# CVEs published 2006-12-14

62 CVEs were published on December 14, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-4902](https://cve.now/CVE-2006-4902.md): The NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0\_MP7, 5.1 before 5.1\_MP6, and 6.0 before 6.0\_MP4 does not p (no CVSS)
- [CVE-2006-5822](https://cve.now/CVE-2006-5822.md): Stack-based buffer overflow in the NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0\_MP7, 5.1 before 5.1\_MP6, an (no CVSS)
- [CVE-2006-6222](https://cve.now/CVE-2006-6222.md): Stack-based buffer overflow in the NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0\_MP7, 5.1 before 5.1\_MP6, an (no CVSS)
- [CVE-2006-6304](https://cve.now/CVE-2006-6304.md): The do\_coredump function in fs/exec.c in the Linux kernel 2.6.19 sets the flag variable to O\_EXCL but does not use it, which allows context- (no CVSS)
- [CVE-2006-6474](https://cve.now/CVE-2006-6474.md): Untrusted search path vulnerability in McAfee VirusScan for Linux 4510e and earlier includes the current working directory in the DT\_RPATH e (no CVSS)
- [CVE-2006-6547](https://cve.now/CVE-2006-6547.md): Buffer overflow in the readAA function in read\_aa.cpp in Winamp iPod Plugin (ml\_ipod) 2.00 p19 and earlier allows remote attackers to cause (no CVSS)
- [CVE-2006-6548](https://cve.now/CVE-2006-6548.md): Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated users to inject arbitra (no CVSS)
- [CVE-2006-6549](https://cve.now/CVE-2006-6549.md): PHP remote file inclusion vulnerability in upload.php in Rad Upload 3.02 allows remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2006-6550](https://cve.now/CVE-2006-6550.md): PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2006-6551](https://cve.now/CVE-2006-6551.md): PHP remote file inclusion vulnerability in libs/tucows/api/cartridges/crt\_TUCOWS\_domains/lib/domainutils.inc.php in Tucows Client Code Suite (no CVSS)
- [CVE-2006-6552](https://cve.now/CVE-2006-6552.md): PHP remote file inclusion vulnerability in admin/plugins/NP\_UserSharing.php in BLOG:CMS 4.1.3 and earlier allows remote attackers to execute (no CVSS)
- [CVE-2006-6553](https://cve.now/CVE-2006-6553.md): PHP remote file inclusion vulnerability in includes/newssuite\_constants.php in the NewsSuite 1.03 module for mxBB allows remote attackers to (no CVSS)
- [CVE-2006-6554](https://cve.now/CVE-2006-6554.md): Unspecified vulnerability in Kerio MailServer before 6.3.1 allows remote attackers to cause a denial of service (segmentation fault and serv (no CVSS)
- [CVE-2006-6555](https://cve.now/CVE-2006-6555.md): Multiple SQL injection vulnerabilities in EasyFill before 0.5.1 allow remote attackers to execute arbitrary SQL commands via unspecified vec (no CVSS)
- [CVE-2006-6556](https://cve.now/CVE-2006-6556.md): The eyeHome function in apps/eyeHome.eyeapp/aplic.php in EyeOS before 0.9.3-3 allows remote attackers to upload and execute arbitrary code v (no CVSS)
- [CVE-2006-6557](https://cve.now/CVE-2006-6557.md): Multiple unspecified vulnerabilities in Skulls! before 0.2.6 have unknown impact and attack vectors, as addressed by "Many security fixes." (no CVSS)
- [CVE-2006-6558](https://cve.now/CVE-2006-6558.md): Crob FTP Server 3.6.1 b.263 allows remote attackers to cause a denial of service via a long series of "?A" sequences in the (1) LIST and pos (no CVSS)
- [CVE-2006-6559](https://cve.now/CVE-2006-6559.md): SQL injection vulnerability in ProductDetails.asp in Lotfian Request For Travel 1.0 allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2006-6560](https://cve.now/CVE-2006-6560.md): PHP remote file inclusion vulnerability in includes/common.php in the mx\_modsdb 1.0.0 module for MxBB (aka MX-System) Portal allows remote a (no CVSS)
- [CVE-2006-6561](https://cve.now/CVE-2006-6561.md): Unspecified vulnerability in Microsoft Word 2000, 2002, and Word Viewer 2003 allows user-assisted remote attackers to execute arbitrary code (no CVSS)
- [CVE-2006-6536](https://cve.now/CVE-2006-6536.md): Cross-site scripting (XSS) vulnerability in hata.asp in Cilem Haber Free Edition allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2006-6537](https://cve.now/CVE-2006-6537.md): IBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parame (no CVSS)
- [CVE-2006-6538](https://cve.now/CVE-2006-6538.md): D-LINK DWL-2000AP+ firmware 2.11 allows remote attackers to cause (1) a denial of service (device reset) via a flood of ARP replies on the w (no CVSS)
- [CVE-2006-6539](https://cve.now/CVE-2006-6539.md): Multiple buffer overflows in Winamp Web Interface (Wawi) 7.5.13 and earlier (1) allow remote attackers to cause a denial of service (applica (no CVSS)
- [CVE-2006-6540](https://cve.now/CVE-2006-6540.md): SQL injection vulnerability in bt-trackback.php in Bluetrait before 1.2.0, when trackback is enabled, allows remote attackers to execute arb (no CVSS)
- [CVE-2006-6541](https://cve.now/CVE-2006-6541.md): PHP remote file inclusion vulnerability in signer/final.php in warez distributions of Animated Smiley Generator allows remote attackers to e (no CVSS)
- [CVE-2006-6542](https://cve.now/CVE-2006-6542.md): SQL injection vulnerability in news.php in Fantastic News 2.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2006-6543](https://cve.now/CVE-2006-6543.md): Multiple SQL injection vulnerabilities in login.asp in AppIntellect SpotLight CRM 1.0 allow remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2006-6544](https://cve.now/CVE-2006-6544.md): Cross-site scripting (XSS) vulnerability in CM68 News allows remote attackers to inject arbitrary web script or HTML via unspecified vectors (no CVSS)
- [CVE-2006-6545](https://cve.now/CVE-2006-6545.md): PHP remote file inclusion vulnerability in includes/common.php in the ErrorDocs 1.0.0 and earlier module for mxBB (mx\_errordocs) allows remo (no CVSS)
- [CVE-2006-6546](https://cve.now/CVE-2006-6546.md): PHP remote file inclusion vulnerability in inc/shows.inc.php in cutenews aj-fork (CN:AJ) 167f and earlier allows remote attackers to execute (no CVSS)
- [CVE-2006-6512](https://cve.now/CVE-2006-6512.md): Directory traversal vulnerability in the Browse function (/browse URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authe (no CVSS)
- [CVE-2006-6513](https://cve.now/CVE-2006-6513.md): The CControl::Download function (/dl URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to download ar (no CVSS)
- [CVE-2006-6514](https://cve.now/CVE-2006-6514.md): Winamp Web Interface (Wawi) 7.5.13 and earlier uses an insufficient comparison to determine whether a directory is located below the applica (no CVSS)
- [CVE-2006-6515](https://cve.now/CVE-2006-6515.md): Mantis before 1.1.0a2 sets the default value of $g\_bug\_reminder\_threshold to "reporter" instead of a more privileged role, which has unknown (no CVSS)
- [CVE-2006-6516](https://cve.now/CVE-2006-6516.md): Multiple PHP remote file inclusion vulnerabilities in KDPics 1.16 and earlier allow remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2006-6517](https://cve.now/CVE-2006-6517.md): Multiple cross-site scripting (XSS) vulnerabilities in KDPics 1.16 and earlier allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-6518](https://cve.now/CVE-2006-6518.md): Multiple cross-site scripting (XSS) vulnerabilities in ProNews 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS)
- [CVE-2006-6519](https://cve.now/CVE-2006-6519.md): SQL injection vulnerability in lire-avis.php in ProNews 1.5 allows remote attackers to execute arbitrary SQL commands via the aa parameter. (no CVSS)
- [CVE-2006-6520](https://cve.now/CVE-2006-6520.md): Multiple cross-site scripting (XSS) vulnerabilities in Messageriescripthp 2.0 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-6521](https://cve.now/CVE-2006-6521.md): SQL injection vulnerability in lire-avis.php in Messageriescripthp 2.0 allows remote attackers to execute arbitrary SQL commands via the aa (no CVSS)
- [CVE-2006-6522](https://cve.now/CVE-2006-6522.md): Multiple cross-site scripting (XSS) vulnerabilities in WikiTimeScale TwoZero before 2.31 allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2006-6523](https://cve.now/CVE-2006-6523.md): Cross-site scripting (XSS) vulnerability in mail/manage.html in BoxTrapper in cPanel 11 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2006-6524](https://cve.now/CVE-2006-6524.md): SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2006-6525](https://cve.now/CVE-2006-6525.md): SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2006-6526](https://cve.now/CVE-2006-6526.md): PHP remote file inclusion vulnerability in index.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code vi (no CVSS)
- [CVE-2006-6527](https://cve.now/CVE-2006-6527.md): PHP remote file inclusion vulnerability in guest.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code vi (no CVSS)
- [CVE-2006-6528](https://cve.now/CVE-2006-6528.md): The Chatroom Module before 4.7.x.-1.0 for Drupal broadcasts Chatroom visitors' session IDs to all participants, which allows remote attacker (no CVSS)
- [CVE-2006-6529](https://cve.now/CVE-2006-6529.md): The Chatroom Module before 4.7.x.-1.0 for Drupal displays private messages in a chatroom's last messages overview, which allows remote attac (no CVSS)
- [CVE-2006-6530](https://cve.now/CVE-2006-6530.md): SQL injection vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2006-6531](https://cve.now/CVE-2006-6531.md): Cross-site scripting (XSS) vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2006-6532](https://cve.now/CVE-2006-6532.md): Multiple cross-site scripting (XSS) vulnerabilities in Vt-Forum Lite 1.3 and earlier allow remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2006-6533](https://cve.now/CVE-2006-6533.md): Directory traversal vulnerability in admin/templates\_boxes\_layout.php in osCommerce 3.0a3 allows remote attackers to include and execute arb (no CVSS)
- [CVE-2006-6534](https://cve.now/CVE-2006-6534.md): Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 3.0a3 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2006-5648](https://cve.now/CVE-2006-5648.md): Ubuntu Linux 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (resource consumption) by using the (1) sys\_get\_robu (CVSS 5.5)
- [CVE-2006-5649](https://cve.now/CVE-2006-5649.md): Unspecified vulnerability in the "alignment check exception handling" in Ubuntu 5.10, 6.06 LTS, and 6.10 for the PowerPC (PPC) allows local (CVSS 5.5)
- [CVE-2006-5875](https://cve.now/CVE-2006-5875.md): eoc.py in Enemies of Carlotta (EoC) before 1.2.4 allows remote attackers to execute arbitrary commands via shell metacharacters in an "SMTP (no CVSS)
- [CVE-2006-6107](https://cve.now/CVE-2006-6107.md): Unspecified vulnerability in the match\_rule\_equal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match (no CVSS)
- [CVE-2006-6508](https://cve.now/CVE-2006-6508.md): Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.21 allows remote authenticated users to send unauthorized messages as an arbitr (no CVSS)
- [CVE-2006-6509](https://cve.now/CVE-2006-6509.md): Cross-site scripting (XSS) vulnerability in the skinning feature in SiteKiosk before 6.5.150 allows local users to bypass security protectio (no CVSS)
- [CVE-2006-6510](https://cve.now/CVE-2006-6510.md): An unspecified ActiveX control in SiteKiosk before 6.5.150 is installed "safe for scripting", which allows local users to bypass security pr (no CVSS)
- [CVE-2006-6511](https://cve.now/CVE-2006-6511.md): dadaIMC .99.3 uses an insufficiently restrictive FilesMatch directive in the installed .htaccess file, which allows remote attackers to exec (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-12-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.