CVE-2006-0949

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

RaidenHTTPD 1.1.47 allows remote attackers to obtain source code of script files, including PHP, via crafted requests involving (1) "." (dot), (2) space, and (3) "/" (slash) characters.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/19032Patch, Vendor Advisory
http://secunia.com/secunia_research/2006-15/advisory/Patch, Vendor Advisory
http://www.osvdb.org/23616Patch, Vendor Advisory
http://www.securityfocus.com/bid/16934
http://www.vupen.com/english/advisories/2006/0807
https://exchange.xforce.ibmcloud.com/vulnerabilities/25037
http://secunia.com/advisories/19032Patch, Vendor Advisory
http://secunia.com/secunia_research/2006-15/advisory/Patch, Vendor Advisory
http://www.osvdb.org/23616Patch, Vendor Advisory
http://www.securityfocus.com/bid/16934
http://www.vupen.com/english/advisories/2006/0807
https://exchange.xforce.ibmcloud.com/vulnerabilities/25037

Timeline

Published: Mar 6, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-09502.6unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." (dot dot) sequences in a filename.CVE-2006-09517.2The GUI (nod32.exe) in NOD32 2.5 runs with SYSTEM privileges when the scheduler runs a scheduled on-demand scan, which allows local users to CVE-2006-09561.7nuauth in NuFW before 1.0.21 does not properly handle blocking TLS sockets, which allows remote authenticated users to cause a denial of ser CVE-2006-09577.5Direct static code injection vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to execute arbitrary CVE-2006-09584.3Cross-site scripting (XSS) vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to inject arbitrary we CVE-2006-09597.5SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote attackers to execute CVE-2006-09605.0uConfig agent in Compex NetPassage WPE54G router allows remote attackers to cause a denial of service (unresposiveness) via crafted datagram CVE-2006-09617.5SQL injection vulnerability in yazdir.asp in Cilem Hiber 1.1 allows remote attackers to execute arbitrary SQL commands via the haber_id para CVE-2006-09627.5SQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the pass parameter in a cookie.CVE-2006-09634.6Multiple buffer overflows in STLport 5.0.2 might allow local users to execute arbitrary code via (1) long locale environment variables to a CVE-2006-09644.6Client Firewall in NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to bypass firewal CVE-2006-09654.6NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to bypass security protections and c