CVE-2006-7138

CVE-2006-7138 affects Oracle Application Express/HTMLDB (APEX) prior to 2.2. The issue is an SQL injection in WWV_FLOW_UTILITIES.gen_popup_list inside the WWV_FLOW_UTILITIES package, enabling remote authenticated users to alter P_LOV and calculate a matching MD5 checksum for P_LOV_CHECKSUM to exe...

CVE-2006-7140

CVE-2006-7140 concerns the libike library used by Sun Solaris components (in.iked, elfsign, kcfd) on Solaris 9/10. When an RSA key with exponent 3 is used, libike removes PKCS#1 padding before hashing, enabling remote attackers to forge a PKCS#1 v1.5 signature signed by that RSA key and to disrup...

CVE-2006-7146

PHP remote file inclusion vulnerability in bug.php in Leicestershire communityPortals 1.0 build 20051018 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cprootpath parameter, a different vector than CVE-2006-5280. NOTE: CVE disputes this issue, since bug.php is...

CVE-2006-7156

CVE-2006-7156 describes a PHP remote file inclusion vulnerability in the Keyword Replacer (keyword_replacer) 1.0 and earlier, a module for miniBB. The flaw allows remote attackers to execute arbitrary PHP code by supplying a URL in the pathToFiles parameter. This is a classic RFI in a component u...

CVE-2006-7148

PHP remote file inclusion vulnerability in includes/bbusagestats.php in maluinfo 206.2.38 for Brazilian PHPBB allows remote attackers to execute arbitrary PHP code via the phpbbrootpath parameter. NOTE: this might be the same issues as CVE-2006-4893...

CVE-2006-7151

Untrusted search path vulnerability in the libtool-ltdl library libltdl.so 1.5.22-2.3 in Fedora Core 5 might allow local users to execute arbitrary code via a malicious library in the 1 hwcap, 2 0, and 3 nosegneg subdirectories...

CVE-2006-7143

The CVE-2006-7143 entry describes a Cross-site Scripting (XSS) vulnerability in Call Center Software versions 0.93 and earlier, exploitable via the problem description field to inject arbitrary script/HTML. The provided sources confirm the affected software and the vulnerability class but do not ...

CVE-2006-7160

Summary: CVE-2006-7160 affects the Sandbox.sys driver in Outpost Firewall PRO 4.0 (and possibly earlier versions). It does not validate arguments to hooked SSDT functions, allowing a local attacker to cause a denial of service (crash) by passing invalid arguments to a set of SSDT handlers, includ...

CVE-2006-7140

The libike library, as used by in.iked, elfsign, and kcfd in Sun Solaris 9 and 10, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS 1 v1.5 signature that is signed by that RSA key and prevents libike from correct...

CVE-2006-7145

CVE-2006-7145 concerns Call Center Software (0.93 and earlier). The vulnerability allows remote attackers to disclose sensitive data (e.g., account passwords) by sending a modified user_id parameter in edit_user.php, leading to partial confidentiality impact and partial integrity impact. The NVD ...

CVE-2006-7139

Affected software: Kmail 1.9.1 on KDE 3.5.2. Vulnerability: when “Prefer HTML to Plain Text” is enabled, certain HTML e-mails containing specific table and frameset tags can trigger a segmentation fault, allowing remote attackers to cause a denial of service (crash). Root cause: not explicitly de...

CVE-2006-7149

CVE-2006-7149 describes multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.x, allowing remote attackers to inject arbitrary script or HTML. The issues arise from reflected input in the query string of index.php and from the mcname parameter sent to moscomment.php and com_comment.php...

CVE-2006-7157

CVE-2006-7157 affects Google Earth v4.0.2091 (beta). The vulnerability is a buffer/heap overflow in the KML/KMZ processing (href in KML/KMZ files) that can cause a crash and, per OpenVAS/Nessus entries, potentially allow arbitrary code execution. Exploitation target is the Google Earth KML engine...

CVE-2006-7153

CVE-2006-7153 is a PHP remote file inclusion vulnerability in MiniBB Forum 2 (index.php) that allows an attacker to execute arbitrary code by supplying a URL in the pathToFiles parameter. The issue enables remote code execution with network access, with CVSS v2 base score 10.0 (HIGH) and impact o...

CVE-2006-7144

CVE-2006-7144 affects Call Center Software version 0.93 and earlier. The vulnerability is an SQL injection in the login page where the username is used in the authentication query, enabling remote attackers to execute arbitrary SQL commands and bypass authentication. Root cause appears to be impr...

CVE-2006-7156

PHP remote file inclusion vulnerability in addonkeywords.php in Keyword Replacer keywordreplacer 1.0 and earlier, a module for miniBB, allows remote attackers to execute arbitrary PHP code via a URL in the pathToFiles parameter...

CVE-2006-7155

CVE-2006-7155 affects Novell BorderManager 3.8 SP4, where ISAKMP cookies generated for the same source IP and port within the same day allow remote attackers to cause a denial of service and enable replay attacks. The issue is noted as possibly related to CVE-2006-5286. Connected sources confirm ...

CVE-2006-7152

CVE-2006-7152 affects ASP-Nuke Community

CVE-2006-7151

CVE-2006-7151 describes an untrusted search path vulnerability in the libtool-ltdl library (libltdl.so) version 1.5.22-2.3 used in Fedora Core 5. It could allow local users to run arbitrary code by placing a malicious library in the (1) hwcap, (2) 0, or (3) nosegneg subdirectories. The connected ...

CVE-2006-7146

CVE-2006-7146 concerns Leicestershire communityPortals 1.0 (build 20051018 and earlier) with a PHP remote file inclusion in bug.php that allows arbitrary PHP code execution via a URL supplied to the cp_root_path parameter. The vulnerability is described as a different vector from CVE-2006-5280. N...