CVE-2006-2481

VMware ESX Server 2.0.x before 2.0.2 and 2.x before 2.5.2 patch 4 stores authentication credentials in base 64 encoded format in the vmware.mui.kid and vmware.mui.sid cookies, which allows attackers to gain privileges by obtaining the cookies using attacks such as cross-site scripting (CVE-2005-3619).

• CWE-255

• http://kb.vmware.com/kb/2118366
• http://secunia.com/advisories/21230Vendor Advisory
• http://www.corsaire.com/advisories/c060512-001.txtVendor Advisory
• http://www.securityfocus.com/archive/1/441728/100/100/threaded
• http://www.securityfocus.com/archive/1/441825/100/100/threaded
• http://www.securityfocus.com/bid/19249
• http://www.vupen.com/english/advisories/2006/3075Vendor Advisory
• http://kb.vmware.com/kb/2118366
• http://secunia.com/advisories/21230Vendor Advisory
• http://www.corsaire.com/advisories/c060512-001.txtVendor Advisory
• http://www.securityfocus.com/archive/1/441728/100/100/threaded
• http://www.securityfocus.com/archive/1/441825/100/100/threaded
• http://www.securityfocus.com/bid/19249
• http://www.vupen.com/english/advisories/2006/3075Vendor Advisory

Published

Jul 31, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-2475Directory traversal vulnerability in (1) edit_mailtexte.cgi …
• CVE-2006-2476Bitrix Site Manager 4.1.x stores updater.log under the web d…
• CVE-2006-2477Cross-site scripting (XSS) vulnerability in the administrati…
• CVE-2006-2478Bitrix Site Manager 4.1.x allows remote attackers to redirec…
• CVE-2006-2479The Update functionality in Bitrix Site Manager 4.1.x does n…
• CVE-2006-2480Format string vulnerability in Dia 0.94 allows user-assisted…
• CVE-2006-2482Heap-based buffer overflow in the TZipTV component in (1) Zi…
• CVE-2006-2483PHP remote file inclusion vulnerability in cart_content.php …
• CVE-2006-2484Cross-site scripting (XSS) vulnerability in index.html in Ic…
• CVE-2006-2485PHP remote file inclusion vulnerability in includes/class_te…
• CVE-2006-2486SQL injection vulnerability in find.php in YapBB 1.2 Beta2 a…
• CVE-2006-2487Multiple PHP remote file inclusion vulnerabilities in ScozNe…