# CVEs published 2006-12-20

46 CVEs were published on December 20, 2006: 0 critical, 0 high. Days are UTC.

- [CVE-2006-6660](https://cve.now/CVE-2006-6660.md): The nodeType function in KDE libkhtml 4.2.0 and earlier, as used by Konquerer, KMail, and other programs, allows remote attackers to cause a (no CVSS)
- [CVE-2006-6661](https://cve.now/CVE-2006-6661.md): Variable overwrite vulnerability in blog.php in PHP-Update 2.7 and earlier allows remote attackers to overwrite arbitrary program variables (no CVSS)
- [CVE-2006-6662](https://cve.now/CVE-2006-6662.md): Unspecified vulnerability in Linux User Management (novell-lum) on SUSE Linux Enterprise Desktop 10 and Open Enterprise Server 9, under unsp (no CVSS)
- [CVE-2006-6663](https://cve.now/CVE-2006-6663.md): The server component in Marathon Aleph One before 0.17.1 and 2006-12-17 allows remote attackers to cause a denial of service (application cr (no CVSS)
- [CVE-2006-6664](https://cve.now/CVE-2006-6664.md): Format string vulnerability in Marathon Aleph One before 0.17.1 and 2006-12-17 might allow remote attackers to cause a denial of service (ap (no CVSS)
- [CVE-2006-6665](https://cve.now/CVE-2006-6665.md): Buffer overflow in Astonsoft DeepBurner Pro and Free 1.8.0 and earlier allows user-assisted remote attackers to execute arbitrary code via a (no CVSS)
- [CVE-2006-6666](https://cve.now/CVE-2006-6666.md): PHP remote file inclusion vulnerability in index.php in VerliAdmin 0.3 and earlier allows remote authenticated users to execute arbitrary PH (no CVSS)
- [CVE-2006-6667](https://cve.now/CVE-2006-6667.md): Multiple SQL injection vulnerabilities in VerliAdmin 0.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ni (no CVSS)
- [CVE-2006-6668](https://cve.now/CVE-2006-6668.md): Cross-site scripting (XSS) vulnerability in VerliAdmin 0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via un (no CVSS)
- [CVE-2006-6669](https://cve.now/CVE-2006-6669.md): Cross-site scripting (XSS) vulnerability in export\_handler.php in WebCalendar 1.0.4 and earlier allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2006-6670](https://cve.now/CVE-2006-6670.md): Unspecified vulnerability in Nortel CallPilot 4.x Server has unknown impact and attack vectors, aka P-2006-0011-GLOBAL. (no CVSS)
- [CVE-2006-4814](https://cve.now/CVE-2006-4814.md): The mincore function in the Linux kernel before 2.4.33.6 does not properly lock access to user space, which has unspecified impact and attac (no CVSS)
- [CVE-2006-5681](https://cve.now/CVE-2006-5681.md): QuickTime for Java on Mac OS X 10.4 through 10.4.8, when used with Quartz Composer, allows remote attackers to obtain sensitive information (no CVSS)
- [CVE-2006-6475](https://cve.now/CVE-2006-6475.md): FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode with SSL enabled, allows remote attackers to cause a deni (no CVSS)
- [CVE-2006-6476](https://cve.now/CVE-2006-6476.md): FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces), (no CVSS)
- [CVE-2006-6477](https://cve.now/CVE-2006-6477.md): FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and configured to use only HTTP, allows local users to mo (no CVSS)
- [CVE-2006-6642](https://cve.now/CVE-2006-6642.md): SQL injection vulnerability in haber.asp in Contra Haber Sistemi 1.0 allows remote attackers to execute arbitrary SQL commands via the id pa (no CVSS)
- [CVE-2006-6643](https://cve.now/CVE-2006-6643.md): Fightersoft Multimedia Star FTP server 1.10 allows remote attackers to cause a denial of service (crash) via multiple RETR commands with lon (no CVSS)
- [CVE-2006-6644](https://cve.now/CVE-2006-6644.md): PHP remote file inclusion vulnerability in pages/meeting\_constants.php in the Meeting (mx\_meeting) 1.1.2 and earlier module for mxBB allows (no CVSS)
- [CVE-2006-6645](https://cve.now/CVE-2006-6645.md): PHP remote file inclusion vulnerability in language/lang\_english/lang\_admin.php in the Web Links (mx\_links) 2.05 and earlier module for mxBB (no CVSS)
- [CVE-2006-6646](https://cve.now/CVE-2006-6646.md): Multiple cross-site scripting (XSS) vulnerabilities in Drupal (1) Project Issue Tracking 4.7.x-1.0 and 4.7.x-2.0, and (2) Project 4.6.x-1.0, (no CVSS)
- [CVE-2006-6647](https://cve.now/CVE-2006-6647.md): Cross-site scripting (XSS) vulnerability in the MySite 4.7.x before 4.7.x-3.3 and 5.x before 5.x-1.3 module for Drupal allows remote attacke (no CVSS)
- [CVE-2006-6648](https://cve.now/CVE-2006-6648.md): PHP remote file inclusion vulnerability in main.inc.php in planetluc.com RateMe 1.3.2 and earlier allows remote attackers to execute arbitra (no CVSS)
- [CVE-2006-6649](https://cve.now/CVE-2006-6649.md): Cross-site scripting (XSS) vulnerability in display.php in HyperVM 1.2 and earlier allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-6650](https://cve.now/CVE-2006-6650.md): PHP remote file inclusion vulnerability in charts\_constants.php in the Charts (mx\_charts) 1.0.0 and earlier module for mxBB allows remote at (no CVSS)
- [CVE-2006-6651](https://cve.now/CVE-2006-6651.md): Race condition in W29N51.SYS in the Intel 2200BG wireless driver 9.0.3.9 allows remote attackers to cause memory corruption and execute arbi (no CVSS)
- [CVE-2006-6652](https://cve.now/CVE-2006-6652.md): Buffer overflow in the glob implementation (glob.c) in libc in NetBSD-current before 20050914, NetBSD 2.\* and 3.\* before 20061203, and Apple (no CVSS)
- [CVE-2006-6653](https://cve.now/CVE-2006-6653.md): The accept function in NetBSD-current before 20061023, NetBSD 3.0 and 3.0.1 before 20061024, and NetBSD 2.x before 20061029 allows local use (no CVSS)
- [CVE-2006-6654](https://cve.now/CVE-2006-6654.md): The sendmsg function in NetBSD-current before 20061023, NetBSD 3.0 and 3.0.1 before 20061024, and NetBSD 2.x before 20061029, when run on a (no CVSS)
- [CVE-2006-6655](https://cve.now/CVE-2006-6655.md): The procfs implementation in NetBSD-current before 20061023, NetBSD 3.0 and 3.0.1 before 20061024, and NetBSD 2.x before 20061029 allows loc (no CVSS)
- [CVE-2006-6656](https://cve.now/CVE-2006-6656.md): Unspecified vulnerability in ptrace in NetBSD-current before 20061027, NetBSD 3.0 and 3.0.1 before 20061027, and NetBSD 2.x before 20061119 (no CVSS)
- [CVE-2006-6657](https://cve.now/CVE-2006-6657.md): The if\_clone\_list function in NetBSD-current before 20061027, NetBSD 3.0 and 3.0.1 before 20061027, and NetBSD 2.x before 20061119 allows lo (no CVSS)
- [CVE-2006-6658](https://cve.now/CVE-2006-6658.md): Inktomi Search 4.1.4 allows remote attackers to obtain sensitive information via direct requests with missing parameters to (1) help/header. (no CVSS)
- [CVE-2006-6659](https://cve.now/CVE-2006-6659.md): The Microsoft Office Outlook Recipient ActiveX control (ole32.dll) in Windows XP SP2 allows remote attackers to cause a denial of service (I (no CVSS)
- [CVE-2006-6497](https://cve.now/CVE-2006-6497.md): Multiple unspecified vulnerabilities in the layout engine for Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1 (no CVSS)
- [CVE-2006-6498](https://cve.now/CVE-2006-6498.md): Multiple unspecified vulnerabilities in the JavaScript engine for Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird befo (no CVSS)
- [CVE-2006-6499](https://cve.now/CVE-2006-6499.md): The js\_dtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 ove (no CVSS)
- [CVE-2006-6500](https://cve.now/CVE-2006-6500.md): Heap-based buffer overflow in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0 (no CVSS)
- [CVE-2006-6501](https://cve.now/CVE-2006-6501.md): Unspecified vulnerability in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0. (no CVSS)
- [CVE-2006-6502](https://cve.now/CVE-2006-6502.md): Use-after-free vulnerability in the LiveConnect bridge code for Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before (no CVSS)
- [CVE-2006-6503](https://cve.now/CVE-2006-6503.md): Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to (no CVSS)
- [CVE-2006-6504](https://cve.now/CVE-2006-6504.md): Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by ap (no CVSS)
- [CVE-2006-6505](https://cve.now/CVE-2006-6505.md): Multiple heap-based buffer overflows in Mozilla Thunderbird before 1.5.0.9 and SeaMonkey before 1.0.7 allow remote attackers to execute arbi (no CVSS)
- [CVE-2006-6506](https://cve.now/CVE-2006-6506.md): The "Feed Preview" feature in Mozilla Firefox 2.0 before 2.0.0.1 sends the URL of the feed when requesting favicon.ico icons, which results (no CVSS)
- [CVE-2006-6507](https://cve.now/CVE-2006-6507.md): Mozilla Firefox 2.0 before 2.0.0.1 allows remote attackers to bypass Cross-Site Scripting (XSS) protection via vectors related to a Function (no CVSS)
- [CVE-2006-6641](https://cve.now/CVE-2006-6641.md): Unspecified vulnerability in CA CleverPath Portal before maintenance version 4.71.001\_179\_060830, as used in multiple products including Bri (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2006-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.