Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2006

34 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2006-2111
    29Monitor

    A component in Microsoft Outlook Express 6 allows remote attackers to bypass domain restrictions and obtain sensitive information via redire

    MediumCVSS 4.3Proof of conceptEPSS 40%

    microsoft · outlook expressMay 1, 2006

  • CVE-2006-2151
    33Monitor

    PHP remote file inclusion vulnerability in toplist.php in phpBB TopList 1.3.8 and earlier, when register_globals is enabled, allows remote a

    HighCVSS 7.5Proof of conceptEPSS 10%

    phpbb group · phpbb toplistMay 3, 2006

  • CVE-2006-1516
    31Monitor

    The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attacker

    MediumCVSS 5.0Proof of conceptEPSS 35%

    mysql · mysqlMay 5, 2006

  • CVE-2006-1518
    38Monitor

    Buffer overflow in the open_table function in sql_base.cc in MySQL 5.0.x up to 5.0.20 might allow remote attackers to execute arbitrary code

    MediumCVSS 6.5Proof of conceptEPSS 38%

    mysql · mysqlMay 5, 2006

  • CVE-2006-2212
    43Plan

    Buffer overflow in KarjaSoft Sami FTP Server 2.0.2 and earlier allows remote attackers to execute arbitrary code via a long (1) USER or (2)

    MediumCVSS 6.4WeaponizedEPSS 58%

    karjasoft · sami ftp serverMay 5, 2006

  • CVE-2006-2218
    47Plan

    Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "except

    CriticalCVSS 9.3No exploitEPSS 32%

    microsoft · internet explorerMay 5, 2006

  • CVE-2006-2223
    23Monitor

    RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly implement configurations that (1) disable RIPv1 or (2) require plaintext or M

    MediumCVSS 5.0Proof of conceptEPSS 11%

    quagga · quaggaMay 5, 2006

  • CVE-2006-2224
    23Monitor

    RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly enforce RIPv2 authentication requirements, which allows remote attackers to m

    MediumCVSS 5.0Proof of conceptEPSS 10%

    quagga · quagga routing software suiteMay 5, 2006

  • CVE-2006-2237
    40Plan

    The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell

    MediumCVSS 5.1WeaponizedEPSS 58%

    awstats · awstatsMay 8, 2006

  • CVE-2006-1172
    24Monitor

    Stack-based buffer overflow in the createPKCS10 function in Cryptomathic Cenroll ActiveX Control 1.1.0.0 allows remote attackers to execute

    MediumCVSS 5.0Proof of conceptEPSS 14%

    tdc · cryptomathic cenroll activex controlMay 9, 2006

  • CVE-2006-2270
    34Monitor

    PHP remote file inclusion vulnerability in includes/config.php in Jetbox CMS 2.1 allows remote attackers to execute arbitrary code via a URL

    HighCVSS 7.5Proof of conceptEPSS 14%

    jetbox · jetbox cmsMay 9, 2006

  • CVE-2006-0027
    54Plan

    Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal

    HighCVSS 7.5WeaponizedEPSS 78%

    microsoft · exchange serverMay 9, 2006

  • CVE-2006-0034
    39Monitor

    Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinat

    HighCVSS 7.5No exploitEPSS 31%

    microsoft · distributed transaction coordinatorMay 9, 2006

  • CVE-2006-1184
    29Monitor

    Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers

    MediumCVSS 5.0No exploitEPSS 29%

    microsoft · distributed transaction coordinatorMay 9, 2006

  • CVE-2006-2297
    22Monitor

    Heap-based buffer overflow in Microsoft Infotech Storage System Library (itss.dll) allows user-assisted attackers to execute arbitrary code

    MediumCVSS 4.0Proof of conceptEPSS 19%

    microsoft · infotech storage system libraryMay 9, 2006

  • CVE-2006-0994
    36Monitor

    Multiple Sophos Anti-Virus products, including Anti-Virus for Windows 5.x before 5.2.1 and 4.x before 4.05, when cabinet file inspection is

    HighCVSS 7.5No exploitEPSS 21%

    sophos · sophos anti-virusMay 10, 2006

  • CVE-2006-2362
    33Monitor

    Buffer overflow in getsym in tekhex.c in libbfd in Free Software Foundation GNU Binutils before 20060423, as used by GNU strings, allows con

    HighCVSS 7.3Proof of conceptEPSS 14%

    gnu · binutilsMay 15, 2006

  • CVE-2006-2369
    58Plan

    RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authenticat

    HighCVSS 7.5WeaponizedEPSS 92%

    vnc · realvncMay 15, 2006

  • CVE-2006-2407
    51Plan

    Stack-based buffer overflow in (1) WeOnlyDo wodSSHServer ActiveX Component 1.2.7 and 1.3.3 DEMO, as used in other products including (2) Fre

    HighCVSS 7.5WeaponizedEPSS 71%

    weonlydo · wodsshserverMay 16, 2006

  • CVE-2006-2426
    29Monitor

    Sun Java Runtime Environment (JRE) 1.5.0_6 and earlier, JDK 1.5.0_6 and earlier, and SDK 1.5.0_6 and earlier allows remote attackers to caus

    MediumCVSS 6.4Proof of conceptEPSS 12%

    sun · jdkMay 17, 2006

  • CVE-2006-2460
    28Monitor

    Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when register_globals is enabled, does not protect critical variables such as $_GLOBALS

    MediumCVSS 6.4Proof of conceptEPSS 10%

    sugarcrm · sugarcrmMay 19, 2006

  • CVE-2006-2492
    79This week

    Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allow

    HighCVSS 8.8KEVWeaponizedEPSS 48%

    microsoft · officeMay 19, 2006

  • CVE-2006-2502
    40Plan

    Stack-based buffer overflow in pop3d in Cyrus IMAPD (cyrus-imapd) 2.3.2, when the popsubfolders option is enabled, allows remote attackers t

    MediumCVSS 5.1WeaponizedEPSS 53%

    cyrus · imapdMay 22, 2006

  • CVE-2006-0747
    24Monitor

    Integer underflow in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a font file with an odd number of

    MediumCVSS 5.0Proof of conceptEPSS 12%

    freetype · freetypeMay 23, 2006

  • CVE-2006-2548
    34Monitor

    Prodder before 0.5, and perlpodder before 0.5, allows remote attackers to execute arbitrary code via shell metacharacters in the URL of a po

    HighCVSS 7.5Proof of conceptEPSS 13%

    perlpodder · perlpodderMay 23, 2006

  • CVE-2006-2554
    29Monitor

    Buffer overflow in the tell_player_surr_changes function in Genecys 0.2 and earlier might allow remote attackers to execute arbitrary code v

    MediumCVSS 6.4Proof of conceptEPSS 12%

    genecys · genecysMay 23, 2006

  • CVE-2006-2557
    29Monitor

    PHP remote file inclusion vulnerability in extras/poll/poll.php in Florian Amrhein NewsPortal before 0.37, and TR Newsportal (TRanx rebuilde

    MediumCVSS 6.4Proof of conceptEPSS 13%

    florian amrhein · newsportalMay 23, 2006

  • CVE-2006-2444
    38Monitor

    The snmp_trap_decode function in the SNMP NAT helper for Linux kernel before 2.6.16.18 allows remote attackers to cause a denial of service

    HighCVSS 7.8Proof of conceptEPSS 22%

    linux · linux kernelMay 25, 2006

  • CVE-2006-2630
    62This week

    Stack-based buffer overflow in Symantec Antivirus 10.1 and Client Security 3.1 allows remote attackers to execute arbitrary code via unknown

    CriticalCVSS 10.0WeaponizedEPSS 73%

    symantec · client securityMay 27, 2006

  • CVE-2006-2656
    34Monitor

    Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via

    HighCVSS 7.5Proof of conceptEPSS 14%

    libtiff · libtiffMay 30, 2006

  • CVE-2006-2661
    25Monitor

    ftutil.c in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a crafted font file that triggers a null de

    MediumCVSS 5.0Proof of conceptEPSS 16%

    freetype · freetypeMay 30, 2006

  • CVE-2006-2667
    34Monitor

    Direct static code injection vulnerability in WordPress 2.0.2 and earlier allows remote attackers to execute arbitrary commands by inserting

    HighCVSS 7.5Proof of conceptEPSS 14%

    wordpress · wordpressMay 30, 2006

  • CVE-2006-2685
    40Plan

    PHP remote file inclusion vulnerability in Basic Analysis and Security Engine (BASE) 1.2.4 and earlier, with register_globals enabled, allow

    MediumCVSS 4.0WeaponizedEPSS 49%

    kevin johnson · basic analysis and security engineMay 31, 2006

  • CVE-2006-2686
    29Monitor

    PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[

    MediumCVSS 6.4Proof of conceptEPSS 13%

    actionapps · actionappsMay 31, 2006