# CVEs published 2006-09-15 27 CVEs were published on September 15, 2006: 0 critical, 0 high. Days are UTC. - [CVE-2006-4821](https://cve.now/CVE-2006-4821.md): Cross-site scripting (XSS) vulnerability in the Drupal 4.7 Userreview module before 1.19 2006/09/12 allows remote attackers to inject arbitr (no CVSS) - [CVE-2006-4822](https://cve.now/CVE-2006-4822.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in eMuSOFT emuCMS 0.3 and earlier allow remote attackers to inject arbitrar (no CVSS) - [CVE-2006-4823](https://cve.now/CVE-2006-4823.md): PHP remote file inclusion vulnerability in scripts/news\_page.php in Reamday Enterprises Magic News Pro 1.0.3 and earlier allows remote attac (no CVSS) - [CVE-2006-4824](https://cve.now/CVE-2006-4824.md): PHP remote file inclusion vulnerability in lib/activeutil.php in Quicksilver Forums (QSF) 1.2.1 and earlier allows remote attackers to execu (no CVSS) - [CVE-2006-4825](https://cve.now/CVE-2006-4825.md): Multiple cross-site scripting (XSS) vulnerabilities in cl\_files/index.php in SoftComplex PHP Event Calendar 1.5.1, and possibly earlier, all (no CVSS) - [CVE-2006-4826](https://cve.now/CVE-2006-4826.md): PHP remote file inclusion vulnerability in bottom.php in Shadowed Portal 5.599 and earlier allows remote attackers to execute arbitrary PHP (no CVSS) - [CVE-2006-4827](https://cve.now/CVE-2006-4827.md): Multiple PHP remote file inclusion vulnerabilities in Vmist Downstat 1.8 and earlier allow remote attackers to execute arbitrary PHP code vi (no CVSS) - [CVE-2006-4828](https://cve.now/CVE-2006-4828.md): PHP remote file inclusion vulnerability in zipndownload.php in PhotoPost 4.0 through 4.6 allows remote attackers to execute arbitrary PHP co (no CVSS) - [CVE-2006-4829](https://cve.now/CVE-2006-4829.md): Multiple cross-site scripting (XSS) vulnerabilities in David Czarnecki Blojsom 2.31 allow remote attackers to inject arbitrary web script or (no CVSS) - [CVE-2006-4830](https://cve.now/CVE-2006-4830.md): Directory traversal vulnerability in EditBlogTemplatesPlugin.java in David Czarnecki Blojsom 2.30 allows remote attackers to have an unknown (no CVSS) - [CVE-2006-4831](https://cve.now/CVE-2006-4831.md): Unspecified vulnerability in IP over DNS is now easy (iodine) before 0.3.2 has unknown impact and attack vectors, related to "potential secu (no CVSS) - [CVE-2006-4832](https://cve.now/CVE-2006-4832.md): Buffer overflow in the telnet service in Verso NetPerformer FRAD ACT SDM-95xx 7.xx (R1) and earlier, SDM-93xx 10.x.x (R2) and earlier, and S (no CVSS) - [CVE-2006-4833](https://cve.now/CVE-2006-4833.md): Verso NetPerformer FRAD ACT SDM-95xx 7.xx (R1) and earlier, SDM-93xx 10.x.x (R2) and earlier, and SDM-92xx 9.x.x (R1) and earlier allow remo (no CVSS) - [CVE-2006-4834](https://cve.now/CVE-2006-4834.md): PHP remote file inclusion vulnerability in index.php in Jule Slootbeek phpQuiz 0.01 allows remote attackers to execute arbitrary PHP code vi (no CVSS) - [CVE-2006-4835](https://cve.now/CVE-2006-4835.md): Bluview Blue Magic Board (BMB) (aka BMForum) 5.5 allows remote attackers to obtain sensitive information via a direct request to (1) footer. (no CVSS) - [CVE-2006-4836](https://cve.now/CVE-2006-4836.md): SQL injection vulnerability in login.php in DCP-Portal SE 6.0 allows remote attackers to execute arbitrary SQL commands via the username par (no CVSS) - [CVE-2006-4837](https://cve.now/CVE-2006-4837.md): Multiple PHP remote file inclusion vulnerabilities in DCP-Portal SE 6.0 allow remote attackers to execute arbitrary PHP code via a URL in th (no CVSS) - [CVE-2006-4838](https://cve.now/CVE-2006-4838.md): Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal SE 6.0 allow remote attackers to inject arbitrary web script or HTML via t (no CVSS) - [CVE-2006-4820](https://cve.now/CVE-2006-4820.md): Unspecified vulnerability in X.25 on HP-UX B.11.00, B.11.11, and B.11.23 allows local users to cause an unspecified denial of service via un (no CVSS) - [CVE-2006-4568](https://cve.now/CVE-2006-4568.md): Mozilla Firefox before 1.5.0.7 and SeaMonkey before 1.0.5 allows remote attackers to bypass the security model and inject content into the s (no CVSS) - [CVE-2006-4569](https://cve.now/CVE-2006-4569.md): The popup blocker in Mozilla Firefox before 1.5.0.7 opens the "blocked popups" display in the context of the Location bar instead of the sub (no CVSS) - [CVE-2006-4570](https://cve.now/CVE-2006-4570.md): Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass s (no CVSS) - [CVE-2006-4571](https://cve.now/CVE-2006-4571.md): Multiple unspecified vulnerabilities in Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5 allow remote attacker (no CVSS) - [CVE-2006-4340](https://cve.now/CVE-2006-4340.md): Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and Sea (no CVSS) - [CVE-2006-4565](https://cve.now/CVE-2006-4565.md): Heap-based buffer overflow in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5 allows remote attackers (no CVSS) - [CVE-2006-4566](https://cve.now/CVE-2006-4566.md): Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5 allows remote attackers to cause a denial of service (no CVSS) - [CVE-2006-4567](https://cve.now/CVE-2006-4567.md): Mozilla Firefox before 1.5.0.7 and Thunderbird before 1.5.0.7 makes it easy for users to accept self-signed certificates for the auto-update (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2006-09-15 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.