CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In July 2006

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
401 CVE-2006-3430 89 Exec Code Sql 2006-07-07 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in checkprofile.asp in (1) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (2) Novell ZENworks 6.2 SR1 and earlier, allows remote attackers to execute arbitrary SQL commands via the agentid parameter.
402 CVE-2006-3429 XSS 2006-07-07 2018-10-18
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in TigerTom TTCalc 1.0 allows remote attackers to inject arbitrary web script or HTML via the currency parameter in (1) loan.php and (2) mortgage.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
403 CVE-2006-3428 XSS 2006-07-07 2018-10-18
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in TigerTom TTCalc 1.0 allows remote attackers to inject arbitrary web script or HTML via the year parameter in (1) loan.php and (2) mortgage.php.
404 CVE-2006-3427 DoS 2006-07-07 2021-12-13
5.0
 None Remote Low Not required None None Partial
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by declaring the sourceURL attribute on an uninitialized DirectAnimation.StructuredGraphicsControl ActiveX Object, which triggers a null dereference.
405 CVE-2006-3426 Dir. Trav. 2006-07-07 2018-10-18
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (b) Novell ZENworks 6.2 SR1 and earlier allows remote attackers to overwrite arbitrary files and directories via a .. (dot dot) sequence in the (1) action, (2) agentid, or (3) index parameters to dagent/nwupload.asp, which are used as pathname components.
406 CVE-2006-3425 2006-07-07 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
FastPatch for (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1, and (b) Novell ZENworks 6.2 SR1 and earlier, does not require authentication for dagent/proxyreg.asp, which allows remote attackers to list, add, or delete PatchLink Distribution Point (PDP) proxy servers via modified (1) List, (2) Proxy, or (3) Delete parameters.
407 CVE-2006-3424 Exec Code Overflow 2006-07-07 2017-07-20
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in WebEx Downloader ActiveX Control, possibly in versions before November 2005, allow remote attackers to execute arbitrary code via unspecified vectors.
408 CVE-2006-3423 20 Exec Code 2006-07-07 2018-10-18
9.3
 None Remote Medium Not required Complete Complete Complete
WebEx Downloader ActiveX Control and WebEx Downloader Java before 2.1.0.0 do not validate downloaded components, which allows remote attackers to execute arbitrary code via a website that activates the GpcUrlRoot and GpcIniFileName ActiveX controls to cause the client to download a DLL file.
409 CVE-2006-3422 Exec Code File Inclusion 2006-07-07 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in WonderEdit Pro CMS allows remote attackers to execute arbitrary PHP code via the config[template_path] parameter in user_bottom.php, as used by multiple templates including (1) rwb (template/rwb/user_bottom.php), (2) gwb (template/rwb/user_bottom.php, (3) blues, (4) bluwhi, and (5) grns.
410 CVE-2006-3421 Exec Code File Inclusion 2006-07-07 2018-10-18
5.1
 None Remote High Not required Partial Partial Partial
PHP remote file inclusion vulnerability in SmartSiteCMS 1.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the root parameter in (1) comment.php, (2) admin/comedit.php, (3) admin/test.php, (4) admin/index.php, and (5) admin/include/inc_adminfoot.php, a different set of vectors than CVE-2006-3162.
411 CVE-2006-3420 CSRF 2006-07-07 2017-07-20
7.5
 None Remote Low Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in editpost.php in MyBulletinBoard (MyBB) before 1.1.5 allows remote attackers to perform unauthorized actions as a logged in user and delete arbitrary forum posts via a bbcode IMG tag with a modified delete parameter in a deletepost action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
412 CVE-2006-3419 2006-07-07 2008-09-05
5.0
 None Remote Low Not required Partial None None
Tor before 0.1.1.20 uses OpenSSL pseudo-random bytes (RAND_pseudo_bytes) instead of cryptographically strong RAND_bytes, and seeds the entropy value at start-up with 160-bit chunks without reseeding, which makes it easier for attackers to conduct brute force guessing attacks.
413 CVE-2006-3418 2006-07-07 2008-09-05
5.0
 None Remote Low Not required None Partial None
Tor before 0.1.1.20 does not validate that a server descriptor's fingerprint line matches its identity key, which allows remote attackers to spoof the fingerprint line, which might be trusted by users or other applications.
414 CVE-2006-3417 2006-07-07 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
Tor client before 0.1.1.20 prefers entry points based on is_fast or is_stable flags, which could allow remote attackers to be preferred over nodes that are identified as more trustworthy "entry guard" (is_guard) systems by directory authorities.
415 CVE-2006-3416 2006-07-07 2008-09-05
5.0
 None Remote Low Not required None None Partial
** DISPUTED ** Tor before 0.1.1.20 kills the circuit when it receives an unrecognized relay command, which causes network circuits to be disbanded. NOTE: while this item is listed under the "Security fixes" section of the developer changelog, the developer clarified on 20060707 that this is only a self-DoS. Therefore this issue should not be included in CVE.
416 CVE-2006-3415 2006-07-07 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
Tor before 0.1.1.20 uses improper logic to validate the "OR" destination, which allows remote attackers to perform a man-in-the-middle (MITM) attack via unspecified vectors.
417 CVE-2006-3414 2006-07-07 2008-09-05
5.0
 None Remote Low Not required Partial None None
Tor before 0.1.1.20 supports server descriptors that contain hostnames instead of IP addresses, which allows remote attackers to arbitrarily group users by providing preferential address resolution.
418 CVE-2006-3413 +Info 2006-07-07 2008-09-05
5.0
 None Remote Low Not required Partial None None
The privoxy configuration file in Tor before 0.1.1.20, when run on Apple OS X, logs all data via the "logfile", which allows attackers to obtain potentially sensitive information.
419 CVE-2006-3412 Bypass 2006-07-07 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
Tor before 0.1.1.20 does not sufficiently obey certain firewall options, which allows remote attackers to bypass intended access restrictions for dirservers, direct connections, or proxy servers.
420 CVE-2006-3411 2006-07-07 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
TLS handshakes in Tor before 0.1.1.20 generate public-private keys based on TLS context rather than the connection, which makes it easier for remote attackers to conduct brute force attacks on the encryption keys.
421 CVE-2006-3410 2006-07-07 2017-07-20
5.0
 None Remote Low Not required Partial None None
Tor before 0.1.1.20 creates "internal circuits" primarily consisting of nodes with "useful exit nodes," which allows remote attackers to conduct unspecified statistical attacks.
422 CVE-2006-3409 Exec Code Overflow 2006-07-07 2017-07-20
7.5
 None Remote Low Not required Partial Partial Partial
Integer overflow in Tor before 0.1.1.20 allows remote attackers to execute arbitrary code via crafted large inputs, which result in a buffer overflow when elements are added to smartlists.
423 CVE-2006-3408 DoS 2006-07-07 2017-07-20
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in the directory server (dirserver) in Tor before 0.1.1.20 allows remote attackers to cause an unspecified denial of service via unknown vectors.
424 CVE-2006-3407 Exec Code 2006-07-07 2017-07-20
6.4
 None Remote Low Not required Partial Partial None
Tor before 0.1.1.20 allows remote attackers to spoof log entries or possibly execute shell code via strings with non-printable characters.
425 CVE-2006-3406 Dir. Trav. 2006-07-07 2018-10-18
6.4
 None Remote Low Not required Partial Partial None
Directory traversal vulnerability in qtofm.php in QTOFileManager 1.0 allows remote attackers to modify arbitrary files via a .. (dot dot) sequence in the edit parameter.
426 CVE-2006-3405 XSS 2006-07-07 2018-10-18
5.8
 None Remote Medium Not required Partial Partial None
Cross-site scripting (XSS) vulnerability in qtofm.php in QTOFileManager 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) delete, (2) pathext, and (3) edit parameters.
427 CVE-2006-3404 120 DoS Exec Code Overflow 2006-07-06 2022-02-07
5.1
 None Remote High Not required Partial Partial Partial
Buffer overflow in the xcf_load_vector function in app/xcf/xcf-load.c for gimp before 2.2.12 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XCF file with a large num_axes value in the VECTORS property.
428 CVE-2006-3403 DoS 2006-07-12 2018-10-18
5.0
 None Remote Low Not required None None Partial
The smdb daemon (smbd/service.c) in Samba 3.0.1 through 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of share connection requests.
429 CVE-2006-3402 Exec Code Sql 2006-07-06 2017-07-20
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in VirtuaStore 2.0 allows remote attackers to execute arbitrary SQL commands via the password parameter when logging in.
430 CVE-2006-3401 119 DoS Exec Code Overflow 2006-07-06 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in Quake 3 Engine as used by Quake 3: Arena 1.32b and 1.32c allows remote attackers to cause a denial of service and possibly execute code via long CS_ITEMS values.
431 CVE-2006-3400 DoS Exec Code Overflow 2006-07-06 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the CG_ServerCommand function in Quake 3 Engine as used by Soldier of Fortune 2 (SOF2MP) GOLD 1.03 allows remote attackers to cause a denial of service and possibly execute code by sending a long command from the server.
432 CVE-2006-3399 XSS 2006-07-06 2018-10-18
2.6
 None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in wiki.php in MoniWiki before 1.1.2-20060702 allows remote attackers to inject arbitrary Javascript via the URL, which is reflected back in an error message, a variant of CVE-2004-1632.
433 CVE-2006-3398 +Info 2006-07-06 2011-03-08
5.0
 None Remote Low Not required Partial None None
The "change password forms" in Taskjitsu before 2.0.1 includes password hashes in hidden form fields, which allows remote attackers to obtain sensitive information from the (1) Category Editor and (2) User Information editor.
434 CVE-2006-3397 XSS 2006-07-06 2017-07-20
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Taskjitsu before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via multiple unspecified parameters, including the (1) title and (2) description parameters when creating a task.
435 CVE-2006-3396 94 Exec Code File Inclusion 2006-07-06 2018-10-18
6.8
 None Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in galleria.html.php in Galleria Mambo Module 1.0 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
436 CVE-2006-3395 94 Exec Code File Inclusion 2006-07-06 2017-07-20
5.1
 None Remote High Not required Partial Partial Partial
PHP remote file inclusion vulnerability in top.php in SiteBuilder-FX 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter.
437 CVE-2006-3394 Exec Code Sql 2006-07-06 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the files mod in index.php in BXCP 0.3.0.4 allows remote attackers to execute arbitrary SQL commands via the where parameter in a view action.
438 CVE-2006-3393 DoS 2006-07-06 2017-07-20
7.8
 None Remote Low Not required None None Complete
Papyrus NASCAR Racing 4 4.1.3.1.6 and earlier, 2002 Season 1.1.0.2 and earlier, and 2003 Season 1.2.0.1 and earlier allows remote attackers to cause a denial of service (CPU consumption) by sending an empty UDP datagram, which is not properly discarded due to use of the FIONREAD asynchronous socket.
439 CVE-2006-3392 Bypass 2006-07-06 2018-10-18
5.0
 None Remote Low Not required Partial None None
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.
440 CVE-2006-3391 2006-07-06 2017-07-20
5.1
 None Remote High Not required Partial Partial Partial
The Execute function in iMBCContents ActiveX Control before 2.0.0.59 allows remote attackers to execute arbitrary files via the file URI handler.
441 CVE-2006-3390 2006-07-06 2018-10-18
5.0
 None Remote Low Not required Partial None None
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
442 CVE-2006-3389 +Info 2006-07-06 2018-10-18
5.0
 None Remote Low Not required Partial None None
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.
443 CVE-2006-3388 XSS 2006-07-06 2018-10-18
5.8
 None Remote Medium Not required Partial Partial None
Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the table parameter.
444 CVE-2006-3387 Exec Code Dir. Trav. 2006-07-06 2017-10-19
5.1
 None Remote High Not required Partial Partial Partial
Directory traversal vulnerability in sources/post.php in Fusion News 1.0, when register_globals is enabled, allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the fil_config parameter, which can be used to execute PHP code that has been injected into a log file.
445 CVE-2006-3386 +Info 2006-07-06 2018-10-18
5.0
 None Remote Low Not required Partial None None
index.php in Vincent Leclercq News 5.2 allows remote attackers to obtain sensitive information, such as the installation path, via a mail[] parameter with invalid values.
446 CVE-2006-3385 XSS 2006-07-06 2018-10-18
5.8
 None Remote Medium Not required Partial Partial None
Cross-site scripting (XSS) vulnerability in divers.php in Vincent Leclercq News 5.2 allows remote attackers to inject arbitrary web script or HTML via the (1) id and (2) disabled parameters.
447 CVE-2006-3384 Exec Code Sql 2006-07-06 2018-10-18
5.1
 None Remote High Not required Partial Partial Partial
SQL injection vulnerability in divers.php in Vincent Leclercq News 5.2 allows remote attackers to execute arbitrary SQL commands via the (1) id and (2) texte parameters.
448 CVE-2006-3383 XSS 2006-07-06 2017-07-20
5.8
 None Remote Medium Not required Partial Partial None
Cross-site scripting (XSS) vulnerability in index.php in mAds 1.0 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as onmouseover within a URL. NOTE: the provenance of this information is unknown; the details are obtained solely from third party reports.
449 CVE-2006-3382 XSS 2006-07-06 2018-10-18
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in search.php in mAds 1.0 allows remote attackers to inject arbitrary web script or HTML via the "search string".
450 CVE-2006-3381 Exec Code 2006-07-06 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
SturGeoN Upload allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension, then directly accessing the file. NOTE: It is uncertain whether this is a vulnerability or a feature of the product.
Total number of vulnerabilities : 529   Page : 1 2 3 4 5 6 7 8 9 (This Page)10 11
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.