CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In September 2006

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2006-5099 Exec Code 2006-09-29 2011-03-08
7.5
 None Remote Low Not required Partial Partial Partial
lib/exec/fetch.php in DokuWiki before 2006-03-09e, when conf[imconvert] is configured to use ImageMagick, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) w and (2) h parameters, which are not filtered when invoking convert.
2 CVE-2006-5098 DoS 2006-09-29 2011-03-08
5.0
 None Remote Low Not required None None Partial
lib/exec/fetch.php in DokuWiki before 2006-03-09e allows remote attackers to cause a denial of service (CPU consumption) via large w and h parameters, when resizing an image.
3 CVE-2006-5097 Exec Code File Inclusion 2006-09-29 2018-10-17
7.5
 None Remote Low Not required Partial Partial Partial
** DISPUTED ** PHP remote file inclusion vulnerability in index.php in net2ftp, possibly 0.1 through 0.62, allows remote attackers to execute arbitrary PHP code via a URL in the application_rootdir parameter. NOTE: this issue has been disputed by a third party researcher, CVE, and the vendor. The vendor says "the variable is set in settings.inc.php, so this is not a vulnerability."
4 CVE-2006-5096 XSS 2006-09-29 2018-10-17
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in index.php in VirtueMart (formerly known as mambo-phpShop) Joomla! eCommerce Edition CMS 1.0.11, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the Itemid parameter in a (1) com_contact or (2) subscribe action.
5 CVE-2006-5095 Exec Code File Inclusion 2006-09-29 2018-10-17
7.5
 None Remote Low Not required Partial Partial Partial
** DISPUTED ** PHP remote file inclusion vulnerability in index.php in MyPhotos 0.1.3b beta allows remote attackers to execute arbitrary PHP code via the includesdir parameter. NOTE: this issue is disputed by CVE on 20060927, since the includesdir is defined before being used when the product is installed according to the provided instructions.
6 CVE-2006-5094 Exec Code File Inclusion 2006-09-29 2018-10-17
5.1
 None Remote High Not required Partial Partial Partial
PHP remote file inclusion vulnerability in includes/functions_kb.php in the phpBB XS 2 (Spain version) allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter, a different vector than CVE-2006-4780 or CVE-2006-4893.
7 CVE-2006-5093 94 Exec Code File Inclusion 2006-09-29 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in index.php in Tagmin Control Center in TagIt! Tagboard 2.1.B Build 2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
8 CVE-2006-5092 Exec Code File Inclusion 2006-09-29 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in navigation/menu.php in A-Blog 2 allows remote attackers to execute arbitrary PHP code via a URL in the navigation_start parameter.
9 CVE-2006-5091 +Priv 2006-09-29 2018-10-17
7.2
 None Local Low Not required Complete Complete Complete
Unspecified vulnerability in HP-UX B.11.11 and B.11.23 CIFS Server (Samba) allows local users to gain privileges or obtain "unauthorized access" via unspecified vectors.
10 CVE-2006-5090 XSS 2006-09-29 2008-11-15
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in Phoenix Evolution CMS (PECMS) allow remote attackers to inject arbitrary web script or HTML via the (1) mod or (2) action parameters in index.php, or the (3) pageid parameter in modules/pageedit/index.php. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
11 CVE-2006-5089 Exec Code File Inclusion 2006-09-29 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
** DISPUTED ** PHP remote file inclusion vulnerability in mybic_server.php in Jim Plush My-BIC 0.6.5 allows remote attackers to execute arbitrary PHP code via a URL in the file parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information. CVE disputes this vulnerability because the file variable is defined before use in a way that prevents arbitrary inclusion.
12 CVE-2006-5088 Exec Code File Inclusion 2006-09-29 2018-10-17
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in connected_users.lib.php3 in phpHeaven phpMyChat 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the ChatPath parameter.
13 CVE-2006-5087 Exec Code File Inclusion 2006-09-29 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in evoBB 0.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path parameter in (1) track.php or (2) connect.php.
14 CVE-2006-5086 Sql 2006-09-29 2018-10-17
6.4
 None Remote Low Not required Partial Partial None
Blog Pixel Motion 2.1.1 allows remote attackers to change the username and password for the admin user via a direct request to insere_base.php with modified (1) login and (2) pass parameters. NOTE: this issue was claimed to be SQL injection by the original researcher, but it is not.
15 CVE-2006-5085 Exec Code 2006-09-29 2018-10-17
7.5
 None Remote Low Not required Partial Partial Partial
Static code injection vulnerability in config.php in Blog Pixel Motion 2.1.1 allows remote attackers to execute arbitrary PHP code via the nom_blog parameter, which is injected into include/variables.php.
16 CVE-2006-5084 20 DoS Exec Code 2006-09-29 2016-12-08
7.5
 None Remote Low Not required Partial Partial Partial
Format string vulnerability in the NSRunAlertPanel function in eBay Skype for Mac 1.5.*.79 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed Skype URL, as originally reported to involve a null dereference.
17 CVE-2006-5083 Exec Code File Inclusion 2006-09-29 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in includes/functions_portal.php in Integrated MODs (IM) Portal 1.2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
18 CVE-2006-5082 Exec Code 2006-09-29 2017-07-20
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Sugar Suite Open Source (SugarCRM) before 4.2.1 Patch C (20060917) has unspecified impact, related to code execution, and unspecified attack vectors.
19 CVE-2006-5081 Exec Code File Inclusion 2006-09-29 2018-10-17
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in acc.php in QuickBlogger (QB) 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
20 CVE-2006-5080 79 XSS 2006-09-29 2017-07-20
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the search function in Six Apart Movable Type 3.3 to 3.32, and Movable Type Enterprise 1.01 and 1.02, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
21 CVE-2006-5079 Exec Code File Inclusion 2006-09-29 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in class.mysql.php in Matt Humphrey paBugs 2.0 Beta 3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path_to_bt_dir parameter.
22 CVE-2006-5078 Exec Code File Inclusion 2006-09-29 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in view/general.php in Kristian Niemi Polaring 00.04.03 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _SESSION[dirMain] parameter.
23 CVE-2006-5077 Exec Code File Inclusion 2006-09-29 2017-10-19
5.1
 None Remote High Not required Partial Partial Partial
PHP remote file inclusion vulnerability in admin/admin_topic_action_logging.php in Chris Smith Minerva Build 238 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
24 CVE-2006-5076 Exec Code File Inclusion 2006-09-29 2018-10-17
7.5
 None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in OpenConcept Back-End 0.4.5 allow remote attackers to execute arbitrary PHP code via a URL in the includes_path parameter in (1) admin/index.php, (2) Facts.php, or (3) search.php.
25 CVE-2006-5075 DoS 2006-09-29 2017-07-20
7.8
 None Remote Low Not required None None Complete
The Kernel SSL Proxy service (svc:/network/ssl/proxy) in Sun Solaris 10 before 20060926 allows remote attackers to cause a denial of service (system crash) via unspecified vectors related to an SSL client.
26 CVE-2006-5074 XSS 2006-09-29 2018-10-17
5.1
 None Remote High Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in home.php in PHP Invoice 2.2 allows remote attackers to inject arbitrary web script or HTML via the alert parameter.
27 CVE-2006-5073 DoS 2006-09-29 2018-10-30
7.8
 None Remote Low Not required None None Complete
Unspecified vulnerability in Sun Solaris 8, 9 and 10 allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets, a different vulnerability than CVE-2006-5013.
28 CVE-2006-5071 XSS 2006-09-28 2017-07-20
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in eyeOS before 0.9.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) eyeNav and (2) system/baixar.php.
29 CVE-2006-5070 Exec Code File Inclusion 2006-09-28 2017-10-19
5.1
 None Remote High Not required Partial Partial Partial
PHP remote file inclusion vulnerability in fsl2/objects/fs_form_links.php in faceStones Personal 2.0.42 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[fsinit][objpath] parameter.
30 CVE-2006-5069 XSS 2006-09-28 2018-10-17
2.6
 None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in class.tx_indexedsearch.php in the Indexed Search 2.9.0 extension for Typo3 before 4.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter.
31 CVE-2006-5068 Exec Code File Inclusion 2006-09-28 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in admin/index.php in Brudaswen (1) BrudaNews 1.1 and earlier and (2) BrudaGB 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the o parameter.
32 CVE-2006-5067 Exec Code File Inclusion 2006-09-28 2018-10-17
7.5
 None Remote Low Not required Partial Partial Partial
** DISPUTED ** PHP remote file inclusion vulnerability in loader.php in PHP System Administration Toolkit (PHPSaTK) allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[config] parameter. NOTE: this issue is disputed by CVE; analysis shows that the GLOBALS[config] variable is initialized before being used.
33 CVE-2006-5066 XSS 2006-09-28 2018-10-17
5.1
 None Remote High Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in DanPHPSupport 0.5, and other versions before 1.0, allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in index.php or the (2) do parameter in admin.php.
34 CVE-2006-5065 Exec Code File Inclusion 2006-09-28 2017-10-19
5.1
 None Remote High Not required Partial Partial Partial
PHP remote file inclusion vulnerability in libs/dbmax/mysql.php in ZoomStats 1.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[lib][db][path] parameter.
35 CVE-2006-5064 XSS 2006-09-28 2008-09-05
5.1
 None Remote High Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in BirdBlog 1.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) entryid parameter in comment.php, (2) page parameter in index.php, or the (3) uid parameter in user.php. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
36 CVE-2006-5063 XSS 2006-09-28 2017-07-20
5.1
 None Remote High Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in Elog 2.6.1 allows remote attackers to inject arbitrary web script or HTML by editing log entries in HTML mode.
37 CVE-2006-5062 Exec Code File Inclusion 2006-09-28 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in templates/pb/language/lang_nl.php in PBLang (PBL) 4.66z and earlier allows remote attackers to execute arbitrary PHP code via a URL in the temppath parameter.
38 CVE-2006-5061 Exec Code File Inclusion 2006-09-28 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in mcf.php in Advanced-Clan-Script (AVCX) 3.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the content parameter.
39 CVE-2006-5060 XSS 2006-09-28 2018-10-17
5.1
 None Remote High Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in login.php in Jamroom 3.0.16 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the forgot parameter in the forgot mode.
40 CVE-2006-5059 XSS 2006-09-28 2018-10-17
5.1
 None Remote High Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in WWWthreads 5.4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the Cat parameter to (1) dosearch.php, (2) postlist.php, (3) showmembers.php, (4) faq_english.php, (5) online.php, (6) login.php, (7) newuser.php, (8) wwwthreads.php, (9) search.php, or (10) postlist.php.
41 CVE-2006-5058 Exec Code Overflow 2006-09-28 2017-07-20
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in (1) Call of Duty 1.5b and earlier, (2) Call of Duty United Offensive 1.51b and earlier, and (3) Call of Duty 2 1.3 and earlier allows remote attackers to execute arbitrary code via a long map argument to the "callvote map" command.
42 CVE-2006-5057 XSS 2006-09-28 2018-10-17
5.1
 None Remote High Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in Ktools.net PhotoStore allow remote attackers to inject arbitrary web script or HTML via the (1) gid parameter in details.php, or the (2) photogid parameter in view_photog.php.
43 CVE-2006-5056 XSS 2006-09-28 2018-10-17
5.1
 None Remote High Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in index.php in Opial Audio/Video Download Management 1.0 allows remote attackers to inject arbitrary web script or HTML via the destination parameter in the Login view.
44 CVE-2006-5055 94 Exec Code File Inclusion 2006-09-28 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in admin/testing/tests/0004_init_urls.php in syntaxCMS 1.1.1 through 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the init_path parameter.
45 CVE-2006-5054 Exec Code Sql 2006-09-28 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in uye/uye_ayrinti.asp in iyzi Forum 1 Beta 2 and earlier allows remote attackers to execute arbitrary SQL commands via the uye_nu parameter.
46 CVE-2006-5053 Exec Code File Inclusion 2006-09-28 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in webnews/template.php in Web-News 1.6.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the content_page parameter.
47 CVE-2006-5052 2006-09-27 2018-10-17
5.0
 None Remote Low Not required Partial None None
Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort."
48 CVE-2006-5051 362 DoS Exec Code 2006-09-27 2017-10-11
9.3
 None Remote Medium Not required Complete Complete Complete
Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.
49 CVE-2006-5050 Dir. Trav. 2006-09-27 2018-10-17
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in httpd in Rob Landley BusyBox allows remote attackers to read arbitrary files via URL-encoded "%2e%2e/" sequences in the URI.
50 CVE-2006-5049 2006-09-27 2016-11-28
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Classifieds (com_classifieds) component 1.3 and earlier for Joomla! has unspecified impact and attack vectors.
Total number of vulnerabilities : 551   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.