Primary Vendor -- Product | Description | | CVSS Score | Source & Patch Info | 2X -- ThinClientServer
| 2X ThinClientServer Enterprise Edition before 4.0.2248 allows remote attackers to create multiple privileged accounts via a replay attack using the initial account creation request. | | 7.0 | CVE-2006-6221 BUGTRAQ OTHER-REF BID FRSIRT SECUNIA SECTRACK XF
| Adobe -- ColdFusion
| Adobe ColdFusion MX7 does not properly filter HTML tags when protecting against cross-site scripting (XSS) attacks, which allows remote attackers to inject arbitrary web script or HTML via a NULL byte (%00) in certain HTML tags, as demonstrated using "%00script" in a tag. | | 7.0 | CVE-2006-6483 BUGTRAQ FRSIRT SECTRACK SECUNIA
| AOL -- AOL Client Software
| Stack-based buffer overflow in the SetClientInfo function in the CDDBControlAOL.CDDBAOLControl ActiveX control (cddbcontrol.dll), as used in America Online (AOL) 7.0 4114.563, 8.0 4129.230, and 9.0 Security Edition 4156.910, and possibly other products, allows remote attackers to execute arbitrary code via a long ClientId argument. | | 7.0 | CVE-2006-6442 OTHER-REF BID FRSIRT SECUNIA BUGTRAQ FULLDISC MLIST SECTRACK XF
| AppIntellect -- SpotLight CRM
| Multiple SQL injection vulnerabilities in login.asp in AppIntellect SpotLight CRM 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) login (UserName) and possibly (2) password parameter. NOTE: some of these details are obtained from third party information. | | 10.0 | CVE-2006-6543 OTHER-REF FRSIRT
| CM68 News -- CM68 News
| PHP remote file inclusion vulnerability in engine/oldnews.inc.php in CM68 News 12.02.06 allows remote attackers to execute arbitrary PHP code via a URL in the addpath parameter. | | 10.0 | CVE-2006-6462 BID OTHER-REF OTHER-REF FRSIRT SECUNIA XF
| CM68 News -- CM68 News
| Cross-site scripting (XSS) vulnerability in CM68 News allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. | | 10.0 | CVE-2006-6544 OTHER-REF FRSIRT
| cPanel -- cPanel
| Cross-site scripting (XSS) vulnerability in mail/manage.html in BoxTrapper in cPanel 11 allows remote attackers to inject arbitrary web script or HTML via the account parameter. | | 7.0 | CVE-2006-6523 BUGTRAQ OTHER-REF BID XF
| Cutenews Aj-fork -- Cutenews Aj-fork
| PHP remote file inclusion vulnerability in inc/shows.inc.php in cutenews aj-fork (CN:AJ) 167f and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter. | | 10.0 | CVE-2006-6546 OTHER-REF BID FRSIRT XF
| Drupal -- Chatroom Module
| The Chatroom Module before 4.7.x.-1.0 for Drupal broadcasts Chatroom visitors' session IDs to all participants, which allows remote attackers to hijack sessions and gain privileges. | | 7.0 | CVE-2006-6528 OTHER-REF SECUNIA
| Drupal -- Chatroom Module
| The Chatroom Module before 4.7.x.-1.0 for Drupal displays private messages in a chatroom's last messages overview, which allows remote attackers to obtain sensitive information by reading the overview. | | 7.0 | CVE-2006-6529 DRUPAL SECUNIA
| Drupal -- Help Tip Module
| SQL injection vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | | 7.0 | CVE-2006-6530 DRUPAL SECUNIA
| Drupal -- Help Tip Module
| Cross-site scripting (XSS) vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to inject arbitrary web script or HTML, and possibly obtain administrative access, via node titles. | | 7.0 | CVE-2006-6531 DRUPAL SECUNIA
| EasyFill -- EasyFill
| Multiple SQL injection vulnerabilities in EasyFill before 0.5.1 allow remote attackers to execute arbitrary SQL commands via unspecified vectors. | | 10.0 | CVE-2006-6555 OTHER-REF FRSIRT
| EasyPage -- EasyPage
| SQL injection vulnerability in EasyPage allows remote attackers to execute arbitrary SQL commands via unspecified vectors in sptrees/default.aspx, possibly involving the docId parameter. NOTE: this issue appears to have been disputed by a third party researcher, stating that SQL injection is not possible. However, insufficient details were provided to evaluate the dispute. | | 7.0 | CVE-2006-6486 BUGTRAQ BUGTRAQ XF
| EyeOS -- EyeOS
| The eyeHome function in apps/eyeHome.eyeapp/aplic.php in EyeOS before 0.9.3-3 allows remote attackers to upload and execute arbitrary code via dangerous file extensions that are not all lowercase, which bypasses a cleansing operation. | | 10.0 | CVE-2006-6556 OTHER-REF OTHER-REF FRSIRT XF
| EzHRS -- HR Assist
| SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the Uname (UserName) parameter. | | 7.0 | CVE-2006-6524 Milw0rm FRSIRT SECUNIA
| EzHRS -- HR Assist
| SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. | | 7.0 | CVE-2006-6525 SECUNIA
| Fantastic News -- Fantastic News
| SQL injection vulnerability in news.php in Fantastic News 2.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. | | 10.0 | CVE-2006-6542 OTHER-REF FRSIRT
| Flippet.org -- Winamp Web Interface
| Multiple buffer overflows in Winamp Web Interface (Wawi) 7.5.13 and earlier (1) allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an (a) long username or a (b) crafted packet to the FindBasicAuth function in security.cpp, related to the /browse URI; and allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a long path string in the (2) Browse, (3) CControl::Download, and (4) CControl::Load functions, related to the file parameter in the /dl URI. NOTE: some of these details are obtained from third party information. | | 10.0 | CVE-2006-6539 FULLDISC FRSIRT SECUNIA OTHER-REF SECTRACK XF
| GenesisTrader -- GenesisTrader
| Unrestricted file upload vulnerability in upload.php in GenesisTrader 1.0 allows remote authenticated users to upload arbitrary files via unspecified vectors, possibly involving form.php and the ajoutfich "foap" action. | | 8.0 | CVE-2006-6570 BUGTRAQ
| GenesisTrader -- GenesisTrader
| Multiple cross-site scripting (XSS) vulnerabilities in form.php in GenesisTrader 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cuve, (2) chem, (3) do, and possibly other parameters. | | 10.0 | CVE-2006-6571 BUGTRAQ
| Gizzar -- Gizzar
| PHP remote file inclusion vulnerability in index.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter. | | 7.0 | CVE-2006-6526 OTHER-REF FRSIRT
| Gizzar -- Gizzar
| PHP remote file inclusion vulnerability in guest.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. | | 7.0 | CVE-2006-6527 FRSIRT
| IBM -- WebSphere Host On-Demand
| IBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html. | | 7.0 | CVE-2006-6537 BUGTRAQ SECUNIA
| Justsystem -- Ichitaro viewer Justsystem -- Ichitaro Justsystem -- Ichitaro Lite2 Justsystem -- Sanshiro Justsystem -- Hanako viewer Justsystem -- Hanako
| Buffer overflow in JustSystems Hanako 2004 through 2006, Hanako viewer 1.x, Ichitaro 2004, Ichitaro 2005, Ichitaro Lite2, Ichitaro viewer 4.x, and Sanshiro 2005 allows remote attackers to execute arbitrary code via the (1) Keyword and (2) Title fields, related to string length fields. | | 7.0 | CVE-2006-6400 OTHER-REF OTHER-REF OTHER-REF BID FRSIRT SECTRACK SECUNIA
| KDPics -- KDPics
| Multiple PHP remote file inclusion vulnerabilities in KDPics 1.16 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) page parameter to (a) index.php3, or the (2) lib_path parameter to (b) authenticate.inc.php3 or (c) lib/exifer/exif.php. | | 7.0 | CVE-2006-6516 BUGTRAQ BID FRSIRT SECUNIA
| Lotfian -- Request For Travel
| SQL injection vulnerability in ProductDetails.asp in Lotfian Request For Travel 1.0 allows remote attackers to execute arbitrary SQL commands via the PID parameter. | | 10.0 | CVE-2006-6559 OTHER-REF FRSIRT
| MailEnable -- MailEnable Enterprise MailEnable -- MailEnable Professional
| Stack-based buffer overflow in the IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.35, Professional Edition 1.6 through 1.84, and Enterprise Edition 1.1 through 1.41 allows remote attackers to execute arbitrary code via a pre-authentication command followed by a crafted parameter and a long string, as addressed by the ME-10025 hotfix. | | 10.0 | CVE-2006-6423 OTHER-REF OTHER-REF XF BUGTRAQ BID SECUNIA
| Mantis -- Mantis
| Mantis before 1.1.0a2 sets the default value of $g_bug_reminder_threshold to "reporter" instead of a more privileged role, which has unknown impact and attack vectors, possibly related to frequency of reminders. | | 7.0 | CVE-2006-6515 OTHER-REF OTHER-REF
| McAfee -- VirusScan
| Untrusted search path vulnerability in McAfee VirusScan for Linux 4510e and earlier includes the current working directory in the DT_RPATH environment variable, which allows local users to load arbitrary ELF DSO libraries and execute arbitrary code by installing malicious libraries in that directory. | | 7.0 | CVE-2006-6474 GENTOO BID
| Microsoft -- Internet Explorer
| Microsoft Internet Explorer 6 and earlier allows remote attackers to read Temporary Internet Files (TIF) and obtain sensitive information via unspecified vectors involving certain drag and drop operations, aka "TIF Folder Information Disclosure Vulnerability," and a different issue than CVE-2006-5577. | | 7.0 | CVE-2006-5578 MS FRSIRT SECTRACK SECUNIA
| Microsoft -- Internet Explorer
| Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code by using JavaScript to cause certain errors simultaneously, which results in the access of previously freed memory, aka "Script Error Handling Memory Corruption Vulnerability." | | 7.0 | CVE-2006-5579 MS BUGTRAQ OTHER-REF CERT-VN FRSIRT SECTRACK SECUNIA
| Microsoft -- Internet Explorer
| Unspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via certain DHTML script functions, such as normalize, and "incorrectly created elements" that trigger memory corruption, aka "DHTML Script Function Memory Corruption Vulnerability." | | 10.0 | CVE-2006-5581 MS OTHER-REF BUGTRAQ CERT-VN FRSIRT SECTRACK SECUNIA
| Microsoft -- Windows Server 2003
| Buffer overflow in the SNMP Service in Microsoft Windows 2000 SP4, XP SP2, Server 2003, Server 2003 SP1, and possibly other versions allows remote attackers to execute arbitrary code via a crafted SNMP packet, aka "SNMP Memory Corruption Vulnerability." | | 10.0 | CVE-2006-5583 MS FRSIRT SECTRACK SECUNIA
| Microsoft -- Windows 2000
| The Remote Installation Service (RIS) in Microsoft Windows 2000 SP4 uses a TFTP server that allows anonymous access, which allows remote attackers to upload and overwrite arbitrary files to gain privileges on systems that use RIS. | | 7.0 | CVE-2006-5584 MS FRSIRT SECTRACK SECUNIA
| Microsoft -- Word
| Unspecified vulnerability in Microsoft Word allows user-assisted remote attackers to execute arbitrary code via a crafted DOC file that triggers memory corruption, as demonstrated via the 12122006-djtest.doc file, a different issue than CVE-2006-5994 and CVE-2006-6456. | | 8.0 | CVE-2006-6561 BUGTRAQ OTHER-REF OTHER-REF OTHER-REF CERT-VN BID FRSIRT OTHER-REF
| mxBB -- mxBB NewsSuite
| PHP remote file inclusion vulnerability in includes/newssuite_constants.php in the NewsSuite 1.03 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the mx_root_path parameter. | | 10.0 | CVE-2006-6553 OTHER-REF FRSIRT SECUNIA
| MxBB -- ModSDB
| PHP remote file inclusion vulnerability in includes/common.php in the mx_modsdb 1.0.0 module for MxBB (aka MX-System) Portal allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter. | | 10.0 | CVE-2006-6560 OTHER-REF FRSIRT SECUNIA XF
| mxBB -- mxBB
| PHP remote file inclusion vulnerability in includes/profilcp_constants.php in the Profile Control Panel (CPanel) module for mxBB 0.91c allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter. | | 7.0 | CVE-2006-6566 OTHER-REF OTHER-REF MLIST MLIST FRSIRT XF
| MxBB -- kb_mods
| PHP remote file inclusion vulnerability in includes/kb_constants.php in the Knowledge Base (mx_kb) 2.0.2 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter. | | 10.0 | CVE-2006-6567 OTHER-REF BID FRSIRT SECUNIA XF
| MxBB -- kb_mods
| Directory traversal vulnerability in includes/kb_constants.php in the Knowledge Base (mx_kb) 2.0.2 module for mxBB allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the phpEx parameter. | | 10.0 | CVE-2006-6568 OTHER-REF BID SECUNIA XF
| MyStats -- MyStats
| Multiple cross-site scripting (XSS) vulnerabilities in mystats.php in MyStats 1.0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) connexion, (2) by, and (3) details parameter. | | 7.0 | CVE-2006-6401 BUGTRAQ FRSIRT OSVDB SECTRACK SECUNIA
| MyStats -- MyStats
| SQL injection vulnerability in mystats.php in MyStats 1.0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the details parameter. | | 7.0 | CVE-2006-6402 BUGTRAQ FRSIRT OSVDB SECTRACK SECUNIA
| osCommerce -- osCommerce
| Directory traversal vulnerability in admin/templates_boxes_layout.php in osCommerce 3.0a3 allows remote attackers to include and execute arbitrary PHP files via a .. (dot dot) in the filter parameter. NOTE: this issue can be leveraged to obtain full path information in error messages. | | 7.0 | CVE-2006-6533 OTHER-REF BID FRSIRT SECTRACK XF
| PHP -- Animated Smiley Generator
| PHP remote file inclusion vulnerability in signer/final.php in Animated Smiley Generator allows remote attackers to execute arbitrary PHP code via a URL in the smiley parameter. | | 10.0 | CVE-2006-6541 BUGTRAQ XF
| PHP -- ErrorDocs
| PHP remote file inclusion vulnerability in includes/common.php in the ErrorDocs 1.0.0 and earlier module for mxBB (mx_errordocs) allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter. | | 10.0 | CVE-2006-6545 OTHER-REF FRSIRT SECUNIA XF
| PHP -- Phorum
| ** DISPUTED ** PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the db_file parameter. NOTE: CVE disputes this vulnerability because db_file is defined before use. | | 10.0 | CVE-2006-6550 OTHER-REF XF
| PHP -- Blog:CMS
| PHP remote file inclusion vulnerability in admin/plugins/NP_UserSharing.php in BLOG:CMS 4.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DIR_ADMIN parameter. | | 10.0 | CVE-2006-6552 BUGTRAQ OTHER-REF SECUNIA SECTRACK XF
| Rad Inks -- Rad Upload
| ** DISPUTED ** PHP remote file inclusion vulnerability in upload.php in Rad Upload 3.02 allows remote attackers to execute arbitrary PHP code via a URL in the save_path parameter. NOTE: CVE disputes this vulnerability because save_path is originally defined as "" before use, and the nearby instructions say "SET THE SAVE PATH by editing the line below." | | 7.0 | CVE-2006-6549 BUGTRAQ
| SCRIPTPHP -- AnnonceScriptHP
| Multiple SQL injection vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a) email.php, the (2) no parameter in (b) voirannonce.php, the (3) idmembre parameter in (c) admin/admin_membre/fiche_membre.php, and the (4) idannonce parameter in (d) admin/admin_annonce/okvalannonce.php and (e) admin/admin_annonce/changeannonce.php. | | 10.0 | CVE-2006-6478 BUGTRAQ BID FRSIRT SECUNIA XF
| SCRIPTPHP -- AnnonceScriptHP
| Multiple cross-site scripting (XSS) vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the email parameter in (1) erreurinscription.php, (2) Templates/admin.dwt.php, (3) Templates/commun.dwt.php, (4) membre.dwt.php, and (5) admin/admin_config/Aide.php. | | 10.0 | CVE-2006-6479 BUGTRAQ BID FRSIRT SECUNIA XF
| SCRIPTPHP -- ProNews
| Multiple cross-site scripting (XSS) vulnerabilities in ProNews 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo, (2) email, (3) date, (4) sujet, (5) message, (6) site, and (7) lien parameters to (a) admin/change.php, and the (8) aa parameter to (b) lire-avis.php. | | 7.0 | CVE-2006-6518 BUGTRAQ BID
| SCRIPTPHP -- ProNews
| SQL injection vulnerability in lire-avis.php in ProNews 1.5 allows remote attackers to execute arbitrary SQL commands via the aa parameter. | | 7.0 | CVE-2006-6519 BUGTRAQ BID
| SCRIPTPHP -- Messageriescripthp
| Multiple cross-site scripting (XSS) vulnerabilities in Messageriescripthp 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo parameter to (a) existepseudo.php, the (2) email parameter to (b) existeemail.php, or the (3) pageName or (4) cssform parameter to (c) Contact/contact.php. | | 7.0 | CVE-2006-6520 BUGTRAQ BID
| SCRIPTPHP -- Messageriescripthp
| SQL injection vulnerability in lire-avis.php in Messageriescripthp 2.0 allows remote attackers to execute arbitrary SQL commands via the aa parameter. | | 7.0 | CVE-2006-6521 BUGTRAQ BID
| ShopSite -- ShopSite
| Multiple cross-site scripting (XSS) vulnerabilities in ShopSite 8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the prevlocation parameter in shopper/sc/registration.cgi and other unspecified vectors. | | 7.0 | CVE-2006-6485 BUGTRAQ OTHER-REF SECTRACK BUGTRAQ OTHER-REF FRSIRT SECUNIA XF
| Sophos -- Sophos Anti-Virus
| Multiple buffer overflows in Sophos Anti-Virus scanning engine before 2.40 allow remote attackers to execute arbitrary code via (1) a SIT archive with a long filename that is not null-terminated, which triggers a heap-based overflow in veex.dll due to improper length calculation, and (2) a CPIO archive, with a long filename that is not null-terminated, which triggers a stack-based overflow in veex.dll. | | 10.0 | CVE-2006-6335 OTHER-REF OTHER-REF OTHER-REF OTHER-REF FRSIRT BUGTRAQ BUGTRAQ BID SECUNIA XF XF
| SWsoft -- Plesk
| Multiple cross-site scripting (XSS) vulnerabilities in SWsoft Plesk 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) get_password.php or (2) login_up.php3. | | 7.0 | CVE-2006-6451 BUGTRAQ OTHER-REF BID SECTRACK XF
| Symantec -- Veritas NetBackup Enterprise Server Symantec -- Veritas NetBackup Server Symantec -- Veritas NetBackup Client
| The NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 does not properly check for chained commands, which allows remote attackers to execute arbitrary commands by appending malicious commands to valid commands. | | 7.0 | CVE-2006-4902 ISS OTHER-REF BID FRSIRT SECUNIA SECTRACK
| Symantec -- Veritas NetBackup Enterprise Server Symantec -- Veritas NetBackup Server Symantec -- Veritas NetBackup Client
| Stack-based buffer overflow in the NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 allows remote attackers to execute arbitrary code via a long CONNECT_OPTIONS request, a different issue than CVE-2006-6222. | | 7.0 | CVE-2006-5822 BUGTRAQ OTHER-REF OTHER-REF BID FRSIRT SECUNIA SECTRACK
| Symantec -- Veritas NetBackup Enterprise Server Symantec -- Veritas NetBackup Server Symantec -- Veritas NetBackup Client
| Stack-based buffer overflow in the NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 allows remote attackers to execute arbitrary code via a long request with a malformed length prefix. | | 7.0 | CVE-2006-6222 BUGTRAQ OTHER-REF OTHER-REF BID FRSIRT SECUNIA SECTRACK XF
| Tucows -- Client Code Suite
| PHP remote file inclusion vulnerability in libs/tucows/api/cartridges/crt_TUCOWS_domains/lib/domainutils.inc.php in Tucows Client Code Suite (CCS) 1.2.1015 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _ENV[TCA_HOME] parameter. | | 10.0 | CVE-2006-6551 OTHER-REF XF
| Vt-Forum -- Vt-Forum Lite
| Multiple cross-site scripting (XSS) vulnerabilities in Vt-Forum Lite 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) StrMsg or (2) Topic_ID parameter to (a) vf_info.asp, (b) vf_newtopic.asp, (c) vf_settings.asp, and (d) vf_replytopic.asp, different vectors than CVE-2006-6447. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. | | 7.0 | CVE-2006-6532 FRSIRT XF
| WikiTimeScale -- TwoZero
| Multiple cross-site scripting (XSS) vulnerabilities in WikiTimeScale TwoZero before 2.31 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in the (1) forum module and (2) event descriptions. NOTE: some of these details are obtained from third party information. | | 7.0 | CVE-2006-6522 OTHER-REF FRSIRT XF
| Xerox -- WorkCentre Pro Xerox -- WorkCentre
| The Web User Interface in Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 allows remote attackers to execute arbitrary commands via unspecified vectors involving "command injection" in (1) the TCP/IP hostname, (2) Scan-to-mailbox folder names, and (3) certain parameters in the Microsoft Networking configuration. NOTE: vector 1 might be the same as CVE-2006-5290. | | 7.0 | CVE-2006-6427 OTHER-REF FRSIRT SECTRACK SECUNIA OTHER-REF
| Xerox -- WorkCentre Pro Xerox -- WorkCentre
| Multiple unspecified vulnerabilities in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 have unknown impact and attack vectors, related to (1) an Immediate Image Overwrite (IIO) error message at the Local User Interface (LUI) if overwrite fails, (2) an IIO failure when a Held Job is deleted, and (3) an On Demand Image Overwrite failure when the overwrite is greater than 2 Gb. | | 10.0 | CVE-2006-6473 OTHER-REF SECUNIA
|