# CVEs published 2006-09-27

53 CVEs were published on September 27, 2006: 2 critical, 1 high. Days are UTC.

- [CVE-2006-5016](https://cve.now/CVE-2006-5016.md): Unrestricted file upload vulnerability in admin/x\_image.php in Szava Gyula and Csaba Tamas e-Vision CMS, probably 1.0, allows remote attacke (no CVSS)
- [CVE-2006-5017](https://cve.now/CVE-2006-5017.md): SQL injection vulnerability in admin/all\_users.php in Szava Gyula and Csaba Tamas e-Vision CMS, probably 1.0, allows remote attackers to exe (no CVSS)
- [CVE-2006-5018](https://cve.now/CVE-2006-5018.md): ContentKeeper 123.25 and earlier places passwords in cleartext in an INPUT element in cgi-bin/ck/changepw.cgi, which allows remote authentic (no CVSS)
- [CVE-2006-5019](https://cve.now/CVE-2006-5019.md): Google Mini 4.4.102.M.36 and earlier allows remote attackers to obtain sensitive information via a direct request for /search with an invali (no CVSS)
- [CVE-2006-5020](https://cve.now/CVE-2006-5020.md): Multiple PHP remote file inclusion vulnerabilities in SolidState 0.4 and earlier allow remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2006-5021](https://cve.now/CVE-2006-5021.md): Multiple PHP remote file inclusion vulnerabilities in redgun RedBLoG 0.5 allow remote attackers to execute arbitrary PHP code via a URL in ( (CVSS 9.8)
- [CVE-2006-5022](https://cve.now/CVE-2006-5022.md): PHP remote file inclusion vulnerability in includes/global.php in Joshua Wilson pNews System 1.1.0 (aka PowerNews) allows remote attackers t (no CVSS)
- [CVE-2006-5023](https://cve.now/CVE-2006-5023.md): SQL injection vulnerability in kategori.asp in xweblog 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the kat (no CVSS)
- [CVE-2006-5024](https://cve.now/CVE-2006-5024.md): Multiple unspecified vulnerabilities in Paisterist Simple HTTP Scanner (sHTTPScanner) before 0.4 have unknown impact and attack vectors. (CVSS 9.8)
- [CVE-2006-5025](https://cve.now/CVE-2006-5025.md): Multiple unspecified vulnerabilities in Paisterist Simple HTTP Scanner (sHTTPScanner) before 0.2 have unknown impact and attack vectors. (no CVSS)
- [CVE-2006-5026](https://cve.now/CVE-2006-5026.md): Multiple unspecified vulnerabilities in Paisterist Simple HTTP Scanner (sHTTPScanner) before 0.3 have unknown impact and attack vectors. (no CVSS)
- [CVE-2006-5027](https://cve.now/CVE-2006-5027.md): Jeroen Vennegoor JevonCMS, possibly pre alpha, allows remote attackers to obtain sensitive information via a direct request for php/main/php (no CVSS)
- [CVE-2006-5028](https://cve.now/CVE-2006-5028.md): Directory traversal vulnerability in filemanager/filemanager.php in SWsoft Plesk 7.5 Reload and Plesk 7.6 for Microsoft Windows allows remot (no CVSS)
- [CVE-2006-5029](https://cve.now/CVE-2006-5029.md): SQL injection vulnerability in thread.php in WoltLab Burning Board (wBB) 2.3.x allows remote attackers to obtain the version numbers of PHP, (no CVSS)
- [CVE-2006-5030](https://cve.now/CVE-2006-5030.md): SQL injection vulnerability in modules/messages/index.php in exV2 2.0.4.3 and earlier allows remote authenticated users to execute arbitrary (no CVSS)
- [CVE-2006-5031](https://cve.now/CVE-2006-5031.md): Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attacker (no CVSS, cakephp/cakephp)
- [CVE-2006-5032](https://cve.now/CVE-2006-5032.md): PHP remote file inclusion vulnerability in dix.php3 in PHPartenaire 1.0 allows remote attackers to execute arbitrary PHP code via a URL in t (no CVSS)
- [CVE-2006-5033](https://cve.now/CVE-2006-5033.md): Unspecified vulnerability in StoresAndCalendarsList.cgi in Paul Smith Computer Services vCAP 1.9.0 Beta and earlier allows remote attackers (no CVSS)
- [CVE-2006-5034](https://cve.now/CVE-2006-5034.md): Directory traversal vulnerability in Paul Smith Computer Services vCAP 1.9.0 Beta and earlier allows remote attackers to read arbitrary file (no CVSS)
- [CVE-2006-5035](https://cve.now/CVE-2006-5035.md): Multiple cross-site scripting (XSS) vulnerabilities in Paul Smith Computer Services vCAP 1.7.0 allow remote attackers to inject arbitrary we (no CVSS)
- [CVE-2006-5036](https://cve.now/CVE-2006-5036.md): MySource Matrix 3.8 and earlier, and MySource 2.x, allow remote attackers to use the application as an HTTP proxy server via the sq\_remote\_p (no CVSS)
- [CVE-2006-5037](https://cve.now/CVE-2006-5037.md): MySource Matrix after 3.8 allows remote attackers to use the application as an HTTP proxy server via a MIME encoded URL in the sq\_content\_sr (no CVSS)
- [CVE-2006-5038](https://cve.now/CVE-2006-5038.md): The FiWin SS28S WiFi VoIP SIP/Skype Phone, firmware version 01\_02\_07, has a hard-coded username and password, which allows remote attackers (no CVSS)
- [CVE-2006-5039](https://cve.now/CVE-2006-5039.md): Unspecified vulnerability in Events 1.3 beta module (com\_events) for Joomla! has unspecified impact and attack vectors. (no CVSS)
- [CVE-2006-5040](https://cve.now/CVE-2006-5040.md): Unspecified vulnerability in SEF404x (com\_sef) for Joomla! has unspecified impact and attack vectors. (no CVSS)
- [CVE-2006-5041](https://cve.now/CVE-2006-5041.md): Unspecified vulnerability in Hot Properties (possibly com\_hotproperties) 0.97 and earlier for Joomla! has unspecified impact and attack vect (no CVSS)
- [CVE-2006-5042](https://cve.now/CVE-2006-5042.md): Unspecified vulnerability in mosMedia (com\_mosmedia) 1.0.8 and earlier for Joomla! has unspecified impact and attack vectors. (no CVSS)
- [CVE-2006-5043](https://cve.now/CVE-2006-5043.md): Multiple PHP remote file inclusion vulnerabilities in the Joomlaboard Forum Component (com\_joomlaboard) before 1.1.2 for Joomla! allow remot (no CVSS)
- [CVE-2006-5044](https://cve.now/CVE-2006-5044.md): Unspecified vulnerability in Prince Clan (Princeclan) Chess component (com\_pcchess) 0.8 and earlier for Mambo and Joomla! has unspecified im (no CVSS)
- [CVE-2006-5045](https://cve.now/CVE-2006-5045.md): Unspecified vulnerability in PollXT component (com\_pollxt) 1.22.07 and earlier for Joomla! has unspecified impact and attack vectors, probab (no CVSS)
- [CVE-2006-5046](https://cve.now/CVE-2006-5046.md): Unspecified vulnerability in RS Gallery2 (com\_rsgallery2) 1.11.3 and earlier for Joomla! has unspecified impact and attack vectors, related (no CVSS)
- [CVE-2006-5047](https://cve.now/CVE-2006-5047.md): Unspecified vulnerability in rsgallery2.html.php in RS Gallery2 component (com\_rsgallery2) before 1.11.3 for Joomla! allows attackers to exe (no CVSS)
- [CVE-2006-5048](https://cve.now/CVE-2006-5048.md): Multiple PHP remote file inclusion vulnerabilities in Security Images (com\_securityimages) component 3.0.5 and earlier for Joomla! allow rem (no CVSS)
- [CVE-2006-5049](https://cve.now/CVE-2006-5049.md): Unspecified vulnerability in Classifieds (com\_classifieds) component 1.3 and earlier for Joomla! has unspecified impact and attack vectors. (no CVSS)
- [CVE-2006-5050](https://cve.now/CVE-2006-5050.md): Directory traversal vulnerability in httpd in Rob Landley BusyBox allows remote attackers to read arbitrary files via URL-encoded "%2e%2e/" (no CVSS)
- [CVE-2006-5051](https://cve.now/CVE-2006-5051.md): Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbit (no CVSS)
- [CVE-2006-5052](https://cve.now/CVE-2006-5052.md): Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity (no CVSS)
- [CVE-2006-4694](https://cve.now/CVE-2006-4694.md): Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office XP and Office 2003 allows user-assisted attackers to execute arbitr (no CVSS)
- [CVE-2006-4924](https://cve.now/CVE-2006-4924.md): sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) vi (no CVSS)
- [CVE-2006-5002](https://cve.now/CVE-2006-5002.md): Unspecified vulnerability in IBM Inventory Scout for AIX 2.2.0.0 through 2.2.0.9 (invscoutClient\_VPD\_Survey) allows attackers to overwrite a (no CVSS)
- [CVE-2006-5003](https://cve.now/CVE-2006-5003.md): Unspecified vulnerability in the named8 command in IBM AIX 5.2.0 and 5.3.0 allows local users to execute arbitrary commands via unspecified (no CVSS)
- [CVE-2006-5004](https://cve.now/CVE-2006-5004.md): Unspecified vulnerability in the rdist command in IBM AIX 5.2.0 and 5.3.0 allows local users to overwrite arbitrary files via unspecified ve (no CVSS)
- [CVE-2006-5005](https://cve.now/CVE-2006-5005.md): Unspecified vulnerability in bos.net.tcp.client in IBM AIX 5.2.0 and 5.3.0 allows local users to execute arbitrary commands via unspecified (no CVSS)
- [CVE-2006-5006](https://cve.now/CVE-2006-5006.md): Buffer overflow in cfgmgr in IBM AIX 5.2.0 and 5.3.0 allows local users to execute arbitrary code via a long directory path argument. (no CVSS)
- [CVE-2006-5007](https://cve.now/CVE-2006-5007.md): Untrusted search path vulnerability in uucp in IBM AIX 5.2.0 and 5.3.0 allows local users to local users to gain privileges via a Trojan hor (no CVSS)
- [CVE-2006-5008](https://cve.now/CVE-2006-5008.md): Unspecified vulnerability in utape in IBM AIX 5.2.0 and 5.3.0 allows attackers to execute arbitrary commands and overwrite arbitrary files v (no CVSS)
- [CVE-2006-5009](https://cve.now/CVE-2006-5009.md): Unspecified vulnerability in xlock in IBM AIX 5.2.0 and 5.3.0 allows local users to execute arbitrary commands and overwrite arbitrary files (no CVSS)
- [CVE-2006-5010](https://cve.now/CVE-2006-5010.md): Untrusted search path vulnerability in acctctl in IBM AIX 5.3.0 allows local users to execute arbitrary commands by modifying the path to po (no CVSS)
- [CVE-2006-5011](https://cve.now/CVE-2006-5011.md): Untrusted search path vulnerability in snappd in IBM AIX 5.2.0 and 5.3.0 allows local users to execute arbitrary commands via a Trojan horse (no CVSS)
- [CVE-2006-5012](https://cve.now/CVE-2006-5012.md): Unspecified vulnerability in Sun Solaris 8, 9, and 10 before 20060925 allows local users to cause a denial of service (disable syslog) and p (no CVSS)
- [CVE-2006-5013](https://cve.now/CVE-2006-5013.md): Sun Solaris 10 before patch 118855-16 (20060925), when run on x64 systems using IPv6, allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2006-5014](https://cve.now/CVE-2006-5014.md): Unspecified vulnerability in cPanel before 10.9.0 12 Tree allows remote authenticated users to gain privileges via unspecified vectors in (1 (CVSS 8.8)
- [CVE-2006-5015](https://cve.now/CVE-2006-5015.md): PHP remote file inclusion vulnerability in hit.php in Kietu 3.2 allows remote attackers to execute arbitrary PHP code via an FTP URL in the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-09-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.