Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2006-0916
Bugzilla 2.19.3 through 2.20 does not properly handle "//" sequences in URLs when redirecting a user from the login form, which could cause it to generate a partial URL in a form action that causes the user's browser to send the form data to another domain.
Affected Products: n/a
References: [{'name': '464', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/464'}, {'name': '18979', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18979'}, {'name': 'ADV-2006-0692', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0692'}, {'name': '20060221 [BUGZILLA] Security Advisory for Bugzilla 2.20, 2.21.1, and 2.18.4', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/425584/100/0/threaded'}, {'name': 'bugzilla-login-data-redirection(24821)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24821'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=325079'}, {'name': '16745', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16745'}]
CVE State: PUBLISHED
Explain CVE-2006-0917
Melange Chat Server (aka M-Chat), when accessed via a web browser, automatically sends cookies and other sensitive information for a server to any port specified in the associated link, which allows local users on that server to read the cookies from HTTP headers and possibly gain sensitive information, such as credentials, by setting up a listening port and reading the credentials when the victim clicks on the link.
Affected Products: n/a
References: [{'name': '16747', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16747'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.oh2600.com/forum/viewtopic.php?t=43'}, {'name': '463', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/463'}, {'name': '18984', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18984'}, {'name': '20060221 grab cookie information with Melange Chat Server 1.10', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/425589/100/0/threaded'}, {'name': 'melange-chat-command-information-disclosure(24868)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24868'}]
CVE State: PUBLISHED
Explain CVE-2006-0918
Buffer overflow in RITLabs The Bat! 3.60.07 allows remote attackers to execute arbitrary code via a long Subject field.
Affected Products: n/a
References: [{'name': '20060223 NSA Group Security Advisory NSAG-&sup1;198-23.02.2006 Vulnerability The Bat v. 3.60.07', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/425936/100/0/threaded'}, {'name': '485', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/485'}, {'name': 'thebat-subject-bo(24882)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24882'}, {'name': '16797', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16797'}, {'name': '18989', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18989'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nsag.ru/vuln/953.html'}, {'name': 'ADV-2006-0717', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0717'}]
CVE State: PUBLISHED
Explain CVE-2006-0919
SQL injection vulnerability in index.php (aka the login page) in Oi! Email Marketing System 3.0 (aka Oi! 3) allows remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.
Affected Products: n/a
References: [{'name': '23462', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23462'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.h4cky0u.org/advisories/HYSA-2006-003-oi-email.txt'}, {'name': '20060223 HYSA-2006-003 Oi! Email Marketing 3.0 SQL Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/425924/100/0/threaded'}, {'name': '18993', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18993'}, {'name': 'ADV-2006-0718', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0718'}]
CVE State: PUBLISHED
Explain CVE-2006-0920
Oi! Email Marketing System 3.0 (aka Oi! 3) stores the server's FTP password in cleartext on a Configuration web page, which allows local users with superadministrator privileges, or attackers who have obtained access to the web page, to view the password.
Affected Products: n/a
References: [{'name': '483', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/483'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.h4cky0u.org/advisories/HYSA-2006-003-oi-email.txt'}, {'name': '20060223 HYSA-2006-003 Oi! Email Marketing 3.0 SQL Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/425924/100/0/threaded'}, {'name': '16794', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16794'}]
CVE State: PUBLISHED
Explain CVE-2006-0921
Multiple directory traversal vulnerabilities in connector.php in FCKeditor 2.0 FC, as used in products such as RunCMS, allow remote attackers to list and create arbitrary directories via a .. (dot dot) in the CurrentFolder parameter to (1) GetFoldersAndFiles and (2) CreateFolder.
Affected Products: n/a
References: [{'name': '484', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/484'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nsag.ru/vuln/952.html'}, {'name': 'fckeditor-connector-obtain-information(24878)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24878'}, {'name': '20060519 Re: NSA Group Security Advisory NSAG-&sup1;195-23.02.2006 Vulnerability FCKeditor 2.0 FC', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/434559/30/4890/threaded'}, {'name': '20060223 NSA Group Security Advisory NSAG-&sup1;195-23.02.2006 Vulnerability FCKeditor 2.0 FC', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/425937/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0922
CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php (aka upload.php) that allows remote attackers to upload arbitrary files via a modified CurrentFolder parameter in a direct request to admin/filemanager/upload.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.cubecart.com/site/forums/index.php?showtopic=14972'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.cubecart.com/site/forums/index.php?showtopic=14960'}, {'name': 'cubecart-connector-file-include(24883)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24883'}, {'name': '482', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/482'}, {'name': '20060223 NSA Group Security Advisory NSAG-&sup1;197-23.02.2006 Vulnerability CubeCart 3.0.0 ? 3.0.6', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/425931/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.cubecart.com/site/forums/index.php?showtopic=14817'}, {'name': '16796', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16796'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.cubecart.com/site/forums/index.php?showtopic=14825'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cubecart.com/site/forums/index.php?showtopic=14704'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nsag.ru/vuln/892.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0923
Multiple cross-site scripting (XSS) vulnerabilities in MyPHPNuke (MPN) 1.88 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the letter parameter in reviews.php and (2) the dcategory parameter in download.php.
Affected Products: n/a
References: [{'name': '491', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/491'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nukedx.com/?viewdoc=12'}, {'name': 'myphpnuke-reviews-download-xss(24887)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24887'}, {'name': '19052', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19052'}, {'name': '16815', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16815'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.myphpnuke.com/article.php?sid=1035&mode=thread&order=0'}, {'name': '20060224 Advisory: MyPHPNuke <= 1.8.8 multiple XSS vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/425983/100/0/threaded'}, {'name': 'ADV-2006-0750', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0750'}]
CVE State: PUBLISHED
Explain CVE-2006-0924
Cross-site scripting (XSS) vulnerability in Brown Bear iCal 3.10 allows remote attackers to inject arbitrary web script or HTML via the Calendar Text field when a new event is added.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': 'ADV-2006-0727', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0727'}, {'name': '16845', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16845'}, {'name': 'ical-calendartext-xss(24919)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24919'}, {'name': '23472', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23472'}, {'name': '19001', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19001'}]
CVE State: PUBLISHED
Explain CVE-2006-0925
Format string vulnerability in the IMAP4rev1 server in Alt-N MDaemon 8.1.1 and possibly 8.1.4 allows remote attackers to cause a denial of service (CPU consumption) by creating and then listing folders whose names contain format string specifiers.
Affected Products: n/a
References: [{'name': 'mdaemon-imap-foldername-dos(24916)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24916'}, {'name': '18921', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18921'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nsag.ru/vuln/888.html'}, {'name': 'ADV-2006-0729', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0729'}, {'name': '16854', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16854'}]
CVE State: PUBLISHED
Explain CVE-2006-0926
Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0, ZipMagic Deluxe 9.0, and StuffIt Expander 9.0.0.21 Engine 9.0.0.21 allow remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive.
Affected Products: n/a
References: [{'name': 'ADV-2006-0732', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0732'}, {'name': '23463', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23463'}, {'name': '16806', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16806'}, {'name': '20060224 StuffIt and ZipMagic Family of products Directory traversal', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/425972/100/0/threaded'}, {'name': 'stuffit-zipmagic-archive-directory-traversal(24886)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24886'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hamid.ir/security/stuffit.txt'}, {'name': '19010', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19010'}]
CVE State: PUBLISHED
Explain CVE-2006-0927
Multiple cross-site scripting (XSS) vulnerabilities in the JGS-XA JGS-Gallery Addon 4.0.0 and earlier for Woltlab Burning Board (wBB) 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) userid parameter in (a) jgs_galerie_slideshow.php and (b) jgs_galerie_scroll.php, and the (2) katid parameter in (c) jgs_galerie_slideshow.php.
Affected Products: n/a
References: [{'name': '16810', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16810'}, {'name': '20060224 Advisory: Woltlab Burning Board 2.x (JGS-Gallery MOD <= 4.0) multiple XSS vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0615.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nukedx.com/?viewdoc=11'}, {'name': '20060224 Advisory: Woltlab Burning Board 2.x (JGS-Gallery MOD <= 4.0)multiple XSS vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/425981/100/0/threaded'}, {'name': 'wbb-jgsgallerymod-xss(24888)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24888'}, {'name': '16843', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16843'}]
CVE State: PUBLISHED
Explain CVE-2006-0928
The POP3 Server in ArGoSoft Mail Server Pro 1.8 allows remote attackers to obtain sensitive information via the _DUMP command, which reveals the operating system, registered user, and registration code.
Affected Products: n/a
References: [{'name': '16808', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16808'}, {'name': '18990', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18990'}, {'name': '20060224 NSA Group Security Advisory NSAG-&sup1;198-23.02.2006 Vulnerability ArGoSoft Mail Server Pro', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/425968/100/0/threaded'}, {'name': 'ADV-2006-0733', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0733'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nsag.ru/vuln/879.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0929
Directory traversal vulnerability in the IMAP server in ArGoSoft Mail Server Pro 1.8.8.1 allows remote authenticated users to create arbitrary folders via a .. (dot dot) in the RENAME command.
Affected Products: n/a
References: [{'name': '18990', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18990'}, {'name': '16809', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16809'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nsag.ru/vuln/878.html'}, {'name': '20060224 NSA Group Security Advisory NSAG-&sup1;200-24.02.2006 Vulnerability ArGoSoft Mail Server Pro IMAP', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/425969/100/0/threaded'}, {'name': 'ADV-2006-0733', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0733'}]
CVE State: PUBLISHED
Explain CVE-2006-0930
Directory traversal vulnerability in Webmail in ArGoSoft Mail Server Pro 1.8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the UIDL parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.nsag.ru/vuln/877.html'}, {'name': '18990', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18990'}, {'name': 'ADV-2006-0733', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0733'}, {'name': '487', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/487'}]
CVE State: PUBLISHED
Explain CVE-2006-0931
Directory traversal vulnerability in PEAR::Archive_Tar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.hamid.ir/security/phptar.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://pear.php.net/bugs/bug.php?id=6933'}, {'name': '23481', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23481'}, {'name': 'ADV-2006-0728', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0728'}, {'name': '20060224 Archive_Tar v 1.2(Tested) (Tar file management class) Directory traversal', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/425967/100/0/threaded'}, {'name': '19011', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19011'}, {'name': '16805', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16805'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://pear.php.net/package/Archive_Tar/download/'}]
CVE State: PUBLISHED
Explain CVE-2006-0932
Directory traversal vulnerability in zip.lib.php 0.1.1 in PEAR::Archive_Zip allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a ZIP archive.
Affected Products: n/a
References: [{'name': '20060225 Archive_Zip (Zip file management class) Directory traversal', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426153/100/0/threaded'}, {'name': '20060224 Archive_Tar v 1.2(Tested) (Tar file management class) Directory traversal', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/425967/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hamid.ir/security/phpzip.txt'}, {'name': 'ziplib-directory-traversal(24972)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24972'}, {'name': '486', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/486'}]
CVE State: PUBLISHED
Explain CVE-2006-0933
Cross-site scripting (XSS) vulnerability in PHPX 3.5.9 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a url XCode tag in a posted message.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': 'ADV-2006-0722', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0722'}, {'name': '16799', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16799'}, {'name': '18688', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18688'}, {'name': 'phpx-xcode-tag-xss(24874)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24874'}]
CVE State: PUBLISHED
Explain CVE-2006-0934
Cross-site scripting (XSS) vulnerability in webinsta Limbo 1.0.4.2 allows remote attackers to inject arbitrary web script or HTML via the message field in the Contact Form.
Affected Products: n/a
References: [{'name': '18723', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18723'}, {'name': 'ADV-2006-0721', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0721'}, {'name': '23469', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23469'}, {'tags': ['x_refsource_MISC'], 'url': 'http://osvdb.org/ref/23/23469-limbo.txt'}, {'name': '16811', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16811'}, {'name': 'webinsta-limbo-contact-form-xss(24877)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24877'}]
CVE State: PUBLISHED
Explain CVE-2006-0935
Microsoft Word 2003 allows remote attackers to cause a denial of service (application crash) via a crafted file, as demonstrated by 101_filefuzz.
Affected Products: n/a
References: [{'name': '[Dailydave] 20060221 word dos 4fun', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://archives.neohapsis.com/archives/dailydave/2006-q1/0179.html'}, {'name': '16782', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16782'}]
CVE State: PUBLISHED
Explain CVE-2006-0936
Free Host Shop Website Generator 3.3 allows remote authenticated users with administrative privileges to upload and execute arbitrary files via a formname parameter with a filename containing a dangerous file extension and a trailing %00.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://nsag.ru/vuln/894.html'}, {'name': '19014', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19014'}, {'name': '16823', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16823'}, {'name': '20060225 NSA Group Security Advisory NSAG-&sup1;202-25.02.2006 Vulnerability WEBSITE GENERATOR 3.3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426077/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0937
U.N.U. Mailgust 1.9 allows remote attackers to obtain sensitive information via a direct request to index.php with method=showfullcsv, which reveals the POP3 server configuration, including account name and password.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://nsag.ru/vuln/890.html'}, {'name': '18998', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18998'}, {'name': 'mailgust-index-info-disclosure(24890)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24890'}]
CVE State: PUBLISHED
Explain CVE-2006-0938
Cross-site scripting (XSS) vulnerability in eZ publish 3.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the RefererURL parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.nukedx.com/?viewdoc=16'}, {'name': '16817', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16817'}, {'name': 'ezpublish-referrerurl-xss(24956)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24956'}, {'name': '20060225 Advisory: eZ publish <= 3.7.3 (imagecatalogue module) XSSvulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426076/100/0/threaded'}, {'name': '1015683', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015683'}]
CVE State: PUBLISHED
Explain CVE-2006-0939
SQL injection vulnerability in DCI-Taskeen 1.03 allows remote attackers to execute arbitrary SQL commands via the (1) id or (2) action parameter to (a) basket.php, or (3) id or (4) page parameter to (b) cat.php.
Affected Products: n/a
References: [{'name': 'dci-taskeen-multiple-scripts-sql-injection(24963)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24963'}, {'name': '20060225 SQL Injection in DCI-Taskeen', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426082'}, {'name': '16828', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16828'}, {'name': '495', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/495'}, {'name': '1015685', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015685'}]
CVE State: PUBLISHED
Explain CVE-2006-0940
Multiple direct static code injection vulnerabilities in savesettings.php in ShoutLIVE 1.1.0 allow remote attackers to execute arbitrary PHP code via variables that are written to settings.php.
Affected Products: n/a
References: [{'name': '23482', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23482'}, {'name': '20060307 [eVuln] ShoutLIVE PHP Code Execution & Multiple XSS Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426985/100/0/threaded'}, {'name': '16857', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16857'}, {'name': '19047', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19047'}, {'name': 'shoutlive-savesettings-file-include(24897)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24897'}, {'name': '557', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/557'}, {'name': 'ADV-2006-0755', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0755'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/87/summary.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0941
Multiple cross-site scripting (XSS) vulnerabilities in post.php in ShoutLIVE 1.1.0 allow remote attackers to inject arbitrary web script or HTML via certain variables when posting new messages.
Affected Products: n/a
References: [{'name': '20060307 [eVuln] ShoutLIVE PHP Code Execution & Multiple XSS Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426985/100/0/threaded'}, {'name': '16857', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16857'}, {'name': 'shoutlive-post-xss(24901)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24901'}, {'name': '19047', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19047'}, {'name': '23483', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23483'}, {'name': '557', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/557'}, {'name': 'ADV-2006-0755', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0755'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/87/summary.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0942
SQL injection vulnerability in profil.php in PwsPHP 1.2.3, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the aff_news_form parameter, a different vulnerability than CVE-2005-1509.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://downloads.securityfocus.com/vulnerabilities/exploits/PwsPHP_SQL_Inj.php'}, {'name': '28444', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/28444'}, {'name': '16567', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16567'}]
CVE State: PUBLISHED
Explain CVE-2006-0943
SQL injection vulnerability in the sondages module in index.php in PwsPHP 1.2.3 allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
Affected Products: n/a
References: [{'name': '1015684', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015684'}, {'name': '20060225 PwsPHP Injection SQL on Index.php', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426084/100/0/threaded'}, {'name': '496', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/496'}, {'name': '20060226 Re: PwsPHP Injection SQL on Index.php', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426183/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.pwsphp.com/index.php?mod=news&ac=commentaires&id=278'}, {'name': 'ADV-2006-0748', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0748'}]
CVE State: PUBLISHED
Explain CVE-2006-0944
Archangel Weblog 0.90.02 allows remote attackers to bypass authentication by setting the ba_admin cookie to 1.
Affected Products: n/a
References: [{'name': '1015689', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015689'}, {'name': 'archangel-admin-auth-bypass(24984)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24984'}, {'name': '16848', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16848'}, {'name': '23620', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23620'}, {'name': '20060226 Archangel Weblog 0.90.02 Admin Authentication Bypass & Remote File Inclusion', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426184/100/0/threaded'}, {'name': '3859', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/3859'}]
CVE State: PUBLISHED
Explain CVE-2006-0945
PHP remote file include vulnerability in admin/index.php in Archangel Weblog 0.90.02 allows remote authenticated administrators to execute arbitrary PHP code via a URL ending in a NULL (%00) in the index parameter.
Affected Products: n/a
References: [{'name': '1015689', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015689'}, {'name': '23621', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23621'}, {'name': '16848', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16848'}, {'name': 'archangel-index-file-include(25142)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25142'}, {'name': '20060226 Archangel Weblog 0.90.02 Admin Authentication Bypass & Remote File Inclusion', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426184/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0946
Cross-site scripting (XSS) vulnerability in Thomson SpeedTouch modems running firmware 5.3.2.6.0 allows remote attackers to inject arbitrary web script or HTML via the name parameter to the LocalNetwork page.
Affected Products: n/a
References: [{'name': '1015688', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015688'}, {'name': '16839', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16839'}, {'name': 'ADV-2006-0765', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0765'}, {'name': '20060226 Thomson SpeedTouch 500 modems vulnerable to XSS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426186'}, {'name': '23527', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23527'}, {'name': '19069', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19069'}, {'name': 'speedtouch-localnetwork-xss(24977)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24977'}]
CVE State: PUBLISHED
Explain CVE-2006-0947
Thomson SpeedTouch modem running firmware 5.3.2.6.0 allows remote attackers to create users that cannot be deleted via scripting code in the "31" parameter in a NewUser function, which is not filtered by the modem when creating the account, but cannot be deleted by the administrator, possibly due to cleansing that occurs in the administrator interface.
Affected Products: n/a
References: [{'name': '1015688', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015688'}, {'name': '16839', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16839'}, {'name': 'ADV-2006-0765', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0765'}, {'name': '20060226 Thomson SpeedTouch 500 modems vulnerable to XSS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426186'}, {'name': '19069', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19069'}]
CVE State: PUBLISHED
Explain CVE-2006-0948
AOL 9.0 Security Edition revision 4184.2340, and probably other versions, uses insecure permissions (Everyone/Full Control) for the "America Online 9.0" directory, which allows local users to gain privileges by replacing critical files.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2006-08'}, {'name': 'ADV-2006-3317', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/3317'}, {'name': 'aol-default-insecure-permissions(28445)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/28445'}, {'name': '18734', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18734'}, {'name': '20060818 Secunia Research: AOL Insecure Default Directory Permissions', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/443622/100/0/threaded'}, {'name': '1416', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/1416'}, {'name': '27995', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/27995'}, {'name': '19583', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/19583'}, {'name': '1016717', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1016717'}]
CVE State: PUBLISHED
Explain CVE-2006-0949
RaidenHTTPD 1.1.47 allows remote attackers to obtain source code of script files, including PHP, via crafted requests involving (1) "." (dot), (2) space, and (3) "/" (slash) characters.
Affected Products: n/a
References: [{'name': 'raidenhttpd-extension-obtain-information(25037)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25037'}, {'name': '16934', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16934'}, {'name': 'ADV-2006-0807', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0807'}, {'name': '19032', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19032'}, {'name': '23616', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23616'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2006-15/advisory/'}]
CVE State: PUBLISHED
Explain CVE-2006-0950
unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." (dot dot) sequences in a filename.
Affected Products: n/a
References: [{'name': 'ADV-2006-0938', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0938'}, {'name': '20060313 Secunia Research: unalz Filename Handling', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=114226632422033&w=2'}, {'name': '17105', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17105'}, {'name': '23835', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23835'}, {'name': '19063', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19063'}, {'name': '575', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/575'}, {'name': '1015780', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015780'}, {'name': 'unalz-archive-directory-traversal(25171)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25171'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2006-16/'}, {'name': '20060313 Secunia Research: unalz Filename Handling Directory TraversalVulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/427475/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0951
The GUI (nod32.exe) in NOD32 2.5 runs with SYSTEM privileges when the scheduler runs a scheduled on-demand scan, which allows local users to execute arbitrary code during a scheduled scan via unspecified attack vectors.
Affected Products: n/a
References: [{'name': '24394', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24394'}, {'name': 'ADV-2006-1242', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1242'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2006-17/advisory/'}, {'name': '19054', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19054'}]
CVE State: PUBLISHED
Explain CVE-2006-0956
nuauth in NuFW before 1.0.21 does not properly handle blocking TLS sockets, which allows remote authenticated users to cause a denial of service (service hang) by flooding packets at the authentication server.
Affected Products: n/a
References: [{'name': 'ADV-2006-0762', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0762'}, {'name': '19046', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19046'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.nufw.org/+NuFW-1-21-minor-security-fix+.html'}, {'name': '16868', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16868'}]
CVE State: PUBLISHED
Explain CVE-2006-0957
Direct static code injection vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to execute arbitrary PHP code via the (1) X-Forwarded-For and (2) Client-Ip HTTP headers, which are stored in Data/flood.db.php.
Affected Products: n/a
References: [{'name': '20060310 [eVuln] FreeForum PHP Code Execution & Multiple XSS Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/427321/100/0/threaded'}, {'name': 'ADV-2006-0759', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0759'}, {'name': '16871', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16871'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/89/summary.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://soft.zoneo.net/freeForum/changes.php'}, {'name': '19020', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19020'}]
CVE State: PUBLISHED
Explain CVE-2006-0958
Cross-site scripting (XSS) vulnerability in func.inc.php in ZoneO-Soft freeForum before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) subject parameters.
Affected Products: n/a
References: [{'name': '20060310 [eVuln] FreeForum PHP Code Execution & Multiple XSS Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/427321/100/0/threaded'}, {'name': 'ADV-2006-0759', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0759'}, {'name': 'freeforum-func-xss(24925)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24925'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/89/summary.html'}, {'name': '16877', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16877'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://soft.zoneo.net/freeForum/changes.php'}, {'name': '19020', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19020'}]
CVE State: PUBLISHED
Explain CVE-2006-0959
SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands by setting the comma variable value via the comma parameter in a cookie.  NOTE: 1.04 has also been reported to be affected.
Affected Products: n/a
References: [{'name': 'ADV-2006-0774', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0774'}, {'name': '16631', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16631'}, {'name': '20060228 MyBB 1.3 NewSQL Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426320/100/0/threaded'}, {'name': '20060303 MyBB 1.04 Perl Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426653/100/0/threaded'}, {'name': '512', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/512'}, {'name': '1539', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1539'}, {'name': '19061', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19061'}, {'name': '23554', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23554'}, {'name': 'mybb-misc-sql-injection(24953)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24953'}]
CVE State: PUBLISHED
Explain CVE-2006-0960
uConfig agent in Compex NetPassage WPE54G router allows remote attackers to cause a denial of service (unresposiveness) via crafted datagrams to UDP port 7778.
Affected Products: n/a
References: [{'name': '19037', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19037'}, {'name': '1015690', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015690'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.security.nnov.ru/Ldocument605.html'}, {'name': 'netpassage-udp-dos(24968)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24968'}, {'name': 'ADV-2006-0780', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0780'}, {'name': '16894', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16894'}]
CVE State: PUBLISHED
Explain CVE-2006-0961
SQL injection vulnerability in yazdir.asp in Cilem Hiber 1.1 allows remote attackers to execute arbitrary SQL commands via the haber_id parameter.  NOTE: this product has also been referred to as "Cilem News," although that does not appear to be the proper name.
Affected Products: n/a
References: [{'name': '16813', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16813'}, {'name': '1015677', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015677'}, {'name': '23618', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23618'}, {'name': '20060224 Advisory: CilemNews System <= 1.1 Remote SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2006-02/0449.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nukedx.com/?viewdoc=10'}, {'name': '1562', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1562'}, {'name': '20060224 Advisory: CilemNews System <= 1.1 Remote SQL', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=114079912721723&w=2'}, {'name': 'cilemnews-sql-injection(24920)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24920'}, {'name': 'ADV-2006-0881', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0881'}, {'name': '19157', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19157'}]
CVE State: PUBLISHED
Explain CVE-2006-0962
SQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the pass parameter in a cookie.
Affected Products: n/a
References: [{'name': '16930', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16930'}, {'name': '19084', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19084'}, {'name': 'vubb-index-sql-injection(25019)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25019'}, {'name': 'ADV-2006-0799', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0799'}, {'name': '1543', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1543'}]
CVE State: PUBLISHED
Explain CVE-2006-0963
Multiple buffer overflows in STLport 5.0.2 might allow local users to execute arbitrary code via (1) long locale environment variables to a strcpy function call in c_locale_glibc2.c and (2) long arguments to unspecified functions in num_put_float.cpp.
Affected Products: n/a
References: [{'name': 'stlport-strcpy-local-bo(25159)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25159'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=397543'}, {'name': '16928', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16928'}, {'name': '19051', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19051'}, {'name': 'ADV-2006-0800', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0800'}]
CVE State: PUBLISHED
Explain CVE-2006-0964
Client Firewall in NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to bypass firewall program execution rules by replacing an allowed program with an arbitrary program.
Affected Products: n/a
References: [{'name': '16906', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16906'}, {'name': '20060301 NCP VPN/PKI Client - various Bugs', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426480/100/0/threaded'}, {'name': 'ncp-client-firewall-bypass-security(25242)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25242'}, {'name': '19082', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19082'}, {'name': '20060301 NCP VPN/PKI Client - various Bugs', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/042640.html'}]
CVE State: PUBLISHED