# CVEs published 2006-02-28

35 CVEs were published on February 28, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-0909](https://cve.now/CVE-2006-0909.md): Invision Power Board (IPB) 2.1.4 and earlier allows remote attackers to view sensitive information via a direct request to multiple PHP scri (no CVSS)
- [CVE-2006-0910](https://cve.now/CVE-2006-0910.md): Invision Power Board (IPB) 2.1.4 and earlier allows remote attackers to list directory contents via a direct request to multiple directories (no CVSS)
- [CVE-2006-0911](https://cve.now/CVE-2006-0911.md): NmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of service (CPU consumption) via crafted reque (no CVSS)
- [CVE-2006-0912](https://cve.now/CVE-2006-0912.md): Oreka before 0.5 allows remote attackers to cause a denial of service (application crash) via a "certain RTP sequence." (no CVSS)
- [CVE-2006-0913](https://cve.now/CVE-2006-0913.md): SQL injection vulnerability in whineatnews.pl in Bugzilla 2.17 through 2.18.4 and 2.20 allows remote authenticated users with administrative (no CVSS)
- [CVE-2006-0914](https://cve.now/CVE-2006-0914.md): Bugzilla 2.16.10, 2.17 through 2.18.4, and 2.20 does not properly handle certain characters in the mostfreqthreshold parameter in duplicates (no CVSS)
- [CVE-2006-0915](https://cve.now/CVE-2006-0915.md): Bugzilla 2.16.10 does not properly handle certain characters in the (1) maxpatchsize and (2) maxattachmentsize parameters in attachment.cgi, (no CVSS)
- [CVE-2006-0916](https://cve.now/CVE-2006-0916.md): Bugzilla 2.19.3 through 2.20 does not properly handle "//" sequences in URLs when redirecting a user from the login form, which could cause (no CVSS)
- [CVE-2006-0917](https://cve.now/CVE-2006-0917.md): Melange Chat Server (aka M-Chat), when accessed via a web browser, automatically sends cookies and other sensitive information for a server (no CVSS)
- [CVE-2006-0918](https://cve.now/CVE-2006-0918.md): Buffer overflow in RITLabs The Bat! 3.60.07 allows remote attackers to execute arbitrary code via a long Subject field. (no CVSS)
- [CVE-2006-0919](https://cve.now/CVE-2006-0919.md): SQL injection vulnerability in index.php (aka the login page) in Oi! Email Marketing System 3.0 (aka Oi! 3) allows remote attackers to execu (no CVSS)
- [CVE-2006-0920](https://cve.now/CVE-2006-0920.md): Oi! Email Marketing System 3.0 (aka Oi! 3) stores the server's FTP password in cleartext on a Configuration web page, which allows local use (no CVSS)
- [CVE-2006-0921](https://cve.now/CVE-2006-0921.md): Multiple directory traversal vulnerabilities in connector.php in FCKeditor 2.0 FC, as used in products such as RunCMS, allow remote attacker (no CVSS)
- [CVE-2006-0922](https://cve.now/CVE-2006-0922.md): CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, whic (no CVSS)
- [CVE-2006-0923](https://cve.now/CVE-2006-0923.md): Multiple cross-site scripting (XSS) vulnerabilities in MyPHPNuke (MPN) 1.88 and earlier allow remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2006-0924](https://cve.now/CVE-2006-0924.md): Cross-site scripting (XSS) vulnerability in Brown Bear iCal 3.10 allows remote attackers to inject arbitrary web script or HTML via the Cale (no CVSS)
- [CVE-2006-0925](https://cve.now/CVE-2006-0925.md): Format string vulnerability in the IMAP4rev1 server in Alt-N MDaemon 8.1.1 and possibly 8.1.4 allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2006-0926](https://cve.now/CVE-2006-0926.md): Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0, ZipMagic Deluxe 9.0, and StuffIt Expander 9.0.0.21 E (no CVSS)
- [CVE-2006-0927](https://cve.now/CVE-2006-0927.md): Multiple cross-site scripting (XSS) vulnerabilities in the JGS-XA JGS-Gallery Addon 4.0.0 and earlier for Woltlab Burning Board (wBB) 2.x al (no CVSS)
- [CVE-2006-0928](https://cve.now/CVE-2006-0928.md): The POP3 Server in ArGoSoft Mail Server Pro 1.8 allows remote attackers to obtain sensitive information via the \_DUMP command, which reveals (no CVSS)
- [CVE-2006-0929](https://cve.now/CVE-2006-0929.md): Directory traversal vulnerability in the IMAP server in ArGoSoft Mail Server Pro 1.8.8.1 allows remote authenticated users to create arbitra (no CVSS)
- [CVE-2006-0930](https://cve.now/CVE-2006-0930.md): Directory traversal vulnerability in Webmail in ArGoSoft Mail Server Pro 1.8 allows remote authenticated users to read arbitrary files via a (no CVSS)
- [CVE-2006-0931](https://cve.now/CVE-2006-0931.md): Directory traversal vulnerability in PEAR::Archive\_Tar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite (no CVSS, pear/archive\_tar)
- [CVE-2006-0932](https://cve.now/CVE-2006-0932.md): Directory traversal vulnerability in zip.lib.php 0.1.1 in PEAR::Archive\_Zip allows remote attackers to create and overwrite arbitrary files (no CVSS)
- [CVE-2006-0933](https://cve.now/CVE-2006-0933.md): Cross-site scripting (XSS) vulnerability in PHPX 3.5.9 allows remote attackers to inject arbitrary web script or HTML via a javascript URI i (no CVSS)
- [CVE-2006-0934](https://cve.now/CVE-2006-0934.md): Cross-site scripting (XSS) vulnerability in webinsta Limbo 1.0.4.2 allows remote attackers to inject arbitrary web script or HTML via the me (no CVSS)
- [CVE-2006-0935](https://cve.now/CVE-2006-0935.md): Microsoft Word 2003 allows remote attackers to cause a denial of service (application crash) via a crafted file, as demonstrated by 101\_file (no CVSS)
- [CVE-2006-0936](https://cve.now/CVE-2006-0936.md): Free Host Shop Website Generator 3.3 allows remote authenticated users with administrative privileges to upload and execute arbitrary files (no CVSS)
- [CVE-2006-0937](https://cve.now/CVE-2006-0937.md): U.N.U. (no CVSS)
- [CVE-2006-0906](https://cve.now/CVE-2006-0906.md): SQL injection vulnerability in D3Jeeb Pro 3 allows remote attackers to execute arbitrary SQL commands via the catid parameter in (1) fastlin (no CVSS)
- [CVE-2006-0907](https://cve.now/CVE-2006-0907.md): SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/ (no CVSS)
- [CVE-2006-0908](https://cve.now/CVE-2006-0908.md): PHP-Nuke 7.8 Patched 3.2 allows remote attackers to bypass SQL injection protection mechanisms via /%2a (/\*) sequences with the "ad\_click" w (no CVSS)
- [CVE-2003-0885](https://cve.now/CVE-2003-0885.md): Xscreensaver 4.14 contains certain debugging code that should have been omitted, which causes Xscreensaver to create temporary files insecur (no CVSS)
- [CVE-2003-1294](https://cve.now/CVE-2003-1294.md): Xscreensaver before 4.15 creates temporary files insecurely in (1) driver/passwd-kerberos.c, (2) driver/xscreensaver-getimage-video, (3) dri (no CVSS)
- [CVE-2003-1295](https://cve.now/CVE-2003-1295.md): Unspecified vulnerability in xscreensaver 4.12, and possibly other versions, allows attackers to cause xscreensaver to crash via unspecified (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-02-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.