# CVEs published 2006-05-12

66 CVEs were published on May 12, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-1439](https://cve.now/CVE-2006-1439.md): NSSecureTextField in AppKit in Apple Mac OS X 10.4.6 does not re-enable secure event input under certain circumstances, which could allow ot (no CVSS)
- [CVE-2006-1440](https://cve.now/CVE-2006-1440.md): BOM in Apple Mac OS X 10.3.9 and 10.4.6 allows attackers to overwrite arbitrary files via an archive that contains symbolic links. (no CVSS)
- [CVE-2006-1441](https://cve.now/CVE-2006-1441.md): Integer overflow in CFNetwork in Apple Mac OS X 10.4.6 allows remote attackers to execute arbitrary code via crafted chunked transfer encodi (no CVSS)
- [CVE-2006-1442](https://cve.now/CVE-2006-1442.md): The bundle API in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4.6 loads dynamic libraries even if the client application has not directly (no CVSS)
- [CVE-2006-1443](https://cve.now/CVE-2006-1443.md): Integer underflow in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4.6 allows context-dependent attackers to execute arbitrary code via uns (no CVSS)
- [CVE-2006-1444](https://cve.now/CVE-2006-1444.md): CoreGraphics in Apple Mac OS X 10.4.6, when "Enable access for assistive devices" is on, allows an application to bypass restrictions for se (no CVSS)
- [CVE-2006-1445](https://cve.now/CVE-2006-1445.md): Buffer overflow in the FTP server (FTPServer) in Apple Mac OS X 10.3.9 and 10.4.6 allows remote authenticated users to execute arbitrary cod (no CVSS)
- [CVE-2006-1446](https://cve.now/CVE-2006-1446.md): Keychain in Apple Mac OS X 10.3.9 and 10.4.6 might allow an application to bypass a locked Keychain by first obtaining a reference to the Ke (no CVSS)
- [CVE-2006-1447](https://cve.now/CVE-2006-1447.md): LaunchServices in Apple Mac OS X 10.4.6 allows remote attackers to cause Safari to launch unsafe content via long file name extensions, whic (no CVSS)
- [CVE-2006-1448](https://cve.now/CVE-2006-1448.md): Finder in Apple Mac OS X 10.3.9 and 10.4.6 allows user-assisted attackers to execute arbitrary code by tricking a user into launching an Int (no CVSS)
- [CVE-2006-1449](https://cve.now/CVE-2006-1449.md): Integer overflow in Mail in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to execute arbitrary code via a crafted MacMIME encapsu (no CVSS)
- [CVE-2006-1450](https://cve.now/CVE-2006-1450.md): Mail in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to execute arbitrary code via an enriched text e-mail message with "invalid (no CVSS)
- [CVE-2006-1451](https://cve.now/CVE-2006-1451.md): MySQL Manager in Apple Mac OS X 10.3.9 and 10.4.6, when setting up a new MySQL database server, does not use the "New MySQL root password" t (no CVSS)
- [CVE-2006-1452](https://cve.now/CVE-2006-1452.md): Stack-based buffer overflow in Preview in Apple Mac OS 10.4 up to 10.4.6 allows local users to execute arbitrary code via a deep directory h (no CVSS)
- [CVE-2006-1455](https://cve.now/CVE-2006-1455.md): QuickTime Streaming Server in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to cause a denial of service (crash and connection in (no CVSS)
- [CVE-2006-1456](https://cve.now/CVE-2006-1456.md): Buffer overflow in QuickTime Streaming Server in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to execute arbitrary code via a cr (no CVSS)
- [CVE-2006-1457](https://cve.now/CVE-2006-1457.md): Safari on Apple Mac OS X 10.4.6, when "Open \`safe' files after downloading" is enabled, will automatically expand archives, which could allo (no CVSS)
- [CVE-2006-2238](https://cve.now/CVE-2006-2238.md): Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted BMP file that trigg (no CVSS)
- [CVE-2006-1453](https://cve.now/CVE-2006-1453.md): Stack-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickDraw PICT ima (no CVSS)
- [CVE-2006-1454](https://cve.now/CVE-2006-1454.md): Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickDraw PICT imag (no CVSS)
- [CVE-2006-1458](https://cve.now/CVE-2006-1458.md): Integer overflow in Apple QuickTime Player before 7.1 allows remote attackers to execute arbitrary code via a crafted JPEG image. (no CVSS)
- [CVE-2006-1459](https://cve.now/CVE-2006-1459.md): Multiple integer overflows in Apple QuickTime before 7.1 allow remote attackers to cause a denial of service or execute arbitrary code via a (no CVSS)
- [CVE-2006-1460](https://cve.now/CVE-2006-1460.md): Multiple buffer overflows in Apple QuickTime before 7.1 allow remote attackers to execute arbitrary code via a crafted QuickTime movie (.MOV (no CVSS)
- [CVE-2006-1461](https://cve.now/CVE-2006-1461.md): Multiple buffer overflows in Apple QuickTime before 7.1 allow remote attackers to execute arbitrary code via a crafted QuickTime Flash (SWF) (no CVSS)
- [CVE-2006-1462](https://cve.now/CVE-2006-1462.md): Multiple integer overflows in Apple QuickTime before 7.1 allow remote attackers to execute arbitrary code via a crafted QuickTime H.264 (M4V (no CVSS)
- [CVE-2006-1463](https://cve.now/CVE-2006-1463.md): Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a H.264 (M4V) video format fi (no CVSS)
- [CVE-2006-1464](https://cve.now/CVE-2006-1464.md): Buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickTime MPEG4 (M4P) video fo (no CVSS)
- [CVE-2006-1465](https://cve.now/CVE-2006-1465.md): Buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickTime AVI video format fil (no CVSS)
- [CVE-2006-2342](https://cve.now/CVE-2006-2342.md): IBM WebSphere Application Server 6.0.2 before FixPack 3 allows remote attackers to bypass authentication for the Welcome Page via a request (no CVSS)
- [CVE-2006-2343](https://cve.now/CVE-2006-2343.md): Cross-site scripting (XSS) vulnerability in Search.do in ManageEngine OpManager 6.0 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2006-2344](https://cve.now/CVE-2006-2344.md): SQL injection vulnerability in inc/elementz.php in AliPAGER 1.5, with magic\_quotes\_gpc disabled, allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2006-2345](https://cve.now/CVE-2006-2345.md): Cross-site scripting (XSS) vulnerability in inc/elementz.php in AliPAGER 1.5 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-2346](https://cve.now/CVE-2006-2346.md): vpopmail 5.4.14 and 5.4.15, with cleartext passwords enabled, allows remote attackers to authenticate to an account that does not have a cle (no CVSS)
- [CVE-2006-2347](https://cve.now/CVE-2006-2347.md): E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to obtain the full path of the web server via "'" characters, and possib (no CVSS)
- [CVE-2006-2348](https://cve.now/CVE-2006-2348.md): Cross-site scripting (XSS) vulnerability in form\_grupo.html in E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to inject (no CVSS)
- [CVE-2006-2349](https://cve.now/CVE-2006-2349.md): E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to upload or modify arbitrary files, and execute arbitrary code, via a d (no CVSS)
- [CVE-2006-1859](https://cve.now/CVE-2006-1859.md): Memory leak in \_\_setlease in fs/locks.c in Linux kernel before 2.6.16.16 allows attackers to cause a denial of service (memory consumption) (no CVSS)
- [CVE-2006-1860](https://cve.now/CVE-2006-1860.md): lease\_init in fs/locks.c in Linux kernel before 2.6.16.16 allows attackers to cause a denial of service (fcntl\_setlease lockup) via actions (no CVSS)
- [CVE-2006-2339](https://cve.now/CVE-2006-2339.md): SQL injection vulnerability in index.php in evoTopsites 2.x and evoTopsites Pro 2.x allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2006-2340](https://cve.now/CVE-2006-2340.md): Cross-site scripting (XSS) vulnerability in PassMasterFlex and PassMasterFlexPlus (PassMasterFlex+) 1.2 and earlier allows remote attackers (no CVSS)
- [CVE-2006-2341](https://cve.now/CVE-2006-2341.md): The HTTP proxy in Symantec Gateway Security 5000 Series 2.0.1 and 3.0, and Enterprise Firewall 8.0, when NAT is being used, allows remote at (no CVSS)
- [CVE-2006-2273](https://cve.now/CVE-2006-2273.md): The InstallProduct routine in the Verisign VUpdater.Install (aka i-Nav) ActiveX control does not verify Microsoft Cabinet (.CAB) files, whic (no CVSS)
- [CVE-2006-2315](https://cve.now/CVE-2006-2315.md): PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier allows remote attackers to execute arbitrary PHP c (no CVSS)
- [CVE-2006-2316](https://cve.now/CVE-2006-2316.md): S24EvMon.exe in the Intel PROset/Wireless software, possibly 10.1.0.33, uses a S24EventManagerSharedMemory shared memory section with weak p (no CVSS)
- [CVE-2006-2317](https://cve.now/CVE-2006-2317.md): Unspecified vulnerability in Ideal Science Ideal BB 1.5.4a and earlier allows remote attackers to read arbitrary files under the web root vi (no CVSS)
- [CVE-2006-2318](https://cve.now/CVE-2006-2318.md): Incomplete blacklist vulnerability in Ideal Science Ideal BB 1.5.4a and earlier allows remote attackers to upload and execute an ASP script (no CVSS)
- [CVE-2006-2319](https://cve.now/CVE-2006-2319.md): Ideal Science Ideal BB 1.5.4a and earlier does not properly check file extensions before permitting an upload, which allows remote attackers (no CVSS)
- [CVE-2006-2320](https://cve.now/CVE-2006-2320.md): Multiple SQL injection vulnerabilities in Ideal Science Ideal BB 1.5.4a and earlier allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2006-2321](https://cve.now/CVE-2006-2321.md): Multiple cross-site scripting (XSS) vulnerabilities in Ideal Science Ideal BB 1.5.4a and earlier allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2006-2322](https://cve.now/CVE-2006-2322.md): The transparent proxy feature of the Cisco Application Velocity System (AVS) 3110 5.0 and 4.0 and earlier, and 3120 5.0.0 and earlier, has a (no CVSS)
- [CVE-2006-2323](https://cve.now/CVE-2006-2323.md): Multiple PHP remote file inclusion vulnerabilities in SmartISoft phpListPro 2.01 and earlier allow remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2006-2324](https://cve.now/CVE-2006-2324.md): 180solutions Zango downloads "required Adware components" without checking integrity or authenticity, which might allow context-dependent at (no CVSS)
- [CVE-2006-2325](https://cve.now/CVE-2006-2325.md): Cross-site scripting (XSS) vulnerability in index.php in OnlyScript.info Online Universal Payment System Script allows remote attackers to i (no CVSS)
- [CVE-2006-2326](https://cve.now/CVE-2006-2326.md): Directory traversal vulnerability in index.php in OnlyScript.info Online Universal Payment System Script allows remote attackers to read arb (no CVSS)
- [CVE-2006-2327](https://cve.now/CVE-2006-2327.md): Multiple integer overflows in the DPRPC library (DPRPCNLM.NLM) NDPS/iPrint module in Novell Distributed Print Services in Novell NetWare 6.5 (no CVSS)
- [CVE-2006-2328](https://cve.now/CVE-2006-2328.md): SQL injection vulnerability in lib/adodb/server.php in AngelineCMS 0.6.5 and earlier might allow remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2006-2329](https://cve.now/CVE-2006-2329.md): AngelineCMS 0.6.5 and earlier allow remote attackers to obtain sensitive information via a direct request for (1) adodb-access.inc.php, (2) (no CVSS)
- [CVE-2006-2330](https://cve.now/CVE-2006-2330.md): PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of (no CVSS)
- [CVE-2006-2331](https://cve.now/CVE-2006-2331.md): Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (no CVSS)
- [CVE-2006-2332](https://cve.now/CVE-2006-2332.md): Mozilla Firefox 1.5.0.3 allows remote attackers to cause a denial of service via a web page with a large number of IMG elements in which the (no CVSS)
- [CVE-2006-2333](https://cve.now/CVE-2006-2333.md): Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2006-2334](https://cve.now/CVE-2006-2334.md): The RtlDosPathNameToNtPathName\_U API function in NTDLL.DLL in Microsoft Windows 2000 SP4 and XP SP2 does not properly convert DOS style path (no CVSS)
- [CVE-2006-2335](https://cve.now/CVE-2006-2335.md): Jelsoft vBulletin accepts uploads of Cascading Style Sheets (CSS) and processes them in a way that allows remote authenticated administrator (no CVSS)
- [CVE-2006-2336](https://cve.now/CVE-2006-2336.md): SQL injection vulnerability in showthread.php in MyBB (aka MyBulletinBoard) 1.1.1 allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2006-2337](https://cve.now/CVE-2006-2337.md): Directory traversal vulnerability in webcm in the D-Link DSL-G604T Wireless ADSL Router Modem allows remote attackers to read arbitrary file (no CVSS)
- [CVE-2006-2338](https://cve.now/CVE-2006-2338.md): PlaNet Concept plaNetStat 20050127 allows remote attackers to gain administrative privileges, and view and configure log files, via a direct (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-05-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.