DuyTa/cve-kgrag-db huggingface dataset:
CVE-2006-1819
Directory traversal vulnerability in the loadConfig function in index.php in phpWebSite 0.10.2 and earlier allows remote attackers to include arbitrary local files and execute arbitrary PHP code via the hub_dir parameter, as demonstrated by including access_log.  NOTE: in some cases, arbitrary remote file inclusion could be performed under PHP 5 using an SMB share argument such as "\\systemname\sharename".
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpwebsite
References: http://downloads.securityfocus.com/vulnerabilities/exploits/PHPWebSite_fi_poc, http://secunia.com/advisories/19647, http://secunia.com/advisories/19914
CVE-2006-4313
Multiple unspecified vulnerabilities in Cisco VPN 3000 series concentrators before 4.1, 4.1.x up to 4.1(7)L, and 4.7.x up to 4.7(2)F allow attackers to execute the (1) CWD, (2) MKD, (3) CDUP, (4) RNFR, (5) SIZE, and (6) RMD FTP commands to modify files or create and delete directories via unknown vectors.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: vpn_3000_concentrator_series_software
References: http://secunia.com/advisories/21617, http://securitytracker.com/id?1016737, http://www.cisco.com/warp/public/707/cisco-sa-20060823-vpn3k.shtml
CVE-2006-3329
SQL injection vulnerability in search.php in PHP/MySQL Classifieds (PHP Classifieds) allows remote attackers to execute arbitrary SQL commands via the rate parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php_classifieds
References: http://securityreason.com/securityalert/1179, http://securitytracker.com/id?1016407, http://www.securityfocus.com/archive/1/438667/100/0/threaded
CVE-2006-3411
TLS handshakes in Tor before 0.1.1.20 generate public-private keys based on TLS context rather than the connection, which makes it easier for remote attackers to conduct brute force attacks on the encryption keys.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: tor
References: http://secunia.com/advisories/20514, http://security.gentoo.org/glsa/glsa-200606-04.xml, http://tor.eff.org/cvs/tor/ChangeLog
CVE-2006-6494
Directory traversal vulnerability in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via a .. (dot dot) sequence in the LANG environment variable that points to a locale file containing attacker-controlled format string specifiers.
CVSS v2.0 Score: 6.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C
Affected Products: sunos, solaris
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=449, http://secunia.com/advisories/23317, http://securitytracker.com/id?1017376
CVE-2006-0199
SQL injection vulnerability in news.asp in Mini-Nuke CMS System 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the hid parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cms_system
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0439.html, http://secunia.com/advisories/18439, http://securityreason.com/securityalert/340
CWE: CWE-89
CVE-2006-5320
Directory traversal vulnerability in getimg.php in Album Photo Sans Nom 1.6 allows remote attackers to read arbitrary files via the img parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: album_photo_sans_nom
References: http://acid-root.new.fr/poc/13061007.txt, http://secunia.com/advisories/22375, http://www.attrition.org/pipermail/vim/2006-December/001193.html
CVE-2006-1474
Cross-site scripting (XSS) vulnerability in the "failed" functionality in Raindance Web Conferencing Pro allows remote attackers to inject arbitrary web script or HTML via the browser parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: web_conferencing_pro
References: http://www.securityfocus.com/archive/1/428971/100/0/threaded, http://www.securityfocus.com/archive/1/428971/100/0/threaded
CVE-2006-3018
Unspecified vulnerability in the session extension functionality in PHP before 5.1.3 has unknown impact and attack vectors related to heap corruption.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php
References: http://secunia.com/advisories/19927, http://secunia.com/advisories/21050, http://secunia.com/advisories/21125
CVE-2006-3312
Multiple cross-site scripting (XSS) vulnerabilities in ashmans and Bill Echlin QaTraq 6.5 RC and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) link_print, (2) link_upgrade, (3) link_sql, (4) link_next, (5) link_prev, and (6) link_list parameters in top.inc as included by queries_view_search.php; the (7) msg, (8) component_name, and (9) component_desc parameters in (a) components_copy_content.php, (b) components_modify_content.php, and (c) components_new_content.php; the (10) title, (11) version, and (12) content parameters in design_copy_content.php; the (13) plan_title and (14) plan_content parameters in design_copy_plan_search.php; the (15) title, (16) minor_version, (17) new_version, and (18) content parameters in design_modify_content.php; the (19) title, (20) version, and (21) content parameters in design_new_content.php; the (22) plan_name and (23) plan_desc parameters in design_new_search.php; the (24) file_name parameter in download.php; the (25) username and (26) password parameters in login.php; the (27) title, (28) version, and (29) content parameters in phase_copy_content.php; the (30) content parameter in phase_delete_search.php; the (31) title, (32) minor_version, (33) new_version, and (34) content parameters in phase_modify_content.php; the (35) content, (36) title, (37) version, and (38) content parameters in phase_modify_search.php; the (39) content parameter in phase_view_search.php; the (40) msg, (41) product_name, and (42) product_desc parameters in products_copy_content.php; and possibly the (43) product_name and (44) product_desc parameters in (d) products_copy_search.php, and a large number of additional parameters and executables.  NOTE: the vendor notified CVE via e-mail that this issue has been fixed in the 6.8 RC release.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: qatraq
References: http://seclab.tuwien.ac.at/advisories/TUVSA-0606-001.txt, http://securityreason.com/securityalert/1169, http://securitytracker.com/id?1016381
CVE-2006-3172
Multiple PHP remote file inclusion vulnerabilities in Content*Builder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL with a trailing slash (/) character in the (1) lang_path parameter to (a) cms/plugins/col_man/column.inc.php, (b) cms/plugins/poll/poll.inc.php, (c) cms/plugins/user_managment/usrPortrait.inc.php, (d) cms/plugins/user_managment/user.inc.php, (e) cms/plugins/media_manager/media.inc.php, (f) cms/plugins/events/permanent.eventMonth.inc.php, (g) cms/plugins/events/events.inc.php, and (h) cms/plugins/newsletter2/newsletter.inc.php; (2) path[cb] parameter to (i) modules/guestbook/guestbook.inc.php, (j) modules/shoutbox/shoutBox.php, and (k) modules/sitemap/sitemap.inc.php; and the (3) rel parameter to (l) modules/download/overview.inc.php, (m) modules/download/detailView.inc.php, (n) modules/article/fullarticle.inc.php, (o) modules/article/comments.inc.php, (p) modules/article2/overview.inc.php, (q) modules/article2/fullarticle.inc.php, (r) modules/article2/comments.inc.php, (s) modules/headline/headlineBox.php, and (t) modules/headline/showHeadline.inc.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: content\*builder
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://marc.info/?l=bugtraq&m=115016951316696&w=2, http://secunia.com/advisories/20557, http://www.osvdb.org/26344
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2006-6547
Buffer overflow in the readAA function in read_aa.cpp in Winamp iPod Plugin (ml_ipod) 2.00 p19 and earlier allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long tag in an audible.com audiobook (aa) file.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: winamp_ipod_plugin
References: http://aluigi.altervista.org/adv/mlipodbof-adv.txt, http://mlipod.cvs.sourceforge.net/mlipod/ml_ipod/read_aa.cpp, http://mlipod.cvs.sourceforge.net/mlipod/ml_ipod/read_aa.cpp?r1=1.3.6.1&r2=1.3.6.2
CVE-2006-5112
Buffer overflow in InterVations NaviCOPA Web Server 2.01 allows remote attackers to execute arbitrary code via a long HTTP GET request.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: navicopa_web_server
References: http://secunia.com/advisories/22124, http://www.kb.cert.org/vuls/id/693992, http://www.securityfocus.com/bid/20250
CVE-2006-7072
Cross-site scripting (XSS) vulnerability in GeoClassifieds Enterprise 2.0.5.2 and earlier allows remote attackers to inject arbitrary web script and HTML via the (1) b[username] and (2) c parameters to (a) index.php, the b[username] parameter to (b) admin/index.php, and (3) c[phone] parameter to register.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: geoclassifieds_enterprise
References: http://secunia.com/advisories/21237, http://securityreason.com/securityalert/2324, http://www.osvdb.org/27630
CVE-2006-2664
Cross-site scripting (XSS) vulnerability in iFdate 1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) username, (2) password fields, or certain other input text boxes.
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Affected Products: ifdate
References: http://secunia.com/advisories/20287, http://securityreason.com/securityalert/991, http://www.osvdb.org/25778
CVE-2006-5039
Unspecified vulnerability in Events 1.3 beta module (com_events) for Joomla! has unspecified impact and attack vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: events_module, com_events
References: http://forum.joomla.org/index.php/topic%2C79477.0.html, http://forum.joomla.org/index.php/topic%2C80411.0.html, http://forum.joomla.org/index.php/topic%2C79477.0.html
CVE-2006-0404
Note-A-Day Weblog 2.2 stores sensitive data under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to archive/.phpass-admin, which contains encrypted passwords.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: note-a-day_weblog
References: http://archives.neohapsis.com/archives/bugtraq/2006-01/0389.html, http://evuln.com/vulns/44/summary.html, http://secunia.com/advisories/18566
CVE-2006-5428
rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a display_get_requesters operation, which allows remote attackers to bypass the GUI login and obtain sensitive information (ticket data) via a direct request.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: cerberus_helpdesk
References: http://forum.cerberusweb.com/showthread.php?t=7922, http://secunia.com/advisories/22418, http://www.securityfocus.com/bid/20598
CVE-2006-0070
Drupal allows remote attackers to conduct cross-site scripting (XSS) attacks via an IMG tag with an unusual encoded Javascript function name, as demonstrated using variations of the alert() function.  NOTE: a followup by the vendor suggests that the issue does not exist in 4.5.6 or 4.6.4 when "Filtered HTML" is enabled, and since "Full HTML" would not filter HTML by design, perhaps this should not be included in CVE
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: drupal
References: http://www.securityfocus.com/archive/1/420671/100/0/threaded, http://www.securityfocus.com/archive/1/420683/100/0/threaded, http://www.securityfocus.com/archive/1/420671/100/0/threaded
CVE-2006-3704
Unspecified vulnerability in the Oracle ODBC Driver for Oracle Database 10.1.0.4 has unknown impact and attack vectors, aka Oracle Vuln# 10.1.0.4.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: database_server
References: http://secunia.com/advisories/21111, http://secunia.com/advisories/21165, http://securitytracker.com/id?1016529
CVE-2006-0974
Cross-site scripting (XSS) vulnerability in failure.asp in Battleaxe bttlxeForum 2.0 allows remote attackers to inject arbitrary web script or HTML via the err_txt parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: bttlxeforum
References: http://archives.neohapsis.com/archives/bugtraq/2006-02/0548.html, http://secunia.com/advisories/19043, http://www.osvdb.org/23540
CVE-2006-4899
The ePPIServlet script in Computer Associates (CA) eTrust Security Command Center 1.0 and r8 up to SP1 CR2, when running on Windows, allows remote attackers to obtain the web server path via a "'" (single quote) in the PIProfile function, which leaks the path in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: etrust_security_command_center
References: http://secunia.com/advisories/22023, http://securitytracker.com/id?1016910, http://users.tpg.com.au/adsl2dvp/advisories/200608-computerassociates.txt
CVE-2006-3818
Cross-site scripting (XSS) vulnerability in the login page in Novell GroupWise WebAccess 6.5 before 20060721 and WebAccess 7 before 20060727 allows remote attackers to inject arbitrary web script or HTML via the GWAP.version parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: groupwise_webaccess
References: http://secunia.com/advisories/21411, http://securitytracker.com/id?1016648, http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974176.htm
CVE-2006-2799
Cross-site scripting (XSS) vulnerability in content_footer.php in toendaCMS 0.7.0 allows remote attackers to inject arbitrary web scripts or HTML via the print_url variable.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party sources.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: toendacms
References: http://secunia.com/advisories/20391, http://www.securityfocus.com/bid/18207, http://www.vupen.com/english/advisories/2006/2081
CVE-2006-3435
PowerPoint in Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac does not properly parse the slide notes field in a document, which allows remote user-assisted attackers to execute arbitrary code via crafted data in this field, which triggers an erroneous object pointer calculation that uses data from within the document. NOTE: this issue is different than other PowerPoint vulnerabilities including CVE-2006-4694.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: office
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://securitytracker.com/id?1017030, http://www.kb.cert.org/vuls/id/187028, http://www.osvdb.org/29446
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2006-0198
Cross-site scripting (XSS) vulnerability in a certain module, possibly poll or Pool, for XOOPS allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an IMG element in a comment.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: xoops_pool_module
References: http://www.securityfocus.com/archive/1/421325/100/0/threaded, http://www.securityfocus.com/bid/16189, http://www.xoops.org/modules/newbb/viewtopic.php?topic_id=45637&forum=2&post_id=200481
CVE-2006-5185
Eval injection vulnerability in Template.php in HAMweather 3.9.8.4 and earlier allows remote attackers to execute arbitrary code via a modified query string, which is supplied to an eval function call within the do_parse_code function.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: hamweather
References: http://secunia.com/advisories/22242, http://support.hamweather.com/viewtopic.php?t=6548, http://www.gulftech.org/?node=research&article_id=00115-09302006
CVE-2006-6972
SQL injection in torrents.php in BtitTracker 1.3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) by and (2) order parameters.  NOTE: it is not clear whether this issue is exploitable.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: btitracker
References: http://attrition.org/pipermail/vim/2006-June/000894.html, http://pridels0.blogspot.com/2006/06/btittracker-sql-injection-vuln.html, http://secunia.com/advisories/20753
CVE-2006-5669
PHP remote file inclusion vulnerability in gestion/savebackup.php in Gepi 1.4.0 and earlier, and possibly other versions before 1.4.4, allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: gepi
References: http://www.attrition.org/pipermail/vim/2006-November/001104.html, http://www.securityfocus.com/bid/20830, https://exchange.xforce.ibmcloud.com/vulnerabilities/29921
CVE-2006-3193
Multiple PHP remote file inclusion vulnerabilities in Grayscale BandSite CMS 1.1.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) includes/content/contact_content.php; multiple files in adminpanel/includes/add_forms/ including (2) addbioform.php, (3) addfliersform.php, (4) addgenmerchform.php, (5) addinterviewsform.php, (6) addlinksform.php, (7) addlyricsform.php, (8) addmembioform.php, (9) addmerchform.php, (10) addmerchpicform.php, (11) addnewsform.php, (12) addphotosform.php, (13) addreleaseform.php, (14) addreleasepicform.php, (15) addrelmerchform.php, (16) addreviewsform.php, (17) addshowsform.php, (18) addwearmerchform.php; (19) adminpanel/includes/mailinglist/disphtmltbl.php, and (20) adminpanel/includes/mailinglist/dispxls.php.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: bandsite_cms
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://secunia.com/advisories/20768, http://sourceforge.net/project/shownotes.php?release_id=428062, http://www.osvdb.org/27233
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2006-0875
Cross-site scripting vulnerability in ratefile.php in RunCMS 1.3a5 allows remote attackers to inject arbitrary web script or HTML via the lid parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: runcms
References: http://kapda.ir/advisory-267.html, http://secunia.com/advisories/18997, http://securitytracker.com/id?1015663
CVE-2006-1115
nCipher HSM before 2.22.6, when generating a Diffie-Hellman public/private key pair without any specified DiscreteLogGroup parameters, chooses random parameters that could allow an attacker to crack the private key in significantly less time than a brute force attack.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N
Affected Products: ncipher_software_cd, chil, mscapi_csp
References: http://secunia.com/advisories/19137, http://securitytracker.com/id?1015719, http://www.ncipher.com/resources/95/sa12_insecure_generation_of_diffiehellman_keys
CVE-2006-4839
Sophos Anti-Virus 5.1 allows remote attackers to cause a denial of service (memory consumption) via a file that is compressed with Petite and contains a large number of sections.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: sophos_anti-virus
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=438, http://secunia.com/advisories/22635, http://securitytracker.com/id?1017132
CVE-2006-3718
Multiple unspecified vulnerabilities in Oracle Exchange for Oracle E-Business Suite and Applications 6.2.4 have unknown impact and attack vectors, aka Oracle Vuln# (1) APPS16 and (2) APPS17.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: exchange
References: http://secunia.com/advisories/21111, http://secunia.com/advisories/21165, http://securitytracker.com/id?1016529
CVE-2006-2964
Multiple PHP remote file inclusion vulnerabilities in Xtreme Scripts Download Manager (aka Xtreme Downloads) 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter in (1) download.php, (2) manager.php, (3) admin/scripts/category.php, (4) includes/add_allow.php, (5) admin/index.php, and (6) admin/admin/login.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: download_manager
References: http://securityreason.com/securityalert/1072, http://www.osvdb.org/26643, http://www.osvdb.org/26644
CVE-2006-4479
Cross-site scripting (XSS) vulnerability in loginreq2.php in Visual Shapers ezContents 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the subgroupname parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: ezcontents
References: http://secunia.com/advisories/21703, http://securityreason.com/securityalert/1479, http://securitytracker.com/id?1016770
CVE-2006-0383
IPSec when used with VPN networks in Mac OS X 10.4 through 10.4.5 allows remote attackers to cause a denial of service (application crash) via unspecified vectors involving the "incorrect handling of error conditions".
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: mac_os_x_server, mac_os_x
References: http://docs.info.apple.com/article.html?artnum=303382, http://lists.apple.com/archives/security-announce/2006/Mar/msg00000.html, http://secunia.com/advisories/19064
CVE-2006-0520
SQL injection vulnerability index.php in Dragoran Portal module 1.3 for Invision Power Board (IPB) allows remote attackers to execute arbitrary SQL commands via the site parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: portal_module
References: http://secunia.com/advisories/18664, http://www.osvdb.org/22851, http://www.securityfocus.com/bid/16447
CVE-2006-7184
Multiple PHP remote file inclusion vulnerabilities in Exhibit Engine (EE) 1.22, and possibly earlier, allow remote attackers to execute arbitrary PHP code via a URL in the toroot parameter to (1) fetchsettings.php or (2) fstyles.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: exhibit_engine_2
References: http://www.securityfocus.com/bid/20793, http://www.securityfocus.com/bid/20793
CVE-2006-6164
The _dl_unsetenv function in loader.c in the ELF ld.so in OpenBSD 3.9 and 4.0 does not properly remove duplicate environment variables, which allows local users to pass dangerous variables such as LD_PRELOAD to loading processes, which might be leveraged to gain privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: openbsd
References: http://secunia.com/advisories/22993, http://securitytracker.com/id?1017253, http://www.matasano.com/log/592/finger-79tcp-mcdonald-dowd-and-schuh-challenge-part-2/
CVE-2006-1258
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.1 allows remote attackers to inject arbitrary web script or HTML via the set_theme parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: phpmyadmin
References: http://secunia.com/advisories/19277, http://securitytracker.com/id?1015776, http://www.osvdb.org/23943
CVE-2006-3403
The smdb daemon (smbd/service.c) in Samba 3.0.1 through 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of share connection requests.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: samba
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc, http://docs.info.apple.com/article.html?artnum=304829, http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html
CVE-2006-2237
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: awstats
References: http://awstats.sourceforge.net/awstats_security_news.php, http://secunia.com/advisories/19969, http://secunia.com/advisories/20170
CVE-2006-2796
Cross-site scripting (XSS) vulnerability in gallery.php in Captivate 1.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter, which is reflected in an error message.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: captivate
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0413.html, http://securityreason.com/securityalert/1020, http://www.securityfocus.com/bid/18072
CWE: CWE-79
CVE-2006-4181
Format string vulnerability in the sqllog function in the SQL accounting code for radiusd in GNU Radius 1.2 and 1.3 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: radius
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=443, http://secunia.com/advisories/23087, http://security.gentoo.org/glsa/glsa-200612-17.xml
CVE-2006-4340
Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates, a similar vulnerability to CVE-2006-4339.  NOTE: on 20061107, Mozilla released an advisory stating that these versions were not completely patched by MFSA2006-60. The newer fixes for 1.5.0.7 are covered by CVE-2006-5462.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N
Affected Products: thunderbird, network_security_services, seamonkey, firefox
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc, http://secunia.com/advisories/21903, http://secunia.com/advisories/21906
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2006-0308
PHP remote file inclusion vulnerability in htmltonuke.php in the htmltonuke 2.0 alpha, and possibly other versions, module for PHP-Nuke allows remote attackers to execute arbitrary PHP code via a URL in the filnavn parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: htmltonuke
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://www.securityfocus.com/bid/16282, https://exchange.xforce.ibmcloud.com/vulnerabilities/33092, https://www.exploit-db.com/exploits/3524
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2006-1649
The "restore to" selection in the "quarantine a file" capability of ESET NOD32 before 2.51.26 allows a restore to any directory that permits read access by the invoking user, which allows local users to create new files despite write-access directory permissions.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: nod32_antivirus
References: http://secunia.com/advisories/19054, http://securityreason.com/securityalert/672, http://securitytracker.com/id?1015867
CVE-2006-4128
Multiple heap-based buffer overflows in Symantec VERITAS Backup Exec for Netware Server Remote Agent for Windows Server 9.1 and 9.2 (all builds), Backup Exec Continuous Protection Server Remote Agent for Windows Server 10.1 (builds 10.1.325.6301, 10.1.326.1401, 10.1.326.2501, 10.1.326.3301, and 10.1.327.401), and Backup Exec for Windows Server and Remote Agent 9.1 (build 9.1.4691), 10.0 (builds 10.0.5484 and 10.0.5520), and 10.1 (build 10.1.5629) allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted RPC message.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: backup_exec
References: http://secunia.com/advisories/21472, http://securityreason.com/securityalert/1380, http://securityresponse.symantec.com/avcenter/security/Content/2006.08.11.html
CVE-2006-2014
Directory traversal vulnerability in gallerie.php in SL_site 1.0 allows remote attackers to list images in arbitrary directories via ".." sequences in the rep parameter, which is used to construct a directory name in admin/config.inc.php.  NOTE: this issue could be used to produce resultant XSS from an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: sl_site
References: http://secunia.com/advisories/19792, http://securitytracker.com/id?1015972, http://www.osvdb.org/24897
CVE-2006-2205
The audio_write function in NetBSD 3.0 allows local users to cause a denial of service (kernel crash) by using the audiosetinfo ioctl to change the sample rate of an audio device.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: netbsd
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-014.txt.asc, http://securitytracker.com/id?1016004, http://www.osvdb.org/25086
CVE-2006-1077
Multiple cross-site scripting (XSS) vulnerabilities in the commentary in Evo-Dev evoBlog allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter and (2) other unspecified parameters.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: evoblog
References: http://securityreason.com/securityalert/544, http://www.osvdb.org/23826, http://www.securityfocus.com/archive/1/426826/100/0/threaded
CVE-2006-3301
Multiple cross-site scripting (XSS) vulnerabilities in phpQLAdmin 2.2.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the domain parameter in (1) user_add.php or (2) unit_add.php.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected Products: phpqladmin
References: http://pridels0.blogspot.com/2006/06/phpqladmin-vuln.html, http://secunia.com/advisories/20788, http://www.securityfocus.com/bid/18658
CVE-2006-7043
Multiple cross-site scripting (XSS) vulnerabilities in Chipmunk Blogger allow remote authenticated users to inject arbitrary web script or HTML via script tags in (1) posts and (2) profile names; and (3) a javascript URI in a URL argument in the photo gallery.
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: chipmunk_blogger
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0104.html, http://securityreason.com/securityalert/2306, http://www.securityfocus.com/bid/17862
CVE-2006-1974
SQL injection vulnerability in index.php in MyBB (MyBulletinBoard) before 1.04 allows remote attackers to execute arbitrary SQL commands via the referrer parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mybulletinboard
References: http://www.securityfocus.com/bid/16443, http://www.securityfocus.com/bid/16443/exploit, http://www.securityfocus.com/bid/16443
CVE-2006-4732
Unspecified vulnerability in Microsoft Visual Basic (VB) 6 has an unknown impact ("overflow") via a project that contains a certain Click event procedure, as demonstrated using the msgbox function and the VB.Label object.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: visual_basic
References: http://securityreason.com/securityalert/1547, http://silversmith.persiangig.com/PoC.rar, http://www.securityfocus.com/archive/1/445784/100/0/threaded
CVE-2006-4072
Multiple SQL injection vulnerabilities in Club-Nuke [XP] 2.0 LCID 2048 allow remote attackers to execute arbitrary SQL commands via the (1) haber_id parameter to haber_detay.asp, and allow remote authenticated users to execute arbitrary SQL commands via the (2) menu_id parameter to menu.asp.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: club-nuke
References: http://secunia.com/advisories/21431, http://www.securityfocus.com/bid/19442, http://www.vupen.com/english/advisories/2006/3228
CVE-2006-3581
Multiple stack-based buffer overflows in Audacious AdPlug 2.0 and earlier allow remote user-assisted attackers to execute arbitrary code via large (1) DTM and (2) S3M files.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: adplug
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://adplug.cvs.sourceforge.net/adplug/adplug/src/dtm.cpp?view=log#rev1.17, http://aluigi.altervista.org/adv/adplugbof-adv.txt, http://secunia.com/advisories/20972
CWE: CWE-119
CVE-2006-0486
Certain Cisco IOS releases in 12.2S based trains with maintenance release number 25 and later, 12.3T based trains, and 12.4 based trains reuse a Tcl Shell process across login sessions of different local users on the same terminal if the first user does not use tclquit before exiting, which may cause subsequent local users to execute unintended commands or bypass AAA command authorization checks, aka Bug ID CSCef77770.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ios
References: http://secunia.com/advisories/18613, http://securitytracker.com/id?1015543, http://www.cisco.com/warp/public/707/cisco-response-20060125-aaatcl.shtml
CVE-2006-0519
SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to obtain sensitive information via a direct request to inc-messforum.php3, which reveals the path in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: spip
References: http://secunia.com/advisories/18676, http://www.vupen.com/english/advisories/2006/0398, http://www.zone-h.org/en/advisories/read/id=8650/
CVE-2006-7023
Multiple cross-site scripting (XSS) vulnerabilities in fx-APP 0.0.8.1 allow remote attackers to inject arbitrary HTML or web script via (1) the search box, and the (2) url, (3) website, (4) comment, and (5) signature fields in the profile, and possibly (6) a menu item.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: fx-app
References: http://securityreason.com/securityalert/2251, http://www.securityfocus.com/archive/1/436691/30/4500/threaded, http://www.securityfocus.com/archive/1/469825/100/100/threaded
CVE-2006-6955
Opera allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nested marquee tags, a related issue to CVE-2006-2723.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: opera_browser
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0085.html, https://exchange.xforce.ibmcloud.com/vulnerabilities/26898, http://archives.neohapsis.com/archives/bugtraq/2006-06/0085.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2006-4163
PHP remote file inclusion vulnerability in cls_fast_template.php in myWebland miniBloggie 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the fname parameter.  NOTE: another researcher was unable to find a way to execute code after including it via a URL.  CVE analysis as of 20060816 was inconclusive
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: minibloggie
References: http://www.securityfocus.com/archive/1/442966/100/0/threaded, http://www.securityfocus.com/archive/1/443160/100/0/threaded, http://www.securityfocus.com/bid/19476
CVE-2006-4980
Buffer overflow in the repr function in Python 2.3 through 2.6 before 20060822 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via crafted wide character UTF-32/UCS-4 strings to certain scripts.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: python
References: ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc, http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=391589, http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=208162
CVE-2006-6618
AntiHook 3.0.0.23 - Desktop relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process by spoofing the (1) ImagePathName, (2) CommandLine, and (3) WindowTitle fields in the PEB.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sygate_personal_firewall, antivirus_plus_firewall, personal_firewall, comodo_personal_firewall, antihook
References: http://www.matousec.com/downloads/windows-personal-firewall-analysis/ex-coat.zip, http://www.matousec.com/info/advisories/Bypassing-process-identification-serveral-personal-firewalls-HIPS.php, http://www.securityfocus.com/archive/1/454522/100/0/threaded
CVE-2006-0637
Buffer overflow in cram.dll in QUALCOMM Eudora WorldMail 3.0 allows remote attackers to execute arbitrary code via an IMAP APPEND command with a long message literal argument, as demonstrated by Worldmail.pl. NOTE: this is a different vector and a different manipulation than CVE-2005-4267, so it might be a different vulnerability than CVE-2005-4267.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: eudora_worldmail
References: http://www.securityfocus.com/archive/1/424157/100/0/threaded, http://www.securityfocus.com/archive/1/424157/100/0/threaded
CVE-2006-2704
Secure Elements Class 5 AVR server and client (aka C5 EVM) before 2.8.1 send messages in cleartext, which allows remote attackers to read sensitive vulnerability information.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: c5_enterprise_vulnerability_management
References: http://secunia.com/advisories/20378, http://securitytracker.com/id?1016184, http://www.kb.cert.org/vuls/id/135529
CVE-2006-0028
Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via a BIFF parsing format file containing malformed BOOLERR records that lead to memory corruption, probably involving invalid pointers.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: excel, office
References: http://secunia.com/advisories/19138, http://secunia.com/advisories/19238, http://securityreason.com/securityalert/583
CVE-2006-3209
The Task scheduler (at.exe) on Microsoft Windows XP spawns each scheduled process with SYSTEM permissions, which allows local users to gain privileges.  NOTE: this issue has been disputed by third parties, who state that the Task scheduler is limited to the Administrators group by default upon installation
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_xp
References: http://securityreason.com/securityalert/1137, http://www.securityfocus.com/archive/1/436810/100/200/threaded, http://www.securityfocus.com/archive/1/436884/100/200/threaded
CVE-2006-1283
opiepasswd in One-Time Passwords in Everything (OPIE) in FreeBSD 4.10-RELEASE-p22 through 6.1-STABLE before 20060322 uses the getlogin function to determine the invoking user account, which might allow local users to configure OPIE access to the root account and possibly gain root privileges if a root shell is permitted by the configuration of the wheel group or sshd.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: freebsd
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:12.opie.asc, http://secunia.com/advisories/19347, http://securitytracker.com/id?1015817
CVE-2006-5959
SQL injection vulnerability in browse.asp in A+ Store E-Commerce allows remote attackers to execute arbitrary SQL commands via the ParentID parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: a\+_store_e-commerce
References: http://archives.neohapsis.com/archives/bugtraq/2006-11/0248.html, http://secunia.com/advisories/22918/, http://securityreason.com/securityalert/1880
CVE-2006-2118
JMK's Picture Gallery allows remote attackers to bypass authentication via a direct request to admin_gallery.php3, possibly related to the add action.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: jmk_picture_gallery
References: http://securityreason.com/securityalert/821, http://www.securityfocus.com/archive/1/432575/100/0/threaded, http://www.securityfocus.com/bid/17755
CVE-2006-3592
Unspecified vulnerability in the command line interface (CLI) in Cisco Unified CallManager (CUCM) 5.0(1) through 5.0(3a) allows local users to execute arbitrary commands with elevated privileges via unspecified vectors, involving "certain CLI commands," aka bug CSCse11005.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: unified_callmanager
References: http://secunia.com/advisories/21030, http://securitytracker.com/id?1016475, http://www.cisco.com/warp/public/707/cisco-sa-20060712-cucm.shtml
CVE-2006-2273
The InstallProduct routine in the Verisign VUpdater.Install (aka i-Nav) ActiveX control does not verify Microsoft Cabinet (.CAB) files, which allows remote attackers to run an arbitrary executable file.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: i-nav
References: http://secunia.com/advisories/20074, http://securityreason.com/securityalert/878, http://securitytracker.com/id?1016059
CVE-2006-3687
Stack-based buffer overflow in the Universal Plug and Play (UPnP) service in D-Link DI-524, DI-604 Broadband Router, DI-624, D-Link DI-784, WBR-1310 Wireless G Router, WBR-2310 RangeBooster G Router, and EBR-2310 Ethernet Broadband Router allows remote attackers to execute arbitrary code via a long M-SEARCH request to UDP port 1900.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: di-624, wbr-1310_wireless_g_router, di-524, di-604_broadband_router, wbr-2310_rangebooster_g_router
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0363.html, http://secunia.com/advisories/21081, http://securitytracker.com/id?1016511
CVE-2006-0529
Computer Associates (CA) Message Queuing (CAM / CAFT) before 1.07 Build 220_16 and 1.11 Build 29_20, as used in multiple CA products, allows remote attackers to cause a denial of service via a crafted message to TCP port 4105.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: messaging
References: http://secunia.com/advisories/18681, http://securitytracker.com/id?1015571, http://supportconnectw.ca.com/public/ca_common_docs/camessagsecurity_notice.asp
CVE-2006-6031
Multiple SQL injection vulnerabilities in Greater Cincinnati Internet Solutions (GCIS) ASPCart allow remote attackers to execute arbitrary SQL commands via (1) the prodid parameter in (a) prodetails.asp; (2) the page parameter in (b) display.asp; the (3) custid, (4) item, (5) price, (6) custom, (7) department, (8) start, (9) quantity, (10) submit, (11) custom1, (12) custom2, or (13) custom3 parameters in (c) addcart.asp; or the (14) customerid parameter in (d) payment.asp.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: aspcart
References: http://secunia.com/advisories/22946, http://securityreason.com/securityalert/1899, http://www.securityfocus.com/archive/1/451858/100/0/threaded
CVE-2006-4619
The start update window in update.exe in Avira AntiVir PersonalEdition Classic 7.0 build 151 allows local users to gain system privileges via a "Shatter" style attack on the (1) IParam parameter, and the (2) PBM_GETRANGE and (3) PBM_SETRANGE messages in an unspecified progress bar.  NOTE: some details are obtained from third party information.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: antivir_personal
References: http://secunia.com/advisories/21764, http://www.securityfocus.com/archive/1/445205/100/0/threaded, http://www.securityfocus.com/archive/1/445263/100/0/threaded
CVE-2006-1232
Multiple SQL injection vulnerabilities in DSDownload 1.0, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) key and (2) category parameters to (a) search.php and (b) downloads.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: dsdownload
References: http://evuln.com/vulns/99/summary.html, http://secunia.com/advisories/19202, http://securityreason.com/securityalert/626
CVE-2006-5457
Multiple cross-site scripting (XSS) vulnerabilities in the registration form in Casinosoft Casino Script (Masvet) 3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) surname field.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: casino_script
References: http://www.securitylab.ru/forum/read.php?FID=16&TID=23884, http://www.securitylab.ru/forum/read.php?FID=16&TID=23884
CVE-2006-5778
ftpd in linux-ftpd 0.17, and possibly other versions, performs a chdir before setting the UID, which allows local users to bypass intended access restrictions by redirecting their home directory to a restricted directory.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: linux-ftpd-ssl
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384454, http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/049014.html, http://secunia.com/advisories/22997
CVE-2006-5274
Integer overflow in McAfee ePolicy Orchestrator 3.5 through 3.6.1, ProtectionPilot 1.1.1 and 1.5, and Common Management Agent (CMA) 3.5.5.438 allows remote attackers to cause a denial of service (CMA Framework service crash) and possibly execute arbitrary code via unspecified vectors.
CVSS v2.0 Score: 7.6 (HIGH)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Affected Products: epolicy_orchestrator, common_management_agent, protectionpilot
References: http://secunia.com/advisories/26029, http://www.iss.net/threats/269.html, http://www.osvdb.org/36101
CVE-2006-1929
PHP remote file inclusion vulnerability in include/common.php in I-Rater Platinum allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: i-rater_platinum
References: http://pridels0.blogspot.com/2006/04/i-rater-platinum-remote-file-inclusion.html, http://secunia.com/advisories/19684, http://www.osvdb.org/24777