CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In July 2006

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
201 CVE-2006-3699 2006-07-21 2018-10-18
9.0
 None Remote Low ??? Complete Complete Complete
Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.0.1.5 and 9.2.0.6 has unknown impact and attack vectors, aka Oracle Vuln# DB02.
202 CVE-2006-3698 Sql 2006-07-21 2018-10-18
10.0
 None Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB01 for Change Data Capture (CDC) component and (2) DB03 for Data Pump Metadata API. NOTE: as of 20060719, Oracle has not disputed a claim by a reliable researcher that DB01 is related to multiple SQL injection vulnerabilities in SYS.DBMS_CDC_IMPDP using the (a) IMPORT_CHANGE_SET, (b) IMPORT_CHANGE_TABLE, (c) IMPORT_CHANGE_COLUMN, (d) IMPORT_SUBSCRIBER, (e) IMPORT_SUBSCRIBED_TABLE, (f) IMPORT_SUBSCRIBED_COLUMN, (g) VALIDATE_IMPORT, (h) VALIDATE_CHANGE_SET, (i) VALIDATE_CHANGE_TABLE, and (j) VALIDATE_SUBSCRIPTION procedures, and that DB03 is for SQL injection in the MAIN procedure for SYS.KUPW$WORKER.
203 CVE-2006-3697 264 Exec Code +Priv 2006-07-21 2018-10-18
7.2
 None Local Low Not required Complete Complete Complete
Agnitum Outpost Firewall Pro 3.51.759.6511 (462), as used in (1) Lavasoft Personal Firewall 1.0.543.5722 (433) and (2) Novell BorderManager Novell Client Firewall 2.0, does not properly restrict user activities in application windows that run in a LocalSystem context, which allows local users to gain privileges and execute commands (a) via the "open folder" option when no instance of explorer.exe is running, possibly related to the ShellExecute API function; or (b) by overwriting a batch file through the "Save Configuration As" option. NOTE: this might be a vulnerability in Microsoft Windows and explorer.exe instead of the firewall.
204 CVE-2006-3696 DoS 2006-07-21 2017-07-20
2.1
 None Local Low Not required None None Partial
filtnt.sys in Outpost Firewall Pro before 3.51.759.6511 (462) allows local users to cause a denial of service (crash) via long arguments to mshta.exe.
205 CVE-2006-3695 DoS XSS 2006-07-21 2017-07-20
6.8
 None Remote Medium Not required Partial Partial Partial
Trac before 0.9.6 does not disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows remote attackers to read arbitrary files, perform cross-site scripting (XSS) attacks, or cause a denial of service via unspecified vectors. NOTE: this might be related to CVE-2006-3458.
206 CVE-2006-3694 Bypass 2006-07-21 2017-10-11
6.4
 None Remote Low Not required Partial Partial None
Multiple unspecified vulnerabilities in Ruby before 1.8.5 allow remote attackers to bypass "safe level" checks via unspecified vectors involving (1) the alias function and (2) "directory operations".
207 CVE-2006-3693 +Priv 2006-07-21 2018-10-18
4.6
 None Local Low Not required Partial Partial Partial
Rocks Clusters 4.1 and earlier allows local users to gain privileges via commands enclosed with escaped backticks (\`) in an argument to the (1) mount-loop (mount-loop.c) or (2) umount-loop (umount-loop.c) command, which is not filtered in a system function call.
208 CVE-2006-3692 Exec Code File Inclusion 2006-07-21 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
** DISPUTED ** PHP remote file inclusion vulnerability in enduser/listmessenger.php in ListMessenger 0.9.3 allows remote attackers to execute arbitrary PHP code via a URL in the lm_path parameter. NOTE: the vendor has disputed this issue to SecurityTracker, stating that the $lm_path variable is set to a constant value. As of 20060726, CVE concurs with the vendor based on SecurityTracker's post-disclosure analysis.
209 CVE-2006-3691 Exec Code Sql 2006-07-21 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in VBZooM 1.11 and earlier allow remote attackers to execute arbitrary SQL commands via the UserID parameter to (1) ignore-pm.php, (2) sendmail.php, (3) reply.php or (4) sub-join.php.
210 CVE-2006-3690 Exec Code File Inclusion 2006-07-21 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter to (1) components/com_minibb.php or (2) components/minibb/index.php.
211 CVE-2006-3689 Exec Code File Inclusion 2006-07-21 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
** DISPUTED ** PHP remote file inclusion vulnerability in user-func.php in Codeworks Gnomedia SubberZ[Lite] allows remote attackers to execute arbitrary PHP code via a URL in the myadmindir parameter. NOTE: this issue has been disputed by a third party that claims that " the myadmindir variable is set before any GET variables are processed."
212 CVE-2006-3688 89 Exec Code Sql 2006-07-21 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Room.php in Francisco Charrua Photo-Gallery 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
213 CVE-2006-3687 Exec Code Overflow 2006-07-21 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the Universal Plug and Play (UPnP) service in D-Link DI-524, DI-604 Broadband Router, DI-624, D-Link DI-784, WBR-1310 Wireless G Router, WBR-2310 RangeBooster G Router, and EBR-2310 Ethernet Broadband Router allows remote attackers to execute arbitrary code via a long M-SEARCH request to UDP port 1900.
214 CVE-2006-3686 DoS 2006-07-21 2011-03-08
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in [SYSEXE]SMPUTIL.EXE in HP OpenVMS 7.3-2 allows local users and "remote users" to cause a denial of service (crash).
215 CVE-2006-3685 Exec Code File Inclusion 2006-07-21 2017-10-19
5.1
 None Remote High Not required Partial Partial Partial
PHP remote file inclusion vulnerability in CzarNews 1.12 through 1.14 allows remote attackers to execute arbitrary PHP code via a URL in the tpath parameter to cn_config.php. NOTE: the news.php vector is already covered by CVE-2005-0859.
216 CVE-2006-3684 Exec Code File Inclusion 2006-07-21 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in calendar.php in SoftComplex PHP Event Calendar 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_calendar parameter, which overwrites the $path_to_calendar variable from an extract function call.
217 CVE-2006-3683 1 Exec Code File Inclusion 2006-07-21 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in poll.php in Flipper Poll 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
218 CVE-2006-3682 2006-07-21 2017-07-20
5.0
 None Remote Low Not required Partial None None
awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the (1) year, (2) pluginmode or (3) month parameters.
219 CVE-2006-3681 XSS 2006-07-21 2017-07-20
2.6
 None Remote High Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) refererpagesfilter, (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5) hostfilter, or (6) hostfilterex parameters, a different set of vectors than CVE-2006-1945.
220 CVE-2006-3680 XSS 2006-07-21 2018-10-18
2.6
 None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in photocycle in Photocycle 1.0 allows remote attackers to inject arbitrary web script or HTML via the phpage parameter.
221 CVE-2006-3679 Bypass 2006-07-21 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
FatWire Content Server 5.5.0 allows remote attackers to bypass access restrictions and obtain administrative privileges via unspecified attack vectors in the authentication process.
222 CVE-2006-3678 254 DoS 2006-07-26 2018-10-18
5.0
 None Remote Low Not required None None Partial
TippingPoint IPS running the TippingPoint Operating System (TOS) before 2.2.4.6519 allows remote attackers to "force the device into layer 2 fallback (L2FB)", causing a denial of service (page fault), via a malformed packet.
223 CVE-2006-3677 16 Exec Code 2006-07-27 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properties of the window navigator object (window.navigator) that are accessed when Java starts up, which causes a crash that leads to code execution.
224 CVE-2006-3676 Exec Code Bypass 2006-07-24 2018-10-18
5.1
 None Remote High Not required Partial Partial Partial
admin/gallery_admin.php in planetGallery before 14.07.2006 allows remote attackers to execute arbitrary PHP code by uploading files with a double extension and directly accessing the file in the images directory, which bypasses a regular expression check for safe file types.
225 CVE-2006-3675 2006-07-28 2018-10-18
2.1
 None Local Low Not required Partial None None
Password Safe 2.11, 2.16 and 3.0BETA1 does not respect the configuration settings for locking the password database when certain dialogue windows are open, which might allow attackers with physical access to obtain the database contents.
226 CVE-2006-3674 DoS 2006-07-18 2017-07-20
7.8
 None Remote Low Not required None None Complete
nNetObject.cpp in Armagetron Advanced 2.8.2 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a large number handled by the id_req_handler function.
227 CVE-2006-3673 DoS 2006-07-18 2017-07-20
5.0
 None Remote Low Not required None None Partial
nNetObject.cpp in Armagetron Advanced 2.8.2 and earlier allows remote attackers to cause a denial of service (application crash) via a large owner value, which causes an assert error.
228 CVE-2006-3672 DoS 2006-07-18 2017-07-20
2.6
 None Remote High Not required None None Partial
KDE Konqueror 3.5.1 and earlier allows remote attackers to cause a denial of service (application crash) by calling the replaceChild method on a DOM object, which triggers a null dereference, as demonstrated by calling document.replaceChild with a 0 (zero) argument.
229 CVE-2006-3671 CSRF 2006-07-18 2011-03-08
7.5
 None Remote Low Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in the communicate function in estmaster.c for Hyper Estraier before 1.3.3 allows remote attackers to perform unauthorized actions as other users via unknown vectors.
230 CVE-2006-3670 Exec Code Overflow 2006-07-18 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in Winlpd 1.26 allows remote attackers to execute arbitrary code via a long string in a request to TCP port 515.
231 CVE-2006-3669 2006-07-18 2018-10-18
2.1
 None Local Low Not required Partial None None
Mercury Messenger, possibly 1.7.1.1 and other versions, when running on a multi-user Mac OS X platform, stores chat logs with world-readable permissions within the /Users directory, which allows local users to read the chat logs from other users.
232 CVE-2006-3668 119 Exec Code Overflow 2006-07-18 2017-07-20
7.6
 None Remote High Not required Complete Complete Complete
Heap-based buffer overflow in the it_read_envelope function in Dynamic Universal Music Bibliotheque (DUMB) 0.9.3 and earlier and current CVS as of 20060716, including libdumb, allows user-assisted attackers to execute arbitrary code via a ".it" (Impulse Tracker) file with an envelope with a large number of nodes.
233 CVE-2006-3667 2006-07-18 2011-03-08
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Sybase/Financial Fusion Consumer Banking Suite versions before 20060706 has unknown impact and remote attack vectors.
234 CVE-2006-3666 Exec Code Sql 2006-07-18 2017-07-20
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in AjaxPortal 3.0, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the 'Search' field, a different vulnerability than CVE-2006-3515.
235 CVE-2006-3665 XSS 2006-07-18 2017-07-20
4.3
 None Remote Medium Not required None Partial None
SquirrelMail 1.4.6 and earlier, with register_globals enabled, allows remote attackers to hijack cookies in src/redirect.php via unknown vectors. NOTE: while "cookie theft" is frequently associated with XSS, the vendor disclosure is too vague to be certain of this.
236 CVE-2006-3664 DoS 2006-07-18 2018-10-30
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in NIS server on Sun Solaris 8, 9, and 10 allows local and remote attackers to cause a denial of service (ypserv hang) via unknown vectors.
237 CVE-2006-3663 +Priv 2006-07-18 2018-10-18
4.6
 None Local Low Not required Partial Partial Partial
Finjan Vital Security Appliance 5100/8100 NG 8.3.5 stores passwords in plaintext in a backup file, which allows local users to gain privileges. NOTE: the vendor has notified CVE that this issue was fixed in 8.3.6.
238 CVE-2006-3662 Exec Code Sql 2006-07-18 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
** DISPUTED ** SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. NOTE: this issue has been disputed by the vendor, who states "The mentioned SQL injection vulnerability is not possible." However, the relevant source code suggests that this issue may be legitimate, and the parameter is cleansed in 1.5.3.1.
239 CVE-2006-3661 XSS 2006-07-18 2008-09-05
2.6
 None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in Index.PHP in CuteNews 1.4.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
240 CVE-2006-3660 2006-07-18 2018-10-18
7.6
 None Remote High Not required Complete Complete Complete
Unspecified vulnerability in Microsoft PowerPoint 2003 has unknown impact and user-assisted attack vectors related to powerpnt.exe. NOTE: due to the lack of available details as of 20060717, it is unclear how this is related to CVE-2006-3655, CVE-2006-3656, and CVE-2006-3590, although it is possible that they are all different.
241 CVE-2006-3659 DoS 2006-07-18 2021-07-23
5.0
 None Remote Low Not required None None Partial
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the location or URL property of a MHTMLFile ActiveX object.
242 CVE-2006-3658 DoS 2006-07-18 2021-07-23
5.0
 None Remote Low Not required None None Partial
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by accessing the object references of a FolderItem ActiveX object, which triggers a null dereference in the security check.
243 CVE-2006-3657 DoS Overflow 2006-07-18 2021-07-23
5.0
 None Remote Low Not required None None Partial
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (stack overflow exception) via a DXImageTransform.Microsoft.Gradient ActiveX object with a long (1) StartColorStr or (2) EndColorStr property.
244 CVE-2006-3656 1 Mem. Corr. 2006-07-18 2018-10-18
2.6
 None Remote High Not required None Partial None
Unspecified vulnerability in Microsoft PowerPoint 2003 allows user-assisted attackers to cause memory corruption via a crafted PowerPoint file, which triggers the corruption when the file is closed. NOTE: due to the lack of available details as of 20060717, it is unclear how this is related to CVE-2006-3655, CVE-2006-3660, and CVE-2006-3590, although it is possible that they are all different.
245 CVE-2006-3655 Exec Code 2006-07-18 2018-10-18
5.1
 None Remote High Not required Partial Partial Partial
Unspecified vulnerability in mso.dll in Microsoft PowerPoint 2003 allows user-assisted attackers to execute arbitrary code via a crafted PowerPoint file. NOTE: due to the lack of available details as of 20060717, it is unclear how this is related to CVE-2006-3656, CVE-2006-3660, and CVE-2006-3590, although it is possible that they are all different.
246 CVE-2006-3654 DoS Overflow 2006-07-18 2018-10-18
2.6
 None Remote High Not required None None Partial
Buffer overflow in wksss.exe 8.4.702.0 in Microsoft Works Spreadsheet 8.0 allows remote attackers to cause a denial of service (CPU consumption or crash) via crafted Excel files.
247 CVE-2006-3653 DoS 2006-07-18 2018-10-18
2.6
 None Remote High Not required None None Partial
wksss.exe 8.4.702.0 in Microsoft Works Spreadsheet 8.0 allows remote attackers to cause a denial of service (CPU consumption or crash) via crafted (1) Works, (2) Excel, and (3) Lotus 1-2-3 files.
248 CVE-2006-3652 Bypass 2006-07-18 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Microsoft Internet Security and Acceleration (ISA) Server 2004 allows remote attackers to bypass file extension filters via a request with a trailing "#" character. NOTE: as of 20060715, this could not be reproduced by third parties.
249 CVE-2006-3633 20 Exec Code 2006-07-27 2017-07-20
6.5
 None Remote Low ??? Partial Partial Partial
OSSP shiela 1.1.5 and earlier allows remote authenticated users to execute arbitrary commands on the CVS server via shell metacharacters in a filename that is committed.
250 CVE-2006-3632 119 DoS Exec Code Overflow 2006-07-21 2018-10-18
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in Wireshark (aka Ethereal) 0.8.16 to 0.99.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the NFS dissector.
Total number of vulnerabilities : 529   Page : 1 2 3 4 5 (This Page)6 7 8 9 10 11
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.