# CVEs published 2006-04-19 30 CVEs were published on April 19, 2006: 0 critical, 0 high. Days are UTC. - [CVE-2006-1524](https://cve.now/CVE-2006-1524.md): madvise\_remove in Linux kernel 2.6.16 up to 2.6.16.6 does not follow file and mmap restrictions, which allows local users to bypass IPC perm (no CVSS) - [CVE-2006-1525](https://cve.now/CVE-2006-1525.md): ip\_route\_input in Linux kernel 2.6 before 2.6.16.8 allows local users to cause a denial of service (panic) via a request for a route for a m (no CVSS) - [CVE-2005-4786](https://cve.now/CVE-2005-4786.md): Buffer overflow in the archive decompression library (vrAZMain.dll 5.8.22.137), as used in HAURI anti-virus products including (1) ViRobot E (no CVSS) - [CVE-2006-1247](https://cve.now/CVE-2006-1247.md): rm\_mlcache\_file in bos.rte.install in AIX 5.1.0 through 5.3.0 allows local users to overwrite arbitrary files via a symlink attack on tempor (no CVSS) - [CVE-2006-1828](https://cve.now/CVE-2006-1828.md): SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL commands and execute arbitr (no CVSS) - [CVE-2006-1829](https://cve.now/CVE-2006-1829.md): EAServer Manager in Sybase EAServer 5.2 and 5.3 allows remote authenticated users, possibly guests, to obtain password credentials of arbitr (no CVSS) - [CVE-2006-1830](https://cve.now/CVE-2006-1830.md): Sun Java Studio Enterprise 8, when installed as root, creates certain files with world-writable permissions, which allows local users to exe (no CVSS) - [CVE-2006-1831](https://cve.now/CVE-2006-1831.md): Direct static code injection vulnerability in sysinfo.cgi in sysinfo 1.21 and possibly other versions before 2.25 allows remote attackers to (no CVSS) - [CVE-2006-1832](https://cve.now/CVE-2006-1832.md): sysinfo.cgi in sysinfo 1.21 allows remote attackers to obtain the installation path via the debugger action. (no CVSS) - [CVE-2006-1833](https://cve.now/CVE-2006-1833.md): Intel RNG Driver in NetBSD 1.6 through 3.0 may incorrectly detect the presence of the pchb interface, which will cause it to always generate (no CVSS) - [CVE-2006-1834](https://cve.now/CVE-2006-1834.md): Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, w (no CVSS) - [CVE-2006-1835](https://cve.now/CVE-2006-1835.md): Cross-site scripting (XSS) vulnerability in yearcal.php in Calendarix allows remote attackers to inject arbitrary web script or HTML via the (no CVSS) - [CVE-2006-1836](https://cve.now/CVE-2006-1836.md): Untrusted search path vulnerability in unspecified components in Symantec LiveUpdate for Macintosh 3.0.0 through 3.5.0 do not set the execut (no CVSS) - [CVE-2006-1837](https://cve.now/CVE-2006-1837.md): SQL injection vulnerability in archiv2.php in Fuju News 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter. (no CVSS) - [CVE-2006-1838](https://cve.now/CVE-2006-1838.md): edit\_kategorie.php in Fuju News 1.0 allows remote attackers to bypass authentication by setting the authorized cookie. (no CVSS) - [CVE-2006-1839](https://cve.now/CVE-2006-1839.md): PHP remote file inclusion vulnerability in language.php in PHP Album 0.3.2.3, when register\_globals is enabled, allows remote attackers to e (no CVSS) - [CVE-2006-1840](https://cve.now/CVE-2006-1840.md): Multiple format string vulnerabilities in Empire Server before 4.3.1 allow attackers to cause a denial of service (crash) via the (1) load, (no CVSS) - [CVE-2006-1841](https://cve.now/CVE-2006-1841.md): Cross-site scripting (XSS) vulnerability in search.php in boastMachine (bMachine) 2.7, and possibly other versions before 2.9b, allows remot (no CVSS) - [CVE-2006-1842](https://cve.now/CVE-2006-1842.md): Cross-site scripting (XSS) vulnerability in global.php in ShoutBOOK 1.1 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS) - [CVE-2006-1843](https://cve.now/CVE-2006-1843.md): Cross-site scripting (XSS) vulnerability in global.php in ShoutBOOK 1.1 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS) - [CVE-2006-1844](https://cve.now/CVE-2006-1844.md): The Debian installer for the (1) shadow 4.0.14 and (2) base-config 2.53.10 packages includes sensitive information in world-readable log fil (no CVSS) - [CVE-2006-1846](https://cve.now/CVE-2006-1846.md): Cross-site scripting (XSS) vulnerability in the Your\_Account module in PHP-Nuke 7.8 might allows remote attackers to inject arbitrary HTML a (no CVSS) - [CVE-2006-1847](https://cve.now/CVE-2006-1847.md): SQL injection vulnerability in the Your\_Account module in PHP-Nuke 7.8 might allows remote attackers to execute arbitrary SQL commands via t (no CVSS) - [CVE-2006-1848](https://cve.now/CVE-2006-1848.md): Multiple cross-site scripting (XSS) vulnerabilities in stats\_view.php in LinPHA 1.1.0 allow remote attackers to inject arbitrary web script (no CVSS) - [CVE-2006-1849](https://cve.now/CVE-2006-1849.md): Multiple SQL injection vulnerabilities in members\_only/index.cgi in xFlow 5.46.11 and earlier allow remote attackers to execute arbitrary SQ (no CVSS) - [CVE-2006-1850](https://cve.now/CVE-2006-1850.md): Multiple cross-site scripting (XSS) vulnerabilities in xFlow 5.46.11 and earlier allow remote attackers to inject arbitrary web script or HT (no CVSS) - [CVE-2006-1851](https://cve.now/CVE-2006-1851.md): xFlow 5.46.11 and earlier allows remote attackers to determine the installation path of the application via the (1) action parameter to memb (no CVSS) - [CVE-2006-1852](https://cve.now/CVE-2006-1852.md): SQL injection vulnerability in category.php in Article Publisher Pro 1.0.1 and earlier allows remote attackers to execute arbitrary SQL comm (no CVSS) - [CVE-2006-1853](https://cve.now/CVE-2006-1853.md): Multiple SQL injection vulnerabilities in ModernBill 4.3.2 and earlier allow remote attackers or administrators to execute arbitrary SQL com (no CVSS) - [CVE-2006-1854](https://cve.now/CVE-2006-1854.md): Multiple cross-site scripting (XSS) vulnerabilities in BluePay Manager 2.0 and earlier allow remote attackers to inject arbitrary web script (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2006-04-19 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.