# CVEs published 2006-12-07

47 CVEs were published on December 7, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-4249](https://cve.now/CVE-2006-4249.md): Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to "masquera (no CVSS, plone)
- [CVE-2006-6384](https://cve.now/CVE-2006-6384.md): Absolute path traversal vulnerability in abitwhizzy.php before 20061204 allows remote attackers to read arbitrary files via an absolute path (no CVSS)
- [CVE-2006-6380](https://cve.now/CVE-2006-6380.md): Cross-site scripting (XSS) vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2006-6381](https://cve.now/CVE-2006-6381.md): Directory traversal vulnerability in getfile.asp in Ultimate HelpDesk allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2006-6382](https://cve.now/CVE-2006-6382.md): The control panel for Positive Software H-Sphere before 2.5.0 RC3 creates log files in a user's directory with insecure permissions, which a (no CVSS)
- [CVE-2006-6369](https://cve.now/CVE-2006-6369.md): SQL injection vulnerability in lib/entry\_reply\_entry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary S (no CVSS)
- [CVE-2006-6370](https://cve.now/CVE-2006-6370.md): SQL injection vulnerability in forum/modules/gallery/post.php in Invision Gallery 2.0.7 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2006-6371](https://cve.now/CVE-2006-6371.md): Cross-site scripting (XSS) vulnerability in pbguestbook.php in JAB Guest Book allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-6372](https://cve.now/CVE-2006-6372.md): Multiple cross-site scripting (XSS) vulnerabilities in pbguestbook.php in JAB Guest Book 20061205 allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2006-6373](https://cve.now/CVE-2006-6373.md): PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via a direct request for libraries/common.lib.php, which reveal (no CVSS)
- [CVE-2006-6374](https://cve.now/CVE-2006-6374.md): Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-pl2 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP res (no CVSS)
- [CVE-2006-6375](https://cve.now/CVE-2006-6375.md): Cross-site scripting (XSS) vulnerability in display.php in Simple Machines Forum (SMF) 1.1 Final and earlier allows remote attackers to inje (no CVSS)
- [CVE-2006-6376](https://cve.now/CVE-2006-6376.md): Multiple directory traversal vulnerabilities in fm.php in Simple File Manager (SFM) 0.24a allow remote attackers to use ".." sequences to (1 (no CVSS)
- [CVE-2006-6377](https://cve.now/CVE-2006-6377.md): Uploadscript 1.2 and earlier stores sensitive data under the web root with insufficient access control, which allows remote attackers to obt (no CVSS)
- [CVE-2006-6378](https://cve.now/CVE-2006-6378.md): BTSaveMySql 1.2 stores sensitive data under the web root with insufficient access control, which allows remote attackers to obtain configura (no CVSS)
- [CVE-2006-6235](https://cve.now/CVE-2006-6235.md): A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute ar (no CVSS)
- [CVE-2006-6358](https://cve.now/CVE-2006-6358.md): SQL injection vulnerability in the login function in auth.inc in Stefan Frech online-bookmarks 0.6.12 allows remote attackers to execute arb (no CVSS)
- [CVE-2006-6359](https://cve.now/CVE-2006-6359.md): Cross-site scripting (XSS) vulnerability in Stefan Frech online-bookmarks 0.6.12 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2006-6360](https://cve.now/CVE-2006-6360.md): PHP remote file inclusion vulnerability in activate.php in PHP Upload Center 2.0 allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2006-6361](https://cve.now/CVE-2006-6361.md): Heap-based buffer overflow in the uploadprogress\_php\_rfc1867\_file function in uploadprogress.c in Bitflux Upload Progress Meter before 8276 (no CVSS)
- [CVE-2006-6363](https://cve.now/CVE-2006-6363.md): Cross-site scripting (XSS) vulnerability in admin.pl in BlueSocket Secure Controller (BSC) before 5.2, or without 5.1.1-BluePatch, allows re (no CVSS)
- [CVE-2006-6364](https://cve.now/CVE-2006-6364.md): Cross-site scripting (XSS) vulnerability in error.php in Inside Systems Mail (ISMail) 2.0 and earlier allows remote attackers to inject arbi (no CVSS)
- [CVE-2006-6365](https://cve.now/CVE-2006-6365.md): SQL injection vulnerability in detail.asp in DUware DUpaypal 3.1, and possibly earlier, allows remote attackers to execute arbitrary SQL com (no CVSS)
- [CVE-2006-6366](https://cve.now/CVE-2006-6366.md): Cross-site scripting (XSS) vulnerability in includes/elements/spellcheck/spellwin.php in Cerberus Helpdesk 0.97.3, 2.0 through 2.7, 3.2.1, a (no CVSS)
- [CVE-2006-6367](https://cve.now/CVE-2006-6367.md): Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbit (no CVSS)
- [CVE-2006-6368](https://cve.now/CVE-2006-6368.md): PHP remote file inclusion vulnerability in login.php.inc in awrate 1.0 allows remote attackers to execute arbitrary PHP code via a URL in th (no CVSS)
- [CVE-2006-6337](https://cve.now/CVE-2006-6337.md): Multiple SQL injection vulnerabilities in giris.asp in Aspee and Dogantepe Ziyaretci Defteri allow remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2006-6338](https://cve.now/CVE-2006-6338.md): Unrestricted file upload vulnerability in upload/index.php in deV!L\`z Clanportal (DZCP) before 1.3.6.1 allows remote attackers to upload and (no CVSS)
- [CVE-2006-6339](https://cve.now/CVE-2006-6339.md): SQL injection vulnerability in sites/index.php in deV!L\`z Clanportal (DZCP) before 1.3.6.1 allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2006-6340](https://cve.now/CVE-2006-6340.md): keystone.exe in nVIDIA nView allows attackers to cause a denial of service via a long command line argument. (no CVSS)
- [CVE-2006-6341](https://cve.now/CVE-2006-6341.md): Multiple PHP remote file inclusion vulnerabilities in mg.applanix 1.3.1 and earlier allow remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2006-6342](https://cve.now/CVE-2006-6342.md): Multiple SQL injection vulnerabilities in KLF-DESIGN (aka Kim L. (no CVSS)
- [CVE-2006-6343](https://cve.now/CVE-2006-6343.md): SQL injection vulnerability in polls.php in Neocrome Seditio 1.10 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2006-6344](https://cve.now/CVE-2006-6344.md): Multiple unspecified vulnerabilities in Neocrome Seditio 1.10 and earlier have unknown impact and attack vectors related to (1) plugins/ipse (no CVSS)
- [CVE-2006-6345](https://cve.now/CVE-2006-6345.md): Directory traversal vulnerability in SAP Internet Graphics Service (IGS) 6.40 Patchlevel 16 and earlier, and 7.00 Patchlevel 6 and earlier, (no CVSS)
- [CVE-2006-6346](https://cve.now/CVE-2006-6346.md): Unspecified vulnerability in SAP Internet Graphics Service (IGS) 6.40 Patchlevel 15 and earlier, and 7.00 Patchlevel 3 and earlier, allows r (no CVSS)
- [CVE-2006-6347](https://cve.now/CVE-2006-6347.md): Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly us (no CVSS)
- [CVE-2006-6348](https://cve.now/CVE-2006-6348.md): Cross-site scripting (XSS) vulnerability in board.php in mowdBB RC-6 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2006-6349](https://cve.now/CVE-2006-6349.md): Multiple SQL injection vulnerabilities in PWP Technologies The Classified Ad System allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2006-6350](https://cve.now/CVE-2006-6350.md): listpics 5 stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a database v (no CVSS)
- [CVE-2006-6351](https://cve.now/CVE-2006-6351.md): KhaledMuratList stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a datab (no CVSS)
- [CVE-2006-6352](https://cve.now/CVE-2006-6352.md): FRISK Software F-Prot Antivirus before 4.6.7 allows user-assisted remote attackers to cause a denial of service (infinite loop) via a crafte (no CVSS)
- [CVE-2006-6353](https://cve.now/CVE-2006-6353.md): Multiple unspecified vulnerabilities in BOMArchiveHelper in Mac OS X allow user-assisted remote attackers to cause a denial of service (appl (no CVSS)
- [CVE-2006-6354](https://cve.now/CVE-2006-6354.md): Multiple SQL injection vulnerabilities in detail.asp in DuWare DuNews allow remote attackers to execute arbitrary SQL commands via the (1) i (no CVSS)
- [CVE-2006-6355](https://cve.now/CVE-2006-6355.md): SQL injection vulnerability in default.asp in DuWare DuClassmate allows remote attackers to execute arbitrary SQL commands via the iCity par (no CVSS)
- [CVE-2006-6356](https://cve.now/CVE-2006-6356.md): Multiple cross-site scripting (XSS) vulnerabilities in templates/link\_temp.php in PHPNews 1.3.0 allow remote attackers to inject arbitrary w (no CVSS)
- [CVE-2006-6357](https://cve.now/CVE-2006-6357.md): Cross-site scripting (XSS) vulnerability in templates/cat\_temp.php in PHPNews 1.3.0 and earlier allows remote attackers to inject arbitrary (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-12-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.