# CVEs published 2006-01-09

52 CVEs were published on January 9, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2005-2344](https://cve.now/CVE-2005-2344.md): The BlackBerry Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) 4.0 to version 4.0 Service Pack 2 allows at (no CVSS)
- [CVE-2005-4636](https://cve.now/CVE-2005-4636.md): OpenOffice.org 2.0 and earlier, when hyperlinks has been disabled, does not prevent the user from clicking the WWW-browser button in the Hyp (no CVSS)
- [CVE-2005-4637](https://cve.now/CVE-2005-4637.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kayako SupportSuite 3.00.26 and earlier allow remote attackers to inject (no CVSS)
- [CVE-2005-4638](https://cve.now/CVE-2005-4638.md): index.php in Kayako SupportSuite 3.00.26 and earlier allow remote attackers to obtain the full path via (1) \_a and (2) newsid parameters in (no CVSS)
- [CVE-2006-0144](https://cve.now/CVE-2006-0144.md): The proxy server feature in go-pear.php in PHP PEAR 0.2.2, as used in Apache2Triad, allows remote attackers to execute arbitrary PHP code by (no CVSS)
- [CVE-2006-0145](https://cve.now/CVE-2006-0145.md): The kernfs\_xread function in kernfs in NetBSD 1.6 through 2.1, and OpenBSD 3.8, does not properly validate file offsets against negative 32- (no CVSS)
- [CVE-2006-0146](https://cve.now/CVE-2006-0146.md): The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Ca (no CVSS)
- [CVE-2006-0147](https://cve.now/CVE-2006-0147.md): Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including ( (no CVSS)
- [CVE-2006-0148](https://cve.now/CVE-2006-0148.md): NetSarang Xlpd 2.1 allows remote attackers to cause a denial of service (crash) via a large number of connections from the same IP address. (no CVSS)
- [CVE-2006-0149](https://cve.now/CVE-2006-0149.md): Cross-site scripting (XSS) vulnerability in SimpBook 1.0, with html\_enable on (the default), allows remote attackers to inject arbitrary web (CVSS 6.1)
- [CVE-2006-0150](https://cve.now/CVE-2006-0150.md): Multiple format string vulnerabilities in the auth\_ldap\_log\_reason function in Apache auth\_ldap 1.6.0 and earlier allows remote attackers to (no CVSS)
- [CVE-2006-0151](https://cve.now/CVE-2006-0151.md): sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via (no CVSS)
- [CVE-2005-4351](https://cve.now/CVE-2005-4351.md): The securelevels implementation in FreeBSD 7.0 and earlier, OpenBSD up to 3.8, DragonFly up to 1.2, and Linux up to 2.6.15 allows root users (no CVSS)
- [CVE-2005-4352](https://cve.now/CVE-2005-4352.md): The securelevels implementation in NetBSD 2.1 and earlier, and Linux 2.6.15 and earlier, allows local users to bypass time setting restricti (no CVSS)
- [CVE-2006-0083](https://cve.now/CVE-2006-0083.md): Format string vulnerability in the logging code of SMS Server Tools (smstools) 1.14.8 and earlier allows local users to execute arbitrary co (no CVSS)
- [CVE-2006-0143](https://cve.now/CVE-2006-0143.md): Microsoft Windows Graphics Rendering Engine (GRE) allows remote attackers to corrupt memory and cause a denial of service (crash) via a WMF (no CVSS)
- [CVE-2005-4591](https://cve.now/CVE-2005-4591.md): Heap-based buffer overflow in bogofilter 0.96.2, 0.95.2, 0.94.14, 0.94.12, and other versions from 0.93.5 to 0.96.2, when using Unicode data (no CVSS)
- [CVE-2005-4592](https://cve.now/CVE-2005-4592.md): Heap-based buffer overflow in bogofilter and bogolexer 0.96.2 allows remote attackers to cause a denial of service (crash) and possibly exec (no CVSS)
- [CVE-2006-0140](https://cve.now/CVE-2006-0140.md): Cross-site scripting (XSS) vulnerability in post.php in NavBoard V16 Stable(2.6.0) and V17beta2 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2006-0141](https://cve.now/CVE-2006-0141.md): Qualcomm Eudora Internet Mail Server (EIMS) before 3.2.8 allows remote attackers to cause a denial of service (crash) via (1) malformed NTLM (no CVSS)
- [CVE-2006-0142](https://cve.now/CVE-2006-0142.md): Cross-site scripting (XSS) vulnerability in andromeda.php in Andromeda 1.9.3.4 and earlier allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2004-2653](https://cve.now/CVE-2004-2653.md): Unspecified vulnerability in PD9 Software MegaBBS 2.0 and 2.1 allows attackers to gain privileges via unknown vectors involving (1) admin/us (no CVSS)
- [CVE-2005-2762](https://cve.now/CVE-2005-2762.md): Avaya VPNRemote before 4.2.33 stores credentials in cleartext in process memory, which allows attackers to obtain the VPN user's credentials (no CVSS)
- [CVE-2005-3540](https://cve.now/CVE-2005-3540.md): Buffer overflow in petris before 1.0.1 allows remote attackers to execute arbitrary code via unspecified attack vectors. (no CVSS)
- [CVE-2006-0139](https://cve.now/CVE-2006-0139.md): The send-private-message functionality (send-private-message.asp) in PD9 Software MegaBBS 2.1 allows remote attackers to read private messag (no CVSS)
- [CVE-2005-4634](https://cve.now/CVE-2005-4634.md): SQL injection vulnerability in index.php in ActiveCampaign SupportTrio 1.4 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2005-4635](https://cve.now/CVE-2005-4635.md): The nl\_fib\_input function in fib\_frontend.c in the Linux kernel before 2.6.15 does not check for valid lengths of the header and payload, wh (no CVSS)
- [CVE-2006-0114](https://cve.now/CVE-2006-0114.md): The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attac (no CVSS)
- [CVE-2006-0115](https://cve.now/CVE-2006-0115.md): Multiple SQL injection vulnerabilities in OnePlug Solutions OnePlug CMS allow remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2006-0116](https://cve.now/CVE-2006-0116.md): Cross-site scripting vulnerability search.inetstore in iNETstore Ebusiness Software 2.0 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2006-0117](https://cve.now/CVE-2006-0117.md): Buffer overflow in IBM Lotus Notes and Domino Server before 6.5.5 allows attackers to cause a denial of service (router crash or hang) via u (no CVSS)
- [CVE-2006-0118](https://cve.now/CVE-2006-0118.md): Unspecified vulnerability in IBM Lotus Notes and Domino Server before 6.5.5, when running on AIX, allows attackers to cause a denial of serv (no CVSS)
- [CVE-2006-0119](https://cve.now/CVE-2006-0119.md): Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 have unknown impact and attack vectors, due to "poten (no CVSS)
- [CVE-2006-0120](https://cve.now/CVE-2006-0120.md): Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (applica (no CVSS)
- [CVE-2006-0121](https://cve.now/CVE-2006-0121.md): Multiple memory leaks in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (memory consumption and (no CVSS)
- [CVE-2006-0122](https://cve.now/CVE-2006-0122.md): Cross-site scripting (XSS) vulnerability in Public/Index.asp in Aquifer CMS allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2006-0123](https://cve.now/CVE-2006-0123.md): Multiple SQL injection vulnerabilities in ADN Forum 1.0b allow remote attackers to execute arbitrary SQL commands via the (1) fid parameter (no CVSS)
- [CVE-2006-0124](https://cve.now/CVE-2006-0124.md): Cross-site scripting (XSS) vulnerability in crear.php in ADN Forum 1.0b allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2006-0125](https://cve.now/CVE-2006-0125.md): Unspecified vulnerability in appserv/main.php in AppServ 2.4.5 allows remote attackers to include arbitrary files via the appserv\_root param (no CVSS)
- [CVE-2006-0126](https://cve.now/CVE-2006-0126.md): rxvt-unicode before 6.3, on certain platforms that use openpty and non-Unix pty devices such as Linux and most BSD platforms, does not maint (no CVSS)
- [CVE-2006-0127](https://cve.now/CVE-2006-0127.md): Directory traversal vulnerability in the IMAP service of Rockliffe MailSite before 6.1.22.1 allows remote authenticated users to rename the (no CVSS)
- [CVE-2006-0128](https://cve.now/CVE-2006-0128.md): Buffer overflow in the IMAP service of Rockliffe MailSite before 6.1.22.1 allows remote attackers to have an unknown impact via unknown atta (no CVSS)
- [CVE-2006-0129](https://cve.now/CVE-2006-0129.md): Mail Management Agent (MAILMA) (aka Mail Management Server) in Rockliffe MailSite 7.0.3.1 and earlier generates different responses dependin (no CVSS)
- [CVE-2006-0130](https://cve.now/CVE-2006-0130.md): Mail Management Agent (MAILMA) (aka Mail Management Server) in Rockliffe MailSite 7.0.3.1 and earlier allows remote attackers to attempt aut (no CVSS)
- [CVE-2006-0131](https://cve.now/CVE-2006-0131.md): boastMachine 3.1 allows remote attackers to obtain sensitive information via a direct request to (1) footer.php and (2) side\_menu.php, which (no CVSS)
- [CVE-2006-0132](https://cve.now/CVE-2006-0132.md): Directory traversal vulnerability in webftp.php in SysCP WebFTP 1.2.6 and possibly earlier allows remote attackers to include and execute ar (no CVSS)
- [CVE-2006-0133](https://cve.now/CVE-2006-0133.md): Multiple directory traversal vulnerabilities in AIX 5.3 ML03 allow local users to determine the existence of files and read partial contents (no CVSS)
- [CVE-2006-0134](https://cve.now/CVE-2006-0134.md): Cross-site scripting (XSS) vulnerability in register.php in TheWebForum (twf) 1.2.1 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2006-0135](https://cve.now/CVE-2006-0135.md): SQL injection vulnerability in login.php in TheWebForum (twf) 1.2.1 allows remote attackers to execute arbitrary SQL commands and bypass log (no CVSS)
- [CVE-2006-0136](https://cve.now/CVE-2006-0136.md): Multiple cross-site scripting (XSS) vulnerabilities in the guestbook module in modules.php in Phanatic Softwares Chimera Web Portal System 0 (no CVSS)
- [CVE-2006-0137](https://cve.now/CVE-2006-0137.md): SQL injection vulnerability in linkcategory.php in Phanatic Softwares Chimera Web Portal System 0.2 allows remote attackers to execute arbit (no CVSS)
- [CVE-2006-0138](https://cve.now/CVE-2006-0138.md): aMSN (aka Alvaro's Messenger) allows remote attackers to cause a denial of service (client hang and termination of client's instant-messagin (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-01-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.