# CVEs published 2006-01-19 25 CVEs were published on January 19, 2006: 0 critical, 0 high. Days are UTC. - [CVE-2005-4666](https://cve.now/CVE-2005-4666.md): Cross-site scripting (XSS) vulnerability in PHlyMail before 3.3 Beta1 allows remote attackers to inject arbitrary Javascript via unknown att (no CVSS) - [CVE-2006-0322](https://cve.now/CVE-2006-0322.md): Unspecified vulnerability the edit comment formatting functionality in MediaWiki 1.5.x before 1.5.6 and 1.4.x before 1.4.14 allows attackers (no CVSS) - [CVE-2006-0324](https://cve.now/CVE-2006-0324.md): SQL injection vulnerability in WebspotBlogging 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via t (no CVSS) - [CVE-2005-3340](https://cve.now/CVE-2005-3340.md): The tuxpaint-import.sh script in Tux Paint (tuxpaint) 0.9.14 and earlier creates temporary files insecurely, with unknown impact and attack (no CVSS) - [CVE-2005-4665](https://cve.now/CVE-2005-4665.md): Cross-site scripting (XSS) vulnerability in PunBB 1.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via Javas (no CVSS) - [CVE-2006-0226](https://cve.now/CVE-2006-0226.md): Integer overflow in IEEE 802.11 network subsystem (ieee80211\_ioctl.c) in FreeBSD before 6.0-STABLE, while scanning for wireless networks, al (no CVSS) - [CVE-2006-0309](https://cve.now/CVE-2006-0309.md): Linksys BEFVP41 VPN Router 2.0 with firmware 1.01.04 allows remote attackers on the local network, to cause a denial of service via IP packe (no CVSS) - [CVE-2006-0310](https://cve.now/CVE-2006-0310.md): Cross-site scripting (XSS) vulnerability in aoblogger 2.3 allows remote attackers to inject arbitrary Javascript via a javascript URI in the (no CVSS) - [CVE-2006-0311](https://cve.now/CVE-2006-0311.md): SQL injection vulnerability in login.php in aoblogger 2.3 allows remote attackers to execute arbitrary SQL commands via the username paramet (no CVSS) - [CVE-2006-0312](https://cve.now/CVE-2006-0312.md): create.php in aoblogger 2.3 allows remote attackers to bypass authentication and create new blog entries by setting the uza parameter to 1. (no CVSS) - [CVE-2006-0313](https://cve.now/CVE-2006-0313.md): Multiple SQL injection vulnerabilities in PDFdirectory before 1.0 allow remote attackers to execute arbitrary SQL commands via multiple unsp (no CVSS) - [CVE-2006-0314](https://cve.now/CVE-2006-0314.md): PDFdirectory before 1.0 stores sensitive data in plaintext, which allows remote attackers to obtain arbitrary users' passwords by direct que (no CVSS) - [CVE-2006-0315](https://cve.now/CVE-2006-0315.md): index.php in EZDatabase before 2.1.2 does not properly cleanse the p parameter before constructing and including a .php filename, which allo (no CVSS) - [CVE-2006-0316](https://cve.now/CVE-2006-0316.md): Buffer overflow in YGPPicFinder.DLL in AOL You've Got Pictures (YGP) Picture Finder Tool ActiveX Control, as used in AOL 8.0, 8.0 Plus, and (no CVSS) - [CVE-2006-0317](https://cve.now/CVE-2006-0317.md): Cross-site scripting (XSS) vulnerability in rkrt\_stats.php in RedKernel Referrer Tracker 1.1.0-3 allows remote attackers to inject arbitrary (no CVSS) - [CVE-2006-0318](https://cve.now/CVE-2006-0318.md): SQL injection vulnerability in index.php in BlogPHP 1.0, when magic\_quotes\_gpc is disabled, allows remote attackers to execute arbitrary SQL (no CVSS) - [CVE-2006-0319](https://cve.now/CVE-2006-0319.md): Directory traversal vulnerability in the FTP server (port 22003/tcp) in Farmers WIFE 4.4 SP1 allows remote attackers to create arbitrary fil (no CVSS) - [CVE-2006-0320](https://cve.now/CVE-2006-0320.md): SQL injection vulnerability in admin/processlogin.php in Bit 5 Blog 8.01 allows remote attackers to execute arbitrary SQL commands and bypas (no CVSS) - [CVE-2006-0302](https://cve.now/CVE-2006-0302.md): ZyXel P2000W VoIP 802.11b Wireless Phone running firmware WV.00.02 allows remote attackers to obtain sensitive information, such as MAC addr (no CVSS) - [CVE-2006-0303](https://cve.now/CVE-2006-0303.md): Multiple unspecified vulnerabilities in the (1) publishing component, (2) Contact Component, (3) TinyMCE Compressor, and (4) other component (no CVSS) - [CVE-2006-0304](https://cve.now/CVE-2006-0304.md): Buffer overflow in Dual DHCP DNS Server 1.0 allows remote attackers to cause a denial of service (application crash) and possibly execute ar (no CVSS) - [CVE-2006-0305](https://cve.now/CVE-2006-0305.md): Clipcomm CPW-100E VoIP 802.11b Wireless Handset Phone running firmware 1.1.12 (051129) and CP-100E VoIP 802.11b Wireless Phone running firmw (no CVSS) - [CVE-2006-0306](https://cve.now/CVE-2006-0306.md): The DM Primer (dmprimer.exe) in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0, BrightStor ARC (no CVSS) - [CVE-2006-0307](https://cve.now/CVE-2006-0307.md): The DM Primer in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0, BrightStor ARCserve Backup fo (no CVSS) - [CVE-2006-0308](https://cve.now/CVE-2006-0308.md): PHP remote file inclusion vulnerability in htmltonuke.php in the htmltonuke 2.0 alpha, and possibly other versions, module for PHP-Nuke allo (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2006-01-19 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.