Vulnerability Summary for the Week of November 6, 2006
Released
Nov 13, 2006
Document ID
SB06-317
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores.
Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:
- High: vulnerabilities with a CVSS base score of 7.0–10.0
- Medium: vulnerabilities with a CVSS base score of 4.0–6.9
- Low: vulnerabilities with a CVSS base score of 0.0–3.9
Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis.
Vulnerability Severity:
| High Vulnerabilities |
|---|
| Primary Vendor -- Product | Description |
| CVSS Score | Source & Patch Info | ||
|---|---|---|---|---|---|---|
| Abarcar Software -- Abarcar Realty Portal | Multiple SQL injection vulnerabilities in Abarcar Realty Portal allow remote attackers to execute arbitrary SQL commands via the (1) neid parameter to newsdetails.php, or the (2) slid parameter to slistl.php. NOTE: the cat vector is already covered by CVE-2006-2853. |
| 7.0 | CVE-2006-5840 BUGTRAQ BID | ||
| Adaptive Technology Resource Centre -- ATutor | Multiple PHP remote file inclusion vulnerabilities in ATutor 1.5.3.2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) section parameter in (a) documentation/common/frame_toc.php and (b) documentation/common/search.php, the (2) req_lang parameter in documentation/common/search.php and (c) documentation/common/vitals.inc.php, the (3) row[dir_name] parameter in (d) include/classes/module/module.class.php, and the (4) lang_path parameter in (e) include/classes/phpmailer/class.phpmailer.php. NOTE: the print.php vector is already covered by CVE-2005-3404. |
| 7.0 | CVE-2006-5734 BUGTRAQ | ||
| Advanced Guestbook -- Advanced Guestbook | PHP remote file inclusion vulnerability in admin.php in Advanced Guestbook 2.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter. |
| 7.0 | CVE-2006-5804 BUGTRAQ BID SECUNIA | ||
| AIOCP -- AIOCP | Multiple SQL injection vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) choosed_language parameter to (a) cp_dpage.php, (b)cp_news.php, (c) cp_forum_view.php, (d) cp_edit_user.php, (e) cp_newsletter.php, (f) cp_links.php, (g) cp_contact_us.php, (h) cp_login.php, and (i) cp_codice_fiscale.php in public/code/; (2) news_category parameter to public/code/cp_news.php; (3) nlmsg_nlcatid parameter to public/code/cp_newsletter.php; (4) links_category parameter to public/code/cp_links.php; (5) product_category_id parameter to public/code/cp_show_ec_products.php; (6) order_field parameter to public/code/cp_show_ec_products.php; (7) firstrow parameter to public/code/cp_users_online.php; and (8) orderdir parameter to public/code/cp_links_search.php. |
| 7.0 | CVE-2006-5829 BUGTRAQ BID FRSIRT SECUNIA XF | ||
| AIOCP -- AIOCP | PHP remote file inclusion vulnerability in admin/code/index.php in All In One Control Panel (AIOCP) 1.3.007 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the load_page parameter. |
| 7.0 | CVE-2006-5831 BUGTRAQ BID XF | ||
| America Online -- ICQ | The ICQPhone.SipxPhoneManager ActiveX control in America Online ICQ 5.1 allows remote attackers to download and execute arbitrary code via the DownloadAgent function, as demonstrated using an ICQ avatar. |
| 7.0 | CVE-2006-5650 BUGTRAQ OTHER-REF BID FRSIRT SECUNIA | ||
| Apple -- Mac OS X OpenDarwin -- Darwin Kernel | The Airport driver for certain Orinoco based Airport cards in Darwin kernel 8.8.0 in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to execute arbitrary code via an 802.11 probe response frame without any valid information element (IE) fields after the header. |
| 7.0 | CVE-2006-5710 OTHER-REF BID SECUNIA FRSIRT SECTRACK XF | ||
| Ariadne -- Ariadne CMS | ** DISPUTED ** Multiple PHP remote file inclusions in Ariadne 2.4.1 allows remote attackers to execute arbitrary PHP code via the ariadne parameter in (1) ftp/loader.php and (2) lib/includes/loader.cmd.php. NOTE: this issue is disputed by CVE, since installation instructions recommend that the files be placed outside of the web document root and require the administrator to modify $ariadne in an include file. |
| 7.0 | CVE-2006-5776 BUGTRAQ MLIST MLIST BID XF | ||
| Article Script -- Article Script | SQL injection vulnerability in rss.php in Article Script 1.6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter. |
| 7.0 | CVE-2006-5765 OTHER-REF FRSIRT SECUNIA BUGTRAQ BID | ||
| Article System -- Article System | PHP remote file inclusion vulnerability in volume.php in Article System 0.6 allows remote attackers to execute arbitrary PHP code via a URL in the config[public_dir] parameter. |
| 7.0 | CVE-2006-5766 OTHER-REF BID XF | ||
| BytesFall Explorer -- BytesFall Explorer | SQL injection vulnerability in libs/sessions.lib.php in BytesFall Explorer (bfExplorer) 0.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified parameters, a different issue than CVE-2006-5606. |
| 7.0 | CVE-2006-5719 BUGTRAQ OTHER-REF BID XF | ||
| Creasito -- Creasito E-Commerce Content Manager | Creasito E-Commerce Content Manager 1.3.08 allows remote attackers to bypass authentication and perform privileged functions via a non-empty finame parameter to (1) addnewcont.php, (2) adminpassw.php, (3) amministrazione.php, (4) artins.php, (5) bgcolor.php, (6) cancartcat.php, (7) canccat.php, (8) cancelart.php, (9) cancontsit.php, (10) chanpassamm.php, (11) dele.php, (12) delecat.php, (13) delecont.php, (14) emailall.php, (15) gestflashtempl.php, (16) gestmagart.php, (17) gestmagaz.php, (18) gestpre.php, (19) input.php, (20) input3.php, (21) insnucat.php, (22) instempflash.php, (23) mailfc.php, (24) modfdati.php, (25) rescont4.php, (26) ricordo1.php, (27) ricordo4.php, (28) tabcatalg.php, (29) tabcont.php, (30) tabcont3.php, (31) tabstile.php, (32) tabstile3.php, (33) testimmg.php, and (34) update.php in admin/. NOTE: some of these details are obtained from third party information. |
| 7.0 | CVE-2006-5777 OTHER-REF SECUNIA XF | ||
| Cyberfolio -- Cyberfolio | Multiple PHP remote file inclusion vulnerabilities in Cyberfolio 2.0 RC1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the av parameter to (1) msg/view.php, (2) msg/inc_message.php, (3) msg/inc_envoi.php, and (4) admin/incl_voir_compet.php. |
| 7.0 | CVE-2006-5768 OTHER-REF OTHER-REF OTHER-REF SECUNIA BID FRSIRT XF | ||
| DataparkSearch -- DataparkSearch | SQL injection vulnerability in DataparkSearch Engine 4.42 and earlier allows remote attackers to execute arbitrary SQL commands via a malformed hostname in a URL. |
| 7.0 | CVE-2006-5723 OTHER-REF BID FRSIRT XF | ||
| DeltaScripts -- PHP Classifieds | SQL injection vulnerability in detail.php in DeltaScripts PHP Classifieds 7.1 and earlier allows remote attackers to execute arbitrary SQL commands via the user_id parameter. |
| 7.0 | CVE-2006-5828 OTHER-REF BID SECUNIA XF | ||
| Dmitry Sheiko -- Business Card Web Builder | Multiple PHP remote file inclusion vulnerabilities in Dmitry Sheiko Business Card Web Builder (BCWB) 2.5 allow remote attackers to execute arbitrary PHP code via a URL in the root_path_admin parameter to (1) /include/startup.inc.php, (2) dcontent/default.css.php, or (3) system/default.css.php, different vectors than CVE-2006-4946. |
| 7.0 | CVE-2006-5816 BUGTRAQ | ||
| Dodo's Scripts -- DodosMail | Multiple PHP remote file inclusion vulnerabilities in dodosmail.php in DodosMail 2.0.1 and earlier, and possibly 2.1, allow remote attackers to execute arbitrary PHP code via a URL in the (1) dodosmail_header_file or (2) dodosmail_footer_file parameters. |
| 7.0 | CVE-2006-5841 Milw0rm FRSIRT SECUNIA | ||
| Drake CMS -- Drake CMS | PHP remote file inclusion vulnerability in includes/xhtml.php in Drake CMS 0.2.2 r846 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the d_root parameter. |
| 7.0 | CVE-2006-5767 OTHER-REF BID FRSIRT XF | ||
| e107 -- e107 | Directory traversal vulnerability in class2.php in e107 0.7.5 and earlier allows remote attackers to read and execute PHP code in arbitrary files via ".." sequences in the e107language_e107cookie cookie to gsitemap.php. |
| 7.0 | CVE-2006-5786 OTHER-REF BID XF | ||
| Edgewall Software -- Trac | Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors. |
| 7.0 | CVE-2006-5848 OTHER-REF OTHER-REF FRSIRT SECUNIA | ||
| Essen -- Essentia Web Server | Stack-based buffer overflow in Essentia Web Server 2.15 for Windows allows remote attackers to execute arbitrary code via a long URI, as demonstrated by a GET or HEAD request. NOTE: some of these details are obtained from third party information. |
| 7.0 | CVE-2006-5850 FULLDISC OTHER-REF BID FRSIRT SECUNIA XF | ||
| Francisco Burzi -- PHP-Nuke | SQL injection vulnerability in modules/journal/search.php in the Journal module in Francisco Burzi PHP-Nuke 7.9 and earlier allows remote attackers to execute arbitrary SQL commands via the forwhat parameter. |
| 7.0 | CVE-2006-5720 BUGTRAQ OTHER-REF BID FRSIRT SECUNIA XF | ||
| Free PHP Scripts -- Free File Hosting | PHP remote file inclusion vulnerability in contact.php in Free File Hosting 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AD_BODY_TEMP parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| 7.0 | CVE-2006-5764 FRSIRT | ||
| FreeWebshop -- FreeWebshop | Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) password and (2) prod parameter. |
| 7.0 | CVE-2006-5772 OTHER-REF FRSIRT SECUNIA XF | ||
| FreeWebshop -- FreeWebshop | Cross-site scripting (XSS) vulnerability in index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat parameter. |
| 7.0 | CVE-2006-5847 BUGTRAQ OTHER-REF BID FRSIRT SECUNIA | ||
| FunkBoard -- FunkBoard | Cross-site scripting (XSS) vulnerability in profile.php in FunkBoard 0.71 before 4 November 2006 at 18:16 GMT allows remote attackers to inject arbitrary web script or HTML, possibly via the name parameter. |
| 7.0 | CVE-2006-5775 OTHER-REF FRSIRT SECUNIA BID | ||
| GreenBeast CMS -- GreenBeast CMS | gbcms_php_files/up_loader.php GreenBeast CMS 1.3 does not require authentication to upload files, which allows remote attackers to cause a denial of service (disk consumption) and execute arbitrary code by uploading arbitrary files, such as executing PHP code via an uploaded PHP file. |
| 7.0 | CVE-2006-5833 BUGTRAQ OTHER-REF BID FRSIRT SECTRACK SECUNIA XF | ||
| IBM -- Lotus Domino | Multiple buffer overflows in tunekrnl in IBM Lotus Domino 6.x before 6.5.5 FP2 and 7.x before 7.0.2 allow local users to gain privileges and execute arbitrary code via unspecified vectors. |
| 7.0 | CVE-2006-5818 IDEFENSE OTHER-REF BID | ||
| Immediacy -- Immediacy .NET CMS | Cross-site scripting (XSS) vulnerability in logon.aspx in Immediacy CMS (Immediacy .NET CMS) 5.2 allows remote attackers to inject arbitrary web script or HTML via the lang parameter, which is returned to the client in a lang cookie. |
| 7.0 | CVE-2006-5853 BUGTRAQ OTHER-REF BID | ||
| Iodine -- Iodine | Stack-based buffer overflow in the handshake function in iodine 0.3.2 allows remote attackers to execute arbitrary code via a crafted DNS response. |
| 7.0 | CVE-2006-5781 BUGTRAQ OTHER-REF BID FRSIRT SECTRACK SECUNIA XF | ||
| IPrimal -- IPrimal Forums | admin/index.php in IPrimal Forums as of 20061105 allows remote attackers to bypass authentication and modify user passwords via a direct request, possibly related to an authentication issue in admin/chk_admin.php. |
| 7.0 | CVE-2006-5787 OTHER-REF BID FRSIRT SECUNIA | ||
| IPrimal -- IPrimal Forums | PHP remote file inclusion vulnerability in (1) index.php and (2) admin/index.php in IPrimal Forums as of 20061105 allows remote attackers to execute arbitrary PHP code via a URL in the p parameter. NOTE: the provenance of this information is unknown; details are obtained from third party sources. |
| 7.0 | CVE-2006-5788 FRSIRT SECUNIA | ||
| IrayoBlog -- IrayoBlog | PHP remote file inclusion vulnerability in inc/irayofuncs.php in IrayoBlog alpha-0.2.4 allows remote attackers to execute arbitrary PHP code via a URL in the irayodirhack parameter. |
| 7.0 | CVE-2006-5849 OTHER-REF FRSIRT XF | ||
| Leicestershire -- CommunityPortals | PHP remote file inclusion vulnerability in cpadmin/cpa_index.php in Leicestershire communityPortals 1.0_2005-10-18_12-31-18 allows remote attackers to execute arbitrary PHP code via a URL in the cp_root_path parameter, a different vector than CVE-2006-5280. |
| 7.0 | CVE-2006-5739 SECTRACK | ||
| Linux -- Linux kernel | Multiple unspecified vulnerabilities in netfilter for IPv6 code in Linux kernel before 2.6.16.31 allow remote attackers to bypass intended restrictions via unknown vectors, aka (1) "ip6_tables protocol bypass bug" and (2) "ip6_tables extension header bypass bug". |
| 7.0 | CVE-2006-4572 MLIST MANDRIVA SECUNIA SECUNIA | ||
| Microsoft -- XML Core Services | Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows, when accessed by Internet Explorer, allows remote attackers to execute arbitrary code via crafted arguments that lead to memory corruption, a different vulnerability than CVE-2006-4685. NOTE: some of these details are obtained from third party information. |
| 8.0 | CVE-2006-5745 OTHER-REF OTHER-REF FRSIRT OTHER-REF CERT-VN BID SECTRACK SECUNIA XF | ||
| Microsoft -- Windows 2000 Microsoft -- Windows XP | Microsoft Windows 2000 through 2000 SP4 and Windows XP through SP2 maps GDI Kernel structures on a global shared memory section that is mapped with read-only permissions, but can be remapped by other processes as read-write, which allows local users to cause a denial of service (memory corruption and crash) and execute arbitrary code by modifying the kernel structures. |
| 7.0 | CVE-2006-5758 OTHER-REF FRSIRT SECUNIA BID SECTRACK XF | ||
| MobileSecure Inc -- Highwall Enterprise MobileSecure Inc -- Highwall Endpoint | Multiple SQL injection vulnerabilities in Highwall Enterprise and Highwall Endpoint 4.0.2.11045 management interface allow remote attackers to execute arbitrary SQL commands via an Access Point with a crafted SSID, and via unspecified vectors related to a malicious system operator. |
| 7.0 | CVE-2006-5744 BUGTRAQ BUGTRAQ BID OSVDB | ||
| Mozilla -- SeaMonkey Mozilla -- Firefox Mozilla -- Thunderbird | Unspecified vulnerability in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allows remote attackers to execute arbitrary JavaScript bytecode via unspecified vectors involving modification of a Script object while it is executing. |
| 7.0 | CVE-2006-5463 OTHER-REF OTHER-REF CERT BID FRSIRT SECUNIA SECUNIA SECTRACK SECTRACK SECTRACK | ||
| Mozilla -- SeaMonkey Mozilla -- Firefox Mozilla -- Thunderbird | Unspecified vulnerability in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allows remote attackers to execute arbitrary code via the XML.prototype.hasOwnProperty JavaScript function. |
| 7.0 | CVE-2006-5747 CERT-VN OTHER-REF OTHER-REF CERT BID FRSIRT SECTRACK SECTRACK SECTRACK SECUNIA SECUNIA | ||
| Mozilla -- SeaMonkey Mozilla -- Firefox Mozilla -- Thunderbird | Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allow remote attackers to cause a denial of service (crash) and possible execute arbitrary code via unspecified vectors that trigger memory corruption. |
| 7.0 | CVE-2006-5748 OTHER-REF OTHER-REF OTHER-REF OTHER-REF OTHER-REF OTHER-REF OTHER-REF OTHER-REF OTHER-REF OTHER-REF CERT CERT-VN BID FRSIRT SECTRACK SECTRACK SECTRACK SECUNIA SECUNIA | ||
| mxBB -- mxBB Smartor Album | PHP remote file inclusion vulnerability in modules/mx_smartor/album.php in the mxBB Smartor Album module 1.02 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter. |
| 7.0 | CVE-2006-5803 OTHER-REF BID XF | ||
| NewP -- News Publication System | PHP remote file inclusion vulnerability in lib/class.Database.php in NewP News Publication System 1.0.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the path parameter. |
| 7.0 | CVE-2006-5838 BUGTRAQ BID XF | ||
| Novell -- eDirectory | Unspecified vulnerability in Novell eDirectory allows remote attackers to execute arbitrary code, as demonstrated by vd_novell.pm, a "Novell eDirectory remote exploit." NOTE: As of 20061108, this disclosure has no actionable information. However, since it is from a reliable researcher, it is being assigned a CVE identifier for tracking purposes. |
| 7.0 | CVE-2006-5814 OTHER-REF SECTRACK | ||
| OpenBSD -- OpenSSH | Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker verification that authentication has been successful, which might allow attackers to bypass authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging vulnerabilities in the unprivileged process, which are not known to exist. |
| 7.0 | CVE-2006-5794 OTHER-REF OTHER-REF BID FRSIRT SECUNIA SECUNIA | ||
| OpenDarwin -- Darwin Kernel | The fpathconf syscall function in bsd/kern/kern_descrip.c in the Darwin kernel (XNU) 8.8.1 in Apple Mac OS X allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code via a file descriptor with an unrecognized file type. |
| 7.0 | CVE-2006-5836 OTHER-REF BID | ||
| OpenEMR -- OpenEMR | Multiple PHP remote file inclusion vulnerabilities in OpenEMR 2.8.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the srcdir parameter to (a) billing_process.php, (b) billing_report.php, (c) billing_report_xml.php, and (d) print_billing_report.php in interface/billing/; (e) login.php; (f) interface/batchcom/batchcom.php; (g) interface/login/login.php; (h) main_info.php and (i) main.php in interface/main/; (j) interface/new/new_patient_save.php; (k) interface/practice/ins_search.php; (l) interface/logout.php; (m) custom_report_range.php, (n) players_report.php, and (o) front_receipts_report.php in interface/reports/; (p) facility_admin.php, (q) usergroup_admin.php, and (r) user_info.php in interface/usergroup/; or (s) custom/import_xml.php. |
| 7.0 | CVE-2006-5795 BUGTRAQ OTHER-REF OTHER-REF FRSIRT SECUNIA XF | ||
| PHP -- PHP | Buffer overflow in PHP before 5.2.0 allows remote attackers to execute arbitrary code via crafted UTF-8 inputs to the (1) htmlentities or (2) htmlspecialchars functions. |
| 7.0 | CVE-2006-5465 OTHER-REF UBUNTU OTHER-REF MANDRIVA REDHAT BID FRSIRT SECTRACK SECUNIA SECUNIA XF DEBIAN MANDRAKE SECUNIA SECUNIA SECUNIA | ||
| PHP -- PHP | Unspecified vulnerabilities in PHP, probably before 5.2.0, allow local users to bypass open_basedir restrictions and perform unspecified actions via unspecified vectors involving the (1) chdir and (2) tempnam functions. NOTE: the tempnam vector might overlap CVE-2006-1494. |
| 7.0 | CVE-2006-5706 OTHER-REF UBUNTU | ||
| PHPAdventure -- PHPAdventure | PHP remote file inclusion vulnerability in ad_main.php in PHPAdventure 1.1-Alpha and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _mygamefile parameter. |
| 7.0 | CVE-2006-5839 OTHER-REF FRSIRT XF | ||
| phpDynaSite -- phpDynaSite | Multiple PHP remote file inclusion vulnerabilities in phpDynaSite 3.2.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the racine parameter to (1) function_log.php, (2) function_balise_url.php, or (3) connection.php. |
| 7.0 | CVE-2006-5760 OTHER-REF FRSIRT SECUNIA XF | ||
| PHPEasyData Pro -- PHPEasyData Pro | SQL injection vulnerability in index.php in PHPEasyData Pro 1.4.1 and 2.2.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter. |
| 7.0 | CVE-2006-5707 BUGTRAQ BUGTRAQ OTHER-REF FRSIRT SECTRACK SECUNIA XF | ||
| PostNuke Software Foundation -- PostNuke | Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php. |
| 7.0 | CVE-2006-5733 OTHER-REF BID XF | ||
| ProFTPD Project -- ProFTPD | Unspecified vulnerability in ProFTPD allows remote attackers to execute arbitrary code, as demonstrated by vd_proftpd.pm, a "ProFTPD remote exploit." NOTE: As of 20061108, this disclosure has no actionable information. However, since it is from a reliable researcher, it is being assigned a CVE identifier for tracking purposes. |
| 7.0 | CVE-2006-5815 OTHER-REF SECTRACK | ||
| PunBB -- PunBB | Directory traversal vulnerability in include/common.php in PunBB before 1.2.14 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the language parameter, related to register.php storing a language value in the users table. |
| 7.0 | CVE-2006-5735 BUGTRAQ OTHER-REF OTHER-REF FRSIRT SECTRACK SECUNIA | ||
| PunBB -- PunBB | PunBB uses a predictable cookie_seed value that can be derived from the time of registration of the superadmin account (installation time), which might allow local users to perform unauthorized actions. |
| 7.0 | CVE-2006-5737 BUGTRAQ OTHER-REF SECTRACK | ||
| SimpleChat -- SimpleChat | Static code injection vulnerability in chat_panel.php in the SimpleChat 1.0.0 module for iWare Professional CMS allows remote attackers to inject arbitrary PHP code into chat_log.php via the msg parameter. |
| 7.0 | CVE-2006-5837 OTHER-REF BID FRSIRT SECUNIA XF | ||
| Soholaunch -- Soholaunch Pro Edition | Multiple PHP remote file inclusion vulnerabilities in Soholaunch Pro Edition 4.9 r46 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the _SESSION[docroot_path] parameter to (1) includes/shared_functions.php or (2) client_files/shopping_cart/pgm-shopping_css.inc.php. |
| 7.0 | CVE-2006-5796 BUGTRAQ OTHER-REF OTHER-REF FRSIRT XF | ||
| Speedywiki -- Speedywiki | Cross-site scripting (XSS) vulnerability in index.php in Speedywiki 2.0 allows remote attackers to inject arbitrary web script or HTML via the showRevisions parameter. |
| 7.0 | CVE-2006-5843 BUGTRAQ OTHER-REF BID SECUNIA | ||
| Speedywiki -- Speedywiki | Unrestricted file upload vulnerability in index.php in Speedywiki 2.0 allows remote authenticated users to upload and execute arbitrary PHP code by setting the upload parameter to 1. |
| 7.0 | CVE-2006-5845 BUGTRAQ OTHER-REF SECUNIA | ||
| Stefan Ritt -- Elog Web Logbook | Multiple format string vulnerabilities in elogd.c in ELOG 2.6.2 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) an entry with an attachment whose name contains format string specifiers (el_submit function), and possibly other vectors in the (2) receive_config, (3) show_rss_feed, (4) show_elog_list, (5) show_logbook_node, and (6) server_loop functions. |
| 7.0 | CVE-2006-5790 OTHER-REF BID FRSIRT SECUNIA | ||
| The Web Drivers -- Simple Forum | SQL injection vulnerability in message_details.php in The Web Drivers Simple Forum, dated 20060318, allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| 7.0 | CVE-2006-5802 OTHER-REF BID FRSIRT SECUNIA XF | ||
| Tikiwiki -- Tikiwiki | Cross-site scripting (XSS) vulnerability in tiki-featured_link.php in Tikiwiki 1.9.5 allows remote attackers to inject arbitrary web script or HTML via a url parameter that evades filtering, as demonstrated by a parameter value containing malformed, nested SCRIPT elements. |
| 7.0 | CVE-2006-5703 BUGTRAQ BID SECUNIA FRSIRT | ||
| Xenis -- Xenis.creator CMS | Multiple SQL injection vulnerabilities in default.asp in Xenis.creator CMS allow remote attackers to execute arbitrary SQL commands via the (1) nav, (2) s, or (3) print parameters. |
| 7.0 | CVE-2006-5797 BUGTRAQ BUGTRAQ BID SECTRACK XF | ||
| Xenis -- Xenis.creator CMS | SQL injection vulnerability in default.asp in Xenis.creator CMS allows remote attackers to execute arbitrary SQL commands via the contid parameter. |
| 7.0 | CVE-2006-5798 BUGTRAQ BID SECTRACK XF | ||
| Xenis -- Xenis.creator CMS | Multiple cross-site scripting (XSS) vulnerabilities in default.asp in xenis.creator CMS allow remote attackers to inject arbitrary web script or HTML via the (1) contid or (2) search parameters. |
| 7.0 | CVE-2006-5799 BUGTRAQ OTHER-REF BID SECTRACK XF | ||
| XLink Technology -- Omni-NFS Server | Stack-based buffer overflow in nfsd.exe in XLink Omni-NFS Server 5.2 allows remote attackers to execute arbitrary code via a crafted TCP packet to port 2049 (nfsd), as demonstrated by vd_xlink.pm. |
| 7.0 | CVE-2006-5780 BUGTRAQ OTHER-REF OTHER-REF BID | ||
| XLink Technology -- Omni-NFS/X Enterprise | Unspecified vulnerability in XLink Omni-NFS Enterprise allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by vd_xlink2.pm, an "Omni-NFS Enterprise remote exploit." NOTE: this is probably a different vulnerability than CVE-2006-5780. As of 20061107, this disclosure has no actionable information. However, since it is from a reliable researcher, it is being assigned a CVE identifier for tracking purposes. |
| 7.0 | CVE-2006-5792 OTHER-REF |
| Medium Vulnerabilities |
|---|
| Primary Vendor -- Product | Description |
| CVSS Score | Source & Patch Info | ||
|---|---|---|---|---|---|---|
| Airmagnet -- Enterprise | The console in AirMagnet Enterprise does not properly validate the Enterprise Server certificate, which allows remote attackers to read network traffic via a man-in-the-middle (MITM) attack, possibly related to the use of self-signed certificates. |
| 4.7 | CVE-2006-5746 BUGTRAQ BUGTRAQ BID OSVDB | ||
| Alt-N -- MDaemon | Unspecified vulnerability in WorldClient in Alt-N Technologies MDaemon before 9.50 has unknown impact and attack vectors related to a "JavaScript exploit." |
| 4.9 | CVE-2006-5709 OTHER-REF FRSIRT SECUNIA | ||
| Cisco -- Cisco Secure Desktop | Cisco Secure Desktop (CSD) before 3.1.1.45 allows local users to escape out of the secure desktop environment by using certain applications that switch to the default desktop, aka "System Policy Evasion". |
| 4.9 | CVE-2006-5807 CISCO | ||
| Cisco -- Cisco Secure Desktop | The installation of Cisco Secure Desktop (CSD) before 3.1.1.45 uses insecure default permissions (all users full control) for the CSD directory and its parent directory, which allow local users to gain privileges by replacing CSD executables, aka "Local Privilege Escalation". |
| 4.9 | CVE-2006-5808 IDEFENSE CISCO | ||
| Enlightenment -- Imlib2 | Multiple integer overflows in imlib2 allow user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) ARGB (loader_argb.c), (2) PNG (loader_png.c), (3) LBM (loader_lbm.c), (4) JPEG (loader_jpeg.c), or (5) TIFF (loader_tiff.c) images. |
| 5.6 | CVE-2006-4806 OTHER-REF UBUNTU BID FRSIRT SECUNIA SECUNIA MANDRIVA UBUNTU SECUNIA | ||
| Enlightenment -- Imlib2 | Stack-based buffer overflow in loader_pnm.c in imlib2 before 1.2.1, and possibly other versions, allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PNM image. |
| 5.6 | CVE-2006-4809 OTHER-REF UBUNTU BID FRSIRT SECUNIA SECUNIA MANDRIVA UBUNTU SECUNIA | ||
| Free PHP Scripts -- Free File Hosting | PHP remote file inclusion vulnerability in forgot_pass.php in Free File Hosting 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AD_BODY_TEMP parameter. |
| 5.6 | CVE-2006-5762 OTHER-REF OTHER-REF BID FRSIRT SECUNIA | ||
| Free PHP Scripts -- Free File Hosting | Multiple PHP remote file inclusion vulnerabilities in Free File Hosting 1.1, and possibly earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the AD_BODY_TEMP parameter to (1) login.php, (2) register.php, or (3) send.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| 5.6 | CVE-2006-5763 SECUNIA | ||
| FreeWebshop -- FreeWebshop | Directory traversal vulnerability in index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to read and include arbitrary files via a .. (dot dot) in the page parameter, a different vector than CVE-2006-5773. |
| 4.7 | CVE-2006-5846 BUGTRAQ OTHER-REF BID FRSIRT SECUNIA | ||
| GNU -- texinfo | Buffer overflow in the (1) texi2dvi and (2) texindex commands in texinfo 4.8 and earlier allows local users to execute arbitrary code via a crafted Texinfo file. |
| 4.9 | CVE-2006-4810 MANDRIVA REDHAT | ||
| HP -- NonStop Server | HP NonStop Server G06.29, when running Standard Security T6533G06 before T6533G06^ABK, does not properly evaluate access permissions to OSS directories when no optional ACL entry exists, which allows local users to read arbitrary files. |
| 5.6 | CVE-2006-5704 HP CIAC BID FRSIRT SECTRACK XF | ||
| Jonathon J. Freeman -- OvBB | Multiple unspecified vulnerabilities in Jonathon J. Freeman OvBB before 0.13a have unknown impact and attack vectors. |
| 4.9 | CVE-2006-5809 OTHER-REF FRSIRT | ||
| linux-ftpd-ssl -- linux-ftpd-ssl | ftpd in linux-ftpd 0.17, and possibly other versions, performs a chdir before setting the UID, which allows local users to bypass intended access restrictions by redirecting their home directory to a restricted directory. |
| 4.9 | CVE-2006-5778 FULLDISC OTHER-REF | ||
| Lithium CMS -- Lithium CMS | Directory traversal vulnerability in classes/index.php in Lithium CMS 4.04c and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the siteconf[curl] parameter, as demonstrated by a POST to news/comment.php containing PHP code, which is stored under db/comments/news/ and included by classes/index.php. |
| 4.7 | CVE-2006-5731 Milw0rm BID XF FRSIRT SECUNIA | ||
| Middlebury College -- Segue CMS | Multiple PHP remote file inclusion vulnerabilities in Segue CMS 1.5.9 and earlier, when magic_quotes_gpc is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the theme parameter to (1) themesettings.php or (2) index.php, a different vector than CVE-2006-5497. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| 5.6 | CVE-2006-5722 FRSIRT SECUNIA | ||
| MODxCMS -- MODxCMS | PHP remote file inclusion vulnerability in manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php in Modx CMS 0.9.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter. NOTE: it is possible that this is a vulnerability in FCKeditor. |
| 5.6 | CVE-2006-5730 Milw0rm BID XF FRSIRT SECUNIA | ||
| Mozilla -- Network Security Services (NSS) Mozilla -- SeaMonkey Mozilla -- Firefox Mozilla -- Thunderbird | Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates. NOTE: this identifier is for unpatched product versions that were originally intended to be addressed by CVE-2006-4340. |
| 4.7 | CVE-2006-5462 OTHER-REF OTHER-REF OTHER-REF CERT CERT-VN FRSIRT SECTRACK SECTRACK SECTRACK SECUNIA SECUNIA | ||
| Openbase International Ltd -- OpenBase | Untrusted search path vulnerability in openexec in OpenBase SQL before 10.0.1 allows local users to gain privileges via a modified PATH that references a malicious helper binary, as demonstrated by (1) cp, (2) rm, and (3) killall, different vectors than CVE-2006-5327. |
| 4.9 | CVE-2006-5852 FULLDISC OTHER-REF OTHER-REF SECUNIA | ||
| OpenEMR -- OpenEMR | PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[srcdir] parameter. |
| 5.6 | CVE-2006-5811 BUGTRAQ OTHER-REF OTHER-REF FRSIRT SECUNIA XF | ||
| PunBB -- PunBB | SQL injection vulnerability in search.php in PunBB before 1.2.14, when the PHP installation is vulnerable to CVE-2006-3017, allows remote attackers to execute arbitrary SQL commands via the result_list array parameter, which is not initialized. |
| 5.6 | CVE-2006-5736 BUGTRAQ OTHER-REF OTHER-REF FRSIRT SECTRACK | ||
| SAP -- SAP Web Application Server | Unspecified vulnerability in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to read arbitrary files via unknown vectors. NOTE: this issue can be leveraged by local users to access a named pipe as the SAPServiceJ2E user. |
| 4.9 | CVE-2006-5784 BUGTRAQ BID FRSIRT SECUNIA XF | ||
| Sazcart -- Sazcart | PHP remote file inclusion vulnerability in admin/controls/cart.php in sazcart 1.5 allows remote attackers to execute arbitrary PHP code via the (1) _saz[settings][shippingfolder] and (2) _saz[settings][taxfolder] parameters. |
| 5.6 | CVE-2006-5727 Milw0rm FRSIRT SECUNIA BID XF | ||
| Texas Imperial Software -- WFTPD | Buffer overflow in Texas Imperial Software WFTPD Pro Server 3.23.1.1 allows remote authenticated users to execute arbitrary code or cause a denial of service (application crash) via crafted APPE commands that contain "/" (slash) or "\" (backslash) characters. |
| 4.2 | CVE-2006-5826 BUGTRAQ FULLDISC FULLDISC OTHER-REF BID SECTRACK | ||
| Yazd -- Yazd Discussion Forum | Yazd Discussion Forum before 3.0 beta does not properly manage forum permissions, which allows remote authenticated users to (1) reply to a message in an arbitrary forum, if authorized to create a message in any forum; and (2) perform certain unauthorized forum actions, related to an "error in how the permissions were assembled" that assigns extra permissions to users. |
| 4.2 | CVE-2006-5729 OTHER-REF BID SECUNIA XF XF |
| Low Vulnerabilities |
|---|
| Primary Vendor -- Product | Description |
| CVSS Score | Source & Patch Info | ||
|---|---|---|---|---|---|---|
| ac4p -- ac4p Mobile | Multiple cross-site scripting (XSS) vulnerabilities in Mobile allow remote attackers to inject arbitrary web script or HTML via (1) Bloks, (2) Newnews, (3) lBlok, and (4) foooot parameter in (a) index.php; Newnews, (5) newmsgs, and Bloks parameter in (b) MobileNews.php; Newnews parameter in (c) polls.php; (6) cats parameter in (d) send.php; (7) footer parameter in (e) up.php; and (8) pagenav parameter in (f) cp/index.php. |
| 2.3 | CVE-2006-5770 BUGTRAQ BID | ||
| AEP Networks -- Smartgate SSL Server | The SSL server in AEP Smartgate 4.3b allows remote attackers to determine existence of directories via a direct request for a directory URI, which returns a different HTTP status codes for existing and non-existing directories. |
| 2.3 | CVE-2006-5725 OTHER-REF OTHER-REF FRSIRT SECUNIA XF | ||
| Agnitum -- Outpost Firewall PRO | The \Device\SandBox driver in Outpost Firewall PRO 4.0 (964.582.059) allows local users to cause a denial of service (system crash) via an invalid argument to the DeviceIoControl function that triggers an invalid memory operation. |
| 2.3 | CVE-2006-5721 BUGTRAQ OTHER-REF BID FRSIRT SECTRACK SECUNIA | ||
| AIOCP -- AIOCP | Multiple cross-site scripting (XSS) vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) topid, (2) forid, and (3) catid parameters to code/cp_forum_view.php; (4) choosed_language parameter to cp_dpage.php; (5) orderdir parameter to cp_links_search.php; (6) order_field parameter to (a) cp_show_ec_products.php and (b) cp_users_online.php; and the (7) signature and (8) fiscal code fields in the user profile. |
| 1.9 | CVE-2006-5830 BUGTRAQ BID FRSIRT SECUNIA XF XF | ||
| AIOCP -- AIOCP | All In One Control Panel (AIOCP) 1.3.007 and earlier allows remote attackers to obtain the full path of the web server via certain requests to (1) public/code/cp_dpage.php, possibly involving the aiocp_dp[] parameter, (2) public/code/cp_show_ec_products.php, possibly involving the order_field[] parameter, and (3) public/code/cp_show_page_help.php, possibly involving the hp[] parameter, which reveal the path in various error messages. |
| 2.3 | CVE-2006-5832 BUGTRAQ BID XF | ||
| AirMagnet -- Enterprise | Multiple cross-site scripting (XSS) vulnerabilities in AirMagnet Enterprise allow remote attackers to inject arbitrary web script or HTML via (1) the 404 error page of the Smart Sensor Edge Sensor; (2) the user name for a failed logon, when displayed in the audit journals reviewing interface (/AirMagnetSensor/AMSensor.dll/XH) by the Smart Sensor Edge Sensor log viewer; and (3) an SSID of an AP, when displayed on an ACL page (/Amom/Amom.dll/BD) of the Enterprise Server Status Overview in the Enterprise Server Web interface. |
| 2.3 | CVE-2006-5741 BUGTRAQ BUGTRAQ BID OSVDB OSVDB OSVDB | ||
| Airmagnet -- Enterprise | The AirMagnet Enterprise console and Remote Sensor console (Laptop) in AirMagnet Enterprise allows remote attackers to inject arbitrary web script or HTML from a certain embedded Internet Explorer object into an SSID template value, aka "Cross-Application Scripting (XAS)". |
| 2.3 | CVE-2006-5742 BUGTRAQ BUGTRAQ BID | ||
| Alt-N -- MDaemon | Multiple unspecified vulnerabilities in MDaemon and WorldClient in Alt-N Technologies MDaemon before 9.50 allow attackers to cause a denial of service (memory consumption) via unspecified vectors resulting in memory leaks. |
| 2.3 | CVE-2006-5708 OTHER-REF | ||
| Arkoon -- SSL360 | Cross-site scripting (XSS) vulnerability in Arkoon SSL360 1.0 and 2.0 before 2.0/2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| 2.3 | CVE-2006-5771 OTHER-REF BID FRSIRT XF | ||
| Cisco -- Cisco Secure Desktop | SSL VPN Client in Cisco Secure Desktop before 3.1.1.45, when configured to spawn a web browser after a successful connection, stores sensitive browser session information in a directory outside of the CSD vault and does not restrict the user from saving files outside of the vault, which is not cleared after the VPN connection terminates and allows local users to read unencrypted data. |
| 1.6 | CVE-2006-5806 CISCO | ||
| DigiOz -- DigiOz Guestbook | list.php in DigiOz Guestbook before 1.7.1 allows remote attackers to obtain sensitive information via a non-numeric page parameter, which displays the installation path in the resulting error message. |
| 2.3 | CVE-2006-5651 FULLDISC OTHER-REF OSVDB BUGTRAQ | ||
| Dxmsoft -- XM Easy Personal FTP Server | XM Easy Personal FTP Server 5.2.1 and earlier allows remote authenticated users to cause a denial of service via a long argument to the NLST command, possibly involing the -al flags. |
| 1.4 | CVE-2006-5728 Milw0rm SECUNIA FRSIRT | ||
| ECI Telecom -- B-FOCuS Wireless 802.11b/g ADSL2+ Router | ECI Telecom B-FOCuS Wireless 802.11b/g ADSL2+ Router allows remote attackers to read arbitrary files via a certain HTTP request, as demonstrated by a request for a router configuration file, related to the /html/defs/ URI. |
| 2.3 | CVE-2006-5711 BUGTRAQ FULLDISC BID SECTRACK XF FRSIRT SECUNIA | ||
| EFS Software -- EFS Web Server | Cross-site scripting (XSS) vulnerability in Easy File Sharing (EFS) Web Server 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) author, (2) content, or (3) title parameters when posting a forum thread. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| 2.3 | CVE-2006-5713 BID SECUNIA XF | ||
| EFS Software -- EFS Web Server | Easy File Sharing (EFS) Web Server 4.0, when running on an NTFS file system, allows remote attackers to read arbitrary files under the web root by appending "::$DATA" to the end of a HTTP GET request, which accesses the alternate data stream. |
| 2.3 | CVE-2006-5714 OTHER-REF BID SECUNIA XF | ||
| EFS Software -- Easy Address Book | Easy File Sharing (EFS) Easy Address Book 1.2, when run on an NTFS file system, allows remote attackers to read arbitrary files under the web root by appending "::$DATA" to the end of an HTTP GET request, which accesses the alternate data stream. |
| 2.3 | CVE-2006-5715 OTHER-REF BID SECUNIA FRSIRT XF | ||
| Enlightenment -- Imlib2 | loader_tga.c in imlib2 before 1.2.1, and possibly other versions, allows user-assisted remote attackers to cause a denial of service (crash) via a crafted TGA image that triggers an out-of-bounds memory read, a different issue than CVE-2006-4808. |
| 1.9 | CVE-2006-4807 OTHER-REF UBUNTU BID FRSIRT SECUNIA SECUNIA MANDRIVA UBUNTU SECUNIA XF | ||
| Enlightenment -- Imlib2 | Heap-based buffer overflow in loader_tga.c in imlib2 before 1.2.1, and possibly other versions, allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TGA image. |
| 1.9 | CVE-2006-4808 OTHER-REF UBUNTU BID FRSIRT SECUNIA SECUNIA MANDRIVA UBUNTU SECUNIA | ||
| FixPunkt GmbH -- admin.tool CMS 3 | Multiple cross-site scripting (XSS) vulnerabilities in admin.tool CMS 3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) fSid or (2) fSrcBegriffe parameters in unspecified vectors. |
| 2.3 | CVE-2006-5769 BUGTRAQ OTHER-REF BID XF | ||
| FreeBSD -- FreeBSD | The libarchive library in FreeBSD FreeBSD 6-STABLE after 2006-09-05 and before 2006-11-08 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive that causes libarchive to skip a region past the actual end of the archive, which triggers an infinite loop that attempts to read more data. |
| 2.3 | CVE-2006-5680 FREEBSD | ||
| FreeBSD -- FreeBSD | Integer overflow in the ffs_rdextattr function in FreeBSD 6.1 allows local users to cause a denial of service (kernel panic) and trigger a heap-based buffer overflow via a crafted UFS filesystem, a different vulnerability than CVE-2006-5679. |
| 2.3 | CVE-2006-5824 OTHER-REF | ||
| Freenews -- Freenews | Directory traversal vulnerability in aff_news.php in FreeNews 2.1 allows remote attackers to include local files via a .. (dot dot) sequence in the chemin parameter, when the aff_news parameter is not set to "1." |
| 2.3 | CVE-2006-5716 BUGTRAQ BUGTRAQ BUGTRAQ | ||
| FreeWebshop -- FreeWebshop | Directory traversal vulnerability in index.php in FreeWebshop 2.2.1 and earlier allows remote attackers to read arbitrary files and disclose the installation path via a .. (dot dot) in the action parameter. |
| 2.3 | CVE-2006-5773 OTHER-REF BID FRSIRT SECUNIA XF | ||
| HP -- OpenView Client Configuraton Manager | radexecd.exe in HP OpenView Client Configuraton Manager (CCM) does not require authentication before executing commands in the installation directory, which allows remote attackers to cause a denial of service (reboot) by calling radbootw.exe or create arbitrary files by calling radcrecv. |
| 3.3 | CVE-2006-5782 BUGTRAQ OTHER-REF | ||
| Hyper NIKKI System -- Hyper NIKKI System | Cross-site scripting (XSS) vulnerability in Hyper NIKKI System before 2.19.9 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. |
| 2.3 | CVE-2006-5774 OTHER-REF OTHER-REF FRSIRT SECUNIA BID | ||
| IBM -- Lotus Notes | The Notes Remote Procedure Call (NRPC) protocol in IBM Lotus Notes Domino before 6.5.5 FP2 and 7.x before 7.0.2 does not require authentication to perform user lookups, which allows remote attackers to obtain the user ID file. |
| 2.3 | CVE-2006-5835 OTHER-REF OTHER-REF BID FRSIRT SECUNIA XF | ||
| Jgaa -- WarFTPd | WarFTPd 1.82.00-RC11 allows remote authenticated users to cause a denial of service via a large number of "%s" format strings in (1) CWD, (2) CDUP, (3) DELE, (4) NLST, (5) LIST, (6) SIZE, and possibly other commands. NOTE: it is possible that vector 1 is an off-by-one variant or incomplete fix of CVE-2005-0312. |
| 1.4 | CVE-2006-5789 BUGTRAQ BID | ||
| Kayako -- SupportSuite | Cross-site scripting (XSS) vulnerability in index.php in Kayako SupportSuite 3.00.32 allows remote attackers to inject arbitrary web script or HTML via the query string. |
| 2.3 | CVE-2006-5825 BUGTRAQ OTHER-REF BID | ||
| Kerio -- Kerio MailServer | Unspecified vulnerability in Kerio MailServer allows attackers to cause a denial of service, as demonstrated by vd_kms4.pm, a "Kerio MailServer DoS." NOTE: As of 20061108, this disclosure has no actionable information. However, since it is from a reliable researcher, it is being assigned a CVE identifier for tracking purposes. |
| 2.3 | CVE-2006-5812 OTHER-REF SECTRACK | ||
| Linux -- Linux kernel | Race condition in the __find_get_block_slow function in the ISO9660 filesystem in Linux 2.6.18 and possibly other versions allows local users to cause a denial of service (infinite loop) by mounting a crafted ISO9660 filesystem containing malformed data structures. |
| 1.3 | CVE-2006-5757 OTHER-REF BID SECUNIA SECUNIA FRSIRT XF | ||
| Linux -- Linux kernel | The zlib_inflate function in Linux kernel 2.6.x allows local users to cause a denial of service (crash) via a malformed filesystem that uses zlib compression that triggers memory corruption, as demonstrated using cramfs. |
| 2.3 | CVE-2006-5823 OTHER-REF | ||
| Microsoft -- Internet Explorer | Microsoft Internet Explorer 7 allows remote attackers to cause a security certificate from a secure web site to appear invalid via a link to res://ieframe.dll/invalidcert.htm with the target site as an argument, which displays the site's URL in the address bar but causes Internet Explorer to report that the certificate as invalid. |
| 2.3 | CVE-2006-5805 OTHER-REF SECTRACK | ||
| Mirabilis -- ICQ | Heap-based buffer overflow the "Answering Service" function in ICQ 2003b Build 3916 allows local users to cause a denial of service (application crash) via a long string in the "AwayMsg Presets" value in the ICQ\ICQPro\DefaultPrefs\Presets registry key. |
| 1.6 | CVE-2006-5724 FULLDISC XF | ||
| Mirapoint -- Mirapoint WebMail | Cross-site scripting (XSS) vulnerability in Mirapoint WebMail allows remote attackers to inject arbitrary web script via the expression Cascading Style Sheets (CSS) function, as demonstrated using the width style for an IMG element. |
| 2.3 | CVE-2006-5712 FULLDISC BID SECTRACK XF | ||
| MobileSecure -- Highwall Enterprise MobileSecure -- Highwall Endpoint | Multiple cross-site scripting (XSS) vulnerabilities in Highwall Enterprise and Highwall Endpoint 4.0.2.11045 management interface allow remote attackers to inject arbitrary web script or HTML via (1) an Access Point with a crafted SSID, (2) the name of the sensor WIDS, (3) the name of the Highwall EndPoint workstation, or other unspecified vectors. |
| 2.3 | CVE-2006-5743 BUGTRAQ BUGTRAQ BID OSVDB | ||
| Mozilla -- SeaMonkey Mozilla -- Firefox Mozilla -- Thunderbird | Multiple unspecified vulnerabilities in the layout engine in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allow remote attackers to cause a denial of service (crash) via unspecified vectors. |
| 2.3 | CVE-2006-5464 OTHER-REF OTHER-REF OTHER-REF OTHER-REF OTHER-REF CERT-VN CERT BID FRSIRT SECTRACK SECTRACK SECTRACK SECUNIA SECUNIA | ||
| Mozilla -- Firefox | ** DISPUTED ** Firefox 1.5.0.7 on Kubuntu Linux allows remote attackers to cause a denial of service (crash) via a long URL in an A tag. NOTE: this issue has been disputed by several vendors, who could not reproduce the report. In addition, the scope of the impact - system freeze - suggests an issue that is not related to Firefox. Due to this impact, CVE concurs with the dispute. |
| 3.3 | CVE-2006-5783 BUGTRAQ BUGTRAQ BUGTRAQ BUGTRAQ | ||
| Novell -- eDirectory | The BerDecodeLoginDataRequest function in the libnmasldap.so NMAS module in Novell eDirectory 8.8 and 8.8.1 before the Security Services 2.0.3 patch does not properly increment a pointer when handling certain input, which allows remote attackers to cause a denial of service (invalid memory access) via a crafted login request. |
| 2.3 | CVE-2006-4521 IDEFENSE BID FRSIRT SECTRACK SECUNIA XF | ||
| Novell -- eDirectory | Unspecified vulnerability in Novell eDirectory 8.8 allows attackers to cause a denial of service, as demonstrated by vd_novell3.pm, a "Novell eDirectory 8.8 DoS." NOTE: As of 20061108, this disclosure has no actionable information. However, since it is from a reliable researcher, it is being assigned a CVE identifier for tracking purposes. |
| 2.3 | CVE-2006-5813 OTHER-REF SECTRACK | ||
| Openbase International Ltd -- OpenBase | openexec in OpenBase SQL before 10.0.1 allows local users to create arbitrary files via a symlink attack on the /tmp/output file, a different vulnerability than CVE-2006-5328. |
| 1.6 | CVE-2006-5851 FULLDISC OTHER-REF OTHER-REF SECUNIA | ||
| OpenSolution -- Quick.Cms.Lite | Directory traversal vulnerability in general.php in OpenSolution Quick.Cms.Lite 0.3 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the sLanguage Cookie parameter. |
| 2.3 | CVE-2006-5834 OTHER-REF BID FRSIRT SECUNIA XF | ||
| owfs -- owfs | The owserver module in owfs and owhttpd 2.5p5 and earlier does not properly check the path type, which allows attackers to cause a denial of service (application crash) related to use of the path in owshell. |
| 2.3 | CVE-2006-5801 OTHER-REF FRSIRT SECUNIA | ||
| Parallels -- Parallels Desktop | prl_dhcpd in Parallels Desktop for Mac Build 1940 uses insecure permissions (0666) for /Library/Parallels/.dhcpd_configuration, which allows local users to modify DHCP configuration. NOTE: the provenance of this information is unknown; details are obtained from third party sources. |
| 1.6 | CVE-2006-5817 SECUNIA | ||
| phpComasy -- phpComasy | Multiple cross-site scripting (XSS) vulnerabilities in index.php in phpComasy CMS 0.7.9pre and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username or (2) password parameters. |
| 2.3 | CVE-2006-5827 BUGTRAQ OTHER-REF BID SECUNIA XF | ||
| phpMyAdmin -- phpMyAdmin | Cross-site scripting (XSS) vulnerability in error.php in phpMyAdmin 2.6.4 through 2.9.0.2 allows remote attackers to inject arbitrary web script or HTML via UTF-7 or US-ASCII encoded characters, which are injected into an error message, as demonstrated by a request with a utf7 charset parameter accompanied by UTF-7 data. |
| 2.3 | CVE-2006-5718 OTHER-REF OTHER-REF BID FRSIRT SECUNIA | ||
| PunBB -- PunBB | Multiple SQL injection vulnerabilities in PunBB before 1.2.14 allow remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors. |
| 1.1 | CVE-2006-5738 OTHER-REF OTHER-REF | ||
| Red Hat -- Red Hat Fedora Core OpenLDAP -- OpenLDAP | Unspecified vulnerability in the openldap-2.2.29-1 package of OpenLDAP on Fedora Core 4 (FC4), and possibly other versions and distributions, allows remote attackers to cause a denial of service (daemon crash) via a certain combination of LDAP BIND requests that triggers an assertion failure. |
| 2.3 | CVE-2006-5779 BUGTRAQ OTHER-REF OTHER-REF BID FRSIRT SECTRACK SECUNIA | ||
| Rhadrix -- If-CMS | index.php in Rhadrix If-CMS, possibly 1.01 and 2.07, allows remote attackers to obtain the full path of the web server via empty (1) rns[] or (2) pag[] arguments, which reveals the path in an error message. |
| 2.3 | CVE-2006-5759 BUGTRAQ OTHER-REF XF | ||
| Rhadrix -- If-CMS | Cross-site scripting (XSS) vulnerability in index.php in Rhadrix If-CMS 1.01 and 2.07 allows remote attackers to inject arbitrary web script or HTML via the rns parameter. |
| 2.3 | CVE-2006-5761 BUGTRAQ OTHER-REF BID SECUNIA FRSIRT SECTRACK XF | ||
| RPM -- Package Manager Ubuntu -- Ubuntu Linux | Heap-based buffer overflow in the showQueryPackage function in librpm in RPM Package Manager 4.4.8, when the LANG environment variable is set to ru_RU.UTF-8, might allow user-assisted attackers to execute arbitrary code via crafted RPM packages. |
| 2.7 | CVE-2006-5466 BUGZILLA UBUNTU FRSIRT SECUNIA SECUNIA | ||
| SAP -- SAP Web Application Server | Unspecified vulnerability in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to cause a denial of service (enserver.exe crash) via unknown vectors. |
| 2.3 | CVE-2006-5785 BUGTRAQ BID FRSIRT SECUNIA XF | ||
| Speedywiki -- Speedywiki | Speedywiki 2.0 allows remote attackers to obtain the full path of the web server via the (1) showRevisions[] and (2) searchText[] parameters in (a) index.php, and (b) a direct request to upload.php without any parameters. |
| 2.3 | CVE-2006-5844 BUGTRAQ OTHER-REF | ||
| Stefan Ritt -- Elog Web Logbook | Multiple cross-site scripting (XSS) vulnerabilities in elogd.c in ELOG 2.6.2 and earlier allow remote attackers to inject arbitrary HTML or web script via (1) the filename for downloading, which is not quoted in an error message by the send_file_direct function, and (2) the Type or Category values in a New entry, which is not properly handled in an error message by the submit_elog function. |
| 1.9 | CVE-2006-5791 OTHER-REF BID BID FRSIRT SECUNIA | ||
| Sun -- Solaris | alloccgblk in the UFS filesystem in Solaris 10 allows local users to cause a denial of service (memory corruption) by mounting crafted UFS filesystems with malformed data structures. |
| 2.3 | CVE-2006-5726 OTHER-REF SECUNIA BID FRSIRT | ||
| TGS CMS -- TGS CMS | SQL injection vulnerability in logout.php in T.G.S. CMS 0.1.7 and earlier allows remote attackers to execute arbitrary SQL commands via the myauthorid cookie. |
| 2.3 | CVE-2006-5732 Milw0rm BID XF | ||
| Tikiwiki -- Tikiwiki | Tikiwiki 1.9.5 allows remote attackers to obtain sensitive information (MySQL username and password) via an empty sort_mode parameter in (1) tiki-listpages.php, (2) tiki-lastchanges.php, (3) messu-archive.php, (4) messu-mailbox.php, (5) messu-sent.php, (6) tiki-directory_add_site.php, (7) tiki-directory_ranking.php, (8) tiki-directory_search.php, (9) tiki-forums.php, (10) tiki-view_forum.php, (11) tiki-friends.php, (12) tiki-list_blogs.php, (13) tiki-list_faqs.php, (14) tiki-list_trackers.php, (15) tiki-list_users.php, (16) tiki-my_tiki.php, (17) tiki-notepad_list.php, (18) tiki-orphan_pages.php, (19) tiki-shoutbox.php, (20) tiki-usermenu.php, and (21) tiki-webmail_contacts.php, which reveal the information in certain database error messages. |
| 2.3 | CVE-2006-5702 BUGTRAQ BID SECUNIA FRSIRT XF | ||
| Unicore -- Unicore Client | The keystore file in Unicore Client before 5.6 build 5, when running on Unix systems, has insecure default permissions, which allows local users to obtain sensitive information. |
| 1.6 | CVE-2006-5842 OTHER-REF SECUNIA | ||
| WordPress -- WordPress | Directory traversal vulnerability in plugins/wp-db-backup.php in WordPress before 2.0.5 allows remote attackers to read arbitrary files via directory traversal sequences in unspecified parameters related to the backup of fragment files. |
| 2.3 | CVE-2006-5705 OTHER-REF OTHER-REF OTHER-REF OPENPKG BID FRSIRT SECUNIA | ||
| Xenis -- Xenis.creator CMS | Cross-site scripting (XSS) vulnerability in default.asp in xenis.creator CMS allows remote attackers to inject arbitrary web script or HTML via the nav parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| 1.9 | CVE-2006-5800 XF | ||
| XOOPS -- XOOPS | Cross-site scripting (XSS) vulnerability in modules/wfdownloads/newlist.php in XOOPS 1.0 allows remote attackers to inject arbitrary web script or HTML via the newdownloadshowdays parameter. |
| 2.3 | CVE-2006-5810 OTHER-REF BID | ||
| Zend -- Zend Google Data Client Library Preview | Multiple cross-site scripting (XSS) vulnerabilities in Zend Google Data Client Library (ZendGData) Preview 0.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) basedemo.php and (2) calenderdemo.php in samples/, and other unspecified files. |
| 2.3 | CVE-2006-5717 BUGTRAQ OTHER-REF BID |
Please share your thoughts
We recently updated our anonymous product survey; we’d welcome your feedback.