# CVEs published 2006-04-25

50 CVEs were published on April 25, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-2024](https://cve.now/CVE-2006-2024.md): Multiple vulnerabilities in libtiff before 3.8.1 allow context-dependent attackers to cause a denial of service via a TIFF image that trigge (no CVSS)
- [CVE-2006-2025](https://cve.now/CVE-2006-2025.md): Integer overflow in the TIFFFetchData function in tif\_dirread.c for libtiff before 3.8.1 allows context-dependent attackers to cause a denia (no CVSS)
- [CVE-2006-2026](https://cve.now/CVE-2006-2026.md): Double free vulnerability in tif\_jpeg.c in libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service (crash) and (no CVSS)
- [CVE-2006-1863](https://cve.now/CVE-2006-1863.md): Directory traversal vulnerability in CIFS in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted fi (no CVSS)
- [CVE-2006-2020](https://cve.now/CVE-2006-2020.md): Asterisk Recording Interface (ARI) in Asterisk@Home before 2.8 stores recordings/includes/main.conf under the web document root with insuffi (no CVSS)
- [CVE-2006-2021](https://cve.now/CVE-2006-2021.md): Absolute path traversal vulnerability in recordings/misc/audio.php in the Asterisk Recording Interface (ARI) web interface in Asterisk@Home (no CVSS)
- [CVE-2006-2022](https://cve.now/CVE-2006-2022.md): Buffer overflow in the parse\_url function in the RTSP module (rtsp/parse\_url.c) in Fenice 1.10 and earlier allows remote attackers to execut (no CVSS)
- [CVE-2006-2023](https://cve.now/CVE-2006-2023.md): Integer overflow in the RTSP\_msg\_len function in rtsp/RTSP\_msg\_len.c in Fenice 1.10 and earlier allows remote attackers to cause a denial of (no CVSS)
- [CVE-2006-2019](https://cve.now/CVE-2006-2019.md): Apple Mac OS X Safari 2.0.3, 1.3.1, and possibly other versions allows remote attackers to cause a denial of service (CPU consumption and cr (no CVSS)
- [CVE-2006-1513](https://cve.now/CVE-2006-1513.md): Multiple buffer overflows in abc2ps before 1.3.3 allow user-assisted attackers to execute arbitrary code via crafted ABC music files. (no CVSS)
- [CVE-2006-1932](https://cve.now/CVE-2006-1932.md): Off-by-one error in the OID printing routine in Ethereal 0.10.x up to 0.10.14 has unknown impact and remote attack vectors. (no CVSS)
- [CVE-2006-1933](https://cve.now/CVE-2006-1933.md): Multiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (large or infinite (no CVSS)
- [CVE-2006-1934](https://cve.now/CVE-2006-1934.md): Multiple buffer overflows in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (crash) and possibly execute (no CVSS)
- [CVE-2006-1935](https://cve.now/CVE-2006-1935.md): Buffer overflow in Ethereal 0.9.15 up to 0.10.14 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary (no CVSS)
- [CVE-2006-1936](https://cve.now/CVE-2006-1936.md): Buffer overflow in Ethereal 0.8.5 up to 0.10.14 allows remote attackers to execute arbitrary code via the telnet dissector. (no CVSS)
- [CVE-2006-1937](https://cve.now/CVE-2006-1937.md): Multiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null d (no CVSS)
- [CVE-2006-1938](https://cve.now/CVE-2006-1938.md): Multiple unspecified vulnerabilities in Ethereal 0.8.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null de (no CVSS)
- [CVE-2006-1939](https://cve.now/CVE-2006-1939.md): Multiple unspecified vulnerabilities in Ethereal 0.9.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null de (no CVSS)
- [CVE-2006-1940](https://cve.now/CVE-2006-1940.md): Unspecified vulnerability in Ethereal 0.10.4 up to 0.10.14 allows remote attackers to cause a denial of service (abort) via the SNDCP dissec (no CVSS)
- [CVE-2006-1993](https://cve.now/CVE-2006-1993.md): Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary cod (no CVSS)
- [CVE-2006-1994](https://cve.now/CVE-2006-1994.md): PHP remote file inclusion vulnerability in dForum 1.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DFO (no CVSS)
- [CVE-2006-1995](https://cve.now/CVE-2006-1995.md): Directory traversal vulnerability in index.php in Scry Gallery 1.1 allows remote attackers to read arbitrary files via ".." sequences in the (no CVSS)
- [CVE-2006-1996](https://cve.now/CVE-2006-1996.md): Scry Gallery 1.1 allows remote attackers to obtain sensitive information via an invalid p parameter, which reveals the path in an error mess (no CVSS)
- [CVE-2006-1997](https://cve.now/CVE-2006-1997.md): Unspecified vulnerability in Sybase Pylon Anywhere groupware synchronization server before 7.0 allows local users to obtain sensitive inform (no CVSS)
- [CVE-2006-1998](https://cve.now/CVE-2006-1998.md): OpenTTD 0.4.7 and earlier allows local users to cause a denial of service (application exit) via a large invalid error number, which trigger (no CVSS)
- [CVE-2006-1999](https://cve.now/CVE-2006-1999.md): The multiplayer menu in OpenTTD 0.4.7 allows remote attackers to cause a denial of service via a UDP packet with an incorrect size, which ca (no CVSS)
- [CVE-2006-2000](https://cve.now/CVE-2006-2000.md): Cross-site scripting (XSS) vulnerability in /lms/a2z.jsp in logMethods 0.9 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2006-2001](https://cve.now/CVE-2006-2001.md): Cross-site scripting (XSS) vulnerability in index.php in Scry Gallery 1.1 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2006-2002](https://cve.now/CVE-2006-2002.md): PHP remote file inclusion vulnerability in stats.php in MyGamingLadder 7.0 allows remote attackers to execute arbitrary PHP code via a URL i (no CVSS)
- [CVE-2006-2003](https://cve.now/CVE-2006-2003.md): Cross-site scripting (XSS) vulnerability in cgi-bin/guest in Community Architect Guestbook allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2006-2004](https://cve.now/CVE-2006-2004.md): Multiple SQL injection vulnerabilities in RI Blog 1.1 allow remote attackers to execute arbitrary SQL command via the (1) username or (2) pa (no CVSS)
- [CVE-2006-2005](https://cve.now/CVE-2006-2005.md): Eval injection vulnerability in index.php in ClanSys 1.1 allows remote attackers to execute arbitrary PHP code via PHP code in the page para (no CVSS)
- [CVE-2006-2006](https://cve.now/CVE-2006-2006.md): Multiple directory traversal vulnerabilities in IZArc Archiver 3.5 beta 3 allow remote attackers to write arbitrary files via a ..\\ (dot dot (no CVSS)
- [CVE-2006-2007](https://cve.now/CVE-2006-2007.md): Heap-based buffer overflow in Winny 2.0 b7.1 and earlier allows remote attackers to execute arbitrary code via long strings to certain comma (no CVSS)
- [CVE-2006-2008](https://cve.now/CVE-2006-2008.md): PHP remote file inclusion vulnerability in movie\_cls.php in Built2Go PHP Movie Review 2B and earlier allows remote attackers to execute arbi (no CVSS)
- [CVE-2006-2009](https://cve.now/CVE-2006-2009.md): PHP remote file inclusion vulnerability in agenda.php3 in phpMyAgenda 3.0 Final and earlier allows remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2006-2010](https://cve.now/CVE-2006-2010.md): Multiple SQL injection vulnerabilities in check\_login.asp in Bloggage allow remote attackers to execute arbitrary SQL commands via the (1) a (no CVSS)
- [CVE-2006-2011](https://cve.now/CVE-2006-2011.md): Cross-site scripting (XSS) vulnerability in member.php in 4images 1.7 and earlier allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-2012](https://cve.now/CVE-2006-2012.md): Format string vulnerability in Skulltag 0.96f and earlier allows remote attackers to cause a denial of service via the version string. (no CVSS)
- [CVE-2006-2013](https://cve.now/CVE-2006-2013.md): SQL injection vulnerability in page.php in SL\_site 1.0 allows remote attackers to execute arbitrary SQL commands via the id\_page parameter. (no CVSS)
- [CVE-2006-2014](https://cve.now/CVE-2006-2014.md): Directory traversal vulnerability in gallerie.php in SL\_site 1.0 allows remote attackers to list images in arbitrary directories via ".." se (no CVSS)
- [CVE-2006-2015](https://cve.now/CVE-2006-2015.md): Cross-site scripting (XSS) vulnerability in SL\_site 1.0 allows remote attackers to inject arbitrary web script or HTML via the recherche par (no CVSS)
- [CVE-2006-2016](https://cve.now/CVE-2006-2016.md): Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2006-2017](https://cve.now/CVE-2006-2017.md): Dnsmasq 2.29 allows remote attackers to cause a denial of service (application crash) via a DHCP client broadcast reply request. (no CVSS)
- [CVE-2006-2018](https://cve.now/CVE-2006-2018.md): SQL injection vulnerability in calendar.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL commands via the eventid par (no CVSS)
- [CVE-2006-0230](https://cve.now/CVE-2006-0230.md): Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remot (no CVSS)
- [CVE-2006-0231](https://cve.now/CVE-2006-0231.md): Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each installation, which allows (no CVSS)
- [CVE-2006-0232](https://cve.now/CVE-2006-0232.md): Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, stores sensitive log and virus definition files under the web roo (no CVSS)
- [CVE-2006-1057](https://cve.now/CVE-2006-1057.md): Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and (no CVSS)
- [CVE-2006-1992](https://cve.now/CVE-2006-1992.md): mshtml.dll 6.00.2900.2873, as used in Microsoft Internet Explorer, allows remote attackers to cause a denial of service (crash) via nested O (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-04-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.