Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2006-0510
SQL injection vulnerability in userlogin.jsp in Daffodil CRM 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified parameters in a login action.
Affected Products: n/a
References: [{'name': 'ADV-2006-0412', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0412'}, {'name': '20060130 Daffodil CRM - vulnerable to SQL-injection.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423718/100/0/threaded'}, {'name': 'daffodilcrm-userlogin-sql-injection(24450)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24450'}, {'name': '18685', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18685'}, {'name': '16433', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16433'}, {'name': '22879', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22879'}]
CVE State: PUBLISHED
Explain CVE-2006-0511
Blackboard Academic Suite 6.0 and earlier does not properly clear session information when de-authenticating a user who is idle, which allows subsequent users to log in as the previous user and gain privileges.  NOTE: the vendor has disputed this issue, saying that "This is a customer specific issue related to their Kerberos authentication single sign-on application and not a vulnerability in the Blackboard product.
Affected Products: n/a
References: [{'name': '16438', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16438'}, {'name': '20060202 Re: Blackboard Authentication Error', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423778/100/0/threaded'}, {'name': '20060201 Re: Blackboard Authentication Error', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423686/100/0/threaded'}, {'name': '20060201 Blackboard Authentication Error', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423654/100/0/threaded'}, {'name': '28023', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/28023'}]
CVE State: PUBLISHED
Explain CVE-2006-0512
PADL MigrationTools 46 creates temporary files insecurely, which allows local users to overwrite arbitrary files via a symlink attack on the temporary files, which are not properly created by (1) migrate_all_online.sh, (2) migrate_all_offline.sh, (3) migrate_all_netinfo_online.sh, (4) migrate_all_netinfo_offline.sh, (5) migrate_all_nis_online.sh, (6) migrate_all_nis_offline.sh, (7) migrate_all_nisplus_online.sh, and (8) migrate_all_nisplus_offline.sh.
Affected Products: n/a
References: [{'name': '22243', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/22243'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=338920'}, {'name': 'DSA-1187', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2006/dsa-1187'}, {'name': 'ADV-2005-2427', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2005/2427'}]
CVE State: PUBLISHED
Explain CVE-2006-0513
Directory traversal vulnerability in pkmslogout in Tivoli Web Server Plug-in 5.1.0.10 in Tivoli Access Manager (TAM) 5.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
Affected Products: n/a
References: [{'name': '20060203 VSR Advisory: IBM Tivoli Access Manager - Web Server Plug-in File Retrieval Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041930.html'}, {'name': 'IY79724', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg24011562'}, {'name': 'ADV-2006-0442', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0442'}, {'name': '1015582', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015582'}, {'name': 'tivoli-pkmslogout-directory-traversal(24485)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24485'}, {'name': '20060203 VSR Advisory: IBM Tivoli Access Manager - Web Server Plug-in File Retrieval Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423946/100/0/threaded'}, {'name': '412', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/412'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.vsecurity.com/bulletins/advisories/2006/tam-file-retrieval.txt'}, {'name': '18725', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18725'}, {'name': '16494', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16494'}]
CVE State: PUBLISHED
Explain CVE-2006-0515
Cisco PIX/ASA 7.1.x before 7.1(2) and 7.0.x before 7.0(5), PIX 6.3.x before 6.3.5(112), and FWSM 2.3.x before 2.3(4) and 3.x before 3.1(7), when used with Websense/N2H2, allows remote attackers to bypass HTTP access restrictions by splitting the GET method of an HTTP request into multiple packets, which prevents the request from being sent to Websense for inspection, aka bugs CSCsc67612, CSCsc68472, and CSCsd81734.
Affected Products: n/a
References: [{'name': '20060508 VSR Advisory: WebSense content filter bypass when deployed in conjunction with Cisco filtering devices', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045899.html'}, {'name': '25453', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/25453'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.vsecurity.com/bulletins/advisories/2006/cisco-websense-bypass.txt'}, {'name': '20044', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/20044'}, {'name': '17883', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17883'}, {'name': 'ADV-2006-1738', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1738'}, {'name': '20060508 PIX/ASA/FWSM Websense/N2H2 Content Filter Bypass', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/sw/netmgtsw/ps2032/tsd_products_security_response09186a00806824ec.html'}, {'name': '1016040', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1016040'}, {'name': '1016039', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1016039'}, {'name': '20060508 VSR Advisory: WebSense content filter bypass when deployed in conjunction with Cisco filtering devices', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/433270/100/0/threaded'}, {'name': 'cisco-websense-content-filtering-bypass(26308)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/26308'}]
CVE State: PUBLISHED
Explain CVE-2006-0516
Unspecified vulnerability in the kernel processing in Solaris 10 64 bit platform, when running in 64-bit mode, allows local users to cause a denial of service (system panic) via unknown attack vectors.
Affected Products: n/a
References: [{'name': '102149', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-102149-1'}, {'name': '18671', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18671'}, {'name': 'ADV-2006-0394', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0394'}, {'name': '16460', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16460'}, {'name': '1015557', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015557'}, {'name': 'solaris-x64-kernel-dos(24395)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24395'}, {'name': 'oval:org.mitre.oval:def:1163', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1163'}, {'name': 'oval:org.mitre.oval:def:219', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A219'}]
CVE State: PUBLISHED
Explain CVE-2006-0517
Multiple SQL injection vulnerabilities in formulaires/inc-formulaire_forum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id_forum, (2) id_article, or (3) id_breve parameters to forum.php3; (4) unspecified vectors related to "session handling"; and (5) when posting "petitions".
Affected Products: n/a
References: [{'name': '20060131 ZRCSA-200601: SPIP - Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0990.html'}, {'name': '16458', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16458'}, {'name': '22845', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22845'}, {'name': '22848', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22848'}, {'name': 'spip-forum-sql-injection(24397)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24397'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zone-h.org/en/advisories/read/id=8650/'}, {'name': '22844', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22844'}, {'name': '1015556', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015556'}, {'name': '24397', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/24397'}, {'name': '18676', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18676'}, {'name': '20060131 ZRCSA-200601: SPIP - Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423655/100/0/threaded'}, {'name': 'ADV-2006-0398', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0398'}, {'name': '395', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/395'}]
CVE State: PUBLISHED
Explain CVE-2006-0518
Cross-site scripting (XSS) vulnerability in index.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Affected Products: n/a
References: [{'name': 'spip-index-xss(24401)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24401'}, {'name': '22849', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22849'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zone-h.org/en/advisories/read/id=8650/'}, {'name': '18676', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18676'}, {'name': 'ADV-2006-0398', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0398'}, {'name': '16461', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16461'}]
CVE State: PUBLISHED
Explain CVE-2006-0519
SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to obtain sensitive information via a direct request to inc-messforum.php3, which reveals the path in an error message.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.zone-h.org/en/advisories/read/id=8650/'}, {'name': '18676', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18676'}, {'name': 'ADV-2006-0398', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0398'}, {'name': 'spip-incmessforum-path-disclosure(24399)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24399'}]
CVE State: PUBLISHED
Explain CVE-2006-0520
SQL injection vulnerability index.php in Dragoran Portal module 1.3 for Invision Power Board (IPB) allows remote attackers to execute arbitrary SQL commands via the site parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': 'ADV-2006-0396', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0396'}, {'name': '16447', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16447'}, {'name': '22851', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22851'}, {'name': 'portal-index-sql-injection(24404)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24404'}, {'name': '18664', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18664'}]
CVE State: PUBLISHED
Explain CVE-2006-0521
Cross-site scripting (XSS) vulnerability in results.php in BrowserCRM allows remote attackers to inject arbitrary web script or HTML via certain manipulations of the query parameter, as demonstrated using an IMG SRC tag.
Affected Products: n/a
References: [{'name': 'browsercrm-results-xss(24390)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24390'}, {'name': 'ADV-2006-0391', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0391'}, {'name': '20060131 BrowserCRM vulnerable for XSS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423546/100/0/threaded'}, {'name': '18658', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18658'}, {'name': '16435', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16435'}, {'name': '22841', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22841'}, {'name': '393', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/393'}]
CVE State: PUBLISHED
Explain CVE-2006-0522
SQL injection vulnerability in the Authentication Servlet in Symantec Sygate Management Server (SMS) version 4.1 build 1417 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via unknown attack vectors related to a URL.
Affected Products: n/a
References: [{'name': '1015561', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015561'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://securityresponse.symantec.com/avcenter/security/Content/2006.02.01.html'}, {'name': '16452', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16452'}, {'name': '18689', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18689'}, {'name': 'symantec-sms-sql-injection(24413)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24413'}, {'name': '22883', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22883'}, {'name': 'ADV-2006-0402', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0402'}]
CVE State: PUBLISHED
Explain CVE-2006-0523
SQL injection vulnerability in global.php in MyBB before 1.03 allows remote attackers to execute arbitrary SQL commands via the templatelist variable.
Affected Products: n/a
References: [{'name': 'mybb-global-sql-injection(24416)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24416'}, {'name': '22903', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22903'}, {'name': 'ADV-2006-0400', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0400'}, {'name': '18678', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18678'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://community.mybboard.net/showthread.php?tid=6418'}]
CVE State: PUBLISHED
Explain CVE-2006-0524
Cross-site scripting (XSS) vulnerability in ashnews.php in Derek Ashauer ashNews 0.83 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Affected Products: n/a
References: [{'name': 'ashnews-ashnews-xss(24365)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24365'}, {'name': '9331', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/9331'}, {'name': '22934', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22934'}, {'name': '20060131 Re: ashnews Cross-Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0979.html'}, {'name': '20060130 Re: ashnews Cross-Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0969.html'}, {'name': '20060130 ashnews Cross-Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0955.html'}, {'name': '16426', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16426'}]
CVE State: PUBLISHED
Explain CVE-2006-0525
Multiple Adobe products, including (1) Photoshop CS2, (2) Illustrator CS2, and (3) Adobe Help Center, install a large number of .EXE and .DLL files with write-access permission for the Everyone group, which allows local users to gain privileges via Trojan horse programs.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/techdocs/332644.html'}, {'name': '16451', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16451'}, {'name': '1015577', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015577'}, {'name': '1015579', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015579'}, {'name': '20060131 Windows Access Control Demystified', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423587/100/0/threaded'}, {'name': 'VU#953860', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/953860'}, {'name': '18698', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18698'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.princeton.edu/~sudhakar/papers/winval.pdf'}, {'name': '1015578', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015578'}, {'name': 'adobe-insecure-default-permissions(24464)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24464'}, {'name': 'ADV-2006-0431', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0431'}, {'name': '22908', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22908'}]
CVE State: PUBLISHED
Explain CVE-2006-0526
The default configuration of the America Online (AOL) client software allows all users to modify a certain registry value that specifies a DLL file name, which might allow local users to gain privileges via a Trojan horse program.
Affected Products: n/a
References: [{'name': '16453', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16453'}, {'name': '20060131 Windows Access Control Demystified', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423587/100/0/threaded'}, {'name': 'VU#953860', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/953860'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.cs.princeton.edu/~sudhakar/papers/winval.pdf'}, {'name': 'aol-insecure-default-permissions(24498)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24498'}]
CVE State: PUBLISHED
Explain CVE-2006-0527
BIND 4 (BIND4) and BIND 8 (BIND8), if used as a target forwarder, allows remote attackers to gain privileged access via a "Kashpureff-style DNS cache corruption" attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://computerworld.com/networkingtopics/networking/story/0%2C10801%2C103744%2C00.html'}, {'name': '22888', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22888'}, {'name': 'HPSBTU02095', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00595837'}, {'name': 'ADV-2006-0399', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0399'}, {'name': '1015606', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015606'}, {'name': 'SSRT051045', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://www.securityfocus.com/archive/1/425083/100/0/threaded'}, {'name': '18690', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18690'}, {'name': '438', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/438'}, {'name': 'HPSBUX02097', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://www.securityfocus.com/archive/1/425083/100/0/threaded'}, {'name': '748', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/748'}, {'name': '1015551', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015551'}, {'name': '16455', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16455'}, {'name': '20060216 Recent HP advisories outline BIND problems', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://attrition.org/pipermail/vim/2006-February/000551.html'}, {'name': 'SSRT051007', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00595837'}, {'name': 'tru64-dns-bind-unauth-access(24414)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24414'}]
CVE State: PUBLISHED
Explain CVE-2006-0528
The cairo library (libcairo), as used in GNOME Evolution and possibly other products, allows remote attackers to cause a denial of service (persistent client crash) via an attached text file that contains "Content-Disposition: inline" in the header, and a very long line in the body, which causes the client to repeatedly crash until the e-mail message is manually removed, possibly due to a buffer overflow, as demonstrated using an XML attachment.
Affected Products: n/a
References: [{'name': '16408', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16408'}, {'name': 'USN-265-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/265-1/'}, {'name': 'SUSE-SR:2006:007', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2006_07_sr.html'}, {'name': '610', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/610'}, {'name': 'MDKSA-2006:057', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2006:057'}, {'name': '20060128 gnome evolution mail client inline text file DoS issue', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0925.html'}, {'name': '19504', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19504'}]
CVE State: PUBLISHED
Explain CVE-2006-0529
Computer Associates (CA) Message Queuing (CAM / CAFT) before 1.07 Build 220_16 and 1.11 Build 29_20, as used in multiple CA products, allows remote attackers to cause a denial of service via a crafted message to TCP port 4105.
Affected Products: n/a
References: [{'name': '16475', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16475'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://supportconnectw.ca.com/public/ca_common_docs/camessagsecurity_notice.asp'}, {'name': '1015571', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015571'}, {'name': 'ADV-2006-0414', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0414'}, {'name': '18681', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18681'}, {'name': 'ca-cam-port4105-dos(24448)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24448'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33581'}, {'name': '21146', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/21146'}, {'name': '20060202 CAID 33581 - CA Message Queuing Denial of Service Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423785/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0530
Computer Associates (CA) Message Queuing (CAM / CAFT) before 1.07 Build 220_16 and 1.11 Build 29_20, as used in multiple CA products, allows remote attackers to cause a denial of service via spoofed CAM control messages.
Affected Products: n/a
References: [{'name': '16475', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16475'}, {'name': 'ca-cam-spoofed-message-dos(24449)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24449'}, {'name': '404', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/404'}, {'name': '1015571', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015571'}, {'name': 'ADV-2006-0414', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0414'}, {'name': '18681', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18681'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33581'}, {'name': '20060202 CAID 33581 - CA Message Queuing Denial of Service Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423785/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0531
Unspecified vulnerability in Sun Java System Access Manager 7.0 allows local users logged in as "root" to bypass authentication and gain top-level administrator privileges via the amadmin CLI tool.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:360', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A360'}, {'name': 'oval:org.mitre.oval:def:755', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A755'}, {'name': '16474', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16474'}, {'name': '102140', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-102140-1'}, {'name': 'ADV-2006-0430', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0430'}, {'name': '1015567', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015567'}, {'name': '18699', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18699'}, {'name': 'sun-jsam-admin-access(24423)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24423'}]
CVE State: PUBLISHED
Explain CVE-2006-0532
Cross-site scripting (XSS) vulnerability in resultat.asp in SoftMaker Shop allows remote attackers to inject arbitrary web script or HTML via a strSok parameter containing a javascript: URI in an IMG SRC attribute.
Affected Products: n/a
References: [{'name': 'ADV-2006-0434', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0434'}, {'name': '20060201 SoftMaker Shop is vulnerable to XSS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423768'}, {'name': 'softmakershop-image-xss(24451)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24451'}, {'name': '22911', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22911'}, {'name': '18683', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18683'}, {'name': '400', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/400'}, {'name': '16471', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16471'}]
CVE State: PUBLISHED
Explain CVE-2006-0533
Cross-site scripting (XSS) vulnerability in webmailaging.cgi in cPanel allows remote attackers to inject arbitrary web script or HTML via the numdays parameter.
Affected Products: n/a
References: [{'name': 'ADV-2006-0433', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0433'}, {'name': 'cpanel-scripts-xss(24468)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24468'}, {'name': '20060203 Re: cPanel Multiple Cross Site Scripting', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=113894933522271&w=2'}, {'name': '22906', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22906'}, {'name': '18691', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18691'}]
CVE State: PUBLISHED
Explain CVE-2006-0534
Multiple cross-site scripting (XSS) vulnerabilities in default.asp in CyberShop Ultimate E-commerce allow remote attackers to inject arbitrary web script or HTML via the (1) ortak or (2) kat parameter.
Affected Products: n/a
References: [{'name': '401', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/401'}, {'name': '20060202 CyberShop Ultimate E-commerce Script Cross Site Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423787/100/0/threaded'}, {'name': '18730', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18730'}, {'name': 'cybershop-xss(24454)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24454'}, {'name': '16473', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16473'}]
CVE State: PUBLISHED
Explain CVE-2006-0535
Multiple cross-site scripting (XSS) vulnerabilities in Community Server allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.  NOTE: this candidate does not contain any actionable or distinguishing information.  Perhaps it should not be included in CVE.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '16478', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16478'}]
CVE State: PUBLISHED
Explain CVE-2006-0536
Cross-site scripting (XSS) vulnerability in neomail.pl in NeoMail 1.27 allows remote attackers to inject arbitrary web script or HTML via the sort parameter.  NOTE: some sources say that the affected parameter is "date," but the demonstration URL shows that it is "sort".
Affected Products: n/a
References: [{'name': '20060203 Neomail Cross Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423901/100/0/threaded'}, {'name': '1015581', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015581'}, {'name': 'neomail-neomail-script-xss(24470)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24470'}, {'name': 'ADV-2006-0449', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0449'}, {'name': '22978', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22978'}]
CVE State: PUBLISHED
Explain CVE-2006-0537
Buffer overflow in the POP3 server in Kinesphere Corporation eXchange before 5.0.060125 allows remote attackers to execute arbitrary code via a long RCPT TO argument.
Affected Products: n/a
References: [{'name': '1466', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1466'}, {'name': '408', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/408'}, {'name': '18687', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18687'}, {'tags': ['x_refsource_MISC'], 'url': 'http://downloads.securityfocus.com/vulnerabilities/exploits/exchangepop3.pl'}, {'name': 'ADV-2006-0437', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0437'}, {'name': '20060203 Exchangepop3 rcpt buffer overflow vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2006-02/0040.html'}, {'name': '16485', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16485'}, {'name': '22907', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22907'}, {'name': 'exchangepop3-rcptto-bo(24477)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24477'}, {'name': '1015580', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015580'}]
CVE State: PUBLISHED
Explain CVE-2006-0538
CipherTrust IronMail 5.0.1, when "Denial of Service Protection" is enabled, allows remote attackers to cause a denial of service (possibly CPU consumption) via a SYN flood with malformed TCP packets from multiple connections.
Affected Products: n/a
References: [{'name': '407', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/407'}, {'name': 'ironmail-tcpsyn-flood-dos(24445)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24445'}, {'name': '16465', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16465'}, {'name': '1015555', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015555'}, {'name': '20060203 IronMail-5.0.1-Denial of-Service-Protection-Lets-Remote-Users-Deny-Service', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423898/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0539
The convert-fcrontab program in fcron 3.0.0 might allow local users to gain privileges via a long command-line argument, which causes Linux glibc to report heap memory corruption, possibly because a strcpy in the strdup2 function can "overwrite some data."
Affected Products: n/a
References: [{'name': '20060201 Fcrontab - memory corruption on heap.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423697/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://fcron.free.fr/news.php#a20060206a.xml'}, {'name': 'fcron-syslog-bo(24444)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24444'}, {'name': '20060201 Fcrontab - memory corruption on heap.', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0999.html'}, {'name': 'ADV-2006-0435', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0435'}, {'name': '2006-0036', 'tags': ['vendor-advisory', 'x_refsource_TRUSTIX'], 'url': 'http://www.trustix.org/errata/2006/0036'}, {'name': '18719', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18719'}, {'name': '16467', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16467'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.trustix.org/show_bug.cgi?id=1754'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://fcron.free.fr/doc/en/changes.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0540
Multiple SQL injection vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.evuln.com/vulns/54/summary.html'}, {'name': 'vanillaguestbook-messages-sql-injection(24412)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24412'}, {'name': '20060201 [eVuln] Vanilla Guestbook Multiple XSS & SQL Injection Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423957/100/0/threaded'}, {'name': '16464', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16464'}]
CVE State: PUBLISHED
Explain CVE-2006-0541
Multiple cross-site scripting (XSS) vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to "posting new messages."
Affected Products: n/a
References: [{'name': 'vanillaguestbook-name-xss(24411)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24411'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.evuln.com/vulns/54/summary.html'}, {'name': '20060201 [eVuln] Vanilla Guestbook Multiple XSS & SQL Injection Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423957/100/0/threaded'}, {'name': '16464', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16464'}, {'name': '20060227 Re: [eVuln] Vanilla Guestbook Multiple XSS & SQL Injection Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/426200/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0542
Multiple SQL injection vulnerabilities in config.php in NukedWeb GuestBookHost 2005.04.25 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameters.
Affected Products: n/a
References: [{'name': '16545', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16545'}, {'name': 'ADV-2006-0465', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0465'}, {'name': '20060209 [eVuln] GuestBookHost Authentication Bypass', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/424714/100/0/threaded'}, {'name': '18761', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18761'}, {'name': 'guestbookhost-login-sql-injection(24406)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24406'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.evuln.com/vulns/56/summary.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0543
Cerulean Trillian 3.1.0.120 allows remote attackers to cause a denial of service (client crash) via an AIM message containing the Mac encoded Rich Text Format (RTF) escape sequences (1) \'d1, (2) \'d2, (3) \'d3, (4) \'d4, and (5) \'d5.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '22877', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22877'}]
CVE State: PUBLISHED
Explain CVE-2006-0544
urlmon.dll in Microsoft Internet Explorer 7.0 beta 2 (aka 7.0.5296.0) allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a BGSOUND element with its SRC attribute set to "file://" followed by a large number of "-" (dash of hyphen) characters.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.security-protocols.com/advisory/sp-x23-advisory.txt'}, {'name': '16463', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16463'}]
CVE State: PUBLISHED
Explain CVE-2006-0545
SQL injection vulnerability in showflat.php in Groupee (formerly known as Infopop) UBB.threads 6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Number parameter.
Affected Products: n/a
References: [{'name': '20060325 UBBThreads<=5.5.1+6.0.2+6.0 br5+6.0.1 SQL injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2006-03/0494.html'}, {'name': '22808', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22808'}, {'name': '16520', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16520'}, {'name': '1015549', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1015549'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.cyberlords.net/advisories/cl_ubb.txt'}, {'name': 'ubbthreads-showflat-sql-injection(24381)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24381'}]
CVE State: PUBLISHED
Explain CVE-2006-0546
Unspecified vulnerability in index.php in a certain application available from /v1/tr/portfoy.php on www.egeinternet.com allows remote attackers to execute arbitrary code via "evilcode" in the key parameter, possibly a PHP remote file include vulnerability in which the attack vector is a URL in the key parameter.  NOTE: it is not clear whether this vulnerability is associated with an online service or application service provider.  If so, then it should not be included in CVE.
Affected Products: n/a
References: [{'name': '20060128 Ege Internet Web Desing Remote Command Exucetion', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423365/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2006-0547
Oracle Database 8i, 9i, and 10g allow remote authenticated users to execute arbitrary SQL statements in the context of the SYS user and bypass audit logging, including statements to create new privileged database accounts, via a modified AUTH_ALTER_SESSION attribute in the authentication phase of the Transparent Network Substrate (TNS) protocol.  NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle.  It is possible that this is the same issue as Oracle Vuln# DB18 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0265.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html'}, {'name': 'TA06-018A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA06-018A.html'}, {'name': '20060117 Oracle DBMS - Access Control Bypass in Login', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041464.html'}, {'name': 'VU#871756', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/871756'}, {'name': 'oracle-login-command-execute(24184)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24184'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.imperva.com/application_defense_center/papers/oracle-dbms-01172006.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0548
SQL injection vulnerability in the Oracle Text component of Oracle Database 10g, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle.  It is possible that this is the same issue as Oracle Vuln# DB15 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0260.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdf'}, {'name': 'oracle-january2006-update(24321)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24321'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html'}, {'name': 'VU#150332', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/150332'}, {'name': 'TA06-018A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA06-018A.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html'}]
CVE State: PUBLISHED
Explain CVE-2006-0549
SQL injection vulnerability in the SYS.DBMS_METADATA_UTIL package in Oracle Database 10g, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle.  It is possible that this is the same issue as Oracle Vuln# DB05 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0260.  However, there are some inconsistencies that make this unclear, and there is also a possibility that this is related to DB06, which is subsumed by CVE-2006-0259.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_metadata_util.html'}, {'name': 'VU#629316', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/629316'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdf'}, {'name': 'oracle-january2006-update(24321)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24321'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html'}, {'name': 'TA06-018A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA06-018A.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html'}]
CVE State: PUBLISHED