# CVEs published 2006-09-19

62 CVEs were published on September 19, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-4890](https://cve.now/CVE-2006-4890.md): Multiple PHP remote file inclusion vulnerabilities in UNAK-CMS 1.5 and earlier allow remote attackers to execute arbitrary PHP code via a UR (no CVSS)
- [CVE-2006-4891](https://cve.now/CVE-2006-4891.md): SQL injection vulnerability in ArticlesTableview.asp in Techno Dreams Articles & Papers Package 2.0 and earlier allows remote attackers to e (no CVSS)
- [CVE-2006-4892](https://cve.now/CVE-2006-4892.md): SQL injection vulnerability in faqview.asp in Techno Dreams FAQ Manager Package 1.0 allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2006-4893](https://cve.now/CVE-2006-4893.md): PHP remote file inclusion vulnerability in bb\_usage\_stats/includes/bb\_usage\_stats.php in phpBB XS 0.58 and earlier allows remote attackers t (no CVSS)
- [CVE-2006-4894](https://cve.now/CVE-2006-4894.md): Cross-site scripting (XSS) vulnerability in forms/lostpassword.php in iDevSpot NixieAffiliate 1.9 and earlier allows remote attackers to inj (no CVSS)
- [CVE-2006-4895](https://cve.now/CVE-2006-4895.md): IDevSpot NexieAffiliate 1.9 and earlier allows remote attackers to delete arbitrary affiliates via a modified id parameter to delete.php. (no CVSS)
- [CVE-2006-4897](https://cve.now/CVE-2006-4897.md): CMtextS 1.0 and earlier stores users\_logins/admin.txt under the web document root with insufficient access control, which allows remote atta (no CVSS)
- [CVE-2006-4898](https://cve.now/CVE-2006-4898.md): PHP remote file inclusion vulnerability in include/phpxd/phpXD.php in guanxiCRM 0.9.1 and earlier allows remote attackers to execute arbitra (no CVSS)
- [CVE-2006-2191](https://cve.now/CVE-2006-2191.md): Format string vulnerability in Mailman before 2.1.9 allows attackers to execute arbitrary code via unspecified vectors. (no CVSS)
- [CVE-2006-4334](https://cve.now/CVE-2006-4334.md): Unspecified vulnerability in gzip 1.3.5 allows context-dependent attackers to cause a denial of service (crash) via a crafted GZIP (gz) arch (no CVSS)
- [CVE-2006-4335](https://cve.now/CVE-2006-4335.md): Array index error in the make\_table function in unlzh.c in the LZH decompression component in gzip 1.3.5, when running on certain platforms, (no CVSS)
- [CVE-2006-4336](https://cve.now/CVE-2006-4336.md): Buffer underflow in the build\_tree function in unpack.c in gzip 1.3.5 allows context-dependent attackers to execute arbitrary code via a cra (no CVSS)
- [CVE-2006-4337](https://cve.now/CVE-2006-4337.md): Buffer overflow in the make\_table function in the LHZ component in gzip 1.3.5 allows context-dependent attackers to execute arbitrary code v (no CVSS)
- [CVE-2006-4338](https://cve.now/CVE-2006-4338.md): unlzh.c in the LHZ component in gzip 1.3.5 allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted GZI (no CVSS)
- [CVE-2006-4871](https://cve.now/CVE-2006-4871.md): SQL injection vulnerability in search\_run.asp in Keyvan1 (aka Keyvan Janghorbani) EShoppingPro 1.0 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2006-4872](https://cve.now/CVE-2006-4872.md): SQL injection vulnerability in search.asp in Keyvan1 (aka Keyvan Janghorbani) ECardPro 2.0 allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2006-4873](https://cve.now/CVE-2006-4873.md): Jupiter CMS allows remote attackers to obtain sensitive information via a direct request for (1) includes/functions.php, (2) modules/registe (no CVSS)
- [CVE-2006-4874](https://cve.now/CVE-2006-4874.md): Multiple cross-site scripting (XSS) vulnerabilities in Jupiter CMS allow remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS)
- [CVE-2006-4875](https://cve.now/CVE-2006-4875.md): Unrestricted file upload vulnerability in modules/galleryuploadfunction.php in Jupiter CMS allows remote attackers to upload picture files, (no CVSS)
- [CVE-2006-4876](https://cve.now/CVE-2006-4876.md): Multiple SQL injection vulnerabilities in Jupiter CMS allow remote attackers to execute arbitrary SQL commands via (1) the user name during (no CVSS)
- [CVE-2006-4877](https://cve.now/CVE-2006-4877.md): Variable overwrite vulnerability in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to overwrite arbitrary program var (no CVSS)
- [CVE-2006-4878](https://cve.now/CVE-2006-4878.md): Directory traversal vulnerability in footer.php in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to read and include (no CVSS)
- [CVE-2006-4879](https://cve.now/CVE-2006-4879.md): SQL injection vulnerability in profile.php in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2006-4880](https://cve.now/CVE-2006-4880.md): David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to obtain sensitive information via a direct request for (1) footer.ph (no CVSS)
- [CVE-2006-4881](https://cve.now/CVE-2006-4881.md): Multiple cross-site scripting (XSS) vulnerabilities in David Bennett PHP-Post (PHPp) 1.0 and earlier allow remote attackers to inject arbitr (no CVSS)
- [CVE-2006-4882](https://cve.now/CVE-2006-4882.md): SQL injection vulnerability in Review.asp in Julian Roberts Charon Cart 3 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2006-4883](https://cve.now/CVE-2006-4883.md): Multiple cross-site scripting (XSS) vulnerabilities in IDevSpot BizDirectory allow remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2006-4884](https://cve.now/CVE-2006-4884.md): Multiple cross-site scripting (XSS) vulnerabilities in IDevSpot iSupport 1.8 allow remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2006-4885](https://cve.now/CVE-2006-4885.md): PHP remote file inclusion vulnerability in Shadowed Portal 5.599 and earlier allows remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2006-4886](https://cve.now/CVE-2006-4886.md): The VirusScan On-Access Scan component in McAfee VirusScan Enterprise 7.1.0 and Scan Engine 4.4.00 allows local privileged users to bypass s (no CVSS)
- [CVE-2006-4887](https://cve.now/CVE-2006-4887.md): Apple Remote Desktop (ARD) for Mac OS X 10.2.8 and later does not drop privileges on the remote machine while installing certain application (no CVSS)
- [CVE-2006-4888](https://cve.now/CVE-2006-4888.md): Microsoft Internet Explorer 6 and earlier allows remote attackers to cause a denial of service (application hang) via a CSS-formatted HTML I (no CVSS)
- [CVE-2006-4889](https://cve.now/CVE-2006-4889.md): Multiple PHP remote file inclusion vulnerabilities in Telekorn SignKorn Guestbook (SL) 1.3 and earlier, when register\_globals is enabled, al (no CVSS)
- [CVE-2006-4535](https://cve.now/CVE-2006-4535.md): The Linux kernel 2.6.17.10 and 2.6.17.11 and 2.6.18-rc5 allows local users to cause a denial of service (crash) via an SCTP socket with a ce (no CVSS)
- [CVE-2006-4866](https://cve.now/CVE-2006-4866.md): Buffer overflow in kextload in Apple OS X, as used by TDIXSupport in Roxio Toast Titanium and possibly other products, allows local users to (no CVSS)
- [CVE-2006-4867](https://cve.now/CVE-2006-4867.md): SQL injection vulnerability in mods.php in GNUTurk 2G and earlier allows remote attackers to execute arbitrary SQL commands via the t\_id par (no CVSS)
- [CVE-2006-4868](https://cve.now/CVE-2006-4868.md): Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Win (no CVSS)
- [CVE-2006-4869](https://cve.now/CVE-2006-4869.md): PHP remote file inclusion vulnerability in phpunity-postcard.php in phpunity.postcard allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2006-4870](https://cve.now/CVE-2006-4870.md): Multiple PHP remote file inclusion vulnerabilities in AEDating 4.1, and possibly earlier versions, allow remote attackers to execute arbitra (no CVSS)
- [CVE-2006-4246](https://cve.now/CVE-2006-4246.md): Usermin before 1.220 (20060629) allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an (no CVSS)
- [CVE-2006-4684](https://cve.now/CVE-2006-4684.md): The docutils module in Zope (Zope2) 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText (re (no CVSS, zope2)
- [CVE-2006-4855](https://cve.now/CVE-2006-4855.md): The \\Device\\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.0.33, and other versions of Norton Personal Firewall, Internet Sec (no CVSS)
- [CVE-2006-4856](https://cve.now/CVE-2006-4856.md): Multiple cross-site scripting (XSS) vulnerabilities in Roller WebLogger 2.3 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2006-4857](https://cve.now/CVE-2006-4857.md): SQL injection vulnerability in default.asp (aka the login page) in ClickTech ClickBlog 2.0 allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2006-4858](https://cve.now/CVE-2006-4858.md): PHP remote file inclusion vulnerability in install.serverstat.php in the Serverstat (com\_serverstat) 0.4.4 and earlier component for Mambo a (no CVSS)
- [CVE-2006-4859](https://cve.now/CVE-2006-4859.md): Unrestricted file upload vulnerability in contact.html.php in the Contact (com\_contact) component in Limbo (aka Lite Mambo) CMS 1.0.4.2L and (no CVSS)
- [CVE-2006-4860](https://cve.now/CVE-2006-4860.md): Multiple unspecified vulnerabilities in (1) index.php, (2) minixml.inc.php, (3) doc.inc.php, (4) element.inc.php, (5) node.inc.php, (6) tree (no CVSS)
- [CVE-2006-4861](https://cve.now/CVE-2006-4861.md): SQL injection vulnerability in loginprocess.asp in Mohammed Mehdi Panjwani Complain Center 1 allows remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2006-4862](https://cve.now/CVE-2006-4862.md): SQL injection vulnerability in default.aspx in easypage allows remote attackers to execute arbitrary SQL commands via the srch parameter in (no CVSS)
- [CVE-2006-4863](https://cve.now/CVE-2006-4863.md): Multiple PHP remote file inclusion vulnerabilities in Marc Cagninacci mcLinksCounter 1.1 allow remote attackers to execute arbitrary PHP cod (no CVSS)
- [CVE-2006-4864](https://cve.now/CVE-2006-4864.md): PHP remote file inclusion vulnerability in index.php in All Enthusiast ReviewPost 2.5 allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2006-4865](https://cve.now/CVE-2006-4865.md): Walter Beschmout PhpQuiz allows remote attackers to obtain sensitive information via a direct request to cfgphpquiz/install.php and other un (no CVSS)
- [CVE-2006-4844](https://cve.now/CVE-2006-4844.md): PHP remote file inclusion vulnerability in inc/claro\_init\_local.inc.php in Claroline 1.7.7 and earlier, as used in Dokeos and possibly other (no CVSS)
- [CVE-2006-4845](https://cve.now/CVE-2006-4845.md): PHP remote file inclusion vulnerability in includes/footer.html.inc.php in TeamCal Pro 2.8.001 and earlier allows remote attackers to execut (no CVSS)
- [CVE-2006-4846](https://cve.now/CVE-2006-4846.md): Unspecified vulnerability in Citrix Access Gateway with Advanced Access Control (AAC) 4.2 before 20060914, when AAC is configured to use LDA (no CVSS)
- [CVE-2006-4847](https://cve.now/CVE-2006-4847.md): Multiple buffer overflows in Ipswitch WS\_FTP Server 5.05 before Hotfix 1 allow remote authenticated users to execute arbitrary code via long (no CVSS)
- [CVE-2006-4848](https://cve.now/CVE-2006-4848.md): Multiple PHP remote file inclusion vulnerabilities in Brian Fraval Hitweb 3.0 allow remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2006-4849](https://cve.now/CVE-2006-4849.md): PHP remote file inclusion vulnerability in header.php in MobilePublisherPHP 1.5 RC2 and earlier allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2006-4850](https://cve.now/CVE-2006-4850.md): PHP remote file inclusion vulnerability in system/\_b/contentFiles/gBIndex.php in BolinOS 4.5.5 and earlier allows remote attackers to execut (no CVSS)
- [CVE-2006-4851](https://cve.now/CVE-2006-4851.md): PHP remote file inclusion vulnerability in system/\_b/contentFiles/gBHTMLEditor.php in BolinOS 4.5.5 and earlier allows remote attackers to e (no CVSS)
- [CVE-2006-4852](https://cve.now/CVE-2006-4852.md): SQL injection vulnerability in browse.asp in QuadComm Q-Shop 3.5 allows remote attackers to execute arbitrary SQL commands via the OrderBy p (no CVSS)
- [CVE-2006-4853](https://cve.now/CVE-2006-4853.md): SQL injection vulnerability in kategorix.asp in Haberx 1.02 through 1.1 allows remote attackers to execute arbitrary SQL commands via the id (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-09-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.