CVE-2006-6362

CVE-2006-6362 is rejected/not used; refer to CVE-2006-5873 for the active entry.

CVE-2006-6359

Cross-site scripting XSS vulnerability in Stefan Frech online-bookmarks 0.6.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2006-6359

CVE-2006-6359 is an XSS vulnerability in Stefan Frech’s online-bookmarks 0.6.12 that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Public sources (NVD) assign a Medium severity (CVSS v2: AV:N/AC:M/Au:N/C:P/I:P/A:P, base 6.8). Gentoo GLSA 200901-08 lists t...

gnupg security update

CentOS Errata and Security Advisory CESA-2006:0754-01 Updated GnuPG packages that fix two security issues are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. GnuPG is a utility for encrypting data and creating digital signatures...

CVE-2006-6339

SQL injection vulnerability in sites/index.php in deV!Lz Clanportal DZCP before 1.3.6.1 allows remote attackers to execute arbitrary SQL commands via the show element in a GET request...

CVE-2006-6351

KhaledMuratList stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for 1 CL2F9R1A2C1N.mdb or 2 Data2F9R1A2C1N.mdb...

CVE-2006-6340

CVE-2006-6340 concerns keystone.exe in NVIDIA nView. The vulnerability is a denial of service triggered by a long command line argument, with a note that it is not clear whether the issue crosses security boundaries. Connected documents corroborate the same description but do not provide specific...

CVE-2006-6339

The CVE-2006-6339 entry describes an SQL injection in deV!L`z Clanportal (DZCP) prior to version 1.3.6.1, exploitable via the show parameter in a GET request. This allows remote attackers to execute arbitrary SQL commands. Affected software/function: sites/index.php in DZCP. Root cause: insuffici...

CVE-2006-6349

CVE-2006-6349 covers multiple SQL injection vulnerabilities in PWP Technologies The Classified Ad System. An attacker can remotely execute arbitrary SQL via (1) the main parameter in a view action (includes/mainpage/view.asp) in default.asp or (2) a query in the search engine. The NVD entry cites...

CVE-2006-6354

CVE-2006-6354 and related CVEs describe multiple SQL injection vulnerabilities in DuWare DUNews (and DUNews-family) detail.asp, allowing remote attackers to inject SQL via the (1) iNews, (2) iType, or (3) Action parameters. The iType parameter in type.asp is already covered by CVE-2005-3976. The ...

CVE-2006-6347

Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php. NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector...

CVE-2006-6350

Listpics 5 stores sensitive data under the web root due to insufficient access control, enabling remote attackers to download listpics.mdb via a direct request. Affected product: Listpics 5. Root cause: web-accessible database file (listpics.mdb) exposed without proper permissions. Impact: comple...

CVE-2006-6337

The CVE-2006-6337 entry covers SQL injection in giris.asp of the Aspee and Dogantepe Ziyaretci Defteri guestbook project. The vulnerability allows remote attackers to inject arbitrary SQL via the (1) kullanici or (2) parola parameters, enabling potentially partial data exposure or modification ac...

CVE-2006-6341

CVE-2006-6341 involves multiple PHP remote file inclusion vulnerabilities in mg.applanix 1.3.1 and earlier. The flaw allows an attacker to cause arbitrary PHP code execution by supplying a URL in the apx_root_path parameter to one of three scripts (act/act_check_access.php, dsp/dsp_form_booking_c...

CVE-2006-6347

CVE-2006-6347 concerns TFT Gallery 0.10. It allows an unrestricted file upload by remote authenticated administrators (to upload arbitrary .php files, potentially via admin/index.php). The vulnerability can be combined with CVE-2006-1412 to yield a remote unauthenticated vector. Base metrics indi...

CVE-2006-6352

FRISK Software F-Prot Antivirus before 4.6.7 allows user-assisted remote attackers to cause a denial of service infinite loop via a crafted ACE file. NOTE: this issue has at least a partial overlap with CVE-2006-6294...

CVE-2006-6356

The CVE-2006-6356 entry covers multiple XSS vulnerabilities in PHPNews 1.3.0, specifically in templates/link_temp.php. The issue allows remote attackers to inject arbitrary web script or HTML by supplying one of several parameters (url, id, subject, username, time). The root cause is input handli...

CVE-2006-6338

CVE-2006-6338 : Unrestricted file upload in the PHP script upload/index.php of the DZCP (deV!L`z Clanportal) prior to 1.3.6.1. An attacker can embed PHP code in a JPEG/GIF uploaded to inc/images/uploads/userpics/ and trigger remote code execution. The connected sources confirm the vulnerability p...

CVE-2006-6343

CVE-2006-6343 concerns a SQL injection in the polls.php id parameter of Land Down Under / Seditio (Neocrome Seditio) 1.10 and earlier. The Nessus NASL details show the remote input to polls.php is not sanitized before use in a database query when magic_quotes_gpc is disabled, enabling an unauthen...

CVE-2006-6355

CVE-2006-6355 describes an SQL injection in DUware DUclassmate (default.asp via the iCity parameter; iState is covered by CVE-2005-2049). The issue arises from inadequate input sanitization, allowing remote attackers to execute arbitrary SQL commands. Connected sources corroborate the vulnerabili...