# CVEs published 2006-10-02

58 CVEs were published on October 2, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-5144](https://cve.now/CVE-2006-5144.md): Cross-site scripting (XSS) vulnerability in userupload.php in OlateDownload 3.4.0 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-5145](https://cve.now/CVE-2006-5145.md): Multiple SQL injection vulnerabilities in OlateDownload 3.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) page para (no CVSS)
- [CVE-2006-5146](https://cve.now/CVE-2006-5146.md): Multiple cross-site scripting (XSS) vulnerabilities in Yblog allow remote attackers to inject arbitrary web script or HTML via the (1) id pa (no CVSS)
- [CVE-2006-5147](https://cve.now/CVE-2006-5147.md): PHP remote file inclusion vulnerability in wamp\_dir/setup/yesno.phtml in VAMP Webmail 2.0beta1 and earlier allows remote attackers to execut (no CVSS)
- [CVE-2006-5148](https://cve.now/CVE-2006-5148.md): Multiple PHP remote file inclusion vulnerabilities in Forum82 2.5.2b and earlier allow remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2006-5149](https://cve.now/CVE-2006-5149.md): Multiple directory traversal vulnerabilities in OpenBiblio before 0.5.2 allow remote attackers to include and execute arbitrary local files (no CVSS)
- [CVE-2006-5150](https://cve.now/CVE-2006-5150.md): SQL injection vulnerability in the reports system in OpenBiblio before 0.5.2 allows remote attackers with report privileges to execute arbit (no CVSS)
- [CVE-2006-4395](https://cve.now/CVE-2006-4395.md): Unspecified vulnerability in QuickDraw Manager in Apple Mac OS X 10.3.9 and 10.4 through 10.4.7 allows context-dependent attackers to cause (no CVSS)
- [CVE-2006-4399](https://cve.now/CVE-2006-4399.md): User interface inconsistency in Workgroup Manager in Apple Mac OS X 10.4 through 10.4.7 appears to allow administrators to change the authen (no CVSS)
- [CVE-2006-4387](https://cve.now/CVE-2006-4387.md): Apple Mac OS X 10.4 through 10.4.7, when the administrator clears the "Allow user to administer this computer" checkbox in System Preference (no CVSS)
- [CVE-2006-4391](https://cve.now/CVE-2006-4391.md): Buffer overflow in Apple ImageIO on Apple Mac OS X 10.4 through 10.4.7 allows remote attackers to execute arbitrary code via a malformed JPE (no CVSS)
- [CVE-2006-4393](https://cve.now/CVE-2006-4393.md): Unspecified vulnerability in LoginWindow in Apple Mac OS X 10.4 through 10.4.7, when Fast User Switching is enabled, allows local users to g (no CVSS)
- [CVE-2006-4394](https://cve.now/CVE-2006-4394.md): A logic error in LoginWindow in Apple Mac OS X 10.4 through 10.4.7, allows network accounts without GUIds to bypass service access controls (no CVSS)
- [CVE-2006-4397](https://cve.now/CVE-2006-4397.md): Unchecked error condition in LoginWindow in Apple Mac OS X 10.4 through 10.4.7 prevents Kerberos tickets from being destroyed if a user does (no CVSS)
- [CVE-2006-4390](https://cve.now/CVE-2006-4390.md): CFNetwork in Apple Mac OS X 10.4 through 10.4.7 and 10.3.9 allows remote SSL sites to appear as trusted sites by using encryption without au (no CVSS)
- [CVE-2006-4392](https://cve.now/CVE-2006-4392.md): The Mach kernel, as used in operating systems including (1) Mac OS X 10.4 through 10.4.7 and (2) OpenStep before 4.2, allows local users to (no CVSS)
- [CVE-2006-5100](https://cve.now/CVE-2006-5100.md): PHP remote file inclusion vulnerability in parse/parser.php in WEB//NEWS (aka webnews) 1.4 and earlier allows remote attackers to execute ar (no CVSS)
- [CVE-2006-5101](https://cve.now/CVE-2006-5101.md): PHP remote file inclusion vulnerability in include.php in Comdev CSV Importer 3.1 and possibly 4.1, as used in (1) Comdev Contact Form 3.1, (no CVSS)
- [CVE-2006-5102](https://cve.now/CVE-2006-5102.md): PHP remote file inclusion vulnerability in include/editfunc.inc.php in Sebastian Baumann and Philipp Wolfer Newswriter SW 1.42 and earlier a (no CVSS)
- [CVE-2006-5103](https://cve.now/CVE-2006-5103.md): PHP remote file inclusion vulnerability in admin/index2.php in bbsNew 2.0.1 allows remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2006-5104](https://cve.now/CVE-2006-5104.md): SQL injection vulnerability in global.php in Jelsoft vBulletin 2.x allows remote attackers to execute arbitrary SQL commands via the templat (no CVSS)
- [CVE-2006-5105](https://cve.now/CVE-2006-5105.md): Multiple PHP remote file inclusion vulnerabilities in SyntaxCMS 1.1.1 through 1.3 allow remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2006-5106](https://cve.now/CVE-2006-5106.md): Cross-site scripting (XSS) vulnerability in FacileForms before 1.4.7 for Mambo and Joomla!, when either register\_globals or RG\_EMULATION is (no CVSS)
- [CVE-2006-5107](https://cve.now/CVE-2006-5107.md): Multiple SQL injection vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to execute arbitrary SQL commands via (1) the user (no CVSS)
- [CVE-2006-5108](https://cve.now/CVE-2006-5108.md): Multiple cross-site scripting (XSS) vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2006-5109](https://cve.now/CVE-2006-5109.md): Devellion CubeCart 2.0.x allows remote attackers to obtain sensitive information via a direct request for (1) link\_navi.php or (2) spotlight (no CVSS)
- [CVE-2006-5110](https://cve.now/CVE-2006-5110.md): Cross-site scripting (XSS) vulnerability in home.php in PHP Invoice 2.2 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2006-5111](https://cve.now/CVE-2006-5111.md): The libksba library 0.9.12 and possibly other versions, as used by gpgsm in the newpg package on SUSE LINUX, allows attackers to cause a den (no CVSS)
- [CVE-2006-5112](https://cve.now/CVE-2006-5112.md): Buffer overflow in InterVations NaviCOPA Web Server 2.01 allows remote attackers to execute arbitrary code via a long HTTP GET request. (no CVSS)
- [CVE-2006-5113](https://cve.now/CVE-2006-5113.md): Directory traversal vulnerability in common.php in Yuuki Yoshizawa Exporia 0.3.0 allows remote attackers to include and execute local files (no CVSS)
- [CVE-2006-5114](https://cve.now/CVE-2006-5114.md): Multiple cross-site scripting (XSS) vulnerabilities in wgate in SAP Internet Transaction Server (ITS) 6.1 and 6.2 allow remote attackers to (no CVSS)
- [CVE-2006-5115](https://cve.now/CVE-2006-5115.md): Directory traversal vulnerability in kgcall.php in KGB 1.87 allows remote attackers to include and execute arbitrary local files via a .. (no CVSS)
- [CVE-2006-5116](https://cve.now/CVE-2006-5116.md): Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized act (no CVSS)
- [CVE-2006-5117](https://cve.now/CVE-2006-5117.md): phpMyAdmin before 2.9.1-rc1 has a libraries directory under the web document root with insufficient access control, which allows remote atta (no CVSS)
- [CVE-2006-5118](https://cve.now/CVE-2006-5118.md): PHP remote file inclusion vulnerability in index.php3 in the PDD package for PHPSelect Web Development Division allows remote attackers to e (no CVSS)
- [CVE-2006-5119](https://cve.now/CVE-2006-5119.md): Multiple cross-site scripting (XSS) vulnerabilities in Zen Cart 1.3.5 allow remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2006-5120](https://cve.now/CVE-2006-5120.md): Multiple cross-site scripting (XSS) vulnerabilities in Scott Metoyer Red Mombin 0.7 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-5121](https://cve.now/CVE-2006-5121.md): SQL injection vulnerability in modules/Downloads/admin.php in the Admin section of PostNuke 0.762 allows remote attackers to execute arbitra (no CVSS)
- [CVE-2006-5122](https://cve.now/CVE-2006-5122.md): Multiple cross-site scripting (XSS) vulnerabilities in Mercury SiteScope 8.2 (8.1.2.0) allow remote authenticated users to inject arbitrary (no CVSS)
- [CVE-2006-5123](https://cve.now/CVE-2006-5123.md): Multiple PHP remote file inclusion vulnerabilities in Albrecht Guenther PHProjekt 5.1.x before 5.1.2 allow remote attackers to execute arbit (no CVSS)
- [CVE-2006-5124](https://cve.now/CVE-2006-5124.md): Multiple PHP remote file inclusion vulnerabilities in Joshua Muheim phpMyWebmin 1.0 allow remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2006-5125](https://cve.now/CVE-2006-5125.md): Directory traversal vulnerability in window.php, possibly used by home.php, in Joshua Muheim phpMyWebmin 1.0 allows remote attackers to obta (no CVSS)
- [CVE-2006-5126](https://cve.now/CVE-2006-5126.md): PHP remote file inclusion vulnerability in index.php in John Himmelman (aka DaRk2k1) PowerPortal 1.3a allows remote attackers to execute arb (no CVSS)
- [CVE-2006-5127](https://cve.now/CVE-2006-5127.md): Multiple cross-site scripting (XSS) vulnerabilities in Bartels Schoene ConPresso before 4.0.5a allow remote attackers to inject arbitrary we (no CVSS)
- [CVE-2006-5128](https://cve.now/CVE-2006-5128.md): SQL injection vulnerability in index.php in Bartels Schoene ConPresso before 4.0.5a allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2006-5129](https://cve.now/CVE-2006-5129.md): Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allow remote attackers to inject ar (no CVSS)
- [CVE-2006-5130](https://cve.now/CVE-2006-5130.md): Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allow remote attackers to inject ar (no CVSS)
- [CVE-2006-5131](https://cve.now/CVE-2006-5131.md): module/shout/jafshout.php (aka the shoutbox) in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allows remote attackers to execute arbitra (no CVSS)
- [CVE-2006-5132](https://cve.now/CVE-2006-5132.md): Multiple PHP remote file inclusion vulnerabilities in phpMyAgenda 3.0 Final and earlier allow remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2006-5133](https://cve.now/CVE-2006-5133.md): Buffer overflow in GuildFTPd 0.999.13 allows remote attackers to have an unknown impact, possibly code execution related to input containing (no CVSS)
- [CVE-2006-5134](https://cve.now/CVE-2006-5134.md): Mercury SiteScope 8.2 (8.1.2.0) allows remote authenticated users to cause a denial of service (loss of connectivity to the classic interfac (no CVSS)
- [CVE-2006-5135](https://cve.now/CVE-2006-5135.md): Multiple PHP remote file inclusion vulnerabilities in A-Blog 2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) ope (no CVSS)
- [CVE-2006-5136](https://cve.now/CVE-2006-5136.md): Multiple PHP remote file inclusion vulnerabilities in ubbt.inc.php in Groupee UBB.threads 6.5.1.1 allow remote attackers to execute arbitrar (no CVSS)
- [CVE-2006-5137](https://cve.now/CVE-2006-5137.md): Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to (1) inject PHP code via a the (no CVSS)
- [CVE-2006-5138](https://cve.now/CVE-2006-5138.md): Groupee UBB.threads 6.5.1.1 allows remote attackers to obtain sensitive information via a direct request for cron/php/subscriptions.php, whi (no CVSS)
- [CVE-2006-5139](https://cve.now/CVE-2006-5139.md): Unspecified vulnerability in MkPortal allows remote attackers to corrupt web site content, and possibly have other impact, via a certain lon (no CVSS)
- [CVE-2006-5140](https://cve.now/CVE-2006-5140.md): SQL injection vulnerability in display.php in Lappy512 PHP Krazy Image Host Script (phpkimagehost) 0.7a allows remote attackers to execute a (no CVSS)
- [CVE-2006-5141](https://cve.now/CVE-2006-5141.md): PHP remote file inclusion vulnerability in script.php in Kevin A. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-10-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.