; and (35) convert/auth.php.bak, (36) external/auth.php, and (37) ldap/auth.php in the sources/loginauth directory. cpe:/a:invision_power_services:invision_power_board:2.0.0 cpe:/a:invision_power_services:invision_power_board:2.0.1 cpe:/a:invision_power_services:invision_power_board:2.0.2 cpe:/a:invision_power_services:invision_power_board:2.0.3 cpe:/a:invision_power_services:invision_power_board:2.0.4 cpe:/a:invision_power_services:invision_power_board:2.1.0 cpe:/a:invision_power_services:invision_power_board:2.1.1 cpe:/a:invision_power_services:invision_power_board:2.1.2 cpe:/a:invision_power_services:invision_power_board:2.1.3 cpe:/a:invision_power_services:invision_power_board:2.1.4 cpe:/a:invision_power_services:invision_power_board:2.1_beta2 cpe:/a:invision_power_services:invision_power_board:2.1_beta3 cpe:/a:invision_power_services:invision_power_board:2.1_beta4 cpe:/a:invision_power_services:invision_power_board:2.1_beta5 cpe:/a:invision_power_services:invision_power_board:2.1_rc1 CVE-2006-0910 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:42.290-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://neosecurityteam.net/advisories/Advisory-16.txt MISC http://neosecurityteam.net/index.php?action=advisories&id=16 BUGTRAQ 20060221 Invision Power Board 2.1.4 Multiple Vulnerabilities XF invisionpowerboard-multiple-info-disclosure(24840) Invision Power Board (IPB) 2.1.4 and earlier allows remote attackers to list directory contents via a direct request to multiple directories, including (1) sources/loginauth/convert/, (2) sources/portal_plugins/, (3) cache/skin_cache/cacheid_2/, (4) ips_kernel/PEAR/, (5) ips_kernel/PEAR/Text/, (6) ips_kernel/PEAR/Text/Diff/, (7) ips_kernel/PEAR/Text/Diff/Renderer/, (8) style_images/1/folder_rte_files/, (9) style_images/1/folder_js_skin/, (10) style_images/1/folder_rte_images/, and (11) upgrade/ and its subdirectories. cpe:/a:ipswitch:whatsup:professional_2006 CVE-2006-0911 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:42.603-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SREASON 472 BUGTRAQ 20060222 IpSwitch WhatsUp Professional 2006 DoS BID 16771 VUPEN ADV-2006-0704 MISC http://zur.homelinux.com/Advisories/ipswitch_dos.txt XF whatsup-nmservice-dos(24864) NmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of service (CPU consumption) via crafted requests to Login.asp, possibly involving the (1) "In]" and (2) "b;tnLogIn" parameters, or (3) malformed btnLogIn parameters, possibly involving missing "[" (open bracket) or "[" (closing bracket) characters, as demonstrated by "&btnLogIn=[Log&In]=&" or "&b;tnLogIn=[Log&In]=&" in the URL. NOTE: due to the lack of diagnosis by the original researcher, the precise nature of the vulnerability is unclear. cpe:/a:oreka:oreka:0.1 cpe:/a:oreka:oreka:0.2 cpe:/a:oreka:oreka:0.3 cpe:/a:oreka:oreka:0.4 CVE-2006-0912 2006-02-28T06:02:00.000-05:00 2011-03-07T21:31:04.547-05:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://oreka.sourceforge.net/ BID 16937 VUPEN ADV-2006-0812 Oreka before 0.5 allows remote attackers to cause a denial of service (application crash) via a "certain RTP sequence." cpe:/a:mozilla:bugzilla:2.17.1 cpe:/a:mozilla:bugzilla:2.17.3 cpe:/a:mozilla:bugzilla:2.17.4 cpe:/a:mozilla:bugzilla:2.17.5 cpe:/a:mozilla:bugzilla:2.17.6 cpe:/a:mozilla:bugzilla:2.17.7 cpe:/a:mozilla:bugzilla:2.18:rc1 cpe:/a:mozilla:bugzilla:2.18:rc2 cpe:/a:mozilla:bugzilla:2.18:rc3 cpe:/a:mozilla:bugzilla:2.18.1 cpe:/a:mozilla:bugzilla:2.18.2 cpe:/a:mozilla:bugzilla:2.18.3 cpe:/a:mozilla:bugzilla:2.18.4 cpe:/a:mozilla:bugzilla:2.19 cpe:/a:mozilla:bugzilla:2.19.1 cpe:/a:mozilla:bugzilla:2.19.2 cpe:/a:mozilla:bugzilla:2.19.3 cpe:/a:mozilla:bugzilla:2.20 cpe:/a:mozilla:bugzilla:2.20:rc1 cpe:/a:mozilla:bugzilla:2.20:rc2 cpe:/a:mozilla:bugzilla:2.21 cpe:/a:mozilla:bugzilla:2.21.1 CVE-2006-0913 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:43.087-04:00 5.5 NETWORK LOW SINGLE_INSTANCE NONE PARTIAL PARTIAL http://nvd.nist.gov BUGTRAQ 20060221 [BUGZILLA] Security Advisory for Bugzilla 2.20, 2.21.1, and 2.18.4 BID 16738 VUPEN ADV-2006-0692 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=312498 XF bugzilla-editparams-sql-injection(24819) SQL injection vulnerability in whineatnews.pl in Bugzilla 2.17 through 2.18.4 and 2.20 allows remote authenticated users with administrative privileges to execute arbitrary SQL commands via the whinedays parameter, as accessible from editparams.cgi. cpe:/a:mozilla:bugzilla:2.16.10 cpe:/a:mozilla:bugzilla:2.17 cpe:/a:mozilla:bugzilla:2.17.4 cpe:/a:mozilla:bugzilla:2.17.5 cpe:/a:mozilla:bugzilla:2.17.6 cpe:/a:mozilla:bugzilla:2.17.7 cpe:/a:mozilla:bugzilla:2.18 cpe:/a:mozilla:bugzilla:2.18:rc1 cpe:/a:mozilla:bugzilla:2.18:rc2 cpe:/a:mozilla:bugzilla:2.18.1 cpe:/a:mozilla:bugzilla:2.18.2 cpe:/a:mozilla:bugzilla:2.18.3 cpe:/a:mozilla:bugzilla:2.18.4 cpe:/a:mozilla:bugzilla:2.20:rc1 cpe:/a:mozilla:bugzilla:2.20:rc2 CVE-2006-0914 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:43.633-04:00 5.5 NETWORK LOW SINGLE_INSTANCE NONE PARTIAL PARTIAL http://nvd.nist.gov BUGTRAQ 20060221 [BUGZILLA] Security Advisory for Bugzilla 2.20, 2.21.1, and 2.18.4 VUPEN ADV-2006-0692 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=312498 XF bugzilla-duplicates-sql-injection(42802) Bugzilla 2.16.10, 2.17 through 2.18.4, and 2.20 does not properly handle certain characters in the mostfreqthreshold parameter in duplicates.cgi, which allows remote attackers to trigger a SQL error. cpe:/a:mozilla:bugzilla:2.16.10 CVE-2006-0915 2006-02-28T06:02:00.000-05:00 2011-03-07T21:31:04.893-05:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS VUPEN ADV-2006-0692 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=313441 Bugzilla 2.16.10 does not properly handle certain characters in the (1) maxpatchsize and (2) maxattachmentsize parameters in attachment.cgi, which allows remote attackers to trigger a SQL error. cpe:/a:mozilla:bugzilla:2.19.3 cpe:/a:mozilla:bugzilla:2.20 cpe:/a:mozilla:bugzilla:2.20:rc1 cpe:/a:mozilla:bugzilla:2.20:rc2 cpe:/a:mozilla:bugzilla:2.21 cpe:/a:mozilla:bugzilla:2.21.1 cpe:/a:mozilla:bugzilla:2.21.2 CVE-2006-0916 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:43.993-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 464 BUGTRAQ 20060221 [BUGZILLA] Security Advisory for Bugzilla 2.20, 2.21.1, and 2.18.4 BID 16745 VUPEN ADV-2006-0692 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=325079 XF bugzilla-login-data-redirection(24821) Bugzilla 2.19.3 through 2.20 does not properly handle "//" sequences in URLs when redirecting a user from the login form, which could cause it to generate a partial URL in a form action that causes the user's browser to send the form data to another domain. cpe:/a:melange:melange_chat_system:1.10 CVE-2006-0917 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:44.477-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SREASON 463 MISC http://www.oh2600.com/forum/viewtopic.php?t=43 BUGTRAQ 20060221 grab cookie information with Melange Chat Server 1.10 BID 16747 XF melange-chat-command-information-disclosure(24868) Melange Chat Server (aka M-Chat), when accessed via a web browser, automatically sends cookies and other sensitive information for a server to any port specified in the associated link, which allows local users on that server to read the cookies from HTTP headers and possibly gain sensitive information, such as credentials, by setting up a listening port and reading the credentials when the victim clicks on the link. cpe:/a:ritlabs:the_bat:3.60.07 CVE-2006-0918 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:44.900-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SREASON 485 MISC http://www.nsag.ru/vuln/953.html BUGTRAQ 20060223 NSA Group Security Advisory NSAG-&sup1;198-23.02.2006 Vulnerability The Bat v. 3.60.07 BID 16797 VUPEN ADV-2006-0717 XF thebat-subject-bo(24882) Buffer overflow in RITLabs The Bat! 3.60.07 allows remote attackers to execute arbitrary code via a long Subject field. cpe:/a:oi:email_marketing_system:3.0 CVE-2006-0919 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:45.367-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.h4cky0u.org/advisories/HYSA-2006-003-oi-email.txt BUGTRAQ 20060223 HYSA-2006-003 Oi! Email Marketing 3.0 SQL Injection VUPEN ADV-2006-0718 SQL injection vulnerability in index.php (aka the login page) in Oi! Email Marketing System 3.0 (aka Oi! 3) allows remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields. cpe:/a:oi:email_marketing_system:3.0 CVE-2006-0920 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:45.680-04:00 1.7 LOCAL LOW SINGLE_INSTANCE PARTIAL NONE NONE http://nvd.nist.gov SREASON 483 MISC http://www.h4cky0u.org/advisories/HYSA-2006-003-oi-email.txt BUGTRAQ 20060223 HYSA-2006-003 Oi! Email Marketing 3.0 SQL Injection BID 16794 Oi! Email Marketing System 3.0 (aka Oi! 3) stores the server's FTP password in cleartext on a Configuration web page, which allows local users with superadministrator privileges, or attackers who have obtained access to the web page, to view the password. cpe:/a:fckeditor:fckeditor:2.0_fc CVE-2006-0921 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:45.963-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov SREASON 484 MISC http://www.nsag.ru/vuln/952.html BUGTRAQ 20060223 NSA Group Security Advisory NSAG-&sup1;195-23.02.2006 Vulnerability FCKeditor 2.0 FC BUGTRAQ 20060519 Re: NSA Group Security Advisory NSAG-&sup1;195-23.02.2006 Vulnerability FCKeditor 2.0 FC XF fckeditor-connector-obtain-information(24878) Multiple directory traversal vulnerabilities in connector.php in FCKeditor 2.0 FC, as used in products such as RunCMS, allow remote attackers to list and create arbitrary directories via a .. (dot dot) in the CurrentFolder parameter to (1) GetFoldersAndFiles and (2) CreateFolder. cpe:/a:devellion:cubecart:3.0.0_alpha cpe:/a:devellion:cubecart:3.0.0_alpha-2 cpe:/a:devellion:cubecart:3.0.0_alpha-rgf cpe:/a:devellion:cubecart:3.0.0_beta cpe:/a:devellion:cubecart:3.0.0_final cpe:/a:devellion:cubecart:3.0.1 cpe:/a:devellion:cubecart:3.0.2 cpe:/a:devellion:cubecart:3.0.3 cpe:/a:devellion:cubecart:3.0.4 cpe:/a:devellion:cubecart:3.0.5 cpe:/a:devellion:cubecart:3.0.6 CVE-2006-0922 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:46.400-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 482 CONFIRM http://www.cubecart.com/site/forums/index.php?showtopic=14704 MISC http://www.cubecart.com/site/forums/index.php?showtopic=14817 MISC http://www.cubecart.com/site/forums/index.php?showtopic=14825 MISC http://www.cubecart.com/site/forums/index.php?showtopic=14960 MISC http://www.cubecart.com/site/forums/index.php?showtopic=14972 MISC http://www.nsag.ru/vuln/892.html BUGTRAQ 20060223 NSA Group Security Advisory NSAG-&sup1;197-23.02.2006 Vulnerability CubeCart 3.0.0 ? 3.0.6 BID 16796 XF cubecart-connector-file-include(24883) CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php (aka upload.php) that allows remote attackers to upload arbitrary files via a modified CurrentFolder parameter in a direct request to admin/filemanager/upload.php. cpe:/a:myphpnuke:myphpnuke:1.8.8 cpe:/a:myphpnuke:myphpnuke:1.8.8_7 cpe:/a:myphpnuke:myphpnuke:1.8.8_8_rc2 CVE-2006-0923 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:47.087-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 491 CONFIRM http://www.myphpnuke.com/article.php?sid=1035&mode=thread&order=0 MISC http://www.nukedx.com/?viewdoc=12 BUGTRAQ 20060224 Advisory: MyPHPNuke <= 1.8.8 multiple XSS vulnerabilities BID 16815 VUPEN ADV-2006-0750 XF myphpnuke-reviews-download-xss(24887) Multiple cross-site scripting (XSS) vulnerabilities in MyPHPNuke (MPN) 1.88 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the letter parameter in reviews.php and (2) the dcategory parameter in download.php. cpe:/a:brown_bear_software:ical:3.10 CVE-2006-0924 2006-02-28T06:02:00.000-05:00 2017-07-19T21:30:11.050-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16845 VUPEN ADV-2006-0727 XF ical-calendartext-xss(24919) Cross-site scripting (XSS) vulnerability in Brown Bear iCal 3.10 allows remote attackers to inject arbitrary web script or HTML via the Calendar Text field when a new event is added. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:alt-n:mdaemon:8.1.1 cpe:/a:alt-n:mdaemon:8.1.4 CVE-2006-0925 2006-02-28T06:02:00.000-05:00 2017-07-19T21:30:11.097-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://www.nsag.ru/vuln/888.html BID 16854 VUPEN ADV-2006-0729 XF mdaemon-imap-foldername-dos(24916) Format string vulnerability in the IMAP4rev1 server in Alt-N MDaemon 8.1.1 and possibly 8.1.4 allows remote attackers to cause a denial of service (CPU consumption) by creating and then listing folders whose names contain format string specifiers. cpe:/a:smithmicro:stuffit_deluxe:9.0 cpe:/a:smithmicro:stuffit_expander:9.0.0.21_engine_9.0.0.21 cpe:/a:smithmicro:stuffit_standard:9.0 cpe:/a:smithmicro:zipmagic_deluxe:9.0 CVE-2006-0926 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:47.617-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://www.hamid.ir/security/stuffit.txt BUGTRAQ 20060224 StuffIt and ZipMagic Family of products Directory traversal BID 16806 VUPEN ADV-2006-0732 XF stuffit-zipmagic-archive-directory-traversal(24886) Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0, ZipMagic Deluxe 9.0, and StuffIt Expander 9.0.0.21 Engine 9.0.0.21 allow remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive. cpe:/a:jgs-xa:jgs-gallery_addon:4.0 cpe:/a:woltlab:burning_board:2.0 cpe:/a:woltlab:burning_board:2.0.3 cpe:/a:woltlab:burning_board:2.1.5 cpe:/a:woltlab:burning_board:2.2.1 cpe:/a:woltlab:burning_board:2.2.2 cpe:/a:woltlab:burning_board:2.2.3 cpe:/a:woltlab:burning_board:2.3.0 cpe:/a:woltlab:burning_board:2.3.1 CVE-2006-0927 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:48.087-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060224 Advisory: Woltlab Burning Board 2.x (JGS-Gallery MOD <= 4.0) multiple XSS vulnerabilities MISC http://www.nukedx.com/?viewdoc=11 BUGTRAQ 20060224 Advisory: Woltlab Burning Board 2.x (JGS-Gallery MOD <= 4.0)multiple XSS vulnerabilities BID 16810 BID 16843 XF wbb-jgsgallerymod-xss(24888) Multiple cross-site scripting (XSS) vulnerabilities in the JGS-XA JGS-Gallery Addon 4.0.0 and earlier for Woltlab Burning Board (wBB) 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) userid parameter in (a) jgs_galerie_slideshow.php and (b) jgs_galerie_scroll.php, and the (2) katid parameter in (c) jgs_galerie_slideshow.php. cpe:/a:argosoft:argosoft_mail_server:1.8::pro CVE-2006-0928 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:48.523-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://www.nsag.ru/vuln/879.html BUGTRAQ 20060224 NSA Group Security Advisory NSAG-&sup1;198-23.02.2006 Vulnerability ArGoSoft Mail Server Pro BID 16808 VUPEN ADV-2006-0733 The POP3 Server in ArGoSoft Mail Server Pro 1.8 allows remote attackers to obtain sensitive information via the _DUMP command, which reveals the operating system, registered user, and registration code. cpe:/a:argosoft:argosoft_mail_server:1.8.8.1::pro CVE-2006-0929 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:48.820-04:00 4.0 NETWORK LOW SINGLE_INSTANCE NONE PARTIAL NONE http://nvd.nist.gov MISC http://www.nsag.ru/vuln/878.html BUGTRAQ 20060224 NSA Group Security Advisory NSAG-&sup1;200-24.02.2006 Vulnerability ArGoSoft Mail Server Pro IMAP BID 16809 VUPEN ADV-2006-0733 Directory traversal vulnerability in the IMAP server in ArGoSoft Mail Server Pro 1.8.8.1 allows remote authenticated users to create arbitrary folders via a .. (dot dot) in the RENAME command. cpe:/a:argosoft:argosoft_mail_server:1.8::pro CVE-2006-0930 2006-02-28T06:02:00.000-05:00 2011-03-07T21:31:09.923-05:00 4.0 NETWORK LOW SINGLE_INSTANCE PARTIAL NONE NONE http://nvd.nist.gov SREASON 487 MISC http://www.nsag.ru/vuln/877.html VUPEN ADV-2006-0733 Directory traversal vulnerability in Webmail in ArGoSoft Mail Server Pro 1.8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the UIDL parameter. cpe:/a:pear:pear_archive_tar:1.2 cpe:/a:pear:pear_archive_tar:1.3.0 cpe:/a:pear:pear_archive_tar:1.3.1 CVE-2006-0931 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:49.117-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://pear.php.net/bugs/bug.php?id=6933 CONFIRM http://pear.php.net/package/Archive_Tar/download/ MISC http://www.hamid.ir/security/phptar.txt BUGTRAQ 20060224 Archive_Tar v 1.2(Tested) (Tar file management class) Directory traversal BID 16805 VUPEN ADV-2006-0728 Directory traversal vulnerability in PEAR::Archive_Tar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive. cpe:/a:pear:pear_archive_zip:1.1 CVE-2006-0932 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:49.603-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 486 MISC http://www.hamid.ir/security/phpzip.txt BUGTRAQ 20060224 Archive_Tar v 1.2(Tested) (Tar file management class) Directory traversal BUGTRAQ 20060225 Archive_Zip (Zip file management class) Directory traversal XF ziplib-directory-traversal(24972) Directory traversal vulnerability in zip.lib.php 0.1.1 in PEAR::Archive_Zip allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a ZIP archive. cpe:/a:phpx:phpx:3.5.9 CVE-2006-0933 2006-02-28T06:02:00.000-05:00 2017-07-19T21:30:11.317-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16799 VUPEN ADV-2006-0722 XF phpx-xcode-tag-xss(24874) Cross-site scripting (XSS) vulnerability in PHPX 3.5.9 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a url XCode tag in a posted message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:limbo_cms:limbo_cms:1.0.4.2 CVE-2006-0934 2006-02-28T06:02:00.000-05:00 2017-07-19T21:30:11.380-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16811 VUPEN ADV-2006-0721 XF webinsta-limbo-contact-form-xss(24877) Cross-site scripting (XSS) vulnerability in webinsta Limbo 1.0.4.2 allows remote attackers to inject arbitrary web script or HTML via the message field in the Contact Form. cpe:/a:microsoft:word:2003 CVE-2006-0935 2006-02-28T06:02:00.000-05:00 2008-09-05T17:00:36.553-04:00 2.6 NETWORK HIGH NONE NONE NONE PARTIAL http://nvd.nist.gov 2006-02-28T13:21:00.000-05:00 MLIST [Dailydave] 20060221 word dos 4fun BID 16782 Microsoft Word 2003 allows remote attackers to cause a denial of service (application crash) via a crafted file, as demonstrated by 101_filefuzz. cpe:/a:free_host_shop:website_generator:3.3 CVE-2006-0936 2006-02-28T06:02:00.000-05:00 2018-10-18T12:29:49.993-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://nsag.ru/vuln/894.html BUGTRAQ 20060225 NSA Group Security Advisory NSAG-&sup1;202-25.02.2006 Vulnerability WEBSITE GENERATOR 3.3 BID 16823 Free Host Shop Website Generator 3.3 allows remote authenticated users with administrative privileges to upload and execute arbitrary files via a formname parameter with a filename containing a dangerous file extension and a trailing %00. cpe:/a:unu_networks:mailgust:1.9 CVE-2006-0937 2006-02-28T06:02:00.000-05:00 2017-07-19T21:30:11.427-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://nsag.ru/vuln/890.html XF mailgust-index-info-disclosure(24890) U.N.U. Mailgust 1.9 allows remote attackers to obtain sensitive information via a direct request to index.php with method=showfullcsv, which reveals the POP3 server configuration, including account name and password. cpe:/a:ez:ez_publish:3.4.8 cpe:/a:ez:ez_publish:3.5.4 cpe:/a:ez:ez_publish:3.5.5 cpe:/a:ez:ez_publish:3.5.6 cpe:/a:ez:ez_publish:3.5.7 cpe:/a:ez:ez_publish:3.5.8 cpe:/a:ez:ez_publish:3.6.0 cpe:/a:ez:ez_publish:3.6.1 cpe:/a:ez:ez_publish:3.6.2 cpe:/a:ez:ez_publish:3.6.3 cpe:/a:ez:ez_publish:3.6.4 cpe:/a:ez:ez_publish:3.6.5 cpe:/a:ez:ez_publish:3.7.0 cpe:/a:ez:ez_publish:3.7.1 cpe:/a:ez:ez_publish:3.7.2 cpe:/a:ez:ez_publish:3.7.3 CVE-2006-0938 2006-02-28T21:02:00.000-05:00 2018-10-18T12:29:50.260-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015683 MISC http://www.nukedx.com/?viewdoc=16 BUGTRAQ 20060225 Advisory: eZ publish <= 3.7.3 (imagecatalogue module) XSSvulnerability BID 16817 XF ezpublish-referrerurl-xss(24956) Cross-site scripting (XSS) vulnerability in eZ publish 3.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the RefererURL parameter. cpe:/a:dci-designs:dci-taskeen:1.03 CVE-2006-0939 2006-02-28T21:02:00.000-05:00 2017-07-19T21:30:11.583-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 495 SECTRACK 1015685 BUGTRAQ 20060225 SQL Injection in DCI-Taskeen BID 16828 XF dci-taskeen-multiple-scripts-sql-injection(24963) SQL injection vulnerability in DCI-Taskeen 1.03 allows remote attackers to execute arbitrary SQL commands via the (1) id or (2) action parameter to (a) basket.php, or (3) id or (4) page parameter to (b) cat.php. cpe:/a:cynical_games:shoutlive:1.1.0 CVE-2006-0940 2006-02-28T21:02:00.000-05:00 2018-10-18T12:29:50.667-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/87/summary.html SREASON 557 BUGTRAQ 20060307 [eVuln] ShoutLIVE PHP Code Execution & Multiple XSS Vulnerabilities BID 16857 VUPEN ADV-2006-0755 XF shoutlive-savesettings-file-include(24897) Multiple direct static code injection vulnerabilities in savesettings.php in ShoutLIVE 1.1.0 allow remote attackers to execute arbitrary PHP code via variables that are written to settings.php. cpe:/a:cynical_games:shoutlive:1.1.0 CVE-2006-0941 2006-02-28T21:02:00.000-05:00 2018-10-18T12:29:51.243-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/87/summary.html SREASON 557 BUGTRAQ 20060307 [eVuln] ShoutLIVE PHP Code Execution & Multiple XSS Vulnerabilities BID 16857 VUPEN ADV-2006-0755 XF shoutlive-post-xss(24901) Multiple cross-site scripting (XSS) vulnerabilities in post.php in ShoutLIVE 1.1.0 allow remote attackers to inject arbitrary web script or HTML via certain variables when posting new messages. cpe:/a:pwsphp:pwsphp:1.2.3 CVE-2006-0942 2006-02-28T21:02:00.000-05:00 2008-09-05T17:00:37.630-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-02-28T21:54:00.000-05:00 ALLOWS_OTHER_ACCESS MISC http://downloads.securityfocus.com/vulnerabilities/exploits/PwsPHP_SQL_Inj.php BID 16567 SQL injection vulnerability in profil.php in PwsPHP 1.2.3, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the aff_news_form parameter, a different vulnerability than CVE-2005-1509. cpe:/a:pwsphp:pwsphp:1.2.3 CVE-2006-0943 2006-02-28T21:02:00.000-05:00 2018-10-18T12:29:51.773-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 496 SECTRACK 1015684 CONFIRM http://www.pwsphp.com/index.php?mod=news&ac=commentaires&id=278 BUGTRAQ 20060225 PwsPHP Injection SQL on Index.php BUGTRAQ 20060226 Re: PwsPHP Injection SQL on Index.php VUPEN ADV-2006-0748 SQL injection vulnerability in the sondages module in index.php in PwsPHP 1.2.3 allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. cpe:/a:archangelmgt:weblog:0.90.02 CVE-2006-0944 2006-02-28T21:02:00.000-05:00 2018-10-18T12:29:52.197-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1015689 BUGTRAQ 20060226 Archangel Weblog 0.90.02 Admin Authentication Bypass & Remote File Inclusion BID 16848 XF archangel-admin-auth-bypass(24984) EXPLOIT-DB 3859 Archangel Weblog 0.90.02 allows remote attackers to bypass authentication by setting the ba_admin cookie to 1. cpe:/a:archangelmgt:weblog:0.90.02 CVE-2006-0945 2006-02-28T21:02:00.000-05:00 2018-10-18T12:29:52.680-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1015689 BUGTRAQ 20060226 Archangel Weblog 0.90.02 Admin Authentication Bypass & Remote File Inclusion BID 16848 XF archangel-index-file-include(25142) PHP remote file include vulnerability in admin/index.php in Archangel Weblog 0.90.02 allows remote authenticated administrators to execute arbitrary PHP code via a URL ending in a NULL (%00) in the index parameter. cpe:/h:thomson:speedtouch:516_5.3.2.6.0 cpe:/h:thomson:speedtouch:530_5.3.2.6.0 cpe:/h:thomson:speedtouch:536_5.3.2.6.0 cpe:/h:thomson:speedtouch:546_5.3.2.6.0 cpe:/h:thomson:speedtouch:576_5.3.2.6.0 cpe:/h:thomson:speedtouch:580_5.3.2.6.0 cpe:/h:thomson:speedtouch:585_5.3.2.6.0 CVE-2006-0946 2006-02-28T21:02:00.000-05:00 2017-07-19T21:30:11.880-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015688 BUGTRAQ 20060226 Thomson SpeedTouch 500 modems vulnerable to XSS BID 16839 VUPEN ADV-2006-0765 XF speedtouch-localnetwork-xss(24977) Cross-site scripting (XSS) vulnerability in Thomson SpeedTouch modems running firmware 5.3.2.6.0 allows remote attackers to inject arbitrary web script or HTML via the name parameter to the LocalNetwork page. cpe:/h:thomson:speedtouch:516_5.3.2.6.0 cpe:/h:thomson:speedtouch:530_5.3.2.6.0 cpe:/h:thomson:speedtouch:536_5.3.2.6.0 cpe:/h:thomson:speedtouch:546_5.3.2.6.0 cpe:/h:thomson:speedtouch:576_5.3.2.6.0 cpe:/h:thomson:speedtouch:580_5.3.2.6.0 cpe:/h:thomson:speedtouch:585_5.3.2.6.0 CVE-2006-0947 2006-02-28T21:02:00.000-05:00 2011-03-07T21:31:25.737-05:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1015688 BUGTRAQ 20060226 Thomson SpeedTouch 500 modems vulnerable to XSS BID 16839 VUPEN ADV-2006-0765 Thomson SpeedTouch modem running firmware 5.3.2.6.0 allows remote attackers to create users that cannot be deleted via scripting code in the "31" parameter in a NewUser function, which is not filtered by the modem when creating the account, but cannot be deleted by the administrator, possibly due to cleansing that occurs in the administrator interface. cpe:/a:aol:aol:9.0_4184.2340 CVE-2006-0948 2006-08-21T14:04:00.000-04:00 2018-10-18T12:29:53.087-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SREASON 1416 SECTRACK 1016717 BUGTRAQ 20060818 Secunia Research: AOL Insecure Default Directory Permissions BID 19583 VUPEN ADV-2006-3317 XF aol-default-insecure-permissions(28445) AOL 9.0 Security Edition revision 4184.2340, and probably other versions, uses insecure permissions (Everyone/Full Control) for the "America Online 9.0" directory, which allows local users to gain privileges by replacing critical files. cpe:/a:raidenhttpd:raidenhttpd:1.1.47 CVE-2006-0949 2006-03-06T16:02:00.000-05:00 2017-07-19T21:30:12.003-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BID 16934 VUPEN ADV-2006-0807 XF raidenhttpd-extension-obtain-information(25037) RaidenHTTPD 1.1.47 allows remote attackers to obtain source code of script files, including PHP, via crafted requests involving (1) "." (dot), (2) space, and (3) "/" (slash) characters. cpe:/a:unalz:unalz:0.53 CVE-2006-0950 2006-03-13T14:34:00.000-05:00 2018-10-18T12:29:53.743-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060313 Secunia Research: unalz Filename Handling SREASON 575 SECTRACK 1015780 BUGTRAQ 20060313 Secunia Research: unalz Filename Handling Directory TraversalVulnerability BID 17105 VUPEN ADV-2006-0938 XF unalz-archive-directory-traversal(25171) unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." (dot dot) sequences in a filename. cpe:/a:eset_software:nod32_antivirus:2.5 CVE-2006-0951 2006-04-07T21:04:00.000-04:00 2011-03-07T21:31:26.080-05:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS VUPEN ADV-2006-1242 The GUI (nod32.exe) in NOD32 2.5 runs with SYSTEM privileges when the scheduler runs a scheduled on-demand scan, which allows local users to execute arbitrary code during a scheduled scan via unspecified attack vectors. cpe:/a:nufw:nufw_firewall:1.0.20 CVE-2006-0956 2006-03-02T18:02:00.000-05:00 2011-03-07T21:31:26.173-05:00 1.7 LOCAL LOW SINGLE_INSTANCE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://www.nufw.org/+NuFW-1-21-minor-security-fix+.html BID 16868 VUPEN ADV-2006-0762 nuauth in NuFW before 1.0.21 does not properly handle blocking TLS sockets, which allows remote authenticated users to cause a denial of service (service hang) by flooding packets at the authentication server. cpe:/a:zoneo-soft:freeforum:1.0 cpe:/a:zoneo-soft:freeforum:1.0.1 cpe:/a:zoneo-soft:freeforum:1.1 cpe:/a:zoneo-soft:freeforum:1.1.1 cpe:/a:zoneo-soft:freeforum:1.1.2 cpe:/a:zoneo-soft:freeforum:1.2 CVE-2006-0957 2006-03-02T18:02:00.000-05:00 2018-10-18T12:29:54.463-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/89/summary.html CONFIRM http://soft.zoneo.net/freeForum/changes.php BUGTRAQ 20060310 [eVuln] FreeForum PHP Code Execution & Multiple XSS Vulnerabilities BID 16871 VUPEN ADV-2006-0759 Direct static code injection vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to execute arbitrary PHP code via the (1) X-Forwarded-For and (2) Client-Ip HTTP headers, which are stored in Data/flood.db.php. cpe:/a:zoneo-soft:freeforum:1.0 cpe:/a:zoneo-soft:freeforum:1.0.1 cpe:/a:zoneo-soft:freeforum:1.1 cpe:/a:zoneo-soft:freeforum:1.1.1 cpe:/a:zoneo-soft:freeforum:1.1.2 cpe:/a:zoneo-soft:freeforum:1.2 CVE-2006-0958 2006-03-02T18:02:00.000-05:00 2018-10-18T12:29:54.837-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/89/summary.html CONFIRM http://soft.zoneo.net/freeForum/changes.php BUGTRAQ 20060310 [eVuln] FreeForum PHP Code Execution & Multiple XSS Vulnerabilities BID 16877 VUPEN ADV-2006-0759 XF freeforum-func-xss(24925) Cross-site scripting (XSS) vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) subject parameters. cpe:/a:mybulletinboard:mybulletinboard:1.0.3 cpe:/a:mybulletinboard:mybulletinboard:1.0.4 CVE-2006-0959 2006-03-02T18:02:00.000-05:00 2018-10-18T12:29:55.337-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 512 BUGTRAQ 20060228 MyBB 1.3 NewSQL Injection BUGTRAQ 20060303 MyBB 1.04 Perl Exploit BID 16631 VUPEN ADV-2006-0774 XF mybb-misc-sql-injection(24953) EXPLOIT-DB 1539 SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands by setting the comma variable value via the comma parameter in a cookie. NOTE: 1.04 has also been reported to be affected. cpe:/h:compex:netpassage_wpe54g CVE-2006-0960 2006-03-02T18:02:00.000-05:00 2017-07-19T21:30:12.237-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SECTRACK 1015690 MISC http://www.security.nnov.ru/Ldocument605.html BID 16894 VUPEN ADV-2006-0780 XF netpassage-udp-dos(24968) uConfig agent in Compex NetPassage WPE54G router allows remote attackers to cause a denial of service (unresposiveness) via crafted datagrams to UDP port 7778. cpe:/a:cilem:cilem_haber:1.1 CVE-2006-0961 2006-03-02T18:02:00.000-05:00 2017-10-18T21:29:03.487-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060224 Advisory: CilemNews System <= 1.1 Remote SQL Injection Vulnerability FULLDISC 20060224 Advisory: CilemNews System <= 1.1 Remote SQL SECTRACK 1015677 MISC http://www.nukedx.com/?viewdoc=10 BID 16813 VUPEN ADV-2006-0881 XF cilemnews-sql-injection(24920) EXPLOIT-DB 1562 SQL injection vulnerability in yazdir.asp in Cilem Hiber 1.1 allows remote attackers to execute arbitrary SQL commands via the haber_id parameter. NOTE: this product has also been referred to as "Cilem News," although that does not appear to be the proper name. cpe:/a:vubb:vubb:0.2 CVE-2006-0962 2006-03-02T18:02:00.000-05:00 2017-10-18T21:29:03.550-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BID 16930 VUPEN ADV-2006-0799 XF vubb-index-sql-injection(25019) EXPLOIT-DB 1543 SQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the pass parameter in a cookie. cpe:/a:stlport:stlport:5.0.0 cpe:/a:stlport:stlport:5.0.1 CVE-2006-0963 2006-03-02T18:02:00.000-05:00 2017-07-19T21:30:12.393-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://sourceforge.net/project/shownotes.php?release_id=397543 BID 16928 VUPEN ADV-2006-0800 XF stlport-strcpy-local-bo(25159) Multiple buffer overflows in STLport 5.0.2 might allow local users to execute arbitrary code via (1) long locale environment variables to a strcpy function call in c_locale_glibc2.c and (2) long arguments to unspecified functions in num_put_float.cpp. cpe:/a:ncp_network_communications:secure_client:8.11_build_146 CVE-2006-0964 2006-03-02T18:02:00.000-05:00 2018-10-18T12:29:56.103-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060301 NCP VPN/PKI Client - various Bugs BUGTRAQ 20060301 NCP VPN/PKI Client - various Bugs BID 16906 XF ncp-client-firewall-bypass-security(25242) Client Firewall in NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to bypass firewall program execution rules by replacing an allowed program with an arbitrary program. cpe:/a:ncp_network_communications:secure_client:8.11_build_146 CVE-2006-0965 2006-03-02T18:02:00.000-05:00 2018-10-18T12:29:56.477-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060301 NCP VPN/PKI Client - various Bugs BUGTRAQ 20060301 NCP VPN/PKI Client - various Bugs BID 16906 XF ncp-ncpmon-bo(25243) NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to bypass security protections and configure privileged options via a long argument to ncpmon.exe, which provides access to alternate privileged menus, possibly due to a buffer overflow. cpe:/a:ncp_network_communications:secure_client:8.11_build_146 CVE-2006-0966 2006-03-02T18:02:00.000-05:00 2018-10-18T12:29:56.837-04:00 2.1 LOCAL LOW NONE NONE NONE PARTIAL http://nvd.nist.gov FULLDISC 20060301 NCP VPN/PKI Client - various Bugs BUGTRAQ 20060301 NCP VPN/PKI Client - various Bugs BID 16906 XF ncp-ncprwsnt-dos(25248) NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to cause a denial of service (CPU consumption) via a large number of arguments to ncprwsnt.exe, possibly due to a buffer overflow. cpe:/a:ncp_network_communications:secure_client:8.11_build_146 CVE-2006-0967 2006-03-02T18:02:00.000-05:00 2018-10-18T12:29:57.197-04:00 2.1 LOCAL LOW NONE NONE NONE PARTIAL http://nvd.nist.gov FULLDISC 20060301 NCP VPN/PKI Client - various Bugs BUGTRAQ 20060301 NCP VPN/PKI Client - various Bugs BID 16906 XF ncp-udp-dos(25249) NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to cause a denial of service (memory usage and cpu utilization) via a flood of arbitrary UDP datagrams to ports 0 to 65000. NOTE: this issue was reported as a buffer overflow, but that term usually does not apply in flooding attacks. cpe:/a:ncp_network_communications:secure_client:8.11_build_146 CVE-2006-0968 2006-03-02T18:02:00.000-05:00 2018-10-18T12:29:57.540-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS FULLDISC 20060301 NCP VPN/PKI Client - various Bugs SREASON 524 BUGTRAQ 20060301 NCP VPN/PKI Client - various Bugs BID 16906 XF ncp-connect-command-execution(25251) The ncprwsnt service in NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to execute arbitrary code by modifying the connect.bat script, which is automatically executed by the service after a connection is established. cpe:/a:pixelartkingdom:top_sites CVE-2006-0969 2006-03-03T06:02:00.000-05:00 2018-10-18T12:29:57.963-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 507 BUGTRAQ 20060227 PixelArtKingdom TopSites Remote Command Exucetion PHP remote file inclusion vulnerability in index.php in Top sites de PixelArtKingdom allows remote attackers to include and execute arbitrary files via the page parameter. cpe:/a:activecampaign:1-2-all cpe:/a:activecampaign:general cpe:/a:activecampaign:isalient cpe:/a:activecampaign:knowledgebuilder cpe:/a:activecampaign:supporttrio cpe:/a:activecampaign:visualedit CVE-2006-0970 2006-03-03T06:02:00.000-05:00 2018-10-18T12:29:58.133-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 505 BUGTRAQ 20060227 Knowledgebases Remote Command Exucetion XF activecampaign-index-command-execution(24989) PHP remote file inclusion vulnerability in index.php in one or more ActiveCampaign products, possibly SupportTrio, allows remote attackers to include and execute arbitrary files via the page parameter. cpe:/a:lionel_reyero:directcontact:0.3b CVE-2006-0971 2006-03-03T06:02:00.000-05:00 2018-10-18T12:29:58.447-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov FULLDISC 20060227 directory traversal in DirectContact 0.3b SREASON 506 SECTRACK 1015686 BUGTRAQ 20060227 directory traversal in DirectContact 0.3b BUGTRAQ 20060312 directory traversal Fixed in DirectContact 0.3c BID 16849 VUPEN ADV-2006-0761 MISC http://www3.autistici.org/fdonato/advisory/DirectContact0.3b-adv.txt XF directcontact-dotdot-dir-traversal(24930) Directory traversal vulnerability in Lionel Reyero DirectContact 0.3b allows remote attackers to read arbitrary files via a .. (dot dot) in the URL. cpe:/a:fscripts:fantastic_news:2.1.1 CVE-2006-0972 2006-03-03T06:02:00.000-05:00 2018-10-18T12:29:59.227-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SREASON 501 BUGTRAQ 20060226 2 SQL Injection in Fantastic News BID 16842 XF fantasticnews-news-sql-injection(24943) SQL injection vulnerability in news.php in Tony Baird Fantastic News 2.1.1 allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the category vector is already covered by CVE-2005-3846. cpe:/a:phpwebsite:phpwebsite:0.7.3 cpe:/a:phpwebsite:phpwebsite:0.8.2 cpe:/a:phpwebsite:phpwebsite:0.8.3 cpe:/a:phpwebsite:phpwebsite:0.9.3 cpe:/a:phpwebsite:phpwebsite:0.9.3.1 cpe:/a:phpwebsite:phpwebsite:0.9.3.2 cpe:/a:phpwebsite:phpwebsite:0.9.3.3 cpe:/a:phpwebsite:phpwebsite:0.9.3.4 cpe:/a:phpwebsite:phpwebsite:0.10 cpe:/a:phpwebsite:phpwebsite:0.10.1 cpe:/a:phpwebsite:phpwebsite:0.10.2 CVE-2006-0973 2006-03-03T06:02:00.000-05:00 2018-10-18T12:29:59.523-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov BUGTRAQ 20060412 phpWebSite 0.10.? (topics.php) Remote SQL Injection Exploit BUGTRAQ 20060523 sql injection in phpWebSite 0.8.3 BID 16825 MISC http://www.securityfocus.com/data/vulnerabilities/exploits/phpWebSite-topic-sql-inj.pl XF phpwebsite-topics-sql-injection(25799) EXPLOIT-DB 1525 SQL injection vulnerability in topics.php in Appalachian State University phpWebSite 0.10.2 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter. cpe:/a:battleaxe_software:bttlxeforum:2.0 CVE-2006-0974 2006-03-03T06:02:00.000-05:00 2017-07-19T21:30:12.957-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060226 bttlxeForum 2.* XSS Vulnerability BID 16821 VUPEN ADV-2006-0776 XF bttlxeforum-failure-xss(24981) Cross-site scripting (XSS) vulnerability in failure.asp in Battleaxe bttlxeForum 2.0 allows remote attackers to inject arbitrary web script or HTML via the err_txt parameter. CVE-2006-0975 2006-03-03T06:02:00.000-05:00 2008-09-10T16:04:47.507-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-0459. Reason: This candidate is a reservation duplicate of CVE-2006-0459. Notes: All CVE users should reference CVE-2006-0459 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. cpe:/a:spid:spid:1.3.1 CVE-2006-0976 2006-03-03T06:02:00.000-05:00 2018-10-18T12:30:00.070-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://www.nsag.ru/vuln/955.html BUGTRAQ 20060225 NSA Group Security Advisory NSAG-&sup1;201-25.02.2006 Vulnerability SPiD v1.3.1 BID 16822 VUPEN ADV-2006-0766 XF spid-scanlanginsert-file-include(24955) Directory traversal vulnerability in scan_lang_insert.php in Boris Herbiniere-Seve SPiD 1.3.1 allows remote attackers to read arbitrary files via the lang parameter. cpe:/a:craig_morrison:mts_pro CVE-2006-0977 2006-03-03T06:02:00.000-05:00 2018-10-18T12:30:00.477-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060225 Mail Transport System Professional--Open Relay Hole BID 16840 VUPEN ADV-2006-0786 XF mts-mail-relay(24985) Craig Morrison Mail Transport System Professional (aka MTS Pro) acts as an open relay when configured to relay all mail through an external SMTP server, which allows remote attackers to relay mail by connecting to the MTS Pro server, then sending a MAIL FROM that specifies a domain that is local to the server. cpe:/a:argosoft:argosoft_mail_server:1.8.8.5::pro CVE-2006-0978 2006-03-03T06:02:00.000-05:00 2018-10-18T12:30:00.837-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 504 BUGTRAQ 20060227 Secunia Research: ArGoSoft Mail Server Pro viewheaders ScriptInsertion BID 16834 VUPEN ADV-2006-0751 XF argosoft-mailserverpro-viewheaders-xss(24945) Multiple cross-site scripting (XSS) vulnerabilities in the View Headers (aka viewheaders) functionality in ArGoSoft Mail Server Pro 1.8.8.5 allow remote attackers to inject arbitrary web script or HTML via (1) the Subject header, (2) the From header, and (3) certain other unspecified headers. cpe:/a:nidelven_it:issue_dealer:0.9.95 CVE-2006-0979 2006-03-03T06:02:00.000-05:00 2017-07-19T21:30:13.160-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov CONFIRM http://issuedealer.com/changes/ BID 16884 XF issuedealer-unpublished-issue-disclosure(24929) Unspecified vulnerability in the local weblog publisher in Nidelven IT Issue Dealer before 0.9.96 has unknown impact and attack vectors. cpe:/a:jay_eckles:cgi_calendar:2.7 CVE-2006-0980 2006-03-03T06:02:00.000-05:00 2018-10-18T12:30:01.367-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060226 CGI Calendar XSS Vulnerability VUPEN ADV-2006-0764 XF cgicalendar-index-viewday-xss(24946) Multiple cross-site scripting (XSS) vulnerabilities in Jay Eckles CGI Calendar 2.7 allow remote attackers to inject arbitrary web script or HTML via the year parameter in (1) index.cgi and (2) viewday.cgi. cpe:/a:e-merge:e-merge_winace:2.6 CVE-2006-0981 2006-03-03T06:02:00.000-05:00 2018-10-18T12:30:01.680-04:00 4.0 NETWORK HIGH NONE PARTIAL PARTIAL NONE http://nvd.nist.gov MISC http://www.hamid.ir/security/winace.txt BUGTRAQ 20060224 WinAce Archiver v2.6 Directory traversal BID 16800 VUPEN ADV-2006-0730 XF winace-rar-tar-directory-traversal(24902) Directory traversal vulnerability in e-merge WinAce 2.6 and earlier allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive. cpe:/a:mcafee:virex:7.7::macintosh CVE-2006-0982 2006-03-03T06:02:00.000-05:00 2018-10-18T12:30:02.150-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060228 Virex on-access scanning unreliable The on-access scanner for McAfee Virex 7.7 for Macintosh, in some circumstances, might not activate when malicious content is accessed from the web browser, and might not prevent the content from being saved, which allows remote attackers to bypass virus protection, as demonstrated using the EICAR test file. cpe:/a:david_barrett:qwikiwiki:1.4 CVE-2006-0983 2006-03-03T06:02:00.000-05:00 2018-10-18T12:30:02.260-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 510 MISC http://sourceforge.net/forum/forum.php?forum_id=438526 BUGTRAQ 20060228 QwikiWiki v1.4 XSS Vulnerability BID 16874 XF qwikiwiki-index-xss(24950) Cross-site scripting (XSS) vulnerability in index.php in QwikiWiki 1.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter. cpe:/a:ej3:topo:2.2.178 CVE-2006-0984 2006-03-03T06:02:00.000-05:00 2018-10-18T12:30:02.697-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 511 BUGTRAQ 20060228 EJ3 TOPo - Cross Site Scripting Vulnerability BID 16879 VUPEN ADV-2006-0775 XF topo-incheader-xss(24980) Cross-site scripting (XSS) vulnerability in inc_header.php in EJ3 TOPo 2.2.178 allows remote attackers to inject arbitrary web script or HTML via the gTopNombre parameter. cpe:/a:wordpress:wordpress:1.0 cpe:/a:wordpress:wordpress:1.0.1 cpe:/a:wordpress:wordpress:1.0.2 cpe:/a:wordpress:wordpress:1.2 cpe:/a:wordpress:wordpress:1.5 cpe:/a:wordpress:wordpress:1.5.1 cpe:/a:wordpress:wordpress:1.5.1.2 cpe:/a:wordpress:wordpress:1.5.1.3 cpe:/a:wordpress:wordpress:2.0 cpe:/a:wordpress:wordpress:2.0.1 CVE-2006-0985 2006-03-03T06:02:00.000-05:00 2018-10-18T12:30:03.180-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://NeoSecurityTeam.net/advisories/Advisory-17.txt BUGTRAQ 20060227 WordPress 2.0.1 Multiple Vulnerabilities BUGTRAQ 20060228 FW: WordPress 2.0.1 Multiple Vulnerabilities BUGTRAQ 20060302 Re: FW: WordPress 2.0.1 Multiple Vulnerabilities VUPEN ADV-2006-0777 XF wordpress-wpcommentspost-xss(24957) Multiple cross-site scripting (XSS) vulnerabilities in the "post comment" functionality of WordPress 2.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) website, and (3) comment parameters. cpe:/a:wordpress:wordpress:1.0 cpe:/a:wordpress:wordpress:1.0.1 cpe:/a:wordpress:wordpress:1.0.2 cpe:/a:wordpress:wordpress:1.2 cpe:/a:wordpress:wordpress:1.5 cpe:/a:wordpress:wordpress:1.5.1 cpe:/a:wordpress:wordpress:1.5.1.2 cpe:/a:wordpress:wordpress:1.5.1.3 cpe:/a:wordpress:wordpress:2.0 cpe:/a:wordpress:wordpress:2.0.1 CVE-2006-0986 2006-03-03T06:02:00.000-05:00 2018-10-18T12:30:03.807-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://NeoSecurityTeam.net/advisories/Advisory-17.txt BUGTRAQ 20060227 WordPress 2.0.1 Multiple Vulnerabilities BUGTRAQ 20060228 FW: WordPress 2.0.1 Multiple Vulnerabilities BUGTRAQ 20060302 Re: FW: WordPress 2.0.1 Multiple Vulnerabilities VUPEN ADV-2006-0777 WordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) default-filters.php, (2) template-loader.php, (3) rss-functions.php, (4) locale.php, (5) wp-db.php, and (6) kses.php in the wp-includes/ directory; and (7) edit-form-advanced.php, (8) admin-functions.php, (9) edit-link-form.php, (10) edit-page-form.php, (11) admin-footer.php, and (12) menu.php in the wp-admin directory; and possibly (13) list directory contents of the wp-includes directory. NOTE: the vars.php, edit-form.php, wp-settings.php, and edit-form-comment.php vectors are already covered by CVE-2005-4463. The menu-header.php vector is already covered by CVE-2005-2110. Other vectors might be covered by CVE-2005-1688. NOTE: if the typical installation of WordPress does not list any site-specific files to wp-includes, then vector [13] is not an exposure. cpe:/a:isc:bind:9.3.2 CVE-2006-0987 2006-03-03T06:02:00.000-05:00 2018-10-18T12:30:04.337-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://dns.measurement-factory.com/surveys/sum1.html CONFIRM http://kb.isc.org/article/AA-00269 BUGTRAQ 20060228 recursive DNS servers DDoS as a growing DDoS problem MISC http://www.us-cert.gov/reading_room/DNS-recursion121605.pdf The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses. cpe:/o:microsoft:windows_2000 cpe:/o:microsoft:windows_2003_server:r2 cpe:/o:microsoft:windows_nt:4.0 CVE-2006-0988 2006-03-03T06:02:00.000-05:00 2018-10-18T12:30:04.603-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov MISC http://dns.measurement-factory.com/surveys/sum1.html BUGTRAQ 20060228 recursive DNS servers DDoS as a growing DDoS problem MISC http://www.us-cert.gov/reading_room/DNS-recursion121605.pdf The default configuration of the DNS Server service on Windows Server 2003 and Windows 2000, and the Microsoft DNS Server service on Windows NT 4.0, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses. cpe:/a:veritas:netbackup:4.5.0:fp:businessserver cpe:/a:veritas:netbackup:4.5.0:fp:datacenter cpe:/a:veritas:netbackup:4.5.0:mp:businessserver cpe:/a:veritas:netbackup:4.5.0:mp:datacenter cpe:/a:veritas:netbackup:5.0::enterprise_server cpe:/a:veritas:netbackup:5.0::server cpe:/a:veritas:netbackup:5.1::enterprise_server cpe:/a:veritas:netbackup:5.1::server cpe:/a:veritas:netbackup:6.0::enterprise_server cpe:/a:veritas:netbackup:6.0::server CVE-2006-0989 2006-03-27T19:06:00.000-05:00 2018-10-18T12:30:04.837-04:00 9.0 NETWORK LOW SINGLE_INSTANCE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SREASON 639 CONFIRM http://securityresponse.symantec.com/avcenter/security/Content/2006.03.27.html SECTRACK 1015832 CONFIRM http://seer.support.veritas.com/docs/281521.htm CERT-VN VU#880801 BUGTRAQ 20060327 ZDI-06-005: Symantec VERITAS NetBackup Volume Manager Buffer Overflow BID 17264 VUPEN ADV-2006-1124 MISC http://www.zerodayinitiative.com/advisories/ZDI-06-005.html XF netbackup-vmd-sscanf-bo(25471) Stack-based buffer overflow in the volume manager daemon (vmd) in Veritas NetBackup Enterprise Server 5.0 through 6.0 and DataCenter and BusinesServer 4.5FP and 4.5MP allows attackers to execute arbitrary code via unknown vectors. cpe:/a:veritas:netbackup:4.5.0:fp:businessserver cpe:/a:veritas:netbackup:4.5.0:fp:datacenter cpe:/a:veritas:netbackup:4.5.0:mp:businessserver cpe:/a:veritas:netbackup:4.5.0:mp:datacenter cpe:/a:veritas:netbackup:5.0::enterprise_server cpe:/a:veritas:netbackup:5.0::server cpe:/a:veritas:netbackup:5.1::enterprise_server cpe:/a:veritas:netbackup:5.1::server cpe:/a:veritas:netbackup:6.0::enterprise_server cpe:/a:veritas:netbackup:6.0::server CVE-2006-0990 2006-03-27T19:06:00.000-05:00 2018-10-18T12:30:05.617-04:00 9.0 NETWORK LOW SINGLE_INSTANCE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SREASON 642 CONFIRM http://securityresponse.symantec.com/avcenter/security/Content/2006.03.27.html SECTRACK 1015832 CONFIRM http://seer.support.veritas.com/docs/281521.htm CERT-VN VU#744137 BUGTRAQ 20060327 ZDI-06-006: Symantec VERITAS NetBackup Database Manager Buffer Overflow BUGTRAQ 20060327 SYM06-006, Veritas NetBackup: Multiple Overflow Vulnerabilities in NetBackup Daemons BID 17264 VUPEN ADV-2006-1124 MISC http://www.zerodayinitiative.com/advisories/ZDI-06-006.html XF netbackup-bpdbm-sprintf-bo(25472) Stack-based buffer overflow in the NetBackup Catalog daemon (bpdbm) in Veritas NetBackup Enterprise Server 5.0 through 6.0 and DataCenter and BusinesServer 4.5FP and 4.5MP allows attackers to execute arbitrary code via unknown vectors. cpe:/a:veritas:netbackup:4.5.0:fp:businessserver cpe:/a:veritas:netbackup:4.5.0:fp:datacenter cpe:/a:veritas:netbackup:4.5.0:mp:businessserver cpe:/a:veritas:netbackup:4.5.0:mp:datacenter cpe:/a:veritas:netbackup:5.0::enterprise_server cpe:/a:veritas:netbackup:5.0::server cpe:/a:veritas:netbackup:5.1::enterprise_server cpe:/a:veritas:netbackup:5.1::server cpe:/a:veritas:netbackup:6.0::enterprise_server cpe:/a:veritas:netbackup:6.0::server CVE-2006-0991 2006-03-27T19:06:00.000-05:00 2018-10-18T12:30:06.510-04:00 7.1 NETWORK HIGH SINGLE_INSTANCE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS CONFIRM http://securityresponse.symantec.com/avcenter/security/Content/2006.03.27.html SECTRACK 1015832 CONFIRM http://seer.support.veritas.com/docs/281521.htm CERT-VN VU#377441 BUGTRAQ 20060327 TSRT-06-01: Symantec VERITAS NetBackup vnetd Buffer Overflow Vulnerability BID 17264 MISC http://www.tippingpoint.com/security/advisories/TSRT-06-01.html VUPEN ADV-2006-1124 XF netbackup-vnetd-bo(25473) Buffer overflow in the NetBackup Sharepoint Services server daemon (bpspsserver) on NetBackup 6.0 for Windows allows remote attackers to execute arbitrary code via crafted "Request Service" packets to the vnetd service (TCP port 13724). cpe:/a:novell:groupwise_messenger:2.0 CVE-2006-0992 2006-04-14T06:02:00.000-04:00 2018-10-18T12:30:07.243-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS MISC http://cirt.dk/advisories/cirt-42-advisory.txt MISC http://metasploit.blogspot.com/2006/04/exploit-development-groupwise_14.html SECTRACK 1015911 CONFIRM http://support.novell.com/cgi-bin/search/searchtid.cgi?10100861.htm BUGTRAQ 20060413 ZDI-06-008: Novell GroupWise Messenger Accept-Language Buffer Overflow BID 17503 VUPEN ADV-2006-1355 MISC http://www.zerodayinitiative.com/advisories/ZDI-06-008.html XF groupwise-accept-language-bo(25828) EXPLOIT-DB 1679 Stack-based buffer overflow in Novell GroupWise Messenger before 2.0 Public Beta 2 allows remote attackers to execute arbitrary code via a long Accept-Language value without a comma or semicolon. NOTE: due to a typo, the original ZDI advisory accidentally referenced CVE-2006-0092. This is the correct identifier. cpe:/h:3com:tippingpoint_sms_server:2.2.1.4477 CVE-2006-0993 2006-05-09T22:22:00.000-04:00 2018-10-18T12:30:08.227-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SREASON 870 SECTRACK 1016051 CONFIRM http://www.3com.com/securityalert/alerts/3COM-06-002.html BUGTRAQ 20060509 ZDI-06-013: 3Com TippingPoint SMS Server Information Disclosure Vulnerability BID 17935 VUPEN ADV-2006-1752 MISC http://www.zerodayinitiative.com/advisories/ZDI-06-013.html XF tippingpoint-sms-information-disclosure(26338) The web management interface in 3Com TippingPoint SMS Server before 2.2.1.4478 does not restrict access to certain directories, which might allow remote attackers to obtain potentially sensitive information such as configuration settings. cpe:/a:sophos:sophos_anti-virus:4.04 cpe:/a:sophos:sophos_anti-virus:4.04:-:windows cpe:/a:sophos:sophos_anti-virus:5.0.1 cpe:/a:sophos:sophos_anti-virus:5.0.2 cpe:/a:sophos:sophos_anti-virus:5.0.4 cpe:/a:sophos:sophos_anti-virus:5.1 cpe:/a:sophos:sophos_anti-virus:5.1.3 cpe:/a:sophos:sophos_anti-virus:5.2.0 cpe:/a:sophos:sophos_anti-virus:5.2.0:-:windows CVE-2006-0994 2006-05-10T06:02:00.000-04:00 2018-10-18T12:30:08.867-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060508 ZDI-06-012: Sophos Anti-Virus CAB Unpacking Code Execution Vulnerability SREASON 869 SECTRACK 1016041 BUGTRAQ 20060508 ZDI-06-012: Sophos Anti-Virus CAB Unpacking Code Execution Vulnerability BID 17876 VUPEN ADV-2006-1730 MISC http://www.zerodayinitiative.com/advisories/ZDI-06-012.html XF sophos-cab-parsing-bo(26305) Multiple Sophos Anti-Virus products, including Anti-Virus for Windows 5.x before 5.2.1 and 4.x before 4.05, when cabinet file inspection is enabled, allows remote attackers to execute arbitrary code via a CAB file with "invalid folder count values," which leads to heap corruption. cpe:/a:emc_dantz:retrospect:6.5 cpe:/a:emc_dantz:retrospect:7.0 CVE-2006-0995 2006-03-03T16:02:00.000-05:00 2017-07-19T21:30:13.880-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://kb.dantz.com/article.asp?article=8361&p=2 SECTRACK 1015714 IDEFENSE 20060302 EMC Dantz Retrospect 7 Backup client DoS Vulnerability BID 16933 VUPEN ADV-2006-0811 XF retrospect-backup-packet-dos(25143) EMC Dantz Retrospect 7 backup client 7.0.107, and other versions before 7.0.109, and 6.5 before 6.5.138 allows remote attackers to cause a denial of service (client termination and loss of backup service) via a malformed packet to TCP port 497, which triggers an assert error. cpe:/a:php:php:4.4.2 cpe:/a:php:php:5.1.2 CVE-2006-0996 2006-04-10T14:06:00.000-04:00 2017-10-10T21:30:40.420-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SGI 20060501-01-U CONFIRM http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/info.c CONFIRM http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/info.c?r1=1.260&r2=1.261 MLIST [php-cvs] 20060330 cvs: php-src /ext/standard info.c REDHAT RHSA-2006:0276 REDHAT RHSA-2006:0549 GENTOO GLSA-200605-08 SREASONRES 20060408 phpinfo() Cross Site Scripting PHP 5.1.2 and 4.4.2 SREASON 675 SECTRACK 1015879 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-129.htm CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-160.htm MANDRIVA MDKSA-2006:074 SUSE SUSE-SA:2006:024 CONFIRM http://www.php.net/ChangeLog-4.php#4.4.3 REDHAT RHSA-2006:0501 BID 17362 UBUNTU USN-320-1 VUPEN ADV-2006-1290 VUPEN ADV-2006-2685 XF php-phpinfo-long-array-xss(25702) Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed. cpe:/a:novell:open_enterprise_server cpe:/o:novell:netware:6.5 cpe:/o:novell:netware:6.5:sp1 cpe:/o:novell:netware:6.5:sp1.1a cpe:/o:novell:netware:6.5:sp1.1b cpe:/o:novell:netware:6.5:sp2 cpe:/o:novell:netware:6.5:sp3 cpe:/o:novell:netware:6.5:sp4 CVE-2006-0997 2006-03-23T06:06:00.000-05:00 2017-07-19T21:30:14.020-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SECTRACK 1015799 CONFIRM http://support.novell.com/cgi-bin/search/searchtid.cgi?10100633.htm BID 17176 VUPEN ADV-2006-1043 XF netware-nile-ssl-cleartext(25380) The SSL server implementation in NILE.NLM in Novell NetWare 6.5 and Novell Open Enterprise Server (OES) permits encryption with a NULL key, which results in cleartext communication that allows remote attackers to read an SSL protected session by sniffing network traffic. cpe:/a:novell:open_enterprise_server cpe:/o:novell:netware:6.5 cpe:/o:novell:netware:6.5:sp1 cpe:/o:novell:netware:6.5:sp1.1a cpe:/o:novell:netware:6.5:sp1.1b cpe:/o:novell:netware:6.5:sp2 cpe:/o:novell:netware:6.5:sp3 cpe:/o:novell:netware:6.5:sp4 CVE-2006-0998 2006-03-23T06:06:00.000-05:00 2017-07-19T21:30:14.113-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SECTRACK 1015799 CONFIRM http://support.novell.com/cgi-bin/search/searchtid.cgi?10100633.htm CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 17176 BID 64758 VUPEN ADV-2006-1043 XF netware-nile-weak-encryption(25381) The SSL server implementation in NILE.NLM in Novell NetWare 6.5 and Novell Open Enterprise Server (OES) sometimes selects a weak cipher instead of an available stronger cipher, which makes it easier for remote attackers to sniff and decrypt an SSL protected session. cpe:/a:novell:open_enterprise_server cpe:/o:novell:netware:6.5 cpe:/o:novell:netware:6.5:sp1 cpe:/o:novell:netware:6.5:sp1.1a cpe:/o:novell:netware:6.5:sp1.1b cpe:/o:novell:netware:6.5:sp2 cpe:/o:novell:netware:6.5:sp3 cpe:/o:novell:netware:6.5:sp4 CVE-2006-0999 2006-03-23T06:06:00.000-05:00 2017-07-19T21:30:14.160-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SECTRACK 1015799 CONFIRM http://support.novell.com/cgi-bin/search/searchtid.cgi?10100633.htm CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html BID 17176 BID 64758 VUPEN ADV-2006-1043 XF netware-nile-forced-weak-encryption(25382) The SSL server implementation in NILE.NLM in Novell NetWare 6.5 and Novell Open Enterprise Server (OES) allows a client to force the server to use weak encryption by stating that a weak cipher is required for client compatibility, which might allow remote attackers to decrypt contents of an SSL protected session. cpe:/a:g2soft:pentacle_in-out_board:6.03 CVE-2006-1000 2006-03-06T15:06:00.000-05:00 2018-10-18T12:30:09.463-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS FULLDISC 20060225 Advisory: Pentacle In-Out Board <= 6.03 (login.asp) Authencation ByPass Vulnerability FULLDISC 20060225 Advisory: Pentacle In-Out Board <= 6.03 (newsdetailsview.asp newsid) Remote SQL Injection Vulnerability SECTRACK 1015682 MISC http://www.nukedx.com/?viewdoc=13 MISC http://www.nukedx.com/?viewdoc=14 BUGTRAQ 20060225 Advisory: Pentacle In-Out Board <= 6.03 (login.asp) AuthencationByPass Vulnerability BUGTRAQ 20060225 Advisory: Pentacle In-Out Board <= 6.03 (newsdetailsview.aspnewsid) Remote SQL Injection Vulnerability BID 16818 VUPEN ADV-2006-0749 Multiple SQL injection vulnerabilities in Pentacle In-Out Board 3.0 and earlier allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) newsid parameter to newsdetailsview.asp and (2) password parameter to login.asp. cpe:/a:lansuite:lanparty_intranet_system:2.0.6 cpe:/a:lansuite:lanparty_intranet_system:2.1 CVE-2006-1001 2006-03-06T15:06:00.000-05:00 2017-10-18T21:29:03.673-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16836 VUPEN ADV-2006-0747 XF lansuite-fid-sql-injection(24940) EXPLOIT-DB 1526 SQL injection vulnerability in the board module in LanSuite LanParty Intranet System 2.0.6 and 2.1.0 beta allows remote attackers to execute arbitrary SQL commands via the fid parameter. cpe:/h:netgear:wgt624 CVE-2006-1002 2006-03-06T15:06:00.000-05:00 2018-10-18T12:30:10.150-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS BUGTRAQ 20060226 NETGEAR WGT624 ? Wireless DSL router default user name/password vulnerability BUGTRAQ 20060227 Re: NETGEAR WGT624 Wireless DSL router default user name/password vulnerability BUGTRAQ 20060413 Re: Re: NETGEAR WGT624 Wireless DSL router default user name/password vulnerability BUGTRAQ 20071220 Re: Re: NETGEAR WGT624 Wireless DSL router default user name/password vulnerability BID 16835 XF netgear-wgt624-default-account(24926) NETGEAR WGT624 Wireless DSL router has a default account of super_username "Gearguy" and super_passwd "Geardog", which allows remote attackers to modify the configuration. NOTE: followup posts have suggested that this might not occur with all WGT624 routers. cpe:/h:netgear:wgt624 CVE-2006-1003 2006-03-06T15:06:00.000-05:00 2017-07-19T21:30:14.317-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BUGTRAQ 20060227 NETGEAR WGT624 ? Wireless DSL Firewall/Router vulnerability BID 16837 XF netgear-wgt624-cleartext-config(24927) The backup configuration option in NETGEAR WGT624 Wireless Firewall Router stores sensitive information in cleartext, which allows remote attackers to obtain passwords and gain privileges. cpe:/a:cactusoft:parodia:6.2 CVE-2006-1004 2006-03-06T15:06:00.000-05:00 2017-07-19T21:30:14.363-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16865 VUPEN ADV-2006-0763 XF parodia-agencyprofile-xss(24971) Cross-site scripting (XSS) vulnerability in agencyprofile.asp in Parodia 6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the AG_ID parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information. cpe:/a:cactusoft:parodia:6.2 CVE-2006-1005 2006-03-06T15:06:00.000-05:00 2008-09-05T17:00:46.707-04:00 6.4 NETWORK LOW NONE NONE PARTIAL PARTIAL http://nvd.nist.gov 2006-03-07T08:44:00.000-05:00 agencyprofile.asp in Parodia 6.2 and earlier might allow remote attackers to obtain sensitive information by triggering an SQL error via an invalid AG_ID parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information. cpe:/a:sendcard:sendcard:1.00 cpe:/a:sendcard:sendcard:1.01 cpe:/a:sendcard:sendcard:1.02 cpe:/a:sendcard:sendcard:1.10 cpe:/a:sendcard:sendcard:1.20 cpe:/a:sendcard:sendcard:2.00 cpe:/a:sendcard:sendcard:2.01 cpe:/a:sendcard:sendcard:3.0.0 cpe:/a:sendcard:sendcard:3.0.1 cpe:/a:sendcard:sendcard:3.0.2 cpe:/a:sendcard:sendcard:3.0.3 cpe:/a:sendcard:sendcard:3.0.4 cpe:/a:sendcard:sendcard:3.0.5 cpe:/a:sendcard:sendcard:3.0.5:pl1 cpe:/a:sendcard:sendcard:3.0.5:pl2 cpe:/a:sendcard:sendcard:3.1.0 cpe:/a:sendcard:sendcard:3.1.1 cpe:/a:sendcard:sendcard:3.1.2 cpe:/a:sendcard:sendcard:3.2 cpe:/a:sendcard:sendcard:3.2.0:rc1 cpe:/a:sendcard:sendcard:3.2.0:rc2 cpe:/a:sendcard:sendcard:3.2.0:rc3 cpe:/a:sendcard:sendcard:3.2.1 cpe:/a:sendcard:sendcard:3.2.2 cpe:/a:sendcard:sendcard:3.2.3 CVE-2006-1006 2006-03-06T15:06:00.000-05:00 2017-07-19T21:30:14.427-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://sourceforge.net/forum/forum.php?forum_id=544749 BID 16900 VUPEN ADV-2006-0778 XF sendcard-unspecified-sql-injection(24978) Multiple SQL injection vulnerabilities in sendcard.php in sendcard before 3.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified parameters. cpe:/a:nathan_landry:n8cms_sitesuite_cms:1.1 cpe:/a:nathan_landry:n8cms_sitesuite_cms:1.2 CVE-2006-1007 2006-03-06T15:06:00.000-05:00 2018-10-18T12:30:10.713-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://biyosecurity.be/bugs/n8cms.txt BUGTRAQ 20060309 n8cms 1.1 & 1.2 version Sql &#304;njection And XSS BID 16858 VUPEN ADV-2006-0779 XF n8cms-index-sql-injection(24974) Multiple SQL injection vulnerabilities in N8cms 1.1 and 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) dir and (2) page_id parameter to index.php. cpe:/a:nathan_landry:n8cms_sitesuite_cms:1.1 cpe:/a:nathan_landry:n8cms_sitesuite_cms:1.2 cpe:/a:nathan_landry:n8cms_sitesuite_cms:1.12 CVE-2006-1008 2006-03-06T15:06:00.000-05:00 2018-10-18T12:30:11.133-04:00 5.8 NETWORK MEDIUM NONE NONE PARTIAL PARTIAL http://nvd.nist.gov MISC http://biyosecurity.be/bugs/n8cms.txt SREASON 562 BUGTRAQ 20060309 n8cms 1.1 & 1.2 version Sql &#304;njection And XSS BID 16858 VUPEN ADV-2006-0779 XF n8cms-mailto-xss(24975) XF n8cms--xss(25126) Multiple cross-site scripting (XSS) vulnerabilities in N8cms 1.1 and 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) dir and (2) page_id parameter to (a) index.php and (3) userid parameter to (b) mailto.php. NOTE: it is possible that issues 1 and 2 are resultant from SQL injection. cpe:/a:m4_project:enigma-suite:0.70 cpe:/a:m4_project:enigma-suite:0.71 cpe:/a:m4_project:enigma-suite:0.72 cpe:/a:m4_project:enigma-suite:0.73 cpe:/a:m4_project:enigma-suite:0.73.1 cpe:/a:m4_project:enigma-suite:0.73.2 CVE-2006-1009 2006-03-06T15:06:00.000-05:00 2017-07-19T21:30:14.583-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://www.bytereef.org/m4-project-blog.html VUPEN ADV-2006-0787 XF enigma-suite-default-acoount(24993) M4 Project enigma-suite before 0.73.3 (Windows) has a default password of "nominal" for the "enigma-client" account, which allows local users to gain access. cpe:/a:crossfire:crossfire:1.7.0 cpe:/a:crossfire:crossfire:1.8.0 CVE-2006-1010 2006-03-06T16:02:00.000-05:00 2017-07-19T21:30:14.643-04:00 6.4 NETWORK LOW NONE NONE PARTIAL PARTIAL http://nvd.nist.gov MISC http://aluigi.altervista.org/poc/crossfirebof.zip CONFIRM http://cvs.sourceforge.net/viewcvs.py/crossfire/crossfire/socket/request.c?r1=1.80&r2=1.81 DEBIAN DSA-1001 GENTOO GLSA-200604-11 BID 16883 VUPEN ADV-2006-0760 XF crossfire-oldsocketmode-bo(24932) Buffer overflow in socket/request.c in CrossFire before 1.9.0, when oldsocketmode is enabled, allows remote attackers to cause a denial of service (segmentation fault) and possibly execute code by sending the server a large request. cpe:/a:peters_software:lettermerger:1.2 CVE-2006-1011 2006-03-06T16:02:00.000-05:00 2017-07-19T21:30:14.690-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov BID 16917 XF lettermerger-files-disclose-information(25020) LetterMerger 1.2 stores user information in Access database files with insecure permissions, which allows local users to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:wordpress:wordpress:1.5.2 CVE-2006-1012 2006-03-06T16:02:00.000-05:00 2017-07-19T21:30:14.787-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS GENTOO GLSA-200603-01 BID 16950 XF wordpress-comment-sql-injection(25321) SQL injection vulnerability in WordPress 1.5.2, and possibly other versions before 2.0, allows remote attackers to execute arbitrary SQL commands via the User-Agent field in an HTTP header for a comment. cpe:/a:smartblog:smartblog:1.2 CVE-2006-1013 2006-03-06T19:02:00.000-05:00 2018-10-18T12:30:11.713-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060301 SMBlog Remote Command Exucetion BID 16905 XF smartblog-index-file-include(25220) PHP remote file include vulnerability in index.php in SMartBlog (aka SMBlog) 1.2 allows remote attackers to include and execute arbitrary PHP files via (1) the pg parameter and (2) a query string without a parameter. cpe:/a:php:php:4.0.0 cpe:/a:php:php:4.2::dev cpe:/a:php:php:4.3.3 cpe:/a:php:php:4.3.4 cpe:/a:php:php:4.3.5 cpe:/a:php:php:4.3.6 cpe:/a:php:php:4.3.7 cpe:/a:php:php:4.3.8 cpe:/a:php:php:4.3.9 cpe:/a:php:php:4.3.10 cpe:/a:php:php:4.3.11 cpe:/a:php:php:4.4.0 cpe:/a:php:php:4.4.1 cpe:/a:php:php:5.0:rc1 cpe:/a:php:php:5.0:rc2 cpe:/a:php:php:5.0:rc3 cpe:/a:php:php:5.0.0 cpe:/a:php:php:5.0.0:beta1 cpe:/a:php:php:5.0.0:beta2 cpe:/a:php:php:5.0.0:beta3 cpe:/a:php:php:5.0.0:beta4 cpe:/a:php:php:5.0.0:rc1 cpe:/a:php:php:5.0.0:rc2 cpe:/a:php:php:5.0.0:rc3 cpe:/a:php:php:5.0.1 cpe:/a:php:php:5.0.2 cpe:/a:php:php:5.0.3 cpe:/a:php:php:5.0.4 cpe:/a:php:php:5.0.5 cpe:/a:php:php:5.1.0 CVE-2006-1014 2006-03-06T19:02:00.000-05:00 2018-10-18T12:30:11.963-04:00 3.2 LOCAL LOW SINGLE_INSTANCE PARTIAL PARTIAL NONE http://nvd.nist.gov SUSE SUSE-SA:2006:024 BUGTRAQ 20060228 (PHP) mb_send_mail security bypass BID 16878 VUPEN ADV-2006-0772 Argument injection vulnerability in certain PHP 4.x and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mb_send_mail function, allows context-dependent attackers to read and create arbitrary files by providing extra -C and -X arguments to sendmail. NOTE: it could be argued that this is a class of technology-specific vulnerability, instead of a particular instance; if so, then this should not be included in CVE. cpe:/a:php:php:3.0 cpe:/a:php:php:3.0.1 cpe:/a:php:php:3.0.2 cpe:/a:php:php:3.0.3 cpe:/a:php:php:3.0.4 cpe:/a:php:php:3.0.5 cpe:/a:php:php:3.0.6 cpe:/a:php:php:3.0.7 cpe:/a:php:php:3.0.8 cpe:/a:php:php:3.0.9 cpe:/a:php:php:3.0.10 cpe:/a:php:php:3.0.11 cpe:/a:php:php:3.0.12 cpe:/a:php:php:3.0.13 cpe:/a:php:php:3.0.14 cpe:/a:php:php:3.0.15 cpe:/a:php:php:3.0.16 cpe:/a:php:php:3.0.17 cpe:/a:php:php:3.0.18 cpe:/a:php:php:4.0.0 cpe:/a:php:php:4.0.1 cpe:/a:php:php:4.0.1:patch1 cpe:/a:php:php:4.0.1:patch2 cpe:/a:php:php:4.0.2 cpe:/a:php:php:4.0.3 cpe:/a:php:php:4.0.3:patch1 cpe:/a:php:php:4.0.4 cpe:/a:php:php:4.0.5 cpe:/a:php:php:4.0.6 cpe:/a:php:php:4.0.7 cpe:/a:php:php:4.0.7:rc1 cpe:/a:php:php:4.0.7:rc2 cpe:/a:php:php:4.0.7:rc3 cpe:/a:php:php:4.1.0 cpe:/a:php:php:4.1.1 cpe:/a:php:php:4.1.2 cpe:/a:php:php:4.2::dev cpe:/a:php:php:4.2.0 cpe:/a:php:php:4.2.1 cpe:/a:php:php:4.2.2 cpe:/a:php:php:4.2.3 cpe:/a:php:php:4.3.0 cpe:/a:php:php:4.3.1 cpe:/a:php:php:4.3.2 cpe:/a:php:php:4.3.3 cpe:/a:php:php:4.3.4 cpe:/a:php:php:4.3.5 cpe:/a:php:php:4.3.6 cpe:/a:php:php:4.3.7 cpe:/a:php:php:4.3.8 cpe:/a:php:php:4.3.9 cpe:/a:php:php:4.3.10 cpe:/a:php:php:4.3.11 cpe:/a:php:php:4.4.0 cpe:/a:php:php:4.4.1 cpe:/a:php:php:4.4.2 cpe:/a:php:php:5.0:rc1 cpe:/a:php:php:5.0:rc2 cpe:/a:php:php:5.0:rc3 cpe:/a:php:php:5.0.0 cpe:/a:php:php:5.0.0:beta1 cpe:/a:php:php:5.0.0:beta2 cpe:/a:php:php:5.0.0:beta3 cpe:/a:php:php:5.0.0:beta4 cpe:/a:php:php:5.0.0:rc1 cpe:/a:php:php:5.0.0:rc2 cpe:/a:php:php:5.0.0:rc3 cpe:/a:php:php:5.0.1 cpe:/a:php:php:5.0.2 cpe:/a:php:php:5.0.3 cpe:/a:php:php:5.0.4 cpe:/a:php:php:5.0.5 cpe:/a:php:php:5.1.0 cpe:/a:php:php:5.1.1 cpe:/a:php:php:5.1.2 CVE-2006-1015 2006-03-06T19:02:00.000-05:00 2018-10-30T12:25:35.387-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov SREASON 517 SUSE SUSE-SA:2006:024 BUGTRAQ 20060301 Re: (PHP) mb_send_mail security bypass BID 16878 Argument injection vulnerability in certain PHP 3.x, 4.x, and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mail function, allows remote attackers to read and create arbitrary files via the sendmail -C and -X arguments. NOTE: it could be argued that this is a class of technology-specific vulnerability, instead of a particular instance; if so, then this should not be included in CVE. cpe:/a:microsoft:ie:6.0 CVE-2006-1016 2006-03-06T19:02:00.000-05:00 2017-07-19T21:30:14.893-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://metasploit.com/projects/Framework/exploits.html#ie_iscomponentinstalled MISC http://www.metasploit.com/projects/Framework/modules/exploits/ie_iscomponentinstalled.pm BID 16870 XF ie-iscomponentinstalled-bo(24923) Buffer overflow in the IsComponentInstalled method in Internet Explorer 6.0, when used on Windows 2000 before SP4 or Windows XP before SP1, allows remote attackers to execute arbitrary code via JavaScript that calls IsComponentInstalled with a long first argument. cpe:/a:php:php:3.0 cpe:/a:php:php:3.0.1 cpe:/a:php:php:3.0.2 cpe:/a:php:php:3.0.3 cpe:/a:php:php:3.0.4 cpe:/a:php:php:3.0.5 cpe:/a:php:php:3.0.6 cpe:/a:php:php:3.0.7 cpe:/a:php:php:3.0.8 cpe:/a:php:php:3.0.9 cpe:/a:php:php:3.0.10 cpe:/a:php:php:3.0.11 cpe:/a:php:php:3.0.12 cpe:/a:php:php:3.0.13 cpe:/a:php:php:3.0.14 cpe:/a:php:php:3.0.15 cpe:/a:php:php:3.0.16 cpe:/a:php:php:3.0.17 cpe:/a:php:php:3.0.18 cpe:/a:php:php:4.0.0 cpe:/a:php:php:4.0.1 cpe:/a:php:php:4.0.1:patch1 cpe:/a:php:php:4.0.1:patch2 cpe:/a:php:php:4.0.2 cpe:/a:php:php:4.0.3 cpe:/a:php:php:4.0.3:patch1 cpe:/a:php:php:4.0.4 cpe:/a:php:php:4.0.5 cpe:/a:php:php:4.0.6 cpe:/a:php:php:4.0.7 cpe:/a:php:php:4.0.7:rc1 cpe:/a:php:php:4.0.7:rc2 cpe:/a:php:php:4.0.7:rc3 cpe:/a:php:php:4.1.0 cpe:/a:php:php:4.1.1 cpe:/a:php:php:4.1.2 cpe:/a:php:php:4.2::dev cpe:/a:php:php:4.2.0 cpe:/a:php:php:4.2.1 cpe:/a:php:php:4.2.2 cpe:/a:php:php:4.2.3 cpe:/a:php:php:4.3.0 cpe:/a:php:php:4.3.1 cpe:/a:php:php:4.3.2 cpe:/a:php:php:4.3.3 cpe:/a:php:php:4.3.4 cpe:/a:php:php:4.3.5 cpe:/a:php:php:4.3.6 cpe:/a:php:php:4.3.7 cpe:/a:php:php:4.3.8 cpe:/a:php:php:4.3.9 cpe:/a:php:php:4.3.10 cpe:/a:php:php:4.3.11 cpe:/a:php:php:4.4.0 cpe:/a:php:php:4.4.1 cpe:/a:php:php:4.4.2 cpe:/a:php:php:4.4.3 cpe:/a:php:php:5.0:rc1 cpe:/a:php:php:5.0:rc2 cpe:/a:php:php:5.0:rc3 cpe:/a:php:php:5.0.0 cpe:/a:php:php:5.0.0:beta1 cpe:/a:php:php:5.0.0:beta2 cpe:/a:php:php:5.0.0:beta3 cpe:/a:php:php:5.0.0:beta4 cpe:/a:php:php:5.0.0:rc1 cpe:/a:php:php:5.0.0:rc2 cpe:/a:php:php:5.0.0:rc3 cpe:/a:php:php:5.0.1 cpe:/a:php:php:5.0.2 cpe:/a:php:php:5.0.3 cpe:/a:php:php:5.0.4 cpe:/a:php:php:5.0.5 cpe:/a:php:php:5.1.0 cpe:/a:php:php:5.1.1 cpe:/a:php:php:5.1.2 cpe:/a:php:php:5.1.3 cpe:/a:php:php:5.1.4 CVE-2006-1017 2006-03-06T19:02:00.000-05:00 2018-10-30T12:25:35.387-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS CONFIRM http://bugs.php.net/bug.php?id=37265 SREASON 516 MANDRIVA MDKSA-2006:122 CONFIRM http://www.php.net/ChangeLog-5.php#5.1.5 CONFIRM http://www.php.net/release_5_1_5.php BUGTRAQ 20060228 (PHP) imap functions bypass safemode and open_basedir restrictions VUPEN ADV-2006-0772 XF php-imap-restriction-bypass(24964) The c-client library 2000, 2001, or 2004 for PHP before 4.4.4 and 5.x before 5.1.5 do not check the (1) safe_mode or (2) open_basedir functions, and when used in applications that accept user-controlled input for the mailbox argument to the imap_open function, allow remote attackers to obtain access to an IMAP stream data structure and conduct unauthorized IMAP actions. cpe:/a:dci-designs:dawaween:1.03 CVE-2006-1018 2006-03-06T19:02:00.000-05:00 2018-10-18T12:30:14.103-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060302 sql in Dawaween V 1.03 BID 16909 XF dawaween-poems-sql-injection(25163) SQL injection vulnerability in poems.php in DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL commands via the id parameter in a diwan view action. cpe:/a:ukiweb:ukiboard:3.0.1 CVE-2006-1019 2006-03-06T19:02:00.000-05:00 2017-07-19T21:30:15.097-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16912 XF ukiboard-fce-xss(24990) Cross-site scripting (XSS) vulnerability in fce.php in UKiBoard 3.0.1 allows remote attackers to inject arbitrary web script or HTML via a BBCode url tag when using the show_post function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information, some of which reference a source URL that appears to be for an unrelated issue. cpe:/a:johnny_vegas:vegas_forum:1.0 CVE-2006-1020 2006-03-06T19:02:00.000-05:00 2018-10-18T12:30:14.417-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/90/summary.html SREASON 574 BUGTRAQ 20060313 [eVuln] Vegas Forum SQL Injection Vulnerability BID 17079 VUPEN ADV-2006-0790 XF vegasforum-forumlib-sql-injection(25167) SQL injection vulnerability in forumlib.php in Johnny_Vegas Vegas Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the postid parameter. cpe:/a:pehepe:membership_management_system:3 cpe:/a:pehepe:uyelik_sistemi:3 CVE-2006-1021 2006-03-06T19:02:00.000-05:00 2018-10-18T12:30:14.917-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060228 PEHEPE Membership Management System Multiple Vulnerabilities BID 16885 VUPEN ADV-2006-0781 MISC http://yns.zaxaz.com/2006/02/28/pehepe-membership-management-system-multiple-vulnerabilities/ Cross-site scripting (XSS) vulnerability in sol_menu.php in PeHePe Uyelik Sistemi (aka PeHePe MemberShip Management System) 3 allows remote attackers to inject arbitrary web script or HTML via the kuladi parameter ($kul_adi variable). cpe:/a:pehepe:membership_management_system:3.0 CVE-2006-1022 2006-03-06T19:02:00.000-05:00 2018-10-18T12:30:15.243-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 515 BUGTRAQ 20060228 PEHEPE Membership Management System Multiple Vulnerabilities BID 16887 VUPEN ADV-2006-0781 MISC http://yns.zaxaz.com/2006/02/28/pehepe-membership-management-system-multiple-vulnerabilities/ XF pehepe-uyeklasor-command-execution(24970) PHP remote file include vulnerability in sol_menu.php in PeHePe Uyelik Sistemi (aka PeHePe MemberShip Management System) 3 allows remote attackers to include and execute arbitrary PHP code via a URL in the uye_klasor parameter, along with a misafir[] parameter that is set to UYE_SEVIYE. cpe:/a:hp:system_management_homepage:2.0.0 cpe:/a:hp:system_management_homepage:2.1.4 CVE-2006-1023 2006-03-06T19:02:00.000-05:00 2018-10-18T12:30:15.823-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SECTRACK 1015692 HP SSRT061118 BID 16876 VUPEN ADV-2006-0769 HP HPSBMA02099 XF hp-system-managemenet-homepage-dir-traversal(24996) Directory traversal vulnerability in HP System Management Homepage (SMH) 2.0.0 through 2.1.4 on Windows allows remote attackers to access certain files via unspecified vectors. cpe:/a:addsoft:storebot:2005::professional CVE-2006-1024 2006-03-06T19:02:00.000-05:00 2017-07-19T21:30:15.300-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BID 16897 VUPEN ADV-2006-0784 XF storebot-mgrlogin-sql-injection(24987) SQL injection vulnerability in MgrLogin.asp in Addsoft StoreBot 2005 Professional allows remote attackers to execute arbitrary SQL commands via the Pwd parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:addsoft:storebot:2002::standard CVE-2006-1025 2006-03-06T19:02:00.000-05:00 2017-07-19T21:30:15.363-04:00 6.8 NETWORK MEDIUM NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BID 16898 VUPEN ADV-2006-0785 XF storebot-manage-xss(24986) Cross-site scripting (XSS) vulnerability in manage.asp in Addsoft StoreBot 2002 Standard allows remote attackers to inject arbitrary web script or HTML via the ShipMethod parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:jfacets:jfacets CVE-2006-1026 2006-03-06T19:02:00.000-05:00 2017-07-19T21:30:15.410-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://sourceforge.net/project/shownotes.php?group_id=154666&release_id=396824 CONFIRM http://sourceforge.net/tracker/index.php?func=detail&aid=1439037&group_id=154666&atid=792697 VUPEN ADV-2006-0767 XF jfacets-auth-authentication-bypass(24958) JFacets before 0.2 allows remote attackers to gain privileges as any account via a GET request with a modified account profileID. cpe:/a:joomla:joomla:1.0.7 CVE-2006-1027 2006-03-06T19:02:00.000-05:00 2018-10-18T12:30:16.323-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SREASON 527 CONFIRM http://www.joomla.org/content/view/938/78/ BUGTRAQ 20060302 JOOMLA CMS 1.0.7 DoS & path disclosing XF joomla-multiple-disclose-path(25028) feedcreator.class.php (aka the syndication component) in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via a "/" (slash) in the feed parameter to index.php, which reveals the path in an error message. cpe:/a:joomla:joomla:1.0.7 CVE-2006-1028 2006-03-06T19:02:00.000-05:00 2018-10-18T12:30:16.713-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov SREASON 527 CONFIRM http://www.joomla.org/content/view/938/78/ BUGTRAQ 20060302 JOOMLA CMS 1.0.7 DoS & path disclosing feedcreator.class.php (aka the syndication component) in Joomla! 1.0.7 allows remote attackers to cause a denial of service (stressed file cache) by creating many files via filenames in the feed parameter to index.php. cpe:/a:joomla:joomla:1.0.7 CVE-2006-1029 2006-03-06T19:02:00.000-05:00 2018-10-18T12:30:17.040-04:00 4.3 NETWORK MEDIUM NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://www.joomla.org/content/view/938/78/ BUGTRAQ 20060302 JOOMLA CMS 1.0.7 DoS & path disclosing The cross-site scripting (XSS) countermeasures in class.inputfilter.php in Joomla! 1.0.7 allow remote attackers to cause a denial of service via a crafted mosmsg parameter to index.php with a malformed sequence of multiple tags, as demonstrated using "<<>AAA<><>", possibly due to nested or empty tags. cpe:/a:joomla:joomla:1.0.7 CVE-2006-1030 2006-03-06T19:02:00.000-05:00 2017-07-19T21:30:15.550-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://www.joomla.org/content/view/938/78/ VUPEN ADV-2006-0818 XF joomla-multiple-disclose-path(25028) Unspecified vulnerability in mod_templatechooser in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via an unspecified attack vector that reveals the path. cpe:/a:igenus:igenus_webmail:2.0 cpe:/a:igenus:igenus_webmail:2.01 cpe:/a:igenus:igenus_webmail:2.02 CVE-2006-1031 2006-03-07T06:02:00.000-05:00 2017-07-19T21:30:15.613-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://retrogod.altervista.org/igenus_202_xpl_pl.html BID 16829 VUPEN ADV-2006-0753 XF igenus-sg-home-file-include(24935) config/config_inc.php in iGENUS Webmail 2.02 and earlier allows remote attackers to include arbitrary local files via the SG_HOME parameter. cpe:/a:phprpc:phprpc:0.7 cpe:/a:phprpc:phprpc:0.8 cpe:/a:phprpc:phprpc:0.9 CVE-2006-1032 2006-03-07T06:02:00.000-05:00 2011-03-07T21:31:45.080-05:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 502 SECTRACK 1015691 MISC http://www.gulftech.org/?node=research&article_id=00105-02262006 BUGTRAQ 20060226 phpRPC Library Remote Code Execution BID 16833 VUPEN ADV-2006-0745 Eval injection vulnerability in the decode function in rpc_decoder.php for phpRPC 0.7 and earlier, as used by runcms, exoops, and possibly other programs, allows remote attackers to execute arbitrary PHP code via the base64 tag. cpe:/a:cpg-nuke:dragonfly_cms:9.0.1.1 cpe:/a:cpg-nuke:dragonfly_cms:9.0.2.0 cpe:/a:cpg-nuke:dragonfly_cms:9.0.3.0 cpe:/a:cpg-nuke:dragonfly_cms:9.0.4.0 cpe:/a:cpg-nuke:dragonfly_cms:9.0.5.0 cpe:/a:cpg-nuke:dragonfly_cms:9.0.6.0 CVE-2006-1033 2006-03-07T06:02:00.000-05:00 2017-07-19T21:30:15.677-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://lostmon.blogspot.com/2006/02/multiple-cross-site-scripting-in.html SECTRACK 1015661 BID 16784 VUPEN ADV-2006-0688 XF cpg-dragonfly-multiple-xss(24843) Multiple cross-site scripting (XSS) vulnerabilities in Dragonfly CMS before 9.0.6.1 allow remote attackers to inject arbitrary web script or HTML via (1) uname, (2) error, (3) profile or (4) the username filed parameter to the (a) Your_Account module, (5) catid, (6) sid, (7) Story Text or (8) Extended text text fields in the (b) News module, (9) month, (10) year or (11) sa parameter to the (c) Stories_Archive module, (12) show, (13) cid, (14) ratetype, or (15) orderby parameter to the (d) Web_Links module, (16) op, or (17) pollid parameter to the (e) Surveys module, (18) c parameter to the (f) Downloads module, (19) meta, or (20) album parameter to the (g) coppermine module, or the search box in the (21) Search, (22) Stories_Archive, (23) Downloads, and (24) Topics module. cpe:/a:woltlab:burning_board:1.1.1 cpe:/a:woltlab:burning_board:2.0_beta_3 cpe:/a:woltlab:burning_board:2.0_beta_4 cpe:/a:woltlab:burning_board:2.0_beta_5 cpe:/a:woltlab:burning_board:2.0_rc1 cpe:/a:woltlab:burning_board:2.0_rc2 cpe:/a:woltlab:burning_board:2.2.2 cpe:/a:woltlab:burning_board:2.3.1 cpe:/a:woltlab:burning_board:2.3.3 cpe:/a:woltlab:burning_board:2.4 cpe:/a:woltlab:burning_board:2.5 cpe:/a:woltlab:burning_board:2.6 cpe:/a:woltlab:burning_board:2.7 CVE-2006-1034 2006-03-07T06:02:00.000-05:00 2008-09-05T17:00:51.550-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov 2006-03-08T08:15:00.000-05:00 BID 16843 Multiple cross-site scripting (XSS) vulnerabilities in Woltlab Burning Board (wBB) allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to galerie_index.php and possibly (2) galerie_onfly.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. The second vector might not be XSS. cpe:/a:oracle:diagnostics:2.0 cpe:/a:oracle:diagnostics:2.1 cpe:/a:oracle:diagnostics:2.2 cpe:/a:oracle:e-business_suite:11.5.3 cpe:/a:oracle:e-business_suite:11.5.4 cpe:/a:oracle:e-business_suite:11.5.5 cpe:/a:oracle:e-business_suite:11.5.6 cpe:/a:oracle:e-business_suite:11.5.7 cpe:/a:oracle:e-business_suite:11.5.8 cpe:/a:oracle:e-business_suite:11.5.9 cpe:/a:oracle:e-business_suite:11.5.10 cpe:/a:oracle:e-business_suite:11.5.10.1 cpe:/a:oracle:e-business_suite:11.5.10.2 CVE-2006-1035 2006-03-07T06:02:00.000-05:00 2008-09-05T17:00:51.723-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-03-08T08:35:00.000-05:00 ALLOWS_OTHER_ACCESS MISC http://www.integrigy.com/info/IntegrigySecurityAnalysis-OracleDiag0206.pdf CERT-VN VU#298958 BID 16844 Unspecified vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to access diagnostics tests via unknown attack vectors. cpe:/a:oracle:diagnostics:2.0 cpe:/a:oracle:diagnostics:2.1 cpe:/a:oracle:diagnostics:2.2 CVE-2006-1036 2006-03-07T06:02:00.000-05:00 2008-09-05T17:00:51.910-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-03-08T08:50:00.000-05:00 ALLOWS_USER_ACCESS MISC http://www.integrigy.com/info/IntegrigySecurityAnalysis-OracleDiag0206.pdf BID 16844 Multiple unspecified vulnerabilities in the Oracle Diagnostics module 2.2 and earlier have unknown impact and attack vectors, related to "permissions." cpe:/a:oracle:diagnostics:2.0 cpe:/a:oracle:diagnostics:2.1 cpe:/a:oracle:diagnostics:2.2 cpe:/a:oracle:e-business_suite:11.5.3 cpe:/a:oracle:e-business_suite:11.5.4 cpe:/a:oracle:e-business_suite:11.5.5 cpe:/a:oracle:e-business_suite:11.5.6 cpe:/a:oracle:e-business_suite:11.5.7 cpe:/a:oracle:e-business_suite:11.5.8 cpe:/a:oracle:e-business_suite:11.5.9 cpe:/a:oracle:e-business_suite:11.5.10 cpe:/a:oracle:e-business_suite:11.5.10.1 cpe:/a:oracle:e-business_suite:11.5.10.2 CVE-2006-1037 2006-03-07T06:02:00.000-05:00 2017-07-20T21:29:00.193-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.integrigy.com/info/IntegrigySecurityAnalysis-OracleDiag0206.pdf BID 16844 XF oracle-diagnostics-sql-injection(25259) SQL injection vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown attack vectors. cpe:/a:van_dyke_technologies:securecrt:5.0 cpe:/a:van_dyke_technologies:securecrt:5.0.1 cpe:/a:van_dyke_technologies:securecrt:5.0.2 cpe:/a:van_dyke_technologies:securecrt:5.0.3 cpe:/a:van_dyke_technologies:securecrt:5.0.4 cpe:/a:van_dyke_technologies:securecrt:5.0_beta_1 cpe:/a:van_dyke_technologies:securecrt:5.0_beta_2 cpe:/a:van_dyke_technologies:securecrt:5.0_beta_3 cpe:/a:van_dyke_technologies:securecrt:5.0_beta_4 cpe:/a:van_dyke_technologies:securecrt:5.0_beta_5 cpe:/a:van_dyke_technologies:securecrt:5.0_beta_6 cpe:/a:van_dyke_technologies:securefx:3.0 cpe:/a:van_dyke_technologies:securefx:3.0.1 cpe:/a:van_dyke_technologies:securefx:3.0.2 cpe:/a:van_dyke_technologies:securefx:3.0.3 cpe:/a:van_dyke_technologies:securefx:3.0.4 cpe:/a:van_dyke_technologies:securefx:3.0_beta_1 cpe:/a:van_dyke_technologies:securefx:3.0_beta_2 cpe:/a:van_dyke_technologies:securefx:3.0_beta_3 cpe:/a:van_dyke_technologies:securefx:3.0_beta_4 cpe:/a:van_dyke_technologies:securefx:3.0_beta_5 cpe:/a:van_dyke_technologies:securefx:3.0_beta_6 cpe:/a:van_dyke_technologies:securefx:3.0_beta_7 CVE-2006-1038 2006-03-07T06:02:00.000-05:00 2017-07-19T21:30:15.787-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov BID 16935 CONFIRM http://www.vandyke.com/products/securecrt/history.txt CONFIRM http://www.vandyke.com/products/securefx/history.txt VUPEN ADV-2006-0806 XF securecrt-securefx-string-bo(25092) Buffer overflow in SecureCRT 5.0.4 and earlier and SecureFX 3.0.4 and earlier allows remote attackers to have an unknown impact when a Unicode string is converted to a "narrow" string. cpe:/a:sap:sap_web_application_server:6.10 cpe:/a:sap:sap_web_application_server:6.20 cpe:/a:sap:sap_web_application_server:6.40 CVE-2006-1039 2006-03-07T06:02:00.000-05:00 2018-10-18T12:30:17.243-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov SECTRACK 1015702 BUGTRAQ 20060301 SAP Web Application Server http request url parsing vulnerability BID 18006 VUPEN ADV-2006-0810 XF sap-was-url-obtain-information(25003) SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a ";%20" followed by encoded HTTP headers. cpe:/a:jelsoft:vbulletin:3.0.12 cpe:/a:jelsoft:vbulletin:3.5.3 CVE-2006-1040 2006-03-07T06:02:00.000-05:00 2018-10-18T12:30:17.713-04:00 4.3 NETWORK MEDIUM NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://www.kapda.ir/advisory-266.html BUGTRAQ 20060301 [KAPDA::#26]vBulletin.3.5.3~3.0.12-XSS BUGTRAQ 20060302 vBulletin3.0.12&3.5.3~is_valid_email()~XSS Attack BID 16919 CONFIRM http://www.vbulletin.com/forum/showthread.php?postid=1079030 VUPEN ADV-2006-0808 Cross-site scripting (XSS) vulnerability in vBulletin 3.0.12 and 3.5.3 allows remote attackers to inject arbitrary web script or HTML via the email field, which is injected in profile.php but not sanitized in sendmsg.php. cpe:/a:gregarius:gregarius:0.5.2 CVE-2006-1041 2006-03-07T06:02:00.000-05:00 2018-10-18T12:30:18.260-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060303 Gregarius 0.5.2 XSS and SQL Injection Vulnerabilities BID 16939 VUPEN ADV-2006-0819 XF gregarius-multiple-xss(25058) Multiple cross-site scripting (XSS) vulnerabilities in Gregarius 0.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) rss_query parameter to search.php or (2) tag parameter to tags.php. cpe:/a:gregarius:gregarius:0.5.2 CVE-2006-1042 2006-03-07T06:02:00.000-05:00 2018-10-18T12:30:18.727-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov SREASON 537 BUGTRAQ 20060303 Gregarius 0.5.2 XSS and SQL Injection Vulnerabilities BID 16939 VUPEN ADV-2006-0819 XF gregarius-feed-sql-injection(25059) Multiple SQL injection vulnerabilities in Gregarius 0.5.2 allow remote attackers to execute arbitrary SQL commands via the (1) folder parameter to feed.php or (2) rss_query parameter to search.php. cpe:/a:microsoft:visual_interdev:6.0 cpe:/a:microsoft:visual_studio:6.0 cpe:/a:microsoft:visual_studio:6.0:sp1 cpe:/a:microsoft:visual_studio:6.0:sp2 cpe:/a:microsoft:visual_studio:6.0:sp3 cpe:/a:microsoft:visual_studio:6.0:sp4 cpe:/a:microsoft:visual_studio:6.0:sp5 CVE-2006-1043 2006-03-07T06:02:00.000-05:00 2018-10-18T12:30:19.260-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1015721 MISC http://www.frsirt.com/exploits/20060305.ms-visual-dbp.c.php BUGTRAQ 20060304 Visual Studio 6.0 Buffer Overflow Vulnerability BUGTRAQ 20060305 Microsoft Visual Studio 6.0 Sp6 Malformed .dbp File BoF Exploit BID 16953 VUPEN ADV-2006-0825 XF visualstudio-dataproject-bo(25148) Stack-based buffer overflow in Microsoft Visual Studio 6.0 and Microsoft Visual InterDev 6.0 allows user-assisted attackers to execute arbitrary code via a long DataProject field in a (1) Visual Studio Database Project File (.dbp) or (2) Visual Studio Solution (.sln). cpe:/a:lsoft:listserv:14.3 cpe:/a:lsoft:listserv:14.4 CVE-2006-1044 2006-03-07T06:02:00.000-05:00 2018-10-18T12:30:19.917-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015722 CERT-VN VU#841132 CONFIRM http://www.lsoft.com/manuals/1.8e/relnotes/LISTSERV14.5-Release-Notes.html#wasecurityalert MISC http://www.ngssoftware.com/advisories/listserv_3.txt BUGTRAQ 20060304 Critical Risk Vulnerability in L-Soft Listserv BID 16951 VUPEN ADV-2006-0824 XF listserv-wa-cgi-bo(25168) Multiple buffer overflows in LISTSERV 14.3 and 14.4, including LISTSERV Lite and HPO, with the web archive interface enabled, allow remote attackers to execute arbitrary code via unknown attack vectors related to the WA CGI. NOTE: technical details will be released after the grace period has ended on 20060603. cpe:/a:mozilla:thunderbird:1.5 CVE-2006-1045 2006-03-07T06:02:00.000-05:00 2018-10-18T12:30:20.527-04:00 2.6 NETWORK HIGH NONE PARTIAL NONE NONE http://nvd.nist.gov SREASON 514 DEBIAN DSA-1046 DEBIAN DSA-1051 GENTOO GLSA-200604-18 GENTOO GLSA-200605-09 MANDRIVA MDKSA-2006:078 CONFIRM http://www.mozilla.org/security/announce/2006/mfsa2006-26.html SUSE SUSE-SA:2006:022 REDHAT RHSA-2006:0330 BUGTRAQ 20060228 Mozilla Thunderbird : Multiple Information Disclosure Vulnerabilities HP SSRT061236 BID 16881 BID 17516 VUPEN ADV-2006-1356 VUPEN ADV-2006-3749 XF thunderbird-inline-information-disclosure(24959) UBUNTU USN-276-1 The HTML rendering engine in Mozilla Thunderbird 1.5, when "Block loading of remote images in mail messages" is enabled, does not properly block external images from inline HTML attachments, which could allow remote attackers to obtain sensitive information, such as application version or IP address, when the user reads the email and the external image is accessed. cpe:/a:monopd:monopd:0.9.3 CVE-2006-1046 2006-03-07T06:02:00.000-05:00 2017-07-19T21:30:16.223-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://aluigi.altervista.org/adv/monopdx-adv.txt CONFIRM http://www.robertjohnkaper.com/downloads/atlantik/monopd-0.9.3-dosfix.diff BID 16981 VUPEN ADV-2006-0844 XF monopd-string-dos(25161) server.cpp in Monopd 0.9.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a string containing a large number of characters that are escaped when Monopd produces XML output. cpe:/a:joomla:joomla:1.0.0 cpe:/a:joomla:joomla:1.0.1 cpe:/a:joomla:joomla:1.0.2 cpe:/a:joomla:joomla:1.0.3 cpe:/a:joomla:joomla:1.0.4 cpe:/a:joomla:joomla:1.0.5 cpe:/a:joomla:joomla:1.0.6 cpe:/a:joomla:joomla:1.0.7 CVE-2006-1047 2006-03-07T06:02:00.000-05:00 2008-09-05T17:00:53.677-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov 2006-03-08T13:30:00.000-05:00 CONFIRM http://www.joomla.org/content/view/938/78/ Unspecified vulnerability in the "Remember Me login functionality" in Joomla! 1.0.7 and earlier has unknown impact and attack vectors. cpe:/a:joomla:joomla:1.0 cpe:/a:joomla:joomla:1.0.1 cpe:/a:joomla:joomla:1.0.2 cpe:/a:joomla:joomla:1.0.3 cpe:/a:joomla:joomla:1.0.4 cpe:/a:joomla:joomla:1.0.5 cpe:/a:joomla:joomla:1.0.6 cpe:/a:joomla:joomla:1.0.7 CVE-2006-1048 2006-03-07T06:02:00.000-05:00 2017-07-19T21:30:16.270-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://www.joomla.org/content/view/938/78/ VUPEN ADV-2006-0818 XF joomla-multiple-bypass-security(25033) Joomla! 1.0.7 and earlier allows attackers to bypass intended access restrictions and gain certain privileges via certain attack vectors related to the (1) Weblink, (2) Polls, (3) Newsfeeds, (4) Weblinks, (5) Content, (6) Content Section, (7) Content Category, (8) Contact items, or (9) Contact Search, (10) Content Search, (11) Newsfeed Search, or (12) Weblink Search. cpe:/a:joomla:joomla:1.0.0 cpe:/a:joomla:joomla:1.0.1 cpe:/a:joomla:joomla:1.0.2 cpe:/a:joomla:joomla:1.0.3 cpe:/a:joomla:joomla:1.0.4 cpe:/a:joomla:joomla:1.0.5 cpe:/a:joomla:joomla:1.0.6 cpe:/a:joomla:joomla:1.0.7 CVE-2006-1049 2006-03-07T06:02:00.000-05:00 2011-09-08T00:00:00.000-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-03-08T13:31:00.000-05:00 ALLOWS_OTHER_ACCESS CONFIRM http://www.joomla.org/content/view/938/78/ VUPEN ADV-2006-0818 Multiple SQL injection vulnerabilities in the Admin functionality in Joomla! 1.0.7 and earlier allow remote authenticated administrators to execute arbitrary SQL commands via unknown attack vectors. cpe:/a:kwik-pay:kwik-pay_payroll:4.2.20 CVE-2006-1050 2006-03-07T15:02:00.000-05:00 2017-07-19T21:30:16.333-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov XF kwikpay-payroll-insecure-permissions(25114) ** DISPUTED ** Kwik-Pay Payroll 4.2.20, and possibly other versions, stores the KwikPay.mdb database file with insecure permissions, which allows local users to obtain sensitive information such as employment and payment data. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: the vendor has disputed this vulnerability, stating that "The kwikpay.mdb file supplied with kwikpay is a template for the database structure of user databases created by kwikpay and to store a demonstration payroll. It does not contain any sensitive user information. When a user payroll database is opened, the encryption of the database is checked and if the database is not encrypted, the user is prompted to encrypt the database, but the choice is the customers." cpe:/a:akarru:social_bookmarking_engine:0.4.3.2 cpe:/a:akarru:social_bookmarking_engine:0.4.3.3 CVE-2006-1051 2006-03-07T16:06:00.000-05:00 2017-07-19T21:30:16.410-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://sourceforge.net/project/shownotes.php?release_id=398713&group_id=155783 BID 16989 VUPEN ADV-2006-0841 XF akarru-users-sql-injection(25115) SQL injection vulnerability in Akarru Social BookMarking Engine before 0.4.3.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors, possibly involving the username parameter to akarru.lib/users.php. cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.0::64-bit_x86 cpe:/o:linux:linux_kernel:2.6.0::itanium_ia64_montecito cpe:/o:linux:linux_kernel:2.6.0:test1 cpe:/o:linux:linux_kernel:2.6.0:test10 cpe:/o:linux:linux_kernel:2.6.0:test11 cpe:/o:linux:linux_kernel:2.6.0:test2 cpe:/o:linux:linux_kernel:2.6.0:test3 cpe:/o:linux:linux_kernel:2.6.0:test4 cpe:/o:linux:linux_kernel:2.6.0:test5 cpe:/o:linux:linux_kernel:2.6.0:test6 cpe:/o:linux:linux_kernel:2.6.0:test7 cpe:/o:linux:linux_kernel:2.6.0:test8 cpe:/o:linux:linux_kernel:2.6.0:test9 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.6:rc2 cpe:/o:linux:linux_kernel:2.6.6:rc3 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.7:rc2 cpe:/o:linux:linux_kernel:2.6.7:rc3 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.8:rc4 cpe:/o:linux:linux_kernel:2.6.8.1 cpe:/o:linux:linux_kernel:2.6.8.1.5 cpe:/o:linux:linux_kernel:2.6.8.1.5::386 cpe:/o:linux:linux_kernel:2.6.8.1.5::686 cpe:/o:linux:linux_kernel:2.6.8.1.5::686_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64 cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64_k8 cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64_k8_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::amd64_xeon cpe:/o:linux:linux_kernel:2.6.8.1.5::k7 cpe:/o:linux:linux_kernel:2.6.8.1.5::k7_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::power3 cpe:/o:linux:linux_kernel:2.6.8.1.5::power3_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::power4 cpe:/o:linux:linux_kernel:2.6.8.1.5::power4_smp cpe:/o:linux:linux_kernel:2.6.8.1.5::powerpc cpe:/o:linux:linux_kernel:2.6.8.1.5::powerpc_smp cpe:/o:linux:linux_kernel:2.6.9 cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.9:rc1 cpe:/o:linux:linux_kernel:2.6.9:rc2 cpe:/o:linux:linux_kernel:2.6.9:rc3 cpe:/o:linux:linux_kernel:2.6.9:rc4 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc1 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.10:rc3 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11::x86_64 cpe:/o:linux:linux_kernel:2.6.11:rc1 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11:rc5 cpe:/o:linux:linux_kernel:2.6.11.1 cpe:/o:linux:linux_kernel:2.6.11.2 cpe:/o:linux:linux_kernel:2.6.11.3 cpe:/o:linux:linux_kernel:2.6.11.4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.9 cpe:/o:linux:linux_kernel:2.6.11.10 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.11_rc1_bk6 cpe:/o:linux:linux_kernel:2.6.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc2 cpe:/o:linux:linux_kernel:2.6.12:rc3 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12:rc6 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc2 cpe:/o:linux:linux_kernel:2.6.13:rc3 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc5 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14:rc5 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.14.5 cpe:/o:linux:linux_kernel:2.6.14.6 cpe:/o:linux:linux_kernel:2.6.14.7 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc2 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15:rc4 cpe:/o:linux:linux_kernel:2.6.15:rc5 cpe:/o:linux:linux_kernel:2.6.15:rc6 cpe:/o:linux:linux_kernel:2.6.15:rc7 cpe:/o:linux:linux_kernel:2.6.15.1 cpe:/o:linux:linux_kernel:2.6.15.2 cpe:/o:linux:linux_kernel:2.6.15.3 cpe:/o:linux:linux_kernel:2.6.15.4 cpe:/o:linux:linux_kernel:2.6.15.5 cpe:/o:linux:linux_kernel:2.6.15.6 cpe:/o:linux:linux_kernel:2.6.15.7 cpe:/o:linux:linux_kernel:2.6.16 cpe:/o:linux:linux_kernel:2.6.16:rc1 cpe:/o:linux:linux_kernel:2.6.16:rc2 cpe:/o:linux:linux_kernel:2.6.16:rc3 cpe:/o:linux:linux_kernel:2.6.16:rc4 cpe:/o:linux:linux_kernel:2.6.16:rc5 cpe:/o:linux:linux_kernel:2.6.16:rc6 cpe:/o:linux:linux_kernel:2.6.16.1 cpe:/o:linux:linux_kernel:2.6.16.2 cpe:/o:linux:linux_kernel:2.6.16.3 cpe:/o:linux:linux_kernel:2.6.16.4 cpe:/o:linux:linux_kernel:2.6.16.7 cpe:/o:linux:linux_kernel:2.6.16.8 cpe:/o:linux:linux_kernel:2.6.16.12 cpe:/o:linux:linux_kernel:2.6.16_rc7 cpe:/o:linux:linux_kernel:2.6.17 cpe:/o:linux:linux_kernel:2.6.17:rc1 cpe:/o:linux:linux_kernel:2.6_test9_cvs CVE-2006-1052 2006-05-05T08:46:00.000-04:00 2018-10-30T12:26:20.390-04:00 2.1 LOCAL LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MLIST [git-commits-head] 20060311 [PATCH] selinux: tracer SID fix MLIST [selinux] 20060313 [SECURITY] SELinux ptrace bug (CVE-2006-1052) MISC http://selinuxnews.org/wp/index.php/2006/03/13/security-ptrace-bug-cve-2006-1052/ CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm DEBIAN DSA-1184 MANDRIVA MDKSA-2006:086 REDHAT RHSA-2006:0575 BID 17830 UBUNTU USN-281-1 The selinux_ptrace logic in hooks.c in SELinux for Linux 2.6.6 allows local users with ptrace permissions to change the tracer SID to an SID of another process. CVE-2006-1054 2006-05-26T17:06:00.000-04:00 2008-09-10T16:05:35.913-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-1861. Reason: This candidate is a reservation duplicate of CVE-2006-1861. Notes: All CVE users should reference CVE-2006-1861 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. cpe:/o:linux:linux_kernel:2.6.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.14.5 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15:rc4 cpe:/o:linux:linux_kernel:2.6.15:rc5 cpe:/o:linux:linux_kernel:2.6.15:rc6 cpe:/o:linux:linux_kernel:2.6.15:rc7 cpe:/o:linux:linux_kernel:2.6.15.1 cpe:/o:linux:linux_kernel:2.6.15.2 cpe:/o:linux:linux_kernel:2.6.15.3 cpe:/o:linux:linux_kernel:2.6.15.4 cpe:/o:linux:linux_kernel:2.6.15.5 cpe:/o:linux:linux_kernel:2.6.16:rc1 cpe:/o:linux:linux_kernel:2.6.17 CVE-2006-1055 2006-04-05T13:04:00.000-04:00 2018-10-03T17:36:37.307-04:00 4.9 LOCAL LOW NONE NONE NONE COMPLETE http://nvd.nist.gov FEDORA FEDORA-2006-423 CONFIRM http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6e0dd741a89be35defa05bd79f4211c5a2762825 CONFIRM http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=6e0dd741a89be35defa05bd79f4211c5a2762825;hp=597a7679dd83691be2f3a53e1f3f915b4a7f6eba SUSE SUSE-SA:2006:028 BID 17402 TRUSTIX 2006-0020 UBUNTU USN-302-1 VUPEN ADV-2006-1273 VUPEN ADV-2006-1475 XF linux-fillwritebuffer-dos(25693) UBUNTU USN-281-1 The fill_write_buffer function in sysfs/file.c in Linux kernel 2.6.12 up to versions before 2.6.17-rc1 does not zero terminate a buffer when a length of PAGE_SIZE or more is requested, which might allow local users to cause a denial of service (crash) by causing an out-of-bounds read. cpe:/o:freebsd:freebsd cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.0:test1 cpe:/o:linux:linux_kernel:2.6.0:test10 cpe:/o:linux:linux_kernel:2.6.0:test11 cpe:/o:linux:linux_kernel:2.6.0:test2 cpe:/o:linux:linux_kernel:2.6.0:test3 cpe:/o:linux:linux_kernel:2.6.0:test4 cpe:/o:linux:linux_kernel:2.6.0:test5 cpe:/o:linux:linux_kernel:2.6.0:test6 cpe:/o:linux:linux_kernel:2.6.0:test7 cpe:/o:linux:linux_kernel:2.6.0:test8 cpe:/o:linux:linux_kernel:2.6.0:test9 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.1:rc3 cpe:/o:linux:linux_kernel:2.6.2 cpe:/o:linux:linux_kernel:2.6.2:rc1 cpe:/o:linux:linux_kernel:2.6.2:rc2 cpe:/o:linux:linux_kernel:2.6.2:rc3 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.3:rc1 cpe:/o:linux:linux_kernel:2.6.3:rc2 cpe:/o:linux:linux_kernel:2.6.3:rc3 cpe:/o:linux:linux_kernel:2.6.3:rc4 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.4:rc1 cpe:/o:linux:linux_kernel:2.6.4:rc2 cpe:/o:linux:linux_kernel:2.6.4:rc3 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.5:rc1 cpe:/o:linux:linux_kernel:2.6.5:rc2 cpe:/o:linux:linux_kernel:2.6.5:rc3 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.6:rc2 cpe:/o:linux:linux_kernel:2.6.6:rc3 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.7:rc2 cpe:/o:linux:linux_kernel:2.6.7:rc3 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.8:rc4 cpe:/o:linux:linux_kernel:2.6.9 cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.9:rc1 cpe:/o:linux:linux_kernel:2.6.9:rc2 cpe:/o:linux:linux_kernel:2.6.9:rc3 cpe:/o:linux:linux_kernel:2.6.9:rc4 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc1 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.10:rc3 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11:rc1 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11:rc5 cpe:/o:linux:linux_kernel:2.6.11.1 cpe:/o:linux:linux_kernel:2.6.11.2 cpe:/o:linux:linux_kernel:2.6.11.3 cpe:/o:linux:linux_kernel:2.6.11.4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.9 cpe:/o:linux:linux_kernel:2.6.11.10 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc2 cpe:/o:linux:linux_kernel:2.6.12:rc3 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12:rc6 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc2 cpe:/o:linux:linux_kernel:2.6.13:rc3 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc5 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14:rc5 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.14.5 cpe:/o:linux:linux_kernel:2.6.14.6 cpe:/o:linux:linux_kernel:2.6.14.7 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15:rc4 cpe:/o:linux:linux_kernel:2.6.15:rc5 cpe:/o:linux:linux_kernel:2.6.15:rc6 cpe:/o:linux:linux_kernel:2.6.15:rc7 cpe:/o:linux:linux_kernel:2.6.15.1 cpe:/o:linux:linux_kernel:2.6.15.2 cpe:/o:linux:linux_kernel:2.6.15.3 cpe:/o:linux:linux_kernel:2.6.15.4 cpe:/o:linux:linux_kernel:2.6.15.5 cpe:/o:linux:linux_kernel:2.6.15.6 cpe:/o:linux:linux_kernel:2.6.15.7 cpe:/o:linux:linux_kernel:2.6.16 cpe:/o:linux:linux_kernel:2.6.16:rc1 cpe:/o:linux:linux_kernel:2.6.16:rc2 cpe:/o:linux:linux_kernel:2.6.16:rc3 cpe:/o:linux:linux_kernel:2.6.16:rc4 cpe:/o:linux:linux_kernel:2.6.16:rc5 cpe:/o:linux:linux_kernel:2.6.16:rc6 cpe:/o:linux:linux_kernel:2.6.16.1 cpe:/o:linux:linux_kernel:2.6.16.2 cpe:/o:linux:linux_kernel:2.6.16.3 cpe:/o:linux:linux_kernel:2.6.16.4 cpe:/o:linux:linux_kernel:2.6.16.5 cpe:/o:linux:linux_kernel:2.6.16.6 cpe:/o:linux:linux_kernel:2.6.16.7 cpe:/o:linux:linux_kernel:2.6.16.8 cpe:/o:linux:linux_kernel:2.6.16_rc7 cpe:/o:linux:linux_kernel:2.6_test9_cvs CVE-2006-1056 2006-04-20T06:02:00.000-04:00 2018-10-30T12:26:20.390-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov FREEBSD FreeBSD-SA-06:14 CONFIRM http://kb.vmware.com/kb/2533126 CONFIRM http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.9 SUSE SUSE-SU-2014:0446 FEDORA FEDORA-2006-423 MLIST [linux-kernel] 20060419 RE: Linux 2.6.16.9 MISC http://security.freebsd.org/advisories/FreeBSD-SA-06:14-amd.txt SECTRACK 1015966 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-180.htm CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm DEBIAN DSA-1097 DEBIAN DSA-1103 SUSE SUSE-SA:2006:028 REDHAT RHSA-2006:0437 REDHAT RHSA-2006:0575 REDHAT RHSA-2006:0579 BUGTRAQ 20060419 FreeBSD Security Advisory FreeBSD-SA-06:14.fpu BUGTRAQ 20061113 VMSA-2006-0006 - VMware ESX Server 2.5.3 Upgrade Patch 4 BUGTRAQ 20061113 VMSA-2006-0007 - VMware ESX Server 2.1.3 Upgrade Patch 2 BUGTRAQ 20061113 VMSA-2006-0005 - VMware ESX Server 2.5.4 Upgrade Patch 1 BUGTRAQ 20061113 VMSA-2006-0009 - VMware ESX Server 3.0.0 AMD fxsave/restore issue BID 17600 UBUNTU USN-302-1 CONFIRM http://www.vmware.com/download/esx/esx-213-200610-patch.html CONFIRM http://www.vmware.com/download/esx/esx-254-200610-patch.html VUPEN ADV-2006-1426 VUPEN ADV-2006-1475 VUPEN ADV-2006-2554 VUPEN ADV-2006-4353 VUPEN ADV-2006-4502 CONFIRM https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187910 CONFIRM https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187911 XF amd-fpu-information-disclosure(25871) The Linux kernel before 2.6.16.9 and the FreeBSD kernel, when running on AMD64 and other 7th and 8th generation AuthenticAMD processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one process to determine portions of the state of floating point instructions of other processes, which can be leveraged to obtain sensitive information such as cryptographic keys. NOTE: this is the documented behavior of AMD64 processors, but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels. cpe:/a:gnome:gdm:2.14 CVE-2006-1057 2006-04-24T21:02:00.000-04:00 2018-10-03T17:36:39.153-04:00 3.7 LOCAL HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://cvs.gnome.org/viewcvs/gdm2/daemon/slave.c?r1=1.260&r2=1.261 DEBIAN DSA-1040 MANDRIVA MDKSA-2006:083 REDHAT RHSA-2007:0286 BID 17635 VUPEN ADV-2006-1465 CONFIRM https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188303 XF gdm-slavec-symlink(26092) UBUNTU USN-278-1 FEDORA FEDORA-2006-338 Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority file. cpe:/a:busybox:busybox:1.1.1 CVE-2006-1058 2006-04-04T06:04:00.000-04:00 2017-10-10T21:30:40.860-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://bugs.busybox.net/view.php?id=604 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2007-250.htm REDHAT RHSA-2007:0244 BID 17330 XF busybox-passwd-weak-security(25569) BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables. cpe:/a:samba:samba:3.0.21 cpe:/a:samba:samba:3.0.21a cpe:/a:samba:samba:3.0.21b cpe:/a:samba:samba:3.0.21c CVE-2006-1059 2006-03-30T12:06:00.000-05:00 2018-10-18T12:30:30.977-04:00 1.2 LOCAL HIGH NONE PARTIAL NONE NONE http://nvd.nist.gov SECTRACK 1015850 CONFIRM http://us1.samba.org/samba/security/CAN-2006-1059.html FEDORA FEDORA-2006-259 BUGTRAQ 20060330 [SECURITY] Samba 3.0.21-3.0.21c: Exposure of machine account credentials in winbindd log files BID 17314 TRUSTIX 2006-0018 VUPEN ADV-2006-1179 XF samba-logfile-account-cleartext(25575) The winbindd daemon in Samba 3.0.21 to 3.0.21c writes the machine trust account password in cleartext in log files, which allows local users to obtain the password and spoof the server in the domain. cpe:/a:xzgv:xzgv:0.8 CVE-2006-1060 2006-04-11T06:02:00.000-04:00 2017-07-19T21:30:16.940-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SREASON 756 DEBIAN DSA-1037 DEBIAN DSA-1038 SUSE SUSE-SR:2006:008 BID 17409 VUPEN ADV-2006-1288 XF xzgv-jpeg-bo(25718) Heap-based buffer overflow in zgv before 5.8 and xzgv before 0.8 might allow user-assisted attackers to execute arbitrary code via a JPEG image with more than 3 output components, such as a CMYK or YCCK color space, which causes less memory to be allocated than required. cpe:/a:daniel_stenberg:curl:7.15.0 cpe:/a:daniel_stenberg:curl:7.15.1 cpe:/a:daniel_stenberg:curl:7.15.2 CVE-2006-1061 2006-03-20T20:06:00.000-05:00 2017-07-19T21:30:17.003-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060320 [SSAG#001] :: cURL tftp:// URL Buffer Overflow CONFIRM http://curl.haxx.se/docs/adv_20060320.html GENTOO GLSA-200603-19 FEDORA FEDORA-2006-189 BID 17154 TRUSTIX 2006-0016 VUPEN ADV-2006-1008 XF curl-tftp-bo(25318) Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL (tftp://) with a valid hostname and a long path. cpe:/a:lurker:lurker:0.1a cpe:/a:lurker:lurker:0.2 CVE-2006-1062 2006-03-07T16:06:00.000-05:00 2017-07-19T21:30:17.067-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://sourceforge.net/project/shownotes.php?release_id=399034&group_id=8168 MLIST [Lurker-users] 20060302 Serious security vulnerabilities found DEBIAN DSA-999 BID 17003 VUPEN ADV-2006-0850 XF lurker-lurker-information-disclosure(25149) Unspecified vulnerability in lurker.cgi for Lurker 2.0 and earlier allows attackers to read arbitrary files via unknown vectors. cpe:/a:lurker:lurker:0.1a cpe:/a:lurker:lurker:0.2 CVE-2006-1063 2006-03-07T16:06:00.000-05:00 2017-07-19T21:30:17.113-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://sourceforge.net/project/shownotes.php?release_id=399034&group_id=8168 MLIST [Lurker-users] 20060302 Serious security vulnerabilities found DEBIAN DSA-999 BID 17003 VUPEN ADV-2006-0850 XF lurker-mbox-error(25153) Unspecified vulnerability in Lurker 2.0 and earlier allows remote attackers to create or overwrite files in any writable directory that is named "mbox". cpe:/a:lurker:lurker:0.1a cpe:/a:lurker:lurker:2.0 CVE-2006-1064 2006-03-07T16:06:00.000-05:00 2017-07-19T21:30:17.177-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://sourceforge.net/project/shownotes.php?release_id=399034&group_id=8168 MLIST [Lurker-users] 20060302 Serious security vulnerabilities found DEBIAN DSA-999 BID 17003 VUPEN ADV-2006-0850 XF lurker-unspecified-xss(25154) Multiple cross-site scripting (XSS) vulnerabilities in Lurker 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors. cpe:/a:mybulletinboard:mybulletinboard:1.04 CVE-2006-1065 2006-03-07T17:06:00.000-05:00 2018-10-18T12:30:31.807-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060302 MyBB 1.0.4 New SQL Injection XF mybb-search-sql-injection(25018) SQL injection vulnerability in search.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to execute arbitrary SQL commands via the forums[] parameter. cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.0:test1 cpe:/o:linux:linux_kernel:2.6.0:test10 cpe:/o:linux:linux_kernel:2.6.0:test11 cpe:/o:linux:linux_kernel:2.6.0:test2 cpe:/o:linux:linux_kernel:2.6.0:test3 cpe:/o:linux:linux_kernel:2.6.0:test4 cpe:/o:linux:linux_kernel:2.6.0:test5 cpe:/o:linux:linux_kernel:2.6.0:test6 cpe:/o:linux:linux_kernel:2.6.0:test7 cpe:/o:linux:linux_kernel:2.6.0:test8 cpe:/o:linux:linux_kernel:2.6.0:test9 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.2 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.14.5 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15.1 cpe:/o:linux:linux_kernel:2.6.15.4 cpe:/o:linux:linux_kernel:2.6_test9_cvs CVE-2006-1066 2006-03-26T19:02:00.000-05:00 2018-10-03T17:36:40.323-04:00 1.2 LOCAL HIGH NONE NONE NONE PARTIAL http://nvd.nist.gov MLIST [linux-kernel] 20060207 [PATCH] arch/x86_64/kernel/traps.c PTRACE_SINGLESTEP oops DEBIAN DSA-1017 MANDRIVA MDKSA-2006:151 BID 17216 UBUNTU USN-281-1 Linux kernel 2.6.16-rc2 and earlier, when running on x86_64 systems with preemption enabled, allows local users to cause a denial of service (oops) via multiple ptrace tasks that perform single steps, which can cause corruption of the DEBUG_STACK stack during the do_debug function call. cpe:/h:linksys:wrt54g_v5 CVE-2006-1067 2006-03-07T17:06:00.000-05:00 2018-10-18T12:30:32.073-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://www.hm2k.org/news/1141413208.html BUGTRAQ 20060304 Various router DoS BUGTRAQ 20060303 linksys router + irc DoS BUGTRAQ 20060306 Re: linksys router + irc DoS BUGTRAQ 20060306 RE: linksys router + irc DoS BID 16954 XF multiple-vendor-dccsend-dos(25230) Linksys WRT54G routers version 5 (running VXWorks) allow remote attackers to cause a denial of service by sending a malformed DCC SEND string to an IRC channel, which causes an IRC connection reset, possibly related to the masquerading code for NAT environments, and as demonstrated via (1) a DCC SEND with a single long argument, or (2) a DCC SEND with IP, port, and filesize arguments with a 0 value. cpe:/h:netgear:netgear_router CVE-2006-1068 2006-03-07T17:06:00.000-05:00 2018-10-18T12:30:32.637-04:00 4.9 LOCAL LOW NONE NONE NONE COMPLETE http://nvd.nist.gov MISC http://www.hm2k.org/news/1141413208.html BUGTRAQ 20060304 Various router DoS BUGTRAQ 20060303 linksys router + irc DoS BUGTRAQ 20060306 Re: linksys router + irc DoS BUGTRAQ 20060306 RE: linksys router + irc DoS BID 16954 XF multiple-vendor-dccsend-dos(25230) Netgear 614 and 624 routers, possibly running VXWorks, allow remote attackers to cause a denial of service by sending a malformed DCC SEND string to an IRC channel, which causes an IRC connection reset, possibly related to the masquerading code for NAT environments, and as demonstrated via (1) a DCC SEND with a single long argument, or (2) a DCC SEND with IP, port, and filesize arguments with a 0 value. cpe:/a:geeklog:geeklog:1.3.9 cpe:/a:geeklog:geeklog:1.3.9_sr1 cpe:/a:geeklog:geeklog:1.3.9_sr2 cpe:/a:geeklog:geeklog:1.3.9_sr3 cpe:/a:geeklog:geeklog:1.3.9_sr4 cpe:/a:geeklog:geeklog:1.3.11 cpe:/a:geeklog:geeklog:1.3.11_sr1 cpe:/a:geeklog:geeklog:1.3.11_sr2 cpe:/a:geeklog:geeklog:1.3.11_sr3 cpe:/a:geeklog:geeklog:1.3.11_sr4 cpe:/a:geeklog:geeklog:1.4.0 cpe:/a:geeklog:geeklog:1.4.0_sr1 CVE-2006-1069 2006-03-07T18:02:00.000-05:00 2011-03-07T21:31:54.547-05:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov CONFIRM http://www.geeklog.net/article.php/geeklog-1.4.0sr2 BID 17010 VUPEN ADV-2006-0851 Unspecified vulnerability in the session handling for Geeklog 1.4.x before 1.4.0sr2, 1.3.11 before 1.3.11sr5, 1.3.9 before 1.3.9sr5, and possibly earlier versions allows attackers to gain privileges as arbitrary users via unknown vectors. cpe:/a:dvguestbook:dvguestbook:1.0 CVE-2006-1070 2006-03-07T19:02:00.000-05:00 2018-10-18T12:30:33.213-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://biyosecurity.be/bugs/dvguestbook.txt BUGTRAQ 20060309 DVguestbook 1.0 And 1.2.2 Cross Site Scripting BID 16968 VUPEN ADV-2006-0842 XF dvguestbook-index-dvgbook-xss(25049) Cross-site scripting (XSS) vulnerability in dv_gbook.php in DVguestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the f parameter. cpe:/a:dvguestbook:dvguestbook:1.2.2 CVE-2006-1071 2006-03-07T19:02:00.000-05:00 2018-10-18T12:30:33.603-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://biyosecurity.be/bugs/dvguestbook.txt BUGTRAQ 20060309 DVguestbook 1.0 And 1.2.2 Cross Site Scripting BID 16968 VUPEN ADV-2006-0843 XF dvguestbook-index-dvgbook-xss(25049) Cross-site scripting (XSS) vulnerability in index.php in DVguestbook 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the page parameter. cpe:/a:simplog:simplog:1.0.2 CVE-2006-1072 2006-03-07T19:02:00.000-05:00 2018-10-18T12:30:34.010-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://notlegal.ws/simplogsploit.txt BUGTRAQ 20060304 Simplog <= 1.0.2 Vulnerabilities BID 16965 XF simplog-post-xss(25066) Cross-site scripting (XSS) vulnerability in Daverave Simplog 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a blog post. cpe:/a:simplog:simplog:1.0.2 CVE-2006-1073 2006-03-07T19:02:00.000-05:00 2018-10-18T12:30:34.307-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov MISC http://notlegal.ws/simplogsploit.txt SREASON 542 BUGTRAQ 20060304 Simplog <= 1.0.2 Vulnerabilities BID 16965 VUPEN ADV-2006-0839 XF simplog-index-traverse-directories(25067) Directory traversal vulnerability in index.php in Daverave Simplog 1.0.2 and earlier allows remote attackers to include or read arbitrary .txt files via the (1) act and (2) blogid parameters. cpe:/a:jason_boettcher:liero_xtreme:0.56b_pack_1.7 cpe:/a:jason_boettcher:liero_xtreme:0.62b CVE-2006-1074 2006-03-08T19:02:00.000-05:00 2018-10-18T12:30:34.777-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://aluigi.altervista.org/adv/lieroxxx-adv.txt BUGTRAQ 20060306 Multiple vulnerabilities in Liero Xtreme 0.62b BID 16992 VUPEN ADV-2006-0849 XF liero-connect-dos(25185) Jason Boettcher Liero Xtreme 0.62b and earlier allow remote attackers to cause a denial of service (application crash or hang) via a long argument to the connect command. cpe:/a:jason_boettcher:liero_xtreme:0.56b_pack_1.7 cpe:/a:jason_boettcher:liero_xtreme:0.62b CVE-2006-1075 2006-03-08T19:02:00.000-05:00 2018-10-18T12:30:35.213-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://aluigi.altervista.org/adv/lieroxxx-adv.txt SREASON 549 BUGTRAQ 20060306 Multiple vulnerabilities in Liero Xtreme 0.62b BID 16990 VUPEN ADV-2006-0849 XF liero-visualization-format-string(25187) Format string vulnerability in the visualization function in Jason Boettcher Liero Xtreme 0.62b and earlier allows remote attackers to execute arbitrary code via format string specifiers in (1) a nickname, (2) a dedicated server name, or (3) a mapname in a level (aka .lxl) file. cpe:/a:invision_power_services:invision_power_board:2.1.5 CVE-2006-1076 2006-03-08T19:02:00.000-05:00 2018-10-18T12:30:35.683-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060306 SQL injection in Invision Power Board v2.1.5 BUGTRAQ 20060405 Re: SQL injection in Invision Power Board v2.1.5 BID 16971 XF invision-index-sql-injection(25254) SQL injection vulnerability in index.php, possibly during a showtopic operation, in Invision Power Board (IPB) 2.1.5 allows remote attackers to execute arbitrary SQL commands via the st parameter. cpe:/a:evo-dev:evoblog CVE-2006-1077 2006-03-08T19:02:00.000-05:00 2018-10-18T12:30:36.040-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 544 BUGTRAQ 20060306 evoBlog Remote Name tag Script injection BUGTRAQ 20060423 Re: evoBlog Remote Name tag Script injection BID 16983 Multiple cross-site scripting (XSS) vulnerabilities in the commentary in Evo-Dev evoBlog allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter and (2) other unspecified parameters. cpe:/a:acme_labs:thttpd:2.25b CVE-2006-1078 2006-03-08T19:02:00.000-05:00 2018-10-18T12:30:36.447-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS FULLDISC 20040916 FlowSecurity.org: Local Stack Overflow on htpasswd apache 1.3.31 advsory. MISC http://issues.apache.org/bugzilla/show_bug.cgi?id=31975 MISC http://issues.apache.org/bugzilla/show_bug.cgi?id=41279 FULLDISC 20070102 Apache 1.3.37 htpasswd buffer overflow vulnerability MLIST [thttpd] 20060305 htpasswd.c security issues MLIST [thttpd] 20060305 Re: htpasswd.c security issues BUGTRAQ 20041029 Re: local buffer overflow in htpasswd for apache 1.3.31 not fixed in .33? FULLDISC 20041029 Apache 1.3.33 local buffer overflow in apache 1.3.31 not fixed in .33? BUGTRAQ 20060305 htpasswd bufferoverflow and command execution in thttpd-2.25b. BID 16972 XF thttpd-command-file-bo(25216) XF apache-htpasswd-strcpy-bo(31236) Multiple buffer overflows in htpasswd, as used in Acme thttpd 2.25b, and possibly other products such as Apache, might allow local users to gain privileges via (1) a long command line argument and (2) a long line in a file. NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE. However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included. cpe:/a:acme_labs:thttpd:2.25b CVE-2006-1079 2006-03-08T19:02:00.000-05:00 2018-10-18T12:30:37.447-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS MLIST [thttpd] 20060305 htpasswd.c security issues MLIST [thttpd] 20060305 Re: htpasswd.c security issues BUGTRAQ 20060305 htpasswd bufferoverflow and command execution in thttpd-2.25b. BID 16972 XF thttpd-command-line-bo(25217) htpasswd, as used in Acme thttpd 2.25b and possibly other products such as Apache, might allow local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function. NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE. However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included. cpe:/a:game-panel:game-panel:2.6 cpe:/a:game-panel:game-panel:2.6.1 CVE-2006-1080 2006-03-08T19:02:00.000-05:00 2018-10-18T12:30:37.993-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://notlegal.ws/gamepanel.txt BUGTRAQ 20060304 Game-Panel <= 2.1.6 XSS BID 16979 VUPEN ADV-2006-0864 XF gamepanel-login-xss(25144) Cross-site scripting (XSS) vulnerability in login.php in Game-Panel 2.6.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the message parameter, possibly requiring a URL encoded value. cpe:/a:jonathan_beckett:pluggedout_nexus:0.1 CVE-2006-1081 2006-03-08T19:02:00.000-05:00 2018-10-18T12:30:38.417-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://hamid.ir/security/nexus.txt SREASON 536 SECTRACK 1015715 BUGTRAQ 20060302 PluggedOut Nexus SQL injection BID 16915 VUPEN ADV-2006-0809 XF nexus-forgottenpassword-sql-injection(25017) SQL injection vulnerability in forgotten_password.php in Jonathan Beckett PluggedOut Nexus 0.1 allows remote attackers to execute arbitrary SQL commands via the email parameter. cpe:/a:phparcadescript:phparcadescript:2.0 CVE-2006-1082 2006-03-08T19:02:00.000-05:00 2018-10-18T12:30:38.933-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 533 BUGTRAQ 20060304 phpArcadeScript XSS Injections BID 16957 VUPEN ADV-2006-0821 Multiple cross-site scripting (XSS) vulnerabilities in phpArcadeScript 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the gamename parameter in tellafriend.php, (2) the login_status parameter in loginbox.php, (3) the submissionstatus parameter in index.php, the (4) cell_title_background_color and (5) browse_cat_name parameters in browse.php, the (6) gamefile parameter in displaygame.php, and (7) possibly other parameters in unspecified PHP scripts. cpe:/a:php-stats:php-stats:0.1.9.1 CVE-2006-1083 2006-03-08T19:02:00.000-05:00 2018-10-18T12:30:39.243-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://retrogod.altervista.org/php_stats_0191_adv.html MISC http://www.phpstats.net/forum/viewtopic.php?t=140 BUGTRAQ 20060304 PHP-Stats <= 0.1.9.1 remote commands execution BUGTRAQ 20060322 Re: PHP-Stats <= 0.1.9.1 remote commands execution BUGTRAQ 20060327 Re: PHP-Stats <= 0.1.9.1 remote commands execution BID 16963 VUPEN ADV-2006-0822 Multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to read and possibly execute arbitrary files via a .. (dot dot) in the (1) option[language] and (2) option[template] parameters, and (3) possibly other parameters, to (a) admin.php and (b) other unspecified scripts. NOTE: the admin.php/option[language] vector can be used by remote unauthenticated attackers to include arbitrary files in conjunction with CVE-2006-1085. cpe:/a:php-stats:php-stats:0.1.9.1 CVE-2006-1084 2006-03-08T19:02:00.000-05:00 2018-10-18T12:30:39.837-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://retrogod.altervista.org/php_stats_0191_adv.html MISC http://www.phpstats.net/forum/viewtopic.php?t=140 BUGTRAQ 20060304 PHP-Stats <= 0.1.9.1 remote commands execution BUGTRAQ 20060322 Re: PHP-Stats <= 0.1.9.1 remote commands execution BUGTRAQ 20060327 Re: PHP-Stats <= 0.1.9.1 remote commands execution BID 16963 VUPEN ADV-2006-0822 Multiple SQL injection vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the option[prefix] parameter in admin.php and other unspecified PHP scripts, and (2) the PC_REMOTE_ADDR HTTP header to click.php. cpe:/a:php-stats:php-stats:0.1.9.1 CVE-2006-1085 2006-03-08T19:02:00.000-05:00 2018-10-18T12:30:40.417-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS MISC http://retrogod.altervista.org/php_stats_0191_adv.html MISC http://www.phpstats.net/forum/viewtopic.php?t=140 BUGTRAQ 20060304 PHP-Stats <= 0.1.9.1 remote commands execution BUGTRAQ 20060322 Re: PHP-Stats <= 0.1.9.1 remote commands execution BUGTRAQ 20060327 Re: PHP-Stats <= 0.1.9.1 remote commands execution BID 16963 VUPEN ADV-2006-0822 admin.php in PHP-Stats 0.1.9.1 and earlier allows remote attackers to bypass authentication, gain administrator privileges, and execute arbitrary PHP code by modifying the option[admin_pass] parameter and setting the pass_cookie to the MD5 hash of the specified password. CVE-2006-1086 2006-03-08T19:02:00.000-05:00 2008-09-10T16:06:04.523-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-1083. Reason: This candidate is a duplicate of CVE-2006-1083. Notes: All CVE users should reference CVE-2006-1083 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. cpe:/a:php-stats:php-stats:0.1.9.1 CVE-2006-1087 2006-03-08T19:02:00.000-05:00 2018-10-18T12:30:41.010-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://retrogod.altervista.org/php_stats_0191_adv.html MISC http://www.phpstats.net/forum/viewtopic.php?t=140 BUGTRAQ 20060304 PHP-Stats <= 0.1.9.1 remote commands execution BUGTRAQ 20060322 Re: PHP-Stats <= 0.1.9.1 remote commands execution BUGTRAQ 20060327 Re: PHP-Stats <= 0.1.9.1 remote commands execution BID 16963 VUPEN ADV-2006-0822 Direct static code injection vulnerability in the modify_config action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the option_new[compatibility_mode] parameter, which is not filtered before being stored in config.php. NOTE: this vulnerability can be exploited by remote unauthenticated attackers in conjunction with the option[admin_pass] authentication bypass vulnerability. cpe:/a:php-stats:php-stats:0.1.9.1 CVE-2006-1088 2006-03-08T19:02:00.000-05:00 2018-10-18T12:30:41.587-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://retrogod.altervista.org/php_stats_0191_adv.html MISC http://www.phpstats.net/forum/viewtopic.php?t=140 BUGTRAQ 20060304 PHP-Stats <= 0.1.9.1 remote commands execution BUGTRAQ 20060322 Re: PHP-Stats <= 0.1.9.1 remote commands execution BUGTRAQ 20060327 Re: PHP-Stats <= 0.1.9.1 remote commands execution BID 16963 VUPEN ADV-2006-0822 PHP-Stats 0.1.9.1 and earlier allows remote attackers to obtain potentially sensitive information via a direct request to checktables.php, which lists the database table_prefix. cpe:/a:punbb:punbb:1.0 cpe:/a:punbb:punbb:1.0.1 cpe:/a:punbb:punbb:1.0_alpha cpe:/a:punbb:punbb:1.0_beta1 cpe:/a:punbb:punbb:1.0_beta1a cpe:/a:punbb:punbb:1.0_beta2 cpe:/a:punbb:punbb:1.0_beta3 cpe:/a:punbb:punbb:1.0_rc1 cpe:/a:punbb:punbb:1.0_rc2 cpe:/a:punbb:punbb:1.1 cpe:/a:punbb:punbb:1.1.1 cpe:/a:punbb:punbb:1.1.2 cpe:/a:punbb:punbb:1.1.3 cpe:/a:punbb:punbb:1.1.4 cpe:/a:punbb:punbb:1.1.5 cpe:/a:punbb:punbb:1.2 cpe:/a:punbb:punbb:1.2.1 cpe:/a:punbb:punbb:1.2.2 cpe:/a:punbb:punbb:1.2.3 cpe:/a:punbb:punbb:1.2.4 cpe:/a:punbb:punbb:1.2.5 cpe:/a:punbb:punbb:1.2.6 cpe:/a:punbb:punbb:1.2.7 cpe:/a:punbb:punbb:1.2.8 cpe:/a:punbb:punbb:1.2.9 cpe:/a:punbb:punbb:1.2.10 CVE-2006-1089 2006-03-09T08:06:00.000-05:00 2017-07-19T21:30:18.020-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://www.punbb.org/changelogs/1.2.10_to_1.2.11.txt CONFIRM http://www.punbb.org/download/patch/punbb-1.2.10_to_1.2.11.patch BID 16891 VUPEN ADV-2006-0773 XF punbb-header-xss(24982) Cross-site scripting (XSS) vulnerability in header.php in PunBB 1.2.10 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly handled when the PHP_SELF variable is used to handle a pun_page tag. cpe:/a:punbb:punbb:1.2.10 CVE-2006-1090 2006-03-09T08:06:00.000-05:00 2017-07-19T21:30:18.083-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov CONFIRM http://www.punbb.org/changelogs/1.2.10_to_1.2.11.txt CONFIRM http://www.punbb.org/download/patch/punbb-1.2.10_to_1.2.11.patch VUPEN ADV-2006-0773 XF punbb-register-ip-dos(24837) register.php in PunBB 1.2.10 allows remote attackers to cause an unspecified denial of service via a flood of new user registrations. cpe:/a:kaspersky_lab:kaspersky_anti-virus:5.0.5 cpe:/a:kaspersky_lab:kaspersky_anti-virus:5.5.3 CVE-2006-1091 2006-03-09T08:06:00.000-05:00 2017-07-19T21:30:18.130-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov SREASON 535 BUGTRAQ 20060303 Kaspersky Memory/CPU Usage Leak by design BID 16942 XF kaspersky-unspecified-dos(25221) Kaspersky Antivirus 5.0.5 and 5.5.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via unknown attack vectors. cpe:/o:sun:solaris:9.0::sparc cpe:/o:sun:solaris:10.0::sparc cpe:/o:sun:sunos:5.8 CVE-2006-1092 2006-03-09T08:06:00.000-05:00 2018-10-30T12:25:37.090-04:00 2.1 LOCAL LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SECTRACK 1015723 SUNALERT 102159 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm BID 16966 VUPEN ADV-2006-0829 XF solaris-proc-pagedata-dos(25152) Unspecified vulnerability in the pagedata subsystem of the process file system (/proc) in Solaris 8 through 10 allows local users to cause a denial of service (system hang or panic) via unknown attack vectors that cause cause the kmem_oversize arena to allocate a large amount of system memory that does not get freed. cpe:/a:ibm:websphere_application_server:5.0.2 cpe:/a:ibm:websphere_application_server:5.0.2.1 cpe:/a:ibm:websphere_application_server:5.0.2.2 cpe:/a:ibm:websphere_application_server:5.0.2.3 cpe:/a:ibm:websphere_application_server:5.0.2.4 cpe:/a:ibm:websphere_application_server:5.0.2.5 cpe:/a:ibm:websphere_application_server:5.0.2.6 cpe:/a:ibm:websphere_application_server:5.0.2.7 cpe:/a:ibm:websphere_application_server:5.0.2.8 cpe:/a:ibm:websphere_application_server:5.0.2.9 cpe:/a:ibm:websphere_application_server:5.0.2.10 cpe:/a:ibm:websphere_application_server:5.0.2.11 cpe:/a:ibm:websphere_application_server:5.0.2.12 cpe:/a:ibm:websphere_application_server:5.0.2.13 cpe:/a:ibm:websphere_application_server:5.0.2.14 cpe:/a:ibm:websphere_application_server:5.1.1 cpe:/a:ibm:websphere_application_server:5.1.1.1 cpe:/a:ibm:websphere_application_server:5.1.1.2 cpe:/a:ibm:websphere_application_server:5.1.1.3 cpe:/a:ibm:websphere_application_server:5.1.1.4 cpe:/a:ibm:websphere_application_server:5.1.1.5 cpe:/a:ibm:websphere_application_server:5.1.1.6 cpe:/a:ibm:websphere_application_server:5.1.1.7 cpe:/a:ibm:websphere_application_server:5.1.1.8 cpe:/a:ibm:websphere_application_server:5.1.1.9 CVE-2006-1093 2006-03-09T08:06:00.000-05:00 2011-03-07T21:32:01.220-05:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov SECTRACK 1015716 BID 16908 VUPEN ADV-2006-0788 Unspecified vulnerability in IBM WebSphere 5.0.2.10 through 5.0.2.15 and 5.1.1.4 through 5.1.1.9 allows remote attackers to obtain sensitive information via unknown attack vectors, which causes JSP source code to be revealed. cpe:/a:datenbank_module:datenbank_module:2.7 cpe:/a:woltlab:burning_board:1.1.1 cpe:/a:woltlab:burning_board:2.0_beta_3 cpe:/a:woltlab:burning_board:2.0_beta_4 cpe:/a:woltlab:burning_board:2.0_beta_5 cpe:/a:woltlab:burning_board:2.0_rc1 cpe:/a:woltlab:burning_board:2.0_rc2 cpe:/a:woltlab:burning_board:2.2.2 cpe:/a:woltlab:burning_board:2.3.1 cpe:/a:woltlab:burning_board:2.3.3 cpe:/a:woltlab:burning_board:2.4 cpe:/a:woltlab:burning_board:2.5 cpe:/a:woltlab:burning_board:2.6 cpe:/a:woltlab:burning_board:2.7 CVE-2006-1094 2006-03-09T08:06:00.000-05:00 2008-09-05T17:01:01.393-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-03-09T12:37:00.000-05:00 ALLOWS_OTHER_ACCESS MISC http://www.nukedx.com/?viewdoc=17 BUGTRAQ 20060301 Woltlab Burning Board 2.x (Datenbank MOD fileid) MultipleVulnerabilities BID 16914 SQL injection vulnerability in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allows remote attackers to execute arbitrary SQL commands via the fileid parameter to (1) info_db.php or (2) database.php. cpe:/a:apache:mod_python:3.2.7 CVE-2006-1095 2006-03-09T08:06:00.000-05:00 2017-07-19T21:30:18.237-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015764 CONFIRM http://svn.apache.org/viewcvs.cgi/httpd/mod_python/branches/3.2.x/NEWS?rev=378945 MISC http://www.cgisecurity.com/2006/02/07 CONFIRM http://www.modpython.org/fs_sec_warn.html BID 16916 VUPEN ADV-2006-0768 XF modpython-filesession-command-execution(24965) Directory traversal vulnerability in the FileSession object in Mod_python module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie. cpe:/a:digital_builder:nz_ecommerce CVE-2006-1096 2006-03-09T08:06:00.000-05:00 2011-03-07T21:32:01.657-05:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://pridels0.blogspot.com/2006/03/nz-ecommerce-sqlxss-vuln.html BID 16931 VUPEN ADV-2006-0803 ** DISPUTED ** Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem. cpe:/a:datenbank_module:datenbank_module:mod_2.7 CVE-2006-1097 2006-03-09T08:06:00.000-05:00 2017-07-19T21:30:18.300-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060301 Woltlab Burning Board 2.x (Datenbank MOD fileid) MultipleVulnerabilities MISC http://www.nukedx.com/?viewdoc=17 BUGTRAQ 20060301 Woltlab Burning Board 2.x (Datenbank MOD fileid) MultipleVulnerabilities XF wbb-multiple-xss(25004) Multiple cross-site scripting (XSS) vulnerabilities in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allow remote attackers to inject arbitrary web script or HTML via the fileid parameter to (1) info_db.php or (2) database.php. cpe:/a:digital_builder:nz_ecommerce CVE-2006-1098 2006-03-09T08:06:00.000-05:00 2017-07-11T21:29:02.003-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://pridels0.blogspot.com/2006/03/nz-ecommerce-sqlxss-vuln.html BID 16931 VUPEN ADV-2006-0803 ** DISPUTED ** Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the (1) informationID or (2) ParentCategory parameter to index.php. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem. cpe:/a:logit:logit:1.3 cpe:/a:logit:logit:1.4 CVE-2006-1099 2006-03-09T08:06:00.000-05:00 2008-09-05T17:01:02.160-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-03-09T16:01:00.000-05:00 ALLOWS_OTHER_ACCESS BID 16932 PHP remote file include vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:sauerbraten:cube:2005-08-09 cpe:/a:sauerbraten:sauerbraten:2004-05-08 cpe:/a:sauerbraten:sauerbraten:2004-05-23 cpe:/a:sauerbraten:sauerbraten:2004-11-02 cpe:/a:sauerbraten:sauerbraten:2005-05-24 cpe:/a:sauerbraten:sauerbraten:2005-05-29 cpe:/a:sauerbraten:sauerbraten:2005-06-05 cpe:/a:sauerbraten:sauerbraten:2005-06-12 cpe:/a:sauerbraten:sauerbraten:2005-07-04 cpe:/a:sauerbraten:sauerbraten:2005-08-15 cpe:/a:sauerbraten:sauerbraten:2005-11-07 cpe:/a:sauerbraten:sauerbraten:2006-01-31 cpe:/a:sauerbraten:sauerbraten:2006-02-27 cpe:/a:sauerbraten:sauerbraten:2006-02-28 cpe:/a:sauerbraten:sauerbraten:initial_2004-02-27 CVE-2006-1100 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:42.243-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://aluigi.altervista.org/adv/evilcube-adv.txt CONFIRM http://cvs.sourceforge.net/viewcvs.py/sauerbraten/sauerbraten/src/shared/cube.h?r1=1.7&r2=1.8 GENTOO GLSA-200603-10 BUGTRAQ 20060306 Multiple vulnerabilities in Sauerbraten engine 2006_02_28 BUGTRAQ 20060306 Multiple vulnerabilities in Cube engine 2005_08_29 BID 16986 VUPEN ADV-2006-0847 VUPEN ADV-2006-0848 XF sauerbraten-sgetstr-bo(25083) Buffer overflow in the sgetstr function in shared/cube.h in Sauerbraten 2006_02_28 and earlier, as derived from the Cube engine, allows remote attackers to execute arbitrary code via long streams of input data. cpe:/a:sauerbraten:cube:2005-08-09 cpe:/a:sauerbraten:sauerbraten:2006-02-28 CVE-2006-1101 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:43.230-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://aluigi.altervista.org/adv/evilcube-adv.txt GENTOO GLSA-200603-10 BUGTRAQ 20060306 Multiple vulnerabilities in Sauerbraten engine 2006_02_28 BUGTRAQ 20060306 Multiple vulnerabilities in Cube engine 2005_08_29 BID 16986 VUPEN ADV-2006-0847 VUPEN ADV-2006-0848 XF sauerbraten-multiple-dos(25085) The (1) sgetstr and (2) getint functions in Sauerbraten 2006_02_28, as derived from the Cube engine, allow remote attackers to cause a denial of service (segmentation fault) via long streams of input data that trigger an out-of-bounds read, as demonstrated using SV_EXT tag data in the Cube engine, which is not properly handled by getint. cpe:/a:sauerbraten:cube:2005-08-09 cpe:/a:sauerbraten:sauerbraten:2006-02-28 CVE-2006-1102 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:44.010-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://aluigi.altervista.org/adv/evilcube-adv.txt SREASON 548 GENTOO GLSA-200603-10 BUGTRAQ 20060306 Multiple vulnerabilities in Sauerbraten engine 2006_02_28 BUGTRAQ 20060306 Multiple vulnerabilities in Cube engine 2005_08_29 BID 16986 VUPEN ADV-2006-0847 VUPEN ADV-2006-0848 XF sauerbraten-sprintf-dos(25086) Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (client exit) by forcing the server to change to a map (ogz) file whose name contains ".." sequences and has a certain length that prevents the addition of the ".ogz" extension. cpe:/a:sauerbraten:cube:2005-08-09 cpe:/a:sauerbraten:sauerbraten:2006-02-28 CVE-2006-1103 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:44.853-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SREASON 550 BUGTRAQ 20060306 Multiple vulnerabilities in Sauerbraten engine 2006_02_28 BID 16986 VUPEN ADV-2006-0848 XF sauerbraten-engineserver-dos(25087) engine/server.cpp in Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (segmentation fault) via a client that does not completely join the game and times out, which results in a null pointer dereference. cpe:/a:pixelpost:pixelpost:1.4.3 cpe:/a:pixelpost:pixelpost:1.5_beta1 CVE-2006-1104 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:45.243-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://forum.pixelpost.org/showthread.php?t=3535 MISC http://www.neosecurityteam.net/index.php?action=advisories&id=19 BUGTRAQ 20060304 Pixel Post Multiple Vulnerabilities BID 16964 VUPEN ADV-2006-0823 XF pixelpost-index-sql-injection(25044) XF pixelpost-functions-sql-injection(25046) Multiple SQL injection vulnerabilities in Pixelpost 1.5 beta 1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the showimage parameter in index.php; and the (2) USER_AGENT, (3) HTTP_REFERER, and (4) HTTP_HOST HTTP header fields as used in the book_vistor function in includes/functions.php. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue. cpe:/a:pixelpost:pixelpost:1.4.3 cpe:/a:pixelpost:pixelpost:1.5_beta1 CVE-2006-1105 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:45.790-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://forum.pixelpost.org/showthread.php?t=3535 MISC http://www.neosecurityteam.net/index.php?action=advisories&id=19 BUGTRAQ 20060304 Pixel Post Multiple Vulnerabilities BID 16964 VUPEN ADV-2006-0823 XF pixelpost-phpinfo-obtain-information(25048) Pixelpost 1.5 beta 1 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue. cpe:/a:pixelpost:pixelpost:1.4.3 cpe:/a:pixelpost:pixelpost:1.5_beta1 CVE-2006-1106 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:46.183-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://forum.pixelpost.org/showthread.php?t=3535 MISC http://www.neosecurityteam.net/index.php?action=advisories&id=19 BUGTRAQ 20060304 Pixel Post Multiple Vulnerabilities BID 16964 VUPEN ADV-2006-0823 XF pixelpost-functions-xss(25047) Cross-site scripting (XSS) vulnerability in Pixelpost 1.5 beta 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) message, (2) name, (3) url, and (4) email parameters when commenting on a post. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue. cpe:/a:nmdeluxe:nmdeluxe:1.0 CVE-2006-1107 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:46.603-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/93/summary.html CONFIRM http://nmdeluxe.com/index.php SREASON 595 BUGTRAQ 20060317 [eVuln] NMDeluxe XSS & SQL Injection Vulnerabilities BID 17017 VUPEN ADV-2006-0860 XF nmdeluxe-news-xss(25069) Cross-site scripting (XSS) vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the nick parameter. cpe:/a:nmdeluxe:nmdeluxe:1.0 CVE-2006-1108 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:47.137-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/93/summary.html CONFIRM http://nmdeluxe.com/index.php SREASON 595 BUGTRAQ 20060317 [eVuln] NMDeluxe XSS & SQL Injection Vulnerabilities BID 17017 VUPEN ADV-2006-0860 XF nmdeluxe-news-sql-injection(25070) SQL injection vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. cpe:/a:totalecommerce:totalecommerce:1.0 CVE-2006-1109 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:47.667-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 530 MISC http://www.nukedx.com/?viewdoc=18 BUGTRAQ 20060304 Advisory: TotalECommerce (index.asp id) Remote SQL InjectionVulnerability. BID 16960 VUPEN ADV-2006-0840 XF totalecommerce-index-sql-injection(25045) SQL injection vulnerability in index.asp in Total Ecommerce 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: it is not clear whether this report is associated with a specific product. If not, then it should not be included in CVE. cpe:/a:aztek_forum:aztek_forum:4.0 CVE-2006-1110 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:48.183-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060302 AZTEK forums 4.0 multiple vulnerabilities (PoC) BID 16938 XF aztekforum-multiple-xss(25035) EXPLOIT-DB 1547 Cross-site scripting (XSS) vulnerability in Aztek Forum 4.0 allows remote attackers to inject arbitrary web script or HTML via the message body in a new message. cpe:/a:aztek_forum:aztek_forum:4.0 CVE-2006-1111 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:48.637-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060302 AZTEK forums 4.0 multiple vulnerabilities (PoC) BID 16938 XF aztekforum-info-disclosure(25036) EXPLOIT-DB 1547 Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a "*/*" in the msg parameter to index.php, which reveals usernames and passwords in a MySQL error message, possibly due to a forced SQL error or SQL injection. cpe:/a:aztek_forum:aztek_forum:4.0 CVE-2006-1112 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:49.027-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SREASON 539 BUGTRAQ 20060302 AZTEK forums 4.0 multiple vulnerabilities (PoC) BID 16938 EXPLOIT-DB 1547 Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a long login value in a register form, which displays the installation path in a MySQL error message. cpe:/a:gerrit_van_aaken:loudblog:0.41 CVE-2006-1113 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:49.370-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://loudblog.de/forum/viewtopic.php?id=590 BUGTRAQ 20060307 Loudblog 0.41 SQL Injection, Local file read/include BID 17023 VUPEN ADV-2006-0878 XF loudblog-podcast-sql-injection(25101) SQL injection vulnerability in podcast.php in Loudblog before 0.42 allows remote attackers to execute arbitrary SQL commands via the id parameter. cpe:/a:gerrit_van_aaken:loudblog:0.41 CVE-2006-1114 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:49.777-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov CONFIRM http://loudblog.de/forum/viewtopic.php?id=590 BUGTRAQ 20060307 Loudblog 0.41 SQL Injection, Local file read/include BID 17023 VUPEN ADV-2006-0878 XF loudblog-index-directory-traversal(25103) Multiple directory traversal vulnerabilities in Loudblog before 0.42 allow remote attackers to read or include arbitrary files via a .. (dot dot) and trailing %00 (NULL) byte in the (1) template and (2) page parameters in (a) index.php, and the (3) language parameter in (b) inc/backend_settings.php. cpe:/a:ncipher:chil cpe:/a:ncipher:mscapi_csp:5.50 cpe:/a:ncipher:mscapi_csp:5.54 cpe:/a:ncipher:ncipher_software_cd CVE-2006-1115 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:50.167-04:00 2.6 NETWORK HIGH NONE PARTIAL NONE NONE http://nvd.nist.gov SECTRACK 1015719 CONFIRM http://www.ncipher.com/resources/95/sa12_insecure_generation_of_diffiehellman_keys BUGTRAQ 20060308 nCipher Advisory #12: Insecure Generation of Diffie-Hellman keys BID 17006 VUPEN ADV-2006-0862 XF ncipher-hsm-weak-key(25060) nCipher HSM before 2.22.6, when generating a Diffie-Hellman public/private key pair without any specified DiscreteLogGroup parameters, chooses random parameters that could allow an attacker to crack the private key in significantly less time than a brute force attack. cpe:/a:ncipher:ncore:2.17 CVE-2006-1116 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:50.650-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015718 CONFIRM http://www.ncipher.com/resources/96/sa13_cbcmac_iv_misleading_programming_interface BUGTRAQ 20060308 nCipher Advisory #13: CBC-MAC IV misleading programming interface BID 17011 VUPEN ADV-2006-0862 XF ncipher-ncore-bypass-security(25062) The CBC-MAC integrity functions in the nCipher nCore API before 2.18 transmit the initialization vector IV as part of a message when the implementation uses a non-zero IV, which allows remote attackers to bypass integrity checks and modify messages without being detected. cpe:/a:ncipher:dse200_document_sealing_engine cpe:/a:ncipher:ncore cpe:/a:ncipher:nforce cpe:/a:ncipher:securedb cpe:/a:ncipher:time_source_master_clock cpe:/h:ncipher:nethsm:2.0 cpe:/h:ncipher:nethsm:2.1 cpe:/h:ncipher:nethsm:2.1.12_cam5 cpe:/h:ncipher:nshield cpe:/h:ncipher:payshield CVE-2006-1117 2006-03-09T08:06:00.000-05:00 2018-10-18T12:30:51.120-04:00 2.6 NETWORK HIGH NONE PARTIAL NONE NONE http://nvd.nist.gov SECTRACK 1015718 CONFIRM http://www.ncipher.com/resources/97/sa14_presence_of_flaws_in_firmware_security BUGTRAQ 20060309 nCipher Advisory #14: Presence of flaws in firmware security BID 17012 VUPEN ADV-2006-0862 XF ncipher-firmware-weak-security(25063) nCipher firmware before V10, as used by (1) nShield, (2) nForce, (3) netHSM, (4) payShield, (5) SecureDB, (6) DSE200 Document Sealing Engine, (7) Time Source Master Clock (TSMC), and possibly other products, contains certain options that were only intended for testing and not production, which might allow remote attackers to obtain information about encryption keys and crack those keys with less effort than brute force. cpe:/a:bmail:bmail:pr9.0 CVE-2006-1118 2006-03-09T08:06:00.000-05:00 2017-07-19T21:30:19.427-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://sourceforge.net/project/shownotes.php?group_id=144412&release_id=399256 VUPEN ADV-2006-0863 XF bmail-gbkcharacterset-sql-injection(25073) SQL injection vulnerability in bmail before Aardvark PR9.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving GBK character sets. cpe:/a:netenberg:fantastico_de_luxe CVE-2006-1119 2006-03-09T15:02:00.000-05:00 2018-10-18T12:30:51.620-04:00 4.0 NETWORK LOW SINGLE_INSTANCE PARTIAL NONE NONE http://nvd.nist.gov BUGTRAQ 20060307 Cpanel Path Disclosure Vulnerability XF cpanel-fantastico-path-disclosure(25277) fantastico in Cpanel does not properly handle when it has insufficient permissions to perform certain file operations, which allows remote authenticated users to obtain the full pathname, which is leaked in a PHP error message. cpe:/a:codeworx_technologies:dcp-portal:3.7 cpe:/a:codeworx_technologies:dcp-portal:4.0 cpe:/a:codeworx_technologies:dcp-portal:4.1 cpe:/a:codeworx_technologies:dcp-portal:4.2 cpe:/a:codeworx_technologies:dcp-portal:4.5.1 cpe:/a:codeworx_technologies:dcp-portal:5.0.1 cpe:/a:codeworx_technologies:dcp-portal:5.0.2 cpe:/a:codeworx_technologies:dcp-portal:5.1 cpe:/a:codeworx_technologies:dcp-portal:5.2 cpe:/a:codeworx_technologies:dcp-portal:5.3 cpe:/a:codeworx_technologies:dcp-portal:5.3.1 cpe:/a:codeworx_technologies:dcp-portal:5.3.2 cpe:/a:codeworx_technologies:dcp-portal:6.1.1 CVE-2006-1120 2006-03-09T16:02:00.000-05:00 2018-10-18T12:30:51.823-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 392 MISC http://www.seclab.tuwien.ac.at/advisories/TUVSA-0603-001.txt BUGTRAQ 20060309 DCP Portal: Multiple XSS Vulnerabilities BID 17050 XF dcpportal-multiple-scripts-xss(25279) Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 6.1.1 and earlier, with register_globals enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) its_url parameter in the documents page and (2) url parameter in the send_write page of (a) index.php; (3) subject, and (4) images parameters to (b) calendar.php; (5) bid, (6) replying_msg, (7) subject, (8) body, and (9) mid parameters to (c) forums.php; (10) subject and (11) message parameters to (d) inbox.php; (12) subject_color and (13) email parameters to (e) lostpassword.php; and the (14) c_name, (15) content_inicial, and (16) cid parameters to (f) mycontents.php. NOTE: the calendar.php/day vector is already subsumed by CVE-2006-0220, and the calendar.php/month, calendar.php/year, and search.php/q parameters for calendar.php are already subsumed by CVE-2004-2511. cpe:/a:cutephp:cutenews:1.4.1 CVE-2006-1121 2006-03-09T16:02:00.000-05:00 2018-10-18T12:30:52.637-04:00 6.8 NETWORK MEDIUM NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://kapda.ir/advisory-277.html SREASON 531 SECTRACK 1015726 BUGTRAQ 20060304 [KAPDA::#30] - CuteNews1.4.1 Cross_Site_Scripting Vulnerability BID 16961 XF cutenews-index-script-xss(25052) Cross-site scripting (XSS) vulnerability in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the query string to index.php. cpe:/a:d2ksoft:d2kblog:1.0 cpe:/a:d2ksoft:d2kblog:1.0.1 cpe:/a:d2ksoft:d2kblog:1.0.2 cpe:/a:d2ksoft:d2kblog:1.0.3 CVE-2006-1122 2006-03-09T16:02:00.000-05:00 2018-10-18T12:30:53.087-04:00 6.8 NETWORK MEDIUM NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 559 BUGTRAQ 20060308 [KAPDA::#32] - d2kBlog 1.0.3 Multiple Vulnerabilities BID 17035 VUPEN ADV-2006-0896 XF d2kblog-default-msg-xss(25214) Cross-site scripting (XSS) vulnerability in Default.asp in D2KBlog 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter. cpe:/a:d2ksoft:d2kblog:1.0 cpe:/a:d2ksoft:d2kblog:1.0.1 cpe:/a:d2ksoft:d2kblog:1.0.2 cpe:/a:d2ksoft:d2kblog:1.0.3 CVE-2006-1123 2006-03-09T16:02:00.000-05:00 2018-10-18T12:30:53.603-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SREASON 559 BUGTRAQ 20060308 [KAPDA::#32] - d2kBlog 1.0.3 Multiple Vulnerabilities BID 17035 VUPEN ADV-2006-0896 XF d2kblog-memname-sql-injection(25215) SQL injection vulnerability in D2KBlog 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the memName parameter in a cookie. cpe:/a:revilloc_solutions:revilloc_mailserver:1.21 cpe:/a:revilloc_solutions:revilloc_mailserver:proxy_1.21 CVE-2006-1124 2006-03-09T16:02:00.000-05:00 2018-10-18T12:30:54.137-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060307 RevilloC mail server USER command heap overflow SECTRACK 1015739 MISC http://www.morx.org/rev.txt BUGTRAQ 20060309 RevilloC MailServer 1.x "USER" Command Handling Remote Buffer Overflow Exploit BID 16997 VUPEN ADV-2006-0867 XF revilloc-user-bo(25072) Buffer overflow in RevilloC MailServer and Proxy 1.21 allows remote attackers to execute arbitrary code via a long USER command. cpe:/a:grisoft:avg_antivirus:7.0 cpe:/a:grisoft:avg_antivirus:7.0.251 cpe:/a:grisoft:avg_antivirus:7.0.323 cpe:/a:grisoft:avg_antivirus:7.1.308 CVE-2006-1125 2006-03-09T16:02:00.000-05:00 2017-07-19T21:30:19.833-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BUGTRAQ 20060303 AVG 7 granting Everyone Full Control to updated files... even its drivers SECTRACK 1015728 MISC http://www.dslreports.com/forum/remark,15601404 BID 16952 VUPEN ADV-2006-0845 XF avg-update-gain-privilieges(25139) Grisoft AVG Free 7.1, and other versions including 7.0.308, sets Everyone/Full Control permissions for certain update files including (1) upd_vers.cfg, (2) incavi.avm, and (3) unspecified drivers, which might allow local users to gain privileges. cpe:/a:gallery_project:gallery:2.0.2 CVE-2006-1126 2006-03-09T17:02:00.000-05:00 2017-07-19T21:30:19.910-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060303 Gallery 2 Multiple Vulnerabilities CONFIRM http://gallery.menalto.com/gallery_2.0.3_released SECTRACK 1015717 MISC http://www.gulftech.org/?node=research&article_id=00106-03022006 VUPEN ADV-2006-0813 XF gallery-header-spoofing(25120) Gallery 2 up to 2.0.2 allows remote attackers to spoof their IP address via a modified X-Forwarded-For (X_FORWARDED_FOR) HTTP header, which is checked by Gallery before other more reliable sources of IP address information, such as REMOTE_ADDR. cpe:/a:gallery_project:gallery:2.0 cpe:/a:gallery_project:gallery:2.0.1 cpe:/a:gallery_project:gallery:2.0.2 cpe:/a:gallery_project:gallery:2.0_alpha cpe:/a:gallery_project:gallery:2.0_alpha1 cpe:/a:gallery_project:gallery:2.0_alpha2 cpe:/a:gallery_project:gallery:2.0_alpha3 cpe:/a:gallery_project:gallery:2.0_alpha4 cpe:/a:gallery_project:gallery:2.0_beta1 cpe:/a:gallery_project:gallery:2.0_beta2 cpe:/a:gallery_project:gallery:2.0_beta3 CVE-2006-1127 2006-03-09T17:02:00.000-05:00 2017-07-19T21:30:19.973-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060303 Gallery 2 Multiple Vulnerabilities CONFIRM http://gallery.menalto.com/gallery_2.0.3_released SECTRACK 1015717 MISC http://www.gulftech.org/?node=research&article_id=00106-03022006 BID 16940 VUPEN ADV-2006-0813 XF gallery-getremotehostaddress-xss(25117) Cross-site scripting (XSS) vulnerability in Gallery 2 up to 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For (X_FORWARDED_FOR) HTTP header, which is not properly handled when adding a comment to an album. cpe:/a:gallery_project:gallery:2.0 cpe:/a:gallery_project:gallery:2.0.1 cpe:/a:gallery_project:gallery:2.0.2 cpe:/a:gallery_project:gallery:2.0_alpha cpe:/a:gallery_project:gallery:2.0_alpha1 cpe:/a:gallery_project:gallery:2.0_alpha2 cpe:/a:gallery_project:gallery:2.0_alpha3 cpe:/a:gallery_project:gallery:2.0_alpha4 cpe:/a:gallery_project:gallery:2.0_beta1 cpe:/a:gallery_project:gallery:2.0_beta2 cpe:/a:gallery_project:gallery:2.0_beta3 CVE-2006-1128 2006-03-09T17:02:00.000-05:00 2017-07-19T21:30:20.050-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060303 Gallery 2 Multiple Vulnerabilities CONFIRM http://gallery.menalto.com/gallery_2.0.3_released SECTRACK 1015717 MISC http://www.gulftech.org/?node=research&article_id=00106-03022006 BID 16948 VUPEN ADV-2006-0813 XF gallery-sessionid-bypass-security(25118) Directory traversal vulnerability in the session handling class (GallerySession.class) in Gallery 2 up to 2.0.2 allows remote attackers to access and delete files by specifying the session in a cookie, which is used in constructing file paths before the session value is sanitized. cpe:/a:ekinboard:ekinboard:1.0.3 CVE-2006-1129 2006-03-09T21:02:00.000-05:00 2018-10-18T12:30:54.730-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/88/summary.html CONFIRM http://www.ekinboard.com/forums/v1/viewtopic.php?id=469 MISC http://www.ekinboard.com/patch_for_1.0.3.txt BUGTRAQ 20060308 [eVuln] EKINboard 'img' BBCode XSS & Cookie 'username' SQL Injection Vulnerabilities BID 16861 VUPEN ADV-2006-0758 XF ekinboard-config-sql-injection(24922) SQL injection vulnerability in config.php in EKINboard 1.0.3 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username cookie. cpe:/a:ekinboard:ekinboard:1.0.3 CVE-2006-1130 2006-03-09T21:02:00.000-05:00 2018-10-18T12:30:55.337-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/88/summary.html SREASON 558 CONFIRM http://www.ekinboard.com/forums/v1/viewtopic.php?id=469 MISC http://www.ekinboard.com/patch_for_1.0.3.txt BUGTRAQ 20060308 [eVuln] EKINboard 'img' BBCode XSS & Cookie 'username' SQL Injection Vulnerabilities BID 16861 VUPEN ADV-2006-0758 XF ekinboard-bbcode-xss(24921) Cross-site scripting (XSS) vulnerability in EKINboard 1.0.3 allows remote attackers to inject arbitrary web script or HTML via a Javascript URI in a BBCode img tag. cpe:/a:bitweaver:bitweaver:1.2.1 CVE-2006-1131 2006-03-09T21:02:00.000-05:00 2017-07-19T21:30:20.207-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://kiki91.altervista.org/exploit/bitweaver_1.2.1_XSS.txt BID 16973 VUPEN ADV-2006-0837 XF bitweaver-titlefield-xss(25053) Cross-site scripting (XSS) vulnerability in read.php in bitweaver CMS 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the comment_title parameter. cpe:/a:vbzoom:vbzoom:1.11 CVE-2006-1132 2006-03-09T21:02:00.000-05:00 2018-10-18T12:30:55.980-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 552 BUGTRAQ 20060306 SQL injection & XSS IN vbzoom v1.11 BID 16955 SQL injection vulnerability in show.php in vbzoom 1.11 allow remote attackers to execute arbitrary SQL commands via the MainID parameter. NOTE: the SubjectID vector is already covered by CVE-2005-4729. cpe:/a:vbzoom:vbzoom:1.11 CVE-2006-1133 2006-03-09T21:02:00.000-05:00 2018-10-18T12:30:56.197-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 552 BUGTRAQ 20060306 SQL injection & XSS IN vbzoom v1.11 BID 16956 BID 16969 XF vbzoom-comment-contact-xss(25090) Multiple cross-site scripting (XSS) vulnerabilities in vbzoom 1.11 allow remote attackers to inject arbitrary web script or HTML via the UserID parameter to (1) comment.php or (2) contact.php. NOTE: the profile.php/UserName vector is already covered by CVE-2005-2441. cpe:/a:jason_smith:cyboards_php_lite:1.25 CVE-2006-1134 2006-03-09T21:02:00.000-05:00 2018-10-18T12:30:56.667-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/91/description.html SREASON 582 MISC http://www.gold-sonata.com/forums/read.php?board=1&id=17271 BUGTRAQ 20060314 [eVuln] CyBoards PHP Lite SQL Injection Vulnerability BID 16987 BID 17107 VUPEN ADV-2006-0820 XF cyboards-processpost-sql-injection(25061) SQL injection vulnerability in CyBoards PHP Lite 1.25, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the parent parameter to (1) post.php and possibly (2) process_post.php. cpe:/a:sblog:sblog:0.7.2 CVE-2006-1135 2006-03-09T21:02:00.000-05:00 2017-07-19T21:30:20.363-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://kiki91.altervista.org/exploit/sBlog_0.72_xss.txt BID 17044 VUPEN ADV-2006-0883 XF sblog-username-xss(25111) Multiple cross-site scripting (XSS) vulnerabilities in sBlog 0.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword parameter to search.php or (2) username parameter to comments_do.php. cpe:/h:xerox:copycentre_c65:1.001.02.073 cpe:/h:xerox:copycentre_c75:1.001.02.073 cpe:/h:xerox:copycentre_c90:1.001.02.073 cpe:/h:xerox:workcentre_65:1.001.02.073::pro cpe:/h:xerox:workcentre_75:1.001.02.073::pro cpe:/h:xerox:workcentre_90:1.001.02.073::pro CVE-2006-1136 2006-03-09T21:02:00.000-05:00 2018-09-27T17:33:04.107-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov 2018-09-27T14:07:25.803-04:00 SECTRACK 1015738 BID 17014 VUPEN ADV-2006-0857 CONFIRM http://www.xerox.com/downloads/usa/en/c/cert_XRX06_002.pdf XF xerox-postscript-interpreter-dos(25172) Buffer overflow in the PostScript file interpreter code for Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, allows attackers to cause a denial of service via unknown vectors. cpe:/o:xerox:copycentre_c65_firmware:1.001.02.073 cpe:/o:xerox:copycentre_c75_firmware:1.001.02.073 cpe:/o:xerox:copycentre_c90_firmware:1.001.02.073 cpe:/o:xerox:workcentre_pro_65_firmware:1.001.02.073 cpe:/o:xerox:workcentre_pro_75_firmware:1.001.02.073 cpe:/o:xerox:workcentre_pro_90_firmware:1.001.02.073 CVE-2006-1137 2006-03-09T21:02:00.000-05:00 2018-10-04T18:11:38.393-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov 2018-10-04T10:08:01.890-04:00 SECTRACK 1015738 BID 17014 VUPEN ADV-2006-0857 CONFIRM http://www.xerox.com/downloads/usa/en/c/cert_XRX06_002.pdf XF xerox-postscript-navigate-dos(25173) XF xerox-postscript-tcpip-dos(25174) Multiple unspecified vulnerabilities in Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, allow remote attackers to cause an unspecified denial of service via a crafted PostScript file that will (1) "navigate through the directory" or (2) a "file sent to expose TCP/IP ports". cpe:/o:xerox:copycentre_c65_firmware:1.001.02.073 cpe:/o:xerox:copycentre_c75_firmware:1.001.02.073 cpe:/o:xerox:copycentre_c90_firmware:1.001.02.073 cpe:/o:xerox:workcentre_pro_65_firmware:1.001.02.073 cpe:/o:xerox:workcentre_pro_75_firmware:1.001.02.073 cpe:/o:xerox:workcentre_pro_90_firmware:1.001.02.073 CVE-2006-1138 2006-03-09T21:02:00.000-05:00 2018-10-04T18:11:30.157-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov 2018-10-04T10:28:06.653-04:00 SECTRACK 1015738 BID 17014 VUPEN ADV-2006-0857 CONFIRM http://www.xerox.com/downloads/usa/en/c/cert_XRX06_002.pdf XF xerox-web-corruption-dos(25175) Unspecified vulnerability in the web server code in Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, allows remote attackers to cause a denial of service (memory corruption) via unknown vectors. cpe:/o:xerox:copycentre_c65_firmware:1.001.02.073 cpe:/o:xerox:copycentre_c75_firmware:1.001.02.073 cpe:/o:xerox:copycentre_c90_firmware:1.001.02.073 cpe:/o:xerox:workcentre_pro_65_firmware:1.001.02.073 cpe:/o:xerox:workcentre_pro_75_firmware:1.001.02.073 cpe:/o:xerox:workcentre_pro_90_firmware:1.001.02.073 CVE-2006-1139 2006-03-09T21:02:00.000-05:00 2018-10-04T18:11:20.843-04:00 6.4 NETWORK LOW NONE PARTIAL PARTIAL NONE http://nvd.nist.gov 2018-10-04T10:27:22.783-04:00 SECTRACK 1015738 VUPEN ADV-2006-0857 CONFIRM http://www.xerox.com/downloads/usa/en/c/cert_XRX06_002.pdf XF xerox-image-overwrite-dos(25176) Unspecified vulnerability in the ESS/ Network Controller in Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, causes the Immediate Image Overwrite feature to fail after a power loss, which could leave data exposed to attack. cpe:/a:redblog:redblog:0.5 CVE-2006-1140 2006-03-10T06:02:00.000-05:00 2017-07-19T21:30:20.660-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BID 17041 VUPEN ADV-2006-0894 MISC http://www.x128.net/redblog-05-remote-sql-injection.txt XF redblog-catid-sql-injection(25122) SQL injection vulnerability in rss.php in RedBLoG 0.5 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter. cpe:/a:inter7:qmailadmin:1.0.1 cpe:/a:inter7:qmailadmin:1.0.2 cpe:/a:inter7:qmailadmin:1.0.3 cpe:/a:inter7:qmailadmin:1.0.4 cpe:/a:inter7:qmailadmin:1.0.5 cpe:/a:inter7:qmailadmin:1.0.6 cpe:/a:inter7:qmailadmin:1.2.0 cpe:/a:inter7:qmailadmin:1.2.1 cpe:/a:inter7:qmailadmin:1.2.3 cpe:/a:inter7:qmailadmin:1.2.7 cpe:/a:inter7:qmailadmin:1.2.8 cpe:/a:inter7:qmailadmin:1.2.9 CVE-2006-1141 2006-03-10T06:02:00.000-05:00 2017-07-19T21:30:20.723-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://cvs.sourceforge.net/viewcvs.py/qmailadmin/qmailadmin/qmailadmin.c?r1=1.6.2.10&r2=1.6.2.11 GENTOO GLSA-200611-15 CONFIRM http://sourceforge.net/project/shownotes.php?group_id=6691&release_id=395211 BID 16994 VUPEN ADV-2006-0852 XF qmialadmin-qmailadmin-bo(25065) Buffer overflow in qmailadmin.c in QmailAdmin before 1.2.10 allows remote attackers to execute arbitrary code via a long PATH_INFO environment variable. cpe:/a:solido_systems:ravenous_web_server:0.2.0 cpe:/a:solido_systems:ravenous_web_server:0.4.0 cpe:/a:solido_systems:ravenous_web_server:0.5.0 cpe:/a:solido_systems:ravenous_web_server:0.5.1 cpe:/a:solido_systems:ravenous_web_server:0.5.9 cpe:/a:solido_systems:ravenous_web_server:0.6.0 cpe:/a:solido_systems:ravenous_web_server:0.7.0 CVE-2006-1142 2006-03-10T06:02:00.000-05:00 2017-07-19T21:30:20.770-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://sourceforge.net/project/shownotes.php?group_id=131871&release_id=399092 BID 17013 VUPEN ADV-2006-0859 XF ravenous-rvplg-unauth-access(25191) Unspecified vulnerability in Ravenous Web Server before 0.7.1 allows remote attackers to access arbitrary rvplg files, with unknown impact. cpe:/a:ftpoed:ftpoed_blog_engine:1.1 CVE-2006-1143 2006-03-10T06:02:00.000-05:00 2018-10-18T12:30:57.307-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015725 BUGTRAQ 20060305 FTPoed Blog Engine =>v1.1 HTML Injection Vulnerability XF ftpoed-comment-xss(25138) Cross-site scripting (XSS) vulnerability in FTPoed Blog Engine 1.1 allows remote attackers to inject arbitrary web script or HTML via the comment_body parameter, as used by the comment field, when posting a comment. cpe:/a:david_ravenscroft:hithost:1.0.0 CVE-2006-1144 2006-03-10T06:02:00.000-05:00 2018-10-18T12:30:57.557-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060306 histhost v1.0.0 xss and possible rmdir BID 17025 VUPEN ADV-2006-0886 XF hithost-viewuser-deleteuser-xss(25105) Cross-site scripting (XSS) vulnerability in HitHost 1.0.0 allows remote attackers to inject arbitrary web script or HTML via (1) the user parameter in deleteuser.php and (2) the hits parameter in viewuser.php. cpe:/a:cor_entertainment:alien_arena_2006:gold_5.00 CVE-2006-1145 2006-03-10T06:02:00.000-05:00 2018-10-18T12:30:58.027-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://aluigi.altervista.org/adv/aa2k6x-adv.txt FULLDISC 20060307 Multiple vulnerabilities in Alien Arena 2006 GE 5.00 BUGTRAQ 20060307 Multiple vulnerabilities in Alien Arena 2006 GE 5.00 BID 17028 VUPEN ADV-2006-0882 XF alien-safe-cprintf-format-string(25199) Format string vulnerability in the safe_cprintf function in acebot_cmds.c in Alien Arena 2006 Gold Edition 5.00 allows remote attackers (possibly authenticated) to execute arbitrary code via unspecified vectors when the server sends crafted messages to the clients. cpe:/a:cor_entertainment:alien_arena_2006:gold_5.00 CVE-2006-1146 2006-03-10T06:02:00.000-05:00 2018-10-18T12:30:58.573-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://aluigi.altervista.org/adv/aa2k6x-adv.txt FULLDISC 20060307 Multiple vulnerabilities in Alien Arena 2006 GE 5.00 BUGTRAQ 20060307 Multiple vulnerabilities in Alien Arena 2006 GE 5.00 BID 17028 VUPEN ADV-2006-0882 XF alien-cmd-sa-f-bo(25200) Stack-based buffer overflow in the Cmd_Say_f function in g_cmds.c in Alien Arena 2006 Gold Edition 5.00 allows remote attackers (possibly authenticated) to execute arbitrary code by sending a long message to the server. cpe:/a:cor_entertainment:alien_arena_2006:gold_5.00 CVE-2006-1147 2006-03-10T06:02:00.000-05:00 2018-10-18T12:30:59.087-04:00 4.0 NETWORK LOW SINGLE_INSTANCE NONE NONE PARTIAL http://nvd.nist.gov MISC http://aluigi.altervista.org/adv/aa2k6x-adv.txt FULLDISC 20060307 Multiple vulnerabilities in Alien Arena 2006 GE 5.00 BUGTRAQ 20060307 Multiple vulnerabilities in Alien Arena 2006 GE 5.00 BID 17028 VUPEN ADV-2006-0882 XF alien-com-sprintf-dos(25201) The Com_sprintf function in q_shared.c in Alien Arena 2006 Gold Edition 5.00 does not properly NULL terminate certain long strings, which allows remote attackers (possibly authenticated) to cause a denial of service (application crash) via a long skin, weapon, or model name. cpe:/a:peercast:peercast:0.1211 cpe:/a:peercast:peercast:0.1212 cpe:/a:peercast:peercast:0.1215 CVE-2006-1148 2006-03-10T06:02:00.000-05:00 2018-10-18T12:30:59.637-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS GENTOO GLSA-200603-17 MISC http://www.infigo.hr/in_focus/INFIGO-2006-03-01 CONFIRM http://www.peercast.org/forum/viewtopic.php?t=3346 BUGTRAQ 20060309 INFIGO-2006-03-01: PeerCast streaming server remote buffer overflow BID 17040 VUPEN ADV-2006-0900 XF peercast-url-bo(25113) Multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp in PeerCast before 0.1217 allow remote attackers to execute arbitrary code via an HTTP GET request with a long (1) parameter name or (2) value in a URL, which triggers the overflow in the nextCGIarg function in servhs.cpp. cpe:/a:owl:owl_intranet_engine:0.6 cpe:/a:owl:owl_intranet_engine:0.8 cpe:/a:owl:owl_intranet_engine:0.72 cpe:/a:owl:owl_intranet_engine:0.73 cpe:/a:owl:owl_intranet_engine:0.82 CVE-2006-1149 2006-03-10T06:02:00.000-05:00 2017-10-18T21:29:04.050-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BID 17021 VUPEN ADV-2006-0868 XF owl-intranet-owlapi-file-include(25082) EXPLOIT-DB 1561 PHP remote file inclusion vulnerability in lib/OWL_API.php in OWL Intranet Engine 0.82, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the xrms_file_root parameter, which is not initialized before use. cpe:/a:teg:tenes_empanadas_graciela:0.11.1 CVE-2006-1150 2006-03-10T06:02:00.000-05:00 2017-07-19T21:30:21.207-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov MISC http://aluigi.altervista.org/adv/tegob1-adv.txt BID 16982 VUPEN ADV-2006-0846 XF teg-nickname-offbyone-dos(25165) Buffer overflow in Tenes Empanadas Graciela (TEG) 0.11.1, automatically appends an _ (underscore) to the end of duplicate nicknames, which allows remote attackers to cause a denial of service (application crash) by creating multiple users with long, identical nicknames, which triggers an off-by-one error. cpe:/a:m_phorum:m_phorum:0.2 CVE-2006-1151 2006-03-10T06:02:00.000-05:00 2018-10-18T12:31:00.370-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://biyosecurity.be/bugs/mphorum.txt MISC http://securityvulns.com/Ldocument750.html MISC http://securityvulns.com/source13951.html BUGTRAQ 20060309 M-Phorum Cross Site Scripting BUGTRAQ 20070821 Vulnerabilities digest BID 25394 XF mphorum-index-xss(25312) Cross-site scripting vulnerability in index.php in M-Phorum 0.2 allows remote attackers to inject arbitrary web script or HTML via the go parameter. cpe:/a:m_phorum:m_phorum:0.2 CVE-2006-1152 2006-03-10T06:02:00.000-05:00 2017-07-19T21:30:21.367-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16977 VUPEN ADV-2006-0827 XF mphorum-index-file-include(25102) PHP remote file inclusion vulnerability in index.php in M-Phorum 0.2 allows remote attackers to include arbitrary files via the go parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:d2-shoutbox:d2-shoutbox:4.2 CVE-2006-1153 2006-03-10T06:02:00.000-05:00 2017-10-18T21:29:04.110-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BID 16984 VUPEN ADV-2006-0865 XF d2shoutbox-index-sql-injection(25074) EXPLOIT-DB 1556 SQL injection vulnerability in D2-Shoutbox 4.2 allows remote attackers to execute arbitrary SQL commands via the load parameter, when performing a Shoutbox action through Invision Power Board (IPB). cpe:/a:fscripts:fantastic_news:2.1.1 cpe:/a:fscripts:fantastic_news:2.1.2 cpe:/a:fscripts:fantastic_news:2.1.4 CVE-2006-1154 2006-03-10T06:02:00.000-05:00 2017-10-10T21:30:41.000-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://sx02.coresec.de/advisories/152.txt BID 16985 BID 21796 VUPEN ADV-2006-0826 VUPEN ADV-2006-3513 XF fantasticnews-archive-file-include(25064) XF fantasticnews-configscriptpath-file-include(31121) EXPLOIT-DB 3027 PHP remote file inclusion vulnerability in archive.php in Fantastic News 2.1.2 allows remote attackers to include arbitrary files via the CONFIG[script_path] variable. NOTE: 2.1.4 was also reported to be vulnerable. cpe:/a:manas_tungare:site_membership_script CVE-2006-1155 2006-03-12T15:02:00.000-05:00 2017-07-19T21:30:21.520-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://www.manastungare.com/projects/site-membership/ BID 17045 VUPEN ADV-2006-0884 XF manas-tungare-login-default-xss(25109) Cross-site scripting (XSS) vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to inject arbitrary web script or HTML via the Error parameter in (1) login.asp and (2) default.asp. cpe:/a:manas_tungare:site_membership_script CVE-2006-1156 2006-03-12T15:02:00.000-05:00 2017-07-19T21:30:21.583-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://www.manastungare.com/projects/site-membership/ BID 17045 VUPEN ADV-2006-0884 XF manas-tungare-login-sql-injection(25110) SQL injection vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to execute arbitrary SQL commands via the Username parameter in login.asp. cpe:/a:adp:adp_forum CVE-2006-1157 2006-03-12T15:02:00.000-05:00 2018-10-18T12:31:01.073-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://biyosecurity.be/bugs/adpforum2.txt BUGTRAQ 20060309 ADP Forum 2.0,* script &#304;njection BID 17047 VUPEN ADV-2006-0901 XF adp-forum-subject-xss(25189) Cross-site scripting (XSS) vulnerability in Vz Scripts ADP Forum 2.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the Subject field (possibly messaggio parameter) when posting a new message in post.php. cpe:/a:kerio:kerio_mailserver:5.6.4 cpe:/a:kerio:kerio_mailserver:5.6.5 cpe:/a:kerio:kerio_mailserver:5.7.0 cpe:/a:kerio:kerio_mailserver:5.7.1 cpe:/a:kerio:kerio_mailserver:5.7.2 cpe:/a:kerio:kerio_mailserver:5.7.3 cpe:/a:kerio:kerio_mailserver:5.7.4 cpe:/a:kerio:kerio_mailserver:5.7.5 cpe:/a:kerio:kerio_mailserver:5.7.6 cpe:/a:kerio:kerio_mailserver:5.7.7 cpe:/a:kerio:kerio_mailserver:5.7.8 cpe:/a:kerio:kerio_mailserver:5.7.9 cpe:/a:kerio:kerio_mailserver:5.7.10 cpe:/a:kerio:kerio_mailserver:6.0 cpe:/a:kerio:kerio_mailserver:6.0.0 cpe:/a:kerio:kerio_mailserver:6.0.1 cpe:/a:kerio:kerio_mailserver:6.0.2 cpe:/a:kerio:kerio_mailserver:6.0.3 cpe:/a:kerio:kerio_mailserver:6.0.4 cpe:/a:kerio:kerio_mailserver:6.0.5 cpe:/a:kerio:kerio_mailserver:6.0.6 cpe:/a:kerio:kerio_mailserver:6.0.7 cpe:/a:kerio:kerio_mailserver:6.0.8 cpe:/a:kerio:kerio_mailserver:6.1.3_patch_1 CVE-2006-1158 2006-03-12T15:02:00.000-05:00 2018-10-18T12:31:01.480-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov SECTRACK 1015748 CONFIRM http://www.kerio.com/kms_history.html BUGTRAQ 20060313 Kerio MailServer bugfun BID 17043 VUPEN ADV-2006-0898 XF kerio-mailserver-imap-dos(25150) Kerio MailServer before 6.1.3 Patch 1 allows remote attackers to cause a denial of service (application crash) via a crafted IMAP LOGIN command. cpe:/a:efs_software:efs_web_server:3.2 CVE-2006-1159 2006-03-12T16:02:00.000-05:00 2018-10-18T12:31:02.090-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov BUGTRAQ 20060309 Easy File Sharing Web Server Multiple Vulnerablilities BID 17046 VUPEN ADV-2006-0912 XF easyfilesharing-logging-dos(25135) Format string vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in the query string argument in an HTTP GET request. cpe:/a:efs_software:efs_web_server:3.2 CVE-2006-1160 2006-03-12T16:02:00.000-05:00 2018-10-18T12:31:02.543-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060309 Easy File Sharing Web Server Multiple Vulnerablilities BID 17046 VUPEN ADV-2006-0912 XF easyfilesharing-description-xss(25136) Cross-site scripting (XSS) vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote attackers to inject arbitrary web script or HTML via the Description field in creating a folder or uploading a file. cpe:/a:efs_software:efs_web_server:3.2 CVE-2006-1161 2006-03-12T16:02:00.000-05:00 2018-10-18T12:31:02.997-04:00 6.5 NETWORK LOW SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060309 Easy File Sharing Web Server Multiple Vulnerablilities BID 17046 XF easyfilesharing-startup-file-upload(39994) Absolute path traversal vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote registered users to execute arbitrary code by uploading a malicious file to the Windows startup folder. cpe:/a:nodez:nodez:4.6.1.1 CVE-2006-1162 2006-03-12T16:02:00.000-05:00 2017-07-19T21:30:21.897-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://hamid.ir/security/nodez.txt SECTRACK 1015747 BID 17066 VUPEN ADV-2006-0899 XF nodez-op-file-include(25119) Directory traversal vulnerability in Nodez 4.6.1.1 and earlier allows remote attackers to read or include arbitrary PHP files via a .. (dot dot) in the op parameter, as demonstrated by inserting malicious Email parameters into list.gtdat, then accessing list.gtdat using the op parameter. cpe:/a:nodez:nodez:4.6.1.1 CVE-2006-1163 2006-03-12T16:02:00.000-05:00 2017-07-19T21:30:21.943-04:00 6.8 NETWORK MEDIUM NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://hamid.ir/security/nodez.txt SECTRACK 1015747 BID 17066 VUPEN ADV-2006-0899 XF nodez-op-xss(25121) Cross-site scripting (XSS) vulnerability in Nodez 4.6.1.1 allows remote attackers to inject arbitrary web script or HTML via the op parameter. NOTE: it is possible that this issue is resultant from the directory traversal vulnerability. cpe:/a:nodez:nodez:4.6.1.1 CVE-2006-1164 2006-03-12T16:02:00.000-05:00 2008-09-05T17:01:12.143-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-03-13T14:26:00.000-05:00 ALLOWS_OTHER_ACCESS MISC http://hamid.ir/security/nodez.txt BID 17066 Nodez 4.6.1.1 and earlier stores sensitive data in the list.gtdat file under the web document root with insufficient access control, which allows remote attackers to obtain usernames and password hashes by directly accessing list.gtdat. cpe:/a:andreas_gohr:dokuwiki:release_2004-07-04 cpe:/a:andreas_gohr:dokuwiki:release_2004-07-07 cpe:/a:andreas_gohr:dokuwiki:release_2004-07-12 cpe:/a:andreas_gohr:dokuwiki:release_2004-07-21 cpe:/a:andreas_gohr:dokuwiki:release_2004-07-25 cpe:/a:andreas_gohr:dokuwiki:release_2004-08-08 cpe:/a:andreas_gohr:dokuwiki:release_2004-08-15a cpe:/a:andreas_gohr:dokuwiki:release_2004-08-22 cpe:/a:andreas_gohr:dokuwiki:release_2004-09-12 cpe:/a:andreas_gohr:dokuwiki:release_2004-09-25 cpe:/a:andreas_gohr:dokuwiki:release_2004-09-30 cpe:/a:andreas_gohr:dokuwiki:release_2004-10-19 cpe:/a:andreas_gohr:dokuwiki:release_2004-11-01 cpe:/a:andreas_gohr:dokuwiki:release_2004-11-02 cpe:/a:andreas_gohr:dokuwiki:release_2004-11-10 cpe:/a:andreas_gohr:dokuwiki:release_2005-01-14 cpe:/a:andreas_gohr:dokuwiki:release_2005-01-15 cpe:/a:andreas_gohr:dokuwiki:release_2005-01-16a cpe:/a:andreas_gohr:dokuwiki:release_2005-02-06 cpe:/a:andreas_gohr:dokuwiki:release_2005-02-18 cpe:/a:andreas_gohr:dokuwiki:release_2005-05-07 cpe:/a:andreas_gohr:dokuwiki:release_2005-07-01 cpe:/a:andreas_gohr:dokuwiki:release_2005-07-13 cpe:/a:andreas_gohr:dokuwiki:release_2005-09-19 cpe:/a:andreas_gohr:dokuwiki:release_2005-09-22 cpe:/a:andreas_gohr:dokuwiki:release_2006-03-05 CVE-2006-1165 2006-03-12T16:02:00.000-05:00 2017-07-19T21:30:22.003-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://wiki.splitbrain.org/wiki%3Achanges BID 17065 VUPEN ADV-2006-0909 XF dokuwiki-mediamanger-xss(25137) Cross-site scripting (XSS) vulnerability in the mediamanager module in DokuWiki before 2006-03-05 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors relating to "handling EXIF data." cpe:/a:monotone:monotone:0.25 CVE-2006-1166 2006-03-12T16:02:00.000-05:00 2017-07-19T21:30:22.067-04:00 3.7 LOCAL HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MLIST [Monotone-devel] 20060308 [ANNOUNCE] Monotone 0.25.2 -- security fix release BID 17139 VUPEN ADV-2006-0990 XF monotone-mt-lua-code-execution(25294) Monotone 0.25 and earlier, when a user creates a file in a directory called "mt", and when checking out that file on a case-insensitive file system such as Windows or Mac OS X, places the file into the "MT" bookkeeping directory, which could allow context-dependent attackers to execute arbitrary Lua programs as the user running monotone. cpe:/a:sgi:propack:3:sp6 CVE-2006-1167 2007-02-06T17:28:00.000-05:00 2008-09-05T17:01:12.627-04:00 1.2 LOCAL HIGH NONE PARTIAL NONE NONE http://nvd.nist.gov 2007-02-06T17:54:00.000-05:00 SGI 20060402-01-U SGI ProPack 3 SP6 kernel displays the frame buffer contents of the last session after a reboot, which might allow local users to obtain sensitive information. cpe:/a:ncompress:ncompress:4.2.4 CVE-2006-1168 2006-08-14T16:04:00.000-04:00 2017-10-10T21:30:41.077-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SGI 20060901-01-P MISC http://bugs.gentoo.org/show_bug.cgi?id=141728 CONFIRM http://downloads.avaya.com/css/P8/documents/100158840 REDHAT RHSA-2012:0810 GENTOO GLSA-200610-03 SECTRACK 1016836 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-226.htm DEBIAN DSA-1149 MANDRIVA MDKSA-2006:140 MANDRIVA MDVSA-2012:129 SUSE SUSE-SR:2006:020 REDHAT RHSA-2006:0663 BID 19455 VUPEN ADV-2006-3234 MISC https://bugzilla.redhat.com/show_bug.cgi?id=728536 XF ncompress-decompress-underflow(28315) The decompress function in compress42.c in (1) ncompress 4.2.4 and (2) liblzw allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code, via crafted data that leads to a buffer underflow. CVE-2006-1169 2017-05-11T10:29:03.587-04:00 2017-05-11T10:29:03.587-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2006. Notes: none. CVE-2006-1170 2017-05-11T10:29:03.603-04:00 2017-05-11T10:29:03.603-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2006. Notes: none. CVE-2006-1171 2017-05-11T10:29:03.637-04:00 2017-05-11T10:29:03.637-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2006. Notes: none. cpe:/a:tdc:cryptomathic_cenroll_activex_control:1.1.0.0 CVE-2006-1172 2006-05-09T06:02:00.000-04:00 2018-10-18T12:31:03.340-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://cirt.dk/advisories/cirt-43-advisory.pdf SECTRACK 1016034 BUGTRAQ 20060505 Cryptomathic ActiveX Buffer Overflow (TDC Digital signature) BID 17852 VUPEN ADV-2006-1675 XF cryptomathic-primeink-createpkcs10-bo(26255) Stack-based buffer overflow in the createPKCS10 function in Cryptomathic Cenroll ActiveX Control 1.1.0.0 allows remote attackers to execute arbitrary code via vectors related to the TDC Digital signature. cpe:/a:sendmail:sendmail:8.8.8 cpe:/a:sendmail:sendmail:8.9.0 cpe:/a:sendmail:sendmail:8.9.1 cpe:/a:sendmail:sendmail:8.9.2 cpe:/a:sendmail:sendmail:8.9.3 cpe:/a:sendmail:sendmail:8.10 cpe:/a:sendmail:sendmail:8.10.1 cpe:/a:sendmail:sendmail:8.10.2 cpe:/a:sendmail:sendmail:8.11.0 cpe:/a:sendmail:sendmail:8.11.1 cpe:/a:sendmail:sendmail:8.11.2 cpe:/a:sendmail:sendmail:8.11.3 cpe:/a:sendmail:sendmail:8.11.4 cpe:/a:sendmail:sendmail:8.11.5 cpe:/a:sendmail:sendmail:8.11.6 cpe:/a:sendmail:sendmail:8.11.7 cpe:/a:sendmail:sendmail:8.12:beta10 cpe:/a:sendmail:sendmail:8.12:beta12 cpe:/a:sendmail:sendmail:8.12:beta16 cpe:/a:sendmail:sendmail:8.12:beta5 cpe:/a:sendmail:sendmail:8.12:beta7 cpe:/a:sendmail:sendmail:8.12.0 cpe:/a:sendmail:sendmail:8.12.1 cpe:/a:sendmail:sendmail:8.12.2 cpe:/a:sendmail:sendmail:8.12.3 cpe:/a:sendmail:sendmail:8.12.4 cpe:/a:sendmail:sendmail:8.12.5 cpe:/a:sendmail:sendmail:8.12.6 cpe:/a:sendmail:sendmail:8.12.7 cpe:/a:sendmail:sendmail:8.12.8 cpe:/a:sendmail:sendmail:8.12.9 cpe:/a:sendmail:sendmail:8.12.10 cpe:/a:sendmail:sendmail:8.12.11 cpe:/a:sendmail:sendmail:8.13.0 cpe:/a:sendmail:sendmail:8.13.1 cpe:/a:sendmail:sendmail:8.13.1.2 cpe:/a:sendmail:sendmail:8.13.2 cpe:/a:sendmail:sendmail:8.13.3 cpe:/a:sendmail:sendmail:8.13.4 cpe:/a:sendmail:sendmail:8.13.5 cpe:/a:sendmail:sendmail:8.13.6 CVE-2006-1173 2006-06-07T19:06:00.000-04:00 2018-10-18T12:31:04.043-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov FREEBSD FreeBSD-SA-06:17.sendmail SGI 20060601-01-P SGI 20060602-01-U HP HPSBTU02116 SUSE SUSE-SA:2006:032 SECTRACK 1016295 SLACKWARE SSA:2006-166-01 SUNALERT 102460 CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-148.htm DEBIAN DSA-1155 CONFIRM http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-18.html CONFIRM http://www.f-secure.com/security/fsc-2006-5.shtml GENTOO GLSA-200606-19 CERT-VN VU#146718 MANDRIVA MDKSA-2006:104 OPENBSD [3.8] 008: SECURITY FIX: June 15, 2006 REDHAT RHSA-2006:0515 BUGTRAQ 20060620 Sendmail MIME DoS vulnerability BUGTRAQ 20060621 Re: Sendmail MIME DoS vulnerability BUGTRAQ 20060624 Re: Sendmail MIME DoS vulnerability BUGTRAQ 20060721 rPSA-2006-0134-1 sendmail sendmail-cf HP HPSBUX02124 BID 18433 CONFIRM http://www.sendmail.com/security/advisories/SA-200605-01.txt.asc VUPEN ADV-2006-2189 VUPEN ADV-2006-2351 VUPEN ADV-2006-2388 VUPEN ADV-2006-2389 VUPEN ADV-2006-2390 VUPEN ADV-2006-2798 VUPEN ADV-2006-3135 AIXAPAR IY85415 AIXAPAR IY85930 XF sendmail-multipart-mime-dos(27128) CONFIRM https://issues.rpath.com/browse/RPL-526 Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multipart MIME messages that exhaust the stack during the recursive mime8to7 function for performing 8-bit to 7-bit conversion, which prevents Sendmail from delivering queued messages and might lead to disk consumption by core dump files. cpe:/a:debian:shadow-utils:4.0.0 cpe:/a:debian:shadow-utils:4.0.1 cpe:/a:debian:shadow-utils:4.0.2 cpe:/a:debian:shadow-utils:4.0.4 cpe:/a:debian:shadow-utils:4.0.4.1 cpe:/a:debian:shadow-utils:4.0.5 cpe:/a:debian:shadow-utils:4.0.6 cpe:/a:debian:shadow-utils:4.0.7 CVE-2006-1174 2006-05-28T19:02:00.000-04:00 2018-10-18T12:31:11.247-04:00 3.7 LOCAL HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SGI 20070602-01-P CONFIRM http://cvs.pld.org.pl/shadow/NEWS?rev=1.109 FULLDISC 20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2007-249.htm GENTOO GLSA-200606-02 CERT-VN VU#312692 MANDRIVA MDKSA-2006:090 REDHAT RHSA-2007:0276 REDHAT RHSA-2007:0431 BUGTRAQ 20070511 rPSA-2007-0096-1 shadow BID 18111 SECTRACK 1018221 VUPEN ADV-2006-2006 VUPEN ADV-2007-3229 XF shadow-utils-useradd-file-permission(26958) CONFIRM https://issues.rpath.com/browse/RPL-1357 useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox. cpe:/a:weonlydo:weonlydo_sftp CVE-2006-1175 2006-05-31T06:06:00.000-04:00 2017-07-19T21:30:22.520-04:00 4.0 NETWORK HIGH NONE PARTIAL PARTIAL NONE http://nvd.nist.gov CERT-VN VU#378604 BID 18192 VUPEN ADV-2006-2064 XF wodsftp-activex-unauth-access(26752) The WeOnlyDo! SFTP (wodSFTP) ActiveX control is marked as safe for scripting, which allows remote attackers to read and write files in arbitrary locations by accessing the control from a web page. cpe:/a:ebay:enhanced_picture_services:1.0.3.36 CVE-2006-1176 2006-07-07T20:05:00.000-04:00 2017-07-19T21:30:22.597-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1016445 CERT-VN VU#597721 CONFIRM http://www.kb.cert.org/vuls/id/MIMG-6QKPVH BID 18921 VUPEN ADV-2006-2698 XF ebay-epuimagecontrol-bo(27631) Buffer overflow in eBay Enhanced Picture Services (aka EPUImageControl Class) in EUPWALcontrol.dll before 1.0.3.48, as used in Sell Your Item (SYI), Setup & Test eBay Enhanced Picture Services, Picture Manager Enhanced Uploader, and CARad.com Add Vehicle, allows remote attackers to execute arbitrary code via a crafted HTML document. cpe:/a:tamarack_consulting:tamarack_mmsd:7.991 CVE-2006-1178 2006-07-28T21:04:00.000-04:00 2017-07-19T21:30:22.660-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SECTRACK 1016734 CERT-VN VU#372878 CONFIRM http://www.kb.cert.org/vuls/id/JGEI-6RZPUT BID 19202 VUPEN ADV-2006-3080 XF tamarack-mmsd-packet-dos(28053) Tamarack MMSd before 7.992 allows remote attackers to cause a denial of service (crash) via malformed RFC1006 (OSI over TCP/IP) packets. cpe:/a:adobe:document_server:5.0 cpe:/a:adobe:document_server:6.0 cpe:/a:adobe:graphics_server:2.0 cpe:/a:adobe:graphics_server:2.1 CVE-2006-1182 2006-03-15T20:02:00.000-05:00 2018-10-18T12:31:13.510-04:00 2.6 LOCAL HIGH NONE PARTIAL PARTIAL NONE http://nvd.nist.gov SREASON 588 SECTRACK 1015768 SECTRACK 1015769 CONFIRM http://www.adobe.com/support/techdocs/332989.html BUGTRAQ 20060315 Secunia Research: Adobe Document/Graphics Server File URI ResourceAccess BID 17113 VUPEN ADV-2006-0956 XF adobe-unauth-command-access(25247) Adobe Graphics Server 2.0 and 2.1 (formerly AlterCast) and Adobe Document Server (ADS) 5.0 and 6.0 allows local users to read files with certain extensions or overwrite arbitrary files and execute code via a crafted SOAP request to the AlterCast web service in which the request uses the (1) saveContent or (2) saveOptimized ADS commands, or the (3) loadContent command. cpe:/o:ubuntu:ubuntu_linux:5.10 CVE-2006-1183 2006-03-13T07:18:00.000-05:00 2018-10-03T17:36:41.450-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015761 BID 17086 VUPEN ADV-2006-0927 XF ubuntu-installer-password-disclosure(25170) CONFIRM https://launchpad.net/distros/ubuntu/+source/shadow/+bug/34606 UBUNTU USN-262-1 The Ubuntu 5.10 installer does not properly clear passwords from the installer log file (questions.dat), and leaves the log file with world-readable permissions, which allows local users to gain privileges. cpe:/a:microsoft:distributed_transaction_coordinator cpe:/o:microsoft:windows_2000 cpe:/o:microsoft:windows_2000::sp1 cpe:/o:microsoft:windows_2000::sp2 cpe:/o:microsoft:windows_2000::sp3 cpe:/o:microsoft:windows_2000::sp4 cpe:/o:microsoft:windows_2003_server:enterprise::64-bit cpe:/o:microsoft:windows_2003_server:enterprise_64-bit cpe:/o:microsoft:windows_2003_server:r2::64-bit cpe:/o:microsoft:windows_2003_server:r2::datacenter_64-bit cpe:/o:microsoft:windows_2003_server:standard::64-bit cpe:/o:microsoft:windows_2003_server:web cpe:/o:microsoft:windows_nt:4.0 cpe:/o:microsoft:windows_nt:4.0::enterprise_server cpe:/o:microsoft:windows_nt:4.0::server cpe:/o:microsoft:windows_nt:4.0::terminal_server cpe:/o:microsoft:windows_nt:4.0::workstation cpe:/o:microsoft:windows_nt:4.0:sp1 cpe:/o:microsoft:windows_nt:4.0:sp1:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp1:server cpe:/o:microsoft:windows_nt:4.0:sp1:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp1:workstation cpe:/o:microsoft:windows_nt:4.0:sp2 cpe:/o:microsoft:windows_nt:4.0:sp2:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp2:server cpe:/o:microsoft:windows_nt:4.0:sp2:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp2:workstation cpe:/o:microsoft:windows_nt:4.0:sp3 cpe:/o:microsoft:windows_nt:4.0:sp3:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp3:server cpe:/o:microsoft:windows_nt:4.0:sp3:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp3:workstation cpe:/o:microsoft:windows_nt:4.0:sp4 cpe:/o:microsoft:windows_nt:4.0:sp4:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp4:server cpe:/o:microsoft:windows_nt:4.0:sp4:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp4:workstation cpe:/o:microsoft:windows_nt:4.0:sp5 cpe:/o:microsoft:windows_nt:4.0:sp5:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp5:server cpe:/o:microsoft:windows_nt:4.0:sp5:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp5:workstation cpe:/o:microsoft:windows_nt:4.0:sp6 cpe:/o:microsoft:windows_nt:4.0:sp6:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp6:server cpe:/o:microsoft:windows_nt:4.0:sp6:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp6:workstation cpe:/o:microsoft:windows_nt:4.0:sp6a cpe:/o:microsoft:windows_nt:4.0:sp6a:enterprise_server cpe:/o:microsoft:windows_nt:4.0:sp6a:server cpe:/o:microsoft:windows_nt:4.0:sp6a:terminal_server cpe:/o:microsoft:windows_nt:4.0:sp6a:workstation cpe:/o:microsoft:windows_xp:::64-bit cpe:/o:microsoft:windows_xp:::embedded cpe:/o:microsoft:windows_xp:::home cpe:/o:microsoft:windows_xp:::media_center cpe:/o:microsoft:windows_xp::gold:professional cpe:/o:microsoft:windows_xp::sp1:64-bit cpe:/o:microsoft:windows_xp::sp1:embedded cpe:/o:microsoft:windows_xp::sp1:home cpe:/o:microsoft:windows_xp::sp1:media_center cpe:/o:microsoft:windows_xp::sp2:tablet_pc CVE-2006-1184 2006-05-09T22:14:00.000-04:00 2019-04-30T10:27:13.913-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SREASON 864 SECTRACK 1016047 MISC http://www.eeye.com/html/research/advisories/AD20060509b.html BUGTRAQ 20060509 [EEYEB20051011B] - Microsoft Distributed Transaction Coordinator Denial of Service BID 17905 VUPEN ADV-2006-1742 MS MS06-018 XF msdtc-message-dos(25558) Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service (crash) via a BuildContextW request with a large (1) UuidString or (2) GuidIn of a certain length, which causes an out-of-range memory access, aka the MSDTC Denial of Service Vulnerability. NOTE: this is a variant of CVE-2005-2119. cpe:/a:microsoft:ie:5.01:windows_2000_sp4 cpe:/a:microsoft:ie:6::windows_xp_professional_64bit cpe:/a:microsoft:ie:6:sp1 cpe:/a:microsoft:ie:6:sp1:windows_xpsp1 cpe:/a:microsoft:ie:6:windows_2000_sp4 cpe:/a:microsoft:ie:6:windows_server_2003_sp1 cpe:/a:microsoft:ie:6:windows_server_2003_sp1_itanium_systems cpe:/a:microsoft:ie:6:windows_xp_sp2 cpe:/h:canon:network_camera_server_vb101 CVE-2006-1185 2006-04-11T19:02:00.000-04:00 2018-10-12T17:39:03.930-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015900 CERT-VN VU#503124 BID 17450 CERT TA06-101A VUPEN ADV-2006-1318 MS MS06-013 XF ie-html-execute-code(25542) Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes memory corruption. cpe:/a:microsoft:ie:5.0.1 cpe:/a:microsoft:ie:5.0.1::windows_2000 cpe:/a:microsoft:ie:5.0.1::windows_95 cpe:/a:microsoft:ie:5.0.1::windows_98 cpe:/a:microsoft:ie:5.0.1::windows_nt_4.0 cpe:/a:microsoft:ie:5.0.1:sp1 cpe:/a:microsoft:ie:5.0.1:sp2 cpe:/a:microsoft:ie:5.0.1:sp3 cpe:/a:microsoft:ie:5.0.1:sp4 cpe:/a:microsoft:ie:5.01 cpe:/a:microsoft:ie:5.01:sp1 cpe:/a:microsoft:ie:5.01:sp2 cpe:/a:microsoft:ie:5.01:sp3 cpe:/a:microsoft:ie:5.01:sp4 cpe:/a:microsoft:ie:5.01:windows_2000_sp4 cpe:/a:microsoft:ie:5.5 cpe:/a:microsoft:ie:5.5:preview cpe:/a:microsoft:ie:5.5:sp1 cpe:/a:microsoft:ie:5.5:sp2 cpe:/a:microsoft:ie:6:windows_server_2003_sp1 CVE-2006-1186 2006-04-11T19:02:00.000-04:00 2018-10-12T17:39:05.243-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015900 CERT-VN VU#959049 BID 17453 CERT TA06-101A VUPEN ADV-2006-1318 MS MS06-013 XF ie-com-activex-execute-code(25545) Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2) Mdt2dd.dll, and (3) Mdt2gddo.dll COM objects as ActiveX controls, which leads to memory corruption. CVE-2006-1187 2017-05-11T10:29:03.650-04:00 2017-05-11T10:29:03.650-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2006. Notes: none. cpe:/a:microsoft:ie:5.1 cpe:/a:microsoft:ie:5.1::mac_os cpe:/a:microsoft:ie:5.2.3::macintosh cpe:/a:microsoft:ie:5.5 cpe:/a:microsoft:ie:5.5:preview cpe:/a:microsoft:ie:5.5:sp1 cpe:/a:microsoft:ie:5.5:sp2 cpe:/a:microsoft:ie:6::windows_xp_professional_64bit cpe:/a:microsoft:ie:6:sp1 cpe:/a:microsoft:ie:6:sp1:windows_xpsp1 cpe:/a:microsoft:ie:6:windows_2000_sp4 cpe:/a:microsoft:ie:6:windows_server_2003_sp1 cpe:/a:microsoft:ie:6:windows_server_2003_sp1_itanium_systems cpe:/a:microsoft:ie:6:windows_xp_sp2 cpe:/a:microsoft:ie:6.0 cpe:/a:microsoft:ie:6.0::windows_server_2003 cpe:/a:microsoft:ie:6.0:sp1 cpe:/a:microsoft:ie:6.0:sp2 cpe:/a:microsoft:ie:6.0.2600 cpe:/a:microsoft:ie:6.0.2800 cpe:/a:microsoft:ie:6.0.2800.1106 cpe:/a:microsoft:ie:6.0.2900.2180 cpe:/h:canon:network_camera_server_vb101 CVE-2006-1188 2006-04-11T19:02:00.000-04:00 2018-10-18T12:31:15.947-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1015900 CERT-VN VU#824324 BUGTRAQ 20060525 [BuHa-Security] MS06-013: HTML Tag Memory Corruption Vulnerability in MS IE 6 SP2 CERT TA06-101A VUPEN ADV-2006-1318 MS MS06-013 Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads to memory corruption. cpe:/a:microsoft:ie:5.01 cpe:/a:microsoft:ie:5.5 cpe:/a:microsoft:ie:6.0 CVE-2006-1189 2006-04-11T19:02:00.000-04:00 2018-10-12T17:39:08.447-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS BUGTRAQ 20060411 Microsoft Internet Explorer DBCS Remote Memory Corruption Vulnerability SECTRACK 1015900 CERT-VN VU#341028 BID 17454 CERT TA06-101A VUPEN ADV-2006-1318 MS MS06-013 XF ie-double-byte-execute-code(25551) Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with an International Domain Name (IDN) using double-byte character sets (DBCS), aka the "Double Byte Character Parsing Memory Corruption Vulnerability." cpe:/a:microsoft:ie:5.01 cpe:/a:microsoft:ie:5.5 cpe:/a:microsoft:ie:6.0 CVE-2006-1190 2006-04-11T19:02:00.000-04:00 2018-10-12T17:39:09.790-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015900 CERT-VN VU#959649 BID 17455 VUPEN ADV-2006-1318 MS MS06-013 XF ie-ioleclientsite-execute-code(25552) Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object, which could cause Internet Explorer to run the object in the wrong security context or zone, and allow remote attackers to execute arbitrary code. cpe:/a:microsoft:ie:5.01 cpe:/a:microsoft:ie:5.5 cpe:/a:microsoft:ie:6.0 CVE-2006-1191 2006-04-11T19:02:00.000-04:00 2018-10-12T17:39:11.040-04:00 4.0 NETWORK HIGH NONE PARTIAL PARTIAL NONE http://nvd.nist.gov SECTRACK 1015892 BID 17457 VUPEN ADV-2006-1318 MS MS06-013 XF ie-popup-zone-bypass(25555) Microsoft Internet Explorer 5.01 through 6 does not always correctly identify the domain that is associated with a browser window, which allows remote attackers to obtain sensitive cross-domain information and spoof sites by running script after the user has navigated to another site. cpe:/a:microsoft:ie:5.01:windows_2000_sp4 cpe:/a:microsoft:ie:6::windows_xp_professional_64bit cpe:/a:microsoft:ie:6:sp1 cpe:/a:microsoft:ie:6:sp1:windows_xpsp1 cpe:/a:microsoft:ie:6:windows_2000_sp4 cpe:/a:microsoft:ie:6:windows_server_2003_sp1 cpe:/a:microsoft:ie:6:windows_server_2003_sp1_itanium_systems cpe:/a:microsoft:ie:6:windows_xp_sp2 cpe:/h:canon:network_camera_server_vb101 CVE-2006-1192 2006-04-11T19:02:00.000-04:00 2018-10-12T17:39:11.897-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 670 SECTRACK 1015899 BID 17460 VUPEN ADV-2006-1318 MS MS06-013 XF ie-browser-window-spoofing(25557) Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via unknown methods that allow "window content to persist" after the user has navigated to another site, aka the "Address Bar Spoofing Vulnerability." NOTE: this is a different vulnerability than CVE-2006-1626. cpe:/a:microsoft:exchange_server:2000:sp1 cpe:/a:microsoft:exchange_server:2000:sp2 cpe:/a:microsoft:exchange_server:2000:sp3 CVE-2006-1193 2006-06-13T15:06:00.000-04:00 2018-10-12T17:39:13.413-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060614 SEC Consult SA-20060613-0 :: Outlook Web Access Cross Site Scripting Vulnerability SECTRACK 1016280 CERT-VN VU#138188 MISC http://www.sec-consult.com/fileadmin/Advisories/20060613-0_owa_xss_noexploit.txt BID 18381 CERT TA06-164A VUPEN ADV-2006-2326 MS MS06-029 XF exchange-owa-xss(25550) Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access (OWA), allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing." cpe:/a:enet:enet_library:jul_2005 CVE-2006-1194 2006-03-13T17:02:00.000-05:00 2018-10-18T12:31:17.010-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://aluigi.altervista.org/adv/enetx-adv.txt FULLDISC 20060312 Multiple vulnerabilities in ENet library (Jul 2005) SECTRACK 1015767 BUGTRAQ 20060312 Multiple vulnerabilities in ENet library (Jul 2005) BID 17087 VUPEN ADV-2006-0940 XF enet-signedness-dos(25157) Integer signedness error in the enet_protocol_handle_incoming_commands function in protocol.c for ENet library CVS version Jul 2005 and earlier, as used in products including (1) Cube, (2) Sauerbraten, and (3) Duke3d_w32, allows remote attackers to cause a denial of service (application crash) via a packet with a large command length value, which leads to an invalid memory access. cpe:/a:enet:enet_library CVE-2006-1195 2006-03-13T17:02:00.000-05:00 2018-10-18T12:31:17.590-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://aluigi.altervista.org/adv/enetx-adv.txt FULLDISC 20060312 Multiple vulnerabilities in ENet library (Jul 2005) SECTRACK 1015767 BUGTRAQ 20060312 Multiple vulnerabilities in ENet library (Jul 2005) BID 17087 VUPEN ADV-2006-0940 XF enet-packet-dos(25158) The enet_protocol_handle_send_fragment function in protocol.c for ENet library CVS version Jul 2005 and earlier, as used in products including (1) Cube, (2) Sauerbraten, and (3) Duke3d_w32, allows remote attackers to cause a denial of service (application crash) via a packet fragment with a large total data size, which triggers an application abort when memory allocation fails. cpe:/a:david_barrett:qwikiwiki:1.4 cpe:/a:david_barrett:qwikiwiki:1.5 cpe:/a:david_barrett:qwikiwiki:1.5.1 CVE-2006-1196 2006-03-13T17:02:00.000-05:00 2017-07-19T21:30:23.537-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://kiki91.altervista.org/exploit/qwikiwiki_1.0.5_xss.txt BID 17064 VUPEN ADV-2006-0910 XF qwikiwiki-multiple-scripts-xss(25128) Multiple cross-site scripting (XSS) vulnerabilities in QwikiWiki 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) from and (2) help parameters to (a) index.php; (3) action, (4) page, (5) debug, (6) help, (7) username, or (8) password parameters to (b) login.php; the (7) help parameter to (c) pageindex.php; or (8) help parameter to (d) recentchanges.php. cpe:/a:macrovision:safedisc CVE-2006-1197 2006-03-13T17:02:00.000-05:00 2018-10-18T12:31:18.150-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS BUGTRAQ 20060311 Copy protection scheme SafeDisc allows privilege escalation BID 17070 XF safedisk-secdrv-gain-privileges(25162) SafeDisc installs the driver service for the secdrv.sys driver with insecure permissions, which allows local users to gain privileges by changing the configuration to reference a malicious program. cpe:/a:comvigo:im_lock:home_2006 cpe:/a:comvigo:im_lock:professional_2006 CVE-2006-1198 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:18.400-04:00 3.7 LOCAL HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060306 IM Lock 2006 - Insecure Registry Permission Vulnerability BID 16988 VUPEN ADV-2006-0866 XF imlock-password-weak-encryption(25219) Comvigo IM Lock 2006 uses a simple substitution cipher to encrypt a password stored in the msnvs\prc registry value, for which all users have Read permission, which allows local users to bypass the product's blocking functionality by decrypting the password. cpe:/a:daverave:link_bank CVE-2006-1199 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:18.760-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060306 link bank code execution and xss BID 17001 VUPEN ADV-2006-0885 XF linkbank-iframe-xss(25107) Cross-site scripting (XSS) vulnerability in iframe.php in daverave Link Bank allows remote attackers to inject arbitrary web script or HTML via the site parameter. cpe:/a:daverave:link_bank CVE-2006-1200 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:19.167-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SREASON 553 BUGTRAQ 20060306 link bank code execution and xss BID 17004 VUPEN ADV-2006-0885 Direct static code injection vulnerability in add_link.txt in daverave Link Bank allows remote attackers to execute arbitrary PHP code via the url_name parameter, which is not sanitized before being stored in links.txt, which is later used in an include statement. cpe:/a:eschew.net:phpbannerexchange:2.0 cpe:/a:eschew.net:phpbannerexchange:2.0_update_1 cpe:/a:eschew.net:phpbannerexchange:2.0_update_2 cpe:/a:eschew.net:phpbannerexchange:2.0_update_3 cpe:/a:eschew.net:phpbannerexchange:2.0_update_4 CVE-2006-1201 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:19.527-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov FULLDISC 20060307 phpBannerExchange 2.0 Directory Traversal Vulnerability CONFIRM http://www.eschew.net/scripts/phpbe/2.0/releasenotes.php MISC http://www.h4cky0u.org/advisories/HYSA-2006-004-phpbanner.txt BUGTRAQ 20060307 phpBannerExchange 2.0 Directory Traversal Vulnerability BID 16996 VUPEN ADV-2006-0869 XF phpbannerexchange-resetpw-dir-traversal(25071) XF phpbannerexchange-recoverpw-dir-traversal(25080) Directory traversal vulnerability in resetpw.php in eschew.net phpBannerExchange 2.0 and earlier, and other versions before 2.0 Update 5, allows remote attackers to read arbitrary files via a .. (dot dot) in the email parameter during a "Recover password" operation (recoverpw.php). cpe:/a:jcink.com:textfilebb:1.0 CVE-2006-1202 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:20.323-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://notlegal.ws/textfilebbmessanger.txt SECTRACK 1015744 BUGTRAQ 20060308 textfileBB <= 1.0 Multiple XSS BID 17029 VUPEN ADV-2006-0897 XF textbb-messanger-xss(25091) Multiple cross-site scripting (XSS) vulnerabilities in textfileBB 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) mess and (2) user parameters in messanger.php, possibly requiring a URL encoded value. cpe:/a:txtforum:txtforum:1.0.4_dev CVE-2006-1203 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:20.823-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://www.seclab.tuwien.ac.at/advisories/TUVSA-0603-004.txt BUGTRAQ 20060309 txtForum: Script Injection Vulnerability BID 17061 XF txtforum-login-file-include(25131) PHP remote file include vulnerability in common.php in txtForum 1.0.4-dev and earlier allows remote attackers to include and execute arbitrary PHP code via a URL in the skin parameter to login.php, and possibly other parameters to other PHP scripts, related to include statements in common.php. cpe:/a:txtforum:txtforum:1.0.4_dev CVE-2006-1204 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:21.183-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://www.seclab.tuwien.ac.at/advisories/TUVSA-0603-003.txt BUGTRAQ 20060309 txtForum: Multiple XSS Vulnerabilities BID 17054 XF txtforum-multiple-xss(25132) Multiple cross-site scripting (XSS) vulnerabilities in txtForum 1.0.4-dev and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) prev, (2) next, and (3) rand5 parameters in (a) index.php; the (4) r_username and (5) r_loc parameters in (b) new_topic.php; the (6) r_num, (7) r_family_name, (8) r_icq, (9) r_yahoo, (10) r_aim, (11) r_homepage, (12) r_interests, (13) r_about, (14) selected1, (15) selected0, (16) signature_selected1, (17) signature_selected0, (18) smile_selected1, (19) smile_selected0, (20) ubb_selected1, and (21) ubb_selected0 parameters in (c) profile.php; the (22) quote and (23) tid parameters in (d) reply.php; and the (24) tid, (25) sticked, and (26) mid parameters in (e) view_topic.php. cpe:/a:mywebland:mybloggie:2.1.2 cpe:/a:mywebland:mybloggie:2.1.3 cpe:/a:mywebland:mybloggie:2.1.3_beta CVE-2006-1205 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:21.777-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://www.seclab.tuwien.ac.at/advisories/TUVSA-0603-002.txt BUGTRAQ 20060309 MyBloggie: Multiple XSS Vulnerabilities BID 17048 XF mybloggie-index-admin-xss(25134) Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) confirmredirect and (2) post_id parameters in (a) delcomment.php, as reachable when mode=delcom from index.php; and the (3) del and (4) message parameters in (b) upload.php, the (5) errormsg parameter in (c) addcat.php, (d) edituser.php, (e) adduser.php, and (f) editcat.php, the (6) trackback_url parameter in (g) add.php, (7) id parameter in (h) deluser.php, (8) cat_id parameter in (i) delcat.php, and (9) post_id parameter in (j) del.php, as reachable from admin.php. cpe:/a:dropbear_ssh_project:dropbear_ssh:0.47 CVE-2006-1206 2006-03-13T20:06:00.000-05:00 2018-10-30T12:28:03.233-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SECTRACK 1015742 BUGTRAQ 20060307 Dropbear SSH server Denial of Service BID 17024 XF dropbear-connection-dos(25075) Matt Johnston Dropbear SSH server 0.47 and earlier, as used in embedded Linux devices and on general-purpose operating systems, allows remote attackers to cause a denial of service (connection slot exhaustion) via a large number of connection attempts that exceeds the MAX_UNAUTH_CLIENTS defined value of 30. cpe:/a:sergey_korostel:php_upload_center CVE-2006-1207 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:23.090-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://biyosecurity.be/bugs/phpuploadcenter2.txt MISC http://www.blogcu.com/Liz0ziM/317250/ MISC http://www.scripts-by.net/PHP/File-Manipulation/php-upload-center.html BUGTRAQ 20060309 PHP Upload Center Download users password hashes And phpshell Upload PHP Upload Center stores password hashes under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for the upload/users/[USERNAME] file. cpe:/a:sergey_korostel:php_upload_center CVE-2006-1208 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:23.387-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://biyosecurity.be/bugs/phpuploadcenter2.txt SREASON 564 MISC http://www.blogcu.com/Liz0ziM/317250/ MISC http://www.scripts-by.net/PHP/File-Manipulation/php-upload-center.html BUGTRAQ 20060309 PHP Upload Center Download users password hashes And phpshell Upload VUPEN ADV-2006-0817 Sergey Korostel PHP Upload Center allows remote attackers to execute arbitrary PHP code by uploading a file whose name ends in a .php.li extension, which can be accessed from the upload directory. cpe:/a:bugada_andrea:php_advanced_transfer_manager:1.00 cpe:/a:bugada_andrea:php_advanced_transfer_manager:1.01 cpe:/a:bugada_andrea:php_advanced_transfer_manager:1.02 cpe:/a:bugada_andrea:php_advanced_transfer_manager:1.03 cpe:/a:bugada_andrea:php_advanced_transfer_manager:1.20 cpe:/a:bugada_andrea:php_advanced_transfer_manager:1.21 cpe:/a:bugada_andrea:php_advanced_transfer_manager:1.22 cpe:/a:bugada_andrea:php_advanced_transfer_manager:1.30 CVE-2006-1209 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:23.870-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://biyosecurity.be/bugs/patm.txt SREASON 565 MISC http://www.blogcu.com/Liz0ziM/316652/ BUGTRAQ 20060309 PHP Advanced Transfer Manager Download users password hashes BUGTRAQ 20060613 Re: PHP Advanced Transfer Manager Download users password hashes XF phpatm-password-hash-disclosure(25127) PHP Advanced Transfer Manager 1.00 through 1.30 stores sensitive information, including password hashes, under the web root with insufficient access control, which allows remote attackers to download each password hash via a direct request for a users/[USERNAME] file. cpe:/a:micromuse:netcool_neusecure:3.0.236 CVE-2006-1210 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:24.403-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060308 Remote access to NeuSecure/Netcool backend database via web interface credentials leakage BID 17032 XF netcool-neusecure-ns-unauth-access(25270) The web interface for IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 includes the MySQL database username and password in cleartext in body.phtml, which allows remote attackers to gain privileges by reading the source. NOTE: IBM has privately confirmed to CVE that a fix is available for these issues. cpe:/a:micromuse:netcool_neusecure:3.0.236 CVE-2006-1211 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:24.637-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060308 Remote access to NeuSecure/Netcool backend database via web interface credentials leakage XF netcool-neusecure-ns-unauth-access(25270) IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 configures a MySQL database to allow connections from any source IP address with the ns database account, which allows remote attackers to bypass the Netcool/NeuSecure application layer and perform unauthorized database actions. NOTE: IBM has privately confirmed to CVE that a fix is available for these issues. cpe:/a:corenews:corenews:2.0.1 CVE-2006-1212 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:24.840-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS VIM 20060313 Oddness - CoreNews 2.0.1 Remote Command Exucetion SREASON 754 MISC http://web.archive.org/web/20050323212004/www.coreslawn.de/?show=downloads&cat_id=1 BUGTRAQ 20060309 CoreNews 2.0.1 Remote Command Exucetion BID 17067 XF corenews-index-command-execution(25180) Unspecified vulnerability in index.php in Core CoreNews 2.0.1 allows remote attackers to execute arbitrary commands via the page parameter, possibly due to a PHP remote file include vulnerability. NOTE: this vulnerability could not be confirmed by source code inspection of CoreNews 2.0.1, which does not appear to use a "page" parameter or variable. cpe:/a:jiro:banner_system:1.0_experience cpe:/a:jiro:banner_system:1.0_professional CVE-2006-1213 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:25.277-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060309 Advisory: Jiros Banner Experience Pro Remote Privilege Escalation. MISC http://www.nukedx.com/?viewdoc=19 BUGTRAQ 20060309 Advisory: Jiros Banner Experience Pro Remote Privilege Escalation. BID 17060 VUPEN ADV-2006-0911 XF jbspro-security-bypass(25169) JiRo's Banner System Experience and Professional 1.0 and earlier allows remote attackers to bypass access restrictions and gain privileges via a direct request to certain scripts in the files directory, as demonstrated by using addadmin.asp to create a new administrator account. cpe:/a:unreal:unrealircd:3.2.3 CVE-2006-1214 2006-03-13T20:06:00.000-05:00 2018-10-18T12:31:25.857-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://forums.unrealircd.com/viewtopic.php?t=2985 BUGTRAQ 20060309 UnrealIRCd3.2.3 Server-Link Denial of Service BID 17057 VUPEN ADV-2006-0908 XF unrealircd-server-link-dos(25130) UnrealIRCd 3.2.3 allows remote attackers to cause an unspecified denial of service by causing a linked server to send malformed TKL Q:Line commands, as demonstrated by "TKL - q\x08Q *\x08PoC." cpe:/a:woltlab:burning_board:2.3.4 CVE-2006-1215 2006-03-13T21:02:00.000-05:00 2017-07-19T21:30:24.537-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060304 Wbb 2.3. xss BUGTRAQ 20060304 Re: Wbb 2.3. xss BID 16959 XF wbb-misc-xss(25156) Cross-site scripting (XSS) vulnerability in misc.php in Woltlab Burning Board (wBB) 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the percent parameter. NOTE: this issue has been disputed in a followup post, although the original disclosure might be related to reflected XSS. cpe:/a:runcms:runcms:1.1 cpe:/a:runcms:runcms:1.1a cpe:/a:runcms:runcms:1.2 cpe:/a:runcms:runcms:1.3a cpe:/a:runcms:runcms:1.3a2 cpe:/a:runcms:runcms:1.3a5 CVE-2006-1216 2006-03-13T21:02:00.000-05:00 2008-09-05T17:01:19.267-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov 2006-03-14T14:58:00.000-05:00 SREASON 474 MISC http://www.kapda.ir/advisory-280.html BUGTRAQ 20060304 [KAPDA::#31] - Runcms 1.x Cross_Site_Scripting vulnerability in bigshow.php BID 16970 Cross-site scripting (XSS) vulnerability in bigshow.php in Runcms 1.x allows remote attackers to inject arbitrary web script or HTML via the id parameter. cpe:/a:dsportal:dspoll:1.1 CVE-2006-1217 2006-03-13T21:02:00.000-05:00 2018-10-18T12:31:26.307-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/96/summary.html SREASON 620 SREASON 622 SECTRACK 1015758 BUGTRAQ 20060324 [eVuln] DSPoll Multiple SQL Injection Vulnerabilities BID 17103 VUPEN ADV-2006-0932 XF dspoll-pollid-sql-injection(25192) SQL injection vulnerability in DSPoll 1.1 allows remote attackers to execute arbitrary SQL commands via the pollid parameter to (1) results.php, (2) topolls.php, (3) pollit.php. cpe:/a:novell:bordermanager:3.8 cpe:/a:novell:bordermanager:3.8:sp4 CVE-2006-1218 2006-03-13T21:02:00.000-05:00 2011-03-07T21:32:27.860-05:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov CONFIRM http://support.novell.com/cgi-bin/search/searchtid.cgi?/2972993.htm BID 17031 VUPEN ADV-2006-0879 Unspecified vulnerability in the HTTP proxy in Novell BorderManager 3.8 and earlier allows remote attackers to cause a denial of service (CPU consumption and ABEND) via unknown attack vectors related to "media streaming over HTTP 1.1". cpe:/a:gallery_project:gallery:2.0 cpe:/a:gallery_project:gallery:2.0.1 cpe:/a:gallery_project:gallery:2.0.2 cpe:/a:gallery_project:gallery:2.0.3 cpe:/a:gallery_project:gallery:2.0_alpha cpe:/a:gallery_project:gallery:2.0_alpha1 cpe:/a:gallery_project:gallery:2.0_alpha2 cpe:/a:gallery_project:gallery:2.0_alpha3 cpe:/a:gallery_project:gallery:2.0_alpha4 cpe:/a:gallery_project:gallery:2.0_beta1 cpe:/a:gallery_project:gallery:2.0_beta2 cpe:/a:gallery_project:gallery:2.0_beta3 cpe:/a:gallery_project:gallery:2.1_rc1 cpe:/a:gallery_project:gallery:2.1_rc2 CVE-2006-1219 2006-03-13T21:02:00.000-05:00 2017-10-18T21:29:04.173-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://gallery.menalto.com/2.0.4_and_2.1_rc_2a_update BID 17051 VUPEN ADV-2006-0895 XF gallery-multiple-index-file-include(25129) EXPLOIT-DB 1566 Directory traversal vulnerability in Gallery 2.0.3 and earlier, and 2.1 before RC-2a, allows remote attackers to include arbitrary PHP files via ".." (dot dot) sequences in the stepOrder parameter to (1) upgrade/index.php or (2) install/index.php. cpe:/o:apple:mac_os_x:10.0 cpe:/o:apple:mac_os_x:10.0.1 cpe:/o:apple:mac_os_x:10.0.2 cpe:/o:apple:mac_os_x:10.0.3 cpe:/o:apple:mac_os_x:10.0.4 cpe:/o:apple:mac_os_x:10.1 cpe:/o:apple:mac_os_x:10.1.1 cpe:/o:apple:mac_os_x:10.1.2 cpe:/o:apple:mac_os_x:10.1.3 cpe:/o:apple:mac_os_x:10.1.4 cpe:/o:apple:mac_os_x:10.1.5 cpe:/o:apple:mac_os_x:10.2 cpe:/o:apple:mac_os_x:10.2.1 cpe:/o:apple:mac_os_x:10.2.2 cpe:/o:apple:mac_os_x:10.2.3 cpe:/o:apple:mac_os_x:10.2.4 cpe:/o:apple:mac_os_x:10.2.5 cpe:/o:apple:mac_os_x:10.2.6 cpe:/o:apple:mac_os_x:10.2.7 cpe:/o:apple:mac_os_x:10.2.8 cpe:/o:apple:mac_os_x:10.3 cpe:/o:apple:mac_os_x:10.3.1 cpe:/o:apple:mac_os_x:10.3.2 cpe:/o:apple:mac_os_x:10.3.3 cpe:/o:apple:mac_os_x:10.3.4 cpe:/o:apple:mac_os_x:10.3.5 cpe:/o:apple:mac_os_x:10.3.6 cpe:/o:apple:mac_os_x:10.3.7 cpe:/o:apple:mac_os_x:10.3.8 cpe:/o:apple:mac_os_x:10.3.9 cpe:/o:apple:mac_os_x:10.4 cpe:/o:apple:mac_os_x:10.4.1 cpe:/o:apple:mac_os_x:10.4.2 cpe:/o:apple:mac_os_x:10.4.3 cpe:/o:apple:mac_os_x:10.4.4 cpe:/o:apple:mac_os_x:10.4.5 cpe:/o:apple:mac_os_x_server:10.0 cpe:/o:apple:mac_os_x_server:10.1 cpe:/o:apple:mac_os_x_server:10.1.1 cpe:/o:apple:mac_os_x_server:10.1.2 cpe:/o:apple:mac_os_x_server:10.1.3 cpe:/o:apple:mac_os_x_server:10.1.4 cpe:/o:apple:mac_os_x_server:10.1.5 cpe:/o:apple:mac_os_x_server:10.2 cpe:/o:apple:mac_os_x_server:10.2.1 cpe:/o:apple:mac_os_x_server:10.2.2 cpe:/o:apple:mac_os_x_server:10.2.3 cpe:/o:apple:mac_os_x_server:10.2.4 cpe:/o:apple:mac_os_x_server:10.2.5 cpe:/o:apple:mac_os_x_server:10.2.6 cpe:/o:apple:mac_os_x_server:10.2.7 cpe:/o:apple:mac_os_x_server:10.2.8 cpe:/o:apple:mac_os_x_server:10.3 cpe:/o:apple:mac_os_x_server:10.3.1 cpe:/o:apple:mac_os_x_server:10.3.2 cpe:/o:apple:mac_os_x_server:10.3.3 cpe:/o:apple:mac_os_x_server:10.3.4 cpe:/o:apple:mac_os_x_server:10.3.5 cpe:/o:apple:mac_os_x_server:10.3.6 cpe:/o:apple:mac_os_x_server:10.3.7 cpe:/o:apple:mac_os_x_server:10.3.8 cpe:/o:apple:mac_os_x_server:10.3.9 cpe:/o:apple:mac_os_x_server:10.4 cpe:/o:apple:mac_os_x_server:10.4.1 cpe:/o:apple:mac_os_x_server:10.4.2 cpe:/o:apple:mac_os_x_server:10.4.3 cpe:/o:apple:mac_os_x_server:10.4.4 cpe:/o:apple:mac_os_x_server:10.4.5 CVE-2006-1220 2006-03-13T21:02:00.000-05:00 2013-09-06T00:53:05.953-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://www.felinemenace.org/~nemo/ BID 17056 Integer overflow in the mach_msg_send function in the kernel for Mac OS X might allow local users to execute arbitrary code via unknown attack vectors related to a large message header size, which leads to a heap-based buffer overflow. cpe:/a:zonelabs:zonealarm_security_suite:6.1.744.000 CVE-2006-1221 2006-03-14T06:02:00.000-05:00 2018-10-18T12:31:27.120-04:00 6.2 LOCAL HIGH NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS MISC http://reedarvin.thearvins.com/20060308-01.html SECTRACK 1015743 BUGTRAQ 20060308 18 ways to escalate privileges in Zone Labs ZoneAlarm Security Suite build 6.1.744.000 BUGTRAQ 20060309 Re: 18 ways to escalate privileges in Zone Labs ZoneAlarm Security Suite build 6.1.744.000 BUGTRAQ 20060309 Statement Regarding Reported Local Escalation of Privileges Vulnerability for ZoneAlarm BID 17037 VUPEN ADV-2006-0947 XF zonealarm-path-gain-privileges(25097) Untrusted search path vulnerability in the TrueVector service (VSMON.exe) in Zone Labs ZoneAlarm 6.x and Integrity does not search ZoneAlarm's own folders before other folders that are specified in a user's PATH, which might allow local users to execute code as SYSTEM by placing malicious DLLs into a folder that has insecure permissions, but is searched before ZoneAlarm's folder. NOTE: since this issue is dependent on the existence of a vulnerability in a separate product (weak permissions of executables or libraries, or the execution of malicious code), perhaps it should not be included in CVE. cpe:/a:zeroboard:zeroboard:4.1_pl2 cpe:/a:zeroboard:zeroboard:4.1_pl3 cpe:/a:zeroboard:zeroboard:4.1_pl4 cpe:/a:zeroboard:zeroboard:4.1_pl5 cpe:/a:zeroboard:zeroboard:4.1_pl6 cpe:/a:zeroboard:zeroboard:4.1_pl7 CVE-2006-1222 2006-03-14T06:02:00.000-05:00 2018-10-18T12:31:27.823-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060312 [INetCop Security Advisory] zeroboard IP session bypass XSS vulnerability MISC http://www.inetcop.org/upfiles/33INCSA.2006-0x82-029-zeroboard.pdf CONFIRM http://www.nzeo.com/bbs/zboard.php?id=cgi_bugreport2&no=5406 BUGTRAQ 20060312 [INetCop Security Advisory] zeroboard IP session bypass XSS vulnerability BID 17075 VUPEN ADV-2006-0944 XF zeroboard-multiple-fields-xss(25212) Multiple cross-site scripting (XSS) vulnerabilities in zeroboard 4.1 pl7 allows allow remote attackers to inject arbitrary web script or HTML via the (1) memo box title, (2) user email, and (3) homepage fields. cpe:/a:jupiter_cms:jupiter_cms:1.1.4 cpe:/a:jupiter_cms:jupiter_cms:1.1.5 CVE-2006-1223 2006-03-14T06:02:00.000-05:00 2018-10-18T12:31:28.450-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 572 CONFIRM http://www.jupiterportal.com/index.php?n=modules/forum&a=3&d=11&o=5&q=313 BUGTRAQ 20060311 Jupiter CMS <= 1.1.5 multiple XSS attack vectors. BUGTRAQ 20060412 Re: Jupiter CMS <= 1.1.5 multiple XSS attack vectors. BID 17072 VUPEN ADV-2006-0942 XF jupitercm-bbcodetag-xss(25241) Cross-site scripting (XSS) vulnerability in Jupiter Content Manager 1.1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a Javascript URI in the image BBcode tag. cpe:/a:guppy:guppy:2.4 cpe:/a:guppy:guppy:2.4_p1 cpe:/a:guppy:guppy:2.4_p3 cpe:/a:guppy:guppy:2.4_p4 cpe:/a:guppy:guppy:4.5 cpe:/a:guppy:guppy:4.5.3 cpe:/a:guppy:guppy:4.5.3a cpe:/a:guppy:guppy:4.5.4 cpe:/a:guppy:guppy:4.5.9 cpe:/a:guppy:guppy:4.5.10 cpe:/a:guppy:guppy:4.5.11 CVE-2006-1224 2006-03-14T06:02:00.000-05:00 2018-10-18T12:31:29.090-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 569 SECTRACK 1015753 CONFIRM http://www.freeguppy.org/?lng=en MISC http://www.kapda.ir/advisory-291.html BUGTRAQ 20060310 [KAPDA::#33] - GuppY <= 4.5.11 Remote DoS vulnerability BID 17068 VUPEN ADV-2006-0936 XF guppy-dwnld-file-deletion(25141) Directory traversal vulnerability in dwnld.php in GuppY 4.5.11 allows remote attackers to overwrite arbitrary files via a "%2E." (mixed encoding) in the pg parameter. cpe:/a:drupal:drupal:4.5.0 cpe:/a:drupal:drupal:4.5.1 cpe:/a:drupal:drupal:4.5.2 cpe:/a:drupal:drupal:4.5.3 cpe:/a:drupal:drupal:4.6.0 cpe:/a:drupal:drupal:4.6.1 CVE-2006-1225 2006-03-14T14:06:00.000-05:00 2018-10-18T12:31:29.840-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://drupal.org/node/53806 SREASON 579 DEBIAN DSA-1007 BUGTRAQ 20060314 [DRUPAL-SA-2006-004] Drupal 4.6.6 / 4.5.8 fixes mail header injection issue BID 17104 XF drupal-header-data-manipulation(25206) CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam proxy. cpe:/a:drupal:drupal:4.5.0 cpe:/a:drupal:drupal:4.5.1 cpe:/a:drupal:drupal:4.5.2 cpe:/a:drupal:drupal:4.5.3 cpe:/a:drupal:drupal:4.6.0 cpe:/a:drupal:drupal:4.6.1 CVE-2006-1226 2006-03-14T14:06:00.000-05:00 2018-10-18T12:31:30.450-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://drupal.org/node/53803 SREASON 581 DEBIAN DSA-1007 BUGTRAQ 20060314 [DRUPAL-SA-2006-002] Drupal 4.6.6 / 4.5.8 fixes XSS issue BID 17104 XF drupal-undisclosed-xss(25202) Cross-site scripting (XSS) vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. cpe:/a:drupal:drupal:4.5.0 cpe:/a:drupal:drupal:4.5.1 cpe:/a:drupal:drupal:4.5.2 cpe:/a:drupal:drupal:4.5.3 cpe:/a:drupal:drupal:4.5.4 cpe:/a:drupal:drupal:4.5.5 cpe:/a:drupal:drupal:4.5.6 cpe:/a:drupal:drupal:4.5.7 cpe:/a:drupal:drupal:4.6.0 cpe:/a:drupal:drupal:4.6.1 cpe:/a:drupal:drupal:4.6.2 cpe:/a:drupal:drupal:4.6.3 cpe:/a:drupal:drupal:4.6.4 cpe:/a:drupal:drupal:4.6.5 CVE-2006-1227 2006-03-14T14:06:00.000-05:00 2018-10-18T12:31:31.057-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://drupal.org/node/53796 SREASON 578 DEBIAN DSA-1007 BUGTRAQ 20060314 [DRUPAL-SA-2006-001] Drupal 4.6.6 / 4.5.8 fixes access control issue BID 17104 XF drupal-menumodule-bypass-security(25197) Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8, when menu.module is used to create a menu item, does not implement access control for the page that is referenced, which might allow remote attackers to access administrator pages. cpe:/a:drupal:drupal:4.5.0 cpe:/a:drupal:drupal:4.5.1 cpe:/a:drupal:drupal:4.5.2 cpe:/a:drupal:drupal:4.5.3 cpe:/a:drupal:drupal:4.6.0 cpe:/a:drupal:drupal:4.6.1 CVE-2006-1228 2006-03-14T14:06:00.000-05:00 2018-10-18T12:31:31.730-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://drupal.org/node/53805 SREASON 580 DEBIAN DSA-1007 BUGTRAQ 20060314 [DRUPAL-SA-2006-003] Drupal 4.6.6 / 4.5.8 fixes session fixation issue BID 17104 XF drupal-login-session-hijacking(25205) Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier. cpe:/a:hosting_controller:hosting_controller:6.1_hotfix_2.9 CVE-2006-1229 2006-03-14T14:06:00.000-05:00 2017-07-19T21:30:25.237-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS VUPEN ADV-2006-0914 XF hosting-controller-search-sql-injection(25140) SQL injection vulnerability in search.asp in Hosting Controller 6.1 (Hotfix 2.9) allows remote attackers to execute arbitrary SQL commands via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:belchior_foundry:vcard:2.6 cpe:/a:belchior_foundry:vcard:2.8 cpe:/a:belchior_foundry:vcard:2.9 CVE-2006-1230 2006-03-14T14:06:00.000-05:00 2018-10-18T12:31:32.370-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1016183 BUGTRAQ 20060311 XSS in vCard BUGTRAQ 20060527 multiple Xss exploits in : vCard 2.9 BUGTRAQ 20070304 XSS Remote In vCard 2.6 (c)2002 BID 17073 BID 22819 VUPEN ADV-2006-0945 XF vcard-create-xss(25181) Multiple cross-site scripting (XSS) vulnerabilities in create.php in vCard 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) card_id, (2) uploaded, (3) card_fontsize, or (4) card_color parameter. NOTE: the card_id vector was later reported to affect vCard 2.9, and the uploaded vector for 2.6. cpe:/a:julian_pawlowski:capi4hylafax:1.3 CVE-2006-1231 2006-03-14T14:06:00.000-05:00 2018-10-18T12:31:33.167-04:00 1.2 LOCAL HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060307 capi4hylafax insecure manipulation with tmp files BUGTRAQ 20060307 capi4hylafax insecure manipulation with tmp files BID 17034 XF capi4hylafax-c2faxrecvdbgdatafile-symlink(25262) CAPI4HylaFAX 1.3, when compiled with GENERATE_DEBUGSFFDATAFILE set, allows local users to modify arbitrary files via a symlink attack on the c2faxrecv_dbgdatafile.sff temporary file. cpe:/a:dsportal:dsdownload:1.0 CVE-2006-1232 2006-03-14T14:06:00.000-05:00 2018-10-18T12:31:33.510-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/99/summary.html SREASON 626 SECTRACK 1015755 BUGTRAQ 20060325 [eVuln] DSDownload Multiple SQL Injection Vulnerabilities BID 17116 VUPEN ADV-2006-0934 XF dsdownload-multiple-sql-injection(25193) Multiple SQL injection vulnerabilities in DSDownload 1.0, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) key and (2) category parameters to (a) search.php and (b) downloads.php. cpe:/a:mikael_software:wmnews CVE-2006-1233 2006-03-14T14:06:00.000-05:00 2018-10-18T12:31:34.167-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://biyosecurity.be/bugs/wmnews.txt BUGTRAQ 20060312 WMNews Cross Site Scripting BID 17076 VUPEN ADV-2006-0939 XF wmnews-multiple-scripts-xss(25210) Multiple cross-site scripting (XSS) vulnerabilities in WMNews allow remote attackers to inject arbitrary web script or HTML via the (1) ArtCat parameter to wmview.php, (2) ctrrowcol parameter to footer.php, or (3) ArtID parameter to wmcomments.php. cpe:/a:dsportal:dscounter:1.2 CVE-2006-1234 2006-03-14T14:06:00.000-05:00 2018-10-18T12:31:34.747-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/98/summary.html SREASON 627 SECTRACK 1015756 BUGTRAQ 20060325 [eVuln] DSCounter 'X-Forwarded-For' SQL Injection Vulnerability BID 17112 VUPEN ADV-2006-0933 XF dscounter-index-sql-injection(25190) SQL injection vulnerability in index.php in DSCounter 1.2, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For field (HTTP_X_FORWARDED_FOR environment variable) in an HTTP header. cpe:/a:david_ravenscroft:hithost:1.0.0 CVE-2006-1235 2006-03-14T18:02:00.000-05:00 2018-10-18T12:31:35.340-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BUGTRAQ 20060306 histhost v1.0.0 xss and possible rmdir BUGTRAQ 20060314 Re: histhost v1.0.0 xss and possible rmdir XF hithost-deleteuser-directory-deletion(25106) Directory traversal vulnerability in admin/deleteuser.php in HitHost 1.0.0 might allow remote attackers to delete directories (possibly only empty directories) via the $deleteuser variable. NOTE: the initial disclosure for this issue indicated that the researcher was unable to prove this issue; however, this might have been due to certain behaviors of rmdir. cpe:/a:crossfire:crossfire:1.9.0 CVE-2006-1236 2006-03-14T19:02:00.000-05:00 2017-10-10T21:30:42.187-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS CONFIRM http://cvs.sourceforge.net/viewcvs.py/crossfire/crossfire/socket/request.c?rev=1.86&view=log DEBIAN DSA-1009 BID 17093 VUPEN ADV-2006-0951 XF crossfire-setup-bo(25252) EXPLOIT-DB 1582 Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrary code via a long setup sound command, a different vulnerability than CVE-2006-1010. cpe:/a:dsportal:dsnewsletter:1.0 CVE-2006-1237 2006-03-15T11:06:00.000-05:00 2018-10-18T12:31:35.700-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/97/summary.html SREASON 623 SECTRACK 1015757 BUGTRAQ 20060324 [eVuln] DSNewsletter SQL Injection Vulnerability BID 17111 VUPEN ADV-2006-0931 XF dsnewsletter-email-sql-injection(25188) Multiple SQL injection vulnerabilities in DSNewsletter 1.0, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the email parameter to (1) include/sub.php, (2) include/confirm.php, or (3) include/unconfirm.php. cpe:/a:dsportal:dslogin:1.0 CVE-2006-1238 2006-03-15T11:06:00.000-05:00 2018-10-18T12:31:36.417-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/100/summary.html SREASON 637 SECTRACK 1015754 BUGTRAQ 20060327 [eVuln] DSLogin Authentication Bypass Vulnerability BID 17262 VUPEN ADV-2006-0953 XF dslogin-index-sql-injection(25194) SQL injection vulnerability in DSLogin 1.0, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the $log_userid variable in (1) index.php and (2) admin/index.php. cpe:/a:countersoft:gemini:2.0 CVE-2006-1239 2006-03-15T11:06:00.000-05:00 2017-07-19T21:30:25.833-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 17092 VUPEN ADV-2006-0954 XF gemini-createissue-xss(25195) Cross-site scripting (XSS) vulnerability in issue/createissue.aspx in Gemini 2.0 allows remote attackers to inject arbitrary web script or HTML via the rtcDescription$RadEditor1 field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:firebirdsql:firebird:1.5 cpe:/a:firebirdsql:firebird:1.5.1 cpe:/a:firebirdsql:firebird:1.5.2 CVE-2006-1240 2006-03-15T12:06:00.000-05:00 2018-10-18T12:31:36.997-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS FULLDISC 20060312 Buffer Overflow and Installation Script Error in Firebird 1.5.3 BUGTRAQ 20060312 Buffer Overflow and Installation Script Error in Firebird 1.5.3 BID 17077 XF firebird-fbinetserver-fbserver-bo(25282) Buffer overflow in inet_server.cpp in (1) fb_inet_server and (2) fbserver in Firebird 1.5.2.4731 allows local users to gain privileges via a long value of the -p argument. cpe:/a:firebirdsql:firebird:1.5.2.4731 CVE-2006-1241 2006-03-15T12:06:00.000-05:00 2018-10-18T12:31:37.293-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS FULLDISC 20060312 Buffer Overflow and Installation Script Error in Firebird 1.5.3 BUGTRAQ 20060312 Buffer Overflow and Installation Script Error in Firebird 1.5.3 BID 17077 XF firebird-fbinetserver-fbserver-bo(25282) Firebird 1.5.2.4731 installs (1) fb_lock_mgr, (2) gds_drop, and (3) fb_inet_server with setuid firebird permissions, which might allow local users to gain privileges via a buffer overflow as identified by CVE-2006-1240, or possibly other vulnerabilities. cpe:/o:linux:linux_kernel:2.4.0 cpe:/o:linux:linux_kernel:2.4.0:test1 cpe:/o:linux:linux_kernel:2.4.0:test10 cpe:/o:linux:linux_kernel:2.4.0:test11 cpe:/o:linux:linux_kernel:2.4.0:test12 cpe:/o:linux:linux_kernel:2.4.0:test2 cpe:/o:linux:linux_kernel:2.4.0:test3 cpe:/o:linux:linux_kernel:2.4.0:test4 cpe:/o:linux:linux_kernel:2.4.0:test5 cpe:/o:linux:linux_kernel:2.4.0:test6 cpe:/o:linux:linux_kernel:2.4.0:test7 cpe:/o:linux:linux_kernel:2.4.0:test8 cpe:/o:linux:linux_kernel:2.4.0:test9 cpe:/o:linux:linux_kernel:2.4.1 cpe:/o:linux:linux_kernel:2.4.2 cpe:/o:linux:linux_kernel:2.4.3 cpe:/o:linux:linux_kernel:2.4.4 cpe:/o:linux:linux_kernel:2.4.5 cpe:/o:linux:linux_kernel:2.4.6 cpe:/o:linux:linux_kernel:2.4.7 cpe:/o:linux:linux_kernel:2.4.8 cpe:/o:linux:linux_kernel:2.4.9 cpe:/o:linux:linux_kernel:2.4.10 cpe:/o:linux:linux_kernel:2.4.11 cpe:/o:linux:linux_kernel:2.4.12 cpe:/o:linux:linux_kernel:2.4.13 cpe:/o:linux:linux_kernel:2.4.14 cpe:/o:linux:linux_kernel:2.4.15 cpe:/o:linux:linux_kernel:2.4.16 cpe:/o:linux:linux_kernel:2.4.17 cpe:/o:linux:linux_kernel:2.4.18 cpe:/o:linux:linux_kernel:2.4.18::x86 cpe:/o:linux:linux_kernel:2.4.18:pre1 cpe:/o:linux:linux_kernel:2.4.18:pre2 cpe:/o:linux:linux_kernel:2.4.18:pre3 cpe:/o:linux:linux_kernel:2.4.18:pre4 cpe:/o:linux:linux_kernel:2.4.18:pre5 cpe:/o:linux:linux_kernel:2.4.18:pre6 cpe:/o:linux:linux_kernel:2.4.18:pre7 cpe:/o:linux:linux_kernel:2.4.18:pre8 cpe:/o:linux:linux_kernel:2.4.19 cpe:/o:linux:linux_kernel:2.4.19:pre1 cpe:/o:linux:linux_kernel:2.4.19:pre2 cpe:/o:linux:linux_kernel:2.4.19:pre3 cpe:/o:linux:linux_kernel:2.4.19:pre4 cpe:/o:linux:linux_kernel:2.4.19:pre5 cpe:/o:linux:linux_kernel:2.4.19:pre6 cpe:/o:linux:linux_kernel:2.4.20 cpe:/o:linux:linux_kernel:2.4.21 cpe:/o:linux:linux_kernel:2.4.21:pre1 cpe:/o:linux:linux_kernel:2.4.21:pre4 cpe:/o:linux:linux_kernel:2.4.21:pre7 cpe:/o:linux:linux_kernel:2.4.22 cpe:/o:linux:linux_kernel:2.4.23 cpe:/o:linux:linux_kernel:2.4.23:pre9 cpe:/o:linux:linux_kernel:2.4.23_ow2 cpe:/o:linux:linux_kernel:2.4.24 cpe:/o:linux:linux_kernel:2.4.24_ow1 cpe:/o:linux:linux_kernel:2.4.25 cpe:/o:linux:linux_kernel:2.4.26 cpe:/o:linux:linux_kernel:2.4.27 cpe:/o:linux:linux_kernel:2.4.27:pre1 cpe:/o:linux:linux_kernel:2.4.27:pre2 cpe:/o:linux:linux_kernel:2.4.27:pre3 cpe:/o:linux:linux_kernel:2.4.27:pre4 cpe:/o:linux:linux_kernel:2.4.27:pre5 cpe:/o:linux:linux_kernel:2.4.28 cpe:/o:linux:linux_kernel:2.4.29 cpe:/o:linux:linux_kernel:2.4.29:rc1 cpe:/o:linux:linux_kernel:2.4.29:rc2 cpe:/o:linux:linux_kernel:2.4.30 cpe:/o:linux:linux_kernel:2.4.30:rc2 cpe:/o:linux:linux_kernel:2.4.30:rc3 cpe:/o:linux:linux_kernel:2.4.31 cpe:/o:linux:linux_kernel:2.4.31:pre1 cpe:/o:linux:linux_kernel:2.4.32 cpe:/o:linux:linux_kernel:2.4.32:pre1 cpe:/o:linux:linux_kernel:2.4.32:pre2 cpe:/o:linux:linux_kernel:2.4.33:pre1 cpe:/o:linux:linux_kernel:2.6.0 cpe:/o:linux:linux_kernel:2.6.0:test1 cpe:/o:linux:linux_kernel:2.6.0:test10 cpe:/o:linux:linux_kernel:2.6.0:test11 cpe:/o:linux:linux_kernel:2.6.0:test2 cpe:/o:linux:linux_kernel:2.6.0:test3 cpe:/o:linux:linux_kernel:2.6.0:test4 cpe:/o:linux:linux_kernel:2.6.0:test5 cpe:/o:linux:linux_kernel:2.6.0:test6 cpe:/o:linux:linux_kernel:2.6.0:test7 cpe:/o:linux:linux_kernel:2.6.0:test8 cpe:/o:linux:linux_kernel:2.6.0:test9 cpe:/o:linux:linux_kernel:2.6.1 cpe:/o:linux:linux_kernel:2.6.1:rc1 cpe:/o:linux:linux_kernel:2.6.1:rc2 cpe:/o:linux:linux_kernel:2.6.2 cpe:/o:linux:linux_kernel:2.6.3 cpe:/o:linux:linux_kernel:2.6.4 cpe:/o:linux:linux_kernel:2.6.5 cpe:/o:linux:linux_kernel:2.6.6 cpe:/o:linux:linux_kernel:2.6.6:rc1 cpe:/o:linux:linux_kernel:2.6.7 cpe:/o:linux:linux_kernel:2.6.7:rc1 cpe:/o:linux:linux_kernel:2.6.8 cpe:/o:linux:linux_kernel:2.6.8:rc1 cpe:/o:linux:linux_kernel:2.6.8:rc2 cpe:/o:linux:linux_kernel:2.6.8:rc3 cpe:/o:linux:linux_kernel:2.6.9:2.6.20 cpe:/o:linux:linux_kernel:2.6.10 cpe:/o:linux:linux_kernel:2.6.10:rc2 cpe:/o:linux:linux_kernel:2.6.11 cpe:/o:linux:linux_kernel:2.6.11:rc2 cpe:/o:linux:linux_kernel:2.6.11:rc3 cpe:/o:linux:linux_kernel:2.6.11:rc4 cpe:/o:linux:linux_kernel:2.6.11.5 cpe:/o:linux:linux_kernel:2.6.11.6 cpe:/o:linux:linux_kernel:2.6.11.7 cpe:/o:linux:linux_kernel:2.6.11.8 cpe:/o:linux:linux_kernel:2.6.11.11 cpe:/o:linux:linux_kernel:2.6.11.12 cpe:/o:linux:linux_kernel:2.6.12:rc1 cpe:/o:linux:linux_kernel:2.6.12:rc4 cpe:/o:linux:linux_kernel:2.6.12:rc5 cpe:/o:linux:linux_kernel:2.6.12.1 cpe:/o:linux:linux_kernel:2.6.12.2 cpe:/o:linux:linux_kernel:2.6.12.3 cpe:/o:linux:linux_kernel:2.6.12.4 cpe:/o:linux:linux_kernel:2.6.12.5 cpe:/o:linux:linux_kernel:2.6.12.6 cpe:/o:linux:linux_kernel:2.6.13 cpe:/o:linux:linux_kernel:2.6.13:rc1 cpe:/o:linux:linux_kernel:2.6.13:rc4 cpe:/o:linux:linux_kernel:2.6.13:rc6 cpe:/o:linux:linux_kernel:2.6.13:rc7 cpe:/o:linux:linux_kernel:2.6.13.1 cpe:/o:linux:linux_kernel:2.6.13.2 cpe:/o:linux:linux_kernel:2.6.13.3 cpe:/o:linux:linux_kernel:2.6.13.4 cpe:/o:linux:linux_kernel:2.6.14 cpe:/o:linux:linux_kernel:2.6.14:rc1 cpe:/o:linux:linux_kernel:2.6.14:rc2 cpe:/o:linux:linux_kernel:2.6.14:rc3 cpe:/o:linux:linux_kernel:2.6.14:rc4 cpe:/o:linux:linux_kernel:2.6.14.1 cpe:/o:linux:linux_kernel:2.6.14.2 cpe:/o:linux:linux_kernel:2.6.14.3 cpe:/o:linux:linux_kernel:2.6.14.4 cpe:/o:linux:linux_kernel:2.6.14.5 cpe:/o:linux:linux_kernel:2.6.15 cpe:/o:linux:linux_kernel:2.6.15:rc1 cpe:/o:linux:linux_kernel:2.6.15:rc3 cpe:/o:linux:linux_kernel:2.6.15.1 cpe:/o:linux:linux_kernel:2.6.15.2 cpe:/o:linux:linux_kernel:2.6.15.3 cpe:/o:linux:linux_kernel:2.6.15.4 cpe:/o:linux:linux_kernel:2.6.15.5 cpe:/o:linux:linux_kernel:2.6_test9_cvs CVE-2006-1242 2006-03-15T12:06:00.000-05:00 2018-10-18T12:31:37.667-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-180.htm CONFIRM http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm DEBIAN DSA-1097 DEBIAN DSA-1103 CONFIRM http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.1 MANDRIVA MDKSA-2006:086 SUSE SUSE-SA:2006:028 REDHAT RHSA-2006:0437 REDHAT RHSA-2006:0575 BUGTRAQ 20060314 Linux zero IP ID vulnerability? BUGTRAQ 20060315 Re: Linux zero IP ID vulnerability? BUGTRAQ 20060316 Re: Linux zero IP ID vulnerability? BUGTRAQ 20060323 Re: Linux zero IP ID vulnerability? BID 17109 VUPEN ADV-2006-1140 VUPEN ADV-2006-2554 UBUNTU USN-281-1 The ip_push_pending_frames function in Linux 2.4.x and 2.6.x before 2.6.16 increments the IP ID field when sending a RST after receiving unsolicited TCP SYN-ACK packets, which allows remote attackers to conduct an Idle Scan (nmap -sI) attack, which bypasses intended protections against such attacks. cpe:/a:alexander_palmo:simple_php_blog:0.4.0 cpe:/a:alexander_palmo:simple_php_blog:0.4.5 cpe:/a:alexander_palmo:simple_php_blog:0.4.6 cpe:/a:alexander_palmo:simple_php_blog:0.4.7 cpe:/a:alexander_palmo:simple_php_blog:0.4.7.1 CVE-2006-1243 2006-03-15T12:06:00.000-05:00 2017-10-18T21:29:04.237-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://sourceforge.net/forum/forum.php?forum_id=564904 VIM Vendor ACK for CVE-2006-1243 (older Simple PHP Blog) BID 17102 VUPEN ADV-2006-1007 XF simplephpblog-install05-file-include(25322) EXPLOIT-DB 1581 Directory traversal vulnerability in install05.php in Simple PHP Blog (SPB) 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the blog_language parameter, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included using install05.php. cpe:/a:gnome:gpdf:2.8.2 cpe:/a:libextractor:libextractor:0.3.6 cpe:/a:libextractor:libextractor:0.3.7 cpe:/a:libextractor:libextractor:0.3.8 cpe:/a:libextractor:libextractor:0.3.9 cpe:/a:libextractor:libextractor:0.3.11 cpe:/a:libextractor:libextractor:0.4 cpe:/a:libextractor:libextractor:0.4.1 cpe:/a:libextractor:libextractor:0.4.2 cpe:/a:libextractor:libextractor:0.5 cpe:/a:xpdf:xpdf:0.90 cpe:/a:xpdf:xpdf:0.91 cpe:/a:xpdf:xpdf:0.92 cpe:/a:xpdf:xpdf:0.93 cpe:/a:xpdf:xpdf:1.0 cpe:/a:xpdf:xpdf:1.0a cpe:/a:xpdf:xpdf:1.1 cpe:/a:xpdf:xpdf:2.0 cpe:/a:xpdf:xpdf:2.1 cpe:/a:xpdf:xpdf:2.2 cpe:/a:xpdf:xpdf:2.3 cpe:/a:xpdf:xpdf:3.0 cpe:/a:xpdf:xpdf:3.0.1 cpe:/a:xpdf:xpdf:3.0.1_pl1 cpe:/a:xpdf:xpdf:3.0_pl2 cpe:/a:xpdf:xpdf:3.0_pl3 cpe:/o:debian:debian_linux:3.1 cpe:/o:debian:debian_linux:3.1::alpha cpe:/o:debian:debian_linux:3.1::amd64 cpe:/o:debian:debian_linux:3.1::arm cpe:/o:debian:debian_linux:3.1::hppa cpe:/o:debian:debian_linux:3.1::ia-32 cpe:/o:debian:debian_linux:3.1::ia-64 cpe:/o:debian:debian_linux:3.1::m68k cpe:/o:debian:debian_linux:3.1::mips cpe:/o:debian:debian_linux:3.1::mipsel cpe:/o:debian:debian_linux:3.1::ppc cpe:/o:debian:debian_linux:3.1::s-390 cpe:/o:debian:debian_linux:3.1::sparc CVE-2006-1244 2006-03-15T14:06:00.000-05:00 2018-10-03T17:36:46.717-04:00 7.6 NETWORK HIGH NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov MISC http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3.diff.gz DEBIAN DSA-1019 DEBIAN DSA-979 DEBIAN DSA-982 DEBIAN DSA-983 DEBIAN DSA-984 DEBIAN DSA-998 BID 16748 UBUNTU USN-270-1 Unspecified vulnerability in certain versions of xpdf after 3.00, as used in various products including (a) pdfkit.framework, (b) gpdf, (c) pdftohtml, and (d) libextractor, has unknown impact and user-assisted attack vectors, possibly involving errors in (1) gmem.c, (2) SplashXPathScanner.cc, (3) JBIG2Stream.cc, (4) JPXStream.cc, and/or (5) Stream.cc. NOTE: this description is based on Debian advisory DSA 979, which is based on changes that were made after other vulnerabilities such as CVE-2006-0301 and CVE-2005-3624 through CVE-2005-3628 were fixed. Some of these newer fixes appear to be security-relevant, although it is not clear if they fix specific issues or are defensive in nature. cpe:/a:microsoft:ie:6.0:sp2 CVE-2006-1245 2006-03-16T20:02:00.000-05:00 2018-10-18T12:31:41.840-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS BUGTRAQ 20060316 Remote overflow in MSIE script action handlers (mshtml.dll) SECTRACK 1015794 CERT-VN VU#984473 BUGTRAQ 20060325 Re: [optimized PoC] Remote overflow in MSIE script action handlers (mshtml.dll) BUGTRAQ 20061203 MS Internet Explorer 6.0 (mshtml.dll) Denial of Service Exploit BUGTRAQ 20061205 Re: MS Internet Explorer 6.0 (mshtml.dll) Denial of Service Exploit BID 17131 CERT TA06-101A VUPEN ADV-2006-1318 MS MS06-013 XF ie-mshtml-bo(25292) Buffer overflow in mshtml.dll in Microsoft Internet Explorer 6.0.2900.2180, and probably other versions, allows remote attackers to execute arbitrary code via an HTML tag with a large number of script action handlers such as onload and onmouseover, as demonstrated using onclick, aka the "Multiple Event Handler Memory Corruption Vulnerability." cpe:/o:ibm:aix:5.3 CVE-2006-1246 2006-03-17T06:02:00.000-05:00 2017-07-19T21:30:26.130-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS VIM 20060323 IBM changing significant details? SECTRACK 1015786 MISC http://www.nsfocus.com/english/homepage/research/0602.htm BID 17115 VUPEN ADV-2006-0957 AIXAPAR IY82739 XF aix-bosrtelvm-gain-privileges(25299) XF aix-mklvcopy-code-execution(25849) Unspecified vulnerability in mklvcopy in BOS.RTE.LVM in IBM AIX 5.3 allows local users to execute arbitrary commands when mklvcopy calls external commands, possibly due to an untrusted search path vulnerability. cpe:/o:ibm:aix:5.1 cpe:/o:ibm:aix:5.1l cpe:/o:ibm:aix:5.2 cpe:/o:ibm:aix:5.2.0.50 cpe:/o:ibm:aix:5.2.0.54 cpe:/o:ibm:aix:5.2.2 cpe:/o:ibm:aix:5.2_l cpe:/o:ibm:aix:5.3 cpe:/o:ibm:aix:5.3.0 cpe:/o:ibm:aix:5.3.0.10 cpe:/o:ibm:aix:5.3.0.20 cpe:/o:ibm:aix:5.3_l cpe:/o:ibm:aix:5.3_ml03 CVE-2006-1247 2006-04-19T12:06:00.000-04:00 2018-10-18T12:31:43.777-04:00 3.3 LOCAL MEDIUM NONE NONE PARTIAL PARTIAL http://nvd.nist.gov SECTRACK 1015952 MISC http://www.nsfocus.com/english/homepage/research/0603.htm BUGTRAQ 20060424 NSFOCUS SA2006-03 : IBM AIX rm_mlcache_file Local Race Condition Vulnerability BUGTRAQ 20060424 NSFOCUS SA2006-02 : IBM AIX mklvcopy Local Privilege Escalation Vulnerability BID 17576 VUPEN ADV-2006-1389 AIXAPAR IY82357 XF aix-rm-mlcache-file-overwrite(25848) rm_mlcache_file in bos.rte.install in AIX 5.1.0 through 5.3.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files. cpe:/o:hp:hp-ux:11.00 cpe:/o:hp:hp-ux:11.11 cpe:/o:hp:hp-ux:11.23::ia64_64-bit CVE-2006-1248 2006-03-17T14:02:00.000-05:00 2017-10-10T21:30:42.500-04:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS HP HPSBUX02102 SECTRACK 1015782 SECTRACK 1015834 BID 17143 VUPEN ADV-2006-0997 XF hpux-usermod-unauthorized-access(25311) Unspecified vulnerability in usermod in HP-UX B.11.00, B.11.11, and B.11.23, when run with certain options that involve a new home directory, might cause usermod to change the ownership of all directories and files under the new directory, which might result in less secure permissions than intended. cpe:/a:apple:itunes:6.0.1 cpe:/a:apple:itunes:6.0.2 cpe:/a:apple:quicktime:7.0.3 cpe:/a:apple:quicktime:7.0.4 CVE-2006-1249 2006-03-18T20:02:00.000-05:00 2018-10-18T12:31:44.543-04:00 6.8 NETWORK MEDIUM NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS APPLE APPLE-SA-2006-05-11 SECTRACK 1016067 MISC http://www.eeye.com/html/research/upcoming/20060307b.html CERT-VN VU#570689 BUGTRAQ 20060512 Apple QuickDraw/QuickTime Multiple Vulnerabilities BUGTRAQ 20060511 [EEYEB-20060307] Apple QuickTime FPX Integer Overflow BID 17074 CERT TA06-132B VUPEN ADV-2006-1778 XF quicktime-flashpix-overflow(26398) Integer overflow in Apple QuickTime Player 7.0.3 and 7.0.4 and iTunes 6.0.1 and 6.0.2 allows remote attackers to execute arbitrary code via a FlashPix (FPX) image that contains a field that specifies a large number of blocks. cpe:/a:amax_information_technologies:winmail:4.3 CVE-2006-1250 2006-03-18T20:02:00.000-05:00 2011-03-07T21:32:31.687-05:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov CONFIRM http://www.magicwinmail.net/changelog.asp BID 17009 VUPEN ADV-2006-0858 Unspecified vulnerability in the Webmail module in Winmail before 4.3 has unknown impact and unknown remote attack vectors. cpe:/a:sa-exim:sa-exim:4.0 cpe:/a:sa-exim:sa-exim:4.1 cpe:/a:sa-exim:sa-exim:4.2 CVE-2006-1251 2006-03-18T20:02:00.000-05:00 2017-07-19T21:30:26.380-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=345071 CONFIRM http://marc.merlins.org/linux/exim/files/sa-exim-cvs/Changelog.html BID 17110 VUPEN ADV-2006-0941 XF saexim-greylistclean-file-deletion(25286) Argument injection vulnerability in greylistclean.cron in sa-exim 4.2 allows remote attackers to delete arbitrary files via an email with a To field that contains a filename separated by whitespace, which is not quoted when greylistclean.cron provides the argument to the rm command. cpe:/a:light_weight_calendar:light_weight_calendar:1.0 CVE-2006-1252 2006-03-18T20:02:00.000-05:00 2017-10-10T21:30:42.563-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS VIM 20060318 Source VERIFY - Light Weight Calendar issue is eval injection BID 17059 EXPLOIT-DB 1570 Eval injection vulnerability in cal.php in Light Weight Calendar (LWC) 1.0 allows remote attackers to execute arbitrary PHP code via the date parameter to index.php. cpe:/a:glftpd:glftpd:1.18 cpe:/a:glftpd:glftpd:1.19 cpe:/a:glftpd:glftpd:1.20 cpe:/a:glftpd:glftpd:1.21 cpe:/a:glftpd:glftpd:1.22 cpe:/a:glftpd:glftpd:1.23 cpe:/a:glftpd:glftpd:1.24 cpe:/a:glftpd:glftpd:1.25 cpe:/a:glftpd:glftpd:1.26 cpe:/a:glftpd:glftpd:1.27 cpe:/a:glftpd:glftpd:1.28 cpe:/a:glftpd:glftpd:1.29 cpe:/a:glftpd:glftpd:1.29.1 cpe:/a:glftpd:glftpd:1.30 cpe:/a:glftpd:glftpd:1.31 cpe:/a:glftpd:glftpd:1.32 cpe:/a:glftpd:glftpd:2.0 cpe:/a:glftpd:glftpd:2.0_rc1 cpe:/a:glftpd:glftpd:2.0_rc2 cpe:/a:glftpd:glftpd:2.0_rc3 cpe:/a:glftpd:glftpd:2.0_rc4 cpe:/a:glftpd:glftpd:2.0_rc5 cpe:/a:glftpd:glftpd:2.0_rc6 cpe:/a:glftpd:glftpd:2.0_rc7 cpe:/a:glftpd:glftpd:2.01_rc1 cpe:/a:glftpd:glftpd:2.01_rc2 cpe:/a:glftpd:glftpd:2.01_rc3 cpe:/a:glftpd:glftpd:2.01_rc4 CVE-2006-1253 2006-03-18T20:02:00.000-05:00 2008-09-05T17:01:25.690-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov 2006-03-20T08:42:00.000-05:00 ALLOWS_OTHER_ACCESS CONFIRM http://www.glftpd.com/files/docs/changelog BID 17118 Unspecified vulnerability in glFTPd before 2.01 RC5 allows remote attackers to bypass IP checks via a crafted DNS hostname, possibly a hostname that appears to be an IP address. cpe:/h:borderware:mxtreme:5.0 cpe:/h:borderware:mxtreme:6.0 CVE-2006-1254 2006-03-18T20:02:00.000-05:00 2017-07-19T21:30:26.443-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1015787 BID 17140 VUPEN ADV-2006-0972 XF borderware-mxtreme-web-admin(25325) Unspecified vulnerability in BorderWare MXtreme 5.0 and 6.0 allows remote attackers to have an unknown impact via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. cpe:/a:mercur:mercur_messaging:2005_5.0_sp3 CVE-2006-1255 2006-03-18T20:02:00.000-05:00 2017-07-19T21:30:26.520-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS FULLDISC 20060316 Mercur IMAPD 5.0 SP3 DoS Exploit or more? FULLDISC 20060316 Re: Mercur IMAPD 5.0 SP3 DoS Exploit or more? BID 17138 VUPEN ADV-2006-0977 XF mercur-imap-bo(25290) Stack-based buffer overflow in the IMAP service in Mercur Messaging 5.0 SP3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string to the (1) LOGIN or (2) SELECT command, a different set of attack vectors and possibly a different vulnerability than CVE-2003-1177. cpe:/a:skullsplitter:php_guestbook:2.6 cpe:/a:skullsplitter:php_guestbook:2.7 CVE-2006-1256 2006-03-18T20:02:00.000-05:00 2018-10-18T12:31:45.357-04:00 2.6 NETWORK HIGH NONE NONE PARTIAL NONE http://nvd.nist.gov VIM 20060318 Vendor ACK for Skull-Splitter Guestbook XSS MISC http://evuln.com/vulns/104/summary.html SREASON 650 CONFIRM http://www.boysen.be/en/ BUGTRAQ 20060329 [eVuln] Skull-Splitter's PHP Guestbook XSS Vulnerability BID 17136 VUPEN ADV-2006-0974 XF skullsplitter-guestbook-xss(25293) Cross-site scripting (XSS) vulnerability in guestbook.php in Soren Boysen (SkullSplitter) PHP Guestbook 2.6 allows remote attackers to inject arbitrary web script or HTML via the url parameter. cpe:/a:microsoft:commerce_server:2002 cpe:/a:microsoft:commerce_server:2002:sp1 CVE-2006-1257 2006-03-18T20:02:00.000-05:00 2018-10-18T12:31:46.057-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://msdn.microsoft.com/library/default.asp?url=/library/en-us/csvr2002/htm/cs_se_securityconcepts_cbgw.asp SREASON 594 BUGTRAQ 20060316 Microsoft Commerce Server 2002: Logon as known user with a false password BID 17134 XF mscs-authfiles-authentication-bypass(25330) The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice. cpe:/a:phpmyadmin:phpmyadmin:2.8.0.1 CVE-2006-1258 2006-03-18T20:02:00.000-05:00 2017-07-19T21:30:26.693-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015776 CONFIRM http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0 BID 17142 VUPEN ADV-2006-0991 XF phpmyadmin-settheme-xss(25305) Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.1 allows remote attackers to inject arbitrary web script or HTML via the set_theme parameter. cpe:/a:maian:support:1.0 CVE-2006-1259 2006-03-18T20:02:00.000-05:00 2018-10-18T12:31:46.480-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/103/summary.html SREASON 645 BUGTRAQ 20060328 [eVuln] Maian Support Authentication Bypass VUPEN ADV-2006-0992 XF maiansupport-adminindex-sql-injection(25300) Multiple SQL injection vulnerabilities in Maian Support 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) email or (2) pass parameter to admin/index.php. cpe:/a:horde:horde:1.2 cpe:/a:horde:horde:1.2.1 cpe:/a:horde:horde:1.2.2 cpe:/a:horde:horde:1.2.3 cpe:/a:horde:horde:1.2.4 cpe:/a:horde:horde:1.2.5 cpe:/a:horde:horde:1.2.6 cpe:/a:horde:horde:1.2.7 cpe:/a:horde:horde:1.2.8 cpe:/a:horde:horde:2.0 cpe:/a:horde:horde:2.1 cpe:/a:horde:horde:2.1.3 cpe:/a:horde:horde:2.2 cpe:/a:horde:horde:2.2.1 cpe:/a:horde:horde:2.2.3 cpe:/a:horde:horde:2.2.4 cpe:/a:horde:horde:2.2.4_rc1 cpe:/a:horde:horde:2.2.5 cpe:/a:horde:horde:2.2.6 cpe:/a:horde:horde:2.2.7 cpe:/a:horde:horde:2.2.8 cpe:/a:horde:horde:2.2.9 cpe:/a:horde:horde:3.0 cpe:/a:horde:horde:3.0.1 cpe:/a:horde:horde:3.0.2 cpe:/a:horde:horde:3.0.3 cpe:/a:horde:horde:3.0.4 cpe:/a:horde:horde:3.0.4_rc1 cpe:/a:horde:horde:3.0.4_rc2 cpe:/a:horde:horde:3.0.6 cpe:/a:horde:horde:3.0.7 cpe:/a:horde:horde:3.0.8 cpe:/a:horde:horde:3.0.9 CVE-2006-1260 2006-03-18T21:02:00.000-05:00 2018-10-18T12:31:46.997-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov FULLDISC 20060315 CodeScan Advisory: Unauthenticated Arbitrary File Read in Horde v3.09 and prior SREASON 590 SECTRACK 1015771 DEBIAN DSA-1033 DEBIAN DSA-1034 GENTOO GLSA-200604-02 SUSE SUSE-SR:2006:009 BUGTRAQ 20060315 CodeScan Advisory: Unauthenticated Arbitrary File Read in Horde v3.09 and prior BID 17117 VUPEN ADV-2006-0959 XF horde-servicesgo-information-disclosure(25239) Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check. cpe:/a:aspportal:aspportal:3.0.0 CVE-2006-1261 2006-03-18T21:02:00.000-05:00 2017-07-19T21:30:26.880-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov FULLDISC 20060314 CodeScan Advisory: Multiple Vulnerabilities In ASPPortal.net BUGTRAQ 20060315 CodeScan Advisory: Multiple Vulnerabilities In ASPPortal.net SECTRACK 1015772 CONFIRM http://www.aspportal.net/content/news/News_Item.asp?content_ID=32 BID 17114 XF aspportal-multiple-xss(25235) Multiple cross-site scripting (XSS) vulnerabilities in ASPPortal 3.00 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors. cpe:/a:aspportal:aspportal:3.0.0 CVE-2006-1262 2006-03-18T21:02:00.000-05:00 2017-07-19T21:30:26.927-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS FULLDISC 20060314 CodeScan Advisory: Multiple Vulnerabilities In ASPPortal.net BUGTRAQ 20060315 CodeScan Advisory: Multiple Vulnerabilities In ASPPortal.net SREASON 592 SECTRACK 1015772 CONFIRM http://www.aspportal.net/content/news/News_Item.asp?content_ID=32 BID 17114 XF aspportal-multiple-scripts-sql-injection(25234) Multiple SQL injection vulnerabilities in ASPPortal 3.00 have unknown impact and attack vectors. cpe:/a:wordpress:wordpress:0.6.2:beta_2 cpe:/a:wordpress:wordpress:0.6.2.1:beta_2 cpe:/a:wordpress:wordpress:0.7 cpe:/a:wordpress:wordpress:0.71 cpe:/a:wordpress:wordpress:1.2 cpe:/a:wordpress:wordpress:1.2.1 cpe:/a:wordpress:wordpress:1.2.2 cpe:/a:wordpress:wordpress:1.5 cpe:/a:wordpress:wordpress:1.5.1 cpe:/a:wordpress:wordpress:1.5.1.2 cpe:/a:wordpress:wordpress:1.5.1.3 cpe:/a:wordpress:wordpress:1.5.2 cpe:/a:wordpress:wordpress:2.0 cpe:/a:wordpress:wordpress:2.0.1 CVE-2006-1263 2006-03-18T21:02:00.000-05:00 2008-09-05T17:01:27.440-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov 2006-03-20T09:43:00.000-05:00 CONFIRM http://wordpress.org/development/2006/03/security-202/ BID 17069 Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors. cpe:/a:xhawk.net:discussion:2.0_beta2 CVE-2006-1264 2006-03-18T21:02:00.000-05:00 2018-10-18T12:31:48.417-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/92/summary.html BUGTRAQ 20060315 [eVuln] discussion - xhawk.net BBCode 'img' XSS & SQL Injection Vulnerabilities BID 17119 XF discussion-bbcode-xss(25236) Cross-site scripting (XSS) vulnerability in xhawk.net discussion 2.0 beta2 allows remote attackers to inject arbitrary web script or HTML via a Javascript URI in a BBCode img tag. cpe:/a:xhawk.net:discussion:2.0_beta2 CVE-2006-1265 2006-03-18T21:02:00.000-05:00 2018-10-18T12:31:48.807-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://evuln.com/vulns/92/summary.html BUGTRAQ 20060315 [eVuln] discussion - xhawk.net BBCode 'img' XSS & SQL Injection Vulnerabilities BID 17121 XF discussion-class-sql-injection(25237) SQL injection vulnerability in discussion.class.php in xhawk.net discussion 2.0 beta2 allows remote attackers to execute arbitrary SQL commands via the view parameter. cpe:/a:virtual_communication_services:vpmi_enterprise:3.3 CVE-2006-1266 2006-03-18T21:02:00.000-05:00 2017-07-19T21:30:27.083-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov VIM 20060314 vendor dispute: VCS BID 17172 XF vpmi-servicerequests-xss(25339) Cross-site scripting (XSS) vulnerability in Service_Requests.asp in VPMi Enterprise 3.3 allows remote attackers to inject arbitrary web script or HTML via the Request_Name_Display parameter. cpe:/a:invision_power_services:invision_power_board:2.1.4 CVE-2006-1267 2006-03-18T21:02:00.000-05:00 2018-10-18T12:31:49.167-04:00 5.1 NETWORK HIGH NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS BUGTRAQ 20060314 Invision Power Board v2.1.4 - session hijacking BUGTRAQ 20060316 Re: Invision Power Board v2.1.4 - session hijacking Invision Power Board 2.1.4 allows remote attackers to hijack sessions and possibly gain administrative privileges by obtaining the session ID from the s parameter, then replaying it in another request. cpe:/h:funkwerk:x2300:7.2.1 CVE-2006-1268 2006-03-18T21:02:00.000-05:00 2011-03-07T21:32:36.407-05:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov CONFIRM http://www.funkwerk-ec.com/portal/downloadcenter/dateien/x2300/r7201p09/readme_721p9.pdf BID 17124 VUPEN ADV-2006-0958 The Internet Key Exchange implementation in Funkwerk X2300 7.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite. NOTE: due to the lack of details in the advisory, it is unclear which of CVE-2005-3666, CVE-2005-3667, and/or CVE-2005-3668 this issue applies to. cpe:/a:rahul_dhesi:zoo:2.10 CVE-2006-1269 2006-03-18T21:02:00.000-05:00 2017-07-19T21:30:27.147-04:00 6.2 LOCAL HIGH NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS GENTOO GLSA-200603-12 BID 17126 VUPEN ADV-2006-0969 MISC https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=183426 XF zoo-parse-bo(25264) Buffer overflow in the parse function in parse.c in zoo 2.10 might allow local users to execute arbitrary code via long filename command line arguments, which are not properly handled during archive creation. NOTE: since this issue is local and not setuid, the set of attack scenarios is limited, although is reasonable to expect that there are some situations in which the zoo user might automatically list attacker-controlled filenames to add to the zoo archive. cpe:/a:inprotect:inprotect:0.21 CVE-2006-1270 2006-03-18T21:02:00.000-05:00 2017-07-19T21:30:27.207-04:00 3.5 NETWORK MEDIUM SINGLE_INSTANCE NONE PARTIAL NONE http://nvd.nist.gov BID 17141 VUPEN ADV-2006-0970 XF inprotect-zones-xss(25280) Multiple cross-site scripting (XSS) vulnerabilities in zones.php in Inprotect 0.21 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Description field. NOTE: the provenance of this information is unknown; the details are obtained from third party information. cpe:/a:oxynews:oxynews CVE-2006-1271 2006-03-18T21:02:00.000-05:00 2018-10-18T12:31:49.340-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://biyosecurity.be/bugs/oxynews.txt BUGTRAQ 20060316 Oxynews Sql &#304;njection BID 17132 VUPEN ADV-2006-0976 XF oxynews-index-sql-injection(25301) SQL injection vulnerability in index.php in OxyNews allows remote attackers to execute arbitrary SQL commands via the oxynews_comment_id parameter. cpe:/a:mybulletinboard:mybulletinboard:1.0.3 CVE-2006-1272 2006-03-18T21:02:00.000-05:00 2018-10-18T12:31:49.793-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov MISC http://community.mybboard.net/showthread.php?tid=7368 MISC http://kapda.ir/advisory-297.html BUGTRAQ 20060314 [[KAPDA::#35] MyBB 1.0.3~member.php~XSS Attack in contact details BID 17097 XF mybb-member-xss(25263) Multiple cross-site scripting (XSS) vulnerabilities in member.php in MyBulletin Board (MyBB) 1.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) aim, (2) yahoo, (3) msn, or (4) website field. cpe:/a:mozilla:firefox:1.0.7 cpe:/a:mozilla:firefox:1.5.0.1 CVE-2006-1273 2006-03-19T06:06:00.000-05:00 2018-10-18T12:31:50.217-04:00 7.8 NETWORK LOW NONE NONE NONE COMPLETE http://nvd.nist.gov SREASON 593 BUGTRAQ 20060317 Re: Re: Remote overflow in MSIE script action handlers (mshtml.dll) BUGTRAQ 20060318 Re: Re: Remote overflow in MSIE script action handlers (mshtml.dll) ** DISPUTED ** Mozilla Firefox 1.0.7 and 1.5.0.1 allows remote attackers to cause a denial of service (crash) via an HTML tag with a large number of script action handlers such as onload and onmouseover, which triggers the crash when the user views the page source. NOTE: Red Hat has disputed this issue, suggesting that "It is likely the reporter was running the IE Tab extension," and Mozilla also confirmed that this is not an issue in Firefox itself. cpe:/a:avira:antivir_personal:::premium cpe:/a:avira:antivir_personal:7::classic CVE-2006-1274 2006-03-19T06:06:00.000-05:00 2018-10-18T12:31:50.527-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS FULLDISC 20060311 AntiVir PersonalEdition Classic: Local Privilige Escalation SREASON 573 BUGTRAQ 20060311 AntiVir PersonalEdition Classic: Local Privilige Escalation BID 17071 VUPEN ADV-2006-0948 XF antivir-notepad-gain-privilege(25244) Classic Planer in AntiVir PersonalEdition Classic 7 does not drop privileges before executing external programs, which allows local users to gain privileges via notepad.exe, which is used to display scan reports. cpe:/a:ggz_gaming_zone:ggz_gaming_zone:0.0.12 CVE-2006-1275 2006-03-19T06:06:00.000-05:00 2017-07-19T21:30:27.443-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://aluigi.altervista.org/adv/ggzcdos-adv.txt BID 17094 VUPEN ADV-2006-0935 XF ggzgaminzone-xml-dos(25164) GGZ Gaming Zone 0.0.12 allows remote attackers to cause a denial of service (client disconnect) via inputs that produce malformed XML, including (1) trailing ' (apostrophe) character on the ID attribute in a PLAYER XML tag, (2) joining with a long ID attribute or non-trailing ' characters, which causes a <none> name to be assigned, and then disconnecting, or (3) a long CDATA message attribute, which prevents closing tags from being added to the string. cpe:/a:himpfen_consulting:php_simplenews:1.0.0 CVE-2006-1276 2006-03-19T06:06:00.000-05:00 2017-07-19T21:30:27.503-04:00 10.0 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS MISC http://evuln.com/vulns/94/summary.html SREASON 613 BUGTRAQ 20060322 [eVuln] PHP SimpleNEWS, PHP SimpleNEWS MySQL - Authentication Bypass Vulnerability BID 17186 VUPEN ADV-2006-0913 XF simplenews-admin-bypass-security(25177) admin.php in Himpfen Consulting Company PHP SimpleNEWS 1.0.0 allows remote attackers to bypass authentication by setting the admin parameter in a cookie. cpe:/a:upoint:at1_file_store:2006.03.07 CVE-2006-1277 2006-03-19T06:06:00.000-05:00 2018-10-18T12:31:51.043-04:00 5.8 NETWORK MEDIUM NONE PARTIAL PARTIAL NONE http://nvd.nist.gov MISC http://evuln.com/vulns/95/summary.html SECTRACK 1015826 BUGTRAQ 20060324 [eVuln] @1 File Store Multiple XSS and SQL Injection Vulnerabilities BID 17090 VUPEN ADV-2006-0943 XF filestore-signup-xss(25182) Cross-site scripting (XSS) vulnerability in signup.php in @1 File Store 2006.03.07 allows remote attackers to inject arbitrary web script or HTML via the (1) real_name, (2) email, and (3) login parameters. cpe:/a:upoint:%401_file_store:2006.03.07 CVE-2006-1278 2006-03-19T06:06:00.000-05:00 2018-10-18T12:31:51.590-04:00 6.8 NETWORK MEDIUM NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov MISC http://evuln.com/vulns/95/summary.html SREASON 619 SECTRACK 1015826 VIM 20090825 @1 File Store PRO SQL injection - the old gray dupe BUGTRAQ 20060324 [eVuln] @1 File Store Multiple XSS and SQL Injection Vulnerabilities BID 17090 BID 30182 VUPEN ADV-2006-0943 XF filestore-multiple-sql-injection(25183) XF filestorepro-id-sql-injection(43718) XF filestorepro-download-file-include(43724) EXPLOIT-DB 6040 SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) functions.php and (2) user.php in the libs directory, (3) edit.php and (4) delete.php in control/files/, (5) edit.php and (6) delete.php in control/users/, (7) edit.php, (8) access.php, and (9) in control/folders/, (10) access.php and (11) delete.php in control/groups/, (12) confirm.php, and (13) download.php; (14) the email parameter in password.php, and (15) the id parameter in folder.php. NOTE: it was later reported that vectors 12 and 13 also affect @1 File Store PRO 3.2. cpe:/a:sherzod_ruzmetov:cgi_session:4.03 CVE-2006-1279 2006-03-19T06:06:00.000-05:00 2017-07-19T21:30:27.693-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356555 BID 17177 VUPEN ADV-2006-0946 XF cgisession-cgisess-information-disclosure(25285) CGI::Session 4.03-1 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by (1) Driver::File, (2) Driver::db_file, and possibly (3) Driver::sqlite. cpe:/a:sherzod_ruzmetov:cgi_session:4.03 CVE-2006-1280 2006-03-19T06:06:00.000-05:00 2017-07-19T21:30:27.753-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356555 BID 17099 VUPEN ADV-2006-0946 XF cgisession-driver-files-insecure-permissions(25283) CGI::Session 4.03-1 does not set proper permissions on temporary files created in (1) Driver::File and (2) Driver::db_file, which allows local users to obtain privileged information, such as session keys, by viewing the files. cpe:/a:mybulletinboard:mybulletinboard:1.0.1 cpe:/a:mybulletinboard:mybulletinboard:1.0.2 cpe:/a:mybulletinboard:mybulletinboard:1.0.3 cpe:/a:mybulletinboard:mybulletinboard:1.0.4 cpe:/a:mybulletinboard:mybulletinboard:1.0_final cpe:/a:mybulletinboard:mybulletinboard:1.0_pr2 cpe:/a:mybulletinboard:mybulletinboard:1.10 cpe:/a:mybulletinboard:mybulletinboard:rc1 cpe:/a:mybulletinboard:mybulletinboard:rc2 cpe:/a:mybulletinboard:mybulletinboard:rc3 cpe:/a:mybulletinboard:mybulletinboard:rc4 CVE-2006-1281 2006-03-19T06:06:00.000-05:00 2018-10-18T12:31:54.357-04:00 3.5 NETWORK MEDIUM SINGLE_INSTANCE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://community.mybboard.net/showthread.php?tid=7368 MISC http://kapda.ir/advisory-296.html MISC http://myimei.com/security/2006-03-09/mybb104memberphpxss-after-login.html BUGTRAQ 20060314 [KAPDA::#35] - MyBB1.0.4~member.php~XSS after login BID 17097 BID 17492 VUPEN ADV-2006-0971 XF mybb-member-url-xss(25266) Cross-site scripting (XSS) vulnerability in member.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vulnerability than CVE-2006-1272. NOTE: 1.10 was later reported to be vulnerable. cpe:/a:mybulletinboard:mybulletinboard:1.0.1 cpe:/a:mybulletinboard:mybulletinboard:1.0.2 cpe:/a:mybulletinboard:mybulletinboard:1.0.3 cpe:/a:mybulletinboard:mybulletinboard:1.0.4 cpe:/a:mybulletinboard:mybulletinboard:1.0_final cpe:/a:mybulletinboard:mybulletinboard:1.0_pr2 cpe:/a:mybulletinboard:mybulletinboard:rc1 cpe:/a:mybulletinboard:mybulletinboard:rc2 cpe:/a:mybulletinboard:mybulletinboard:rc3 cpe:/a:mybulletinboard:mybulletinboard:rc4 CVE-2006-1282 2006-03-19T06:06:00.000-05:00 2018-10-18T12:31:55.120-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov CONFIRM http://community.mybboard.net/showthread.php?tid=7368 MISC http://kapda.ir/advisory-295.html MISC http://myimei.com/security/2006-03-10/mybb104redirectfunctionheaderinjection.html BUGTRAQ 20060314 [KAPDA::#34] - MyBB1.0.4~redirectfunction()~HeaderInjection BID 17097 XF mybb-crlf-header-injection(25267) CRLF injection vulnerability in inc/function.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to conduct cross-site scripting (XSS), poison caches, or hijack pages via CRLF (%0A%0D) sequences in the Referrer HTTP header field, possibly when redirecting to other web pages. cpe:/o:freebsd:freebsd:1.1.5.1 cpe:/o:freebsd:freebsd:2.0 cpe:/o:freebsd:freebsd:2.0.5 cpe:/o:freebsd:freebsd:2.1:stable cpe:/o:freebsd:freebsd:2.1.0 cpe:/o:freebsd:freebsd:2.1.5 cpe:/o:freebsd:freebsd:2.1.6 cpe:/o:freebsd:freebsd:2.1.6.1 cpe:/o:freebsd:freebsd:2.1.7 cpe:/o:freebsd:freebsd:2.1.7.1 cpe:/o:freebsd:freebsd:2.2 cpe:/o:freebsd:freebsd:2.2.1 cpe:/o:freebsd:freebsd:2.2.2 cpe:/o:freebsd:freebsd:2.2.3 cpe:/o:freebsd:freebsd:2.2.4 cpe:/o:freebsd:freebsd:2.2.5 cpe:/o:freebsd:freebsd:2.2.6 cpe:/o:freebsd:freebsd:2.2.7 cpe:/o:freebsd:freebsd:2.2.8 cpe:/o:freebsd:freebsd:3.0 cpe:/o:freebsd:freebsd:3.0:releng cpe:/o:freebsd:freebsd:3.1 cpe:/o:freebsd:freebsd:3.2 cpe:/o:freebsd:freebsd:3.3 cpe:/o:freebsd:freebsd:3.4 cpe:/o:freebsd:freebsd:3.5 cpe:/o:freebsd:freebsd:3.5:stable cpe:/o:freebsd:freebsd:3.5.1 cpe:/o:freebsd:freebsd:3.5.1:release cpe:/o:freebsd:freebsd:3.5.1:stable cpe:/o:freebsd:freebsd:4.0 cpe:/o:freebsd:freebsd:4.0:alpha cpe:/o:freebsd:freebsd:4.0:releng cpe:/o:freebsd:freebsd:4.1 cpe:/o:freebsd:freebsd:4.1.1 cpe:/o:freebsd:freebsd:4.1.1:release cpe:/o:freebsd:freebsd:4.1.1:stable cpe:/o:freebsd:freebsd:4.2 cpe:/o:freebsd:freebsd:4.2:stable cpe:/o:freebsd:freebsd:4.3 cpe:/o:freebsd:freebsd:4.3:release cpe:/o:freebsd:freebsd:4.3:release_p38 cpe:/o:freebsd:freebsd:4.3:releng cpe:/o:freebsd:freebsd:4.3:stable cpe:/o:freebsd:freebsd:4.4 cpe:/o:freebsd:freebsd:4.4:release_p42 cpe:/o:freebsd:freebsd:4.4:releng cpe:/o:freebsd:freebsd:4.4:stable cpe:/o:freebsd:freebsd:4.5 cpe:/o:freebsd:freebsd:4.5:release cpe:/o:freebsd:freebsd:4.5:release_p32 cpe:/o:freebsd:freebsd:4.5:releng cpe:/o:freebsd:freebsd:4.5:stable cpe:/o:freebsd:freebsd:4.6 cpe:/o:freebsd:freebsd:4.6:release cpe:/o:freebsd:freebsd:4.6:release_p20 cpe:/o:freebsd:freebsd:4.6:releng cpe:/o:freebsd:freebsd:4.6:stable cpe:/o:freebsd:freebsd:4.6.2 cpe:/o:freebsd:freebsd:4.7 cpe:/o:freebsd:freebsd:4.7:release cpe:/o:freebsd:freebsd:4.7:release_p17 cpe:/o:freebsd:freebsd:4.7:releng cpe:/o:freebsd:freebsd:4.7:stable cpe:/o:freebsd:freebsd:4.8 cpe:/o:freebsd:freebsd:4.8:pre-release cpe:/o:freebsd:freebsd:4.8:release_p7 cpe:/o:freebsd:freebsd:4.8:releng cpe:/o:freebsd:freebsd:4.9 cpe:/o:freebsd:freebsd:4.9:pre-release cpe:/o:freebsd:freebsd:4.9:releng cpe:/o:freebsd:freebsd:4.10 cpe:/o:freebsd:freebsd:4.10:release cpe:/o:freebsd:freebsd:4.10:release_p8 cpe:/o:freebsd:freebsd:4.10:releng cpe:/o:freebsd:freebsd:4.11:release_p3 cpe:/o:freebsd:freebsd:4.11:releng cpe:/o:freebsd:freebsd:4.11:stable cpe:/o:freebsd:freebsd:5.0 cpe:/o:freebsd:freebsd:5.0:alpha cpe:/o:freebsd:freebsd:5.0:release_p14 cpe:/o:freebsd:freebsd:5.0:releng cpe:/o:freebsd:freebsd:5.1 cpe:/o:freebsd:freebsd:5.1:alpha cpe:/o:freebsd:freebsd:5.1:release cpe:/o:freebsd:freebsd:5.1:release_p5 cpe:/o:freebsd:freebsd:5.1:releng cpe:/o:freebsd:freebsd:5.2 cpe:/o:freebsd:freebsd:5.2.1:release cpe:/o:freebsd:freebsd:5.2.1:releng cpe:/o:freebsd:freebsd:5.3 cpe:/o:freebsd:freebsd:5.3:release cpe:/o:freebsd:freebsd:5.3:releng cpe:/o:freebsd:freebsd:5.3:stable cpe:/o:freebsd:freebsd:5.4:pre-release cpe:/o:freebsd:freebsd:5.4:release cpe:/o:freebsd:freebsd:5.4:releng cpe:/o:freebsd:freebsd:5.4:stable cpe:/o:freebsd:freebsd:6.0:release cpe:/o:freebsd:freebsd:6.0:stable CVE-2006-1283 2006-03-23T15:06:00.000-05:00 2017-07-19T21:30:27.957-04:00 7.2 LOCAL LOW NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS FREEBSD FreeBSD-SA-06:12 SECTRACK 1015817 BID 17194 VUPEN ADV-2006-1074 XF bsd-opie-unauthorized-privileges(25397) opiepasswd in One-Time Passwords in Everything (OPIE) in FreeBSD 4.10-RELEASE-p22 through 6.1-STABLE before 20060322 uses the getlogin function to determine the invoking user account, which might allow local users to configure OPIE access to the root account and possibly gain root privileges if a root shell is permitted by the configuration of the wheel group or sshd. cpe:/a:symantec:ghost_solutions_suite:1.0 cpe:/a:symantec:norton_ghost:8.0 cpe:/a:symantec:norton_ghost:8.2 CVE-2006-1284 2006-03-19T18:02:00.000-05:00 2011-03-07T21:32:42.547-05:00 4.6 LOCAL LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://securityresponse.symantec.com/avcenter/security/Content/2006.03.07.html SECTRACK 1015733 BID 17018 VUPEN ADV-2006-0870 The installation of SQLAnywhere in Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, includes a default administrator login account and password, which allows local users to gain privileges or modify tasks. cpe:/a:symantec:ghost_solutions_suite:1.0 cpe:/a:symantec:norton_ghost:8.0 cpe:/a:symantec:norton_ghost:8.2 CVE-2006-1285 2006-03-19T18:02:00.000-05:00 2011-03-07T21:32:42.643-05:00 3.2 LOCAL LOW SINGLE_INSTANCE PARTIAL PARTIAL NONE http://nvd.nist.gov CONFIRM http://securityresponse.symantec.com/avcenter/security/Content/2006.03.07.html SECTRACK 1015733 BID 17019 VUPEN ADV-2006-0870 SQLAnywhere in Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, gives read and write permissions to all users for database shared memory sections, which allows local users to access and possibly modify certain information. cpe:/a:symantec:ghost_solutions_suite:1.0 cpe:/a:symantec:norton_ghost:8.0 cpe:/a:symantec:norton_ghost:8.2 CVE-2006-1286 2006-03-19T18:02:00.000-05:00 2017-07-19T21:30:28.020-04:00 2.1 LOCAL LOW NONE PARTIAL NONE NONE http://nvd.nist.gov CONFIRM http://securityresponse.symantec.com/avcenter/security/Content/2006.03.07.html SECTRACK 1015733 VUPEN ADV-2006-0870 XF ghost-dbisqlc-bo(25089) Buffer overflow in the login dialog in dbisqlc.exe in SQLAnywhere for Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, might allow local users to read certain sensitive information from the database. cpe:/a:invision_power_services:invision_power_board:2.0.4 cpe:/a:invision_power_services:invision_power_board:2.1.4 CVE-2006-1287 2006-03-19T18:02:00.000-05:00 2011-03-07T21:32:42.860-05:00 5.8 NETWORK MEDIUM NONE PARTIAL PARTIAL NONE http://nvd.nist.gov CONFIRM http://forums.invisionpower.com/index.php?showtopic=206790 VUPEN ADV-2006-0861 Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB) 2.0.4 and 2.1.4 before 20060130 allows remote attackers to steal cookies and probably conduct other activities when the victim is using Internet Explorer. cpe:/a:invision_power_services:invision_power_board:2.0.4 cpe:/a:invision_power_services:invision_power_board:2.1.4 CVE-2006-1288 2006-03-19T18:02:00.000-05:00 2017-07-19T21:30:28.083-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://forums.invisionpower.com/index.php?act=Attach&type=post&id=9642 CONFIRM http://forums.invisionpower.com/index.php?showtopic=204627 VUPEN ADV-2006-0861 XF invision-multiple-sql-injection(25100) Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to (1) arrays of id/stamp pairs and (2) the keys in arrays of key/value pairs in ipsclass.php; (3) the topics variable in usercp.php; and the topicsread cookie in (4) topics.php, (5) search.php, and (6) forums.php. cpe:/a:milkeyway:milkeyway_captive_portal:0.1 cpe:/a:milkeyway:milkeyway_captive_portal:0.1.1 CVE-2006-1289 2006-03-19T18:02:00.000-05:00 2018-10-18T12:31:55.560-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS SECTRACK 1015778 BUGTRAQ 20060316 Milkeyway Multiple Vulnerabilities BID 17127 MISC http://www.ush.it/team/ascii/hack-milkeway/advisory.txt MISC http://www.ush.it/team/ascii/hack-milkeway/milkeyway.txt VUPEN ADV-2006-0968 XF milkeyway-multiple-sql-injection(25281) XF milkeyway-admin-sql-injection(25287) Multiple SQL injection vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) password, (3) team, (4) level, (5) status, (6) teamname, and (7) teamlead parameters in (a) auth.php; the (8) username, (9) action, and (10) filter parameters in (b) authuser.php; the (11) username parameter in (c) utils.php; the (12) id and (13) date parameters in (d) traffic.php; the (14) username parameter in (e) userstatistics.php; and the (15) USERNAME and (16) PASSWORD parameters in a cookie to (f) chgpwd.php. cpe:/a:milkeyway:milkeyway_captive_portal:0.1 cpe:/a:milkeyway:milkeyway_captive_portal:0.1.1 CVE-2006-1290 2006-03-19T18:02:00.000-05:00 2018-10-18T12:31:56.573-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SECTRACK 1015778 BUGTRAQ 20060316 Milkeyway Multiple Vulnerabilities BID 17127 MISC http://www.ush.it/team/ascii/hack-milkeway/advisory.txt MISC http://www.ush.it/team/ascii/hack-milkeway/milkeyway.txt VUPEN ADV-2006-0968 XF milkeyway-multiple-xss(25288) Multiple cross-site scripting (XSS) vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) ipAddress, (2) act, (3) username, and (4) unspecified other parameters in (a) authuser.php; and the (5) username and (6) unspecified other parameters in (b) userstatistics.php. cpe:/a:php_icalendar:php_icalendar:2.0 cpe:/a:php_icalendar:php_icalendar:2.0.1 cpe:/a:php_icalendar:php_icalendar:2.0a2 cpe:/a:php_icalendar:php_icalendar:2.0b cpe:/a:php_icalendar:php_icalendar:2.0c cpe:/a:php_icalendar:php_icalendar:2.1 cpe:/a:php_icalendar:php_icalendar:2.2.1 CVE-2006-1291 2006-03-19T18:02:00.000-05:00 2017-10-10T21:30:42.717-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS MISC http://downloads.securityfocus.com/vulnerabilities/exploits/php-iCalendar-221.upload.php BID 17129 VUPEN ADV-2006-1019 EXPLOIT-DB 1586 publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write access to the calendars directory, which allows remote attackers to upload and execute arbitrary PHP scripts via a WebDAV PUT request with a filename containing a .php extension and a trailing null character. cpe:/a:php_icalendar:php_icalendar:2.0 cpe:/a:php_icalendar:php_icalendar:2.0.1 cpe:/a:php_icalendar:php_icalendar:2.0a2 cpe:/a:php_icalendar:php_icalendar:2.0b cpe:/a:php_icalendar:php_icalendar:2.0c cpe:/a:php_icalendar:php_icalendar:2.1 cpe:/a:php_icalendar:php_icalendar:2.2.1 CVE-2006-1292 2006-03-19T18:02:00.000-05:00 2017-10-10T21:30:42.780-04:00 5.0 NETWORK LOW NONE NONE PARTIAL NONE http://nvd.nist.gov BID 17125 VUPEN ADV-2006-1019 EXPLOIT-DB 1585 Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the phpicalendar[cookie_language] and phpicalendar[cookie_style] cookies, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by day.php. cpe:/a:astalavista_it_engineering:contrexx:1.0.4 cpe:/a:astalavista_it_engineering:contrexx:1.0.5 cpe:/a:astalavista_it_engineering:contrexx:1.0.7 cpe:/a:astalavista_it_engineering:contrexx:1.0.8 CVE-2006-1293 2006-03-19T18:02:00.000-05:00 2018-10-18T12:31:57.230-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov SREASON 599 MISC http://soot.shabgard.org/Contrexx-CMS.txt MISC http://www.contrexx.com/?section=media1&act=download&path=/media/archive1/Opensource/Bugfixes/contrexx_1.0.8/&file=contrexx_v1.0.8_bugfix_27-02-06.zip MISC http://www.contrexx.com/?section=news&cmd=details&newsid=54 BUGTRAQ 20060318 Contrexx CMS Xss Vuln BID 17128 VUPEN ADV-2006-1013 XF contrexx-index-xss(25332) Cross-site scripting (XSS) vulnerability in index.php in Contrexx CMS 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF). cpe:/a:knowledgebasepublisher:knowledgebasepublisher:1.2 CVE-2006-1294 2006-03-19T18:02:00.000-05:00 2017-10-10T21:30:42.860-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_OTHER_ACCESS CONFIRM http://sourceforge.net/project/shownotes.php?release_id=402179&group_id=144153 BID 17120 VUPEN ADV-2006-1020 XF knowledgebasepublisher-dir-file-include(25338) EXPLOIT-DB 1587 PHP remote file include vulnerability in PageController.php in KnowledgebasePublisher 1.2 allows remote attackers to include and execute arbitrary PHP code via a URL in the dir parameter. cpe:/a:spip:spip:1.8.2e cpe:/a:spip:spip:1.8.2g CVE-2006-1295 2006-03-19T18:02:00.000-05:00 2017-07-19T21:30:28.363-04:00 4.3 NETWORK MEDIUM NONE NONE PARTIAL NONE http://nvd.nist.gov BID 17130 MISC http://www.silitix.com/spip-xss.html MISC http://www.zone-h.fr/advisories/read/id=1105 CONFIRM http://zone.spip.org/trac/spip-zone/changeset/1672 XF spip-research-xss(25389) Cross-site scripting (XSS) vulnerability in recherche.php3 in SPIP 1.8.2-g allows remote attackers to inject arbitrary web script or HTML via the recherche parameter. cpe:/a:beagle-project:beagle:0.2.2.1 CVE-2006-1296 2006-03-19T18:02:00.000-05:00 2017-07-19T21:30:28.473-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS MISC http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=357392 FEDORA FEDORA-2006-188 BID 17195 XF beagle-beagle-status-privilege-escalation(25303) Untrusted search path vulnerability in Beagle 0.2.2.1 might allow local users to gain privileges via a malicious beagle-info program in the current working directory, or possibly directories specified in the PATH. cpe:/a:symantec_veritas:backup_exec:netware_server_9.1 cpe:/a:symantec_veritas:backup_exec:netware_server_9.2 cpe:/a:symantec_veritas:backup_exec_remote_agent:netware_server_9.1 cpe:/a:symantec_veritas:backup_exec_remote_agent:netware_server_9.2 cpe:/a:symantec_veritas:backup_exec_remote_agent:unix_linux_server_10.1 cpe:/a:symantec_veritas:backup_exec_remote_agent:windows_server_9.1 cpe:/a:symantec_veritas:backup_exec_remote_agent:windows_server_10.0 cpe:/a:symantec_veritas:backup_exec_remote_agent:windows_server_10.1 CVE-2006-1297 2006-03-19T18:02:00.000-05:00 2018-10-18T12:31:57.840-04:00 5.0 NETWORK LOW NONE NONE NONE PARTIAL http://nvd.nist.gov SREASON 597 SECTRACK 1015784 BUGTRAQ 20060317 Symantec Security Advisory SYM06-004 BID 17098 CONFIRM http://www.symantec.com/avcenter/security/Content/2006.03.17a.html VUPEN ADV-2006-0995 XF backupexec-app-memory-dos(25309) Unspecified vulnerability in Veritas Backup Exec for Windows Server Remote Agent 9.1 through 10.1, for Netware Servers and Remote Agent 9.1 and 9.2, and Remote Agent for Linux Servers 10.0 and 10.1 allow attackers to cause a denial of service (application crash or unavailability) due to "memory errors." cpe:/a:symantec_veritas:backup_exec:9.1 cpe:/a:symantec_veritas:backup_exec:10.0::windows_servers CVE-2006-1298 2006-03-19T18:02:00.000-05:00 2018-10-18T12:31:58.417-04:00 4.6 NETWORK HIGH SINGLE_INSTANCE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1015785 CONFIRM http://support.veritas.com/docs/282254 BUGTRAQ 20060320 Symantec Security Advisory, SYM06-005 BID 17096 CONFIRM http://www.symantec.com/avcenter/security/Content/2006.03.17b.html VUPEN ADV-2006-0996 XF backupexec-bengine-format-string(25310) Format string vulnerability in the Job Engine service (bengine.exe) in the Media Server in Veritas Backup Exec 10d (10.1) for Windows Servers rev. 5629, Backup Exec 10.0 for Windows Servers rev. 5520, Backup Exec 10.0 for Windows Servers rev. 5484, and Backup Exec 9.1 for Windows Servers rev. 4691, when the job log mode is Full Detailed (aka Full Details), allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted filename on a machine that is backed up by Backup Exec. CVE-2006-1299 2017-05-11T10:29:03.683-04:00 2017-05-11T10:29:03.683-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2006. Notes: none. cpe:/a:microsoft:.net_framework:2.0 CVE-2006-1300 2006-07-11T17:05:00.000-04:00 2018-10-12T17:39:17.307-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SECTRACK 1016465 BID 18920 VUPEN ADV-2006-2751 MS MS06-033 XF ms-aspnet-appcode-information-disclosure(26802) Microsoft .NET framework 2.0 (ASP.NET) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to bypass access restrictions via unspecified "URL paths" that can access Application Folder objects "explicitly by name." cpe:/a:microsoft:excel:2000 cpe:/a:microsoft:excel:2000:sp2 cpe:/a:microsoft:excel:2000:sp3 cpe:/a:microsoft:excel:2000:sr1 cpe:/a:microsoft:excel:2002 cpe:/a:microsoft:excel:2002:sp1 cpe:/a:microsoft:excel:2002:sp2 cpe:/a:microsoft:excel:2002:sp3 cpe:/a:microsoft:excel:2003 cpe:/a:microsoft:excel:2003:sp1 cpe:/a:microsoft:excel:2004::mac_os_x cpe:/a:microsoft:excel:x::mac_os_x cpe:/a:microsoft:excel_viewer:2003 CVE-2006-1301 2006-07-13T18:05:00.000-04:00 2018-10-12T17:39:18.057-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1016472 BID 18853 VUPEN ADV-2006-2755 MS MS06-037 Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted SELECTION record that triggers memory corruption, a different vulnerability than CVE-2006-1302. cpe:/a:microsoft:excel:2000 cpe:/a:microsoft:excel:2000:sp2 cpe:/a:microsoft:excel:2000:sp3 cpe:/a:microsoft:excel:2000:sr1 cpe:/a:microsoft:excel:2002 cpe:/a:microsoft:excel:2002:sp1 cpe:/a:microsoft:excel:2002:sp2 cpe:/a:microsoft:excel:2002:sp3 cpe:/a:microsoft:excel:2003 cpe:/a:microsoft:excel:2003:sp1 cpe:/a:microsoft:excel:2004::mac_os_x cpe:/a:microsoft:excel:x::mac_os_x cpe:/a:microsoft:excel_viewer:2003 CVE-2006-1302 2006-07-13T17:05:00.000-04:00 2018-10-18T12:31:58.933-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SREASON 1238 SECTRACK 1016472 MISC http://www.nsfocus.com/english/homepage/research/0605.htm BUGTRAQ 20060712 NSFOCUS SA2006-05 : Microsoft Excel SELECTION Record Memory Corruption Vulnerability BID 18885 VUPEN ADV-2006-2755 MS MS06-037 Buffer overflow in Microsoft Excel 2000 through 2003 allows user-assisted attackers to execute arbitrary code via a .xls file with certain crafted fields in a SELECTION record, which triggers memory corruption, aka "Malformed SELECTION record Vulnerability." cpe:/a:microsoft:ie:5.0.1 cpe:/a:microsoft:ie:5.0.1::windows_2000 cpe:/a:microsoft:ie:5.0.1::windows_95 cpe:/a:microsoft:ie:5.0.1::windows_98 cpe:/a:microsoft:ie:5.0.1::windows_nt_4.0 cpe:/a:microsoft:ie:5.0.1:sp1 cpe:/a:microsoft:ie:5.0.1:sp2 cpe:/a:microsoft:ie:5.0.1:sp3 cpe:/a:microsoft:ie:5.0.1:sp4 cpe:/a:microsoft:ie:6.0 cpe:/a:microsoft:ie:6.0:sp1 CVE-2006-1303 2006-06-13T15:06:00.000-04:00 2018-10-18T12:31:59.560-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1016291 CERT-VN VU#959049 BUGTRAQ 20060613 ZDI-06-018: Microsoft Internet Explorer DXImageTransform ActiveX Memory Corruption Vulnerability BID 18328 VUPEN ADV-2006-2319 MISC http://www.zerodayinitiative.com/advisories/ZDI-06-018.html MS MS06-021 XF ie-wmm2fxadll-execute-code(26774) Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection. cpe:/a:microsoft:excel:2000 cpe:/a:microsoft:excel:2000:sp2 cpe:/a:microsoft:excel:2000:sp3 cpe:/a:microsoft:excel:2000:sr1 cpe:/a:microsoft:excel:2002 cpe:/a:microsoft:excel:2002:sp1 cpe:/a:microsoft:excel:2002:sp2 cpe:/a:microsoft:excel:2002:sp3 cpe:/a:microsoft:excel:2003 cpe:/a:microsoft:excel:2003:sp1 cpe:/a:microsoft:excel:x::mac_os_x cpe:/a:microsoft:excel_viewer:2003 CVE-2006-1304 2006-07-13T17:05:00.000-04:00 2018-10-18T12:32:01.200-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1016472 MISC http://www.nsfocus.com/english/homepage/research/0606.htm BUGTRAQ 20060712 NSFOCUS SA2006-06 : Microsoft Excel COLINFO Record Buffer Overflow Vulnerability BID 18888 VUPEN ADV-2006-2755 MS MS06-037 Buffer overflow in Microsoft Excel 2000 through 2003 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted COLINFO record, which triggers the overflow during a "data filling operation." cpe:/a:microsoft:office:2000:sp3 cpe:/a:microsoft:office:2003:sp2 cpe:/a:microsoft:office:xp:sp3 cpe:/a:microsoft:outlook:2000 cpe:/a:microsoft:outlook:2002 cpe:/a:microsoft:outlook:2003 CVE-2006-1305 2006-12-31T00:00:00.000-05:00 2018-10-18T12:32:01.763-04:00 4.3 NETWORK MEDIUM NONE NONE NONE PARTIAL http://nvd.nist.gov MISC http://blogs.securiteam.com/index.php/archives/347 MLIST [funsec] 20060308 DOSing Outlook 2003 SECTRACK 1017488 CERT-VN VU#617436 HP HPSBST02184 BID 21937 CERT TA07-009A VUPEN ADV-2007-0104 MS MS07-003 Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to cause a denial of service (memory exhaustion and interrupted mail recovery) via malformed e-mail header information, possibly related to (1) long subject lines or (2) large numbers of recipients in To or CC headers. cpe:/a:microsoft:excel:2000 cpe:/a:microsoft:excel:2000:sp2 cpe:/a:microsoft:excel:2000:sp3 cpe:/a:microsoft:excel:2000:sr1 cpe:/a:microsoft:excel:2002 cpe:/a:microsoft:excel:2002:sp1 cpe:/a:microsoft:excel:2002:sp2 cpe:/a:microsoft:excel:2002:sp3 cpe:/a:microsoft:excel:2003 cpe:/a:microsoft:excel:2003:sp1 cpe:/a:microsoft:excel:2004::mac_os_x cpe:/a:microsoft:excel:x::mac_os_x cpe:/a:microsoft:excel_viewer:2003 CVE-2006-1306 2006-07-13T17:05:00.000-04:00 2018-10-18T12:32:02.747-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1016472 MISC http://secway.org/advisory/AD20060711.txt BUGTRAQ 20060712 Microsoft Excel Array Index Error Remote Code Execution BID 18886 VUPEN ADV-2006-2755 MS MS06-037 Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted BIFF record with an attacker-controlled array index that is used for a function pointer, aka "Malformed OBJECT record Vulnerability." CVE-2006-1307 2017-05-11T10:29:03.697-04:00 2017-05-11T10:29:03.697-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2006. Notes: none. cpe:/a:microsoft:excel:2000 cpe:/a:microsoft:excel:2000:sp2 cpe:/a:microsoft:excel:2000:sp3 cpe:/a:microsoft:excel:2000:sr1 cpe:/a:microsoft:excel:2002 cpe:/a:microsoft:excel:2002:sp1 cpe:/a:microsoft:excel:2002:sp2 cpe:/a:microsoft:excel:2002:sp3 cpe:/a:microsoft:excel:2003 cpe:/a:microsoft:excel:2003:sp1 cpe:/a:microsoft:excel:2004::mac_os_x cpe:/a:microsoft:excel:x::mac_os_x cpe:/a:microsoft:excel_viewer:2003 CVE-2006-1308 2006-07-13T18:05:00.000-04:00 2018-10-12T17:39:23.993-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS FULLDISC 20060712 Microsoft Excel Could Allow Remote Code Execution by Malformed FNGROUPCOUNT value Vulnerability SECTRACK 1016472 BID 18890 VUPEN ADV-2006-2755 MS MS06-037 XF excel-fngroupcount-bo(27464) Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted FNGROUPCOUNT value. cpe:/a:microsoft:excel:2000 cpe:/a:microsoft:excel:2000:sp2 cpe:/a:microsoft:excel:2000:sp3 cpe:/a:microsoft:excel:2000:sr1 cpe:/a:microsoft:excel:2002 cpe:/a:microsoft:excel:2002:sp1 cpe:/a:microsoft:excel:2002:sp2 cpe:/a:microsoft:excel:2002:sp3 cpe:/a:microsoft:excel:2003 cpe:/a:microsoft:excel:2003:sp1 cpe:/a:microsoft:excel:2004::mac_os_x cpe:/a:microsoft:excel:x::mac_os_x cpe:/a:microsoft:excel_viewer:2003 CVE-2006-1309 2006-07-13T18:05:00.000-04:00 2018-10-12T17:39:24.713-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1016472 BID 18910 VUPEN ADV-2006-2755 MS MS06-037 Microsoft Excel 2000 through 2004 allows user-assisted attackers to execute arbitrary code via a .xls file with a crafted LABEL record that triggers memory corruption. CVE-2006-1310 2017-05-11T10:29:03.713-04:00 2017-05-11T10:29:03.730-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2006. Notes: none. cpe:/a:microsoft:learning_essentials:1.0 cpe:/a:microsoft:learning_essentials:1.1 cpe:/a:microsoft:learning_essentials:1.5 cpe:/a:microsoft:office cpe:/a:microsoft:office:2000:sp3 cpe:/a:microsoft:office:2003:sp2 cpe:/a:microsoft:office:xp:sp3 cpe:/o:microsoft:windows_2000::sp4::fr cpe:/o:microsoft:windows_2003_server:sp1 cpe:/o:microsoft:windows_xp::sp2:tablet_pc CVE-2006-1311 2007-02-13T15:28:00.000-05:00 2018-10-12T17:39:25.213-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS CERT-VN VU#368132 BID 21876 SECTRACK 1017640 SECTRACK 1017641 CERT TA07-044A VUPEN ADV-2007-0582 MS MS07-013 XF ms-richedit-code-execution(30592) The RichEdit component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1; Office 2000 SP3, XP SP3, 2003 SP2, and Office 2004 for Mac; and Learning Essentials for Microsoft Office 1.0, 1.1, and 1.5 allows user-assisted remote attackers to execute arbitrary code via a malformed OLE object in an RTF file, which triggers memory corruption. CVE-2006-1312 2017-05-11T10:29:03.747-04:00 2017-05-11T10:29:03.747-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2006. Notes: none. cpe:/o:microsoft:windows_2000 cpe:/o:microsoft:windows_2000::sp1 cpe:/o:microsoft:windows_2000::sp2 cpe:/o:microsoft:windows_2000::sp3 cpe:/o:microsoft:windows_2000::sp4 cpe:/o:microsoft:windows_2003_server:datacenter_edition cpe:/o:microsoft:windows_2003_server:datacenter_edition:sp1 cpe:/o:microsoft:windows_2003_server:datacenter_edition_64-bit cpe:/o:microsoft:windows_2003_server:datacenter_edition_64-bit:sp1 cpe:/o:microsoft:windows_2003_server:enterprise_64-bit cpe:/o:microsoft:windows_2003_server:enterprise_edition:sp1 cpe:/o:microsoft:windows_2003_server:enterprise_edition_64-bit cpe:/o:microsoft:windows_2003_server:enterprise_edition_64-bit:sp1 cpe:/o:microsoft:windows_2003_server:r2::datacenter_64-bit cpe:/o:microsoft:windows_2003_server:sp1::enterprise cpe:/o:microsoft:windows_2003_server:standard cpe:/o:microsoft:windows_2003_server:standard:sp1 cpe:/o:microsoft:windows_2003_server:standard_64-bit cpe:/o:microsoft:windows_2003_server:web cpe:/o:microsoft:windows_2003_server:web:sp1 cpe:/o:microsoft:windows_98::gold cpe:/o:microsoft:windows_98se cpe:/o:microsoft:windows_me cpe:/o:microsoft:windows_xp:::64-bit cpe:/o:microsoft:windows_xp:::home cpe:/o:microsoft:windows_xp:::media_center cpe:/o:microsoft:windows_xp::gold:professional cpe:/o:microsoft:windows_xp::sp1:home cpe:/o:microsoft:windows_xp::sp1:media_center cpe:/o:microsoft:windows_xp::sp2:home cpe:/o:microsoft:windows_xp::sp2:media_center cpe:/o:microsoft:windows_xp::sp2:tablet_pc CVE-2006-1313 2006-06-13T15:06:00.000-04:00 2019-04-30T10:27:13.913-04:00 6.8 NETWORK MEDIUM NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SECTRACK 1016283 CERT-VN VU#390044 BID 18359 CERT TA06-164A VUPEN ADV-2006-2321 MS MS06-023 XF ms-jscript-code-execution(26805) Microsoft JScript 5.1, 5.5, and 5.6 on Windows 2000 SP4, and 5.6 on Windows XP, Server 2003, Windows 98 and Windows Me, will "release objects early" in certain cases, which results in memory corruption and allows remote attackers to execute arbitrary code. cpe:/o:microsoft:windows_2000::sp4::fr cpe:/o:microsoft:windows_2003_server:64-bit cpe:/o:microsoft:windows_2003_server:itanium cpe:/o:microsoft:windows_2003_server:r2 cpe:/o:microsoft:windows_2003_server:sp1 cpe:/o:microsoft:windows_2003_server:sp1::itanium cpe:/o:microsoft:windows_xp:::64-bit cpe:/o:microsoft:windows_xp::sp1:tablet_pc cpe:/o:microsoft:windows_xp::sp2:tablet_pc CVE-2006-1314 2006-07-11T17:05:00.000-04:00 2018-10-18T12:32:03.310-04:00 7.5 NETWORK LOW NONE PARTIAL PARTIAL PARTIAL http://nvd.nist.gov ALLOWS_USER_ACCESS SREASON 1212 CERT-VN VU#189140 BUGTRAQ 20060711 TSRT-06-02: Microsoft SRV.SYS Mailslot Ring0 Memory Corruption Vulnerability BID 18863 MISC http://www.tippingpoint.com/security/advisories/TSRT-06-02.html CERT TA06-192A VUPEN ADV-2006-2753 MS MS06-035 XF win-mailslot-bo(26818) Heap-based buffer overflow in the Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other products, allows remote attackers to execute arbitrary code via crafted first-class Mailslot messages that triggers memory corruption and bypasses size restrictions on second-class Mailslot messages. cpe:/a:microsoft:server_service CVE-2006-1315 2006-07-11T17:05:00.000-04:00 2018-10-18T12:32:04.247-04:00 5.0 NETWORK LOW NONE PARTIAL NONE NONE http://nvd.nist.gov SECTRACK 1016467 CERT-VN VU#333636 BUGTRAQ 20060711 SMB Information Disclosure Vulnerability BID 18891 VUPEN ADV-2006-2753 MS MS06-035 XF win-smb-information-disclosure(26820) The Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other products, allows remote attackers to obtain sensitive information via crafted requests that leak information in SMB buffers, which are not properly initialized, aka "SMB Information Disclosure Vulnerability." cpe:/a:microsoft:office:2000:sp3 cpe:/a:microsoft:office:2003:sp1 cpe:/a:microsoft:office:2003:sp2 cpe:/a:microsoft:office:xp:sp3 CVE-2006-1316 2006-07-11T17:05:00.000-04:00 2018-10-12T17:39:30.477-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS SECTRACK 1016469 CERT-VN VU#580036 BID 18912 CERT TA06-192A VUPEN ADV-2006-2756 MS MS06-038 XF office-string-parse-bo(27607) Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allows user-assisted attackers to execute arbitrary code via an Office file with malformed string that triggers memory corruption related to record lengths, aka "Microsoft Office Parsing Vulnerability," a different vulnerability than CVE-2006-2389. CVE-2006-1317 2017-05-11T10:29:03.760-04:00 2017-05-11T10:29:03.760-04:00 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2006. Notes: none. cpe:/a:microsoft:office:2000:sp1 cpe:/a:microsoft:office:2000:sp2 cpe:/a:microsoft:office:2004::mac cpe:/a:microsoft:office:x::mac cpe:/a:microsoft:office:xp:sp3 CVE-2006-1318 2014-09-19T06:55:03.280-04:00 2018-10-12T17:39:31.430-04:00 9.3 NETWORK MEDIUM NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov MS MS06-038 Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability." cpe:/a:runit:runit:1.3.3.1 CVE-2006-1319 2006-03-20T06:02:00.000-05:00 2017-07-19T21:30:29.457-04:00 6.2 LOCAL HIGH NONE COMPLETE COMPLETE COMPLETE http://nvd.nist.gov ALLOWS_ADMIN_ACCESS CONFIRM http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356016 BID 17179 XF runit-chpst-gain-privileges(25419) chpst in runit 1.3.3-1 for Debian GNU/Linux, when compiled on little endian i386 machines against dietlibc, does not properly handle when multiple groups are specified in the -u option, which causes chpst to assign permissions for the root group due to inconsistent bit sizes for the gid_t type. cpe:/a:rssh:rssh:2.3.0 CVE-2006-1320 2006-03-20T06:02:00.000-05:00 2017-07-19T21:30:29.520-04:00