CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In March 2007

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2006-3892 Exec Code 2007-03-02 2011-03-08
10.0
 None Remote Low Not required Complete Complete Complete
The Management Console server in EMC NetWorker (formerly Legato NetWorker) 7.3.2 before Jumbo Update 1 uses weak authentication, which allows remote attackers to execute arbitrary commands.
2 CVE-2006-4175 DoS 2007-03-26 2017-07-20
7.8
 None Remote Low Not required None None Complete
The LDAP server (ns-slapd) in Sun Java System Directory Server 5.2 Patch4 and earlier and ONE Directory Server 5.1 and 5.2 allows remote attackers to cause a denial of service (crash) via malformed queries, probably malformed BER queries, which trigger a free of uninitialized memory locations.
3 CVE-2006-4843 XSS Bypass 2007-03-29 2017-07-20
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Active Content Filter feature in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to inject arbitrary web script or HTML via unspecified "code sequences" that bypass the protection scheme.
4 CVE-2006-7065 DoS 2007-03-02 2021-07-23
5.0
 None Remote Low Not required None None Partial
Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via an IFRAME with a certain XML file and XSL stylesheet that triggers a crash in mshtml.dll when a refresh is called, probably a null pointer dereference.
5 CVE-2006-7066 DoS 2007-03-02 2021-12-13
7.1
 None Remote Medium Not required None None Complete
Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by creating an object inside an iframe, deleting the frame by setting its location.href to about:blank, then accessing a property of the object within the deleted frame, which triggers a NULL pointer dereference. NOTE: it was later reported that 7.0.6000.16473 and earlier are also affected.
6 CVE-2006-7067 Overflow 2007-03-02 2018-10-16
6.0
 None Local High ??? Complete Complete Complete
Oracle 10g R2 and possibly other versions allows remote attackers to trigger internal errors, and possibly have other impacts, via an "alter session set events" command with invalid arguments. NOTE: this issue was originally disputed by a third party, but the dispute was retracted. NOTE: this issue was called an "integer overflow" in the original source, but this might be incorrect.
7 CVE-2006-7068 Exec Code File Inclusion 2007-03-02 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in CliServ Web Community 0.65 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cl_headers parameter to (1) menu.php3 and (2) login.php3.
8 CVE-2006-7069 Exec Code File Inclusion 2007-03-02 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in smarty_config.php in Socketwiz Bookmarks 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the root_dir parameter.
9 CVE-2006-7070 20 2007-03-02 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in manager/media/ibrowser/scripts/rfiles.php in Etomite CMS 0.6.1 and earlier allows remote attackers to upload and execute arbitrary files via an nfile[] parameter with a filename that contains a .php extension followed by a valid image extension such as .gif or .jpg, then calling the rename function.
10 CVE-2006-7071 Exec Code Sql 2007-03-02 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in classes/class_session.php in Invision Power Board (IPB) 2.1 up to 2.1.6 allows remote attackers to execute arbitrary SQL commands via the CLIENT_IP parameter.
11 CVE-2006-7072 XSS 2007-03-02 2018-10-16
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in GeoClassifieds Enterprise 2.0.5.2 and earlier allows remote attackers to inject arbitrary web script and HTML via the (1) b[username] and (2) c parameters to (a) index.php, the b[username] parameter to (b) admin/index.php, and (3) c[phone] parameter to register.php.
12 CVE-2006-7073 XSS 2007-03-02 2017-07-29
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Opentools Attachment Mod before 2.4.5 allows remote attackers to inject arbitrary web script or HTML in Internet Explorer via unknown vectors related to the uploaded attachments form. NOTE: some details were obtained from third party information.
13 CVE-2006-7074 798 +Priv Bypass 2007-03-02 2017-07-29
7.5
 None Remote Low Not required Partial Partial Partial
admin.php in SmartSiteCMS 1.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the userName cookie.
14 CVE-2006-7075 Exec Code Overflow 2007-03-02 2017-07-29
6.8
 None Remote Medium Not required Partial Partial Partial
Buffer overflow in the meta_read_flac function in meta_decoder.c for Aqualung 0.9beta5 and earlier, and CVS 0.193.2 and earlier, allows user-assisted attackers to execute arbitrary code via a long Vorbis comment in a Free Lossless Audio Codec (FLAC) file.
15 CVE-2006-7076 Sql XSS 2007-03-02 2017-07-29
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in guestbook.php in Advanced Guestbook 2.4 for phpBB allows remote attackers to inject arbitrary web script or HTML via the entry parameter. NOTE: this issue might be resultant from SQL injection.
16 CVE-2006-7077 Exec Code Sql 2007-03-02 2017-07-29
6.8
 None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in guestbook.php in Advanced Guestbook 2.4 for phpBB allows remote attackers to execute arbitrary SQl commands via the entry parameter.
17 CVE-2006-7078 XSS 2007-03-02 2018-10-16
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Professional Home Page Tools Login Script, as of July 2006, allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) vorname, and (3) nachname parameters in the register script. NOTE: some details have been obtained from third party sources.
18 CVE-2006-7079 Exec Code Dir. Trav. 2007-03-02 2017-10-11
6.8
 None Remote Medium Not required Partial Partial Partial
Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program variables and conduct directory traversal attacks to execute arbitrary code by modifying the $xoopsOption['pagetype'] variable.
19 CVE-2006-7080 Dir. Trav. 2007-03-02 2017-10-11
4.3
 None Remote Medium Not required Partial None None
Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to delete arbitrary files via ".." sequences in the old_avatar parameter.
20 CVE-2006-7081 Exec Code File Inclusion 2007-03-02 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in PhpNews 1.0 allow remote attackers to execute arbitrary PHP code via the Include parameter to (1) Include/lib.inc.php3 and (2) Include/variables.php3.
21 CVE-2006-7082 Bypass 2007-03-02 2017-07-29
7.5
 None Remote Low Not required Partial Partial Partial
Rigter Portal System (RPS) 1.0, 2.0, and 3.0 allows remote attackers to bypass authentication and upload arbitrary files via direct requests to (1) adm/photos/images.php and (2) adm/down/files.php.
22 CVE-2006-7083 Dir. Trav. 2007-03-02 2017-07-29
4.3
 None Remote Medium Not required Partial None None
Directory traversal vulnerability in index.php in Rigter Portal System (RPS) 1.0, 2.0, and 3.0 allows remote attackers to read arbitrary files via ".." sequences in the id parameter.
23 CVE-2006-7085 Sql XSS 2007-03-02 2017-07-29
4.3
 None Remote Medium Not required None Partial None
Rigter Portal System (RPS) 1.0, 2.0, and 3.0 allows remote attackers to add arbitrary content and conduct XSS attacks via a direct request to add_art.php. NOTE: this issue was originally reported as SQL injection, but this is not likely.
24 CVE-2006-7086 200 +Info 2007-03-02 2020-06-10
4.3
 None Remote Medium Not required Partial None None
The (1) dlback.php and (2) dlback.cgi scripts in Hot Links allow remote attackers to obtain sensitive information and download the database via a direct request with a modified dl parameter.
25 CVE-2006-7087 Bypass 2007-03-02 2018-10-16
5.0
 None Remote Low Not required None Partial None
CRLF injection vulnerability in the mail function in Dotdeb PHP before 5.2.0 Rev 3 allows remote attackers to bypass the protection scheme and inject arbitrary email headers via CRLF sequences in the query string, which is processed via the PHP_SELF variable.
26 CVE-2006-7088 Exec Code Sql 2007-03-02 2017-07-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Simple PHP Forum before 0.4 allow remote attackers to execute arbitrary SQL commands via the username parameter to (1) logon_user.php and (2) update_profile.php.
27 CVE-2006-7089 89 Exec Code Sql 2007-03-02 2017-07-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in connexion.php in Ban 0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
28 CVE-2006-7090 94 Exec Code File Inclusion 2007-03-02 2017-07-29
6.8
 None Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in phpbb_security.php in phpBB Security 1.0.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the php_root_path parameter.
29 CVE-2006-7091 Exec Code File Inclusion 2007-03-02 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in config.php in phpht Topsites FREE 1.022b allows remote attackers to execute arbitrary PHP code via a URL in the fullpath parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
30 CVE-2006-7092 Exec Code Sql 2007-03-02 2011-03-08
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in includes/mambo.php in Mambo LaiThai 4.5.4 SP2 and earlier allows remote attackers to execute arbitrary SQL commands via the usercookie[password] cookie parameter.
31 CVE-2006-7093 XSS 2007-03-02 2011-03-08
5.8
 None Remote Medium Not required Partial Partial None
Cross-site scripting (XSS) vulnerability in Mambo LaiThai 4.5.4 Security Patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
32 CVE-2006-7094 2007-03-02 2018-10-16
8.5
 None Remote Medium ??? Complete Complete Complete
ftpd, as used by Gentoo and Debian Linux, sets the gid to the effective uid instead of the effective group id before executing /bin/ls, which allows remote authenticated users to list arbitrary directories with the privileges of gid 0 and possibly enable additional attack vectors.
33 CVE-2006-7095 DoS Exec Code Overflow 2007-03-02 2017-07-29
10.0
 None Remote Low Not required Complete Complete Complete
Integer signedness error in the network_receive_packet function in socket.c in dimension 3 engine (dim3) 1.5 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large data_len value, which is cast to a signed short and results in a buffer overflow.
34 CVE-2006-7096 DoS Exec Code Overflow 2007-03-02 2017-07-29
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the network_host_handle_join function in host.c in dimension 3 engine (dim3) 1.5 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long nickname.
35 CVE-2006-7097 2007-03-02 2008-09-05
10.0
 None Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in TaskFreak! before 0.1.4 have unknown impact and attack vectors.
36 CVE-2006-7098 264 +Priv 2007-03-03 2017-07-29
6.6
 None Local Medium ??? Complete Complete Complete
The Debian GNU/Linux 033_-F_NO_SETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a CGI program that calls the TIOCSTI ioctl.
37 CVE-2006-7099 Dir. Trav. 2007-03-03 2008-11-15
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in index.php in SolarPay allows remote attackers to read certain files via a .. (dot dot) in the read parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
38 CVE-2006-7100 94 Exec Code File Inclusion 2007-03-03 2018-10-16
6.8
 None Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in includes/functions_mod_user.php in phpBB Insert User 0.1.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
39 CVE-2006-7101 Exec Code Sql 2007-03-03 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in admin.php in PHPWind 5.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the AdminUser cookie.
40 CVE-2006-7102 94 Exec Code File Inclusion 2007-03-03 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in phpBurningPortal quiz-modul 1.0.1, and possibly earlier, allow remote attackers to execute arbitrary PHP code via a URL in the lang_path parameter to (1) quest_delete.php, (2) quest_edit.php, or (3) quest_news.php.
41 CVE-2006-7103 Dir. Trav. 2007-03-03 2018-10-16
6.4
 None Remote Low Not required Partial Partial None
Multiple directory traversal vulnerabilities in EZOnlineGallery 1.3 and earlier, and possibly other versions before 1.3.2 Beta, allow remote attackers to (1) determine directory existence via a ".." in the album parameter in a show_album action to (a) ezgallery.php, which produces different responses depending on existence; and read arbitrary image files via a ".." in the album or (2) image parameter to (b) image.php.
42 CVE-2006-7104 94 Exec Code File Inclusion 2007-03-03 2017-07-29
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in htmltemplate.php in the Chad Auld MOStlyContent Editor (MOStlyCE) as created on May 2006, a component for Mambo 4.5.4, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
43 CVE-2006-7105 94 Exec Code File Inclusion 2007-03-03 2017-07-29
7.5
 None Remote Low Not required Partial Partial Partial
** DISPUTED ** PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter. NOTE: in the original disclosure, filename is used in a function definition, so this report is probably incorrect.
44 CVE-2006-7106 94 Exec Code File Inclusion 2007-03-03 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in config.inc.php3 in Power Phlogger 2.0.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rel_path parameter.
45 CVE-2006-7107 Exec Code File Inclusion 2007-03-03 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in upgrade.php in Coalescent Systems freePBX 2.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the amp_conf[AMPWEBROOT] parameter.
46 CVE-2006-7108 264 Bypass 2007-03-04 2017-10-11
4.1
 None Local Medium ??? Partial Partial Partial
login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pam_acct_mgmt and chauth_tok.
47 CVE-2006-7109 2007-03-05 2017-07-29
6.5
 None Remote Low ??? Partial Partial Partial
Unrestricted file upload vulnerability in IMCE before 1.6, a Drupal module, allows remote authenticated users to upload arbitrary PHP code via a filename with a double extension such as .php.gif.
48 CVE-2006-7110 Dir. Trav. 2007-03-05 2017-07-29
5.5
 None Remote Low ??? None Partial Partial
Directory traversal vulnerability in the delete function in IMCE before 1.6, a Drupal module, allows remote authenticated users to delete arbitrary files via ".." sequences.
49 CVE-2006-7111 Bypass 2007-03-05 2017-07-29
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Futomi's CGI Cafe KMail CGI 1.0.3 and earlier allows remote attackers to bypass authentication and obtain unauthorized email access via unspecified vectors.
50 CVE-2006-7112 22 Dir. Trav. 2007-03-06 2017-10-11
6.0
 None Remote Medium ??? Partial Partial Partial
Directory traversal vulnerability in error.php in MD-Pro 1.0.76 and earlier allows remote authenticated users to read and include arbitrary files via the PNSVlang cookie, as demonstrated by uploading a GIF image using AddDownload or injecting PHP code into a log file, then accessing it.
Total number of vulnerabilities : 704   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.