Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2006-3241 State: PUBLISHED Published: 2006-06-27T10:00:00 Last Updated: 2024-08-07T18:23:21.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in messages.php in XennoBB 1.0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the tid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/20797 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27367 - http://www.securityfocus.com/bid/18652 - http://www.vupen.com/english/advisories/2006/2510 - http://pridels0.blogspot.com/2006/06/xennobb-xss-vuln.html
CVE ID: CVE-2006-3242 State: PUBLISHED Published: 2006-06-27T10:00:00 Last Updated: 2024-08-07T18:23:20.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the browse_get_namespace function in imap/browse.c of Mutt 1.4.2.1 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via long namespaces received from the IMAP server. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/21220 - http://www.gentoo.org/security/en/glsa/glsa-200606-27.xml - http://secunia.com/advisories/20895 - http://secunia.com/advisories/21039 - http://dev.mutt.org/cgi-bin/gitweb.cgi?p=mutt
ttp://secunia.com/advisories/20895 - http://secunia.com/advisories/21039 - http://dev.mutt.org/cgi-bin/gitweb.cgi?p=mutt/.git%3Ba=commit%3Bh=dc0272b749f0e2b102973b7ac43dbd3908507540 - http://www.redhat.com/support/errata/RHSA-2006-0577.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10826 - http://secunia.com/advisories/20887 - http://www.vupen.com/english/advisories/2006/2522 - http://secunia.com/advisories/20810 - http://www.mandriva.com/security/advisories?name=MDKSA-2006:115 - https://usn.ubuntu.com/307-1/ - http://www.trustix.org/errata/2006/0038 - http://dev.mutt.org/cgi-bin/viewcvs.cgi/mutt/imap/browse.c?r1=1.34.2.2&r2=1.34.2.3 - http://se
ix.org/errata/2006/0038 - http://dev.mutt.org/cgi-bin/viewcvs.cgi/mutt/imap/browse.c?r1=1.34.2.2&r2=1.34.2.3 - http://secunia.com/advisories/20854 - http://secunia.com/advisories/21135 - http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472221 - http://www.securityfocus.com/bid/18642 - http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.013-mutt.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/27428 - http://www.debian.org/security/2006/dsa-1108 - http://www.novell.com/linux/security/advisories/2006_16_sr.html - http://secunia.com/advisories/20836 - ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U - http://security
://secunia.com/advisories/20836 - ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U - http://securitytracker.com/id?1016482 - http://secunia.com/advisories/20960 - http://www.securityfocus.com/archive/1/438712/100/0/threaded - https://issues.rpath.com/browse/RPL-471 - http://secunia.com/advisories/21124 - http://secunia.com/advisories/20879
CVE ID: CVE-2006-3243 State: PUBLISHED Published: 2006-06-27T10:00:00 Last Updated: 2024-08-07T18:23:20.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in usercp.php in MyBB (MyBulletinBoard) 1.0 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the showcodebuttons parameter. Additional Analyst Notes: - CVE Program Container: References: - http://myimei.com/security/2006-06-21/mybb113option-update-for-code-buttonssql-injection-admin-access.html - http://www.securityfocus.com/archive/1/438209 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27410 - http://community.mybboard.net/showthread.php?tid=9955 - http://securit
hange.xforce.ibmcloud.com/vulnerabilities/27410 - http://community.mybboard.net/showthread.php?tid=9955 - http://securityreason.com/securityalert/1147 - http://www.vupen.com/english/advisories/2006/2511 - http://secunia.com/advisories/20795
CVE ID: CVE-2006-3244 State: PUBLISHED Published: 2006-06-27T10:00:00 Last Updated: 2024-08-07T18:23:21.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Anthill 0.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) order parameter in buglist.php and the (2) bug parameter in query.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27373 - http://www.vupen.com/english/advisories/2006/2529 - http://www.securityfocus.com/bid/18661 - http://secunia.com/advisories/20838 - http://pridels0.blogspot.com/2006/06/anthill-sql-injection-vuln.htm
om/bid/18661 - http://secunia.com/advisories/20838 - http://pridels0.blogspot.com/2006/06/anthill-sql-injection-vuln.html
CVE ID: CVE-2006-3245 State: PUBLISHED Published: 2006-06-27T10:00:00 Last Updated: 2024-08-07T18:23:20.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in activatemember in mvnForum 1.0 GA and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) member and (2) activatecode parameters. Additional Analyst Notes: - CVE Program Container: References: - http://pridels0.blogspot.com/2006/06/mvnforum-xss-vuln.html - http://www.vupen.com/english/advisories/2006/2531 - http://www.securityfocus.com/bid/18663 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27370 - http://secunia.com/advisories/20803
CVE ID: CVE-2006-3246 State: PUBLISHED Published: 2006-06-27T10:00:00 Last Updated: 2024-08-07T18:23:20.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in show.php in GL-SH Deaf Forum 6.4.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the sort parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/18651 - http://secunia.com/advisories/20781 - http://www.osvdb.org/26804 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27363 - http://pridels0.blogspot.com/2006/06/gl-sh-deaf-forum-xss-vuln.html - http://www.vupen.com/english/advisories/2006/2515
CVE ID: CVE-2006-3247 State: PUBLISHED Published: 2006-06-27T10:00:00 Last Updated: 2024-08-07T18:23:21.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in show.php in GL-SH Deaf Forum 6.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) search, (2) page, and (3) action parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/18651 - http://secunia.com/advisories/20781 - http://www.osvdb.org/26804 - https://exchange.xforce
securityfocus.com/bid/18651 - http://secunia.com/advisories/20781 - http://www.osvdb.org/26804 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27363 - http://pridels0.blogspot.com/2006/06/gl-sh-deaf-forum-xss-vuln.html - http://www.vupen.com/english/advisories/2006/2515
CVE ID: CVE-2006-3248 State: REJECTED Published: 2006-06-27T10:00:00 Last Updated: 2006-08-08T09:00:00 Description: No description available.
CVE ID: CVE-2006-3249 State: PUBLISHED Published: 2006-06-27T10:00:00 Last Updated: 2024-08-07T18:23:20.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the vendor has disputed this report, stating "If a non positive integer or non-integer is used for the page parameter for a search URL, the search query will use a negative number for the LIMIT clause. This causes the query to break, showing no results. It IS NOT however a sql injection error." While the original report is from a researcher with mixed accuracy, as of 200
It IS NOT however a sql injection error." While the original report is from a researcher with mixed accuracy, as of 20060703, CVE does not have any additional information regarding this issue Additional Analyst Notes: - CVE Program Container: References: - http://www.phorum.org/phorum5/read.php?14%2C114358 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27369 - http://www.phorum.org/cgi-bin/trac.cgi/ticket/382#preview - http://www.osvdb.org/27165 - http://pridels0.blogspot.com/2006/06/phorum-sql-injection-vuln.html
CVE ID: CVE-2006-3250 State: PUBLISHED Published: 2006-06-27T18:00:00 Last Updated: 2024-08-07T18:23:21.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in Windows Live Messenger 8.0 allows user-assisted attackers to execute arbitrary code via a crafted Contact List (.ctt) file, which triggers the overflow when it is imported by the user. Additional Analyst Notes: - CVE Program Container: References: - http://www.jaascois.com/exploits/18602016/ - http://www.securityfocus.com/archive/1/438442/100/0/threaded - http://securitydot.net/xpl/exploits/vulnerabilities/articles/1108/exploit.html - http://securitytracker.com/id?1016373 - https://exchange.xforce
pl/exploits/vulnerabilities/articles/1108/exploit.html - http://securitytracker.com/id?1016373 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27417 - http://www.securityfocus.com/bid/18639
CVE ID: CVE-2006-3251 State: PUBLISHED Published: 2006-06-27T18:00:00 Last Updated: 2024-08-07T18:23:21.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the array_push function in hashcash.c for Hashcash before 1.21 might allow attackers to execute arbitrary code via crafted entries. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/2551 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27422 - http://secunia.com/advisories/20800 - http://secunia.com/advisories/21146 - http://www.gentoo.org/security/en/glsa/glsa-200606-25.xml - http://www.debian.org/security/2006/dsa-1114 - http://se
6 - http://www.gentoo.org/security/en/glsa/glsa-200606-25.xml - http://www.debian.org/security/2006/dsa-1114 - http://secunia.com/advisories/20846 - http://www.hashcash.org/source/CHANGELOG - http://www.securityfocus.com/bid/18659
CVE ID: CVE-2006-3252 State: PUBLISHED Published: 2006-06-27T18:00:00 Last Updated: 2024-08-07T18:23:20.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the Online Registration Facility for Algorithmic Research PrivateWire VPN software up to 3.7 allows remote attackers to execute arbitrary code via a long GET request. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/1152 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27430 - http://www.securityfocus.com/archive/1/438329/100/0/threaded - http://www.securityfocus.com/bid/18647 - http://securitytracker.com/id?1016382 - http://secunia.com/advisories
hreaded - http://www.securityfocus.com/bid/18647 - http://securitytracker.com/id?1016382 - http://secunia.com/advisories/20812 - http://www.vupen.com/english/advisories/2006/2549
CVE ID: CVE-2006-3253 State: PUBLISHED Published: 2006-06-27T19:00:00 Last Updated: 2024-08-07T18:23:21.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in member.php in vBulletin 3.5.x allows remote attackers to inject arbitrary web script or HTML via the u parameter. NOTE: the vendor has disputed this report, stating that they have been unable to replicate the issue and that "the userid parameter is run through our filtering system as an unsigned integer. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/27508 - http://www.securityfocus.com/archive/1/437817/100/0/threaded - http://securityreason.com
- http://www.osvdb.org/27508 - http://www.securityfocus.com/archive/1/437817/100/0/threaded - http://securityreason.com/securityalert/1155 - http://securitytracker.com/id?1016348 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27261 - http://www.securityfocus.com/archive/1/438364/100/100/threaded - http://www.securityfocus.com/bid/18551
CVE ID: CVE-2006-3254 State: PUBLISHED Published: 2006-06-27T19:00:00 Last Updated: 2024-08-07T18:23:21.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in newthread.php in Woltlab Burning Board (WBB) 2.0 RC2 allows remote attackers to execute arbitrary SQL commands via the boardid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/1154 - http://www.securityfocus.com/bid/18597 - http://www.securityfocus.com/archive/1/438252 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27350 - http://securitytracker.com/id?1016374
CVE ID: CVE-2006-3255 State: PUBLISHED Published: 2006-06-27T19:00:00 Last Updated: 2024-08-07T18:23:20.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in showmods.php in Woltlab Burning Board (WBB) 1.2 allows remote attackers to execute arbitrary SQL commands via the boardid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/438184 - http://www.securityfocus.com/bid/18597 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27353 - http://securityreason.com/securityalert/1153 - http://securitytracker.com/id?1016374
CVE ID: CVE-2006-3256 State: PUBLISHED Published: 2006-06-27T19:00:00 Last Updated: 2024-08-07T18:23:21.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in report.php in Woltlab Burning Board (WBB) 2.3.1 allows remote attackers to execute arbitrary SQL commands via the postid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/18597 - http://seclists.org/lists/bugtraq/2006/Jun/0614.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/27351 - http://securitytracker.com/id?1016374
CVE ID: CVE-2006-3257 State: PUBLISHED Published: 2006-06-27T19:00:00 Last Updated: 2024-08-07T18:23:20.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.7.7 allow remote attackers to inject arbitrary HTML or web script via unspecified attack vectors, possibly including (1) calendar/myagenda.php, (2) document/document.php, (3) phpbb/newtopic.php, (4) tracking/userLog.php, and (5) wiki/page.php. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1016387 - http://securityreason.com/securityalert/1160 - http://www.claroline.net/dlarea/claroline.patch17701.zip - http://www
7 - http://securityreason.com/securityalert/1160 - http://www.claroline.net/dlarea/claroline.patch17701.zip - http://www.securityfocus.com/bid/18667 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27391 - http://www.securityfocus.com/archive/1/438343/100/0/threaded - http://secunia.com/advisories/20817 - http://www.vupen.com/english/advisories/2006/2544
CVE ID: CVE-2006-3258 State: PUBLISHED Published: 2006-06-27T21:00:00 Last Updated: 2024-08-07T18:23:21.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in index.html in BNBT TrinEdit and EasyTracker 7.7r3.2004.10.27 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) filter or (2) sort parameters. Additional Analyst Notes: - CVE Program Container: References: - http://pridels0.blogspot.com/2006/06/bnbt-trinedit-vuln.html - http://secunia.com/advisories/20774 - http://securitytracker.com/id?1016368 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27302 - http://www.securityfocus.com/bid
tytracker.com/id?1016368 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27302 - http://www.securityfocus.com/bid/18617 - http://www.vupen.com/english/advisories/2006/2506
CVE ID: CVE-2006-3259 State: PUBLISHED Published: 2006-06-27T21:00:00 Last Updated: 2024-08-07T18:23:21.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the (1) ep parameter to search.php and the (2) subject parameter in comment.php (aka the Subject field when posting a comment). Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/20727 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27242 - http://www.securityfocus.com/bid/18508 - http://www.vupen.com/english/advisories/2006/2460 - http://www.secu
ies/27242 - http://www.securityfocus.com/bid/18508 - http://www.vupen.com/english/advisories/2006/2460 - http://www.securityfocus.com/bid/18560 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27240 - http://www.securityfocus.com/archive/1/437649/100/0/threaded - http://securityreason.com/securityalert/1151
CVE ID: CVE-2006-3260 State: PUBLISHED Published: 2006-06-27T21:00:00 Last Updated: 2024-08-07T18:23:21.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in vlbook 1.02 allows remote attackers to inject arbitrary web script or HTML via the message parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/2505 - http://secunia.com/advisories/20776 - http://www.securityfocus.com/bid/18618 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27333 - http://www.securityfocus.com/archive/1/438146/100/0/threaded - http://colander.altervista.org/advisory/vlbook.txt -
3 - http://www.securityfocus.com/archive/1/438146/100/0/threaded - http://colander.altervista.org/advisory/vlbook.txt - http://securitytracker.com/id?1016379 - http://securityreason.com/securityalert/1150
CVE ID: CVE-2006-3261 State: PUBLISHED Published: 2006-06-27T21:00:00 Last Updated: 2024-08-07T18:23:20.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Trend Micro Control Manager (TMCM) 3.5 allows remote attackers to inject arbitrary web script or HTML via the username field on the login page, which is not properly sanitized before being displayed in the error log. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1016372 - http://www.vupen.com/english/advisories/2006/2526 - http://secunia.com/advisories/20794 - http://www.securityfocus.com/bid/18619 - http://securityreason.com/securitya
526 - http://secunia.com/advisories/20794 - http://www.securityfocus.com/bid/18619 - http://securityreason.com/securityalert/1159 - http://www.securityfocus.com/archive/1/438158/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/27388
CVE ID: CVE-2006-3262 State: PUBLISHED Published: 2006-06-27T21:00:00 Last Updated: 2024-08-07T18:23:20.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/2416 - http://securityreason.com/securityalert/1158 - http://securitytracker.com/id?1016334 - http://www.osvdb.org/26624 - http://www.securityfocus.com/archive/1/437496/100/100/threaded - http://www.securityfocus.com/bid/18492 - http://secunia.c
tp://www.securityfocus.com/archive/1/437496/100/100/threaded - http://www.securityfocus.com/bid/18492 - http://secunia.com/advisories/20745 - http://retrogod.altervista.org/mambo_46rc1_sql.html - http://www.mamboserver.com/?option=com_content&task=view&id=207
CVE ID: CVE-2006-3263 State: PUBLISHED Published: 2006-06-27T21:00:00Z Last Updated: 2024-09-16T19:15:15.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.mamboserver.com/?option=com_content&task=view&id=207
CVE ID: CVE-2006-3264 State: PUBLISHED Published: 2006-06-27T21:00:00 Last Updated: 2024-08-07T18:23:20.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in mclient.cgi in Namo DeepSearch 4.5 allows remote attackers to inject arbitrary web script or HTML via the p parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/20821 - http://securitytracker.com/id?1016366 - http://www.vupen.com/english/advisories/2006/2519 - http://securityreason.com/securityalert/1156 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27404 - http://www.kil13r.info/sa/Kil13r-SA-20060622-2.txt - http://www.se
/exchange.xforce.ibmcloud.com/vulnerabilities/27404 - http://www.kil13r.info/sa/Kil13r-SA-20060622-2.txt - http://www.securityfocus.com/archive/1/438240/100/0/threaded - http://www.securityfocus.com/bid/18589
CVE ID: CVE-2006-3265 State: PUBLISHED Published: 2006-06-27T21:00:00 Last Updated: 2024-08-07T18:23:20.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Qdig before 1.2.9.3, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pre_gallery or (2) post_gallery parameters. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27471 - http://www.vupen.com/english/advisories/2006/2514 - http://secunia.com/advisories/20808 - http://qdig.sourceforge.net/News/News2006-06-24-1 - http://www.osvdb.org/26
2514 - http://secunia.com/advisories/20808 - http://qdig.sourceforge.net/News/News2006-06-24-1 - http://www.osvdb.org/26828 - http://securityreason.com/securityalert/538
CVE ID: CVE-2006-3266 State: PUBLISHED Published: 2006-06-27T21:00:00 Last Updated: 2024-08-07T18:23:21.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in Bee-hive Lite 1.2 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) header parameter to (a) conad/include/rootGui.inc.php and (b) include/rootGui.inc.php; (2) mysqlCall parameter to (c) conad/changeEmail.inc.php, (d) conad/changeUserDetails.inc.php, (e) conad/checkPasswd.inc.php, (f) conad/login.inc.php and (g) conad/logout.inc.php; (3) mysqlcall parameter to (h) include/listall.inc.php; (4) prefix param
nad/login.inc.php and (g) conad/logout.inc.php; (3) mysqlcall parameter to (h) include/listall.inc.php; (4) prefix parameter to (i) show/index.php; and (5) config parameter to (j) conad/include/mysqlCall.inc.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/26822 - http://www.osvdb.org/26819 - http://www.securityfocus.com/bid/18654 - http://www.osvdb.org/26818 - http://www.vupen.com/english/advisories/2006/2516 - http://www.osvdb.org/26824 - http://secunia.com/advisories/20814 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27386 - http://www.osvdb.org/26815 - http://www.osvdb.org/26821 - https://www.exploit-db.com/exploits/1951 - http://www.os
386 - http://www.osvdb.org/26815 - http://www.osvdb.org/26821 - https://www.exploit-db.com/exploits/1951 - http://www.osvdb.org/26820 - http://www.osvdb.org/26816 - http://www.osvdb.org/26817 - http://www.osvdb.org/26823