U.S. Flag Official website of the Department of Homeland Security

Note: This page is part of the us-cert.gov archive.This document is part of the US-CERT website archive. These documents are no longer updated and may contain outdated information. Links may also no longer function. Please contact info@us-cert.gov if you have any questions about the US-CERT website archive.

TLP:WHITE

Bulletin (SB06-352)

Vulnerability Summary for the Week of December 11, 2006

Original release date: December 18, 2006

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

  • High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0

  • Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9

  • Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.

">

High Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
2X -- ThinClientServer2X ThinClientServer Enterprise Edition before 4.0.2248 allows remote attackers to create multiple privileged accounts via a replay attack using the initial account creation request.
unknown
2006-12-09
7.0CVE-2006-6221
BUGTRAQ
OTHER-REF
BID
FRSIRT
SECUNIA
SECTRACK
XF
Adobe -- ColdFusionAdobe ColdFusion MX7 does not properly filter HTML tags when protecting against cross-site scripting (XSS) attacks, which allows remote attackers to inject arbitrary web script or HTML via a NULL byte (%00) in certain HTML tags, as demonstrated using "%00script" in a tag.
unknown
2006-12-12
7.0CVE-2006-6483
BUGTRAQ
FRSIRT
SECTRACK
SECUNIA
AOL -- AOL Client SoftwareStack-based buffer overflow in the SetClientInfo function in the CDDBControlAOL.CDDBAOLControl ActiveX control (cddbcontrol.dll), as used in America Online (AOL) 7.0 4114.563, 8.0 4129.230, and 9.0 Security Edition 4156.910, and possibly other products, allows remote attackers to execute arbitrary code via a long ClientId argument.
unknown
2006-12-10
7.0CVE-2006-6442
OTHER-REF
BID
FRSIRT
SECUNIA
BUGTRAQ
FULLDISC
MLIST
SECTRACK
XF
AppIntellect -- SpotLight CRMMultiple SQL injection vulnerabilities in login.asp in AppIntellect SpotLight CRM 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) login (UserName) and possibly (2) password parameter. NOTE: some of these details are obtained from third party information.
unknown
2006-12-13
10.0CVE-2006-6543
OTHER-REF
FRSIRT
CM68 News -- CM68 NewsPHP remote file inclusion vulnerability in engine/oldnews.inc.php in CM68 News 12.02.06 allows remote attackers to execute arbitrary PHP code via a URL in the addpath parameter.
unknown
2006-12-11
10.0CVE-2006-6462
BID
OTHER-REF
OTHER-REF
FRSIRT
SECUNIA
XF
CM68 News -- CM68 NewsCross-site scripting (XSS) vulnerability in CM68 News allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2006-12-13
10.0CVE-2006-6544
OTHER-REF
FRSIRT
cPanel -- cPanelCross-site scripting (XSS) vulnerability in mail/manage.html in BoxTrapper in cPanel 11 allows remote attackers to inject arbitrary web script or HTML via the account parameter.
unknown
2006-12-13
7.0CVE-2006-6523
BUGTRAQ
OTHER-REF
BID
XF
Cutenews Aj-fork -- Cutenews Aj-forkPHP remote file inclusion vulnerability in inc/shows.inc.php in cutenews aj-fork (CN:AJ) 167f and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter.
unknown
2006-12-13
10.0CVE-2006-6546
OTHER-REF
BID
FRSIRT
XF
Drupal -- Chatroom ModuleThe Chatroom Module before 4.7.x.-1.0 for Drupal broadcasts Chatroom visitors' session IDs to all participants, which allows remote attackers to hijack sessions and gain privileges.
unknown
2006-12-13
7.0CVE-2006-6528
OTHER-REF
SECUNIA
Drupal -- Chatroom ModuleThe Chatroom Module before 4.7.x.-1.0 for Drupal displays private messages in a chatroom's last messages overview, which allows remote attackers to obtain sensitive information by reading the overview.
unknown
2006-12-13
7.0CVE-2006-6529
DRUPAL
SECUNIA
Drupal -- Help Tip ModuleSQL injection vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
unknown
2006-12-13
7.0CVE-2006-6530
DRUPAL
SECUNIA
Drupal -- Help Tip ModuleCross-site scripting (XSS) vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to inject arbitrary web script or HTML, and possibly obtain administrative access, via node titles.
unknown
2006-12-13
7.0CVE-2006-6531
DRUPAL
SECUNIA
EasyFill -- EasyFillMultiple SQL injection vulnerabilities in EasyFill before 0.5.1 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
unknown
2006-12-14
10.0CVE-2006-6555
OTHER-REF
FRSIRT
EasyPage -- EasyPageSQL injection vulnerability in EasyPage allows remote attackers to execute arbitrary SQL commands via unspecified vectors in sptrees/default.aspx, possibly involving the docId parameter. NOTE: this issue appears to have been disputed by a third party researcher, stating that SQL injection is not possible. However, insufficient details were provided to evaluate the dispute.
unknown
2006-12-12
7.0CVE-2006-6486
BUGTRAQ
BUGTRAQ
XF
EyeOS -- EyeOSThe eyeHome function in apps/eyeHome.eyeapp/aplic.php in EyeOS before 0.9.3-3 allows remote attackers to upload and execute arbitrary code via dangerous file extensions that are not all lowercase, which bypasses a cleansing operation.
unknown
2006-12-14
10.0CVE-2006-6556
OTHER-REF
OTHER-REF
FRSIRT
XF
EzHRS -- HR AssistSQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the Uname (UserName) parameter.
unknown
2006-12-13
7.0CVE-2006-6524
Milw0rm
FRSIRT
SECUNIA
EzHRS -- HR AssistSQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2006-12-13
7.0CVE-2006-6525
SECUNIA
Fantastic News -- Fantastic NewsSQL injection vulnerability in news.php in Fantastic News 2.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
unknown
2006-12-13
10.0CVE-2006-6542
OTHER-REF
FRSIRT
Flippet.org -- Winamp Web InterfaceMultiple buffer overflows in Winamp Web Interface (Wawi) 7.5.13 and earlier (1) allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an (a) long username or a (b) crafted packet to the FindBasicAuth function in security.cpp, related to the /browse URI; and allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a long path string in the (2) Browse, (3) CControl::Download, and (4) CControl::Load functions, related to the file parameter in the /dl URI. NOTE: some of these details are obtained from third party information.
unknown
2006-12-13
10.0CVE-2006-6539
FULLDISC
FRSIRT
SECUNIA
OTHER-REF
SECTRACK
XF
GenesisTrader -- GenesisTraderUnrestricted file upload vulnerability in upload.php in GenesisTrader 1.0 allows remote authenticated users to upload arbitrary files via unspecified vectors, possibly involving form.php and the ajoutfich "foap" action.
unknown
2006-12-15
8.0CVE-2006-6570
BUGTRAQ
GenesisTrader -- GenesisTraderMultiple cross-site scripting (XSS) vulnerabilities in form.php in GenesisTrader 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cuve, (2) chem, (3) do, and possibly other parameters.
unknown
2006-12-15
10.0CVE-2006-6571
BUGTRAQ
Gizzar -- GizzarPHP remote file inclusion vulnerability in index.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter.
unknown
2006-12-13
7.0CVE-2006-6526
OTHER-REF
FRSIRT
Gizzar -- GizzarPHP remote file inclusion vulnerability in guest.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2006-12-13
7.0CVE-2006-6527
FRSIRT
IBM -- WebSphere Host On-DemandIBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html.
unknown
2006-12-13
7.0CVE-2006-6537
BUGTRAQ
SECUNIA
Justsystem -- Ichitaro viewer
Justsystem -- Ichitaro
Justsystem -- Ichitaro Lite2
Justsystem -- Sanshiro
Justsystem -- Hanako viewer
Justsystem -- Hanako
Buffer overflow in JustSystems Hanako 2004 through 2006, Hanako viewer 1.x, Ichitaro 2004, Ichitaro 2005, Ichitaro Lite2, Ichitaro viewer 4.x, and Sanshiro 2005 allows remote attackers to execute arbitrary code via the (1) Keyword and (2) Title fields, related to string length fields.
unknown
2006-12-09
7.0CVE-2006-6400
OTHER-REF
OTHER-REF
OTHER-REF
BID
FRSIRT
SECTRACK
SECUNIA
KDPics -- KDPicsMultiple PHP remote file inclusion vulnerabilities in KDPics 1.16 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) page parameter to (a) index.php3, or the (2) lib_path parameter to (b) authenticate.inc.php3 or (c) lib/exifer/exif.php.
unknown
2006-12-13
7.0CVE-2006-6516
BUGTRAQ
BID
FRSIRT
SECUNIA
Lotfian -- Request For TravelSQL injection vulnerability in ProductDetails.asp in Lotfian Request For Travel 1.0 allows remote attackers to execute arbitrary SQL commands via the PID parameter.
unknown
2006-12-14
10.0CVE-2006-6559
OTHER-REF
FRSIRT
MailEnable -- MailEnable Enterprise
MailEnable -- MailEnable Professional
Stack-based buffer overflow in the IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.35, Professional Edition 1.6 through 1.84, and Enterprise Edition 1.1 through 1.41 allows remote attackers to execute arbitrary code via a pre-authentication command followed by a crafted parameter and a long string, as addressed by the ME-10025 hotfix.
unknown
2006-12-11
10.0CVE-2006-6423
OTHER-REF
OTHER-REF
XF
BUGTRAQ
BID
SECUNIA
Mantis -- MantisMantis before 1.1.0a2 sets the default value of $g_bug_reminder_threshold to "reporter" instead of a more privileged role, which has unknown impact and attack vectors, possibly related to frequency of reminders.
unknown
2006-12-13
7.0CVE-2006-6515
OTHER-REF
OTHER-REF
McAfee -- VirusScanUntrusted search path vulnerability in McAfee VirusScan for Linux 4510e and earlier includes the current working directory in the DT_RPATH environment variable, which allows local users to load arbitrary ELF DSO libraries and execute arbitrary code by installing malicious libraries in that directory.
unknown
2006-12-14
7.0CVE-2006-6474
GENTOO
BID
Microsoft -- Internet ExplorerMicrosoft Internet Explorer 6 and earlier allows remote attackers to read Temporary Internet Files (TIF) and obtain sensitive information via unspecified vectors involving certain drag and drop operations, aka "TIF Folder Information Disclosure Vulnerability," and a different issue than CVE-2006-5577.
unknown
2006-12-12
7.0CVE-2006-5578
MS
FRSIRT
SECTRACK
SECUNIA
Microsoft -- Internet ExplorerMicrosoft Internet Explorer 6 allows remote attackers to execute arbitrary code by using JavaScript to cause certain errors simultaneously, which results in the access of previously freed memory, aka "Script Error Handling Memory Corruption Vulnerability."
unknown
2006-12-12
7.0CVE-2006-5579
MS
BUGTRAQ
OTHER-REF
CERT-VN
FRSIRT
SECTRACK
SECUNIA
Microsoft -- Internet ExplorerUnspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via certain DHTML script functions, such as normalize, and "incorrectly created elements" that trigger memory corruption, aka "DHTML Script Function Memory Corruption Vulnerability."
unknown
2006-12-12
10.0CVE-2006-5581
MS
OTHER-REF
BUGTRAQ
CERT-VN
FRSIRT
SECTRACK
SECUNIA
Microsoft -- Windows Server 2003Buffer overflow in the SNMP Service in Microsoft Windows 2000 SP4, XP SP2, Server 2003, Server 2003 SP1, and possibly other versions allows remote attackers to execute arbitrary code via a crafted SNMP packet, aka "SNMP Memory Corruption Vulnerability."
unknown
2006-12-12
10.0CVE-2006-5583
MS
FRSIRT
SECTRACK
SECUNIA
Microsoft -- Windows 2000The Remote Installation Service (RIS) in Microsoft Windows 2000 SP4 uses a TFTP server that allows anonymous access, which allows remote attackers to upload and overwrite arbitrary files to gain privileges on systems that use RIS.
unknown
2006-12-12
7.0CVE-2006-5584
MS
FRSIRT
SECTRACK
SECUNIA
Microsoft -- WordUnspecified vulnerability in Microsoft Word allows user-assisted remote attackers to execute arbitrary code via a crafted DOC file that triggers memory corruption, as demonstrated via the 12122006-djtest.doc file, a different issue than CVE-2006-5994 and CVE-2006-6456.
unknown
2006-12-14
8.0CVE-2006-6561
BUGTRAQ
OTHER-REF
OTHER-REF
OTHER-REF
CERT-VN
BID
FRSIRT
OTHER-REF
mxBB -- mxBB NewsSuitePHP remote file inclusion vulnerability in includes/newssuite_constants.php in the NewsSuite 1.03 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the mx_root_path parameter.
unknown
2006-12-14
10.0CVE-2006-6553
OTHER-REF
FRSIRT
SECUNIA
MxBB -- ModSDBPHP remote file inclusion vulnerability in includes/common.php in the mx_modsdb 1.0.0 module for MxBB (aka MX-System) Portal allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
unknown
2006-12-14
10.0CVE-2006-6560
OTHER-REF
FRSIRT
SECUNIA
XF
mxBB -- mxBBPHP remote file inclusion vulnerability in includes/profilcp_constants.php in the Profile Control Panel (CPanel) module for mxBB 0.91c allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
unknown
2006-12-15
7.0CVE-2006-6566
OTHER-REF
OTHER-REF
MLIST
MLIST
FRSIRT
XF
MxBB -- kb_modsPHP remote file inclusion vulnerability in includes/kb_constants.php in the Knowledge Base (mx_kb) 2.0.2 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
unknown
2006-12-15
10.0CVE-2006-6567
OTHER-REF
BID
FRSIRT
SECUNIA
XF
MxBB -- kb_modsDirectory traversal vulnerability in includes/kb_constants.php in the Knowledge Base (mx_kb) 2.0.2 module for mxBB allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the phpEx parameter.
unknown
2006-12-15
10.0CVE-2006-6568
OTHER-REF
BID
SECUNIA
XF
MyStats -- MyStatsMultiple cross-site scripting (XSS) vulnerabilities in mystats.php in MyStats 1.0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) connexion, (2) by, and (3) details parameter.
unknown
2006-12-09
7.0CVE-2006-6401
BUGTRAQ
FRSIRT
OSVDB
SECTRACK
SECUNIA
MyStats -- MyStatsSQL injection vulnerability in mystats.php in MyStats 1.0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the details parameter.
unknown
2006-12-09
7.0CVE-2006-6402
BUGTRAQ
FRSIRT
OSVDB
SECTRACK
SECUNIA
osCommerce -- osCommerceDirectory traversal vulnerability in admin/templates_boxes_layout.php in osCommerce 3.0a3 allows remote attackers to include and execute arbitrary PHP files via a .. (dot dot) in the filter parameter. NOTE: this issue can be leveraged to obtain full path information in error messages.
unknown
2006-12-13
7.0CVE-2006-6533
OTHER-REF
BID
FRSIRT
SECTRACK
XF
PHP -- Animated Smiley GeneratorPHP remote file inclusion vulnerability in signer/final.php in Animated Smiley Generator allows remote attackers to execute arbitrary PHP code via a URL in the smiley parameter.
unknown
2006-12-13
10.0CVE-2006-6541
BUGTRAQ
XF
PHP -- ErrorDocsPHP remote file inclusion vulnerability in includes/common.php in the ErrorDocs 1.0.0 and earlier module for mxBB (mx_errordocs) allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
unknown
2006-12-13
10.0CVE-2006-6545
OTHER-REF
FRSIRT
SECUNIA
XF
PHP -- Phorum** DISPUTED ** PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the db_file parameter. NOTE: CVE disputes this vulnerability because db_file is defined before use.
unknown
2006-12-14
10.0CVE-2006-6550
OTHER-REF
XF
PHP -- Blog:CMSPHP remote file inclusion vulnerability in admin/plugins/NP_UserSharing.php in BLOG:CMS 4.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DIR_ADMIN parameter.
unknown
2006-12-14
10.0CVE-2006-6552
BUGTRAQ
OTHER-REF
SECUNIA
SECTRACK
XF
Rad Inks -- Rad Upload** DISPUTED ** PHP remote file inclusion vulnerability in upload.php in Rad Upload 3.02 allows remote attackers to execute arbitrary PHP code via a URL in the save_path parameter. NOTE: CVE disputes this vulnerability because save_path is originally defined as "" before use, and the nearby instructions say "SET THE SAVE PATH by editing the line below."
unknown
2006-12-14
7.0CVE-2006-6549
BUGTRAQ
SCRIPTPHP -- AnnonceScriptHPMultiple SQL injection vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a) email.php, the (2) no parameter in (b) voirannonce.php, the (3) idmembre parameter in (c) admin/admin_membre/fiche_membre.php, and the (4) idannonce parameter in (d) admin/admin_annonce/okvalannonce.php and (e) admin/admin_annonce/changeannonce.php.
unknown
2006-12-11
10.0CVE-2006-6478
BUGTRAQ
BID
FRSIRT
SECUNIA
XF
SCRIPTPHP -- AnnonceScriptHPMultiple cross-site scripting (XSS) vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the email parameter in (1) erreurinscription.php, (2) Templates/admin.dwt.php, (3) Templates/commun.dwt.php, (4) membre.dwt.php, and (5) admin/admin_config/Aide.php.
unknown
2006-12-11
10.0CVE-2006-6479
BUGTRAQ
BID
FRSIRT
SECUNIA
XF
SCRIPTPHP -- ProNewsMultiple cross-site scripting (XSS) vulnerabilities in ProNews 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo, (2) email, (3) date, (4) sujet, (5) message, (6) site, and (7) lien parameters to (a) admin/change.php, and the (8) aa parameter to (b) lire-avis.php.
unknown
2006-12-13
7.0CVE-2006-6518
BUGTRAQ
BID
SCRIPTPHP -- ProNewsSQL injection vulnerability in lire-avis.php in ProNews 1.5 allows remote attackers to execute arbitrary SQL commands via the aa parameter.
unknown
2006-12-13
7.0CVE-2006-6519
BUGTRAQ
BID
SCRIPTPHP -- MessageriescripthpMultiple cross-site scripting (XSS) vulnerabilities in Messageriescripthp 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo parameter to (a) existepseudo.php, the (2) email parameter to (b) existeemail.php, or the (3) pageName or (4) cssform parameter to (c) Contact/contact.php.
unknown
2006-12-13
7.0CVE-2006-6520
BUGTRAQ
BID
SCRIPTPHP -- MessageriescripthpSQL injection vulnerability in lire-avis.php in Messageriescripthp 2.0 allows remote attackers to execute arbitrary SQL commands via the aa parameter.
unknown
2006-12-13
7.0CVE-2006-6521
BUGTRAQ
BID
ShopSite -- ShopSiteMultiple cross-site scripting (XSS) vulnerabilities in ShopSite 8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the prevlocation parameter in shopper/sc/registration.cgi and other unspecified vectors.
unknown
2006-12-12
7.0CVE-2006-6485
BUGTRAQ
OTHER-REF
SECTRACK
BUGTRAQ
OTHER-REF
FRSIRT
SECUNIA
XF
Sophos -- Sophos Anti-VirusMultiple buffer overflows in Sophos Anti-Virus scanning engine before 2.40 allow remote attackers to execute arbitrary code via (1) a SIT archive with a long filename that is not null-terminated, which triggers a heap-based overflow in veex.dll due to improper length calculation, and (2) a CPIO archive, with a long filename that is not null-terminated, which triggers a stack-based overflow in veex.dll.
unknown
2006-12-12
10.0CVE-2006-6335
OTHER-REF
OTHER-REF
OTHER-REF
OTHER-REF
FRSIRT
BUGTRAQ
BUGTRAQ
BID
SECUNIA
XF
XF
SWsoft -- PleskMultiple cross-site scripting (XSS) vulnerabilities in SWsoft Plesk 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) get_password.php or (2) login_up.php3.
2006-11-05
2006-12-10
7.0CVE-2006-6451
BUGTRAQ
OTHER-REF
BID
SECTRACK
XF
Symantec -- Veritas NetBackup Enterprise Server
Symantec -- Veritas NetBackup Server
Symantec -- Veritas NetBackup Client
The NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 does not properly check for chained commands, which allows remote attackers to execute arbitrary commands by appending malicious commands to valid commands.
unknown
2006-12-14
7.0CVE-2006-4902
ISS
OTHER-REF
BID
FRSIRT
SECUNIA
SECTRACK
Symantec -- Veritas NetBackup Enterprise Server
Symantec -- Veritas NetBackup Server
Symantec -- Veritas NetBackup Client
Stack-based buffer overflow in the NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 allows remote attackers to execute arbitrary code via a long CONNECT_OPTIONS request, a different issue than CVE-2006-6222.
unknown
2006-12-14
7.0CVE-2006-5822
BUGTRAQ
OTHER-REF
OTHER-REF
BID
FRSIRT
SECUNIA
SECTRACK
Symantec -- Veritas NetBackup Enterprise Server
Symantec -- Veritas NetBackup Server
Symantec -- Veritas NetBackup Client
Stack-based buffer overflow in the NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 allows remote attackers to execute arbitrary code via a long request with a malformed length prefix.
unknown
2006-12-14
7.0CVE-2006-6222
BUGTRAQ
OTHER-REF
OTHER-REF
BID
FRSIRT
SECUNIA
SECTRACK
XF
Tucows -- Client Code SuitePHP remote file inclusion vulnerability in libs/tucows/api/cartridges/crt_TUCOWS_domains/lib/domainutils.inc.php in Tucows Client Code Suite (CCS) 1.2.1015 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _ENV[TCA_HOME] parameter.
unknown
2006-12-14
10.0CVE-2006-6551
OTHER-REF
XF
Vt-Forum -- Vt-Forum LiteMultiple cross-site scripting (XSS) vulnerabilities in Vt-Forum Lite 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) StrMsg or (2) Topic_ID parameter to (a) vf_info.asp, (b) vf_newtopic.asp, (c) vf_settings.asp, and (d) vf_replytopic.asp, different vectors than CVE-2006-6447. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2006-12-13
7.0CVE-2006-6532
FRSIRT
XF
WikiTimeScale -- TwoZeroMultiple cross-site scripting (XSS) vulnerabilities in WikiTimeScale TwoZero before 2.31 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in the (1) forum module and (2) event descriptions. NOTE: some of these details are obtained from third party information.
unknown
2006-12-13
7.0CVE-2006-6522
OTHER-REF
FRSIRT
XF
Xerox -- WorkCentre Pro
Xerox -- WorkCentre
The Web User Interface in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allows remote attackers to execute arbitrary commands via unspecified vectors involving "command injection" in (1) the TCP/IP hostname, (2) Scan-to-mailbox folder names, and (3) certain parameters in the Microsoft Networking configuration. NOTE: vector 1 might be the same as CVE-2006-5290.
unknown
2006-12-10
7.0CVE-2006-6427
OTHER-REF
FRSIRT
SECTRACK
SECUNIA
OTHER-REF
Xerox -- WorkCentre Pro
Xerox -- WorkCentre
Multiple unspecified vulnerabilities in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 have unknown impact and attack vectors, related to (1) an Immediate Image Overwrite (IIO) error message at the Local User Interface (LUI) if overwrite fails, (2) an IIO failure when a Held Job is deleted, and (3) an On Demand Image Overwrite failure when the overwrite is greater than 2 Gb.
unknown
2006-12-11
10.0CVE-2006-6473
OTHER-REF
SECUNIA

Back to top

Medium Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
Bluetrait -- BluetraitSQL injection vulnerability in bt-trackback.php in Bluetrait before 1.2.0, when trackback is enabled, allows remote attackers to execute arbitrary SQL commands via unspecified parameters. NOTE: some of these details are obtained from third party information.
unknown
2006-12-13
5.6CVE-2006-6540
OTHER-REF
FRSIRT
SECUNIA
Cilem -- Cilem HaberCross-site scripting (XSS) vulnerability in hata.asp in Cilem Haber Free Edition allows remote attackers to inject arbitrary web script or HTML via the hata parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2006-12-13
5.6CVE-2006-6536
BID
Citrix -- Advanced Access Control
Citrix -- Access Gateway
Unspecified vulnerability in Citrix Advanced Access Control (AAC) Option 4.0, and Access Gateway 4.2 with Advanced Access Control 4.2, before 20061114, when the Browser-Only access feature is enabled, allows remote authenticated users to bypass access policies via a certain login method, a different issue than CVE-2006-4846. NOTE: some of these details are obtained from third party information.
unknown
2006-12-15
4.2CVE-2006-6572
OTHER-REF
SECTRACK
Citrix -- Access Gateway Appliance
Citrix -- Access Gateway AAC
Citrix -- Access Gateway
Unspecified vulnerability in Citrix Access Gateway 4.5 Advanced Edition, and 4.2 with Advanced Access Control (AAC) 4.2, when deployed on the Access Gateway appliance 4.2 through 4.2.2 allows remote authenticated users to "gain access to data" and obtain sensitive information via unspecified vectors.
unknown
2006-12-15
4.2CVE-2006-6573
OTHER-REF
SECTRACK
Computer Associates -- Internet Security Suite
Computer Associates -- eTrust Antivirus
The (1) VetMONNT.sys and (2) VetFDDNT.sys drivers in CA Anti-Virus 2007 8.1, Anti-Virus for Vista Beta 8.2, and CA Internet Security Suite 2007 v3.0 do not properly handle NULL buffers, which allows local users with administrative access to cause a denial of service (system crash) via certain IOCTLs.
unknown
2006-12-13
4.2CVE-2006-6496
OTHER-REF
OTHER-REF
OTHER-REF
FRSIRT
OSVDB
dadaIMC -- dadaIMCdadaIMC .99.3 uses an insufficiently restrictive FilesMatch directive in the installed .htaccess file, which allows remote attackers to execute arbitrary PHP code by uploading files whose names contain (1) feature, (2) editor, (3) newswire, (4) otherpress, (5) admin, (6) pbook, (7) media, or (8) mod, which are processed as PHP file types (application/x-httpd-php).
unknown
2006-12-13
5.6CVE-2006-6511
OTHER-REF
FRSIRT
SECUNIA
XF
Enemies of Carlotta -- Enemies of Carlottaeoc.py in Enemies of Carlotta (EoC) before 1.2.4 allows remote attackers to execute arbitrary commands via shell metacharacters in an "SMTP level e-mail address".
unknown
2006-12-13
5.6CVE-2006-5875
DEBIAN
MLIST
BID
FRSIRT
SECUNIA
KDPics -- KDPicsMultiple cross-site scripting (XSS) vulnerabilities in KDPics 1.16 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) categories parameter to (a) index.php3 or (b) galeries.inc.php3.
unknown
2006-12-13
5.6CVE-2006-6517
BUGTRAQ
BID
FRSIRT
SECUNIA
Linux -- Linux kernelThe do_coredump function in fs/exec.c in the Linux kernel 2.6.19 sets the flag variable to O_EXCL but does not use it, which allows context-dependent attackers to modify arbitrary files via a rewrite attack during a core dump.
unknown
2006-12-14
4.9CVE-2006-6304
OTHER-REF
BID
FRSIRT
Microsoft -- Outlook ExpressUnspecified vulnerability in Microsoft Outlook Express 6 and earlier allows remote attackers to execute arbitrary code via a crafted contact record in a Windows Address Book (WAB) file.
unknown
2006-12-12
5.6CVE-2006-2386
MS
FRSIRT
SECTRACK
SECUNIA
XF
Microsoft -- Windows Media Player
Microsoft -- Windows XP
Microsoft -- Server 2003
Buffer overflow in the Windows Media Format Runtime in Microsoft Windows Media Player (WMP) 6.4 and Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file.
unknown
2006-12-12
5.6CVE-2006-4702
MS
SECTRACK
Microsoft -- Windows Server 2003
Microsoft -- Windows XP
The Client-Server Run-time Subsystem in Microsoft Windows XP SP2 and Server 2003 allows local users to gain privileges via a crafted file manifest within an application, aka "File Manifest Corruption Vulnerability."
unknown
2006-12-12
4.2CVE-2006-5585
MS
SECUNIA
FRSIRT
SECTRACK
SECUNIA
MidiCart Software -- MidiCart PHP Shopping CartUnrestricted file upload vulnerability in admin/add.php in Midicart allows remote authenticated users to upload arbitrary .php files, and possibly other files, to the images/ directory under the web root.
unknown
2006-12-11
5.4CVE-2006-6463
BUGTRAQ
BID
SECUNIA
mlipod -- Winamp iPod PluginBuffer overflow in the readAA function in read_aa.cpp in Winamp iPod Plugin (ml_ipod) 2.00 p19 and earlier allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long tag in an audible.com audiobook (aa) file.
unknown
2006-12-14
5.6CVE-2006-6547
OTHER-REF
OTHER-REF
OTHER-REF
BID
FRSIRT
OpenLDAP -- OpenLDAPBuffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos.c in OpenLDAP 2.4.3 and earlier, when OpenLDAP is compiled with the --enable-kbind (Kerberos KBIND) option, allows remote attackers to execute arbitrary code via an LDAP bind request using the LDAP_AUTH_KRBV41 authentication method and long credential data.
unknown
2006-12-12
5.6CVE-2006-6493
BUGTRAQ
OTHER-REF
FRSIRT
SECUNIA
osCommerce -- osCommerceMultiple cross-site scripting (XSS) vulnerabilities in osCommerce 3.0a3 allow remote attackers to inject arbitrary web script or HTML via the (1) set parameter to admin/modules.php, the (2) selected_box parameter to definitiva/admin/customers.php, the (3) lID parameter to admin/languages_definitions.php, or the (4) pID parameter to admin/products.php.
2006-11-11
2006-12-13
5.6CVE-2006-6534
BLOGSPOT
BID
SECTRACK
phpBB Group -- phpBBCross-site scripting (XSS) vulnerability in the private message box implementation (privmsg.php) in phpBB 2.0.x allows remote authenticated users to inject arbitrary web script or HTML via the "Message body" field in a message to a non-existent user. NOTE: this attack may not cross privilege boundaries, since the XSS is reflected back to the attacker, but not anyone else. Therefore this might not be a vulnerability.
unknown
2006-12-10
4.2CVE-2006-6421
BUGTRAQ
SECUNIA
XF
Skulls -- SkullsMultiple unspecified vulnerabilities in Skulls! before 0.2.6 have unknown impact and attack vectors, as addressed by "Many security fixes."
unknown
2006-12-14
5.6CVE-2006-6557
OTHER-REF
FRSIRT

Back to top

Low Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
Adobe -- ColdFusionAdobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request (1) for a non-existent (a) JWS, (b) CFM, (c) CFML, or (d) CFC file, which displays the installation path in the resulting error message; or (2) to /CFIDE/administrator/login.cfm without a host, which can reveal the server's internal IP address in an HREF tag.
unknown
2006-12-12
2.3CVE-2006-6482
BUGTRAQ
FRSIRT
SECTRACK
SECUNIA
Clam Anti-Virus -- ClamAVClam AntiVirus (ClamAV) 0.88 and earlier allows remote attackers to cause a denial of service (crash) via a malformed base64-encoded MIME attachment that triggers a null pointer dereference.
unknown
2006-12-09
2.3CVE-2006-5874
DEBIAN
MANDRIVA
SECUNIA
SECUNIA
Clam Anti-Virus -- ClamAVClam AntiVirus (ClamAV) 0.88.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
unknown
2006-12-09
2.3CVE-2006-6406
BUGTRAQ
OTHER-REF
BID
MANDRIVA
SECUNIA
Clam Anti-Virus -- ClamAVClam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.
unknown
2006-12-11
2.3CVE-2006-6481
OTHER-REF
MANDRIVA
SECUNIA
SECUNIA
cPanel -- WebHost ManagerMultiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the domain parameter to (1) scripts2/changeemail, (2) scripts2/limitbw, or (3) scripts/rearrangeacct. NOTE: the feature parameter to scripts2/dofeaturemanager is already covered by CVE-2006-6198.
unknown
2006-12-14
2.7CVE-2006-6548
BUGTRAQ
OTHER-REF
XF
Crob -- Crob FTP ServerCrob FTP Server 3.6.1 b.263 allows remote attackers to cause a denial of service via a long series of "?A" sequences in the (1) LIST and possibly (2) NLST command.
unknown
2006-12-14
2.3CVE-2006-6558
Milw0rm
SECUNIA
D-BUS -- D-BUSUnspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match rules for other applications and cause a denial of service (lost process messages).
unknown
2006-12-13
1.0CVE-2006-6107
BID
OTHER-REF
FRSIRT
OTHER-REF
XF
D-LINK -- DWL-2000AP+D-LINK DWL-2000AP+ firmware 2.11 allows remote attackers to cause (1) a denial of service (device reset) via a flood of ARP replies on the wired or wireless (radio) link and (2) a denial of service (device crash) via a flood of ARP requests on the wireless link.
unknown
2006-12-13
3.3CVE-2006-6538
BUGTRAQ
OTHER-REF
Debian -- Debian Linux
l2tpns -- l2tpns
Buffer overflow in the cluster_process_heartbeat function in cluster.c in layer 2 tunneling protocol network server (l2tpns) before 2.1.21 allows remote attackers to cause a denial of service via a large heartbeat packet.
unknown
2006-12-11
3.3CVE-2006-5873
OTHER-REF
OTHER-REF
DEBIAN
BID
FRSIRT
SECUNIA
SECUNIA
XF
F-Prot -- F-Prot AntivirusF-Prot Antivirus for Linux x86 Mail Servers 4.6.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
unknown
2006-12-09
2.3CVE-2006-6407
BUGTRAQ
OTHER-REF
BID
FileZilla -- FileZillaFileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a malformed argument to the STOR command, which results in a NULL pointer dereference. NOTE: CVE analysis suggests that the problem might be due to a malformed PORT command.
unknown
2006-12-15
3.3CVE-2006-6564
OTHER-REF
OTHER-REF
FRSIRT
XF
FileZilla -- FileZilla ServerFileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to the (1) LIST or (2) NLST commands, which results in a NULL pointer dereference, a different set of vectors than CVE-2006-????. NOTE: CVE analysis suggests that the problem might be due to a malformed PORT command.
unknown
2006-12-15
3.3CVE-2006-6565
OTHER-REF
OTHER-REF
FRSIRT
XF
Flippet.org -- Winamp Web InterfaceDirectory traversal vulnerability in the Browse function (/browse URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to list arbitrary directories via URL encoded backslashes ("%2F") in the path parameter.
unknown
2006-12-13
1.1CVE-2006-6512
FULLDISC
FRSIRT
SECUNIA
OTHER-REF
SECTRACK
XF
Flippet.org -- Winamp Web InterfaceThe CControl::Download function (/dl URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to download arbitrary file types under the root via a trailing "." (dot) in a filename in the file parameter, related to erroneous behavior of the IsWinampFile function.
unknown
2006-12-13
1.1CVE-2006-6513
FULLDISC
FRSIRT
SECUNIA
OTHER-REF
SECTRACK
Flippet.org -- Winamp Web InterfaceWinamp Web Interface (Wawi) 7.5.13 and earlier uses an insufficient comparison to determine whether a directory is located below the application's root directory, which allows remote authenticated users to access certain other directories if the name of the root directory is a substring of the name of the target directory, as demonstrated by accessing C:\folder2 when the root directory is C:\folder.
unknown
2006-12-13
1.1CVE-2006-6514
FULLDISC
FRSIRT
SECUNIA
OTHER-REF
SECTRACK
GenesisTrader -- GenesisTraderform.php in GenesisTrader 1.0 allows remote attackers to read source code for arbitrary files and obtain sensitive information via the (1) do and (2) chem parameters with a "modfich" floap parameter.
unknown
2006-12-15
3.3CVE-2006-6569
BUGTRAQ
GNOME -- GDMFormat string vulnerability in the host chooser window (gdmchooser) in GNOME Foundation Display Manager (gdm) allows local users to execute arbitrary code via format string specifiers in a hostname, which are used in an error dialog.
unknown
2006-12-14
2.9CVE-2006-6105
IDEFENSE
BID
SECTRACK
Kaspersky Lab -- Kaspersky Anti-VirusKaspersky Anti-Virus for Linux Mail Servers 5.5.10 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
unknown
2006-12-09
2.3CVE-2006-6408
BUGTRAQ
OTHER-REF
BID
Kerio -- Kerio MailServerUnspecified vulnerability in Kerio MailServer before 6.3.1 allows remote attackers to cause a denial of service (service stop) via certain LDAP queries.
unknown
2006-12-14
1.6CVE-2006-6554
OTHER-REF
FRSIRT
SECUNIA
XF
Linux -- Linux kernelsmbfs in Linux kernel 2.6.8 and other versions, and 2.4.x before 2.4.34, when UNIX extensions are enabled, ignores certain mount options, which could cause clients to use server-specified uid, gid and mode settings.
unknown
2006-12-11
2.3CVE-2006-5871
SECUNIA
SECUNIA
MailEnable -- MailEnable Enterprise
MailEnable -- MailEnable Professional
The IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.34, Professional Edition 1.6 through 1.83, and Enterprise Edition 1.1 through 1.40 allows remote attackers to cause a denial of service (crash) via unspecified vectors that trigger a null pointer dereference, as addressed by the ME-10023 hotfix, and a different issue than CVE-2006-6423. NOTE: some details were obtained from third party information.
unknown
2006-12-12
2.3CVE-2006-6484
OTHER-REF
BID
SECUNIA
XF
Microsoft -- Internet ExplorerMicrosoft Internet Explorer 6 and earlier allows remote attackers to obtain sensitive information via unspecified uses of the OBJECT HTML tag, which discloses the absolute path of the corresponding TIF folder, aka "TIF Folder Information Disclosure Vulnerability," and a different issue than CVE-2006-5578.
unknown
2006-12-12
2.3CVE-2006-5577
MS
FRSIRT
SECTRACK
SECUNIA
MyStats -- MyStatsmystats.php in MyStats 1.0.8 and earlier allows remote attackers to obtain the installation path via (1) details and (2) by array parameters, probably resulting in a path disclosure in an error message.
unknown
2006-12-09
2.3CVE-2006-6403
BUGTRAQ
SECTRACK
XF
phpBB Group -- phpBBCross-site request forgery (CSRF) vulnerability in phpBB 2.0.21 allows remote authenticated users to send unauthorized messages as an arbitrary user via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2006-12-13
3.4CVE-2006-6508
SECUNIA
XF
ProFTPD Project -- ProFTPDStack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value.
unknown
2006-12-15
3.4CVE-2006-6563
BUGTRAQ
OTHER-REF
OTHER-REF
BID
FRSIRT
SECUNIA
SCRIPTPHP -- AnnonceScriptHPadmin/admin_membre/fiche_membre.php in AnnonceScriptHP 2.0 allows remote attackers to obtain sensitive information via the idmembre parameter, which discloses the passwords for arbitrary users.
unknown
2006-12-11
2.3CVE-2006-6480
BUGTRAQ
BID
SECUNIA
XF
SiteKiosk -- SiteKioskCross-site scripting (XSS) vulnerability in the skinning feature in SiteKiosk before 6.5.150 allows local users to bypass security protections and inject arbitrary web script or HTML via an ABOUT: URI, which is displayed in the title bar of the browser.
2006-11-30
2006-12-13
2.9CVE-2006-6509
BUGTRAQ
OTHER-REF
BID
FRSIRT
SECUNIA
XF
SiteKiosk -- SiteKioskAn unspecified ActiveX control in SiteKiosk before 6.5.150 is installed "safe for scripting", which allows local users to bypass security protections and read arbitrary files via certain functions.
unknown
2006-12-13
1.0CVE-2006-6510
BUGTRAQ
OTHER-REF
BID
FRSIRT
SECUNIA
XF
Softwin -- BitDefender Mail ProtectionBitDefender Mail Protection for SMB 2.0 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
unknown
2006-12-09
2.3CVE-2006-6405
BUGTRAQ
OTHER-REF
BID
Sun -- SolarisDirectory traversal vulnerability in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via a .. (dot dot) sequence in the LANG environment variable that points to a locale file containing attacker-controlled format string specifiers.
unknown
2006-12-12
3.4CVE-2006-6494
IDEFENSE
SUNALERT
BID
FRSIRT
SECTRACK
SECUNIA
Sun -- SolarisStack-based buffer overflow in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via large precision padding values in a format string specifier in the format parameter of the doprf function. NOTE: this issue normally does not cross privilege boundaries, except in cases of external introduction of malicious message files, or if it is leveraged with other vulnerabilities such as CVE-2006-6494.
unknown
2006-12-12
3.4CVE-2006-6495
IDEFENSE
SUNALERT
BID
FRSIRT
SECTRACK
SECUNIA
Ubuntu -- Ubuntu LinuxUbuntu Linux 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (resource consumption) by using the (1) sys_get_robust_list and (2) sys_set_robust_list functions to create processes that cannot be killed.
unknown
2006-12-13
1.4CVE-2006-5648
UBUNTU
SECUNIA
SECUNIA
Ubuntu -- Ubuntu LinuxUnspecified vulnerability in the "alignment check exception handling" in Ubuntu 5.10, 6.06 LTS, and 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (kernel panic) via unspecified vectors.
unknown
2006-12-13
1.4CVE-2006-5649
UBUNTU
DEBIAN
SECUNIA
SECUNIA
SECUNIA

Back to top

">

High Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
2X -- ThinClientServer2X ThinClientServer Enterprise Edition before 4.0.2248 allows remote attackers to create multiple privileged accounts via a replay attack using the initial account creation request.
unknown
2006-12-09
7.0CVE-2006-6221
BUGTRAQ
OTHER-REF
BID
FRSIRT
SECUNIA
SECTRACK
XF
Adobe -- ColdFusionAdobe ColdFusion MX7 does not properly filter HTML tags when protecting against cross-site scripting (XSS) attacks, which allows remote attackers to inject arbitrary web script or HTML via a NULL byte (%00) in certain HTML tags, as demonstrated using "%00script" in a tag.
unknown
2006-12-12
7.0CVE-2006-6483
BUGTRAQ
FRSIRT
SECTRACK
SECUNIA
AOL -- AOL Client SoftwareStack-based buffer overflow in the SetClientInfo function in the CDDBControlAOL.CDDBAOLControl ActiveX control (cddbcontrol.dll), as used in America Online (AOL) 7.0 4114.563, 8.0 4129.230, and 9.0 Security Edition 4156.910, and possibly other products, allows remote attackers to execute arbitrary code via a long ClientId argument.
unknown
2006-12-10
7.0CVE-2006-6442
OTHER-REF
BID
FRSIRT
SECUNIA
BUGTRAQ
FULLDISC
MLIST
SECTRACK
XF
AppIntellect -- SpotLight CRMMultiple SQL injection vulnerabilities in login.asp in AppIntellect SpotLight CRM 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) login (UserName) and possibly (2) password parameter. NOTE: some of these details are obtained from third party information.
unknown
2006-12-13
10.0CVE-2006-6543
OTHER-REF
FRSIRT
CM68 News -- CM68 NewsPHP remote file inclusion vulnerability in engine/oldnews.inc.php in CM68 News 12.02.06 allows remote attackers to execute arbitrary PHP code via a URL in the addpath parameter.
unknown
2006-12-11
10.0CVE-2006-6462
BID
OTHER-REF
OTHER-REF
FRSIRT
SECUNIA
XF
CM68 News -- CM68 NewsCross-site scripting (XSS) vulnerability in CM68 News allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2006-12-13
10.0CVE-2006-6544
OTHER-REF
FRSIRT
cPanel -- cPanelCross-site scripting (XSS) vulnerability in mail/manage.html in BoxTrapper in cPanel 11 allows remote attackers to inject arbitrary web script or HTML via the account parameter.
unknown
2006-12-13
7.0CVE-2006-6523
BUGTRAQ
OTHER-REF
BID
XF
Cutenews Aj-fork -- Cutenews Aj-forkPHP remote file inclusion vulnerability in inc/shows.inc.php in cutenews aj-fork (CN:AJ) 167f and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter.
unknown
2006-12-13
10.0CVE-2006-6546
OTHER-REF
BID
FRSIRT
XF
Drupal -- Chatroom ModuleThe Chatroom Module before 4.7.x.-1.0 for Drupal broadcasts Chatroom visitors' session IDs to all participants, which allows remote attackers to hijack sessions and gain privileges.
unknown
2006-12-13
7.0CVE-2006-6528
OTHER-REF
SECUNIA
Drupal -- Chatroom ModuleThe Chatroom Module before 4.7.x.-1.0 for Drupal displays private messages in a chatroom's last messages overview, which allows remote attackers to obtain sensitive information by reading the overview.
unknown
2006-12-13
7.0CVE-2006-6529
DRUPAL
SECUNIA
Drupal -- Help Tip ModuleSQL injection vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
unknown
2006-12-13
7.0CVE-2006-6530
DRUPAL
SECUNIA
Drupal -- Help Tip ModuleCross-site scripting (XSS) vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to inject arbitrary web script or HTML, and possibly obtain administrative access, via node titles.
unknown
2006-12-13
7.0CVE-2006-6531
DRUPAL
SECUNIA
EasyFill -- EasyFillMultiple SQL injection vulnerabilities in EasyFill before 0.5.1 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
unknown
2006-12-14
10.0CVE-2006-6555
OTHER-REF
FRSIRT
EasyPage -- EasyPageSQL injection vulnerability in EasyPage allows remote attackers to execute arbitrary SQL commands via unspecified vectors in sptrees/default.aspx, possibly involving the docId parameter. NOTE: this issue appears to have been disputed by a third party researcher, stating that SQL injection is not possible. However, insufficient details were provided to evaluate the dispute.
unknown
2006-12-12
7.0CVE-2006-6486
BUGTRAQ
BUGTRAQ
XF
EyeOS -- EyeOSThe eyeHome function in apps/eyeHome.eyeapp/aplic.php in EyeOS before 0.9.3-3 allows remote attackers to upload and execute arbitrary code via dangerous file extensions that are not all lowercase, which bypasses a cleansing operation.
unknown
2006-12-14
10.0CVE-2006-6556
OTHER-REF
OTHER-REF
FRSIRT
XF
EzHRS -- HR AssistSQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the Uname (UserName) parameter.
unknown
2006-12-13
7.0CVE-2006-6524
Milw0rm
FRSIRT
SECUNIA
EzHRS -- HR AssistSQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2006-12-13
7.0CVE-2006-6525
SECUNIA
Fantastic News -- Fantastic NewsSQL injection vulnerability in news.php in Fantastic News 2.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
unknown
2006-12-13
10.0CVE-2006-6542
OTHER-REF
FRSIRT
Flippet.org -- Winamp Web InterfaceMultiple buffer overflows in Winamp Web Interface (Wawi) 7.5.13 and earlier (1) allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an (a) long username or a (b) crafted packet to the FindBasicAuth function in security.cpp, related to the /browse URI; and allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a long path string in the (2) Browse, (3) CControl::Download, and (4) CControl::Load functions, related to the file parameter in the /dl URI. NOTE: some of these details are obtained from third party information.
unknown
2006-12-13
10.0CVE-2006-6539
FULLDISC
FRSIRT
SECUNIA
OTHER-REF
SECTRACK
XF
GenesisTrader -- GenesisTraderUnrestricted file upload vulnerability in upload.php in GenesisTrader 1.0 allows remote authenticated users to upload arbitrary files via unspecified vectors, possibly involving form.php and the ajoutfich "foap" action.
unknown
2006-12-15
8.0CVE-2006-6570
BUGTRAQ
GenesisTrader -- GenesisTraderMultiple cross-site scripting (XSS) vulnerabilities in form.php in GenesisTrader 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cuve, (2) chem, (3) do, and possibly other parameters.
unknown
2006-12-15
10.0CVE-2006-6571
BUGTRAQ
Gizzar -- GizzarPHP remote file inclusion vulnerability in index.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter.
unknown
2006-12-13
7.0CVE-2006-6526
OTHER-REF
FRSIRT
Gizzar -- GizzarPHP remote file inclusion vulnerability in guest.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2006-12-13
7.0CVE-2006-6527
FRSIRT
IBM -- WebSphere Host On-DemandIBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html.
unknown
2006-12-13
7.0CVE-2006-6537
BUGTRAQ
SECUNIA
Justsystem -- Ichitaro viewer
Justsystem -- Ichitaro
Justsystem -- Ichitaro Lite2
Justsystem -- Sanshiro
Justsystem -- Hanako viewer
Justsystem -- Hanako
Buffer overflow in JustSystems Hanako 2004 through 2006, Hanako viewer 1.x, Ichitaro 2004, Ichitaro 2005, Ichitaro Lite2, Ichitaro viewer 4.x, and Sanshiro 2005 allows remote attackers to execute arbitrary code via the (1) Keyword and (2) Title fields, related to string length fields.
unknown
2006-12-09
7.0CVE-2006-6400
OTHER-REF
OTHER-REF
OTHER-REF
BID
FRSIRT
SECTRACK
SECUNIA
KDPics -- KDPicsMultiple PHP remote file inclusion vulnerabilities in KDPics 1.16 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) page parameter to (a) index.php3, or the (2) lib_path parameter to (b) authenticate.inc.php3 or (c) lib/exifer/exif.php.
unknown
2006-12-13
7.0CVE-2006-6516
BUGTRAQ
BID
FRSIRT
SECUNIA
Lotfian -- Request For TravelSQL injection vulnerability in ProductDetails.asp in Lotfian Request For Travel 1.0 allows remote attackers to execute arbitrary SQL commands via the PID parameter.
unknown
2006-12-14
10.0CVE-2006-6559
OTHER-REF
FRSIRT
MailEnable -- MailEnable Enterprise
MailEnable -- MailEnable Professional
Stack-based buffer overflow in the IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.35, Professional Edition 1.6 through 1.84, and Enterprise Edition 1.1 through 1.41 allows remote attackers to execute arbitrary code via a pre-authentication command followed by a crafted parameter and a long string, as addressed by the ME-10025 hotfix.
unknown
2006-12-11
10.0CVE-2006-6423
OTHER-REF
OTHER-REF
XF
BUGTRAQ
BID
SECUNIA
Mantis -- MantisMantis before 1.1.0a2 sets the default value of $g_bug_reminder_threshold to "reporter" instead of a more privileged role, which has unknown impact and attack vectors, possibly related to frequency of reminders.
unknown
2006-12-13
7.0CVE-2006-6515
OTHER-REF
OTHER-REF
McAfee -- VirusScanUntrusted search path vulnerability in McAfee VirusScan for Linux 4510e and earlier includes the current working directory in the DT_RPATH environment variable, which allows local users to load arbitrary ELF DSO libraries and execute arbitrary code by installing malicious libraries in that directory.
unknown
2006-12-14
7.0CVE-2006-6474
GENTOO
BID
Microsoft -- Internet ExplorerMicrosoft Internet Explorer 6 and earlier allows remote attackers to read Temporary Internet Files (TIF) and obtain sensitive information via unspecified vectors involving certain drag and drop operations, aka "TIF Folder Information Disclosure Vulnerability," and a different issue than CVE-2006-5577.
unknown
2006-12-12
7.0CVE-2006-5578
MS
FRSIRT
SECTRACK
SECUNIA
Microsoft -- Internet ExplorerMicrosoft Internet Explorer 6 allows remote attackers to execute arbitrary code by using JavaScript to cause certain errors simultaneously, which results in the access of previously freed memory, aka "Script Error Handling Memory Corruption Vulnerability."
unknown
2006-12-12
7.0CVE-2006-5579
MS
BUGTRAQ
OTHER-REF
CERT-VN
FRSIRT
SECTRACK
SECUNIA
Microsoft -- Internet ExplorerUnspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via certain DHTML script functions, such as normalize, and "incorrectly created elements" that trigger memory corruption, aka "DHTML Script Function Memory Corruption Vulnerability."
unknown
2006-12-12
10.0CVE-2006-5581
MS
OTHER-REF
BUGTRAQ
CERT-VN
FRSIRT
SECTRACK
SECUNIA
Microsoft -- Windows Server 2003Buffer overflow in the SNMP Service in Microsoft Windows 2000 SP4, XP SP2, Server 2003, Server 2003 SP1, and possibly other versions allows remote attackers to execute arbitrary code via a crafted SNMP packet, aka "SNMP Memory Corruption Vulnerability."
unknown
2006-12-12
10.0CVE-2006-5583
MS
FRSIRT
SECTRACK
SECUNIA
Microsoft -- Windows 2000The Remote Installation Service (RIS) in Microsoft Windows 2000 SP4 uses a TFTP server that allows anonymous access, which allows remote attackers to upload and overwrite arbitrary files to gain privileges on systems that use RIS.
unknown
2006-12-12
7.0CVE-2006-5584
MS
FRSIRT
SECTRACK
SECUNIA
Microsoft -- WordUnspecified vulnerability in Microsoft Word allows user-assisted remote attackers to execute arbitrary code via a crafted DOC file that triggers memory corruption, as demonstrated via the 12122006-djtest.doc file, a different issue than CVE-2006-5994 and CVE-2006-6456.
unknown
2006-12-14
8.0CVE-2006-6561
BUGTRAQ
OTHER-REF
OTHER-REF
OTHER-REF
CERT-VN
BID
FRSIRT
OTHER-REF
mxBB -- mxBB NewsSuitePHP remote file inclusion vulnerability in includes/newssuite_constants.php in the NewsSuite 1.03 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the mx_root_path parameter.
unknown
2006-12-14
10.0CVE-2006-6553
OTHER-REF
FRSIRT
SECUNIA
MxBB -- ModSDBPHP remote file inclusion vulnerability in includes/common.php in the mx_modsdb 1.0.0 module for MxBB (aka MX-System) Portal allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
unknown
2006-12-14
10.0CVE-2006-6560
OTHER-REF
FRSIRT
SECUNIA
XF
mxBB -- mxBBPHP remote file inclusion vulnerability in includes/profilcp_constants.php in the Profile Control Panel (CPanel) module for mxBB 0.91c allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
unknown
2006-12-15
7.0CVE-2006-6566
OTHER-REF
OTHER-REF
MLIST
MLIST
FRSIRT
XF
MxBB -- kb_modsPHP remote file inclusion vulnerability in includes/kb_constants.php in the Knowledge Base (mx_kb) 2.0.2 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
unknown
2006-12-15
10.0CVE-2006-6567
OTHER-REF
BID
FRSIRT
SECUNIA
XF
MxBB -- kb_modsDirectory traversal vulnerability in includes/kb_constants.php in the Knowledge Base (mx_kb) 2.0.2 module for mxBB allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the phpEx parameter.
unknown
2006-12-15
10.0CVE-2006-6568
OTHER-REF
BID
SECUNIA
XF
MyStats -- MyStatsMultiple cross-site scripting (XSS) vulnerabilities in mystats.php in MyStats 1.0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) connexion, (2) by, and (3) details parameter.
unknown
2006-12-09
7.0CVE-2006-6401
BUGTRAQ
FRSIRT
OSVDB
SECTRACK
SECUNIA
MyStats -- MyStatsSQL injection vulnerability in mystats.php in MyStats 1.0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the details parameter.
unknown
2006-12-09
7.0CVE-2006-6402
BUGTRAQ
FRSIRT
OSVDB
SECTRACK
SECUNIA
osCommerce -- osCommerceDirectory traversal vulnerability in admin/templates_boxes_layout.php in osCommerce 3.0a3 allows remote attackers to include and execute arbitrary PHP files via a .. (dot dot) in the filter parameter. NOTE: this issue can be leveraged to obtain full path information in error messages.
unknown
2006-12-13
7.0CVE-2006-6533
OTHER-REF
BID
FRSIRT
SECTRACK
XF
PHP -- Animated Smiley GeneratorPHP remote file inclusion vulnerability in signer/final.php in Animated Smiley Generator allows remote attackers to execute arbitrary PHP code via a URL in the smiley parameter.
unknown
2006-12-13
10.0CVE-2006-6541
BUGTRAQ
XF
PHP -- ErrorDocsPHP remote file inclusion vulnerability in includes/common.php in the ErrorDocs 1.0.0 and earlier module for mxBB (mx_errordocs) allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
unknown
2006-12-13
10.0CVE-2006-6545
OTHER-REF
FRSIRT
SECUNIA
XF
PHP -- Phorum** DISPUTED ** PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the db_file parameter. NOTE: CVE disputes this vulnerability because db_file is defined before use.
unknown
2006-12-14
10.0CVE-2006-6550
OTHER-REF
XF
PHP -- Blog:CMSPHP remote file inclusion vulnerability in admin/plugins/NP_UserSharing.php in BLOG:CMS 4.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DIR_ADMIN parameter.
unknown
2006-12-14
10.0CVE-2006-6552
BUGTRAQ
OTHER-REF
SECUNIA
SECTRACK
XF
Rad Inks -- Rad Upload** DISPUTED ** PHP remote file inclusion vulnerability in upload.php in Rad Upload 3.02 allows remote attackers to execute arbitrary PHP code via a URL in the save_path parameter. NOTE: CVE disputes this vulnerability because save_path is originally defined as "" before use, and the nearby instructions say "SET THE SAVE PATH by editing the line below."
unknown
2006-12-14
7.0CVE-2006-6549
BUGTRAQ
SCRIPTPHP -- AnnonceScriptHPMultiple SQL injection vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a) email.php, the (2) no parameter in (b) voirannonce.php, the (3) idmembre parameter in (c) admin/admin_membre/fiche_membre.php, and the (4) idannonce parameter in (d) admin/admin_annonce/okvalannonce.php and (e) admin/admin_annonce/changeannonce.php.
unknown
2006-12-11
10.0CVE-2006-6478
BUGTRAQ
BID
FRSIRT
SECUNIA
XF
SCRIPTPHP -- AnnonceScriptHPMultiple cross-site scripting (XSS) vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the email parameter in (1) erreurinscription.php, (2) Templates/admin.dwt.php, (3) Templates/commun.dwt.php, (4) membre.dwt.php, and (5) admin/admin_config/Aide.php.
unknown
2006-12-11
10.0CVE-2006-6479
BUGTRAQ
BID
FRSIRT
SECUNIA
XF
SCRIPTPHP -- ProNewsMultiple cross-site scripting (XSS) vulnerabilities in ProNews 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo, (2) email, (3) date, (4) sujet, (5) message, (6) site, and (7) lien parameters to (a) admin/change.php, and the (8) aa parameter to (b) lire-avis.php.
unknown
2006-12-13
7.0CVE-2006-6518
BUGTRAQ
BID
SCRIPTPHP -- ProNewsSQL injection vulnerability in lire-avis.php in ProNews 1.5 allows remote attackers to execute arbitrary SQL commands via the aa parameter.
unknown
2006-12-13
7.0CVE-2006-6519
BUGTRAQ
BID
SCRIPTPHP -- MessageriescripthpMultiple cross-site scripting (XSS) vulnerabilities in Messageriescripthp 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo parameter to (a) existepseudo.php, the (2) email parameter to (b) existeemail.php, or the (3) pageName or (4) cssform parameter to (c) Contact/contact.php.
unknown
2006-12-13
7.0CVE-2006-6520
BUGTRAQ
BID
SCRIPTPHP -- MessageriescripthpSQL injection vulnerability in lire-avis.php in Messageriescripthp 2.0 allows remote attackers to execute arbitrary SQL commands via the aa parameter.
unknown
2006-12-13
7.0CVE-2006-6521
BUGTRAQ
BID
ShopSite -- ShopSiteMultiple cross-site scripting (XSS) vulnerabilities in ShopSite 8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the prevlocation parameter in shopper/sc/registration.cgi and other unspecified vectors.
unknown
2006-12-12
7.0CVE-2006-6485
BUGTRAQ
OTHER-REF
SECTRACK
BUGTRAQ
OTHER-REF
FRSIRT
SECUNIA
XF
Sophos -- Sophos Anti-VirusMultiple buffer overflows in Sophos Anti-Virus scanning engine before 2.40 allow remote attackers to execute arbitrary code via (1) a SIT archive with a long filename that is not null-terminated, which triggers a heap-based overflow in veex.dll due to improper length calculation, and (2) a CPIO archive, with a long filename that is not null-terminated, which triggers a stack-based overflow in veex.dll.
unknown
2006-12-12
10.0CVE-2006-6335
OTHER-REF
OTHER-REF
OTHER-REF
OTHER-REF
FRSIRT
BUGTRAQ
BUGTRAQ
BID
SECUNIA
XF
XF
SWsoft -- PleskMultiple cross-site scripting (XSS) vulnerabilities in SWsoft Plesk 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) get_password.php or (2) login_up.php3.
2006-11-05
2006-12-10
7.0CVE-2006-6451
BUGTRAQ
OTHER-REF
BID
SECTRACK
XF
Symantec -- Veritas NetBackup Enterprise Server
Symantec -- Veritas NetBackup Server
Symantec -- Veritas NetBackup Client
The NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 does not properly check for chained commands, which allows remote attackers to execute arbitrary commands by appending malicious commands to valid commands.
unknown
2006-12-14
7.0CVE-2006-4902
ISS
OTHER-REF
BID
FRSIRT
SECUNIA
SECTRACK
Symantec -- Veritas NetBackup Enterprise Server
Symantec -- Veritas NetBackup Server
Symantec -- Veritas NetBackup Client
Stack-based buffer overflow in the NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 allows remote attackers to execute arbitrary code via a long CONNECT_OPTIONS request, a different issue than CVE-2006-6222.
unknown
2006-12-14
7.0CVE-2006-5822
BUGTRAQ
OTHER-REF
OTHER-REF
BID
FRSIRT
SECUNIA
SECTRACK
Symantec -- Veritas NetBackup Enterprise Server
Symantec -- Veritas NetBackup Server
Symantec -- Veritas NetBackup Client
Stack-based buffer overflow in the NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 allows remote attackers to execute arbitrary code via a long request with a malformed length prefix.
unknown
2006-12-14
7.0CVE-2006-6222
BUGTRAQ
OTHER-REF
OTHER-REF
BID
FRSIRT
SECUNIA
SECTRACK
XF
Tucows -- Client Code SuitePHP remote file inclusion vulnerability in libs/tucows/api/cartridges/crt_TUCOWS_domains/lib/domainutils.inc.php in Tucows Client Code Suite (CCS) 1.2.1015 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _ENV[TCA_HOME] parameter.
unknown
2006-12-14
10.0CVE-2006-6551
OTHER-REF
XF
Vt-Forum -- Vt-Forum LiteMultiple cross-site scripting (XSS) vulnerabilities in Vt-Forum Lite 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) StrMsg or (2) Topic_ID parameter to (a) vf_info.asp, (b) vf_newtopic.asp, (c) vf_settings.asp, and (d) vf_replytopic.asp, different vectors than CVE-2006-6447. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2006-12-13
7.0CVE-2006-6532
FRSIRT
XF
WikiTimeScale -- TwoZeroMultiple cross-site scripting (XSS) vulnerabilities in WikiTimeScale TwoZero before 2.31 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in the (1) forum module and (2) event descriptions. NOTE: some of these details are obtained from third party information.
unknown
2006-12-13
7.0CVE-2006-6522
OTHER-REF
FRSIRT
XF
Xerox -- WorkCentre Pro
Xerox -- WorkCentre
The Web User Interface in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allows remote attackers to execute arbitrary commands via unspecified vectors involving "command injection" in (1) the TCP/IP hostname, (2) Scan-to-mailbox folder names, and (3) certain parameters in the Microsoft Networking configuration. NOTE: vector 1 might be the same as CVE-2006-5290.
unknown
2006-12-10
7.0CVE-2006-6427
OTHER-REF
FRSIRT
SECTRACK
SECUNIA
OTHER-REF
Xerox -- WorkCentre Pro
Xerox -- WorkCentre
Multiple unspecified vulnerabilities in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 have unknown impact and attack vectors, related to (1) an Immediate Image Overwrite (IIO) error message at the Local User Interface (LUI) if overwrite fails, (2) an IIO failure when a Held Job is deleted, and (3) an On Demand Image Overwrite failure when the overwrite is greater than 2 Gb.
unknown
2006-12-11
10.0CVE-2006-6473
OTHER-REF
SECUNIA

Back to top

Medium Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
Bluetrait -- BluetraitSQL injection vulnerability in bt-trackback.php in Bluetrait before 1.2.0, when trackback is enabled, allows remote attackers to execute arbitrary SQL commands via unspecified parameters. NOTE: some of these details are obtained from third party information.
unknown
2006-12-13
5.6CVE-2006-6540
OTHER-REF
FRSIRT
SECUNIA
Cilem -- Cilem HaberCross-site scripting (XSS) vulnerability in hata.asp in Cilem Haber Free Edition allows remote attackers to inject arbitrary web script or HTML via the hata parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2006-12-13
5.6CVE-2006-6536
BID
Citrix -- Advanced Access Control
Citrix -- Access Gateway
Unspecified vulnerability in Citrix Advanced Access Control (AAC) Option 4.0, and Access Gateway 4.2 with Advanced Access Control 4.2, before 20061114, when the Browser-Only access feature is enabled, allows remote authenticated users to bypass access policies via a certain login method, a different issue than CVE-2006-4846. NOTE: some of these details are obtained from third party information.
unknown
2006-12-15
4.2CVE-2006-6572
OTHER-REF
SECTRACK
Citrix -- Access Gateway Appliance
Citrix -- Access Gateway AAC
Citrix -- Access Gateway
Unspecified vulnerability in Citrix Access Gateway 4.5 Advanced Edition, and 4.2 with Advanced Access Control (AAC) 4.2, when deployed on the Access Gateway appliance 4.2 through 4.2.2 allows remote authenticated users to "gain access to data" and obtain sensitive information via unspecified vectors.
unknown
2006-12-15
4.2CVE-2006-6573
OTHER-REF
SECTRACK
Computer Associates -- Internet Security Suite
Computer Associates -- eTrust Antivirus
The (1) VetMONNT.sys and (2) VetFDDNT.sys drivers in CA Anti-Virus 2007 8.1, Anti-Virus for Vista Beta 8.2, and CA Internet Security Suite 2007 v3.0 do not properly handle NULL buffers, which allows local users with administrative access to cause a denial of service (system crash) via certain IOCTLs.
unknown
2006-12-13
4.2CVE-2006-6496
OTHER-REF
OTHER-REF
OTHER-REF
FRSIRT
OSVDB
dadaIMC -- dadaIMCdadaIMC .99.3 uses an insufficiently restrictive FilesMatch directive in the installed .htaccess file, which allows remote attackers to execute arbitrary PHP code by uploading files whose names contain (1) feature, (2) editor, (3) newswire, (4) otherpress, (5) admin, (6) pbook, (7) media, or (8) mod, which are processed as PHP file types (application/x-httpd-php).
unknown
2006-12-13
5.6CVE-2006-6511
OTHER-REF
FRSIRT
SECUNIA
XF
Enemies of Carlotta -- Enemies of Carlottaeoc.py in Enemies of Carlotta (EoC) before 1.2.4 allows remote attackers to execute arbitrary commands via shell metacharacters in an "SMTP level e-mail address".
unknown
2006-12-13
5.6CVE-2006-5875
DEBIAN
MLIST
BID
FRSIRT
SECUNIA
KDPics -- KDPicsMultiple cross-site scripting (XSS) vulnerabilities in KDPics 1.16 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) categories parameter to (a) index.php3 or (b) galeries.inc.php3.
unknown
2006-12-13
5.6CVE-2006-6517
BUGTRAQ
BID
FRSIRT
SECUNIA
Linux -- Linux kernelThe do_coredump function in fs/exec.c in the Linux kernel 2.6.19 sets the flag variable to O_EXCL but does not use it, which allows context-dependent attackers to modify arbitrary files via a rewrite attack during a core dump.
unknown
2006-12-14
4.9CVE-2006-6304
OTHER-REF
BID
FRSIRT
Microsoft -- Outlook ExpressUnspecified vulnerability in Microsoft Outlook Express 6 and earlier allows remote attackers to execute arbitrary code via a crafted contact record in a Windows Address Book (WAB) file.
unknown
2006-12-12
5.6CVE-2006-2386
MS
FRSIRT
SECTRACK
SECUNIA
XF
Microsoft -- Windows Media Player
Microsoft -- Windows XP
Microsoft -- Server 2003
Buffer overflow in the Windows Media Format Runtime in Microsoft Windows Media Player (WMP) 6.4 and Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file.
unknown
2006-12-12
5.6CVE-2006-4702
MS
SECTRACK
Microsoft -- Windows Server 2003
Microsoft -- Windows XP
The Client-Server Run-time Subsystem in Microsoft Windows XP SP2 and Server 2003 allows local users to gain privileges via a crafted file manifest within an application, aka "File Manifest Corruption Vulnerability."
unknown
2006-12-12
4.2CVE-2006-5585
MS
SECUNIA
FRSIRT
SECTRACK
SECUNIA
MidiCart Software -- MidiCart PHP Shopping CartUnrestricted file upload vulnerability in admin/add.php in Midicart allows remote authenticated users to upload arbitrary .php files, and possibly other files, to the images/ directory under the web root.
unknown
2006-12-11
5.4CVE-2006-6463
BUGTRAQ
BID
SECUNIA
mlipod -- Winamp iPod PluginBuffer overflow in the readAA function in read_aa.cpp in Winamp iPod Plugin (ml_ipod) 2.00 p19 and earlier allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long tag in an audible.com audiobook (aa) file.
unknown
2006-12-14
5.6CVE-2006-6547
OTHER-REF
OTHER-REF
OTHER-REF
BID
FRSIRT
OpenLDAP -- OpenLDAPBuffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos.c in OpenLDAP 2.4.3 and earlier, when OpenLDAP is compiled with the --enable-kbind (Kerberos KBIND) option, allows remote attackers to execute arbitrary code via an LDAP bind request using the LDAP_AUTH_KRBV41 authentication method and long credential data.
unknown
2006-12-12
5.6CVE-2006-6493
BUGTRAQ
OTHER-REF
FRSIRT
SECUNIA
osCommerce -- osCommerceMultiple cross-site scripting (XSS) vulnerabilities in osCommerce 3.0a3 allow remote attackers to inject arbitrary web script or HTML via the (1) set parameter to admin/modules.php, the (2) selected_box parameter to definitiva/admin/customers.php, the (3) lID parameter to admin/languages_definitions.php, or the (4) pID parameter to admin/products.php.
2006-11-11
2006-12-13
5.6CVE-2006-6534
BLOGSPOT
BID
SECTRACK
phpBB Group -- phpBBCross-site scripting (XSS) vulnerability in the private message box implementation (privmsg.php) in phpBB 2.0.x allows remote authenticated users to inject arbitrary web script or HTML via the "Message body" field in a message to a non-existent user. NOTE: this attack may not cross privilege boundaries, since the XSS is reflected back to the attacker, but not anyone else. Therefore this might not be a vulnerability.
unknown
2006-12-10
4.2CVE-2006-6421
BUGTRAQ
SECUNIA
XF
Skulls -- SkullsMultiple unspecified vulnerabilities in Skulls! before 0.2.6 have unknown impact and attack vectors, as addressed by "Many security fixes."
unknown
2006-12-14
5.6CVE-2006-6557
OTHER-REF
FRSIRT

Back to top

Low Vulnerabilities
Primary
Vendor -- Product
Description
Discovered
Published
CVSS ScoreSource & Patch Info
Adobe -- ColdFusionAdobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request (1) for a non-existent (a) JWS, (b) CFM, (c) CFML, or (d) CFC file, which displays the installation path in the resulting error message; or (2) to /CFIDE/administrator/login.cfm without a host, which can reveal the server's internal IP address in an HREF tag.
unknown
2006-12-12
2.3CVE-2006-6482
BUGTRAQ
FRSIRT
SECTRACK
SECUNIA
Clam Anti-Virus -- ClamAVClam AntiVirus (ClamAV) 0.88 and earlier allows remote attackers to cause a denial of service (crash) via a malformed base64-encoded MIME attachment that triggers a null pointer dereference.
unknown
2006-12-09
2.3CVE-2006-5874
DEBIAN
MANDRIVA
SECUNIA
SECUNIA
Clam Anti-Virus -- ClamAVClam AntiVirus (ClamAV) 0.88.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
unknown
2006-12-09
2.3CVE-2006-6406
BUGTRAQ
OTHER-REF
BID
MANDRIVA
SECUNIA
Clam Anti-Virus -- ClamAVClam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.
unknown
2006-12-11
2.3CVE-2006-6481
OTHER-REF
MANDRIVA
SECUNIA
SECUNIA
cPanel -- WebHost ManagerMultiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the domain parameter to (1) scripts2/changeemail, (2) scripts2/limitbw, or (3) scripts/rearrangeacct. NOTE: the feature parameter to scripts2/dofeaturemanager is already covered by CVE-2006-6198.
unknown
2006-12-14
2.7CVE-2006-6548
BUGTRAQ
OTHER-REF
XF
Crob -- Crob FTP ServerCrob FTP Server 3.6.1 b.263 allows remote attackers to cause a denial of service via a long series of "?A" sequences in the (1) LIST and possibly (2) NLST command.
unknown
2006-12-14
2.3CVE-2006-6558
Milw0rm
SECUNIA
D-BUS -- D-BUSUnspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match rules for other applications and cause a denial of service (lost process messages).
unknown
2006-12-13
1.0CVE-2006-6107
BID
OTHER-REF
FRSIRT
OTHER-REF
XF
D-LINK -- DWL-2000AP+D-LINK DWL-2000AP+ firmware 2.11 allows remote attackers to cause (1) a denial of service (device reset) via a flood of ARP replies on the wired or wireless (radio) link and (2) a denial of service (device crash) via a flood of ARP requests on the wireless link.
unknown
2006-12-13
3.3CVE-2006-6538
BUGTRAQ
OTHER-REF
Debian -- Debian Linux
l2tpns -- l2tpns
Buffer overflow in the cluster_process_heartbeat function in cluster.c in layer 2 tunneling protocol network server (l2tpns) before 2.1.21 allows remote attackers to cause a denial of service via a large heartbeat packet.
unknown
2006-12-11
3.3CVE-2006-5873
OTHER-REF
OTHER-REF
DEBIAN
BID
FRSIRT
SECUNIA
SECUNIA
XF
F-Prot -- F-Prot AntivirusF-Prot Antivirus for Linux x86 Mail Servers 4.6.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
unknown
2006-12-09
2.3CVE-2006-6407
BUGTRAQ
OTHER-REF
BID
FileZilla -- FileZillaFileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a malformed argument to the STOR command, which results in a NULL pointer dereference. NOTE: CVE analysis suggests that the problem might be due to a malformed PORT command.
unknown
2006-12-15
3.3CVE-2006-6564
OTHER-REF
OTHER-REF
FRSIRT
XF
FileZilla -- FileZilla ServerFileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to the (1) LIST or (2) NLST commands, which results in a NULL pointer dereference, a different set of vectors than CVE-2006-????. NOTE: CVE analysis suggests that the problem might be due to a malformed PORT command.
unknown
2006-12-15
3.3CVE-2006-6565
OTHER-REF
OTHER-REF
FRSIRT
XF
Flippet.org -- Winamp Web InterfaceDirectory traversal vulnerability in the Browse function (/browse URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to list arbitrary directories via URL encoded backslashes ("%2F") in the path parameter.
unknown
2006-12-13
1.1CVE-2006-6512
FULLDISC
FRSIRT
SECUNIA
OTHER-REF
SECTRACK
XF
Flippet.org -- Winamp Web InterfaceThe CControl::Download function (/dl URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to download arbitrary file types under the root via a trailing "." (dot) in a filename in the file parameter, related to erroneous behavior of the IsWinampFile function.
unknown
2006-12-13
1.1CVE-2006-6513
FULLDISC
FRSIRT
SECUNIA
OTHER-REF
SECTRACK
Flippet.org -- Winamp Web InterfaceWinamp Web Interface (Wawi) 7.5.13 and earlier uses an insufficient comparison to determine whether a directory is located below the application's root directory, which allows remote authenticated users to access certain other directories if the name of the root directory is a substring of the name of the target directory, as demonstrated by accessing C:\folder2 when the root directory is C:\folder.
unknown
2006-12-13
1.1CVE-2006-6514
FULLDISC
FRSIRT
SECUNIA
OTHER-REF
SECTRACK
GenesisTrader -- GenesisTraderform.php in GenesisTrader 1.0 allows remote attackers to read source code for arbitrary files and obtain sensitive information via the (1) do and (2) chem parameters with a "modfich" floap parameter.
unknown
2006-12-15
3.3CVE-2006-6569
BUGTRAQ
GNOME -- GDMFormat string vulnerability in the host chooser window (gdmchooser) in GNOME Foundation Display Manager (gdm) allows local users to execute arbitrary code via format string specifiers in a hostname, which are used in an error dialog.
unknown
2006-12-14
2.9CVE-2006-6105
IDEFENSE
BID
SECTRACK
Kaspersky Lab -- Kaspersky Anti-VirusKaspersky Anti-Virus for Linux Mail Servers 5.5.10 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
unknown
2006-12-09
2.3CVE-2006-6408
BUGTRAQ
OTHER-REF
BID
Kerio -- Kerio MailServerUnspecified vulnerability in Kerio MailServer before 6.3.1 allows remote attackers to cause a denial of service (service stop) via certain LDAP queries.
unknown
2006-12-14
1.6CVE-2006-6554
OTHER-REF
FRSIRT
SECUNIA
XF
Linux -- Linux kernelsmbfs in Linux kernel 2.6.8 and other versions, and 2.4.x before 2.4.34, when UNIX extensions are enabled, ignores certain mount options, which could cause clients to use server-specified uid, gid and mode settings.
unknown
2006-12-11
2.3CVE-2006-5871
SECUNIA
SECUNIA
MailEnable -- MailEnable Enterprise
MailEnable -- MailEnable Professional
The IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.34, Professional Edition 1.6 through 1.83, and Enterprise Edition 1.1 through 1.40 allows remote attackers to cause a denial of service (crash) via unspecified vectors that trigger a null pointer dereference, as addressed by the ME-10023 hotfix, and a different issue than CVE-2006-6423. NOTE: some details were obtained from third party information.
unknown
2006-12-12
2.3CVE-2006-6484
OTHER-REF
BID
SECUNIA
XF
Microsoft -- Internet ExplorerMicrosoft Internet Explorer 6 and earlier allows remote attackers to obtain sensitive information via unspecified uses of the OBJECT HTML tag, which discloses the absolute path of the corresponding TIF folder, aka "TIF Folder Information Disclosure Vulnerability," and a different issue than CVE-2006-5578.
unknown
2006-12-12
2.3CVE-2006-5577
MS
FRSIRT
SECTRACK
SECUNIA
MyStats -- MyStatsmystats.php in MyStats 1.0.8 and earlier allows remote attackers to obtain the installation path via (1) details and (2) by array parameters, probably resulting in a path disclosure in an error message.
unknown
2006-12-09
2.3CVE-2006-6403
BUGTRAQ
SECTRACK
XF
phpBB Group -- phpBBCross-site request forgery (CSRF) vulnerability in phpBB 2.0.21 allows remote authenticated users to send unauthorized messages as an arbitrary user via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
unknown
2006-12-13
3.4CVE-2006-6508
SECUNIA
XF
ProFTPD Project -- ProFTPDStack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value.
unknown
2006-12-15
3.4CVE-2006-6563
BUGTRAQ
OTHER-REF
OTHER-REF
BID
FRSIRT
SECUNIA
SCRIPTPHP -- AnnonceScriptHPadmin/admin_membre/fiche_membre.php in AnnonceScriptHP 2.0 allows remote attackers to obtain sensitive information via the idmembre parameter, which discloses the passwords for arbitrary users.
unknown
2006-12-11
2.3CVE-2006-6480
BUGTRAQ
BID
SECUNIA
XF
SiteKiosk -- SiteKioskCross-site scripting (XSS) vulnerability in the skinning feature in SiteKiosk before 6.5.150 allows local users to bypass security protections and inject arbitrary web script or HTML via an ABOUT: URI, which is displayed in the title bar of the browser.
2006-11-30
2006-12-13
2.9CVE-2006-6509
BUGTRAQ
OTHER-REF
BID
FRSIRT
SECUNIA
XF
SiteKiosk -- SiteKioskAn unspecified ActiveX control in SiteKiosk before 6.5.150 is installed "safe for scripting", which allows local users to bypass security protections and read arbitrary files via certain functions.
unknown
2006-12-13
1.0CVE-2006-6510
BUGTRAQ
OTHER-REF
BID
FRSIRT
SECUNIA
XF
Softwin -- BitDefender Mail ProtectionBitDefender Mail Protection for SMB 2.0 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.
unknown
2006-12-09
2.3CVE-2006-6405
BUGTRAQ
OTHER-REF
BID
Sun -- SolarisDirectory traversal vulnerability in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via a .. (dot dot) sequence in the LANG environment variable that points to a locale file containing attacker-controlled format string specifiers.
unknown
2006-12-12
3.4CVE-2006-6494
IDEFENSE
SUNALERT
BID
FRSIRT
SECTRACK
SECUNIA
Sun -- SolarisStack-based buffer overflow in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via large precision padding values in a format string specifier in the format parameter of the doprf function. NOTE: this issue normally does not cross privilege boundaries, except in cases of external introduction of malicious message files, or if it is leveraged with other vulnerabilities such as CVE-2006-6494.
unknown
2006-12-12
3.4CVE-2006-6495
IDEFENSE
SUNALERT
BID
FRSIRT
SECTRACK
SECUNIA
Ubuntu -- Ubuntu LinuxUbuntu Linux 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (resource consumption) by using the (1) sys_get_robust_list and (2) sys_set_robust_list functions to create processes that cannot be killed.
unknown
2006-12-13
1.4CVE-2006-5648
UBUNTU
SECUNIA
SECUNIA
Ubuntu -- Ubuntu LinuxUnspecified vulnerability in the "alignment check exception handling" in Ubuntu 5.10, 6.06 LTS, and 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (kernel panic) via unspecified vectors.
unknown
2006-12-13
1.4CVE-2006-5649
UBUNTU
DEBIAN
SECUNIA
SECUNIA
SECUNIA

Back to top

Was this document helpful?  Yes  |  Somewhat  |  No

Back to Top