# CVEs published 2006-02-01

60 CVEs were published on February 1, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-0505](https://cve.now/CVE-2006-0505.md): zbattle.net Zbattle client 1.09 SR-1 beta allows remote attackers to cause an unspecified denial of service by rapidly creating and closing (no CVSS)
- [CVE-2006-0506](https://cve.now/CVE-2006-0506.md): Cross-site scripting (XSS) vulnerability in index.php in Nuked-klaN 1.7 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2006-0507](https://cve.now/CVE-2006-0507.md): Multiple cross-site scripting (XSS) vulnerabilities in Easy CMS allow remote attackers to inject arbitrary web script or HTML via (1) unknow (no CVSS)
- [CVE-2006-0508](https://cve.now/CVE-2006-0508.md): Easy CMS stores the images directory under the web document root with insufficient access control and browsing enabled, which allows remote (no CVSS)
- [CVE-2006-0509](https://cve.now/CVE-2006-0509.md): Multiple cross-site scripting (XSS) vulnerabilities in clients.php in Cerberus Helpdesk, possibly 2.7, allow remote attackers to inject arbi (no CVSS)
- [CVE-2006-0510](https://cve.now/CVE-2006-0510.md): SQL injection vulnerability in userlogin.jsp in Daffodil CRM 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified p (no CVSS)
- [CVE-2006-0511](https://cve.now/CVE-2006-0511.md): Blackboard Academic Suite 6.0 and earlier does not properly clear session information when de-authenticating a user who is idle, which allow (no CVSS)
- [CVE-2005-4536](https://cve.now/CVE-2005-4536.md): Mail::Audit module in libmail-audit-perl 2.1-5, when logging is enabled without a default log file specified, uses predictable log filenames (no CVSS)
- [CVE-2006-0499](https://cve.now/CVE-2006-0499.md): Cross-site scripting (XSS) vulnerability in rlink.php in Rlink 1.0.0 module for phpBB allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2006-0500](https://cve.now/CVE-2006-0500.md): MyCO Guestbook 1.0 stores the admin directory under the web document root with insufficient access control, which allows remote attackers to (no CVSS)
- [CVE-2006-0501](https://cve.now/CVE-2006-0501.md): Cross-site scripting (XSS) vulnerability in MyCO Guestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the Name f (no CVSS)
- [CVE-2006-0502](https://cve.now/CVE-2006-0502.md): PHP remote file inclusion vulnerability in loginout.php in FarsiNews 2.1 Beta 2 and earlier, with register\_globals enabled, allows remote at (no CVSS)
- [CVE-2006-0503](https://cve.now/CVE-2006-0503.md): IMAP service in MailEnable Professional Edition before 1.72 allows remote attackers to cause a denial of service (service crash) via unspeci (no CVSS)
- [CVE-2006-0504](https://cve.now/CVE-2006-0504.md): Unspecified vulnerability in MailEnable Enterprise Edition before 1.2 allows remote attackers to cause a denial of service (CPU utilization) (no CVSS)
- [CVE-2003-1291](https://cve.now/CVE-2003-1291.md): VMware ESX Server 1.5.2 before Patch 4 allows local users to execute arbitrary programs as root via certain modified VMware ESX Server envir (no CVSS)
- [CVE-2005-4692](https://cve.now/CVE-2005-4692.md): Unspecified vulnerability in mroovca stats (mroovcastats) before 0.4.5b has unknown attack vectors and impact, related to cookies. (no CVSS)
- [CVE-2005-4693](https://cve.now/CVE-2005-4693.md): Gaim-Encryption 2.38-1 on Debian Linux allows remote attackers to cause a denial of service (crash) via a crafted message from an ICQ buddy, (no CVSS)
- [CVE-2005-4694](https://cve.now/CVE-2005-4694.md): Unspecified vulnerability in the www\_add method in Asset.pm in Plain Black WebGUI 6.3.0 and other versions before 6.7.6 allows attackers to (no CVSS)
- [CVE-2005-4695](https://cve.now/CVE-2005-4695.md): Symantec Brightmail AntiSpam 6.0 build 1 and 2 allows remote attackers to cause a denial of service (bmserver component termination) via mal (no CVSS)
- [CVE-2005-4696](https://cve.now/CVE-2005-4696.md): The Microsoft Wireless Zero Configuration system (WZCS) stores WEP keys and pair-wise Master Keys (PMK) of the WPA pre-shared key in plainte (no CVSS)
- [CVE-2005-4697](https://cve.now/CVE-2005-4697.md): The Microsoft Wireless Zero Configuration system (WZCS) allows local users to access WEP keys and pair-wise Master Keys (PMK) of the WPA pre (no CVSS)
- [CVE-2005-4698](https://cve.now/CVE-2005-4698.md): Cross-site scripting (XSS) vulnerability in TellMe 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the 91 (no CVSS)
- [CVE-2005-4699](https://cve.now/CVE-2005-4699.md): Argument injection vulnerability in TellMe 1.2 and earlier allows remote attackers to modify command line arguments for the Whois program an (no CVSS)
- [CVE-2005-4700](https://cve.now/CVE-2005-4700.md): TellMe 1.2 and earlier, when the Server (o\_Server) and HEAD (o\_Head) options are enabled, allows remote attackers to obtain sensitive inform (no CVSS)
- [CVE-2005-4701](https://cve.now/CVE-2005-4701.md): Unspecified vulnerability in Process File System (procfs) in Sun Solaris 10 allows local users to obtain sensitive information such as proce (no CVSS)
- [CVE-2005-4702](https://cve.now/CVE-2005-4702.md): SQL injection vulnerability in the favorites module in index.php in IPBProArcade 2.5.2 allows remote attackers to inject arbitrary SQL comma (no CVSS)
- [CVE-2005-4703](https://cve.now/CVE-2005-4703.md): Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2005-4704](https://cve.now/CVE-2005-4704.md): Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 through SP3, 7.0 through SP6, and 6.1 through SP7, when SSL is int (no CVSS)
- [CVE-2005-4705](https://cve.now/CVE-2005-4705.md): BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java client application creates an SS (no CVSS)
- [CVE-2005-4706](https://cve.now/CVE-2005-4706.md): Unspecified vulnerability in the "privilege management" feature of Sun Solaris 10 allows local users to cause a denial of service (panic) vi (no CVSS)
- [CVE-2005-4707](https://cve.now/CVE-2005-4707.md): Multiple cross-site scripting (XSS) vulnerabilities in PHP GEN before 1.3 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2006-0497](https://cve.now/CVE-2006-0497.md): Multiple SQL injection vulnerabilities in PHP GEN before 1.4 allow remote attackers to inject arbitrary SQL commands via unknown attack vect (no CVSS)
- [CVE-2006-0498](https://cve.now/CVE-2006-0498.md): Multiple cross-site scripting (XSS) vulnerabilities in PHP GEN before 1.4 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2005-4677](https://cve.now/CVE-2005-4677.md): SQL injection vulnerability in additional\_images.php (aka the Additional Images module) before 1.14 in osCommerce allows remote attackers to (no CVSS)
- [CVE-2005-4678](https://cve.now/CVE-2005-4678.md): Apple Safari 2.0.2 (aka 416.12) allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted (no CVSS)
- [CVE-2005-4679](https://cve.now/CVE-2005-4679.md): Internet Explorer 6 for Windows XP Service Pack 2 allows remote attackers to spoof the URL in the status bar via the title in an image in a (no CVSS)
- [CVE-2005-4680](https://cve.now/CVE-2005-4680.md): Sophos Anti-Virus before 4.02, 4.5.x before 4.5.9, 4.6.x before 4.6.9, and 5.x before 5.1.4 allow remote attackers to hide arbitrary files a (no CVSS)
- [CVE-2005-4681](https://cve.now/CVE-2005-4681.md): Buffer overflow in mIRC 5.91, 6.03, 6.12, and 6.16 allows local users to execute arbitrary code via a long string that is entered after reac (no CVSS)
- [CVE-2005-4682](https://cve.now/CVE-2005-4682.md): Cross-site scripting (XSS) vulnerability in error.asp in AudienceView allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2005-4683](https://cve.now/CVE-2005-4683.md): PADL MigrationTools 46, when a failure occurs, stores contents of /etc/shadow in a world-readable /tmp/nis.$$.ldif file, and possibly other (no CVSS)
- [CVE-2005-4684](https://cve.now/CVE-2005-4684.md): Konqueror can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote a (no CVSS)
- [CVE-2005-4685](https://cve.now/CVE-2005-4685.md): Firefox and Mozilla can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allow (no CVSS)
- [CVE-2005-4686](https://cve.now/CVE-2005-4686.md): PunBB 1.2.9, when used alone or with F-ART BLOG:CMS, includes config.php before calling the unregister\_globals function, which allows attack (no CVSS)
- [CVE-2005-4687](https://cve.now/CVE-2005-4687.md): PunBB 1.2.9, used alone or with F-ART BLOG:CMS, may trust a client's IP address as specified in the X-Forwarded-For HTTP header rather than (no CVSS)
- [CVE-2005-4688](https://cve.now/CVE-2005-4688.md): PunBB 1.2.9 does not require password entry when changing the e-mail address in an account's profile, which might allow an attacker to make (no CVSS)
- [CVE-2005-4689](https://cve.now/CVE-2005-4689.md): Six Apart Movable Type 3.16 stores account names and password hashes in a cookie, which allows remote attackers to login to an account by sn (no CVSS)
- [CVE-2005-4690](https://cve.now/CVE-2005-4690.md): Six Apart Movable Type 3.16 allows local users with blog-creation privileges to create or overwrite arbitrary files of certain types (such a (no CVSS)
- [CVE-2005-4691](https://cve.now/CVE-2005-4691.md): imake in NetBSD before 2.0.3, NetBSD-current before 12 September 2005, certain versions of X.Org, and certain versions of XFree86 allows loc (no CVSS)
- [CVE-2006-0485](https://cve.now/CVE-2006-0485.md): The TCL shell in Cisco IOS 12.2(14)S before 12.2(14)S16, 12.2(18)S before 12.2(18)S11, and certain other releases before 25 January 2006 doe (no CVSS)
- [CVE-2006-0486](https://cve.now/CVE-2006-0486.md): Certain Cisco IOS releases in 12.2S based trains with maintenance release number 25 and later, 12.3T based trains, and 12.4 based trains reu (no CVSS)
- [CVE-2006-0487](https://cve.now/CVE-2006-0487.md): Multiple unspecified vulnerabilities in Tumbleweed MailGate Email Firewall (EMF) 6.x allow remote attackers to (1) trigger temporarily incor (no CVSS)
- [CVE-2006-0488](https://cve.now/CVE-2006-0488.md): The VDM (Virtual DOS Machine) emulation environment for MS-DOS applications in Windows 2000, Windows XP SP2, and Windows Server 2003 allows (no CVSS)
- [CVE-2006-0489](https://cve.now/CVE-2006-0489.md): Buffer overflow in the font command of mIRC, probably 6.16, allows local users to execute arbitrary code via a long string. (no CVSS)
- [CVE-2006-0490](https://cve.now/CVE-2006-0490.md): SQL injection vulnerability in login.asp in ASPThai.Net ASPThai Forums 8.0 and earlier allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2006-0491](https://cve.now/CVE-2006-0491.md): SQL injection vulnerability in SZUserMgnt.class.php in SZUserMgnt 1.4 allows remote attackers to execute arbitrary SQL commands via the user (no CVSS)
- [CVE-2006-0492](https://cve.now/CVE-2006-0492.md): Multiple SQL injection vulnerabilities in Calendarix allow remote attackers to execute arbitrary SQL commands via (1) the catview parameter (no CVSS)
- [CVE-2006-0493](https://cve.now/CVE-2006-0493.md): Cross-site scripting (XSS) vulnerability in MG2 (formerly known as Minigal) 0.5.1 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-0494](https://cve.now/CVE-2006-0494.md): Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.02 allows local users with MyBB administrative privileges to include and p (no CVSS)
- [CVE-2006-0495](https://cve.now/CVE-2006-0495.md): Cross-site scripting (XSS) vulnerability in the Add Thread to Favorites feature in usercp2.php in MyBB (aka MyBulletinBoard) 1.02 allows rem (no CVSS)
- [CVE-2006-0496](https://cve.now/CVE-2006-0496.md): Cross-site scripting (XSS) vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-02-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.