# CVEs published 2006-07-21

44 CVEs were published on July 21, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-3780](https://cve.now/CVE-2006-3780.md): Keyifweb Keyif Portal 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to (no CVSS)
- [CVE-2006-3781](https://cve.now/CVE-2006-3781.md): Unspecified vulnerability in Sun Solaris 10 allows context-dependent attackers to cause a denial of service (panic) via unspecified vectors (no CVSS)
- [CVE-2006-3782](https://cve.now/CVE-2006-3782.md): Unspecified vulnerability in the kernel debugger (kmdb) in Sun Solaris 10, when running on x86, allows local users to cause a denial of serv (no CVSS)
- [CVE-2006-3783](https://cve.now/CVE-2006-3783.md): Sun Solaris 10 allows local users to cause a denial of service (panic) via unspecified vectors involving (1) the /net mount point and (2) th (no CVSS)
- [CVE-2006-3784](https://cve.now/CVE-2006-3784.md): Symantec pcAnywhere 12.5 uses weak default permissions for the "Symantec\\pcAnywhere\\Hosts" folder, which allows local users to gain privileg (no CVSS)
- [CVE-2006-3785](https://cve.now/CVE-2006-3785.md): Symantec pcAnywhere 12.5 obfuscates the passwords in a GUI textbox with asterisks but does not encrypt them in the associated .cif (aka call (no CVSS)
- [CVE-2006-3786](https://cve.now/CVE-2006-3786.md): Symantec pcAnywhere 12.5 uses weak integrity protection for .cif (aka caller or CallerID) files, which allows local users to generate a cust (no CVSS)
- [CVE-2006-3787](https://cve.now/CVE-2006-3787.md): kpf4ss.exe in Sunbelt Kerio Personal Firewall 4.3.x before 4.3.268 does not properly hook the CreateRemoteThread API function, which allows (no CVSS)
- [CVE-2006-3788](https://cve.now/CVE-2006-3788.md): Multiple buffer overflows in multiplay.cpp in UFO2000 svn 1057 allow remote attackers to execute arbitrary code via (1) a long unit name in (no CVSS)
- [CVE-2006-3789](https://cve.now/CVE-2006-3789.md): Multiple array index errors in the (1) recv\_rules, (2) recv\_select\_unit, (3) recv\_options, and (4) recv\_unit\_data functions in multiplay.cpp (no CVSS)
- [CVE-2006-3790](https://cve.now/CVE-2006-3790.md): The decode\_stringmap function in server\_transport.cpp for UFO2000 svn 1057 allows remote attackers to cause a denial of service (daemon term (no CVSS)
- [CVE-2006-3791](https://cve.now/CVE-2006-3791.md): The decode\_stringmap function in server\_transport.cpp for UFO2000 svn 1057 allows remote attackers to cause a denial of service (daemon term (no CVSS)
- [CVE-2006-3792](https://cve.now/CVE-2006-3792.md): SQL injection vulnerability in ServerClientUfo::recv\_packet in server\_protocol.cpp in UFO2000 svn 1057 allows remote attackers to execute ar (no CVSS)
- [CVE-2006-3793](https://cve.now/CVE-2006-3793.md): PHP remote file inclusion vulnerability in constants.php in SiteDepth CMS 3.01 and earlier allows remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2006-3794](https://cve.now/CVE-2006-3794.md): SQL injection vulnerability in Amazing Flash AFCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the sear (no CVSS)
- [CVE-2006-3795](https://cve.now/CVE-2006-3795.md): Multiple cross-site scripting (XSS) vulnerabilities in DeluxeBB before 1.08 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2006-3796](https://cve.now/CVE-2006-3796.md): DeluxeBB 1.07 and earlier does not properly handle a username composed of a single space character, which allows remote authenticated users (no CVSS)
- [CVE-2006-3797](https://cve.now/CVE-2006-3797.md): SQL injection vulnerability in DeluxeBB 1.07 and earlier allows remote attackers to bypass authentication, spoof users, and modify settings (no CVSS)
- [CVE-2006-3798](https://cve.now/CVE-2006-3798.md): DeluxeBB 1.07 and earlier allows remote attackers to overwrite the (1) \_GET, (2) \_POST, (3) \_ENV, and (4) \_SERVER variables via the \_COOKIE (no CVSS)
- [CVE-2006-3799](https://cve.now/CVE-2006-3799.md): DeluxeBB 1.07 and earlier allows remote attackers to bypass SQL injection protection mechanisms via the login variable and certain other var (no CVSS)
- [CVE-2006-3800](https://cve.now/CVE-2006-3800.md): Cross-site scripting (XSS) vulnerability in Amazing Flash AFCommerce Shopping Cart allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-3676](https://cve.now/CVE-2006-3676.md): admin/gallery\_admin.php in planetGallery before 14.07.2006 allows remote attackers to execute arbitrary PHP code by uploading files with a d (no CVSS)
- [CVE-2006-3775](https://cve.now/CVE-2006-3775.md): SQL injection vulnerability in the init function in class\_session.php in MyBB (aka MyBulletinBoard) 1.1.5 allows remote attackers to execute (no CVSS)
- [CVE-2006-3776](https://cve.now/CVE-2006-3776.md): PHP remote file inclusion vulnerability in order/index.php in IDevSpot (1) PhpHostBot 1.0 and (2) AutoHost 3.0 allows remote attackers to ex (no CVSS)
- [CVE-2006-3777](https://cve.now/CVE-2006-3777.md): PHP remote file inclusion vulnerability in index.php in IDevSpot PhpLinkExchange 1.0 allows remote attackers to execute arbitrary PHP code v (no CVSS)
- [CVE-2006-3778](https://cve.now/CVE-2006-3778.md): IBM Lotus Notes 6.0, 6.5, and 7.0 does not properly handle replies to e-mail messages with alternate name users when the (1) "Save As Draft" (no CVSS)
- [CVE-2006-3779](https://cve.now/CVE-2006-3779.md): Citrix MetaFrame up to XP 1.0 Feature 1, except when running on Windows Server 2003, installs a registry key with an insecure ACL, which all (no CVSS)
- [CVE-2006-3769](https://cve.now/CVE-2006-3769.md): Multiple cross-site scripting (XSS) vulnerabilities in Top XL 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-3770](https://cve.now/CVE-2006-3770.md): Multiple SQL injection vulnerabilities in index.php in phpFaber TopSites 2.0.9 and earlier allow remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2006-3771](https://cve.now/CVE-2006-3771.md): Multiple PHP remote file inclusion vulnerabilities in component.php in iManage CMS 4.0.12 and earlier allow remote attackers to execute arbi (no CVSS)
- [CVE-2006-3772](https://cve.now/CVE-2006-3772.md): PHP-Post 0.21 and 1.0, and possibly earlier versions, when auto-login is enabled, allows remote attackers to bypass security restrictions an (no CVSS)
- [CVE-2006-3773](https://cve.now/CVE-2006-3773.md): PHP remote file inclusion vulnerability in smf.php in the SMF-Forum 1.3.1.3 Bridge Component (com\_smf) For Joomla! and Mambo 4.5.3+ allows r (no CVSS)
- [CVE-2006-3774](https://cve.now/CVE-2006-3774.md): PHP remote file inclusion vulnerability in performs.php in the perForms component (com\_performs) 1.0 and earlier for Joomla! allows remote a (no CVSS)
- [CVE-2006-3757](https://cve.now/CVE-2006-3757.md): index.php in Zen Cart 1.3.0.2 allows remote attackers to obtain sensitive information via empty (1) \_GET\[\], (2) \_SESSION\[\], (3) \_POST\[\], (4) (no CVSS)
- [CVE-2006-3758](https://cve.now/CVE-2006-3758.md): inc/init.php in Archive Mode (Light) in MyBB (aka MyBulletinBoard) 1.1.4 calls the extract function with EXTR\_OVERWRITE on HTTP POST and GET (no CVSS)
- [CVE-2006-3759](https://cve.now/CVE-2006-3759.md): Unspecified vulnerability in MyBB (aka MyBulletinBoard) 1.1.4, related has unspecified impact and attack vectors related to "user group mani (no CVSS)
- [CVE-2006-3760](https://cve.now/CVE-2006-3760.md): Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) 1.1.4 allow remote attackers to execute arbitrary SQL commands via unsp (no CVSS)
- [CVE-2006-3761](https://cve.now/CVE-2006-3761.md): Cross-site scripting (XSS) vulnerability in inc/functions\_post.php in MyBB (aka MyBulletinBoard) 1.0 RC2 through 1.1.4 allows remote attacke (no CVSS)
- [CVE-2006-3762](https://cve.now/CVE-2006-3762.md): The Touch Control ActiveX control 2.0.0.55 allows remote attackers to read and possibly execute arbitrary files via a "file///" URI in the s (no CVSS)
- [CVE-2006-3763](https://cve.now/CVE-2006-3763.md): SQL injection vulnerability in category.php in Diesel Joke Site allows remote attackers to execute arbitrary SQL commands via the id paramet (no CVSS)
- [CVE-2006-3764](https://cve.now/CVE-2006-3764.md): Till Gerken phpPolls 1.0.3 allows remote attackers to create a new poll via a direct request to phpPollAdmin.php3 with the poll\_action param (no CVSS)
- [CVE-2006-3765](https://cve.now/CVE-2006-3765.md): Multiple cross-site scripting (XSS) vulnerabilities in Huttenlocher Webdesign hwdeGUEST 2.1.1 and earlier allow remote attackers to inject a (no CVSS)
- [CVE-2006-3766](https://cve.now/CVE-2006-3766.md): Darren's $5 Script Archive osDate 1.1.7 and earlier allows users to boost their own ratings via a txtrating parameter with a score greater t (no CVSS)
- [CVE-2006-3767](https://cve.now/CVE-2006-3767.md): Cross-site scripting (XSS) vulnerability in showprofile.php in Darren's $5 Script Archive osDate 1.1.7 and earlier allows remote attackers t (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-07-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.