# CVEs published 2006-12-15

46 CVEs were published on December 15, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-6596](https://cve.now/CVE-2006-6596.md): HyperAccess 8.4 allows user-assisted remote attackers to execute arbitrary vbscript and commands via a session (HAW) file, which can be auto (no CVSS)
- [CVE-2006-6597](https://cve.now/CVE-2006-6597.md): Argument injection vulnerability in HyperAccess 8.4 allows user-assisted remote attackers to execute arbitrary vbscript and commands via the (no CVSS)
- [CVE-2006-6598](https://cve.now/CVE-2006-6598.md): Directory traversal vulnerability in viewnfo.php in (1) TorrentFlux before 2.2 and (2) torrentflux-b4rt before 2.1-b4rt-972 allows remote au (no CVSS)
- [CVE-2006-6599](https://cve.now/CVE-2006-6599.md): maketorrent.php in TorrentFlux 2.2 allows remote authenticated users to execute arbitrary commands via shell metacharacters (";" semicolon) (no CVSS)
- [CVE-2006-6600](https://cve.now/CVE-2006-6600.md): Cross-site scripting (XSS) vulnerability in dir.php in TorrentFlux 2.2, when allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-6601](https://cve.now/CVE-2006-6601.md): Windows Media Player 10.00.00.4036 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service via a .MID (no CVSS)
- [CVE-2006-6602](https://cve.now/CVE-2006-6602.md): explorer.exe in Windows Explorer 6.00.2900.2180 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of servi (no CVSS)
- [CVE-2006-6603](https://cve.now/CVE-2006-6603.md): Buffer overflow in the YMMAPI.YMailAttach ActiveX control (ymmapi.dll) before 2005.1.1.4 in Yahoo! Messenger allows remote attackers to exec (no CVSS)
- [CVE-2006-6604](https://cve.now/CVE-2006-6604.md): Directory traversal vulnerability in downloaddetails.php in TorrentFlux 2.2 allows remote authenticated users to read arbitrary files via .. (no CVSS)
- [CVE-2003-1311](https://cve.now/CVE-2003-1311.md): siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder does not ensure that the TARGET parameter names a valid redirection resource, which (no CVSS)
- [CVE-2003-1312](https://cve.now/CVE-2003-1312.md): siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder places a session ID string in the value of the SMSESSION parameter in a URL, which (no CVSS)
- [CVE-2004-2666](https://cve.now/CVE-2004-2666.md): Mantis before 20041016 provides a complete Issue History (Bug History) in the web interface regardless of view\_history\_threshold, which allo (no CVSS)
- [CVE-2006-6574](https://cve.now/CVE-2006-6574.md): Mantis before 1.1.0a2 does not implement per-item access control for Issue History (Bug History), which allows remote attackers to obtain se (no CVSS)
- [CVE-2006-6575](https://cve.now/CVE-2006-6575.md): PHP remote file inclusion vulnerability in ldap.php in Brian Drawert Yet Another PHP LDAP Admin Project (yaplap) 0.6 and 0.6.1 allows remote (no CVSS)
- [CVE-2006-6576](https://cve.now/CVE-2006-6576.md): Heap-based buffer overflow in Golden FTP Server (goldenftpd) 1.92 allows remote attackers to cause a denial of service (application crash) a (no CVSS)
- [CVE-2006-6577](https://cve.now/CVE-2006-6577.md): SQL injection vulnerability in polls.php in Neocrome Land Down Under (LDU) 8.x and earlier allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2006-6578](https://cve.now/CVE-2006-6578.md): Microsoft Internet Information Services (IIS) 5.1 permits the IUSR\_Machine account to execute non-EXE files such as .COM files, which allows (no CVSS)
- [CVE-2006-6579](https://cve.now/CVE-2006-6579.md): Microsoft Windows XP has weak permissions (FILE\_WRITE\_DATA and FILE\_READ\_DATA for Everyone) for %WINDIR%\\pchealth\\ERRORREP\\QHEADLES, which a (no CVSS)
- [CVE-2006-6580](https://cve.now/CVE-2006-6580.md): admin/change.php in ProNews 1.5 does not check whether a user is permitted to change news items, which allows remote attackers to add or del (no CVSS)
- [CVE-2006-6581](https://cve.now/CVE-2006-6581.md): PHP remote file inclusion vulnerability in tests/debug\_test.php in Vernet Loic PHP\_Debug 1.1.0 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2006-6582](https://cve.now/CVE-2006-6582.md): Multiple cross-site scripting (XSS) vulnerabilities in ScriptMate User Manager 2.1 and earlier allow remote attackers to inject arbitrary we (no CVSS)
- [CVE-2006-6583](https://cve.now/CVE-2006-6583.md): ScriptMate User Manager 2.1 and earlier allow remote attackers to obtain sensitive information via unspecified vectors related to (1) the Lo (no CVSS)
- [CVE-2006-6584](https://cve.now/CVE-2006-6584.md): Multiple buffer overflows in italkplus (Italk+) before 0.92.1 allow remote attackers to cause a denial of service (application crash) and po (no CVSS)
- [CVE-2006-6585](https://cve.now/CVE-2006-6585.md): The Extensions manager in Mozilla Firefox 2.0 does not properly populate the list of local extensions, which allows attackers to construct a (no CVSS)
- [CVE-2006-6586](https://cve.now/CVE-2006-6586.md): Multiple PHP remote file inclusion vulnerabilities in Vortex Blog (vBlog, aka C12) a0.1\_nonfunc allow remote attackers to execute arbitrary (no CVSS)
- [CVE-2006-6587](https://cve.now/CVE-2006-6587.md): Cross-site scripting (XSS) vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project (OFB (no CVSS)
- [CVE-2006-6588](https://cve.now/CVE-2006-6588.md): The forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) trusts the (1) dataResourceTypeId, (2) c (no CVSS)
- [CVE-2006-6589](https://cve.now/CVE-2006-6589.md): Cross-site scripting (XSS) vulnerability in ecommerce/control/keywordsearch in the Apache Open For Business Project (OFBiz) and Opentaps 0.9 (no CVSS)
- [CVE-2006-6590](https://cve.now/CVE-2006-6590.md): PHP remote file inclusion vulnerability in usercp\_menu.php in AR Memberscript allows remote attackers to execute arbitrary PHP code via a UR (no CVSS)
- [CVE-2006-6591](https://cve.now/CVE-2006-6591.md): PHP remote file inclusion vulnerability in fonctions/template.php in EXlor 1.0 allows remote attackers to execute arbitrary PHP code via a U (no CVSS)
- [CVE-2006-6592](https://cve.now/CVE-2006-6592.md): Multiple PHP remote file inclusion vulnerabilities in Bloq 0.5.4 allow remote attackers to execute arbitrary PHP code via a URL in the page\[ (no CVSS)
- [CVE-2006-6593](https://cve.now/CVE-2006-6593.md): PHP remote file inclusion vulnerability in zufallscodepart.php in AMAZONIA MOD for phpBB allows remote attackers to execute arbitrary PHP co (no CVSS)
- [CVE-2006-6594](https://cve.now/CVE-2006-6594.md): SQL injection vulnerability in utilities/usermessages.asp in ScriptMate User Manager 2.0 allows remote attackers to execute arbitrary SQL co (no CVSS)
- [CVE-2006-6595](https://cve.now/CVE-2006-6595.md): Multiple SQL injection vulnerabilities in ScriptMate User Manager 2.1 and earlier allow remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2006-6563](https://cve.now/CVE-2006-6563.md): Stack-based buffer overflow in the pr\_ctrls\_recv\_request function in ctrls.c in the mod\_ctrls module in ProFTPD before 1.3.1rc1 allows local (no CVSS)
- [CVE-2006-6564](https://cve.now/CVE-2006-6564.md): FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a malformed argument to the STOR command, wh (no CVSS)
- [CVE-2006-6565](https://cve.now/CVE-2006-6565.md): FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to the (1) LIST or (2) N (no CVSS)
- [CVE-2006-6566](https://cve.now/CVE-2006-6566.md): PHP remote file inclusion vulnerability in includes/profilcp\_constants.php in the Profile Control Panel (CPanel) module for mxBB 0.91c allow (no CVSS)
- [CVE-2006-6567](https://cve.now/CVE-2006-6567.md): PHP remote file inclusion vulnerability in includes/kb\_constants.php in the Knowledge Base (mx\_kb) 2.0.2 module for mxBB allows remote attac (no CVSS)
- [CVE-2006-6568](https://cve.now/CVE-2006-6568.md): Directory traversal vulnerability in includes/kb\_constants.php in the Knowledge Base (mx\_kb) 2.0.2 module for mxBB allows remote attackers t (no CVSS)
- [CVE-2006-6569](https://cve.now/CVE-2006-6569.md): form.php in GenesisTrader 1.0 allows remote attackers to read source code for arbitrary files and obtain sensitive information via the (1) d (no CVSS)
- [CVE-2006-6570](https://cve.now/CVE-2006-6570.md): Unrestricted file upload vulnerability in upload.php in GenesisTrader 1.0 allows remote authenticated users to upload arbitrary files via un (no CVSS)
- [CVE-2006-6571](https://cve.now/CVE-2006-6571.md): Multiple cross-site scripting (XSS) vulnerabilities in form.php in GenesisTrader 1.0 allow remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2006-6572](https://cve.now/CVE-2006-6572.md): Unspecified vulnerability in Citrix Advanced Access Control (AAC) Option 4.0, and Access Gateway 4.2 with Advanced Access Control 4.2, befor (no CVSS)
- [CVE-2006-6573](https://cve.now/CVE-2006-6573.md): Unspecified vulnerability in Citrix Access Gateway 4.5 Advanced Edition, and 4.2 with Advanced Access Control (AAC) 4.2, when deployed on th (no CVSS)
- [CVE-2006-6105](https://cve.now/CVE-2006-6105.md): Format string vulnerability in the host chooser window (gdmchooser) in GNOME Foundation Display Manager (gdm) allows local users to execute (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-12-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.