# CVEs published 2006-11-17

27 CVEs were published on November 17, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2003-1308](https://cve.now/CVE-2003-1308.md): CRLF injection vulnerability in fvwm-menu-directory for fvwm 2.5.x before 2.5.10 and 2.4.x before 2.4.18 allows local users to execute arbit (no CVSS)
- [CVE-2006-5793](https://cve.now/CVE-2006-5793.md): The sPLT chunk handling code (png\_set\_sPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data typ (no CVSS)
- [CVE-2006-5969](https://cve.now/CVE-2006-5969.md): CRLF injection vulnerability in the evalFolderLine function in fvwm 2.5.18 and earlier allows local users to execute arbitrary commands via (no CVSS)
- [CVE-2006-5966](https://cve.now/CVE-2006-5966.md): Panda ActiveScan 5.53.00, and other versions before 5.54.01, allows remote attackers to (1) reboot the system using the Reinicializar method (no CVSS)
- [CVE-2006-5967](https://cve.now/CVE-2006-5967.md): Race condition in Panda ActiveScan 5.53.00, and other versions before 5.54.01, allows remote attackers to cause memory corruption and execut (no CVSS)
- [CVE-2006-5968](https://cve.now/CVE-2006-5968.md): MDaemon 9.0.5, 9.0.6, 9.51, and 9.53, and possibly other versions, installs the MDaemon application folder with insecure permissions (Users (no CVSS)
- [CVE-2006-5957](https://cve.now/CVE-2006-5957.md): Multiple SQL injection vulnerabilities in INFINICART allow remote attackers to execute arbitrary SQL commands via the (1) groupid parameter (no CVSS)
- [CVE-2006-5958](https://cve.now/CVE-2006-5958.md): Multiple cross-site scripting (XSS) vulnerabilities in INFINICART allow remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS)
- [CVE-2006-5959](https://cve.now/CVE-2006-5959.md): SQL injection vulnerability in browse.asp in A+ Store E-Commerce allows remote attackers to execute arbitrary SQL commands via the ParentID (no CVSS)
- [CVE-2006-5960](https://cve.now/CVE-2006-5960.md): Multiple cross-site scripting (XSS) vulnerabilities in account\_login.asp in A+ Store E-Commerce allow remote attackers to inject arbitrary w (no CVSS)
- [CVE-2006-5961](https://cve.now/CVE-2006-5961.md): Buffer overflow in Mercury Mail Transport System 4.01b for Windows has unknown impact and attack vectors, as originally reported in a GLEG V (no CVSS)
- [CVE-2006-5962](https://cve.now/CVE-2006-5962.md): Multiple SQL injection vulnerabilities in Hpecs Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) Username (no CVSS)
- [CVE-2006-5942](https://cve.now/CVE-2006-5942.md): Cross-site scripting (XSS) vulnerability in inventory/display/display\_results.asp in Website Designs For Less Inventory Manager allows remot (no CVSS)
- [CVE-2006-5943](https://cve.now/CVE-2006-5943.md): Multiple SQL injection vulnerabilities in inventory/display/imager.asp in Website Designs for Less Inventory Manager allow remote attackers (no CVSS)
- [CVE-2006-5944](https://cve.now/CVE-2006-5944.md): Cross-site scripting (XSS) vulnerability in csm/asp/listings.asp in MGinternet Car Site Manager (CSM) allows remote attackers to inject arbi (no CVSS)
- [CVE-2006-5945](https://cve.now/CVE-2006-5945.md): Multiple SQL injection vulnerabilities in MGinternet Car Site Manager (CSM) allow remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2006-5946](https://cve.now/CVE-2006-5946.md): SQL injection vulnerability in demo/glossary/glossary.asp in FunkyASP Glossary 1.0 allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2006-5947](https://cve.now/CVE-2006-5947.md): Multiple directory traversal vulnerabilities in Conxint FTP Server 2.2.0603, and possibly earlier, allow remote attackers to read arbitrary (no CVSS)
- [CVE-2006-5948](https://cve.now/CVE-2006-5948.md): PHP remote file inclusion vulnerability in pntUnit/Inspect.php in phpPeanuts 1.1 and earlier allows remote attackers to execute arbitrary PH (no CVSS)
- [CVE-2006-5949](https://cve.now/CVE-2006-5949.md): Directory traversal vulnerability in ALTools ALFTP FTP Server 4.1 beta 1, and possibly earlier, allows remote attackers to create arbitrary (no CVSS)
- [CVE-2006-5950](https://cve.now/CVE-2006-5950.md): Unspecified vulnerability in ALTools ALFTP FTP Server 4.1 beta 1, and possibly earlier, allows remote authenticated users to obtain the inst (no CVSS)
- [CVE-2006-5951](https://cve.now/CVE-2006-5951.md): PHP remote file inclusion vulnerability in pipe.php in Exophpdesk 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the (no CVSS)
- [CVE-2006-5952](https://cve.now/CVE-2006-5952.md): SQL injection vulnerability in admin/default.asp in ASP Smiley 1.0 allows remote attackers to execute arbitrary SQL commands via the Usernam (no CVSS)
- [CVE-2006-5953](https://cve.now/CVE-2006-5953.md): SQL injection vulnerability in viewcart.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2006-5954](https://cve.now/CVE-2006-5954.md): SQL injection vulnerability in page.asp in NetVIOS 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the NewsID (no CVSS)
- [CVE-2006-5955](https://cve.now/CVE-2006-5955.md): SQL injection vulnerability in listings.asp in 20/20 DataShed (aka Real Estate Listing System) allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2006-5956](https://cve.now/CVE-2006-5956.md): XLineSoft PHPRunner 3.1 stores the (1) database server name, (2) database names, (3) usernames, and (4) passwords in plaintext in %WINDIR%\\P (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-11-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.