DuyTa/cve-kgrag-db huggingface dataset:
CVE-2006-3055
Multiple SQL injection vulnerabilities in VBZooM 1.02 allow remote attackers to execute arbitrary SQL commands via the (1) QuranID, (2) ShowByQuranID, or (3) Action parameters to meaning.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: vbzoom
References: http://www.securityfocus.com/archive/1/436939/100/0/threaded, http://www.securityfocus.com/bid/18403, https://exchange.xforce.ibmcloud.com/vulnerabilities/27170
CVE-2006-3257
Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.7.7 allow remote attackers to inject arbitrary HTML or web script via unspecified attack vectors, possibly including (1) calendar/myagenda.php, (2) document/document.php, (3) phpbb/newtopic.php, (4) tracking/userLog.php, and (5) wiki/page.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: claroline
References: http://secunia.com/advisories/20817, http://securityreason.com/securityalert/1160, http://securitytracker.com/id?1016387
CVE-2006-2538
IE Tab 1.0.9 plugin for Mozilla Firefox 1.5.0.3 allows remote user-assisted attackers to cause a denial of service (application crash), possibly due to a null dereference, via certain Javascript, as demonstrated using a url parameter to the content/reloaded.html page in a chrome:// URI.  Some third-party researchers claim that they are unable to reproduce this vulnerability.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P
Affected Products: ie_tab, firefox
References: http://www.securityfocus.com/archive/1/434280/100/0/threaded, http://www.securityfocus.com/archive/1/434519/100/0/threaded, https://exchange.xforce.ibmcloud.com/vulnerabilities/26540
CVE-2006-1005
agencyprofile.asp in Parodia 6.2 and earlier might allow remote attackers to obtain sensitive information by triggering an SQL error via an invalid AG_ID parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P
Affected Products: parodia
References: http://secunia.com/advisories/19025, http://secunia.com/advisories/19025
CVE-2006-4502
ezPortal/ztml CMS 1.0 allows remote attackers to bypass authentication controls via a direct request to the "Administration Area" script.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ezportal_ztml_cms
References: http://securityreason.com/securityalert/1481, http://www.securityfocus.com/archive/1/444743/100/0/threaded, http://www.securityfocus.com/bid/19759
CVE-2006-3615
Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: phorum
References: http://archives.neohapsis.com/archives/bugtraq/2006-07/0191.html, http://archives.neohapsis.com/archives/bugtraq/2006-07/0200.html, http://retrogod.altervista.org/phorum5_local_incl_xpl.html
CVE-2006-0050
snmptrapfmt in Debian 3.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary log file.
CVSS v2.0 Score: 1.2 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:N
Affected Products: debian_linux
References: http://secunia.com/advisories/19318, http://www.debian.org/security/2006/dsa-1013, http://www.securityfocus.com/bid/17182
CVE-2006-6243
Multiple SQL injection vulnerabilities in index.asp in FipsSHOP allow remote attackers to execute arbitrary SQL commands via the (1) cat or (2) did parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: fipsshop
References: http://secunia.com/advisories/23147, http://securityreason.com/securityalert/1959, http://www.aria-security.com/forum/showthread.php?t=46
CVE-2006-3191
Cross-site scripting (XSS) vulnerability in comment.php in MPCS 0.2 allows remote attackers to inject arbitrary web script or HTML via the pageid parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: mpcs
References: http://securityreason.com/securityalert/1130, http://tpvgames.co.uk/mpcs/, http://www.securityfocus.com/archive/1/437631/100/0/threaded
CVE-2006-0972
SQL injection vulnerability in news.php in Tony Baird Fantastic News 2.1.1 allows remote attackers to execute arbitrary SQL commands via the page parameter.  NOTE: the category vector is already covered by CVE-2005-3846.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: fantastic_news
References: http://securityreason.com/securityalert/501, http://www.securityfocus.com/archive/1/426195/100/0/threaded, http://www.securityfocus.com/bid/16842
CVE-2006-1002
NETGEAR WGT624 Wireless DSL router has a default account of super_username "Gearguy" and super_passwd "Geardog", which allows remote attackers to modify the configuration.  NOTE: followup posts have suggested that this might not occur with all WGT624 routers.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: wgt624
Related CWEs: CWE-255
References: http://www.securityfocus.com/archive/1/426187/100/0/threaded, http://www.securityfocus.com/archive/1/426313/100/0/threaded, http://www.securityfocus.com/archive/1/431026/30/5580/threaded
CWE: CWE-255
CVE-2006-1930
Multiple SQL injection vulnerabilities in userscript.php in Green Minute 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) huserid, (2) pituus, or (3) date parameters. NOTE: this issue has been disputed by the vendor, saying "those parameters mentioned ARE checked (preg_match) before they are used in SQL-query...  If someone decided to add SQL-injection stuff to certain parameter, they would see an error text, but only because _nothing_ was passed inside that parameter (to MySQL-database)."  As allowed by the vendor, CVE investigated this report on 20060525 and found that the demo site demonstrated a non-sensitive SQL error when given standard SQL injection manipulations
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: green_minute
References: http://hoito.org/en/products/, http://osvdb.org/ref/25/25207-dispute.txt, http://pridels0.blogspot.com/2006/04/green-minute-sql-inj-vuln.html
CVE-2006-6993
Multiple SQL injection vulnerabilities in pages/addcomment2.php in Neuron Blog 1.1 allow remote attackers to inject arbitrary SQL commands via the (1) commentname, (2) commentmail, (3) commentwebsite, and (4) comment parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: neuron_blog
References: http://secunia.com/advisories/19703, http://www.vupen.com/english/advisories/2006/1406, http://secunia.com/advisories/19703
CVE-2006-4615
Shape Services IM+ Mobile Instant Messenger for Pocket PC 3.10 stores usernames and passwords in plaintext in %PROGRAMFILES%\IMPlus\implus.cfg, which allows local users to obtain sensitive information by reading the file.
CVSS v2.0 Score: 4.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:N/A:N
Affected Products: im\+_mobile_instant_messenger
References: http://airscanner.com/security/05081701_implus.htm, http://securityreason.com/securityalert/1518, http://www.securityfocus.com/archive/1/445082/100/0/threaded
CVE-2006-6330
index.php for TorrentFlux 2.2 allows remote registered users to execute arbitrary commands via shell metacharacters in the kill parameter.
CVSS v2.0 Score: 6.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P
Affected Products: torrentflux
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=%23400582, http://secunia.com/advisories/22880, https://www.exploit-db.com/exploits/2786
CVE-2006-0515
Cisco PIX/ASA 7.1.x before 7.1(2) and 7.0.x before 7.0(5), PIX 6.3.x before 6.3.5(112), and FWSM 2.3.x before 2.3(4) and 3.x before 3.1(7), when used with Websense/N2H2, allows remote attackers to bypass HTTP access restrictions by splitting the GET method of an HTTP request into multiple packets, which prevents the request from being sent to Websense for inspection, aka bugs CSCsc67612, CSCsc68472, and CSCsd81734.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: firewall_services_module, adaptive_security_appliance_software, pix_firewall_software, pix_firewall
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045899.html, http://secunia.com/advisories/20044, http://securitytracker.com/id?1016039
CVE-2006-0517
Multiple SQL injection vulnerabilities in formulaires/inc-formulaire_forum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id_forum, (2) id_article, or (3) id_breve parameters to forum.php3; (4) unspecified vectors related to "session handling"; and (5) when posting "petitions".
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: spip
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0990.html, http://secunia.com/advisories/18676, http://securityreason.com/securityalert/395
CVE-2006-4044
PHP remote file inclusion vulnerability in Beautifier/Core.php in Brad Fears phpCodeCabinet 0.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the BEAUT_PATH parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpcodecabinet
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0146.html, http://downloads.securityfocus.com/vulnerabilities/exploits/PHPCabinetRFIAugust052006.html, http://secunia.com/advisories/21386
CVE-2006-5989
Off-by-one error in the der_get_oid function in mod_auth_kerb 5.0 allows remote attackers to cause a denial of service (crash) via a crafted Kerberos message that triggers a heap-based buffer overflow in the component array.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: mod_auth_kerb
References: http://secunia.com/advisories/23023, http://secunia.com/advisories/23251, http://secunia.com/advisories/23681
CVE-2006-1016
Buffer overflow in the IsComponentInstalled method in Internet Explorer 6.0, when used on Windows 2000 before SP4 or Windows XP before SP1, allows remote attackers to execute arbitrary code via JavaScript that calls IsComponentInstalled with a long first argument.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: internet_explorer
References: http://metasploit.com/projects/Framework/exploits.html#ie_iscomponentinstalled, http://www.metasploit.com/projects/Framework/modules/exploits/ie_iscomponentinstalled.pm, http://www.securityfocus.com/bid/16870
CVE-2006-0129
Mail Management Agent (MAILMA) (aka Mail Management Server) in Rockliffe MailSite 7.0.3.1 and earlier generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames via user requests to TCP port 106.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mailsite
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/040970.html, http://secunia.com/advisories/18318, http://www.osvdb.org/22230
CVE-2006-2975
Multiple cross-site scripting (XSS) vulnerabilities in pblguestbook.php in PBL Guestbook 1.31 allow remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of IMG tags in the (1) name, (2) email, and (3) website parameter, which bypasses XSS protection mechanisms that check for SCRIPT tags but not IMG.  NOTE: portions of this description's details are obtained from third party information.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected Products: pbl_guestbook
References: http://secunia.com/advisories/20526, http://securityreason.com/securityalert/1088, http://www.securityfocus.com/archive/1/436408/100/0/threaded
CVE-2006-0683
Cross-site scripting (XSS) vulnerability in Virtual Hosting Control System (VHCS) 2.4.7.1 with v.1 patch and earlier allows remote attackers to inject arbitrary web script or HTML via the username, which is recorded in a log file but not properly handled when the administrator uses the admin log utility to read the log file.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: virtual_hosting_control_system
References: http://secunia.com/advisories/18799, http://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txt, http://www.securityfocus.com/archive/1/424816/100/0/threaded
CVE-2006-3049
Multiple cross-site scripting (XSS) vulnerabilities in booking3.php in Mole Group Ticket Booking Script allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) address1, (3) address2, (4) county, (5) postcode, (6) email, (7) phone, or (8) mobile parameters to booking2.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: mole_group_ticket_booking_script
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0111.html, http://secunia.com/advisories/20612, http://www.attrition.org/pipermail/vim/2006-June/000868.html
CVE-2006-3091
PhpMyFactures 1.0, and possibly 1.2 and earlier, allows remote attackers to obtain the installation path via a direct request to (1) /verif.php, (2) /inc/footer.php, and (3) /remises/ajouter_remise.php.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: phpmyfactures
References: http://secunia.com/advisories/20642, http://securityreason.com/securityalert/1111, http://www.acid-root.new.fr/advisories/phpmyfactures.txt
CVE-2006-3010
Multiple SQL injection vulnerabilities in Open Business Management (OBM) 1.0.3 pl1 allow remote attackers to execute arbitrary SQL commands via the (1) new_order and (2) order_dir parameters to (a) index.php, (b) group/group_index.php, (c) user/user_index.php, (d) list/list_index.php, and (e) company/company_index.php, and the (3) entity and (4) tf_dateafter parameter to company/company_index.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: open_business_management
References: http://pridels0.blogspot.com/2006/06/obm-multiple-sql-inj-and-xss-vuln.html, http://secunia.com/advisories/20486, http://www.osvdb.org/26203
CVE-2006-5979
Renasoft NetJetServer 2.5.3.939, and possibly earlier, uses insecure permissions for Global.asa, which allows remote attackers to obtain sensitive information.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: netjetserver
References: http://secunia.com/advisories/22859, http://www.vupen.com/english/advisories/2006/4559, https://exchange.xforce.ibmcloud.com/vulnerabilities/30338
CVE-2006-0205
Multiple SQL injection vulnerabilities in Wordcircle 2.17 allow remote attackers to (1) execute arbitrary SQL commands and bypass authentication via the password field in the login action to index.php (involving v_login.php and s_user.php) and (2) have other unknown impact via certain other fields in unspecified scripts.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: wordcircle
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://evuln.com/vulns/27/summary.html, http://evuln.com/vulns/28/summary.html, http://secunia.com/advisories/18440
CWE: CWE-89
CVE-2006-0522
SQL injection vulnerability in the Authentication Servlet in Symantec Sygate Management Server (SMS) version 4.1 build 1417 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via unknown attack vectors related to a URL.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sygate_management_server
References: http://secunia.com/advisories/18689, http://securityresponse.symantec.com/avcenter/security/Content/2006.02.01.html, http://securitytracker.com/id?1015561
CVE-2006-2825
cPanel does not automatically synchronize the PHP open_basedir configuration directive between the main server and virtual hosts that share physical directories, which might allow a local user to bypass open_basedir restrictions and access other virtual hosts via a PHP script that uses a main server URL (such as ~username) that is blocked by the user's own open_basedir directive, but not the main server's open_basedir directive.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: cpanel
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0402.html, http://osvdb.org/31835, http://securityreason.com/securityalert/1039
CVE-2006-6178
Buffer overflow in PCCSRV\Web_console\RemoteInstallCGI\Wizard.exe for Trend Micro OfficeScan 7.3 before build 7.3.0.1087 allows remote attackers to execute arbitrary code via unknown attack vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: officescan
References: http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1031702, http://solutionfile.trendmicro.com/SolutionFile/1031702/en/Hotfix_Readme_OSCE7_3_B1087.txt, http://www.securityfocus.com/bid/21442
CVE-2006-3967
PHP remote file inclusion vulnerability in component/option,com_moskool/Itemid,34/admin.moskool.php in MamboXChange Moskool 1.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: moskool
References: http://securityreason.com/securityalert/1314, http://www.securityfocus.com/archive/1/441710/100/0/threaded, http://www.securityfocus.com/bid/19245
CVE-2006-4022
Intel 2100 PRO/Wireless Network Connection driver PROSet before 7.1.4.6 allows local users to corrupt memory and execute code via "requests for capabilities from higher-level protocol drivers or user-level applications" involving crafted frames, a different issue than CVE-2006-3992.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: 2100_proset_wireless
References: http://securitytracker.com/id?1016621, http://support.intel.com/support/wireless/wlan/pro2100/sb/CS-023067.htm, http://www.kb.cert.org/vuls/id/824500
CVE-2006-6703
Multiple cross-site scripting (XSS) vulnerabilities in Oracle Portal 9i and 10g allow remote attackers to inject arbitrary JavaScript via the tc parameter in webapp/jsp/container_tabs.jsp, and other unspecified vectors.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: oracle9i, oracle10g
References: http://www.securityfocus.com/archive/1/455143/100/0/threaded, http://www.securityfocus.com/bid/21717, http://www.vupen.com/english/advisories/2006/5143
CVE-2006-3252
Buffer overflow in the Online Registration Facility for Algorithmic Research PrivateWire VPN software up to 3.7 allows remote attackers to execute arbitrary code via a long GET request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: privatewire_gateway
References: http://secunia.com/advisories/20812, http://securityreason.com/securityalert/1152, http://securitytracker.com/id?1016382
CVE-2006-6118
Cross-site scripting (XSS) vulnerability in thumbs.php in mmgallery 1.55 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: mmgallery
References: http://secunia.com/advisories/23130, http://securityreason.com/securityalert/1917, http://securitytracker.com/id?1017283
CVE-2006-3337
Cross-site scripting (XSS) vulnerability in frontend/x/files/select.html in cPanel 10.8.2-CURRENT 118 and earlier allows remote attackers to inject arbitrary web script or HTML via the file parameter.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected Products: cpanel
References: http://bugzilla.cpanel.net/show_bug.cgi?id=4282, http://secunia.com/advisories/20840, http://securitytracker.com/id?1016383
CVE-2006-4184
SmartLine DeviceLock before 5.73 Build 305 does not properly enforce access control lists (ACL) in raw mode, which allows local users to bypass NTFS controls and obtain sensitive information.
CVSS v2.0 Score: 4.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:N/A:N
Affected Products: devicelock
References: http://secunia.com/advisories/21494, http://securityreason.com/securityalert/1392, http://www.protect-me.com/dl/whatsnew.html
CVE-2006-1463
Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a H.264 (M4V) video format file with a certain modified size value.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: quicktime
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://lists.apple.com/archives/security-announce/2006/May/msg00002.html, http://secunia.com/advisories/20069, http://securityreason.com/securityalert/888
CWE: CWE-119
CVE-2006-4750
PHP remote file inclusion vulnerability in openi-admin/base/fileloader.php in OPENi-CMS 1.0.1, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the config[openi_dir] parameter.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: openi-cms
References: http://bb.domaindlx.com/bingung/shellcore/advisories.asp?bug_report=display&infamous_group=103, http://secunia.com/advisories/21874, http://www.securityfocus.com/bid/19952
CVE-2006-0353
unix_random.c in lshd for lsh 2.0.1 leaks file descriptors related to the randomness generator, which allows local users to cause a denial of service by truncating the seed file, which prevents the server from starting, or obtain sensitive seed information that could be used to crack keys.
CVSS v2.0 Score: 3.6 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:P
Affected Products: lsh
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://lists.lysator.liu.se/pipermail/lsh-bugs/2006q1/000467.html, http://secunia.com/advisories/18564, http://secunia.com/advisories/18623
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2006-0532
Cross-site scripting (XSS) vulnerability in resultat.asp in SoftMaker Shop allows remote attackers to inject arbitrary web script or HTML via a strSok parameter containing a javascript: URI in an IMG SRC attribute.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: shop
References: http://secunia.com/advisories/18683, http://securityreason.com/securityalert/400, http://www.osvdb.org/22911
CVE-2006-6947
The FTP server in the NEC MultiWriter 1700C allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command, a variant of CVE-1999-0017.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: multiwriter_1700c
References: http://jvn.jp/jp/JVN%2385996645/index.html, http://jvn.jp/jp/JVN%2385996645/index.html
CVE-2006-6221
2X ThinClientServer Enterprise Edition before 4.0.2248 allows remote attackers to create multiple privileged accounts via a replay attack using the initial account creation request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: thinclientserver
References: http://secunia.com/advisories/23248, http://securityreason.com/securityalert/2012, http://securitytracker.com/id?1017350
CVE-2006-1953
Directory traversal vulnerability in Caucho Resin 3.0.17 and 3.0.18 for Windows allows remote attackers to read arbitrary files via a "C:%5C" (encoded drive letter) in a URL.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
Affected Products: resin
References: http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0026.html, http://secunia.com/advisories/20125, http://securityreason.com/securityalert/904
CVE-2006-4677
PHP remote file inclusion vulnerability in contrib/yabbse/poc.php in phpopenchat before 3.0.2 allows remote attackers to execute arbitrary PHP code via the sourcedir parameter.  NOTE: this issue was disputed by a third-party researcher who stated that the _REQUEST parameters were dynamically unset at the beginning of the file.  Another researcher noted, and CVE agrees, that the unset PHP function can be bypassed (CVE-2006-3017).  If this issue is due to a vulnerability in PHP, then it should be excluded from CVE
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpopenchat
References: http://phpopenchat.org/index.php, http://www.securityfocus.com/archive/1/445384/100/0/threaded, http://www.securityfocus.com/archive/1/445522/100/0/threaded
CVE-2006-5841
Multiple PHP remote file inclusion vulnerabilities in dodosmail.php in DodosMail 2.0.1 and earlier, and possibly 2.1, allow remote attackers to execute arbitrary PHP code via a URL in the (1) dodosmail_header_file or (2) dodosmail_footer_file parameters.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: dodosmail
References: http://secunia.com/advisories/22775, http://www.osvdb.org/30248, http://www.securityfocus.com/archive/1/452130/100/0/threaded
CVE-2006-4863
Multiple PHP remote file inclusion vulnerabilities in Marc Cagninacci mcLinksCounter 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the langfile parameter in (1) login.php, (2) stats.php, (3) detail.php, or (4) erase.php.  NOTE: CVE and a third party dispute this vulnerability, because the langfile parameter is set to english.php in each file.  NOTE: CVE also disputes a later report of this vulnerability in 1.2, because the langfile parameter is set to french.php in 1.2
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mclinkscounter
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://marc.info/?l=bugtraq&m=115860241806867&w=2, http://securityvulns.com/Rdocument844.html, http://securityvulns.com/source26994.html
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2006-1134
SQL injection vulnerability in CyBoards PHP Lite 1.25, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the parent parameter to (1) post.php and possibly (2) process_post.php.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: cyboards_php_lite
References: http://evuln.com/vulns/91/description.html, http://secunia.com/advisories/19135, http://securityreason.com/securityalert/582
CVE-2006-6995
mycontacts.php in V3 Chat allows remote authenticated users to gain privileges as other users via a modified membername parameter.
CVSS v2.0 Score: 6.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P
Affected Products: v3chat_instant_messenger
References: http://www.securityfocus.com/archive/1/437755/100/200/threaded, http://www.securityfocus.com/bid/18543, http://www.vupen.com/english/advisories/2006/2474
CVE-2006-5292
PHP remote file inclusion vulnerability in photo_comment.php in Exhibit Engine 1.5 RC 4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the toroot parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: exhibit_engine
References: http://www.securityfocus.com/bid/20447, https://exchange.xforce.ibmcloud.com/vulnerabilities/29424, https://www.exploit-db.com/exploits/2509
CVE-2006-2739
PHP remote file inclusion vulnerability in footers.php in Epicdesigns tinyBB 0.3, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the tinybb_footers parameter.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: tinybb
References: http://secunia.com/advisories/20356, http://securityreason.com/securityalert/1011, http://securitytracker.com/id?1016172
CVE-2006-4594
Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpAtm) 1.21 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the include_location parameter in (1) confirm.php or (2) login.php.  NOTE: the include_location parameter to index.php is already covered by CVE-2005-1681.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php_advanced_transfer_manager
References: http://www.securityfocus.com/bid/19765, https://exchange.xforce.ibmcloud.com/vulnerabilities/28670, https://www.exploit-db.com/exploits/2279
CVE-2006-2175
PHP remote file inclusion vulnerability in FtrainSoft Fast Click 2.3.8 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) show.php or (2) top.php.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: fast_click
References: http://secunia.com/advisories/19923, http://securitytracker.com/id?1016021, http://www.aria-security.net/advisory/fc/fastclick.txt
CVE-2006-3759
Unspecified vulnerability in MyBB (aka MyBulletinBoard) 1.1.4, related has unspecified impact and attack vectors related to "user group manipulation."
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: mybulletinboard
References: http://community.mybboard.net/showthread.php?tid=10115, http://secunia.com/advisories/20873, http://www.mybboard.com/archive.php?nid=15
CVE-2006-2946
Dmx Forum 2.1a stores _includes/bd.inc under the web root with insufficient access control, which allows remote attackers to obtain database username and password information.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: dmx_forum
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0799.html, http://secunia.com/advisories/20450, http://www.vupen.com/english/advisories/2006/2154
CVE-2006-0674
Buffer overflow in the arp command of IBM AIX 5.3 L, 5.3, 5.2.2, 5.2 L, and 5.2 allows local users to cause a denial of service (crash) via a long iftype argument.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: aix
References: http://secunia.com/advisories/18773, http://www-1.ibm.com/support/docview.wss?rs=0&q1=IY81424&uid=isg1IY81424&loc=en_US&cs=utf-8&cc=us&lang=en, http://www-1.ibm.com/support/docview.wss?uid=isg1IY81476
CVE-2006-6332
Stack-based buffer overflow in net80211/ieee80211_wireless.c in MadWifi before 0.9.2.1 allows remote attackers to execute arbitrary code via unspecified vectors, related to the encode_ie and giwscan_cb functions.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: madwifi
References: http://lists.immunitysec.com/pipermail/dailydave/2006-December/003888.html, http://madwifi.org/changeset/1842, http://madwifi.org/wiki/news/20061207/release-0-9-2-1-fixes-critical-security-issue
CVE-2006-2905
Partial Links 1.2.2 allows remote attackers to obtain sensitive information via a direct request to (1) page_footer.php and (2) page_header.php, which displays the path in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: particle_links
References: http://secunia.com/advisories/20491, http://www.securityfocus.com/archive/1/436112/100/0/threaded, http://www.vupen.com/english/advisories/2006/2169
CVE-2006-3034
MyScrapbook 3.1 allows remote attackers to obtain sensitive information via a direct request to files in the txt-db-api directory such as txt-db-api/sql.php, which reveals the path in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: myscrapbook
References: http://secunia.com/advisories/20599, http://www.osvdb.org/26414, http://www.securityfocus.com/archive/1/436792/100/0/threaded
CVE-2006-6154
PHP remote file inclusion vulnerability in addcode.php in HIOX Star Rating System Script (HSRS) 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the hm parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: hiox_star_rating_system_script
References: http://secunia.com/advisories/23078, http://www.securityfocus.com/archive/1/494928/100/0/threaded, http://www.securityfocus.com/bid/21280
CVE-2006-4507
Unspecified vulnerability in the TIFF viewer (possibly libTIFF) in the Photo Viewer in the Sony PlaystationPortable (PSP) 2.00 through 2.80 allows local users to execute arbitrary code via crafted TIFF images. NOTE: due to lack of details, it is not clear whether this is related to other issues such as CVE-2006-3464 or CVE-2006-3465.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: playstation_portable
References: http://noobz.eu/content/home.html#280806, http://secunia.com/advisories/21672, http://www.vupen.com/english/advisories/2006/3419
CVE-2006-1119
fantastico in Cpanel does not properly handle when it has insufficient permissions to perform certain file operations, which allows remote authenticated users to obtain the full pathname, which is leaked in a PHP error message.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N
Affected Products: fantastico_de_luxe, cpanel
Related CWEs: CWE-264
References: http://www.securityfocus.com/archive/1/426957/100/0/threaded, https://exchange.xforce.ibmcloud.com/vulnerabilities/25277, http://www.securityfocus.com/archive/1/426957/100/0/threaded
CWE: CWE-264
CVE-2006-3983
PHP remote file inclusion vulnerability in editprofile.php in php(Reactor) 1.27pl1 allows remote attackers to execute arbitrary PHP code via a URL in the pathtohomedir parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php\(reactor\)
References: http://www.securityfocus.com/bid/19259, http://www.vupen.com/english/advisories/2006/3087, https://exchange.xforce.ibmcloud.com/vulnerabilities/28100
CVE-2006-4005
BomberClone 0.11.6 and earlier allows remote attackers to cause a denial of service (daemon crash) via (1) a certain malformed PKGF_ackreq packet, which triggers a crash in the rscache_add() function in pkgcache.c; and (2) an error packet, which is intended to be received by clients and force client shutdown, but also triggers server shutdown.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: bomberclone
References: http://aluigi.altervista.org/adv/bcloneboom-adv.txt, http://aluigi.org/poc/bcloneboom.zip, http://secunia.com/advisories/21303
CVE-2006-3550
Multiple cross-site scripting (XSS) vulnerabilities in F5 Networks FirePass 4100 5.x allow remote attackers to inject arbitrary web script or HTML via unspecified "writable form fields and hidden fields," including "authentication frontends."
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected Products: firepass_4100
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047635.html, http://securityreason.com/securityalert/1237, http://securitytracker.com/id?1016431
CVE-2006-3467
Integer overflow in FreeType before 2.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PCF file, as demonstrated by the Red Hat bad1.pcf test file, due to a partial fix of CVE-2006-1861.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: freetype
Related CWEs: CWE-189
References: ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U, http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=190593, http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
CWE: CWE-189
CVE-2006-3135
Multiple SQL injection vulnerabilities in CMS Mundo 1.0 build 008, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) news_id parameter in the (a) news module, (2) searchstring parameter in (b) the search module, (3) id parameter in (c) the webshop module, (4) username parameter in (d) index.php, and (5) Name, (6) Address, (7) Zip, (8) City, (9) Country, and (10) Email fields during (e) a user profile update.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cms_mundo
References: http://secunia.com/advisories/20589, http://secunia.com/secunia_research/2006-52/advisory/, http://securityreason.com/securityalert/1236
CVE-2006-2024
Multiple vulnerabilities in libtiff before 3.8.1 allow context-dependent attackers to cause a denial of service via a TIFF image that triggers errors in (1) the TIFFFetchAnyArray function in (a) tif_dirread.c; (2) certain "codec cleanup methods" in (b) tif_lzw.c, (c) tif_pixarlog.c, and (d) tif_zip.c; (3) and improper restoration of setfield and getfield methods in cleanup functions within (e) tif_jpeg.c, tif_pixarlog.c, (f) tif_fax3.c, and tif_zip.c.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P
Affected Products: libtiff
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc, http://bugzilla.remotesensing.org/show_bug.cgi?id=1102, http://secunia.com/advisories/19838
CVE-2006-4489
Multiple PHP remote file inclusion vulnerabilities in MiniBill 2006-07-14 (1.2.2) allow remote attackers to execute arbitrary PHP code via (1) a URL in the config[include_dir] parameter in actions/ipn.php or (2) an FTP path in the config[plugin_dir] parameter in include/initPlugins.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: minibill
References: http://secunia.com/advisories/21688, http://securitytracker.com/id?1016769, http://www.attrition.org/pipermail/vim/2006-November/001115.html
CVE-2006-4201
Unspecified vulnerability in the backup agent and Cell Manager in HP OpenView Storage Data Protector 5.1 and 5.5 before 20060810 allows remote attackers to execute arbitrary code on an agent via unspecified vectors related to authentication and input validation.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: openview_storage_data_protector
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00742778, http://jvn.jp/niscc/NISCC-412866/, http://secunia.com/advisories/21485
CVE-2006-5121
SQL injection vulnerability in modules/Downloads/admin.php in the Admin section of PostNuke 0.762 allows remote attackers to execute arbitrary SQL commands via the hits parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: postnuke
References: http://community.postnuke.com/index.php?name=News&file=article&sid=2783, http://secunia.com/advisories/22197, http://securityreason.com/securityalert/1669
CVE-2006-6425
Stack-based buffer overflow in the IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via unspecified vectors involving the APPEND command.
CVSS v2.0 Score: 9.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Affected Products: netmail
References: http://secunia.com/advisories/23437, http://securityreason.com/securityalert/2080, http://securitytracker.com/id?1017437
CVE-2006-1672
The installation of Cisco Transport Controller (CTC) for Cisco Optical Networking System (ONS) 15000 series nodes adds a Java policy file entry with a wildcard that grants the java.security.AllPermission permission to any http URL containing "fs/LAUNCHER.jar", which allows remote attackers to execute arbitrary code on a CTC workstation, aka bug ID CSCea25049.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ons_15600, ons_15310-cl_series, transport_controller, ons_15454_mspp, optical_networking_systems_software
References: http://secunia.com/advisories/19553, http://securitytracker.com/id?1015871, http://www.cisco.com/warp/public/707/cisco-sa-20060405-ons.shtml
CVE-2006-4927
The (a) NAVENG (NAVENG.SYS) and (b) NAVEX15 (NAVEX15.SYS) device drivers 20061.3.0.12 and later, as used in Symantec AntiVirus and security products, allow local users to gain privileges by overwriting critical system addresses using a crafted Irp to the IOCTL functions (1) 0x222AD3, (2) 0x222AD7, and (3) 0x222ADB.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: navex15_driver, naveng_driver
References: http://secunia.com/advisories/22288, http://securityreason.com/securityalert/1690, http://securitytracker.com/id?1016994
CVE-2006-1427
Multiple cross-site scripting (XSS) vulnerabilities in WebAPP 0.9.9.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) action, (2) id, (3) num, (4) board, (5) cat, (6) real, (7) viewcat, (8) img, or (9) curcatname parameter in cgi-bin/index.cgi, or (10) vsSD parameter in /mods/calendar/index.cgi.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: webapp
References: http://pridels0.blogspot.com/2006/03/webapp-multiple-xss-vuln.html, http://secunia.com/advisories/19506, http://www.osvdb.org/24278
CVE-2006-2303
Cross-Application Scripting (XAS) vulnerability in ICQ Client 5.04 build 2321 and earlier allows remote attackers to inject arbitrary web script from one application into another via a banner, which is processed in the My Computer zone using the Internet Explorer COM object.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: icq
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045916.html, http://secunia.com/advisories/20010, http://securityreason.com/securityalert/868
CVE-2006-0006
Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4, Media Player 9 on Windows 2000 SP4 and XP SP1, and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap (.BMP) file that specifies a size of 0 but contains additional data.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: windows_media_player, windows_2000, windows_98se, windows_98, windows_2003_server
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://secunia.com/advisories/18835, http://securityreason.com/securityalert/423, http://securitytracker.com/id?1015627
CWE: CWE-119
CVE-2006-4545
PHP remote file inclusion vulnerability in ModuleBased CMS Pre-Alpha allows remote attackers to execute arbitrary PHP code via the _SERVER parameter in (1) admin/avatar.php, (2) libs/archive.class.php, (3) libs/login.php, (4) libs/profiles.class.php, and (5) libs/profile/proccess.php.  NOTE: CVE disputes this claim, as the _SERVER array and the _SERVER[DOCUMENT_ROOT] index are controlled by PHP and cannot be manipulated by an attacker
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: modulebased_cms
References: http://www.attrition.org/pipermail/vim/2006-September/001012.html, http://www.osvdb.org/29872, http://www.securityfocus.com/archive/1/444897/100/0/threaded
CVE-2006-1055
The fill_write_buffer function in sysfs/file.c in Linux kernel 2.6.12 up to versions before 2.6.17-rc1 does not zero terminate a buffer when a length of PAGE_SIZE or more is requested, which might allow local users to cause a denial of service (crash) by causing an out-of-bounds read.
CVSS v2.0 Score: 4.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C
Affected Products: linux_kernel
References: http://lwn.net/Alerts/180820/, http://secunia.com/advisories/19495, http://secunia.com/advisories/19735
CVE-2006-4908
OSU 3.11alpha and 3.10a allows remote attackers to obtain sensitive information via a URL containing an * (asterisk) wildcard, which displays all matching file and directory information.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: osu_httpd
References: http://secunia.com/advisories/22016, http://securityreason.com/securityalert/1622, http://www.securityfocus.com/archive/1/446372/100/0/threaded
CVE-2006-2633
Absolute path traversal vulnerability in the copy action in index.php in Andrew Godwin ByteHoard 2.1 and earlier allows remote authenticated users to create or overwrite files in other users' directories by specifying the absolute path of the directory in the infolder parameter and simultaneously specifying the filename in the filepath parameter.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: bytehoard
References: http://secunia.com/advisories/20304, http://securityreason.com/securityalert/968, http://sourceforge.net/forum/forum.php?forum_id=576219
CVE-2006-1775
Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.19 allow remote attackers to inject arbitrary web script or HTML via the (1) Site Description field in (a) admin_board.php, the (2) Group name and (3) Group description fields in (b) admin_groups.php and (c) groupcp.php, the (4) Theme Name field in (d) admin_styles.php, and the (5) Rank Title field in (e) admin_ranks.php.  NOTE: the profile.php/Current password vector is already covered by CVE-2006-1603.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: phpbb
References: http://osvdb.org/ref/24/24353-phpbb.txt, http://www.osvdb.org/24354, http://www.osvdb.org/24355
CVE-2006-3572
SQL injection vulnerability in forumthread.php in Papoo 3 RC3 and earlier allows remote attackers to execute arbitrary SQL commands via the msgid parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: papoo
References: http://secunia.com/advisories/20978, http://securityreason.com/securityalert/1217, http://securitytracker.com/id?1016461
CVE-2006-6631
PHP remote file inclusion vulnerability in lib/xml/oai/GetRecord.php in osprey 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the lib_dir parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: osprey
References: http://www.securityfocus.com/bid/20552, https://exchange.xforce.ibmcloud.com/vulnerabilities/29586, https://www.exploit-db.com/exploits/2572
CVE-2006-6563
Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value.
CVSS v2.0 Score: 6.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C
Affected Products: proftpd
References: http://secunia.com/advisories/23371, http://secunia.com/advisories/23392, http://secunia.com/advisories/23473
CVE-2006-0584
The PSCipher function in PeopleSoft People Tools 8.4x uses PKCS #5 with a fixed DES key to store user passwords, which makes it easier for local users to guess passwords using a dictionary attack that compares output strings.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: peopletools
References: http://www.osvdb.org/22952, http://www.securityfocus.com/archive/1/424086/100/0/threaded, http://www.securityfocus.com/bid/16507
CVE-2006-2072
Multiple unspecified vulnerabilities in DeleGate 9.x before 9.0.6 and 8.x before 8.11.6 allow remote attackers to cause a denial of service via crafted DNS responses messages that cause (1) a buffer over-read or (2) infinite recursion, which can trigger a segmentation fault or invalid memory access, as demonstrated by the OUSPG PROTOS DNS test suite.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: delegate
References: http://secunia.com/advisories/19750, http://securitytracker.com/id?1015991, http://www.kb.cert.org/vuls/id/955777