DuyTa/cve-kgrag-db huggingface dataset:
CVE-2006-0931
Directory traversal vulnerability in PEAR::Archive_Tar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: pear_archive_tar
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://pear.php.net/bugs/bug.php?id=6933, http://pear.php.net/package/Archive_Tar/download/, http://secunia.com/advisories/19011
CWE: CWE-22
CVE-2006-0331
Buffer overflow in Change passwd 3.1 (chpasswd) SquirrelMail plugin allows local users to execute arbitrary code via long command line arguments.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: change_passwd
References: http://securityreason.com/securityalert/363, http://www.securityfocus.com/archive/1/422414/100/0/threaded, http://www.squirrelmail.org/plugin_view.php?id=117
CVE-2006-4466
Joomla! before 1.0.11 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to have an unspecified impact.  NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Joomla!.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: joomla
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://www.joomla.org/content/view/1841/78/, http://www.vupen.com/english/advisories/2006/3408, http://www.joomla.org/content/view/1841/78/
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2006-4992
Multiple PHP remote file inclusion vulnerabilities in JD-WordPress for Joomla! (com_jd-wp) 2.0-1.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter in (1) wp-comments-post.php, (2) wp-feed.php, or (3) wp-trackback.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: jd-wordpress
References: http://forum.joomla.org/index.php/topic%2C79477.0.html, http://forum.joomla.org/index.php/topic%2C81064.0.html, http://www.babilonics.com/?q=node/1802
CVE-2006-3001
Cross-site scripting (XSS) vulnerability in search.php in OkScripts OkMall 1.0 allow remote attackers to inject arbitrary web script or HTML via the page parameter.  NOTE: this might be resultant from another vulnerability, since the XSS is reflected in an error message.
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Affected Products: okmall
References: http://secunia.com/advisories/20621, http://securityreason.com/securityalert/1080, http://www.securityfocus.com/archive/1/436561
CVE-2006-2082
Directory traversal vulnerability in Quake 3 engine, as used in products including Quake3 Arena, Return to Castle Wolfenstein, Wolfenstein: Enemy Territory, and Star Trek Voyager: Elite Force, when the sv_allowdownload cvar is enabled, allows remote attackers to read arbitrary files from the server via ".." sequences in a .pk3 file request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: quake_3_engine
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045906.html, http://securityreason.com/securityalert/880, http://www.securityfocus.com/archive/1/433349/100/0/threaded
CVE-2006-3239
SQL injection vulnerability in message.php in VBZooM 1.11 and earlier allows remote attackers to execute arbitrary SQL commands via the UserID parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: vbzoom
References: http://securityreason.com/securityalert/1148, http://www.securityfocus.com/archive/1/437655, http://www.securityfocus.com/bid/18497
CVE-2006-2725
SQL injection vulnerability in rss/posts.php in Eggblog before 3.07 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: eggblog
References: http://secunia.com/advisories/20352, http://www.nukedx.com/?getxpl=36, http://www.nukedx.com/?viewdoc=36
CVE-2006-5315
PHP remote file inclusion vulnerability in main.php in registroTL allows remote attackers to execute arbitrary PHP code via an ftp:// URL in the page parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: registrotl
References: http://acid-root.new.fr/poc/13061007.txt, http://securityreason.com/securityalert/1734, http://www.securityfocus.com/archive/1/448096/100/0/threaded
CVE-2006-5074
Cross-site scripting (XSS) vulnerability in home.php in PHP Invoice 2.2 allows remote attackers to inject arbitrary web script or HTML via the alert parameter.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: php_invoice
References: http://secunia.com/advisories/22123, http://securityreason.com/securityalert/1652, http://www.securityfocus.com/archive/1/447015/100/0/threaded
CVE-2006-5108
Multiple cross-site scripting (XSS) vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to inject arbitrary web script or HTML via the order_id parameter in (1) admin/print_order.php and (2) view_order.php; the (3) site_url and (4) la_search_home parameters and (5) certain language parameters in admin/nav.php; the (6) image parameter in admin/image.php; the (7) site_name, (8) la_adm_header, (9) charset, and (10) certain other parameters in admin/header.inc.php; the (12) la_pow_by parameter in footer.inc.php; and the (13) site_name parameter and (14) certain other parameters in header.inc.php.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: cubecart
References: http://secunia.com/advisories/22175, http://securityreason.com/securityalert/1662, http://www.osvdb.org/29246
CVE-2006-5120
Multiple cross-site scripting (XSS) vulnerabilities in Scott Metoyer Red Mombin 0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) index.php and (2) process_login.php.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N
Affected Products: red_mombin
References: http://securityreason.com/securityalert/1668, http://www.armorize.com/advisory.php?Keyword=Armorize-ADV-2006-0002, http://www.securityfocus.com/archive/1/447255/100/0/threaded
CVE-2006-7071
SQL injection vulnerability in classes/class_session.php in Invision Power Board (IPB) 2.1 up to 2.1.6 allows remote attackers to execute arbitrary SQL commands via the CLIENT_IP parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: invision_power_board
References: http://archives.neohapsis.com/archives/bugtraq/2006-07/0249.html, http://rst.void.ru/download/r57ipb216gui.txt, http://secunia.com/advisories/21072
CVE-2006-4273
Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin 3.5.4 and 3.6.0 allows remote attackers to inject arbitrary web script or HTML by uploading an attachment with a .pdf extension that contains JavaScript, which is processed as script by Microsoft Internet Explorer 6.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: vbulletin
References: http://archives.neohapsis.com/archives/bugtraq/2006-08/0074.html, http://archives.neohapsis.com/archives/bugtraq/2006-08/0082.html, http://www.osvdb.org/27778
CVE-2006-2104
Multiple cross-site scripting (XSS) vulnerabilities in Kamgaing Email System (kmail) 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) d parameter to main.php, ordner parameter to (2) main.php, or (3) webdisk.php, (4) draft parameter to compose.php, or (5) m, or (6) y parameter to calendar.php.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: kmail
References: http://pridels0.blogspot.com/2006/04/kmail-23-vuln.html, http://secunia.com/advisories/19755, http://www.osvdb.org/25061
CVE-2006-2334
The RtlDosPathNameToNtPathName_U API function in NTDLL.DLL in Microsoft Windows 2000 SP4 and XP SP2 does not properly convert DOS style paths with trailing spaces into NT style paths, which allows context-dependent attackers to create files that cannot be accessed through the expected DOS path or prevent access to other similarly named files in the same directory, which prevents those files from being detected or disinfected by certain anti-virus and anti-spyware software.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: windows_2000, windows_xp
References: http://www.48bits.com/advisories/rtldospath.pdf, http://www.osvdb.org/25761, http://www.securityfocus.com/archive/1/433583/100/0/threaded
CVE-2006-5138
Groupee UBB.threads 6.5.1.1 allows remote attackers to obtain sensitive information via a direct request for cron/php/subscriptions.php, which reveals the path in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: ubb.threads
References: http://securityreason.com/securityalert/1676, http://www.securityfocus.com/archive/1/447359/100/0/threaded, http://www.securityfocus.com/bid/20266
CVE-2006-0364
Cross-site scripting (XSS) vulnerability in MyBulletinBoard (MyBB) allows remote attackers to inject arbitrary web script or HTML via a signature containing a JavaScript URI in the SRC attribute of an IMG element, in which the URI uses SGML numeric character references without trailing semicolons, as demonstrated by "&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116".
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: mybulletinboard
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://archives.neohapsis.com/archives/bugtraq/2006-01/0332.html, http://secunia.com/advisories/18544, http://www.osvdb.org/22628
CWE: CWE-79
CVE-2006-6701
Cross-site request forgery (CSRF) vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG element in an HTML e-mail.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: atmail_webmail
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0512.html, http://secunia.com/advisories/23472, http://secunia.com/advisories/25328
CWE: CWE-352
CVE-2006-2879
SQL injection vulnerability in newscomments.php in Alex News-Engine 1.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: news-engine
References: http://secunia.com/advisories/20469, http://securityreason.com/securityalert/1057, http://www.securityfocus.com/archive/1/435988
CVE-2006-0778
Multiple SQL injection vulnerabilities in XMB Forums 1.9.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) $u2u_select array parameter to u2u.inc.php and (2) $val variable (fidpw0 cookie value) in today.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xmb
References: http://secunia.com/advisories/18821, http://www.gulftech.org/?node=research&article_id=00100-02122006, http://www.osvdb.org/23117
CVE-2006-1271
SQL injection vulnerability in index.php in OxyNews allows remote attackers to execute arbitrary SQL commands via the oxynews_comment_id parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: oxynews
References: http://biyosecurity.be/bugs/oxynews.txt, http://secunia.com/advisories/19255, http://www.osvdb.org/23940
CVE-2006-6959
WebRoot Spy Sweeper 4.5.9 and earlier allows local users to bypass the "Startup-Shield" security restrictions by modifying certain registry keys.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: spy_sweeper
References: http://www.osvdb.org/27535, http://www.securityfocus.com/archive/1/437814/100/200/threaded, http://www.sentinel.gr/advisories/SGA-0001.txt
CVE-2006-3672
KDE Konqueror 3.5.1 and earlier allows remote attackers to cause a denial of service (application crash) by calling the replaceChild method on a DOM object, which triggers a null dereference, as demonstrated by calling document.replaceChild with a 0 (zero) argument.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P
Affected Products: konqueror
References: http://browserfun.blogspot.com/2006/07/mobb-14-konqueror-replacechild.html, http://www.mandriva.com/security/advisories?name=MDKSA-2006:130, http://www.osvdb.org/27058
CVE-2006-5161
IBM Client Security Password Manager stores and distributes saved passwords based upon the title of a website, which allows remote attackers to obtain username and password credentials by changing the title of an HTML page.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: client_security_password_manager
References: http://securityreason.com/securityalert/1681, http://www.securityfocus.com/archive/1/447577/100/0/threaded, http://www.securityfocus.com/bid/20308
CVE-2006-0445
index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by "\", which will display the full path of uploader.php.  NOTE: this might be the result of a file inclusion vulnerability.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N
Affected Products: phpclanwebsite
References: http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt, http://www.osvdb.org/22721, http://www.securityfocus.com/archive/1/423145/100/0/threaded
CVE-2006-3176
SQL injection vulnerability in xarancms_haupt.php in xarancms 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xaran_cms
References: http://pridels0.blogspot.com/2006/06/xarancms-v20-vuln.html, http://secunia.com/advisories/20739, http://www.osvdb.org/26632
CVE-2006-1607
Unspecified vulnerability in the banner module in Exponent CMS before 0.96.5 RC 1 allows "php injection" via unknown attack vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: exponent_cms
References: http://secunia.com/advisories/19498, http://sourceforge.net/project/shownotes.php?release_id=406474&group_id=118524, http://www.osvdb.org/24358
CVE-2006-0635
Tiny C Compiler (TCC) 0.9.23 (aka TinyCC) evaluates the "i>sizeof(int)" expression to false when i equals -1, which might introduce integer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: tiny_c_compiler
References: http://www.osvdb.org/22956, http://www.securityfocus.com/archive/1/424257/100/0/threaded, http://www.osvdb.org/22956
CVE-2006-0475
PHP-Ping 1.3 does not properly validate ping counts, which allows remote attackers to cause a denial of service (ping flood) via a negative count parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: php-ping
References: http://secunia.com/advisories/18645, http://www.kapda.ir/advisory-231.html, http://www.vupen.com/english/advisories/2006/0368
CVE-2006-7181
Multiple PHP remote file inclusion vulnerabilities in Morcego CMS 0.9.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) fichero parameter to morcegoCMS.php or the (2) path parameter to adodb/adodb.inc.php.  NOTE: vector 1 has been disputed by a third party who shows that $fichero can not be controlled by an attacker
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: morcego_cms
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://securityreason.com/securityalert/2494, http://www.securityfocus.com/archive/1/448545/100/0/threaded, http://www.securityfocus.com/archive/1/485403/100/0/threaded
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2006-1923
Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) RSS/RSS.php and (2) possibly other vectors.
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Affected Products: linpha
References: http://attrition.org/pipermail/vim/2006-April/000709.html, http://secunia.com/advisories/19719, http://www.osvdb.org/24816
CVE-2006-7097
Multiple unspecified vulnerabilities in TaskFreak! before 0.1.4 have unknown impact and attack vectors.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: taskfreak
References: http://www.taskfreak.com/versions.html, http://www.taskfreak.com/versions.html
CVE-2006-4806
Multiple integer overflows in imlib2 allow user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) ARGB (loader_argb.c), (2) PNG (loader_png.c), (3) LBM (loader_lbm.c), (4) JPEG (loader_jpeg.c), or (5) TIFF (loader_tiff.c) images.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: imlib2
References: http://secunia.com/advisories/22732, http://secunia.com/advisories/22744, http://secunia.com/advisories/22752
CVE-2006-3048
SQL injection vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: tikiwiki_cms//groupware
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/20648, http://secunia.com/advisories/20850, http://securityreason.com/securityalert/1102
CWE: CWE-89
CVE-2006-4525
Cross-site scripting (XSS) vulnerability in CubeCart 3.0.12 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the links array.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: cubecart
References: http://cubecart.com/site/forums/index.php?showtopic=21540, http://secunia.com/advisories/21659, http://www.cubecart.com/site/forums/index.php?s=5e34938dc670782af211587b8a450c90&act=Attach&type=post&id=697
CVE-2006-2788
Double free vulnerability in the getRawDER function for nsIX509Cert in Firefox allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via certain Javascript code.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: firefox
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://rhn.redhat.com/errata/RHSA-2006-0609.html, http://secunia.com/advisories/21269, http://secunia.com/advisories/21270
CWE: CWE-119
CVE-2006-0707
PyBlosxom before 1.3.2, when running on certain webservers, allows remote attackers to read arbitrary files via an HTTP request with multiple leading / (slash) characters, which is accessed using the PATH_INFO variable.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: pyblosxom
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://secunia.com/advisories/18858, http://sourceforge.net/project/shownotes.php?release_id=391800, http://www.securityfocus.com/bid/16641
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2006-5152
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL that is returned in a large HTTP 404 error message without an explicit charset, a related issue to CVE-2006-0032.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: internet_explorer
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0017.html, http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0030.html, http://www.osvdb.org/31328
CVE-2006-6905
Unspecified vulnerability in the Widcomm Bluetooth stack allows remote attackers to gain administrative access (aka Remote Root) via unspecified vectors.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: widcomm_bluetooth
References: http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf, http://osvdb.org/37588, http://www.securityfocus.com/archive/1/455889/100/0/threaded
CVE-2006-2226
Buffer overflow in XM Easy Personal FTP Server 4.2 and 5.0.1 allows remote authenticated users to cause a denial of service via a long argument to the PORT command.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: xm_easy_personal_ftp_server
References: http://secunia.com/advisories/19970, http://www.packetstormsecurity.org/0606-exploits/xmepftp.txt, http://www.securityfocus.com/bid/18711
CVE-2006-7115
SQL injection vulnerability in PHPKit 1.6.1 RC2 allows remote attackers to inject arbitrary SQL commands via the catid parameter to include.php when the path parameter is set to faq/faq.php, and other unspecified vectors involving guestbook/print.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpkit
References: http://secunia.com/advisories/17479, http://securityreason.com/securityalert/2357, http://www.bb-pcsecurity.de/websecurity/532/org/PHPKit_1.6.1_RC2_%28faq-faq.php%29_Remote_SQL_Injection_Exploit.htm
CVE-2006-5826
Buffer overflow in Texas Imperial Software WFTPD Pro Server 3.23.1.1 allows remote authenticated users to execute arbitrary code or cause a denial of service (application crash) via crafted APPE commands that contain "/" (slash) or "\" (backslash) characters.
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:M/C:P/I:P/A:P
Affected Products: wftpd
References: http://marc.info/?l=full-disclosure&m=116289234522958&w=2, http://marc.info/?l=full-disclosure&m=116295408114746&w=2, http://securityreason.com/securityalert/1837
CVE-2006-4165
Cross-site scripting (XSS) vulnerability in NetCommons 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: netcommons
References: http://jvn.jp/jp/JVN%2351301450/index.html, http://secunia.com/advisories/21445, http://www.securityfocus.com/bid/19497
CVE-2006-3694
Multiple unspecified vulnerabilities in Ruby before 1.8.5 allow remote attackers to bypass "safe level" checks via unspecified vectors involving (1) the alias function and (2) "directory operations".
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: ruby
References: ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P, http://jvn.jp/jp/JVN%2313947696/index.html, http://jvn.jp/jp/JVN%2383768862/index.html
CVE-2006-5387
PHP remote file inclusion vulnerability in mods/iai/includes/constants.php in the PlusXL 20_272 and earlier phpBB module allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: plusxl
References: http://secunia.com/advisories/22414, http://securityreason.com/securityalert/1740, http://www.securityfocus.com/archive/1/448581/100/0/threaded
CVE-2006-3304
SQL injection vulnerability in cp.php in DeluxeBB 1.07 and earlier allows remote attackers to execute arbitrary SQL commands via the xmsn parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: deluxebb
References: http://secunia.com/advisories/20813, http://securityreason.com/securityalert/1180, http://securitytracker.com/id?1016384
CVE-2006-3128
choose_file.php in easy-CMS 0.1.2, when mod_mime is installed, does not restrict uploads of filenames with multiple extensions, which allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a GIF file extension, then directly accessing that file in the Repositories directory.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P
Affected Products: easy-cms
References: http://biyosecurity.be/bugs/easycms.txt, http://secunia.com/advisories/20733, http://securitytracker.com/id?1016335
CVE-2006-3971
Cross-site scripting (XSS) vulnerability in visitor/livesupport/chat.php in Scott Weedon Ajax Chat, possibly 0.1, allows remote attackers to inject arbitrary web script or HTML via the userid parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: ajax_chat
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0716.html, http://secunia.com/advisories/21286, http://www.osvdb.org/27643
CVE-2006-1148
Multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp in PeerCast before 0.1217 allow remote attackers to execute arbitrary code via an HTTP GET request with a long (1) parameter name or (2) value in a URL, which triggers the overflow in the nextCGIarg function in servhs.cpp.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: peercast
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://secunia.com/advisories/19169, http://secunia.com/advisories/19291, http://security.gentoo.org/glsa/glsa-200603-17.xml
CWE: CWE-119
CVE-2006-1070
Cross-site scripting (XSS) vulnerability in dv_gbook.php in DVguestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the f parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: dvguestbook
References: http://biyosecurity.be/bugs/dvguestbook.txt, http://secunia.com/advisories/19098, http://www.securityfocus.com/archive/1/427214/100/0/threaded
CVE-2006-7148
PHP remote file inclusion vulnerability in includes/bb_usage_stats.php in maluinfo 206.2.38 for Brazilian PHPBB allows remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter.  NOTE: this might be the same issues as CVE-2006-4893.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: maluinfo
References: http://securityreason.com/securityalert/2380, http://www.securityfocus.com/archive/1/448639/100/0/threaded, http://www.securityfocus.com/bid/20507
CVE-2006-1149
PHP remote file inclusion vulnerability in lib/OWL_API.php in OWL Intranet Engine 0.82, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the xrms_file_root parameter, which is not initialized before use.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: owl_intranet_engine
References: http://secunia.com/advisories/19142, http://www.osvdb.org/23734, http://www.securityfocus.com/bid/17021
CVE-2006-5455
Cross-site request forgery (CSRF) vulnerability in editversions.cgi in Bugzilla before 2.22.1 and 2.23.x before 2.23.3 allows user-assisted remote attackers to create, modify, or delete arbitrary bug reports via a crafted URL.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected Products: bugzilla
References: http://secunia.com/advisories/22409, http://secunia.com/advisories/22790, http://security.gentoo.org/glsa/glsa-200611-04.xml
CVE-2006-2804
Cross-site scripting (XSS) vulnerability in index.cfm in Goss Intelligent Content Management (iCM) 7.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party sources.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: icm
References: http://secunia.com/advisories/20372, http://www.securityfocus.com/bid/18221, http://www.vupen.com/english/advisories/2006/2089
CVE-2006-4910
The web administration interface (mainApp) to Cisco IDS before 4.1(5c), and IPS 5.0 before 5.0(6p1) and 5.1 before 5.1(2) allows remote attackers to cause a denial of service (unresponsive device) via a crafted SSLv2 Client Hello packet.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ips_sensor_software, ids_sensor_software
References: http://secunia.com/advisories/22046, http://securitytracker.com/id?1016891, http://www.cisco.com/warp/public/707/cisco-sa-20060920-ips.shtml
CVE-2006-3081
mysqld in MySQL 4.1.x before 4.1.18, 5.0.x before 5.0.19, and 5.1.x before 5.1.6 allows remote authorized users to cause a denial of service (crash) via a NULL second argument to the str_to_date function.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P
Affected Products: mysql
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=373913, http://bugs.mysql.com/bug.php?id=15828, http://docs.info.apple.com/article.html?artnum=305214
CVE-2006-6739
PHP remote file inclusion vulnerability in buycd.php in Paristemi 0.8.3 allows remote attackers to execute arbitrary PHP code via a URL in the HTTP_DOCUMENT_ROOT parameter, a different vector than CVE-2006-6689.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: paristemi
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://www.securityfocus.com/bid/21665, https://www.exploit-db.com/exploits/2955, http://www.securityfocus.com/bid/21665
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2006-2249
Multiple cross-site scripting (XSS) vulnerabilities in search.php in CuteNews 1.4.1 and earlier, and possibly 1.4.5, allow remote attackers to inject arbitrary web script or HTML via the (1) user, (2) story, or (3) title parameters.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: cutenews
References: http://neosecurityteam.net/index.php?action=advisories&id=21, http://secunia.com/advisories/20026, http://securityreason.com/securityalert/860
CVE-2006-1098
Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the (1) informationID or (2) ParentCategory parameter to index.php. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: nz_ecommerce
References: http://pridels0.blogspot.com/2006/03/nz-ecommerce-sqlxss-vuln.html, http://secunia.com/advisories/19088, http://www.osvdb.org/23601
CVE-2006-6265
Teredo clients, when located behind a restricted NAT, allow remote attackers to establish an inbound connection without the guessing required to find a port mapping for a traditional restricted NAT client, by (1) using the client port number contained in the Teredo address or (2) following the bubble-to-open procedure.
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:L/Au:N/C:P/I:P/A:P
Affected Products: teredo
References: http://www.securityfocus.com/archive/1/452989/100/0/threaded, http://www.securityfocus.com/archive/1/452996/100/0/threaded, http://www.symantec.com/avcenter/reference/Teredo_Security.pdf
CVE-2006-6480
admin/admin_membre/fiche_membre.php in AnnonceScriptHP 2.0 allows remote attackers to obtain sensitive information via the idmembre parameter, which discloses the passwords for arbitrary users.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: annoncescripthp
References: http://secunia.com/advisories/23318, http://securityreason.com/securityalert/2019, http://www.securityfocus.com/archive/1/453966/100/0/threaded
CVE-2006-4734
Multiple SQL injection vulnerabilities in tiki-g-admin_processes.php in Tikiwiki 1.9.4 allow remote attackers to execute arbitrary SQL commands via the (1) pid and (2) where parameters.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: tikiwiki_cms//groupware
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://securityreason.com/securityalert/1544, http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/tiki-g-admin_processes.php?view=log, http://www.hackers.ir/advisories/tikiwiki.html
CWE: CWE-89
CVE-2006-4749
Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpATM) 1.20 allow remote attackers to execute arbitrary PHP code via the include_location parameter in (1) activate.php, (2) configure.php, (3) fileop.php, (4) getimg.php, (5) ipblocked.php, (6) register.php, (7) showrecent.php, (8) showtophits.php, (9) usrmanag.php, (10) viewer_bottom.php, (11) viewer_content.php, and (12) viewer_top.php.  NOTE: The login.php and confirm.php vectors are already covered by CVE-2006-4594.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php_advanced_transfer_manager
References: http://www.securityfocus.com/archive/1/445742/100/0/threaded, https://exchange.xforce.ibmcloud.com/vulnerabilities/28874, http://www.securityfocus.com/archive/1/445742/100/0/threaded
CVE-2006-3132
Cross-site scripting (XSS) vulnerability in qtofm.php4 in QTOFileManager 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, as originally reported for index.php.
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Affected Products: qtofilemanager
References: http://secunia.com/advisories/20681, http://securityreason.com/securityalert/1118, http://securitytracker.com/id?1016333
CVE-2006-6035
Cross-site scripting (XSS) vulnerability in list.php in BLOG:CMS 4.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the FADDR parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: blog_cms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://marc.info/?l=bugtraq&m=116387287216907&w=2, http://secunia.com/advisories/23025, http://securitytracker.com/id?1017250
CWE: CWE-79
CVE-2006-4120
Cross-site scripting (XSS) vulnerability in the Recipe module (recipe.module) before 1.54 for Drupal 4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: drupal, recipe_module
References: http://drupal.org/node/77538, http://drupal.org/node/77753, http://secunia.com/advisories/21381
CVE-2006-7155
Novell BorderManager 3.8 SP4 generates the same ISAKMP cookies for the same source IP and port number during the same day, which allows remote attackers to conduct denial of service and replay attacks. NOTE: this issue might be related to CVE-2006-5286.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: bordermanager
References: http://secunia.com/advisories/22699, http://securitytracker.com/id?1017213, http://www.attrition.org/pipermail/vim/2007-March/001410.html
CVE-2006-3994
SQL injection vulnerability in the u2u_send_recp function in u2u.inc.php in XMB (aka extreme message board) 1.9.6 Alpha and earlier allows remote attackers to execute arbitrary SQL commands via the u2uid parameter to u2u.php, which is directly accessed from $_POST and bypasses the protection scheme.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xmb_forum
References: http://secunia.com/advisories/21293, http://www.securityfocus.com/bid/19280, http://www.vupen.com/english/advisories/2006/3088
CVE-2006-2210
Cross-site scripting (XSS) vulnerability in index.php in 321soft PhP-Gallery 0.9 allows remote attackers to inject arbitrary web script or HTML via the path parameter.  NOTE: this issue might be resultant from the directory traversal vulnerability.
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Affected Products: php-gallery
References: http://d4igoro.blogspot.com/2006/05/321soft-php-gallery-09-directory.html, http://secunia.com/advisories/19924, http://www.securityfocus.com/archive/1/432964/100/0/threaded
CVE-2006-2164
Multiple SQL injection vulnerabilities in Avactis Shopping Cart 0.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) category_id parameter in (a) store_special_offers.php and (b) store.php, and (2) prod_id parameter in (c) cart.php and (d) product_info.php.  NOTE: this issue also produces resultant full path disclosure from invalid SQL queries.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: avactis_shopping_cart
References: http://pridels0.blogspot.com/2006/05/avactis-shopping-cart-vuln.html, http://www.osvdb.org/25637, http://www.osvdb.org/25638
CVE-2006-3962
PHP remote file inclusion vulnerability in administrator/components/com_bayesiannaivefilter/lang.php in the bayesiannaivefilter component (com_bayesiannaivefilter) 1.1 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: bayesiannaivefilter
References: http://www.securityfocus.com/bid/19231, https://www.exploit-db.com/exploits/2090, http://www.securityfocus.com/bid/19231
CVE-2006-1369
Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB) 2.1.5 and earlier before 20060308 allows remote attackers to inject arbitrary web script or HTML via a Private Message (PM) in certain circumstances.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: invision_power_board
References: http://forums.invisionpower.com/index.php?showtopic=209178, http://secunia.com/advisories/19299, http://www.securityfocus.com/bid/17187
CVE-2006-3560
SQL injection vulnerability in topics.php in Blue Dojo Graffiti Forums 1.0 allows remote attackers to execute arbitrary SQL commands via the f parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: graffiti_forums
References: http://secunia.com/advisories/21017, http://securityreason.com/securityalert/1221, http://www.neosecurityteam.net/index.php?action=advisories&id=24
CVE-2006-4738
PHP remote file inclusion vulnerability in phpthumb.php in Jetbox CMS allows remote attackers to execute arbitrary PHP code via a URL in the includes_path parameter.  NOTE: The relative_script_path vector is already covered by CVE-2006-2270.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: jetbox_cms
References: http://securityreason.com/securityalert/1562, http://www.securityfocus.com/archive/1/445652/100/0/threaded, http://www.securityfocus.com/bid/19303
CVE-2006-4361
Multiple cross-site scripting (XSS) vulnerabilities in jobseekers/forgot.php in Diesel Job Site allow remote attackers to inject arbitrary web script or HTML via the (1) uname or (2) SEmail parameters.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: diesel_job_site
References: http://secunia.com/advisories/21589, http://securityreason.com/securityalert/1453, http://www.osvdb.org/28073
CVE-2006-0341
Cross-site scripting (XSS) vulnerability in WCONSOLE.DLL in Rockliffe MailSite 5.x and 6.1.22 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: mailsite
References: http://marc.info/?l=full-disclosure&m=113777628702043&w=2, http://secunia.com/advisories/18551, http://www.osvdb.org/22677
CVE-2006-1378
PasswordSafe 3.0 beta, when running on Windows before XP, uses a weak random number generator (C++ rand function) during generation of the database encryption key, which makes it easier for attackers to decrypt the database and steal passwords by generating keys for all possible rand() seed values and conducting a known plaintext attack.
CVSS v2.0 Score: 4.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:N/A:N
Affected Products: password_safe
References: http://securityreason.com/securityalert/618, http://www.securityfocus.com/archive/1/428552/100/0/threaded, http://www.securityfocus.com/archive/1/445509/100/0/threaded
CVE-2006-3633
OSSP shiela 1.1.5 and earlier allows remote authenticated users to execute arbitrary commands on the CVS server via shell metacharacters in a filename that is committed.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: shiela
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://secunia.com/advisories/21209, http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.014-shiela.html, http://www.securityfocus.com/bid/19199
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2006-6574
Mantis before 1.1.0a2 does not implement per-item access control for Issue History (Bug History), which allows remote attackers to obtain sensitive information by reading the Change column, as demonstrated by the Change column of a custom field.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mantis
References: http://bugs.mantisbugtracker.com/view.php?id=3375, http://bugs.mantisbugtracker.com/view.php?id=7364, http://mantisbt.cvs.sourceforge.net/mantisbt/mantisbt/core/history_api.php?r1=1.34&r2=1.35
CVE-2006-2706
Secure Elements Class 5 AVR server (aka C5 EVM) before 2.8.1 allows remote attackers to cause a denial of service via forged "session start" messages that cause AVR to connect to arbitrary hosts.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: class_5_enterprise_vulnerability_management
References: http://secunia.com/advisories/20378, http://securitytracker.com/id?1016184, http://www.kb.cert.org/vuls/id/487617
CVE-2006-1640
Cross-site scripting (XSS) vulnerability in news.php in CzarNews 1.14 allows remote attackers to inject arbitrary web script or HTML via the email parameter.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected Products: czarnews
References: http://evuln.com/vulns/118/summary.html, http://secunia.com/advisories/19541, http://securityreason.com/securityalert/732
CVE-2006-4971
MyBB (aka MyBulletinBoard) allows remote attackers to obtain sensitive information via a direct request for inc/plugins/hello.php, which reveals the path in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mybulletinboard
References: http://securityreason.com/securityalert/1628, http://www.securityfocus.com/archive/1/446093/100/0/threaded, http://www.vupen.com/english/advisories/2006/3666
CVE-2006-3502
Unspecified vulnerability in ImageIO in Apple Mac OS X 10.4.7 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted GIF image that triggers a memory allocation failure that is not properly handled.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: mac_os_x_server, mac_os_x
References: http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html, http://secunia.com/advisories/21253, http://www.kb.cert.org/vuls/id/651844
CVE-2006-6103
Integer overflow in the ProcDbeSwapBuffers function in the DBE extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of unspecified data structures.
CVSS v2.0 Score: 6.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C
Affected Products: x.org, xfree86
References: http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-002.txt.asc, http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01075678, http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=465
CVE-2006-5835
The Notes Remote Procedure Call (NRPC) protocol in IBM Lotus Notes Domino before 6.5.5 FP2 and 7.x before 7.0.2 does not require authentication to perform user lookups, which allows remote attackers to obtain the user ID file.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: lotus_notes
References: http://secunia.com/advisories/22741, http://securitytracker.com/id?1017203, http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21248026
CVE-2006-2525
SQL injection vulnerability in UseBB 1.0 RC1 and earlier allows remote attackers to execute arbitrary SQL commands via the member list search module.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: usebb
References: http://secunia.com/advisories/20187, http://sourceforge.net/project/shownotes.php?release_id=418462&group_id=93103, http://www.osvdb.org/25685
CVE-2006-1422
SQL injection vulnerability in details_view.php in PHP Booking Calendar 1.0c and earlier allows remote attackers to execute arbitrary SQL commands via the event_id parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: phpbookingcalendar
References: http://www.securityfocus.com/bid/17230, https://exchange.xforce.ibmcloud.com/vulnerabilities/25580, https://www.exploit-db.com/exploits/1610
CVE-2006-6110
Multiple SQL injection vulnerabilities in an unspecified BPG-InfoTech Content Management System product allow remote attackers to execute arbitrary SQL commands via the (1) vjob parameter in publications_list.asp or (2) InfoID parameter in publication_view.asp.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: content_management_system
References: http://aria-security.net/advisory/bpg.txt, http://securityreason.com/securityalert/1915, http://www.securityfocus.com/archive/1/451537/100/100/threaded
CVE-2006-0362
TippingPoint Intrusion Prevention System (IPS) TOS before 2.1.4.6324, and TOS 2.2.x before 2.2.1.6506, allow remote attackers to cause a denial of service (CPU consumption) via an unknown vector, probably involving an HTTP request with a negative number in the Content-Length header.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: tippingpoint_ips_tos
Related CWEs: CWE-399
References: http://isc.sans.org/diary.php?storyid=1042, http://secunia.com/advisories/18515, http://securitytracker.com/id?1015511
CWE: CWE-399
CVE-2006-2448
Linux kernel before 2.6.16.21 and 2.6.17, when running on PowerPC, does not perform certain required access_ok checks, which allows local users to read arbitrary kernel memory on 64-bit systems (signal_64.c) and cause a denial of service (crash) and possibly read kernel memory on 32-bit systems (signal_32.c).
CVSS v2.0 Score: 5.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:C/I:N/A:C
Affected Products: linux_kernel
References: http://secunia.com/advisories/20703, http://secunia.com/advisories/20831, http://secunia.com/advisories/20991