Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2006-3531 State: PUBLISHED Published: 2006-07-12T21:00:00 Last Updated: 2024-08-07T18:30:34.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: includes/editor/insert_image.php in Pivot 1.30 RC2 and earlier creates the authentication credentials from parameters, which allows remote attackers to obtain privileges and upload arbitrary files via modified (1) pass and (2) session parameters, and (3) pass and (4) userlevel indices of the (a) Pivot_Vars[] or (b) Users[] array parameters. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/439495/100/0/threaded - http://retrogod.altervista.org/pivot_130RC2_xpl.html - http:/
://www.securityfocus.com/archive/1/439495/100/0/threaded - http://retrogod.altervista.org/pivot_130RC2_xpl.html - http://www.vupen.com/english/advisories/2006/2744 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27671 - http://secunia.com/advisories/20962 - http://www.securityfocus.com/bid/18881 - http://securityreason.com/securityalert/1214 - http://www.osvdb.org/27126
CVE ID: CVE-2006-3532 State: PUBLISHED Published: 2006-07-12T21:00:00 Last Updated: 2024-08-07T18:30:34.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP file inclusion vulnerability in includes/edit_new.php in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a FTP URL or full file path in the Paths[extensions_path] parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/439495/100/0/threaded - http://retrogod.altervista.org/pivot_130RC2_xpl.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/27679 - http://secunia.com/advisories/20962 -
ot_130RC2_xpl.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/27679 - http://secunia.com/advisories/20962 - http://www.securityfocus.com/bid/18881 - http://securityreason.com/securityalert/1214 - http://www.osvdb.org/27512
CVE ID: CVE-2006-3533 State: PUBLISHED Published: 2006-07-12T21:00:00 Last Updated: 2024-08-07T18:30:34.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) fg, (2) line1, (3) line2, (4) bg, (5) c1, (6) c2, (7) c3, and (8) c4 parameters in (a) includes/blogroll.php; (9) name and (10) js_name parameters in (b) includes/editor/edit_menu.php; and, even if register_globals is not enabled, the (11) h and (12) w parameters in (c) includes/photo.php. Additional Analyst Notes: - CVE Program Container:
enabled, the (11) h and (12) w parameters in (c) includes/photo.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/439495/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/27672 - http://retrogod.altervista.org/pivot_130RC2_xpl.html - http://www.vupen.com/english/advisories/2006/2744 - http://www.osvdb.org/27128 - http://secunia.com/advisories/20962 - http://www.securityfocus.com/bid/18881 - http://securityreason.com/securityalert/1214 - http://www.osvdb.org/27129 - http://www.osvdb.org/27127
CVE ID: CVE-2006-3534 State: PUBLISHED Published: 2006-07-12T21:00:00 Last Updated: 2024-08-07T18:30:34.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Nullsoft SHOUTcast DSP before 1.9.6 filters directory traversal sequences before decoding, which allows remote attackers to read arbitrary files via encoded dot dot (%2E%2E) sequences in an HTTP GET request for a file path containing "/content". Additional Analyst Notes: - CVE Program Container: References: - http://people.ksp.sk/~goober/advisory/001-shoutcast.html - http://securitytracker.com/id?1016493 - http://secunia.com/advisories/20524 - http://www.vupen.com/english/advisories/2006/28
//securitytracker.com/id?1016493 - http://secunia.com/advisories/20524 - http://www.vupen.com/english/advisories/2006/2801 - http://bugs.gentoo.org/show_bug.cgi?id=136721 - http://www.shoutcast.com/#news - http://security.gentoo.org/glsa/glsa-200607-05.xml
CVE ID: CVE-2006-3535 State: PUBLISHED Published: 2006-07-12T21:00:00 Last Updated: 2024-08-07T18:30:34.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Nullsoft SHOUTcast DSP before 1.9.7 allows remote attackers to read arbitrary files via unspecified vectors that are a "slight variation" of CVE-2006-3534. Additional Analyst Notes: - CVE Program Container: References: - http://people.ksp.sk/~goober/advisory/001-shoutcast.html - http://securitytracker.com/id?1016493 - http://secunia.com/advisories/20524 - http://bugs.gentoo.org/show_bug.cgi?id=136721 - http://www.shoutcast.com/#news - http://security.gentoo.org/glsa/glsa-200607-05.xml
CVE ID: CVE-2006-3536 State: PUBLISHED Published: 2006-07-12T21:00:00 Last Updated: 2024-08-07T18:30:34.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: Direct static code injection vulnerability in code/class_db_text.php in EJ3 TOPo 2.2.178 and earlier allows remote attackers to execute arbitrary PHP code via parameters such as (1) descripcion and (2) pais, which are stored directly in a PHP script. NOTE: the provenance of this information is unknown; the details are obtained solely from third party reports. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27659 - http://www.vupen.com/english/advisories/2006
References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27659 - http://www.vupen.com/english/advisories/2006/2736 - http://www.securityfocus.com/bid/18935
CVE ID: CVE-2006-3537 State: PUBLISHED Published: 2006-07-12T21:00:00 Last Updated: 2024-08-07T18:30:34.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in index.php in Randshop before 1.2 allows remote attackers to execute arbitrary PHP code via the dateiPfad parameter, a different vector than CVE-2006-3375. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/2740 - http://www.securityfocus.com/bid/18865 - http://securityreason.com/securityalert/1213 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27540 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27541 - http://
xchange.xforce.ibmcloud.com/vulnerabilities/27540 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27541 - http://www.securityfocus.com/archive/1/439750/100/0/threaded
CVE ID: CVE-2006-3538 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in demo.php in BeatificFaith Eprayer Alpha allow remote attackers to inject arbitrary web script or HTML via the SRC attribute of a SCRIPT element in the (1) "Your name" field and (2) "Enter Prayer Request here" field. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27162 - http://www.youfucktard.com/xsp/eprayer2.jpg - http://www.youfucktard.com/xsp/eprayer1.jpg - http://www.securityfocus.com/bid/18485 - ht
ucktard.com/xsp/eprayer2.jpg - http://www.youfucktard.com/xsp/eprayer1.jpg - http://www.securityfocus.com/bid/18485 - http://www.securityfocus.com/archive/1/437269/100/0/threaded
CVE ID: CVE-2006-3539 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in DKScript.com Dragon's Kingdom Script 1.0 allow remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element in the (1) Subject and (2) Message fields in a do=write (aka Send Mail Message) action in gamemail.php; the (3) Gender, (4) Country/Location, (5) MSN Messenger, (6) AOL Instant Messenger, (7) Yahoo Instant Messenger, and (8) ICQ fields in a do=onlinechar (aka Edit your Profile) action in index.php, as accessed by
hoo Instant Messenger, and (8) ICQ fields in a do=onlinechar (aka Edit your Profile) action in index.php, as accessed by dk.php; a javascript URI in the SRC attribute of an IMG element in the (9) Title and (10) Message fields in a do=new (aka Create Thread) action in general.php; and a javascript URI in the SRC attribute of an IMG element in unspecified fields in (11) other Forum posts and (12) Forum replies. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/20662 - http://www.vupen.com/english/advisories/2006/2439 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27390 - http://www.securityfocus.com/bid/18535 - http://www.youfucktard.com/xsp
ange.xforce.ibmcloud.com/vulnerabilities/27390 - http://www.securityfocus.com/bid/18535 - http://www.youfucktard.com/xsp/dragking5.jpg - http://www.youfucktard.com/xsp/dragking2.jpg - http://www.youfucktard.com/xsp/dragking6.jpg - http://www.securityfocus.com/archive/1/437753/100/0/threaded - http://www.youfucktard.com/xsp/dragking4.jpg - http://www.youfucktard.com/xsp/dragking3.jpg - http://www.youfucktard.com/xsp/dragking7.jpg - http://www.youfucktard.com/xsp/dragking1.jpg
CVE ID: CVE-2006-3540 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: Check Point Zone Labs ZoneAlarm Internet Security Suite 6.5.722.000, 6.1.737.000, and possibly other versions do not properly validate RegSaveKey, RegRestoreKey, and RegDeleteKey function calls, which allows local users to cause a denial of service (system crash) via a certain combination of these function calls with an HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VETFDDNT\Enum argument. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/438970/100/0/threaded - https
alyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/438970/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/27584 - http://www.securityfocus.com/bid/18789 - http://www.matousec.com/info/advisories/ZoneAlarm-Insufficient-protection-of-registry-key-VETFDDNT-Enum.php
CVE ID: CVE-2006-3541 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Meine Links (aka My Links) in Kyberna ky2help allows remote authenticated users to execute arbitrary SQL commands via unspecified "textboxes." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/18800 - http://www.securityfocus.com/archive/1/439034/100/0/threaded - http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047634.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/27598 - http://secunia.com/advisories/20924 - http://www.scip
tml - https://exchange.xforce.ibmcloud.com/vulnerabilities/27598 - http://secunia.com/advisories/20924 - http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2351
CVE ID: CVE-2006-3542 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Garry Glendown Shopping Cart 0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) shop name field in (a) editshop.php, (b) edititem.php, and (c) index.php; and via the (2) item field in editshop.php and edititem.php. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/20957 - http://securityreason.com/securityalert/1223 - http://www.osvdb.org/27025 - http://www.osvdb.org/27024 - http://www.securityfocus.co
ityreason.com/securityalert/1223 - http://www.osvdb.org/27025 - http://www.osvdb.org/27024 - http://www.securityfocus.com/archive/1/439150/100/0/threaded - http://www.vupen.com/english/advisories/2006/2693 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27539 - http://www.securityfocus.com/bid/18841
CVE ID: CVE-2006-3543 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.x and 2.x allow remote attackers to execute arbitrary SQL commands via the (1) idcat and (2) code parameters in a ketqua action in index.php; the id parameter in a (3) Attach and (4) ref action in index.php; the CODE parameter in a (5) Profile, (6) Login, and (7) Help action in index.php; and the (8) member_id parameter in coins_list.php. NOTE: the developer has disputed this issue, stating that the "CODE attribute is never present in an SQL query" and the
NOTE: the developer has disputed this issue, stating that the "CODE attribute is never present in an SQL query" and the "'ketqua' [action] and file 'coin_list.php' are not standard IPB 2.x features". It is unknown whether these vectors are associated with an independent module or modification of IPB Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/18836 - http://securityreason.com/securityalert/1231 - http://www.securityfocus.com/archive/1/439145/100/0/threaded - http://www.osvdb.org/30084 - http://www.securityfocus.com/archive/1/439602/100/0/threaded
CVE ID: CVE-2006-3544 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.3 Final allow remote attackers to execute arbitrary SQL commands via the CODE parameter in a (1) Stats, (2) Mail, and (3) Reg action in index.php. NOTE: the developer has disputed this issue, stating that "At no point does the CODE parameter touch the database. The CODE parameter is used in a SWITCH statement to determine which function to run. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/1225 - ht
run. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/1225 - http://www.securityfocus.com/archive/1/439629/100/0/threaded - http://www.securityfocus.com/bid/18782 - http://www.securityfocus.com/archive/1/438961/100/0/threaded - http://www.osvdb.org/30084 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27555
CVE ID: CVE-2006-3545 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 7.0 Beta allows remote attackers to cause a denial of service (application crash) via a web page with multiple empty APPLET start tags. NOTE: a third party has disputed this issue, stating that the crash does not occur with Microsoft Internet Explorer 7.0 Beta3 Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/18736 - http://www.securityfocus.com/archive/1/438865/100/0/threaded - http://www.securityfocus.com/archive/1/438754/100/0/threaded
CVE ID: CVE-2006-3546 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: Patrice Freydiere ImgSvr (aka ADA Image Server) allows remote attackers to cause a denial of service (daemon crash) via a long HTTP POST request. NOTE: this might be the same issue as CVE-2004-2463. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27613 - http://securityreason.com/securityalert/1232 - http://www.securityfocus.com/archive/1/438971/100/0/threaded - http://www.securityfocus.com/bid/18784
CVE ID: CVE-2006-3547 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2025-01-17T13:58:42.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: EMC VMware Player allows user-assisted attackers to cause a denial of service (unrecoverable application failure) via a long value of the ide1:0.fileName parameter in the .vmx file of a virtual machine. NOTE: third parties have disputed this issue, saying that write access to the .vmx file enables other ways of stopping the virtual machine, so no privilege boundaries are crossed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/archive/1/437806/100/200/thread
E Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/archive/1/437806/100/200/threaded - http://www.securityfocus.com/archive/1/437809/100/200/threaded - http://www.osvdb.org/27524 - http://www.securityfocus.com/archive/1/437756/100/200/threaded
CVE ID: CVE-2006-3548 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 allow remote attackers to inject arbitrary web script or HTML via a (1) javascript URI or an external (2) http, (3) https, or (4) ftp URI in the url parameter in services/go.php (aka the dereferrer), (5) a javascript URI in the module parameter in services/help (aka the help viewer), and (6) the name parameter in services/problem.php (aka the problem reporting screen). Additional Analyst Notes: - CVE
and (6) the name parameter in services/problem.php (aka the problem reporting screen). Additional Analyst Notes: - CVE Program Container: References: - http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047687.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/27589 - http://lists.horde.org/archives/announce/2006/000287.html - http://www.securityfocus.com/bid/18845 - http://www.vupen.com/english/advisories/2006/2694 - http://secunia.com/advisories/21459 - http://www.novell.com/linux/security/advisories/2006_19_sr.html - http://secunia.com/advisories/27565 - http://securitytracker.com/id?1016442 - http://lists.horde.org/archives/announce/2006/000288.html - http://securityr
5 - http://securitytracker.com/id?1016442 - http://lists.horde.org/archives/announce/2006/000288.html - http://securityreason.com/securityalert/1229 - http://moritz-naumann.com/adv/0011/hordemulti/0011.txt - http://www.debian.org/security/2007/dsa-1406 - http://secunia.com/advisories/20954 - http://www.securityfocus.com/archive/1/439255/100/0/threaded
CVE ID: CVE-2006-3549 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform "Web tunneling" attacks and use the server as a proxy via (1) http, (2) https, and (3) ftp URL in the url parameter, which is requested from the server. Additional Analyst Notes: - CVE Program Container: References: - http://lists.horde.org/archives/announce/2006/000287.html - http://www.securityfocus.com/bid/18845 - http://www.vupen.com/engl
/lists.horde.org/archives/announce/2006/000287.html - http://www.securityfocus.com/bid/18845 - http://www.vupen.com/english/advisories/2006/2694 - http://secunia.com/advisories/21459 - http://www.novell.com/linux/security/advisories/2006_19_sr.html - http://secunia.com/advisories/27565 - http://securitytracker.com/id?1016442 - http://lists.horde.org/archives/announce/2006/000288.html - http://securityreason.com/securityalert/1229 - http://moritz-naumann.com/adv/0011/hordemulti/0011.txt - http://www.debian.org/security/2007/dsa-1406 - http://secunia.com/advisories/20954 - http://www.securityfocus.com/archive/1/439255/100/0/threaded
CVE ID: CVE-2006-3550 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in F5 Networks FirePass 4100 5.x allow remote attackers to inject arbitrary web script or HTML via unspecified "writable form fields and hidden fields," including "authentication frontends." Additional Analyst Notes: - CVE Program Container: References: - http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2352 - http://www.securityfocus.com/archive/1/439033/100/0/threaded - http://securitytracker.com/id?1016431 - http://securityreason.com/securityalert/1237 - http://www.securityf
0/threaded - http://securitytracker.com/id?1016431 - http://securityreason.com/securityalert/1237 - http://www.securityfocus.com/bid/18799 - http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047635.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/27547 - http://www.vupen.com/english/advisories/2006/2678
CVE ID: CVE-2006-3551 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: NCP Secure Enterprise Client (aka VPN/PKI client) 8.30 Build 59, and possibly earlier versions, when the Link Firewall and Personal Firewall are both configured to block all inbound and outbound network traffic, allows context-dependent attackers to send inbound UDP traffic with source port 67 and destination port 68, and outbound UDP traffic with source port 68 and destination port 67. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27484 - http://lists.gro
es: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27484 - http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047547.html
CVE ID: CVE-2006-3552 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: Premium Anti-Spam in Ipswitch IMail Secure Server 2006 and Collaboration Suite 2006 Premium, when using a certain .dat file in the StarEngine /data directory from 20060630 or earlier, does not properly receive and implement bullet signature updates, which allows context-dependent attackers to use the server for spam transmission. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1016420 - http://ipswitch.com/support/imail/releases/security_advisory_20060630.asp - http://www.vupen.co
tracker.com/id?1016420 - http://ipswitch.com/support/imail/releases/security_advisory_20060630.asp - http://www.vupen.com/english/advisories/2006/2653 - http://securitytracker.com/id?1016419 - http://ipswitch.com/support/ics/updates/security_advisory_20060630.asp
CVE ID: CVE-2006-3553 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: PlaNet Concept planetNews allows remote attackers to bypass authentication and execute arbitrary code via a direct request to news/admin/planetnews.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/438344/100/100/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/27419 - http://securityreason.com/securityalert/1222 - http://securitytracker.com/id?1016385
CVE ID: CVE-2006-3554 State: PUBLISHED Published: 2006-07-13T00:00:00 Last Updated: 2024-08-07T18:30:34.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in index.php in MKPortal 1.0.1 Final allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language cookie, as demonstrated by using a gl_session cookie to inject PHP sequences into the error.log file, which is then included by index.php with malicious commands accessible by the ind parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27451 - http://www.securityfo