# CVEs published 2006-09-06

41 CVEs were published on September 6, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-4583](https://cve.now/CVE-2006-4583.md): Multiple PHP remote file inclusion vulnerabilities in FlashChat before 4.6.2 allow remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2006-4584](https://cve.now/CVE-2006-4584.md): Tr Forum 2.0 allows remote attackers to bypass authentication and add an administrative account via the login and password parameters to adm (no CVSS)
- [CVE-2006-4585](https://cve.now/CVE-2006-4585.md): SQL injection vulnerability in admin/editer.php in Tr Forum 2.0 allows remote authenticated users to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2006-4586](https://cve.now/CVE-2006-4586.md): The admin panel in Tr Forum 2.0 accepts a username and password hash for authentication, which allows remote authenticated users to perform (no CVSS)
- [CVE-2006-4587](https://cve.now/CVE-2006-4587.md): Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 4.2.4, and possibly earlier, allow remote attackers to inject arbitrary we (no CVSS)
- [CVE-2006-4588](https://cve.now/CVE-2006-4588.md): vtiger CRM 4.2.4, and possibly earlier, allows remote attackers to bypass authentication and access administrative modules via a direct requ (no CVSS)
- [CVE-2006-4589](https://cve.now/CVE-2006-4589.md): PHP remote file inclusion vulnerability in 0\_admin/modules/Wochenkarte/frontend/index.php in DynCMS 6 and earlier allows remote attackers to (no CVSS)
- [CVE-2006-4590](https://cve.now/CVE-2006-4590.md): SQL injection vulnerability in admin/default.asp in Jetstat.com JS ASP Faq Manager 1.10 and earlier allows remote attackers to execute arbit (no CVSS)
- [CVE-2006-4591](https://cve.now/CVE-2006-4591.md): Multiple PHP remote file inclusion vulnerabilities in AlstraSoft Template Seller, and possibly AltraSoft Template Seller Pro 3.25, allow rem (no CVSS)
- [CVE-2006-4592](https://cve.now/CVE-2006-4592.md): Incomplete blacklist vulnerability in default.asp in 8pixel.net Simple Blog 2.3 and earlier allows remote attackers to conduct SQL injection (no CVSS)
- [CVE-2006-4593](https://cve.now/CVE-2006-4593.md): Cross-site scripting (XSS) vulnerability in index.php in SoftBB 0.1 and earlier allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2006-4594](https://cve.now/CVE-2006-4594.md): Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpAtm) 1.21 and earlier allow remote attackers to exec (no CVSS)
- [CVE-2006-3742](https://cve.now/CVE-2006-3742.md): The KDE PAM configuration shipped with Fedora Core 5 causes KDM passwords to be cached, which allows attackers to login without a password b (no CVSS)
- [CVE-2006-4563](https://cve.now/CVE-2006-4563.md): Cross-site scripting (XSS) vulnerability in the MyHeadlines before 4.3.2 module for PHP-Nuke allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2006-4564](https://cve.now/CVE-2006-4564.md): SQL injection vulnerability in Sources/ManageBoards.php in Simple Machines Forum 1.1 RC3 allows remote attackers to execute arbitrary SQL co (no CVSS)
- [CVE-2006-2941](https://cve.now/CVE-2006-2941.md): Mailman before 2.1.9rc1 allows remote attackers to cause a denial of service via unspecified vectors involving "standards-breaking RFC 2231 (no CVSS)
- [CVE-2006-3126](https://cve.now/CVE-2006-3126.md): c2faxrecv in capi4hylafax 01.02.03 allows remote attackers to execute arbitrary commands via null (\\0) and shell metacharacters in the TSI s (no CVSS)
- [CVE-2006-3636](https://cve.now/CVE-2006-3636.md): Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-4095](https://cve.now/CVE-2006-4095.md): BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via certain SIG queries, which c (no CVSS)
- [CVE-2006-4096](https://cve.now/CVE-2006-4096.md): BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via a flood of recursive queries (no CVSS)
- [CVE-2006-4459](https://cve.now/CVE-2006-4459.md): Integer overflow in AnywhereUSB/5 1.80.00 allows local users to cause a denial of service (crash) via a 1 byte header size specified in the (no CVSS)
- [CVE-2006-4543](https://cve.now/CVE-2006-4543.md): Cross-site scripting (XSS) vulnerability in index.php in HLStats 1.34 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2006-4544](https://cve.now/CVE-2006-4544.md): Multiple PHP remote file inclusion vulnerabilities in ExBB 1.9.1, when register\_globals is enabled, allow remote attackers to execute arbitr (no CVSS)
- [CVE-2006-4545](https://cve.now/CVE-2006-4545.md): PHP remote file inclusion vulnerability in ModuleBased CMS Pre-Alpha allows remote attackers to execute arbitrary PHP code via the \_SERVER p (no CVSS)
- [CVE-2006-4546](https://cve.now/CVE-2006-4546.md): Lyris ListManager 8.95 allows remote authenticated users, who have administrative privileges for at least one list on the server, to add new (no CVSS)
- [CVE-2006-4547](https://cve.now/CVE-2006-4547.md): Lyris ListManager 8.95 allows remote authenticated users to obtain sensitive information by attempting to add a user with a ' (single quote) (no CVSS)
- [CVE-2006-4548](https://cve.now/CVE-2006-4548.md): e107 0.75 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumer (no CVSS)
- [CVE-2006-4549](https://cve.now/CVE-2006-4549.md): CHXO Feedsplitter 2006-01-21 allows remote attackers to read the source code of feedsplitter.php via the showsource function. (no CVSS)
- [CVE-2006-4550](https://cve.now/CVE-2006-4550.md): Directory traversal vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to read arbitrary XML files via .. (no CVSS)
- [CVE-2006-4551](https://cve.now/CVE-2006-4551.md): Eval injection vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to execute arbitrary PHP code via (1) the file specifie (no CVSS)
- [CVE-2006-4552](https://cve.now/CVE-2006-4552.md): Cross-site scripting (XSS) vulnerability in CHXO Feedsplitter 2006-01-21 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2006-4553](https://cve.now/CVE-2006-4553.md): PHP remote file inclusion vulnerability in plugin.class.php in the com\_comprofiler Components 1.0 RC2 for Mambo and Joomla! allows remote at (no CVSS)
- [CVE-2006-4554](https://cve.now/CVE-2006-4554.md): Stack-based buffer overflow in the ReadFile function in the ZOO-processing exports in the BeCubed Compression Plus before 5.0.1.28, as used (no CVSS)
- [CVE-2006-4555](https://cve.now/CVE-2006-4555.md): Buffer overflow in the Retro64 / Miniclip CR64Loader ActiveX control allows remote attackers to execute arbitrary code via unspecified vecto (no CVSS)
- [CVE-2006-4556](https://cve.now/CVE-2006-4556.md): PHP remote file inclusion vulnerability in index.php in the JIM component for Mambo and Joomla! allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2006-4557](https://cve.now/CVE-2006-4557.md): PHP remote file inclusion vulnerability in plugins/plugins.php in Bob Jewell Discloser 0.0.4 allows remote attackers to execute arbitrary PH (no CVSS)
- [CVE-2006-4558](https://cve.now/CVE-2006-4558.md): DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod\_mime module, allows remote attackers to execute arbitrary PHP cod (no CVSS)
- [CVE-2006-4559](https://cve.now/CVE-2006-4559.md): Multiple PHP remote file inclusion vulnerabilities in Yet Another Community System (YACS) CMS 6.6.1 allow remote attackers to execute arbitr (no CVSS)
- [CVE-2006-4560](https://cve.now/CVE-2006-4560.md): Internet Explorer 6 on Windows XP SP2 allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with a (no CVSS)
- [CVE-2006-4561](https://cve.now/CVE-2006-4561.md): Mozilla Firefox 1.5.0.6 allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary in (no CVSS)
- [CVE-2006-4562](https://cve.now/CVE-2006-4562.md): The proxy DNS service in Symantec Gateway Security (SGS) allows remote attackers to make arbitrary DNS queries to third-party DNS servers, w (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-09-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.