CVE-2006-6694

CVE-2006-6694 concerns a directory traversal vulnerability in include/config.php of E-Uploader Pro versions up to 1.0. The root cause is improper handling of the language parameter, allowing traversal via .. and enabling an attacker to upload a PHP payload inside a .JPG file and then access the f...

CVE-2006-6693

CVE-2006-6693 involves multiple buffer overflows in Zabbix prior to 20061006, enabling an attacker to cause a denial of service (application crash) and potentially execute arbitrary code by supplying long strings to the zabbix_log and zabbix_syslog functions. The vulnerability affects the Zabbix ...

CVE-2006-6688

Web Automated Perl Portal (WebAPP) versions 0.9.9.4 and 0.9.9.3.4 Network Edition (WebAPP.NET) are identified as vulnerable to bypassing filtering mechanisms by remote attackers via unknown vectors. The CVSS data indicates NETWORK attack vector, low complexity, no authentication required, with pa...

CVE-2006-6685

Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd 2.3.3 allows local users to cause a denial of service application crash and possibly execute arbitrary code via a long REMOTEADDR environment variable. NOTE: The provenance of this information is unknown; the details are obtained solely...

CVE-2006-6679

The issue affects chetcpasswd prior to version 2.4, where ACL checks rely on the X-Forwarded-For header. This header spoofing allows remote attackers to gain unauthorized access. Root cause: authentication/authorization logic trusts X-Forwarded-For for client status in IP ACLs. Documented impact:...

CVE-2006-6683

Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that processes /etc/shadow and does not follow the PAM configuration, which might allow remote attackers to bypass intended restrictions implemented through PAM...

CVE-2006-6683

CVE-2006-6683 affects the chetcpasswd utility (versions 2.4.1 and earlier). A custom component processes /etc/shadow and does not follow the PAM configuration, potentially allowing remote attackers to bypass PAM-enforced restrictions. The sources indicate this vulnerability but do not specify an ...

CVE-2002-2221

The CVE-2002-2221 entry describes an untrusted search path vulnerability in chetcpasswd (Pedro Lineu Orso) versions 2.4.1 and earlier. The underlying issue is a modified PATH that can reference a malicious cp binary, enabling local users to gain privileges. Documented impact is local privilege es...

CVE-2006-6685

CVE-2006-6685 describes a heap-based buffer overflow in chetcpasswd 2.3.3 by Pedro Lineu Orso, exploited via a long REMOTE_ADDR environment variable. The vulnerability allows local users to cause an application crash (DoS) and may allow arbitrary code execution. The provided documents do not spec...

CVE-2006-6681

CVE-2006-6681: Pedro Lineu Orso chetcpasswd 2.3.3 is vulnerable because it does not implement a rate limit on client requests, potentially allowing remote attackers to perform dictionary attacks to guess passwords. The cited sources (NVD/NVD page) confirm the issue and its impact as a partial con...

CVE-2006-6684

The CVE-2006-6684 entry relates to a heap-based buffer overflow in Pedro Lineu Orso chetcpasswd prior to version 2.4. The vulnerability can be triggered by a long X-Forwarded-For HTTP header, allowing remote attackers to cause an application crash and, per the description, possibly execute arbitr...

CVE-2006-6104

CVE-2006-6104 affects the Mono platform’s XSP/ASP.NET server. The System.Web class does not properly verify local pathnames, allowing remote attackers to read sensitive content: source code by appending a space to a URI, and Web.Config via a Web.Config%20 request. The vulnerability lies in Mono 1...

CVE-2006-6682

CVE-2006-6682 affects chetpasswd 2.3.3. The vulnerability arises from a discrepancy in error messages when authenticating with a valid username versus an invalid one, enabling remote attackers to enumerate valid usernames on the target system. The provided documents confirm the issue and its impa...

CVE-2006-6680

CVE-2006-6680 affects chetcpasswd before 2.3.1. The issue arises from not documenting the need for 0400 permissions on /etc/chetcpasswd.allow, potentially permitting local users to read the file and obtain sensitive information. Evidence across sources (NVD/Red Hat entries) confirms the file path...

[SECURITY] [DSA-1240-1] New links2 packages fix arbitrary shell command execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1240-1 [email protected] http://www.debian.org/security/ Steve Kemp December 21, 2006 - ------------------------------------------------------------------------ Package : links2 Vulnerability :...

CVE-2006-6677

ESET NOD32 Antivirus before 1.1743 allows remote attackers to cause a denial of service crash via a crafted .CHM file that triggers a divide-by-zero error...

CVE-2006-6673

WinFtp Server 2.0.2 allows remote attackers to cause a denial of service crash via long 1 PASV, 2 LIST, 3 USER, 4 PORT, and possibly other commands...

DEBIAN-CVE-2006-6678

The edittextarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename...

CVE-2006-6673

CVE-2006-6673 affects WinFtp Server 2.0.2. A remote attacker can trigger a crash (DoS) by sending abnormally long commands for (1) PASV, (2) LIST, (3) USER, (4) PORT, and possibly other commands. The entry notes a network-based vulnerability with no authentication required and an impact limited t...

CVE-2006-6672

CVE-2006-6672 describes multiple SQL injection vulnerabilities in the Burak Yylmaz Download Portal. The affected components are the application pages HABERLER.ASP and ASPKAT.ASP, with exploitable parameters (1) kid and (2) id. The impact stated is remote attackers can execute arbitrary SQL comman...