# CVEs published 2006-11-20

16 CVEs were published on November 20, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-5975](https://cve.now/CVE-2006-5975.md): Multiple cross-site scripting (XSS) vulnerabilities in comments.asp in BlogMe 3.0 allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2006-5976](https://cve.now/CVE-2006-5976.md): Multiple SQL injection vulnerabilities in admin\_login.asp in BlogMe 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2006-5977](https://cve.now/CVE-2006-5977.md): Multiple SQL injection vulnerabilities in MultiCalendars allow remote attackers to execute arbitrary SQL commands via the (1) M or (2) Y par (no CVSS)
- [CVE-2006-5978](https://cve.now/CVE-2006-5978.md): Unspecified vulnerability in E-Xoopport before 2.2.0 has unknown impact and attack vectors, as addressed by "Some security fix." (no CVSS)
- [CVE-2006-5979](https://cve.now/CVE-2006-5979.md): Renasoft NetJetServer 2.5.3.939, and possibly earlier, uses insecure permissions for Global.asa, which allows remote attackers to obtain sen (no CVSS)
- [CVE-2006-5980](https://cve.now/CVE-2006-5980.md): adm\_lgn\_admin.asp in Renasoft NetJetServer 2.5.3.939, and possibly earlier, does not properly perform login authentication, which allows rem (no CVSS)
- [CVE-2006-5981](https://cve.now/CVE-2006-5981.md): Multiple directory traversal vulnerabilities in SeleniumServer FTP Server 1.0, and possibly earlier, allow remote attackers to list arbitrar (no CVSS)
- [CVE-2006-5982](https://cve.now/CVE-2006-5982.md): SeleniumServer FTP Server 1.0, and possibly earlier, stores user passwords in plaintext in the Servers directory, which allows attackers to (no CVSS)
- [CVE-2006-5983](https://cve.now/CVE-2006-5983.md): Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users to inject arbitrary (no CVSS)
- [CVE-2006-5984](https://cve.now/CVE-2006-5984.md): Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 allow remote authenticated users to inject arbi (no CVSS)
- [CVE-2006-5985](https://cve.now/CVE-2006-5985.md): Multiple cross-site scripting (XSS) vulnerabilities in admin/options.php in Extreme CMS 0.9, and possibly earlier, allow remote attackers to (no CVSS)
- [CVE-2006-5986](https://cve.now/CVE-2006-5986.md): admin/options.php in Extreme CMS 0.9, and possibly earlier, does not require authentication, which might allow remote attackers to conduct u (no CVSS)
- [CVE-2006-5987](https://cve.now/CVE-2006-5987.md): SQL injection vulnerability in default.asp in ASPintranet, possibly 1.2, allows remote attackers to execute arbitrary SQL commands via the a (no CVSS)
- [CVE-2006-5988](https://cve.now/CVE-2006-5988.md): Unspecified vulnerability in Windows 2000 Advanced Server SP4 running Active Directory allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2006-5989](https://cve.now/CVE-2006-5989.md): Off-by-one error in the der\_get\_oid function in mod\_auth\_kerb 5.0 allows remote attackers to cause a denial of service (crash) via a crafted (no CVSS)
- [CVE-2006-5973](https://cve.now/CVE-2006-5973.md): Off-by-one buffer overflow in Dovecot 1.0test53 through 1.0.rc14, and possibly other versions, when index files are used and mmap\_disable is (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-11-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.