Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2006-1336
Cross-site scripting vulnerability in calendar.php in ExtCalendar 1.0 and possibly other versions before 2.0 allows remote attackers to inject arbitrary web script or HTML via the (1) year, (2) month, (3) next, and (4) prev parameters.
Affected Products: n/a
References: [{'name': 'ADV-2006-1012', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1012'}, {'name': '17146', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17146'}, {'name': '20060319 ExtCalendar v1.0 Multiple Xss Vuln', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428131/100/0/threaded'}, {'name': '19321', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19321'}, {'name': '23969', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23969'}, {'name': '601', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/601'}, {'name': 'extcalendar-calendar-xss(25350)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25350'}]
CVE State: PUBLISHED
Explain CVE-2006-1337
Buffer overflow in the POP 3 (POP3) service in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enterprise Edition before 1.21 allows remote attackers to execute arbitrary code via unknown vectors before authentication.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mailenable.com/professionalhistory.asp'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mailenable.com/enterprisehistory.asp'}, {'name': '19288', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19288'}, {'name': '17162', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17162'}, {'name': '20060320 [MU-200603-01] MailEnable POP3 Pre-Authentication Buffer Overflow', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1359.html'}, {'name': 'mailenable-pop-authentication(25314)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25314'}, {'name': '1015797', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015797'}, {'name': 'ADV-2006-1006', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1006'}, {'name': '24012', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24012'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mailenable.com/standardhistory.asp'}]
CVE State: PUBLISHED
Explain CVE-2006-1338
Webmail in MailEnable Professional Edition before 1.73 and Enterprise Edition before 1.21 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors involving "incorrectly encoded quoted-printable emails".
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mailenable.com/professionalhistory.asp'}, {'name': 'mailenable-webmail-component-dos(25315)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25315'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mailenable.com/enterprisehistory.asp'}, {'name': '19288', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19288'}, {'name': '24014', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24014'}, {'name': 'ADV-2006-1006', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1006'}, {'name': '17161', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17161'}]
CVE State: PUBLISHED
Explain CVE-2006-1339
Directory traversal vulnerability in inc/functions.inc.php in CuteNews 1.4.1 and possibly other versions, when register_globals is enabled, allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the archive parameter in an HTTP POST or COOKIE request, which bypasses a sanity check that is only applied to a GET request.
Affected Products: n/a
References: [{'name': '19289', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19289'}, {'name': '17152', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17152'}, {'tags': ['x_refsource_MISC'], 'url': 'http://hamid.ir/security/cutenews.txt'}, {'name': '20060322 cutenews 1.4.1 Arbitrary File Access', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428434/100/0/threaded'}, {'name': 'cutenews-incfunction-directory-traversal(25324)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25324'}]
CVE State: PUBLISHED
Explain CVE-2006-1340
CuteNews 1.4.1 and possibly other versions allows remote attackers to obtain the installation path via unspecified vectors involving an invalid file path.
Affected Products: n/a
References: [{'name': '19289', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19289'}, {'name': '17152', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17152'}, {'tags': ['x_refsource_MISC'], 'url': 'http://hamid.ir/security/cutenews.txt'}, {'name': '20060322 cutenews 1.4.1 Arbitrary File Access', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428434/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-1341
SQL injection vulnerability in events.php in Maian Events 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters.
Affected Products: n/a
References: [{'name': '646', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/646'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/102/description.html'}, {'name': '19274', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19274'}, {'name': 'ADV-2006-0993', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0993'}, {'name': 'maianevents-events-sql-injection(25298)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25298'}, {'name': '23947', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23947'}, {'name': '20060328 [eVuln] Maian Events SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/429093/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-1342
net/ipv4/af_inet.c in Linux kernel 2.4 does not clear sockaddr_in.sin_zero before returning IPv4 socket names from the (1) getsockname, (2) getpeername, and (3) accept functions, which allows local users to obtain portions of potentially sensitive memory.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/git/?p=linux/kernel/git/marcelo/linux-2.4.git%3Ba=commit%3Bh=09d3b3dcfa80c9094f1748c1be064b9326c9ef2b'}, {'name': 'ADV-2006-4502', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/4502'}, {'name': 'RHSA-2006:0579', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2006-0579.html'}, {'name': '22875', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/22875'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/download/esx/esx-202-200610-patch.html'}, {'name': '20061113 VMSA-2006-0008 - VMware ESX Server 2.0.2 Upgrade Patch 2', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/451426/100/200/threaded'}, {'name': '21035', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/21035'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/download/esx/esx-213-200610-patch.html'}, {'name': 'SUSE-SA:2006:028', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2006-05-31.html'}, {'name': 'RHSA-2006:0580', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2006-0580.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/download/esx/esx-254-200610-patch.html'}, {'name': '19357', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19357'}, {'name': '20061113 VMSA-2006-0006 - VMware ESX Server 2.5.3 Upgrade Patch 4', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/451404/100/0/threaded'}, {'name': '20398', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/20398'}, {'name': '20061113 VMSA-2006-0007 - VMware ESX Server 2.1.3 Upgrade Patch 2', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/451417/100/200/threaded'}, {'name': '17203', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17203'}, {'name': '20061113 VMSA-2006-0005 - VMware ESX Server 2.5.4 Upgrade Patch 1', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/451419/100/200/threaded'}, {'name': '[linux-netdev] 20060304 BUG: Small information leak in SO_ORIGINAL_DST (2.4 and 2.6) and', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=linux-netdev&m=114148078223594&w=2'}]
CVE State: PUBLISHED
Explain CVE-2006-1344
Cross-site scripting (XSS) vulnerability in VeriSign haydn.exe, as used in Managed PKI (MPKI) 6.0, allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the VHTML_FILE parameter.
Affected Products: n/a
References: [{'name': '17170', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17170'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/common/showdoc.php?idx=522&idxseccion=10'}, {'name': 'ADV-2006-1084', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1084'}, {'name': 'verisign-haydn-xss(25349)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25349'}, {'name': '614', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/614'}, {'name': '20060320 CORE-2006-0124: Cross-Site Scripting in Verisign?s haydn.exe CGI script', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428267/100/0/threaded'}, {'name': '1015813', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015813'}]
CVE State: PUBLISHED
Explain CVE-2006-1345
polls.php in MyBB (aka MyBulletinBoard) 1.10 allows remote attackers to obtain sensitive information via a vote action with an "option[]=null" parameter value, which reveals the path in an error message.
Affected Products: n/a
References: [{'name': '20060317 MyBB 1.10 Full Path Disclosure', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428056/100/0/threaded'}, {'name': 'mybb-polls-path-disclosure(25337)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25337'}]
CVE State: PUBLISHED
Explain CVE-2006-1346
Directory traversal vulnerability in inc/setLang.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a lang[*][file] parameter, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by index.php.
Affected Products: n/a
References: [{'name': '1595', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1595'}, {'name': '24016', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24016'}, {'name': '19322', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19322'}, {'name': 'ADV-2006-1015', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1015'}, {'name': '17165', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17165'}, {'name': '20060414 Provable vendor ACK for gcards issues', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://attrition.org/pipermail/vim/2006-April/000698.html'}]
CVE State: PUBLISHED
Explain CVE-2006-1347
SQL injection vulnerability in loginfunction.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
Affected Products: n/a
References: [{'name': '1595', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1595'}, {'name': '24017', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24017'}, {'name': '19322', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19322'}, {'name': 'ADV-2006-1015', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1015'}, {'name': '17165', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17165'}, {'name': 'gcards-loginfunction-sql-injection(25344)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25344'}, {'name': '20060414 Provable vendor ACK for gcards issues', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://attrition.org/pipermail/vim/2006-April/000698.html'}]
CVE State: PUBLISHED
Explain CVE-2006-1348
Cross-site scripting (XSS) vulnerability in index.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang[*][file] parameter, which is injected into an error message.  NOTE: this issue might be resultant from CVE-2006-1346.
Affected Products: n/a
References: [{'name': '1595', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1595'}, {'name': '24018', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24018'}, {'name': '19322', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19322'}, {'name': 'ADV-2006-1015', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1015'}, {'name': 'gcards-incsetlang-xss(25343)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25343'}, {'name': '17165', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17165'}, {'name': '20060414 Provable vendor ACK for gcards issues', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://attrition.org/pipermail/vim/2006-April/000698.html'}]
CVE State: PUBLISHED
Explain CVE-2006-1349
Multiple cross-site scripting (XSS) vulnerabilities in Musicbox 2.3 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) id and (2) type and (3) show parameters in a top action in (a) index.php; and the (4) message1 parameter in (b) cart.php.
Affected Products: n/a
References: [{'name': '23967', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23967'}, {'name': 'musicbox-index-cart-xss(25525)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25525'}, {'name': '20060724 MusicBox <= 2.3.4 XSS SQL injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/441000/100/0/threaded'}, {'name': '20060324 XSS & SQL Injection in Music Box v2.3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428972/100/0/threaded'}, {'name': 'musicbox-multiple-xss(27925)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/27925'}, {'name': '17149', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17149'}, {'name': '23968', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23968'}]
CVE State: PUBLISHED
Explain CVE-2006-1350
PHP remote file include vulnerability in index.php in 99Articles.com (aka ArticlesOne.com) Free articles directory allows remote attackers to include and execute arbitrary PHP code via a URL in the page parameter.
Affected Products: n/a
References: [{'name': '616', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/616'}, {'name': '20060322 Free Articles Directory - file inclusion, code execution?', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://attrition.org/pipermail/vim/2006-March/000626.html'}, {'name': '24024', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24024'}, {'name': '17183', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17183'}, {'name': 'ADV-2006-1037', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1037'}, {'name': 'freearticlesdirectory-index-file-include(25378)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25378'}, {'name': '20060321 Free Articles Directory Remote Command Exucetion', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428354/100/0/threaded'}, {'name': '19320', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19320'}]
CVE State: PUBLISHED
Explain CVE-2006-1351
BEA WebLogic Server 6.1 SP7 and earlier allows remote attackers to read arbitrary files via unknown attack vectors related to a "default internal servlet" accessed through HTTP.
Affected Products: n/a
References: [{'name': '1015792', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015792'}, {'name': 'weblogic-server-default-servlet(25347)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25347'}, {'name': 'BEA06-120.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/180'}, {'name': '19310', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19310'}, {'name': 'ADV-2006-1021', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1021'}, {'name': '17166', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17166'}]
CVE State: PUBLISHED
Explain CVE-2006-1352
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service (memory exhaustion) via crafted non-canonicalized XML documents.
Affected Products: n/a
References: [{'name': 'BEA06-123.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/183'}, {'name': '17167', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17167'}, {'name': 'weblogic-xml-parser-dos(25348)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25348'}, {'name': '1015790', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015790'}, {'name': '19310', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19310'}, {'name': 'ADV-2006-1021', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1021'}]
CVE State: PUBLISHED
Explain CVE-2006-1354
Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module.
Affected Products: n/a
References: [{'name': 'GLSA-200604-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200604-03.xml'}, {'name': '20060404-01-U', 'tags': ['vendor-advisory', 'x_refsource_SGI'], 'url': 'ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc'}, {'name': 'freeradius-eap-mschapv2-auth-bypass(25352)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25352'}, {'name': '19300', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19300'}, {'name': 'SUSE-SA:2006:019', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.suse.de/archive/suse-security-announce/2006-Mar/0009.html'}, {'name': '17171', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17171'}, {'name': '20461', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/20461'}, {'name': '19405', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19405'}, {'name': '19811', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19811'}, {'name': 'ADV-2006-1016', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1016'}, {'name': 'oval:org.mitre.oval:def:10156', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10156'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.freeradius.org/security.html'}, {'name': 'DSA-1089', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1089'}, {'name': '1015795', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015795'}, {'name': 'RHSA-2006:0271', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2006-0271.html'}, {'name': '19527', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19527'}, {'name': '2006-0020', 'tags': ['vendor-advisory', 'x_refsource_TRUSTIX'], 'url': 'http://www.trustix.org/errata/2006/0020'}, {'name': 'MDKSA-2006:060', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2006:060'}, {'name': '19518', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19518'}]
CVE State: PUBLISHED
Explain CVE-2006-1355
avast! Antivirus 4.6.763 and earlier sets "BUILTIN\Everyone" permissions to critical system files in the installation folder, which allows local users to gain privileges or disable protection by modifying those files.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.dslreports.com/forum/remark%2C15601404~days=9999~start=20'}, {'name': '19284', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19284'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://forum.avast.com/index.php?topic=19862.0'}, {'name': 'ADV-2006-1011', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1011'}, {'name': 'avast-default-insecure-permissions(25336)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25336'}, {'name': '17158', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17158'}]
CVE State: PUBLISHED
Explain CVE-2006-1356
Stack-based buffer overflow in the count_vcards function in LibVC 3, as used in Rolo, allows user-assisted attackers to execute arbitrary code via a vCard file (e.g. contacts.vcf) containing a long line.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://osvdb.org/ref/23/23985-libvc.txt'}, {'name': 'libvc-vc-bo(25430)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25430'}, {'name': '23985', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/23985'}, {'name': '19295', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19295'}, {'name': '17237', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17237'}]
CVE State: PUBLISHED
Explain CVE-2006-1357
Cross-site scripting (XSS) vulnerability in my.support.php3 in F5 Firepass 4100 SSL VPN 5.4.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Affected Products: n/a
References: [{'name': '19337', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19337'}, {'name': '17175', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17175'}, {'name': '20060321 XSS in Firepass 4100 SSL VPN v.5.4.2 (and probably others)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428318/100/0/threaded'}, {'name': '611', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/611'}, {'name': 'firepass-mysupport-xss(25393)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25393'}, {'name': 'ADV-2006-1036', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1036'}, {'name': '1015798', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015798'}]
CVE State: PUBLISHED
Explain CVE-2006-1358
Unspecified vulnerability in BEA WebLogic Portal 8.1 up to SP5 causes a JSR-168 Portlet to be retrieved from the cache for the wrong session, which might allow one user to see a Portlet of another user.
Affected Products: n/a
References: [{'name': 'ADV-2006-1022', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1022'}, {'tags': ['x_refsource_MISC'], 'url': 'ftp://ftpna.beasys.com/pub/releases/security/patch_CR259534_81SP5.zip'}, {'name': 'BEA06-122.00', 'tags': ['vendor-advisory', 'x_refsource_BEA'], 'url': 'http://dev2dev.bea.com/pub/advisory/182'}, {'name': '19308', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19308'}, {'name': '17164', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17164'}, {'name': '1015791', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015791'}, {'name': 'weblogic-portal-portlet-disclosure(25345)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25345'}]
CVE State: PUBLISHED
Explain CVE-2006-1360
Multiple SQL injection vulnerabilities in MusicBox 2.3 Beta 2 allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) type, or (3) show parameter to (a) index.php; or the (4) message1 or (5) message parameter to (b) cart.php.
Affected Products: n/a
References: [{'name': '20060724 MusicBox <= 2.3.4 XSS SQL injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/441000/100/0/threaded'}, {'name': '20060324 XSS & SQL Injection in Music Box v2.3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428972/100/0/threaded'}, {'name': 'musicbox-multiple-sql-injection(27926)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/27926'}, {'name': '17149', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17149'}]
CVE State: PUBLISHED
Explain CVE-2006-1361
Cross-site scripting (XSS) vulnerability in OSWiki before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the username field to (1) list.rhtml or (2) show.rhtml.
Affected Products: n/a
References: [{'name': 'oswiki-username-xss(25410)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25410'}, {'name': 'ADV-2006-1035', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1035'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.sourceforge.net/viewcvs.cgi/opensourcewiki/branches/0.3/oswiki/app/views/user/list.rhtml?view=log'}, {'name': '19290', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19290'}, {'name': '17189', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17189'}]
CVE State: PUBLISHED
Explain CVE-2006-1362
Multiple SQL injection vulnerabilities in Mini-Nuke CMS System 1.8.2 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the uid parameter in (a) members.asp, the (2) catid parameter in (b) articles.asp and (c) programs.asp, and the (3) id parameter in (d) hpages.asp and (e) forum.asp.  NOTE: The pages.asp/id vector is already covered by CVE-2006-0870.
Affected Products: n/a
References: [{'name': 'mininuke-multiple-sql-injection(25372)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25372'}, {'name': '18439', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18439'}, {'name': '617', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/617'}, {'name': '20060321 Mini-Nuke<=1.8.2 SQL injection (6)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428361/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-1363
images.php in Justin White (aka YTZ) Free Web Publishing System (FreeWPS) 2.11 allows remote attackers to execute arbitrary PHP code by uploading a .php file into the /upload directory as specified in the dirPath parameter, then performing a direct request to that file.
Affected Products: n/a
References: [{'name': '1600', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1600'}, {'name': '19343', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19343'}, {'name': 'freewps-images-file-include(25377)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25377'}, {'name': 'ADV-2006-1038', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1038'}]
CVE State: PUBLISHED
Explain CVE-2006-1364
Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause a denial of service (resource consumption or crash) by repeatedly requesting each of several documents that refer to COM components, or are restricted documents located under the ASP.NET application path.
Affected Products: n/a
References: [{'name': '20060322 w3wp remote DoS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428622/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://hackingspirits.com/vuln-rnd/w3wp-remote-dos.zip'}, {'name': '1015825', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015825'}, {'name': '17188', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17188'}, {'name': 'ms-aspnet-w3wp-dos(25392)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25392'}, {'name': '1601', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1601'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securiteam.com/windowsntfocus/5KP0O0KI0Y.html'}, {'name': '20060322 w3wp remote DoS due to improper reference of STA COM components in ASP.NET', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044291.html'}, {'name': '20060322 w3wp remote DoS', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044292.html'}]
CVE State: PUBLISHED
Explain CVE-2006-1365
The Motorola PEBL U6, the Motorola V600, and possibly the Motorola E398 and other Motorola phones allow remote attackers to add an entry for their own Bluetooth device to a target device's list of trusted devices (aka Device History), and possibly obtain AT level access to the target device, by initiating and interrupting an OBEX Push Profile that pretends to send a vCard, aka a "HeloMoto" attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://trifinite.org/trifinite_stuff_helomoto.html'}, {'name': "20060321 DMA[2006-0321a] - 'Motorola P2K Platform setpath() overflow and Blueline attack'", 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428431/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.digitalmunition.com/DMA%5B2006-0321a%5D.txt'}]
CVE State: PUBLISHED
Explain CVE-2006-1366
Buffer overflow in the Motorola PEBL U6 08.83.76R, and possibly other Motorola P2K-based phones, allows remote attackers to cause a denial of service (device shutdown), and possibly execute arbitrary code, via a long OBEX setpath to the OBEX File Transfer (aka FTP) service on Bluetooth channel 9.
Affected Products: n/a
References: [{'name': 'motorola-peblu6-v600-obex-bo(25401)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25401'}, {'name': "20060321 DMA[2006-0321a] - 'Motorola P2K Platform setpath() overflow and Blueline attack'", 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428431/100/0/threaded'}, {'name': '19319', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19319'}, {'name': '17185', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17185'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.digitalmunition.com/DMA%5B2006-0321a%5D.txt'}, {'name': 'ADV-2006-1045', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1045'}, {'name': "20060321 DMA[2006-0321a] - 'Motorola P2K Platform setpath() overflow and Blueline attack'", 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044287.html'}]
CVE State: PUBLISHED
Explain CVE-2006-1367
The Motorola PEBL U6 08.83.76R, the Motorola V600, and possibly the Motorola E398 and other Motorola P2K-based phones does not require pairing for a connection related to the Headset Audio Gateway service, which allows user-assisted remote attackers to obtain AT level access and view phonebook entries and saved SMS messages by connecting on Bluetooth channel 3 and tricking the user into pressing Grant, aka a "Blueline" attack.  NOTE: while user-assisted, the attack is made more feasible because of a GUI misrepresentation issue that allows a default message to be replaced by an attacker-specified one.
Affected Products: n/a
References: [{'name': "20060321 DMA[2006-0321a] - 'Motorola P2K Platform setpath() overflow and Blueline attack'", 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428431/100/0/threaded'}, {'name': 'motorola-peblu6-v600-name-spoofing(25402)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25402'}, {'name': '19319', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19319'}, {'name': '17190', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17190'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.digitalmunition.com/DMA%5B2006-0321a%5D.txt'}, {'name': 'ADV-2006-1045', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1045'}, {'name': "20060321 DMA[2006-0321a] - 'Motorola P2K Platform setpath() overflow and Blueline attack'", 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044287.html'}]
CVE State: PUBLISHED
Explain CVE-2006-1368
Buffer overflow in the USB Gadget RNDIS implementation in the Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (kmalloc'd memory corruption) via a remote NDIS response to OID_GEN_SUPPORTED_LIST, which causes memory to be allocated for the reply data but not the reply structure.
Affected Products: n/a
References: [{'name': '17831', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17831'}, {'name': 'ADV-2006-2554', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/2554'}, {'name': 'USN-281-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/281-1/'}, {'name': 'ADV-2006-1046', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1046'}, {'name': 'MDKSA-2006:123', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2006:123'}, {'name': 'DSA-1097', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1097'}, {'name': '19955', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19955'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16'}, {'name': 'DSA-1103', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1103'}, {'name': '21045', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/21045'}, {'name': '19330', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19330'}, {'name': '20671', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/20671'}, {'name': '20914', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/20914'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8763716bfe4d8a16bef28c9947cf9d799b1796a5'}]
CVE State: PUBLISHED
Explain CVE-2006-1369
Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB) 2.1.5 and earlier before 20060308 allows remote attackers to inject arbitrary web script or HTML via a Private Message (PM) in certain circumstances.
Affected Products: n/a
References: [{'name': '19299', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19299'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://forums.invisionpower.com/index.php?showtopic=209178'}, {'name': 'ADV-2006-1044', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1044'}, {'name': '17187', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17187'}, {'name': 'invision-privatemessage-xss(25384)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25384'}]
CVE State: PUBLISHED
Explain CVE-2006-1370
Buffer overflow in RealNetworks RealPlayer 10.5 6.0.12.1040 through 6.0.12.1348, RealPlayer 10, RealOne Player v2, RealOne Player v1, RealPlayer 8, and RealPlayer Enterprise before 20060322 allows remote attackers to have an unknown impact via a malicious Mimio boardCast (mbc) file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.service.real.com/realplayer/security/03162006_player/en/'}, {'name': 'realnetworks-mbc-bo(25411)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25411'}, {'name': '19358', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19358'}, {'name': 'ADV-2006-1057', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1057'}, {'name': '17202', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17202'}, {'name': 'VU#451556', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/451556'}, {'name': '1015810', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015810'}]
CVE State: PUBLISHED
Explain CVE-2006-1371
Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5 and earlier allows remote authenticated users to use the HTMLArea FileManager plugin to upload and execute arbitrary PHP files using (1) manager.php, (2) standalonemanager.php, and (3) images.php.
Affected Products: n/a
References: [{'name': '19353', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19353'}, {'name': '24058', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24058'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xhp.targetit.ro/index.php?page=3&box_id=34&action=show_single_entry&post_id=10'}, {'name': '17209', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17209'}, {'name': 'ADV-2006-1052', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1052'}, {'name': 'xhpcms-filemanager-file-upload(25399)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25399'}, {'name': '20060324 XHP vendor ack/fix', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2006-March/000649.html'}, {'name': '1605', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1605'}, {'name': '24059', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24059'}]
CVE State: PUBLISHED
Explain CVE-2006-1372
Multiple SQL injection vulnerabilities in 1WebCalendar 4.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) EventID parameter in viewEvent.cfm, (2) NewsID parameter in newsView.cfm, or (3) ThisDate parameter in mainCal.cfm.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://pridels0.blogspot.com/2006/03/1webcalendar-v-4x-vuln.html'}, {'name': '1webcalendar-multiple-sql-injection(25373)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25373'}, {'name': '24023', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24023'}, {'name': '17193', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17193'}, {'name': '19329', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19329'}, {'name': 'ADV-2006-1040', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1040'}, {'name': '24021', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24021'}, {'name': '24022', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24022'}]
CVE State: PUBLISHED
Explain CVE-2006-1373
Cross-site scripting (XSS) vulnerability in status_image.php in PHP Live! 3.0 allows remote attackers to inject arbitrary web script or HTML via the base_url parameter.
Affected Products: n/a
References: [{'name': 'phplive-statusimage-xss(25386)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25386'}, {'name': '20060322 PHP Live! XSS status_image.php', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/428452/100/0/threaded'}, {'name': '19340', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19340'}, {'name': 'ADV-2006-1054', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1054'}, {'name': '17184', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17184'}]
CVE State: PUBLISHED
Explain CVE-2006-1374
SQL injection vulnerability in viewStatement.php in AdMan 1.0.20051221 and earlier allows remote attackers to execute arbitrary SQL commands via the transactions_offset parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://pridels0.blogspot.com/2006/03/adman-v10x-sql-vuln.html'}, {'name': 'adman-viewstatement-sql-injection(25403)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25403'}, {'name': '19351', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19351'}, {'name': 'ADV-2006-1071', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1071'}, {'name': '24064', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24064'}, {'name': '17208', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17208'}]
CVE State: PUBLISHED
Explain CVE-2006-1375
AdMan 1.0.20051221 and earlier allows remote attackers to obtain the full path via (1) a blank campaignId parameter to editCampaign.php and (2) a blank schemeId parameter to viewPricingScheme.php.
Affected Products: n/a
References: [{'name': '24065', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24065'}, {'tags': ['x_refsource_MISC'], 'url': 'http://pridels0.blogspot.com/2006/03/adman-v10x-sql-vuln.html'}, {'name': '24066', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/24066'}, {'name': 'adman-multiple-path-disclosure(25404)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25404'}, {'name': '19351', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19351'}, {'name': 'ADV-2006-1071', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1071'}]
CVE State: PUBLISHED
Explain CVE-2006-1376
The installation of Debian GNU/Linux 3.1r1 from the network install CD creates /var/log/debian-installer/cdebconf with world writable permissions, which allows local users to cause a denial of service (disk consumption).
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=358210'}, {'name': '19331', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19331'}, {'name': 'debian-cdebconf-world-writable(25526)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/25526'}]
CVE State: PUBLISHED