deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-4368
Published: 2006-08-26
Description: PHP remote file inclusion vulnerability in includes/functions_portal.php in IntegraMOD Portal 2.x and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8714&w=2; http://www.nukedx.com/?viewdoc=47; http://www.securityfocus.com/archive/1/444207/100/0/threaded
CVE: CVE-2006-4369
Published: 2006-08-26
Description: Absolute path traversal vulnerability in includes/functions_portal.php in IntegraMOD Portal 2.x and earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via an absolute pathname in the phpbb_root_path parameter.
CVSS Score: 2.6 (LOW)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8714&w=2; http://www.nukedx.com/?viewdoc=47; http://www.securityfocus.com/archive/1/444207/100/0/threaded
CVE: CVE-2006-4370
Published: 2006-08-26
Description: Alt-N WebAdmin 3.2.3 and 3.2.4 running with MDaemon 9.0.5, and possibly earlier, allow remote authenticated domain administrators to change a global administrator's password and gain privileges via the userlist.wdm file.
CVSS Score: 7.5 (HIGH)
References: http://files.altn.com/WebAdmin/Release/RelNotes_en.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048959.html; http://secunia.com/advisories/21558
CVE: CVE-2006-4371
Published: 2006-08-26
Description: Multiple directory traversal vulnerabilities in Alt-N WebAdmin 3.2.3 and 3.2.4 running with MDaemon 9.0.5, and possibly earlier, allow remote authenticated global administrators to read arbitrary files via a .. (dot dot) in the file parameter to (1) logfile_view.wdm and (2) configfile_view.wdm.
CVSS Score: 4.0 (MEDIUM)
References: http://files.altn.com/WebAdmin/Release/RelNotes_en.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048959.html; http://secunia.com/advisories/21558
CVE: CVE-2006-4372
Published: 2006-08-26
Description: PHP remote file inclusion vulnerability in admin.lurm_constructor.php in the Lurm Constructor component (com_lurm_constructor) 0.6b and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the lm_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/28475; https://www.exploit-db.com/exploits/2222; https://exchange.xforce.ibmcloud.com/vulnerabilities/28475
CVE: CVE-2006-4373
Published: 2006-08-26
Description: PHP remote file inclusion vulnerability in modules/visitors2/include/config.inc.php in pSlash 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the lvc_include_dir parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1449; http://securitytracker.com/id?1016752; http://www.attrition.org/pipermail/vim/2006-August/000993.html
CVE: CVE-2006-4374
Published: 2006-08-26
Description: IrfanView 3.98 (with plugins) allows user-assisted attackers to cause a denial of service (application crash) via a crafted ANI image file, possibly due to a buffer overflow.
CVSS Score: 2.6 (LOW)
References: http://securityreason.com/securityalert/1457; http://www.securityfocus.com/archive/1/442876/100/200/threaded; http://www.securityfocus.com/bid/19452
CVE: CVE-2006-4375
Published: 2006-08-26
Description: PHP remote file inclusion vulnerability in contxtd.class.php in the Contacts XTD (ContXTD) component for Mambo (com_contxtd) allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.  NOTE: another researcher has disputed this issue, saying that the software prevents the attack by checking whether _VALID_MOS is defined
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1451; http://www.osvdb.org/28091; http://www.securityfocus.com/archive/1/443892/100/0/threaded
CVE: CVE-2006-4376
Published: 2006-08-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Guder und Koch Netzwerktechnik Eichhorn Portal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly including the (1) profil_nr and (2) sprache parameters in the main portion of the portal, the (3) suchstring field in suchForm in the main portion of the portal, the (4) GaleryKey and (5) Breadcrumbs parameters in the gallerie module, and the (6) GGBNSaction parameter in the ggbns module.
CVSS Score: 5.1 (MEDIUM)
References: http://securityreason.com/securityalert/1458; http://www.securityfocus.com/archive/1/444065/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/28533
CVE: CVE-2006-4377
Published: 2006-08-26
Description: Multiple SQL injection vulnerabilities in Guder und Koch Netzwerktechnik Eichhorn Portal allow remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly including the (1) profil_nr and (2) sprache parameters in the main portion of the portal, the (3) suchstring field in suchForm in the main portion of the portal, the (4) GaleryKey and (5) Breadcrumbs parameters in the gallerie module, and the (6) GGBNSaction parameter in the ggbns module.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1458; http://www.securityfocus.com/archive/1/444065/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/28535
CVE: CVE-2006-4378
Published: 2006-08-26
Description: Multiple PHP remote file inclusion vulnerabilities in the Rssxt component for Joomla! (com_rssxt), possibly 2.0 Beta 1 or 1.0 and earlier, allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter in (1) pinger.php, (2) RPC.php, or (3) rssxt.php.  NOTE: another researcher has disputed this issue, saying that the attacker can not control this parameter.  In addition, as of 20060825, the original researcher has appeared to be unreliable with some other past reports.  CVE has not performed any followup analysis with respect to this issue
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1456; http://www.osvdb.org/28096; http://www.securityfocus.com/archive/1/443628/100/100/threaded
CVE: CVE-2006-4354
Published: 2006-08-27
Description: PHP remote file inclusion vulnerability in e/class/CheckLevel.php in Phome Empire CMS 3.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the check_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21584; http://www.osvdb.org/28116; http://www.securityfocus.com/bid/19655
CVE: CVE-2006-4355
Published: 2006-08-27
Description: Cross-site scripting (XSS) vulnerability in Drupal Easylinks Module (easylinks.module) 4.7 before 1.5.2.1 2006/08/19 12:02:27 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.6 (LOW)
References: http://drupal.org/node/80087; http://secunia.com/advisories/21603; http://www.securityfocus.com/bid/19670
CVE: CVE-2006-4356
Published: 2006-08-27
Description: SQL injection vulnerability in Drupal Easylinks Module (easylinks.module) 4.7 before 1.5.2.1 2006/08/19 12:02:27 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://drupal.org/node/80087; http://secunia.com/advisories/21603; http://www.securityfocus.com/bid/19673
CVE: CVE-2006-4357
Published: 2006-08-27
Description: PHP remote file inclusion vulnerability in clients/index.php in Diesel Smart Traffic allows remote attackers to execute arbitrary PHP code via a URL in the src parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1454; http://www.securityfocus.com/archive/1/443930/100/0/threaded; http://www.securityfocus.com/bid/19630
CVE: CVE-2006-4358
Published: 2006-08-27
Description: Cross-site scripting (XSS) vulnerability in index.php in Diesel Pay allows remote attackers to inject arbitrary web script or HTML via the read parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-08/0416.html; http://secunia.com/advisories/21588; http://securityreason.com/securityalert/1459
CVE: CVE-2006-4359
Published: 2006-08-27
Description: Stack-based buffer overflow in Trident Software PowerZip 7.06 Build 3895 on Windows 2000 allows remote attackers to execute arbitrary code via a ZIP archive containing a long filename.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21556; http://vuln.sg/powerzip706-en.html; http://www.securityfocus.com/bid/19671
CVE: CVE-2006-4360
Published: 2006-08-27
Description: Cross-site scripting (XSS) vulnerability in E-commerce 4.7 for Drupal before file.module 1.37.2.4 (20060812) allows remote authenticated users with the "create products" permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
References: http://drupal.org/node/80084; http://secunia.com/advisories/21604; http://www.securityfocus.com/bid/19675
CVE: CVE-2006-4361
Published: 2006-08-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in jobseekers/forgot.php in Diesel Job Site allow remote attackers to inject arbitrary web script or HTML via the (1) uname or (2) SEmail parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21589; http://securityreason.com/securityalert/1453; http://www.osvdb.org/28073
CVE: CVE-2006-4362
Published: 2006-08-27
Description: Cross-site scripting (XSS) vulnerability in getad.php in Diesel Paid Mail allows remote attackers to inject arbitrary web script or HTML via the ps parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21568; http://securityreason.com/securityalert/1452; http://www.osvdb.org/28072
CVE: CVE-2006-4363
Published: 2006-08-27
Description: PHP remote file inclusion vulnerability in admin.cropcanvas.php in the CropImage component (com_cropimage) 1.0 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the cropimagedir parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1450; http://www.securityfocus.com/archive/1/443762/100/0/threaded; http://www.securityfocus.com/bid/19605
CVE: CVE-2006-4364
Published: 2006-08-27
Description: Multiple heap-based buffer overflows in the POP3 server in Alt-N Technologies MDaemon before 9.0.6 allow remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via long strings that contain '@' characters in the (1) USER and (2) APOP commands.
CVSS Score: 5.0 (MEDIUM)
References: http://files.altn.com/MDaemon/Release/RelNotes_en.txt; http://secunia.com/advisories/21595; http://securityreason.com/securityalert/1446
CVE: CVE-2006-4380
Published: 2006-08-28
Description: MySQL before 4.1.13 allows local users to cause a denial of service (persistent replication slave crash) via a query with multiupdate and subselects.
CVSS Score: 2.1 (LOW)
References: http://bugs.mysql.com/10442; http://lists.mysql.com/internals/26123; http://secunia.com/advisories/21712
CVE: CVE-2006-4416
Published: 2006-08-28
Description: Untrusted search path vulnerability in the mkvg command in IBM AIX 5.2 and 5.3 allows local users to gain privileges by modifying the path to point to a malicious (1) chdev, (2) mkboot, (3) varyonvg, or (4) varyoffvg program.
CVSS Score: 7.2 (HIGH)
References: ftp://aix.software.ibm.com/aix/efixes/security/README; http://secunia.com/advisories/21620; http://secunia.com/advisories/22106
CVE: CVE-2006-4417
Published: 2006-08-28
Description: SQL injection vulnerability in edituser.php in Xoops before 2.0.15 allows remote attackers to execute arbitrary SQL commands via the user_avatar parameter.
CVSS Score: 7.5 (HIGH)
References: http://devteam.xoops.org/releases/changelog-2.0.15.html; http://secunia.com/advisories/21643; http://securityreason.com/securityalert/1461
CVE: CVE-2006-4418
Published: 2006-08-28
Description: Directory traversal vulnerability in index.php for Wikepage 2006.2a Opus 10 allows remote attackers to include arbitrary local files via the lng parameter, as demonstrated by inserting PHP code into a log file.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/21542; http://www.osvdb.org/28177; http://www.securityfocus.com/bid/19694
CVE: CVE-2006-4419
Published: 2006-08-28
Description: SQL injection vulnerability in note.php in ProManager 0.73 allows remote attackers to execute arbitrary SQL commands via the note_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19728; https://exchange.xforce.ibmcloud.com/vulnerabilities/28592; https://www.exploit-db.com/exploits/2259
CVE: CVE-2006-4420
Published: 2006-08-28
Description: Directory traversal vulnerability in include_lang.php in Phaos 0.9.2 allows remote attackers to include arbitrary local files via ".." sequences in the lang parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/19710; https://exchange.xforce.ibmcloud.com/vulnerabilities/28565; https://www.exploit-db.com/exploits/2253
CVE: CVE-2006-4421
Published: 2006-08-29
Description: Cross-site scripting (XSS) vulnerability in template/default/thanks_comment.php in Yet Another PHP Image Gallery (YaPIG) 0.95b allows remote attackers to inject arbitrary web script or HTML via the D_REFRESH_URL parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1463; http://www.armorize.com/advisory.php?Keyword=Armorize-ADV-2006-0001; http://www.securityfocus.com/archive/1/444328/100/0/threaded
CVE: CVE-2006-4422
Published: 2006-08-29
Description: PHP remote file inclusion vulnerability in includes/phpdig/libs/search_function.php in Jetbox CMS 2.1 allows remote attackers to execute arbitrary PHP code via a URL in the relative_script_path parameter, a different vector than CVE-2006-2270. NOTE: this issue has been disputed, and as of 20060830, CVE analysis concurs with the dispute.  In addition, it is likely that the vulnerability is actually in a third party module, phpDig 1.8.8
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1016765; http://www.attrition.org/pipermail/vim/2006-August/000997.html; http://www.attrition.org/pipermail/vim/2006-August/001003.html
CVE: CVE-2006-4423
Published: 2006-08-29
Description: Multiple PHP remote file inclusion vulnerabilities in Bigace 1.8.2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[_BIGACE][DIR][admin] parameter in (a) system/command/admin.cmd.php, (b) admin/include/upload_form.php, and (c) admin/include/item_main.php; and the (2) GLOBALS[_BIGACE][DIR][libs] parameter in (d) system/command/admin.cmd.php and (e) system/command/download.cmd.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1462; http://securitytracker.com/id?1016760; http://www.securityfocus.com/archive/1/444415/100/0/threaded
CVE: CVE-2006-4424
Published: 2006-08-29
Description: PHP remote file inclusion vulnerability in coin_includes/constants.php in phpCOIN 1.2.3 allows remote attackers to execute arbitrary PHP code via the _CCFG[_PKG_PATH_INCL] parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21624; http://www.osvdb.org/28218; http://www.securityfocus.com/bid/19706
CVE: CVE-2006-4425
Published: 2006-08-29
Description: Multiple PHP remote file inclusion vulnerabilities in phpCOIN 1.2.3 allow remote attackers to execute arbitrary PHP code via the _CCFG[_PKG_PATH_INCL] parameter in coin_includes scripts including (1) api.php, (2) common.php, (3) core.php, (4) custom.php, (5) db.php, (6) redirect.php or (7) session_set.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21624; http://www.osvdb.org/28219; http://www.osvdb.org/28220
CVE: CVE-2006-4426
Published: 2006-08-29
Description: PHP remote file inclusion vulnerability in AES/modules/auth/phpsecurityadmin/include/logout.php in AlberT-EasySite (AES) 1.0a5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PSA_PATH parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21651; http://www.securityfocus.com/archive/1/448292/100/0/threaded; http://www.securityfocus.com/bid/19729
CVE: CVE-2006-4427
Published: 2006-08-29
Description: index.php in eFiction before 2.0.7 allows remote attackers to bypass authentication and gain privileges by setting the (1) adminloggedin, (2) loggedin, and (3) level parameters to "1".
CVSS Score: 5.1 (MEDIUM)
References: http://efiction.org/forums/index.php?topic=3698; http://secunia.com/advisories/21625; http://www.osvdb.org/28237
CVE: CVE-2006-4428
Published: 2006-08-29
Description: PHP remote file inclusion vulnerability in index.php in Jupiter CMS 1.1.5 allows remote attackers to execute arbitrary PHP code via a URL in the template parameter.  NOTE: CVE disputes this claim, since the $template variable is defined as a static value before it is referenced in an include statement
CVSS Score: 9.8 (CRITICAL)
References: http://www.attrition.org/pipermail/vim/2006-August/000996.html; http://www.osvdb.org/28298; http://www.securityfocus.com/archive/1/444421/100/0/threaded
CVE: CVE-2006-4429
Published: 2006-08-29
Description: PHP remote file inclusion vulnerability in handlers/email/mod.output.php in PHlyMail Lite 3.4.4 and earlier (Build 3.04.04) allows remote attackers to execute arbitrary PHP code via a URL in the _PM_[path][handler] parameter, a different vector than CVE-2006-4291.  NOTE: This issue has been disputed by a third party, who states that the _IN_PHM_ declaration prevents this file from being called directly
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5999&w=2; http://www.osvdb.org/29355; http://www.securityfocus.com/archive/1/444215/100/0/threaded
CVE: CVE-2006-4430
Published: 2006-08-29
Description: The Cisco Network Admission Control (NAC) 3.6.4.1 and earlier allows remote attackers to prevent installation of the Cisco Clean Access (CCA) Agent and bypass local and remote protection mechanisms by modifying (1) the HTTP User-Agent header or (2) the behavior of the TCP/IP stack.  NOTE: the vendor has disputed the severity of this issue, stating that users cannot bypass authentication mechanisms.
CVSS Score: 5.0 (MEDIUM)
References: http://archive.cert.uni-stuttgart.de/archive/bugtraq/2005/08/msg00200.html; http://www.cisco.com/en/US/products/ps6128/products_security_notice09186a00804fa82b.html; http://www.cisco.com/en/US/products/ps6128/tsd_products_security_response09186a008071d609.html
CVE: CVE-2006-4431
Published: 2006-08-29
Description: Multiple buffer overflows in the (a) Session Clustering Daemon and the (b) mod_cluster module in the Zend Platform 2.2.1 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a (1) empty or (2) crafted PHP session identifier (PHPSESSID).
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6217&w=2; http://secunia.com/advisories/21573; http://securityreason.com/securityalert/1466
CVE: CVE-2006-4432
Published: 2006-08-29
Description: Directory traversal vulnerability in Zend Platform 2.2.1 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the final component of the PHP session identifier (PHPSESSID).  NOTE: in some cases, this issue can be leveraged to perform direct static code injection.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21573; http://securityreason.com/securityalert/1466; http://www.hardened-php.net/advisory_052006.128.html
CVE: CVE-2006-4433
Published: 2006-08-29
Description: PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote attackers to exploit other vulnerabilities by inserting PHP code into the PHPSESSID, which is stored in the session file.  NOTE: it could be argued that this not a vulnerability in PHP itself, rather a design limitation that enables certain attacks against session handlers that do not account for this limitation.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21573; http://securityreason.com/securityalert/1466; http://www.hardened-php.net/advisory_052006.128.html
CVE: CVE-2006-4434
Published: 2006-08-29
Description: Use-after-free vulnerability in Sendmail before 8.13.8 allows remote attackers to cause a denial of service (crash) via a long "header line", which causes a previously freed variable to be referenced. NOTE: the original developer has disputed the severity of this issue, saying "The only denial of service that is possible here is to fill up the disk with core dumps if the OS actually generates different core dumps (which is unlikely)... the bug is in the shutdown code (finis()) which leads directly to exit(3), i.e., the process would terminate anyway, no mail delivery or receiption is affected."
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://secunia.com/advisories/21637; http://secunia.com/advisories/21641; http://secunia.com/advisories/21696
CVE: CVE-2006-4435
Published: 2006-08-29
Description: OpenBSD 3.8, 3.9, and possibly earlier versions allows context-dependent attackers to cause a denial of service (kernel panic) by allocating more semaphores than the default.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/21642; http://securitytracker.com/id?1016756; http://www.openbsd.org/errata.html#sem
CVE: CVE-2006-4436
Published: 2006-08-29
Description: isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates Security Associations (SA) with a replay window of size 0 when isakmpd acts as a responder during SA negotiation, which allows remote attackers to replay IPSec packets and bypass the replay protection.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21652; http://secunia.com/advisories/21905; http://securitytracker.com/id?1016757
CVE: CVE-2006-4439
Published: 2006-08-29
Description: pkgadd in Sun Solaris 10 before 20060825 installs files with insecure file and directory permissions (755 or 777) if the pkgmap file contains a "?" (question mark) in the mode field, which allows local users to modify arbitrary files or directories, a different vulnerability than CVE-2002-1871.
CVSS Score: 3.6 (LOW)
References: http://secunia.com/advisories/21633; http://secunia.com/advisories/22992; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102513-1
CVE: CVE-2006-4440
Published: 2006-08-29
Description: PHP remote file inclusion vulnerability in main.php in Ay System Solutions CMS 2.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path[ShowProcessHandle] parameter.
CVSS Score: 7.5 (HIGH)
References: http://aysad.net/download/logs/WCSv2.7_upgrades.log; http://secunia.com/advisories/21661; http://www.osvdb.org/28245
CVE: CVE-2006-4441
Published: 2006-08-29
Description: Multiple PHP remote file inclusion vulnerabilities in Ay System Solutions CMS 2.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path[ShowProcessHandle] parameter to (1) home.php or (2) impressum.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21661; http://www.osvdb.org/28246; http://www.osvdb.org/28247
CVE: CVE-2006-4442
Published: 2006-08-29
Description: Cross-site scripting (XSS) vulnerability in PHP iAddressBook before 0.95 allows remote attackers to inject arbitrary web script or HTML via the cat_name parameter, related to adding a category. (categories field).  NOTE: some details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/21611; http://wacha.ch/wiki/addressbook:changelog; http://www.osvdb.org/28174