deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6545
Published: 2006-12-14
Description: PHP remote file inclusion vulnerability in includes/common.php in the ErrorDocs 1.0.0 and earlier module for mxBB (mx_errordocs) allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23298; http://www.vupen.com/english/advisories/2006/4947; https://exchange.xforce.ibmcloud.com/vulnerabilities/30820
CVE: CVE-2006-6546
Published: 2006-12-14
Description: PHP remote file inclusion vulnerability in inc/shows.inc.php in cutenews aj-fork (CN:AJ) 167f and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23425; http://www.securityfocus.com/bid/21432; http://www.vupen.com/english/advisories/2006/4858
CVE: CVE-2006-6547
Published: 2006-12-14
Description: Buffer overflow in the readAA function in read_aa.cpp in Winamp iPod Plugin (ml_ipod) 2.00 p19 and earlier allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long tag in an audible.com audiobook (aa) file.
CVSS Score: 4.3 (MEDIUM)
References: http://aluigi.altervista.org/adv/mlipodbof-adv.txt; http://mlipod.cvs.sourceforge.net/mlipod/ml_ipod/read_aa.cpp; http://mlipod.cvs.sourceforge.net/mlipod/ml_ipod/read_aa.cpp?r1=1.3.6.1&r2=1.3.6.2
CVE: CVE-2006-6548
Published: 2006-12-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the domain parameter to (1) scripts2/changeemail, (2) scripts2/limitbw, or (3) scripts/rearrangeacct.  NOTE: the feature parameter to scripts2/dofeaturemanager is already covered by CVE-2006-6198.
CVSS Score: 3.5 (LOW)
References: http://securityreason.com/securityalert/2027; http://www.aria-security.com/forum/showthread.php?t=44; http://www.securityfocus.com/archive/1/453885/100/0/threaded
CVE: CVE-2006-6549
Published: 2006-12-14
Description: PHP remote file inclusion vulnerability in upload.php in Rad Upload 3.02 allows remote attackers to execute arbitrary PHP code via a URL in the save_path parameter.  NOTE: CVE disputes this vulnerability because save_path is originally defined as "" before use, and the nearby instructions say "SET THE SAVE PATH by editing the line below.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2034; http://www.securityfocus.com/archive/1/454175/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30864
CVE: CVE-2006-6550
Published: 2006-12-14
Description: PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the db_file parameter.  NOTE: CVE disputes this vulnerability because db_file is defined before use
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/30741; https://www.exploit-db.com/exploits/2894; https://exchange.xforce.ibmcloud.com/vulnerabilities/30741
CVE: CVE-2006-6551
Published: 2006-12-14
Description: PHP remote file inclusion vulnerability in libs/tucows/api/cartridges/crt_TUCOWS_domains/lib/domainutils.inc.php in Tucows Client Code Suite (CCS) 1.2.1015 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _ENV[TCA_HOME] parameter.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/30789; https://www.exploit-db.com/exploits/2896; https://exchange.xforce.ibmcloud.com/vulnerabilities/30789
CVE: CVE-2006-6552
Published: 2006-12-14
Description: PHP remote file inclusion vulnerability in admin/plugins/NP_UserSharing.php in BLOG:CMS 4.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DIR_ADMIN parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1459&w=2; http://secunia.com/advisories/23345; http://securitytracker.com/id?1017375
CVE: CVE-2006-6553
Published: 2006-12-14
Description: PHP remote file inclusion vulnerability in includes/newssuite_constants.php in the NewsSuite 1.03 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the mx_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23358; http://www.securityfocus.com/bid/21573; http://www.vupen.com/english/advisories/2006/4981
CVE: CVE-2006-6554
Published: 2006-12-14
Description: Unspecified vulnerability in Kerio MailServer before 6.3.1 allows remote attackers to cause a denial of service (segmentation fault and service stop) via certain long LDAP queries, as demonstrated by vd_kms6.pm.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23364; http://www.kerio.com/kms_history.html; http://www.securityfocus.com/archive/1/454455/100/0/threaded
CVE: CVE-2006-6555
Published: 2006-12-14
Description: Multiple SQL injection vulnerabilities in EasyFill before 0.5.1 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://sourceforge.net/forum/forum.php?forum_id=642711; http://www.vupen.com/english/advisories/2006/4961; https://exchange.xforce.ibmcloud.com/vulnerabilities/30843
CVE: CVE-2006-6556
Published: 2006-12-14
Description: The eyeHome function in apps/eyeHome.eyeapp/aplic.php in EyeOS before 0.9.3-3 allows remote attackers to upload and execute arbitrary code via dangerous file extensions that are not all lowercase, which bypasses a cleansing operation.
CVSS Score: 7.5 (HIGH)
References: http://eyeos.blogspot.com/2006/12/eyeos-093-4-released-webmail-eyeapp.html; http://prdownloads.sourceforge.net/eyeos/eyeOS-0.9.3-4.tar.gz?download; http://secunia.com/advisories/23388
CVE: CVE-2006-6557
Published: 2006-12-14
Description: Multiple unspecified vulnerabilities in Skulls! before 0.2.6 have unknown impact and attack vectors, as addressed by "Many security fixes."
CVSS Score: 6.8 (MEDIUM)
References: http://sourceforge.net/project/shownotes.php?release_id=470092; http://www.vupen.com/english/advisories/2006/4963; https://exchange.xforce.ibmcloud.com/vulnerabilities/30846
CVE: CVE-2006-6558
Published: 2006-12-14
Description: Crob FTP Server 3.6.1 b.263 allows remote attackers to cause a denial of service via a long series of "?A" sequences in the (1) LIST and possibly (2) NLST command.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23365; http://www.securityfocus.com/bid/13848; http://www.vupen.com/english/advisories/2006/4994
CVE: CVE-2006-6559
Published: 2006-12-14
Description: SQL injection vulnerability in ProductDetails.asp in Lotfian Request For Travel 1.0 allows remote attackers to execute arbitrary SQL commands via the PID parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/4933; https://exchange.xforce.ibmcloud.com/vulnerabilities/30836; https://www.exploit-db.com/exploits/2908
CVE: CVE-2006-6560
Published: 2006-12-14
Description: PHP remote file inclusion vulnerability in includes/common.php in the mx_modsdb 1.0.0 module for MxBB (aka MX-System) Portal allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23331; http://www.vupen.com/english/advisories/2006/4983; https://exchange.xforce.ibmcloud.com/vulnerabilities/30858
CVE: CVE-2006-6561
Published: 2006-12-14
Description: Unspecified vulnerability in Microsoft Word 2000, 2002, and Word Viewer 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted DOC file that triggers memory corruption, as demonstrated via the 12122006-djtest.doc file, a different issue than CVE-2006-5994 and CVE-2006-6456.
CVSS Score: 9.3 (HIGH)
References: http://blogs.securiteam.com/?p=763; http://blogs.technet.com/msrc/archive/2006/12/15/update-on-current-word-vulnerability-reports.aspx; http://research.eeye.com/html/alerts/zeroday/20061212.html
CVE: CVE-2006-4902
Published: 2006-12-14
Description: The NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 does not properly check for chained commands, which allows remote attackers to execute arbitrary commands by appending malicious commands to valid commands.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23368; http://securitytracker.com/id?1017379; http://www.iss.net/threats/247.html
CVE: CVE-2006-5822
Published: 2006-12-14
Description: Stack-based buffer overflow in the NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 allows remote attackers to execute arbitrary code via a long CONNECT_OPTIONS request, a different issue than CVE-2006-6222.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23368; http://securitytracker.com/id?1017379; http://www.kb.cert.org/vuls/id/650432
CVE: CVE-2006-6222
Published: 2006-12-14
Description: Stack-based buffer overflow in the NetBackup bpcd daemon (bpcd.exe) in Symantec Veritas NetBackup 5.0 before 5.0_MP7, 5.1 before 5.1_MP6, and 6.0 before 6.0_MP4 allows remote attackers to execute arbitrary code via a long request with a malformed length prefix.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23368; http://securityreason.com/securityalert/2033; http://securitytracker.com/id?1017379
CVE: CVE-2006-6304
Published: 2006-12-14
Description: The do_coredump function in fs/exec.c in the Linux kernel 2.6.19 sets the flag variable to O_EXCL but does not use it, which allows context-dependent attackers to modify arbitrary files via a rewrite attack during a core dump.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/23349; http://support.avaya.com/css/P8/documents/100073666; http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.19.1
CVE: CVE-2006-6474
Published: 2006-12-14
Description: Untrusted search path vulnerability in McAfee VirusScan for Linux 4510e and earlier includes the current working directory in the DT_RPATH environment variable, which allows local users to load arbitrary ELF DSO libraries and execute arbitrary code by installing malicious libraries in that directory.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/23278; http://secunia.com/advisories/23429; http://security.gentoo.org/glsa/glsa-200612-15.xml
CVE: CVE-2006-6105
Published: 2006-12-15
Description: Format string vulnerability in the host chooser window (gdmchooser) in GNOME Foundation Display Manager (gdm) allows local users to execute arbitrary code via format string specifiers in a hostname, which are used in an error dialog.
CVSS Score: 4.3 (MEDIUM)
References: http://ftp.acc.umu.se/pub/GNOME/sources/gdm/2.17/gdm-2.17.4.news; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=453; http://secunia.com/advisories/23381
CVE: CVE-2006-6563
Published: 2006-12-15
Description: Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value.
CVSS Score: 6.6 (MEDIUM)
References: http://secunia.com/advisories/23371; http://secunia.com/advisories/23392; http://secunia.com/advisories/23473
CVE: CVE-2006-6564
Published: 2006-12-15
Description: FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a malformed argument to the STOR command, which results in a NULL pointer dereference.  NOTE: CVE analysis suggests that the problem might be due to a malformed PORT command.
CVSS Score: 4.0 (MEDIUM)
References: http://retrogod.altervista.org/filezilla_0921_dos.html; http://sourceforge.net/project/shownotes.php?release_id=470364&group_id=21558; http://www.vupen.com/english/advisories/2006/4937
CVE: CVE-2006-6565
Published: 2006-12-15
Description: FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to the (1) LIST or (2) NLST commands, which results in a NULL pointer dereference, a different set of vectors than CVE-2006-6564.  NOTE: CVE analysis suggests that the problem might be due to a malformed PORT command.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-476
References: http://sourceforge.net/project/shownotes.php?release_id=470364&group_id=21558; http://www.vupen.com/english/advisories/2006/4937; https://exchange.xforce.ibmcloud.com/vulnerabilities/30853
CVE: CVE-2006-6566
Published: 2006-12-15
Description: PHP remote file inclusion vulnerability in includes/profilcp_constants.php in the Profile Control Panel (CPanel) module for mxBB 0.91c allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.attrition.org/pipermail/vim/2006-December/001176.html; http://www.vupen.com/english/advisories/2006/4928; http://www.vupen.com/english/advisories/2006/4946
CVE: CVE-2006-6567
Published: 2006-12-15
Description: PHP remote file inclusion vulnerability in includes/kb_constants.php in the Knowledge Base (mx_kb) 2.0.2 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23356; http://www.securityfocus.com/bid/21577; http://www.vupen.com/english/advisories/2006/4982
CVE: CVE-2006-6568
Published: 2006-12-15
Description: Directory traversal vulnerability in includes/kb_constants.php in the Knowledge Base (mx_kb) 2.0.2 module for mxBB allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the phpEx parameter.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23356; http://www.securityfocus.com/bid/21577; https://exchange.xforce.ibmcloud.com/vulnerabilities/30857
CVE: CVE-2006-6569
Published: 2006-12-15
Description: form.php in GenesisTrader 1.0 allows remote attackers to read source code for arbitrary files and obtain sensitive information via the (1) do and (2) chem parameters with a "modfich" floap parameter.
CVSS Score: 7.8 (HIGH)
References: http://securityreason.com/securityalert/2035; http://www.securityfocus.com/archive/1/454385/100/0/threaded; http://www.securityfocus.com/bid/21595
CVE: CVE-2006-6570
Published: 2006-12-15
Description: Unrestricted file upload vulnerability in upload.php in GenesisTrader 1.0 allows remote authenticated users to upload arbitrary files via unspecified vectors, possibly involving form.php and the ajoutfich "foap" action.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2035; http://www.securityfocus.com/archive/1/454385/100/0/threaded; http://www.securityfocus.com/bid/21595
CVE: CVE-2006-6571
Published: 2006-12-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in form.php in GenesisTrader 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cuve, (2) chem, (3) do, and possibly other parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2035; http://www.securityfocus.com/archive/1/454385/100/0/threaded; http://www.securityfocus.com/bid/21595
CVE: CVE-2006-6572
Published: 2006-12-15
Description: Unspecified vulnerability in Citrix Advanced Access Control (AAC) Option 4.0, and Access Gateway 4.2 with Advanced Access Control 4.2, before 20061114, when the Browser-Only access feature is enabled, allows remote authenticated users to bypass access policies via a certain login method, a different issue than CVE-2006-4846.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/22909; http://securitytracker.com/id?1017227; http://support.citrix.com/article/CTX111614
CVE: CVE-2006-6573
Published: 2006-12-15
Description: Unspecified vulnerability in Citrix Access Gateway 4.5 Advanced Edition, and 4.2 with Advanced Access Control (AAC) 4.2, when deployed on the Access Gateway appliance 4.2 through 4.2.2 allows remote authenticated users to "gain access to data" and obtain sensitive information via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
References: http://secunia.com/advisories/22908; http://secunia.com/advisories/22909; http://securitytracker.com/id?1017228
CVE: CVE-2006-6574
Published: 2006-12-15
Description: Mantis before 1.1.0a2 does not implement per-item access control for Issue History (Bug History), which allows remote attackers to obtain sensitive information by reading the Change column, as demonstrated by the Change column of a custom field.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.mantisbugtracker.com/view.php?id=3375; http://bugs.mantisbugtracker.com/view.php?id=7364; http://mantisbt.cvs.sourceforge.net/mantisbt/mantisbt/core/history_api.php?r1=1.34&r2=1.35
CVE: CVE-2006-6575
Published: 2006-12-15
Description: PHP remote file inclusion vulnerability in ldap.php in Brian Drawert Yet Another PHP LDAP Admin Project (yaplap) 0.6 and 0.6.1 allows remote attackers to execute arbitrary PHP code via a URL in the LOGIN_style parameter.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/30887; https://www.exploit-db.com/exploits/2930; https://exchange.xforce.ibmcloud.com/vulnerabilities/30887
CVE: CVE-2006-6576
Published: 2006-12-15
Description: Heap-based buffer overflow in Golden FTP Server (goldenftpd) 1.92 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long PASS command. NOTE: it was later reported that 4.70 is also affected.  NOTE: the USER vector is already covered by CVE-2005-0634.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/161711/Golden-FTP-Server-4.70-Buffer-Overflow.html; http://retrogod.altervista.org/golden_heap.html; http://secunia.com/advisories/23323
CVE: CVE-2006-6577
Published: 2006-12-15
Description: SQL injection vulnerability in polls.php in Neocrome Land Down Under (LDU) 8.x and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2037; http://www.securityfocus.com/archive/1/453134/100/200/threaded; http://www.securityfocus.com/bid/21366
CVE: CVE-2006-6578
Published: 2006-12-15
Description: Microsoft Internet Information Services (IIS) 5.1 permits the IUSR_Machine account to execute non-EXE files such as .COM files, which allows attackers to execute arbitrary commands via arguments to any .COM file that executes those arguments, as demonstrated using win.com when it is in a web directory with certain permissions.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2036; http://www.securityfocus.com/archive/1/454268/100/0/threaded; http://securityreason.com/securityalert/2036
CVE: CVE-2006-6579
Published: 2006-12-15
Description: Microsoft Windows XP has weak permissions (FILE_WRITE_DATA and FILE_READ_DATA for Everyone) for %WINDIR%\pchealth\ERRORREP\QHEADLES, which allows local users to write and read files in this folder, as demonstrated by an ASP shell that has write access by IWAM_machine and read access by IUSR_Machine.
CVSS Score: 4.4 (MEDIUM)
References: http://www.securityfocus.com/archive/1/454268/100/0/threaded; http://www.securityfocus.com/archive/1/454268/100/0/threaded
CVE: CVE-2006-6580
Published: 2006-12-15
Description: admin/change.php in ProNews 1.5 does not check whether a user is permitted to change news items, which allows remote attackers to add or delete information within an item, and possibly have other impacts. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/23315; http://www.securityfocus.com/bid/21559; http://secunia.com/advisories/23315
CVE: CVE-2006-6581
Published: 2006-12-15
Description: PHP remote file inclusion vulnerability in tests/debug_test.php in Vernet Loic PHP_Debug 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the debugClassLocation parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3015&w=2; http://securitytracker.com/id?1017219; http://www.securityfocus.com/bid/21047
CVE: CVE-2006-6582
Published: 2006-12-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in ScriptMate User Manager 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) members_username (user) and (2) members_password (password) fields in a login action in members/default.asp, and (3) the Search box.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23372; http://securitytracker.com/id?1017384; http://www.hackerscenter.com/archive/view.asp?id=26656
CVE: CVE-2006-6583
Published: 2006-12-15
Description: ScriptMate User Manager 2.1 and earlier allow remote attackers to obtain sensitive information via unspecified vectors related to (1) the Logins box and (2) the Search box.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1017384; http://www.hackerscenter.com/archive/view.asp?id=26656; http://securitytracker.com/id?1017384
CVE: CVE-2006-6584
Published: 2006-12-15
Description: Multiple buffer overflows in italkplus (Italk+) before 0.92.1 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://italk.sourceforge.net/italk-sa-1.txt; http://secunia.com/advisories/23374; http://www.vupen.com/english/advisories/2006/5014
CVE: CVE-2006-6585
Published: 2006-12-15
Description: The Extensions manager in Mozilla Firefox 2.0 does not properly populate the list of local extensions, which allows attackers to construct an extension that hides itself by finding its name in the list and then calling RemoveElement, as demonstrated by the FFsniFF extension.  NOTE: it was later reported that 3.0 is also affected.
CVSS Score: 6.4 (MEDIUM)
References: http://azurit.elbiahosting.sk/ffsniff/ffsniff-0.2.tar.gz; http://securityreason.com/securityalert/2046; http://www.securityfocus.com/archive/1/454058/100/0/threaded
CVE: CVE-2006-6586
Published: 2006-12-15
Description: Multiple PHP remote file inclusion vulnerabilities in Vortex Blog (vBlog, aka C12) a0.1_nonfunc allow remote attackers to execute arbitrary PHP code via a URL in the cfgProgDir parameter in (1) secure.php or (2) checklogin.php in admin/auth/.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1017204; https://exchange.xforce.ibmcloud.com/vulnerabilities/30094; https://www.exploit-db.com/exploits/2740
CVE: CVE-2006-6587
Published: 2006-12-15
Description: Cross-site scripting (XSS) vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) allows remote attackers to inject arbitrary web script or HTML by posting a message.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-12/0177.html; http://securitytracker.com/id?1017360; http://www.securityfocus.com/bid/21529
CVE: CVE-2006-6588
Published: 2006-12-15
Description: The forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) trusts the (1) dataResourceTypeId, (2) contentTypeId, and certain other hidden form fields, which allows remote attackers to create unauthorized types of content, modify content, or have other unknown impact.
CVSS Score: 7.5 (HIGH)
References: https://issues.apache.org/jira/browse/OFBIZ-178; https://issues.apache.org/jira/browse/OFBIZ-178