CVE-2006-2711

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Secure Elements Class 5 AVR (aka C5 EVM) 2.8.1 and earlier, and possibly later 2.8.x releases, uses the same initialization vector and key for each message session, which allows remote attackers to obtain potentially sensitive information about messages.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/20377
http://securitytracker.com/id?1016184
http://www.kb.cert.org/vuls/id/346377Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/WDON-6QAQN6
http://www.vupen.com/english/advisories/2006/2068
https://exchange.xforce.ibmcloud.com/vulnerabilities/26740
http://secunia.com/advisories/20377
http://securitytracker.com/id?1016184
http://www.kb.cert.org/vuls/id/346377Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/WDON-6QAQN6
http://www.vupen.com/english/advisories/2006/2068
https://exchange.xforce.ibmcloud.com/vulnerabilities/26740

Timeline

Published: May 31, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-27125.0Secure Elements Class 5 AVR (aka C5 EVM) client and server before 2.8.1 do not verify the integrity of a message digest, which allows remote CVE-2006-27135.0Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 generates predictable CEIDs, which allows remote attackers to determine the CEI CVE-2006-27145.0Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 does not validate the CEID of an incoming message, which allows remote attacker CVE-2006-27157.5The Administration Console in Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 does not enforce access control, which allows remote att CVE-2006-27167.5Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 uses a hard-coded user ID and password, which allows remote attackers to gain a CVE-2006-27174.0Unspecified vulnerability in Secure Elements Class 5 AVR client and server (aka C5 EVM) before 2.8.1 allows authenticated attackers to overw CVE-2006-27186.5JIWA Financials 6.4.14 passes a Microsoft SQL Server account's username and password, and the name of a data source, to a Crystal Reports .r CVE-2006-27194.9JIWA Financials 6.4.14 stores usernames and passwords for all accounts in cleartext in the HR_Staff table in Microsoft SQL Server, and sends CVE-2006-27207.5SQL injection vulnerability in news.php in VARIOMAT allows remote attackers to execute arbitrary SQL commands via the subcat parameter.CVE-2006-27216.8Cross-site scripting (XSS) vulnerability in news.php in VARIOMAT allows remote attackers to inject arbitrary HTML or web script via the subc CVE-2006-27227.5SQL injection vulnerability in view_album.php in SelectaPix 1.4 allows remote attackers to execute arbitrary SQL commands via unknown vector CVE-2006-27235.0Unspecified versions of Mozilla Firefox allow remote attackers to cause a denial of service (crash) via a web page that contains a large num