CVE-2006-6586

Vulnerability: CVE-2006-6586 affects Vortex Blog (vBlog, aka C12) - a0.1_nonfunc. Root cause: multiple PHP remote file inclusion via the cfgProgDir parameter in admin/auth/secure.php and admin/auth/checklogin.php. Impact: allows remote attackers to execute arbitrary PHP code on affected systems (...

CVE-2006-6589

The CVE-2006-6589 entry tracks a cross-site scripting (XSS) vulnerability affecting the ecommerce/control/keywordsearch path in Apache OFBiz and Opentaps 0.9.3, enabling remote injection of script/HTML via the SEARCH_STRING parameter. Connected OpenVAS data confirms HTML injection issues for Open...

CVE-2006-6575

The vulnerability CVE-2006-6575 affects the Yet Another PHP LDAP Admin Project (yaplap) versions 0.6 and 0.6.1, where a PHP remote file inclusion is possible via the LOGIN_style parameter, enabling remote code execution. The root cause is an unsafe handling of user-supplied URL input in that para...

CVE-2006-6581

The provided documents describe CVE-2006-6581 as a PHP remote file inclusion vulnerability in Vernet Loic PHP_Debug 1.1.0, specifically in tests/debug_test.php where the debugClassLocation parameter can be a URL to execute arbitrary PHP code. Affected software is PHP_Debug 1.1.0; the vulnerable c...

CVE-2006-6583

Technical details for CVE-2006-6583 are not provided in the connected documents; monitor for updates.

CVE-2006-6578

CVE-2006-6578 affects Microsoft Internet Information Services (IIS) 5.1, where the IUSR_Machine account can execute non-EXE files (e.g., .COM) in a web directory with certain permissions. This allows attackers to pass arguments to any .COM file that runs those arguments, enabling arbitrary comman...

CVE-2006-6590

CVE-2006-6590: PHP remote file inclusion in AR Memberscript, specifically in usercp_menu.php, allows an attacker to supply a URL via the script_folder parameter to execute arbitrary PHP code. The NVD entry lists a CVSS v2 base score of 7.5 (HIGH) with network vector and low attack complexity, no ...

CVE-2006-6592

Vulnerability summary: CVE-2006-6592 affects Bloq 0.5.4 and involves multiple PHP remote file inclusion flaws. The issue arises when a user-supplied URL in the parameter page[path] is used by (1) index.php, (2) admin.php, (3) rss.php, (4) rdf.php, (5) rss2.php, or (6) files/mainfile.php, allowing...

CVE-2006-6587

Cross-site scripting XSS vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project OFBiz allows remote attackers to inject arbitrary web script or HTML by posting a message...

CVE-2006-6594

SQL injection vulnerability in utilities/usermessages.asp of ScriptMate User Manager 2.0 allows remote attackers to execute arbitrary SQL commands via the mesid parameter. Affected: ScriptMate User Manager 2.0; root cause: improper input handling in mesid. Impact and exploitation details are prov...

CVE-2006-6563

Stack-based buffer overflow in the prctrlsrecvrequest function in ctrls.c in the modctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value...

CVE-2006-6563

Stack-based buffer overflow in the prctrlsrecvrequest function in ctrls.c in the modctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value...

CVE-2006-6566

PHP remote file inclusion vulnerability in includes/profilcpconstants.php in the Profile Control Panel CPanel module for mxBB 0.91c allows remote attackers to execute arbitrary PHP code via a URL in the modulerootpath parameter...

CVE-2006-6567

CVE-2006-6567 concerns a PHP remote file inclusion in the Knowledge Base (mx_kb) 2.0.2 module for mxBB. The issue arises in the file includes/kb_constants.php where the parameter module_root_path can be supplied via a URL, enabling an attacker to cause the application to include and execute arbit...

CVE-2006-6563

ProFTPD is affected by a local, stack-based buffer overflow in the mod_ctrls component. The vulnerability resides in the pr_ctrls_recv_request function (ctrls.c) of ProFTPD before 1.3.1rc1, where handling of a large reqarglen length value can allow a local attacker to execute arbitrary code. Affe...

CVE-2006-6565

FileZilla Server is affected by CVE-2006-6565: prior to version 0.9.22, remote attackers can cause a denial-of-service (crash) by sending a wildcard argument to LIST or NLST commands, leading to a NULL pointer dereference. The issue is related to malformed PORT handling in some vectors; an upgrad...

CVE-2006-6570

CVE-2006-6570 describes an unrestricted file upload in upload.php of GenesisTrader 1.0. The vulnerability allows remote authenticated users to upload arbitrary files through unspecified vectors, possibly involving form.php and the ajoutfich “foap” action. The available sources indicate a high-sev...

CVE-2006-6568

CVE-2006-6568 describes a directory traversal vulnerability in the Knowledge Base (mx_kb) 2.0.2 module for mxBB, where an attacker can include arbitrary files through a .. sequence in the phpEx parameter of includes/kb_constants.php. Affected software: mxBB MX_KB 2.0.2 module. Root cause: imprope...

CVE-2006-6564

Affected software: FileZilla Server prior to 0.9.22. Vulnerabilities: (1) CVE-2006-6564 allows remote DoS (crash) via a malformed argument to the STOR command, causing a NULL pointer dereference (possible relation to a malformed PORT command). (2) CVE-2006-6565 likewise enables DoS via a wildcard...

CVE-2006-6573

The vulnerability CVE-2006-6573 affects Citrix Access Gateway: 4.5 Advanced Edition and 4.2 with Advanced Access Control 4.2 on Access Gateway appliances 4.2–4.2.2. A remote, authenticated user can gain access to data via unspecified vectors, causing information disclosure. Citrix notes updates a...