Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2006-7040 State: PUBLISHED Published: 2007-02-23T01:00:00 Last Updated: 2024-08-07T20:50:05.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in MERCUR Messaging 2005 before Service Pack 4 allows remote attackers to cause a denial of service (crash) via a TOP command to the POP3 service. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/18462 - http://www.vupen.com/english/advisories/2006/2354 - http://secunia.com/advisories/20432 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27232 - http://www.atrium-software.com/download/McrReadMe_EN.html
CVE ID: CVE-2006-7041 State: PUBLISHED Published: 2007-02-23T01:00:00 Last Updated: 2024-08-07T20:50:06.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SMTP service in MERCUR Messaging 2005 before Service Pack 4 allows remote attackers to cause a denial of service (infinite loop) via a message in which neither the originator nor recipient address is known. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/18462 - http://www.vupen.com/english/advisories/2006/2354 - http://secunia.com/advisories/20432 - http://www.atrium-software.com/download/McrReadMe_EN.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/27230
CVE ID: CVE-2006-7042 State: PUBLISHED Published: 2007-02-24T00:00:00 Last Updated: 2024-08-07T20:50:06.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in directory/index.php in Chipmunk directory allows remote attackers to inject arbitrary web script or HTML via the start parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/18119 - http://www.securityfocus.com/archive/1/435381/30/4770/threaded - http://securityreason.com/securityalert/2288
CVE ID: CVE-2006-7043 State: PUBLISHED Published: 2007-02-24T00:00:00 Last Updated: 2024-08-07T20:50:05.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Chipmunk Blogger allow remote authenticated users to inject arbitrary web script or HTML via script tags in (1) posts and (2) profile names; and (3) a javascript URI in a URL argument in the photo gallery. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/17862 - https://exchange.xforce.ibmcloud.com/vulnerabilities/26296 - http://securityreason.com/securityalert/2306 - http://archives.neohapsis.com/archives/bugtraq/2006-05/01
ilities/26296 - http://securityreason.com/securityalert/2306 - http://archives.neohapsis.com/archives/bugtraq/2006-05/0104.html
CVE ID: CVE-2006-7044 State: PUBLISHED Published: 2007-02-24T00:00:00 Last Updated: 2024-08-07T20:50:05.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in comment.core.inc.php in Clan Manager Pro (CMPRO) 1.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the sitepath parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/26223 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27059 - http://sx02.coresec.de/advisories/150.txt - http://www.vupen.com/english/advisories/2006/2195
CVE ID: CVE-2006-7045 State: PUBLISHED Published: 2007-02-24T00:00:00 Last Updated: 2024-08-07T20:50:06.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in Clan Manager Pro (CMPRO) 1.1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the (1) rootpath and possibly (2) sitepath parameters to (a) cmpro.ext/comment.core.inc.php and (b) cmpro.intern/comment.core.inc.php. NOTE: the provenance of this information is unknown; details are obtained from third party sources. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/26224 - http://www.vupen.com/english/advisories/2006/2195
CVE ID: CVE-2006-7046 State: PUBLISHED Published: 2007-02-24T00:00:00Z Last Updated: 2024-09-16T19:24:57.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in cmpro.intern/login.inc.php for Clan Manager Pro (CMPRO) 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/20484 - http://www.osvdb.org/26224
CVE ID: CVE-2006-7047 State: PUBLISHED Published: 2007-02-24T00:00:00 Last Updated: 2024-08-07T20:50:06.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: include.php in Shoutpro 1.0 might allow remote attackers to bypass IP ban restrictions via a URL in the path parameter that points to an alternate bannedips.php file. NOTE: this issue was originally reported as remote file inclusion, but CVE analysis suggests that this cannot be used for code execution. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27111 - http://www.securityfocus.com/archive/1/436997/30/4410/threaded - http://securityreason.com/securityal
rabilities/27111 - http://www.securityfocus.com/archive/1/436997/30/4410/threaded - http://securityreason.com/securityalert/2303 - http://www.securityfocus.com/archive/1/436975/30/4440/threaded
CVE ID: CVE-2006-7048 State: PUBLISHED Published: 2007-02-24T00:00:00Z Last Updated: 2024-09-16T18:04:08.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) clarolineRepositorySys parameter to (a) atutor.inc.php (b) db-generic.inc.php (c) docebo.inc.php (d) dokeos.1.6.inc.php (e) dokeos.inc.php (f) ganesha.inc.php (g) mambo.inc.php (h) moodle.inc.php (i) phpnuke.inc.php (j) postnuke.inc.php and (k) spip.inc.php in claroline/auth/extauth/drivers/; (2) includePath parameter in mambo.inc.php, postnuke.inc.php, and (l) inc/lib/event/init_even
ine/auth/extauth/drivers/; (2) includePath parameter in mambo.inc.php, postnuke.inc.php, and (l) inc/lib/event/init_event_manager.inc.php; and (3) rootSys parameter in (m) inc/lib/export_exe_tracking.class.php, a different set of vectors than CVE-2006-2284. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/25326 - http://www.osvdb.org/25325 - http://www.osvdb.org/25318 - http://www.osvdb.org/25323 - http://www.osvdb.org/25328 - http://www.osvdb.org/25322 - http://www.osvdb.org/25320 - http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0211.html - http://www.osvdb.org/25321
CVE ID: CVE-2006-7049 State: PUBLISHED Published: 2007-02-24T00:00:00 Last Updated: 2024-08-07T20:50:05.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Method method in WikkaWiki (Wikka Wiki) before 1.1.6.2 calls the strstr and strrpos functions with the wrong argument order, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27226 - http://wikkawiki.org/WikkaReleaseNotes - http://www.vupen.com/english/advisories/2006/2381 - http://secunia.com/advisories/20628 - http://www.securityfocus.com/bid/18484 - http
n.com/english/advisories/2006/2381 - http://secunia.com/advisories/20628 - http://www.securityfocus.com/bid/18484 - http://www.osvdb.org/26543
CVE ID: CVE-2006-7050 State: PUBLISHED Published: 2007-02-24T00:00:00 Last Updated: 2024-08-07T20:50:06.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in WikkaWiki (Wikka Wiki) before 1.1.6.2 allows remote attackers to inject arbitrary javascript via (1) events in forced links (url parameter) that are not properly handled in formatters/wakka.php, and possibly (2) other vectors in wikka.php. Additional Analyst Notes: - CVE Program Container: References: - http://wikkawiki.org/WikkaReleaseNotes - http://wush.net/trac/wikka/changeset/47 - http://www.vupen.com/english/advisories/2006/2381 - http://secunia.com/advisories/20628 - http://wus
ikka/changeset/47 - http://www.vupen.com/english/advisories/2006/2381 - http://secunia.com/advisories/20628 - http://wush.net/trac/wikka/ticket/142 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27227 - http://www.securityfocus.com/bid/18481
CVE ID: CVE-2006-7051 State: PUBLISHED Published: 2007-02-24T00:00:00 Last Updated: 2024-08-07T20:50:06.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sys_timer_create function in posix-timers.c for Linux kernel 2.6.x allows local users to cause a denial of service (memory consumption) and possibly bypass memory limits or cause other processes to be killed by creating a large number of posix timers, which are allocated in kernel memory but are not treated as part of the process' memory. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/1657 - http://securityreason.com/securityalert/2287 - https://exchange.xforce.ibmcloud
tps://www.exploit-db.com/exploits/1657 - http://securityreason.com/securityalert/2287 - https://exchange.xforce.ibmcloud.com/vulnerabilities/25712 - http://www.securityfocus.com/archive/1/430278/30/5790/threaded
CVE ID: CVE-2006-7052 State: PUBLISHED Published: 2007-02-24T00:00:00 Last Updated: 2024-08-07T20:50:05.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in DotWidget For Articles (dotwidgeta) 0.2 allow remote attackers to execute arbitrary code via a URL in the (1) file_path parameter to (a) index.php, (b) showcatpicks.php, and (c) showarticle.php; and the (2) admin_header_file and (3) admin_footer_file parameters to (d) admin/authors.php, (e) admin/index.php, (f) admin/categories.php, (g) admin/editconfig.php, and (h) admin/articles.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus
p, and (h) admin/articles.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/437483 - http://securityreason.com/securityalert/2308 - http://www.securityfocus.com/bid/18479 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27327
CVE ID: CVE-2006-7053 State: PUBLISHED Published: 2007-02-24T00:00:00 Last Updated: 2024-08-07T20:50:06.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Arkoon FAST360 UTM appliances 3.0 through 3.0/29, 3.1, 3.2, and 3.3 allows remote attackers to bypass keyword filtering in the FAST HTTP module, and signatures in the IDPS HTTP module, via crafted URLs that are "misinterpreted." Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27003 - http://www.arkoon.fr/upload/alertes/32AK-2006-01-EN-1.0_EVASION_HTTP.pdf - http://www.vupen.com/english/advisories/2006/2216 - http://secunia.com/ad
alertes/32AK-2006-01-EN-1.0_EVASION_HTTP.pdf - http://www.vupen.com/english/advisories/2006/2216 - http://secunia.com/advisories/20570
CVE ID: CVE-2006-7054 State: PUBLISHED Published: 2007-02-24T00:00:00 Last Updated: 2024-08-07T20:50:06.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DNS module in Arkoon FAST360 UTM appliances 3.0 up to 3.0/29, 3.1 through 3.3, and 4.0 allows remote attackers to cause a denial of service (reboot) via a malformed DNS message, as demonstrated by the PROTOS DNS testing suite. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27004 - http://www.arkoon.fr/upload/alertes/33AK-2006-02-EN-1.0_FAST_DNS_DOS.pdf - http://www.vupen.com/english/advisories/2006/2217 - http://secunia.com/advisories/20618 - http://www
_FAST_DNS_DOS.pdf - http://www.vupen.com/english/advisories/2006/2217 - http://secunia.com/advisories/20618 - http://www.ee.oulu.fi/research/ouspg/protos/testing/c09/dns/index.html
CVE ID: CVE-2006-7055 State: PUBLISHED Published: 2007-02-24T00:00:00 Last Updated: 2024-08-07T20:50:06.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in index.php in TotalCalendar 2.30 and earlier allows remote attackers to execute arbitrary code via a URL in the inc_dir parameter, a different vector than CVE-2006-1922. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/1753 - http://www.osvdb.org/25237 - http://sweetphp.com/nuke/index.php - http://sweetphp.com/files/downloads/patches/TotalCalendar/Security_Patch.zip - http://www.securityfocus.com/bid/17618 - http://www.securityfocus.c
downloads/patches/TotalCalendar/Security_Patch.zip - http://www.securityfocus.com/bid/17618 - http://www.securityfocus.com/archive/1/431866/30/5370/threaded - http://securityreason.com/securityalert/2290 - https://exchange.xforce.ibmcloud.com/vulnerabilities/25878
CVE ID: CVE-2006-7056 State: PUBLISHED Published: 2007-02-24T00:00:00 Last Updated: 2024-08-07T20:50:06.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in DreamCost HostAdmin 3.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) functions.php and (2) members.php. NOTE: the index.php vector is covered by CVE-2006-0791. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/2289 - http://www.majorsecurity.de/advisory/major_rls9.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/24723 - http://www.securityfocus.com/arc
/advisory/major_rls9.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/24723 - http://www.securityfocus.com/archive/1/435993/30/4650/threaded - http://secunia.com/advisories/18901 - http://www.securityfocus.com/bid/18284
CVE ID: CVE-2006-7057 State: PUBLISHED Published: 2007-02-24T01:00:00 Last Updated: 2024-08-07T20:50:06.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in search.php in Sphider before 1.3.1c allows remote attackers to execute arbitrary SQL commands via the category parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this issue might be primary to CVE-2006-2506.2. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/1845 - http://secunia.com/advisories/20131
CVE ID: CVE-2006-7058 State: PUBLISHED Published: 2007-02-24T01:00:00 Last Updated: 2024-08-07T20:50:06.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Sphider before 1.3.1c allow remote attackers to inject arbitrary web script or HTML via the catid parameter to (1) templates/standard/search_form.html and (2) templates/dark/search_form.html. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/1845 - http://www.osvdb.org/25574 - http://secunia.com/advis
References: - http://www.vupen.com/english/advisories/2006/1845 - http://www.osvdb.org/25574 - http://secunia.com/advisories/20131
CVE ID: CVE-2006-7059 State: PUBLISHED Published: 2007-02-24T01:00:00 Last Updated: 2024-08-07T20:50:06.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Scriptsez.net E-Dating System allow remote attackers to inject arbitrary web script or HTML via encoded entities (&#0000039) in IMG tags to (1) messages, (2) profile fields, or (3) the id parameter in a dologin operation to cindex.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27102 - http://archives.neohapsis.com/archives/bugtraq/2006-06/0067.html - http://securityreason.com/securityalert/2300 - h
02 - http://archives.neohapsis.com/archives/bugtraq/2006-06/0067.html - http://securityreason.com/securityalert/2300 - http://www.securityfocus.com/bid/18336 - http://secunia.com/advisories/20535
CVE ID: CVE-2006-7060 State: PUBLISHED Published: 2007-02-24T01:00:00 Last Updated: 2024-08-07T20:50:05.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: cindex.php in Scriptsez.net E-Dating System allows remote attackers to obtain the full path via an invalid id parameter in a dologin action, which leaks the path in an error message. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2006-06/0067.html - http://securityreason.com/securityalert/2300 - http://secunia.com/advisories/20535
CVE ID: CVE-2006-7061 State: PUBLISHED Published: 2007-02-24T01:00:00 Last Updated: 2024-08-07T20:50:06.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: Scriptsez.net E-Dating System stores data files with predictable names under the web document root with insufficient access control, which allows remote attackers to read private messages and leverage them for cross-site scripting (XSS) attacks. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2006-06/0067.html - http://securityreason.com/securityalert/2300 - http://secunia.com/advisories/20535
CVE ID: CVE-2006-7062 State: PUBLISHED Published: 2007-02-24T01:00:00 Last Updated: 2024-08-07T20:50:06.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: calendar.php in Kamgaing Email System (kmail) 2.3 and earlier allows remote attackers to obtain the full path of the server via an invalid d parameter, which leaks the path in an error message. Additional Analyst Notes: - CVE Program Container: References: - http://pridels0.blogspot.com/2006/04/kmail-23-vuln.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/26120 - http://www.osvdb.org/25065
CVE ID: CVE-2006-7063 State: PUBLISHED Published: 2007-02-24T01:00:00 Last Updated: 2024-08-07T20:50:06.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in profile.php in TinyPHPforum 3.6 and earlier allows remote attackers to include and execute arbitrary files via ".." sequences in the uname parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/18304 - https://exchange.xforce.ibmcloud.com/vulnerabilities/26881 - https://www.exploit-db.com/exploits/1857
CVE ID: CVE-2006-7064 State: PUBLISHED Published: 2007-02-24T01:00:00 Last Updated: 2024-08-07T20:50:05.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in forum/admin.php for Invision Power Board (IPB) 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML as the administrator via the phpinfo parameter. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2006-06/0204.html - http://www.securityfocus.com/bid/18450 - http://securityreason.com/securityalert/2307 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27069
CVE ID: CVE-2006-7065 State: PUBLISHED Published: 2007-02-27T18:00:00Z Last Updated: 2024-09-16T19:52:09.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via an IFRAME with a certain XML file and XSL stylesheet that triggers a crash in mshtml.dll when a refresh is called, probably a null pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/19364 - http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0163.html - http://www3.ca.com/be/securityadvisor/vulninfo/Vuln.aspx?ID=34511
CVE ID: CVE-2006-7066 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:06.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by creating an object inside an iframe, deleting the frame by setting its location.href to about:blank, then accessing a property of the object within the deleted frame, which triggers a NULL pointer dereference. NOTE: it was later reported that 7.0.6000.16473 and earlier are also affected. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2009-07/0193.html -
Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2009-07/0193.html - http://websecurity.com.ua/3130/ - http://www.securityfocus.com/bid/19228 - http://browserfun.blogspot.com/2006/07/mobb-30-orphan-object-properties.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/28068 - http://www.osvdb.org/27533 - http://blogs.securiteam.com/index.php/archives/554
CVE ID: CVE-2006-7067 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:06.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: Oracle 10g R2 and possibly other versions allows remote attackers to trigger internal errors, and possibly have other impacts, via an "alter session set events" command with invalid arguments. NOTE: this issue was originally disputed by a third party, but the dispute was retracted. NOTE: this issue was called an "integer overflow" in the original source, but this might be incorrect. Additional Analyst Notes: - CVE Program Container: References: - http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048292.html - http:/
- CVE Program Container: References: - http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048292.html - http://securityreason.com/securityalert/2328 - http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/048251.html - http://www.securityfocus.com/archive/1/441345/100/0/threaded - http://www.securityfocus.com/archive/1/441477/100/0/threaded
CVE ID: CVE-2006-7068 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:05.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in CliServ Web Community 0.65 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cl_headers parameter to (1) menu.php3 and (2) login.php3. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/19737 - https://www.exploit-db.com/exploits/2257 - https://exchange.xforce.ibmcloud.com/vulnerabilities/28590
CVE ID: CVE-2006-7069 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:06.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in smarty_config.php in Socketwiz Bookmarks 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the root_dir parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/28850 - http://secunia.com/advisories/21857 - http://www.securityfocus.com/bid/19935 - https://www.exploit-db.com/exploits/2336 - http://www.vupen.com/english/advisories/2006/3550
CVE ID: CVE-2006-7070 State: PUBLISHED Published: 2007-02-27T18:00:00 Last Updated: 2024-08-07T20:50:06.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in manager/media/ibrowser/scripts/rfiles.php in Etomite CMS 0.6.1 and earlier allows remote attackers to upload and execute arbitrary files via an nfile[] parameter with a filename that contains a .php extension followed by a valid image extension such as .gif or .jpg, then calling the rename function. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/21208 - http://www.securityfocus.com/bid/19157 - http://securitytracker.com/id?1016593 - http: