# CVEs published 2006-08-31

55 CVEs were published on August 31, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-4506](https://cve.now/CVE-2006-4506.md): idmlib.sh in nxdrv in Novell Identity Manager (IDM) 3.0.1 allows local users to execute arbitrary commands via unspecified vectors, possibly (no CVSS)
- [CVE-2006-4507](https://cve.now/CVE-2006-4507.md): Unspecified vulnerability in the TIFF viewer (possibly libTIFF) in the Photo Viewer in the Sony PlaystationPortable (PSP) 2.00 through 2.80 (no CVSS)
- [CVE-2006-4508](https://cve.now/CVE-2006-4508.md): Unspecified vulnerability in (1) Tor 0.1.0.x before 0.1.0.18 and 0.1.1.x before 0.1.1.23, and (2) ScatterChat before 1.0.2, allows remote at (no CVSS)
- [CVE-2006-4146](https://cve.now/CVE-2006-4146.md): Buffer overflow in the (1) DWARF (dwarfread.c) and (2) DWARF2 (dwarf2read.c) debugging code in GNU Debugger (GDB) 6.5 allows user-assisted a (no CVSS)
- [CVE-2006-4487](https://cve.now/CVE-2006-4487.md): DUware DUpoll 3.0 and 3.1 stores \_private/Dupoll.mdb under the web document root with insufficient access control, which allows remote attac (no CVSS)
- [CVE-2006-4488](https://cve.now/CVE-2006-4488.md): PHP remote file inclusion vulnerability in modules/userstop/userstop.php in ExBB Italia 0.2 and earlier, when register\_globals is enabled, a (no CVSS)
- [CVE-2006-4489](https://cve.now/CVE-2006-4489.md): Multiple PHP remote file inclusion vulnerabilities in MiniBill 2006-07-14 (1.2.2) allow remote attackers to execute arbitrary PHP code via ( (no CVSS)
- [CVE-2006-4490](https://cve.now/CVE-2006-4490.md): Multiple directory traversal vulnerabilities in Cybozu Office before 6.6 Build 1.3 and Share 360 before 2.5 Build 0.3 allow remote authentic (no CVSS)
- [CVE-2006-4491](https://cve.now/CVE-2006-4491.md): Directory traversal vulnerability in Cybozu Collaborex, AG before 1.2(1.5), AG Pocket before 5.2(0.8), Mailwise before 3.0(0.3), and Garoon (no CVSS)
- [CVE-2006-4492](https://cve.now/CVE-2006-4492.md): Unspecified vulnerability in Cybozu Office 6.5 Build 1.2 for Windows allows remote attackers to obtain sensitive information, including user (no CVSS)
- [CVE-2006-4493](https://cve.now/CVE-2006-4493.md): xbiff2 1.9 creates $HOME/.xbiff2rc in a user's home directory with insecure file permissions, which allows local users to obtain sensitive i (no CVSS)
- [CVE-2006-4494](https://cve.now/CVE-2006-4494.md): Microsoft Visual Studio 6.0 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code by (no CVSS)
- [CVE-2006-4495](https://cve.now/CVE-2006-4495.md): Microsoft Internet Explorer allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code by (no CVSS)
- [CVE-2006-4496](https://cve.now/CVE-2006-4496.md): Cross-site scripting (XSS) vulnerability in comments.php in IwebNegar 1.1 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2006-4497](https://cve.now/CVE-2006-4497.md): SQL injection vulnerability in comments.php in IwebNegar 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. (no CVSS)
- [CVE-2006-4498](https://cve.now/CVE-2006-4498.md): PHP remote file inclusion vulnerability in sommaire\_admin.php in PhpAlbum (mod\_phpalbum) 2.15 for PortailPHP allows remote attackers to exec (no CVSS)
- [CVE-2006-4499](https://cve.now/CVE-2006-4499.md): ModernBill 5.0.4 and earlier uses cURL with insecure settings for CURLOPT\_SSL\_VERIFYPEER and CURLOPT\_SSL\_VERIFYHOST that do not verify SSL c (no CVSS)
- [CVE-2006-4500](https://cve.now/CVE-2006-4500.md): Cross-site scripting (XSS) vulnerability in index.php in ezPortal/ztml CMS 1.0 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2006-4501](https://cve.now/CVE-2006-4501.md): SQL injection vulnerability in index.php in ezPortal/ztml CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) abou (no CVSS)
- [CVE-2006-4502](https://cve.now/CVE-2006-4502.md): ezPortal/ztml CMS 1.0 allows remote attackers to bypass authentication controls via a direct request to the "Administration Area" script. (no CVSS)
- [CVE-2006-4503](https://cve.now/CVE-2006-4503.md): Directory traversal vulnerability in link.php in NX5Linx 1.0 allows remote attackers to read arbitrary files via the logo parameter. (no CVSS)
- [CVE-2006-4504](https://cve.now/CVE-2006-4504.md): SQL injection vulnerability in NX5Linx 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) c and (2) l parameters. (no CVSS)
- [CVE-2006-4505](https://cve.now/CVE-2006-4505.md): CRLF injection vulnerability in links.php in NX5Linx 1.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response (no CVSS)
- [CVE-2006-3125](https://cve.now/CVE-2006-3125.md): Array index error in tetrinet.c in gtetrinet 0.7.8 and earlier allows remote attackers to execute arbitrary code via a packet specifying a n (no CVSS)
- [CVE-2006-4477](https://cve.now/CVE-2006-4477.md): Multiple PHP remote file inclusion vulnerabilities in Visual Shapers ezContents 2.0.3 allow remote attackers to execute arbitrary PHP code v (no CVSS)
- [CVE-2006-4478](https://cve.now/CVE-2006-4478.md): SQL injection vulnerability in headeruserdata.php in Visual Shapers ezContents 2.0.3 allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2006-4479](https://cve.now/CVE-2006-4479.md): Cross-site scripting (XSS) vulnerability in loginreq2.php in Visual Shapers ezContents 2.0.3 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2006-4480](https://cve.now/CVE-2006-4480.md): Incomplete blacklist vulnerability in the nk\_CSS function in nuked.php in Nuked-Klan 1.7 SP4.3 allows remote attackers to bypass anti-XSS fe (no CVSS)
- [CVE-2006-4481](https://cve.now/CVE-2006-4481.md): The (1) file\_exists and (2) imap\_reopen functions in PHP before 5.1.5 do not check for the safe\_mode and open\_basedir settings, which allows (no CVSS)
- [CVE-2006-4482](https://cve.now/CVE-2006-4482.md): Multiple heap-based buffer overflows in the (1) str\_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when use (no CVSS)
- [CVE-2006-4483](https://cve.now/CVE-2006-4483.md): The cURL extension files (1) ext/curl/interface.c and (2) ext/curl/streams.c in PHP before 5.1.5 permit the CURLOPT\_FOLLOWLOCATION option wh (no CVSS)
- [CVE-2006-4484](https://cve.now/CVE-2006-4484.md): Buffer overflow in the LWZReadByte\_ function in ext/gd/libgd/gd\_gif\_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to (no CVSS)
- [CVE-2006-4485](https://cve.now/CVE-2006-4485.md): The stripos function in PHP before 5.1.5 has unknown impact and attack vectors related to an out-of-bounds read. (no CVSS)
- [CVE-2006-4486](https://cve.now/CVE-2006-4486.md): Integer overflow in memory allocation routines in PHP before 5.1.6, when running on a 64-bit system, allows context-dependent attackers to b (no CVSS)
- [CVE-2006-4460](https://cve.now/CVE-2006-4460.md): Cross-site scripting (XSS) vulnerability in PHP iAddressBook before 0.96 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2006-4461](https://cve.now/CVE-2006-4461.md): Paessler IPCheck Server Monitor before 5.3.3.639/640 does not properly implement a "list of acceptable host IP addresses in the probe settin (no CVSS)
- [CVE-2006-4462](https://cve.now/CVE-2006-4462.md): Gonafish.com LinksCaffe 2.0 and 3.0 do not properly restrict access to administrator functions, which allows remote attackers to gain full a (no CVSS)
- [CVE-2006-4463](https://cve.now/CVE-2006-4463.md): SQL injection vulnerability in the administrator control panel in Jetstat.com JS ASP Faq Manager 1.10 allows remote attackers to execute arb (no CVSS)
- [CVE-2006-4464](https://cve.now/CVE-2006-4464.md): The Nokia Browser, possibly Nokia Symbian 60 Browser 3rd edition, allows remote attackers to cause a denial of service (crash) via JavaScrip (no CVSS)
- [CVE-2006-4465](https://cve.now/CVE-2006-4465.md): Microsoft Terminal Server, when running an application session with the "Start program at logon" and "Override settings from user profile an (no CVSS)
- [CVE-2006-4466](https://cve.now/CVE-2006-4466.md): Joomla! before 1.0.11 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumer (no CVSS)
- [CVE-2006-4467](https://cve.now/CVE-2006-4467.md): Simple Machines Forum (SMF) 1.1RCx before 1.1RC3, and 1.0.x before 1.0.8, does not properly unset variables when the input data includes a n (no CVSS)
- [CVE-2006-4468](https://cve.now/CVE-2006-4468.md): Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to unvalidated input, allow attackers to have an unknown impact via u (no CVSS)
- [CVE-2006-4469](https://cve.now/CVE-2006-4469.md): Unspecified vulnerability in PEAR.php in Joomla! before 1.0.11 allows remote attackers to perform "remote execution," related to "Injection (no CVSS)
- [CVE-2006-4470](https://cve.now/CVE-2006-4470.md): Joomla! before 1.0.11 omits some checks for whether \_VALID\_MOS is defined, which allows attackers to have an unknown impact, possibly result (no CVSS)
- [CVE-2006-4471](https://cve.now/CVE-2006-4471.md): The Admin Upload Image functionality in Joomla! before 1.0.11 allows remote authenticated users to upload files outside of the /images/stori (no CVSS)
- [CVE-2006-4472](https://cve.now/CVE-2006-4472.md): Multiple unspecified vulnerabilities in Joomla! before 1.0.11 allow attackers to bypass user authentication via unknown vectors involving th (no CVSS)
- [CVE-2006-4473](https://cve.now/CVE-2006-4473.md): Unspecified vulnerability in com\_content in Joomla! before 1.0.11, when $mosConfig\_hideEmail is set, allows attackers to perform the emailfo (no CVSS)
- [CVE-2006-4474](https://cve.now/CVE-2006-4474.md): Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.11 allow remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2006-4475](https://cve.now/CVE-2006-4475.md): Joomla! before 1.0.11 does not limit access to the Admin Popups functionality, which has unknown impact and attack vectors. (no CVSS)
- [CVE-2006-4476](https://cve.now/CVE-2006-4476.md): Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to "Injection Flaws," allow attackers to have an unknown impact via ( (no CVSS)
- [CVE-2006-4456](https://cve.now/CVE-2006-4456.md): PHP remote file inclusion vulnerability in functions.php in phpECard 2.1.4 and earlier allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2006-4457](https://cve.now/CVE-2006-4457.md): PHP remote file inclusion vulnerability in index.php in phpECard 2.1.4 and earlier allows remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2006-4458](https://cve.now/CVE-2006-4458.md): Directory traversal vulnerability in calendar/inc/class.holidaycalc.inc.php in phpGroupWare 0.9.16.010 and earlier allows remote attackers t (no CVSS)
- [CVE-2006-4244](https://cve.now/CVE-2006-4244.md): SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-\[username\] cookie matches the value of the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-08-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.