CVSS: 7.2EPSS: 0%CPEs: 14EXPL: 0CVE-2006-4447
https://notcve.org/view.php?id=CVE-2006-4447
X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit. X.Org y XFree86, incluyendo libX11, xdm, xf86dga, xinit, xload, xtrans, y xterm, no comprueban los valores de retorno de las llamadas a setuid y seteuid al intentar eliminar privilegios, lo cual permite a usuarios locales obtener privilegios haciendo fallar estas llamadas, como por ejemplo excediendo un ulimit. • http://lists.freedesktop.org/archives/xorg/2006-June/016146.html http://mail.gnome.org/archives/beast/2006-December/msg00025.html http://secunia.com/advisories/21650 http://secunia.com/advisories/21660 http://secunia.com/advisories/21693 http://secunia.com/advisories/22332 http://secunia.com/advisories/25032 http://secunia.com/advisories/25059 http://security.gentoo.org/glsa/glsa-200608-25.xml http://security.gentoo.org/glsa/glsa-200704-22.xml http://www.debian.org/securit •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 2CVE-2006-3950
https://notcve.org/view.php?id=CVE-2006-3950
SQL injection vulnerability in x-statistics.php in X-Scripts X-Statistics 1.20 allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header. Vulnerabilidad de inyección SQL en x-statistics.php en X-Scripts X-Statistics 1.20 permite a atacantes remotos ejecutar comandos SQL a través de la cabecera HTTP User-Agent. • http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0722.html http://secunia.com/advisories/21281 http://www.osvdb.org/27636 http://www.securityfocus.com/bid/19237 http://www.vupen.com/english/advisories/2006/3059 https://exchange.xforce.ibmcloud.com/vulnerabilities/28087 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3CVE-2006-3959 – X-Scripts X-Protection 1.10 - 'Protect.php' SQL Injection
https://notcve.org/view.php?id=CVE-2006-3959
SQL injection vulnerability in protect.php in X-Scripts X-Protection 1.10, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameter. Vulnerabilidad de inyección SQL en protect.php en X-Scripts X-Protection 1.10, con magic_quotes_gpc desactivado, permite a atacanets remotos ejecutar comandos SQL de su elecciòn a través de los parámetros (1) username y (2) password. • https://www.exploit-db.com/exploits/28303 http://downloads.securityfocus.com/vulnerabilities/exploits/x-protection_poc.txt http://secunia.com/advisories/21282 http://www.osvdb.org/27635 http://www.securityfocus.com/bid/19235 http://www.vupen.com/english/advisories/2006/3060 https://exchange.xforce.ibmcloud.com/vulnerabilities/28088 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3CVE-2006-3960 – X-Scripts X-Poll 1.10 - 'top.php' SQL Injection
https://notcve.org/view.php?id=CVE-2006-3960
SQL injection vulnerability in top.php in X-Scripts X-Poll, probably 2.30, allows remote attackers to execute arbitrary SQL commands via the poll parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information. Vulnerabilidad de inyección SQL en top.phpn en X-Scripts X-Poll, posiblemente 2.30, permite a atacantes remotos ejecutar comandos SQL de su elección a tracés del parámetro poll. NOTA: la procedencia de esta información es desconocida; los detalles han sido obtenidos a partir de la información de terceros. • https://www.exploit-db.com/exploits/28304 http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0720.html http://downloads.securityfocus.com/vulnerabilities/exploits/x-poll_poc.txt http://secunia.com/advisories/21283 http://www.osvdb.org/27634 http://www.securityfocus.com/bid/19236 http://www.vupen.com/english/advisories/2006/3070 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 1CVE-2006-2281
https://notcve.org/view.php?id=CVE-2006-2281
X-Scripts X-Poll (xpoll) 2.30 allows remote attackers to execute arbitrary PHP code by using admin/images/add.php to upload a PHP file, then access it. • http://attrition.org/pipermail/vim/2006-May/000752.html http://secunia.com/advisories/20057 http://securityreason.com/securityalert/872 http://www.securityfocus.com/archive/1/433220/100/0/threaded http://www.securityfocus.com/bid/17901 http://www.vupen.com/english/advisories/2006/1732 https://exchange.xforce.ibmcloud.com/vulnerabilities/26363 • CWE-94: Improper Control of Generation of Code ('Code Injection') •