# CVEs published 2006-04-06 27 CVEs were published on April 6, 2006: 0 critical, 0 high. Days are UTC. - [CVE-2006-1614](https://cve.now/CVE-2006-1614.md): Integer overflow in the cli\_scanpe function in the PE header parser (libclamav/pe.c) in Clam AntiVirus (ClamAV) before 0.88.1, when ArchiveM (no CVSS) - [CVE-2006-1615](https://cve.now/CVE-2006-1615.md): Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute (no CVSS) - [CVE-2006-1629](https://cve.now/CVE-2006-1629.md): OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD\_PRELOAD enviro (no CVSS) - [CVE-2006-1630](https://cve.now/CVE-2006-1630.md): The cli\_bitset\_set function in libclamav/others.c in Clam AntiVirus (ClamAV) before 0.88.1 allows remote attackers to cause a denial of serv (no CVSS) - [CVE-2006-1634](https://cve.now/CVE-2006-1634.md): Cross-site scripting (XSS) vulnerability in index.php in LucidCMS 2.0.0 RC4 allows remote attackers to inject arbitrary web script or HTML v (no CVSS) - [CVE-2006-1635](https://cve.now/CVE-2006-1635.md): LucidCMS 2.0.0 RC4 allows remote attackers to obtain sensitive information via a direct request to /lucid\_phplib/translator.php, which revea (no CVSS) - [CVE-2006-1636](https://cve.now/CVE-2006-1636.md): PHP remote file inclusion vulnerability in get\_header.php in VWar 1.5.0 R12 and earlier allows remote attackers to execute arbitrary PHP cod (no CVSS) - [CVE-2006-1637](https://cve.now/CVE-2006-1637.md): Multiple cross-site scripting (XSS) vulnerabilities in aWebBB 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS) - [CVE-2006-1638](https://cve.now/CVE-2006-1638.md): Multiple SQL injection vulnerabilities in aWebBB 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) Username parameter (no CVSS) - [CVE-2006-1639](https://cve.now/CVE-2006-1639.md): SQL injection vulnerability in index.php in wpBlog 0.4 allows remote attackers to execute arbitrary SQL commands via the postid parameter. (no CVSS) - [CVE-2006-1640](https://cve.now/CVE-2006-1640.md): Cross-site scripting (XSS) vulnerability in news.php in CzarNews 1.14 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS) - [CVE-2006-1641](https://cve.now/CVE-2006-1641.md): Multiple SQL injection vulnerabilities in CzarNews 1.14 allow remote attackers to execute arbitrary SQL commands via the (1) usern or (2) pa (no CVSS) - [CVE-2006-1642](https://cve.now/CVE-2006-1642.md): Cross-site scripting (XSS) vulnerability in Interact 2.1.1 allows remote attackers to inject arbitrary web script or HTML via (1) the search (no CVSS) - [CVE-2006-1643](https://cve.now/CVE-2006-1643.md): SQL injection vulnerability in login.php in Interact 2.1.1 allows remote attackers to execute arbitrary SQL commands via the user\_name param (no CVSS) - [CVE-2006-1644](https://cve.now/CVE-2006-1644.md): login.php in Interact 2.1.1 generates different responses depending on whether or not a username is valid, which allows remote attackers to (no CVSS) - [CVE-2006-1645](https://cve.now/CVE-2006-1645.md): Cross-site scripting (XSS) vulnerability in Anton Vlasov and Rostislav Gaitkuloff ReloadCMS 1.2.5 and earlier allows remote attackers to inj (no CVSS) - [CVE-2006-1646](https://cve.now/CVE-2006-1646.md): The Internet Key Exchange version 1 (IKEv1) implementation (isakmp\_agg.c) in the Shoichi Sakane KAME Project racoon, as used by NetBSD 1.6, (no CVSS) - [CVE-2006-1647](https://cve.now/CVE-2006-1647.md): An unspecified "logical programming mistake" in SMART SynchronEyes Student and Teacher 6.0, and possibly earlier versions, allows remote att (no CVSS) - [CVE-2006-1648](https://cve.now/CVE-2006-1648.md): SMART SynchronEyes Student and Teacher 6.0, and possibly earlier versions, allows remote attackers to cause a denial of service (memory cons (no CVSS) - [CVE-2006-1649](https://cve.now/CVE-2006-1649.md): The "restore to" selection in the "quarantine a file" capability of ESET NOD32 before 2.51.26 allows a restore to any directory that permits (no CVSS) - [CVE-2006-1650](https://cve.now/CVE-2006-1650.md): Firefox 1.5.0.1 allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicio (no CVSS) - [CVE-2006-1651](https://cve.now/CVE-2006-1651.md): Microsoft ISA Server 2004 allows remote attackers to bypass certain filtering rules, including ones for (1) ICMP and (2) TCP, via IPv6 packe (no CVSS) - [CVE-2006-1652](https://cve.now/CVE-2006-1652.md): Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed\_viewer 1.29 (1) allow user-assisted remote attacke (no CVSS) - [CVE-2006-1653](https://cve.now/CVE-2006-1653.md): PHP remote file inclusion vulnerability in loadkernel.php in AngelineCMS 0.8.1 allows remote attackers to execute arbitrary PHP code via a U (no CVSS) - [CVE-2006-1654](https://cve.now/CVE-2006-1654.md): Directory traversal vulnerability in the HP Color LaserJet 2500 Toolbox and Color LaserJet 4600 Toolbox on Microsoft Windows before 20060402 (no CVSS) - [CVE-2006-1655](https://cve.now/CVE-2006-1655.md): Multiple buffer overflows in mpg123 0.59r allow user-assisted attackers to trigger a segmentation fault and possibly have other impacts via (no CVSS) - [CVE-2006-1656](https://cve.now/CVE-2006-1656.md): vserver in util-vserver 0.30.209 executes a command as root when the suexec userid parameter is invalid and non-numeric, which might cause l (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2006-04-06 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.