Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2006-0387
Stack-based buffer overflow in Safari in Mac OS X 10.4.5 and earlier, and 10.3.9 and earlier, allows remote attackers to execute arbitrary code via unspecified vectors involving a web page with crafted JavaScript, a different vulnerability than CVE-2005-4504.
Affected Products: n/a
References: [{'name': 'VU#176732', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/176732'}, {'name': '19064', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19064'}, {'name': '16907', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16907'}, {'name': '1015713', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015713'}, {'name': 'ADV-2006-0791', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0791'}, {'name': 'APPLE-SA-2006-03-01', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2006/Mar/msg00000.html'}, {'name': 'TA06-062A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA06-062A.html'}, {'name': 'macosx-safari-bo(25032)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25032'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=303382'}]
CVE State: PUBLISHED
Explain CVE-2006-0388
Safari in Mac OS X 10.3 before 10.3.9 and 10.4 before 10.4.5 allows remote attackers to redirect users to local files and execute arbitrary JavaScript via unspecified vectors involving HTTP redirection to local resources.
Affected Products: n/a
References: [{'name': '19064', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19064'}, {'name': '16907', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16907'}, {'name': '1015713', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015713'}, {'name': 'ADV-2006-0791', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0791'}, {'name': 'APPLE-SA-2006-03-01', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2006/Mar/msg00000.html'}, {'name': 'TA06-062A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA06-062A.html'}, {'name': 'macosx-safari-http-redirect(25038)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25038'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=303382'}]
CVE State: PUBLISHED
Explain CVE-2006-0389
Cross-site scripting (XSS) vulnerability in Syndication (Safari RSS) in Mac OS X 10.4 through 10.4.5 allows remote attackers to execute arbitrary JavaScript via unspecified vectors involving RSS feeds.
Affected Products: n/a
References: [{'name': 'macosx-syndication-xss(25040)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25040'}, {'name': '23649', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23649'}, {'name': '19064', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19064'}, {'name': '16907', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16907'}, {'name': 'ADV-2006-0791', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0791'}, {'name': 'APPLE-SA-2006-03-01', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2006/Mar/msg00000.html'}, {'name': 'TA06-062A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA06-062A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=303382'}]
CVE State: PUBLISHED
Explain CVE-2006-0391
Directory traversal vulnerability in the BOM framework in Mac OS X 10.x before 10.3.9 and 10.4 before 10.4.5 allows user-assisted attackers to overwrite or create arbitrary files via an archive that is handled by BOMArchiveHelper.
Affected Products: n/a
References: [{'name': '23641', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23641'}, {'name': 'macosx-bom-directory-traversal(25023)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25023'}, {'name': '19064', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19064'}, {'name': '20060302 Apple MacOS X BOMArchiveHelper Directory Traversal Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://www.idefense.com/intelligence/vulnerabilities/display.php?id=399'}, {'name': '16907', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16907'}, {'name': 'ADV-2006-0791', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0791'}, {'name': 'APPLE-SA-2006-03-01', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2006/Mar/msg00000.html'}, {'name': 'TA06-062A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA06-062A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=303382'}]
CVE State: PUBLISHED
Explain CVE-2006-0392
Buffer overflow in Apple Mac OS X 10.4.7 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Canon RAW image.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2006-08-01', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html'}, {'name': 'ADV-2006-3101', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/3101'}, {'name': '21253', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/21253'}, {'name': 'VU#527236', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/527236'}, {'name': '19289', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/19289'}, {'name': 'TA06-214A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA06-214A.html'}, {'name': 'macosx-raw-image-bo(28142)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/28142'}, {'name': '27739', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/27739'}]
CVE State: PUBLISHED
Explain CVE-2006-0393
OpenSSH in Apple Mac OS X 10.4.7 allows remote attackers to cause a denial of service or determine account existence by attempting to log in using an invalid user, which causes the server to hang.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2006-08-01', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html'}, {'name': '27745', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/27745'}, {'name': 'ADV-2006-3101', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/3101'}, {'name': '21253', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/21253'}, {'name': '19289', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/19289'}, {'name': 'TA06-214A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA06-214A.html'}, {'name': '1016672', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1016672'}, {'name': 'macosx-openssh-nonexistent-user-dos(28147)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/28147'}]
CVE State: PUBLISHED
Explain CVE-2006-0395
The Download Validation in Mail in Mac OS X 10.4 does not properly recognize attachment file types to warn a user of an unsafe type, which allows user-assisted remote attackers to execute arbitrary code via crafted file types.
Affected Products: n/a
References: [{'name': 'macosx-mail-bypass-security(25027)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25027'}, {'name': '23645', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23645'}, {'name': '19064', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19064'}, {'name': '16907', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16907'}, {'name': 'ADV-2006-0791', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0791'}, {'name': 'APPLE-SA-2006-03-01', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/client-management/2006/Mar/msg00030.html'}, {'name': 'TA06-062A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA06-062A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=303382'}]
CVE State: PUBLISHED
Explain CVE-2006-0396
Buffer overflow in Mail in Apple Mac OS X 10.4 up to 10.4.5, when patched with Security Update 2006-001, allows remote attackers to execute arbitrary code via a long Real Name value in an e-mail attachment sent in AppleDouble format, which triggers the overflow when the user double-clicks on an attachment.
Affected Products: n/a
References: [{'name': '17081', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17081'}, {'name': '23872', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23872'}, {'name': 'ADV-2006-0949', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0949'}, {'name': '1015762', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015762'}, {'name': 'VU#980084', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/980084'}, {'name': 'macosx-mail-attachment-bo(25209)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25209'}, {'name': '19129', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19129'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.digitalmunition.com/DMA%5B2006-0313a%5D.txt'}, {'name': 'APPLE-SA-2006-03-13', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2006/Mar/msg00001.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=303453'}, {'name': "20060314 DMA[2006-0313a] - 'Apple OSX Mail.app RFC1740 Real Name Buffer Overflow'", 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/427601/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0397
Unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. NOTE: due to the lack of specific information in the vendor advisory, it is not clear how CVE-2006-0397, CVE-2006-0398, and CVE-2006-0399 are different.
Affected Products: n/a
References: [{'name': '23869', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23869'}, {'name': 'ADV-2006-0949', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0949'}, {'name': '1015760', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015760'}, {'name': '19129', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19129'}, {'name': 'APPLE-SA-2006-03-13', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2006/Mar/msg00001.html'}, {'name': 'macosx-safefiletype-command-execution(25269)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25269'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=303453'}]
CVE State: PUBLISHED
Explain CVE-2006-0398
Unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. NOTE: due to the lack of specific information in the vendor advisory, it is not clear how CVE-2006-0397, CVE-2006-0398, and CVE-2006-0399 are different.
Affected Products: n/a
References: [{'name': 'ADV-2006-0949', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0949'}, {'name': '1015760', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015760'}, {'name': '19129', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19129'}, {'name': 'APPLE-SA-2006-03-13', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2006/Mar/msg00001.html'}, {'name': 'macosx-safefiletype-command-execution(25269)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25269'}, {'name': '23870', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23870'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=303453'}]
CVE State: PUBLISHED
Explain CVE-2006-0399
Unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. NOTE: due to the lack of specific information in the vendor advisory, it is not clear how CVE-2006-0397, CVE-2006-0398, and CVE-2006-0399 are different.
Affected Products: n/a
References: [{'name': 'ADV-2006-0949', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0949'}, {'name': '23871', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23871'}, {'name': '1015760', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015760'}, {'name': '19129', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19129'}, {'name': 'APPLE-SA-2006-03-13', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2006/Mar/msg00001.html'}, {'name': 'macosx-safefiletype-command-execution(25269)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25269'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=303453'}]
CVE State: PUBLISHED
Explain CVE-2006-0400
CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows remote attackers to bypass the same-origin policy and execute Javascript in other domains via unknown vectors involving "crafted archives."
Affected Products: n/a
References: [{'name': '1015763', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015763'}, {'name': 'ADV-2006-0949', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0949'}, {'name': '19129', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19129'}, {'name': 'APPLE-SA-2006-03-13', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2006/Mar/msg00001.html'}, {'name': 'macosx-sameorigin-policy-bypass(25208)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25208'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=303453'}, {'name': '23873', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23873'}, {'name': '17082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17082'}]
CVE State: PUBLISHED
Explain CVE-2006-0401
Unspecified vulnerability in Mac OS X before 10.4.6, when running on an Intel-based computer, allows attackers with physical access to bypass the firmware password and log on in Single User Mode via unspecified vectors.
Affected Products: n/a
References: [{'name': 'ADV-2006-1215', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1215'}, {'name': 'macosx-firmware-password-bypass(25620)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25620'}, {'name': '24399', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24399'}, {'name': '1015859', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015859'}, {'name': '17364', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17364'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://docs.info.apple.com/article.html?artnum=303567'}, {'name': '19462', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19462'}]
CVE State: PUBLISHED
Explain CVE-2006-0402
SQL injection vulnerability in Zoph before 0.5pre1 allows remote attackers to execute arbitrary SQL commands.
Affected Products: n/a
References: [{'name': '22743', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22743'}, {'name': '18563', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18563'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?group_id=69353&release_id=387320'}, {'name': '19153', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19153'}, {'name': '16347', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16347'}, {'name': 'ADV-2006-0297', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0297'}, {'name': 'zoph-sql-injection(24264)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24264'}, {'name': 'DSA-989', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-989'}]
CVE State: PUBLISHED
Explain CVE-2006-0403
Multiple SQL injection vulnerabilities in e-moBLOG 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) monthy parameter to index.php or (2) login parameter to admin/index.php. NOTE: some sources have reported item 1 as involving the "monthly" parameter, but this is incorrect.
Affected Products: n/a
References: [{'name': '16344', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16344'}, {'name': '22701', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22701'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/43/summary.html'}, {'name': '22700', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22700'}, {'name': 'emoblog-index-sql-injection(24245)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24245'}, {'name': '370', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/370'}, {'name': '1015524', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015524'}, {'name': '20060125 The parameter in e-moBLOG is "monthy" [sic]', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://attrition.org/pipermail/vim/2006-January/000511.html'}, {'name': '18567', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18567'}, {'name': 'ADV-2006-0296', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0296'}, {'name': '20060122 [eVuln] e-moBLOG SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/422938/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0404
Note-A-Day Weblog 2.2 stores sensitive data under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to archive/.phpass-admin, which contains encrypted passwords.
Affected Products: n/a
References: [{'name': 'ADV-2006-0299', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0299'}, {'name': '20060122 [eVuln] Note-A-Day Weblog Sensitive Information Disclosure', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2006-01/0389.html'}, {'name': '371', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/371'}, {'name': '18566', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18566'}, {'name': '1015539', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015539'}, {'name': '22699', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22699'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/44/summary.html'}, {'name': 'noteaday-archive-information-disclosure(24270)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24270'}]
CVE State: PUBLISHED
Explain CVE-2006-0405
The TIFFFetchShortPair function in tif_dirread.c in libtiff 3.8.0 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a NULL pointer dereference, possibly due to changes in type declarations and/or the TIFFVSetField function.
Affected Products: n/a
References: [{'name': 'ADV-2006-0302', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0302'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugzilla.remotesensing.org/show_bug.cgi?id=1029'}, {'name': '18172', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/18172'}, {'name': 'GLSA-200605-17', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200605-17.xml'}, {'name': '20345', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/20345'}, {'name': 'libtiff-tiffvsetfield-dos(24275)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24275'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugzilla.remotesensing.org/show_bug.cgi?id=1034'}, {'name': '18587', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18587'}]
CVE State: PUBLISHED
Explain CVE-2006-0406
search.php in MyBB 1.0.2 allows remote attackers to obtain sensitive information via a certain search request that reveals the table prefix in a SQL error message, possibly due to invalid parameters.
Affected Products: n/a
References: [{'name': 'mybb-search-information-disclosure(24272)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24272'}, {'name': '18577', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18577'}, {'name': '20060114 MyBB 1.0.2 Sniffing table perfix bug in search.php', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/422227/100/0/threaded'}, {'name': '22736', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22736'}]
CVE State: PUBLISHED
Explain CVE-2006-0407
Cross-site scripting (XSS) vulnerability in post.php in AZ Bulletin Board (AZbb) 1.1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) nickname parameter and (2) an iframe tag in the topic parameter.  NOTE: the original disclosure specified the name parameter, but a correction was later provided. NOTE: followup posts have both disputed and confirmed the original claim.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://kapda.ir/advisory-236.html'}, {'name': '20060123 Azbb v1.1.00 Cross-Site Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423353/100/0/threaded'}, {'name': '16351', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16351'}, {'name': '20060128 [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423363/100/0/threaded'}, {'name': 'azbulletinboard-post-xss(24274)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24274'}, {'name': '20060309 Re: Re: [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/427194/100/0/threaded'}, {'name': '20060308 Re: [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/427076/30/6510/threaded'}, {'name': '20060308 Re: [CORRECTIONS AND ADDITIONS ]Azbb v1.1.00 Cross-Site Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/427076/100/0/threaded'}, {'name': '18565', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18565'}, {'name': 'ADV-2006-0298', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0298'}]
CVE State: PUBLISHED
Explain CVE-2006-0408
rsh utility in Sun Grid Engine (SGE) before 6.0u7_1 allows local users to gain privileges and execute arbitrary code via unspecified vectors, possibly involving command line arguments.
Affected Products: n/a
References: [{'name': 'sge-rsh-gain-privileges(24281)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24281'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://gridengine.sunsource.net/project/gridengine/60patches.txt'}, {'name': '18580', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18580'}, {'name': '16366', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16366'}, {'name': '1015531', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015531'}, {'name': 'ADV-2006-0308', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0308'}]
CVE State: PUBLISHED
Explain CVE-2006-0409
Cross-site scripting (XSS) vulnerability in index.php in Pixelpost Photoblog 1.4.3 allows remote attackers to inject arbitrary web script or HTML via the "Add Comment" field in a comment popup.
Affected Products: n/a
References: [{'name': '1015529', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015529'}, {'name': 'pixelpost-index-xss(24261)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24261'}, {'name': 'ADV-2006-0309', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0309'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/45/summary.html'}, {'name': '18572', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18572'}, {'name': '20060123 [eVuln] Pixelpost Photoblog XSS Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423384/100/0/threaded'}, {'name': '16362', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16362'}]
CVE State: PUBLISHED
Explain CVE-2006-0410
SQL injection vulnerability in ADOdb before 4.71, when using PostgreSQL, allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors involving binary strings.
Affected Products: n/a
References: [{'name': '19590', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19590'}, {'name': '19555', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19555'}, {'name': 'DSA-1029', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1029'}, {'name': 'ADV-2006-0448', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0448'}, {'name': 'DSA-1030', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1030'}, {'name': 'ADV-2006-0315', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0315'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=387862&group_id=42718'}, {'name': '18575', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18575'}, {'name': '19591', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19591'}, {'name': '18745', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18745'}, {'name': 'adodb-postgresql-sql-injection(24314)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24314'}, {'name': '19691', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19691'}, {'name': 'DSA-1031', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1031'}, {'name': '22705', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22705'}, {'name': 'GLSA-200604-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200604-07.xml'}, {'name': '16364', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16364'}, {'name': '18732', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18732'}, {'name': 'GLSA-200602-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200602-02.xml'}]
CVE State: PUBLISHED
Explain CVE-2006-0411
claro_init_local.inc.php in Claroline 1.7.2 uses guessable session cookies (MD5 hash of connection time), which allows remote attackers to hijack sessions and possibly gain administrative privileges.
Affected Products: n/a
References: [{'name': '20060120 Claroline 1.7.2, sso identification vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/422482'}, {'name': '16341', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16341'}, {'name': 'claroline-cookie-bypass-security(24326)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24326'}, {'name': '18588', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18588'}, {'name': 'ADV-2006-0320', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0320'}]
CVE State: PUBLISHED
Explain CVE-2006-0412
SQL injection vulnerability in CyberShop allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in a login action.
Affected Products: n/a
References: [{'name': 'cybershop-login-sql-injection(24005)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24005'}, {'name': '20060105 CyberShop User Login Sql Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2006-01/0064.html'}, {'name': '22365', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22365'}]
CVE State: PUBLISHED
Explain CVE-2006-0413
Multiple SQL injection vulnerabilities in index.php in NewsPHP allow remote attackers to execute arbitrary SQL commands via the (1) discuss, (2) tim, (3) id, (4) last, and (5) limit parameter.
Affected Products: n/a
References: [{'name': '22717', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22717'}, {'name': '20060122 Newsphp Multiple SQL Injection Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423129/100/0/threaded'}, {'name': '18624', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18624'}, {'name': 'newsphp-index-sql-injection(24320)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24320'}, {'name': 'ADV-2006-0341', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0341'}, {'name': '16339', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16339'}]
CVE State: PUBLISHED
Explain CVE-2006-0414
Tor before 0.1.1.20 allows remote attackers to identify hidden services via a malicious Tor server that attempts a large number of accesses of the hidden service, which eventually causes a circuit to be built through the malicious server.
Affected Products: n/a
References: [{'name': '19795', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/19795'}, {'name': '18576', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18576'}, {'name': 'tor-service-information-disclosure(24285)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24285'}, {'name': '18323', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/18323'}, {'name': '22689', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22689'}, {'name': '20514', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/20514'}, {'name': 'GLSA-200606-04', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200606-04.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tor.eff.org/cvs/tor/ChangeLog'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://archives.seul.org/or/announce/Jan-2006/msg00001.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0415
Cross-site scripting (XSS) vulnerability in index.php in SleeperChat 0.3f and earlier allows remote attackers to inject arbitrary web script or HTML via the pseudo parameter.
Affected Products: n/a
References: [{'name': '22784', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22784'}, {'name': 'sleeperchat-index-xss(24300)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24300'}, {'name': '1015525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015525'}, {'name': '16363', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16363'}]
CVE State: PUBLISHED
Explain CVE-2006-0416
SleeperChat 0.3f and earlier allows remote attackers to bypass authentication and create new entries via the txt parameter to (1) chat_no.php and (2) chat_if.php.
Affected Products: n/a
References: [{'name': 'sleeperchat-txt-security-bypass(24357)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24357'}, {'name': '1015525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015525'}]
CVE State: PUBLISHED
Explain CVE-2006-0417
SQL injection vulnerability in login.php in miniBloggie 1.0 and earlier, when gpc_magic_quotes is disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password parameters.
Affected Products: n/a
References: [{'name': 'ADV-2006-0310', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0310'}, {'name': '16367', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16367'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/47/summary.html'}, {'name': '22729', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22729'}, {'name': '18604', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18604'}, {'name': '1015534', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015534'}, {'name': 'minibloggie-login-sql-injection(24280)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24280'}, {'name': '20060124 [eVuln] miniBloggie Authentication Bypass', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423126/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0418
Eval injection vulnerability in 123 Flash Chat Server 5.0 and 5.1 allows attackers to execute arbitrary code via a crafted username.
Affected Products: n/a
References: [{'name': '20060124 [ISecAuditors Advisories] Arbitrary flash code remote execution in 123flashchat', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423164/100/0/threaded'}, {'name': '16360', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16360'}]
CVE State: PUBLISHED
Explain CVE-2006-0419
BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which allows remote attackers to read user entries or cause a denial of service (unspecified) via a large number of connections.
Affected Products: n/a
References: [{'name': '1015528', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015528'}, {'name': 'BEA06-81.01', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/163'}]
CVE State: PUBLISHED
Explain CVE-2006-0420
BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when servlets use relative forwarding, which allows remote attackers to cause a denial of service (slowdown) via unknown attack vectors that cause "looping stack overflow errors."
Affected Products: n/a
References: [{'name': '1015528', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015528'}, {'name': 'BEA06-106.01', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/164'}]
CVE State: PUBLISHED
Explain CVE-2006-0421
By design, BEA WebLogic Server and WebLogic Express 7.0 and 6.1, when creating multiple domains from the same WebLogic instance on the same machine, allows administrators of any created domain to access other created domains, which could allow administrators to gain privileges that were not intended.
Affected Products: n/a
References: [{'name': 'ADV-2006-0313', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0313'}, {'name': 'BEA06-108.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/165'}, {'name': 'weblogic-cross-domain-management(24286)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24286'}, {'name': '1015528', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015528'}, {'name': '18581', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18581'}, {'name': '16358', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16358'}]
CVE State: PUBLISHED
Explain CVE-2006-0422
Multiple unspecified vulnerabilities in BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allow remote attackers to access MBean attributes or cause an unspecified denial of service via unknown attack vectors.
Affected Products: n/a
References: [{'name': 'ADV-2006-0313', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0313'}, {'name': 'BEA06-109.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/166'}, {'name': '1015528', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015528'}, {'name': '18592', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18592'}, {'name': '16358', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16358'}, {'name': 'weblogic-java-mbean-access(24294)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24294'}]
CVE State: PUBLISHED
Explain CVE-2006-0423
BEA WebLogic Portal 8.1 through SP3 stores the password for the RDBMS Authentication provider in cleartext in the config.xml file, which allows attackers to gain privileges.
Affected Products: n/a
References: [{'name': 'ADV-2008-0613', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/0613'}, {'name': 'weblogic-portal-config-info-disclosure(40705)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/40705'}, {'name': '18593', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18593'}, {'name': 'BEA06-110.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/167'}, {'name': 'ADV-2006-0312', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0312'}, {'name': '1015528', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015528'}, {'name': 'weblogicportal-config-info-disclosure(24284)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24284'}, {'name': '16358', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16358'}, {'name': 'BEA08-110.01', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/262'}]
CVE State: PUBLISHED
Explain CVE-2006-0424
BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allows remote authenticated guest users to read the server log and obtain sensitive configuration information.
Affected Products: n/a
References: [{'name': 'BEA06-111.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/168'}, {'name': 'ADV-2006-0313', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0313'}, {'name': 'weblogic-server-log-disclosure(24295)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24295'}, {'name': '22776', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22776'}, {'name': '1015528', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015528'}, {'name': '18592', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18592'}, {'name': '16358', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16358'}]
CVE State: PUBLISHED
Explain CVE-2006-0425
BEA WebLogic Portal 8.1 through SP4 allows remote attackers to obtain the source for a deployment descriptor file via unknown vectors.
Affected Products: n/a
References: [{'name': '18593', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18593'}, {'name': 'weblogic-deployment-descriptor-disclosure(24297)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24297'}, {'name': 'ADV-2006-0312', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0312'}, {'name': '1015528', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015528'}, {'name': 'BEA06-112.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/169'}, {'name': '16358', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16358'}]
CVE State: PUBLISHED
Explain CVE-2006-0426
BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges.
Affected Products: n/a
References: [{'name': 'ADV-2006-0313', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0313'}, {'name': '22775', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22775'}, {'name': '1015528', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015528'}, {'name': '18592', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18592'}, {'name': '16358', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16358'}, {'name': 'weblogic-password-information-disclosure(24290)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24290'}, {'name': 'BEA06-113.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/170'}]
CVE State: PUBLISHED
Explain CVE-2006-0427
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing functionality that should have been restricted.
Affected Products: n/a
References: [{'name': 'ADV-2006-0313', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0313'}, {'name': 'BEA06-114.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/171'}, {'name': '1015528', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015528'}, {'name': '18592', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18592'}, {'name': '22774', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22774'}, {'name': 'weblogic-servlets-obtain-information(24291)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24291'}, {'name': '16358', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16358'}]
CVE State: PUBLISHED