CVE-2006-7207

Buffer overflow in ageet AGEphone before 1.4.0 might allow remote attackers to have an unknown impact via unspecified vectors...

CVE-2006-7164

SimpleFileServlet in IBM WebSphere Application Server 5.0.1 through 5.0.2.7 on Linux and UNIX does not block certain invalid URIs and does not issue a security challenge, which allows remote attackers to read secure files and obtain sensitive information via certain requests...

CVE-2006-7162

PuTTY 0.59 and earlier uses weak file permissions for 1 ppk files containing private keys generated by puttygen and 2 session logs created by putty, which allows local users to gain sensitive information by reading these files...

CVE-2006-7163

DreameeSoft Password Master 1.0 stores the database in an unencrypted format when the master password is set, which allows attackers with physical access to read the database contents via an unspecified authentication bypass. NOTE: the provenance of this information is unknown; the details are...

CVE-2006-7046

PHP remote file inclusion vulnerability in cmpro.intern/login.inc.php for Clan Manager Pro CMPRO 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2006-7008

Unspecified vulnerability in Joomla! before 1.0.10 has unknown impact and attack vectors, related to "securing mosmsg from misuse." NOTE: it is possible that this issue overlaps CVE-2006-1029...

CVE-2006-7003

PHP remote file inclusion vulnerability in admin/index.php in Fusion Polls allows remote attackers to execute arbitrary PHP code via a URL in the xtrphome parameter...

CVE-2006-7001

Directory traversal vulnerability in avatar.php in PhpMyChat Plus 1.9 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the L parameter, a different issue than CVE-2006-5897. NOTE: the provenance of this information is unknown; the details are obtained solely from...

CVE-2006-6975

PHP remote file inclusion vulnerability in centipaidclass.php in CentiPaid 1.4.3 allows remote attackers to execute arbitrary code via a URL in the classpwd parameter. NOTE: this issue has been disputed by CVE and multiple third parties, who state that $classpwd is set to a static value before th...

CVE-2006-6926

Buffer overflow in eXtremail 2.1 has unknown impact and attack vectors, as demonstrated by VulnDisco Pack. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-6887

Unrestricted file upload vulnerability in logahead UNU 1.0 allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors related to plugins/widged/widged.php aka the WidgEd plugin, a different vulnerability than CVE-2006-6783. NOTE: The provenance of this information is...

CVE-2006-6750

Format string vulnerability in XM Easy Personal FTP Server 5.0.1 allows remote attackers to cause a denial of service application crash via format string specifiers in a long PORT command. NOTE: this issue might be related to CVE-2006-2226...

CVE-2006-6744

phpProfiles before 2.1.1 does not have an index.php or other index file in the 1 imagedata, 2 graphics/comm, or 3 users read/write directories, which might allow remote attackers to list directory contents or have other unknown impacts...

CVE-2006-0465

Cross-site scripting XSS vulnerability in risultatiricerca.php in active121 Site Manager allows remote attackers to inject arbitrary web script or HTML via the cerca parameter...

CVE-2006-5047

Unspecified vulnerability in rsgallery2.html.php in RS Gallery2 component comrsgallery2 before 1.11.3 for Joomla! allows attackers to execute arbitrary code...

CVE-2006-5026

Multiple unspecified vulnerabilities in Paisterist Simple HTTP Scanner sHTTPScanner before 0.3 have unknown impact and attack vectors...

CVE-2006-4943

course/jumpto.php in Moodle before 1.6.2 does not validate the session key sesskey before providing content from arbitrary local URIs, which allows remote attackers to obtain sensitive information via the jump parameter...

CVE-2006-4940

login/forgotpassword.php in Moodle before 1.6.2 allows remote attackers to obtain sensitive information e-mail addresses and Moodle account names via a find action...

CVE-2006-4942

Moodle before 1.6.2, when the configuration lacks 1 algebra or 2 tex filters, allows remote authenticated users to write LaTeX or MimeTeX output files to the top level of the dataroot directory via a filter/algebra/pix.php or b filter/tex/pix.php...

CVE-2006-4937

lib/setup.php in Moodle before 1.6.2 sets the error reporting level to 7 to display EWARNING messages to users even if debugging is disabled, which might allow remote authenticated users to obtain sensitive information by triggering the messages...