DuyTa/cve-kgrag-db huggingface dataset:
CVE-2006-0814
response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: lighttpd
References: http://secunia.com/advisories/18886, http://secunia.com/secunia_research/2006-9/advisory/, http://securityreason.com/securityalert/523
CVE-2006-5083
PHP remote file inclusion vulnerability in includes/functions_portal.php in Integrated MODs (IM) Portal 1.2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: importal
References: http://secunia.com/advisories/22113, http://www.securityfocus.com/bid/84255, http://www.vupen.com/english/advisories/2006/3774
CVE-2006-6475
FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode with SSL enabled, allows remote attackers to cause a denial of service (refused connections) via malformed requests, which results in a mishandled exception.
CVSS v2.0 Score: 7.1 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C
Affected Products: first_response
References: http://secunia.com/advisories/23393, http://securityreason.com/securityalert/2052, http://securitytracker.com/id?1017394
CVE-2006-7094
ftpd, as used by Gentoo and Debian Linux, sets the gid to the effective uid instead of the effective group id before executing /bin/ls, which allows remote authenticated users to list arbitrary directories with the privileges of gid 0 and possibly enable additional attack vectors.
CVSS v2.0 Score: 8.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C
Affected Products: debian_linux, ftpd, linux
References: http://bugs.debian.org/384454, http://bugs.gentoo.org/show_bug.cgi?id=155317, http://osvdb.org/34242
CVE-2006-2216
Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to obtain the full path of the web server via an invalid pforums parameter to (1) misc.php and (2) member.php.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: open_bulletin_board
References: http://securityreason.com/securityalert/845, http://www.securityfocus.com/archive/1/432592/100/0/threaded, https://exchange.xforce.ibmcloud.com/vulnerabilities/26193
CVE-2006-6439
Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows remote attackers to download the audit log and obtain potentially sensitive information via unspecified vectors.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
Affected Products: workcentre_232, workcentre_238, workcentre_275, workcentre_265, workcentre_255
References: http://secunia.com/advisories/23265, http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf, http://secunia.com/advisories/23265
CVE-2006-2995
Multiple PHP remote file inclusion vulnerabilities in WebprojectDB 0.1.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the INCDIR parameter in (1) include/nav.php and (2) include/lang.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: webprojectdb
References: http://secunia.com/advisories/20568, http://www.osvdb.org/26339, http://www.osvdb.org/26340
CVE-2006-4448
Multiple PHP remote file inclusion vulnerabilities in interact 2.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) CONFIG[BASE_PATH] parameter in (a) admin/autoprompter.php and (b) includes/common.inc.php, and the (2) CONFIG[LANGUAGE_CPATH] parameter in (c) admin/autoprompter.php.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: interact
References: http://securityreason.com/securityalert/1471, http://www.securityfocus.com/archive/1/444526/100/0/threaded, http://www.securityfocus.com/bid/19739
CVE-2006-3493
Buffer overflow in LsCreateLine function (mso_203) in mso.dll and mso9.dll, as used by Microsoft Word and possibly other products in Microsoft Office 2003, 2002, and 2000, allows remote user-assisted attackers to cause a denial of service (crash) via a crafted Word DOC or other Office file type.  NOTE: this issue was originally reported to allow code execution, but on 20060710 Microsoft stated that code execution is not possible, and the original researcher agrees.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: office
References: http://blogs.technet.com/msrc/archive/2006/07/10/441006.aspx, http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047732.html, http://marc.info/?l=full-disclosure&m=115231380526820&w=2
CVE-2006-2012
Format string vulnerability in Skulltag 0.96f and earlier allows remote attackers to cause a denial of service via the version string.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: skulltag
References: http://aluigi.altervista.org/adv/skulltagfs-adv.txt, http://secunia.com/advisories/19767, http://www.securityfocus.com/archive/1/431872/100/0/threaded
CVE-2006-5839
PHP remote file inclusion vulnerability in ad_main.php in PHPAdventure 1.1-Alpha and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _mygamefile parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpadventure
References: http://www.vupen.com/english/advisories/2006/4413, https://exchange.xforce.ibmcloud.com/vulnerabilities/30091, https://www.exploit-db.com/exploits/2736
CVE-2006-1418
Cross-site scripting (XSS) vulnerability in default.asp in Caloris Planitia E-School Management System 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected Products: e-school_management_system
References: http://pridels0.blogspot.com/2006/03/e-school-management-system-xss-vuln.html, http://secunia.com/advisories/19381, http://www.osvdb.org/24128
CVE-2006-4676
TIBCO RendezVous 7.4.11 and earlier logs base64-encoded usernames and passwords in rvrd.db, which allows local users to obtain sensitive information by decoding the log file.
CVSS v2.0 Score: 1.2 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:P/I:N/A:N
Affected Products: rendezvous
References: http://secunia.com/advisories/21748, http://www.securityfocus.com/bid/19883, http://www.vupen.com/english/advisories/2006/3497
CVE-2006-6938
Directory traversal vulnerability in includes/common.php in NitroTech 0.0.3a, as distributed before 2006, allows remote attackers to include arbitrary files via ".." sequences in the root parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: nitrotech
References: http://www.securityfocus.com/bid/20810, https://exchange.xforce.ibmcloud.com/vulnerabilities/29904, https://www.exploit-db.com/exploits/2685
CVE-2006-2630
Stack-based buffer overflow in Symantec Antivirus 10.1 and Client Security 3.1 allows remote attackers to execute arbitrary code via unknown attack vectors.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: norton_antivirus, client_security
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046355.html, http://secunia.com/advisories/20318, http://securityresponse.symantec.com/avcenter/security/Content/2006.05.25.html
CVE-2006-1411
Cross-site scripting (XSS) vulnerability in Absolute Image Gallery XE 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) the shownew parameter in gallery.asp and (2) unspecified search module parameters.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: absolute_image_gallery_xe
References: http://pridels0.blogspot.com/2006/03/absolute-image-gallery-xe-20-xss-vuln.html, http://www.osvdb.org/24214, http://www.securityfocus.com/bid/18712
CVE-2006-7240
gnome-power-manager 2.14.0 does not properly implement the lock_on_suspend and lock_on_hibernate settings for locking the screen when the suspend or hibernate button is pressed, which might make it easier for physically proximate attackers to access an unattended laptop via a resume action, a related issue to CVE-2010-2532.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: power_manager
Related CWEs: CWE-264
References: https://bugs.launchpad.net/ubuntu/+source/gnome-power-manager/+bug/42052, https://bugs.launchpad.net/ubuntu/+source/gnome-power-manager/+bug/42052
CWE: CWE-264
CVE-2006-5520
PHP remote file inclusion vulnerability in functions.php in DeltaScripts PHP Classifieds 7.1 allows remote attackers to execute arbitrary PHP code via a URL in the set_path parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php_classifieds
References: http://securityreason.com/securityalert/1778, http://www.securityfocus.com/archive/1/449295/100/0/threaded, http://www.securityfocus.com/bid/20649
CVE-2006-6902
Unspecified vulnerability in the Bluetooth stack in Microsoft Windows Mobile Pocket PC edition allows remote attackers to gain administrative access (aka Remote Root) via unspecified vectors.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_2003_server
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf, http://osvdb.org/36143, http://www.securityfocus.com/archive/1/455889/100/0/threaded
CVE-2006-0653
Multiple SQL injection vulnerabilities in Hinton Design phpht Topsites 1.3 allow remote attackers to execute arbitrary SQL commands via multiple vectors including the username parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpht_topsites
References: http://evuln.com/vulns/59/summary.html, http://secunia.com/advisories/18782, http://www.securityfocus.com/archive/1/424741/100/0/threaded
CVE-2006-4645
PHP remote file inclusion vulnerability in akarru.gui/main_content.php in Akarru Social BookMarking Engine 0.4.3.34 and earlier, and possibly 0.4.4.120, allows remote attackers to execute arbitrary PHP code via a URL in the bm_content parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: social_bookmarking_engine
References: http://secunia.com/advisories/21784, http://securityreason.com/securityalert/1543, http://www.securityfocus.com/archive/1/445605/100/0/threaded
CVE-2006-5735
Directory traversal vulnerability in include/common.php in PunBB before 1.2.14 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the language parameter, related to register.php storing a language value in the users table.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: punbb
References: http://secunia.com/advisories/22622, http://securityreason.com/securityalert/1824, http://securitytracker.com/id?1017131
CVE-2006-4386
Integer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted H.264 movie, a different issue than CVE-2006-4381.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: quicktime
References: http://docs.info.apple.com/article.html?artnum=304357, http://lists.apple.com/archives/Security-announce/2006/Sep/msg00000.html, http://piotrbania.com/all/adv/quicktime-integer-overflow-h264-adv-7.1.txt
CVE-2006-1264
Cross-site scripting (XSS) vulnerability in xhawk.net discussion 2.0 beta2 allows remote attackers to inject arbitrary web script or HTML via a Javascript URI in a BBCode img tag.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: discussion
References: http://evuln.com/vulns/92/summary.html, http://www.osvdb.org/23970, http://www.securityfocus.com/archive/1/427729/100/0/threaded
CVE-2006-4178
Integer signedness error in the i386_set_ldt call in FreeBSD 5.5, and possibly earlier versions down to 5.2, allows local users to cause a denial of service (crash) via unspecified arguments that use negative signed integers to cause the bzero function to be called with a large length parameter, a different vulnerability than CVE-2006-4172.
CVSS v2.0 Score: 4.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C
Affected Products: freebsd
References: http://secunia.com/advisories/22064, http://securitytracker.com/id?1016927, http://www.idefense.com/intelligence/vulnerabilities/display.php?id=415
CVE-2006-5980
adm_lgn_admin.asp in Renasoft NetJetServer 2.5.3.939, and possibly earlier, does not properly perform login authentication, which allows remote attackers to obtain administrative privileges.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: netjetserver
References: http://secunia.com/advisories/22859, http://www.vupen.com/english/advisories/2006/4559, https://exchange.xforce.ibmcloud.com/vulnerabilities/30337
CVE-2006-5404
Unspecified vulnerability in an ActiveX control used in Symantec Automated Support Assistant, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, allows user-assisted remote attackers to obtain sensitive information via unspecified vectors.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N
Affected Products: norton_antivirus, norton_internet_security, norton_system_works, automated_support_assistant
References: http://secunia.com/advisories/22228, http://securityresponse.symantec.com/avcenter/security/Content/2006.10.05.html, http://securitytracker.com/id?1016988
CVE-2006-5852
Untrusted search path vulnerability in openexec in OpenBase SQL before 10.0.1 allows local users to gain privileges via a modified PATH that references a malicious helper binary, as demonstrated by (1) cp, (2) rm, and (3) killall, different vectors than CVE-2006-5327.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: openbase
References: http://marc.info/?l=full-disclosure&m=116296717330758&w=2, http://secunia.com/advisories/22742, http://www.digitalmunition.com/DMA%5B2006-1107a%5D.txt
CVE-2006-5651
list.php in DigiOz Guestbook before 1.7.1 allows remote attackers to obtain sensitive information via a non-numeric page parameter, which displays the installation path in the resulting error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: digioz_guestbook
References: http://marc.info/?l=full-disclosure&m=116288079420333&w=2, http://securityreason.com/securityalert/1829, http://www.netvigilance.com/advisory0006
CVE-2006-4066
The Graphical Device Interface Plus library (gdiplus.dll) in Microsoft Windows XP SP2 allows context-dependent attackers to cause a denial of service (application crash) via certain images that trigger a divide-by-zero error, as demonstrated by a (1) .ico file, (2) .png file that crashes MSN Messenger, and (3) .jpg file that crashes Internet Explorer.  NOTE: another researcher has not been able to reproduce this issue.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P
Affected Products: windows_xp
References: http://www.securityfocus.com/archive/1/441548/100/100/threaded, http://www.securityfocus.com/archive/1/441723/100/100/threaded, http://www.securityfocus.com/archive/1/441875/100/0/threaded
CVE-2006-2718
JIWA Financials 6.4.14 passes a Microsoft SQL Server account's username and password, and the name of a data source, to a Crystal Reports .rpt file, which allows remote authenticated users to execute certain standard stored procedures by referencing them in a user-written .rpt file, as demonstrated by using a stored procedure that provides the username and cleartext password of every account.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: financials
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046398.html, http://secunia.com/advisories/20342, http://securityreason.com/securityalert/1000
CVE-2006-5601
Stack-based buffer overflow in the eap_do_notify function in eap.c in xsupplicant before 1.2.6, and possibly other versions, allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVSS v2.0 Score: 9.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Affected Products: xsupplicant
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://open1x.cvs.sourceforge.net/open1x/xsupplicant/src/eap.c?r1=1.135&r2=1.136, http://secunia.com/advisories/22612, http://secunia.com/advisories/22641
CWE: CWE-119
CVE-2006-3821
Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) lang parameter in (a) index_list.php and (2) year, (3) month, and (4) day parameter in (b) registration.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: atutor
References: http://secunia.com/advisories/21008, http://www.osvdb.org/28186, http://www.osvdb.org/displayvuln.php?osvdb_id=28187
CVE-2006-1841
Cross-site scripting (XSS) vulnerability in search.php in boastMachine (bMachine) 2.7, and possibly other versions before 2.9b, allows remote attackers to inject arbitrary web script or HTML via the key parameter, as used by the search field.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected Products: boastmachine
References: http://secunia.com/advisories/19711, http://www.securityfocus.com/archive/1/431120/100/0/threaded, http://www.securityfocus.com/bid/17550
CVE-2006-1933
Multiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (large or infinite loops) viarafted packets to the (1) UMA and (2) BER dissectors.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ethereal
References: ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc, http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html, http://secunia.com/advisories/19769
CVE-2006-0252
SQL injection vulnerability in Benders Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via multiple parameters, as demonstrated by the (1) year, (2) month, and (3) day parameters.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: benders_calendar
References: http://evuln.com/vulns/30/summary.html, http://secunia.com/advisories/18462, http://securitytracker.com/id?1015491
CVE-2006-3278
Cross-site scripting (XSS) vulnerability in H-Sphere 2.5.1 Beta 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) next_template, (2) start, (3) curr_menu_id, and (4) arid parameters in psoft/servlet/resadmin/psoft.hsphere.CP when using the mailman/massmail.html template_name.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected Products: h-sphere
References: http://pridels0.blogspot.com/2006/06/h-sphere-25x-xss-vuln.html, http://secunia.com/advisories/20798, http://www.osvdb.org/26863
CVE-2006-4622
PHP remote file inclusion vulnerability in annonce.php in AnnonceV (aka annoncesV) 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: annoncev
References: http://kurdishsecurity.blogspot.com/2006/09/kurdish-security-26-annoncev-news.html, http://secunia.com/advisories/21772, http://securityreason.com/securityalert/1515
CVE-2006-6627
Integer overflow in the packed PE file parsing implementation in BitDefender products before 20060829, including Antivirus, Antivirus Plus, Internet Security, Mail Protection for Enterprises, and Online Scanner; and BitDefender products for Microsoft ISA Server and Exchange 5.5 through 2003; allows remote attackers to execute arbitrary code via a crafted file, which triggers a heap-based buffer overflow, aka the "cevakrnl.xmd vulnerability."
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: bitdefender_mail_protection, bitdefender_internet_security, bitdefender_online_scanner, bitdefender_antivirus, bitdefender
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051319.html, http://secunia.com/advisories/23415, http://securityreason.com/securityalert/2044
CVE-2006-0133
Multiple directory traversal vulnerabilities in AIX 5.3 ML03 allow local users to determine the existence of files and read partial contents of certain files via a .. (dot dot) in the argument to (1) getCommand.new (aka getCommand) and (2) getShell, a different vulnerability than CVE-2005-4273.
CVSS v2.0 Score: 3.6 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N
Affected Products: aix
References: http://securitytracker.com/id?1015429, http://www.securityfocus.com/archive/1/420589/100/0/threaded, http://www.securityfocus.com/bid/16102
CVE-2006-4291
PHP remote file inclusion vulnerability in handlers/email/mod.listmail.php in PHlyMail Lite 3.4.4 and earlier (Build 3.04.04) allows remote attackers to execute arbitrary PHP code via a URL in the _PM_[path][handler] parameter.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: phlymail_lite
References: http://secunia.com/advisories/21582, http://securitytracker.com/id?1016718, http://www.securityfocus.com/bid/19587
CVE-2006-1290
Multiple cross-site scripting (XSS) vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) ipAddress, (2) act, (3) username, and (4) unspecified other parameters in (a) authuser.php; and the (5) username and (6) unspecified other parameters in (b) userstatistics.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: milkeyway_captive_portal
References: http://secunia.com/advisories/19258, http://securitytracker.com/id?1015778, http://www.osvdb.org/23932
CVE-2006-3878
Opsware Network Automation System (NAS) 6.0 installs /etc/init.d/mysql with insecure permissions, which allows local users to read the root password for the MySQL MAX database or gain privileges by modifying /etc/init.d/mysql.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: network_automation_system
References: http://secunia.com/advisories/21192, http://securityreason.com/securityalert/1289, http://securitytracker.com/id?1016566
CVE-2006-0324
SQL injection vulnerability in WebspotBlogging 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter to login.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: webspotblogging
References: http://evuln.com/vulns/41/summary.html, http://secunia.com/advisories/18560, http://securityreason.com/securityalert/356
CVE-2006-1705
Oracle Database 9.2.0.0 to 10.2.0.3 allows local users with "SELECT" privileges for a base table to insert, update, or delete data by creating a crafted view then performing the operations on that view.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: oracle9i, oracle10g
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/044990.html, http://secunia.com/advisories/19574, http://securitytracker.com/id?1015886
CVE-2006-5173
Linux kernel does not properly save or restore EFLAGS during a context switch, or reset the flags when creating new threads, which allows local users to cause a denial of service (process crash), as demonstrated using a process that sets the Alignment Check flag (EFLAGS 0x40000), which triggers a SIGBUS in other processes that have an unaligned access.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: linux_kernel, ubuntu_linux
References: http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=47a5c6fa0e204a2b63309c648bb2fde36836c826, http://secunia.com/advisories/23361, http://secunia.com/advisories/23384
CVE-2006-3548
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a (1) javascript URI or an external (2) http, (3) https, or (4) ftp URI in the url parameter in services/go.php (aka the dereferrer), (5) a javascript URI in the module parameter in services/help (aka the help viewer), and (6) the name parameter in services/problem.php (aka the problem reporting screen).
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: horde
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047687.html, http://lists.horde.org/archives/announce/2006/000287.html, http://lists.horde.org/archives/announce/2006/000288.html
CVE-2006-1562
Multiple cross-site scripting (XSS) vulnerabilities in index.php in vscripts (aka Kuba Kunkiewicz) [V]Book (aka VBook) 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) autor, (2) www, (3) temat, and (4) tresc parameters.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: vbook
References: http://evuln.com/vulns/111, http://secunia.com/advisories/19448, http://www.osvdb.org/24271
CVE-2006-6392
Directory traversal vulnerability in index.php in plx Web Studio (aka plxWebDev) plx Pay 3.2 and earlier allows remote attackers to include and execute arbitrary local files, or obtain user credentials and other sensitive information, via a .. (dot dot) in the read parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: plx_pay
References: http://secunia.com/advisories/23190, http://www.securityfocus.com/bid/21379, http://www.vupen.com/english/advisories/2006/4809
CVE-2006-5065
PHP remote file inclusion vulnerability in libs/dbmax/mysql.php in ZoomStats 1.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[lib][db][path] parameter.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: zoomstats
References: http://www.securityfocus.com/bid/20165, http://zoomstats.cvs.sourceforge.net/zoomstats/zoomstats/libs/dbmax/mysql.php?view=markup, https://exchange.xforce.ibmcloud.com/vulnerabilities/29120
CVE-2006-6872
Directory traversal vulnerability in mod.php in eNdonesia 8.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the mod parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: endonesia
References: http://secunia.com/advisories/23502, http://www.securityfocus.com/bid/21333, http://www.vupen.com/english/advisories/2006/5187
CVE-2006-2749
SQL injection vulnerability in search.php in Open Searchable Image Catalogue (OSIC) 0.7.0.1 and earlier allows remote attackers to inject arbitrary SQL commands via the (1) txtCustomField and (2) CustomFieldID array parameters.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: open_searchable_image_catalogue
References: http://secunia.com/advisories/20341, http://securityreason.com/securityalert/1014, http://securitytracker.com/id?1016178
CVE-2006-4359
Stack-based buffer overflow in Trident Software PowerZip 7.06 Build 3895 on Windows 2000 allows remote attackers to execute arbitrary code via a ZIP archive containing a long filename.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: powerzip
References: http://secunia.com/advisories/21556, http://vuln.sg/powerzip706-en.html, http://www.securityfocus.com/bid/19671
CVE-2006-4384
Heap-based buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via the COLOR_64 chunk in a FLIC (FLC) movie.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: quicktime
References: http://docs.info.apple.com/article.html?artnum=304357, http://lists.apple.com/archives/Security-announce/2006/Sep/msg00000.html, http://secunia.com/advisories/21893
CVE-2006-6655
The procfs implementation in NetBSD-current before 20061023, NetBSD 3.0 and 3.0.1 before 20061024, and NetBSD 2.x before 20061029 allows local users to cause a denial of service (kernel panic) by attempting to access /emul/linux/proc/0/stat on a procfs filesystem that was mounted with mount_procfs -o linux, which results in a NULL pointer dereference.
CVSS v2.0 Score: 1.7 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:P
Affected Products: netbsd
References: ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-026.txt.asc, http://securitytracker.com/id?1017293, ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-026.txt.asc
CVE-2006-4459
Integer overflow in AnywhereUSB/5 1.80.00 allows local users to cause a denial of service (crash) via a 1 byte header size specified in the USB string descriptor.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: anywhere_usb5
References: http://secunia.com/advisories/21739, http://securityreason.com/securityalert/1500, http://www.safend.com/advisories/digi_anywhereusb5_intoverflow.txt
CVE-2006-5031
Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with "%00" and a .js filename.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: cakephp
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://cakeforge.org/frs/shownotes.php?release_id=134, http://secunia.com/advisories/22040, http://www.gulftech.org/?node=research&article_id=00114-09212006
CWE: CWE-22
CVE-2006-1287
Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB) 2.0.4 and 2.1.4 before 20060130 allows remote attackers to steal cookies and probably conduct other activities when the victim is using Internet Explorer.
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Affected Products: invision_power_board
References: http://forums.invisionpower.com/index.php?showtopic=206790, http://secunia.com/advisories/19141, http://www.vupen.com/english/advisories/2006/0861
CVE-2006-6830
PHP remote file inclusion vulnerability in b2verifauth.php in b2 Blog 0.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the index parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: b2_blog
References: http://www.securityfocus.com/bid/21749, https://exchange.xforce.ibmcloud.com/vulnerabilities/31139, https://www.exploit-db.com/exploits/2983
CVE-2006-4991
RSA Keon Certificate Authority (KeonCA) Manager 6.5.1 and 6.6 allows privileged local users to hide malicious Certificate Authority (CA) activities by modifying CA auditor logs without detection by (1) modifying or deleting a <LOG BLOCK> and its signature from the XML log in a way that is not detected by the integrity check function that operates on the entire pool, or (2) modifying entries in the live log file, which is only signed during rotation.
CVSS v2.0 Score: 3.6 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N
Affected Products: keon_certificate_authority_manager
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049592.html, http://www.securityfocus.com/archive/1/446742/100/0/threaded, http://www.securityfocus.com/bid/20136
CVE-2006-0438
Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode (IMG) are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to (1) admin/admin_users.php and (2) modcp.php.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: phpbb
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041920.html, http://secunia.com/advisories/18693, http://securityreason.com/achievement_securityalert/31
CVE-2006-1638
Multiple SQL injection vulnerabilities in aWebBB 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) Username parameter to (a) accounts.php, (b) changep.php, (c) editac.php, (d) feedback.php, (e) fpass.php, (f) login.php, (g) post.php, (h) reply.php, or (i) reply_log.php; (2) p parameter to (j) dpost.php; (3) c parameter to (k) list.php or (l) ndis.php; or (12) q parameter to (m) search.php.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: awebbb
References: http://evuln.com/vulns/117/summary.html, http://secunia.com/advisories/19486, http://www.osvdb.org/24340
CVE-2006-3059
Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors.  NOTE: this is a different vulnerability than CVE-2006-3086.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: excel, excel_viewer
References: http://blogs.securiteam.com/?p=451, http://blogs.technet.com/msrc/archive/2006/06/16/436174.aspx, http://isc.sans.org/diary.php?storyid=1420
CVE-2006-1501
SQL injection vulnerability in index.php in OneOrZero 1.6.3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in the kans action.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: oneorzero
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://osvdb.org/ref/24/24228-oneorzero.txt, http://secunia.com/advisories/19446, http://www.osvdb.org/24228
CWE: CWE-89
CVE-2006-4692
Argument injection vulnerability in the Windows Object Packager (packager.exe) in Microsoft Windows XP SP1 and SP2 and Server 2003 SP1 and earlier allows remote user-assisted attackers to execute arbitrary commands via a crafted file with a "/" (slash) character in the filename of the Command Line property, followed by a valid file extension, which causes the command before the slash to be executed, aka "Object Packager Dialogue Spoofing Vulnerability."
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: windows_server_2003, windows_xp
Related CWEs: CWE-88
Related CAPECs: CAPEC-137, CAPEC-88, CAPEC-174
References: http://secunia.com/advisories/20717, http://secunia.com/secunia_research/2006-54/advisory/, http://securitytracker.com/id?1017037
CWE: CWE-88
CVE-2006-3853
Buffer overflow in IBM Informix Dynamic Server (IDS) before 9.40.TC7 and 10.00 before 10.00.TC3, when running on Windows, allows remote attackers to execute arbitrary code via a long username.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: informix_dynamic_server
References: http://secunia.com/advisories/21301, http://www-1.ibm.com/support/docview.wss?uid=swg21242921, http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
CVE-2006-2859
PHP remote file inclusion vulnerability in MyBloggie 2.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mybloggie_root_path parameter to (1) admin.php or (2) scode.php. NOTE: this issue has been disputed in multiple third party followups, which say that the MyBloggie source code does not demonstrate the issue, so it might be the result of another module.  CVE analysis as of 20060605 agrees with the dispute.  In addition, scode.php is not part of the MyBloggie distribution
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mybloggie
References: http://securityreason.com/securityalert/1049, http://www.securityfocus.com/archive/1/435789/100/0/threaded, http://www.securityfocus.com/archive/1/435866/100/0/threaded
CVE-2006-5945
Multiple SQL injection vulnerabilities in MGinternet Car Site Manager (CSM) allow remote attackers to execute arbitrary SQL commands via the (1) p parameter to (a) csm/asp/detail.asp, or the (2) l, (3) typ, or (4) loc parameter to (b) csm/asp/listings.asp.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: car_site_manager
References: http://s-a-p.ca/index.php?page=OurAdvisories&id=17, http://secunia.com/advisories/22914, http://securityreason.com/securityalert/1876
CVE-2006-2675
PHP remote file inclusion vulnerability in ubbt.inc.php in UBBThreads 5.x and 6.x allows remote attackers to execute arbitrary PHP code via a URL in the (1) thispath or (2) configdir parameters.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: ubb.threads
References: http://securityreason.com/securityalert/985, http://www.securityfocus.com/archive/1/435288/100/0/threaded, https://exchange.xforce.ibmcloud.com/vulnerabilities/26866
CVE-2006-1285
SQLAnywhere in Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, gives read and write permissions to all users for database shared memory sections, which allows local users to access and possibly modify certain information.
CVSS v2.0 Score: 3.2 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:S/C:P/I:P/A:N
Affected Products: ghost_solutions_suite, norton_ghost
References: http://secunia.com/advisories/19171, http://securityresponse.symantec.com/avcenter/security/Content/2006.03.07.html, http://securitytracker.com/id?1015733
CVE-2006-4495
Microsoft Internet Explorer allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code by instantiating certain Windows 2000 ActiveX COM Objects including (1) ciodm.dll, (2) myinfo.dll, (3) msdxm.ocx, and (4) creator.dll.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ie, windows_2003_server
References: http://securityreason.com/securityalert/1474, http://www.securityfocus.com/archive/1/443896/100/100/threaded, http://www.securityfocus.com/bid/19636
CVE-2006-5984
Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) txtCompanyName, (2) txtEmail, or (3) txtUserAccNum parameter to (a) users.asp, or the (4) setThemeColour parameter to (b) default.asp in the Reseller and Admin levels; or the (5) setThemeColour parameter to default.asp in the User level.  NOTE: the txtDomainName parameter to domains.asp is covered by CVE-2006-1407, which suggests that this vector is fixed in 3.2.10 stable.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: helm_web_hosting_control_panel
References: http://aria-security.net/advisory/helm.txt, http://secunia.com/advisories/22916, http://securityreason.com/securityalert/1884
CVE-2006-1364
Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause a denial of service (resource consumption or crash) by repeatedly requesting each of several documents that refer to COM components, or are restricted documents located under the ASP.NET application path.
CVSS v3.0 Score: 7.5 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: asp.net
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: http://hackingspirits.com/vuln-rnd/w3wp-remote-dos.zip, http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044291.html, http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044292.html
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2006-2886
view.php in KnowledgeTree Open Source 3.0.3 and earlier allows remote attackers to obtain the full installation path via a crafted fDocumentId parameter, which displays the path in the resulting error message.  NOTE: this might be resultant from another vulnerability, since this vector also produces XSS.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: knowledgetree_open_source
References: http://pridels0.blogspot.com/2006/06/knowledgetree-open-source-xss-vuln.html, http://www.osvdb.org/26297, https://exchange.xforce.ibmcloud.com/vulnerabilities/26943
CVE-2006-1641
Multiple SQL injection vulnerabilities in CzarNews 1.14 allow remote attackers to execute arbitrary SQL commands via the (1) usern or (2) passw parameters to (a) cn_auth.php, (3) s parameter to (b) news.php, or (4) a parameter to (c) dpost.php.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: czarnews
References: http://evuln.com/vulns/118/summary.html, http://secunia.com/advisories/19541, http://securitytracker.com/id?1015957
CVE-2006-5528
Directory traversal vulnerability in mod.php in SchoolAlumni Portal 2.26 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod parameter.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: schoolalumni_portal
References: http://securitytracker.com/id?1017105, http://www.securityfocus.com/bid/20673, http://securitytracker.com/id?1017105
CVE-2006-1833
Intel RNG Driver in NetBSD 1.6 through 3.0 may incorrectly detect the presence of the pchb interface, which will cause it to always generate the same random number, which allows remote attackers to more easily crack encryption keys generated from the interface.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N
Affected Products: netbsd
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-009.txt.asc, http://secunia.com/advisories/19585, http://securitytracker.com/id?1015907
CVE-2006-6940
Buffer overflow in the ParseHeader function in clsOWA.cls in POP3/SMTP to OWA (pop2owa) 1.1.3 allows remote attackers to execute arbitrary code via a long header in an e-mail message.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: owa
References: http://sourceforge.net/project/shownotes.php?release_id=473941&group_id=152204, http://sourceforge.net/tracker/index.php?func=detail&aid=1621688&group_id=152204&atid=783596, http://www.vupen.com/english/advisories/2007/0160
CVE-2006-2211
Absolute path traversal vulnerability in index.php in 321soft PhP-Gallery 0.9 allows remote attackers to browse arbitrary directories via the path parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: php-gallery
References: http://d4igoro.blogspot.com/2006/05/321soft-php-gallery-09-directory.html, http://secunia.com/advisories/19924, http://www.securityfocus.com/archive/1/432964/100/0/threaded
CVE-2006-5475
Multiple cross-site scripting (XSS) vulnerabilities in the XML parser in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allow remote attackers to inject arbitrary web script or HTML via a crafted RSS feed.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: drupal
References: http://drupal.org/node/88826, http://secunia.com/advisories/22486, http://securityreason.com/securityalert/1766
CVE-2006-3756
Cross-site scripting (XSS) vulnerability in Geeklog 1.4.0sr4 and earlier, and 1.3.11sr6 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when validating comments in (1) lib-comment.php (1.4.0sr4) or (2) comment.php (0.3.11sr6).
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: geeklog
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://jvn.jp/jp/JVN%2381108784/index.html, http://secunia.com/advisories/21094, http://www.geeklog.net/article.php/geeklog-1.4.0sr5
CWE: CWE-79
CVE-2006-1359
Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain createTextRange call on a checkbox object, which results in a dereference of an invalid table pointer.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: ie, internet_explorer
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1427.html, http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1430.html, http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1434.html
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2006-0044
Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields".
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: albatross
References: http://secunia.com/advisories/18457, http://secunia.com/advisories/18496, http://security.debian.org/pool/updates/main/a/albatross/albatross_1.20-2.diff.gz
CVE-2006-6890
Voodoo chat 1.0RC1b stores sensitive information under the web root with insufficient access control, which allows remote attackers to download passwords via a direct request for data/users.dat.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: voodoo_chat
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/31221, https://www.exploit-db.com/exploits/3044, https://exchange.xforce.ibmcloud.com/vulnerabilities/31221
CVE-2006-5188
Directory traversal vulnerability in download.php in webGENEius GOOP Gallery 2.0.2 allows remote attackers to read or list data from certain files or directories via unspecified vectors.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: goop_gallery
References: http://secunia.com/advisories/22258, http://securityreason.com/securityalert/1698, http://securitytracker.com/id?1016983
CVE-2006-4898
PHP remote file inclusion vulnerability in include/phpxd/phpXD.php in guanxiCRM 0.9.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the appconf[rootpath] parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: guanxicrm_business_solution
References: http://www.securityfocus.com/bid/20071, https://exchange.xforce.ibmcloud.com/vulnerabilities/28994, https://www.exploit-db.com/exploits/2381
CVE-2006-6575
PHP remote file inclusion vulnerability in ldap.php in Brian Drawert Yet Another PHP LDAP Admin Project (yaplap) 0.6 and 0.6.1 allows remote attackers to execute arbitrary PHP code via a URL in the LOGIN_style parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: yaplap
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/30887, https://www.exploit-db.com/exploits/2930, https://exchange.xforce.ibmcloud.com/vulnerabilities/30887
CVE-2006-3372
Apple Safari 2.0.4/419.3 allows remote attackers to cause a denial of service (application crash) via a DHTML setAttributeNode function call with zero arguments, which triggers a null dereference.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: safari
References: http://browserfun.blogspot.com/2006/07/mobb-5-dhtml-setattributenode.html, http://securitytracker.com/id?1016441, http://www.osvdb.org/26838