Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: April 2006

46 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2006-1618
    34Monitor

    Format string vulnerability in the (1) Con_message and (2) conPrintf functions in con_main.c in Doomsday engine 1.8.6 allows remote attacker

    HighCVSS 7.5Proof of conceptEPSS 13%

    doomsday · doomsdayApr 5, 2006

  • CVE-2006-1626
    25Monitor

    Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by

    MediumCVSS 4.3Proof of conceptEPSS 25%

    microsoft · internet explorerApr 5, 2006

  • CVE-2006-1651
    34Monitor

    Microsoft ISA Server 2004 allows remote attackers to bypass certain filtering rules, including ones for (1) ICMP and (2) TCP, via IPv6 packe

    HighCVSS 7.5No exploitEPSS 14%

    microsoft · isa serverApr 6, 2006

  • CVE-2006-1652
    56Plan

    Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-assisted remote attacke

    CriticalCVSS 9.0WeaponizedEPSS 68%

    ultravnc · tabbed viewerApr 6, 2006

  • CVE-2006-1615
    43Plan

    Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute

    CriticalCVSS 10.0No exploitEPSS 11%

    clamav · clamavApr 6, 2006

  • CVE-2006-1664
    34Monitor

    Buffer overflow in xine_list_delete_current in libxine 1.14 and earlier, as distributed in xine-lib 1.1.1 and earlier, allows remote attacke

    HighCVSS 7.5Proof of conceptEPSS 14%

    xine · xine-libApr 7, 2006

  • CVE-2006-0996
    20Monitor

    Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script o

    MediumCVSS 4.3Proof of conceptEPSS 11%

    php · phpApr 10, 2006

  • CVE-2006-0015
    34Monitor

    Cross-site scripting (XSS) vulnerability in _vti_bin/_vti_adm/fpadmdll.dll in Microsoft FrontPage Server Extensions 2002 and SharePoint Team

    MediumCVSS 6.8Proof of conceptEPSS 24%

    microsoft · frontpage server extensionsApr 11, 2006

  • CVE-2006-1185
    51Plan

    Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invali

    HighCVSS 7.5Proof of conceptEPSS 70%

    microsoft · ieApr 11, 2006

  • CVE-2006-1186
    57Plan

    Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2)

    CriticalCVSS 10.0Proof of conceptEPSS 58%

    microsoft · ieApr 11, 2006

  • CVE-2006-1188
    47Plan

    Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, w

    HighCVSS 7.5Proof of conceptEPSS 57%

    microsoft · ieApr 11, 2006

  • CVE-2006-1189
    59Plan

    Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted

    CriticalCVSS 10.0Proof of conceptEPSS 61%

    microsoft · internet explorerApr 11, 2006

  • CVE-2006-1190
    58Plan

    Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedd

    CriticalCVSS 10.0Proof of conceptEPSS 61%

    microsoft · internet explorerApr 11, 2006

  • CVE-2006-1191
    26Monitor

    Microsoft Internet Explorer 5.01 through 6 does not always correctly identify the domain that is associated with a browser window, which all

    MediumCVSS 4.0Proof of conceptEPSS 31%

    microsoft · internet explorerApr 11, 2006

  • CVE-2006-1192
    20Monitor

    Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts o

    LowCVSS 2.6Proof of conceptEPSS 31%

    microsoft · ieApr 11, 2006

  • CVE-2006-1719
    24Monitor

    Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) via any scrollbar Cascading Style Sheets (CSS)

    MediumCVSS 5.0No exploitEPSS 13%

    microsoft · ieApr 11, 2006

  • CVE-2006-0003
    45Plan

    Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in Microsof

    MediumCVSS 5.1WeaponizedEPSS 82%

    microsoft · data access componentsApr 11, 2006

  • CVE-2006-0012
    27Monitor

    Unspecified vulnerability in Windows Explorer in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to

    MediumCVSS 5.1No exploitEPSS 24%

    microsoft · windows 2000Apr 11, 2006

  • CVE-2006-0014
    27Monitor

    Buffer overflow in Microsoft Outlook Express 5.5 and 6 allows remote attackers to execute arbitrary code via a crafted Windows Address Book

    MediumCVSS 5.1No exploitEPSS 24%

    microsoft · outlook expressApr 11, 2006

  • CVE-2006-1770
    43Plan

    Multiple PHP remote file inclusion vulnerabilities in Azerbaijan Design & Development Group (AZDG) AzDGVote allow remote attackers to execut

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    azerbaijan development group · azdgvoteApr 13, 2006

  • CVE-2006-1776
    34Monitor

    PHP remote file inclusion vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to execute arb

    HighCVSS 7.5Proof of conceptEPSS 12%

    simplog · simplogApr 13, 2006

  • CVE-2006-1551
    45Plan

    Eval injection vulnerability in pajax_call_dispatcher.php in PAJAX 0.5.1 and earlier allows remote attackers to execute arbitrary code via t

    HighCVSS 7.5WeaponizedEPSS 51%

    georges auberger · pajaxApr 13, 2006

  • CVE-2006-1786
    14Monitor

    Cross-site scripting (XSS) vulnerability in Adobe Document Server for Reader Extensions 6.0 allows remote attackers to inject arbitrary web

    LowCVSS 2.6Proof of conceptEPSS 12%

    adobe · document serverApr 13, 2006

  • CVE-2006-0749
    40Plan

    nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey b

    CriticalCVSS 9.3No exploitEPSS 10%

    mozilla · firefoxApr 14, 2006

  • CVE-2006-0992
    62This week

    Stack-based buffer overflow in Novell GroupWise Messenger before 2.0 Public Beta 2 allows remote attackers to execute arbitrary code via a l

    CriticalCVSS 10.0WeaponizedEPSS 73%

    novell · groupwise messengerApr 14, 2006

  • CVE-2006-1730
    40Plan

    Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey be

    CriticalCVSS 9.3No exploitEPSS 10%

    mozilla · firefoxApr 14, 2006

  • CVE-2006-1834
    24Monitor

    Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, w

    MediumCVSS 5.1Proof of conceptEPSS 12%

    opera · opera browserApr 19, 2006

  • CVE-2006-1868
    34Monitor

    Buffer overflow in the Advanced Replication component in Oracle Database Server 10.1.0.4 allows database users to execute arbitrary code via

    HighCVSS 7.5No exploitEPSS 14%

    oracle · database serverApr 20, 2006

  • CVE-2006-1900
    35Monitor

    Multiple buffer overflows in World Wide Web Consortium (W3C) Amaya 9.4, and possibly other versions including 8.x before 8.8.5, allow remote

    HighCVSS 7.6Proof of conceptEPSS 16%

    w3c · amayaApr 20, 2006

  • CVE-2006-1905
    34Monitor

    Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.3 allow remote attackers to execute arbitrary code via format stri

    HighCVSS 7.5Proof of conceptEPSS 14%

    xine · xineApr 20, 2006

  • CVE-2006-1931
    23Monitor

    The HTTP/XMLRPC server in Ruby before 1.8.2 uses blocking sockets, which allows attackers to cause a denial of service (blocked connections)

    MediumCVSS 5.0Proof of conceptEPSS 10%

    yukihiro matsumoto · rubyApr 20, 2006

  • CVE-2006-1959
    34Monitor

    PHP remote file inclusion vulnerability in direct.php in ActualScripts ActualAnalyzer Lite 2.72 and earlier, Gold 7.63 and earlier, and Serv

    HighCVSS 7.5Proof of conceptEPSS 13%

    actualscripts · actualanalyzerApr 21, 2006

  • CVE-2006-1982
    36Monitor

    Heap-based buffer overflow in the LZWDecodeVector function in Mac OS X before 10.4.6, as used in applications that use ImageIO or AppKit, al

    HighCVSS 7.5Proof of conceptEPSS 19%

    apple · mac os xApr 21, 2006

  • CVE-2006-1985
    24Monitor

    Heap-based buffer overflow in BOM BOMArchiveHelper 10.4 (6.3) Build 312, as used in Mac OS X 10.4.6 and earlier, allows user-assisted attack

    MediumCVSS 5.1Proof of conceptEPSS 13%

    apple · safariApr 21, 2006

  • CVE-2006-1990
    23Monitor

    Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary co

    MediumCVSS 5.0No exploitEPSS 10%

    php · phpApr 24, 2006

  • CVE-2006-0230
    45Plan

    Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remot

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    symantec · antivirus scan engineApr 24, 2006

  • CVE-2006-1992
    22Monitor

    mshtml.dll 6.00.2900.2873, as used in Microsoft Internet Explorer, allows remote attackers to cause a denial of service (crash) via nested O

    LowCVSS 2.6Proof of conceptEPSS 40%

    microsoft · internet explorerApr 24, 2006

  • CVE-2006-1993
    36Monitor

    Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary cod

    MediumCVSS 5.1Proof of conceptEPSS 54%

    mozilla · firefoxApr 25, 2006

  • CVE-2006-2022
    35Monitor

    Buffer overflow in the parse_url function in the RTSP module (rtsp/parse_url.c) in Fenice 1.10 and earlier allows remote attackers to execut

    HighCVSS 7.5Proof of conceptEPSS 15%

    ls3 · feniceApr 25, 2006

  • CVE-2006-2025
    29Monitor

    Integer overflow in the TIFFFetchData function in tif_dirread.c for libtiff before 3.8.1 allows context-dependent attackers to cause a denia

    MediumCVSS 6.5Proof of conceptEPSS 10%

    libtiff · libtiffApr 25, 2006

  • CVE-2006-2026
    29Monitor

    Double free vulnerability in tif_jpeg.c in libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service (crash) and

    MediumCVSS 6.5Proof of conceptEPSS 10%

    libtiff · libtiffApr 25, 2006

  • CVE-2006-2055
    25Monitor

    Argument injection vulnerability in Microsoft Outlook 2003 SP1 allows user-assisted remote attackers to modify command line arguments to an

    MediumCVSS 5.0No exploitEPSS 15%

    microsoft · outlookApr 26, 2006

  • CVE-2006-2056
    24Monitor

    Argument injection vulnerability in Internet Explorer 6 for Windows XP SP2 allows user-assisted remote attackers to modify command line argu

    MediumCVSS 5.0No exploitEPSS 12%

    microsoft · internet explorerApr 26, 2006

  • CVE-2006-2081
    40Plan

    Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via the GET_DOMAIN_INDEX_METADATA function in the D

    MediumCVSS 4.6WeaponizedEPSS 21%

    oracle · database serverApr 27, 2006

  • CVE-2006-2086
    50Plan

    Buffer overflow in JuniperSetupDLL.dll, loaded from JuniperSetup.ocx by the Juniper SSL-VPN Client when accessing a Juniper NetScreen IVE de

    HighCVSS 7.5WeaponizedEPSS 67%

    juniper · junipersetup controlApr 29, 2006

  • CVE-2006-2094
    27Monitor

    Microsoft Internet Explorer before Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, when Prompt is configured in Security S

    MediumCVSS 5.1Proof of conceptEPSS 23%

    microsoft · ieApr 29, 2006