Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ud.com/vulnerabilities/28623 - http://www.securityfocus.com/bid/19752 - http://www.osvdb.org/28291 - http://secunia.com/advisories/21676
CVE ID: CVE-2006-4457 State: PUBLISHED Published: 2006-08-31T10:00:00 Last Updated: 2024-08-07T19:14:46.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in index.php in phpECard 2.1.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/3411 - http://secunia.com/advisories/21676
CVE ID: CVE-2006-4458 State: PUBLISHED Published: 2006-08-31T10:00:00 Last Updated: 2024-08-07T19:14:46.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in calendar/inc/class.holidaycalc.inc.php in phpGroupWare 0.9.16.010 and earlier allows remote attackers to include arbitrary local files via a .. (dot dot) sequence and trailing null (%00) byte in the GLOBALS[phpgw_info][user][preferences][common][country] parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/19751 - http://www.vupen.com/english/advisories/2006/3414 - https://www.exploit-db.com/exploits/2270 - https://exchange.xforce.ibmc
p://www.vupen.com/english/advisories/2006/3414 - https://www.exploit-db.com/exploits/2270 - https://exchange.xforce.ibmcloud.com/vulnerabilities/28627 - http://secunia.com/advisories/21687
CVE ID: CVE-2006-4459 State: PUBLISHED Published: 2006-09-06T00:00:00 Last Updated: 2024-08-07T19:14:46.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in AnywhereUSB/5 1.80.00 allows local users to cause a denial of service (crash) via a 1 byte header size specified in the USB string descriptor. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/1500 - http://www.securityfocus.com/bid/19833 - http://www.safend.com/advisories/digi_anywhereusb5_intoverflow.txt - http://www.securityfocus.com/archive/1/445088/100/0/threaded - http://secunia.com/advisories/21739
CVE ID: CVE-2006-4460 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:46.718Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in PHP iAddressBook before 0.96 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://wacha.ch/wiki/addressbook:changelog - http://secunia.com/advisories/21730 - https://exchange.xforce.ibmcloud.com/vulnerabilities/28723 - http://www.securityfocus.com/bid/19845
CVE ID: CVE-2006-4461 State: PUBLISHED Published: 2006-08-31T20:00:00Z Last Updated: 2024-09-16T17:53:14.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: Paessler IPCheck Server Monitor before 5.3.3.639/640 does not properly implement a "list of acceptable host IP addresses in the probe settings," which has unknown impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.paessler.com/ipcheck/history
CVE ID: CVE-2006-4462 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:46.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gonafish.com LinksCaffe 2.0 and 3.0 do not properly restrict access to administrator functions, which allows remote attackers to gain full administration rights via a direct request to Admin/admin1953.php. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1016767 - http://www.securityfocus.com/archive/1/444636/100/0/threaded - http://securityreason.com/securityalert/1484
CVE ID: CVE-2006-4463 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:46.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the administrator control panel in Jetstat.com JS ASP Faq Manager 1.10 allows remote attackers to execute arbitrary SQL commands via the pwd parameter (aka the Password field). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/444652/100/0/threaded - http://www.osvdb.org/28266 - https://exchange.xforce.ibmcloud.com/vulnerabilities/28638 - http://www.vupen.com/english/advisories/2006/3415 - http://secunia.com/advisories/21674 - http://securityr
ities/28638 - http://www.vupen.com/english/advisories/2006/3415 - http://secunia.com/advisories/21674 - http://securityreason.com/securityalert/1483 - http://www.securityfocus.com/bid/19761
CVE ID: CVE-2006-4464 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:46.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Nokia Browser, possibly Nokia Symbian 60 Browser 3rd edition, allows remote attackers to cause a denial of service (crash) via JavaScript that constructs a large Unicode string. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/28353 - https://www.exploit-db.com/exploits/2176 - http://www.securityfocus.com/bid/19484 - http://www.securityfocus.com/archive/1/442990/100/200/threaded - http://securityreason.com/securityalert/1485
CVE ID: CVE-2006-4465 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:47.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Terminal Server, when running an application session with the "Start program at logon" and "Override settings from user profile and Client Connection Manager wizard" options, allows local users to execute arbitrary code by forcing an Explorer error. NOTE: a third-party researcher has stated that the options are "a convenience to users" and were not intended to restrict execution of arbitrary code Additional Analyst Notes: - CVE Program Container: References: - http://wklpc.blogspot.com/2006/08/easy-ms-terminal-server
ditional Analyst Notes: - CVE Program Container: References: - http://wklpc.blogspot.com/2006/08/easy-ms-terminal-server-desktop-hack.html - http://www.securityfocus.com/archive/1/443428/100/200/threaded - http://www.securityfocus.com/archive/1/443364/100/200/threaded - http://securityreason.com/securityalert/1486
CVE ID: CVE-2006-4466 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:46.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: Joomla! before 1.0.11 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to have an unspecified impact. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Joomla!. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/engli
a vulnerability in Joomla!. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/3408 - http://www.joomla.org/content/view/1841/78/
CVE ID: CVE-2006-4467 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:46.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple Machines Forum (SMF) 1.1RCx before 1.1RC3, and 1.0.x before 1.0.8, does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to perform directory traversal attacks to read arbitrary local files, lock topics, and possibly have other security impacts. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then thi
nerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Simple Machines Forum. Additional Analyst Notes: - CVE Program Container: References: - http://www.simplemachines.org/community/index.php?topic=107112.0 - http://securityreason.com/securityalert/1475 - http://retrogod.altervista.org/smf_11rc2_lock.html - http://www.securityfocus.com/archive/1/444053/100/100/threaded - http://retrogod.altervista.org/smf_11rc2_local_incl.html - http://www.simplemachines.org/community/index.php?topic=107135.0
CVE ID: CVE-2006-4468 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:46.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to unvalidated input, allow attackers to have an unknown impact via unspecified vectors involving the (1) mosMail, (2) JosIsValidEmail, and (3) josSpoofValue functions; (4) the lack of inclusion of globals.php in administrator/index.php; (5) the Admin User Manager; and (6) the poll module. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/3408 - http://www.joomla.org/content/view/1841/78/ - http://
References: - http://www.vupen.com/english/advisories/2006/3408 - http://www.joomla.org/content/view/1841/78/ - http://secunia.com/advisories/21666 - https://exchange.xforce.ibmcloud.com/vulnerabilities/28628 - http://www.joomla.org/content/view/1843/74/
CVE ID: CVE-2006-4469 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:47.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in PEAR.php in Joomla! before 1.0.11 allows remote attackers to perform "remote execution," related to "Injection Flaws." Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/3408 - http://www.joomla.org/content/view/1841/78/ - http://secunia.com/advisories/21666 - http://www.joomla.org/content/view/1843/74/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/28629
CVE ID: CVE-2006-4470 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:46.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: Joomla! before 1.0.11 omits some checks for whether _VALID_MOS is defined, which allows attackers to have an unknown impact, possibly resulting in PHP remote file inclusion. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/3408 - http://www.joomla.org/content/view/1841/78/ - http://secunia.com/advisories/21666 - https://exchange.xforce.ibmcloud.com/vulnerabilities/28631 - http://www.joomla.org/content/view/1843/74/
CVE ID: CVE-2006-4471 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:47.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Admin Upload Image functionality in Joomla! before 1.0.11 allows remote authenticated users to upload files outside of the /images/stories/ directory via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/3408 - http://www.joomla.org/content/view/1841/78/ - http://secunia.com/advisories/21666 - http://www.joomla.org/content/view/1843/74/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/28630
CVE ID: CVE-2006-4472 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:47.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in Joomla! before 1.0.11 allow attackers to bypass user authentication via unknown vectors involving the (1) do_pdf command and the (2) emailform com_content task. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/28632 - http://www.vupen.com/english/advisories/2006/3408 - http://www.joomla.org/content/view/1841/78/ - http://secunia.com/advisories/21666 - http://www.joomla.org/content/view/1843/74/
CVE ID: CVE-2006-4473 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:46.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in com_content in Joomla! before 1.0.11, when $mosConfig_hideEmail is set, allows attackers to perform the emailform and emailsend tasks. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/3408 - http://www.joomla.org/content/view/1841/78/ - http://secunia.com/advisories/21666 - http://www.joomla.org/content/view/1843/74/
CVE ID: CVE-2006-4474 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:46.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.11 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) Admin Module Manager, (2) Admin Help, and (3) Search. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/3408 - https://exchange.xforce.ibmcloud.com/vulnerabilities/28633 - http://www.joomla.org/content/view/1841/78/ - http://secunia.com/advisories/21666 - http://www.joomla.org/content/view/1843/74/
CVE ID: CVE-2006-4475 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:47.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: Joomla! before 1.0.11 does not limit access to the Admin Popups functionality, which has unknown impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/3408 - http://www.joomla.org/content/view/1841/78/ - http://secunia.com/advisories/21666 - http://www.joomla.org/content/view/1843/74/
CVE ID: CVE-2006-4476 State: PUBLISHED Published: 2006-08-31T20:00:00 Last Updated: 2024-08-07T19:14:46.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to "Injection Flaws," allow attackers to have an unknown impact via (1) globals.php, which uses include_once() instead of require(); (2) the $options variable; (3) Admin Upload Image; (4) ->load(); (5) content submissions when frontpage is selected; (6) the mosPageNav constructor; (7) saveOrder functions; (8) the absence of "exploit blocking rules" in htaccess; and (9) the ACL. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupe
ng rules" in htaccess; and (9) the ACL. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/3408 - http://www.joomla.org/content/view/1841/78/ - http://secunia.com/advisories/21666 - http://www.joomla.org/content/view/1843/74/
CVE ID: CVE-2006-4477 State: PUBLISHED Published: 2006-08-31T21:00:00 Last Updated: 2024-08-07T19:14:47.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in Visual Shapers ezContents 2.0.3 allow remote attackers to execute arbitrary PHP code via an empty GLOBALS[rootdp] parameter and an ftps URL in the (1) GLOBALS[admin_home] parameter in (a) diary/event_list.php, (b) gallery/gallery_summary.php, (c) guestbook/showguestbook.php, (d) links/showlinks.php, and (e) reviews/review_summary.php; and the (2) GLOBALS[language_home] parameter in (f) calendar/calendar.php, (g) news/shownews.php, (h) poll/showpoll.php, (i) search/search.ph
anguage_home] parameter in (f) calendar/calendar.php, (g) news/shownews.php, (h) poll/showpoll.php, (i) search/search.php, (j) toprated/toprated.php, and (k) whatsnew/whatsnew.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/28325 - http://www.osvdb.org/28330 - http://www.osvdb.org/28331 - http://www.osvdb.org/28329 - http://securityreason.com/securityalert/1479 - http://securitytracker.com/id?1016770 - http://www.securityfocus.com/bid/19776 - http://www.osvdb.org/28327 - http://www.vupen.com/english/advisories/2006/3420 - http://www.osvdb.org/28324 - http://www.osvdb.org/28322 - http://www.osvdb.org/28321 - http://www.osvdb.org/28326 - http://www.os
w.osvdb.org/28324 - http://www.osvdb.org/28322 - http://www.osvdb.org/28321 - http://www.osvdb.org/28326 - http://www.osvdb.org/28323 - http://secunia.com/advisories/21703 - https://exchange.xforce.ibmcloud.com/vulnerabilities/28674 - http://www.osvdb.org/28328 - http://www.securityfocus.com/archive/1/444779/100/0/threaded
CVE ID: CVE-2006-4478 State: PUBLISHED Published: 2006-08-31T21:00:00 Last Updated: 2024-08-07T19:14:47.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in headeruserdata.php in Visual Shapers ezContents 2.0.3 allows remote attackers to execute arbitrary SQL commands via the groupname parameter. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/1479 - http://securitytracker.com/id?1016770 - http://www.vupen.com/english/advisories/2006/3420 - http://www.osvdb.org/28320 - https://exchange.xforce.ibmcloud.com/vulnerabilities/28675 - http://secunia.com/advisories/21703 - http://www.securityfocus.com
/exchange.xforce.ibmcloud.com/vulnerabilities/28675 - http://secunia.com/advisories/21703 - http://www.securityfocus.com/bid/19777 - http://www.securityfocus.com/archive/1/444779/100/0/threaded
CVE ID: CVE-2006-4479 State: PUBLISHED Published: 2006-08-31T21:00:00 Last Updated: 2024-08-07T19:14:46.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in loginreq2.php in Visual Shapers ezContents 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the subgroupname parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/19780 - http://securityreason.com/securityalert/1479 - http://securitytracker.com/id?1016770 - http://www.vupen.com/english/advisories/2006/3420 - http://secunia.com/advisories/21703 - http://www.osvdb.org/28319 - https://exchange.xforce.ibmcloud
visories/2006/3420 - http://secunia.com/advisories/21703 - http://www.osvdb.org/28319 - https://exchange.xforce.ibmcloud.com/vulnerabilities/28676 - http://www.securityfocus.com/archive/1/444779/100/0/threaded
CVE ID: CVE-2006-4480 State: PUBLISHED Published: 2006-08-31T21:00:00 Last Updated: 2024-08-07T19:14:46.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incomplete blacklist vulnerability in the nk_CSS function in nuked.php in Nuked-Klan 1.7 SP4.3 allows remote attackers to bypass anti-XSS features and inject arbitrary web script or HTML via JavaScript in an attribute value that is not in the blacklist, as demonstrated using the STYLE attribute of a B element. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/444749/100/0/threaded - http://securityreason.com/securityalert/1478
CVE ID: CVE-2006-4481 State: PUBLISHED Published: 2006-08-31T21:00:00 Last Updated: 2024-08-07T19:14:46.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) file_exists and (2) imap_reopen functions in PHP before 5.1.5 do not check for the safe_mode and open_basedir settings, which allows local users to bypass the settings. NOTE: the error_log function is covered by CVE-2006-3011, and the imap_open function is covered by CVE-2006-1017. Additional Analyst Notes: - CVE Program Container: References: - http://www.php.net/release_5_1_5.php - http://secunia.com/advisories/21768 - http://www.ubuntu.com/usn/usn-342-1 - http://secunia.com/advisories/22039 - http://www.mandriva.com
m/advisories/21768 - http://www.ubuntu.com/usn/usn-342-1 - http://secunia.com/advisories/22039 - http://www.mandriva.com/security/advisories?name=MDKSA-2006:162 - http://www.securityfocus.com/bid/19582 - http://secunia.com/advisories/21546 - http://www.vupen.com/english/advisories/2006/3318 - http://secunia.com/advisories/21842 - http://www.novell.com/linux/security/advisories/2006_52_php.html
CVE ID: CVE-2006-4482 State: PUBLISHED Published: 2006-08-31T21:00:00 Last Updated: 2024-08-07T19:14:46.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990. Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10121 - http://securitytracker.com/id?1016984 - http://www.php.net/release_5_1_5.php - https://issues.rpath.com/browse/RPL-683 -
http://securitytracker.com/id?1016984 - http://www.php.net/release_5_1_5.php - https://issues.rpath.com/browse/RPL-683 - http://secunia.com/advisories/21768 - http://www.redhat.com/support/errata/RHSA-2006-0669.html - http://secunia.com/advisories/22487 - http://www.ubuntu.com/usn/usn-342-1 - http://support.avaya.com/elmodocs2/security/ASA-2006-221.htm - http://secunia.com/advisories/22039 - http://www.turbolinux.com/security/2006/TLSA-2006-38.txt - http://rhn.redhat.com/errata/RHSA-2006-0688.html - http://www.debian.org/security/2006/dsa-1206 - http://www.securityfocus.com/bid/19582 - http://secunia.com/advisories/22004 - http://support.avaya.com/elmodocs2/security/ASA-2006-222.htm - http:/
/bid/19582 - http://secunia.com/advisories/22004 - http://support.avaya.com/elmodocs2/security/ASA-2006-222.htm - http://secunia.com/advisories/22538 - http://secunia.com/advisories/22713 - http://www.redhat.com/support/errata/RHSA-2006-0682.html - http://secunia.com/advisories/21546 - http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.445.2.14.2.10&r2=1.445.2.14.2.11 - http://secunia.com/advisories/22440 - http://www.securityfocus.com/archive/1/447866/100/0/threaded - http://secunia.com/advisories/22069 - http://www.vupen.com/english/advisories/2006/3318 - http://secunia.com/advisories/22225 - http://support.avaya.com/elmodocs2/security/ASA-2006-223.htm - http://www.php.net/Ch
tp://secunia.com/advisories/22225 - http://support.avaya.com/elmodocs2/security/ASA-2006-223.htm - http://www.php.net/ChangeLog-5.php#5.1.5 - ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc - http://www.novell.com/linux/security/advisories/2006_52_php.html
CVE ID: CVE-2006-4483 State: PUBLISHED Published: 2006-08-31T21:00:00 Last Updated: 2024-08-07T19:14:47.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cURL extension files (1) ext/curl/interface.c and (2) ext/curl/streams.c in PHP before 5.1.5 permit the CURLOPT_FOLLOWLOCATION option when open_basedir or safe_mode is enabled, which allows attackers to perform unauthorized actions, possibly related to the realpath cache. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1016984 - http://www.php.net/release_5_1_5.php - http://secunia.com/advisories/22039 - http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?r1=1.62.2.14.
_5.php - http://secunia.com/advisories/22039 - http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?r1=1.62.2.14.2.6&r2=1.62.2.14.2.7 - http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?view=log - http://www.securityfocus.com/bid/19582 - http://www.securityfocus.com/archive/1/492671/100/0/threaded - http://secunia.com/advisories/30411 - http://secunia.com/advisories/21546 - http://www.vupen.com/english/advisories/2006/3318 - http://cvs.php.net/viewvc.cgi/php-src/ext/curl/streams.c?r1=1.14.2.2.2.3&r2=1.14.2.2.2.4 - http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0178 - http://www.php.net/ChangeLog-5.php#5.1.5 - http://www.novell.com/linux/security/advisories/2006_52_php.html