CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In January 2006

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2006-0484 Dir. Trav. 2006-01-31 2018-10-19
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in Vis.pl, as part of the FACE CONTROL product, allows remote attackers to read arbitrary files via a .. (dot dot) in any parameter that opens a file, such as (1) s or (2) p.
2 CVE-2006-0483 DoS 2006-01-31 2018-10-30
7.8
 None Remote Low Not required None None Complete
Cisco VPN 3000 series concentrators running software 4.7.0 through 4.7.2.A allow remote attackers to cause a denial of service (device reload or user disconnect) via a crafted HTTP packet.
3 CVE-2006-0482 DoS 2006-01-31 2017-07-20
2.1
 None Local Low Not required None None Partial
Linux kernel 2.6.15.1 and earlier, when running on SPARC architectures, allows local users to cause a denial of service (hang) via a "date -s" command, which causes invalid sign extended arguments to be provided to the get_compat_timespec function call.
4 CVE-2006-0481 119 DoS Overflow 2006-01-31 2017-10-11
5.0
 None Remote Low Not required None None Partial
Heap-based buffer overflow in the alpha strip capability in libpng 1.2.7 allows context-dependent attackers to cause a denial of service (crash) when the png_do_strip_filler function is used to strip alpha channels out of the image.
5 CVE-2006-0480 XSS 2006-01-31 2018-10-19
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Articles module in sPaiz-Nuke allows remote attackers to inject arbitrary web script or HTML via the query parameter in the search file.
6 CVE-2006-0479 XSS Bypass File Inclusion 2006-01-31 2017-07-20
4.3
 None Remote Medium Not required None Partial None
pmwiki.php in PmWiki 2.1 beta 20, with register_globals enabled, allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GPC variable and a GLOBALS[] variable with the same name, which causes PmWiki to unset the GLOBALS[] variable but not the GPC variable, which creates resultant vulnerabilities such as remote file inclusion and cross-site scripting (XSS).
7 CVE-2006-0478 2006-01-31 2017-07-20
7.5
 None Remote Low Not required Partial Partial Partial
CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php. NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the vulnerability on all known 6.0x and 6.1x releases. We strongly encourage users of CRE Loaded 6.x, osCMax, and other users of osCommerce who have installed HTMLArea based WYSIWYG editors and Admin Access with Levels to modify thier installations at the earliest possible moment."
8 CVE-2006-0477 Exec Code Overflow 2006-01-31 2017-07-20
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to execute arbitrary code via an index file with a long symbolic link.
9 CVE-2006-0476 Exec Code Overflow 2006-01-31 2018-10-19
7.6
 None Remote High Not required Complete Complete Complete
Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field).
10 CVE-2006-0475 DoS 2006-01-31 2017-07-20
5.0
 None Remote Low Not required None None Partial
PHP-Ping 1.3 does not properly validate ping counts, which allows remote attackers to cause a denial of service (ping flood) via a negative count parameter.
11 CVE-2006-0474 Exec Code Overflow 2006-01-31 2018-10-19
7.5
 None Remote Low Not required Partial Partial Partial
Multiple integer overflows in Shareaza 2.2.1.0 allow remote attackers to execute arbitrary code via (1) a large packet length field, which causes an overflow in the ReadBuffer function in (a) BTPacket.cpp and (b) EDPacket.cpp, or (2) a large packet, which causes a heap-based overflow in the Write function in (c) Packet.h.
12 CVE-2006-0473 XSS 2006-01-31 2018-10-19
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the bbcode function in weblog.php in my little homepage my little weblog, as last modified in April 2004, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags.
13 CVE-2006-0472 XSS 2006-01-31 2018-10-19
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in guestbook.php in my little homepage my little guestbook, as last modified in March 2004, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags.
14 CVE-2006-0471 XSS 2006-01-31 2018-10-19
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the bbcode function in functions.php in my little homepage my little forum, as last modified in June 2005, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags.
15 CVE-2006-0470 XSS 2006-01-31 2017-07-20
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in search.php in MyBulletinBoard (MyBB) 1.02 allows remote attackers to inject arbitrary web script or HTML via the (1) sortby and (2) sortordr parameters, which are not properly handled in a redirection.
16 CVE-2006-0469 XSS 2006-01-30 2018-10-19
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in UebiMiau 2.7.9, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG tag.
17 CVE-2006-0468 DoS Exec Code 2006-01-30 2018-10-19
7.5
 None Remote Low Not required Partial Partial Partial
CommuniGate Pro Core Server before 5.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via LDAP messages with negative BER lengths, and possibly other vectors, as demonstrated by the ProtoVer LDAP test suite.
18 CVE-2006-0467 DoS 2006-01-31 2017-07-20
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in Pioneers (formerly gnocatan) before 0.9.49 allows remote attackers to cause a denial of service (application crash) via long chat messages.
19 CVE-2006-0466 XSS 2006-01-27 2017-07-20
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in search.asp in Goldstag Content Management System allows remote attackers to inject arbitrary web script or HTML via the text parameter.
20 CVE-2006-0465 XSS 2006-01-27 2008-09-05
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in risultati_ricerca.php in active121 Site Manager allows remote attackers to inject arbitrary web script or HTML via the cerca parameter.
21 CVE-2006-0464 Exec Code Sql 2006-01-27 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in index.php in IdeoContent Manager allow remote attackers to execute arbitrary SQL commands via the (1) goto_id or (2) mid parameter.
22 CVE-2006-0463 XSS 2006-01-27 2008-09-05
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in IdeoContent Manager allows remote attackers to inject arbitrary web script or HTML via the (1) goto_id parameter to index.php or (2) page parameter to news_full.php.
23 CVE-2006-0462 Exec Code Sql 2006-01-27 2017-07-20
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in comentarios.php in AndoNET Blog 2004.09.02 allows remote attackers to execute arbitrary SQL commands via the entrada parameter.
24 CVE-2006-0461 XSS 2006-01-27 2018-10-19
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in core.input.php in ExpressionEngine 1.4.1 allows remote attackers to inject arbitrary web script or HTML via HTTP_REFERER (referer).
25 CVE-2006-0450 DoS 2006-01-27 2018-10-19
5.0
 None Remote Low Not required None None Partial
phpBB 2.0.19 and earlier allows remote attackers to cause a denial of service (application crash) by (1) registering many users through profile.php or (2) using search.php to search in a certain way that confuses the database.
26 CVE-2006-0449 DoS 2006-01-27 2017-07-20
5.0
 None Remote Low Not required None None Partial
Early termination vulnerability in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allows remote attackers to cause a denial of service (infinite loop) by sending an APPEND command and disconnecting before the expected amount of data is sent.
27 CVE-2006-0448 DoS Dir. Trav. 2006-01-27 2017-07-20
7.5
 None Remote Low Not required Partial Partial Partial
Multiple directory traversal vulnerabilities in (1) EPSTIMAP4S.EXE and (2) SPA-IMAP4S.EXE in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allow remote attackers to (a) list arbitrary directories or cause a denial of service via the LIST command; or create arbitrary files via the (b) APPEND, (c) COPY, or (d) RENAME commands.
28 CVE-2006-0447 Exec Code Overflow 2006-01-27 2017-07-20
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in E-Post Mail Server 4.10 and SPA-PRO Mail @Solomon 4.00 allow remote attackers to execute arbitrary code via a long username to the (1) AUTH PLAIN or (2) AUTH LOGIN SMTP commands, which is not properly handled by (a) EPSTRS.EXE or (b) SPA-RS.EXE; (3) a long username in the APOP POP3 command, which is not properly handled by (c) EPSTPOP4S.EXE or (d) SPA-POP3S.EXE; (4) a long IMAP DELETE command, which is not properly handled by (e) EPSTIMAP4S.EXE or (f) SPA-IMAP4S.EXE.
29 CVE-2006-0446 Exec Code 2006-01-27 2017-07-20
6.5
 None Remote Low ??? Partial Partial Partial
Unspecified vulnerability in WeBWorK 2.1.3 and 2.2-pre1 allows remote privileged attackers to execute arbitrary commands as the web server via unknown attack vectors.
30 CVE-2006-0445 File Inclusion 2006-01-26 2018-10-19
4.0
 None Remote Low ??? Partial None None
index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by "\", which will display the full path of uploader.php. NOTE: this might be the result of a file inclusion vulnerability.
31 CVE-2006-0444 Exec Code Sql XSS 2006-01-26 2018-10-19
6.8
 None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page. NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax.
32 CVE-2006-0443 XSS 2006-01-26 2018-10-19
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in archive.php in CheesyBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) realname and (2) comment parameters, or (3) via a javascript URI in the url parameter, when adding a comment.
33 CVE-2006-0442 79 XSS 2006-01-26 2018-10-19
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in usercp.php in MyBulletinBoard (MyBB) 1.02 allow remote attackers to inject arbitrary web script or HTML via the (1) notepad parameter in a notepad action and (2) signature parameter in an editsig action. NOTE: These are different attack vectors, and probably a different vulnerability, than CVE-2006-0218 and CVE-2006-0219.
34 CVE-2006-0441 Exec Code Overflow 2006-01-26 2018-10-19
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in Sami FTP Server 2.0.1 allows remote attackers to execute arbitrary code via a long USER command, which triggers the overflow when the log is viewed.
35 CVE-2006-0440 Bypass 2006-01-26 2018-10-19
5.0
 None Remote Low Not required None Partial None
Text Rider 2.4 allows attackers to bypass authentication and upload files without providing a valid password by obtaining the MD5 hash of the password (possibly via another vulnerability that reads it from a data file), then including the hash in a cookie.
36 CVE-2006-0439 2006-01-26 2018-10-19
5.0
 None Remote Low Not required Partial None None
Text Rider 2.4 stores sensitive data in the data directory under the web document root with insufficient access control, which allows remote attackers to obtain usernames and password hashes by directly accessing data/userlist.txt.
37 CVE-2006-0436 +Priv 2006-01-26 2017-10-11
7.2
 None Local Low Not required Complete Complete Complete
Unspecified vulnerability in HP HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain privileges via unknown attack vectors.
38 CVE-2006-0435 Bypass 2006-01-26 2018-10-19
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Oracle PL/SQL (PLSQL), as used in Database Server DS 9.2.0.7 and 10.1.0.5, Application Server 1.0.2.2, 9.0.4.2, 10.1.2.0.2, 10.1.2.1.0, and 10.1.3.0.0, E-Business Suite and Applications 11.5.10, and Collaboration Suite 10.1.1, 10.1.2.0, 10.1.2.1, and 9.0.4.2, allows attackers to bypass the PLSQLExclusion list and access excluded packages and procedures, aka Vuln# PLSQL01.
39 CVE-2006-0434 22 Dir. Trav. 2006-01-26 2018-10-19
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in action.php in phpXplorer allows remote attackers to read arbitrary files via ".." (dot dot) sequences and null bytes in the sAction parameter, a different vulnerability than CVE-2006-0244. NOTE: if the functionality of phpXplorer supports the upload of PHP files, then this issue would not cross privilege boundaries and would not be a vulnerability.
40 CVE-2006-0432 2006-01-25 2017-07-20
2.1
 None Local Low Not required None Partial None
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to add custom security policies, causes incorrect policies to be created, which prevents the server from properly protecting JNDI resources.
41 CVE-2006-0431 2006-01-25 2017-07-20
2.1
 None Local Low Not required Partial None None
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server's SSL identity via unknown attack vectors.
42 CVE-2006-0430 DoS 2006-01-25 2017-07-20
5.0
 None Remote Low Not required None None Partial
Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are enabled, cause the server to run more slowly, which makes it easier for remote attackers to cause a denial of service (server slowdown).
43 CVE-2006-0429 2006-01-25 2017-07-20
2.1
 None Local Low Not required None Partial None
BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have not been activated by a server reboot, which could cause an administrator to perform inappropriate, security-relevant actions.
44 CVE-2006-0428 2006-01-25 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in BEA WebLogic Portal 8.1 SP3 through SP5, when using Web Services Remote Portlets (WSRP), allows remote attackers to access restricted web resources via crafted URLs.
45 CVE-2006-0427 2006-01-25 2017-07-20
2.1
 None Local Low Not required Partial None None
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing functionality that should have been restricted.
46 CVE-2006-0426 +Priv 2006-01-25 2017-07-20
7.5
 None Remote Low Not required Partial Partial Partial
BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges.
47 CVE-2006-0425 2006-01-25 2018-10-30
5.0
 None Remote Low Not required Partial None None
BEA WebLogic Portal 8.1 through SP4 allows remote attackers to obtain the source for a deployment descriptor file via unknown vectors.
48 CVE-2006-0424 +Info 2006-01-25 2017-07-20
4.0
 None Remote Low ??? Partial None None
BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allows remote authenticated guest users to read the server log and obtain sensitive configuration information.
49 CVE-2006-0423 +Priv 2006-01-25 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
BEA WebLogic Portal 8.1 through SP3 stores the password for the RDBMS Authentication provider in cleartext in the config.xml file, which allows attackers to gain privileges.
50 CVE-2006-0422 DoS 2006-01-25 2017-07-20
6.4
 None Remote Low Not required Partial None Partial
Multiple unspecified vulnerabilities in BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allow remote attackers to access MBean attributes or cause an unspecified denial of service via unknown attack vectors.
Total number of vulnerabilities : 381   Page : 1 (This Page)2 3 4 5 6 7 8
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.