# CVEs published 2006-12-23 25 CVEs were published on December 23, 2006: 0 critical, 0 high. Days are UTC. - [CVE-2005-4816](https://cve.now/CVE-2005-4816.md): Buffer overflow in mod\_radius in ProFTPD before 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and possibly execute a (no CVSS) - [CVE-2006-6716](https://cve.now/CVE-2006-6716.md): SQL injection vulnerability in administration/administre2.php in Eric GUILLAUME uploader&downloader 3 allows remote attackers to execute arb (no CVSS) - [CVE-2006-6717](https://cve.now/CVE-2006-6717.md): The Allied Telesis AT-9000/24 Ethernet switch accepts management packets from arbitrary VLANs, contrary to the documentation, which allows r (no CVSS) - [CVE-2006-6718](https://cve.now/CVE-2006-6718.md): The Allied Telesis AT-9000/24 Ethernet switch has a default password for its admin account, "manager," which allows remote attackers to perf (no CVSS) - [CVE-2006-6719](https://cve.now/CVE-2006-6719.md): The ftp\_syst function in ftp-basic.c in Free Software Foundation (FSF) GNU wget 1.10.2 allows remote attackers to cause a denial of service (no CVSS) - [CVE-2006-6720](https://cve.now/CVE-2006-6720.md): PHP remote file inclusion vulnerability in admin/index\_sitios.php in Azucar CMS 1.3 allows remote attackers to execute arbitrary PHP code vi (no CVSS) - [CVE-2006-6721](https://cve.now/CVE-2006-6721.md): Multiple cross-site scripting (XSS) vulnerabilities in shout.php in Knusperleicht ShoutBox 2.6 allow remote attackers to inject arbitrary we (no CVSS) - [CVE-2006-6722](https://cve.now/CVE-2006-6722.md): Bandwebsite (aka Bandsite portal system) 1.5 allows remote attackers to create administrative accounts via a direct request to admin.php wit (no CVSS) - [CVE-2006-6699](https://cve.now/CVE-2006-6699.md): Multiple CRLF injection vulnerabilities in Oracle Portal 9.0.2 and possibly other versions allow remote attackers to inject arbitrary HTTP h (no CVSS) - [CVE-2006-6700](https://cve.now/CVE-2006-6700.md): Cross-site scripting (XSS) vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vec (no CVSS) - [CVE-2006-6701](https://cve.now/CVE-2006-6701.md): Cross-site request forgery (CSRF) vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers t (no CVSS) - [CVE-2006-6702](https://cve.now/CVE-2006-6702.md): Cross-site scripting (XSS) vulnerability in Global.pm in @Mail before 4.61 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS) - [CVE-2006-6703](https://cve.now/CVE-2006-6703.md): Multiple cross-site scripting (XSS) vulnerabilities in Oracle Portal 9i and 10g allow remote attackers to inject arbitrary JavaScript via th (no CVSS) - [CVE-2006-6704](https://cve.now/CVE-2006-6704.md): Cross-site scripting (XSS) vulnerability in the Webadmin in @Mail before 4.6 allows remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2006-6705](https://cve.now/CVE-2006-6705.md): Multiple unspecified vulnerabilities in the template files in Soumu Workflow for Groupmax 01-00 through 01-01, Soumu Workflow 02-00 through (no CVSS) - [CVE-2006-6706](https://cve.now/CVE-2006-6706.md): SQL injection vulnerability in Soumu Workflow for Groupmax 01-00 through 01-01, Soumu Workflow 02-00 through 03-03, and Koukyoumuke Soumu Wo (no CVSS) - [CVE-2006-6707](https://cve.now/CVE-2006-6707.md): Stack-based buffer overflow in the NeoTraceExplorer.NeoTraceLoader ActiveX control (NeoTraceExplorer.dll) in NeoTrace Express 3.25 and NeoTr (no CVSS) - [CVE-2006-6708](https://cve.now/CVE-2006-6708.md): Cross-site scripting (XSS) vulnerability in listings.asp in MGinternet Property Site Manager allows remote attackers to inject arbitrary web (no CVSS) - [CVE-2006-6709](https://cve.now/CVE-2006-6709.md): Multiple SQL injection vulnerabilities in MGinternet Property Site Manager allow remote attackers to execute arbitrary SQL commands via the (no CVSS) - [CVE-2006-6710](https://cve.now/CVE-2006-6710.md): Multiple PHP remote file inclusion vulnerabilities in PgmReloaded 0.8.5 and earlier allow remote attackers to execute arbitrary PHP code via (no CVSS) - [CVE-2006-6711](https://cve.now/CVE-2006-6711.md): PHP remote file inclusion vulnerability in compteur/mapage.php in Newxooper 0.9.1 allows remote attackers to execute arbitrary PHP code via (no CVSS) - [CVE-2006-6712](https://cve.now/CVE-2006-6712.md): Cross-site scripting (XSS) vulnerability in SugarCRM Open Source 4.5.0f and earlier allows remote attackers to inject arbitrary web script o (no CVSS) - [CVE-2006-6713](https://cve.now/CVE-2006-6713.md): Buffer overflow in Hitachi Directory Server 2 P-2444-A124 before 02-11-/K on Windows, and P-1B44-A121 before 02-10-/V on HP-UX, allows remot (no CVSS) - [CVE-2006-6714](https://cve.now/CVE-2006-6714.md): Multiple memory leaks in Hitachi Directory Server 2 P-2444-A124 before 02-11-/K on Windows, and P-1B44-A121 before 02-10-/V on HP-UX, allow (no CVSS) - [CVE-2006-6715](https://cve.now/CVE-2006-6715.md): PHP remote file inclusion vulnerability in footer.inc.php in PowerClan 1.14a and earlier, when register\_globals is enabled, allows remote at (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2006-12-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.