CVSS: 7.5EPSS: 23%CPEs: 9EXPL: 0CVE-2006-6499
https://notcve.org/view.php?id=CVE-2006-6499
20 Dec 2006 — The js_dtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 overwrites memory instead of exiting when the floating point precision is reduced, which allows remote attackers to cause a denial of service via any plugins that reduce the precision. La función js_dtoa en Mozilla Firefox 2.x anterior a 2.0.0.1, 1.5.x anterior a 1.5.0.9, Thunderbird anterior a 1.5.0.9, y SeaMonkey anterior a 1.0.7 sobrescribe memoria en lugar de salir cua... • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 9.8EPSS: 36%CPEs: 9EXPL: 0CVE-2006-6500
https://notcve.org/view.php?id=CVE-2006-6500
20 Dec 2006 — Heap-based buffer overflow in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by setting the CSS cursor to certain images that cause an incorrect size calculation when converting to a Windows bitmap. Desbordamiento de búfer basado en pila en Mozilla Firefox 2.x anterior a 2.0.0.1, 1.5.x anterior a 1.5.0.9, Thunderbird anterior a 1.5.0.9, y SeaMonke... • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.1EPSS: 28%CPEs: 9EXPL: 0CVE-2006-6501
https://notcve.org/view.php?id=CVE-2006-6501
20 Dec 2006 — Unspecified vulnerability in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to gain privileges and install malicious code via the watch Javascript function. Vulnerabilidad no especificada en Mozilla Firefox 2.x anterior a 2.0.0.1, 1.5.x anterior a 1.5.0.9, Thunderbird anterior a 1.5.0.9, y SeaMonkey anterior a 1.0.7 permite a atacantes remotos obtener privilegios e instalar código malicioso mediante la función watch de... • ftp://patches.sgi.com/support/free/security/advisories/20061202-01-P.asc • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 25%CPEs: 9EXPL: 0CVE-2006-6503
https://notcve.org/view.php?id=CVE-2006-6503
20 Dec 2006 — Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to bypass cross-site scripting (XSS) protection by changing the src attribute of an IMG element to a javascript: URI. Mozilla Firefox 2.x anterior a 2.0.0.1, 1.5.x anterior a 1.5.0.9, Thunderbird anterior a 1.5.0.9, y SeaMonkey anterior a 1.0.7 permite a atacantes remotos evitar la protección de secuencias de comandos en sitios cruzados (XSS) cambiando el atributo src de u... • ftp://patches.sgi.com/support/free/security/advisories/20061202-01-P.asc • CWE-254: 7PK - Security Features •
CVSS: 9.1EPSS: 0%CPEs: 15EXPL: 1CVE-2006-6614
https://notcve.org/view.php?id=CVE-2006-6614
18 Dec 2006 — The save_log_local function in Fully Automatic Installation (FAI) 2.10.1, and possibly 3.1.2, when verbose mode is enabled, stores the root password hash in /var/log/fai/current/fai.log, whose file permissions allow it to be copied to other hosts when fai-savelog is called and allows attackers to obtain the hash. La función save_log_local en Fully Automatic Installation (FAI) 2.10.1, y posiblemente 3.1.2, cuando el modo verbose está activado, almacena el hash de la contraseña de root en /var/log/fai/current... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=402644 •
CVSS: 7.8EPSS: 1%CPEs: 4EXPL: 0CVE-2006-5873
https://notcve.org/view.php?id=CVE-2006-5873
12 Dec 2006 — Buffer overflow in the cluster_process_heartbeat function in cluster.c in layer 2 tunneling protocol network server (l2tpns) before 2.1.21 allows remote attackers to cause a denial of service via a large heartbeat packet. Desbordamiento de búfer en la función cluster_process_heartbeat en cluster.c del layer 2 tunneling protocol network server (l2tpns) anterior a 2.1.21 permite a atacantes remotos provocar una denegación de servicio mediante un paquete de pulso (heartbeat packet) largo. • http://l2tpns.cvs.sourceforge.net/l2tpns/l2tpns/cluster.c?r1=1.53&r2=1.54 •
CVSS: 9.3EPSS: 1%CPEs: 6EXPL: 0CVE-2006-5868 – Insufficient boundary check in ImageMagick's SGIDecode()
https://notcve.org/view.php?id=CVE-2006-5868
22 Nov 2006 — Multiple buffer overflows in Imagemagick 6.0 before 6.0.6.2, and 6.2 before 6.2.4.5, has unknown impact and user-assisted attack vectors via a crafted SGI image. Múltiples desbordamientos de búfer en Imagemagick 6.0 anterior a 6.0.6.2, y 6.2 anterior a 6.2.4.5, tiene un impacto desconocido y vectores de ataque con la complicidad del usuario a través de una imagen SGI manipulada. • ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc •
CVSS: 9.8EPSS: 2%CPEs: 10EXPL: 0CVE-2006-5170
https://notcve.org/view.php?id=CVE-2006-5170
04 Oct 2006 — pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver. pam_ldap en nss_ldap sobre Red Hat Enterprise Linux 4, Fedora Core 3 y anteriores, y posiblemente otras distribuciones no devuelven un... • http://bugzilla.padl.com/show_bug.cgi?id=291 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.5EPSS: 25%CPEs: 20EXPL: 2CVE-2006-4343 – OpenSSL SSLv2 - Null Pointer Dereference Client Denial of Service
https://notcve.org/view.php?id=CVE-2006-4343
28 Sep 2006 — The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference. La función get_server_hello código del cliente SSLv2 en OpenSSL 0.9.7 anterior a 0.9.7l, 0.9.8 anterior a 0.9.8d, y versiones anteriores permite a servidores remotos provocar una denegación de servicio (caída del cliente) mediante vectores desconocidos que... • https://www.exploit-db.com/exploits/28726 • CWE-476: NULL Pointer Dereference •
CVSS: 9.3EPSS: 1%CPEs: 6EXPL: 4CVE-2006-5051 – unsafe GSSAPI signal handler
https://notcve.org/view.php?id=CVE-2006-5051
27 Sep 2006 — Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free. Condición de carrera en el manejador de señal OpenSSH en versiones anteriores a 4.4 permite a atacantes remotos provocar una denegación de servicio (caída) y posiblemente ejecutar código arbitrario si la autenticación GSSAPI está habilitada, a través de vectores no especif... • https://github.com/bigb0x/CVE-2024-6387 • CWE-415: Double Free •