Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2006-1089
Cross-site scripting (XSS) vulnerability in header.php in PunBB 1.2.10 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly handled when the PHP_SELF variable is used to handle a pun_page tag.
Affected Products: n/a
References: [{'name': 'punbb-header-xss(24982)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24982'}, {'name': '16891', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16891'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.punbb.org/changelogs/1.2.10_to_1.2.11.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.punbb.org/download/patch/punbb-1.2.10_to_1.2.11.patch'}, {'name': 'ADV-2006-0773', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0773'}, {'name': '19039', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19039'}]
CVE State: PUBLISHED
Explain CVE-2006-1090
register.php in PunBB 1.2.10 allows remote attackers to cause an unspecified denial of service via a flood of new user registrations.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.punbb.org/changelogs/1.2.10_to_1.2.11.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.punbb.org/download/patch/punbb-1.2.10_to_1.2.11.patch'}, {'name': 'ADV-2006-0773', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0773'}, {'name': 'punbb-register-ip-dos(24837)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24837'}]
CVE State: PUBLISHED
Explain CVE-2006-1091
Kaspersky Antivirus 5.0.5 and 5.5.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via unknown attack vectors.
Affected Products: n/a
References: [{'name': '20060303 Kaspersky Memory/CPU Usage Leak by design', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426699'}, {'name': '16942', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16942'}, {'name': '535', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/535'}, {'name': 'kaspersky-unspecified-dos(25221)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25221'}]
CVE State: PUBLISHED
Explain CVE-2006-1092
Unspecified vulnerability in the pagedata subsystem of the process file system (/proc) in Solaris 8 through 10 allows local users to cause a denial of service (system hang or panic) via unknown attack vectors that cause cause the kmem_oversize arena to allocate a large amount of system memory that does not get freed.
Affected Products: n/a
References: [{'name': 'ADV-2006-0829', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0829'}, {'name': '16966', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16966'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm'}, {'name': 'solaris-proc-pagedata-dos(25152)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25152'}, {'name': '102159', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-102159-1'}, {'name': '1015723', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015723'}, {'name': 'oval:org.mitre.oval:def:1618', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1618'}, {'name': '19128', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19128'}, {'name': '19716', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19716'}]
CVE State: PUBLISHED
Explain CVE-2006-1093
Unspecified vulnerability in IBM WebSphere 5.0.2.10 through 5.0.2.15 and 5.1.1.4 through 5.1.1.9 allows remote attackers to obtain sensitive information via unknown attack vectors, which causes JSP source code to be revealed.
Affected Products: n/a
References: [{'name': '1015716', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015716'}, {'name': '16908', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16908'}, {'name': 'ADV-2006-0788', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0788'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg21231377'}]
CVE State: PUBLISHED
Explain CVE-2006-1094
SQL injection vulnerability in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allows remote attackers to execute arbitrary SQL commands via the fileid parameter to (1) info_db.php or (2) database.php.
Affected Products: n/a
References: [{'name': '20060301 Woltlab Burning Board 2.x (Datenbank MOD fileid) MultipleVulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426583'}, {'name': '23810', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23810'}, {'name': '16914', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16914'}, {'name': '23808', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23808'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nukedx.com/?viewdoc=17'}]
CVE State: PUBLISHED
Explain CVE-2006-1095
Directory traversal vulnerability in the FileSession object in Mod_python module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.modpython.org/fs_sec_warn.html'}, {'name': '16916', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16916'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.cgisecurity.com/2006/02/07'}, {'name': 'ADV-2006-0768', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0768'}, {'name': '19239', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19239'}, {'name': 'modpython-filesession-command-execution(24965)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24965'}, {'name': '1015764', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015764'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.apache.org/viewcvs.cgi/httpd/mod_python/branches/3.2.x/NEWS?rev=378945'}]
CVE State: PUBLISHED
Explain CVE-2006-1096
Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter.  NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://pridels0.blogspot.com/2006/03/nz-ecommerce-sqlxss-vuln.html'}, {'name': '23600', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23600'}, {'name': '16931', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16931'}, {'name': '19088', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19088'}, {'name': 'ADV-2006-0803', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0803'}]
CVE State: PUBLISHED
Explain CVE-2006-1097
Multiple cross-site scripting (XSS) vulnerabilities in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allow remote attackers to inject arbitrary web script or HTML via the fileid parameter to (1) info_db.php or (2) database.php.
Affected Products: n/a
References: [{'name': '20060301 Woltlab Burning Board 2.x (Datenbank MOD fileid) MultipleVulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426583'}, {'name': '23811', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23811'}, {'name': '20060301 Woltlab Burning Board 2.x (Datenbank MOD fileid) MultipleVulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-03/0033.html'}, {'name': 'wbb-multiple-xss(25004)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25004'}, {'name': '23809', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23809'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nukedx.com/?viewdoc=17'}]
CVE State: PUBLISHED
Explain CVE-2006-1098
Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the (1) informationID or (2) ParentCategory parameter to index.php. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://pridels0.blogspot.com/2006/03/nz-ecommerce-sqlxss-vuln.html'}, {'name': '16931', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16931'}, {'name': '23601', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23601'}, {'name': '19088', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19088'}, {'name': 'ADV-2006-0803', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0803'}]
CVE State: PUBLISHED
Explain CVE-2006-1099
PHP remote file include vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '16932', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16932'}]
CVE State: PUBLISHED
Explain CVE-2006-1100
Buffer overflow in the sgetstr function in shared/cube.h in Sauerbraten 2006_02_28 and earlier, as derived from the Cube engine, allows remote attackers to execute arbitrary code via long streams of input data.
Affected Products: n/a
References: [{'name': 'sauerbraten-sgetstr-bo(25083)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25083'}, {'name': '20060306 Multiple vulnerabilities in Cube engine 2005_08_29', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426867/100/0/threaded'}, {'name': '19199', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19199'}, {'name': '16986', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16986'}, {'name': '20060306 Multiple vulnerabilities in Sauerbraten engine 2006_02_28', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426865/100/0/threaded'}, {'name': '19110', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19110'}, {'name': 'ADV-2006-0847', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0847'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/evilcube-adv.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cvs.sourceforge.net/viewcvs.py/sauerbraten/sauerbraten/src/shared/cube.h?r1=1.7&r2=1.8'}, {'name': '19111', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19111'}, {'name': 'GLSA-200603-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200603-10.xml'}, {'name': 'ADV-2006-0848', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0848'}]
CVE State: PUBLISHED
Explain CVE-2006-1101
The (1) sgetstr and (2) getint functions in Sauerbraten 2006_02_28, as derived from the Cube engine, allow remote attackers to cause a denial of service (segmentation fault) via long streams of input data that trigger an out-of-bounds read, as demonstrated using SV_EXT tag data in the Cube engine, which is not properly handled by getint.
Affected Products: n/a
References: [{'name': '20060306 Multiple vulnerabilities in Cube engine 2005_08_29', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426867/100/0/threaded'}, {'name': '19199', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19199'}, {'name': '16986', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16986'}, {'name': '20060306 Multiple vulnerabilities in Sauerbraten engine 2006_02_28', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426865/100/0/threaded'}, {'name': '19110', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19110'}, {'name': 'ADV-2006-0847', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0847'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/evilcube-adv.txt'}, {'name': 'sauerbraten-multiple-dos(25085)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25085'}, {'name': '19111', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19111'}, {'name': 'GLSA-200603-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200603-10.xml'}, {'name': 'ADV-2006-0848', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0848'}]
CVE State: PUBLISHED
Explain CVE-2006-1102
Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (client exit) by forcing the server to change to a map (ogz) file whose name contains ".." sequences and has a certain length that prevents the addition of the ".ogz" extension.
Affected Products: n/a
References: [{'name': '20060306 Multiple vulnerabilities in Cube engine 2005_08_29', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426867/100/0/threaded'}, {'name': '19199', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19199'}, {'name': '16986', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16986'}, {'name': '20060306 Multiple vulnerabilities in Sauerbraten engine 2006_02_28', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426865/100/0/threaded'}, {'name': '548', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/548'}, {'name': '19110', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19110'}, {'name': 'ADV-2006-0847', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0847'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/evilcube-adv.txt'}, {'name': 'sauerbraten-sprintf-dos(25086)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25086'}, {'name': '19111', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19111'}, {'name': 'GLSA-200603-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200603-10.xml'}, {'name': 'ADV-2006-0848', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0848'}]
CVE State: PUBLISHED
Explain CVE-2006-1103
engine/server.cpp in Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (segmentation fault) via a client that does not completely join the game and times out, which results in a null pointer dereference.
Affected Products: n/a
References: [{'name': 'sauerbraten-engineserver-dos(25087)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25087'}, {'name': '16986', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16986'}, {'name': '20060306 Multiple vulnerabilities in Sauerbraten engine 2006_02_28', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426865/100/0/threaded'}, {'name': '550', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/550'}, {'name': 'ADV-2006-0848', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0848'}]
CVE State: PUBLISHED
Explain CVE-2006-1104
Multiple SQL injection vulnerabilities in Pixelpost 1.5 beta 1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the showimage parameter in index.php; and the (2) USER_AGENT, (3) HTTP_REFERER, and (4) HTTP_HOST HTTP header fields as used in the book_vistor function in includes/functions.php.  NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://forum.pixelpost.org/showthread.php?t=3535'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.neosecurityteam.net/index.php?action=advisories&id=19'}, {'name': 'pixelpost-functions-sql-injection(25046)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25046'}, {'name': '20060304 Pixel Post Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426764/100/0/threaded'}, {'name': '16964', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16964'}, {'name': 'ADV-2006-0823', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0823'}, {'name': 'pixelpost-index-sql-injection(25044)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25044'}]
CVE State: PUBLISHED
Explain CVE-2006-1105
Pixelpost 1.5 beta 1 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function.  NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://forum.pixelpost.org/showthread.php?t=3535'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.neosecurityteam.net/index.php?action=advisories&id=19'}, {'name': '20060304 Pixel Post Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426764/100/0/threaded'}, {'name': '16964', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16964'}, {'name': 'pixelpost-phpinfo-obtain-information(25048)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25048'}, {'name': 'ADV-2006-0823', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0823'}]
CVE State: PUBLISHED
Explain CVE-2006-1106
Cross-site scripting (XSS) vulnerability in Pixelpost 1.5 beta 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) message, (2) name, (3) url, and (4) email parameters when commenting on a post.  NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.
Affected Products: n/a
References: [{'name': 'pixelpost-functions-xss(25047)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25047'}, {'tags': ['x_refsource_MISC'], 'url': 'http://forum.pixelpost.org/showthread.php?t=3535'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.neosecurityteam.net/index.php?action=advisories&id=19'}, {'name': '20060304 Pixel Post Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426764/100/0/threaded'}, {'name': '16964', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16964'}, {'name': 'ADV-2006-0823', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0823'}]
CVE State: PUBLISHED
Explain CVE-2006-1107
Cross-site scripting (XSS) vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the nick parameter.
Affected Products: n/a
References: [{'name': 'ADV-2006-0860', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0860'}, {'name': '17017', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17017'}, {'name': '595', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/595'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/93/summary.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://nmdeluxe.com/index.php'}, {'name': 'nmdeluxe-news-xss(25069)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25069'}, {'name': '19117', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19117'}, {'name': '20060317 [eVuln] NMDeluxe XSS & SQL Injection Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428002/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-1108
SQL injection vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': 'ADV-2006-0860', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0860'}, {'name': '17017', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17017'}, {'name': '595', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/595'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/93/summary.html'}, {'name': 'nmdeluxe-news-sql-injection(25070)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25070'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://nmdeluxe.com/index.php'}, {'name': '19117', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19117'}, {'name': '20060317 [eVuln] NMDeluxe XSS & SQL Injection Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428002/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-1109
SQL injection vulnerability in index.asp in Total Ecommerce 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: it is not clear whether this report is associated with a specific product.  If not, then it should not be included in CVE.
Affected Products: n/a
References: [{'name': '16960', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16960'}, {'name': '19103', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19103'}, {'name': 'totalecommerce-index-sql-injection(25045)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25045'}, {'name': '20060304 Advisory: TotalECommerce (index.asp id) Remote SQL InjectionVulnerability.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426765/100/0/threaded'}, {'name': '530', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/530'}, {'name': 'ADV-2006-0840', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0840'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nukedx.com/?viewdoc=18'}]
CVE State: PUBLISHED
Explain CVE-2006-1110
Cross-site scripting (XSS) vulnerability in Aztek Forum 4.0 allows remote attackers to inject arbitrary web script or HTML via the message body in a new message.
Affected Products: n/a
References: [{'name': '1547', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1547'}, {'name': '23610', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23610'}, {'name': '19096', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19096'}, {'name': 'aztekforum-multiple-xss(25035)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25035'}, {'name': '16938', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16938'}, {'name': '20060302 AZTEK forums 4.0 multiple vulnerabilities (PoC)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426650/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-1111
Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a "*/*" in the msg parameter to index.php, which reveals usernames and passwords in a MySQL error message, possibly due to a forced SQL error or SQL injection.
Affected Products: n/a
References: [{'name': '1547', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1547'}, {'name': '23611', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23611'}, {'name': '16938', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16938'}, {'name': 'aztekforum-info-disclosure(25036)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25036'}, {'name': '20060302 AZTEK forums 4.0 multiple vulnerabilities (PoC)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426650/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-1112
Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a long login value in a register form, which displays the installation path in a MySQL error message.
Affected Products: n/a
References: [{'name': '1547', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1547'}, {'name': '539', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/539'}, {'name': '23612', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23612'}, {'name': '16938', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16938'}, {'name': '20060302 AZTEK forums 4.0 multiple vulnerabilities (PoC)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426650/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-1113
SQL injection vulnerability in podcast.php in Loudblog before 0.42 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://loudblog.de/forum/viewtopic.php?id=590'}, {'name': '17023', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17023'}, {'name': '20060307 Loudblog 0.41 SQL Injection, Local file read/include', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426973/100/0/threaded'}, {'name': '19172', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19172'}, {'name': 'loudblog-podcast-sql-injection(25101)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25101'}, {'name': 'ADV-2006-0878', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0878'}]
CVE State: PUBLISHED
Explain CVE-2006-1114
Multiple directory traversal vulnerabilities in Loudblog before 0.42 allow remote attackers to read or include arbitrary files via a .. (dot dot) and trailing %00 (NULL) byte in the (1) template and (2) page parameters in (a) index.php, and the (3) language parameter in (b) inc/backend_settings.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://loudblog.de/forum/viewtopic.php?id=590'}, {'name': '17023', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17023'}, {'name': '20060307 Loudblog 0.41 SQL Injection, Local file read/include', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426973/100/0/threaded'}, {'name': 'loudblog-index-directory-traversal(25103)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25103'}, {'name': '19172', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19172'}, {'name': 'ADV-2006-0878', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0878'}]
CVE State: PUBLISHED
Explain CVE-2006-1115
nCipher HSM before 2.22.6, when generating a Diffie-Hellman public/private key pair without any specified DiscreteLogGroup parameters, chooses random parameters that could allow an attacker to crack the private key in significantly less time than a brute force attack.
Affected Products: n/a
References: [{'name': 'ADV-2006-0862', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0862'}, {'name': '1015719', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015719'}, {'name': '20060308 nCipher Advisory #12: Insecure Generation of Diffie-Hellman keys', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/427146/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ncipher.com/resources/95/sa12_insecure_generation_of_diffiehellman_keys'}, {'name': '17006', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17006'}, {'name': '19137', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19137'}, {'name': 'ncipher-hsm-weak-key(25060)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25060'}]
CVE State: PUBLISHED
Explain CVE-2006-1116
The CBC-MAC integrity functions in the nCipher nCore API before 2.18 transmit the initialization vector IV as part of a message when the implementation uses a non-zero IV, which allows remote attackers to bypass integrity checks and modify messages without being detected.
Affected Products: n/a
References: [{'name': '20060308 nCipher Advisory #13: CBC-MAC IV misleading programming interface', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/427150/100/0/threaded'}, {'name': 'ADV-2006-0862', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0862'}, {'name': 'ncipher-ncore-bypass-security(25062)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25062'}, {'name': '17011', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17011'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ncipher.com/resources/96/sa13_cbcmac_iv_misleading_programming_interface'}, {'name': '1015718', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015718'}, {'name': '19137', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19137'}]
CVE State: PUBLISHED
Explain CVE-2006-1117
nCipher firmware before V10, as used by (1) nShield, (2) nForce, (3) netHSM, (4) payShield, (5) SecureDB, (6) DSE200 Document Sealing Engine, (7) Time Source Master Clock (TSMC), and possibly other products, contains certain options that were only intended for testing and not production, which might allow remote attackers to obtain information about encryption keys and crack those keys with less effort than brute force.
Affected Products: n/a
References: [{'name': 'ADV-2006-0862', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0862'}, {'name': '20060309 nCipher Advisory #14: Presence of flaws in firmware security', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/427151/100/0/threaded'}, {'name': 'ncipher-firmware-weak-security(25063)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25063'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ncipher.com/resources/97/sa14_presence_of_flaws_in_firmware_security'}, {'name': '1015718', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015718'}, {'name': '17012', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17012'}, {'name': '19137', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19137'}]
CVE State: PUBLISHED
Explain CVE-2006-1118
SQL injection vulnerability in bmail before Aardvark PR9.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving GBK character sets.
Affected Products: n/a
References: [{'name': '19147', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19147'}, {'name': 'ADV-2006-0863', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0863'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?group_id=144412&release_id=399256'}, {'name': 'bmail-gbkcharacterset-sql-injection(25073)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25073'}]
CVE State: PUBLISHED
Explain CVE-2006-1119
fantastico in Cpanel does not properly handle when it has insufficient permissions to perform certain file operations, which allows remote authenticated users to obtain the full pathname, which is leaked in a PHP error message.
Affected Products: n/a
References: [{'name': '20060307 Cpanel Path Disclosure Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426957/100/0/threaded'}, {'name': 'cpanel-fantastico-path-disclosure(25277)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25277'}]
CVE State: PUBLISHED
Explain CVE-2006-1120
Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 6.1.1 and earlier, with register_globals enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) its_url parameter in the documents page and (2) url parameter in the send_write page of (a) index.php; (3) subject, and (4) images parameters to (b) calendar.php; (5) bid, (6) replying_msg, (7) subject, (8) body, and (9) mid parameters to (c) forums.php; (10) subject and (11) message parameters to (d) inbox.php; (12) subject_color and (13) email parameters to (e) lostpassword.php; and the (14) c_name, (15) content_inicial, and (16) cid parameters to (f) mycontents.php.  NOTE: the calendar.php/day vector is already subsumed by CVE-2006-0220, and the calendar.php/month, calendar.php/year, and search.php/q parameters for calendar.php are already subsumed by CVE-2004-2511.
Affected Products: n/a
References: [{'name': 'dcpportal-multiple-scripts-xss(25279)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25279'}, {'name': '23979', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23979'}, {'name': '23981', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23981'}, {'name': '20060309 DCP Portal: Multiple XSS Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/427175/100/0/threaded'}, {'name': '23980', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23980'}, {'name': '17050', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17050'}, {'name': '392', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/392'}, {'name': '23978', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23978'}, {'name': '23976', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23976'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.seclab.tuwien.ac.at/advisories/TUVSA-0603-001.txt'}, {'name': '23977', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23977'}]
CVE State: PUBLISHED
Explain CVE-2006-1121
Cross-site scripting (XSS) vulnerability in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the query string to index.php.
Affected Products: n/a
References: [{'name': 'cutenews-index-script-xss(25052)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25052'}, {'name': '20060304 [KAPDA::#30] - CuteNews1.4.1 Cross_Site_Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426759/100/0/threaded'}, {'name': '16961', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16961'}, {'name': '1015726', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015726'}, {'tags': ['x_refsource_MISC'], 'url': 'http://kapda.ir/advisory-277.html'}, {'name': '531', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/531'}]
CVE State: PUBLISHED
Explain CVE-2006-1122
Cross-site scripting (XSS) vulnerability in Default.asp in D2KBlog 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Affected Products: n/a
References: [{'name': '17035', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17035'}, {'name': '559', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/559'}, {'name': 'ADV-2006-0896', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0896'}, {'name': 'd2kblog-default-msg-xss(25214)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25214'}, {'name': '23771', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23771'}, {'name': '20060308 [KAPDA::#32] - d2kBlog 1.0.3 Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/427103/100/0/threaded'}, {'name': '19177', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19177'}]
CVE State: PUBLISHED
Explain CVE-2006-1123
SQL injection vulnerability in D2KBlog 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the memName parameter in a cookie.
Affected Products: n/a
References: [{'name': '17035', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17035'}, {'name': '23770', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23770'}, {'name': 'd2kblog-memname-sql-injection(25215)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25215'}, {'name': '559', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/559'}, {'name': 'ADV-2006-0896', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0896'}, {'name': '20060308 [KAPDA::#32] - d2kBlog 1.0.3 Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/427103/100/0/threaded'}, {'name': '19177', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19177'}]
CVE State: PUBLISHED
Explain CVE-2006-1124
Buffer overflow in RevilloC MailServer and Proxy 1.21 allows remote attackers to execute arbitrary code via a long USER command.
Affected Products: n/a
References: [{'name': '19119', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19119'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.morx.org/rev.txt'}, {'name': '16997', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16997'}, {'name': '20060309 RevilloC MailServer 1.x "USER" Command Handling Remote Buffer Overflow Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/427192/100/0/threaded'}, {'name': '20060307 RevilloC mail server USER command heap overflow', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0910.html'}, {'name': 'revilloc-user-bo(25072)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25072'}, {'name': 'ADV-2006-0867', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0867'}, {'name': '1015739', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015739'}, {'name': '23735', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23735'}]
CVE State: PUBLISHED
Explain CVE-2006-1125
Grisoft AVG Free 7.1, and other versions including 7.0.308, sets Everyone/Full Control permissions for certain update files including (1) upd_vers.cfg, (2) incavi.avm, and (3) unspecified drivers, which might allow local users to gain privileges.
Affected Products: n/a
References: [{'name': '16952', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16952'}, {'name': '20060303 AVG 7 granting Everyone Full Control to updated files... even its drivers', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2006-02/0631.html'}, {'name': '19118', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19118'}, {'name': '1015728', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015728'}, {'name': 'avg-update-gain-privilieges(25139)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25139'}, {'name': 'ADV-2006-0845', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0845'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.dslreports.com/forum/remark%2C15601404'}]
CVE State: PUBLISHED
Explain CVE-2006-1126
Gallery 2 up to 2.0.2 allows remote attackers to spoof their IP address via a modified X-Forwarded-For (X_FORWARDED_FOR) HTTP header, which is checked by Gallery before other more reliable sources of IP address information, such as REMOTE_ADDR.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.gulftech.org/?node=research&article_id=00106-03022006'}, {'name': 'gallery-header-spoofing(25120)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25120'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://gallery.menalto.com/gallery_2.0.3_released'}, {'name': 'ADV-2006-0813', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0813'}, {'name': '20060303 Gallery 2 Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2006-02/0621.html'}, {'name': '19104', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19104'}, {'name': '1015717', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015717'}]
CVE State: PUBLISHED
Explain CVE-2006-1127
Cross-site scripting (XSS) vulnerability in Gallery 2 up to 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For (X_FORWARDED_FOR) HTTP header, which is not properly handled when adding a comment to an album.
Affected Products: n/a
References: [{'name': '16940', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16940'}, {'name': '23596', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23596'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gulftech.org/?node=research&article_id=00106-03022006'}, {'name': 'gallery-getremotehostaddress-xss(25117)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25117'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://gallery.menalto.com/gallery_2.0.3_released'}, {'name': 'ADV-2006-0813', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0813'}, {'name': '20060303 Gallery 2 Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2006-02/0621.html'}, {'name': '19104', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19104'}, {'name': '1015717', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015717'}]
CVE State: PUBLISHED
Explain CVE-2006-1128
Directory traversal vulnerability in the session handling class (GallerySession.class) in Gallery 2 up to 2.0.2 allows remote attackers to access and delete files by specifying the session in a cookie, which is used in constructing file paths before the session value is sanitized.
Affected Products: n/a
References: [{'name': 'gallery-sessionid-bypass-security(25118)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25118'}, {'name': '23597', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23597'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gulftech.org/?node=research&article_id=00106-03022006'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://gallery.menalto.com/gallery_2.0.3_released'}, {'name': '16948', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16948'}, {'name': 'ADV-2006-0813', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0813'}, {'name': '20060303 Gallery 2 Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2006-02/0621.html'}, {'name': '19104', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19104'}, {'name': '1015717', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015717'}]
CVE State: PUBLISHED