CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In June 2006 (CVSS score >= 6)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2006-3334 DoS Exec Code Overflow 2006-06-30 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to "chunk error processing," possibly involving the "chunk_name".
2 CVE-2006-3332 Exec Code Sql 2006-06-30 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Zorum Forum 3.5 allows remote attackers to execute arbitrary SQL commands via the (1) offset, (2) tid, (3) fromid, (4) sortby, (5) fromfrommethod, and (6) fromfromlist parameters.
3 CVE-2006-3330 Exec Code XSS 2006-06-30 2018-10-18
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in AddAsset1.php in PHP/MySQL Classifieds (PHP Classifieds) allows remote attackers to execute arbitrary SQL commands via the (1) ProductName ("Title" field), (2) url, and (3) Description parameters, possibly related to issues in add1.php.
4 CVE-2006-3329 Exec Code Sql 2006-06-30 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in search.php in PHP/MySQL Classifieds (PHP Classifieds) allows remote attackers to execute arbitrary SQL commands via the rate parameter.
5 CVE-2006-3323 Exec Code XSS File Inclusion 2006-06-30 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in admin/admin.php in MF Piadas 1.0 allows remote attackers to execute arbitrary PHP code via the page parameter. NOTE: the same vector can be used for cross-site scripting, but CVE analysis suggests that this is resultant from file inclusion of HTML or script.
6 CVE-2006-3315 Exec Code File Inclusion 2006-06-29 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in page.php in an unspecified RahnemaCo.com product, possibly eShop, allows remote attackers to execute arbitrary PHP code via a URL in the osCsid parameter.
7 CVE-2006-3314 Exec Code File Inclusion 2006-06-29 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in page.php in an unspecified RahnemaCo.com product, possibly eShop, allows remote attackers to execute arbitrary PHP code via a URL in the pageid parameter.
8 CVE-2006-3309 Exec Code Sql 2006-06-29 2017-10-19
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SPT--ForumTopics.php in Scout Portal Toolkit (SPT) 1.4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the forumid parameter.
9 CVE-2006-3308 XSS 2006-06-29 2017-07-20
9.3
None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in the wpprop code for Project EROS bbsengine before 20060622-0315 has unknown impact and remote attack vectors via [img] tags, possibly cross-site scripting (XSS).
10 CVE-2006-3307 Exec Code Sql 2006-06-29 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Project EROS bbsengine before bbsengine-20060429-1550-jam allow remote attackers to execute arbitrary SQL commands via (1) unspecified parameters in the php/comment.php and (2) the getpartialmatches method in php/aolbonics.php.
11 CVE-2006-3304 Exec Code Sql 2006-06-29 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in cp.php in DeluxeBB 1.07 and earlier allows remote attackers to execute arbitrary SQL commands via the xmsn parameter.
12 CVE-2006-3300 Exec Code File Inclusion 2006-06-29 2017-10-19
7.5
None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in sms_config/gateway.php in PhpMySms 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ROOT_PATH parameter.
13 CVE-2006-3296 Exec Code Sql 2006-06-29 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in view.php in Open Guestbook 0.5 allows remote attackers to execute arbitrary SQL commands via the offset parameter.
14 CVE-2006-3292 Exec Code Sql 2006-06-28 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Search gadget in Jaws 0.6.2 allows remote attackers to execute arbitrary SQL commands via queries with the "LIKE" keyword in the searchdata parameter (search field).
15 CVE-2006-3291 16 2006-06-28 2017-07-20
9.3
None Remote Medium Not required Complete Complete Complete
The web interface on Cisco IOS 12.3(8)JA and 12.3(8)JA1, as used on the Cisco Wireless Access Point and Wireless Bridge, reconfigures itself when it is changed to use the "Local User List Only (Individual Passwords)" setting, which removes all security and password configurations and allows remote attackers to access the system.
16 CVE-2006-3287 2006-06-28 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Cisco Wireless Control System (WCS) for Linux and Windows 4.0(1) and earlier uses a default administrator username "root" and password "public," which allows remote attackers to gain access (aka bug CSCse21391).
17 CVE-2006-3286 2006-06-28 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
The internal database in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(63) stores a hard-coded username and password in plaintext within unspecified files, which allows remote authenticated users to access the database (aka bug CSCsd15951).
18 CVE-2006-3285 2006-06-28 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
The internal database in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) uses an undocumented, hard-coded username and password, which allows remote authenticated users to read, and possibly modify, sensitive configuration data (aka bugs CSCsd15955).
19 CVE-2006-3283 Exec Code Sql 2006-06-28 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Dating Agent PRO 4.7.1 allows remote attackers to execute arbitrary SQL commands via the (1) pid parameter in picture.php, (2) mid parameter in mem.php, and the (3) sex and (4) relationship parameters in search.php.
20 CVE-2006-3280 2006-06-28 2021-07-23
7.5
None Remote Low Not required Partial Partial Partial
Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, aka "Redirect Cross-Domain Information Disclosure Vulnerability."
21 CVE-2006-3276 Exec Code Overflow 2006-06-28 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in RealNetworks Helix DNA Server 10.0 and 11.0 allows remote attackers to execute arbitrary code via (1) a long User-Agent HTTP header in the RTSP service and (2) unspecified vectors involving the "parsing of HTTP URL schemes".
22 CVE-2006-3275 Exec Code Sql 2006-06-28 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in profile.php in YaBB SE 1.5.5 and earlier allows remote attackers to execute SQL commands via a double-encoded user parameter in a viewprofile action.
23 CVE-2006-3271 Exec Code Sql 2006-06-28 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Softbiz Dating 1.0 allow remote attackers to execute SQL commands via the (1) country and (2) sort_by parameters in (a) search_results.php; (3) browse parameter in (b) featured_photos.php; (4) cid parameter in (c) products.php, (d) index.php, and (e) news_desc.php.
24 CVE-2006-3270 Exec Code Sql 2006-06-28 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in cms_admin.php in THoRCMS 1.3.1 allows remote attackers to execute arbitrary SQL commands via multiple unspecified parameters, such as the add_link_mid parameter. NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information.
25 CVE-2006-3267 Exec Code Sql 2006-06-27 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Infinite Core Technologies (ICT) 1.0 Gold and earlier allows remote attackers to execute arbitrary SQL commands via the post parameter.
26 CVE-2006-3263 Exec Code Sql 2006-06-27 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.
27 CVE-2006-3262 Exec Code Sql 2006-06-27 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter.
28 CVE-2006-3256 Exec Code Sql 2006-06-28 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in report.php in Woltlab Burning Board (WBB) 2.3.1 allows remote attackers to execute arbitrary SQL commands via the postid parameter.
29 CVE-2006-3255 Exec Code Sql 2006-06-28 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in showmods.php in Woltlab Burning Board (WBB) 1.2 allows remote attackers to execute arbitrary SQL commands via the boardid parameter.
30 CVE-2006-3254 Exec Code Sql 2006-06-28 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in newthread.php in Woltlab Burning Board (WBB) 2.0 RC2 allows remote attackers to execute arbitrary SQL commands via the boardid parameter.
31 CVE-2006-3252 Exec Code Overflow 2006-06-27 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the Online Registration Facility for Algorithmic Research PrivateWire VPN software up to 3.7 allows remote attackers to execute arbitrary code via a long GET request.
32 CVE-2006-3251 119 Exec Code Overflow 2006-06-27 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the array_push function in hashcash.c for Hashcash before 1.21 might allow attackers to execute arbitrary code via crafted entries.
33 CVE-2006-3249 Exec Code Sql 2006-06-27 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
** DISPUTED ** SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the vendor has disputed this report, stating "If a non positive integer or non-integer is used for the page parameter for a search URL, the search query will use a negative number for the LIMIT clause. This causes the query to break, showing no results. It IS NOT however a sql injection error." While the original report is from a researcher with mixed accuracy, as of 20060703, CVE does not have any additional information regarding this issue.
34 CVE-2006-3243 Exec Code Sql 2006-06-27 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in usercp.php in MyBB (MyBulletinBoard) 1.0 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the showcodebuttons parameter.
35 CVE-2006-3242 DoS Exec Code Overflow 2006-06-27 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the browse_get_namespace function in imap/browse.c of Mutt 1.4.2.1 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via long namespaces received from the IMAP server.
36 CVE-2006-3239 Exec Code Sql 2006-06-27 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in message.php in VBZooM 1.11 and earlier allows remote attackers to execute arbitrary SQL commands via the UserID parameter.
37 CVE-2006-3238 Exec Code Sql 2006-06-27 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in VBZooM 1.00 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) MemberID parameter to rank.php, and the (2) QuranID parameter to lng.php.
38 CVE-2006-3236 Exec Code Sql 2006-06-27 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in thinkWMS 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a) index.php or (b) printarticle.php, and the (2) catid parameter in index.php.
39 CVE-2006-3234 Exec Code Sql 2006-06-27 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in index.php in FineShop 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) produkt, (2) id_produc, and (3) id_kat parameters.
40 CVE-2006-3232 2006-06-27 2011-03-08
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in IBM WebSphere Application Server before 6.0.2.11 has unknown impact and attack vectors because the "UserNameToken cache was improperly used."
41 CVE-2006-3228 Exec Code Overflow 2006-06-26 2017-10-19
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in in_midi.dll for WinAmp 2.90 up to 5.23, including 5.21, allows remote attackers to execute arbitrary code via a crafted .mid (MIDI) file.
42 CVE-2006-3226 Bypass 2006-06-26 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
Cisco Secure Access Control Server (ACS) 4.x for Windows uses the client's IP address and the server's port number to grant access to an HTTP server port for an administration session, which allows remote attackers to bypass authentication via various methods, aka "ACS Weak Session Management Vulnerability."
43 CVE-2006-3223 DoS Exec Code 2006-06-27 2021-04-09
7.5
None Remote Low Not required Partial Partial Partial
Format string vulnerability in CA Integrated Threat Management (ITM), eTrust Antivirus (eAV), and eTrust PestPatrol (ePP) r8 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a scan job with format strings in the description field.
44 CVE-2006-3221 Exec Code Sql 2006-06-24 2017-10-19
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in DataLife Engine 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via double-encoded values in the user parameter in a userinfo subaction.
45 CVE-2006-3220 Exec Code Sql 2006-06-24 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in studienplatztausch.php in Woltlab Burning Board (WBB) 2.2.1 allows remote attackers to execute arbitrary SQL commands via the sid parameter.
46 CVE-2006-3219 Exec Code Sql 2006-06-24 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in thread.php in Woltlab Burning Board (WBB) 2.2.2 allows remote attackers to execute arbitrary SQL commands via the threadid parameter.
47 CVE-2006-3218 Exec Code Sql 2006-06-24 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in profile.php in Woltlab Burning Board (WBB) 2.1.6 allows remote attackers to execute arbitrary SQL commands via the userid parameter.
48 CVE-2006-3215 Bypass 2006-06-24 2017-07-20
7.5
None Remote Low Not required Partial Partial Partial
Clearswift MAILsweeper for SMTP before 4.3.20 and MAILsweeper for Exchange before 4.3.20 allows remote attackers to bypass the "text analysis", possibly bypassing SPAM and other filters, by sending an e-mail specifying a non-existent or unrecognized character set.
49 CVE-2006-3213 Exec Code Sql 2006-06-24 2018-10-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in WeBBoA Hosting 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter to an unspecified script, possibly host/yeni_host.asp.
50 CVE-2006-3209 +Priv 2006-06-24 2018-10-18
7.2
None Local Low Not required Complete Complete Complete
** DISPUTED ** The Task scheduler (at.exe) on Microsoft Windows XP spawns each scheduled process with SYSTEM permissions, which allows local users to gain privileges. NOTE: this issue has been disputed by third parties, who state that the Task scheduler is limited to the Administrators group by default upon installation.
Total number of vulnerabilities : 291   Page : 1 (This Page)2 3 4 5 6
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.