Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2006-0163
SQL injection vulnerability in the search module (modules/Search/index.php) of PHPNuke EV 7.7 -R1 allows remote attackers to execute arbitrary SQL commands via the query parameter, which is used by the search field.  NOTE: This is a different vulnerability than CVE-2005-3792.
Affected Products: n/a
References: [{'name': '22316', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22316'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lostmon.blogspot.com/2006/01/phpnuke-ev-77-search-module-query.html'}, {'name': 'ADV-2006-0120', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0120'}, {'name': '16186', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16186'}, {'name': 'phpnukeev-search-sql-injection(44978)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/44978'}, {'name': '18394', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18394'}]
CVE State: PUBLISHED
Explain CVE-2006-0164
phgstats.inc.php in phgstats before 0.5.1, if register_globals is enabled, allows remote attackers to include arbitrary files and execute arbitrary PHP code by modifying the PHGDIR variable.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=384232'}, {'name': '22302', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22302'}, {'name': 'ADV-2006-0123', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0123'}, {'name': 'phgstats-php-file-include(24062)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24062'}, {'name': '17469', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17469'}, {'name': '18346', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18346'}]
CVE State: PUBLISHED
Explain CVE-2006-0165
Cross-site scripting (XSS) vulnerability in the DataForm Entries functionality in Plain Black WebGUI before 6.8.4 (gamma) allows remote attackers to inject arbitrary Javascript via the (1) url and (2) name field of the default email form.
Affected Products: n/a
References: [{'name': '18372', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18372'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sourceforge.net/tracker/index.php?func=detail&aid=1395371&group_id=51417&atid=463213'}, {'name': 'webgui-forms-xss(24053)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24053'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=384153&group_id=51417'}, {'name': 'ADV-2006-0126', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0126'}]
CVE State: PUBLISHED
Explain CVE-2006-0166
Symantec Norton SystemWorks and SystemWorks Premier 2005 and 2006 stores temporary copies of files in the Norton Protected Recycle Bin NProtect directory, which is hidden from the FindFirst and FindNext Windows APIs and allows remote attackers to hide arbitrary files from virus scanners and other products.
Affected Products: n/a
References: [{'name': 'ADV-2006-0143', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0143'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://securityresponse.symantec.com/avcenter/security/Content/2006.01.10.html'}, {'name': 'systemworks-nprotect-hidden(24061)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24061'}, {'name': '18402', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18402'}, {'name': '1015462', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015462'}]
CVE State: PUBLISHED
Explain CVE-2006-0167
SQL injection vulnerability in MyPhPim 01.05 allows remote attackers to execute arbitrary SQL commands via the (1) cal_id parameter in calendar.php3 and the (2) password field on the login page.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/22/summary.html'}, {'name': '20060111 [eVuln] MyPhPim Multiple SQL Injection and XSS Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421863/100/0/threaded'}, {'name': '22325', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22325'}, {'name': '22324', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22324'}, {'name': '18399', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18399'}, {'name': 'myphpim-login-sql-injection(24075)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24075'}, {'name': '16210', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16210'}, {'name': 'ADV-2006-0147', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0147'}, {'name': 'myphpim-calendar-sql-injection(24066)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24066'}]
CVE State: PUBLISHED
Explain CVE-2006-0168
Cross-site scripting (XSS) vulnerability in MyPhPim 01.05 allows remote attackers to inject arbitrary web script or HTML via the description field on the "Create New todo" page.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/22/summary.html'}, {'name': '20060111 [eVuln] MyPhPim Multiple SQL Injection and XSS Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421863/100/0/threaded'}, {'name': 'myphpim-todo-xss(24071)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24071'}, {'name': '18399', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18399'}, {'name': '16210', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16210'}, {'name': '22326', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22326'}, {'name': 'ADV-2006-0147', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0147'}]
CVE State: PUBLISHED
Explain CVE-2006-0169
addresses.php3 in MyPhPim 01.05 does not restrict uploaded files, which allows remote attackers to execute arbitrary PHP code via the pdbfile variable, then directly accessing those files from the uploads directory.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/23/summary.html'}, {'name': '16208', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16208'}, {'name': '18399', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18399'}, {'name': '20060111 [eVuln] MyPhPim Arbitrary File Upload', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421626/100/0/threaded'}, {'name': 'myphpim-addresses-file-upload(24070)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24070'}, {'name': 'ADV-2006-0147', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0147'}]
CVE State: PUBLISHED
Explain CVE-2006-0171
PHP remote file include vulnerability in index.php in OrjinWeb E-commerce allows remote attackers to execute arbitrary code via a URL in the page parameter.  NOTE: it is not clear, but OrjinWeb might be an application service, in which case it should not be included in CVE.
Affected Products: n/a
References: [{'name': '20060106 Orjinweb E-commerce', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421312/100/0/threaded'}, {'name': '22387', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22387'}, {'name': 'orjinweb-url-file-include(24097)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24097'}, {'name': '16199', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16199'}]
CVE State: PUBLISHED
Explain CVE-2006-0172
Cross-site scripting (XSS) vulnerability in the file manager utility in Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to inject arbitrary web script or HTML in an uploaded page, which is published without a check for hostile scripting.
Affected Products: n/a
References: [{'name': 'ADV-2006-0145', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0145'}, {'name': '16195', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16195'}, {'name': '18411', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18411'}, {'name': 'hummingbird-enterprise-xss(24067)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24067'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securenetwork.it/advisories/sn-2006-01.html'}, {'name': '20060110 Multiple Vulnerabilities in Hummingbird Collaboration', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421392/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0173
Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to misrepresent the type and name of a file via modified doc_ext and id parameters, which might trick a user into downloading dangerous or unexpected content.
Affected Products: n/a
References: [{'name': 'ADV-2006-0145', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0145'}, {'name': '16195', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16195'}, {'name': '18411', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18411'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securenetwork.it/advisories/sn-2006-01.html'}, {'name': '20060110 Multiple Vulnerabilities in Hummingbird Collaboration', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421392/100/0/threaded'}, {'name': 'hummingbird-enterprise-file-download(24068)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24068'}]
CVE State: PUBLISHED
Explain CVE-2006-0174
Hummingbird Collaboration (aka Hummingbird Enterprise Collaboration) 5.21 and earlier allows remote attackers to obtain sensitive information (intranet IP addresses and enumerations of valid parameter values) via a direct request to hc, which reveals the information in an error message or a cookie.
Affected Products: n/a
References: [{'name': 'ADV-2006-0145', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0145'}, {'name': '16195', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16195'}, {'name': 'hummingbird-enterprise-information-disclosure(24069)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24069'}, {'name': '328', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/328'}, {'name': '18411', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18411'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securenetwork.it/advisories/sn-2006-01.html'}, {'name': '20060110 Multiple Vulnerabilities in Hummingbird Collaboration', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421392/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0175
Cross-site scripting (XSS) vulnerability in search_form.asp in Web Wiz Forums 6.34 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Affected Products: n/a
References: [{'name': '20060111 Advisory:XSS vulnerability on WebWiz Forums <= 6.34(search_form.asp)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421615/100/0/threaded'}, {'name': '22398', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22398'}, {'name': '20060109 Advisory:XSS vulnerability on WebWiz Forums <= 6.34 (search_form.asp)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0299.html'}, {'name': '16196', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16196'}, {'name': 'webwizforums-searchform-xss(24048)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24048'}]
CVE State: PUBLISHED
Explain CVE-2006-0176
Buffer overflow in certain functions in src/fileio.c and src/unix/fileio.c in xmame before 11 January 2006 may allow local users to gain privileges via a long (1) -lang, (2) -ctrlr, (3) -pb, or (4) -rec argument on many operating systems, and via a long (5) -jdev argument on Ubuntu Linux.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://x.mame.net/changes-unix.html'}, {'name': '20060110 mysec.org Security Advisory : Xmame buffer overflow, with a possibility of privilege escalation', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421849/100/0/threaded'}, {'name': 'xmame-multiple-parameters-bo(24102)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24102'}, {'name': '20060110 mysec.org Security Advisory : Xmame buffer overflow, with a possibility of privilege escalation.', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0353.html'}, {'name': '16203', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16203'}]
CVE State: PUBLISHED
Explain CVE-2006-0177
Multiple buffer overflows in Cray UNICOS 9.0.2.2 might allow local users to gain privileges by (1) invoking /usr/bin/script with a long command line argument or (2) setting the -c option of /etc/nu to the name of a file containing a long line.
Affected Products: n/a
References: [{'name': '16205', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16205'}, {'name': 'unicos-command-line-bo(24276)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24276'}, {'name': '20060110 SUID root overflows in UNICOS and partial shellcode', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0343.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0178
Format string vulnerability in /bin/ftp in UNICOS 9.0.2.2 allows local users to have an unknown impact via format string specifiers in the quote command.  NOTE: because the program is not setuid and not normally called from remote programs, there may not be a typical attack vector for the issue that crosses privilege boundaries. Therefore this may not be a vulnerability.
Affected Products: n/a
References: [{'name': '16205', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16205'}, {'name': 'unicos-ftp-format-string(24277)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24277'}, {'name': '20060110 SUID root overflows in UNICOS and partial shellcode', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0343.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0179
The Cisco IP Phone 7940 allows remote attackers to cause a denial of service (reboot) via a large amount of TCP SYN packets (syn flood) to arbitrary ports, as demonstrated to port 80.
Affected Products: n/a
References: [{'name': 'cisco-ipphone-synflood-dos(24117)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24117'}, {'name': '22469', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22469'}, {'name': 'ADV-2006-0202', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0202'}, {'name': '20060113 Response to Cisco IP Phone 7940 DoS Exploit posted on milw0rm.com', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/warp/public/707/cisco-response-20060113-ip-phones.shtml'}, {'name': '1015488', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015488'}, {'name': '18479', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18479'}, {'tags': ['x_refsource_MISC'], 'url': 'http://downloads.securityfocus.com/vulnerabilities/exploits/cisco_ip7940_dos.pl'}, {'name': '1411', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1411'}, {'name': '16200', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16200'}]
CVE State: PUBLISHED
Explain CVE-2006-0180
Cross-site scripting (XSS) vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the Title field on the "Adding New Event" page, and possibly other vectors, involving iframe tags.
Affected Products: n/a
References: [{'name': 'ADV-2006-0149', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0149'}, {'name': 'calogic-newevent-xss(24077)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24077'}, {'name': '20060116 [eVuln] CaLogic Calendars Multiple XSS Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/422163/100/0/threaded'}, {'name': '16206', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16206'}, {'name': '22322', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22322'}, {'name': '18417', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18417'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/24/summary.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0181
Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.1.3 has an undocumented administrative account with a default password, which allows local users to gain privileges via the expert command.
Affected Products: n/a
References: [{'name': '335', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/335'}, {'name': '16211', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16211'}, {'name': '1015471', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015471'}, {'name': 'ADV-2006-0154', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0154'}, {'name': '20060111 Default Administrative Password in Cisco Security Monitoring, Analysis and Response System (CS-MARS)', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/warp/public/707/cisco-sa-20060111-mars.shtml'}, {'name': 'cisco-csmars-default-password(24065)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24065'}, {'name': '18424', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18424'}, {'name': "20060112 Cisco, haven't we learned anything? (technician reset)", 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/bugtraq/2006/Jan/202'}, {'name': '22346', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22346'}]
CVE State: PUBLISHED
Explain CVE-2006-0182
login.php in ACal Calendar Project 2.2.5 allows remote attackers to bypass authentication by setting the ACalAuthenticate cookie variable to "inside".
Affected Products: n/a
References: [{'name': '343', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/343'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/25/summary.html'}, {'name': 'ADV-2006-0152', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0152'}, {'name': '18432', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18432'}, {'name': 'acal-login-auth-bypass(24104)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24104'}, {'name': '20060112 [eVuln] ACal Authentication Bypass & PHP Code Insertion', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421744/100/0/threaded'}, {'name': '22344', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22344'}]
CVE State: PUBLISHED
Explain CVE-2006-0183
Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via (1) the edit=header value, which modifies header.php, or (2) the edit=footer value, which modifies footer.php.  NOTE: this issue might be resultant from the poor authentication as identified by CVE-2006-0182.  Since the design of the product allows the administrator to edit the code, perhaps this issue should not be included in CVE, except as a consequence of CVE-2006-0182.
Affected Products: n/a
References: [{'name': '22345', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22345'}, {'name': '343', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/343'}, {'tags': ['x_refsource_MISC'], 'url': 'http://evuln.com/vulns/25/summary.html'}, {'name': 'ADV-2006-0152', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0152'}, {'name': '18432', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18432'}, {'name': '20060112 [eVuln] ACal Authentication Bypass & PHP Code Insertion', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421744/100/0/threaded'}, {'name': 'acal-header-footer-code-execute(24107)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24107'}]
CVE State: PUBLISHED
Explain CVE-2006-0184
Multiple SQL injection vulnerabilities in AspTopSites allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to goto.asp or (2) password parameter to includeloginuser.asp.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.exploitlabs.com/files/advisories/EXPL-A-2006-001-asptopsites.txt'}, {'name': 'ADV-2006-0146', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0146'}, {'name': '22330', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22330'}, {'name': 'asptopsites-goto-sql-injection(24072)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24072'}, {'name': '18408', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18408'}, {'name': '20060110 AspTopSites SQL injection', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0351.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0185
Multiple cross-site scripting vulnerabilities in the (1) Pool or (2) News Modules in Php-Nuke allow remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag.
Affected Products: n/a
References: [{'name': 'ADV-2006-0125', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0125'}, {'name': '18374', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18374'}, {'name': '20060107 Php-Nuke Pool and News Module IMG Tag Cross Site', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421322'}, {'name': '16192', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16192'}]
CVE State: PUBLISHED
Explain CVE-2006-0187
By design, Microsoft Visual Studio 2005 automatically executes code in the Load event of a user-defined control (UserControl1_Load function), which allows user-assisted attackers to execute arbitrary code by tricking the user into opening a malicious Visual Studio project file.
Affected Products: n/a
References: [{'name': 'visualstudio-usercontrol-code-execution(24116)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24116'}, {'name': '16225', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16225'}, {'name': '18409', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18409'}, {'name': '20060113 Visual Studio Remote Code Execution', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421943/100/0/threaded'}, {'name': 'ADV-2006-0151', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0151'}]
CVE State: PUBLISHED
Explain CVE-2006-0188
webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the right_frame parameter.  NOTE: this has been called a cross-site scripting (XSS) issue, but it is different than what is normally identified as XSS.
Affected Products: n/a
References: [{'name': 'MDKSA-2006:049', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2006:049'}, {'name': 'RHSA-2006:0283', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2006-0283.html'}, {'name': '19176', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19176'}, {'name': 'squirrelmail-webmail-xss(24847)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24847'}, {'name': 'FEDORA-2006-133', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://www.redhat.com/archives/fedora-announce-list/2006-March/msg00004.html'}, {'name': 'SUSE-SR:2006:005', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2006_05_sr.html'}, {'name': '20210', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/20210'}, {'name': 'oval:org.mitre.oval:def:10419', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10419'}, {'name': 'ADV-2006-0689', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0689'}, {'name': '18985', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18985'}, {'name': '19205', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19205'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.squirrelmail.org/security/issue/2006-02-01'}, {'name': '19960', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19960'}, {'name': '16756', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16756'}, {'name': '19130', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19130'}, {'name': '20060501-01-U', 'tags': ['vendor-advisory', 'x_refsource_SGI'], 'url': 'ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc'}, {'name': 'DSA-988', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-988'}, {'name': '19131', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19131'}, {'name': 'GLSA-200603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200603-09.xml'}, {'name': '1015662', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015662'}]
CVE State: PUBLISHED
Explain CVE-2006-0189
Buffer overflow in eStara Softphone 3.0.1.14 through 3.0.1.46 allows remote attackers to execute arbitrary code via a long attribute (aka "a") field in the SDP data of a SIP packet on UDP port 5060.
Affected Products: n/a
References: [{'name': '22348', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22348'}, {'name': 'ADV-2006-0167', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0167'}, {'name': '18410', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18410'}, {'name': '20060111 eStara Softphone SIP stack Buffer Overflow Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421596/100/0/threaded'}, {'name': 'estara-sip-sdp-bo(24090)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24090'}, {'name': '16213', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16213'}, {'name': '1015481', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015481'}]
CVE State: PUBLISHED
Explain CVE-2006-0190
Unspecified vulnerability in Sun Solaris 9 and 10 for the x86 platform allows local users to gain privileges or cause a denial of service (panic) via unspecified vectors, possibly involving functions from the mm driver.
Affected Products: n/a
References: [{'name': '18421', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18421'}, {'name': 'ADV-2006-0165', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0165'}, {'name': 'solaris-unspecified-root-access(24084)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24084'}, {'name': '1015478', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015478'}, {'name': '16224', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16224'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm'}, {'name': '102066', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/searchproxy/document.do?assetkey=1-26-102066-1'}, {'name': '19087', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19087'}, {'name': 'oval:org.mitre.oval:def:702', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A702'}]
CVE State: PUBLISHED
Explain CVE-2006-0191
Unspecified vulnerability in Sun Solaris 10 allows local users to cause a denial of service (null dereference) via unspecified vectors involving the use of the find command on the "/proc" filesystem. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this is related to CVE-2005-3250.
Affected Products: n/a
References: [{'name': '16222', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16222'}, {'name': '18420', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18420'}, {'name': '22347', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22347'}, {'name': 'solaris-find-proc-dos(24085)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24085'}, {'name': 'oval:org.mitre.oval:def:1608', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1608'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/elmodocs2/security/ASA-2006-056.htm'}, {'name': 'ADV-2006-0166', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0166'}, {'name': '1015479', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015479'}, {'name': '19087', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19087'}, {'name': '102108', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/searchproxy/document.do?assetkey=1-26-102108-1'}]
CVE State: PUBLISHED
Explain CVE-2006-0192
SQL injection vulnerability in Login_Validate.asp in ASPSurvey 1.10 allows remote attackers to execute arbitrary SQL commands via the Password parameter to login.asp.
Affected Products: n/a
References: [{'name': '20060204 sql injection in ASP Survey', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423949/100/0/threaded'}, {'name': 'ADV-2006-0164', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0164'}, {'name': '414', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/414'}, {'name': 'aspsurvey-loginvalidate-sql-injection(24087)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24087'}, {'name': '18422', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18422'}, {'name': '16496', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16496'}, {'name': '22342', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22342'}]
CVE State: PUBLISHED
Explain CVE-2006-0193
Cross-site scripting (XSS) vulnerability in the Hosting Control Panel (psoft.hsphere.CP) in Positive Software H-Sphere 2.4.3 Patch 8 and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter in a login action.
Affected Products: n/a
References: [{'name': '22372', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22372'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.psoft.net/HSdocumentation/versions/index.php?v=243p9&p=r'}, {'name': 'ADV-2006-0172', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0172'}, {'name': '20060112 H-Sphere Security Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421704/100/0/threaded'}, {'name': 'hsphere-login-xss(24096)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24096'}, {'name': '18447', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18447'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.psoft.net/HSdocumentation/versions/?v=all&p=r'}]
CVE State: PUBLISHED
Explain CVE-2006-0194
Cross-site scripting (XSS) vulnerability in default.asp in FogBugz 4.029, and other versions before 4.0.33, allows remote attackers to inject arbitrary web script or HTML via the dest parameter in the pgLogon page.
Affected Products: n/a
References: [{'name': '22370', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22370'}, {'name': 'ADV-2006-0174', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0174'}, {'name': '20060112 FogBugz Cross Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421729/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fogcreek.com/FogBugz/KB/releaseNotes/WhatsNewInFogBugz4.0.33.html'}, {'name': 'fogbugz-login-xss(24103)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24103'}, {'name': '18443', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18443'}, {'name': '16216', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16216'}]
CVE State: PUBLISHED
Explain CVE-2006-0195
Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via style sheet specifiers with invalid (1) "/*" and "*/" comments, or (2) a newline in a "url" specifier, which is processed by certain web browsers including Internet Explorer.
Affected Products: n/a
References: [{'name': 'MDKSA-2006:049', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2006:049'}, {'name': 'RHSA-2006:0283', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2006-0283.html'}, {'name': '19176', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19176'}, {'name': 'FEDORA-2006-133', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://www.redhat.com/archives/fedora-announce-list/2006-March/msg00004.html'}, {'name': 'SUSE-SR:2006:005', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2006_05_sr.html'}, {'name': '20210', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/20210'}, {'name': 'ADV-2006-0689', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0689'}, {'name': '18985', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18985'}, {'name': '19205', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19205'}, {'name': '19960', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19960'}, {'name': '16756', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16756'}, {'name': '19130', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19130'}, {'name': 'squirrelmail-magichtml-xss(24848)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24848'}, {'name': '20060501-01-U', 'tags': ['vendor-advisory', 'x_refsource_SGI'], 'url': 'ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.squirrelmail.org/security/issue/2006-02-10'}, {'name': 'oval:org.mitre.oval:def:9548', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9548'}, {'name': 'DSA-988', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-988'}, {'name': '19131', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19131'}, {'name': 'GLSA-200603-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200603-09.xml'}, {'name': '1015662', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015662'}]
CVE State: PUBLISHED
Explain CVE-2006-0196
Unspecified vulnerability in Serial line sniffer (aka slsnif) 0.4.4 allows local users to gain privileges via a long value of the HOME environment variable, possibly because of a buffer overflow.
Affected Products: n/a
References: [{'name': '20060111 Serial Line Sniffer 0.4.4 Buffer Overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421583/100/0/threaded'}, {'name': 'slsnif-home-bo(24082)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24082'}, {'name': 'ADV-2006-0212', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0212'}, {'tags': ['x_refsource_MISC'], 'url': 'http://shellcoders.com/sintigan/slsnif-ploit.pl'}, {'name': '18497', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18497'}]
CVE State: PUBLISHED
Explain CVE-2006-0197
The XClientMessageEvent struct used in certain components of X.Org 6.8.2 and earlier, possibly including (1) the X server and (2) Xlib, uses a "long" specifier for elements of the l array, which results in inconsistent sizes in the struct on 32-bit versus 64-bit platforms, and might allow attackers to cause a denial of service (application crash) and possibly conduct other attacks.
Affected Products: n/a
References: [{'name': '20060108 xorg server 6.8.2 and below on 64bit arch', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421256/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0198
Cross-site scripting (XSS) vulnerability in a certain module, possibly poll or Pool, for XOOPS allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an IMG element in a comment.
Affected Products: n/a
References: [{'name': 'xoops-pool-imagetag-xss(24091)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24091'}, {'name': '16189', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16189'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.xoops.org/modules/newbb/viewtopic.php?topic_id=45637&forum=2&post_id=200481'}, {'name': '20060107 Xoops Pool Module IMG Tag Cross Site Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421325/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0199
SQL injection vulnerability in news.asp in Mini-Nuke CMS System 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the hid parameter.
Affected Products: n/a
References: [{'name': 'mininuke-news-sql-injection(24098)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24098'}, {'name': '20060113 Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injectionvulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421727/100/0/threaded'}, {'name': '22384', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22384'}, {'name': '18439', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18439'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nukedx.com/?viewdoc=7'}, {'name': 'ADV-2006-0173', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0173'}, {'name': '340', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/340'}, {'name': '20060112 Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injection vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0439.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0200
Format string vulnerability in the error-reporting feature in the mysqli extension in PHP 5.1.0 and 5.1.1 might allow remote attackers to execute arbitrary code via format string specifiers in MySQL error messages.
Affected Products: n/a
References: [{'name': '1015485', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015485'}, {'name': '18431', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18431'}, {'name': 'ADV-2006-0369', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0369'}, {'name': 'ADV-2006-0177', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0177'}, {'name': '20060112 Advisory 02/2006: PHP ext/mysqli Format String Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421705/100/0/threaded'}, {'name': 'php-extmysqli-format-string(24095)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24095'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.hardened-php.net/advisory_022006.113.html'}, {'name': '337', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/337'}, {'name': '16219', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16219'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/release_5_1_2.php'}]
CVE State: PUBLISHED
Explain CVE-2006-0201
Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50, and possibly earlier versions, allows remote attackers to enter false payment entries into the log file via HTTP POST requests to ipn_success.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.uinc.ru/articles/vuln/ptpaypal050.shtml'}, {'name': '18444', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18444'}, {'name': 'ADV-2006-0183', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0183'}, {'name': '22378', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22378'}, {'name': '16218', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16218'}, {'name': '20060112 Multiple PHP Toolkit for PayPal Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421739'}]
CVE State: PUBLISHED
Explain CVE-2006-0202
Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier has (1) world-readable permissions for ipn/logs/ipn_success.txt, which allows local users to view sensitive information (payment data), and (2) world-writable permissions for ipn/logs, which allows local users to delete or replace payment data.
Affected Products: n/a
References: [{'name': '22379', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22379'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.uinc.ru/articles/vuln/ptpaypal050.shtml'}, {'name': '18444', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18444'}, {'name': 'ADV-2006-0183', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0183'}, {'name': '16218', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16218'}, {'name': '20060112 Multiple PHP Toolkit for PayPal Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/421739'}]
CVE State: PUBLISHED