# CVEs published 2006-05-31

46 CVEs were published on May 31, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-2704](https://cve.now/CVE-2006-2704.md): Secure Elements Class 5 AVR server and client (aka C5 EVM) before 2.8.1 send messages in cleartext, which allows remote attackers to read se (no CVSS)
- [CVE-2006-2705](https://cve.now/CVE-2006-2705.md): Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 allows remote attackers to cause an unspecified denial of service via a large n (no CVSS)
- [CVE-2006-2706](https://cve.now/CVE-2006-2706.md): Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 allows remote attackers to cause a denial of service via forged "session start" (no CVSS)
- [CVE-2006-2707](https://cve.now/CVE-2006-2707.md): Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 does not validate the peer certificate when obtaining an update, which could al (no CVSS)
- [CVE-2006-2708](https://cve.now/CVE-2006-2708.md): Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 allows remote attackers to read portions of process memory via a modified size (no CVSS)
- [CVE-2006-2709](https://cve.now/CVE-2006-2709.md): Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 do not validate the source address of a message, which allows remote attackers to (1) (no CVSS)
- [CVE-2006-2710](https://cve.now/CVE-2006-2710.md): Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 uses the same invariant RSA key for all installations, which allows remote attackers w (no CVSS)
- [CVE-2006-2711](https://cve.now/CVE-2006-2711.md): Secure Elements Class 5 AVR (aka C5 EVM) 2.8.1 and earlier, and possibly later 2.8.x releases, uses the same initialization vector and key f (no CVSS)
- [CVE-2006-2712](https://cve.now/CVE-2006-2712.md): Secure Elements Class 5 AVR (aka C5 EVM) client and server before 2.8.1 do not verify the integrity of a message digest, which allows remote (no CVSS)
- [CVE-2006-2713](https://cve.now/CVE-2006-2713.md): Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 generates predictable CEIDs, which allows remote attackers to determine the CEI (no CVSS)
- [CVE-2006-2714](https://cve.now/CVE-2006-2714.md): Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 does not validate the CEID of an incoming message, which allows remote attacker (no CVSS)
- [CVE-2006-2715](https://cve.now/CVE-2006-2715.md): The Administration Console in Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 does not enforce access control, which allows remote att (no CVSS)
- [CVE-2006-2716](https://cve.now/CVE-2006-2716.md): Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 uses a hard-coded user ID and password, which allows remote attackers to gain a (no CVSS)
- [CVE-2006-2717](https://cve.now/CVE-2006-2717.md): Unspecified vulnerability in Secure Elements Class 5 AVR client and server (aka C5 EVM) before 2.8.1 allows authenticated attackers to overw (no CVSS)
- [CVE-2006-1515](https://cve.now/CVE-2006-1515.md): Buffer overflow in the addnewword function in typespeed 0.4.4 and earlier might allow remote attackers to execute arbitrary code via unknown (no CVSS)
- [CVE-2004-0138](https://cve.now/CVE-2004-0138.md): The ELF loader in Linux kernel 2.4 before 2.4.25 allows local users to cause a denial of service (crash) via a crafted ELF file with an inte (no CVSS)
- [CVE-2004-0997](https://cve.now/CVE-2004-0997.md): Unspecified vulnerability in the ptrace MIPS assembly code in Linux kernel 2.4 before 2.4.17 allows local users to gain privileges via unkno (no CVSS)
- [CVE-2005-0489](https://cve.now/CVE-2005-0489.md): The /proc handling (proc/base.c) Linux kernel 2.4 before 2.4.17 allows local users to cause a denial of service via unknown vectors that cau (no CVSS)
- [CVE-2006-1175](https://cve.now/CVE-2006-1175.md): The WeOnlyDo! SFTP (wodSFTP) ActiveX control is marked as safe for scripting, which allows remote attackers to read and write files in arbit (no CVSS)
- [CVE-2006-2676](https://cve.now/CVE-2006-2676.md): Dispatch.cgi/\_user/uservCard/ in SiteScape Forum 7.2 and possibly earlier generates different responses in a way that allows remote attacker (no CVSS)
- [CVE-2006-2677](https://cve.now/CVE-2006-2677.md): SiteScape Forum 7.2 and possibly earlier stores the avf.rc configuraiton file under the web document root with insufficient access control, (no CVSS)
- [CVE-2006-2678](https://cve.now/CVE-2006-2678.md): Multiple cross-site scripting (XSS) vulnerabilities in Pre News Manager 1.0 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2006-2679](https://cve.now/CVE-2006-2679.md): Unspecified vulnerability in the VPN Client for Windows Graphical User Interface (GUI) (aka the VPN client dialer) in Cisco VPN Client for W (no CVSS)
- [CVE-2006-2680](https://cve.now/CVE-2006-2680.md): Cross-site scripting (XSS) vulnerability in index.php in AZ Photo Album Script Pro allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-2681](https://cve.now/CVE-2006-2681.md): PHP remote file inclusion vulnerability in SocketMail Lite and Pro 2.2.6 and earlier, when register\_globals and magic\_quotes are enabled, al (no CVSS)
- [CVE-2006-2682](https://cve.now/CVE-2006-2682.md): PHP remote file inclusion vulnerability in BE\_config.php in Back-End CMS 0.7.2.1 and earlier allows remote attackers to execute arbitrary PH (no CVSS)
- [CVE-2006-2683](https://cve.now/CVE-2006-2683.md): PHP remote file inclusion vulnerability in 404.php in open-medium.CMS 0.25 allows remote attackers to execute arbitrary PHP code via a URL i (no CVSS)
- [CVE-2006-2684](https://cve.now/CVE-2006-2684.md): Cross-site scripting (XSS) vulnerability in the search module in CMS Mundo 1.0 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2006-2685](https://cve.now/CVE-2006-2685.md): PHP remote file inclusion vulnerability in Basic Analysis and Security Engine (BASE) 1.2.4 and earlier, with register\_globals enabled, allow (no CVSS)
- [CVE-2006-2686](https://cve.now/CVE-2006-2686.md): PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS\[ (no CVSS)
- [CVE-2006-2687](https://cve.now/CVE-2006-2687.md): Cross-site scripting (XSS) vulnerability in adduser.php in PHP-AGTC Membership System 1.1a and earlier allows remote attackers to inject arb (no CVSS)
- [CVE-2006-2688](https://cve.now/CVE-2006-2688.md): SQL injection vulnerability in the employees node (class.employee.inc) in Achievo 1.1.0 and earlier and 1.2 and earlier allows remote attack (no CVSS)
- [CVE-2006-2689](https://cve.now/CVE-2006-2689.md): Multiple cross-site scripting (XSS) vulnerabilities in EVA-Web 2.1.2 and earlier allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2006-2690](https://cve.now/CVE-2006-2690.md): An unspecified script in EVA-Web 2.1.2 and earlier, probably index.php, allows remote attackers to obtain the full path of the web server vi (no CVSS)
- [CVE-2006-2691](https://cve.now/CVE-2006-2691.md): Unspecified "information leakage" vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to access arbitrary images, incl (no CVSS)
- [CVE-2006-2692](https://cve.now/CVE-2006-2692.md): Multiple unspecified vulnerabilities in aMuleWeb for AMule before 2.1.2 allow remote attackers to read arbitrary image, HTML, or PHP files v (no CVSS)
- [CVE-2006-2693](https://cve.now/CVE-2006-2693.md): Directory traversal vulnerability in admin/admin\_hacks\_list.php in Nivisec Hacks List 1.20 and earlier for phpBB, when register\_globals is e (no CVSS)
- [CVE-2006-2694](https://cve.now/CVE-2006-2694.md): Multiple PHP remote file inclusion vulnerabilities in EzUpload Pro 2.10 allow remote attackers to execute arbitrary PHP code via a URL in th (no CVSS)
- [CVE-2006-2695](https://cve.now/CVE-2006-2695.md): admin/upprocess.php in DGNews 1.5 and earlier allows remote attackers to execute arbitrary code by uploading scripts with arbitrary extensio (no CVSS)
- [CVE-2006-2696](https://cve.now/CVE-2006-2696.md): Cross-site scripting (XSS) vulnerabilities in Easy-Content Forums 1.0 allow remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2006-2697](https://cve.now/CVE-2006-2697.md): Multiple SQL injection vulnerabilities in Easy-Content Forums 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) start (no CVSS)
- [CVE-2006-2698](https://cve.now/CVE-2006-2698.md): Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid argument (no CVSS)
- [CVE-2006-2699](https://cve.now/CVE-2006-2699.md): Cross-site scripting (XSS) vulnerability in getimage.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to inject arbitrary HTML or (no CVSS)
- [CVE-2006-2700](https://cve.now/CVE-2006-2700.md): SQL injection vulnerability in admin/auth.inc.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2006-2701](https://cve.now/CVE-2006-2701.md): SQL injection vulnerability in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors re (no CVSS)
- [CVE-2006-2702](https://cve.now/CVE-2006-2702.md): vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PC\_REMOTE\_ADDR HTTP (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-05-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.