CVE-2006-6603

CVE-2006-6603 is a buffer overflow in Yahoo! Messenger’s YMMAPI.YMailAttach ActiveX control (ymmapi.dll). A crafted HTML document could trigger code execution with the user’s privileges. The vulnerability affects Yahoo! Messenger prior to version 2005.1.1.4; Yahoo’s security update fixes versions...

CVE-2006-6585

The Extensions manager in Mozilla Firefox 2.0 does not properly populate the list of local extensions, which allows attackers to construct an extension that hides itself by finding its name in the list and then calling RemoveElement, as demonstrated by the FFsniFF extension. NOTE: it was later...

CVE-2006-6586

Multiple PHP remote file inclusion vulnerabilities in Vortex Blog vBlog, aka C12 a0.1nonfunc allow remote attackers to execute arbitrary PHP code via a URL in the cfgProgDir parameter in 1 secure.php or 2 checklogin.php in admin/auth/...

CVE-2006-6587

Cross-site scripting XSS vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project OFBiz allows remote attackers to inject arbitrary web script or HTML by posting a message...

CVE-2006-6588

The forum implementation in the ecommerce component in the Apache Open For Business Project OFBiz trusts the 1 dataResourceTypeId, 2 contentTypeId, and certain other hidden form fields, which allows remote attackers to create unauthorized types of content, modify content, or have other unknown...

CVE-2006-6579

Microsoft Windows XP has weak permissions FILEWRITEDATA and FILEREADDATA for Everyone for %WINDIR%\pchealth\ERRORREP\QHEADLES, which allows local users to write and read files in this folder, as demonstrated by an ASP shell that has write access by IWAMmachine and read access by IUSRMachine...

CVE-2006-6589

Cross-site scripting XSS vulnerability in ecommerce/control/keywordsearch in the Apache Open For Business Project OFBiz and Opentaps 0.9.3 allows remote attackers to inject arbitrary web script or HTML via the SEARCHSTRING parameter, a different issue than CVE-2006-6587. NOTE: some of these detai...

CVE-2006-6591

PHP remote file inclusion vulnerability in fonctions/template.php in EXlor 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the repphp parameter...

CVE-2006-6576

Golden FTP Server (goldenftpd) is affected by a heap/buffer overflow in the authentication PASS handling, allowing a remote attacker to crash the app and potentially execute code. Affected versions include 1.92 and 4.70; USER vector is noted as covered by CVE-2005-0634. The issue is triggered by ...

CVE-2006-6585

CVE-2006-6585 affects Mozilla Firefox 2.0, with the Extensions Manager not correctly populating the local extensions list. This enables an attacker to craft an extension that hides itself by locating its name in the list and invoking RemoveElement, as demonstrated by the FFsniFF extension; later ...

CVE-2006-6582

CVE-2006-6582 concerns ScriptMate User Manager 2.1 and earlier. The vulnerability set is multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary script or HTML via the login action fields (members_username, members_password) in members/default.asp and via the Sea...

CVE-2006-6574

CVE-2006-6574 affects MantisBT. The vulnerability is that Mantis before 1.1.0a2 does not implement per-item access control for Issue History (Bug History), allowing remote attackers to obtain sensitive information by reading the Change column (e.g., in a custom field). This is the exact issue des...

CVE-2006-6593

CVE-2006-6593: PHP remote file inclusion in zufallscodepart.php of AMAZONIA MOD for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. Documented impact is partial confidentiality/integrity/availability. Connected sources confirm the RFI root c...

CVE-2006-6577

CVE-2006-6577 affects Neocrome Land Down Under (LDU) 8.x and earlier, where polls.php is vulnerable to SQL injection via the id parameter. The remote attacker can cause arbitrary SQL execution, with partial impact on confidentiality, integrity, and availability (CVSS 2.0 base score 6.8). Connecte...

CVE-2006-6587

CVE-2006-6587 is a Cross‑Site Scripting (XSS) flaw in the Apache OFBiz Open For Business (OFBiz) ecommerce forum component. The vulnerability allows remote attackers to inject arbitrary script or HTML by posting a message, targeting the forum implementation. The connected OpenVAS entry notes OFBi...

CVE-2006-6588

CVE-2006-6588 affects the Apache OFBiz OFBiz forum component, where the forum implementation trusts certain hidden form fields (dataResourceTypeId and contentTypeId) to process content. This trust allows remote attackers to create unauthorized content types, modify content, or cause other unknown...

CVE-2006-6591

CVE-2006-6591 is a PHP remote file inclusion vulnerability in EXlor 1.0 affecting fonctions/template.php, where an attacker can trigger remote PHP code execution via a URL in the repphp parameter. Affected software: EXlor 1.0 (template.php in the functions/templates path). The NVD entry lists a C...

CVE-2006-6595

Multiple SQL injection vulnerabilities in ScriptMate User Manager 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via "Manage Resources" and possibly other unspecified components...

CVE-2006-6584

Italk+ users are affected by a vulnerability in versions before 0.92.1, where multiple buffer overflows could be exploited remotely to crash the application and potentially allow arbitrary code execution. The issue is documented in CVE-2006-6584 (NVD, CVE list). The concrete affected component is...

CVE-2006-6580

The connected sources confirm a vulnerability in ProNews 1.5 where admin/change.php does not verify that a user is authorized to modify news items. This permits remote attackers to add or delete information within an item and potentially cause other impacts. Root cause: missing access control che...