# CVEs published 2006-10-28

11 CVEs were published on October 28, 2006: 0 critical, 1 high. Days are UTC.

- [CVE-2006-5598](https://cve.now/CVE-2006-5598.md): Cross-site scripting (XSS) vulnerability in index.php for GOOP Gallery 2.0, and possibly other versions before 2.0.3, allows remote attacker (no CVSS)
- [CVE-2006-5599](https://cve.now/CVE-2006-5599.md): Cross-site scripting (XSS) vulnerability in Oracle Application Express (formerly HTML DB) before 2.2.1 allows remote attackers to inject arb (no CVSS)
- [CVE-2006-5600](https://cve.now/CVE-2006-5600.md): Axalto Protiva 1.1, possibly only non-commercial versions, stores passwords in plaintext in files with insecure permissions, which allows lo (no CVSS)
- [CVE-2006-5601](https://cve.now/CVE-2006-5601.md): Stack-based buffer overflow in the eap\_do\_notify function in eap.c in xsupplicant before 1.2.6, and possibly other versions, allows remote a (no CVSS)
- [CVE-2006-5602](https://cve.now/CVE-2006-5602.md): Multiple memory leaks in xsupplicant before 1.2.6, and possibly other versions, allow attackers to cause a denial of service (memory consump (no CVSS)
- [CVE-2006-4513](https://cve.now/CVE-2006-4513.md): Multiple integer overflows in the WV library in wvWare (formerly mswordview) before 1.2.3, as used by AbiWord, KWord, and possibly other pro (no CVSS)
- [CVE-2006-4574](https://cve.now/CVE-2006-4574.md): Off-by-one error in the MIME Multipart dissector in Wireshark (formerly Ethereal) 0.10.1 through 0.99.3 allows remote attackers to cause a d (CVSS 7.5)
- [CVE-2006-5469](https://cve.now/CVE-2006-5469.md): Unspecified vulnerability in the WBXML dissector in Wireshark (formerly Ethereal) 0.10.11 through 0.99.3 allows remote attackers to cause a (no CVSS)
- [CVE-2006-5595](https://cve.now/CVE-2006-5595.md): Unspecified vulnerability in the AirPcap support in Wireshark (formerly Ethereal) 0.99.3 has unspecified attack vectors related to WEP key p (no CVSS)
- [CVE-2006-5596](https://cve.now/CVE-2006-5596.md): Directory traversal vulnerability in the SSL server in AEP Smartgate 4.3b allows remote attackers to download arbitrary files via ..\\ (dot d (no CVSS)
- [CVE-2006-5597](https://cve.now/CVE-2006-5597.md): join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accounts via modified (1) (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-10-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.