# CVEs published 2006-03-09

58 CVEs were published on March 9, 2006: 0 critical, 1 high. Days are UTC.

- [CVE-2006-1126](https://cve.now/CVE-2006-1126.md): Gallery 2 up to 2.0.2 allows remote attackers to spoof their IP address via a modified X-Forwarded-For (X\_FORWARDED\_FOR) HTTP header, which (no CVSS)
- [CVE-2006-1127](https://cve.now/CVE-2006-1127.md): Cross-site scripting (XSS) vulnerability in Gallery 2 up to 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the X-F (no CVSS)
- [CVE-2006-1128](https://cve.now/CVE-2006-1128.md): Directory traversal vulnerability in the session handling class (GallerySession.class) in Gallery 2 up to 2.0.2 allows remote attackers to a (no CVSS)
- [CVE-2006-1120](https://cve.now/CVE-2006-1120.md): Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 6.1.1 and earlier, with register\_globals enabled, allow remote attackers t (no CVSS)
- [CVE-2006-1121](https://cve.now/CVE-2006-1121.md): Cross-site scripting (XSS) vulnerability in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the query stri (no CVSS)
- [CVE-2006-1122](https://cve.now/CVE-2006-1122.md): Cross-site scripting (XSS) vulnerability in Default.asp in D2KBlog 1.0.3 and earlier allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2006-1123](https://cve.now/CVE-2006-1123.md): SQL injection vulnerability in D2KBlog 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the memName parameter (no CVSS)
- [CVE-2006-1124](https://cve.now/CVE-2006-1124.md): Buffer overflow in RevilloC MailServer and Proxy 1.21 allows remote attackers to execute arbitrary code via a long USER command. (no CVSS)
- [CVE-2006-1125](https://cve.now/CVE-2006-1125.md): Grisoft AVG Free 7.1, and other versions including 7.0.308, sets Everyone/Full Control permissions for certain update files including (1) up (no CVSS)
- [CVE-2006-0743](https://cve.now/CVE-2006-0743.md): Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory (no CVSS, log4net)
- [CVE-2006-1119](https://cve.now/CVE-2006-1119.md): fantastico in Cpanel does not properly handle when it has insufficient permissions to perform certain file operations, which allows remote a (no CVSS)
- [CVE-2005-4728](https://cve.now/CVE-2005-4728.md): Untrusted search path vulnerability (RPATH) in amaya 9.2.1 on Debian GNU/Linux allows local users to gain privileges via a malicious Mesa li (no CVSS)
- [CVE-2006-0742](https://cve.now/CVE-2006-0742.md): The die\_if\_kernel function in arch/ia64/kernel/unaligned.c in Linux kernel 2.6.x before 2.6.15.6, possibly when compiled with certain versio (no CVSS)
- [CVE-2006-1089](https://cve.now/CVE-2006-1089.md): Cross-site scripting (XSS) vulnerability in header.php in PunBB 1.2.10 allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2006-1090](https://cve.now/CVE-2006-1090.md): register.php in PunBB 1.2.10 allows remote attackers to cause an unspecified denial of service via a flood of new user registrations. (no CVSS)
- [CVE-2006-1091](https://cve.now/CVE-2006-1091.md): Kaspersky Antivirus 5.0.5 and 5.5.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via unknown attack vec (no CVSS)
- [CVE-2006-1092](https://cve.now/CVE-2006-1092.md): Unspecified vulnerability in the pagedata subsystem of the process file system (/proc) in Solaris 8 through 10 allows local users to cause a (no CVSS)
- [CVE-2006-1093](https://cve.now/CVE-2006-1093.md): Unspecified vulnerability in IBM WebSphere 5.0.2.10 through 5.0.2.15 and 5.1.1.4 through 5.1.1.9 allows remote attackers to obtain sensitive (no CVSS)
- [CVE-2006-1094](https://cve.now/CVE-2006-1094.md): SQL injection vulnerability in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2006-1095](https://cve.now/CVE-2006-1095.md): Directory traversal vulnerability in the FileSession object in Mod\_python module 3.2.7 for Apache allows local users to execute arbitrary co (no CVSS)
- [CVE-2006-1096](https://cve.now/CVE-2006-1096.md): Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2006-1097](https://cve.now/CVE-2006-1097.md): Multiple cross-site scripting (XSS) vulnerabilities in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allow remote attackers to inj (no CVSS)
- [CVE-2006-1098](https://cve.now/CVE-2006-1098.md): Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the (1) informationID or (no CVSS)
- [CVE-2006-1099](https://cve.now/CVE-2006-1099.md): PHP remote file include vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the pg paramet (no CVSS)
- [CVE-2006-1100](https://cve.now/CVE-2006-1100.md): Buffer overflow in the sgetstr function in shared/cube.h in Sauerbraten 2006\_02\_28 and earlier, as derived from the Cube engine, allows remo (no CVSS)
- [CVE-2006-1101](https://cve.now/CVE-2006-1101.md): The (1) sgetstr and (2) getint functions in Sauerbraten 2006\_02\_28, as derived from the Cube engine, allow remote attackers to cause a denia (no CVSS)
- [CVE-2006-1102](https://cve.now/CVE-2006-1102.md): Sauerbraten 2006\_02\_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (client exit) by forcing the s (no CVSS)
- [CVE-2006-1103](https://cve.now/CVE-2006-1103.md): engine/server.cpp in Sauerbraten 2006\_02\_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (segmenta (no CVSS)
- [CVE-2006-1104](https://cve.now/CVE-2006-1104.md): Multiple SQL injection vulnerabilities in Pixelpost 1.5 beta 1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) (no CVSS)
- [CVE-2006-1105](https://cve.now/CVE-2006-1105.md): Pixelpost 1.5 beta 1 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, w (no CVSS)
- [CVE-2006-1106](https://cve.now/CVE-2006-1106.md): Cross-site scripting (XSS) vulnerability in Pixelpost 1.5 beta 1 and earlier allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-1107](https://cve.now/CVE-2006-1107.md): Cross-site scripting (XSS) vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-1108](https://cve.now/CVE-2006-1108.md): SQL injection vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parame (no CVSS)
- [CVE-2006-1109](https://cve.now/CVE-2006-1109.md): SQL injection vulnerability in index.asp in Total Ecommerce 1.0 allows remote attackers to execute arbitrary SQL commands via the id paramet (no CVSS)
- [CVE-2006-1110](https://cve.now/CVE-2006-1110.md): Cross-site scripting (XSS) vulnerability in Aztek Forum 4.0 allows remote attackers to inject arbitrary web script or HTML via the message b (no CVSS)
- [CVE-2006-1111](https://cve.now/CVE-2006-1111.md): Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a "\*/\*" in the msg parameter to index.php, which reveals usernam (no CVSS)
- [CVE-2006-1112](https://cve.now/CVE-2006-1112.md): Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a long login value in a register form, which displays the instal (no CVSS)
- [CVE-2006-1113](https://cve.now/CVE-2006-1113.md): SQL injection vulnerability in podcast.php in Loudblog before 0.42 allows remote attackers to execute arbitrary SQL commands via the id para (no CVSS)
- [CVE-2006-1114](https://cve.now/CVE-2006-1114.md): Multiple directory traversal vulnerabilities in Loudblog before 0.42 allow remote attackers to read or include arbitrary files via a .. (no CVSS)
- [CVE-2006-1115](https://cve.now/CVE-2006-1115.md): nCipher HSM before 2.22.6, when generating a Diffie-Hellman public/private key pair without any specified DiscreteLogGroup parameters, choos (no CVSS)
- [CVE-2006-1116](https://cve.now/CVE-2006-1116.md): The CBC-MAC integrity functions in the nCipher nCore API before 2.18 transmit the initialization vector IV as part of a message when the imp (no CVSS)
- [CVE-2006-1117](https://cve.now/CVE-2006-1117.md): nCipher firmware before V10, as used by (1) nShield, (2) nForce, (3) netHSM, (4) payShield, (5) SecureDB, (6) DSE200 Document Sealing Engine (no CVSS)
- [CVE-2006-1118](https://cve.now/CVE-2006-1118.md): SQL injection vulnerability in bmail before Aardvark PR9.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors (no CVSS)
- [CVE-2006-0746](https://cve.now/CVE-2006-0746.md): Certain patches for kpdf do not include all relevant patches from xpdf that were associated with CVE-2005-3627, which allows context-depende (no CVSS)
- [CVE-2006-1074](https://cve.now/CVE-2006-1074.md): Jason Boettcher Liero Xtreme 0.62b and earlier allow remote attackers to cause a denial of service (application crash or hang) via a long ar (no CVSS)
- [CVE-2006-1075](https://cve.now/CVE-2006-1075.md): Format string vulnerability in the visualization function in Jason Boettcher Liero Xtreme 0.62b and earlier allows remote attackers to execu (no CVSS)
- [CVE-2006-1076](https://cve.now/CVE-2006-1076.md): SQL injection vulnerability in index.php, possibly during a showtopic operation, in Invision Power Board (IPB) 2.1.5 allows remote attackers (no CVSS)
- [CVE-2006-1077](https://cve.now/CVE-2006-1077.md): Multiple cross-site scripting (XSS) vulnerabilities in the commentary in Evo-Dev evoBlog allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2006-1078](https://cve.now/CVE-2006-1078.md): Multiple buffer overflows in htpasswd, as used in Acme thttpd 2.25b, and possibly other products such as Apache, might allow local users to (CVSS 8.4)
- [CVE-2006-1079](https://cve.now/CVE-2006-1079.md): htpasswd, as used in Acme thttpd 2.25b and possibly other products such as Apache, might allow local users to gain privileges via shell meta (no CVSS)
- [CVE-2006-1080](https://cve.now/CVE-2006-1080.md): Cross-site scripting (XSS) vulnerability in login.php in Game-Panel 2.6.1 and earlier allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2006-1081](https://cve.now/CVE-2006-1081.md): SQL injection vulnerability in forgotten\_password.php in Jonathan Beckett PluggedOut Nexus 0.1 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2006-1082](https://cve.now/CVE-2006-1082.md): Multiple cross-site scripting (XSS) vulnerabilities in phpArcadeScript 2.0 and earlier allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2006-1083](https://cve.now/CVE-2006-1083.md): Multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to read and possibly execute arbitrary (no CVSS)
- [CVE-2006-1084](https://cve.now/CVE-2006-1084.md): Multiple SQL injection vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the (no CVSS)
- [CVE-2006-1085](https://cve.now/CVE-2006-1085.md): admin.php in PHP-Stats 0.1.9.1 and earlier allows remote attackers to bypass authentication, gain administrator privileges, and execute arbi (no CVSS)
- [CVE-2006-1087](https://cve.now/CVE-2006-1087.md): Direct static code injection vulnerability in the modify\_config action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenti (no CVSS)
- [CVE-2006-1088](https://cve.now/CVE-2006-1088.md): PHP-Stats 0.1.9.1 and earlier allows remote attackers to obtain potentially sensitive information via a direct request to checktables.php, w (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-03-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.