CVE-2006-6373

CVE-2006-6373 affects PhpMyAdmin 2.7.0-pl2. The vulnerability allows remote attackers to obtain sensitive information by requesting libraries/common.lib.php, which causes an error message that reveals the installation path. The available sources describe the issue as an information disclosure via...

CVE-2006-6376

The CVE-2006-6376 entry refers to multiple directory traversal vulnerabilities in Simple File Manager (SFM) 0.24a, specifically in the fm.php component. The underlying issue allows an attacker to manipulate .. directory traversals to (1) read arbitrary files via the filename parameter in a downlo...

CVE-2006-6369

CVE-2006-6369 is an SQL injection in the Invision Community Blog Mod 1.2.4. The flaw is in the file lib/entry_reply_entry.php and is exploitable via the eid parameter when the message is previewed, allowing remote attackers to execute arbitrary SQL commands. The connected documents provide the af...

CVE-2006-6371

The CVE-2006-6371 entry documents a Cross-site scripting (XSS) vulnerability in JAB Guest Book’s pbguestbook.php, exploitable via the author parameter. Affected component: pbguestbook.php in the JAB Guest Book. Root cause: lack of proper input sanitization on the author field leading to script/HT...

CVE-2006-6374

The CVE-2006-6374 vulnerability affects PhpMyAdmin 2.7.0-pl2, with multiple CRLF injection flaws enabling HTTP header injection and response splitting via CRLF sequences in a PhpMyAdmin cookie. Affected components include css/phpmyadmin.css.php, db_create.php, index.php, left.php, libraries/sessi...

CVE-2006-6370

SQL injection vulnerability in forum/modules/gallery/post.php in Invision Gallery 2.0.7 allows remote attackers to cause a denial of service and possibly have other impacts, as demonstrated using a "SELECT BENCHMARK" statement in the img parameter in a doaddcomment operation in index.php...

CVE-2006-6377

Uploadscript 1.2 and earlier stores sensitive data under the web root with insufficient access control, which allows remote attackers to obtain the admin password hash via a direct request for /password.txt...

CVE-2006-6368

PHP remote file inclusion vulnerability in login.php.inc in awrate 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the toroot parameter to search.php...

CVE-2006-6363

Cross-site scripting XSS vulnerability in admin.pl in BlueSocket Secure Controller BSC before 5.2, or without 5.1.1-BluePatch, allows remote attackers to inject arbitrary web script or HTML via the adname parameter...

CVE-2006-6368

CVE-2006-6368 is a PHP remote file inclusion vulnerability affecting awrate 1.0. The initial description states that an attacker can trigger arbitrary PHP code execution by supplying a URL in the toroot parameter to login.php.inc/search.php. The connected documents also describe similar remote fi...

CVE-2006-6363

CVE-2006-6363 describes a Cross-site scripting (XSS) vulnerability in admin.pl of BlueSocket Secure Controller (BSC) prior to version 5.2, or without the 5.1.1-BluePatch. An attacker can inject arbitrary web script or HTML via the ad_name parameter. The CVSS data indicates a network-accessible, l...

CVE-2006-6358

This CVE affects the Online-Bookmarks project (version 0.6.12) and relates to the login function in auth.inc, where an SQL injection vulnerability allows remote attackers to execute arbitrary SQL commands via the (1) username and possibly (2) password parameters. The underlying cause is insuffici...

CVE-2006-6360

The CVE-2006-6360 vulnerability affects PHP Upload Center 2.0: activate.php accepts a footerpage parameter that can be controlled by an attacker to include a remote PHP file, enabling arbitrary code execution. It is a networked issue with low access complexity and no authentication, leading to po...

CVE-2006-6365

CVE-2006-6365 describes a SQL injection in DUware DUpayPal 3.1 (and possibly earlier) via the iType parameter in detail.asp, allowing remote execution of arbitrary SQL commands. Related parameters iState and iPro are covered by CVE-2005-3976 and CVE-2005-2047. The connected EUVD/NVD records corro...

CVE-2006-6362

...

CVE-2006-6364

Cross-site scripting XSS vulnerability in error.php in Inside Systems Mail ISMail 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter...

CVE-2006-6366

Cerberus Helpdesk is affected by a Cross-site scripting (XSS) vulnerability in includes/elements/spellcheck/spellwin.php. The js parameter can be exploited to inject arbitrary script/HTML in versions 0.97.3, 2.0–2.7, 3.2.1, and 3.3. This is a remote issue described in the CVE entry; exploitation ...

CVE-2006-6368

PHP remote file inclusion vulnerability in login.php.inc in awrate 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the toroot parameter to search.php...

CVE-2006-6358

SQL injection vulnerability in the login function in auth.inc in Stefan Frech online-bookmarks 0.6.12 allows remote attackers to execute arbitrary SQL commands via the 1 username and possibly the 2 password parameter. NOTE: some of these details are obtained from third party information...

CVE-2006-6361

The CVE-2006-6361 issue affects Bitflux Upload Progress Meter (before build 8276). A heap-based buffer overflow occurs in uploadprogress_php_rfc1867_file (uploadprogress.c) when processing crafted HTTP POST fileupload requests, enabling remote attackers to crash the service or potentially execute...