# CVEs published 2006-07-06

53 CVEs were published on July 6, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-3355](https://cve.now/CVE-2006-3355.md): Heap-based buffer overflow in httpdget.c in mpg123 before 0.59s-rll allows remote attackers to execute arbitrary code via a long URL, which (no CVSS)
- [CVE-2006-3356](https://cve.now/CVE-2006-3356.md): The TIFFFetchAnyArray function in ImageIO in Apple OS X 10.4.7 and earlier allows remote user-assisted attackers to cause a denial of servic (no CVSS)
- [CVE-2006-3357](https://cve.now/CVE-2006-3357.md): Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet Explorer 6.0 allows remote attackers to cause a d (no CVSS)
- [CVE-2006-3358](https://cve.now/CVE-2006-3358.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in NewsPHP 2006 PRO allow remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2006-3359](https://cve.now/CVE-2006-3359.md): Multiple SQL injection vulnerabilities in index.php in NewsPHP 2006 PRO allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2006-3361](https://cve.now/CVE-2006-3361.md): PHP remote file inclusion vulnerability in Stud.IP 1.3.0-2 and earlier, when register\_globals is enabled, allows remote attackers to execute (no CVSS)
- [CVE-2006-3362](https://cve.now/CVE-2006-3362.md): Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through (no CVSS)
- [CVE-2006-3363](https://cve.now/CVE-2006-3363.md): PHP remote file inclusion vulnerability in index.php in the Glossaire module 1.7 for Xoops allows remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2006-3364](https://cve.now/CVE-2006-3364.md): SQL injection vulnerability in index.php in the NP\_SEO plugin in BLOG:CMS before 4.1.0 allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2006-3365](https://cve.now/CVE-2006-3365.md): V3 Chat allows remote attackers to obtain the installation path via (1) an invalid id parameter to mail/index.php or (2) membername paramete (no CVSS)
- [CVE-2006-3366](https://cve.now/CVE-2006-3366.md): Multiple cross-site scripting (XSS) vulnerabilities in V3 Chat allow remote attackers to inject arbitrary web script or HTML via crafted HTM (no CVSS)
- [CVE-2006-3367](https://cve.now/CVE-2006-3367.md): Mp3 JudeBox Server (Mp3NetBox) Beta 1 stores config.inc under the web document root with insufficient access control, which allows remote at (no CVSS)
- [CVE-2006-3368](https://cve.now/CVE-2006-3368.md): Efone 20000723 stores config.inc under the web document root with insufficient access control, which allows remote attackers to obtain sensi (no CVSS)
- [CVE-2006-3369](https://cve.now/CVE-2006-3369.md): Kamikaze-QSCM 0.1 stores config.inc under the web document root with insufficient access control, which allows remote attackers to obtain se (no CVSS)
- [CVE-2006-3370](https://cve.now/CVE-2006-3370.md): Blueboy 1.0.3 stores bb\_news\_config.inc under the web document root with insufficient access control, which allows remote attackers to obtai (no CVSS)
- [CVE-2006-3371](https://cve.now/CVE-2006-3371.md): Eupla Foros 1.0 stores the inc/config.inc file under the web document root with insufficient access control, which allows remote attackers t (no CVSS)
- [CVE-2006-3372](https://cve.now/CVE-2006-3372.md): Apple Safari 2.0.4/419.3 allows remote attackers to cause a denial of service (application crash) via a DHTML setAttributeNode function call (no CVSS)
- [CVE-2006-3373](https://cve.now/CVE-2006-3373.md): Unspecified vulnerability in the client/bin/logfetch script in Hobbit 4.2-beta allows local users to read arbitrary files, related to logfet (no CVSS)
- [CVE-2006-3374](https://cve.now/CVE-2006-3374.md): PHP remote file inclusion vulnerability in index.php in Randshop 1.2 and earlier, including 0.9.3, allows remote attackers to execute arbitr (no CVSS)
- [CVE-2006-3375](https://cve.now/CVE-2006-3375.md): PHP remote file inclusion vulnerability in includes/header.inc.php in Randshop 1.1.1 allows remote attackers to execute arbitrary PHP code v (no CVSS)
- [CVE-2006-3376](https://cve.now/CVE-2006-3376.md): Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libg (no CVSS)
- [CVE-2006-3377](https://cve.now/CVE-2006-3377.md): Cross-site scripting (XSS) vulnerability in JMB Software AutoRank PHP 3.02 and earlier, and AutoRank Pro 5.01 and earlier, allows remote att (no CVSS)
- [CVE-2006-3378](https://cve.now/CVE-2006-3378.md): passwd command in shadow in Ubuntu 5.04 through 6.06 LTS, when called with the -f, -g, or -s flag, does not check the return code of a setui (no CVSS)
- [CVE-2006-3379](https://cve.now/CVE-2006-3379.md): Algorithmic complexity vulnerability in Hiki Wiki 0.6.0 through 0.6.5 and 0.8.0 through 0.8.5 allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2006-3380](https://cve.now/CVE-2006-3380.md): Algorithmic complexity vulnerability in FreeStyle Wiki before 3.6.2 allows remote attackers to cause a denial of service (CPU consumption) b (no CVSS)
- [CVE-2006-3381](https://cve.now/CVE-2006-3381.md): SturGeoN Upload allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension, then directly accessing the (no CVSS)
- [CVE-2006-3382](https://cve.now/CVE-2006-3382.md): Cross-site scripting (XSS) vulnerability in search.php in mAds 1.0 allows remote attackers to inject arbitrary web script or HTML via the "s (no CVSS)
- [CVE-2006-3383](https://cve.now/CVE-2006-3383.md): Cross-site scripting (XSS) vulnerability in index.php in mAds 1.0 allows remote attackers to inject arbitrary web script or HTML via Javascr (no CVSS)
- [CVE-2006-3384](https://cve.now/CVE-2006-3384.md): SQL injection vulnerability in divers.php in Vincent Leclercq News 5.2 allows remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2006-3385](https://cve.now/CVE-2006-3385.md): Cross-site scripting (XSS) vulnerability in divers.php in Vincent Leclercq News 5.2 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2006-3386](https://cve.now/CVE-2006-3386.md): index.php in Vincent Leclercq News 5.2 allows remote attackers to obtain sensitive information, such as the installation path, via a mail\[\] (no CVSS)
- [CVE-2006-3387](https://cve.now/CVE-2006-3387.md): Directory traversal vulnerability in sources/post.php in Fusion News 1.0, when register\_globals is enabled, allows remote attackers to inclu (no CVSS)
- [CVE-2006-3388](https://cve.now/CVE-2006-3388.md): Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the t (no CVSS)
- [CVE-2006-3389](https://cve.now/CVE-2006-3389.md): index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged param (no CVSS)
- [CVE-2006-3390](https://cve.now/CVE-2006-3390.md): WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-a (no CVSS)
- [CVE-2006-3391](https://cve.now/CVE-2006-3391.md): The Execute function in iMBCContents ActiveX Control before 2.0.0.59 allows remote attackers to execute arbitrary files via the file URI han (no CVSS)
- [CVE-2006-3392](https://cve.now/CVE-2006-3392.md): Webmin before 1.290 and Usermin before 1.220 calls the simplify\_path function before decoding HTML, which allows remote attackers to read ar (no CVSS)
- [CVE-2006-3393](https://cve.now/CVE-2006-3393.md): Papyrus NASCAR Racing 4 4.1.3.1.6 and earlier, 2002 Season 1.1.0.2 and earlier, and 2003 Season 1.2.0.1 and earlier allows remote attackers (no CVSS)
- [CVE-2006-3394](https://cve.now/CVE-2006-3394.md): SQL injection vulnerability in the files mod in index.php in BXCP 0.3.0.4 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2006-3395](https://cve.now/CVE-2006-3395.md): PHP remote file inclusion vulnerability in top.php in SiteBuilder-FX 3.5 allows remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2006-3396](https://cve.now/CVE-2006-3396.md): PHP remote file inclusion vulnerability in galleria.html.php in Galleria Mambo Module 1.0 and earlier for Mambo allows remote attackers to e (no CVSS)
- [CVE-2006-3397](https://cve.now/CVE-2006-3397.md): Multiple cross-site scripting (XSS) vulnerabilities in Taskjitsu before 2.0.1 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-3398](https://cve.now/CVE-2006-3398.md): The "change password forms" in Taskjitsu before 2.0.1 includes password hashes in hidden form fields, which allows remote attackers to obtai (no CVSS)
- [CVE-2006-3399](https://cve.now/CVE-2006-3399.md): Cross-site scripting (XSS) vulnerability in wiki.php in MoniWiki before 1.1.2-20060702 allows remote attackers to inject arbitrary Javascrip (no CVSS)
- [CVE-2006-3400](https://cve.now/CVE-2006-3400.md): Stack-based buffer overflow in the CG\_ServerCommand function in Quake 3 Engine as used by Soldier of Fortune 2 (SOF2MP) GOLD 1.03 allows rem (no CVSS)
- [CVE-2006-3401](https://cve.now/CVE-2006-3401.md): Stack-based buffer overflow in Quake 3 Engine as used by Quake 3: Arena 1.32b and 1.32c allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2006-3402](https://cve.now/CVE-2006-3402.md): SQL injection vulnerability in VirtuaStore 2.0 allows remote attackers to execute arbitrary SQL commands via the password parameter when log (no CVSS)
- [CVE-2006-3404](https://cve.now/CVE-2006-3404.md): Buffer overflow in the xcf\_load\_vector function in app/xcf/xcf-load.c for gimp before 2.2.12 allows user-assisted attackers to cause a denia (no CVSS)
- [CVE-2006-3351](https://cve.now/CVE-2006-3351.md): Buffer overflow in Windows Explorer (explorer.exe) on Windows XP and 2003 allows user-assisted attackers to cause a denial of service (repea (no CVSS)
- [CVE-2006-3352](https://cve.now/CVE-2006-3352.md): Cross-domain vulnerability in Mozilla Firefox allows remote attackers to access restricted information from other domains via an object tag (no CVSS)
- [CVE-2006-3353](https://cve.now/CVE-2006-3353.md): Opera 9 allows remote attackers to cause a denial of service (crash) via a crafted web page that triggers an out-of-bounds memory access, re (no CVSS)
- [CVE-2006-3354](https://cve.now/CVE-2006-3354.md): Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the Filter property of an ADODB.Record (no CVSS)
- [CVE-2006-3360](https://cve.now/CVE-2006-3360.md): Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via (no CVSS, phpsysinfo/phpsysinfo)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-07-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.