CVE-2006-6702

The connected Nessus entry for Atmail Webmail identifies CVE-2006-6702 as a cross-site scripting (XSS) flaw in Global.pm affecting Atmail Webmail 4.x prior to 4.6.1 (4.61). The vulnerability arises from an input‑validation error in Global.pm that could allow arbitrary web script or HTML to be inj...

CVE-2006-6710

Multiple PHP remote file inclusion vulnerabilities affect PgmReloaded 0.8.5 and earlier. An attacker can cause arbitrary PHP code execution by supplying URLs to (a) lang in index.php, (b) CFG[libdir] and CFG[localedir] in common.inc.php, and (c) CFG[localelangdir] in form_header.php. Root cause i...

CVE-2006-6707

The CVE-2006-6707 flaw is a stack-based buffer overflow in the NeoTraceExplorer.NeoTraceLoader ActiveX control (NeoTraceExplorer.dll) used by NeoTrace Express 3.25 and NeoTrace Pro (McAfee Visual Trace) 3.25. A remote attacker can trigger arbitrary code execution by sending an overly long argumen...

CVE-2006-6714

The CVE-2006-6714 entry describes memory leaks in Hitachi Directory Server 2, versions P-2444-A124 (Windows, before 02-11-/K) and P-1B44-A121 (HP-UX, before 02-10-/V). Remote attackers can cause a denial of service through invalid LDAP requests. The connected documents provide the vulnerability s...

CVE-2006-6713

The provided records confirm a buffer overflow vulnerability (remote code execution) in Hitachi Directory Server 2, versions P-2444-A124 pre-02-11-/K on Windows and P-1B44-A121 pre-02-10-/V on HP-UX, triggered by crafted LDAP requests. Root cause: improper handling of LDAP data leading to overflo...

CVE-2006-6703

CVE-2006-6703 describes multiple XSS vulnerabilities in Oracle Portal 9i and 10g. The issues allow remote attackers to inject arbitrary JavaScript, e.g., via the tc parameter in webapp/jsp/container_tabs.jsp, with other vectors not detailed here. The NVD metrics indicate a Network attack vector, ...

CVE-2006-6700

Technical details about CVE-2006-6700 are not publicly available in the provided documents. The description notes a vague initial disclosure. Monitor for updates from the sources to obtain affected products, impact, and remediation information.

CVE-2006-6698

The CVE-2006-6698 issue affects the GConf daemon (gconfd) in GConf 2.14.0. It creates temporary files in directories named after the user, even when GCONF_GLOBAL_LOCKS is not set. This enables a local attacker to pre-create the directories and cause a denial of service that blocks other users fro...

Immunity Canvas: LOCALLPC

Name| localLPC ---|--- CVE| CVE-2006-6696 Exploit Pack| CANVAS Description| LPC local MS07-021 Notes| CVE Name: CVE-2006-6696 VENDOR: Microsoft MSADV: MS07-021 CVSS: 6.9 CVE Url: https://vulners.com/cve/CVE-2006-6696 Notes: If you get FFFFFFF that means inetinfo died sorry,...

CVE-2006-6697

CVE-2006-6697 describes a CRLF injection in Oracle Portal 10g and earlier (including 9.0.2) via webapp/jsp/calendar.jsp where an attacker can inject arbitrary HTTP headers and trigger HTTP response splitting by manipulating the enc parameter. Related entries note that CVE-2006-6699’s calendar.jsp...

CVE-2006-6696

CVE-2006-6696 is a CSRSS vulnerability in Windows where improper handling of a MessageBox call with MB_SERVICE_NOTIFICATION can send a crafted HardError to CSRSS, enabling remote code execution. Public details indicate the issue affects multiple Windows versions (Windows 2000, XP, Server 2003, Vi...

BrightStor ARCserve Backup Tape Engine GetGroupStatus buffer overflow

Added: 12/22/2006 CVE: CVE-2006-6076 BID: 21221 OSVDB: 30637 Background The BrightStor ARCserve Backup server includes a Backup Tape Engine feature which allows use of tape drives for storage. Problem A buffer overflow vulnerability in the RPC GetGroupStatus function allows remote attackers to...

BrightStor ARCserve Backup Tape Engine GetGroupStatus buffer overflow

Added: 12/22/2006 CVE: CVE-2006-6076 BID: 21221 OSVDB: 30637 Background The BrightStor ARCserve Backup server includes a Backup Tape Engine feature which allows use of tape drives for storage. Problem A buffer overflow vulnerability in the RPC GetGroupStatus function allows remote attackers to...

CVE-2006-6690

rtehtmlarea/pi1/class.txrtehtmlareapi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to...

CVE-2006-6692

Multiple format string vulnerabilities in zabbix before 20061006 allow attackers to cause a denial of service application crash and possibly execute arbitrary code via format string specifiers in information that would be recorded in the system log using 1 zabbixlog or 2 zabbixsyslog...

CVE-2006-6689

CVE-2006-6689 and CVE-2006-6739 pertain to Paristemi 0.8.3 and earlier. CVE-2006-6689 describes multiple PHP remote file inclusion vulnerabilities allowing arbitrary code execution via a URL in the SERVER_DIRECTORY parameter to unspecified scripts (notably different from CVE-2006-6739). CVE-2006-...

CVE-2006-6695

CVE-2006-6695 : XSS in Carsen Klock TextSend 1.5, affected via index.php, vulnerable parameters (1) error and (2) success. This allows remote attackers to inject arbitrary script/HTML. According to NVD, base CVSS v2 score is 6.8 (Medium) with network attack vector, no authentication, and partial ...

CVE-2006-6687

CVE-2006-6687 describes a cross-site scripting (XSS) vulnerability in Web Automated Perl Portal (WebAPP) versions 0.9.9.4 and 0.9.9.3.4 Network Edition (WebAPP.NET). The vulnerability allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The NVD entry notes a net...

CVE-2006-6692

CVE-2006-6692 affects Zabbix before 20061006, where format string vulnerabilities in logging paths (zabbix_log and zabbix_syslog) can trigger a denial of service (application crash) and potentially allow arbitrary code execution. The root cause is improper handling of format string specifiers in ...

CVE-2006-6690

CVE-2006-6690 affects TYPO3 with the rtehtmlarea extension (Typo3 4.0.0–4.0.3, 3.7–3.8, and 4.1 beta). The issue allows remote command execution via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php (reported as a vulnerability enabli...