# CVEs published 2006-12-04

47 CVEs were published on December 4, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-3893](https://cve.now/CVE-2006-3893.md): Multiple buffer overflows in the ActiveX controls in Newtone ImageKit 5 before Fix 30 and 6 before Fix 40, as used in CASIO Photo Loader… (no CVSS)
- [CVE-2006-6243](https://cve.now/CVE-2006-6243.md): Multiple SQL injection vulnerabilities in index.asp in FipsSHOP allow remote attackers to execute arbitrary SQL commands via the (1) cat… (no CVSS)
- [CVE-2006-6244](https://cve.now/CVE-2006-6244.md): Coalescent Systems freePBX (formerly Asterisk Management Portal) before 2.2.0rc1 allows attackers to execute arbitrary commands via shell… (no CVSS)
- [CVE-2006-6245](https://cve.now/CVE-2006-6245.md): Multiple SQL injection vulnerabilities in Photo Organizer (PO) 2.32b and earlier allow remote attackers to execute arbitrary SQL commands… (no CVSS)
- [CVE-2006-6246](https://cve.now/CVE-2006-6246.md): Photo Organizer 2.32b and earlier does not properly check the ownership of certain objects, which allows remote attackers to gain… (no CVSS)
- [CVE-2006-6247](https://cve.now/CVE-2006-6247.md): Multiple SQL injection vulnerabilities in Uapplication UPhotoGallery 1.1 allow remote attackers to execute arbitrary SQL commands via the… (no CVSS)
- [CVE-2006-6248](https://cve.now/CVE-2006-6248.md): index.php in GPhotos 1.5 allows remote attackers to obtain sensitive information via an invalid rep parameter, which reveals the full path… (no CVSS)
- [CVE-2006-6249](https://cve.now/CVE-2006-6249.md): Cross-site scripting (XSS) vulnerability in Chama Cargo 4.36 and earlier allows remote attackers to inject arbitrary web script or HTML… (no CVSS)
- [CVE-2006-6250](https://cve.now/CVE-2006-6250.md): Format string vulnerability in Songbird Media Player 0.2 and earlier allows remote attackers to cause a denial of service (crash) via an… (no CVSS)
- [CVE-2006-6251](https://cve.now/CVE-2006-6251.md): Stack-based buffer overflow in VUPlayer 2.44 and earlier allows remote attackers to execute arbitrary code via a long string in an M3U… (no CVSS)
- [CVE-2006-6252](https://cve.now/CVE-2006-6252.md): Microsoft Windows Live Messenger 8.0 and earlier, when gestual emoticons are enabled, allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2006-6253](https://cve.now/CVE-2006-6253.md): Cahier de texte 2.0 stores sensitive information under the web root, possibly with insufficient access control, which might allow remote… (no CVSS)
- [CVE-2006-6254](https://cve.now/CVE-2006-6254.md): administration/telecharger.php in Cahier de texte 2.0 allows remote attackers to obtain unparsed content (source code) of files via the… (no CVSS)
- [CVE-2006-6255](https://cve.now/CVE-2006-6255.md): Direct static code injection vulnerability in util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Program E is an AIML chatterbot… (no CVSS)
- [CVE-2006-6256](https://cve.now/CVE-2006-6256.md): Cross-site scripting (XSS) vulnerability in the file manager in admin/bro\_main.php in AlternC 0.9.5 and earlier allows remote attackers to… (no CVSS)
- [CVE-2006-6257](https://cve.now/CVE-2006-6257.md): The file manager in AlternC 0.9.5 and earlier, when warnings are enabled in PHP, allows remote attackers to obtain sensitive information… (no CVSS)
- [CVE-2006-6258](https://cve.now/CVE-2006-6258.md): The phpmyadmin subsystem in AlternC 0.9.5 and earlier transmits the SQL password in cleartext in a cookie, which might allow remote… (no CVSS)
- [CVE-2006-6259](https://cve.now/CVE-2006-6259.md): Multiple directory traversal vulnerabilities in (a) class/functions.php and (b) class/m\_bro.php in AlternC 0.9.5 and earlier allow remote… (no CVSS)
- [CVE-2006-6260](https://cve.now/CVE-2006-6260.md): SQL injection vulnerability in login.asp in Redbinaria Sistema Integrado de Administracion de Portales (SIAP) allows remote attackers to… (no CVSS)
- [CVE-2006-6261](https://cve.now/CVE-2006-6261.md): Buffer overflow in Quintessential Player 4.50.1.82 and earlier allows remote attackers to cause a denial of service (crash) and possibly… (no CVSS)
- [CVE-2006-6262](https://cve.now/CVE-2006-6262.md): Directory traversal vulnerability in mboard.php in PHPJunkYard (aka Klemen Stirn) MBoard 1.22 and earlier allows remote attackers to… (no CVSS)
- [CVE-2006-6263](https://cve.now/CVE-2006-6263.md): Teredo clients, when source routing is enabled, recognize a Routing header in an encapsulated IPv6 packet and send the packet to the next… (no CVSS)
- [CVE-2006-6264](https://cve.now/CVE-2006-6264.md): Teredo creates trusted peer entries for arbitrary incoming source Teredo addresses, even if the low 32 bits represent an intranet address… (no CVSS)
- [CVE-2006-6265](https://cve.now/CVE-2006-6265.md): Teredo clients, when located behind a restricted NAT, allow remote attackers to establish an inbound connection without the guessing… (no CVSS)
- [CVE-2006-6266](https://cve.now/CVE-2006-6266.md): Teredo clients, when following item 6 of RFC4380 section 5.2.3, start direct IPv6 connectivity tests (aka ping tests) in response to… (no CVSS)
- [CVE-2006-6267](https://cve.now/CVE-2006-6267.md): PostNuke 0.7.5.0, and certain minor versions, allows remote attackers to obtain sensitive information via a non-numeric value of the stop… (no CVSS)
- [CVE-2006-6268](https://cve.now/CVE-2006-6268.md): SQL injection vulnerability in system/core/profile/profile.inc.php in Neocrome Land Down Under (LDU) 8.x and earlier allows remote… (no CVSS)
- [CVE-2006-6269](https://cve.now/CVE-2006-6269.md): Multiple SQL injection vulnerabilities in Infinitytechs Restaurants CM allow remote attackers to execute arbitrary SQL commands via (1)… (no CVSS)
- [CVE-2006-6270](https://cve.now/CVE-2006-6270.md): Multiple SQL injection vulnerabilities in ASPMForum allow remote attackers to execute arbitrary SQL commands via (1) the soruid parameter… (no CVSS)
- [CVE-2006-6271](https://cve.now/CVE-2006-6271.md): Multiple cross-site scripting (XSS) vulnerabilities in PHPOLL 0.96 allow remote attackers to inject arbitrary web script or HTML via the… (no CVSS)
- [CVE-2006-6272](https://cve.now/CVE-2006-6272.md): Cross-site scripting (XSS) vulnerability in sp\_index.php in Simple PHP Gallery 1.1 allows remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2006-6273](https://cve.now/CVE-2006-6273.md): sp\_index.php in Simple PHP Gallery 1.1 allows remote attackers to obtain sensitive information via an invalid dir parameter, which reveals… (no CVSS)
- [CVE-2006-6274](https://cve.now/CVE-2006-6274.md): SQL injection vulnerability in articles.asp in Expinion.net iNews (1) Publisher (iNP) 2.5 and earlier, and possibly (2) News Manager… (no CVSS)
- [CVE-2006-6275](https://cve.now/CVE-2006-6275.md): Race condition in the kernel in Sun Solaris 8 through 10 allows local users to cause a denial of service (panic) via unspecified vectors… (no CVSS)
- [CVE-2006-6276](https://cve.now/CVE-2006-6276.md): HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or… (no CVSS)
- [CVE-2006-6277](https://cve.now/CVE-2006-6277.md): Directory traversal vulnerability in admin/FileServer.php in ContentServ 4.x allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2006-6278](https://cve.now/CVE-2006-6278.md): Cross-site scripting (XSS) vulnerability in index.php in @lex Guestbook 4.0.1 allows remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2006-6279](https://cve.now/CVE-2006-6279.md): index.php in @lex Guestbook 4.0.1 allows remote attackers to obtain sensitive information via a skin parameter referencing a nonexistent… (no CVSS)
- [CVE-2006-6280](https://cve.now/CVE-2006-6280.md): SQL injection vulnerability in viewthread.php in Oxygen (O2PHP Bulletin Board) 1.1.3 and earlier allows remote attackers to execute… (no CVSS)
- [CVE-2006-6281](https://cve.now/CVE-2006-6281.md): PHP remote file inclusion vulnerability in check\_status.php in dicshunary 0.1 alpha allows remote attackers to execute arbitrary PHP code… (no CVSS)
- [CVE-2006-6282](https://cve.now/CVE-2006-6282.md): members.php in Vikingboard 0.1.2 allows remote attackers to trigger a forced SQL error via an invalid s parameter, a different vector than… (no CVSS)
- [CVE-2006-6283](https://cve.now/CVE-2006-6283.md): Multiple cross-site scripting (XSS) vulnerabilities in Vikingboard 0.1.2 allow remote attackers to inject arbitrary web script or HTML via… (no CVSS)
- [CVE-2006-6284](https://cve.now/CVE-2006-6284.md): Directory traversal vulnerability in admin.php in Vikingboard 0.1.2 allows remote authenticated administrators to include arbitrary files… (no CVSS)
- [CVE-2006-6285](https://cve.now/CVE-2006-6285.md): PHP remote file inclusion vulnerability in index.php in Kai Blankenhorn Bitfolge simple and nice index file (aka snif) 1.5.2 and earlier… (no CVSS)
- [CVE-2006-6286](https://cve.now/CVE-2006-6286.md): Palm Desktop 4.1.4 and earlier stores user data with weak permissions under the application directory, which allows local users to obtain… (no CVSS)
- [CVE-2006-6287](https://cve.now/CVE-2006-6287.md): Stack-based buffer overflow in AtomixMP3 2.3 and earlier allows remote attackers to execute arbitrary code via a long pathname in an M3U… (no CVSS)
- [CVE-2006-6288](https://cve.now/CVE-2006-6288.md): Multiple buffer overflows in Niek Albers CoolPlayer 216 and earlier allow remote attackers to execute arbitrary code via (1) a playlist… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2006-12-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.