# CVEs published 2006-05-09

66 CVEs were published on May 9, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-0034](https://cve.now/CVE-2006-0034.md): Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinat (no CVSS)
- [CVE-2006-0561](https://cve.now/CVE-2006-0561.md): Cisco Secure Access Control Server (ACS) 3.x for Windows stores ACS administrator passwords and the master key in the registry with insecure (no CVSS)
- [CVE-2006-1184](https://cve.now/CVE-2006-1184.md): Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers (no CVSS)
- [CVE-2006-2276](https://cve.now/CVE-2006-2276.md): bgpd in Quagga 0.98 and 0.99 before 20060504 allows local users to cause a denial of service (CPU consumption) via a certain sh ip bgp comma (no CVSS)
- [CVE-2006-2277](https://cve.now/CVE-2006-2277.md): Multiple Apple Mac OS X 10.4 applications might allow context-dependent attackers to cause a denial of service (application crash) via a cra (no CVSS)
- [CVE-2006-2278](https://cve.now/CVE-2006-2278.md): SaphpLesson 3.0 does not initialize array variables, which allows remote attackers to obtain the full path via an non-array (1) hrow paramet (no CVSS)
- [CVE-2006-2279](https://cve.now/CVE-2006-2279.md): Multiple SQL injection vulnerabilities in SaphpLesson 3.0 allow remote attackers to execute arbitrary SQL commands via (1) the Find paramete (no CVSS)
- [CVE-2006-2280](https://cve.now/CVE-2006-2280.md): Directory traversal vulnerability in website.php in openEngine 1.8 Beta 2 and earlier allows remote attackers to list arbitrary directories (no CVSS)
- [CVE-2006-2281](https://cve.now/CVE-2006-2281.md): X-Scripts X-Poll (xpoll) 2.30 allows remote attackers to execute arbitrary PHP code by using admin/images/add.php to upload a PHP file, then (no CVSS)
- [CVE-2006-2282](https://cve.now/CVE-2006-2282.md): Cross-site scripting (XSS) vulnerability in X7 Chat 2.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a j (no CVSS)
- [CVE-2006-2283](https://cve.now/CVE-2006-2283.md): Multiple PHP remote file inclusion vulnerabilities in SpiffyJr phpRaid 2.9.5 through 3.0.b3 allow remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2006-2284](https://cve.now/CVE-2006-2284.md): Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the (no CVSS)
- [CVE-2006-2285](https://cve.now/CVE-2006-2285.md): PHP remote file inclusion vulnerability in authldap.php in Dokeos 1.6.4 allows remote attackers to execute arbitrary PHP code via a URL in t (no CVSS)
- [CVE-2006-2286](https://cve.now/CVE-2006-2286.md): Multiple PHP remote file inclusion vulnerabilities in claro\_init\_global.inc.php in Dokeos 1.6.3 and earlier, and Dokeos community release 2. (no CVSS)
- [CVE-2006-2287](https://cve.now/CVE-2006-2287.md): Multiple cross-site scripting (XSS) vulnerabilities in Vision Source 0.6 and earlier allow remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2006-2288](https://cve.now/CVE-2006-2288.md): Avahi before 0.6.10 allows local users to cause a denial of service (mDNS/DNS-SD service disconnect) via unspecified mDNS name conflicts. (no CVSS)
- [CVE-2006-2289](https://cve.now/CVE-2006-2289.md): Buffer overflow in avahi-core in Avahi before 0.6.10 allows local users to execute arbitrary code via unknown vectors. (no CVSS)
- [CVE-2006-2290](https://cve.now/CVE-2006-2290.md): Multiple cross-site scripting (XSS) vulnerabilities in kommentar.php in 2005-Comments-Script allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2006-2291](https://cve.now/CVE-2006-2291.md): Cross-site scripting (XSS) vulnerability in calendar\_new.asp in IA-Calendar allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2006-2292](https://cve.now/CVE-2006-2292.md): Multiple SQL injection vulnerabilities in IA-Calendar allow remote attackers to execute arbitrary SQL commands via the (1) type parameter in (no CVSS)
- [CVE-2006-2293](https://cve.now/CVE-2006-2293.md): SQL injection vulnerability in all\_calendars.asp in MultiCalendars 3.0 allows remote attackers to execute arbitrary SQL commands via the cal (no CVSS)
- [CVE-2006-2294](https://cve.now/CVE-2006-2294.md): Cross-site scripting (XSS) vulnerability in Dynamic Galerie 1.0 allows remote attackers to inject arbitrary web script or HTML via the pfad (no CVSS)
- [CVE-2006-2295](https://cve.now/CVE-2006-2295.md): Directory traversal vulnerability in Dynamic Galerie 1.0 allows remote attackers to access arbitrary files via an absolute path in the pfad (no CVSS)
- [CVE-2006-2296](https://cve.now/CVE-2006-2296.md): SQL injection vulnerability in search\_result.asp in EDirectoryPro 2.0 and earlier allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2006-0027](https://cve.now/CVE-2006-0027.md): Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal (no CVSS)
- [CVE-2005-4798](https://cve.now/CVE-2005-4798.md): Buffer overflow in NFS readlink handling in the Linux Kernel 2.4 up to 2.4.31 allows remote NFS servers to cause a denial of service (crash) (no CVSS)
- [CVE-2006-2274](https://cve.now/CVE-2006-2274.md): Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (infinite recursion and crash) via a packet that cont (no CVSS)
- [CVE-2006-2275](https://cve.now/CVE-2006-2275.md): Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (deadlock) via a large number of small messages to a (no CVSS)
- [CVE-2006-2042](https://cve.now/CVE-2006-2042.md): Adobe Dreamweaver 8 before 8.0.2 and MX 2004 can generate code that allows SQL injection attacks in the (1) ColdFusion, (2) PHP mySQL, (3) A (no CVSS)
- [CVE-2006-2271](https://cve.now/CVE-2006-2271.md): The ECNE chunk handling in Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (kernel panic) via an unex (no CVSS)
- [CVE-2006-2272](https://cve.now/CVE-2006-2272.md): Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (kernel panic) via incoming IP fragmented (1) COOKIE\_ (no CVSS)
- [CVE-2006-0515](https://cve.now/CVE-2006-0515.md): Cisco PIX/ASA 7.1.x before 7.1(2) and 7.0.x before 7.0(5), PIX 6.3.x before 6.3.5(112), and FWSM 2.3.x before 2.3(4) and 3.x before 3.1(7), (no CVSS)
- [CVE-2006-1172](https://cve.now/CVE-2006-1172.md): Stack-based buffer overflow in the createPKCS10 function in Cryptomathic Cenroll ActiveX Control 1.1.0.0 allows remote attackers to execute (no CVSS)
- [CVE-2006-2161](https://cve.now/CVE-2006-2161.md): Buffer overflow in (1) TZipBuilder 1.79.03.01, (2) Abakt 0.9.2 and 0.9.3-beta1, (3) CAM UnZip 4.0 and 4.3, and possibly other products, allo (no CVSS)
- [CVE-2006-2239](https://cve.now/CVE-2006-2239.md): SQL injection vulnerability in readarticle.php in Newsadmin 1.1 allows remote attackers to execute arbitrary SQL commands via the nid parame (no CVSS)
- [CVE-2006-2240](https://cve.now/CVE-2006-2240.md): Unspecified vulnerability in the (1) web cache or (2) web proxy in Fujitsu NetShelter/FW allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2006-2241](https://cve.now/CVE-2006-2241.md): PHP remote file inclusion vulnerability in show.php in Fast Click SQL Lite 1.1.3 and earlier allows remote attackers to execute arbitrary PH (no CVSS)
- [CVE-2006-2242](https://cve.now/CVE-2006-2242.md): acFTP 1.4 allows remote attackers to cause a denial of service (application crash) via a long string with "{" (brace) characters to the USER (no CVSS)
- [CVE-2006-2243](https://cve.now/CVE-2006-2243.md): Multiple cross-site scripting (XSS) vulnerabilities in Web4Future News Portal allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-2244](https://cve.now/CVE-2006-2244.md): Multiple SQL injection vulnerabilities in Web4Future News Portal allow remote attackers to execute arbitrary SQL commands via the ID paramet (no CVSS)
- [CVE-2006-2245](https://cve.now/CVE-2006-2245.md): PHP remote file inclusion vulnerability in auction\\auction\_common.php in Auction mod 1.3m for phpBB allows remote attackers to execute arbit (no CVSS)
- [CVE-2006-2246](https://cve.now/CVE-2006-2246.md): Cross-site scripting (XSS) vulnerability in UBlog 1.6 Access Edition allows remote attackers to inject arbitrary web script or HTML via text (no CVSS)
- [CVE-2006-2247](https://cve.now/CVE-2006-2247.md): WebCalendar 1.0.1 to 1.0.3 generates different error messages depending on whether or not a username is valid, which allows remote attackers (no CVSS)
- [CVE-2006-2248](https://cve.now/CVE-2006-2248.md): Xeneo Web Server 2.2.22.0 allows remote attackers to obtain the source code of script files via crafted requests containing dot, space, and (no CVSS)
- [CVE-2006-2249](https://cve.now/CVE-2006-2249.md): Multiple cross-site scripting (XSS) vulnerabilities in search.php in CuteNews 1.4.1 and earlier, and possibly 1.4.5, allow remote attackers (no CVSS)
- [CVE-2006-2250](https://cve.now/CVE-2006-2250.md): CuteNews 1.4.1 allows remote attackers to obtain sensitive information via a direct request to (1) /inc/show.inc.php or (2) /inc/functions.i (no CVSS)
- [CVE-2006-2251](https://cve.now/CVE-2006-2251.md): SQL injection vulnerability in the do\_mmod function in mod.php in Invision Community Blog (ICB) 1.1.2 final through 1.2 allows remote attack (no CVSS)
- [CVE-2006-2252](https://cve.now/CVE-2006-2252.md): Cross-site scripting vulnerability in submit.php in OpenFAQ 0.4.0 allows remote attackers to inject arbitrary web script or HTML via the q p (no CVSS)
- [CVE-2006-2253](https://cve.now/CVE-2006-2253.md): PHP remote file inclusion vulnerability in visible\_count\_inc.php in Statit 4 (060207) allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2006-2254](https://cve.now/CVE-2006-2254.md): Buffer overflow in filecpnt.exe in FileCOPA 1.01 allows remote attackers to cause a denial of service (application crash) via a username wit (no CVSS)
- [CVE-2006-2255](https://cve.now/CVE-2006-2255.md): Multiple SQL injection vulnerabilities in Creative Community Portal 1.1 and earlier allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2006-2256](https://cve.now/CVE-2006-2256.md): PHP remote file inclusion vulnerability in includes/dbal.php in EQdkp 1.3.0 and earlier allows remote attackers to execute arbitrary PHP cod (no CVSS)
- [CVE-2006-2257](https://cve.now/CVE-2006-2257.md): Cross-site scripting (XSS) vulnerability in index.php in easyEvent 1.2 allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2006-2258](https://cve.now/CVE-2006-2258.md): Cross-site scripting (XSS) vulnerability in Logon.asp in MaxxSchedule 1.0 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2006-2259](https://cve.now/CVE-2006-2259.md): SQL injection vulnerability in Logon.asp in MaxxSchedule 1.0 allows remote attackers to execute arbitrary SQL commands via the txtLogon para (no CVSS)
- [CVE-2006-2260](https://cve.now/CVE-2006-2260.md): Cross-site scripting (XSS) vulnerability in the project module (project.module) in Drupal 4.5 and 4.6 allows remote attackers to inject arbi (no CVSS)
- [CVE-2006-2261](https://cve.now/CVE-2006-2261.md): PHP remote file inclusion vulnerability in day.php in ACal 2.2.6 allows remote attackers to execute arbitrary PHP code via a URL in the path (no CVSS)
- [CVE-2006-2262](https://cve.now/CVE-2006-2262.md): Cross-site scripting (XSS) vulnerability in index.php in singapore 0.9.7 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2006-2263](https://cve.now/CVE-2006-2263.md): SQL injection vulnerability in shopcurrency.asp in VP-ASP 6.00 allows remote attackers to execute arbitrary SQL commands via the cid paramet (no CVSS)
- [CVE-2006-2264](https://cve.now/CVE-2006-2264.md): Multiple SQL injection vulnerabilities in Ocean12 Calendar Manager Pro 1.00 allow remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2006-2265](https://cve.now/CVE-2006-2265.md): Cross-site scripting vulnerability in admin/main.asp in Ocean12 Calendar Manager Pro 1.00 allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2006-2266](https://cve.now/CVE-2006-2266.md): SQL injection vulnerability in Chirpy! 0.1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters. (no CVSS)
- [CVE-2006-2267](https://cve.now/CVE-2006-2267.md): Kerio WinRoute Firewall before 6.2.1 allows remote attackers to cause a denial of service (application crash) via unknown vectors in the "em (no CVSS)
- [CVE-2006-2268](https://cve.now/CVE-2006-2268.md): SQL injection vulnerability in FlexCustomer 0.0.4 and earlier allows remote attackers to bypass authentication and execute arbitrary SQL com (no CVSS)
- [CVE-2006-2269](https://cve.now/CVE-2006-2269.md): Cross-site scripting (XSS) vulnerability in myWebland MyBloggie 2.1.3 and earlier allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-2270](https://cve.now/CVE-2006-2270.md): PHP remote file inclusion vulnerability in includes/config.php in Jetbox CMS 2.1 allows remote attackers to execute arbitrary code via a URL (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-05-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.