# CVEs published 2006-05-19

36 CVEs were published on May 19, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-1856](https://cve.now/CVE-2006-1856.md): Certain modifications to the Linux kernel 2.6.16 and earlier do not add the appropriate Linux Security Modules (LSM) file\_permission hooks t (no CVSS)
- [CVE-2006-2483](https://cve.now/CVE-2006-2483.md): PHP remote file inclusion vulnerability in cart\_content.php in Squirrelcart 2.2.2 and earlier allows remote attackers to execute arbitrary P (no CVSS)
- [CVE-2006-2484](https://cve.now/CVE-2006-2484.md): Cross-site scripting (XSS) vulnerability in index.html in IceWarp WebMail 5.5.1 and earlier allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2006-2485](https://cve.now/CVE-2006-2485.md): PHP remote file inclusion vulnerability in includes/class\_template.php in Quezza 1.0 and earlier, and possibly 1.1.0 allows remote attackers (no CVSS)
- [CVE-2006-2486](https://cve.now/CVE-2006-2486.md): SQL injection vulnerability in find.php in YapBB 1.2 Beta2 and earlier allows remote attackers to execute arbitrary SQL commands via the use (no CVSS)
- [CVE-2006-2487](https://cve.now/CVE-2006-2487.md): Multiple PHP remote file inclusion vulnerabilities in ScozNews 1.2.1 and earlier allow remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2006-2488](https://cve.now/CVE-2006-2488.md): Multiple cross-site scripting (XSS) vulnerabilities in Spymac WebOS (WOS) 5.0 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-2489](https://cve.now/CVE-2006-2489.md): Integer overflow in CGI scripts in Nagios 1.x before 1.4.1 and 2.x before 2.3.1 allows remote attackers to cause a denial of service (crash) (no CVSS)
- [CVE-2006-2490](https://cve.now/CVE-2006-2490.md): Multiple cross-site scripting (XSS) vulnerabilities in Mobotix IP Network Cameras M1 1.9.4.7 and M10 2.0.5.2, and other versions before 2.2. (no CVSS)
- [CVE-2006-2491](https://cve.now/CVE-2006-2491.md): Cross-site scripting (XSS) vulnerability in (1) index.php and (2) bmc/admin.php in BoastMachine (bMachine) 3.1 and earlier allows remote att (no CVSS)
- [CVE-2005-3782](https://cve.now/CVE-2005-3782.md): Mac OS X 10.4.3 up to 10.4.6, when loginwindow uses the "Name and password" setting, and the "Show the Restart, Sleep, and Shut Down buttons (no CVSS)
- [CVE-2006-0039](https://cve.now/CVE-2006-0039.md): Race condition in the do\_add\_counters function in netfilter for Linux kernel 2.6.16 allows local users with CAP\_NET\_ADMIN capabilities to re (no CVSS)
- [CVE-2006-2312](https://cve.now/CVE-2006-2312.md): Argument injection vulnerability in the URI handler in Skype 2.0.\*.104 and 2.5.\*.0 through 2.5.\*.78 for Windows allows remote authorized att (no CVSS)
- [CVE-2006-2480](https://cve.now/CVE-2006-2480.md): Format string vulnerability in Dia 0.94 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary c (no CVSS)
- [CVE-2006-0059](https://cve.now/CVE-2006-0059.md): Heap-based buffer overflow in the ISO Transport Service over TCP (RFC 1006) implementation of LiveData ICCP Server before 5.00.035 allows re (no CVSS)
- [CVE-2006-2473](https://cve.now/CVE-2006-2473.md): Cross-site scripting (XSS) vulnerability in ow.asp in OpenWiki 0.78 allows remote attackers to inject arbitrary web script or HTML via the p (no CVSS)
- [CVE-2006-2474](https://cve.now/CVE-2006-2474.md): SQL injection vulnerability in lshop.cgi in Cosmoshop 8.11.106 and earlier allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2006-2475](https://cve.now/CVE-2006-2475.md): Directory traversal vulnerability in (1) edit\_mailtexte.cgi and (2) bestmail.cgi in Cosmoshop 8.11.106 and earlier allows remote administrat (no CVSS)
- [CVE-2006-2476](https://cve.now/CVE-2006-2476.md): Bitrix Site Manager 4.1.x stores updater.log under the web document root with insufficient access control, which allows remote attackers to (no CVSS)
- [CVE-2006-2477](https://cve.now/CVE-2006-2477.md): Cross-site scripting (XSS) vulnerability in the administrative interface Bitrix Site Manager 4.1.x allows remote attackers to inject arbitra (no CVSS)
- [CVE-2006-2478](https://cve.now/CVE-2006-2478.md): Bitrix Site Manager 4.1.x allows remote attackers to redirect users to other websites via a modified back\_url during a HTTP POST request. (no CVSS)
- [CVE-2006-2479](https://cve.now/CVE-2006-2479.md): The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers (no CVSS)
- [CVE-2006-2459](https://cve.now/CVE-2006-2459.md): SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to execute arbitrary SQL co (no CVSS)
- [CVE-2006-2460](https://cve.now/CVE-2006-2460.md): Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when register\_globals is enabled, does not protect critical variables such as $\_GLOBALS (no CVSS)
- [CVE-2006-2461](https://cve.now/CVE-2006-2461.md): BEA WebLogic Server before 8.1 Service Pack 4 does not properly set the Quality of Service in certain circumstances, which prevents some tra (no CVSS)
- [CVE-2006-2462](https://cve.now/CVE-2006-2462.md): BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6, may send sensitive data over non-secure channels when using JTA (no CVSS)
- [CVE-2006-2463](https://cve.now/CVE-2006-2463.md): view\_album.php in SelectaPix 1.31 and earlier allows remote attackers to obtain the installation path via a certain request, which displays (no CVSS)
- [CVE-2006-2464](https://cve.now/CVE-2006-2464.md): stopWebLogic.sh in BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6 displays the administrator password to stdout (no CVSS)
- [CVE-2006-2465](https://cve.now/CVE-2006-2465.md): Buffer overflow in MP3Info 0.8.4 allows attackers to execute arbitrary code via a long command line argument. (no CVSS)
- [CVE-2006-2466](https://cve.now/CVE-2006-2466.md): BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 allows remote attackers to obtain the source code of JSP pages during certain circumstan (no CVSS)
- [CVE-2006-2467](https://cve.now/CVE-2006-2467.md): BEA WebLogic Server 8.1 up to SP4, 7.0 up to SP6, and 6.1 up to SP7 displays the internal IP address of the WebLogic server in the WebLogic (no CVSS)
- [CVE-2006-2468](https://cve.now/CVE-2006-2468.md): The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain name in the Console lo (no CVSS)
- [CVE-2006-2469](https://cve.now/CVE-2006-2469.md): The HTTP handlers in BEA WebLogic Server 9.0, 8.1 up to SP5, 7.0 up to SP6, and 6.1 up to SP7 stores the username and password in cleartext (no CVSS)
- [CVE-2006-2470](https://cve.now/CVE-2006-2470.md): Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the console from setting custom (no CVSS)
- [CVE-2006-2471](https://cve.now/CVE-2006-2471.md): Multiple vulnerabilities in BEA WebLogic Server 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 leak sensitive information to remote a (no CVSS)
- [CVE-2006-2472](https://cve.now/CVE-2006-2472.md): Unspecified vulnerability in BEA WebLogic Server 9.1 and 9.0, 8.1 through SP5, 7.0 through SP6, and 6.1 through SP7 allows untrusted applica (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-05-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.