Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2006-6944 State: PUBLISHED Published: 2007-01-19T02:00:00 Last Updated: 2024-08-07T20:42:07.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpMyAdmin before 2.9.1.1 allows remote attackers to bypass Allow/Deny access rules that use IP addresses via false headers. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/4572 - http://secunia.com/advisories/26733 - http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-9 - http://www.us.debian.org/security/2007/dsa-1370
CVE ID: CVE-2006-6945 State: PUBLISHED Published: 2007-01-19T23:00:00 Last Updated: 2024-08-07T20:42:07.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Virtuemart 1.0.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related to (1) Itemid, (2) product_id, and category_id parameters as handled in virtuemart_parser.php. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/24058 - http://www.securityfocus.com/bid/22123 - http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html - http://virtuemart.svn.sourceforge.net/viewvc/%2Acheckout%2A/virtuemart/
.com/archives/fulldisclosure/2007-01/0355.html - http://virtuemart.svn.sourceforge.net/viewvc/%2Acheckout%2A/virtuemart/branches/virtuemart-1_0_0/virtuemart/CHANGELOG.php?revision=607 - http://www.securityfocus.com/archive/1/459195/100/0/threaded - http://www.hackers.ir/advisories/festival.txt
CVE ID: CVE-2006-6946 State: PUBLISHED Published: 2007-01-23T02:00:00 Last Updated: 2024-08-07T20:50:04.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web server in the NEC MultiWriter 1700C allows remote attackers to modify the device configuration via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/jp/JVN%2363999575/index.html
CVE ID: CVE-2006-6947 State: PUBLISHED Published: 2007-01-23T02:00:00 Last Updated: 2024-08-07T20:50:04.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FTP server in the NEC MultiWriter 1700C allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command, a variant of CVE-1999-0017. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/jp/JVN%2385996645/index.html
CVE ID: CVE-2006-6948 State: PUBLISHED Published: 2007-01-23T02:00:00 Last Updated: 2024-08-07T20:50:04.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyODBC Japanese conversion edition 3.51.06, 2.50.29, and 2.50.25 allows remote attackers to cause a denial of service via a certain string in a response, which has unspecified impact on the MySQL database. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/jp/JVN%2330994815/index.html
CVE ID: CVE-2006-6949 State: PUBLISHED Published: 2007-01-23T02:00:00 Last Updated: 2024-08-07T20:50:06.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: Conti FTPServer 1.0 Build 2.8 stores user passwords in cleartext in MyServerSettings.ini, which allows local users to obtain sensitive information by reading this file. Additional Analyst Notes: - CVE Program Container: References: - http://secwatch.org/advisories/1016194/ - http://secunia.com/advisories/23030 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30412 - http://www.securityfocus.com/bid/21174 - http://www.vupen.com/english/advisories/2006/4605
CVE ID: CVE-2006-6950 State: PUBLISHED Published: 2007-01-23T02:00:00 Last Updated: 2024-08-07T20:50:04.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Conti FTPServer 1.0 Build 2.8 allows remote attackers to read arbitrary files and list arbitrary directories via a .. (dot dot) in a filename argument. Additional Analyst Notes: - CVE Program Container: References: - http://secwatch.org/advisories/1016194/ - http://secunia.com/advisories/23030 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30411 - http://www.securityfocus.com/bid/21174 - http://www.vupen.com/english/advisories/2006/4605
CVE ID: CVE-2006-6951 State: PUBLISHED Published: 2007-01-23T02:00:00 Last Updated: 2024-08-07T20:50:04.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in blog.php in OdysseusBlog allows remote attackers to inject arbitrary web script or HTML via the page parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.attrition.org/pipermail/vim/2007-January/001250.html - http://www.securityfocus.com/bid/21128 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30333 - http://archives.neohapsis.com/archives/bugtraq/2006-11/0274.html - http://securityreason.com/securityalert/2173
CVE ID: CVE-2006-6952 State: PUBLISHED Published: 2007-01-24T23:00:00 Last Updated: 2024-08-07T20:50:05.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: Computer Associates Host Intrusion Prevention System (HIPS) drivers (1) Core kmxstart.sys 6.5.4.31 and (2) Firewall kmxfw.sys 6.5.4.10 allow local users to gain privileges by using certain privileged IOCTLs to modify callback function pointers. Additional Analyst Notes: - CVE Program Container: References: - http://www3.ca.com/securityadvisor/newsinfo/collateral.aspx?cid=97729 - http://www.securityfocus.com/archive/1/452286/100/0/threaded - http://www.securityfocus.com/bid/21140 - http://www.osvdb.org/30497 - http://www.securi
rchive/1/452286/100/0/threaded - http://www.securityfocus.com/bid/21140 - http://www.osvdb.org/30497 - http://www.securityfocus.com/archive/1/451952/100/0/threaded - http://secunia.com/advisories/22972 - http://www.osvdb.org/30498 - http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34818 - http://www.securityfocus.com/archive/1/458040/100/200/threaded - http://www.reversemode.com/index.php?option=com_remository&Itemid=2&func=fileinfo&id=38
CVE ID: CVE-2006-6953 State: PUBLISHED Published: 2007-01-29T16:00:00 Last Updated: 2024-08-07T20:50:05.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: The virtual keyboard implementation in GlobeTrotter Mobility Manager changes the color of a key as it is pressed, which allows local users to capture arbitrary keystrokes, such as for passwords, by shoulder surfing or grabbing periodic screenshots. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/438376/100/100/threaded - http://img45.imageshack.us/my.php?image=poc7ik.jpg - https://exchange.xforce.ibmcloud.com/vulnerabilities/27447
CVE ID: CVE-2006-6954 State: PUBLISHED Published: 2007-01-29T16:00:00 Last Updated: 2024-08-07T20:50:06.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: Flock beta 1 0.7 allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nested marquee tags, a related issue to CVE-2006-2723. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/438365/100/100/threaded - http://www.securityfocus.com/archive/1/439064/100/100/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/26898 - http://www.securityfocus.com/archive/1/438144/100/100/threaded
CVE ID: CVE-2006-6955 State: PUBLISHED Published: 2007-01-29T16:00:00 Last Updated: 2024-08-07T20:50:04.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opera allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nested marquee tags, a related issue to CVE-2006-2723. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/26898 - http://archives.neohapsis.com/archives/bugtraq/2006-06/0085.html
CVE ID: CVE-2006-6956 State: PUBLISHED Published: 2007-01-29T16:00:00 Last Updated: 2024-08-07T20:50:04.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via a web page that contains a large number of nested marquee tags, a related issue to CVE-2006-2723. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/26898 - http://archives.neohapsis.com/archives/bugtraq/2006-06/0085.html
CVE ID: CVE-2006-6957 State: PUBLISHED Published: 2007-01-29T16:00:00 Last Updated: 2024-08-07T20:50:05.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in addons/mod_media/body.php in Docebo 3.0.3 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[where_framework] parameter. NOTE: this issue might be resultant from a global overwrite vulnerability. This issue is similar to CVE-2006-2576 and CVE-2006-3107, but the vectors are different. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2006-06/0109.html
l Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/bugtraq/2006-06/0109.html - http://securityreason.com/securityalert/2194 - http://www.osvdb.org/26710
CVE ID: CVE-2006-6958 State: PUBLISHED Published: 2007-01-29T16:00:00 Last Updated: 2024-08-07T20:50:06.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in phpBlueDragon 2.9.1 allow remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPath parameter to (1) team_admin.php, (2) rss_admin.php, (3) manual_admin.php, and (4) forum_admin.php in includes/root_modules/, a different set of vectors than CVE-2006-3076. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27152 - http://packetstormsecurity.org/0606-exploits/phpbluedragon-2.txt - http:/
ge.xforce.ibmcloud.com/vulnerabilities/27152 - http://packetstormsecurity.org/0606-exploits/phpbluedragon-2.txt - http://www.securityfocus.com/bid/18609 - http://www.osvdb.org/27678 - http://www.osvdb.org/27676 - http://www.osvdb.org/27677 - http://securityreason.com/securityalert/2193 - http://www.osvdb.org/27679 - http://www.securityfocus.com/archive/1/438238/100/100/threaded
CVE ID: CVE-2006-6959 State: PUBLISHED Published: 2007-01-29T16:00:00 Last Updated: 2024-08-07T20:50:04.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebRoot Spy Sweeper 4.5.9 and earlier allows local users to bypass the "Startup-Shield" security restrictions by modifying certain registry keys. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/27264 - http://www.securityfocus.com/archive/1/437814/100/200/threaded - http://www.osvdb.org/27535 - http://www.sentinel.gr/advisories/SGA-0001.txt
CVE ID: CVE-2006-6960 State: PUBLISHED Published: 2007-01-29T16:00:00 Last Updated: 2024-08-07T20:50:04.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Compression Sweep feature in WebRoot Spy Sweeper 4.5.9 and earlier does not handle non-ZIP archives, which allows remote attackers to bypass the malware detection via files with (1) RAR, (2) GZ, (3) TAR, (4) CAB, or (5) ACE compression. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/437814/100/200/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/27266 - http://www.osvdb.org/27536 - http://www.sentinel.gr/advisories/SGA-0001.txt
CVE ID: CVE-2006-6961 State: PUBLISHED Published: 2007-01-29T16:00:00 Last Updated: 2024-08-07T20:50:06.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebRoot Spy Sweeper 4.5.9 and earlier does not detect malware based on file contents, which allows remote attackers to bypass malware detection by changing a file's name. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/437814/100/200/threaded - http://www.osvdb.org/27538 - http://www.sentinel.gr/advisories/SGA-0001.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/27272
CVE ID: CVE-2006-6962 State: PUBLISHED Published: 2007-01-29T16:00:00 Last Updated: 2024-08-07T20:50:06.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in rsgallery2.html.php in the RS Gallery2 component (com_rsgallery2) 1.11.2 for Joomla! allows attackers to execute arbitrary PHP code via the mosConfig_absolute_path parameter. NOTE: this issue may overlap CVE-2006-5047. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/1959 - http://www.vupen.com/english/advisories/2006/2581 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27418 - http://www.securityfocus.com/bid/18705
CVE ID: CVE-2006-6963 State: PUBLISHED Published: 2007-01-29T16:00:00 Last Updated: 2024-08-07T20:50:06.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 3.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[where_lms] parameter to (1) class.module/class.definition.php and (2) modules/scorm/scorm_utils.php. NOTE: this issue may overlap CVE-2006-2577. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/26713 - https://exchange.xforce.ibmcloud.com/vulnerabilities/26633 - http://archives.neohapsis.com/archives/bugtraq/2006-06/0116.html - http://www.doceb
ibmcloud.com/vulnerabilities/26633 - http://archives.neohapsis.com/archives/bugtraq/2006-06/0116.html - http://www.docebo.org/doceboCms/bugtracker/18_124/bugdetails/appid_1-bugid_154/bugtracker.html - http://securityreason.com/securityalert/2188 - http://www.osvdb.org/26712
CVE ID: CVE-2006-6964 State: PUBLISHED Published: 2007-01-29T16:00:00 Last Updated: 2024-08-07T20:50:04.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: MailEnable Professional before 1.78 provides a cleartext user password when an administrator edits the user's settings, which allows remote authenticated administrators to obtain sensitive information by viewing the HTML source. Additional Analyst Notes: - CVE Program Container: References: - http://www.mailenable.com/Professional1-ReleaseNotes.txt - http://securitytracker.com/id?1016337 - https://exchange.xforce.ibmcloud.com/vulnerabilities/27185
CVE ID: CVE-2006-6965 State: PUBLISHED Published: 2007-01-29T17:00:00 Last Updated: 2024-08-07T20:50:06.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF injection vulnerability in lib/exe/fetch.php in DokuWiki 2006-03-09e, and possibly earlier, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the media parameter. NOTE: this issue can be leveraged for XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/31620 - http://sla.ckers.org/forum/read.php?3%2C880%2C1361#msg-1361 - http://secunia.com/advisories/24853 - http://secunia.com/advisories/23926 - http://www.s
d.php?3%2C880%2C1361#msg-1361 - http://secunia.com/advisories/24853 - http://secunia.com/advisories/23926 - http://www.securityfocus.com/bid/22236 - https://exchange.xforce.ibmcloud.com/vulnerabilities/31930 - http://www.vupen.com/english/advisories/2007/0357 - http://security.gentoo.org/glsa/glsa-200704-08.xml
CVE ID: CVE-2006-6966 State: PUBLISHED Published: 2007-02-04T00:00:00 Last Updated: 2024-08-07T20:50:06.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpGraphy before 0.9.13a does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a config.php file via the pictures[] parameter to index.php. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in phpGraphy. Additional An
d the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in phpGraphy. Additional Analyst Notes: - CVE Program Container: References: - http://phpgraphy.sourceforge.net/changelog.php - http://sourceforge.net/forum/forum.php?forum_id=659277 - http://securitytracker.com/id?1017571 - https://exchange.xforce.ibmcloud.com/vulnerabilities/30634 - http://retrogod.altervista.org/phpgraphy_0912_zhdkoi_cmd.html
CVE ID: CVE-2006-6967 State: REJECTED Published: 2007-02-04T00:00:00 Last Updated: 2009-02-26T10:00:00 Description: No description available.
CVE ID: CVE-2006-6968 State: PUBLISHED Published: 2007-02-06T02:00:00 Last Updated: 2024-08-07T20:50:06.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the group moderation control center page in Phorum before 5.1.19 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2007/0410 - http://osvdb.org/34729 - http://www.phorum.org/phorum5/read.php?12%2C119757
CVE ID: CVE-2006-6969 State: PUBLISHED Published: 2007-02-07T11:00:00 Last Updated: 2024-08-07T20:50:04.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/24070 - http://www.vupen.com/english/advisories/2007/0497 - https://exchange.xforce.ibmcloud.
p://secunia.com/advisories/24070 - http://www.vupen.com/english/advisories/2007/0497 - https://exchange.xforce.ibmcloud.com/vulnerabilities/32240 - http://osvdb.org/33108 - http://www.securityfocus.com/bid/22405 - http://fisheye.codehaus.org/changelog/jetty/?cs=1274 - http://archives.neohapsis.com/archives/bugtraq/2007-02/0070.html - http://www.securityfocus.com/archive/1/459164/100/0/threaded
CVE ID: CVE-2006-6970 State: PUBLISHED Published: 2007-02-07T11:00:00 Last Updated: 2024-08-07T20:50:04.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opera 9.10 Final allows remote attackers to bypass the Fraud Protection mechanism by adding certain characters to the end of a domain name, as demonstrated by the "." and "/" characters, which is not caught by the blacklist filter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/459265/100/0/threaded - http://osvdb.org/34927 - http://kaneda.bohater.net/security/20061220-opera_9.10_final_bypass_fraud_protection.php
CVE ID: CVE-2006-6971 State: PUBLISHED Published: 2007-02-07T11:00:00Z Last Updated: 2024-09-16T20:03:11.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mozilla Firefox 2.0, possibly only when running on Windows, allows remote attackers to bypass the Phishing Protection mechanism by representing an IP address in (1) dotted-hex, (2) dotted-octal, (3) single decimal integer, (4) single hex integer, or (5) single octal integer format, which is not captured by the blacklist filter. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=356355 - http://sla.ckers.org/forum/read.php?13%2C2253
CVE ID: CVE-2006-6972 State: PUBLISHED Published: 2007-02-07T20:00:00 Last Updated: 2024-08-07T20:50:06.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection in torrents.php in BtitTracker 1.3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) by and (2) order parameters. NOTE: it is not clear whether this issue is exploitable. Additional Analyst Notes: - CVE Program Container: References: - http://attrition.org/pipermail/vim/2006-June/000894.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/27216 - http://www.securityfocus.com/bid/18549 - http://www.vupen.com/english/advisories/2006/2445 - http://www.osvdb.org/26653 - http:/
ww.securityfocus.com/bid/18549 - http://www.vupen.com/english/advisories/2006/2445 - http://www.osvdb.org/26653 - http://www.attrition.org/pipermail/vim/2006-June/000890.html - http://secunia.com/advisories/20753 - http://pridels0.blogspot.com/2006/06/btittracker-sql-injection-vuln.html
CVE ID: CVE-2006-6973 State: PUBLISHED Published: 2007-02-07T20:00:00Z Last Updated: 2024-09-16T20:16:16.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: Headstart Solutions DeskPRO does not require authentication for certain files and directories associated with administrative activities, which allows remote attackers to (1) reinstall the application via a direct request for install/index.php; (2) delete the database via a do=delete_database QUERY_STRING to a renamed copy of install/index.php; or access the administration system, after guessing a filename, via a direct request for a file in (3) admin/ or (4) tech/. Additional Analyst Notes: - CVE Program Container: References
ia a direct request for a file in (3) admin/ or (4) tech/. Additional Analyst Notes: - CVE Program Container: References: - http://www.zion-security.com/text/Mul_Vulnerability_DeskPro.txt
CVE ID: CVE-2006-6974 State: PUBLISHED Published: 2007-02-07T20:00:00Z Last Updated: 2024-09-16T23:01:50.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: Headstart Solutions DeskPRO stores sensitive information under the web root with insufficient access control, which allows remote attackers to (1) list files in the includes/ directory; obtain the SQL username and password via a direct request for (2) config.php and (3) config.php.bak in includes/; read files in (4) email/, (5) admin/graphs/, (6) includes/javascript/, and (7) certain other includes/ directories via direct requests; and download SQL database data via direct requests for (8) data.sql, (9) install.sql, (10) sett
ies via direct requests; and download SQL database data via direct requests for (8) data.sql, (9) install.sql, (10) settings.sql, and possibly other files in install/v2data/. Additional Analyst Notes: - CVE Program Container: References: - http://www.zion-security.com/text/Mul_Vulnerability_DeskPro.txt
CVE ID: CVE-2006-6975 State: PUBLISHED Published: 2007-02-08T17:00:00Z Last Updated: 2025-01-17T14:13:37.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.3 allows remote attackers to execute arbitrary code via a URL in the class_pwd parameter. NOTE: this issue has been disputed by CVE and multiple third parties, who state that $class_pwd is set to a static value before the relevant include statement Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://archives.neohapsis.com/archives/bugtraq/2006-10/0494.html - http://archives.neohapsis.com/archives/bugtra
nces: - http://archives.neohapsis.com/archives/bugtraq/2006-10/0494.html - http://archives.neohapsis.com/archives/bugtraq/2006-10/0472.html - http://archives.neohapsis.com/archives/bugtraq/2006-10/0499.html - http://www.osvdb.org/31638
CVE ID: CVE-2006-6976 State: PUBLISHED Published: 2007-02-08T17:00:00 Last Updated: 2024-08-07T20:50:04.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.2 and earlier allows remote attackers to execute arbitrary code via a URL in the absolute_path parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.attrition.org/pipermail/vim/2007-February/001296.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/29564 - https://www.exploit-db.com/exploits/2555