# CVEs published 2006-11-21 32 CVEs were published on November 21, 2006: 1 critical, 1 high. Days are UTC. - [CVE-2005-4815](https://cve.now/CVE-2005-4815.md): SAP 6.4 before 6.40 patch 4, 6.2 before 6.20 patch 1364, 4.6 before 4.6D patch 1767, 45 before 45B patch 913, 40 before 40B patch 1008, and (no CVSS) - [CVE-2006-6007](https://cve.now/CVE-2006-6007.md): save\_profile.asp in WebEvents (Online Event Registration Template) 2.0 and earlier allows remote attackers to change the profiles, passwords (no CVSS) - [CVE-2006-6008](https://cve.now/CVE-2006-6008.md): ftpd in Linux Netkit (linux-ftpd) 0.17, and possibly other versions, does not check the return status of certain seteuid, setgid, and setuid (no CVSS) - [CVE-2006-6009](https://cve.now/CVE-2006-6009.md): Unspecified vulnerability in the Java Runtime Environment (JRE) Swing library in JDK and JRE 5.0 Update 7 and earlier allows attackers to ob (no CVSS) - [CVE-2006-6010](https://cve.now/CVE-2006-6010.md): SAP allows remote attackers to obtain potentially sensitive information such as operating system and SAP version via an RFC\_SYSTEM\_INFO RfcC (no CVSS) - [CVE-2006-6011](https://cve.now/CVE-2006-6011.md): Unspecified vulnerability in SAP Web Application Server before 6.40 patch 6 allows remote attackers to cause a denial of service (enserver.e (no CVSS) - [CVE-2006-6012](https://cve.now/CVE-2006-6012.md): Cross-site scripting (XSS) vulnerability in csm/asp/listings.asp in MGinternet Car Site Manager (CSM) allows remote attackers to inject arbi (no CVSS) - [CVE-2006-6013](https://cve.now/CVE-2006-6013.md): Integer signedness error in the fw\_ioctl (FW\_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kerne (no CVSS) - [CVE-2006-6014](https://cve.now/CVE-2006-6014.md): The NetBSD-current kernel before 20061028 does not properly perform bounds checking of an unspecified userspace parameter in the ptrace syst (no CVSS) - [CVE-2006-6015](https://cve.now/CVE-2006-6015.md): Buffer overflow in the JavaScript implementation in Safari on Apple Mac OS X 10.4 allows remote attackers to cause a denial of service (appl (no CVSS) - [CVE-2006-6016](https://cve.now/CVE-2006-6016.md): wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified (CVSS 6.5) - [CVE-2006-6017](https://cve.now/CVE-2006-6017.md): WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote auth (CVSS 6.5) - [CVE-2006-6018](https://cve.now/CVE-2006-6018.md): PHP remote file inclusion vulnerability in mybic\_server.php in Jim Plush My-BIC 0.6.5 allows remote attackers to execute arbitrary PHP code (no CVSS) - [CVE-2006-6019](https://cve.now/CVE-2006-6019.md): Cross-site scripting (XSS) vulnerability in extensions/googiespell/googlespell\_proxy.php in Bill Roberts Bloo 1.0 allows remote attackers to (no CVSS) - [CVE-2006-6020](https://cve.now/CVE-2006-6020.md): Cross-site scripting (XSS) vulnerability in announce.php in Blog Torrent Preview 0.92 allows remote attackers to inject arbitrary web script (no CVSS) - [CVE-2006-6021](https://cve.now/CVE-2006-6021.md): SQL injection vulnerability in the login component in BestWebApp Dating Site allows remote attackers to execute arbitrary SQL commands via t (no CVSS) - [CVE-2006-6022](https://cve.now/CVE-2006-6022.md): Cross-site scripting (XSS) vulnerability in login\_form.asp in BestWebApp Dating Site allows remote attackers to inject arbitrary web script (no CVSS) - [CVE-2006-6023](https://cve.now/CVE-2006-6023.md): PHP remote file inclusion vulnerability in phoo.base.php in Bill Roberts Bloo 1.0 allows remote attackers to execute arbitrary PHP code via (no CVSS) - [CVE-2006-6024](https://cve.now/CVE-2006-6024.md): Multiple buffer overflows in Eudora Worldmail, possibly Worldmail 3 version 6.1.22.0, have unknown impact and attack vectors, as demonstrate (CVSS 9.8) - [CVE-2006-6025](https://cve.now/CVE-2006-6025.md): QUALCOMM Eudora WorldMail 4.0 allows remote attackers to cause a denial of service, as demonstrated by a certain module in VulnDisco Pack. (CVSS 7.5) - [CVE-2006-6026](https://cve.now/CVE-2006-6026.md): Heap-based buffer overflow in Real Networks Helix Server and Helix Mobile Server before 11.1.3, and Helix DNA Server 11.0 and 11.1, allows r (no CVSS) - [CVE-2006-6027](https://cve.now/CVE-2006-6027.md): Adobe Reader (Adobe Acrobat Reader) 7.0 through 7.0.8 allows remote attackers to cause a denial of service and possibly execute arbitrary co (no CVSS) - [CVE-2006-6028](https://cve.now/CVE-2006-6028.md): Directory traversal vulnerability in textview.php in Anton Vlasov DoSePa 1.0.4 allows remote attackers to read arbitrary files via a .. (no CVSS) - [CVE-2006-6029](https://cve.now/CVE-2006-6029.md): SQL injection vulnerability in vir\_Login.asp in Property Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the UserName (no CVSS) - [CVE-2006-6030](https://cve.now/CVE-2006-6030.md): Multiple SQL injection vulnerabilities in E-Calendar Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) username a (no CVSS) - [CVE-2006-6031](https://cve.now/CVE-2006-6031.md): Multiple SQL injection vulnerabilities in Greater Cincinnati Internet Solutions (GCIS) ASPCart allow remote attackers to execute arbitrary S (no CVSS) - [CVE-2006-6032](https://cve.now/CVE-2006-6032.md): Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog (SPHPBlog), probably 0.4.8, allow remote attackers to inject arbitrar (no CVSS) - [CVE-2006-6033](https://cve.now/CVE-2006-6033.md): Multiple directory traversal vulnerabilities in Simple PHP Blog (SPHPBlog), probably 0.4.8, allow remote attackers to read arbitrary files a (no CVSS) - [CVE-2006-6034](https://cve.now/CVE-2006-6034.md): Multiple SQL injection vulnerabilities in SitesOutlet E-commerce Kit-1 PayPal Edition allow remote attackers to execute arbitrary SQL comman (no CVSS) - [CVE-2006-3890](https://cve.now/CVE-2006-3890.md): Stack-based buffer overflow in the Sky Software FileView ActiveX control, as used in WinZip 10 before build 7245 and in certain other applic (no CVSS) - [CVE-2006-5991](https://cve.now/CVE-2006-5991.md): Multiple SQL injection vulnerabilities in wwweb concepts CactuShop allow remote attackers to execute arbitrary SQL commands via the (1) prod (no CVSS) - [CVE-2006-5990](https://cve.now/CVE-2006-5990.md): VMWare VirtualCenter client 2.x before 2.0.1 Patch 1 (Build 33643) and 1.4.x before 1.4.1 Patch 1 (Build 33425), when server certificate ver (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2006-11-21 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.