Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2006-1578
Multiple SQL injection vulnerabilities in Keystone Digital Library Suite (DLS) 1.5.4 and earlier allow remote attackers to execute arbitrary SQL commands via the subject_type_id parameter in (1) the index page and (2) the search module.
Affected Products: n/a
References: [{'name': 'keystonedls-subjecttypeid-sql-injection(25571)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25571'}, {'tags': ['x_refsource_MISC'], 'url': 'http://pridels0.blogspot.com/2006/03/keystone-dls-sql-vuln.html'}]
CVE State: PUBLISHED
Explain CVE-2006-1579
SQL injection vulnerability in topics.php in Dynamic Bulletin Board System (DbbS) 2.0-alpha and earlier allows remote attackers to execute arbitrary SQL commands via the limite parameter.
Affected Products: n/a
References: [{'name': 'dbbs-topics-sql-injection(25584)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25584'}, {'name': '20060331 DbbS<=2.0-alpha SQL injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429512/100/0/threaded'}, {'name': '17338', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17338'}]
CVE State: PUBLISHED
Explain CVE-2006-1580
Multiple cross-site scripting (XSS) vulnerabilities in Bugzero 4.3.1 and other versions allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter in query.jsp and (2) entryId parameter in edit.jsp.
Affected Products: n/a
References: [{'name': '17351', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17351'}, {'tags': ['x_refsource_MISC'], 'url': 'http://pridels0.blogspot.com/2006/04/bugzero-xss-vuln.html'}, {'name': 'bugzero-query-edit-xss(25601)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25601'}, {'name': 'ADV-2006-1195', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1195'}, {'name': '19492', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19492'}, {'name': '24328', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24328'}, {'name': '24329', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24329'}]
CVE State: PUBLISHED
Explain CVE-2006-1581
Directory traversal vulnerability in index.php in Blank'N'Berg 0.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the _path parameter.
Affected Products: n/a
References: [{'name': 'blanknberg-index-directory-traversal(25617)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25617'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.silitix.com/bnb.php'}, {'name': '1015854', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015854'}, {'name': '17345', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17345'}, {'name': '19520', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19520'}, {'name': '24373', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24373'}]
CVE State: PUBLISHED
Explain CVE-2006-1582
Cross-site scripting (XSS) vulnerability in index.php in Blank'N'Berg 0.2 allows remote attackers to inject arbitrary web script or HTML via the _path parameter.  NOTE: this might be resultant from the directory traversal issue.
Affected Products: n/a
References: [{'name': '24374', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24374'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.silitix.com/bnb.php'}, {'name': 'blanknberg-index-xss(25618)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25618'}, {'name': '1015854', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015854'}, {'name': '19520', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19520'}, {'name': '17346', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17346'}]
CVE State: PUBLISHED
Explain CVE-2006-1583
Cross-site scripting (XSS) vulnerability in index.php in Warcraft III Replay Parser for PHP 1.8c allows remote attackers to inject arbitrary web script or HTML via the page parameter.  NOTE: post-disclosure analysis by CVE suggests that the "page" parameter is not used in this product, and "id" might be the affected parameter.
Affected Products: n/a
References: [{'name': '20060331 Warcraft III Replay Parser Script Remote Command Exucetion Vulnerability And Cross-Site Scripting Attacking', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429535/100/0/threaded'}, {'name': 'warcraft3-replay-parser-index-xss(25685)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25685'}, {'name': '17334', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17334'}]
CVE State: PUBLISHED
Explain CVE-2006-1584
Unspecified vulnerability in index.php in Warcraft III Replay Parser for PHP 1.8c allows remote attackers to inject arbitrary web script or HTML via the page parameter, possibly related to fopen function calls or file uploads.  NOTE: post-disclosure analysis by CVE suggests that the "page" parameter is not used in this product, and "id" might be the affected parameter.
Affected Products: n/a
References: [{'name': '20060331 Warcraft III Replay Parser Script Remote Command Exucetion Vulnerability And Cross-Site Scripting Attacking', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429535/100/0/threaded'}, {'name': 'warcraft3-replay-parser-index-file-include(25686)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25686'}, {'name': '17334', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17334'}]
CVE State: PUBLISHED
Explain CVE-2006-1585
Multiple SQL injection vulnerabilities in MonAlbum 0.8.7 allow remote attackers to execute arbitrary SQL commands via (1) the pc parameter in (a) index.php and (2) pnom, (3) pcourriel, and (4) pcommentaire parameters in (b) image_agrandir.php.
Affected Products: n/a
References: [{'name': '20060331 MonAlbum 0.8.7 SQL Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429475/100/0/threaded'}, {'name': 'ADV-2006-1206', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1206'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.bash-x.net/undef/adv/monalbum.html'}, {'name': 'monalbum-image-imageagrandir-sql-injection(25572)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25572'}, {'name': '17327', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17327'}, {'name': '19503', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19503'}, {'name': '660', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/660'}]
CVE State: PUBLISHED
Explain CVE-2006-1586
SQL injection vulnerability in admin_login.asp in ISP of Egypt SiteMan allows remote attackers to execute arbitrary SQL commands via the pass parameter.
Affected Products: n/a
References: [{'name': '24362', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24362'}, {'name': '19500', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19500'}, {'name': 'ADV-2006-1190', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1190'}, {'name': '17347', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17347'}, {'name': 'siteman-adminlogin-sql-injection(25595)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25595'}, {'name': '20060401 SiteMan <= All version SQL injection in admin_login.asp', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429607/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-1587
NetBSD 1.6 up to 3.0, when a user has "set record" in .mailrc with the default umask set, creates the record file with 0644 permissions, which allows local users to read the record file.
Affected Products: n/a
References: [{'name': 'NetBSD-SA2006-007', 'tags': ['vendor-advisory', 'x_refsource_NETBSD'], 'url': 'ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-007.txt.asc'}, {'name': '19465', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19465'}, {'name': '1015847', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015847'}, {'name': '24258', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24258'}, {'name': 'bsd-mailrc-insecure-permissions(25581)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25581'}]
CVE State: PUBLISHED
Explain CVE-2006-1588
The bridge ioctl (if_bridge code) in NetBSD 1.6 through 3.0 does not clear sensitive memory before copying ioctl results to the requesting process, which allows local users to obtain portions of kernel memory.
Affected Products: n/a
References: [{'name': '17312', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17312'}, {'name': '24262', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24262'}, {'name': '19464', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19464'}, {'name': 'bsd-ifbridge-information-disclosure(25582)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25582'}, {'name': 'NetBSD-SA2006-005', 'tags': ['vendor-advisory', 'x_refsource_NETBSD'], 'url': 'ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-005.txt.asc'}, {'name': '1015846', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015846'}]
CVE State: PUBLISHED
Explain CVE-2006-1589
The elf_load_file function in NetBSD 2.0 through 3.0 allows local users to cause a denial of service (kernel crash) via an ELF interpreter that does not have a PT_LOAD section in its header, which triggers a null dereference.
Affected Products: n/a
References: [{'name': 'NetBSD-SA2006-008', 'tags': ['vendor-advisory', 'x_refsource_NETBSD'], 'url': 'ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-008.txt.asc'}, {'name': 'netbsd-elfloadfile-dos(25690)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25690'}, {'name': '1015848', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015848'}, {'name': '24576', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24576'}]
CVE State: PUBLISHED
Explain CVE-2006-1590
Cross-site scripting (XSS) vulnerability in the PrintFreshPage function in (1) Basic Analysis and Security Engine (BASE) 1.2.4 and (2) Analysis Console for Intrusion Databases (ACID) 0.9.6b23 allows remote attackers to inject arbitrary web script or HTML via the (a) back parameter to base_graph_main.php, (b) netmask parameter to base_stat_ipaddr.php, or (c) submit parameter to base_qry_alert.php within BASE, or (d) query string to acid_main.php in ACID, which causes the request URI ($_SERVER['REQUEST_URI']) to be inserted into a refresh operation.
Affected Products: n/a
References: [{'name': '17391', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17391'}, {'name': 'ADV-2006-1264', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1264'}, {'name': '20835', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/20835'}, {'name': 'base-multiple-scripts-xss(25671)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25671'}, {'name': '[secureideas-base-devel] 20060328 3 XSS in BASE 1.2.4', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://sourceforge.net/mailarchive/forum.php?thread_id=10064470&forum_id=42223'}, {'name': '24307', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24307'}, {'name': '19544', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19544'}]
CVE State: PUBLISHED
Explain CVE-2006-1591
Heap-based buffer overflow in Microsoft Windows Help winhlp32.exe allows user-assisted attackers to execute arbitrary code via crafted embedded image data in a .hlp file.
Affected Products: n/a
References: [{'name': 'win-winhlp32-hlp-bo(25573)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25573'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.open-security.org/advisories/15'}, {'name': '20060413 Windows Help Heap Overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/430871/100/0/threaded'}, {'name': '700', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/700'}, {'name': '20060331 Windows Help Heap Overflow', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044748.html'}, {'name': '17325', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17325'}]
CVE State: PUBLISHED
Explain CVE-2006-1592
Buffer overflow in the is_client_wad_ok function in w_wad.cpp for (1) Zdaemon 1.08.01 and (2) X-Doom allows remote attackers to execute arbitrary code via a long filename argument.
Affected Products: n/a
References: [{'name': '20060331 Buffer-overflow and in-game crash in Zdaemon 1.08.01', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429521/100/0/threaded'}, {'name': 'ADV-2006-1198', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1198'}, {'name': 'ADV-2006-1199', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1199'}, {'name': '17340', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17340'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/zdaebof-adv.txt'}, {'name': '20060331 Buffer-overflow and in-game crash in Zdaemon 1.08.01', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044775.html'}, {'name': '19509', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19509'}, {'name': '19496', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19496'}, {'name': 'zdaemon-isclientwadok-bo(25592)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25592'}]
CVE State: PUBLISHED
Explain CVE-2006-1593
The (1) ZD_MissingPlayer, (2) ZD_UseItem, and (3) ZD_LoadNewClientLevel functions in sv_main.cpp for (a) Zdaemon 1.08.01 and (b) X-Doom allows remote attackers to cause a denial of service (crash) via an invalid player slot or item number, which causes an invalid memory access, possibly due to an invalid array index.
Affected Products: n/a
References: [{'name': '20060331 Buffer-overflow and in-game crash in Zdaemon 1.08.01', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429521/100/0/threaded'}, {'name': 'ADV-2006-1198', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1198'}, {'name': 'ADV-2006-1199', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1199'}, {'name': '17340', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17340'}, {'name': '662', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/662'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/zdaebof-adv.txt'}, {'name': '20060331 Buffer-overflow and in-game crash in Zdaemon 1.08.01', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044775.html'}, {'name': '19509', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19509'}, {'name': '19496', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19496'}, {'name': 'zdaemon-memory-access-dos(25593)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25593'}]
CVE State: PUBLISHED
Explain CVE-2006-1594
Multiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and earlier allow remote attackers to use ".." (dot dot) sequences to (1) read arbitrary files via the file parameter in a rqEditHtml command to document/rqmkhtml.php or (2) execute arbitrary code via the includePath parameter to learnPath/include/scormExport.inc.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://retrogod.altervista.org/claroline_174_incl_xpl.html'}, {'name': '19461', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19461'}, {'name': '17343', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17343'}, {'name': 'ADV-2006-1187', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1187'}, {'name': 'claroline-rqmkhtml-directory-traversal(25561)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25561'}, {'name': '1627', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1627'}]
CVE State: PUBLISHED
Explain CVE-2006-1595
Cross-site scripting (XSS) vulnerability in document/rqmkhtml.php in Claroline 1.7.4 and earlier allows remote attackers to read arbitrary files via ".." sequences in the file parameter in a rqEditHtml command.
Affected Products: n/a
References: [{'name': '17344', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17344'}, {'tags': ['x_refsource_MISC'], 'url': 'http://retrogod.altervista.org/claroline_174_incl_xpl.html'}, {'name': '19461', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19461'}, {'name': '24284', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24284'}, {'name': '20060331 Re: [Full-disclosure] Claroline <= 1.7.4 (scormExport.inc.php) Remote Code Execution Exploit by rgod', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1905.html'}, {'name': 'ADV-2006-1187', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1187'}, {'name': '24285', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24285'}, {'name': '1627', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1627'}, {'name': 'claroline-rqmkhtml-xss(25562)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25562'}]
CVE State: PUBLISHED
Explain CVE-2006-1596
PHP remote file inclusion vulnerability in learnPath/include/scormExport.inc.php in Claroline 1.7.4 and earlier allows remote attackers to execute arbitrary PHP code via the includePath parameter.
Affected Products: n/a
References: [{'name': 'claroline-scormexportinc-file-include(25563)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25563'}, {'name': '20060331 Claroline <= 1.7.4 (scormExport.inc.php) Remote Code Execution Exploit by rgod', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1888.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://retrogod.altervista.org/claroline_174_incl_xpl.html'}, {'name': '19461', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19461'}, {'name': '17341', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17341'}, {'name': 'ADV-2006-1187', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1187'}, {'name': '24286', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24286'}, {'name': '1627', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1627'}]
CVE State: PUBLISHED
Explain CVE-2006-1598
AN HTTPD 1.42n, and possibly other versions before 1.42p, allows remote attackers to obtain source code of scripts via crafted requests with (1) dot and (2) space characters in the file extension.
Affected Products: n/a
References: [{'name': '24323', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24323'}, {'name': '20060403 Secunia Research: AN HTTPD Script Source Disclosure Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429667/100/0/threaded'}, {'name': '19326', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19326'}, {'name': '1015858', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015858'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2006-21/advisory'}, {'name': 'anhttpd-script-source-disclosure(25591)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25591'}, {'name': 'ADV-2006-1200', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1200'}, {'name': '17350', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17350'}]
CVE State: PUBLISHED
Explain CVE-2006-1599
Unspecified vulnerability in VCEngine.php in v-creator before 1.3-pre3, when the VC_CRYPTO_METHOD option is OPENSSL, allows remote attackers to execute arbitrary commands, possibly due to problems in the (1) encrypt and (2) decrypt functions.
Affected Products: n/a
References: [{'name': 'vcreator-vcengine-command-execution(25560)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25560'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/forum/forum.php?forum_id=557129'}, {'name': '17328', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17328'}, {'name': '19453', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19453'}, {'name': '24304', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24304'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://sourceforge.net/p/vcreator/news/2006/03/v-creator-v13-pre3-released/'}, {'name': 'ADV-2006-1189', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1189'}]
CVE State: PUBLISHED
Explain CVE-2006-1600
SQL injection vulnerability in category.php in PhpWebGallery 1.4.1 allows remote attackers to execute arbitrary SQL commands via the search parameter.
Affected Products: n/a
References: [{'name': '669', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/669'}, {'name': '20060403 Phpwebgallery <= 1.4.1 SQL injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429665/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-1601
Unspecified vulnerability in SunPlex Manager in Sun Cluster 3.1 4/04 allows local users with solaris.cluster.gui authorization to view arbitrary files via unspecified vectors.
Affected Products: n/a
References: [{'name': '17313', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17313'}, {'name': '1015849', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015849'}, {'name': '102278', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-102278-1'}, {'name': 'suncluster-sunplex-information-disclosure(25543)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25543'}, {'name': '19444', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19444'}, {'name': 'ADV-2006-1175', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1175'}]
CVE State: PUBLISHED
Explain CVE-2006-1602
PHP remote file inclusion vulnerability in includes/functions_common.php in the VWar Account module (vWar_Account) in PHPNuke Clan 3.0.1 allows remote attackers to include arbitrary files via a URL in the vwar_root2 parameter.  NOTE: it is possible that this issue stems from a problem in VWar itself, but this is not clear.
Affected Products: n/a
References: [{'name': 'phpnukeclan-functionscommon-file-include(25609)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25609'}, {'name': '20060401 PHPNuke-Clan 3.0.1 Remote File Inclusion Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429615/100/0/threaded'}, {'name': '19501', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19501'}, {'name': 'ADV-2006-1202', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1202'}, {'name': '17356', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17356'}, {'name': '24481', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24481'}]
CVE State: PUBLISHED
Explain CVE-2006-1603
Cross-site scripting (XSS) vulnerability in profile.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via the cur_password parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': 'ADV-2006-1191', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1191'}, {'name': '17355', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17355'}, {'tags': ['x_refsource_MISC'], 'url': 'http://osvdb.org/ref/24/24353-phpbb.txt'}, {'name': 'phpbb-profile-script-xss(25599)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25599'}, {'name': '24353', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24353'}, {'name': '19494', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19494'}]
CVE State: PUBLISHED
Explain CVE-2006-1604
Unspecified vulnerability in Exponent CMS before 0.96.5 RC 1 has unknown impact and remote attack vectors related to variables that are not "typecasted."
Affected Products: n/a
References: [{'name': 'ADV-2006-1201', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1201'}, {'name': '19498', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19498'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=406474&group_id=118524'}, {'name': '17357', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17357'}]
CVE State: PUBLISHED
Explain CVE-2006-1605
Unspecified vulnerability in the image module in Exponent CMS before 0.96.5 RC 1 allows remote attackers to execute arbitrary code via unknown vectors involving "parsed PHP."
Affected Products: n/a
References: [{'name': 'ADV-2006-1201', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1201'}, {'name': '19498', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19498'}, {'name': '24358', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24358'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=406474&group_id=118524'}, {'name': '17357', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17357'}]
CVE State: PUBLISHED
Explain CVE-2006-1606
Unspecified vulnerability in the image module in Exponent CMS before 0.96.5 RC 1 allows "directory disclosure" with unknown attack vectors.
Affected Products: n/a
References: [{'name': 'ADV-2006-1201', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1201'}, {'name': '19498', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19498'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=406474&group_id=118524'}, {'name': '17357', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17357'}]
CVE State: PUBLISHED
Explain CVE-2006-1607
Unspecified vulnerability in the banner module in Exponent CMS before 0.96.5 RC 1 allows "php injection" via unknown attack vectors.
Affected Products: n/a
References: [{'name': 'ADV-2006-1201', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1201'}, {'name': '19498', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19498'}, {'name': '24358', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24358'}, {'name': 'exponent-banner-php-command-execution(25610)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25610'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=406474&group_id=118524'}, {'name': '17357', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17357'}]
CVE State: PUBLISHED
Explain CVE-2006-1608
The copy function in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass safe mode and read arbitrary files via a source argument containing a compress.zlib:// URI.
Affected Products: n/a
References: [{'name': '19775', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19775'}, {'name': 'php-copy-safemode-bypass(25706)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25706'}, {'name': '20060718 new shell bypass safe mode', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/440869/100/0/threaded'}, {'name': '20060408 copy() Safe Mode Bypass PHP 4.4.2 and 5.1.2', 'tags': ['third-party-advisory', 'x_refsource_SREASONRES'], 'url': 'http://securityreason.com/achievement_securityalert/37'}, {'name': '678', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/678'}, {'name': 'ADV-2006-1290', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1290'}, {'name': 'USN-320-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-320-1'}, {'name': '21125', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/21125'}, {'name': '19599', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19599'}, {'name': 'MDKSA-2006:074', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2006:074'}, {'name': '24487', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24487'}, {'name': '20060409 copy() Safe Mode Bypass PHP 4.4.2 and 5.1.2', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/430461/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://us.php.net/releases/5_1_3.php'}, {'name': '1015882', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015882'}, {'name': '17439', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17439'}, {'name': '20060723 Re: new shell bypass safe mode', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/441210/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-1609
Unspecified vulnerability in Hitachi XFIT/S, XFIT/S/JCA, XFIT/S/ZGN, and XFIT/S ZENGIN TCP/IP Procedure allows remote attackers to cause a denial of service (server process and transfer control process stop) when the products "receive data unexpectedly".
Affected Products: n/a
References: [{'name': '17329', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17329'}, {'name': '19472', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19472'}, {'name': 'xfits-data-dos(25567)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25567'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.hitachi-support.com/security_e/vuls_e/HS06-004_e/index-e.html'}, {'name': '24309', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24309'}]
CVE State: PUBLISHED
Explain CVE-2006-1610
PHP remote file inclusion vulnerability in lib/armygame.php in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party (ALP), allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter.  NOTE: this only occurs when register_globals is disabled.
Affected Products: n/a
References: [{'name': '17434', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17434'}, {'name': 'squery-file-include(25605)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25605'}, {'name': 'ADV-2006-1204', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1204'}, {'name': '1629', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1629'}, {'name': '19482', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19482'}, {'name': '20060401 SQuery <= 4.5 Remote File Inclusion Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429611/100/0/threaded'}, {'name': '24400', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24400'}]
CVE State: PUBLISHED
Explain CVE-2006-1611
Directory traversal vulnerability in KGB Archiver before 1.1.5.22 allows remote attackers to overwrite arbitrary files wile decompressing an archive, possibly due to directory traversal sequences in a filename.
Affected Products: n/a
References: [{'name': 'ADV-2006-1207', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1207'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?group_id=162546&release_id=406411'}, {'name': '17363', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17363'}, {'name': 'kgb-archiver-archive-directory-traversal(25606)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25606'}, {'name': '19511', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19511'}]
CVE State: PUBLISHED
Explain CVE-2006-1612
Multiple cross-site scripting (XSS) vulnerabilities in visview.php in aWebNews 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) yname, (2) emailadd, (3) subject, and (4) comment parameters.
Affected Products: n/a
References: [{'name': 'ADV-2006-1196', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1196'}, {'name': '20060414 [eVuln] aWebNews Multiple XSS and SQL Injection Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/431007/100/0/threaded'}, {'name': '19487', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19487'}, {'name': '24333', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24333'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/116/summary.html'}, {'name': 'awebnews-visview-xss(25589)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25589'}, {'name': '707', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/707'}]
CVE State: PUBLISHED
Explain CVE-2006-1613
Multiple SQL injection vulnerabilities in aWebNews 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) user123 variable in (a) login.php or (b) fpass.php; or (2) cid parameter to (c) visview.php.
Affected Products: n/a
References: [{'name': 'ADV-2006-1196', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1196'}, {'name': '24336', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24336'}, {'name': '24334', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24334'}, {'name': '24335', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24335'}, {'name': '20060414 [eVuln] aWebNews Multiple XSS and SQL Injection Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/431007/100/0/threaded'}, {'name': '19487', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19487'}, {'name': 'awebnews-multiple-sql-injection(25590)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25590'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/116/summary.html'}]
CVE State: PUBLISHED
Explain CVE-2006-1616
Multiple SQL injection vulnerabilities in Advanced Poll 2.02 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to comments.php or (2) poll_id parameter to page.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ns79.hosteur.com/~secuti/advancedpoll.txt'}, {'name': 'advancedpoll-comments-page-sql-injection(25676)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25676'}]
CVE State: PUBLISHED
Explain CVE-2006-1617
Multiple cross-site scripting (XSS) vulnerabilities in Advanced Poll 2.02 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to comments.php or (2) poll_id parameter to page.php.  NOTE: it is possible that this issue is resultant from CVE-2006-1616.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://ns79.hosteur.com/~secuti/advancedpoll.txt'}, {'name': 'advancedpoll-comments-page-xss(25677)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25677'}]
CVE State: PUBLISHED
Explain CVE-2006-1618
Format string vulnerability in the (1) Con_message and (2) conPrintf functions in con_main.c in Doomsday engine 1.8.6 allows remote attackers to execute arbitrary code via format string specifiers in an argument to the JOIN command, and possibly other command arguments.
Affected Products: n/a
References: [{'name': '20060403 Format string in Doomsday 1.8.6', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429857/100/0/threaded'}, {'name': '1015860', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015860'}, {'name': 'GLSA-200604-05', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200604-05.xml'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/doomsdayfs-adv.txt'}, {'name': 'doomsday-conmessage-conprintf-format-string(25622)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25622'}, {'name': '20060403 Format string in Doomsday 1.8.6', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/044865.html'}, {'name': '19519', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19519'}, {'name': '17369', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17369'}, {'name': '19515', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19515'}, {'name': 'ADV-2006-1221', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1221'}]
CVE State: PUBLISHED
Explain CVE-2006-1619
IBM WebSphere Application Server 4.0.1 through 4.0.3 allows remote attackers to cause a denial of service (application crash) via an HTTP request with a large header.
Affected Products: n/a
References: [{'name': 'websphere-http-header-dos(25619)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25619'}, {'name': 'ADV-2006-1214', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1214'}, {'name': '1015857', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015857'}, {'name': 'PQ62144', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg21053738'}]
CVE State: PUBLISHED
Explain CVE-2006-1620
admin/accounts/AccountActions.asp in Hosting Controller 2002 RC 1 allows remote attackers to modify passwords of other users, probably via an "Update User" ActionType with a modified UserName parameter and the PassCheck parameter set to TRUE.  It was later reported that the vulnerability is present in 6.1 Hotfix 3.3 and earlier.
Affected Products: n/a
References: [{'name': '28973', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28973'}, {'name': '20071213 Hosting Controller - Multiple Security Bugs (Extremely Critical)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/485028/100/0/threaded'}, {'name': '20060402 Hosting Controller AccountActions.asp and saveuploadfiles.asp vulns (PoC)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429731/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hostingcontroller.com/english/logs/Post-Hotfix-3_3-sec-Patch-ReleaseNotes.html'}, {'name': '4730', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4730'}, {'name': '26862', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/26862'}, {'name': '24773', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24773'}, {'name': 'hosting-controller-accountactions-password(25673)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25673'}, {'name': 'hostingcontroller-multiple-security-bypass(39038)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39038'}]
CVE State: PUBLISHED
Explain CVE-2006-1621
Directory traversal vulnerability in admin/folders/saveuploadfiles.asp in Hosting Controller 2002 RC 1 allows remote authenticated users to overwrite arbitrary files via an absolute path in the OpenPath parameter.
Affected Products: n/a
References: [{'name': 'hosting-controller-Saveupload-file-upload(25675)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25675'}, {'name': '20060402 Hosting Controller AccountActions.asp and saveuploadfiles.asp vulns (PoC)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429731/100/0/threaded'}, {'name': '24772', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24772'}]
CVE State: PUBLISHED
Explain CVE-2006-1622
Cross-site scripting (XSS) vulnerability in PHPSelect linksubmit allows remote attackers to inject arbitrary web script or HTML via (1) the description parameter to linklist.php and possibly other vectors involving (2) index.php and (3) linksubmit.php.
Affected Products: n/a
References: [{'name': '20060401 linksubmit <= All version Html Tag Injector in index.php', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429608/100/0/threaded'}, {'name': 'linksubmit-linksubmit-xss(25607)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25607'}]
CVE State: PUBLISHED
Explain CVE-2006-1623
Unspecified vulnerability in main.php in an unspecified "file created by Andries Bruinsma," possibly a FleXiBle Development (FXB) application, allows remote attackers to include and execute arbitrary PHP code.  NOTE: this disclosure is extremely vague and has very little information about the specific vulnerability type.  In addition, there is little public information on the named product. Finally, an XSS vector is implied in the subject line, but because there is no other information and evidence of a cut-and-paste error, it will not be assigned a separate CVE identifier unless additional information is provided.
Affected Products: n/a
References: [{'name': '20060404 FleXiBle Development Script Remote Command Exucetion And XSS Attacking', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://attrition.org/pipermail/vim/2006-April/000680.html'}, {'name': '20060401 FleXiBle Development Script Remote Command Exucetion And XSS Attacking', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429613/100/0/threaded'}, {'name': 'flexible-development-main-xss(25603)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25603'}, {'name': '20060405 Re: FleXiBle Development Script Remote Command Exucetion And XSS Attacking', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/430334/100/0/threaded'}, {'name': 'flexible-development-main-command-execution(25600)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25600'}]
CVE State: PUBLISHED
Explain CVE-2006-1624
The default configuration of syslogd in the Linux sysklogd package does not enable the -x (disable name lookups) option, which allows remote attackers to cause a denial of service (traffic amplification) via messages with spoofed source IP addresses.
Affected Products: n/a
References: [{'name': '20060331 DoS-ing sysklogd?', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429618/100/0/threaded'}, {'name': '20060402 RE: DoS-ing sysklogd?', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429739/100/0/threaded'}, {'name': 'sysklogd-sourceip-dos(25672)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25672'}]
CVE State: PUBLISHED