CVE-2006-6617

projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 allows remote authenticated users to obtain the MSProjectUser password for a SQL database via a GetInitializationData request, which includes the information in the UserName and Password tags of the response...

CVE-2006-6624

CVE-2006-6624 concerns the FTP Server in Sambar Server 6.4. The vulnerability allows remote authenticated users to cause a denial of service (application crash) by sending a long sequence of "./" characters in the FTP SIZE command. The primary affected component is the FTP service within Sambar S...

CVE-2006-6622

Soft4Ever Look 'n' Stop (LnS) 2.05p2 (pre-20061215) is affected. The flaw arises because LnS relies on the Process Environment Block (PEB) to identify a target process, enabling local attackers to spoof PEB fields (ImagePathName, CommandLine, WindowTitle) and bypass the software’s process control...

CVE-2006-6625

The vulnerability is a Cross-site Scripting (XSS) in Moodle 1.6.1 specifically in mod/forum/discuss.php, exploitable by supplying a crafted value for the navtail parameter. Affected product: Moodle 1.6.1; vulnerable component/function: discuss.php in the forum module. Underlying cause is input ha...

CVE-2006-6619

CVE-2006-6619 affects AVG Anti-Virus plus Firewall 7.5.431. The vulnerability arises from the product using the Process Environment Block (PEB) to identify a process, allowing a local attacker to bypass the product’s controls by spoofing the PEB fields: ImagePathName, CommandLine, and WindowTitle...

CVE-2006-6635

CVE-2006-6635 affects JumbaCMS 0.0.1 , where a PHP remote file inclusion in includes/functions.php allows an attacker to execute arbitrary PHP code via a URL parameter jcms_root_path . The vulnerability enables remote code execution/compromise of the affected site as described in the NVD entry. P...

CVE-2006-6628

OpenOffice.org 2.1 is affected by CVE-2006-6628 due to an integer overflow when processing a crafted DOC file, which can lead to a user‑assisted remote denial of service (application crash). The issue is demonstrated by the 12122006-djtest.doc and is described as a variant of CVE-2006-6561 in a s...

CVE-2006-6632

CVE-2006-6632 affects Genepi 1.6 and earlier. A PHP remote file inclusion flaw in genepi.php allows an attacker to execute arbitrary PHP code by supplying a URL in the topdir parameter. The vulnerability’s CVSS v2 base score is 6.8 (Medium) with network access, requiring no authentication and par...

CVE-2006-6610

clientcommands in Nexuiz before 2.2.1 has unknown impact and remote attack vectors related to "remote console command injection."...

CVE-2006-6612

PHP remote file inclusion vulnerability in basic.inc.php in PhpMyCms 0.3 allows remote attackers to execute arbitrary PHP code via a URL in the basepathstart parameter...

CVE-2006-6609

Nexuiz before 2.2.1 allows remote attackers to cause a denial of service resource exhaustion or crash via unspecified vectors related to "fake players." NOTE: some of these details are obtained from third party information...

CVE-2006-6614

The saveloglocal function in Fully Automatic Installation FAI 2.10.1, and possibly 3.1.2, when verbose mode is enabled, stores the root password hash in /var/log/fai/current/fai.log, whose file permissions allow it to be copied to other hosts when fai-savelog is called and allows attackers to...

CVE-2006-6607

The CVE-2006-6607 vulnerability affects WebSphere Application Server (WAS) used with IBM Tivoli Identity Manager (ITIM) 4.6. The JKS password is exposed via a -Djavax.net.ssl.trustStorePassword command line argument, enabling local users to read the password by inspecting the process or similar m...

CVE-2006-6612

CVE-2006-6612 affects PhpMyCms 0.3, with a PHP remote file inclusion in basic.inc.php exploitable via the basepath_start parameter, enabling remote code execution. Public references cite an exploit (exploit-db 2927) and NVD/CVE entries. The connected documents do not provide a vendor-provided fix...

CVE-2006-6615

The CVE-2006-6615 entry concerns the Activity Games (mx_act) 0.92 module for mxBB. The vulnerability is a PHP remote file inclusion in includes/act_constants.php, exploitable via a URL supplied to the module_root_path parameter, enabling remote attackers to execute arbitrary PHP code. Connected r...

CVE-2006-6616

CVE-2006-6616 affects index.php in w00t Gallery 1.4.0. The issue allows remote authenticated users with privileges for one installation to gain access to other installations on the same web server (multi-gallery admin session spanning). The sources provide the vulnerability description but do not...

CVE-2006-6614

The CVE-2006-6614 issue affects Fully Automatic Installation (FAI) 2.10.1 (and possibly 3.1.2). When verbose mode is enabled, the save_log_local function writes the root password hash to /var/log/fai/current/fai.log, and the log file’s permissions permit copying to other hosts when fai-savelog is...

CVE-2006-6612

PHP remote file inclusion vulnerability in basic.inc.php in PhpMyCms 0.3 allows remote attackers to execute arbitrary PHP code via a URL in the basepathstart parameter...

CVE-2006-6609

Nexuiz before 2.2.1 is affected by a remote DoS vulnerability related to “fake players.” Multiple sources (NVD, OSV, Gentoo GLSA, GLSA plugin) describe that remote attackers can exhaust resources or crash the server through unspecified vectors. The Gentoo GLSA-200702-09 and the Gentoo advisory re...

CVE-2006-6613

The CVE-2006-6613 issue affects phpAlbum 0.4.1 Beta 6 and earlier, where language.php can include arbitrary local files due to a directory traversal via pa_lang[include_file] when magic_quotes_gpc is disabled and register_globals is enabled. The root cause is improper handling of the include_file...