# CVEs published 2006-06-28 24 CVEs were published on June 28, 2006: 0 critical, 0 high. Days are UTC. - [CVE-2006-3286](https://cve.now/CVE-2006-3286.md): The internal database in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(63) stores a hard-coded username and password (no CVSS) - [CVE-2006-3287](https://cve.now/CVE-2006-3287.md): Cisco Wireless Control System (WCS) for Linux and Windows 4.0(1) and earlier uses a default administrator username "root" and password "publ (no CVSS) - [CVE-2006-3288](https://cve.now/CVE-2006-3288.md): Unspecified vulnerability in the TFTP server in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51), when configured to (no CVSS) - [CVE-2006-3289](https://cve.now/CVE-2006-3289.md): Cross-site scripting (XSS) vulnerability in the login page of the HTTP interface for the Cisco Wireless Control System (WCS) for Linux and W (no CVSS) - [CVE-2006-3290](https://cve.now/CVE-2006-3290.md): HTTP server in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) stores sensitive information under the web root with (no CVSS) - [CVE-2006-3291](https://cve.now/CVE-2006-3291.md): The web interface on Cisco IOS 12.3(8)JA and 12.3(8)JA1, as used on the Cisco Wireless Access Point and Wireless Bridge, reconfigures itself (no CVSS) - [CVE-2006-3292](https://cve.now/CVE-2006-3292.md): SQL injection vulnerability in the Search gadget in Jaws 0.6.2 allows remote attackers to execute arbitrary SQL commands via queries with th (no CVSS) - [CVE-2006-3269](https://cve.now/CVE-2006-3269.md): PHP remote file inclusion vulnerability in includes/functions\_cms.php in THoRCMS 1.3.1 allows remote attackers to execute arbitrary PHP code (no CVSS) - [CVE-2006-3270](https://cve.now/CVE-2006-3270.md): SQL injection vulnerability in cms\_admin.php in THoRCMS 1.3.1 allows remote attackers to execute arbitrary SQL commands via multiple unspeci (no CVSS) - [CVE-2006-3271](https://cve.now/CVE-2006-3271.md): Multiple SQL injection vulnerabilities in Softbiz Dating 1.0 allow remote attackers to execute SQL commands via the (1) country and (2) sort (no CVSS) - [CVE-2006-3272](https://cve.now/CVE-2006-3272.md): Cross-site request forgery (CSRF) vulnerability in menu.php in Some Chess 1.5 rc2 allows remote attackers to conduct actions as another user (no CVSS) - [CVE-2006-3273](https://cve.now/CVE-2006-3273.md): Cross-site scripting (XSS) vulnerability in menu.php in Some Chess 1.5 rc1 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS) - [CVE-2006-3274](https://cve.now/CVE-2006-3274.md): Directory traversal vulnerability in Webmin before 1.280, when run on Windows, allows remote attackers to read arbitrary files via \\ (backsl (no CVSS) - [CVE-2006-3275](https://cve.now/CVE-2006-3275.md): SQL injection vulnerability in profile.php in YaBB SE 1.5.5 and earlier allows remote attackers to execute SQL commands via a double-encoded (no CVSS) - [CVE-2006-3276](https://cve.now/CVE-2006-3276.md): Heap-based buffer overflow in RealNetworks Helix DNA Server 10.0 and 11.0 allows remote attackers to execute arbitrary code via (1) a long U (no CVSS) - [CVE-2006-3277](https://cve.now/CVE-2006-3277.md): The SMTP service of MailEnable Standard 1.92 and earlier, Professional 2.0 and earlier, and Enterprise 2.0 and earlier before the MESMTPC ho (no CVSS) - [CVE-2006-3278](https://cve.now/CVE-2006-3278.md): Cross-site scripting (XSS) vulnerability in H-Sphere 2.5.1 Beta 1 and earlier allows remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2006-3279](https://cve.now/CVE-2006-3279.md): Cross-site scripting (XSS) vulnerability in aeDating 4.1 allows remote attackers to inject arbitrary web script or HTML via the (1) Sex para (no CVSS) - [CVE-2006-3280](https://cve.now/CVE-2006-3280.md): Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains vi (no CVSS) - [CVE-2006-3281](https://cve.now/CVE-2006-3281.md): Microsoft Internet Explorer 6.0 does not properly handle Drag and Drop events, which allows remote user-assisted attackers to execute arbitr (no CVSS) - [CVE-2006-3282](https://cve.now/CVE-2006-3282.md): requirements.php in Dating Agent PRO 4.7.1 allows remote attackers to obtain sensitive information via a direct request, which calls the php (no CVSS) - [CVE-2006-3283](https://cve.now/CVE-2006-3283.md): SQL injection vulnerability in Dating Agent PRO 4.7.1 allows remote attackers to execute arbitrary SQL commands via the (1) pid parameter in (no CVSS) - [CVE-2006-3284](https://cve.now/CVE-2006-3284.md): Cross-site scripting (XSS) vulnerability in Dating Agent PRO 4.7.1 allows remote attackers to inject arbitrary web script or HTML via the lo (no CVSS) - [CVE-2006-3285](https://cve.now/CVE-2006-3285.md): The internal database in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) uses an undocumented, hard-coded username (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2006-06-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.