Unscored severity · published Sep 6, 2006
CVE-2006-4546
Lyris ListManager 8.95 allows remote authenticated users, who have administrative privileges for at least one list on the server, to add new administrators to any list via a…
–
CVSS
1.4%
EPSS
No
On KEV
Description
Lyris ListManager 8.95 allows remote authenticated users, who have administrative privileges for at least one list on the server, to add new administrators to any list via a modified MEMBERS_.List_ parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LM
List Manager · Lyris
8.95 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-4546
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-4546
archives.neohapsis.com
http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0817.html
secunia.com
http://secunia.com/advisories/21698
securityreason.com
http://securityreason.com/securityalert/1502
securitytracker.com
http://securitytracker.com/id?1016771
www.securityfocus.com
http://www.securityfocus.com/archive/1/444844/100/0/threaded
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/28679
More from List Manager
–
CVE-2014-5188
Cross-site scripting (XSS) vulnerability in doemailpassword.tml in Lyris ListManager (LM) 8.95a allows remote attackers to inject arbitrary web script or HTML via the EmailAddr…
–
CVE-2008-2923
Cross-site scripting (XSS) vulnerability in read/search/results in Lyris ListManager 8.8, 8.95, and 9.3d allows remote attackers to inject arbitrary web script or HTML via the…
–
CVE-2007-6319
Multiple unspecified vulnerabilities in Lyris ListManager 8.x before 8.95d, 9.2 before 9.2c, and 9.3 before 9.3b allow remote attackers to (1) gain list administrator privileges…
–
CVE-2006-4547
Lyris ListManager 8.95 allows remote authenticated users to obtain sensitive information by attempting to add a user with a ' (single quote) character in the name, which reveals…
–
CVE-2005-4144
Lyris ListManager 5.0 through 8.9a allows remote attackers to add "ORDER BY" columns to SQL queries via unusual whitespace characters in the orderby parameter, such as (1)…