Skip to content
OpenAdvisories

Archive

July 2006

Vulnerabilities first published in this month (UTC), newest first.

← June 2006 2006 / July August 2006 →
  1. 1 
  2. 2 
  3. 314
  4. 4 
  5. 54
  6. 653
  7. 729
  8. 81
  9. 9 
  10. 1027
  11. 1119
  12. 1220
  13. 1357
  14. 1436
  15. 151
  16. 16 
  17. 1718
  18. 1830
  19. 1946
  20. 209
  21. 2144
  22. 22 
  23. 23 
  24. 243
  25. 2532
  26. 261
  27. 2740
  28. 2821
  29. 292
  30. 30 
  31. 3125
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium —
    CVE-2006-3935

    Alkacon OpenCMS Improper Access Control via system/workplace/views/admin/admin-main.jsp

    system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to (1) send broadcast messages to all users (/workplace/broadcast), (2) list all users (/a…

    org.opencms:opencms-core Maven
  • Medium —
    CVE-2006-3936

    Alkacon OpenCms Exposes JSP Source Code

    system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp.

    org.opencms:opencms-core Maven
  • Medium —
    CVE-2006-3934

    Alkacon OpenCMS Absolute Path Traversal via pathname in filePath parameter

    Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.

    org.opencms:opencms-core Maven
  • Medium —
    CVE-2006-3835 Public exploit EPSS 48%

    Apache Tomcat Reveals Directories

    Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.

    org.apache.tomcat:tomcat Maven
  • Medium 5.5
    CVE-2006-3547

    EMC VMware Player allows user-assisted attackers to cause a denial of service (unrecoverable application failure) via a…

  • Medium —
    CVE-2006-3360

    phpSysInfo allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence

    Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error mess…

    phpsysinfo phpsysinfo/phpsysinfo Debian Packagist