deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-1943
Published: 2006-04-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Smarter Scripts IntelliLink Pro 5.06 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter in addlink_lwp.cgi and the (2) id, (3) forgotid, and (4) forgotpass parameters in edit.cgi.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/04/intellilink-pro-xss-vuln.html; http://secunia.com/advisories/19701; http://www.osvdb.org/24732
CVE: CVE-2006-1944
Published: 2006-04-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in SibSoft CommuniMail 1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the list_id parameter in mailadmin.cgi and (2) the form_id parameter in templates.cgi.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/04/communimail-xss-vuln.html; http://secunia.com/advisories/19667; http://www.osvdb.org/24735
CVE: CVE-2006-1945
Published: 2006-04-20
Description: Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config parameter.  NOTE: this might be the same core issue as CVE-2005-2732.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/04/awstats-65-vuln.html; http://secunia.com/advisories/20496; http://security.gentoo.org/glsa/glsa-200606-06.xml
CVE: CVE-2006-1946
Published: 2006-04-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Visale 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the keyval parameter in pbpgst.cgi, (2) the catsubno parameter in pblscg.cgi, and (3) the listno parameter in pblsmb.cgi.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/04/visale-xss-vuln.html; http://secunia.com/advisories/19655; http://www.osvdb.org/24716
CVE: CVE-2006-1947
Published: 2006-04-20
Description: Multiple SQL injection vulnerabilities in plexum.php in NicPlex Plexum X5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) pagesize, (2) maxrec, and (3) startpos parameters.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/04/plexum-x5-sql-vuln.html; http://secunia.com/advisories/19720; http://www.securityfocus.com/bid/17617
CVE: CVE-2006-1948
Published: 2006-04-20
Description: The "Add Sender to Address Book" operation (AddSenderToAddressBook.lss) and NameHelper.lss in IBM Lotus Notes 6.0 and 6.5 before 20060331 do not properly store information in the Personal Address Book when multiple messages are checked and a message uses AltFrom, which might allow user-assisted remote attackers to trick a user into sending e-mail to an unauthorized recipient.
CVSS Score: 4.0 (MEDIUM)
References: http://securitytracker.com/id?1015914; http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21232945; http://securitytracker.com/id?1015914
CVE: CVE-2006-1949
Published: 2006-04-20
Description: SQL injection vulnerability in plexcart.pl in NicPlex PlexCart X3 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2006/04/plexcart-x3-sql-inj.html; http://secunia.com/advisories/18033; https://exchange.xforce.ibmcloud.com/vulnerabilities/25917
CVE: CVE-2006-1950
Published: 2006-04-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in banners.cgi in PerlCoders BannerFarm 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) aff and (2) cat parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/bannerfarm-xss-vuln.html; http://secunia.com/advisories/19718; http://www.osvdb.org/24728
CVE: CVE-2006-1954
Published: 2006-04-21
Description: SQL injection vulnerability in authent.php4 in Nicolas Fischer (aka NFec) RechnungsZentrale V2 1.1.3, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the User field.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-04/0384.html; http://secunia.com/advisories/19728; http://www.g-0.org/code/rz2-adv.html
CVE: CVE-2006-1955
Published: 2006-04-21
Description: PHP remote file inclusion vulnerability in authent.php4 in Nicolas Fischer (aka NFec) RechnungsZentrale V2 1.1.3, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-04/0384.html; http://secunia.com/advisories/19728; http://www.g-0.org/code/rz2-adv.html
CVE: CVE-2006-1956
Published: 2006-04-21
Description: The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to obtain sensitive information via an invalid feed parameter, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://irannetjob.com/content/view/209/28/; http://www.kapda.ir/advisory-313.html; http://www.securityfocus.com/archive/1/431317/100/0/threaded
CVE: CVE-2006-1957
Published: 2006-04-21
Description: The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to cause a denial of service (disk consumption and possibly web-server outage) via multiple requests with different values of the feed parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2006-04/0380.html; http://irannetjob.com/content/view/209/28/; http://www.kapda.ir/advisory-313.html
CVE: CVE-2006-1958
Published: 2006-04-21
Description: Multiple SQL injection vulnerabilities in WWWThreads RC 3 allow remote attackers to execute arbitrary SQL commands via (1) the forumreferrer cookie to register.php and (2) the messages parameter in message_list.php.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19732; http://securityreason.com/securityalert/739; http://www.securityfocus.com/archive/1/431400/100/0/threaded
CVE: CVE-2006-1959
Published: 2006-04-21
Description: PHP remote file inclusion vulnerability in direct.php in ActualScripts ActualAnalyzer Lite 2.72 and earlier, Gold 7.63 and earlier, and Server 8.23 and earlier allows remote attackers to execute arbitrary code via a URL in the rf parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19743; http://securityreason.com/securityalert/742; http://securitytracker.com/id?1015967
CVE: CVE-2006-1960
Published: 2006-04-21
Description: Cross-site scripting (XSS) vulnerability in the appliance web user interface in Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13 allows remote attackers to inject arbitrary web script or HTML, possibly via the displayMsg parameter to archiveApplyDisplay.jsp, aka bug ID CSCsc01095.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/19736; http://securitytracker.com/id?1015965; http://www.assurance.com.au/advisories/200604-cisco.txt
CVE: CVE-2006-1961
Published: 2006-04-21
Description: Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13, Hosting Solution Engine (HSE) and User Registration Tool (URT) before 20060419, and all versions of Ethernet Subscriber Solution Engine (ESSE) and CiscoWorks2000 Service Management Solution (SMS) allow local users to gain Linux shell access via shell metacharacters in arguments to the "show" command in the application's command line interface (CLI), aka bug ID CSCsd21502 (WLSE), CSCsd22861 (URT), and CSCsd22859 (HSE).  NOTE: other issues might be addressed by the Cisco advisory.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19736; http://secunia.com/advisories/19739; http://secunia.com/advisories/19741
CVE: CVE-2006-1962
Published: 2006-04-21
Description: SQL injection vulnerability in PCPIN Chat 5.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username field (login parameter) to main.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://retrogod.altervista.org/pcpin_504_xpl.html; http://secunia.com/advisories/19708; http://securitytracker.com/id?1015968
CVE: CVE-2006-1963
Published: 2006-04-21
Description: Directory traversal vulnerability in main.php in PCPIN Chat 5.0.4 and earlier allows remote authenticated users to include and execute arbitrary PHP code via a ".." (dot dot) in a language cookie, as demonstrated by uploading then accessing a smiliefile image that actually contains PHP code.
CVSS Score: 5.5 (MEDIUM)
References: http://retrogod.altervista.org/pcpin_504_xpl.html; http://secunia.com/advisories/19708; http://securitytracker.com/id?1015968
CVE: CVE-2006-1964
Published: 2006-04-21
Description: SQL injection vulnerability in Haberler.asp in ASPSitem 1.83 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19693; http://www.nukedx.com/?getxpl=23; http://www.securityfocus.com/archive/1/431469/100/0/threaded
CVE: CVE-2006-1965
Published: 2006-04-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in aasi media Net Clubs Pro 4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) onuser, (2) pass, (3) chatsys, (4) room, (5) username, and (6) to parameters in (a) sendim.cgi; the (7) username parameter in (b) imessage.cgi; the (8) password parameter in (c) login.cgi; and the (9) cat_id parameter in (d) viewcat.cgi.
CVSS Score: 5.8 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/net-clubs-pro-xss-vuln.html; http://secunia.com/advisories/19651; http://www.osvdb.org/24754
CVE: CVE-2006-1966
Published: 2006-04-21
Description: An unspecified Fortinet product, possibly Fortinet28, allows remote attackers to cause a denial of service via a "small synflood" to the SMTP port (TCP port 25), as demonstrated by a 10-microsecond wait between sending packets.  NOTE: this issue has been disputed in followup posts that suggest that a protection feature is triggering a RST.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0449.html; http://archives.neohapsis.com/archives/fulldisclosure/2006-04/0472.html; http://www.securityfocus.com/archive/1/431404/100/0/threaded
CVE: CVE-2006-1967
Published: 2006-04-21
Description: Cross-site scripting (XSS) vulnerability in calendar/Visitor.cgi in KCScripts Calendar, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the sort_order parameter.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/04/portal-pack-6-xss-vuln.html; http://secunia.com/advisories/19695; http://securityreason.com/securityalert/503
CVE: CVE-2006-1968
Published: 2006-04-21
Description: Cross-site scripting (XSS) vulnerability in news/NsVisitor.cgi in KCScripts News Publisher, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the sort_order parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/portal-pack-6-xss-vuln.html; http://secunia.com/advisories/19695; http://www.osvdb.org/24762
CVE: CVE-2006-1969
Published: 2006-04-21
Description: Cross-site scripting (XSS) vulnerability in search/search.cgi in an unspecified KCScripts script, probably Search Engine or Site Search, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/04/portal-pack-6-xss-vuln.html; http://secunia.com/advisories/19695; http://www.osvdb.org/24763
CVE: CVE-2006-1970
Published: 2006-04-21
Description: Cross-site scripting (XSS) vulnerability in classifieds/viewcat.cgi in KCScripts Classifieds, distributed individually and as part of Portal Pack 6.0 and earlier, allows remote attackers to inject arbitrary web script or HTML via the cat_id parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/portal-pack-6-xss-vuln.html; http://secunia.com/advisories/19695; http://www.osvdb.org/24764
CVE: CVE-2006-1971
Published: 2006-04-21
Description: Cross-site scripting (XSS) vulnerability in login.php in KRANKIKOM ContentBoxX allows remote attackers to inject arbitrary web script or HTML via the action parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19733; http://securityreason.com/securityalert/740; http://securityreason.com/securityalert/779
CVE: CVE-2006-1972
Published: 2006-04-21
Description: Cross-site scripting (XSS) vulnerability in EasyGallery.php in Wingnut EasyGallery allows remote attackers to inject arbitrary web script or HTML via the ordner parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://advisory.patriotichackers.com/index.php?itemid=5; http://secunia.com/advisories/19713; http://securityreason.com/securityalert/746
CVE: CVE-2006-1973
Published: 2006-04-21
Description: Multiple unspecified vulnerabilities in Linksys RT31P2 VoIP router allow remote attackers to cause a denial of service via malformed Session Initiation Protocol (SIP) messages.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19722; http://www.kb.cert.org/vuls/id/621566; http://www.kb.cert.org/vuls/id/MIMG-6GMMW4
CVE: CVE-2006-1974
Published: 2006-04-21
Description: SQL injection vulnerability in index.php in MyBB (MyBulletinBoard) before 1.04 allows remote attackers to execute arbitrary SQL commands via the referrer parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/16443; http://www.securityfocus.com/bid/16443/exploit; http://www.securityfocus.com/bid/16443
CVE: CVE-2006-1975
Published: 2006-04-21
Description: Cross-site scripting (XSS) vulnerability in guestbook_newentry.php in PHP-Gastebuch 1.61 allows remote attackers to inject arbitrary web script or HTML via the Kommentar field.
CVSS Score: 2.6 (LOW)
References: http://osvdb.org/ref/23/23962-gastebuch.txt; http://secunia.com/advisories/19810; http://www.osvdb.org/23962
CVE: CVE-2006-1976
Published: 2006-04-21
Description: Cross-site scripting (XSS) vulnerability in addRequest.php in Prayer Request Board (PRB) Beta 1 before 20060320 allows remote attackers to inject arbitrary web script or HTML via the Request field.
CVSS Score: 2.6 (LOW)
References: http://osvdb.org/ref/23/23958-prb.txt; http://www.osvdb.org/23958; http://osvdb.org/ref/23/23958-prb.txt
CVE: CVE-2006-1977
Published: 2006-04-21
Description: Cross-site scripting (XSS) vulnerability in FlexBB 0.5.7 BETA and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) message parameters.
CVSS Score: 5.8 (MEDIUM)
References: http://securityreason.com/securityalert/777; http://securitytracker.com/id?1015946; http://www.securityfocus.com/archive/1/431071/100/0/threaded
CVE: CVE-2006-1978
Published: 2006-04-21
Description: SQL injection vulnerability in inc/start.php in FlexBB 0.5.5 and earlier allows remote attackers to execute arbitrary SQL commands via the flexbb_username COOKIE parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securitytracker.com/id?1015949; http://www.securityfocus.com/archive/1/431156/100/0/threaded; http://www.securityfocus.com/bid/17568
CVE: CVE-2006-1979
Published: 2006-04-21
Description: Cross-site scripting (XSS) vulnerability in mwguest.php in Manic Web MWGuest 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the homepage parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://evuln.com/vulns/122/summary.html; http://securityreason.com/securityalert/747; http://www.securityfocus.com/archive/1/431507/100/0/threaded
CVE: CVE-2006-1980
Published: 2006-04-21
Description: Cross-site scripting (XSS) vulnerability in W2B Online Banking allows remote attackers to inject arbitrary web script or HTML via the (1) query string, (2) SID parameter, or (3) ilang parameter.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/04/w2b-online-banking-vuln.html; http://secunia.com/advisories/19717; http://www.osvdb.org/24759
CVE: CVE-2006-1981
Published: 2006-04-21
Description: Unspecified vulnerability in Java InputMethods on Mac OS X 10.4.5 may cause InputMethods to send input events for secure fields to the wrong text field, which might reveal the password to others who can view the screen.
CVSS Score: 2.1 (LOW)
References: http://docs.info.apple.com/article.html?artnum=303658; http://www.vupen.com/english/advisories/2006/1398; https://exchange.xforce.ibmcloud.com/vulnerabilities/26167
CVE: CVE-2006-1982
Published: 2006-04-21
Description: Heap-based buffer overflow in the LZWDecodeVector function in Mac OS X before 10.4.6, as used in applications that use ImageIO or AppKit, allows remote attackers to execute arbitrary code via crafted TIFF images.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=303411; http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/19686
CVE: CVE-2006-1983
Published: 2006-04-21
Description: Multiple heap-based buffer overflows in Mac OS X 10.4.6 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) PredictorVSetField function for TIFF or (2) CFAllocatorAllocate function for GIF, as used in applications that use ImageIO or AppKit.  NOTE: the BMP vector has been re-assigned to CVE-2006-2238 because it affects a separate product family.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/19686; http://secunia.com/advisories/20077
CVE: CVE-2006-1984
Published: 2006-04-21
Description: Unspecified vulnerability in the _cg_TIFFSetField function in Mac OS X 10.4.6 and earlier, as used in applications that use ImageIO or AppKit, allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/19686; http://secunia.com/advisories/20077
CVE: CVE-2006-1985
Published: 2006-04-21
Description: Heap-based buffer overflow in BOM BOMArchiveHelper 10.4 (6.3) Build 312, as used in Mac OS X 10.4.6 and earlier, allows user-assisted attackers to execute arbitrary code via a crafted archive (such as ZIP) that contains long path names, which triggers an error in the BOMStackPop function.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/19686; http://secunia.com/advisories/20077
CVE: CVE-2006-1986
Published: 2006-04-21
Description: Apple Safari 2.0.3 allows remote attackers to cause a denial of service and possibly execute code via a large CELLSPACING attribute in a TABLE tag, which triggers an error in KWQListIteratorImpl::KWQListIteratorImpl.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19686; http://security-protocols.com/poc/sp-x26-1.html; http://www.osvdb.org/24823
CVE: CVE-2006-1987
Published: 2006-04-21
Description: Apple Safari 2.0.3 allows remote attackers to cause a denial of service and possibly execute code via an invalid FRAME tag, possibly due to (1) multiple SCROLLING attributes with no values, or (2) a SRC attribute with no value.  NOTE: due to lack of diagnosis by the researcher, it is unclear which vector is responsible.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19686; http://security-protocols.com/poc/sp-x26-4.html; http://www.security-protocols.com/sp-x26-advisory.php
CVE: CVE-2006-1988
Published: 2006-04-21
Description: The WebTextRenderer(WebInternal) _CG_drawRun:style:geometry: function in Apple Safari 2.0.3 allows remote attackers to cause a denial of service (application crash) via an HTML LI tag with a large VALUE attribute (list item number), which triggers a null dereference in QPainter::drawText, probably due to a failed memory allocation that uses the VALUE.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19686; http://security-protocols.com/poc/sp-x26-2.html; http://www.osvdb.org/24823
CVE: CVE-2006-1865
Published: 2006-04-21
Description: Argument injection vulnerability in Beagle before 0.2.5 allows attackers to execute arbitrary commands via crafted filenames that inject command line arguments when Beagle launches external helper applications while indexing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-88
References: http://lists.seifried.org/pipermail/security/2006-April/013163.html; http://scary.beasts.org/security/CESA-2006-002.html; http://secunia.com/advisories/19778
CVE: CVE-2006-1951
Published: 2006-04-24
Description: Directory traversal vulnerability in SolarWinds TFTP Server 8.1 and earlier allows remote attackers to download arbitrary files via a crafted GET request including "....//" sequences, which are collapsed into "../" sequences by filtering.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0009.html; http://secunia.com/advisories/19848; http://securityreason.com/securityalert/778
CVE: CVE-2006-1952
Published: 2006-04-24
Description: Directory traversal vulnerability in WinAgents TFTP Server for Windows 3.1 and earlier allows remote attackers to read arbitrary files via "..." (triple dot) sequences in a GET request.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19844; http://www.rapid7.com/advisories/R7-0020.html; http://www.securityfocus.com/bid/17718
CVE: CVE-2006-1990
Published: 2006-04-24
Description: Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U; http://docs.info.apple.com/article.html?artnum=304829; http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html
CVE: CVE-2006-1991
Published: 2006-04-24
Description: The substr_compare function in string.c in PHP 5.1.2 allows context-dependent attackers to cause a denial of service (memory access violation) via an out-of-bounds offset argument.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/20052; http://secunia.com/advisories/20269; http://secunia.com/advisories/20676
CVE: CVE-2006-1512
Published: 2006-04-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-1712.  Reason: This candidate is a reservation duplicate of CVE-2006-1712.  Notes: All CVE users should reference CVE-2006-1712 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-0230
Published: 2006-04-25
Description: Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attackers to gain administrator privileges via a modified client that sends certain XML requests.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0010.html; http://secunia.com/advisories/19734; http://www.kb.cert.org/vuls/id/118388
CVE: CVE-2006-0231
Published: 2006-04-25
Description: Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each installation, which allows remote attackers to conduct man-in-the-middle attacks and decrypt communications.
CVSS Score: 6.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2006-q2/0011.html; http://secunia.com/advisories/19734; http://securitytracker.com/id?1015974