# CVEs published 2006-09-09

22 CVEs were published on September 9, 2006: 0 critical, 1 high. Days are UTC.

- [CVE-2006-4294](https://cve.now/CVE-2006-4294.md): Directory traversal vulnerability in viewfile in TWiki 4.0.0 through 4.0.4 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2006-4650](https://cve.now/CVE-2006-4650.md): Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field (no CVSS)
- [CVE-2006-4651](https://cve.now/CVE-2006-4651.md): Directory traversal vulnerability in download/index.php, and possibly download.php, in threesquared.net (aka Ben Speakman) Php download allo (no CVSS)
- [CVE-2006-4652](https://cve.now/CVE-2006-4652.md): (1) Amazing Little Poll and (2) Amazing Little Picture Poll have a default password of "dsapoll", which allows remote attackers to create a (no CVSS)
- [CVE-2006-4653](https://cve.now/CVE-2006-4653.md): (1) Amazing Little Poll and (2) Amazing Little Picture Poll store sensitive information under the web root with insufficient access control, (no CVSS)
- [CVE-2006-4654](https://cve.now/CVE-2006-4654.md): Format string vulnerability in Easy Address Book Web Server 1.2 allows remote attackers to cause a denial of service (crash) or "compromise (no CVSS)
- [CVE-2006-4655](https://cve.now/CVE-2006-4655.md): Buffer overflow in the Strcmp function in the XKEYBOARD extension in X Window System X11R6.4 and earlier, as used in SCO UnixWare 7.1.3 and (no CVSS)
- [CVE-2006-4656](https://cve.now/CVE-2006-4656.md): PHP remote file inclusion vulnerability in admin/editeur/spaw\_control.class.php in Web Provence SL\_Site 1.0 and earlier allows remote attack (no CVSS)
- [CVE-2006-4657](https://cve.now/CVE-2006-4657.md): Panda Platinum Internet Security 2006 10.02.01 and 2007 11.00.00 stores service executables under the product's installation directory with (no CVSS)
- [CVE-2006-4658](https://cve.now/CVE-2006-4658.md): Panda Platinum Internet Security 2006 10.02.01 and 2007 11.00.00 uses sequential message numbers in generated URLs that are not filtered if (no CVSS)
- [CVE-2006-4659](https://cve.now/CVE-2006-4659.md): The Panda Platinum Internet Security 2006 10.02.01 and 2007 11.00.00 uses predictable URLs for the spam classification of each message, whic (no CVSS)
- [CVE-2006-4660](https://cve.now/CVE-2006-4660.md): Multiple cross-site scripting (XSS) vulnerabilities in the RSS Feed module in AOL ICQ Toolbar 1.3 for Internet Explorer (toolbaru.dll) allow (no CVSS)
- [CVE-2006-4661](https://cve.now/CVE-2006-4661.md): AOL ICQ Toolbar 1.3 for Internet Explorer (toolbaru.dll) does not properly validate the origin of the configuration web page (options2.html) (no CVSS)
- [CVE-2006-4662](https://cve.now/CVE-2006-4662.md): Heap-based buffer overflow in the MCRegEx\_\_Search function in AOL ICQ Pro 2003b Build 3916 and earlier allows remote attackers to execute ar (no CVSS)
- [CVE-2006-4663](https://cve.now/CVE-2006-4663.md): The source code tar archive of the Linux kernel 2.6.16, 2.6.17.11, and possibly other versions specifies weak permissions (0666 and 0777) fo (CVSS 7.8)
- [CVE-2006-4664](https://cve.now/CVE-2006-4664.md): PHP remote file inclusion vulnerability in includes/functions\_portal.php in Premod Shadow 2.7.1 and earlier allows remote attackers to execu (no CVSS)
- [CVE-2006-4665](https://cve.now/CVE-2006-4665.md): Cross-site scripting (XSS) vulnerability in index.php in MKPortal M1.1 Rc1 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2006-4666](https://cve.now/CVE-2006-4666.md): Multiple PHP remote file inclusion vulnerabilities in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allow remote attackers to execute arbit (no CVSS)
- [CVE-2006-4667](https://cve.now/CVE-2006-4667.md): Multiple SQL injection vulnerabilities in RunCMS 1.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) uid parameter in (no CVSS)
- [CVE-2006-4668](https://cve.now/CVE-2006-4668.md): Cross-site scripting (XSS) vulnerability in index.php in Rob Hensley AckerTodo 4.0 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-4669](https://cve.now/CVE-2006-4669.md): PHP remote file inclusion vulnerability in admin/system/include.php in Somery 0.4.6 and earlier, when register\_globals is enabled, allows re (no CVSS)
- [CVE-2006-4670](https://cve.now/CVE-2006-4670.md): Multiple PHP remote file inclusion vulnerabilities in PhotoKorn Gallery 1.52 and earlier allow remote attackers to execute arbitrary PHP cod (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-09-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.