CVE-2006-7148

Technical details for CVE-2006-7148 are not publicly available in the provided documents. Monitor for updates.

CVE-2006-7159

CVE-2006-7159 affects BTI-Tracker 1.3.2 (btitracker). A directory traversal in include/prune_torrents.php via the TORRENTSDIR parameter in a prune action allows remote attackers to delete arbitrary files. This is a file-system traversal vulnerability (no authentication required per the descriptio...

CVE-2006-7150

CVE-2006-7150 affects Mambo 4.6.x with multiple SQL injection vulnerabilities. The issues allow remote attackers to inject arbitrary SQL via the mcname parameter to moscomment.php and com_comment.php, enabling potentially unauthorized data access or modification. The vulnerability is documented w...

CVE-2006-7147

CVE-2006-7147 affects the phpBB Import Tools Mod 0.1.4 and earlier. The vulnerability is a PHP remote file inclusion via the phpbb_root_path parameter, allowing remote attackers to execute arbitrary PHP code. The root cause is insufficient sanitization of the phpbb_root_path input, enabling inclu...

CVE-2006-7151

CVE-2006-7151 describes an untrusted search path vulnerability in the libtool-ltdl library (libltdl.so) version 1.5.22-2.3 used in Fedora Core 5. It could allow local users to run arbitrary code by placing a malicious library in the (1) hwcap, (2) 0, or (3) nosegneg subdirectories. The connected ...

CVE-2006-7158

Oracle Application Express (APEX/HTMLDB) prior to version 2.2.1 is affected by a cross-site scripting (XSS) vulnerability in the NOTIFICATION_MSG parameter in the APEX UI. The issue allows remote attackers to inject arbitrary web script or HTML. The root cause is insufficient input handling for t...

Stack overflow

Stack-based buffer overflow in the IMAP service in MailEnable Enterprise and Professional Editions 2.37 and earlier allows remote authenticated users to execute arbitrary code via a long argument to the APPEND command. NOTE: this is probably different than CVE-2006-6423...

CVE-2006-7136

CVE-2006-7136 : Multiple PHP remote file inclusion vulnerabilities in PHP Poll Creator (phpPC) 1.04 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the relativer_pfad parameter to (poll.php, poll_kommentar.php, poll_sm.php). Affected component is the phpPC poll suite...

CVE-2006-7135

CVE-2006-7135: Affects PHP Poll Creator (phpPC) 1.04; vulnerable component is lib/functions.inc.php. Remote PHP code execution possible via a URL in the relativer_pfad parameter. No explicit remediation or patch details are provided in the supplied documents. The connected sources do not reveal a...

CVE-2006-7120

PHP remote file inclusion vulnerability in lib/php/phphtmllib-2.5.4/examples/example6.php for maintain 3.0.0-RC2 allows remote attackers to execute arbitrary PHP code via a URL in the phphtmllib parameter. NOTE: this issue might be in phpHtmlLib. NOTE: CVE disputes this issue for proper...

CVE-2006-7133

Directory traversal vulnerability in upload/bin/download.php in Upload Tool for PHP 1.0 allows remote attackers to read arbitrary files via 1 ".." sequences or 2 absolute pathnames in the filename parameter...

CVE-2006-7119

PHP remote file inclusion vulnerability in kernel/system/startup.php in J. He PHPGiggle 12.08 and earlier, as distributed on comscripts.com, allows remote attackers to execute arbitrary PHP code via a URL in the CFGPHPGIGGLEROOT parameter...

CVE-2006-7118

The CVE-2006-7118 issue affects DMXReady Site Engine Manager 1.0, where index.asp is vulnerable to SQL injection via the mid parameter. The underlying cause is improper input handling allowing arbitrary SQL execution by remote attackers. The provided documents do not specify affected versions bey...

CVE-2006-7123

CVE-2006-7123 concerns BSQ Sitestats (a Joomla component) version 1.8.0 and possibly earlier than 2.2.1. The vulnerability is described as multiple SQL injection flaws that allow remote attackers to execute arbitrary SQL commands through (1) parameters during the import of ip-to-country.csv and (...

CVE-2006-7129

ISS BlackICE PC Protection 3.6 cpj and cpu, and possibly earlier versions, allows local users to bypass the protection scheme by using the ZwDeleteFile API function to delete the critical filelock.txt file, which stores information about protected files...

CVE-2006-7117

CVE-2006-7117 affects Kubix 0.7 and earlier. The vulnerabilities are directory traversal flaws where an attacker can cause local file inclusion via ".." sequences in the theme cookie passed to index.php (handled by includes/head.php) and arbitrary file read via ".." in the file parameter of add_d...

CVE-2006-7129

CVE-2006-7129 concerns ISS BlackICE PC Protection 3.6 cpj and possibly earlier versions. The issue allows local users to bypass the protection scheme by calling ZwDeleteFile to delete the critical filelock.txt, which stores information about protected files. The root cause is tampering with the f...

CVE-2006-7115

The CVE-2006-7115 entry documents a SQL injection in PHPKit 1.6.1 RC2. The vulnerability is triggered via the catid parameter passed to include.php when the path parameter is set to faq/faq.php, with additional unspecified vectors involving guestbook/print.php. Affected software is PHPKit 1.6.1 R...

CVE-2006-7128

CVE-2006-7128 describes a PHP remote file inclusion in JAF CMS 4.0 RC1, exploitable via the URL in the website parameter of forum.php, allowing remote code execution. The NVD CVSSv2 base score is 7.5 (HIGH) with network access, low complexity, no authentication, and partial impact on confidential...

CVE-2006-7133

CVE-2006-7133 describes a directory traversal vulnerability in Upload Tool for PHP 1.0, specifically in upload/bin/download.php. Remote attackers can read arbitrary files by manipulating the filename parameter with “..” sequences or absolute pathnames. The vulnerability affects Upload Tool for PH...