CVE-2006-6823

PHP remote file inclusion vulnerability in plugins/metasearch/plug.inc.php in Yrch! 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...

CVE-2006-6815

CVE-2006-6815 describes multiple XSS vulnerabilities in DMXReady Secure Login Manager 1.0 . The flaws allow remote authenticated administrators to inject arbitrary web script or HTML through unspecified parameters to the following Local-Admin Panel pages: set_preferences.asp , send_password_prefe...

CVE-2006-6816

CVE-2006-6816 affects DMXReady Secure Login Manager 1.0. The CVE records multiple SQL injection vulnerabilities allowing remote attackers to execute arbitrary SQL commands via unspecified parameters to Local-Admin Panel pages (set_preferences.asp, send_password_preferences.asp, SecureLoginManager...

CVE-2006-6824

Multiple cross-site scripting XSS vulnerabilities in Jim Hu and Chad Little PHP iCalendar 2.23 rc1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 getdate parameter in a day.php, b month.php, c year.php, d week.php, e search.php, f rss/index.php, g print.php, a...

CVE-2006-6819

CVE-2006-6819 concerns AlstraSoft Web Host Directory, where sensitive information is stored under the web root due to insufficient access control. The vulnerability allows remote attackers to download a backup database by issuing a direct request to admin/backup/db. The public records indicate th...

CVE-2006-6822

Vulnerability : In Enthrallweb eClassifieds, myprofile.asp does not properly validate the MM_recordId parameter during profile updates. This allows remote authenticated users to modify certain profile fields of another account by supplying that account’s username in a modified MM_recordId value. ...

CVE-2006-6811

CVE-2006-6811 affects KsIRC 1.3.12. Affected component: KsIRC’s IRC client handling of PRIVMSG strings. Root cause: a too-long PRIVMSG triggers an assertion failure, leading to a NULL pointer dereference and a denial of service when connecting to an IRC server. Public advisories (Gentoo GLSA, Man...

CVE-2006-6814

Directory traversal vulnerability in FolderManager/FolderManager.aspx in Hosting Controller 7c allows remote authenticated users to read and modify arbitrary files, and list arbitrary directories via ..\ dot dot backslash sequences in the BrowsePath parameter...

CVE-2006-6813

CVE-2006-6813 affects Mxmania File Upload Manager (FUM) up to version 1.0.6. The vulnerability is an SQL injection in detail.asp via the ID parameter, allowing remote attackers to execute arbitrary SQL commands. This is documented in NVD records for CVE-2006-6813. The connected documents confirm ...

CVE-2006-6817

The CVE-2006-6817 issue affects AlstraSoft Web Host Directory (also listed as HyperStop WebHost Directory 1.2). Affected component: login/URI handling that, when an invalid URI is requested, exposes the installation path in the error message, enabling a remote attacker to obtain sensitive informa...

CVE-2006-6823

The provided records identify CVE-2006-6823 as a PHP remote file inclusion vulnerability in Yrch! 1.0, specifically in plugins/metasearch/plug.inc.php. The root cause is ARBITRARY PHP code execution via a URL supplied in the path parameter, enabling an attacker to run code on the affected server....

CVE-2006-6824

CVE-2006-6824 concerns multiple reflected XSS vulnerabilities in PHP iCalendar 2.23 rc1 and earlier. The affected software is PHP iCalendar, with the vulnerability exploitable via various parameters across several scripts: getdate (day.php, month.php, year.php, week.php, search.php, rss/index.php...

CVE-2006-6814

CVE-2006-6814 describes a directory traversal vulnerability in FolderManager/FolderManager.aspx (Hosting Controller 7c). The flaw allows remote authenticated users to read and modify arbitrary files and to list arbitrary directories by sending ..\ sequences in the BrowsePath parameter. This resul...

CVE-2006-6809

CVE-2006-6809 covers multiple PHP remote file inclusion vulnerabilities in Vladimir Menshakov buratinable templator (aka bubla) 1.0.0rc2 and earlier. The flaw allows an attacker to trigger arbitrary PHP code execution by supplying a URL in the (1) bu_dir or (2) bu_config[dir] parameter of process...

CVE-2006-6818

CVE-2006-6818 affects AlstraSoft Web Host Directory. The vulnerability allows remote attackers to bypass authentication and change the admin password via a direct request to /admin/config. CVSS v2 base score 7.5 (HIGH) with network attack vector and no authentication required; impact includes par...

CVE-2006-6821

The CVE concerns Enthrallweb eNews: myprofile.asp fails to validate MM_recordId during profile updates, allowing remote authenticated users to change certain fields of another account by supplying that account’s username in MM_recordId. No remediation details are provided in the supplied documents.

CVE-2006-6810

DB Hub 0.3 contains an unspecified vulnerability in the clear_user_list function (src/main.c) that allows remote attackers to cause an application crash via crafted network traffic, due to memory corruption. The available sources do not specify affected subcomponents, versions beyond 0.3, exploit...

CVE-2006-6820

The CVE-2006-6820 issue concerns Enthrallweb eCoupons, where myprofile.asp does not properly validate the MM_recordId parameter during profile updates. This allows remote authenticated users to modify certain profile fields of another account by supplying that account’s username in a modified MM_...

NetMail IMAP APPEND command buffer overflow

Added: 12/29/2006 CVE: CVE-2006-6425 BID: 21723 OSVDB: 31362 Background Novell NetMail is an e-mail and calendaring server application. Problem A buffer overflow in the NetMail IMAP service allows remote, authenticated attackers to execute arbitrary commands by sending a long, specially crafted...

NetMail IMAP APPEND command buffer overflow

Added: 12/29/2006 CVE: CVE-2006-6425 BID: 21723 OSVDB: 31362 Background Novell NetMail is an e-mail and calendaring server application. Problem A buffer overflow in the NetMail IMAP service allows remote, authenticated attackers to execute arbitrary commands by sending a long, specially crafted...