Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2006

48 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2006-5112
    50Plan

    Buffer overflow in InterVations NaviCOPA Web Server 2.01 allows remote attackers to execute arbitrary code via a long HTTP GET request.

    HighCVSS 7.5WeaponizedEPSS 66%

    intervations · navicopa web serverOct 3, 2006

  • CVE-2006-5152
    30Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer allows remote attackers to inject arbitrary web script or HTML via a

    MediumCVSS 6.8No exploitEPSS 10%

    microsoft · internet explorerOct 5, 2006

  • CVE-2006-5156
    62This week

    Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot before 1.1.1.126 allows remote attackers to execute arbi

    CriticalCVSS 10.0WeaponizedEPSS 74%

    mcafee · epolicy orchestratorOct 5, 2006

  • CVE-2006-5162
    31Monitor

    wininet.dll in Microsoft Internet Explorer 6.0 SP2 and earlier allows remote attackers to cause a denial of service (unhandled exception and

    MediumCVSS 5.0Proof of conceptEPSS 36%

    microsoft · internet explorerOct 5, 2006

  • CVE-2006-4812
    46Plan

    Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserializ

    CriticalCVSS 10.0Proof of conceptEPSS 20%

    php · phpOct 10, 2006

  • CVE-2006-5142
    34Monitor

    Stack-based buffer overflow in CA BrightStor ARCserve Backup R11.5 client and server allows remote attackers to execute arbitrary code via l

    HighCVSS 7.5No exploitEPSS 13%

    broadcom · brightstor arcserve backupOct 10, 2006

  • CVE-2006-5143
    54Plan

    Multiple buffer overflows in CA BrightStor ARCserve Backup r11.5 SP1 and earlier, r11.1, and 9.01; BrightStor ARCserve Backup for Windows r1

    HighCVSS 7.5WeaponizedEPSS 79%

    ca · brightstor arcserve backupOct 10, 2006

  • CVE-2006-5205
    23Monitor

    Directory traversal vulnerability in Invision Gallery 2.0.7 allows remote attackers to read arbitrary files via a ..

    MediumCVSS 5.0Proof of conceptEPSS 10%

    invision power services · invision galleryOct 10, 2006

  • CVE-2006-5216
    49Plan

    Stack-based buffer overflow in Sergey Lyubka Simple HTTPD (shttpd) 1.34 allows remote attackers to execute arbitrary code via a long URI.

    HighCVSS 7.5WeaponizedEPSS 63%

    sergey lyubka · simple httpdOct 10, 2006

  • CVE-2006-5220
    24Monitor

    Multiple PHP remote file inclusion vulnerabilities in WebYep 1.1.9, when register_globals is enabled, allow remote attackers to execute arbi

    MediumCVSS 5.1Proof of conceptEPSS 14%

    objective development · webyepOct 10, 2006

  • CVE-2006-3435
    48Plan

    PowerPoint in Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac does not properly parse the slide notes field in a document, wh

    CriticalCVSS 9.3No exploitEPSS 37%

    microsoft · officeOct 10, 2006

  • CVE-2006-3436
    29Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft .NET Framework 2.0 allows remote attackers to inject arbitrary web script or HTML via

    MediumCVSS 4.3No exploitEPSS 38%

    microsoft · .net frameworkOct 10, 2006

  • CVE-2006-3876
    40Plan

    Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allo

    CriticalCVSS 9.3No exploitEPSS 11%

    microsoft · officeOct 10, 2006

  • CVE-2006-2387
    24Monitor

    Unspecified vulnerability in Microsoft Excel 2000, 2002, 2003, 2004 for Mac, v.X for Mac, Excel Viewer 2003, and Microsoft Works Suite 2004

    MediumCVSS 5.1No exploitEPSS 12%

    microsoft · officeOct 10, 2006

  • CVE-2006-3434
    46Plan

    Unspecified vulnerability in Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac allows remote user-assisted attackers to execute

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · officeOct 10, 2006

  • CVE-2006-3647
    45Plan

    Integer overflow in Microsoft Word 2000, 2002, 2003, 2004 for Mac, and v.X for Mac allows remote user-assisted attackers to execute arbitrar

    CriticalCVSS 9.3No exploitEPSS 26%

    microsoft · officeOct 10, 2006

  • CVE-2006-3650
    49Plan

    Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac do not properly parse the length of a chart record, which allows remote user-

    CriticalCVSS 9.3No exploitEPSS 38%

    microsoft · officeOct 10, 2006

  • CVE-2006-3651
    46Plan

    Unspecified vulnerability in Microsoft Word 2000, 2002, and Office 2003 allows remote user-assisted attackers to execute arbitrary code via

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · officeOct 10, 2006

  • CVE-2006-3864
    47Plan

    Unspecified vulnerability in mso.dll in Microsoft Office 2000, XP, and 2003, and Microsoft PowerPoint 2000, XP, and 2003, allows remote user

    CriticalCVSS 9.3No exploitEPSS 33%

    microsoft · officeOct 10, 2006

  • CVE-2006-3868
    27Monitor

    Unspecified vulnerability in Microsoft Office XP and 2003 allows remote user-assisted attackers to execute arbitrary code via a malformed Sm

    MediumCVSS 5.1No exploitEPSS 24%

    microsoft · officeOct 10, 2006

  • CVE-2006-3877
    41Plan

    Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allo

    CriticalCVSS 9.3No exploitEPSS 13%

    microsoft · accessOct 10, 2006

  • CVE-2006-4685
    16Monitor

    The XMLHTTP ActiveX control in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 does not properly handle HTTP server-side redi

    LowCVSS 2.6No exploitEPSS 20%

    microsoft · xml core servicesOct 10, 2006

  • CVE-2006-4686
    39Monitor

    Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.

    HighCVSS 7.5No exploitEPSS 30%

    microsoft · xml core servicesOct 10, 2006

  • CVE-2006-4692
    29Monitor

    Argument injection vulnerability in the Windows Object Packager (packager.exe) in Microsoft Windows XP SP1 and SP2 and Server 2003 SP1 and e

    MediumCVSS 5.1No exploitEPSS 29%

    microsoft · windows server 2003Oct 10, 2006

  • CVE-2006-4693
    44Plan

    Unspecified vulnerability in Microsoft Word 2004 for Mac and v.X for Mac allows remote user-assisted attackers to execute arbitrary code via

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · officeOct 10, 2006

  • CVE-2006-4696
    49Plan

    Unspecified vulnerability in the Server service in Microsoft Windows 2000 SP4, Server 2003 SP1 and earlier, and XP SP2 and earlier allows re

    CriticalCVSS 9.0No exploitEPSS 43%

    microsoft · windows 2000Oct 10, 2006

  • CVE-2006-5229
    40Plan

    OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote atta

    LowCVSS 2.6WeaponizedEPSS 58%

    openbsd · opensshOct 10, 2006

  • CVE-2006-4842
    40Plan

    The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in Sun Solaris 10, trusts user-specified environment variables for specify

    LowCVSS 3.6WeaponizedEPSS 7%

    netscape · portable runtime apiOct 11, 2006

  • CVE-2006-4154
    32Monitor

    Format string vulnerability in the mod_tcl module 1.0 for Apache 2.x allows context-dependent attackers to execute arbitrary code via format

    MediumCVSS 6.8No exploitEPSS 16%

    apache · http serverOct 16, 2006

  • CVE-2006-5296
    25Monitor

    PowerPoint in Microsoft Office 2003 does not properly handle a container object whose position value exceeds the record length, which allows

    MediumCVSS 4.3Proof of conceptEPSS 26%

    microsoft · powerpointOct 16, 2006

  • CVE-2006-4182
    36Monitor

    Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanni

    HighCVSS 7.5Proof of conceptEPSS 21%

    clam anti-virus · clamavOct 16, 2006

  • CVE-2006-5295
    23Monitor

    Unspecified vulnerability in ClamAV before 0.88.5 allows remote attackers to cause a denial of service (scanning service crash) via a crafte

    MediumCVSS 5.0Proof of conceptEPSS 11%

    clam anti-virus · clamavOct 16, 2006

  • CVE-2006-5302
    35Monitor

    Multiple PHP remote file inclusion vulnerabilities in Redaction System 1.0000 allow remote attackers to execute arbitrary PHP code via a URL

    HighCVSS 7.5Proof of conceptEPSS 15%

    redaction system · redaction systemOct 17, 2006

  • CVE-2006-5330
    27Monitor

    CRLF injection vulnerability in Adobe Flash Player plugin 9.0.16 and earlier for Windows, 7.0.63 and earlier for Linux, 7.x before 7.0 r67 f

    MediumCVSS 5.0No exploitEPSS 24%

    adobe · flash playerOct 17, 2006

  • CVE-2006-5379
    38Monitor

    The accelerated rendering functionality of NVIDIA Binary Graphics Driver (binary blob driver) For Linux v8774 and v8762, and probably on oth

    HighCVSS 7.5Proof of conceptEPSS 27%

    nvidia · binary graphics driverOct 18, 2006

  • CVE-2006-5392
    35Monitor

    Multiple PHP remote file inclusion vulnerabilities in OpenDock FullCore 4.4 and earlier allow remote attackers to execute arbitrary PHP code

    HighCVSS 7.5Proof of conceptEPSS 16%

    opendoc · fullcoreOct 18, 2006

  • CVE-2006-5444
    56Plan

    Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2

    HighCVSS 7.5Proof of conceptEPSS 86%

    digium · asteriskOct 23, 2006

  • CVE-2006-5448
    34Monitor

    The drmstor.dll ActiveX object in Microsoft Windows Digital Rights Management System (DRM) allows remote attackers to cause a denial of serv

    HighCVSS 7.5No exploitEPSS 12%

    microsoft · windows digital rights managementOct 23, 2006

  • CVE-2006-5478
    56Plan

    Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e F

    HighCVSS 7.5WeaponizedEPSS 85%

    novell · edirectoryOct 24, 2006

  • CVE-2006-5506
    35Monitor

    Multiple PHP remote file inclusion vulnerabilities in WiClear 0.10 allow remote attackers to execute arbitrary PHP code via the path paramet

    HighCVSS 7.5Proof of conceptEPSS 16%

    wiclear · wiclearOct 25, 2006

  • CVE-2006-5517
    34Monitor

    Multiple PHP remote file inclusion vulnerabilities in Rhode Island Open Meetings Filing Application (OMFA) allow remote attackers to execute

    HighCVSS 7.5Proof of conceptEPSS 14%

    rhode island secretary of state · open meetings filing systemOct 26, 2006

  • CVE-2006-5518
    33Monitor

    Multiple PHP remote file inclusion vulnerabilities in Christopher Fowler (Rhode Island) RSSonate allow remote attackers to execute arbitrary

    HighCVSS 7.5Proof of conceptEPSS 10%

    christopher fowler · rssonateOct 26, 2006

  • CVE-2006-5536
    24Monitor

    Directory traversal vulnerability in cgi-bin/webcm in D-Link DSL-G624T firmware 3.00B01T01.YA-C.20060616 allows remote attackers to read arb

    MediumCVSS 5.0Proof of conceptEPSS 13%

    d-link · dsl-g624tOct 26, 2006

  • CVE-2006-5544
    31Monitor

    Visual truncation vulnerability in Microsoft Internet Explorer 7 allows remote attackers to spoof the address bar and possibly conduct phish

    MediumCVSS 6.4No exploitEPSS 20%

    microsoft · ieOct 26, 2006

  • CVE-2006-5559
    50Plan

    The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Micros

    CriticalCVSS 9.3Proof of conceptEPSS 43%

    microsoft · windows 2000Oct 27, 2006

  • CVE-2006-5567
    41Plan

    Multiple heap-based buffer overflows in AOL Nullsoft WinAmp before 5.31 allow user-assisted remote attackers to execute arbitrary code via a

    CriticalCVSS 9.3Proof of conceptEPSS 14%

    nullsoft · winampOct 27, 2006

  • CVE-2006-5614
    40Plan

    Microsoft Windows NAT Helper Components (ipnathlp.dll) on Windows XP SP2, when Internet Connection Sharing is enabled, allows remote attacke

    LowCVSS 2.6WeaponizedEPSS 79%

    microsoft · windows nt helper componentsOct 30, 2006

  • CVE-2006-5627
    35Monitor

    Multiple PHP remote file inclusion vulnerabilities in QnECMS 2.5.6 and earlier allow remote attackers to execute arbitrary PHP code via a UR

    HighCVSS 7.5Proof of conceptEPSS 17%

    qnecms · qnecmsOct 31, 2006