Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2006-6358 State: PUBLISHED Published: 2006-12-07T11:00:00 Last Updated: 2024-08-07T20:26:46.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the login function in auth.inc in Stefan Frech online-bookmarks 0.6.12 allows remote attackers to execute arbitrary SQL commands via the (1) username and possibly the (2) password parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/23169 - http://www.securityfocus.com/bid/21422 - http://www.vupen.com/english/advisories/2006/4849 - http://marc.info/?l=bugtraq&m=1165255080184
ityfocus.com/bid/21422 - http://www.vupen.com/english/advisories/2006/4849 - http://marc.info/?l=bugtraq&m=116525508018486&w=2 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30696 - http://www.vigilon.com/resources/120406.html
CVE ID: CVE-2006-6359 State: PUBLISHED Published: 2006-12-07T11:00:00 Last Updated: 2024-08-07T20:26:46.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Stefan Frech online-bookmarks 0.6.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/23169 - http://www.securityfocus.com/bid/21422 - http://www.vupen.com/english/advisories/2006/4849 - http://marc.info/?l=bugtraq&m=116525508018486&w=2 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30697 - http://www.vigilon.com/resources/120406.html
CVE ID: CVE-2006-6360 State: PUBLISHED Published: 2006-12-07T11:00:00 Last Updated: 2024-08-07T20:26:46.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in activate.php in PHP Upload Center 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the footerpage parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/30690 - https://www.exploit-db.com/exploits/2886 - http://securitytracker.com/id?1017329 - http://secunia.com/advisories/23204 - http://www.securityfocus.com/bid/21412 - http://www.vupen.com/english/advisories/2006/4837 - https://exchange.x
/23204 - http://www.securityfocus.com/bid/21412 - http://www.vupen.com/english/advisories/2006/4837 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30688
CVE ID: CVE-2006-6361 State: PUBLISHED Published: 2006-12-07T11:00:00 Last Updated: 2024-08-07T20:26:45.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the uploadprogress_php_rfc1867_file function in uploadprogress.c in Bitflux Upload Progress Meter before 8276 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via crafted HTTP POST fileupload requests. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/4841 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30715 - http://www.securityfocus.com/bid/21417 - http://blog.php-security.org/archives/58-Su
bmcloud.com/vulnerabilities/30715 - http://www.securityfocus.com/bid/21417 - http://blog.php-security.org/archives/58-Suhosin-caught-another-remote-code-execution-vulnerability.html - https://ssl.bitflux.ch/horde/chora/diff.php/misc/uploadprogress/uploadprogress.c?r1=8215&r2=8276&ty=h
CVE ID: CVE-2006-6362 State: REJECTED Published: 2006-12-07T11:00:00 Last Updated: 2006-12-11T10:00:00 Description: No description available.
CVE ID: CVE-2006-6363 State: PUBLISHED Published: 2006-12-07T11:00:00 Last Updated: 2024-08-07T20:26:45.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin.pl in BlueSocket Secure Controller (BSC) before 5.2, or without 5.1.1-BluePatch, allows remote attackers to inject arbitrary web script or HTML via the ad_name parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/4844 - http://www.securityfocus.com/bid/21419 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30735 - http://www.securityfocus.com/archive/1/453412/100/0/threaded - http://securityreason.com/sec
com/vulnerabilities/30735 - http://www.securityfocus.com/archive/1/453412/100/0/threaded - http://securityreason.com/securityalert/1991 - http://secunia.com/advisories/23238
CVE ID: CVE-2006-6364 State: PUBLISHED Published: 2006-12-07T11:00:00 Last Updated: 2024-08-07T20:26:45.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in error.php in Inside Systems Mail (ISMail) 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.insidesystems.net/projects/project.php?projectid=4 - http://securityreason.com/securityalert/1990 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30704 - http://www.securityfocus.com/archive/1/453420/100/0/threaded - http://www.vupen.com/english/advisories/20
lities/30704 - http://www.securityfocus.com/archive/1/453420/100/0/threaded - http://www.vupen.com/english/advisories/2006/4848 - http://www.securityfocus.com/bid/21424 - http://secunia.com/advisories/23229
CVE ID: CVE-2006-6365 State: PUBLISHED Published: 2006-12-07T11:00:00 Last Updated: 2024-08-07T20:26:46.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in detail.asp in DUware DUpaypal 3.1, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the iType parameter. NOTE: the iState parameter is already covered by CVE-2005-3976 and the iPro parameter is already covered by CVE-2005-2047. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/4846 - http://www.aria-security.com/forum/showthread.php?t=62 - http://www.securityfocus.com/archive/1/453332/100/0/threaded - h
ttp://www.aria-security.com/forum/showthread.php?t=62 - http://www.securityfocus.com/archive/1/453332/100/0/threaded - http://securityreason.com/securityalert/1987 - http://secunia.com/advisories/23222 - http://www.securityfocus.com/bid/14034 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30666
CVE ID: CVE-2006-6366 State: PUBLISHED Published: 2006-12-07T11:00:00 Last Updated: 2024-08-07T20:26:45.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in includes/elements/spellcheck/spellwin.php in Cerberus Helpdesk 0.97.3, 2.0 through 2.7, 3.2.1, and 3.3 allows remote attackers to inject arbitrary web script or HTML via the js parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/4875 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30719 - http://
http://www.vupen.com/english/advisories/2006/4875 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30719 - http://www.securityfocus.com/bid/21423 - http://secunia.com/advisories/23193
CVE ID: CVE-2006-6367 State: PUBLISHED Published: 2006-12-07T11:00:00 Last Updated: 2024-08-07T20:26:46.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter. NOTE: the iType parameter is already covered by CVE-2005-3976. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/21405 - http://secunia.com/advisories/23224 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30669 - http://www.vupen.com/english/advisories/2006/4845 - http://www.
s://exchange.xforce.ibmcloud.com/vulnerabilities/30669 - http://www.vupen.com/english/advisories/2006/4845 - http://www.aria-security.com/forum/showthread.php?t=60 - http://marc.info/?l=bugtraq&m=116508632603388&w=2
CVE ID: CVE-2006-6368 State: PUBLISHED Published: 2006-12-07T11:00:00 Last Updated: 2024-08-07T20:26:46.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in login.php.inc in awrate 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the toroot parameter to search.php. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/23293 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30708 - https://www.exploit-db.com/exploits/2884 - http://www.vupen.com/english/advisories/2006/4839 - http://www.attrition.org/pipermail/vim/2006-December/001166.html - http://www.securityfocus.com/bid
visories/2006/4839 - http://www.attrition.org/pipermail/vim/2006-December/001166.html - http://www.securityfocus.com/bid/21407
CVE ID: CVE-2006-6369 State: PUBLISHED Published: 2006-12-07T17:00:00 Last Updated: 2024-08-07T20:26:46.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in lib/entry_reply_entry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the eid parameter, when accessed through the "Preview message" functionality. Additional Analyst Notes: - CVE Program Container: References: - http://forums.invisionpower.com/index.php?showtopic=230108 - http://www.securityfocus.com/archive/1/453159/100/100/threaded - http://www.vupen.com/english/advisories/2006/4820 - http://www.securityfocus.com/archive/1/453126/100/100/t
0/threaded - http://www.vupen.com/english/advisories/2006/4820 - http://www.securityfocus.com/archive/1/453126/100/100/threaded
CVE ID: CVE-2006-6370 State: PUBLISHED Published: 2006-12-07T17:00:00 Last Updated: 2024-08-07T20:26:46.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in forum/modules/gallery/post.php in Invision Gallery 2.0.7 allows remote attackers to cause a denial of service and possibly have other impacts, as demonstrated using a "SELECT BENCHMARK" statement in the img parameter in a doaddcomment operation in index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/453167/100/100/threaded - http://www.securityfocus.com/archive/1/453468/100/0/threaded
CVE ID: CVE-2006-6371 State: PUBLISHED Published: 2006-12-07T17:00:00 Last Updated: 2024-08-07T20:26:46.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in pbguestbook.php in JAB Guest Book allows remote attackers to inject arbitrary web script or HTML via the author parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/453482/100/0/threaded - http://www.securityfocus.com/bid/21429 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30718 - http://secunia.com/advisories/23216 - http://securityreason.com/securityalert/1992
CVE ID: CVE-2006-6372 State: PUBLISHED Published: 2006-12-07T17:00:00 Last Updated: 2024-08-07T20:26:45.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in pbguestbook.php in JAB Guest Book 20061205 allow remote attackers to inject arbitrary web script or HTML via the (1) topic or (2) message parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/30718 - http://secunia.com/advisories/23216
CVE ID: CVE-2006-6373 State: PUBLISHED Published: 2006-12-07T17:00:00 Last Updated: 2024-08-07T20:26:46.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via a direct request for libraries/common.lib.php, which reveals the path in an error message. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/30737 - http://www.securityfocus.com/archive/1/453432/100/0/threaded - http://securityreason.com/securityalert/1993
CVE ID: CVE-2006-6374 State: PUBLISHED Published: 2006-12-07T17:00:00 Last Updated: 2024-08-07T20:26:46.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-pl2 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a phpMyAdmin cookie in (1) css/phpmyadmin.css.php, (2) db_create.php, (3) index.php, (4) left.php, (5) libraries/session.inc.php, (6) libraries/transformations/overview.php, (7) querywindow.php, (8) server_engines.php, and possibly other files. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive
sibly other files. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/453432/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/30703 - http://securityreason.com/securityalert/1993
CVE ID: CVE-2006-6375 State: PUBLISHED Published: 2006-12-07T17:00:00 Last Updated: 2024-08-07T20:26:46.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in display.php in Simple Machines Forum (SMF) 1.1 Final and earlier allows remote attackers to inject arbitrary web script or HTML via the contents of a file that is uploaded with the image parameter set, which can be interpreted as script by Internet Explorer's automatic type detection. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/23175 - http://www.vupen.com/english/advisories/2006/4843 - https://exchange.xforce.ibmcloud.com/vulnerabil
m/advisories/23175 - http://www.vupen.com/english/advisories/2006/4843 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30659 - http://www.securityfocus.com/archive/1/453426/100/0/threaded - http://www.securityfocus.com/bid/21431 - http://securityreason.com/securityalert/2001
CVE ID: CVE-2006-6376 State: PUBLISHED Published: 2006-12-07T17:00:00 Last Updated: 2024-08-07T20:26:45.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in fm.php in Simple File Manager (SFM) 0.24a allow remote attackers to use ".." sequences to (1) read arbitrary files via the filename parameter in a download action, (2) delete arbitrary files via the delete parameter, and (3) modify arbitrary files via the edit parameter, which can be leveraged to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/30687 - https://www.exploit-db.com/exploits/
ntainer: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/30687 - https://www.exploit-db.com/exploits/2883
CVE ID: CVE-2006-6377 State: PUBLISHED Published: 2006-12-07T17:00:00 Last Updated: 2024-08-07T20:26:46.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: Uploadscript 1.2 and earlier stores sensitive data under the web root with insufficient access control, which allows remote attackers to obtain the admin password hash via a direct request for /password.txt. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/23264 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30747 - http://www.vupen.com/english/advisories/2006/4893 - http://securityreason.com/securityalert/2003 - http://www.securityfocus.com/archive/1/453644/100/0/threaded
2006/4893 - http://securityreason.com/securityalert/2003 - http://www.securityfocus.com/archive/1/453644/100/0/threaded - http://www.securityfocus.com/archive/1/457696/100/0/threaded
CVE ID: CVE-2006-6378 State: PUBLISHED Published: 2006-12-07T17:00:00 Last Updated: 2024-08-07T20:26:46.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: BTSaveMySql 1.2 stores sensitive data under the web root with insufficient access control, which allows remote attackers to obtain configuration and save files via direct requests. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/30760 - http://securityreason.com/securityalert/2002 - http://www.securityfocus.com/archive/1/453652/100/0/threaded
CVE ID: CVE-2006-6379 State: PUBLISHED Published: 2006-12-10T19:00:00 Last Updated: 2024-08-07T20:26:46.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the BrightStor Backup Discovery Service in multiple CA products, including ARCserve Backup r11.5 SP1 and earlier, ARCserve Backup 9.01 up to 11.1, Enterprise Backup 10.5, and CA Server Protection Suite r2, allows remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/4910 - http://www.securityfocus.com/archive/1/453916/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities
10 - http://www.securityfocus.com/archive/1/453916/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/30791 - http://securitytracker.com/id?1017356 - http://securityreason.com/securityalert/2010 - http://www.osvdb.org/30775 - http://www.securityfocus.com/bid/21502 - http://supportconnectw.ca.com/public/storage/infodocs/babsecurity-notice.asp
CVE ID: CVE-2006-6380 State: PUBLISHED Published: 2006-12-07T21:00:00 Last Updated: 2024-08-07T20:26:46.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/2881 - http://www.securityfocus.com/bid/21402 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30723 - http://secunia.com/advisories/23225 - http://www.vupen.com/english/advisories/2006/4819
CVE ID: CVE-2006-6381 State: PUBLISHED Published: 2006-12-07T21:00:00 Last Updated: 2024-08-07T20:26:46.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in getfile.asp in Ultimate HelpDesk allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/2881 - http://secunia.com/advisories/23225 - http://www.vupen.com/english/advisories/2006/4819 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30722
CVE ID: CVE-2006-6382 State: PUBLISHED Published: 2006-12-07T21:00:00 Last Updated: 2024-08-07T20:26:46.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: The control panel for Positive Software H-Sphere before 2.5.0 RC3 creates log files in a user's directory with insecure permissions, which allows local users to append log data to arbitrary files via a symlink attack. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/30753 - http://secunia.com/advisories/23199 - http://www.securityfocus.com/bid/21
ge.xforce.ibmcloud.com/vulnerabilities/30753 - http://secunia.com/advisories/23199 - http://www.securityfocus.com/bid/21436
CVE ID: CVE-2006-6383 State: PUBLISHED Published: 2006-12-10T20:00:00 Last Updated: 2024-08-07T20:26:46.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ";" in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/24022 - http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.010.html - http://www.securityfocus.com/arch
visories/24022 - http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.010.html - http://www.securityfocus.com/archive/1/453938/30/9270/threaded - http://secunia.com/advisories/24514 - http://securityreason.com/securityalert/2000 - http://cvs.php.net/viewcvs.cgi/php-src/ext/session/session.c?r1=1.336.2.53.2.7&r2=1.336.2.53.2.8 - http://www.mandriva.com/security/advisories?name=MDKSA-2007:038 - http://securityreason.com/achievement_securityalert/43 - http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.html - http://www.securityfocus.com/bid/21508
CVE ID: CVE-2006-6384 State: PUBLISHED Published: 2006-12-07T23:00:00 Last Updated: 2024-08-07T20:26:46.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: Absolute path traversal vulnerability in abitwhizzy.php before 20061204 allows remote attackers to read arbitrary files via an absolute pathname in the Filename text window (f parameter), a variant of CVE-2006-6084. Additional Analyst Notes: - CVE Program Container: References: - http://www.unverse.net/abitwhizzy-forum/0611251408/
CVE ID: CVE-2006-6385 State: PUBLISHED Published: 2006-12-08T01:00:00 Last Updated: 2024-08-07T20:26:46.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Intel PRO 10/100, PRO/1000, and PRO/10GbE PCI, PCI-X, and PCIe network adapter drivers (aka NDIS miniport drivers) before 20061205 allows local users to execute arbitrary code with "kernel-level" privileges via an incorrect function call in certain OID handlers. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/30750 - http://www.securityfocus.com/bid/21456 - http://securityreason.com/securityalert/2007 - http://research.eeye.com
30750 - http://www.securityfocus.com/bid/21456 - http://securityreason.com/securityalert/2007 - http://research.eeye.com/html/advisories/upcoming/20060710.html - http://lists.freebsd.org/pipermail/freebsd-security/2006-December/004186.html - http://www.intel.com/support/network/sb/CS-023726.htm - http://research.eeye.com/html/advisories/published/AD20061207.html - http://www.vupen.com/english/advisories/2006/4871 - http://www.kb.cert.org/vuls/id/296681 - http://secunia.com/advisories/23221 - http://www.fujitsu.com/global/support/software/security/products-f/primergy-200701e.html - http://www.securityfocus.com/archive/1/453852/100/0/threaded - http://securitytracker.com/id?1017346
CVE ID: CVE-2006-6386 State: PUBLISHED Published: 2006-12-08T01:00:00 Last Updated: 2024-08-07T20:26:46.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the CVS management/tracker 4.7.x-1.0, 4.7.x-2.0, and 4.7.0 (before the 20060807 contribution release system) for Drupal allows remote attackers to inject arbitrary web script or HTML via the motivation field in the CVS application page, which is not passed through check_markup on display. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/101540 - http://secunia.com/advisories/23261 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30748 - ht
.org/node/101540 - http://secunia.com/advisories/23261 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30748 - http://www.securityfocus.com/bid/21455 - http://www.vupen.com/english/advisories/2006/4870