# CVEs published 2006-01-25

37 CVEs were published on January 25, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-0419](https://cve.now/CVE-2006-0419.md): BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which (no CVSS)
- [CVE-2006-0420](https://cve.now/CVE-2006-0420.md): BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when servlets use relative forwarding, (no CVSS)
- [CVE-2006-0421](https://cve.now/CVE-2006-0421.md): By design, BEA WebLogic Server and WebLogic Express 7.0 and 6.1, when creating multiple domains from the same WebLogic instance on the same (no CVSS)
- [CVE-2006-0422](https://cve.now/CVE-2006-0422.md): Multiple unspecified vulnerabilities in BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allow (no CVSS)
- [CVE-2006-0423](https://cve.now/CVE-2006-0423.md): BEA WebLogic Portal 8.1 through SP3 stores the password for the RDBMS Authentication provider in cleartext in the config.xml file, which all (no CVSS)
- [CVE-2006-0424](https://cve.now/CVE-2006-0424.md): BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allows remote authenticated guest users to re (no CVSS)
- [CVE-2006-0425](https://cve.now/CVE-2006-0425.md): BEA WebLogic Portal 8.1 through SP4 allows remote attackers to obtain the source for a deployment descriptor file via unknown vectors. (no CVSS)
- [CVE-2006-0426](https://cve.now/CVE-2006-0426.md): BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the ol (no CVSS)
- [CVE-2006-0427](https://cve.now/CVE-2006-0427.md): Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications (no CVSS)
- [CVE-2006-0428](https://cve.now/CVE-2006-0428.md): Unspecified vulnerability in BEA WebLogic Portal 8.1 SP3 through SP5, when using Web Services Remote Portlets (WSRP), allows remote attacker (no CVSS)
- [CVE-2006-0429](https://cve.now/CVE-2006-0429.md): BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have not been activated by a server (no CVSS)
- [CVE-2006-0430](https://cve.now/CVE-2006-0430.md): Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are en (no CVSS)
- [CVE-2006-0431](https://cve.now/CVE-2006-0431.md): Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server's SSL ident (no CVSS)
- [CVE-2006-0432](https://cve.now/CVE-2006-0432.md): Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to (no CVSS)
- [CVE-2006-0379](https://cve.now/CVE-2006-0379.md): FreeBSD kernel 5.4-STABLE and 6.0 does not completely initialize a buffer before making it available to userland, which could allow local us (no CVSS)
- [CVE-2006-0380](https://cve.now/CVE-2006-0380.md): A logic error in FreeBSD kernel 5.4-STABLE and 6.0 causes the kernel to calculate an incorrect buffer length, which causes more data to be c (no CVSS)
- [CVE-2006-0381](https://cve.now/CVE-2006-0381.md): A logic error in the IP fragment cache functionality in pf in FreeBSD 5.3, 5.4, and 6.0, and OpenBSD, when a 'scrub fragment crop' or 'scrub (no CVSS)
- [CVE-2005-4667](https://cve.now/CVE-2005-4667.md): Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument (no CVSS)
- [CVE-2006-0225](https://cve.now/CVE-2006-0225.md): scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are exp (no CVSS)
- [CVE-2006-0411](https://cve.now/CVE-2006-0411.md): claro\_init\_local.inc.php in Claroline 1.7.2 uses guessable session cookies (MD5 hash of connection time), which allows remote attackers to h (no CVSS)
- [CVE-2006-0412](https://cve.now/CVE-2006-0412.md): SQL injection vulnerability in CyberShop allows remote attackers to execute arbitrary SQL commands and bypass authentication via the usernam (no CVSS)
- [CVE-2006-0413](https://cve.now/CVE-2006-0413.md): Multiple SQL injection vulnerabilities in index.php in NewsPHP allow remote attackers to execute arbitrary SQL commands via the (1) discuss, (no CVSS)
- [CVE-2006-0414](https://cve.now/CVE-2006-0414.md): Tor before 0.1.1.20 allows remote attackers to identify hidden services via a malicious Tor server that attempts a large number of accesses (no CVSS)
- [CVE-2006-0415](https://cve.now/CVE-2006-0415.md): Cross-site scripting (XSS) vulnerability in index.php in SleeperChat 0.3f and earlier allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2006-0416](https://cve.now/CVE-2006-0416.md): SleeperChat 0.3f and earlier allows remote attackers to bypass authentication and create new entries via the txt parameter to (1) chat\_no.ph (no CVSS)
- [CVE-2006-0417](https://cve.now/CVE-2006-0417.md): SQL injection vulnerability in login.php in miniBloggie 1.0 and earlier, when gpc\_magic\_quotes is disabled, allows remote attackers to execu (no CVSS)
- [CVE-2006-0418](https://cve.now/CVE-2006-0418.md): Eval injection vulnerability in 123 Flash Chat Server 5.0 and 5.1 allows attackers to execute arbitrary code via a crafted username. (no CVSS)
- [CVE-2006-0224](https://cve.now/CVE-2006-0224.md): Buffer overflow in Library of Assorted Spiffy Things (LibAST) 0.6.1 and earlier, as used in Eterm and possibly other software, allows local (no CVSS)
- [CVE-2006-0402](https://cve.now/CVE-2006-0402.md): SQL injection vulnerability in Zoph before 0.5pre1 allows remote attackers to execute arbitrary SQL commands. (no CVSS)
- [CVE-2006-0403](https://cve.now/CVE-2006-0403.md): Multiple SQL injection vulnerabilities in e-moBLOG 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) monthy parameter (no CVSS)
- [CVE-2006-0404](https://cve.now/CVE-2006-0404.md): Note-A-Day Weblog 2.2 stores sensitive data under the web document root with insufficient access control, which allows remote attackers to o (no CVSS)
- [CVE-2006-0405](https://cve.now/CVE-2006-0405.md): The TIFFFetchShortPair function in tif\_dirread.c in libtiff 3.8.0 allows remote attackers to cause a denial of service (application crash) v (no CVSS)
- [CVE-2006-0406](https://cve.now/CVE-2006-0406.md): search.php in MyBB 1.0.2 allows remote attackers to obtain sensitive information via a certain search request that reveals the table prefix (no CVSS)
- [CVE-2006-0407](https://cve.now/CVE-2006-0407.md): Cross-site scripting (XSS) vulnerability in post.php in AZ Bulletin Board (AZbb) 1.1.00 and earlier allows remote attackers to inject arbitr (no CVSS)
- [CVE-2006-0408](https://cve.now/CVE-2006-0408.md): rsh utility in Sun Grid Engine (SGE) before 6.0u7\_1 allows local users to gain privileges and execute arbitrary code via unspecified vectors (no CVSS)
- [CVE-2006-0409](https://cve.now/CVE-2006-0409.md): Cross-site scripting (XSS) vulnerability in index.php in Pixelpost Photoblog 1.4.3 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-0410](https://cve.now/CVE-2006-0410.md): SQL injection vulnerability in ADOdb before 4.71, when using PostgreSQL, allows remote attackers to execute arbitrary SQL commands via unspe (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-01-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.