CVE-2006-5026

Multiple unspecified vulnerabilities in Paisterist Simple HTTP Scanner sHTTPScanner before 0.3 have unknown impact and attack vectors...

CVE-2006-4943

course/jumpto.php in Moodle before 1.6.2 does not validate the session key sesskey before providing content from arbitrary local URIs, which allows remote attackers to obtain sensitive information via the jump parameter...

CVE-2006-4940

login/forgotpassword.php in Moodle before 1.6.2 allows remote attackers to obtain sensitive information e-mail addresses and Moodle account names via a find action...

CVE-2006-4942

Moodle before 1.6.2, when the configuration lacks 1 algebra or 2 tex filters, allows remote authenticated users to write LaTeX or MimeTeX output files to the top level of the dataroot directory via a filter/algebra/pix.php or b filter/tex/pix.php...

CVE-2006-4937

lib/setup.php in Moodle before 1.6.2 sets the error reporting level to 7 to display EWARNING messages to users even if debugging is disabled, which might allow remote authenticated users to obtain sensitive information by triggering the messages...

CVE-2006-4938

help.php in Moodle before 1.6.2 does not check the existence of certain help files before including them, which might allow remote authenticated users to obtain the path in an error message...

CVE-2006-4884

Multiple cross-site scripting XSS vulnerabilities in IDevSpot iSupport 1.8 allow remote attackers to inject arbitrary web script or HTML via 1 the suser parameter in support/rightbar.php, 2 the ticketid parameter in support/opentickets.php, and 3 the conspagetitle parameter in index.php. NOTE: th...

CVE-2006-0149

Cross-site scripting XSS vulnerability in SimpBook 1.0, with htmlenable on the default, allows remote attackers to inject arbitrary web script or HTML via the message field...

CVE-2006-0130

Mail Management Agent MAILMA aka Mail Management Server in Rockliffe MailSite 7.0.3.1 and earlier allows remote attackers to attempt authentication with an unlimited number of user account names and passwords without denying connections, limiting the rate of connections, or locking out an account...

CVE-2006-4525

Cross-site scripting XSS vulnerability in CubeCart 3.0.12 and earlier, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the links array...

CVE-2006-4526

SQL injection vulnerability in includes/content/viewCat.inc.php in CubeCart 3.0.12 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary SQL commands via the searchArray parameter...

CVE-2006-4506

idmlib.sh in nxdrv in Novell Identity Manager IDM 3.0.1 allows local users to execute arbitrary commands via unspecified vectors, possibly involving the " quote and \ backslash characters and eval injection...

CVE-2006-4499

ModernBill 5.0.4 and earlier uses cURL with insecure settings for CURLOPTSSLVERIFYPEER and CURLOPTSSLVERIFYHOST that do not verify SSL certificates, which allows remote attackers to read network traffic via a man-in-the-middle MITM attack...

CVE-2006-4461

Paessler IPCheck Server Monitor before 5.3.3.639/640 does not properly implement a "list of acceptable host IP addresses in the probe settings," which has unknown impact and attack vectors...

CVE-2006-4352

The ArrowPoint cookie functionality for Cisco 11000 series Content Service Switches specifies an internal IP address if the administrator does not specify a string option, which allows remote attackers to obtain sensitive information...

CVE-2006-2463

viewalbum.php in SelectaPix 1.31 and earlier allows remote attackers to obtain the installation path via a certain request, which displays the path in an error message, possibly due to an invalid or missing parameter...

CVE-2006-3488

Absolute path traversal vulnerability in administrador.asp in VirtuaStore 2.0 allows remote attackers to possibly read arbitrary directories or files via an absolute path with Windows drive letter in the Pasta parameter when link=util, acao=ftp, and acaba=sim...

CVE-2006-6166

Cross-site scripting XSS vulnerability in jce.php in the JCE Admin Component in Ryan Demmer Joomla Content Editor JCE 1.0.4 for Joomla! comjce, without the 20060821 jcepatch, allows remote attackers to inject arbitrary web script or HTML via the mosConfiglivesite parameter...

CVE-2006-6008

ftpd in Linux Netkit linux-ftpd 0.17, and possibly other versions, does not check the return status of certain seteuid, setgid, and setuid calls, which might allow remote authenticated users to gain privileges if these calls fail in cases such as PAM failures or resource limits, a different...

CVE-2006-6683

Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that processes /etc/shadow and does not follow the PAM configuration, which might allow remote attackers to bypass intended restrictions implemented through PAM...