DuyTa/cve-kgrag-db huggingface dataset:
CVE-2006-2607
do_command.c in Vixie cron (vixie-cron) 4.1 does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits, as originally demonstrated by a program that exceeds the process limits as defined in /etc/security/limits.conf.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: vixie_cron
References: http://bugs.gentoo.org/show_bug.cgi?id=134194, http://secunia.com/advisories/20380, http://secunia.com/advisories/20388
CVE-2006-3510
The Remote Data Service Object (RDS.DataControl) in Microsoft Internet Explorer 6 on Windows 2000 allows remote attackers to cause a denial of service (crash) via a series of operations that result in an invalid length calculation when using SysAllocStringLen, then triggers a buffer over-read.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P
Affected Products: ie
References: http://browserfun.blogspot.com/2006/07/mobb-8-rdsdatacontrol-url.html, http://www.osvdb.org/26955, http://www.securityfocus.com/bid/18900
CVE-2006-5187
PHP remote file inclusion vulnerability in includes/functions.php in Bulletin Board Ace (BBaCE) 3.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: bulletin_board_ace
References: http://secunia.com/advisories/22137, http://www.securityfocus.com/bid/20302, http://www.vupen.com/english/advisories/2006/3887
CVE-2006-1448
Finder in Apple Mac OS X 10.3.9 and 10.4.6 allows user-assisted attackers to execute arbitrary code by tricking a user into launching an Internet Location item that appears to use a safe URL scheme, but which actually has a different and more risky scheme.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: mac_os_x
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html, http://secunia.com/advisories/20077, http://securitytracker.com/id?1016082
CVE-2006-2539
Sybase EAServer 5.0 for HP-UX Itanium, 5.2 for IBM AIX, HP-UX PA-RISC, Linux x86, and Sun Solaris SPARC, and 5.3 for Sun Solaris SPARC does not properly protect passwords when they are being entered via the GUI, which allows local users to obtain the cleartext passwords via the getSelectedText function in javax.swing.JPasswordField component.
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:S/C:P/I:P/A:P
Affected Products: easerver
References: http://secunia.com/advisories/20145, http://www.securityfocus.com/bid/18036, http://www.sybase.com/detail?id=1040665
CVE-2006-5621
PHP remote file inclusion vulnerability in end.php in ask_rave 0.9 PR, and other versions before 0.9b, allows remote attackers to execute arbitrary PHP code via a URL in the footfile parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ask_rave
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://rave.jk-digital.com/blog/2006/12/08/ask_rave-09b-released/, http://www.securityfocus.com/bid/20758, http://www.vupen.com/english/advisories/2006/4211
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2006-2346
vpopmail 5.4.14 and 5.4.15, with cleartext passwords enabled, allows remote attackers to authenticate to an account that does not have a cleartext password set by using a blank password to (1) SMTP AUTH or (2) APOP.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: vpopmail_\(vchkpw\)
References: http://secunia.com/advisories/19987, http://sourceforge.net/project/shownotes.php?release_id=415350, http://www.osvdb.org/25445
CVE-2006-6346
Unspecified vulnerability in SAP Internet Graphics Service (IGS) 6.40 Patchlevel 15 and earlier, and 7.00 Patchlevel 3 and earlier, allows remote attackers to cause a denial of service (service shutdown), obtain sensitive information (configuration files), and conduct certain other unauthorized activities, related to "Undocumented Features." NOTE: it is possible that there are multiple issues. This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended. This is likely a different issue than CVE-2006-4134.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: internet_graphics_server
References: http://secunia.com/advisories/23262, http://securityreason.com/securityalert/1985, http://securitytracker.com/id?1017341
CVE-2006-1646
The Internet Key Exchange version 1 (IKEv1) implementation (isakmp_agg.c) in the Shoichi Sakane KAME Project racoon, as used by NetBSD 1.6, 2.x before 20060119, certain FreeBSD releases, and possibly other distributions of BSD or Linux operating systems, when running in aggressive mode, allows remote attackers to cause a denial of service (daemon crash) via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: internet_key_exchange
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-003.txt.asc, http://mail-index.netbsd.org/source-changes/2006/01/19/0017.html, http://secunia.com/advisories/19463
CVE-2006-5005
Unspecified vulnerability in bos.net.tcp.client in IBM AIX 5.2.0 and 5.3.0 allows local users to execute arbitrary commands via unspecified vectors involving /etc/slip.login.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: aix
References: ftp://aix.software.ibm.com/aix/efixes/security/README, http://secunia.com/advisories/22111, http://securitytracker.com/id?1016918
CVE-2006-2714
Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 does not validate the CEID of an incoming message, which allows remote attackers to send messages to a protected asset without knowing the proper CEID.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: c5_enterprise_vulnerability_management
References: http://secunia.com/advisories/20378, http://securitytracker.com/id?1016184, http://www.kb.cert.org/vuls/id/635721
CVE-2006-1772
debconf in Debian GNU/Linux, when configuring mnogosearch in the mnogosearch-common 3.2.31-1 package, uses the world-readable config.dat file instead of the restricted passwords.dat for storing the cleartext database administrator password in the mnogosearch-common/database_admin_pass record, which allows local users to view the password.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: debian_linux
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=361775, http://secunia.com/advisories/19589, http://www.securityfocus.com/bid/17477
CVE-2006-0190
Unspecified vulnerability in Sun Solaris 9 and 10 for the x86 platform allows local users to gain privileges or cause a denial of service (panic) via unspecified vectors, possibly involving functions from the mm driver.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: solaris
References: http://secunia.com/advisories/18421, http://secunia.com/advisories/19087, http://securitytracker.com/id?1015478
CVE-2006-2090
Multiple SQL injection vulnerabilities in misc.php in MySmartBB 1.1.x allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) username parameters.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mysmartbb
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://securityreason.com/securityalert/807, http://www.securityfocus.com/archive/1/432095/100/0/threaded, http://www.securityfocus.com/bid/17707
CWE: CWE-89
CVE-2006-5208
Multiple SQL injection vulnerabilities in PHP Classifieds 7.1 allow remote attackers to execute arbitrary SQL commands via (1) the catid_search parameter in search.php and (2) the catid parameter in index.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php_classifieds
References: http://kzar.co.uk/exploits/phpclassifieds_exploit, http://secunia.com/advisories/22264, http://www.securityfocus.com/bid/20359
CVE-2006-3941
Unspecified vulnerability in the daemons for Sun N1 Grid Engine 5.3 and N1 Grid Engine 6.0 allows local users to cause a denial of service (grid service shutdown) and possibly execute arbitrary code using buffer overflows via unknown vectors that cause (1) qmaster or (2) execd to terminate.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: n1_grid_engine
References: http://secunia.com/advisories/21185, http://secunia.com/advisories/22425, http://securitytracker.com/id?1016607
CVE-2006-3769
Multiple cross-site scripting (XSS) vulnerabilities in Top XL 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) pass and (2) pass2 parameters in (a) add.php or the (3) id parameter in (b) members/index.php.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected Products: top_xl
References: http://secunia.com/advisories/21145, http://securityreason.com/securityalert/1267, http://securitytracker.com/id?1016548
CVE-2006-6863
PHP remote file inclusion vulnerability in the Enigma2 plugin (Enigma2.php) in Enigma WordPress Bridge allows remote attackers to execute arbitrary PHP code via a URL in the boarddir parameter.  NOTE: CVE disputes this issue, since $boarddir is set to a fixed value
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: wordpress_bridge
References: http://securityreason.com/securityalert/2093, http://securitytracker.com/id?017459, http://www.attrition.org/pipermail/vim/2007-January/001207.html
CVE-2006-2078
Multiple unspecified vulnerabilities in multiple FITELnet products, including FITELnet-F40, F80, F100, F120, F1000, and E20/E30, allow remote attackers to cause a denial of service via crafted DNS messages that trigger errors in (1) ProxyDNS or (2) PKI-Resolver, as demonstrated by the OUSPG PROTOS DNS test suite.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: mucho-ev_pk, fitelnet
References: http://secunia.com/advisories/19820, http://www.furukawa.co.jp/fitelnet/topic/dns2_attacks.html, http://www.kb.cert.org/vuls/id/955777
CVE-2006-2606
Cross-site scripting (XSS) vulnerability in Chatty, possibly 1.0.2 and other versions, allows remote attackers to inject arbitrary web script or HTML via the username.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: chatty
References: http://secunia.com/advisories/20259, http://securityreason.com/securityalert/963, http://securitytracker.com/id?1016152
CVE-2006-3932
SQL injection vulnerability in links.php in Gonafish LinksCaffe 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: linkscaffe
References: http://secunia.com/advisories/21212, http://www.vupen.com/english/advisories/2006/2983, https://exchange.xforce.ibmcloud.com/vulnerabilities/27961
CVE-2006-0627
Cross-site scripting (XSS) vulnerability in Clever Copy 2.0, 2.0a, and 3.0 allows remote attackers to inject arbitrary web script or HTML via the (1) Referer or (2) X-Forwarded-For headers in an HTTP request, which are not properly handled when the administrator accesses Site Stats.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: clever_copy
References: http://secunia.com/advisories/18790, http://www.evuln.com/vulns/64/summary.html, http://www.securityfocus.com/archive/1/424831/100/0/threaded
CVE-2006-2272
Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (kernel panic) via incoming IP fragmented (1) COOKIE_ECHO and (2) HEARTBEAT SCTP control chunks.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: stream_control_transmission_protocol
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0227.html, http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=62b08083ec3dbfd7e533c8d230dd1d8191a6e813, http://labs.musecurity.com/advisories/MU-200605-01.txt
CVE-2006-7039
The IMAP4 service in MERCUR Messaging 2005 before Service Pack 4 allows remote attackers to cause a denial of service (crash) via a message with a long subject field.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: mercur_messaging_2005, windows_2000, windows_nt, windows_98se, windows_98
References: http://secunia.com/advisories/20432, http://www.atrium-software.com/download/McrReadMe_EN.html, http://www.securityfocus.com/bid/18462
CVE-2006-3491
Stack-based buffer overflow in Kaillera Server 0.86 and earlier allows remote attackers to execute arbitrary code via a long nickname.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: kaillera
References: http://aluigi.altervista.org/adv/kailleraex-adv.txt, http://marc.info/?l=full-disclosure&m=115220500707900&w=2, http://secunia.com/advisories/20973
CVE-2006-6636
Unspecified vulnerability in the Utility Classes for IBM WebSphere Application Server (WAS) before 5.1.1.13 and 6.x before 6.0.2.17 has unknown impact and attack vectors.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: websphere_application_server
References: http://secunia.com/advisories/23386, http://secunia.com/advisories/23414, http://www-1.ibm.com/support/docview.wss?uid=swg1PK29725
CVE-2006-1327
SQL injection vulnerability in reg.php in SoftBB 0.1 allows remote attackers to execute arbitrary SQL commands via the mail parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: softbb
References: http://secunia.com/advisories/19283, http://www.osvdb.org/23999, http://www.securityfocus.com/bid/17160
CVE-2006-4083
PHP remote file inclusion vulnerability in viewevent.php in myWebland myEvent 1.x allows remote attackers to execute arbitrary PHP code via a URL in the myevent_path parameter, a different vector than CVE-2006-4040.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: myevent
References: http://secunia.com/advisories/19680, http://www.vupen.com/english/advisories/2006/1384, https://exchange.xforce.ibmcloud.com/vulnerabilities/28347
CVE-2006-3639
Microsoft Internet Explorer 5.01 and 6 does not properly identify the originating domain zone when handling redirects, which allows remote attackers to read cross-domain web pages and possibly execute code via unspecified vectors involving a crafted web page, aka "Source Element Cross-Domain Vulnerability."
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ie, internet_explorer
References: http://secunia.com/advisories/21396, http://securitytracker.com/id?1016663, http://www.kb.cert.org/vuls/id/252764
CVE-2006-2105
Directory traversal vulnerability in index.php in Jupiter CMS 1.1.4 and 1.1.5 allows remote attackers to read arbitrary files via ".." sequences terminated by a %00 (null) character in the n parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: jupiter_cms
References: http://downloads.securityfocus.com/vulnerabilities/exploits/jupitercms-lteq1.1.5-local-file-include.txt, http://www.securityfocus.com/bid/17716, http://downloads.securityfocus.com/vulnerabilities/exploits/jupitercms-lteq1.1.5-local-file-include.txt
CVE-2006-4942
Moodle before 1.6.2, when the configuration lacks (1) algebra or (2) tex filters, allows remote authenticated users to write LaTeX or MimeTeX output files to the top level of the dataroot directory via (a) filter/algebra/pix.php or (b) filter/tex/pix.php.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P
Affected Products: moodle
References: http://docs.moodle.org/en/Release_notes#Moodle_1.6.2, http://docs.moodle.org/en/Release_notes#Moodle_1.6.2
CVE-2006-3438
Unspecified vulnerability in Microsoft Hyperlink Object Library (hlink.dll), possibly a buffer overflow, allows user-assisted attackers to execute arbitrary code via crafted hyperlinks that are not properly handled when hlink.dll "uses a file containing a malformed function," aka "Hyperlink Object Function Vulnerability."
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: hyperlink_object_library
References: http://securitytracker.com/id?1016659, http://www.kb.cert.org/vuls/id/683612, http://www.securityfocus.com/bid/19405
CVE-2006-2239
SQL injection vulnerability in readarticle.php in Newsadmin 1.1 allows remote attackers to execute arbitrary SQL commands via the nid parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: newsadmin
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://evuln.com/vulns/133/summary.html, http://secunia.com/advisories/19972, http://www.osvdb.org/25276
CWE: CWE-89
CVE-2006-7122
Cross-site scripting (XSS) vulnerability in the IP Address Lookup functionality in BSQ Sitestats (component for Joomla) 1.8.0, and possibly other versions before 2.2.1, allows remote attackers to inject arbitrary web script and HTML via the ip parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: bsq_sitestats
References: http://secunia.com/secunia_research/2006-63/advisory/, http://securityreason.com/securityalert/2360, http://www.securityfocus.com/archive/1/447356/100/0/threaded
CVE-2006-1957
The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to cause a denial of service (disk consumption and possibly web-server outage) via multiple requests with different values of the feed parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: mambo, joomla\!
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://archives.neohapsis.com/archives/bugtraq/2006-04/0380.html, http://irannetjob.com/content/view/209/28/, http://www.kapda.ir/advisory-313.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2006-5444
Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: asterisk
References: http://ftp.digium.com/pub/asterisk/releases/ChangeLog-1.0.12, http://ftp.digium.com/pub/asterisk/releases/ChangeLog-1.2.13, http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050171.html
CVE-2006-1560
Multiple SQL injection vulnerabilities in SkinTech phpNewsManager 1.48 allow remote attackers to execute arbitrary SQL commands via unspecified parameters, possibly (1) id and (2) topicid, in (a) browse.php, (b) category.php, (c) gallery.php, (d) poll.php, and (e) possibly other unspecified scripts.  NOTE: portions of the description details are obtained from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpnewsmanager
References: http://evuln.com/vulns/110, http://secunia.com/advisories/19391, http://securityreason.com/securityalert/680
CVE-2006-4363
PHP remote file inclusion vulnerability in admin.cropcanvas.php in the CropImage component (com_cropimage) 1.0 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the cropimagedir parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cropimage_component
References: http://securityreason.com/securityalert/1450, http://www.securityfocus.com/archive/1/443762/100/0/threaded, http://www.securityfocus.com/bid/19605
CVE-2006-4366
PHP remote file inclusion vulnerability in index.php in RedBLoG 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: redblog
References: http://www.osvdb.org/30311, http://www.securityfocus.com/bid/19658, http://www.securityfocus.com/data/vulnerabilities/exploits/19658-rfi.html
CVE-2006-5971
Absolute path traversal vulnerability in admin/logfile.txt in Verity Ultraseek before 5.6.2 allows remote attackers to read arbitrary files via the name variable.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: ultraseek
References: http://secunia.com/advisories/22892, http://www.osvdb.org/30289, http://www.securityfocus.com/archive/1/451847/100/0/threaded
CVE-2006-6666
PHP remote file inclusion vulnerability in index.php in VerliAdmin 0.3 and earlier allows remote authenticated users to execute arbitrary PHP code via a URL in the q parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: verliadmin
References: http://secunia.com/advisories/23418, http://www.securityfocus.com/bid/21640, http://www.vupen.com/english/advisories/2006/5059
CVE-2006-7062
calendar.php in Kamgaing Email System (kmail) 2.3 and earlier allows remote attackers to obtain the full path of the server via an invalid d parameter, which leaks the path in an error message.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
Affected Products: kmail
References: http://pridels0.blogspot.com/2006/04/kmail-23-vuln.html, http://www.osvdb.org/25065, https://exchange.xforce.ibmcloud.com/vulnerabilities/26120
CVE-2006-3706
Unspecified vulnerability in OC4J for Oracle Application Server 9.0.2.3 has unknown impact and attack vectors, aka Oracle Vuln# AS01.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: application_server
References: http://secunia.com/advisories/21111, http://secunia.com/advisories/21165, http://securitytracker.com/id?1016529
CVE-2006-5205
Directory traversal vulnerability in Invision Gallery 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the dir parameter in (1) index.php and (2) forum/index.php, when the viewimage command in the gallery module is used.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: invision_gallery
References: http://secunia.com/advisories/22400, http://www.securityfocus.com/bid/20328, https://exchange.xforce.ibmcloud.com/vulnerabilities/29334
CVE-2006-2219
phpBB 2.0.20 does not verify user-specified input variable types before being passed to type-dependent functions, which allows remote attackers to obtain sensitive information, as demonstrated by the (1) mode parameter to memberlist.php and the (2) highlight parameter to viewtopic.php that are used as an argument to the htmlspecialchars or urlencode functions, which displays the installation path in the resulting error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: phpbb
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://marc.info/?l=bugtraq&m=114695651425026&w=2, http://marc.info/?l=bugtraq&m=114731067321710&w=2, http://marc.info/?l=full-disclosure&m=114685931319903&w=2
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2006-1477
Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools PHP Live Helper 1.8 allow remote attackers to include and execute arbitrary PHP code via the abs_path parameter in (1) initiate.php, (2) waiting.php, (3) welcome.php, (4) admin/index.php, (5) javascript.php, (6) checkchat.php, and (7) blank.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php_live_helper
References: http://secunia.com/advisories/19428, http://www.osvdb.org/24193, http://www.osvdb.org/24194
CVE-2006-1654
Directory traversal vulnerability in the HP Color LaserJet 2500 Toolbox and Color LaserJet 4600 Toolbox on Microsoft Windows before 20060402 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 5225.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: color_laserjet_2500, color_laserjet_2500n, color_laserjet, color_laserjet_4600, color_laserjet_2500lse
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0085.html, http://secunia.com/advisories/19529, http://securitytracker.com/id?1015862
CVE-2006-7133
Directory traversal vulnerability in upload/bin/download.php in Upload Tool for PHP 1.0 allows remote attackers to read arbitrary files via (1) ".." sequences or (2) absolute pathnames in the filename parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: php_upload_tool
References: http://secunia.com/advisories/22973, http://www.craigheffner.com/security/exploits/upload_tool_php.txt, http://www.securityfocus.com/bid/21150
CVE-2006-3952
Stack-based buffer overflow in EFS Software Easy File Sharing FTP Server 2.0 allows remote attackers to execute arbitrary code via a long argument to the PASS command.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: efs_ftp_server
References: http://secunia.com/advisories/21289, http://www.osvdb.org/27646, http://www.securityfocus.com/bid/19243
CVE-2006-6538
D-LINK DWL-2000AP+ firmware 2.11 allows remote attackers to cause (1) a denial of service (device reset) via a flood of ARP replies on the wired or wireless (radio) link and (2) a denial of service (device crash) via a flood of ARP requests on the wireless link.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: dwl-2000ap\+
References: http://secunia.com/advisories/23332, http://securityreason.com/securityalert/2029, http://tripp.dynalias.org/arpflood.c
CVE-2006-0644
Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS (aka CPG Dragonfly CMS) 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in (1) the newlang parameter and (2) the installlang parameter in a cookie, as demonstrated by using error.php to insert malicious code into a log file, or uploading a malicious .png file, which is then included using install.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: dragonfly_cms
References: http://dragonflycms.org/Forums/viewtopic/p=98034.html, http://dragonflycms.org/Forums/viewtopic/p=98034.html#98034, http://retrogod.altervista.org/dragonfly9.0.6.1_incl_xpl.html
CVE-2006-0132
Directory traversal vulnerability in webftp.php in SysCP WebFTP 1.2.6 and possibly earlier allows remote attackers to include and execute arbitrary local PHP scripts, and possibly read other types of files, via a .. (dot dot) and a trailing null in the webftp_language parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: webftp
References: http://secunia.com/advisories/18355, http://www.securityfocus.com/archive/1/420973/100/0/threaded, http://www.securityfocus.com/bid/16175
CVE-2006-3562
PHP remote file inclusion vulnerabilities in plume cms 1.0.4 allow remote attackers to execute arbitrary PHP code via a URL in the _PX_config[manager_path] parameter to (1) index.php, (2) rss.php, or (3) search.php, a different set of vectors and versions than CVE-2006-2645 and CVE-2006-0725.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: plume_cms
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://securityreason.com/securityalert/1220, http://securitytracker.com/id?1016426, http://www.securityfocus.com/archive/1/438948/100/100/threaded
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2006-4719
Multiple PHP remote file inclusion vulnerabilities in MyABraCaDaWeb 1.0.3, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the base parameter to (1) index.php or (2) pop.php.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: myabracadaweb
References: http://attrition.org/pipermail/vim/2006-September/001027.html, http://secunia.com/advisories/21817, http://www.securityfocus.com/bid/19944
CVE-2006-6549
PHP remote file inclusion vulnerability in upload.php in Rad Upload 3.02 allows remote attackers to execute arbitrary PHP code via a URL in the save_path parameter.  NOTE: CVE disputes this vulnerability because save_path is originally defined as "" before use, and the nearby instructions say "SET THE SAVE PATH by editing the line below.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: rad_upload
References: http://securityreason.com/securityalert/2034, http://www.securityfocus.com/archive/1/454175/100/0/threaded, https://exchange.xforce.ibmcloud.com/vulnerabilities/30864
CVE-2006-4268
Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) file, (2) x, and (3) y parameters in (a) admin/filemanager/preview.php; and the (4) email parameter in (b) admin/login.php.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: cubecart
References: http://bugs.cubecart.com/?do=details&id=523, http://retrogod.altervista.org/cubecart_3011_adv.html, http://secunia.com/advisories/21538
CVE-2006-2540
Privacy leak in install.php for Diesel PHP Job Site sends sensitive information such as user credentials to an e-mail address controlled by the product developers.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: diesel_job_site
References: http://secunia.com/advisories/20142, http://www.securityfocus.com/archive/1/434369/100/0/threaded, http://www.securityfocus.com/archive/1/435382/100/0/threaded
CVE-2006-4161
Directory traversal vulnerability in the avatar_gallery action in profile.php in XennoBB 2.1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the category parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: xennobb
References: http://secunia.com/advisories/21483, http://securityreason.com/securityalert/1395, http://www.securityfocus.com/archive/1/442881/100/0/threaded
CVE-2006-5668
Unspecified vulnerability in Ampache 3.3.2 and earlier, when register_globals is enabled, allows remote attackers to bypass security restrictions and gain guest access.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ampache
References: http://secunia.com/advisories/22842, http://www.securityfocus.com/bid/20798, http://www.vupen.com/english/advisories/2006/4236
CVE-2006-4958
Multiple cross-site scripting (XSS) vulnerabilities in Sun Secure Global Desktop (SSGD, aka Tarantella) before 4.20.983 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving (1) taarchives.cgi, (2) ttaAuthentication.jsp, (3) ttalicense.cgi, (4) ttawlogin.cgi, (5) ttawebtop.cgi, (6) ttaabout.cgi, or (7) test-cgi.  NOTE: This information is based upon a vague initial disclosure.  Details will be updated as they become available.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: secure_global_desktop
References: http://secunia.com/advisories/22037, http://securityreason.com/securityalert/1623, http://securitytracker.com/id?1016900
CVE-2006-7182
PHP remote file inclusion vulnerability in noticias.php in MNews 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mnews
References: http://securityreason.com/securityalert/2493, http://www.securityfocus.com/archive/1/448629/100/0/threaded, http://securityreason.com/securityalert/2493
CVE-2006-3647
Integer overflow in Microsoft Word 2000, 2002, 2003, 2004 for Mac, and v.X for Mac allows remote user-assisted attackers to execute arbitrary code via a crafted string in a Word document, which overflows a 16-bit integer length value, aka "Memmove Code Execution," a different vulnerability than CVE-2006-3651 and CVE-2006-4693.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: office
Related CWEs: CWE-189
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0211.html, http://securitytracker.com/id?1017032, http://www.osvdb.org/29440
CWE: CWE-189
CVE-2006-5953
SQL injection vulnerability in viewcart.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL commands via the zoneid parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: evolve_merchant
References: http://s-a-p.ca/index.php?page=OurAdvisories&id=28, http://secunia.com/advisories/22912, http://www.securityfocus.com/archive/1/451549/100/100/threaded
CVE-2006-6677
ESET NOD32 Antivirus before 1.1743 allows remote attackers to cause a denial of service (crash) via a crafted .CHM file that triggers a divide-by-zero error.
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P
Affected Products: nod32_antivirus
References: http://eset.com/support/updates.php?pageno=63, http://secunia.com/advisories/23459, http://securityreason.com/securityalert/2079
CVE-2006-2236
Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III Arena 1.32b allows remote attackers to execute arbitrary commands via a long remapShader command.
CVSS v2.0 Score: 7.6 (HIGH)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Affected Products: quake_3_arena, wolfenstein_enemy_territory, return_to_castle_wolfenstein, quake_3_engine
References: http://secunia.com/advisories/19984, http://secunia.com/advisories/20065, http://www.gentoo.org/security/en/glsa/glsa-200605-12.xml
CVE-2006-3479
Cross-site request forgery (CSRF) vulnerability in the del_block function in modules/Admin/block.php in Nuked-Klan 1.7.5 and earlier and 1.7 SP4.2 allows remote attackers to delete arbitrary "blocks" via a link with a modified bid parameter in a del_block op on the block page in index.php.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: nuked-klan
References: http://secunia.com/advisories/20898, http://securityreason.com/securityalert/1205, http://www.securityfocus.com/archive/1/438703
CVE-2006-4039
Multiple SQL injection vulnerabilities in eintragen.php in GaesteChaos 0.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) gastname, (2) gastwohnort, or (3) gasteintrag parameters.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: gaestechaos
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://marc.info/?l=full-disclosure&m=115464286427745&w=2, http://secunia.com/advisories/21357, http://www.securityfocus.com/archive/1/442205/100/200/threaded
CWE: CWE-89
CVE-2006-0539
The convert-fcrontab program in fcron 3.0.0 might allow local users to gain privileges via a long command-line argument, which causes Linux glibc to report heap memory corruption, possibly because a strcpy in the strdup2 function can "overwrite some data."
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: fcron
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0999.html, http://fcron.free.fr/doc/en/changes.html, http://fcron.free.fr/news.php#a20060206a.xml
CVE-2006-3882
Shalwan MusicBox 2.3.4 and earlier allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: musicbox
References: http://securityreason.com/securityalert/1284, http://www.securityfocus.com/archive/1/441000/100/0/threaded, http://securityreason.com/securityalert/1284
CVE-2006-5737
PunBB uses a predictable cookie_seed value that can be derived from the time of registration of the superadmin account (installation time), which might allow local users to perform unauthorized actions.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: punbb
References: http://securitytracker.com/id?1017131, http://www.osvdb.org/30134, http://www.securityfocus.com/archive/1/450055/100/0/threaded
CVE-2006-2089
Multiple cross-site scripting (XSS) vulnerabilities in misc.php in MySmartBB 1.1.x allow remote attackers to inject arbitrary web script or HTML via the (1) id and (2) username parameters.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: mysmartbb
References: http://securityreason.com/securityalert/807, http://www.securityfocus.com/archive/1/432095/100/0/threaded, http://www.securityfocus.com/bid/17707
CVE-2006-5177
The NTLM authentication in MailEnable Professional 2.0 and Enterprise 2.0 allows remote attackers to (1) execute arbitrary code via unspecified vectors involving crafted base64 encoded NTLM Type 3 messages, or (2) cause a denial of service via crafted base64 encoded NTLM Type 1 messages, which trigger a buffer over-read.
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: mailenable_enterprise, mailenable_professional
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://labs.musecurity.com/advisories/MU-200609-01.txt, http://secunia.com/advisories/22179, http://www.mailenable.com/hotfix/
CWE: CWE-119
CVE-2006-2367
Cross-site scripting (XSS) vulnerability in index.php in Clansys (aka Clanpage System) 1.0 and 1.1 allows remote attackers to inject arbitrary web script or HTML via the func parameter in a search function.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: clansys
References: http://archives.neohapsis.com/archives/bugtraq/2006-04/0238.html, http://secunia.com/advisories/19609, http://securityreason.com/securityalert/892
CVE-2006-4681
Directory traversal vulnerability in Redirect.bat in IBM Director before 5.10 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the file parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: director
References: ftp://ftp.software.ibm.com/pc/pccbbs/pc_servers_pdf/dir5.10_docs_relnotes.pdf, http://secunia.com/advisories/21802, http://securitytracker.com/id?1016815
CVE-2006-6063
Stack-based buffer overflow in Un4seen XMPlay 3.3.0.5 and earlier allows remote attackers to execute arbitrary code via a M3U file containing a long (1) FileName, and cause a crash via a long (2) DisplayName.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: xmplay
References: http://secunia.com/advisories/22999, http://www.securityfocus.com/bid/21206, http://www.vupen.com/english/advisories/2006/4636
CVE-2006-6133
Stack-based buffer overflow in Visual Studio Crystal Reports for Microsoft Visual Studio .NET 2002 and 2002 SP1, .NET 2003 and 2003 SP1, and 2005 and 2005 SP1 (formerly Business Objects Crystal Reports XI Professional) allows user-assisted remote attackers to execute arbitrary code via a crafted RPT file.
CVSS v2.0 Score: 7.6 (HIGH)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Affected Products: crystal_reports_xi, visual_studio_.net
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://secunia.com/advisories/23091, http://secunia.com/advisories/26754, http://securitytracker.com/id?1017279
CWE: CWE-119
CVE-2006-5539
PHP remote file inclusion vulnerability in login/secure.php in UeberProject Management System 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cfg[homepath] parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ueberproject_management_system
References: http://secunia.com/advisories/22565, http://www.osvdb.org/30015, http://www.securityfocus.com/bid/20719
CVE-2006-6706
SQL injection vulnerability in Soumu Workflow for Groupmax 01-00 through 01-01, Soumu Workflow 02-00 through 03-03, and Koukyoumuke Soumu Workflow 01-00 through 01-01 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors in certain web pages.
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: koukyoumuke_soumu_workflow, soumu_workflow, soumo_workflow
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://secunia.com/advisories/23399, http://www.hitachi-support.com/security_e/vuls_e/HS06-016_e/01-e.html, http://www.vupen.com/english/advisories/2006/5114
CWE: CWE-89
CVE-2006-1832
sysinfo.cgi in sysinfo 1.21 allows remote attackers to obtain the installation path via the debugger action.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: sysinfo
References: http://secunia.com/advisories/19690, http://www.securityfocus.com/bid/17523, http://www.vupen.com/english/advisories/2006/1360
CVE-2006-6108
Cross-site scripting (XSS) vulnerability in EC-CUBE before 1.0.1a-beta allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: ec-cube
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://jvn.jp/jp/JVN%2361543834/index.html, http://secunia.com/advisories/22925, http://securitytracker.com/id?1017277
CWE: CWE-79
CVE-2006-0962
SQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the pass parameter in a cookie.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: vubb
References: http://secunia.com/advisories/19084, http://www.securityfocus.com/bid/16930, http://www.vupen.com/english/advisories/2006/0799
CVE-2006-5581
Unspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via certain DHTML script functions, such as normalize, and "incorrectly created elements" that trigger memory corruption, aka "DHTML Script Function Memory Corruption Vulnerability."
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: internet_explorer
References: http://secunia.com/advisories/23288, http://securitytracker.com/id?1017373, http://www.kb.cert.org/vuls/id/347448
CVE-2006-1570
Cross-site scripting (XSS) vulnerability in Esqlanelapse 2.0 and 2.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: esqlanelapse
References: http://secunia.com/advisories/19474, http://sourceforge.net/project/shownotes.php?release_id=406021, http://www.osvdb.org/24300
CVE-2006-6823
PHP remote file inclusion vulnerability in plugins/metasearch/plug.inc.php in Yrch! 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: yrch
References: http://www.securityfocus.com/bid/21794, http://www.vupen.com/english/advisories/2006/5196, https://exchange.xforce.ibmcloud.com/vulnerabilities/31120
CVE-2006-1966
An unspecified Fortinet product, possibly Fortinet28, allows remote attackers to cause a denial of service via a "small synflood" to the SMTP port (TCP port 25), as demonstrated by a 10-microsecond wait between sending packets.  NOTE: this issue has been disputed in followup posts that suggest that a protection feature is triggering a RST.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: fortinet28
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0449.html, http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0472.html, http://www.securityfocus.com/archive/1/431404/100/0/threaded
CVE-2006-4263
Multiple PHP remote file inclusion vulnerabilities in the Product Scroller Module and other modules in mambo-phpshop (com_phpshop) for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter in (1) mod_phpshop.php, (2) mod_phpshop_allinone.php, (3) mod_phpshop_cart.php, (4) mod_phpshop_featureprod.php, (5) mod_phpshop_latestprod.php, (6) mod_product_categories.php, (7) mod_productscroller.php, and (8) mosproductsnap.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: product_scroller_module
References: http://www.osvdb.org/28151, http://www.osvdb.org/28152, http://www.osvdb.org/28153
CVE-2006-4713
PHP remote file inclusion vulnerability in config.php in PSYWERKS PUMA 1.0 RC2 allows remote attackers to execute arbitrary PHP code via a URL in the fpath parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: puma
References: http://securityreason.com/securityalert/1557, http://www.bb-pcsecurity.de/Websecurity/415/org/PUMA_1.0_RC_2_%28config.php%29_R%20FI.htm, http://www.securityfocus.com/archive/1/445723/100/0/threaded
CVE-2006-6267
PostNuke 0.7.5.0, and certain minor versions, allows remote attackers to obtain sensitive information via a non-numeric value of the stop parameter, which reveals the path in an error message.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
Affected Products: postnuke
References: http://www.securityfocus.com/archive/1/452283/100/100/threaded, https://exchange.xforce.ibmcloud.com/vulnerabilities/30474, http://www.securityfocus.com/archive/1/452283/100/100/threaded
CVE-2006-7193
PHP remote file inclusion vulnerability in unit_test/test_cases.php in Smarty 2.6.1 allows remote attackers to execute arbitrary PHP code via a URL in the SMARTY_DIR parameter.  NOTE: this issue is disputed by CVE and a third party because SMARTY_DIR is a constant
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: smarty
References: http://marc.info/?l=bugtraq&m=116163668213491&w=2, http://marc.info/?l=bugtraq&m=116170769322920&w=2, http://osvdb.org/31096