Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2006-5982 State: PUBLISHED Published: 2006-11-20T21:00:00 Last Updated: 2024-08-07T20:12:31.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeleniumServer FTP Server 1.0, and possibly earlier, stores user passwords in plaintext in the Servers directory, which allows attackers to obtain passwords by reading the file. NOTE: the provenance of this information is unknown; details are obtained from third party sources. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/30449 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30334 - http://secunia.com/advisories/22928 - http://www.vupen.com/english/advisories/2006/4540
CVE ID: CVE-2006-5983 State: PUBLISHED Published: 2006-11-20T21:00:00 Last Updated: 2024-08-07T20:12:31.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user parameter to (a) CMD_SHOW_RESELLER or (b) CMD_SHOW_USER in the Admin level; the (2) TYPE parameter to (c) CMD_TICKET_CREATE or (d) CMD_TICKET, the (3) user parameter to (e) CMD_EMAIL_FORWARDER_MODIFY, (f) CMD_EMAIL_VACATION_MODIFY, or (g) CMD_FTP_SHOW, and the (4) name parameter to (h) CMD_EMAIL_LIST in the User level; or the (5) user parameter to (i) C
(g) CMD_FTP_SHOW, and the (4) name parameter to (h) CMD_EMAIL_LIST in the User level; or the (5) user parameter to (i) CMD_SHOW_USER in the Reseller level. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/21049 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30256 - http://aria-security.net/advisory/directadmin.txt - http://www.securityfocus.com/archive/1/451376/100/0/threaded - http://securityreason.com/securityalert/1885
CVE ID: CVE-2006-5984 State: PUBLISHED Published: 2006-11-20T21:00:00 Last Updated: 2024-08-07T20:12:31.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) txtCompanyName, (2) txtEmail, or (3) txtUserAccNum parameter to (a) users.asp, or the (4) setThemeColour parameter to (b) default.asp in the Reseller and Admin levels; or the (5) setThemeColour parameter to default.asp in the User level. NOTE: the txtDomainName parameter to domains.asp is covered by CVE-2006-1407, which suggests that this vector is fixe
l. NOTE: the txtDomainName parameter to domains.asp is covered by CVE-2006-1407, which suggests that this vector is fixed in 3.2.10 stable. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/451737/100/0/threaded - http://aria-security.net/advisory/helm.txt - http://www.vupen.com/english/advisories/2006/4557 - http://secunia.com/advisories/22916 - http://securityreason.com/securityalert/1884 - http://securitytracker.com/id?1017240 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30309 - http://www.securityfocus.com/archive/1/451848/100/200/threaded
CVE ID: CVE-2006-5985 State: PUBLISHED Published: 2006-11-20T21:00:00 Last Updated: 2024-08-07T20:12:31.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/options.php in Extreme CMS 0.9, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) bg1, (2) bg2, (3) text, or (4) size parameters. NOTE: the provenance of this information is unknown; details are obtained from third party sources. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/22919 - http://www.vupen.com/english/advisories/2006/4529
CVE ID: CVE-2006-5986 State: PUBLISHED Published: 2006-11-20T21:00:00 Last Updated: 2024-08-07T20:12:31.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/options.php in Extreme CMS 0.9, and possibly earlier, does not require authentication, which might allow remote attackers to conduct unauthorized activities. NOTE: this issue can be combined with another vulnerability to expand the scope of a cross-site scripting (XSS) attack without authentication. NOTE: the provenance of this information is unknown; details are obtained from third party sources. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/22919 - http://www.vupen.com/e
ional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/22919 - http://www.vupen.com/english/advisories/2006/4529
CVE ID: CVE-2006-5987 State: PUBLISHED Published: 2006-11-20T21:00:00 Last Updated: 2024-08-07T20:12:31.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in default.asp in ASPintranet, possibly 1.2, allows remote attackers to execute arbitrary SQL commands via the a parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/21061 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30267 - http://aria-security.net/advisory/ASPintranet.txt - http://www.securityfocus.com/archive/1/451504/100/0/threaded - http://securityreason.com/securityalert/1886
CVE ID: CVE-2006-5988 State: PUBLISHED Published: 2006-11-20T21:00:00Z Last Updated: 2024-09-17T03:22:22.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Windows 2000 Advanced Server SP4 running Active Directory allows remote attackers to cause a denial of service via unknown vectors, as demonstrated by a certain VulnDisco Pack module. NOTE: the provenance of this information is unknown; the details are obtained from third party information. As of 20061116, this disclosure has no actionable information. However, since the VulnDisco Pack author is a reliable researcher, the disclosure is being assigned a CVE identifier for tracking purposes. Additio
o Pack author is a reliable researcher, the disclosure is being assigned a CVE identifier for tracking purposes. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/21083 - http://secunia.com/advisories/22871
CVE ID: CVE-2006-5989 State: PUBLISHED Published: 2006-11-20T21:00:00 Last Updated: 2024-08-07T20:12:31.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: Off-by-one error in the der_get_oid function in mod_auth_kerb 5.0 allows remote attackers to cause a denial of service (crash) via a crafted Kerberos message that triggers a heap-based buffer overflow in the component array. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=136650 - http://secunia.com/advisories/23251 - http://secunia.com/advisories/23681 - http://www.debian.org/security/2007/dsa-1247 - http://www.securityfocus.com/bid/21214 - https://bugzil
dvisories/23681 - http://www.debian.org/security/2007/dsa-1247 - http://www.securityfocus.com/bid/21214 - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=206736 - http://secunia.com/advisories/23023 - http://secunia.com/advisories/23820 - http://www.redhat.com/support/errata/RHSA-2006-0746.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/30456 - http://www.mandriva.com/security/advisories?name=MDKSA-2006:218 - http://securitytracker.com/id?1017348 - http://www.vupen.com/english/advisories/2006/4633 - http://security.gentoo.org/glsa/glsa-200701-14.xml - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10051
CVE ID: CVE-2006-5990 State: PUBLISHED Published: 2006-11-21T01:00:00 Last Updated: 2024-08-07T20:12:31.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: VMWare VirtualCenter client 2.x before 2.0.1 Patch 1 (Build 33643) and 1.4.x before 1.4.1 Patch 1 (Build 33425), when server certificate verification is enabled, does not verify the server's X.509 certificate when creating an SSL session, which allows remote malicious servers to spoof valid servers via a man-in-the-middle attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/4655 - http://securitytracker.com/id?1017270 - http://www.securityfocus.com/archive/1/4522
n.com/english/advisories/2006/4655 - http://securitytracker.com/id?1017270 - http://www.securityfocus.com/archive/1/452275/100/0/threaded - http://www.vmware.com/download/vi/vc-201-200611-patch.html - http://kb.vmware.com/kb/4646606 - http://secunia.com/advisories/23053 - http://www.securityfocus.com/bid/21231 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30477
CVE ID: CVE-2006-5991 State: PUBLISHED Published: 2006-11-21T02:00:00 Last Updated: 2024-08-07T20:12:31.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in wwweb concepts CactuShop allow remote attackers to execute arbitrary SQL commands via the (1) prodtype parameter in prodtype.asp and the (2) product parameter in product.asp. Additional Analyst Notes: - CVE Program Container: References: - http://aria-security.net/advisory/WWWeb%20Cocepts.txt - http://www.securityfocus.com/bid/21076 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30261 - http://secunia.com/advisories/22895 - http://www.vupen.com/english/advisories/2006/4528 - ht
com/vulnerabilities/30261 - http://secunia.com/advisories/22895 - http://www.vupen.com/english/advisories/2006/4528 - http://www.securityfocus.com/archive/1/451513/100/100/threaded - http://securityreason.com/securityalert/1887
CVE ID: CVE-2006-5992 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2006-5993 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2006-5994 State: PUBLISHED Published: 2006-12-06T20:00:00 Last Updated: 2024-08-07T20:12:31.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Microsoft Word 2000 and 2002, Office Word and Word Viewer 2003, Word 2004 and 2004 v. X for Mac, and Works 2004, 2005, and 2006 allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption, a different vulnerability than CVE-2006-6456. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/30824 - http://www.securityfocus.com/archive/1/453735/100/0/threaded - http://www.securityfocus.com/archive/1/453906
org/30824 - http://www.securityfocus.com/archive/1/453735/100/0/threaded - http://www.securityfocus.com/archive/1/453906/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/30738 - http://www.microsoft.com/technet/security/advisory/929433.mspx - http://secunia.com/advisories/23232 - http://www.us-cert.gov/cas/techalerts/TA07-044A.html - http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A238 - http://blogs.securiteam.com/?p=759 - http://www.vupen.com/english/advisories/2006/4866 - https://docs.microsoft.com/en-us/security-updates/securitybulle
59 - http://www.vupen.com/english/advisories/2006/4866 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-014 - http://www.kb.cert.org/vuls/id/167928 - http://securitytracker.com/id?1017339 - http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9005698&intsrc=hm_list - http://www.securityfocus.com/bid/21451 - http://www.securityfocus.com/archive/1/454061/100/0/threaded
CVE ID: CVE-2006-5995 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2006-5996 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2006-5997 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2006-5998 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2006-5999 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2006-6000 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2006-6001 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2006-6002 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2006-6003 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2006-6004 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2006-6005 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2006-6006 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2006-6007 State: PUBLISHED Published: 2006-11-21T23:00:00 Last Updated: 2024-08-07T20:12:31.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: save_profile.asp in WebEvents (Online Event Registration Template) 2.0 and earlier allows remote attackers to change the profiles, passwords, and other information for arbitrary users via a modified UserID parameter. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/1888 - http://www.securityfocus.com/archive/1/451411/100/0/threaded
CVE ID: CVE-2006-6008 State: PUBLISHED Published: 2006-11-21T23:00:00Z Last Updated: 2024-09-16T18:34:27.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: ftpd in Linux Netkit (linux-ftpd) 0.17, and possibly other versions, does not check the return status of certain seteuid, setgid, and setuid calls, which might allow remote authenticated users to gain privileges if these calls fail in cases such as PAM failures or resource limits, a different vulnerability than CVE-2006-5778. Additional Analyst Notes: - CVE Program Container: References: - http://www.gentoo.org/security/en/glsa/glsa-200611-05.xml - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384454 - http://ftp.debian.or
org/security/en/glsa/glsa-200611-05.xml - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384454 - http://ftp.debian.org/debian/pool/main/l/linux-ftpd/linux-ftpd_0.17-22.diff.gz - http://secunia.com/advisories/22816 - http://secunia.com/advisories/22853 - http://bugs.gentoo.org/show_bug.cgi?id=150292
CVE ID: CVE-2006-6009 State: PUBLISHED Published: 2006-11-21T23:00:00 Last Updated: 2024-08-07T20:12:31.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Java Runtime Environment (JRE) Swing library in JDK and JRE 5.0 Update 7 and earlier allows attackers to obtain certain information via unknown attack vectors, related to an untrusted applet accessing data in other applets. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1017229 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30304 - http://www.vupen.com/english/advisories/2006/4523 - http://www.securityfocus.com/bid/21077 - http://secunia.c
es/30304 - http://www.vupen.com/english/advisories/2006/4523 - http://www.securityfocus.com/bid/21077 - http://secunia.com/advisories/22910 - http://sunsolve.sun.com/search/document.do?assetkey=1-26-102622-1
CVE ID: CVE-2006-6010 State: PUBLISHED Published: 2006-11-21T23:00:00 Last Updated: 2024-08-07T20:12:31.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP allows remote attackers to obtain potentially sensitive information such as operating system and SAP version via an RFC_SYSTEM_INFO RfcCallReceive request, a different vulnerability than CVE-2003-0747. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/1889 - https://exchange.xforce.ibmcloud.com/vulnerabilities/39997 - http://www.securityfocus.com/archive/1/451378/100/0/threaded
CVE ID: CVE-2006-6011 State: PUBLISHED Published: 2006-11-21T23:00:00 Last Updated: 2024-08-07T20:12:31.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in SAP Web Application Server before 6.40 patch 6 allows remote attackers to cause a denial of service (enserver.exe crash) via a certain UDP packet to port 64999, aka "two bytes UDP crash," a different vulnerability than CVE-2006-5785. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/1889 - http://www.securityfocus.com/archive/1/451378/100/0/threaded
CVE ID: CVE-2006-6012 State: PUBLISHED Published: 2006-11-21T23:00:00 Last Updated: 2024-08-07T20:12:31.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in csm/asp/listings.asp in MGinternet Car Site Manager (CSM) allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/4532 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30274
CVE ID: CVE-2006-6013 State: PUBLISHED Published: 2006-11-21T23:00:00 Last Updated: 2024-08-07T20:12:31.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows local users to read arbitrary memory contents via certain negative values of crom_buf->len in an FW_GCROM command. NOTE: this issue has been labeled as an integer overflow, but it is more like an integer signedness error. Additio
mand. NOTE: this issue has been labeled as an integer overflow, but it is more like an integer signedness error. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/451861/100/0/threaded - http://securitytracker.com/id?1017344 - http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0261.html - http://www.securityfocus.com/archive/1/451637/100/0/threaded - http://mail-index.netbsd.org/tech-security/2006/11/16/0001.html - http://security.freebsd.org/advisories/FreeBSD-SA-06:25.kmem.asc - https://exchange.xforce.ibmcloud.com/vulnerabilities/30347 - http://www.securityfocus.com/archive/1/452264/100/0/threaded - http://www.securityfocus.
oud.com/vulnerabilities/30347 - http://www.securityfocus.com/archive/1/452264/100/0/threaded - http://www.securityfocus.com/archive/1/452331/100/0/threaded - http://www.securityfocus.com/archive/1/452124/100/0/threaded - http://mail-index.netbsd.org/tech-security/2006/12/14/0002.html - http://www.dragonflybsd.org/cvsweb/src/sys/bus/firewire/fwdev.c - http://www.securityfocus.com/bid/21089 - http://secunia.com/advisories/22917 - http://www.securityfocus.com/archive/1/451698/100/0/threaded - http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/ieee1394/fwdev.c - http://www.securityfocus.com/archive/1/451677/100/0/threaded - http://www.securityfocus.com/archive/1/451629/100/0/threaded - http://www.k
yfocus.com/archive/1/451677/100/0/threaded - http://www.securityfocus.com/archive/1/451629/100/0/threaded - http://www.kernelhacking.com/bsdadv1.txt
CVE ID: CVE-2006-6014 State: PUBLISHED Published: 2006-11-21T23:00:00Z Last Updated: 2024-09-16T16:14:05.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NetBSD-current kernel before 20061028 does not properly perform bounds checking of an unspecified userspace parameter in the ptrace system call during a PT_DUMPCORE request, which allows local users to have an unknown impact. Additional Analyst Notes: - CVE Program Container: References: - http://mail-index.netbsd.org/current-users/2006/11/10/0000.html
CVE ID: CVE-2006-6015 State: PUBLISHED Published: 2006-11-21T23:00:00 Last Updated: 2024-08-07T20:12:31.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the JavaScript implementation in Safari on Apple Mac OS X 10.4 allows remote attackers to cause a denial of service (application crash) via a long argument to the exec method of a regular expression. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/21053 - http://www.securityfocus.com/archive/1/451823/100/0/threaded - http://www.securityfocus.com/archive/1/451542/100/0/threaded
CVE ID: CVE-2006-6016 State: PUBLISHED Published: 2006-11-21T23:00:00.000Z Last Updated: 2025-04-03T16:02:24.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified user_id parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://trac.wordpress.org/ticket/3142 - http://www.gentoo.org/security/en/glsa/glsa-200611-10.xml - http://bugs.gentoo.org/show_bug.cgi?id=153303
CVE ID: CVE-2006-6017 State: PUBLISHED Published: 2006-11-21T23:00:00.000Z Last Updated: 2025-04-03T15:58:10.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service (application crash) via a string that represents a (1) malformed or (2) large serialized object, because the object triggers automatic unserialization for display. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.gentoo.org/security/en/glsa/glsa-200611-10.xml - http://trac.wordpress.org/ti
ADP Vulnrichment: References: - http://www.gentoo.org/security/en/glsa/glsa-200611-10.xml - http://trac.wordpress.org/ticket/2591 - http://bugs.gentoo.org/show_bug.cgi?id=153303
CVE ID: CVE-2006-6018 State: PUBLISHED Published: 2006-11-21T23:00:00 Last Updated: 2024-08-07T20:12:31.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in mybic_server.php in Jim Plush My-BIC 0.6.5 allows remote attackers to execute arbitrary PHP code via a URL in the INC_PATH parameter, a different vector than CVE-2006-5089. NOTE: this issue is disputed by CVE and third party researchers because INC_PATH is a constant Additional Analyst Notes: - CVE Program Container: References: - http://attrition.org/pipermail/vim/2006-November/001127.html - http://www.securityfocus.com/archive/1/451876/100/0/threaded - http://osvdb.org/31542 - http:
006-November/001127.html - http://www.securityfocus.com/archive/1/451876/100/0/threaded - http://osvdb.org/31542 - http://securityreason.com/securityalert/1891 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30361
CVE ID: CVE-2006-6019 State: PUBLISHED Published: 2006-11-21T23:00:00 Last Updated: 2024-08-07T20:12:31.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in extensions/googiespell/googlespell_proxy.php in Bill Roberts Bloo 1.0 allows remote attackers to inject arbitrary web script or HTML via the lang parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.xmors.com/forum/index.php?topic=1175.msg5782%3Btopicsen - http://www.securityfocus.com/archive/1/451777/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/30326 - http://www.securityfocus.com/bid/21130