DuyTa/cve-kgrag-db huggingface dataset:
CVE-2006-4251
Buffer overflow in PowerDNS Recursor 3.1.3 and earlier might allow remote attackers to execute arbitrary code via a malformed TCP DNS query that prevents Recursor from properly calculating the TCP DNS query length.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: recursor
References: http://doc.powerdns.com/powerdns-advisory-2006-01.html, http://lists.suse.com/archive/suse-security-announce/2006-Nov/0007.html, http://secunia.com/advisories/22824
CVE-2006-4919
Directory traversal vulnerability in starnet/editors/htmlarea/popups/images.php in Site@School (S@S) 2.4.02 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N
Affected Products: siteatschool
References: http://marc.info/?l=bugtraq&m=115869368313367&w=2, http://secunia.com/advisories/21975, http://securitytracker.com/id?1016887
CVE-2006-4276
PHP remote file inclusion vulnerability in Tutti Nova 1.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the TNLIB_DIR parameter to novalib/class.novaEdit.mysql.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: tutti_nova
References: http://secunia.com/advisories/21572, http://www.osvdb.org/28028, http://www.securityfocus.com/bid/19612
CVE-2006-3670
Stack-based buffer overflow in Winlpd 1.26 allows remote attackers to execute arbitrary code via a long string in a request to TCP port 515.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: winlpd
References: http://foro.elhacker.net/index.php/topic%2C131756.htm, http://secunia.com/advisories/21058, http://securitytracker.com/id?1016510
CVE-2006-3275
SQL injection vulnerability in profile.php in YaBB SE 1.5.5 and earlier allows remote attackers to execute SQL commands via a double-encoded user parameter in a viewprofile action.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: yabb
References: http://marc.info/?l=full-disclosure&m=115102378824221&w=2, http://secunia.com/advisories/20780, http://www.securityfocus.com/bid/18625
CVE-2006-6758
Directory traversal vulnerability in Http explorer 1.02 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the URI.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: http_explorer_web_server
References: http://securitytracker.com/id?1017432, http://www.securityfocus.com/bid/21712, http://www.vupen.com/english/advisories/2006/5128
CVE-2006-1328
SQL injection vulnerability in count.php in Skull-Splitter PHP Downloadcounter for Wallpapers 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) count_fieldname, (2) url_fieldname, or (3) url parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: download_counter_wallpaper
References: http://evuln.com/vulns/105/summary.html, http://secunia.com/advisories/19314, http://securityreason.com/securityalert/649
CVE-2006-2751
Cross-site scripting (XSS) vulnerability in Open Searchable Image Catalogue (OSIC) 0.7.0.1 and earlier allows remote attackers to inject arbitrary web scripts or HTML via the item_list parameter in search.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: open_searchable_image_catalogue
References: http://securityreason.com/securityalert/1014, http://sourceforge.net/forum/forum.php?forum_id=576483, http://svn.sourceforge.net/viewcvs.cgi/osic-win/branches/osic_0-7/osic/search.php?view=markup&rev=477
CVE-2006-4480
Incomplete blacklist vulnerability in the nk_CSS function in nuked.php in Nuked-Klan 1.7 SP4.3 allows remote attackers to bypass anti-XSS features and inject arbitrary web script or HTML via JavaScript in an attribute value that is not in the blacklist, as demonstrated using the STYLE attribute of a B element.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: nuked-klan
References: http://securityreason.com/securityalert/1478, http://www.securityfocus.com/archive/1/444749/100/0/threaded, http://securityreason.com/securityalert/1478
CVE-2006-5202
Linksys WRT54g firmware 1.00.9 does not require credentials when making configuration changes, which allows remote attackers to modify arbitrary configurations via a direct request to Security.tri, as demonstrated using the SecurityMode and layout parameters, a different issue than CVE-2006-2559.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: wrt54g
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048495.html, http://secunia.com/advisories/21372, http://securitytracker.com/id?1016638
CVE-2006-6989
Cross-domain vulnerability in NetCaptor 4.5.7 Personal Edition allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
Affected Products: netcaptor
References: http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html, http://pridels0.blogspot.com/2006/06/multiple-browsers-information.html
CVE-2006-4298
Multiple directory traversal vulnerabilities in cache.php in osCommerce before 2.2 Milestone 2 060817 allow remote attackers to determine existence of arbitrary files and disclose the installation path via a .. (dot dot) in unspecified parameters in the (1) tep_cache_also_purchased, (2) tep_cache_manufacturers_box, and (3) tep_cache_categories_box functions.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: oscommerce
References: http://forums.oscommerce.com/index.php?showtopic=223556&pid=918371, http://www.gulftech.org/?node=research&article_id=00110-08172006, https://exchange.xforce.ibmcloud.com/vulnerabilities/28435
CVE-2006-7132
Directory traversal vulnerability in pmd-config.php in PHPMyDesk 1.0beta allows remote attackers to include arbitrary local files via the pmdlang parameter to viewticket.php.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: phpmydesk
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/29872, https://www.exploit-db.com/exploits/2664, https://exchange.xforce.ibmcloud.com/vulnerabilities/29872
CVE-2006-3825
The IPv4 implementation in Sun Solaris 10 before 20060721 allows local users to select routes that differ from the routing table, possibly facilitating firewall bypass or unauthorized network communication.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: solaris
References: http://secunia.com/advisories/21163, http://sunsolve.sun.com/search/document.do?assetkey=1-26-102509-1, http://www.securityfocus.com/bid/19108
CVE-2006-7163
DreameeSoft Password Master 1.0 stores the database in an unencrypted format when the master password is set, which allows attackers with physical access to read the database contents via an unspecified authentication bypass.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: password_master
References: http://www.securityfocus.com/bid/19983, http://www.securityfocus.com/bid/19983
CVE-2006-5554
Directory traversal vulnerability in index.php in Imageview 5 allows remote attackers to read or execute arbitrary local files via a .. (dot dot) in the user_settings cookie, as demonstrated by using the MyFile parameter in albumview.php to upload a text/plain .gif file containing PHP code, which is executed by index.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: imageview
References: http://secunia.com/advisories/22552, http://www.securityfocus.com/bid/20731, http://www.vupen.com/english/advisories/2006/4188
CVE-2006-2037
Cross-site scripting (XSS) vulnerability in index.php in Thwboard 3.0 Beta 2.84 allows remote attackers to inject arbitrary web script or HTML via the navpath parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: thwboard
References: http://www.securityfocus.com/archive/1/431509/100/0/threaded, http://www.securityfocus.com/bid/17627, https://exchange.xforce.ibmcloud.com/vulnerabilities/25953
CVE-2006-5488
SQL injection vulnerability in XchangeBoard 1.70, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the loginNick parameter during login.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xchangeboard
References: http://secunia.com/advisories/22489, http://www.osvdb.org/29898, http://www.securityfocus.com/bid/20643
CVE-2006-2127
SQL injection vulnerability in weblog_posting.php in Blog Mod 0.2.x allows remote attackers to execute arbitrary SQL commands via the r parameter.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: blog_mod
References: http://securityreason.com/securityalert/810, http://www.securityfocus.com/archive/1/432602/100/0/threaded, http://www.securityfocus.com/bid/17744
CVE-2006-0859
Michael Salzer Guestbox 0.6, and other versions before 0.8, allows remote attackers to post an admin comment to a guestbook entry via a certain modified form, possibly related to the nummer parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: guestbox
Related CWEs: CWE-264
References: http://secunia.com/advisories/18946, http://www.osvdb.org/23374, http://www.securityfocus.com/archive/1/425495/100/0/threaded
CWE: CWE-264
CVE-2006-0430
Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are enabled, cause the server to run more slowly, which makes it easier for remote attackers to cause a denial of service (server slowdown).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: weblogic_server
References: http://dev2dev.bea.com/pub/advisory/174, http://secunia.com/advisories/18592, http://securitytracker.com/id?1015528
CVE-2006-1394
Multiple cross-site scripting (XSS) vulnerabilities in the Microsoft IIS ISAPI filter (aka application server module) in University of Washington Pubcookie 3.1.0, 3.1.1, 3.2 before 3.2.1b, and 3.3 before 3.3.0a allow remote attackers to inject arbitrary web script or HTML via unspecified attack vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: pubcookie
References: http://pubcookie.org/news/20060306-apps-secadv.html, http://secunia.com/advisories/19348, http://www.kb.cert.org/vuls/id/314540
CVE-2006-1516
The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to read portions of memory via a username without a trailing null byte, which causes a buffer over-read.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mysql
References: http://bugs.debian.org/365938, http://dev.mysql.com/doc/refman/5.0/en/news-5-0-21.html, http://docs.info.apple.com/article.html?artnum=305214
CVE-2006-6864
PHP remote file inclusion vulnerability in E2_header.inc.php in Enigma2 Coppermine Bridge 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the boarddir parameter.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: coppermine_bridge
References: http://securityreason.com/securityalert/2092, http://securitytracker.com/id?1017459, http://www.attrition.org/pipermail/vim/2007-January/001208.html
CVE-2006-7038
Multiple buffer overflows in MERCUR Messaging 2005 before Service Pack 4 allow remote attackers to cause a denial of service (crash) via (1) "long command lines at port 32000" and (2) certain name service queries that are not properly handled by the SMTP service.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: mercur_messaging_2005
References: http://secunia.com/advisories/20432, http://www.atrium-software.com/download/McrReadMe_EN.html, http://www.securityfocus.com/bid/18462
CVE-2006-1061
Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL (tftp://) with a valid hostname and a long path.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: curl
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1326.html, http://curl.haxx.se/docs/adv_20060320.html, http://secunia.com/advisories/19271
CVE-2006-1294
PHP remote file include vulnerability in PageController.php in KnowledgebasePublisher 1.2 allows remote attackers to include and execute arbitrary PHP code via a URL in the dir parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: knowledgebasepublisher
References: http://secunia.com/advisories/19298, http://sourceforge.net/project/shownotes.php?release_id=402179&group_id=144153, http://www.osvdb.org/24002
CVE-2006-4321
PHP remote file inclusion vulnerability in cpg.php in the Coppermine Photo Gallery component (com_cpg) 1.0 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: coppermine_photo_gallery
References: http://secunia.com/advisories/21539, http://www.osvdb.org/27970, http://www.securityfocus.com/bid/19589
CVE-2006-5378
Unspecified vulnerability in JD Edwards HTML Server in JD Edwards EnterpriseOne SP23_O2, 8.95.P1, and 8.96.D1 has unknown impact and remote authenticated attack vectors, aka Vuln# JDE01.
CVSS v2.0 Score: 9.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Affected Products: enterpriseone
References: http://secunia.com/advisories/22396, http://securitytracker.com/id?1017077, http://www.oracle.com/technetwork/topics/security/cpuoct2006-095368.html
CVE-2006-4417
SQL injection vulnerability in edituser.php in Xoops before 2.0.15 allows remote attackers to execute arbitrary SQL commands via the user_avatar parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xoops
References: http://devteam.xoops.org/releases/changelog-2.0.15.html, http://secunia.com/advisories/21643, http://securityreason.com/securityalert/1461
CVE-2006-0266
Unspecified vulnerability in the Query Optimizer component of Oracle Database server 9.0.1.5, 9.2.0.7, and 10.1.0.5 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB19.
CVSS v2.0 Score: 9.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Affected Products: database_server
References: http://secunia.com/advisories/18493, http://secunia.com/advisories/18608, http://securitytracker.com/id?1015499
CVE-2006-4845
PHP remote file inclusion vulnerability in includes/footer.html.inc.php in TeamCal Pro 2.8.001 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the tc_config[app_root] parameter.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: teamcal_pro
References: http://secunia.com/advisories/21933, http://www.securityfocus.com/bid/20030, http://www.securityfocus.com/bid/20036
CVE-2006-5977
Multiple SQL injection vulnerabilities in MultiCalendars allow remote attackers to execute arbitrary SQL commands via the (1) M or (2) Y parameter to rss_out.asp, or the (3) cate parameter to all_calendars.asp.  NOTE: the all_calendars.asp/calsids vector is already covered by CVE-2006-2293.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: multicalendars
References: http://securityreason.com/securityalert/1883, http://www.securityfocus.com/archive/1/451642/100/0/threaded, https://exchange.xforce.ibmcloud.com/vulnerabilities/30301
CVE-2006-7152
default.asp in ASP-Nuke Community 1.5 and earlier allows remote attackers to gain privileges by setting certain pseudo cookie values.
CVSS v2.0 Score: 8.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C
Affected Products: asp-nuke
References: http://www.securityfocus.com/bid/21309, https://exchange.xforce.ibmcloud.com/vulnerabilities/30541, https://www.exploit-db.com/exploits/2849
CVE-2006-3180
Cross-site scripting (XSS) vulnerability in ftp_index.php in Confixx Pro 3.0 allows remote attackers to inject arbitrary web script or HTML via the path parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: confixx
References: http://archives.neohapsis.com/archives/bugtraq/2006-06/0383.html, http://secunia.com/advisories/20728, http://www.osvdb.org/26629
CVE-2006-3760
Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) 1.1.4 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mybulletinboard
References: http://community.mybboard.net/showthread.php?tid=10115, http://secunia.com/advisories/20873, http://www.mybboard.com/archive.php?nid=15
CVE-2006-4197
Multiple buffer overflows in libmusicbrainz (aka mb_client or MusicBrainz Client Library) 2.1.2 and earlier, and SVN 8406 and earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a long Location header by the HTTP server, which triggers an overflow in the MBHttp::Download function in lib/http.cpp; and (2) a long URL in RDF data, as demonstrated by a URL in an rdf:resource field in an RDF XML document, which triggers overflows in many functions in lib/rdfparse.c.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: libmusicbrainz_svn, libmusicbrainz
References: http://aluigi.altervista.org/adv/brainzbof-adv.txt, http://secunia.com/advisories/21404, http://secunia.com/advisories/21668
CVE-2006-3854
Buffer overflow in IBM Informix Dynamic Server (IDS) 9.40.TC7, 9.40.TC8, 10.00.TC4, and 10.00.TC5, when running on Windows, allows remote attackers to execute arbitrary code via a long username, which causes an overflow in vsprintf when displaying in the resulting error message.  NOTE: this issue is due to an incomplete fix for CVE-2006-3853.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: informix_dynamic_database_server
References: http://securityreason.com/securityalert/1409, http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf, http://www.securityfocus.com/archive/1/443133/100/0/threaded
CVE-2006-6144
The "mechglue" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: kerberos_5
References: http://fedoranews.org/cms/node/2375, http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html, http://osvdb.org/31280
CVE-2006-2547
Unspecified vulnerability in the sapdba command in SAP with Informix before 700, and 700 up to patch 100, allows local users to execute arbitrary commands via unknown vectors related to "insecure environment variable" handling.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sapdba
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046130.html, http://secunia.com/advisories/20180, http://securityreason.com/securityalert/941
CVE-2006-3916
Cross-site scripting (XSS) vulnerability in snews.php in sNews (aka Solucija News) 1.4 allows remote attackers to inject arbitrary web script or HTML via the search_query parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: snews
References: http://secunia.com/advisories/21189, http://security-net.biz/adv/D25706a.txt, http://www.osvdb.org/27481
CVE-2006-4050
PHP remote file inclusion vulnerability in auto_check_renewals.php in phpAutoMembersArea (phpAMA) 3.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the installed_config_file parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpautomembersarea
References: http://dwalker.co.uk/forum/viewtopic.php?t=517, http://secunia.com/advisories/21373, http://securityreason.com/securityalert/1352
CVE-2006-2552
Jemscripts DownloadControl 1.0 allows remote attackers to obtain sensitive information via an invalid dcid parameter to dc.php, which leaks the pathname in an error message.  NOTE: this was originally claimed to be SQL injection, but it is probably resultant from another issue in functions.php.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: downloadcontrol
References: http://securityreason.com/securityalert/943, http://www.osvdb.org/25716, http://www.securityfocus.com/archive/1/434533/100/0/threaded
CVE-2006-1303
Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: ie, internet_explorer
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://secunia.com/advisories/20595, http://securitytracker.com/id?1016291, http://www.kb.cert.org/vuls/id/959049
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2006-2631
phpFoX allows remote authenticated users to modify arbitrary accounts via a modified NATIO cookie value, possibly the phpfox_user parameter.
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: phpfox
References: http://secunia.com/advisories/20280, http://securityreason.com/securityalert/969, http://www.securityfocus.com/archive/1/435001/100/0/threaded
CVE-2006-6222
Stack-based buffer overflow in the NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 allows remote attackers to execute arbitrary code via a long request with a malformed length prefix.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: veritas_netbackup_server, veritas_netbackup_enterprise_server, veritas_netbackup_client
References: http://secunia.com/advisories/23368, http://securityreason.com/securityalert/2033, http://securitytracker.com/id?1017379
CVE-2006-2417
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.x before 2.8.0.4 allows remote attackers to inject arbitrary web script or HTML via the theme parameter in unknown scripts.  NOTE: the lang parameter is already covered by CVE-2006-2031.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: phpmyadmin
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html, http://secunia.com/advisories/20113, http://secunia.com/advisories/20627
CWE: CWE-79
CVE-2006-6376
Multiple directory traversal vulnerabilities in fm.php in Simple File Manager (SFM) 0.24a allow remote attackers to use ".." sequences to (1) read arbitrary files via the filename parameter in a download action, (2) delete arbitrary files via the delete parameter, and (3) modify arbitrary files via the edit parameter, which can be leveraged to execute arbitrary code.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: simple_file_manager
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/30687, https://www.exploit-db.com/exploits/2883, https://exchange.xforce.ibmcloud.com/vulnerabilities/30687
CVE-2006-2358
Multiple cross-site scripting (XSS) vulnerabilities in various scripts in Web-Labs CMS allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter and (2) unspecified fields related to e-mail alerts.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: web-labs_cms
References: http://secunia.com/advisories/20060, http://www.securityfocus.com/bid/17956, http://www.vupen.com/english/advisories/2006/1783
CVE-2006-3828
Incomplete blacklist vulnerability in Kailash Nadh boastMachine (formerly bMachine) 3.1 and earlier allows remote authenticated administrators to bypass SQL injection protection mechanisms by using commas, quote characters, pound sign (#) characters, "UNION," and "SELECT," which are not filtered by the product, which only checks for "insert," "delete," "update," and "replace."
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: boastmachine
References: http://secunia.com/advisories/21066, http://securityreason.com/securityalert/1252, http://securitytracker.com/id?1016515
CVE-2006-2899
Unspecified vulnerability in ESTsoft InternetDISK versions before 2006/04/20 allows remote authenticated users to execute arbitrary code, possibly by uploading a file with multiple extensions into the WebLink directory.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: internetdisk
References: http://securityreason.com/securityalert/1063, http://securitytracker.com/id?1016233, http://www.securityfocus.com/archive/1/436001/100/0/threaded
CVE-2006-4982
Cisco NAC maintains an exception list that does not record device properties other than MAC address, which allows physically proximate attackers to bypass control methods and join a local network by spoofing the MAC address of a different type of device, as demonstrated by using the MAC address of a disconnected printer.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: network_access_control
References: http://www.insightix.com/files/pdf/Bypassing_NAC_Solutions_Whitepaper.pdf, http://www.osvdb.org/30978, http://www.securityfocus.com/archive/1/446421/100/0/threaded
CVE-2006-0700
imageVue 16.1 allows remote attackers to obtain folder permission settings via a direct request to dir.php, which returns an XML document that lists folders and their permissions.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: imagevue
Related CWEs: CWE-264
References: http://secunia.com/advisories/18802, http://www.securityfocus.com/archive/1/424745/30/0/threaded, http://www.securityfocus.com/bid/16594
CWE: CWE-264
CVE-2006-4198
PHP remote file inclusion vulnerability in includes/session.php in Wheatblog (wB) 1.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the wb_class_dir parameter.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: wheatblog
References: http://secunia.com/advisories/25903, http://securityreason.com/securityalert/1410, http://secwatch.org/advisories/1015085/
CVE-2006-0263
Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, 10.1.0.5, and 10.2.0.1 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB09 in the (a) Net Listener component; and (2) DB12 and (3) DB13 in the Network Communications (RPC) component.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: database_server
References: http://secunia.com/advisories/18493, http://secunia.com/advisories/18608, http://securitytracker.com/id?1015499
CVE-2006-2005
Eval injection vulnerability in index.php in ClanSys 1.1 allows remote attackers to execute arbitrary PHP code via PHP code in the page parameter, as demonstrated by using an "include" statement that is injected into the eval statement.  NOTE: this issue has been described as file inclusion by some sources, but that is just one attack; the primary vulnerability is eval injection.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: clansys
References: http://securityreason.com/securityalert/782, http://securitytracker.com/id?1015988, http://www.nukedx.com/?getxpl=29
CVE-2006-2415
Multiple cross-site scripting (XSS) vulnerabilities in FlexChat 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username and (2) CFTOKEN parameter in (a) index.cfm and (3) CFTOKEN and (4) CFID parameter in (b) chat.cfm.
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Affected Products: flexchat
References: http://pridels0.blogspot.com/2006/05/flexchat-xss.html, http://secunia.com/advisories/20101, http://securitytracker.com/id?1016104
CVE-2006-5351
Multiple unspecified vulnerabilities in Oracle Application Express (formerly Oracle HTML DB) 1.5 up to 2.0 have unknown impact and remote attack vectors, aka Vuln# (1) APEX01, (2) APEX02, (3) APEX03, (4) APEX05, (5) APEX06, (6) APEX07, (7) APEX08, (8) APEX09, (9) APEX10, (10) APEX11, (11) APEX12, (12) APEX13, (13) APEX14, (14) APEX15, (15) APEX16, (16) APEX17, (17) APEX18, (18) APEX19, (19) APEX22, (20) APEX23, (21) APEX24, (22) APEX25, (23) APEX26, (24) APEX27, (25) APEX28, (26) APEX29, (27) APEX30, (28) APEX31, (29) APEX32, (30) APEX33, (31) APEX34, and (32) APEX35.  NOTE: as of 20061027, it is likely that some of these identifiers are associated with cross-site scripting (XSS) in WWV_FLOW_ITEM_HELP and NOTIFICATION_MSG, but these have been provided separate identifiers.
CVSS v2.0 Score: 9.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Affected Products: apex
References: http://secunia.com/advisories/22396, http://securitytracker.com/id?1017077, http://www.oracle.com/technetwork/topics/security/cpuoct2006-095368.html
CVE-2006-0386
FileVault in Mac OS X 10.4.5 and earlier does not properly mount user directories when creating a FileVault image, which allows local users to access protected files when FileVault is enabled.
CVSS v2.0 Score: 1.7 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:S/C:P/I:N/A:N
Affected Products: mac_os_x_server, mac_os_x
References: http://docs.info.apple.com/article.html?artnum=303382, http://lists.apple.com/archives/security-announce/2006/Mar/msg00000.html, http://secunia.com/advisories/19064
CVE-2006-2985
SQL injection vulnerability in index.php in IntegraMOD 1.4.0 and earlier allows remote attackers to execute arbitrary SQL commands via double-encoded "'" characters in the STYLE_URL parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: integramod
References: http://securityreason.com/securityalert/1085, http://www.attrition.org/pipermail/vim/2006-June/000847.html, http://www.securityfocus.com/archive/1/436457/100/0/threaded
CVE-2006-2292
Multiple SQL injection vulnerabilities in IA-Calendar allow remote attackers to execute arbitrary SQL commands via the (1) type parameter in (a) calendar_new.asp and (b) default.asp, and (2) ID parameter in (c) calendar_detail.asp.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: ia-calendar
References: http://secunia.com/advisories/20037, http://www.osvdb.org/25351, http://www.osvdb.org/25352
CVE-2006-4678
PHP remote file inclusion vulnerability in News Evolution 3.0.3 allows remote attackers to execute arbitrary PHP code via the _NE[AbsPath] parameter in (1) install.php and (2) migrateNE2toNE3.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: news_evolution
References: http://securityreason.com/securityalert/1536, http://www.securityfocus.com/archive/1/445576/100/0/threaded, https://exchange.xforce.ibmcloud.com/vulnerabilities/28803
CVE-2006-4016
Cross-site scripting (XSS) vulnerability in /toendaCMS in toendaCMS stable 1.0.3 and earlier, and unstable 1.1 and earlier, allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: toendacms
References: http://secunia.com/advisories/21344, http://securityreason.com/securityalert/1337, http://securitytracker.com/id?1016636
CVE-2006-4081
preview_email.cgi in Barracuda Spam Firewall (BSF) 3.3.01.001 through 3.3.03.053 allows remote attackers to execute commands via shell metacharacters ("|" pipe symbol) in the file parameter.  NOTE: the attack can be extended to arbitrary commands by the presence of CVE-2006-4000.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: barracuda_spam_firewall
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0110.html, http://secunia.com/advisories/21258, http://securityreason.com/securityalert/1363
CVE-2006-1044
Multiple buffer overflows in LISTSERV 14.3 and 14.4, including LISTSERV Lite and HPO, with the web archive interface enabled, allow remote attackers to execute arbitrary code via unknown attack vectors related to the WA CGI.  NOTE: technical details will be released after the grace period has ended on 20060603.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: listserv
References: http://secunia.com/advisories/19106, http://securitytracker.com/id?1015722, http://www.kb.cert.org/vuls/id/841132
CVE-2006-1513
Multiple buffer overflows in abc2ps before 1.3.3 allow user-assisted attackers to execute arbitrary code via crafted ABC music files.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: abc2ps
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://secunia.com/advisories/19787, http://secunia.com/advisories/19807, http://www.debian.org/security/2006/dsa-1041
CWE: CWE-119
CVE-2006-1660
Cross-site scripting (XSS) vulnerability in image_desc.php in Softbiz Image Gallery allows remote attackers to inject arbitrary web script or HTML via msg parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: image_gallery
References: http://secunia.com/advisories/19523, http://www.vupen.com/english/advisories/2006/1217, http://secunia.com/advisories/19523
CVE-2006-3146
The TOSRFBD.SYS driver for Toshiba Bluetooth Stack 4.00.29 and earlier on Windows allows remote attackers to cause a denial of service (reboot) via a L2CAP echo request that triggers an out-of-bounds memory access, similar to "Ping o' Death" and as demonstrated by BlueSmack.  NOTE: this issue was originally reported for 4.00.23.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: windows, bluetooth_stack
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://aps.toshiba-tro.de/bluetooth/pages/driverinfo.php?txt=sp2, http://attrition.org/pipermail/vim/2006-October/001085.html, http://briankrebswatch.blogspot.com/2006/10/more-on-toshiba-patches.html
CWE: CWE-119
CVE-2006-3942
The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash) via an SMB_COM_TRANSACTION SMB message that contains a string without null character termination, which leads to a NULL dereference in the ExecuteTransaction function, possibly related to an "SMB PIPE," aka the "Mailslot DOS" vulnerability.  NOTE: the name "Mailslot DOS" was derived from incomplete initial research; the vulnerability is not associated with a mailslot.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: windows_2000, windows_xp, windows_2003_server
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://blogs.technet.com/msrc/archive/2006/07/28/443837.aspx, http://secunia.com/advisories/21276, http://securitytracker.com/id?1016606
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2006-3806
Multiple integer overflows in the Javascript engine in Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 might allow remote attackers to execute arbitrary code via vectors involving (1) long strings in the toSource method of the Object, Array, and String objects; and (2) unspecified "string function arguments."
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: thunderbird, seamonkey, firefox
Related CWEs: CWE-189
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc, http://rhn.redhat.com/errata/RHSA-2006-0609.html, http://secunia.com/advisories/19873
CWE: CWE-189
CVE-2006-0104
Directory traversal vulnerability in TinyPHPForum 3.6 and earlier allows remote attackers to create a new user account, create a new topic, or view the profile of a user account, as demonstrated via a .. (dot dot) in the uname parameter to profile.php.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: tinyphpforum
References: http://evuln.com/vulns/14/exploit.html, http://evuln.com/vulns/14/summary.html, http://secunia.com/advisories/18293
CVE-2006-3984
PHP remote file inclusion vulnerability in phpAdsNew/view.inc.php in Albasoftware Phpauction 2.1 and possibly later versions, with phpAdsNew 2.0.5, allows remote attackers to execute arbitrary PHP code via a URL in the phpAds_path parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpauction, phpadsnew
References: http://securityreason.com/securityalert/1320, http://www.bb-pcsecurity.de/sicherheit_264.htm, http://www.securityfocus.com/archive/1/441716/100/0/threaded
CVE-2006-4586
The admin panel in Tr Forum 2.0 accepts a username and password hash for authentication, which allows remote authenticated users to perform unauthorized actions, as demonstrated by modifying user settings via the id parameter to /membres/modif_profil.php, and changing a password via /membres/change_mdp.php.  NOTE: this can be leveraged with other Tr Forum vulnerabilities to allow unauthenticated attackers to gain privileges.
CVSS v2.0 Score: 5.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N
Affected Products: tr_forum
References: http://acid-root.new.fr/poc/10060903.txt, http://secunia.com/advisories/21754, http://securityreason.com/securityalert/1508
CVE-2006-4168
Integer overflow in the exif_data_load_data_entry function in libexif/exif-data.c in Libexif before 0.6.16 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via an image with many EXIF components, which triggers a heap-based buffer overflow.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: libexif
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=543, http://osvdb.org/35379, http://secunia.com/advisories/25642
CVE-2006-0551
SQL injection vulnerability in the Data Pump Metadata API in Oracle Database 10g and possibly earlier might allow remote attackers to execute arbitrary SQL commands via unknown vectors.  NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle.  It is possible that this is the same issue as Oracle Vuln# DB06 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0259 or, if it is DB05, subsumed by CVE-2006-0260.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: database_server
References: http://www.integrigy.com/info/IntegrigySecurityAnalysis-CPU0106.pdf, http://www.kb.cert.org/vuls/id/983340, http://www.oracle.com/technology/deploy/security/pdf/cpujan2006.html
CVE-2006-3061
Multiple cross-site scripting (XSS) vulnerabilities in 5 Star Review allow remote attackers to inject arbitrary web script or HTML via the (1) sort parameter in index2.php, (2) item_id parameter in report.php, (3) search_term parameter (aka the "search box") in search_reviews.php, (4) the profile field in usercp/profile_edit1.php, and the (5) review field in review_form.php.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected Products: five_star_review_script
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://secunia.com/advisories/20613, http://securityreason.com/securityalert/1107, http://www.osvdb.org/26496
CWE: CWE-79
CVE-2006-0846
Multiple cross-site scripting (XSS) vulnerabilities in Leif M. Wright's Blog 3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) Referer and (2) User-Agent HTTP headers, which are stored in a log file and not sanitized when the administrator views the "Log" page, possibly using the ViewCommentsLog function.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: web_blog
References: http://secunia.com/advisories/18923, http://securityreason.com/securityalert/522, http://www.evuln.com/vulns/82/summary.html
CVE-2006-3714
Unspecified vulnerability in OC4J for Oracle Application Server 10.1.2.0.2 and 10.1.2.1 has unknown impact and attack vectors, aka Oracle Vuln# AS10.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: application_server
References: http://secunia.com/advisories/21111, http://secunia.com/advisories/21165, http://securitytracker.com/id?1016529
CVE-2006-5059
Multiple cross-site scripting (XSS) vulnerabilities in WWWthreads 5.4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the Cat parameter to (1) dosearch.php, (2) postlist.php, (3) showmembers.php, (4) faq_english.php, (5) online.php, (6) login.php, (7) newuser.php, (8) wwwthreads.php, (9) search.php, or (10) postlist.php.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: wwwthreads
References: http://secunia.com/advisories/22211, http://securityreason.com/securityalert/1645, http://www.securityfocus.com/archive/1/446911/100/0/threaded
CVE-2006-5468
Unspecified vulnerability in the HTTP dissector in Wireshark (formerly Ethereal) 0.99.3 allows remote attackers to cause a denial of service (crash) via unspecified vectors.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: wireshark
References: ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P, http://secunia.com/advisories/22590, http://secunia.com/advisories/22672
CVE-2006-3910
Internet Explorer 6 on Windows XP SP2, when Outlook is installed, allows remote attackers to cause a denial of service (crash) by calling the NewDefaultItem function of an OVCtl (OVCtl.OVCtl.1) ActiveX object, which triggers a null dereference.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ie
References: http://browserfun.blogspot.com/2006/07/mobb-20-ovctl-newdefaultitem.html, http://www.osvdb.org/27112, http://www.securityfocus.com/bid/19079
CVE-2006-5620
PHP remote file inclusion vulnerability in include/menu_builder.php in MiniBILL 2006-10-10 (1.2.3) and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the config[page_dir] parameter, a different vector than CVE-2006-4489.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: minibill
References: http://secunia.com/advisories/22632, http://securityreason.com/securityalert/1803, http://www.securityfocus.com/archive/1/449890/100/0/threaded
CVE-2006-1718
Magus Perde Clever Copy 3.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to view the database username and password via a direct request for connect.inc.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: clever_copy
References: http://advisories.echo.or.id/adv/adv28-K-159-2006.txt, http://secunia.com/advisories/19579, http://www.securityfocus.com/archive/1/430369/100/0/threaded
CVE-2006-0525
Multiple Adobe products, including (1) Photoshop CS2, (2) Illustrator CS2, and (3) Adobe Help Center, install a large number of .EXE and .DLL files with write-access permission for the Everyone group, which allows local users to gain privileges via Trojan horse programs.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: acrobat_reader, photoshop, creative_suite, pagemaker, acrobat
Related CWEs: CWE-264
References: http://secunia.com/advisories/18698, http://securitytracker.com/id?1015577, http://securitytracker.com/id?1015578
CWE: CWE-264
CVE-2006-6342
Multiple SQL injection vulnerabilities in KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) agent parameters in (a) search_listing.asp, and the (3) property_id parameter in (b) detail.asp.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: klf-realty
References: http://securityreason.com/securityalert/1976, http://www.securityfocus.com/archive/1/452115/100/200/threaded, http://www.securityfocus.com/bid/21199
CVE-2006-0405
The TIFFFetchShortPair function in tif_dirread.c in libtiff 3.8.0 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a NULL pointer dereference, possibly due to changes in type declarations and/or the TIFFVSetField function.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: libtiff
References: http://bugzilla.remotesensing.org/show_bug.cgi?id=1029, http://bugzilla.remotesensing.org/show_bug.cgi?id=1034, http://secunia.com/advisories/18587
CVE-2006-4674
Direct static code injection vulnerability in doku.php in DokuWiki before 2006-030-09c allows remote attackers to execute arbitrary PHP code via the X-FORWARDED-FOR HTTP header, which is stored in config.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: dokuwiki
References: http://bugs.splitbrain.org/index.php?do=details&id=906, http://retrogod.altervista.org/dokuwiki_2006-03-09b_cmd.html, http://secunia.com/advisories/21819
CVE-2006-2498
Invision Power Board (IPB) before 2.1.6 allows remote attackers to execute arbitrary PHP script via attack vectors involving (1) the post_icon variable in classes/post/class_post.php and (2) the df value in action_public/moderate.php.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: invision_power_board
References: http://attrition.org/pipermail/vim/2006-May/000776.html, http://forums.invisionpower.com/index.php?act=Attach&type=post&id=10026, http://forums.invisionpower.com/index.php?showtopic=215527