{"api_version":"1","generated_at":"2026-07-23T11:35:25+00:00","cve":"CVE-2006-4127","urls":{"html":"https://cve.report/CVE-2006-4127","api":"https://cve.report/api/cve/CVE-2006-4127.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-4127","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-4127"},"summary":{"title":"CVE-2006-4127","description":"Multiple format string vulnerabilities in DConnect Daemon 0.7.0 and earlier allow remote administrators to execute arbitrary code via format string specifiers that are not properly handled when calling the (1) privmsg() or (2) pubmsg functions from (a) cmd.user.c, (b) penalties.c, or (c) cmd.dc.c.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2006-08-14 23:04:00","updated_at":"2018-10-17 21:33:00"},"problem_types":["NVD-CWE-Other"],"metrics":[],"references":[{"url":"http://secunia.com/advisories/21384","name":"21384","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"Secunia - Advisories - DConnect Daemon Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1016641","name":"1016641","refsource":"SECTRACK","tags":["Exploit"],"title":"SecurityTracker.com Archives - DConnect Daemon Format String and Buffer Overflow Flaws Let Remote Users Deny Service or Execute Arbitrary Code","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/1377","name":"1377","refsource":"SREASON","tags":[],"title":"SecurityReason - Multiple vulnerabilities in DConnect Daemon 0.7.0 (CVS 30 Jul 2006)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.dc.ds.pg.gda.pl/?page=doc&doc=changelog","name":"http://www.dc.ds.pg.gda.pl/?page=doc&doc=changelog","refsource":"CONFIRM","tags":[],"title":"","mime":"application/octet-stream","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/3181","name":"ADV-2006-3181","refsource":"VUPEN","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.dc.ds.pg.gda.pl/","name":"http://www.dc.ds.pg.gda.pl/","refsource":"CONFIRM","tags":["Patch"],"title":"DConnect Daemon","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28280","name":"dconnect-daemon-privmsg-pubmsg-format-string(28280)","refsource":"XF","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/19371","name":"19371","refsource":"BID","tags":["Exploit","Patch"],"title":"DConnect Daemon Multiple Format String Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securityfocus.com/archive/1/442440/100/0/threaded","name":"20060806 Multiple vulnerabilities in DConnect Daemon 0.7.0 (CVS 30 Jul 2006)","refsource":"BUGTRAQ","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-4127","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-4127","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"4127","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"dconnect","cpe5":"dconnect_daemon","cpe6":"0.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4127","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"dconnect","cpe5":"dconnect_daemon","cpe6":"0.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4127","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"dconnect","cpe5":"dconnect_daemon","cpe6":"0.7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4127","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"dconnect","cpe5":"dconnect_daemon","cpe6":"0.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4127","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"dconnect","cpe5":"dconnect_daemon","cpe6":"0.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4127","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"dconnect","cpe5":"dconnect_daemon","cpe6":"0.7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-4127","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple format string vulnerabilities in DConnect Daemon 0.7.0 and earlier allow remote administrators to execute arbitrary code via format string specifiers that are not properly handled when calling the (1) privmsg() or (2) pubmsg functions from (a) cmd.user.c, (b) penalties.c, or (c) cmd.dc.c."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20060806 Multiple vulnerabilities in DConnect Daemon 0.7.0 (CVS 30 Jul 2006)","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/442440/100/0/threaded"},{"name":"ADV-2006-3181","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/3181"},{"name":"dconnect-daemon-privmsg-pubmsg-format-string(28280)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28280"},{"name":"21384","refsource":"SECUNIA","url":"http://secunia.com/advisories/21384"},{"name":"1377","refsource":"SREASON","url":"http://securityreason.com/securityalert/1377"},{"name":"http://www.dc.ds.pg.gda.pl/","refsource":"CONFIRM","url":"http://www.dc.ds.pg.gda.pl/"},{"name":"1016641","refsource":"SECTRACK","url":"http://securitytracker.com/id?1016641"},{"name":"19371","refsource":"BID","url":"http://www.securityfocus.com/bid/19371"},{"name":"http://www.dc.ds.pg.gda.pl/?page=doc&doc=changelog","refsource":"CONFIRM","url":"http://www.dc.ds.pg.gda.pl/?page=doc&doc=changelog"}]}},"nvd":{"publishedDate":"2006-08-14 23:04:00","lastModifiedDate":"2018-10-17 21:33:00","problem_types":["NVD-CWE-Other"],"metrics":{"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:H/Au:S/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":4.6},"severity":"MEDIUM","exploitabilityScore":3.9,"impactScore":6.4,"obtainAllPrivilege":false,"obtainUserPrivilege":true,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:dconnect:dconnect_daemon:0.0.2:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:dconnect:dconnect_daemon:0.0.3:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:dconnect:dconnect_daemon:0.7.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"4127","Ordinal":"19453","Title":"CVE-2006-4127","CVE":"CVE-2006-4127","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"4127","Ordinal":"1","NoteData":"Multiple format string vulnerabilities in DConnect Daemon 0.7.0 and earlier allow remote administrators to execute arbitrary code via format string specifiers that are not properly handled when calling the (1) privmsg() or (2) pubmsg functions from (a) cmd.user.c, (b) penalties.c, or (c) cmd.dc.c.","Type":"Description","Title":null},{"CveYear":"2006","CveId":"4127","Ordinal":"2","NoteData":"2006-08-14","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"4127","Ordinal":"3","NoteData":"2018-10-17","Type":"Other","Title":"Modified"}]}}}