# CVEs published 2006-09-14

37 CVEs were published on September 14, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-4437](https://cve.now/CVE-2006-4437.md): Eval injection vulnerability in Tagger LE allows remote attackers to execute arbitrary PHP code via the query string in (1) tags.php, (2) si (no CVSS)
- [CVE-2006-4800](https://cve.now/CVE-2006-4800.md): Multiple buffer overflows in libavcodec in ffmpeg before 0.4.9\_p20060530 allow remote attackers to cause a denial of service or possibly exe (no CVSS)
- [CVE-2006-4801](https://cve.now/CVE-2006-4801.md): Race condition in Deja Vu, as used in Roxio Toast Titanium 7 and possibly other products, allows local users to execute arbitrary code via t (no CVSS)
- [CVE-2006-4802](https://cve.now/CVE-2006-4802.md): Format string vulnerability in the Real Time Virus Scan service in Symantec AntiVirus Corporate Edition 8.1 up to 10.0, and Client Security (no CVSS)
- [CVE-2006-4803](https://cve.now/CVE-2006-4803.md): The Fan-Out Linux and UNIX receiver scripts in Novell Identity Manager (IDM) 3.0.1 allows local users to execute arbitrary commands via unsp (no CVSS)
- [CVE-2004-2665](https://cve.now/CVE-2004-2665.md): Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport software in HP-UX B.11.00, B.11.04, and B.11.11 before (no CVSS)
- [CVE-2006-4793](https://cve.now/CVE-2006-4793.md): Multiple SQL injection vulnerabilities in icerik.asp in TualBLOG 1.0 allow remote attackers to execute arbitrary SQL commands, as demonstrat (no CVSS)
- [CVE-2006-4794](https://cve.now/CVE-2006-4794.md): Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the quer (no CVSS)
- [CVE-2006-4795](https://cve.now/CVE-2006-4795.md): Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport software in HP-UX B.11.11 and B.11.23 before 20060912 a (no CVSS)
- [CVE-2006-4796](https://cve.now/CVE-2006-4796.md): Cross-site scripting (XSS) vulnerability in forum.asp in Snitz Forums 2000 3.4.06 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-4797](https://cve.now/CVE-2006-4797.md): Cross-site scripting (XSS) vulnerability in tag.php in CloudNine Interactive CJ Tag Board 3.0 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2006-4798](https://cve.now/CVE-2006-4798.md): SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Refe (no CVSS)
- [CVE-2006-4799](https://cve.now/CVE-2006-4799.md): Buffer overflow in ffmpeg for xine-lib before 1.1.2 might allow context-dependent attackers to execute arbitrary code via a crafted AVI file (no CVSS)
- [CVE-2006-4790](https://cve.now/CVE-2006-4790.md): verify.c in GnuTLS before 1.4.4, when using an RSA key with exponent 3, does not properly handle excess data in the digestAlgorithm.paramete (no CVSS)
- [CVE-2006-4778](https://cve.now/CVE-2006-4778.md): SQL injection vulnerability in Creative Commons Tools ccHost before 3.0 allows remote attackers to execute arbitrary SQL commands via a craf (no CVSS)
- [CVE-2006-4779](https://cve.now/CVE-2006-4779.md): PHP remote file inclusion vulnerability in includes/functions\_portal.php in Vitrax Premodded phpBB 1.0.6-R3 and earlier allows remote attack (no CVSS)
- [CVE-2006-4780](https://cve.now/CVE-2006-4780.md): PHP remote file inclusion vulnerability in includes/functions.php in phpBB XS 0.58 and earlier allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2006-4781](https://cve.now/CVE-2006-4781.md): Heap-based buffer overflow in FutureSoft TFTP Server Multithreaded (MT) 1.1 allows remote attackers to cause a denial of service (crash) or (no CVSS)
- [CVE-2006-4782](https://cve.now/CVE-2006-4782.md): src/index.php in WebSPELL 4.01.01 and earlier, when register\_globals is enabled, allows remote attackers to bypass authentication and gain s (no CVSS)
- [CVE-2006-4783](https://cve.now/CVE-2006-4783.md): SQL injection vulnerability in squads.php in WebSPELL 4.01.01 and earlier, when register\_globals is enabled, allows remote attackers to exec (no CVSS)
- [CVE-2006-4784](https://cve.now/CVE-2006-4784.md): Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.6.1 and earlier might allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2006-4785](https://cve.now/CVE-2006-4785.md): SQL injection vulnerability in blog/edit.php in Moodle 1.6.1 and earlier allows remote attackers to execute arbitrary SQL commands via the f (no CVSS)
- [CVE-2006-4786](https://cve.now/CVE-2006-4786.md): Moodle 1.6.1 and earlier allows remote attackers to obtain sensitive information via (1) help.php and (2) other unspecified vectors involvin (no CVSS)
- [CVE-2006-4787](https://cve.now/CVE-2006-4787.md): AlphaMail before 1.0.16 allows local users to obtain sensitive information via the logging functionality, which displays unencrypted passwor (no CVSS)
- [CVE-2006-4788](https://cve.now/CVE-2006-4788.md): PHP remote file inclusion vulnerability in includes/log.inc.php in Telekorn SignKorn Guestbook (SL) 1.3 and earlier, when register\_globals i (no CVSS)
- [CVE-2006-4789](https://cve.now/CVE-2006-4789.md): Buffer overflow in Open Movie Editor 0.0.20060901 allows local users to cause a denial of service (system crash) or execute arbitrary code v (no CVSS)
- [CVE-2006-3454](https://cve.now/CVE-2006-3454.md): Multiple format string vulnerabilities in Symantec AntiVirus Corporate Edition 8.1 up to 10.0, and Client Security 1.x up to 3.0, allow loca (no CVSS)
- [CVE-2006-4724](https://cve.now/CVE-2006-4724.md): Unspecified vulnerability in the ColdFusion Flash Remoting Gateway in Adobe ColdFusion MX 7 and 7.01 allows remote attackers to cause a deni (no CVSS)
- [CVE-2006-4725](https://cve.now/CVE-2006-4725.md): Adobe ColdFusion MX 7 and 7.01 allows local users to bypass security restrictions and call components (CFC) within a sandbox from CFML templ (no CVSS)
- [CVE-2006-4726](https://cve.now/CVE-2006-4726.md): Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 6.1 through 7.02 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2006-4771](https://cve.now/CVE-2006-4771.md): Cross-site scripting (XSS) vulnerability in haut.php in ForumJBC 4 allows remote attackers to inject arbitrary web script or HTML via the nb (no CVSS)
- [CVE-2006-4772](https://cve.now/CVE-2006-4772.md): HotPlug CMS stores sensitive information under the web root with insufficient access control, which allows remote attackers to read the admi (no CVSS)
- [CVE-2006-4773](https://cve.now/CVE-2006-4773.md): Sun StorEdge 6130 Array Controllers with firmware 06.12.10.11 and earlier allow remote attackers to cause a denial of service (controller re (no CVSS)
- [CVE-2006-4774](https://cve.now/CVE-2006-4774.md): The VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) allows remote attackers to cause a denial of service by sending a VTP version (no CVSS)
- [CVE-2006-4775](https://cve.now/CVE-2006-4775.md): The VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) and CatOS allows remote attackers to cause a denial of service by sending a V (no CVSS)
- [CVE-2006-4776](https://cve.now/CVE-2006-4776.md): Heap-based buffer overflow in the VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) allows remote attackers to execute arbitrary co (no CVSS)
- [CVE-2006-4777](https://cve.now/CVE-2006-4777.md): Heap-based buffer overflow in the DirectAnimation Path Control (DirectAnimation.PathControl) COM object (daxctle.ocx) for Internet Explorer (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-09-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.