# CVEs published 2006-12-21 29 CVEs were published on December 21, 2006: 0 critical, 0 high. Days are UTC. - [CVE-2006-6686](https://cve.now/CVE-2006-6686.md): PHP remote file inclusion vulnerability in sender.php in Carsen Klock TextSend 1.5 allows remote attackers to execute arbitrary PHP code via (no CVSS) - [CVE-2006-6687](https://cve.now/CVE-2006-6687.md): Cross-site scripting (XSS) vulnerability in Web Automated Perl Portal (WebAPP) 0.9.9.4, and 0.9.9.3.4 Network Edition (NE) (aka WebAPP.NET), (no CVSS) - [CVE-2006-6688](https://cve.now/CVE-2006-6688.md): Web Automated Perl Portal (WebAPP) 0.9.9.4, and 0.9.9.3.4 Network Edition (NE) (aka WebAPP.NET) allows remote attackers to bypass filtering (no CVSS) - [CVE-2006-6689](https://cve.now/CVE-2006-6689.md): Multiple PHP remote file inclusion vulnerabilities in Paristemi 0.8.3 and earlier allow remote attackers to execute arbitrary PHP code via a (no CVSS) - [CVE-2006-6690](https://cve.now/CVE-2006-6690.md): rtehtmlarea/pi1/class.tx\_rtehtmlarea\_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows r (no CVSS) - [CVE-2006-6691](https://cve.now/CVE-2006-6691.md): Multiple PHP remote file inclusion vulnerabilities in Valdersoft Shopping Cart 3.0 and earlier allow remote attackers to execute arbitrary P (no CVSS) - [CVE-2006-6692](https://cve.now/CVE-2006-6692.md): Multiple format string vulnerabilities in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possib (no CVSS) - [CVE-2006-6693](https://cve.now/CVE-2006-6693.md): Multiple buffer overflows in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute ar (no CVSS) - [CVE-2006-6694](https://cve.now/CVE-2006-6694.md): Directory traversal vulnerability in include/config.php in E-Uploader Pro 1.0 and earlier allows remote attackers to execute arbitrary PHP c (no CVSS) - [CVE-2006-6695](https://cve.now/CVE-2006-6695.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in Carsen Klock TextSend 1.5 allow remote attackers to inject arbitrary web (no CVSS) - [CVE-2002-2219](https://cve.now/CVE-2002-2219.md): chetcpasswd.cgi in Pedro Lineu Orso chetcpasswd before 2.1 allows remote attackers to read the last line of the shadow file via a long user (no CVSS) - [CVE-2002-2220](https://cve.now/CVE-2002-2220.md): Buffer overflow in Pedro Lineu Orso chetcpasswd before 1.12, when configured for access from 0.0.0.0, allows local users to gain privileges (no CVSS) - [CVE-2002-2221](https://cve.now/CVE-2002-2221.md): Untrusted search path vulnerability in Pedro Lineu Orso chetcpasswd 2.4.1 and earlier allows local users to gain privileges via a modified P (no CVSS) - [CVE-2006-6104](https://cve.now/CVE-2006-6104.md): The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote att (no CVSS) - [CVE-2006-6679](https://cve.now/CVE-2006-6679.md): Pedro Lineu Orso chetcpasswd before 2.4 relies on the X-Forwarded-For HTTP header when verifying a client's status on an IP address ACL, whi (no CVSS) - [CVE-2006-6680](https://cve.now/CVE-2006-6680.md): Pedro Lineu Orso chetcpasswd before 2.3.1 does not document the need for 0400 permissions on /etc/chetcpasswd.allow, which might allow local (no CVSS) - [CVE-2006-6681](https://cve.now/CVE-2006-6681.md): Pedro Lineu Orso chetcpasswd 2.3.3 does not have a rate limit for client requests, which might allow remote attackers to determine passwords (no CVSS) - [CVE-2006-6682](https://cve.now/CVE-2006-6682.md): Pedro Lineu Orso chetcpasswd 2.3.3 provides a different error message when a request with a valid username fails, compared to a request with (no CVSS) - [CVE-2006-6683](https://cve.now/CVE-2006-6683.md): Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that processes /etc/shadow and does not fo (no CVSS) - [CVE-2006-6684](https://cve.now/CVE-2006-6684.md): Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd before 2.4 allows remote attackers to cause a denial of service (application cras (no CVSS) - [CVE-2006-6685](https://cve.now/CVE-2006-6685.md): Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd 2.3.3 allows local users to cause a denial of service (application crash) and pos (no CVSS) - [CVE-2006-6671](https://cve.now/CVE-2006-6671.md): SQL injection vulnerability in down.asp in Burak Yylmaz Download Portal allows remote attackers to execute arbitrary SQL commands via the id (no CVSS) - [CVE-2006-6672](https://cve.now/CVE-2006-6672.md): Multiple SQL injection vulnerabilities in Burak Yylmaz Download Portal allow remote attackers to execute arbitrary SQL commands via the (1) (no CVSS) - [CVE-2006-6673](https://cve.now/CVE-2006-6673.md): WinFtp Server 2.0.2 allows remote attackers to cause a denial of service (crash) via long (1) PASV, (2) LIST, (3) USER, (4) PORT, and possib (no CVSS) - [CVE-2006-6674](https://cve.now/CVE-2006-6674.md): Ozeki HTTP-SMS Gateway 1.0, and possibly earlier, stores usernames and passwords in plaintext in the HKLM\\Software\\Ozeki\\SMSServer\\CurrentVe (no CVSS) - [CVE-2006-6675](https://cve.now/CVE-2006-6675.md): Cross-site scripting (XSS) vulnerability in Novell NetWare 6.5 Support Pack 5 and 6 and Novell Apache on NetWare 2.0.48 allows remote attack (no CVSS) - [CVE-2006-6676](https://cve.now/CVE-2006-6676.md): Integer overflow in the (a) OLE2 and (b) CHM parsers for ESET NOD32 Antivirus before 1.1743 allows remote attackers to execute arbitrary cod (no CVSS) - [CVE-2006-6677](https://cve.now/CVE-2006-6677.md): ESET NOD32 Antivirus before 1.1743 allows remote attackers to cause a denial of service (crash) via a crafted .CHM file that triggers a divi (no CVSS) - [CVE-2006-6678](https://cve.now/CVE-2006-6678.md): The edit\_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fi (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2006-12-21 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.