# CVEs published 2006-07-07 29 CVEs were published on July 7, 2006: 0 critical, 0 high. Days are UTC. - [CVE-2006-3458](https://cve.now/CVE-2006-3458.md): Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restr (no CVSS, zope2) - [CVE-2006-2451](https://cve.now/CVE-2006-2451.md): The suid\_dumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and 2.6.16 before 2.6.16.24, allows a local user to cause a (no CVSS) - [CVE-2006-3431](https://cve.now/CVE-2006-3431.md): Buffer overflow in certain Asian language versions of Microsoft Excel might allow user-assisted attackers to execute arbitrary code via a cr (no CVSS) - [CVE-2006-3405](https://cve.now/CVE-2006-3405.md): Cross-site scripting (XSS) vulnerability in qtofm.php in QTOFileManager 1.0 allows remote attackers to inject arbitrary web script or HTML v (no CVSS) - [CVE-2006-3406](https://cve.now/CVE-2006-3406.md): Directory traversal vulnerability in qtofm.php in QTOFileManager 1.0 allows remote attackers to modify arbitrary files via a .. (no CVSS) - [CVE-2006-3407](https://cve.now/CVE-2006-3407.md): Tor before 0.1.1.20 allows remote attackers to spoof log entries or possibly execute shell code via strings with non-printable characters. (no CVSS) - [CVE-2006-3408](https://cve.now/CVE-2006-3408.md): Unspecified vulnerability in the directory server (dirserver) in Tor before 0.1.1.20 allows remote attackers to cause an unspecified denial (no CVSS) - [CVE-2006-3409](https://cve.now/CVE-2006-3409.md): Integer overflow in Tor before 0.1.1.20 allows remote attackers to execute arbitrary code via crafted large inputs, which result in a buffer (no CVSS) - [CVE-2006-3410](https://cve.now/CVE-2006-3410.md): Tor before 0.1.1.20 creates "internal circuits" primarily consisting of nodes with "useful exit nodes," which allows remote attackers to con (no CVSS) - [CVE-2006-3411](https://cve.now/CVE-2006-3411.md): TLS handshakes in Tor before 0.1.1.20 generate public-private keys based on TLS context rather than the connection, which makes it easier fo (no CVSS) - [CVE-2006-3412](https://cve.now/CVE-2006-3412.md): Tor before 0.1.1.20 does not sufficiently obey certain firewall options, which allows remote attackers to bypass intended access restriction (no CVSS) - [CVE-2006-3413](https://cve.now/CVE-2006-3413.md): The privoxy configuration file in Tor before 0.1.1.20, when run on Apple OS X, logs all data via the "logfile", which allows attackers to ob (no CVSS) - [CVE-2006-3414](https://cve.now/CVE-2006-3414.md): Tor before 0.1.1.20 supports server descriptors that contain hostnames instead of IP addresses, which allows remote attackers to arbitrarily (no CVSS) - [CVE-2006-3415](https://cve.now/CVE-2006-3415.md): Tor before 0.1.1.20 uses improper logic to validate the "OR" destination, which allows remote attackers to perform a man-in-the-middle (MITM (no CVSS) - [CVE-2006-3416](https://cve.now/CVE-2006-3416.md): Tor before 0.1.1.20 kills the circuit when it receives an unrecognized relay command, which causes network circuits to be disbanded. (no CVSS) - [CVE-2006-3417](https://cve.now/CVE-2006-3417.md): Tor client before 0.1.1.20 prefers entry points based on is\_fast or is\_stable flags, which could allow remote attackers to be preferred over (no CVSS) - [CVE-2006-3418](https://cve.now/CVE-2006-3418.md): Tor before 0.1.1.20 does not validate that a server descriptor's fingerprint line matches its identity key, which allows remote attackers to (no CVSS) - [CVE-2006-3419](https://cve.now/CVE-2006-3419.md): Tor before 0.1.1.20 uses OpenSSL pseudo-random bytes (RAND\_pseudo\_bytes) instead of cryptographically strong RAND\_bytes, and seeds the entro (no CVSS) - [CVE-2006-3420](https://cve.now/CVE-2006-3420.md): Cross-site request forgery (CSRF) vulnerability in editpost.php in MyBulletinBoard (MyBB) before 1.1.5 allows remote attackers to perform un (no CVSS) - [CVE-2006-3421](https://cve.now/CVE-2006-3421.md): PHP remote file inclusion vulnerability in SmartSiteCMS 1.0 and earlier, when register\_globals is enabled, allows remote attackers to execut (no CVSS) - [CVE-2006-3422](https://cve.now/CVE-2006-3422.md): PHP remote file inclusion vulnerability in WonderEdit Pro CMS allows remote attackers to execute arbitrary PHP code via the config\[template\_ (no CVSS) - [CVE-2006-3423](https://cve.now/CVE-2006-3423.md): WebEx Downloader ActiveX Control and WebEx Downloader Java before 2.1.0.0 do not validate downloaded components, which allows remote attacke (no CVSS) - [CVE-2006-3424](https://cve.now/CVE-2006-3424.md): Multiple buffer overflows in WebEx Downloader ActiveX Control, possibly in versions before November 2005, allow remote attackers to execute (no CVSS) - [CVE-2006-3425](https://cve.now/CVE-2006-3425.md): FastPatch for (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1, and (b) Novell ZENworks 6.2 SR1 and earlier, doe (no CVSS) - [CVE-2006-3426](https://cve.now/CVE-2006-3426.md): Directory traversal vulnerability in (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (b) Novell ZENworks 6. (no CVSS) - [CVE-2006-3427](https://cve.now/CVE-2006-3427.md): Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by declaring the sourceURL attribute on an uninit (no CVSS) - [CVE-2006-3428](https://cve.now/CVE-2006-3428.md): Cross-site scripting (XSS) vulnerability in TigerTom TTCalc 1.0 allows remote attackers to inject arbitrary web script or HTML via the year (no CVSS) - [CVE-2006-3429](https://cve.now/CVE-2006-3429.md): Cross-site scripting (XSS) vulnerability in TigerTom TTCalc 1.0 allows remote attackers to inject arbitrary web script or HTML via the curre (no CVSS) - [CVE-2006-3430](https://cve.now/CVE-2006-3430.md): SQL injection vulnerability in checkprofile.asp in (1) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (2) Nove (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2006-07-07 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.