CVE-2006-6872

Technical details about CVE-2006-6872 are not publicly available in the provided connected documents; only the basic description and references are present. Monitor for updates.

CVE-2006-6878

CVE-2006-6878 affects admin/uploads.php in PHP-Update 2.7 and earlier. The underlying issue lets remote attackers gain privileges by setting the rights[7] parameter to 1 during a login action. This describes a server-side privilege escalation during authentication, with no further exploit details...

CVE-2006-6879

Unrestricted file upload vulnerability CVE-2006-6879 affects PHP-Update 2.7 and earlier. Authenticated users can upload arbitrary PHP scripts via the userfile parameter to gfx/ and files/ directories through admin/uploads.php. The NVD notes a base AV:N/AC:M/Au:S/C:P/I:P/A:P with a medium base sco...

CVE-2006-6871

CVE-2006-6871 affects eNdonesia 8.4 with four XSS vectors : (1) mod.php viewlink parameter (mod), (2) informasi module showinfo intypeid, (3) the "your Friend" field in friend.php, (4) the "Main Text" field in admin.php. The vulnerability allows remote attackers to inject arbitrary web script or ...

CVE-2006-6876

OpenSER 1.2.0 and earlier contains a buffer overflow in fetchsms (libsms_getsms.c) that can be triggered by a crafted SMS message. The vulnerability causes memory corruption when the beginning buffer is copied to the third (pdu) argument, enabling a remote denial of service (crash). Affected vers...

CVE-2006-6875

CVE-2006-6875 affects OpenSER 1.1.0 and earlier, with a buffer overflow in the validateospheader function of the Open Settlement Protocol (OSP) module that enables remote code execution via a crafted OSP header. No exploitation details are provided in the connected documents. No remediation is st...

CVE-2006-6877

CVE-2006-6877 describes a directory traversal vulnerability in the index.php of Matteo Lucarelli 3editor CMS

CVE-2006-6874

The vulnerability is an XSS flaw in eNdonesia 8.4, specifically in the file/functIon friend.php, exploitable via the (1) Message or (2) Your Name fields. The connected records confirm affected software and version (eNdonesia 8.4) and that remote attackers can inject arbitrary web script or HTML. ...

CVE-2006-6870

The CVE-2006-6870 vulnerability affects Avahi prior to 0.6.16, where the consume_labels function in avahi-core/dns.c can be triggered by a crafted compressed DNS response containing a label that points to itself. This leads to a denial of service via an infinite loop. Evidence across multiple adv...

Novell NetMail NMAP STOR command buffer overflow

Added: 01/05/2007 CVE: CVE-2006-6424 BID: 21725 OSVDB: 31363 Background Novell NetMail servers include the Network Messaging Application Protocol NMAP service, which listens on port 689/TCP. Problem A buffer overflow in Novell NetMail allows remote attackers to execute arbitrary commands by sendi...

Important openoffice.org security update

1.1.5-6 - ensure correct permissions 1.1.5-5 - Resolves: rhbz217347 CVE-2006-5780 WMF heap overflow ooo70042 Known Issue: bz 2005: May get kde error message when exiting ooimpress and oodraw appears to be an existing problem See http://bugzilla.oracle.com for more details...

CVE-2006-6862

CVE-2006-6862 documents multiple cross-site scripting (XSS) vulnerabilities in the Web app Outfront Spooky Login 2.7 . The issue allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to two pages: login/login.asp and login/register.asp . The core vulnerability ...

CVE-2006-6867

CVE-2006-6867 documents multiple PHP remote file inclusion vulnerabilities in Vladimir Menshakov’s buratinable templator (aka bubla) 0.9.1, allowing an attacker to execute arbitrary PHP code via a URL in the bu_dir parameter to bu/bu_claro.php, bu/bu_cache.php, or bu/bu_parse.php. This differs fr...

CVE-2006-6865

The CVE-2006-6865 entry describes a directory traversal in SoftArtisans FileUp (SAFileUp) 5.0.14. An attacker can read arbitrary files by supplying a path parameter containing a Unicode-encoded dot-dot ( %c0%ae ), bypassing the normal ".." sequence checks in SAFileUpSamples/util/viewsrc.asp. The ...

CVE-2006-6861

CVE-2006-6861: Outfront Spooky Login 2.7 contains multiple SQL injection vulnerabilities. Remote attackers can execute arbitrary SQL via (1) UserUpdate in login/register.asp or (2) unspecified parameters in includes/a_register.asp. No remediation details are provided in the connected documents.

CVE-2006-6864

Technical details about CVE-2006-6864 are not publicly available in the provided documents. Monitor for updates in connected sources for affected product/version, impact, and remediation information.

CVE-2006-6860

The CVE-2006-6860 entry describes a buffer overflow in MythControl 1.0 (and earlier) in the sendToMythTV function within MythControlServer.c. A crafted sendStr string sent to the Bluetooth interface can allow remote code execution. The vulnerability affects MythControl’s Bluetooth handling (sendT...

CVE-2006-6869

Directory traversal vulnerability in includes/search/searchmdforum.php in MAXdev MDForum 2.0.1 and earlier, when magicquotesgpc is disabled and registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the PNSVlang cookie to error.php, as...

CVE-2006-6859

Affected software: Website Designs For Less Click N' Print Coupons 2005.01 and earlier. Issue: SQL injection in coupon_detail.asp allowing remote execution of arbitrary SQL via the key parameter. Root cause: Improper input handling leading to SQL command construction. Impact (as stated): remote a...

CVE-2006-6863

CVE-2006-6863 describes a PHP remote file inclusion in the Enigma2.php file of the Enigma WordPress Bridge (Enigma2 plugin). The vulnerability allows remote code execution via a URL parameter in boarddir, but CVE notes indicate boarddir may be fixed, which affects exploitability. Multiple sources...