Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2006-5195 State: PUBLISHED Published: 2006-10-06T21:00:00Z Last Updated: 2024-09-16T22:31:08.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Wheatblog 1.0 and 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/20306
CVE ID: CVE-2006-5196 State: PUBLISHED Published: 2006-10-06T21:00:00 Last Updated: 2024-08-07T19:41:04.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP interface in the Motorola SURFboard SB4200 Cable Modem allows remote attackers to cause a denial of service (device crash) via a request with MfcISAPICommand set to SecretProc and a long string in the Secret parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/4054 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29617 - http://downloads.securityfocus.com/vulnerabilities/exploits/20309.pl - http://www.securityfocus.com/bid/20309 - http://secunia
/downloads.securityfocus.com/vulnerabilities/exploits/20309.pl - http://www.securityfocus.com/bid/20309 - http://secunia.com/advisories/22359
CVE ID: CVE-2006-5197 State: PUBLISHED Published: 2006-10-06T21:00:00Z Last Updated: 2024-09-17T00:41:53.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: PDshopPro stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) /pdshoppro.mdb, (2) /data/pdshoppro.mdb, or (3) /shoppro/data/pdshoppro.mdb. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1016852
CVE ID: CVE-2006-5198 State: PUBLISHED Published: 2006-11-14T21:00:00 Last Updated: 2024-08-07T19:41:04.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WZFILEVIEW.FileViewCtrl.61 ActiveX control (aka Sky Software "FileView" ActiveX control) for WinZip 10.0 before build 7245 allows remote attackers to execute arbitrary code via unspecified "unsafe methods." Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-06-040.html - http://www.winzip.com/wz7245.htm - http://secunia.com/advisories/22891 - http://www.securityfocus.com/bid/21060 - http://www.kb.cert.org/vuls/id/512804 - http://securitytracker.com/id?1017226 -
ttp://www.securityfocus.com/bid/21060 - http://www.kb.cert.org/vuls/id/512804 - http://securitytracker.com/id?1017226 - http://www.securityfocus.com/archive/1/451589/100/0/threaded - http://www.vupen.com/english/advisories/2006/4509 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-067 - http://isc.sans.org/diary.php?storyid=1861
CVE ID: CVE-2006-5199 State: PUBLISHED Published: 2006-10-10T22:00:00 Last Updated: 2024-08-07T19:41:05.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adobe Contribute Publishing Server leaks the administrator password in logs that are created during product installation, which allows local users to gain privileges to the server. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/29672 - http://secunia.com/advisories/22329 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29441 - http://www.adobe.com/support/security/bulletins/apsb06-15.html - http://www.securityfocus.com/bid/20439 - http://securitytracker.com/id?1017038 - http://www.v
bulletins/apsb06-15.html - http://www.securityfocus.com/bid/20439 - http://securitytracker.com/id?1017038 - http://www.vupen.com/english/advisories/2006/4001
CVE ID: CVE-2006-5200 State: PUBLISHED Published: 2006-10-10T22:00:00 Last Updated: 2024-08-07T19:41:05.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Adobe Breeze 5 Licensed Server and Breeze 5.1 Licensed Server allows attackers to read arbitrary files via unknown vectors related to "URL parsing." Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/29444 - http://secunia.com/advisories/22327 - http://www.vupen.com/english/advisories/2006/4002 - http://securitytracker.com/id?1017039 - http://www.securityfocus.com/bid/20438 - http://www.adobe.com/support/security/bulletins/apsb06-16
cker.com/id?1017039 - http://www.securityfocus.com/bid/20438 - http://www.adobe.com/support/security/bulletins/apsb06-16.html
CVE ID: CVE-2006-5201 State: PUBLISHED Published: 2006-10-09T18:00:00 Last Updated: 2024-08-07T19:41:05.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple packages on Sun Solaris, including (1) NSS; (2) Java JDK and JRE 5.0 Update 8 and earlier, SDK and JRE 1.4.x up to 1.4.2_12, and SDK and JRE 1.3.x up to 1.3.1_19; (3) JSSE 1.0.3_03 and earlier; (4) IPSec/IKE; (5) Secure Global Desktop; and (6) StarOffice, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents these products from correctly verifying X.509 and other certificates th
ture that is signed by that RSA key and prevents these products from correctly verifying X.509 and other certificates that use PKCS #1. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/22992 - http://sunsolve.sun.com/search/document.do?assetkey=1-26-102657-1 - http://www.vupen.com/english/advisories/2006/3899 - http://www.vupen.com/english/advisories/2006/3960 - http://www.vupen.com/english/advisories/2006/3898 - http://support.avaya.com/elmodocs2/security/ASA-2006-250.htm - http://secunia.com/advisories/22325 - http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1 - http://secunia.com/advisories/22204 - http://secunia.com/advisories/
sun.com/search/document.do?assetkey=1-26-102648-1 - http://secunia.com/advisories/22204 - http://secunia.com/advisories/22226 - http://www.kb.cert.org/vuls/id/845620
CVE ID: CVE-2006-5202 State: PUBLISHED Published: 2006-10-09T18:00:00 Last Updated: 2024-08-07T19:41:04.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linksys WRT54g firmware 1.00.9 does not require credentials when making configuration changes, which allows remote attackers to modify arbitrary configurations via a direct request to Security.tri, as demonstrated using the SecurityMode and layout parameters, a different issue than CVE-2006-2559. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/19347 - https://kinqpinz.info/lib/wrt54g/ - http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048495.html - https://www.exp
kinqpinz.info/lib/wrt54g/ - http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048495.html - https://www.exploit-db.com/exploits/5926 - https://kinqpinz.info/lib/wrt54g/own2.txt - http://www.kb.cert.org/vuls/id/930364 - http://secunia.com/advisories/21372 - http://securitytracker.com/id?1016638
CVE ID: CVE-2006-5203 State: PUBLISHED Published: 2006-10-09T19:00:00 Last Updated: 2024-08-07T19:41:05.748Z Vendors: n/a Products: n/a Problem Types: n/a Description: Invision Power Board (IPB) 2.1.7 and earlier allows remote restricted administrators to inject arbitrary web script or HTML, or execute arbitrary SQL commands, via a forum description that contains a crafted image with PHP code, which is executed when the user visits the "Manage Forums" link in the Admin control panel. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/29352 - http://www.securityfocus.com/archive/1/447710/100/0/threaded
CVE ID: CVE-2006-5204 State: PUBLISHED Published: 2006-10-09T19:00:00 Last Updated: 2024-08-07T19:41:05.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in action_admin/member.php in Invision Power Board (IPB) 2.1.7 and earlier allows remote authenticated users to inject arbitrary web script or HTML via a reference to a script in the avatar setting, which can be leveraged for a cross-site request forgery (CSRF) attack involving forced SQL execution by an admin. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/3927 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29351 -
ces: - http://www.vupen.com/english/advisories/2006/3927 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29351 - http://secunia.com/advisories/22272 - http://forums.invisionpower.com/index.php?showtopic=227937 - http://www.securityfocus.com/archive/1/447710/100/0/threaded
CVE ID: CVE-2006-5205 State: PUBLISHED Published: 2006-10-09T19:00:00 Last Updated: 2024-08-07T19:41:05.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Invision Gallery 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the dir parameter in (1) index.php and (2) forum/index.php, when the viewimage command in the gallery module is used. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/2473 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29334 - http://secunia.com/advisories/22400 - http://www.securityfocus.com/bid/20328
CVE ID: CVE-2006-5206 State: PUBLISHED Published: 2006-10-09T19:00:00 Last Updated: 2024-08-07T19:41:04.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Invision Gallery 2.0.7 allows remote attackers to execute arbitrary SQL commands via the album parameter in (1) index.php and (2) forum/index.php, when the rate command in the gallery automodule is used. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/2473 - http://secunia.com/advisories/22400 - http://www.securityfocus.com/bid/20327 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29333
CVE ID: CVE-2006-5207 State: PUBLISHED Published: 2006-10-09T19:00:00 Last Updated: 2024-08-07T19:41:05.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in images/smileys/smileys_packs.php in phpMyTeam 2.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the smileys_dir parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/447842/100/0/threaded - http://secunia.com/advisories/22278 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29358 - http://www.osvdb.org/29530 - http://www.vupen.com/english/advisories/2006/3925 - ht
ibmcloud.com/vulnerabilities/29358 - http://www.osvdb.org/29530 - http://www.vupen.com/english/advisories/2006/3925 - https://www.exploit-db.com/exploits/2478
CVE ID: CVE-2006-5208 State: PUBLISHED Published: 2006-10-09T19:00:00 Last Updated: 2024-08-07T19:41:05.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in PHP Classifieds 7.1 allow remote attackers to execute arbitrary SQL commands via (1) the catid_search parameter in search.php and (2) the catid parameter in index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/20359 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29354 - http://kzar.co.uk/exploits/phpclassifieds_exploit - https://www.exploit-db.com/exploits/2479 - http://secunia.com/advisories/22264 - http://www.vupen.com/e
ifieds_exploit - https://www.exploit-db.com/exploits/2479 - http://secunia.com/advisories/22264 - http://www.vupen.com/english/advisories/2006/3924
CVE ID: CVE-2006-5209 State: PUBLISHED Published: 2006-10-09T19:00:00 Last Updated: 2024-08-07T19:41:04.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in admin/admin_topic_action_logging.php in Admin Topic Action Logging Mod 0.95 and earlier, as used in phpBB 2.0 up to 2.0.21, allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/29345 - https://www.exploit-db.com/exploits/2475/
CVE ID: CVE-2006-5210 State: PUBLISHED Published: 2006-10-16T23:00:00 Last Updated: 2024-08-07T19:41:05.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in IronWebMail before 6.1.1 HotFix-17 allows remote attackers to read arbitrary files via a GET request to the IM_FILE identifier with double-url-encoded "../" sequences ("%252e%252e/"). Additional Analyst Notes: - CVE Program Container: References: - https://supportcenter.ciphertrust.com/vulnerability/IWM501-01.html - http://securitytracker.com/id?1017069 - http://www.vupen.com/english/advisories/2006/4055 - http://www.securityfocus.com/bid/20436 - http://secunia.com/advisories/22406 - https:
com/english/advisories/2006/4055 - http://www.securityfocus.com/bid/20436 - http://secunia.com/advisories/22406 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29620 - http://www.securityfocus.com/archive/1/448779/100/0/threaded - http://securityreason.com/securityalert/1726 - http://www.symantec.com/enterprise/research/SYMSA-2006-010.txt
CVE ID: CVE-2006-5211 State: PUBLISHED Published: 2006-10-09T21:00:00 Last Updated: 2024-08-07T19:41:05.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trend Micro OfficeScan 6.0 in Client/Server/Messaging (CSM) Suite for SMB 2.0 before 6.0.0.1385, and OfficeScan Corporate Edition (OSCE) 6.5 before 6.5.0.1418, 7.0 before 7.0.0.1257, and 7.3 before 7.3.0.1053 allow remote attackers to remove OfficeScan clients via a certain HTTP request that invokes the OfficeScan CGI program. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/20330 - http://www.trendmicro.com/ftp/documentation/readme/osce_70_win_en_securitypatch_1257_readme.txt -
yfocus.com/bid/20330 - http://www.trendmicro.com/ftp/documentation/readme/osce_70_win_en_securitypatch_1257_readme.txt - http://www.trendmicro.com/ftp/documentation/readme/osce_7.3_win_en_securitypatch_1053_readme.txt - http://www.trendmicro.com/ftp/documentation/readme/csm_2.0_osce_6.0_win_en_securitypatch_1385_readme.txt - http://www.vupen.com/english/advisories/2006/3882 - http://secunia.com/advisories/22156 - http://www.trendmicro.com/download/product.asp?productid=5 - http://www.trendmicro.com/ftp/documentation/readme/osce_6.5_win_en_securitypatch_1418_readme.txt
CVE ID: CVE-2006-5212 State: PUBLISHED Published: 2006-10-09T21:00:00 Last Updated: 2024-08-07T19:41:04.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trend Micro OfficeScan 6.0 in Client/Server/Messaging (CSM) Suite for SMB 2.0 before 6.0.0.1385, and OfficeScan Corporate Edition (OSCE) 6.5 before 6.5.0.1418, 7.0 before 7.0.0.1257, and 7.3 before 7.3.0.1053 allow remote attackers to delete files via a modified filename parameter in a certain HTTP request that invokes the OfficeScan CGI program. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/20330 - http://www.trendmicro.com/ftp/documentation/readme/osce_70_win_en_securitypat
- http://www.securityfocus.com/bid/20330 - http://www.trendmicro.com/ftp/documentation/readme/osce_70_win_en_securitypatch_1257_readme.txt - http://www.trendmicro.com/ftp/documentation/readme/osce_7.3_win_en_securitypatch_1053_readme.txt - http://www.trendmicro.com/ftp/documentation/readme/csm_2.0_osce_6.0_win_en_securitypatch_1385_readme.txt - http://www.vupen.com/english/advisories/2006/3882 - http://secunia.com/advisories/22156 - http://www.trendmicro.com/download/product.asp?productid=5 - http://www.trendmicro.com/ftp/documentation/readme/osce_6.5_win_en_securitypatch_1418_readme.txt
CVE ID: CVE-2006-5213 State: PUBLISHED Published: 2006-10-09T21:00:00 Last Updated: 2024-08-07T19:41:04.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sun Solaris 10 before 20061006 uses "incorrect and insufficient permission checks" that allow local users to intercept or spoof packets by creating a raw socket on a link aggregation (network device aggregation). Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/22992 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29381 - http://secunia.com/advisories/22246 - http://support.avaya.com/elmodocs2/security/ASA-2006-250.htm - http://securitytracker.com/id?1017013 - http://www.vup
- http://support.avaya.com/elmodocs2/security/ASA-2006-250.htm - http://securitytracker.com/id?1017013 - http://www.vupen.com/english/advisories/2006/3961 - http://sunsolve.sun.com/search/document.do?assetkey=1-26-102606-1 - http://www.securityfocus.com/bid/20377
CVE ID: CVE-2006-5214 State: PUBLISHED Published: 2006-10-09T21:00:00 Last Updated: 2024-08-07T19:41:04.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 20060225, and Solaris 8 through 10 before 20061006, causes a user's Xsession errors file to have weak permissions before a chmod is performed, which allows local users to read Xsession errors files of other users. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1017015 - http://secunia.com/advisories/22992 - https://bugs.freedesktop.org/show_bug.cgi?id=5897 - http://ww
ker.com/id?1017015 - http://secunia.com/advisories/22992 - https://bugs.freedesktop.org/show_bug.cgi?id=5897 - http://www.vupen.com/english/advisories/2006/3962 - http://secunia.com/advisories/22469 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1760 - http://secunia.com/advisories/22323 - http://www.securityfocus.com/bid/20400 - http://sunsolve.sun.com/search/document.do?assetkey=1-26-102652-1 - http://www.ubuntu.com/usn/usn-364-1 - http://support.avaya.com/elmodocs2/security/ASA-2006-250.htm - http://secunia.com/advisories/22439 - http://www.netbsd.org/cgi-bin/query-pr-single.pl?number=32804
CVE ID: CVE-2006-5215 State: PUBLISHED Published: 2006-10-09T21:00:00 Last Updated: 2024-08-07T19:41:05.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 20060317, and Solaris 8 through 10 before 20061006, allows local users to overwrite arbitrary files, or read another user's Xsession errors file, via a symlink attack on a /tmp/xses-$USER file. Additional Analyst Notes: - CVE Program Container: References: - http://www.netbsd.org/cgi-bin/query-pr-single.pl?number=32805 - http://securitytracker.com/id?1017015 - http://secunia.com/advisories/22992 - https://oval.cisecurity.org/reposit
2805 - http://securitytracker.com/id?1017015 - http://secunia.com/advisories/22992 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2205 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29427 - https://bugs.freedesktop.org/show_bug.cgi?id=5898 - http://sunsolve.sun.com/search/document.do?assetkey=1-26-102652-1 - http://support.avaya.com/elmodocs2/security/ASA-2006-250.htm
CVE ID: CVE-2006-5216 State: PUBLISHED Published: 2006-10-09T21:00:00 Last Updated: 2024-08-07T19:41:05.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Sergey Lyubka Simple HTTPD (shttpd) 1.34 allows remote attackers to execute arbitrary code via a long URI. Additional Analyst Notes: - CVE Program Container: References: - http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050146.html - https://www.exploit-db.com/exploits/2482 - http://secunia.com/advisories/22294 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29368 - http://exploitlabs.com/files/advisories/EXPL-A-2006-005-shttpd.txt - http://securitytracker.com/id?1017088 -
es/29368 - http://exploitlabs.com/files/advisories/EXPL-A-2006-005-shttpd.txt - http://securitytracker.com/id?1017088 - http://www.vupen.com/english/advisories/2006/3939 - http://www.securityfocus.com/bid/20393
CVE ID: CVE-2006-5217 State: PUBLISHED Published: 2006-10-09T21:00:00 Last Updated: 2024-08-07T19:41:05.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in giris_yap.asp in Emek Portal 2.1 allows remote attackers to execute arbitrary SQL commands by simultaneously injecting into the user name and pass fields in uyegiris.asp, also known as the Kullanici Adi (k_a) and Sifre (sifre) parameters. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/29380 - http://www.securityfocus.com/archive/1/447914/100/0/threaded - http://securityreason.com/securityalert/1700 - http://www.securityfocus.c
ityfocus.com/archive/1/447914/100/0/threaded - http://securityreason.com/securityalert/1700 - http://www.securityfocus.com/bid/20378
CVE ID: CVE-2006-5218 State: PUBLISHED Published: 2006-10-09T22:00:00 Last Updated: 2024-08-07T19:41:05.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the systrace_preprepl function (STRIOCREPLACE) in systrace in OpenBSD 3.9 and NetBSD 3 allows local users to cause a denial of service (crash), gain privileges, or read arbitrary kernel memory via large numeric arguments to the systrace ioctl. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/29392 - http://www.osvdb.org/29570 - http://secunia.com/advisories/22324 - http://scary.beasts.org/security/CESA-2006-003.html - http://www.securityfo
9570 - http://secunia.com/advisories/22324 - http://scary.beasts.org/security/CESA-2006-003.html - http://www.securityfocus.com/bid/20392 - http://securitytracker.com/id?1017009 - http://openbsd.org/errata.html#systrace
CVE ID: CVE-2006-5219 State: PUBLISHED Published: 2006-10-09T22:00:00 Last Updated: 2024-08-07T19:41:05.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in blog/index.php in the blog module in Moodle 1.6.2 allows remote attackers to execute arbitrary SQL commands via a double-encoded tag parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/448018/100/0/threaded - http://cvs.moodle.com/blog/index.php?r1=1.18.2.2&r2=1.18.2.3 - https://exchange.xforce.ibmcloud.com/vulnerabilities/29377 - http://secunia.com/advisories/22309 - http://www.vupen.com/english/advisories/2006/3957 - http://marc.inf
lities/29377 - http://secunia.com/advisories/22309 - http://www.vupen.com/english/advisories/2006/3957 - http://marc.info/?l=full-disclosure&m=116034301209228&w=2 - http://www.securityfocus.com/bid/20395 - http://securityreason.com/securityalert/1699 - http://www.securityfocus.com/archive/1/448023/100/0/threaded
CVE ID: CVE-2006-5220 State: PUBLISHED Published: 2006-10-09T22:00:00 Last Updated: 2024-08-07T19:41:05.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in WebYep 1.1.9, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via the webyep_sIncludePath in (1) files in the programm/lib/ directory including (a) WYApplication.php, (b) WYDocument.php, (c) WYEditor.php, (d) WYElement.php, (e) WYFile.php, (f) WYHTMLTag.php, (g) WYImage.php, (h) WYLanguage.php, (i) WYLink.php, (j) WYPath.php, (k) WYPopupWindowLink.php, (l) WYSelectMenu.php, and (m) WYTextArea.php; (2) files in the programm/elements/ di