deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3702
Published: 2006-07-21
Description: Multiple unspecified vulnerabilities in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB06 in Export; (2) DB08, (3) DB09, (4) DB10, (5) DB11, (6) DB12, (7) DB13, (8) DB14, and (9) DBC01 for OCI; (10) DB16 for Query Rewrite/Summary Mgmt; (11) DB17, (12) DB18, (13) DB19, (14) DBC02, (15) DBC03, and (16) DBC04 for RPC; and (17) DB20 for Semantic Analysis.  NOTE: as of 20060719, Oracle has not disputed third party claims that DB06 is related to "SQL injection" using DBMS_EXPORT_EXTENSION with a modified ODCIIndexGetMetadata routine and a call to GET_DOMAIN_INDEX_METADATA, in which case DB06 might be CVE-2006-2081.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3703
Published: 2006-07-21
Description: Unspecified vulnerability in InterMedia for Oracle Database 9.0.1.5, 9.2.0.6, and 10.1.0.4 has unknown impact and attack vectors, aka oracle Vuln# DB07.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3704
Published: 2006-07-21
Description: Unspecified vulnerability in the Oracle ODBC Driver for Oracle Database 10.1.0.4 has unknown impact and attack vectors, aka Oracle Vuln# 10.1.0.4.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3705
Published: 2006-07-21
Description: Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB21 for Statistics and (2) DB22 for Upgrade & Downgrade.  NOTE: as of 20060719, Oracle has not disputed a claim by a reliable researcher that DB21 is for a local SQL injection vulnerability in SYS.DBMS_STATS, and that DB22 is for SQL injection in SYS.DBMS_UPGRADE.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047992.html; http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047993.html; http://secunia.com/advisories/21111
CVE: CVE-2006-3706
Published: 2006-07-21
Description: Unspecified vulnerability in OC4J for Oracle Application Server 9.0.2.3 has unknown impact and attack vectors, aka Oracle Vuln# AS01.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3707
Published: 2006-07-21
Description: Unspecified vulnerability in OC4J for Oracle Application Server 9.0.2.3 and 9.0.3.1 has unknown impact and attack vectors, aka Oracle Vuln# AS02.
CVSS Score: 3.6 (LOW)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3708
Published: 2006-07-21
Description: Unspecified vulnerability in OC4J for Oracle Application Server 9.0.2.3, 9.0.3.1, 9.0.4.2, 10.1.2.0.2, and 10.1.2.1 has unknown impact and attack vectors, aka Oracle Vuln# AS03.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3709
Published: 2006-07-21
Description: Unspecified vulnerability in OC4J for Oracle Application Server 9.0.2.3, 9.0.3.1, and 10.1.2.0.0 has unknown impact and attack vectors, aka Oracle Vuln# AS04.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3710
Published: 2006-07-21
Description: Unspecified vulnerability in OC4J for Oracle Application Server 9.0.2.3, 9.0.3.1, 9.0.4.2, and 10.1.2.0.0 has unknown impact and attack vectors, aka Oracle Vuln# (1) AS05 and (2) AS08.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3711
Published: 2006-07-21
Description: Unspecified vulnerability in OC4J for Oracle Application Server 9.0.2.3, 9.0.3.1, and 9.0.4.1 has unknown impact and attack vectors, aka Oracle Vuln# AS06.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3712
Published: 2006-07-21
Description: Unspecified vulnerability in OC4J for Oracle Application Server 9.0.4.2 and 10.1.2.0.0 has unknown impact and attack vectors, aka Oracle Vuln# AS07.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3713
Published: 2006-07-21
Description: Unspecified vulnerability in OC4J for Oracle Application Server 10.1.3.0 has unknown impact and attack vectors, aka Oracle Vuln# AS09.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3714
Published: 2006-07-21
Description: Unspecified vulnerability in OC4J for Oracle Application Server 10.1.2.0.2 and 10.1.2.1 has unknown impact and attack vectors, aka Oracle Vuln# AS10.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3715
Published: 2006-07-21
Description: Unspecified vulnerability in Calendar for Oracle Collaboration Suite 10.1.2 has unknown impact and attack vectors, aka Oracle Vuln# OCS01.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3716
Published: 2006-07-21
Description: Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10CU2 have unknown impact and attack vectors, aka Oracle Vuln# (1) APPS01 for Internet Expenses; (2) APPS02, (3) APPS05, (4) APPS06, (5) APPS07, (6) APPS08, (7) APPS09, and (8) APPS10 for Oracle Application Object Library; (9) APPS11, (10) APPS12, and (11) APPS13 for Oracle Applications Technology Stack; (12) APPS14 for Oracle Call Center Technology; (13) APPS15 for Oracle Common Applications; (14) APPS18 for Oracle Self-Service Web Applications; and (15) APPS19 for Oracle Workflow Cartridge.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3717
Published: 2006-07-21
Description: Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.9 have unknown impact and attack vectors, aka Oracle Vuln# (1) APPS03 and (2) APPS04 for Oracle Application Object Library; and (3) APPS20 for Oracle XML Gateway.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3718
Published: 2006-07-21
Description: Multiple unspecified vulnerabilities in Oracle Exchange for Oracle E-Business Suite and Applications 6.2.4 have unknown impact and attack vectors, aka Oracle Vuln# (1) APPS16 and (2) APPS17.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3719
Published: 2006-07-21
Description: Unspecified vulnerability in CORE: Repository for Oracle Enterprise Manager 9.0.1.0 and 9.2.0.1 has unknown impact and attack vectors, aka Oracle Vuln# EM01.
CVSS Score: 5.5 (MEDIUM)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3720
Published: 2006-07-21
Description: Unspecified vulnerability in Enterprise Config Management for Oracle Enterprise Manager 10.1.0.3 has unknown impact and attack vectors, aka Oracle Vuln# EM02.
CVSS Score: 5.5 (MEDIUM)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3721
Published: 2006-07-21
Description: Multiple unspecified vulnerabilities in Oracle Management Service for Oracle Enterprise Manager 10.1.0.5 and 10.2.0.1 have unknown impact and attack vectors, aka Oracle Vuln# EM03 and EM04.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3722
Published: 2006-07-21
Description: Unspecified vulnerability in PeopleSoft Enterprise Portal for Oracle PeopleSoft Enterprise Portal 8.4 Bundle #16, 8.8 Bundle #10, and 8.9 Bundle #3 has unknown impact and attack vectors, aka Oracle Vuln# PSE01.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3723
Published: 2006-07-21
Description: Unspecified vulnerability in PeopleSoft Enterprise Portal for Oracle PeopleSoft Enterprise Portal 8.8 with Enforcer Portal Pack Bundle #10 and 8.9 Bundle #3 has unknown impact and attack vectors, aka Oracle Vuln# PSE02.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3724
Published: 2006-07-21
Description: Unspecified vulnerability in JD Edwards HTML Server for Oracle OneWorld Tools EnterpriseOne Tools 8.95 and 8.96 has unknown impact and attack vectors, aka Oracle Vuln# JDE01.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3725
Published: 2006-07-21
Description: Norton Personal Firewall 2006 9.1.0.33 allows local users to cause a denial of service (crash) via certain RegSaveKey, RegRestoreKey and RegDeleteKey operations on the (1) HKLM\SYSTEM\CurrentControlSet\Services\SNDSrvc and (2) HKLM\SYSTEM\CurrentControlSet\Services\SymEvent registry keys.
CVSS Score: 2.1 (LOW)
References: http://securityreason.com/securityalert/1241; http://www.matousec.com/info/advisories/Norton-Insufficient-protection-of-Norton-service-registry-keys.php; http://www.securityfocus.com/archive/1/440110/100/0/threaded
CVE: CVE-2006-3726
Published: 2006-07-21
Description: Buffer overflow in FileCOPA FTP Server before 1.01 released on 18th July 2006, allows remote authenticated attackers to execute arbitrary code via a long argument to the LIST command.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/21108; http://www.appsec.ch/docs/2006-07-19-fileCopa.txt; http://www.osvdb.org/27389
CVE: CVE-2006-3727
Published: 2006-07-21
Description: Multiple SQL injection vulnerabilities in Eskolar CMS 0.9.0.0 allow remote attackers to execute arbitrary SQL commands via the (1) gr_1_id, (2) gr_2_id, (3) gr_3_id, and (4) doc_id parameters in (a) index.php; the (5) uid and (6) pwd parameters in (b) php/esa.php; and possibly other vectors related to files in php/lib/ including (c) del.php, (d) download_backup.php, (e) navig.php, (f) restore.php, (g) set_12.php, (h) set_14.php, and (i) upd_doc.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21101; http://www.osvdb.org/27391; http://www.osvdb.org/27392
CVE: CVE-2006-3728
Published: 2006-07-21
Description: Unspecified vulnerability in the kernel in Solaris 10 with patch 118822-29 (118844-29 on x86) and without patch 118833-11 (118855-08) allows remote authenticated users to cause a denial of service via unspecified vectors that lead to "kernel data structure corruption" that can trigger a system panic, application failure, or "data corruption."
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/21109; http://securitytracker.com/id?1016535; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102344-1
CVE: CVE-2006-3729
Published: 2006-07-21
Description: DataSourceControl in Internet Explorer 6 on Windows XP SP2 with Office installed allows remote attackers to cause a denial of service (crash) via a large negative integer argument to the getDataMemberName method of a OWC11.DataSourceControl.11 object, which leads to an integer overflow and a null dereference.
CVSS Score: 2.6 (LOW)
References: http://browserfun.blogspot.com/2006/07/mobb-19-datasourcecontrol.html; http://www.osvdb.org/27111; http://www.securityfocus.com/bid/19069
CVE: CVE-2006-3730
Published: 2006-07-21
Description: Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a 0x7fffffff argument to the setSlice method on a WebViewFolderIcon ActiveX object, which leads to an invalid memory copy.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: http://browserfun.blogspot.com/2006/07/mobb-18-webviewfoldericon-setslice.html; http://isc.sans.org/diary.php?storyid=1742; http://riosec.com/msie-setslice-vuln
CVE: CVE-2006-3731
Published: 2006-07-21
Description: Mozilla Firefox 1.5.0.4 and earlier allows remote user-assisted attackers to cause a denial of service (crash) via a form with a multipart/form-data encoding and a user-uploaded file.  NOTE: a third party has claimed that this issue might be related to the LiveHTTPHeaders extension.
CVSS Score: 2.6 (LOW)
References: http://www.securityfocus.com/archive/1/440119/100/100/threaded; http://www.securityfocus.com/archive/1/440506/100/0/threaded; http://www.securityfocus.com/archive/1/440119/100/100/threaded
CVE: CVE-2006-3732
Published: 2006-07-21
Description: Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.1 ships with an Oracle database that contains several default accounts and passwords, which allows attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21118; http://securitytracker.com/id?1016537; http://www.cisco.com/warp/public/707/cisco-sa-20060719-mars.shtml
CVE: CVE-2006-3733
Published: 2006-07-21
Description: jmx-console/HtmlAdaptor in the jmx-console in the JBoss web application server, as shipped with Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.1, allows remote attackers to gain privileges as the CS-MARS administrator and execute arbitrary Java code via an invokeOp action in the BSHDeployer jboss.scripts service name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0424.html; http://secunia.com/advisories/21118; http://securitytracker.com/id?1016537
CVE: CVE-2006-3734
Published: 2006-07-21
Description: Multiple unspecified vulnerabilities in the Command Line Interface (CLI) for Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.1, allow local CS-MARS administrators to execute arbitrary commands as root.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/21118; http://securitytracker.com/id?1016537; http://www.cisco.com/warp/public/707/cisco-sa-20060719-mars.shtml
CVE: CVE-2006-3735
Published: 2006-07-21
Description: Multiple PHP remote file inclusion vulnerabilities in Mail2Forum (module for phpBB) 1.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the m2f_root_path parameter to (1) m2f/m2f_phpbb204.php, (2) m2f/m2f_forum.php, (3) m2f/m2f_mailinglist.php or (4) m2f/m2f_cron.php.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21083; http://www.osvdb.org/27354; http://www.osvdb.org/27355
CVE: CVE-2006-3736
Published: 2006-07-21
Description: PHP remote file inclusion vulnerability in core/videodb.class.xml.php in the VideoDB component for Mambo 0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21082; http://www.securityfocus.com/bid/19049; http://www.vupen.com/english/advisories/2006/2845
CVE: CVE-2006-3737
Published: 2006-07-21
Description: Cross-site scripting (XSS) vulnerability in filemanager/filemanager.php in the control panel in SWsoft Plesk 8.0 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the file parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1250; http://www.osvdb.org/28596; http://www.securityfocus.com/archive/1/440292/100/0/threaded
CVE: CVE-2006-3748
Published: 2006-07-21
Description: PHP remote file inclusion vulnerability in includes/abbc/abbc.class.php in the LoudMouth Component for Mambo 4.0j, and possibly other versions including 4.1, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/21077; http://www.securityfocus.com/bid/19044; http://www.vupen.com/english/advisories/2006/2844
CVE: CVE-2006-3749
Published: 2006-07-21
Description: PHP remote file inclusion vulnerability in sitemap.xml.php in Sitemap component (com_sitemap) 2.0.0 for Mambo 4.5.1 CMS, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://advisories.echo.or.id/adv/adv38-matdhule-2006.txt; http://archives.neohapsis.com/archives/bugtraq/2006-07/0180.html; http://secunia.com/advisories/21055
CVE: CVE-2006-3750
Published: 2006-07-21
Description: PHP remote file inclusion vulnerability in server.php in the Hashcash Component (com_hashcash) 1.2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://advisories.echo.or.id/adv/adv38-matdhule-2006.txt; http://archives.neohapsis.com/archives/bugtraq/2006-07/0180.html; http://secunia.com/advisories/21053
CVE: CVE-2006-3751
Published: 2006-07-21
Description: PHP remote file inclusion vulnerability in popups/ImageManager/config.inc.php in the HTMLArea3 Addon Component (com_htmlarea3_xtd-c) for ImageManager 1.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://advisories.echo.or.id/adv/adv38-matdhule-2006.txt; http://archives.neohapsis.com/archives/bugtraq/2006-07/0180.html; http://securityreason.com/securityalert/1249
CVE: CVE-2006-3752
Published: 2006-07-21
Description: Multiple SQL injection vulnerabilities in class.php in Professional Home Page Tools Guestbook allow remote attackers to execute arbitrary SQL commands via the (1) hidemail, (2) name, (3) mail, (4) ip, or (5) text parameters.
CVSS Score: 7.5 (HIGH)
References: http://artemis.abenteuer-mittelerde.de/pub/adv02-phptgb.txt; http://secunia.com/advisories/21102; http://securityreason.com/securityalert/1248
CVE: CVE-2006-3753
Published: 2006-07-21
Description: setcookie.php for the administration login in Professional Home Page Tools Guestbook records the hash of the administrator password in a cookie, which allows attackers to conduct brute force password guessing attacks after obtaining the hash.
CVSS Score: 6.4 (MEDIUM)
References: http://artemis.abenteuer-mittelerde.de/pub/adv02-phptgb.txt; http://secunia.com/advisories/21102; http://securitytracker.com/id?1016550
CVE: CVE-2006-3754
Published: 2006-07-21
Description: PHP remote file inclusion vulnerability in Include/editor/rich_files/class.rich.php in FlushCMS 1.0.0-pre2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the class_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21090; http://www.securityfocus.com/bid/19023; http://www.vupen.com/english/advisories/2006/2822
CVE: CVE-2006-3755
Published: 2006-07-21
Description: PHP remote file inclusion vulnerability in Include/editor/class.rich.php in FlushCMS 1.0.0-pre2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the class_path parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21090; http://www.vupen.com/english/advisories/2006/2822; https://exchange.xforce.ibmcloud.com/vulnerabilities/27751
CVE: CVE-2006-3756
Published: 2006-07-21
Description: Cross-site scripting (XSS) vulnerability in Geeklog 1.4.0sr4 and earlier, and 1.3.11sr6 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when validating comments in (1) lib-comment.php (1.4.0sr4) or (2) comment.php (0.3.11sr6).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/21094; http://www.geeklog.net/article.php/geeklog-1.4.0sr5
CVE: CVE-2006-3757
Published: 2006-07-21
Description: index.php in Zen Cart 1.3.0.2 allows remote attackers to obtain sensitive information via empty (1) _GET[], (2) _SESSION[], (3) _POST[], (4) _COOKIE[], or (5) _SESSION[] array parameters, which reveals the installation path in an error message.  NOTE: this issue might be resultant from a global overwrite vulnerability.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1253; http://www.securityfocus.com/archive/1/438805/100/200/threaded; http://securityreason.com/securityalert/1253
CVE: CVE-2006-3758
Published: 2006-07-21
Description: inc/init.php in Archive Mode (Light) in MyBB (aka MyBulletinBoard) 1.1.4 calls the extract function with EXTR_OVERWRITE on HTTP POST and GET variables, which allows remote attackers to overwrite arbitrary variables, as demonstrated via an SQL injection using the _SERVER[HTTP_CLIENT_IP] parameter in archive/index.php.
CVSS Score: 7.5 (HIGH)
References: http://community.mybboard.net/showthread.php?tid=10115; http://myimei.com/security/2006-06-24/mybb104archive-modelight-parameter-extractionvarable-overwriting.html; http://secunia.com/advisories/20873
CVE: CVE-2006-3759
Published: 2006-07-21
Description: Unspecified vulnerability in MyBB (aka MyBulletinBoard) 1.1.4, related has unspecified impact and attack vectors related to "user group manipulation."
CVSS Score: 5.0 (MEDIUM)
References: http://community.mybboard.net/showthread.php?tid=10115; http://secunia.com/advisories/20873; http://www.mybboard.com/archive.php?nid=15
CVE: CVE-2006-3760
Published: 2006-07-21
Description: Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) 1.1.4 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://community.mybboard.net/showthread.php?tid=10115; http://secunia.com/advisories/20873; http://www.mybboard.com/archive.php?nid=15
CVE: CVE-2006-3761
Published: 2006-07-21
Description: Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.0 RC2 through 1.1.4 allows remote attackers to inject arbitrary web script or HTML via a javascript URI with an SGML numeric character reference in the url BBCode tag, as demonstrated using "java&#115;cript".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://community.mybboard.net/showthread.php?tid=10115; http://myimei.com/security/2006-06-22/mybb-114-function_postphpxss-attack-in-url-tag.html; http://secunia.com/advisories/20873
CVE: CVE-2006-3762
Published: 2006-07-21
Description: The Touch Control ActiveX control 2.0.0.55 allows remote attackers to read and possibly execute arbitrary files via a "file///" URI in the sPath parameter to the Execute function.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/439154/100/100/threaded; http://www.securityfocus.com/archive/1/439154/100/100/threaded
CVE: CVE-2006-3763
Published: 2006-07-21
Description: SQL injection vulnerability in category.php in Diesel Joke Site allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0497.html; http://secunia.com/advisories/20263; http://securityreason.com/securityalert/1270