Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2006-0120
Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (application crash) via multiple vectors, involving (1) a malformed message sent to an "Out Of Office" agent (SPR LPEE6DMQWJ), (2) the compact command (RTIN5U2SAJ), (3) malformed bitmap images (MYAA6FH5HW), (4) the "Delete Attachment" action (YPHG6844LD), (5) parsing certificates from a remote Certificate Table (AELE6DZFJW), and (6) creating a SSL key ring with the Domino Administration client (NSUA4FQPTN).
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/4118a1f266afb26c852570e4001baf5e?OpenDocument'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/ad0dd14aa109f96b852570e4001bb08c?OpenDocument'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/5f166a44ee743b2c852570e4001baf31?OpenDocument'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/040482aeb1416bb7852570e4001badd6?OpenDocument'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg27007054'}, {'name': 'lotus-outofoffice-dos(24212)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24212'}, {'name': 'lotus-bmp-dos(24214)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24214'}, {'name': '16158', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16158'}, {'name': 'lotus-compact-dos(24213)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24213'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/2bb4f466a9e986ae852570e4001babbb?OpenDocument'}, {'name': 'lotus-delete-attachment-dos(24215)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24215'}, {'name': 'lotus-certificate-parsing-dos(24216)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24216'}, {'name': 'lotus-ssl-keyring-dos(24217)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24217'}, {'name': '18328', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18328'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/258394eaa824f2c08525708a004209d3?OpenDocument'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-10.lotus.com/ldd/r5fixlist.nsf/e7dbb5aee9a94c56852570c90056a95d/ced5f873baea4e8b852570e4001baa6d?OpenDocument'}, {'name': 'ADV-2006-0081', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0081'}]
CVE State: PUBLISHED
Explain CVE-2006-0121
Multiple memory leaks in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (memory consumption and crash) via unknown vectors related to (1) unspecified vectors during the SSL handshake (SPR# MKIN67MQVW), (2) the stash file during the SSL handshake (SPR# MKIN693QUT), and possibly other vectors. NOTE: due to insufficient information in the original vendor advisory, it is not clear whether there is an attacker role in other memory leaks that are specified in the advisory.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg27007054'}, {'name': '16158', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16158'}, {'name': '18328', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18328'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/2221243535d88a2b8525701b00420cd6?OpenDocument&Highlight=0%2CMKIN693QUT'}, {'name': 'lotus-ssl-handshake-dos(24223)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24223'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-10.lotus.com/ldd/r5fixlist.nsf/5c087391999d06e7852569280062619d/20f66e356a76c90f8525702a00420e08?OpenDocument&Highlight=0%2CMKIN67MQVW'}, {'name': 'ADV-2006-0081', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0081'}]
CVE State: PUBLISHED
Explain CVE-2006-0122
Cross-site scripting (XSS) vulnerability in Public/Index.asp in Aquifer CMS allows remote attackers to inject arbitrary web script or HTML via the Keyword parameter.
Affected Products: n/a
References: [{'name': '20060124 vendor ack/fix: Aquifer CMS Index.asp Keyword Variable XSS (fwd)', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://attrition.org/pipermail/vim/2006-January/000509.html'}, {'name': '18326', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18326'}, {'name': 'ADV-2006-0074', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0074'}, {'tags': ['x_refsource_MISC'], 'url': 'http://osvdb.org/ref/22/22247-aquifer.txt'}, {'name': '16162', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16162'}, {'name': '22247', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22247'}]
CVE State: PUBLISHED
Explain CVE-2006-0123
Multiple SQL injection vulnerabilities in ADN Forum 1.0b allow remote attackers to execute arbitrary SQL commands via the (1) fid parameter in index.php and (2) pagid parameter in verpag.php, and possibly other vectors.
Affected Products: n/a
References: [{'name': '1015445', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015445'}, {'name': '22240', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22240'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/15/summary.html'}, {'name': '22241', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22241'}, {'name': 'ADV-2006-0077', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0077'}, {'name': '18300', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18300'}, {'name': '16157', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16157'}, {'name': '20060105 [eVuln] ADNForum Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/420990/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0124
Cross-site scripting (XSS) vulnerability in crear.php in ADN Forum 1.0b allows remote attackers to inject arbitrary web script or HTML via the titulo parameter, which is used by the "Topic name" field.
Affected Products: n/a
References: [{'name': '1015445', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015445'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/15/summary.html'}, {'name': 'ADV-2006-0077', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0077'}, {'name': '18300', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18300'}, {'name': '16157', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16157'}, {'name': '22242', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22242'}, {'name': '20060105 [eVuln] ADNForum Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/420990/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0125
Unspecified vulnerability in appserv/main.php in AppServ 2.4.5 allows remote attackers to include arbitrary files via the appserv_root parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  There is not enough detail from these third party sources to know whether this is directory traversal, remote file include, or another issue.
Affected Products: n/a
References: [{'name': '18163', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18163'}, {'name': 'ADV-2006-0053', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0053'}, {'name': '16166', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16166'}, {'name': '22228', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22228'}]
CVE State: PUBLISHED
Explain CVE-2006-0126
rxvt-unicode before 6.3, on certain platforms that use openpty and non-Unix pty devices such as Linux and most BSD platforms, does not maintain the intended permissions of tty devices, which allows local users to gain read and write access to the devices.
Affected Products: n/a
References: [{'name': '22223', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22223'}, {'name': '18301', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18301'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://dist.schmorp.de/rxvt-unicode/Changes'}, {'name': 'ADV-2006-0052', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0052'}]
CVE State: PUBLISHED
Explain CVE-2006-0127
Directory traversal vulnerability in the IMAP service of Rockliffe MailSite before 6.1.22.1 allows remote authenticated users to rename the folders of other users via a .. (dot dot) in the RENAME command.
Affected Products: n/a
References: [{'name': '20060104 Rockliffe Directory Transversal Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/040969.html'}, {'name': '22229', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22229'}, {'name': 'ADV-2006-0055', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0055'}, {'name': '20060105 Re: Rockliffe Directory Transversal Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041039.html'}, {'name': '18318', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18318'}, {'tags': ['x_refsource_MISC'], 'url': 'http://zur.homelinux.com/Advisories/RockliffeMailsiteDirTransveral.txt'}]
CVE State: PUBLISHED
Explain CVE-2006-0128
Buffer overflow in the IMAP service of Rockliffe MailSite before 6.1.22.1 allows remote attackers to have an unknown impact via unknown attack vectors.
Affected Products: n/a
References: [{'name': '20060104 Rockliffe Directory Transversal Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/040969.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://zur.homelinux.com/Advisories/RockliffeMailsiteDirTransveral.txt'}, {'name': 'rockliffe-imap-unspecified-bo(39991)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39991'}]
CVE State: PUBLISHED
Explain CVE-2006-0129
Mail Management Agent (MAILMA) (aka Mail Management Server) in Rockliffe MailSite 7.0.3.1 and earlier generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames via user requests to TCP port 106.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://zur.homelinux.com/Advisories/RockliffeMailsiteUserEnum.txt'}, {'name': 'ADV-2006-0055', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0055'}, {'name': '18318', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18318'}, {'name': '22230', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22230'}, {'name': '20060104 Rockliffe Mailsite User Enumeration Flaw', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/040970.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0130
Mail Management Agent (MAILMA) (aka Mail Management Server) in Rockliffe MailSite 7.0.3.1 and earlier allows remote attackers to attempt authentication with an unlimited number of user account names and passwords without denying connections, limiting the rate of connections, or locking out an account.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://zur.homelinux.com/Advisories/RockliffeMailsiteUserEnum.txt'}, {'name': '20060104 Rockliffe Mailsite User Enumeration Flaw', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/040970.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0131
boastMachine 3.1 allows remote attackers to obtain sensitive information via a direct request to (1) footer.php and (2) side_menu.php, which reveals the path in an error message.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://echo.or.id/adv/adv26-K-159-2006.txt'}, {'name': '20060105 [ECHO_ADV_25$2006] Full path disclosure on boastMachine v3.1', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/420969/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0132
Directory traversal vulnerability in webftp.php in SysCP WebFTP 1.2.6 and possibly earlier allows remote attackers to include and execute arbitrary local PHP scripts, and possibly read other types of files, via a .. (dot dot) and a trailing null in the webftp_language parameter.
Affected Products: n/a
References: [{'name': 'webftp-language-file-include(24018)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24018'}, {'name': '20060104 SysCP WebFTP local file inclusion vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/420973/100/0/threaded'}, {'name': '18355', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18355'}, {'name': '16175', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16175'}, {'name': 'ADV-2006-0090', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0090'}]
CVE State: PUBLISHED
Explain CVE-2006-0133
Multiple directory traversal vulnerabilities in AIX 5.3 ML03 allow local users to determine the existence of files and read partial contents of certain files via a .. (dot dot) in the argument to (1) getCommand.new (aka getCommand) and (2) getShell, a different vulnerability than CVE-2005-4273.
Affected Products: n/a
References: [{'name': '1015429', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015429'}, {'name': '16102', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16102'}, {'name': '16103', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16103'}, {'name': '20060101 [xfocus-SD-060101]AIX getCommand&getShell two vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/420589/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0134
Cross-site scripting (XSS) vulnerability in register.php in TheWebForum (twf) 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the www parameter.
Affected Products: n/a
References: [{'name': '1015450', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015450'}, {'name': '20060106 [eVuln] TheWebForum Script Insertion and Authentication Bypass', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421039/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/17/exploit.html'}, {'name': 'ADV-2006-0093', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0093'}, {'name': '18392', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18392'}, {'name': '16161', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16161'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/17/summary.html'}, {'name': 'thewebforum-register-xss(24007)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24007'}, {'name': '22295', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22295'}]
CVE State: PUBLISHED
Explain CVE-2006-0135
SQL injection vulnerability in login.php in TheWebForum (twf) 1.2.1 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the username parameter (aka the u variable).
Affected Products: n/a
References: [{'name': 'thewebforum-login-sql-injection(24027)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24027'}, {'name': '22294', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22294'}, {'name': '1015450', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015450'}, {'name': '321', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/321'}, {'name': '20060106 [eVuln] TheWebForum Script Insertion and Authentication Bypass', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421039/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/17/exploit.html'}, {'name': 'ADV-2006-0093', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0093'}, {'name': '18392', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18392'}, {'name': '16161', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16161'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/17/summary.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0136
Multiple cross-site scripting (XSS) vulnerabilities in the guestbook module in modules.php in Phanatic Softwares Chimera Web Portal System 0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) comment_poster, (2) comment_poster_email, (3) comment_poster_homepage, and (4) comment_text parameters.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/7/exploit.html'}, {'name': 'ADV-2006-0025', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0025'}, {'name': '20060101 [eVuln] Chimera Web Portal System Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/420669/100/0/threaded'}, {'name': '16113', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16113'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/7/summary.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0137
SQL injection vulnerability in linkcategory.php in Phanatic Softwares Chimera Web Portal System 0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '22420', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22420'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/7/exploit.html'}, {'name': 'ADV-2006-0025', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0025'}, {'name': '20060101 [eVuln] Chimera Web Portal System Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/420669/100/0/threaded'}, {'name': 'chimera-linkcategory-sql-injection(23963)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/23963'}, {'name': '16113', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16113'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/7/summary.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0138
aMSN (aka Alvaro's Messenger) allows remote attackers to cause a denial of service (client hang and termination of client's instant-messaging session) by repeatedly sending crafted data to the default file-transfer port (TCP 6891).
Affected Products: n/a
References: [{'name': '22186', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22186'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securiteam.com/exploits/5JP090KHFQ.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0139
The send-private-message functionality (send-private-message.asp) in PD9 Software MegaBBS 2.1 allows remote attackers to read private messages of other users via a modified replyid parameter.
Affected Products: n/a
References: [{'name': 'ADV-2006-0095', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0095'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hamid.ir/security/megabbs.txt'}, {'name': '16168', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16168'}, {'name': '1015452', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015452'}, {'name': 'megabbs-sendprivatemessage-disclosure(24050)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24050'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.pd9soft.com/megabbs/forums/thread-view.asp?tid=4924'}, {'name': '18342', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18342'}]
CVE State: PUBLISHED
Explain CVE-2006-0140
Cross-site scripting (XSS) vulnerability in post.php in NavBoard V16 Stable(2.6.0) and V17beta2 allows remote attackers to inject arbitrary web script or HTML via the (1) b, (2) textlarge, and (3) url bbcode tags.
Affected Products: n/a
References: [{'name': '18345', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18345'}, {'name': '22277', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22277'}, {'name': 'navboard-post-xss(24021)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24021'}, {'name': '16165', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16165'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/19/summary.html'}, {'name': '20060107 [eVuln] NavBoard BBcode XSS Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421149/100/0/threaded'}, {'name': 'ADV-2006-0092', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0092'}]
CVE State: PUBLISHED
Explain CVE-2006-0141
Qualcomm Eudora Internet Mail Server (EIMS) before 3.2.8 allows remote attackers to cause a denial of service (crash) via (1) malformed NTLM authentication requests, or a malformed (2) Incoming Mail X or (3) Temporary Mail file.
Affected Products: n/a
References: [{'name': 'ADV-2006-0099', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0099'}, {'name': 'eims-corrupted-mail-dos(24033)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24033'}, {'name': '16179', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16179'}, {'name': '18356', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18356'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.eudora.co.nz/updates.html'}, {'name': 'eims-ntlm-auth-dos(24032)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24032'}]
CVE State: PUBLISHED
Explain CVE-2006-0142
Cross-site scripting (XSS) vulnerability in andromeda.php in Andromeda 1.9.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the s parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '16183', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16183'}, {'name': '18359', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18359'}, {'name': 'andromeda-script-xss(24031)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24031'}, {'name': 'ADV-2006-0096', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0096'}]
CVE State: PUBLISHED
Explain CVE-2006-0143
Microsoft Windows Graphics Rendering Engine (GRE) allows remote attackers to corrupt memory and cause a denial of service (crash) via a WMF file containing (1) ExtCreateRegion or (2) ExtEscape function calls with arguments with inconsistent lengths.
Affected Products: n/a
References: [{'name': '1015453', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015453'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lostmon.blogspot.com/2007/08/windows-extended-file-attributes-buffer.html'}, {'name': 'win-gre-wmf-dos(24044)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24044'}, {'name': '16167', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16167'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.technet.com/msrc/archive/2006/01/09/417198.aspx'}, {'name': '20060109 [UPDATE]Microsoft Windows GRE WMF Format Multiple Unauthorized Memory Access Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421258/100/0/threaded'}, {'name': '20060107 Microsoft Windows GRE WMF Format Multiple Memory Overrun Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421257/100/0/threaded'}, {'name': 'ADV-2006-0115', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0115'}]
CVE State: PUBLISHED
Explain CVE-2006-0144
The proxy server feature in go-pear.php in PHP PEAR 0.2.2, as used in Apache2Triad, allows remote attackers to execute arbitrary PHP code by redirecting go-pear.php to a malicious proxy server that provides a modified version of Tar.php with a malicious extractModify function.
Affected Products: n/a
References: [{'name': 'ADV-2006-0148', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0148'}, {'name': '16174', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16174'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://apache2triad.net/forums/viewtopic.php?p=14670'}, {'name': '18390', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18390'}, {'name': 'gopear-proxy-redirection(24076)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24076'}, {'name': '20060109 New PEAR / Apache2Triad Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421469/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0145
The kernfs_xread function in kernfs in NetBSD 1.6 through 2.1, and OpenBSD 3.8, does not properly validate file offsets against negative 32-bit values that occur as a result of truncation, which allows local users to read arbitrary kernel memory and gain privileges via the lseek system call.
Affected Products: n/a
References: [{'name': '18712', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18712'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securitylab.net/research/2006/02/advisory_netbsd_openbsd_kernfs.html'}, {'name': '405', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/405'}, {'name': '16173', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16173'}, {'name': '18388', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18388'}, {'name': '22293', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22293'}, {'name': 'NetBSD-SA2006-001', 'tags': ['vendor-advisory', 'x_refsource_NETBSD'], 'url': 'ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-001.txt.asc'}, {'name': 'netbsd-kernfs-memory-disclosure(24035)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24035'}, {'name': '20060202 [SLAB] NetBSD / OpenBSD kernfs_xread patch evasion', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423827/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0148
NetSarang Xlpd 2.1 allows remote attackers to cause a denial of service (crash) via a large number of connections from the same IP address.
Affected Products: n/a
References: [{'name': '16164', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16164'}, {'name': 'xlpd-connection-dos(24041)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24041'}, {'name': '1015444', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015444'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ipomonis.com/advisories/xlpd.txt'}]
CVE State: PUBLISHED
Explain CVE-2006-0149
Cross-site scripting (XSS) vulnerability in SimpBook 1.0, with html_enable on (the default), allows remote attackers to inject arbitrary web script or HTML via the message field.
Affected Products: n/a
References: [{'name': '1015451', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015451'}, {'name': '20060106 SimpBook "message" Remote Cross-Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041127.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0150
Multiple format string vulnerabilities in the auth_ldap_log_reason function in Apache auth_ldap 1.6.0 and earlier allows remote attackers to execute arbitrary code via various vectors, including the username.
Affected Products: n/a
References: [{'name': 'apache-authldap-format-string(24030)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24030'}, {'name': 'ADV-2006-0117', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0117'}, {'name': '1015456', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015456'}, {'name': '18412', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18412'}, {'name': 'MDKSA-2006:017', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:017'}, {'name': '18382', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18382'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.rudedog.org/auth_ldap/Changes.html'}, {'name': '20060109 Digital Armaments Security Advisory 01.09.2006: Apache auth_ldap module Multiple Format Strings Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421286/100/0/threaded'}, {'name': '16177', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16177'}, {'name': '18568', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18568'}, {'name': 'RHSA-2006:0179', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2006-0179.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.digitalarmaments.com/2006090173928420.html'}, {'name': 'DSA-952', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-952'}, {'name': '18405', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18405'}]
CVE State: PUBLISHED
Explain CVE-2006-0151
sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158.
Affected Products: n/a
References: [{'name': '2006-0010', 'tags': ['vendor-advisory', 'x_refsource_TRUSTIX'], 'url': 'http://www.trustix.org/errata/2006/0010'}, {'name': '18549', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18549'}, {'name': '18558', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18558'}, {'name': 'SSA:2006-045-08', 'tags': ['vendor-advisory', 'x_refsource_SLACKWARE'], 'url': 'http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.421822'}, {'name': '18363', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18363'}, {'name': 'SUSE-SR:2006:002', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2006_02_sr.html'}, {'name': '18358', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18358'}, {'name': '16184', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16184'}, {'name': '19016', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19016'}, {'name': '18906', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18906'}, {'name': 'DSA-946', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-946'}, {'name': 'MDKSA-2006:159', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2006:159'}, {'name': 'USN-235-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/235-2/'}, {'name': '21692', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/21692'}]
CVE State: PUBLISHED
Explain CVE-2006-0152
Cross-site scripting (XSS) in search_result.php in phpChamber 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the needle parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '18360', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18360'}, {'name': '16180', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16180'}, {'name': 'ADV-2006-0094', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0094'}, {'name': '22282', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22282'}, {'name': 'phpchamber-searchresult-xss(24029)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24029'}]
CVE State: PUBLISHED
Explain CVE-2006-0153
427BB 2.2 and 2.2.1 verifies authentication credentials based on the username, authenticated, and usertype cookies, which allows remote attackers to bypass authentication by using a valid username and usertype and setting the authenticated cookie.
Affected Products: n/a
References: [{'name': '20060107 [eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421326/100/0/threaded'}, {'name': '18354', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18354'}, {'name': 'ADV-2006-0091', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0091'}, {'name': '427bb-scripts-security-bypass(24038)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24038'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/18/summary.html'}, {'name': '22274', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22274'}, {'name': '16178', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16178'}]
CVE State: PUBLISHED
Explain CVE-2006-0154
SQL injection vulnerability in showthread.php in 427BB 2.2 and 2.2.1 allows remote attackers to execute arbitrary SQL commands via the ForumID parameter.
Affected Products: n/a
References: [{'name': '20060107 [eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421326/100/0/threaded'}, {'name': '18354', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18354'}, {'name': 'ADV-2006-0091', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0091'}, {'name': '22275', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22275'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/18/summary.html'}, {'name': '16169', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16169'}, {'name': '427bb-showthread-sql-injection(24039)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24039'}]
CVE State: PUBLISHED
Explain CVE-2006-0155
Cross-site scripting (XSS) vulnerability in posts.php in 427BB 2.2 and 2.2.1 allows remote attackers to inject arbitrary Javascript via a new message with a url bbcode tag containing a javascript URI.
Affected Products: n/a
References: [{'name': '20060107 [eVuln] 427BB Multiple Vulnerabilities (Cookie-based Authentication Bypass, SQL Injections, XSS)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421326/100/0/threaded'}, {'name': '22276', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22276'}, {'name': '18354', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18354'}, {'name': 'ADV-2006-0091', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0091'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/18/summary.html'}, {'name': '427bb-posts-xss(24040)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24040'}]
CVE State: PUBLISHED
Explain CVE-2006-0156
Cross-site scripting (XSS) vulnerability in Foxrum 4.0.4f allows remote attackers to inject arbitrary Javascript via the javascript URI in bbcode url tags in (1) addpost1.php and (2) addtopic1.php.
Affected Products: n/a
References: [{'name': '16172', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16172'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/20'}, {'name': '325', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/325'}, {'name': 'foxrum-bbcode-xss(24043)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24043'}, {'name': 'ADV-2006-0121', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0121'}, {'name': '20060109 [eVuln] Foxrum BBCode XSS Vulnerabilty', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421277/100/0/threaded'}, {'name': '18386', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18386'}]
CVE State: PUBLISHED
Explain CVE-2006-0157
settings.php in Reamday Enterprises Magic News Plus 1.0.3 allows remote attackers to change the administrator password via a change action that specifies identical values for the passwd and admin_password parameters, then declares the new password string in the new_passwd and confirm_passwd parameters.
Affected Products: n/a
References: [{'name': '18601', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18601'}, {'name': '16182', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16182'}, {'tags': ['x_refsource_MISC'], 'url': 'http://downloads.securityfocus.com/vulnerabilities/exploits/MagicNewsPlus-pw-change.pl'}]
CVE State: PUBLISHED
Explain CVE-2006-0158
SQL injection vulnerability in index.php in CyberDoc SiteSuite CMS allows remote attackers to execute arbitrary SQL commands via the page parameter.
Affected Products: n/a
References: [{'name': 'ADV-2006-0038', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0038'}, {'name': '22205', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22205'}, {'tags': ['x_refsource_MISC'], 'url': 'http://osvdb.org/ref/22/22205-sitesuite.txt'}, {'name': '18305', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18305'}]
CVE State: PUBLISHED
Explain CVE-2006-0159
SQL injection vulnerability in escribir.php in Foro Domus 2.10 allows remote attackers to execute arbitrary SQL commands via the email parameter.  NOTE: the provenance of this information is unknown, although it may be based on post-disclosure analysis of CVE-2006-0110; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '22264', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22264'}, {'name': '18327', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18327'}, {'name': 'domus-escribir-sql-injection(24017)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24017'}, {'name': 'ADV-2006-0073', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0073'}]
CVE State: PUBLISHED
Explain CVE-2006-0160
SQL injection vulnerability in add_post.php3 in Venom Board 1.22 allows remote attackers to execute arbitrary SQL commands via the (1) parent, (2) root, and (3) topic_id parameters to post.php3.
Affected Products: n/a
References: [{'name': 'venomboard-addpost-sql-injection(24046)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24046'}, {'name': 'ADV-2006-0122', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0122'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/21/summary.html'}, {'name': '326', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/326'}, {'name': '16176', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16176'}, {'name': '22297', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22297'}, {'name': '18383', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18383'}, {'name': '20060109 [eVuln] Venom Board SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=113683807903915&w=2'}]
CVE State: PUBLISHED
Explain CVE-2006-0161
Unspecified vulnerability in uucp in Sun Solaris 8 and 9 has unknown impact and attack vectors.  NOTE: due to the vagueness of the vendor advisory, it is not clear whether this is related to CVE-2004-0780.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:1534', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1534'}, {'name': 'ADV-2006-0113', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0113'}, {'name': '1015455', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015455'}, {'name': '101933', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-101933-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm'}, {'name': '18371', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18371'}, {'name': '19087', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19087'}]
CVE State: PUBLISHED
Explain CVE-2006-0162
Heap-based buffer overflow in libclamav/upx.c in Clam Antivirus (ClamAV) before 0.88 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted UPX files.
Affected Products: n/a
References: [{'name': '342', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/342'}, {'name': 'GLSA-200601-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200601-07.xml'}, {'name': '18478', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18478'}, {'name': '18379', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18379'}, {'name': 'ADV-2006-0116', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0116'}, {'name': '16191', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16191'}, {'name': '18453', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18453'}, {'name': '2006-0002', 'tags': ['vendor-advisory', 'x_refsource_TRUSTIX'], 'url': 'http://www.trustix.org/errata/2006/0002/'}, {'name': '1015457', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015457'}, {'name': '18463', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18463'}, {'name': 'clamav-libclamav-upx-bo(24047)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24047'}, {'name': '22318', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22318'}, {'name': 'DSA-947', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-947'}, {'name': '20060112 ZDI-06-001: Clam AntiVirus UPX Unpacking Code Execution Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041325.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.clamav.net/doc/0.88/ChangeLog'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-06-001.html'}, {'name': '18548', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18548'}, {'name': 'MDKSA-2006:016', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2006:016'}, {'name': 'VU#385908', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/385908'}]
CVE State: PUBLISHED