Archive
May 2006
Vulnerabilities first published in this month (UTC), newest first.
609 results · Feed
-
Unscored —
Heap-based buffer overflow in the ISO Transport Service over TCP (RFC 1006) implementation of LiveData ICCP Server befo…
-
Unscored —
Bitrix Site Manager 4.1.x stores updater.log under the web document root with insufficient access control, which allows…
-
Unscored —
Directory traversal vulnerability in (1) edit_mailtexte.cgi and (2) bestmail.cgi in Cosmoshop 8.11.106 and earlier allo…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the administrative interface Bitrix Site Manager 4.1.x allows remote attack…
-
Unscored —
Bitrix Site Manager 4.1.x allows remote attackers to redirect users to other websites via a modified back_url during a …
-
Unscored —
The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which all…
-
Unscored —CVE-2006-2473 Public exploit
Cross-site scripting (XSS) vulnerability in ow.asp in OpenWiki 0.78 allows remote attackers to inject arbitrary web scr…
-
Unscored —CVE-2006-2474 Public exploit
SQL injection vulnerability in lshop.cgi in Cosmoshop 8.11.106 and earlier allows remote attackers to execute arbitrary…
-
Unscored —CVE-2006-2465 Public exploit
Buffer overflow in MP3Info 0.8.4 allows attackers to execute arbitrary code via a long command line argument. NOTE: if …
-
Unscored —
stopWebLogic.sh in BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6 displays the administrat…
-
Unscored —
BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 allows remote attackers to obtain the source code of JSP pages duri…
-
Unscored —
Multiple vulnerabilities in BEA WebLogic Server 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 leak sensitive in…
-
Unscored —
BEA WebLogic Server before 8.1 Service Pack 4 does not properly set the Quality of Service in certain circumstances, wh…
-
Unscored —
Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the consol…
-
Unscored —
Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when register_globals is enabled, does not protect critical variabl…
-
Unscored —
The HTTP handlers in BEA WebLogic Server 9.0, 8.1 up to SP5, 7.0 up to SP6, and 6.1 up to SP7 stores the username and p…
-
Unscored —CVE-2006-2459 Public exploit
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to exe…
-
Unscored —
BEA WebLogic Server 8.1 up to SP4, 7.0 up to SP6, and 6.1 up to SP7 displays the internal IP address of the WebLogic se…
-
Unscored —
The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain n…
-
Unscored —
BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6, may send sensitive data over non-secure ch…
-
Unscored —
Unspecified vulnerability in BEA WebLogic Server 9.1 and 9.0, 8.1 through SP5, 7.0 through SP6, and 6.1 through SP7 all…
-
Unscored —
view_album.php in SelectaPix 1.31 and earlier allows remote attackers to obtain the installation path via a certain req…
-
Medium —CVE-2006-2458 Public exploit
Libextractor multiple heap-based buffer overflows
Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (pl…
-
Unscored —
choose_new_parent in Linux kernel before 2.6.11.12 includes certain debugging code, which allows local users to cause a…
-
Unscored —
Linux kernel before 2.6.13 allows local users to cause a denial of service (crash) via a dio transfer from the sg drive…
-
Unscored —
Pioneers meta-server before 0.9.55, when the server-console is not installed, allows remote attackers to cause a denial…
-
Unscored —
The Debian package of knowledgetree 2.0.7 creates environment.php with world-readable permissions, which allows local u…
-
Unscored —
kphone 4.2 creates .qt/kphonerc with world-readable permissions, which allows local users to read usernames and SIP pas…
-
Unscored —
Heap-based buffer overflow in the libMagick component of ImageMagick 6.0.6.2 might allow attackers to execute arbitrary…
-
Unscored —
graphviz before 2.2.1 allows local users to overwrite arbitrary files via a symlink attack on temporary files. NOTE: th…
-
Unscored —
Flexbackup 1.2.1 and earlier allows local users to overwrite files and execute code via a symlink attack on temporary f…
-
Unscored —
Directory traversal vulnerability in Caucho Resin 3.0.17 and 3.0.18 for Windows allows remote attackers to read arbitra…
-
Unscored —
Unspecified vulnerability in WebSphere 5.1.1 (or any earlier cumulative fix) Common Configuration Mode + CommonArchive …
-
Unscored —
IBM WebSphere Application Server 5.0.2 and earlier, 5.1.1 and earlier, and 6.0.2 up to 6.0.2.7 records user credentials…
-
Unscored —
Unspecified vulnerability in IBM WebSphere Application Server 6.0.2, 6.0.2.1, 6.0.2.3, 6.0.2.5, and 6.0.2.7 has unknown…
-
Unscored —
IBM WebSphere Application Server 5.0.2 (or any earlier cumulative fix) and 5.1.1 (or any earlier cumulative fix) allows…
-
Unscored —
Directory traversal vulnerability in the viewfile servlet in the documentation package (resin-doc) for Caucho Resin 3.0…
-
Unscored —
freshclam in (1) Clam Antivirus (ClamAV) 0.88 and (2) ClamXav 1.0.3h and earlier does not drop privileges before proces…
-
Unscored —
add.asp in DUware DUbanner 3.1 allows remote attackers to execute arbitrary code by uploading files with arbitrary exte…
-
Unscored —CVE-2006-2437 Public exploit
The viewfile servlet in the documentation package (resin-doc) for Caucho Resin 3.0.17 and 3.0.18 allows remote attacker…