# CVEs published 2006-03-30

37 CVEs were published on March 30, 2006: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2006-1550](https://cve.now/CVE-2006-1550.md): Multiple buffer overflows in the xfig import code (xfig-import.c) in Dia 0.87 and later before 0.95-pre6 allow user-assisted attackers to ha (no CVSS)
- [CVE-2006-1546](https://cve.now/CVE-2006-1546.md): Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.ta (no CVSS, struts:struts)
- [CVE-2006-1547](https://cve.now/CVE-2006-1547.md): ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service v (CVSS 7.5, KEV, struts:struts)
- [CVE-2006-1548](https://cve.now/CVE-2006-1548.md): Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Soft (no CVSS, struts:struts)
- [CVE-2006-1059](https://cve.now/CVE-2006-1059.md): The winbindd daemon in Samba 3.0.21 to 3.0.21c writes the machine trust account password in cleartext in log files, which allows local users (no CVSS)
- [CVE-2006-1532](https://cve.now/CVE-2006-1532.md): Cross-site scripting (XSS) vulnerability in search.php in PHP Classifieds 6.18, 6.20, and possibly other versions, allows remote attackers t (no CVSS)
- [CVE-2006-1533](https://cve.now/CVE-2006-1533.md): SQL injection vulnerability in newsletter.php in Sourceworkshop newsletter 1.0 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2006-1534](https://cve.now/CVE-2006-1534.md): Multiple SQL injection vulnerabilities in Null news allow remote attackers to execute arbitrary SQL commands via (1) the user\_email paramete (no CVSS)
- [CVE-2006-1535](https://cve.now/CVE-2006-1535.md): Cross-site scripting (XSS) vulnerability in login.php in Phoetux.net PhxContacts 0.93.1 beta and earlier allows remote attackers to inject a (no CVSS)
- [CVE-2006-1536](https://cve.now/CVE-2006-1536.md): Multiple SQL injection vulnerabilities in Phoetux.net PhxContacts 0.93.1 beta and earlier allow remote attackers to execute arbitrary SQL co (no CVSS)
- [CVE-2006-1537](https://cve.now/CVE-2006-1537.md): Craig Knudsen WebCalendar 1.1.0-CVS allows remote attackers to obtain sensitive information via a direct request to (1) includes/index.php, (no CVSS)
- [CVE-2006-1538](https://cve.now/CVE-2006-1538.md): The Enova X-Wall ASIC encrypts with a key obtained via Microwire from a serial EEPROM that stores the key in cleartext, which allows local u (no CVSS)
- [CVE-2006-1539](https://cve.now/CVE-2006-1539.md): Multiple buffer overflows in the checkscores function in scores.c in tetris-bsd in bsd-games before 2.17-r1 in Gentoo Linux might allow loca (no CVSS)
- [CVE-2006-1540](https://cve.now/CVE-2006-1540.md): MSO.DLL in Microsoft Office 2000, Office XP (2002), and Office 2003 allows user-assisted attackers to cause a denial of service and execute (no CVSS)
- [CVE-2006-1541](https://cve.now/CVE-2006-1541.md): SQL injection vulnerability in Default.asp in EzASPSite 2.0 RC3 and earlier allows remote attackers to execute arbitrary SQL commands and ob (no CVSS)
- [CVE-2006-1542](https://cve.now/CVE-2006-1542.md): Stack-based buffer overflow in Python 2.4.2 and earlier, running on Linux 2.6.12.5 under gcc 4.0.3 with libc 2.3.5, allows local users to ca (no CVSS)
- [CVE-2006-1543](https://cve.now/CVE-2006-1543.md): Multiple SQL injection vulnerabilities in vscripts (aka Kuba Kunkiewicz) VNews 1.2 allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2006-1544](https://cve.now/CVE-2006-1544.md): Multiple cross-site scripting (XSS) vulnerabilities in news.php in vscripts (aka Kuba Kunkiewicz) VNews 1.2 allow remote attackers to inject (no CVSS)
- [CVE-2006-1545](https://cve.now/CVE-2006-1545.md): Direct static code injection vulnerability in admin/config.php in vscripts (aka Kuba Kunkiewicz) VNews 1.2 allows remote authenticated admin (no CVSS)
- [CVE-2005-4748](https://cve.now/CVE-2005-4748.md): PHP remote file include vulnerability in functions\_admin.php in Virtual War (VWar) 1.5.0 R10 allows remote attackers to include and execute (no CVSS)
- [CVE-2006-1503](https://cve.now/CVE-2006-1503.md): PHP remote file inclusion vulnerability in includes/functions\_install.php in Virtual War (VWar) 1.5.0 R11 and earlier allows remote attacker (no CVSS)
- [CVE-2006-1504](https://cve.now/CVE-2006-1504.md): Multiple cross-site scripting (XSS) vulnerabilities in Arab Portal 2.0 (aka Arab Dynamic Portal or ADP) stable allow remote attackers to inj (no CVSS)
- [CVE-2006-1505](https://cve.now/CVE-2006-1505.md): base\_maintenance.php in Basic Analysis and Security Engine (BASE) before 1.2.4 (melissa), when running in standalone mode, allows remote att (no CVSS)
- [CVE-2006-1506](https://cve.now/CVE-2006-1506.md): Unspecified vulnerability in rsh in Sun Microsystems Sun Grid Engine 5.3 before 20060327 and N1 Grid Engine 6.0 before 20060327 allows local (no CVSS)
- [CVE-2006-1507](https://cve.now/CVE-2006-1507.md): Cross-site scripting (XSS) vulnerability in PHPKIT 1.6.03 allows remote attackers to inject arbitrary web script or HTML via the error param (no CVSS)
- [CVE-2006-1508](https://cve.now/CVE-2006-1508.md): Multiple cross-site scripting (XSS) vulnerabilities in MH Software Connect Daily Web Calendar Software 3.2.9 and earlier allow remote attack (no CVSS)
- [CVE-2006-1509](https://cve.now/CVE-2006-1509.md): /sbin/passwd in HP-UX B.11.00, B.11.11, and B.11.23 before 20060326 "does not recover gracefully from some error conditions," which allows l (no CVSS)
- [CVE-2006-1510](https://cve.now/CVE-2006-1510.md): Buffer overflow in calloc.c in the Microsoft Windows XP SP2 ntdll.dll system library, when used by the ILDASM disassembler in the Microsoft (no CVSS)
- [CVE-2006-1511](https://cve.now/CVE-2006-1511.md): Buffer overflow in the ILASM assembler in the Microsoft .NET 1.0 and 1.1 Framework might allow user-assisted attackers to execute arbitrary (no CVSS)
- [CVE-2006-1495](https://cve.now/CVE-2006-1495.md): SQL injection vulnerability in general/sendpassword.php in (1) PHPCollab 2.4 and 2.5.rc3, and (2) NetOffice 2.5.3-pl1 and 2.6.0b2 allows rem (no CVSS)
- [CVE-2006-1496](https://cve.now/CVE-2006-1496.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in ViHor Design allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2006-1497](https://cve.now/CVE-2006-1497.md): Directory traversal vulnerability in index.php in ViHor Design allows remote attackers to read arbitrary files via the page parameter. (no CVSS)
- [CVE-2006-1498](https://cve.now/CVE-2006-1498.md): Cross-site scripting (XSS) vulnerability in MediaWiki before 1.5.8 and 1.4.15 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-1499](https://cve.now/CVE-2006-1499.md): SQL injection vulnerability in vCounter.php in vCounter 1.0 allows remote attackers to execute arbitrary SQL commands via the URI (\_SERVER\[R (no CVSS)
- [CVE-2006-1500](https://cve.now/CVE-2006-1500.md): SQL injection vulnerability in index.php in Tilde CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. (no CVSS)
- [CVE-2006-1501](https://cve.now/CVE-2006-1501.md): SQL injection vulnerability in index.php in OneOrZero 1.6.3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter (no CVSS)
- [CVE-2006-1502](https://cve.now/CVE-2006-1502.md): Multiple integer overflows in MPlayer 1.0pre7try2 allow remote attackers to cause a denial of service and trigger heap-based buffer overflow (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-03-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.