deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-0447
Published: 2006-01-27
Description: Multiple buffer overflows in E-Post Mail Server 4.10 and SPA-PRO Mail @Solomon 4.00 allow remote attackers to execute arbitrary code via a long username to the (1) AUTH PLAIN or (2) AUTH LOGIN SMTP commands, which is not properly handled by (a) EPSTRS.EXE or (b) SPA-RS.EXE; (3) a long username in the APOP POP3 command, which is not properly handled by (c) EPSTPOP4S.EXE or (d) SPA-POP3S.EXE; (4) a long IMAP DELETE command, which is not properly handled by (e) EPSTIMAP4S.EXE or (f) SPA-IMAP4S.EXE.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18480; http://secunia.com/secunia_research/2006-1/advisory/; http://www.osvdb.org/22761
CVE: CVE-2006-0448
Published: 2006-01-27
Description: Multiple directory traversal vulnerabilities in (1) EPSTIMAP4S.EXE and (2) SPA-IMAP4S.EXE in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allow remote attackers to (a) list arbitrary directories or cause a denial of service via the LIST command; or create arbitrary files via the (b) APPEND, (c) COPY, or (d) RENAME commands.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18480; http://secunia.com/secunia_research/2006-1/advisory/; http://www.osvdb.org/22764
CVE: CVE-2006-0449
Published: 2006-01-27
Description: Early termination vulnerability in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allows remote attackers to cause a denial of service (infinite loop) by sending an APPEND command and disconnecting before the expected amount of data is sent.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18480; http://secunia.com/secunia_research/2006-1/advisory/; http://www.osvdb.org/22766
CVE: CVE-2006-0450
Published: 2006-01-27
Description: phpBB 2.0.19 and earlier allows remote attackers to cause a denial of service (application crash) by (1) registering many users through profile.php or (2) using search.php to search in a certain way that confuses the database.
CVSS Score: 5.0 (MEDIUM)
References: http://h4cky0u.org/viewtopic.php?t=637; http://securityreason.com/securityalert/368; http://www.h4cky0u.org/advisories/HYSA-2006-001-phpbb.txt
CVE: CVE-2006-0057
Published: 2006-01-27
Description: Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to bypass the Kill bit settings for dangerous ActiveX controls via unknown vectors involving crafted HTML, which can expose the browser to attacks that would otherwise be prevented by the Kill bit setting. NOTE: CERT/CC claims that MS05-054 fixes this issue, but it is not described in MS05-054.
CVSS Score: 7.5 (HIGH)
References: http://www.kb.cert.org/vuls/id/998297; http://www.microsoft.com/technet/security/bulletin/ms05-054.mspx; http://www.osvdb.org/23657
CVE: CVE-2006-0461
Published: 2006-01-27
Description: Cross-site scripting (XSS) vulnerability in core.input.php in ExpressionEngine 1.4.1 allows remote attackers to inject arbitrary web script or HTML via HTTP_REFERER (referer).
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/48/summary.html; http://secunia.com/advisories/18602; http://securityreason.com/securityalert/372
CVE: CVE-2006-0462
Published: 2006-01-27
Description: SQL injection vulnerability in comentarios.php in AndoNET Blog 2004.09.02 allows remote attackers to execute arbitrary SQL commands via the entrada parameter.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/50/summary.html; http://secunia.com/advisories/18633; http://securityreason.com/securityalert/377
CVE: CVE-2006-0463
Published: 2006-01-27
Description: Cross-site scripting (XSS) vulnerability in IdeoContent Manager allows remote attackers to inject arbitrary web script or HTML via the (1) goto_id parameter to index.php or (2) page parameter to news_full.php.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/ref/22/22712-ideocontent.txt; http://www.osvdb.org/22712; http://www.osvdb.org/22713
CVE: CVE-2006-0464
Published: 2006-01-27
Description: Multiple SQL injection vulnerabilities in index.php in IdeoContent Manager allow remote attackers to execute arbitrary SQL commands via the (1) goto_id or (2) mid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/ref/22/22712-ideocontent.txt; http://www.osvdb.org/22714; http://osvdb.org/ref/22/22712-ideocontent.txt
CVE: CVE-2006-0465
Published: 2006-01-27
Description: Cross-site scripting (XSS) vulnerability in risultati_ricerca.php in active121 Site Manager allows remote attackers to inject arbitrary web script or HTML via the cerca parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/ref/22/22715-active121.txt; http://www.osvdb.org/22715; http://osvdb.org/ref/22/22715-active121.txt
CVE: CVE-2006-0466
Published: 2006-01-27
Description: Cross-site scripting (XSS) vulnerability in search.asp in Goldstag Content Management System allows remote attackers to inject arbitrary web script or HTML via the text parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/ref/22/22711-goldstag.txt; http://www.osvdb.org/22711; https://exchange.xforce.ibmcloud.com/vulnerabilities/25198
CVE: CVE-2006-0468
Published: 2006-01-30
Description: CommuniGate Pro Core Server before 5.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via LDAP messages with negative BER lengths, and possibly other vectors, as demonstrated by the ProtoVer LDAP test suite.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18640; http://www.gleg.net/advisory_cg.shtml; http://www.securityfocus.com/archive/1/423364/100/0/threaded
CVE: CVE-2006-0469
Published: 2006-01-30
Description: Cross-site scripting (XSS) vulnerability in UebiMiau 2.7.9, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG tag.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18655; http://securityreason.com/securityalert/387; http://www.securityfocus.com/archive/1/423437/100/0/threaded
CVE: CVE-2006-0301
Published: 2006-01-30
Description: Heap-based buffer overflow in Splash.cc in xpdf, as used in other products such as (1) poppler, (2) kdegraphics, (3) gpdf, (4) pdfkit.framework, and others, allows attackers to cause a denial of service and possibly execute arbitrary code via crafted splash images that produce certain values that exceed the width or height of the associated bitmap.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt; http://rhn.redhat.com/errata/RHSA-2006-0206.html; http://secunia.com/advisories/18274
CVE: CVE-2006-0043
Published: 2006-01-31
Description: Buffer overflow in the realpath function in nfs-server rpc.mountd, as used in SUSE Linux 9.1 through 10.0, allows local users to execute arbitrary code via unspecified vectors involving mount requests and symlinks.
CVSS Score: 4.6 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350020; http://lists.suse.com/archive/suse-security-announce/2006-Jan/0007.html; http://secunia.com/advisories/18614
CVE: CVE-2006-0467
Published: 2006-01-31
Description: Unspecified vulnerability in Pioneers (formerly gnocatan) before 0.9.49 allows remote attackers to cause a denial of service (application crash) via long chat messages.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350237; http://secunia.com/advisories/18647; http://secunia.com/advisories/18692
CVE: CVE-2006-0470
Published: 2006-01-31
Description: Cross-site scripting (XSS) vulnerability in search.php in MyBulletinBoard (MyBB) 1.02 allows remote attackers to inject arbitrary web script or HTML via the (1) sortby and (2) sortordr parameters, which are not properly handled in a redirection.
CVSS Score: 4.3 (MEDIUM)
References: http://community.mybboard.net/attachment.php?aid=2181; http://community.mybboard.net/showthread.php?tid=6418; http://seclists.org/lists/bugtraq/2006/Jan/0414.html
CVE: CVE-2006-0471
Published: 2006-01-31
Description: Cross-site scripting (XSS) vulnerability in the bbcode function in functions.php in my little homepage my little forum, as last modified in June 2005, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags.
CVSS Score: 4.3 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-January/000520.html; http://evuln.com/vulns/51/; http://evuln.com/vulns/51/summary.html
CVE: CVE-2006-0472
Published: 2006-01-31
Description: Cross-site scripting (XSS) vulnerability in guestbook.php in my little homepage my little guestbook, as last modified in March 2004, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags.
CVSS Score: 4.3 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-January/000520.html; http://evuln.com/vulns/51/; http://evuln.com/vulns/51/summary.html
CVE: CVE-2006-0473
Published: 2006-01-31
Description: Cross-site scripting (XSS) vulnerability in the bbcode function in weblog.php in my little homepage my little weblog, as last modified in April 2004, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags.
CVSS Score: 4.3 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-January/000520.html; http://evuln.com/vulns/51/; http://evuln.com/vulns/51/summary.html
CVE: CVE-2006-0474
Published: 2006-01-31
Description: Multiple integer overflows in Shareaza 2.2.1.0 allow remote attackers to execute arbitrary code via (1) a large packet length field, which causes an overflow in the ReadBuffer function in (a) BTPacket.cpp and (b) EDPacket.cpp, or (2) a large packet, which causes a heap-based overflow in the Write function in (c) Packet.h.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0887.html; http://cvs.sourceforge.net/viewcvs.py/shareaza/shareaza/BTPacket.cpp?r1=1.5&r2=1.5.4.1; http://cvs.sourceforge.net/viewcvs.py/shareaza/shareaza/EDPacket.cpp?r1=1.15&r2=1.15.2.1
CVE: CVE-2006-0475
Published: 2006-01-31
Description: PHP-Ping 1.3 does not properly validate ping counts, which allows remote attackers to cause a denial of service (ping flood) via a negative count parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18645; http://www.kapda.ir/advisory-231.html; http://www.vupen.com/english/advisories/2006/0368
CVE: CVE-2006-0476
Published: 2006-01-31
Description: Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field).
CVSS Score: 7.6 (HIGH)
References: http://secunia.com/advisories/18649; http://securityreason.com/securityalert/386; http://securityreason.com/securityalert/398
CVE: CVE-2006-0477
Published: 2006-01-31
Description: Buffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to execute arbitrary code via an index file with a long symbolic link.
CVSS Score: 7.5 (HIGH)
References: http://lwn.net/Articles/169623/; http://secunia.com/advisories/18643; http://www.securityfocus.com/bid/16417
CVE: CVE-2006-0478
Published: 2006-01-31
Description: CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php.  NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the vulnerability on all known 6.0x and 6.1x releases.  We strongly encourage users of CRE Loaded 6.x, osCMax, and other users of osCommerce who have installed HTMLArea based WYSIWYG editors and Admin Access with Levels to modify thier installations at the earliest possible moment."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18648; http://www.attrition.org/pipermail/vim/2006-February/000527.html; http://www.osvdb.org/22793
CVE: CVE-2006-0479
Published: 2006-01-31
Description: pmwiki.php in PmWiki 2.1 beta 20, with register_globals enabled, allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GPC variable and a GLOBALS[] variable with the same name, which causes PmWiki to unset the GLOBALS[] variable but not the GPC variable, which creates resultant vulnerabilities such as remote file inclusion and cross-site scripting (XSS).
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0931.html; http://secunia.com/advisories/18634; http://securitytracker.com/id?1015550
CVE: CVE-2006-0480
Published: 2006-01-31
Description: Cross-site scripting (XSS) vulnerability in the Articles module in sPaiz-Nuke allows remote attackers to inject arbitrary web script or HTML via the query parameter in the search file.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18672; http://securityreason.com/securityalert/384; http://www.securityfocus.com/archive/1/423451/100/0/threaded
CVE: CVE-2006-0481
Published: 2006-01-31
Description: Heap-based buffer overflow in the alpha strip capability in libpng 1.2.7 allows context-dependent attackers to cause a denial of service (crash) when the png_do_strip_filler function is used to strip alpha channels out of the image.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: ftp://ftp.simplesystems.org/pub/libpng/png/src/libpng-1.2.8-README.txt; http://secunia.com/advisories/18654; http://secunia.com/advisories/18863
CVE: CVE-2006-0482
Published: 2006-01-31
Description: Linux kernel 2.6.15.1 and earlier, when running on SPARC architectures, allows local users to cause a denial of service (hang) via a "date -s" command, which causes invalid sign extended arguments to be provided to the get_compat_timespec function call.
CVSS Score: 2.1 (LOW)
References: http://lists.debian.org/debian-sparc/2006/01/msg00129.html; http://marc.info/?l=linux-sparc&m=[PII_REDACTED]4065&w=2; http://marc.info/?l=linux-sparc&m=[PII_REDACTED]3463&w=2
CVE: CVE-2006-0483
Published: 2006-01-31
Description: Cisco VPN 3000 series concentrators running software 4.7.0 through 4.7.2.A allow remote attackers to cause a denial of service (device reload or user disconnect) via a crafted HTTP packet.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/18629; http://securityreason.com/securityalert/375; http://securitytracker.com/id?1015546
CVE: CVE-2006-0484
Published: 2006-01-31
Description: Directory traversal vulnerability in Vis.pl, as part of the FACE CONTROL product, allows remote attackers to read arbitrary files via a .. (dot dot) in any parameter that opens a file, such as (1) s or (2) p.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/376; http://securitytracker.com/id?1015547; http://www.hackerscenter.com/archive/view.asp?id=22236
CVE: CVE-2006-0485
Published: 2006-02-01
Description: The TCL shell in Cisco IOS 12.2(14)S before 12.2(14)S16, 12.2(18)S before 12.2(18)S11, and certain other releases before 25 January 2006 does not perform Authentication, Authorization, and Accounting (AAA) command authorization checks, which may allow local users to execute IOS EXEC commands that were prohibited via the AAA configuration, aka Bug ID CSCeh73049.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/18613; http://securitytracker.com/id?1015543; http://www.cisco.com/warp/public/707/cisco-response-20060125-aaatcl.shtml
CVE: CVE-2006-0486
Published: 2006-02-01
Description: Certain Cisco IOS releases in 12.2S based trains with maintenance release number 25 and later, 12.3T based trains, and 12.4 based trains reuse a Tcl Shell process across login sessions of different local users on the same terminal if the first user does not use tclquit before exiting, which may cause subsequent local users to execute unintended commands or bypass AAA command authorization checks, aka Bug ID CSCef77770.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/18613; http://securitytracker.com/id?1015543; http://www.cisco.com/warp/public/707/cisco-response-20060125-aaatcl.shtml
CVE: CVE-2006-0487
Published: 2006-02-01
Description: Multiple unspecified vulnerabilities in Tumbleweed MailGate Email Firewall (EMF) 6.x allow remote attackers to (1) trigger temporarily incorrect processing of an e-mail message under "extremely heavy loads" and (2) cause an "increased number of missed spam" during "spam outbreaks."
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/422591/100/0/threaded; http://www.securityfocus.com/archive/1/422591/100/0/threaded
CVE: CVE-2006-0488
Published: 2006-02-01
Description: The VDM (Virtual DOS Machine) emulation environment for MS-DOS applications in Windows 2000, Windows XP SP2, and Windows Server 2003 allows local users to read the first megabyte of memory and possibly obtain sensitive information, as demonstrated by dumper.asm.
CVSS Score: 2.1 (LOW)
References: http://www.securityfocus.com/archive/1/423169/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/24471; http://www.securityfocus.com/archive/1/423169/100/0/threaded
CVE: CVE-2006-0489
Published: 2006-02-01
Description: Buffer overflow in the font command of mIRC, probably 6.16, allows local users to execute arbitrary code via a long string. NOTE: the original researcher claims that issue has been disputed by the vendor, and that the vendor stated "as far as I can tell, this is neither an exploit nor a vulnerability.  The above report describes a local bug in mIRC."  It could be that this is only exploitable by the user of the application, and thus would not cross privilege boundaries unless under an otherwise restrictive environment such as a kiosk
CVSS Score: 4.6 (MEDIUM)
References: http://securityreason.com/securityalert/383; http://trout.snt.utwente.nl/ubbthreads/showflat.php?Cat=0&Board=bugreports&Number=118751; http://www.osvdb.org/22942
CVE: CVE-2006-0490
Published: 2006-02-01
Description: SQL injection vulnerability in login.asp in ASPThai.Net ASPThai Forums 8.0 and earlier allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the password field.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3661&w=2; http://secunia.com/advisories/18636; http://securityreason.com/securityalert/381
CVE: CVE-2006-0491
Published: 2006-02-01
Description: SQL injection vulnerability in SZUserMgnt.class.php in SZUserMgnt 1.4 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18666; http://securityreason.com/securityalert/396; http://securitytracker.com/id?1015569
CVE: CVE-2006-0492
Published: 2006-02-01
Description: Multiple SQL injection vulnerabilities in Calendarix allow remote attackers to execute arbitrary SQL commands via (1) the catview parameter in cal_functions.inc.php and (2) the login parameter in cal_login.php.  NOTE: the catview vector might overlap CVE-2005-1865.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18667; http://securityreason.com/securityalert/394; http://securitytracker.com/id?1015560
CVE: CVE-2006-0493
Published: 2006-02-01
Description: Cross-site scripting (XSS) vulnerability in MG2 (formerly known as Minigal) 0.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field in a comment associated with a picture.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17374; http://securityreason.com/securityalert/389; http://www.securityfocus.com/archive/1/423477/100/0/threaded
CVE: CVE-2006-0494
Published: 2006-02-01
Description: Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.02 allows local users with MyBB administrative privileges to include and possibly execute arbitrary local files via directory traversal sequences and a nul (%00) character in the plugin parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/423465/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/24461; http://www.securityfocus.com/archive/1/423465/100/0/threaded
CVE: CVE-2006-0495
Published: 2006-02-01
Description: Cross-site scripting (XSS) vulnerability in the Add Thread to Favorites feature in usercp2.php in MyBB (aka MyBulletinBoard) 1.02 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer header ($url variable).
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/423443/100/0/threaded; http://www.securityfocus.com/bid/16419; https://exchange.xforce.ibmcloud.com/vulnerabilities/24392
CVE: CVE-2006-0496
Published: 2006-02-01
Description: Cross-site scripting (XSS) vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8.1 and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the -moz-binding (Cascading Style Sheets) CSS property, which does not require that the style sheet have the same origin as the web page, as demonstrated by the compromise of a large number of LiveJournal accounts.
CVSS Score: 4.3 (MEDIUM)
References: http://community.livejournal.com/lj_dev/708069.html; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9062&w=2; http://securitytracker.com/id?1015553
CVE: CVE-2006-0497
Published: 2006-02-01
Description: Multiple SQL injection vulnerabilities in PHP GEN before 1.4 allow remote attackers to inject arbitrary SQL commands via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18715; http://www.eyce.be/php_gen/NEWS; http://www.osvdb.org/22885
CVE: CVE-2006-0498
Published: 2006-02-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHP GEN before 1.4 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18715; http://www.eyce.be/php_gen/NEWS; http://www.osvdb.org/22884
CVE: CVE-2006-0499
Published: 2006-02-01
Description: Cross-site scripting (XSS) vulnerability in rlink.php in Rlink 1.0.0 module for phpBB allows remote attackers to inject arbitrary web script or HTML via the url parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18620; http://www.osvdb.org/22818; http://www.securityfocus.com/bid/16448
CVE: CVE-2006-0500
Published: 2006-02-01
Description: MyCO Guestbook 1.0 stores the admin directory under the web document root with insufficient access control, which allows remote attackers to perform unspecified privileged actions by directly accessing files via a URL.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/423565/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/24438; http://www.securityfocus.com/archive/1/423565/100/0/threaded
CVE: CVE-2006-0501
Published: 2006-02-01
Description: Cross-site scripting (XSS) vulnerability in MyCO Guestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the Name field, when registering a user.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/423565/100/0/threaded; http://www.securityfocus.com/archive/1/423696/100/0/threaded; http://www.securityfocus.com/bid/16444
CVE: CVE-2006-0502
Published: 2006-02-01
Description: PHP remote file inclusion vulnerability in loginout.php in FarsiNews 2.1 Beta 2 and earlier, with register_globals enabled, allows remote attackers to include arbitrary files via a URL in the cutepath parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18637; http://securityreason.com/securityalert/390; http://securitytracker.com/id?1015554
CVE: CVE-2006-0503
Published: 2006-02-01
Description: IMAP service in MailEnable Professional Edition before 1.72 allows remote attackers to cause a denial of service (service crash) via unspecified vectors involving the EXAMINE command.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18668; http://securitytracker.com/id?1015558; http://www.mailenable.com/professionalhistory.asp