Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: June 2006

57 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2006-2726
    36Monitor

    PHP remote file inclusion vulnerability in Fastpublish CMS 1.6.9.d allows remote attackers to include arbitrary files via the config[fsBase]

    HighCVSS 7.5Proof of conceptEPSS 19%

    fastpublish · fastpublish cmsJun 1, 2006

  • CVE-2006-2743
    23Monitor

    Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which al

    MediumCVSS 5.1Proof of conceptEPSS 11%

    drupal · drupalJun 1, 2006

  • CVE-2006-2766
    24Monitor

    Buffer overflow in INETCOMM.DLL, as used in Microsoft Internet Explorer 6.0 through 6.0 SP2, Windows Explorer, Outlook Express 6, and possib

    LowCVSS 2.6Proof of conceptEPSS 47%

    microsoft · ieJun 2, 2006

  • CVE-2006-2769
    23Monitor

    The HTTP Inspect preprocessor (http_inspect) in Snort 2.4.0 through 2.4.4 allows remote attackers to bypass "uricontent" rules via a carriag

    MediumCVSS 5.0Proof of conceptEPSS 10%

    sourcefire · snortJun 2, 2006

  • CVE-2006-2802
    23Monitor

    Buffer overflow in the HTTP Plugin (xineplug_inp_http.so) for xine-lib 1.1.1 allows remote attackers to cause a denial of service (applicati

    MediumCVSS 5.0Proof of conceptEPSS 11%

    xine · gxineJun 3, 2006

  • CVE-2006-2811
    35Monitor

    Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrary PHP code via a URL

    HighCVSS 7.5Proof of conceptEPSS 17%

    cantico · ovidentiaJun 5, 2006

  • CVE-2006-2842
    44Plan

    PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_

    HighCVSS 7.5Proof of conceptEPSS 47%

    squirrelmail · squirrelmailJun 6, 2006

  • CVE-2006-2849
    33Monitor

    PHP remote file inclusion vulnerability in includes/webdav/server.php in Bytehoard 2.1 Epsilon/Delta allows remote attackers to execute arbi

    HighCVSS 7.5Proof of conceptEPSS 11%

    andrew godwin · bytehoardJun 6, 2006

  • CVE-2006-2852
    30Monitor

    PHP remote file inclusion vulnerability in dotWidget CMS 1.0.6 and earlier, when register_globals is enabled, allows remote attackers to exe

    MediumCVSS 6.8Proof of conceptEPSS 11%

    dotwidget · dotwidget cmsJun 6, 2006

  • CVE-2006-2860
    29Monitor

    PHP remote file inclusion vulnerability in Webspotblogging 3.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the path

    MediumCVSS 6.4Proof of conceptEPSS 13%

    webspot · webspotbloggingJun 6, 2006

  • CVE-2006-2864
    25Monitor

    Multiple PHP remote file inclusion vulnerabilities in BlueShoes Framework 4.6 allow remote attackers to execute arbitrary PHP code via a URL

    MediumCVSS 5.1Proof of conceptEPSS 15%

    blueshoes · blueshoes frameworkJun 6, 2006

  • CVE-2006-2868
    23Monitor

    Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.6 allow remote attackers to execute arbitrary PHP code via a URL in the

    MediumCVSS 5.1Proof of conceptEPSS 11%

    claroline · clarolineJun 6, 2006

  • CVE-2006-2447
    43Plan

    SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands vi

    MediumCVSS 5.1WeaponizedEPSS 75%

    apache · spamassassinJun 6, 2006

  • CVE-2006-2878
    34Monitor

    The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "c

    HighCVSS 7.5No exploitEPSS 13%

    andreas gohr · dokuwikiJun 6, 2006

  • CVE-2006-2881
    25Monitor

    Multiple PHP remote file inclusion vulnerabilities in DreamAccount 3.1 and earlier, when register_globals is enabled, allow remote attackers

    MediumCVSS 5.1Proof of conceptEPSS 17%

    dreamcost · dreamaccountJun 7, 2006

  • CVE-2006-2900
    20Monitor

    Internet Explorer 6 allows user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the targe

    MediumCVSS 4.0No exploitEPSS 12%

    microsoft · ieJun 7, 2006

  • CVE-2006-2906
    24Monitor

    The LZW decoding in the gdImageCreateFromGifPtr function in the Thomas Boutell graphics draw (GD) library (aka libgd) 2.0.33 allows remote a

    MediumCVSS 5.4Proof of conceptEPSS 10%

    thomas boutell · graphics draw libraryJun 8, 2006

  • CVE-2006-2919
    38Monitor

    Unspecified vulnerability in Microsoft NetMeeting 3.01 allows remote attackers to cause a denial of service (crash or CPU consumption) and p

    HighCVSS 7.8No exploitEPSS 22%

    microsoft · netmeetingJun 8, 2006

  • CVE-2006-2926
    51Plan

    Stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows remote attackers to cause a denial of service and poss

    HighCVSS 7.5WeaponizedEPSS 70%

    qbik · wingateJun 9, 2006

  • CVE-2006-2961
    49Plan

    Stack-based buffer overflow in CesarFTP 0.99g and earlier allows remote attackers to cause a denial of service (application crash) and possi

    HighCVSS 7.5WeaponizedEPSS 61%

    aclogic · cesarftpJun 12, 2006

  • CVE-2006-2376
    42Plan

    Integer overflow in the PolyPolygon function in Graphics Rendering Engine on Microsoft Windows 98 and Me allows remote attackers to execute

    HighCVSS 7.5No exploitEPSS 41%

    microsoft · windows 98Jun 13, 2006

  • CVE-2006-0022
    34Monitor

    Unspecified vulnerability in Microsoft PowerPoint in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 for Mac,

    HighCVSS 7.6No exploitEPSS 14%

    microsoft · powerpointJun 13, 2006

  • CVE-2006-0025
    52Plan

    Stack-based buffer overflow in Microsoft Windows Media Player 9 and 10 allows remote attackers to execute arbitrary code via a PNG image wit

    CriticalCVSS 9.3No exploitEPSS 48%

    microsoft · windows media playerJun 13, 2006

  • CVE-2006-1193
    22Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access (OWA), allows us

    LowCVSS 2.6Proof of conceptEPSS 39%

    microsoft · exchange serverJun 13, 2006

  • CVE-2006-1303
    48Plan

    Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitra

    CriticalCVSS 9.3No exploitEPSS 38%

    microsoft · ieJun 13, 2006

  • CVE-2006-1313
    36Monitor

    Microsoft JScript 5.1, 5.5, and 5.6 on Windows 2000 SP4, and 5.6 on Windows XP, Server 2003, Windows 98 and Windows Me, will "release object

    MediumCVSS 6.8No exploitEPSS 29%

    microsoft · windows 2000Jun 13, 2006

  • CVE-2006-2370
    51Plan

    Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earli

    HighCVSS 7.5WeaponizedEPSS 70%

    microsoft · windows 2000Jun 13, 2006

  • CVE-2006-2371
    37Monitor

    Buffer overflow in the Remote Access Connection Manager service (RASMAN) service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2

    HighCVSS 7.5No exploitEPSS 22%

    microsoft · windows 2000Jun 13, 2006

  • CVE-2006-2373
    49Plan

    The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows loc

    CriticalCVSS 10.0Proof of conceptEPSS 29%

    microsoft · windows 2000Jun 13, 2006

  • CVE-2006-2378
    37Monitor

    Buffer overflow in the ART Image Rendering component (jgdw400.dll) in Microsoft Windows XP SP1 and Sp2, Server 2003 SP1 and earlier, and Win

    MediumCVSS 6.8No exploitEPSS 34%

    microsoft · ieJun 13, 2006

  • CVE-2006-2379
    53Plan

    Buffer overflow in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote a

    CriticalCVSS 9.3Proof of conceptEPSS 54%

    microsoft · windows 2000Jun 13, 2006

  • CVE-2006-2380
    22Monitor

    Microsoft Windows 2000 SP4 does not properly validate an RPC server during mutual authentication over SSL, which allows remote attackers to

    MediumCVSS 4.3No exploitEPSS 17%

    microsoft · windows 2000Jun 13, 2006

  • CVE-2006-2382
    55Plan

    Heap-based buffer overflow in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code v

    CriticalCVSS 10.0No exploitEPSS 48%

    microsoft · internet explorerJun 13, 2006

  • CVE-2006-2383
    49Plan

    Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code vi

    CriticalCVSS 9.3Proof of conceptEPSS 40%

    microsoft · internet explorerJun 13, 2006

  • CVE-2006-2384
    23Monitor

    Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal

    MediumCVSS 4.3No exploitEPSS 19%

    microsoft · internet explorerJun 13, 2006

  • CVE-2006-2385
    36Monitor

    Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arb

    HighCVSS 7.6No exploitEPSS 20%

    microsoft · ieJun 13, 2006

  • CVE-2006-3059
    49Plan

    Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows remote user-assisted attackers to execute arbitrary code via unspecifi

    CriticalCVSS 9.3Proof of conceptEPSS 41%

    microsoft · excelJun 17, 2006

  • CVE-2006-3081
    24Monitor

    mysqld in MySQL 4.1.x before 4.1.18, 5.0.x before 5.0.19, and 5.1.x before 5.1.6 allows remote authorized users to cause a denial of service

    MediumCVSS 4.0Proof of conceptEPSS 25%

    mysql · mysqlJun 19, 2006

  • CVE-2006-3086
    54Plan

    Stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName function in Microsoft Hyperlink Object Library (hlink.dll) allows remot

    CriticalCVSS 9.3Proof of conceptEPSS 56%

    microsoft · hyperlink object libraryJun 19, 2006

  • CVE-2006-3101
    24Monitor

    Cross-site scripting (XSS) vulnerability in LogonProxy.cgi in Cisco Secure ACS for UNIX 2.3 allows remote attackers to inject arbitrary web

    MediumCVSS 4.3Proof of conceptEPSS 24%

    cisco · secure access control serverJun 20, 2006

  • CVE-2006-3109
    21Monitor

    Cross-site scripting (XSS) vulnerability in Cisco CallManager 3.3 before 3.3(5)SR3, 4.1 before 4.1(3)SR4, 4.2 before 4.2(3), and 4.3 before

    MediumCVSS 4.3Proof of conceptEPSS 13%

    cisco · call managerJun 20, 2006

  • CVE-2006-3014
    29Monitor

    Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadshee

    MediumCVSS 5.1Proof of conceptEPSS 30%

    microsoft · excelJun 21, 2006

  • CVE-2006-3172
    35Monitor

    Multiple PHP remote file inclusion vulnerabilities in Content*Builder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL w

    HighCVSS 7.5Proof of conceptEPSS 15%

    content\*builder · content\*builderJun 22, 2006

  • CVE-2006-3193
    24Monitor

    Multiple PHP remote file inclusion vulnerabilities in Grayscale BandSite CMS 1.1.1, when register_globals is enabled, allow remote attackers

    MediumCVSS 5.1Proof of conceptEPSS 14%

    grayscale · bandsite cmsJun 22, 2006

  • CVE-2006-2914
    26Monitor

    PHP remote file inclusion vulnerability in DeluxeBB 1.06 allows remote attackers to execute arbitrary code via a URL in the templatefolder p

    MediumCVSS 5.1Proof of conceptEPSS 20%

    deluxebb · deluxebbJun 23, 2006

  • CVE-2006-3199
    24Monitor

    Opera 9 allows remote attackers to cause a denial of service (crash) via an A tag with an href attribute with a URL containing a long hostna

    MediumCVSS 5.0Proof of conceptEPSS 14%

    opera · opera browserJun 23, 2006

  • CVE-2006-3200
    25Monitor

    Unspecified versions of Internet Explorer allow remote attackers to cause a denial of service (crash) via an IFRAME with a src tag containin

    MediumCVSS 5.0No exploitEPSS 15%

    microsoft · internet explorerJun 23, 2006

  • CVE-2006-3210
    24Monitor

    Ralf Image Gallery (RIG) 0.7.4 and other versions before 1.0, when register_globals is enabled, allows remote attackers to conduct PHP remot

    MediumCVSS 5.1Proof of conceptEPSS 13%

    le ralf · ralf image galleryJun 23, 2006

  • CVE-2006-3227
    14Monitor

    Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera, and Firefox might allow remote attackers to

    LowCVSS 2.6No exploitEPSS 13%

    microsoft · internet explorerJun 26, 2006

  • CVE-2006-3228
    41Plan

    Buffer overflow in in_midi.dll for WinAmp 2.90 up to 5.23, including 5.21, allows remote attackers to execute arbitrary code via a crafted .

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    nullsoft · winampJun 26, 2006

  • CVE-2006-3134
    40Plan

    Buffer overflow in GraceNote CDDBControl ActiveX Control, as used by multiple products that use Gracenote CDDB, allows remote attackers to e

    CriticalCVSS 9.3No exploitEPSS 11%

    gracenote · cddbcontrol activex controlJun 27, 2006

  • CVE-2006-3252
    49Plan

    Buffer overflow in the Online Registration Facility for Algorithmic Research PrivateWire VPN software up to 3.7 allows remote attackers to e

    HighCVSS 7.5WeaponizedEPSS 62%

    algorithmic research · privatewire gatewayJun 27, 2006

  • CVE-2006-3266
    25Monitor

    Multiple PHP remote file inclusion vulnerabilities in Bee-hive Lite 1.2 and earlier, when register_globals is enabled, allow remote attacker

    MediumCVSS 5.1Proof of conceptEPSS 17%

    magnet · bee-hive liteJun 27, 2006

  • CVE-2006-3276
    34Monitor

    Heap-based buffer overflow in RealNetworks Helix DNA Server 10.0 and 11.0 allows remote attackers to execute arbitrary code via (1) a long U

    HighCVSS 7.5No exploitEPSS 13%

    realnetworks · helix dna serverJun 28, 2006

  • CVE-2006-3280
    47Plan

    Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains vi

    HighCVSS 7.5Proof of conceptEPSS 55%

    microsoft · internet explorerJun 28, 2006

  • CVE-2006-3281
    34Monitor

    Microsoft Internet Explorer 6.0 does not properly handle Drag and Drop events, which allows remote user-assisted attackers to execute arbitr

    MediumCVSS 5.1Proof of conceptEPSS 48%

    microsoft · internet explorerJun 28, 2006

  • CVE-2006-3317
    25Monitor

    PHP remote file inclusion vulnerability in phpRaid 3.0.6 allows remote attackers to execute arbitrary code via a URL in the phpraid_dir para

    MediumCVSS 5.1Proof of conceptEPSS 17%

    spiffyjr · phpraidJun 29, 2006