deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-5147
Published: 2006-10-05
Description: PHP remote file inclusion vulnerability in wamp_dir/setup/yesno.phtml in VAMP Webmail 2.0beta1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the no_url parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20289; https://exchange.xforce.ibmcloud.com/vulnerabilities/29288; https://www.exploit-db.com/exploits/2461
CVE: CVE-2006-5148
Published: 2006-10-05
Description: Multiple PHP remote file inclusion vulnerabilities in Forum82 2.5.2b and earlier allow remote attackers to execute arbitrary PHP code via a URL in the repertorylevel parameter including scripts in /forum/ including (1) search.php, (2) message.php, (3) member.php, (4) mail.php, (5) lostpassword.php, (6) gesfil.php, (7) forum82lib.php3, and other unspecified scripts.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22214; http://www.securityfocus.com/bid/20291; http://www.vupen.com/english/advisories/2006/3865
CVE: CVE-2006-5149
Published: 2006-10-05
Description: Multiple directory traversal vulnerabilities in OpenBiblio before 0.5.2 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the page parameter to shared/help.php or (2) the tab parameter to shared/header.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/22238; http://sourceforge.net/project/shownotes.php?release_id=451780; http://www.securityfocus.com/archive/1/485588/100/0/threaded
CVE: CVE-2006-5150
Published: 2006-10-05
Description: SQL injection vulnerability in the reports system in OpenBiblio before 0.5.2 allows remote attackers with report privileges to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/22238; http://sourceforge.net/project/shownotes.php?release_id=451780; http://www.securityfocus.com/bid/20301
CVE: CVE-2006-5151
Published: 2006-10-05
Description: Unspecified vulnerability in HP Ignite-UX server before C.6.9.150 for HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers to "gain root access" via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/22190; http://secunia.com/advisories/22361; http://securityreason.com/securityalert/1688
CVE: CVE-2006-5152
Published: 2006-10-05
Description: Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL that is returned in a large HTTP 404 error message without an explicit charset, a related issue to CVE-2006-0032.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0017.html; http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0030.html; http://www.osvdb.org/31328
CVE: CVE-2006-5153
Published: 2006-10-05
Description: The (1) fwdrv.sys and (2) khips.sys drivers in Sunbelt Kerio Personal Firewall 4.3.268 and earlier do not validate arguments passed through to SSDT functions, including NtCreateFile, NtDeleteFile, NtLoadDriver, NtMapViewOfSection, NtOpenFile, and NtSetInformationFile, which allows local users to cause a denial of service (crash) and possibly other impacts via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22234; http://securityreason.com/securityalert/1685; http://securitytracker.com/id?1016967
CVE: CVE-2006-5154
Published: 2006-10-05
Description: PHP remote file inclusion vulnerability in cp/sig.php in DeluxeBB 1.09 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the templatefolder parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22176; http://www.deluxebb.com/community/topic.php?tid=420; http://www.osvdb.org/29371
CVE: CVE-2006-5155
Published: 2006-10-05
Description: PHP remote file inclusion vulnerability in core/pdf.php in VideoDB 2.2.1 and earlier allows remote attackers to execute arbitrary PHP code via the config[pdf_module] parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22184; http://www.securityfocus.com/bid/20265; http://www.vupen.com/english/advisories/2006/3864
CVE: CVE-2006-5156
Published: 2006-10-05
Description: Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot before 1.1.1.126 allows remote attackers to execute arbitrary code via a request to /spipe/pkg/ with a long source header.
CVSS Score: 10.0 (HIGH)
References: http://download.nai.com/products/patches/ePO/v3.5/EPO3506.txt; http://download.nai.com/products/patches/protectionpilot/v1.1.1/PRP1113.txt; http://knowledge.mcafee.com/SupportSite/search.do?cmd=displayKC&docType=kc&externalId=8611438&sliceId=SAL_Public&dialogID=2997768&stateId=0%200%202995803
CVE: CVE-2006-5157
Published: 2006-10-05
Description: Format string vulnerability in the ActiveX control (ATXCONSOLE.OCX) in TrendMicro OfficeScan Corporate Edition (OSCE) before 7.3 Patch 1 allows remote attackers to execute arbitrary code via format string identifiers in the "Management Console's Remote Client Install name search".
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22224; http://securityreason.com/securityalert/1682; http://securitytracker.com/id?1016963
CVE: CVE-2006-5158
Published: 2006-10-05
Description: The nlmclnt_mark_reclaim in clntlock.c in NFS lockd in Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (process crash) and deny access to NFS exports via unspecified vectors that trigger a kernel oops (null dereference) and a deadlock.
CVSS Score: 7.5 (HIGH)
CWE: CWE-667
References: http://marc.info/?l=linux-kernel&m=[PII_REDACTED]6446&w=2; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]8973&w=2; http://rhn.redhat.com/errata/RHSA-2007-0488.html
CVE: CVE-2006-5159
Published: 2006-10-05
Description: Stack-based buffer overflow in Mozilla Firefox allows remote attackers to execute arbitrary code via unspecified vectors involving JavaScript.  NOTE: the vendor and original researchers have released a follow-up comment disputing the severity of this issue, in which the researcher states that "we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this... I have not succeeded in making this code do anything more than cause a crash and eat up system resources"
CVSS Score: 7.5 (HIGH)
References: http://developer.mozilla.org/devnews/index.php/2006/10/02/update-possible-vulnerability-reported-at-toorcon/; http://securityreason.com/securityalert/1678; http://securitytracker.com/id?1016962
CVE: CVE-2006-5160
Published: 2006-10-05
Description: Multiple unspecified vulnerabilities in Mozilla Firefox have unspecified vectors and impact, as claimed during ToorCon 2006.  NOTE: the vendor and original researchers have released a follow-up comment disputing this issue, in which one researcher states that "I have no undisclosed Firefox vulnerabilities. The person who was speaking with me made this claim, and I honestly have no idea if he has them or not.
CVSS Score: 8.1 (HIGH)
References: http://developer.mozilla.org/devnews/index.php/2006/10/02/update-possible-vulnerability-reported-at-toorcon/; http://www.securityfocus.com/archive/1/447493/100/0/threaded; http://www.securityfocus.com/bid/20294
CVE: CVE-2006-5161
Published: 2006-10-05
Description: IBM Client Security Password Manager stores and distributes saved passwords based upon the title of a website, which allows remote attackers to obtain username and password credentials by changing the title of an HTML page.
CVSS Score: 6.4 (MEDIUM)
References: http://securityreason.com/securityalert/1681; http://www.securityfocus.com/archive/1/447577/100/0/threaded; http://www.securityfocus.com/bid/20308
CVE: CVE-2006-5162
Published: 2006-10-05
Description: wininet.dll in Microsoft Internet Explorer 6.0 SP2 and earlier allows remote attackers to cause a denial of service (unhandled exception and crash) via a long Content-Type header, which triggers a stack overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-07/0379.html; http://securityreason.com/securityalert/1683; http://www.osvdb.org/29129
CVE: CVE-2006-5163
Published: 2006-10-05
Description: IBM Informix Dynamic Server 10.UC3RC1 Trial for Linux and possibly other versions creates /tmp/installserver.txt with insecure permissions, which allows local users to append data to arbitrary files via a symlink attack.
CVSS Score: 3.6 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0013.html; http://secunia.com/advisories/22223; http://securityreason.com/securityalert/1686
CVE: CVE-2006-5164
Published: 2006-10-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in cart.php in Sum Effect Software digiSHOP 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) sortBy or (2) search parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22086; http://securityreason.com/securityalert/1687; http://www.securityfocus.com/archive/1/447506/100/0/threaded
CVE: CVE-2006-5165
Published: 2006-10-05
Description: PHP remote file inclusion vulnerability in inc/functions.inc.php in Skrypty PPA Gallery 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the config[ppa_root_path] parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22155; http://www.securityfocus.com/bid/20255; http://www.vupen.com/english/advisories/2006/3842
CVE: CVE-2006-5166
Published: 2006-10-05
Description: PHP remote file inclusion vulnerability in functions.php in PHP Web Scripts Easy Banner Free allows remote attackers to execute arbitrary PHP code via a URL in the s[phppath] parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1684; http://www.securityfocus.com/archive/1/447499/100/0/threaded; http://www.securityfocus.com/bid/20295
CVE: CVE-2006-5167
Published: 2006-10-05
Description: Multiple PHP remote file inclusion vulnerabilities in BasiliX 1.1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) BSX_LIBDIR parameter in scripts in /files/ including (a) abook.php3, (b) compose-attach.php3, (c) compose-menu.php3, (d) compose-new.php3, (e) compose-send.php3, (f) folder-create.php3, (g) folder-delete.php3, (h) folder-empty.php3, (i) folder-rename.php3, (j) folders.php3, (k) mbox-action.php3, (l) mbox-list.php3, (m) message-delete.php3, (n) message-forward.php3, (o) message-header.php3, (p) message-print.php3, (q) message-read.php3, (r) message-reply.php3, (s) message-replyall.php3, (t) message-search.php3, or (u) settings.php3; and the (2) BSX_HTXDIR parameter in (v) files/login.php3.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22231; http://www.osvdb.org/29403; http://www.securityfocus.com/bid/20287
CVE: CVE-2006-3741
Published: 2006-10-10
Description: The perfmonctl system call (sys_perfmonctl) in Linux kernel 2.4.x and 2.6 before 2.6.18, when running on Itanium systems, does not properly track the reference count for file descriptors, which allows local users to cause a denial of service (file descriptor consumption).
CVSS Score: 4.9 (MEDIUM)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=204360; http://secunia.com/advisories/22279; http://secunia.com/advisories/22292
CVE: CVE-2006-4812
Published: 2006-10-10
Description: Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function (Zend/zend_alloc.c).
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_alloc.c?r1=1.161&r2=1.162; http://lists.suse.com/archive/suse-security-announce/2006-Oct/0002.html; http://rhn.redhat.com/errata/RHSA-2006-0688.html
CVE: CVE-2006-4927
Published: 2006-10-10
Description: The (a) NAVENG (NAVENG.SYS) and (b) NAVEX15 (NAVEX15.SYS) device drivers 20061.3.0.12 and later, as used in Symantec AntiVirus and security products, allow local users to gain privileges by overwriting critical system addresses using a crafted Irp to the IOCTL functions (1) 0x222AD3, (2) 0x222AD7, and (3) 0x222ADB.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/22288; http://securityreason.com/securityalert/1690; http://securitytracker.com/id?1016994
CVE: CVE-2006-4980
Published: 2006-10-10
Description: Buffer overflow in the repr function in Python 2.3 through 2.6 before 20060822 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via crafted wide character UTF-32/UCS-4 strings to certain scripts.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=391589; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=208162
CVE: CVE-2006-4997
Published: 2006-10-10
Description: The clip_mkip function in net/atm/clip.c of the ATM subsystem in Linux kernel allows remote attackers to cause a denial of service (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (freed pointer dereference).
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=206265; http://secunia.com/advisories/22253; http://secunia.com/advisories/22279
CVE: CVE-2006-5072
Published: 2006-10-10
Description: The System.CodeDom.Compiler classes in Novell Mono create temporary files with insecure permissions, which allows local users to overwrite arbitrary files or execute arbitrary code via a symlink attack.
CVSS Score: 6.2 (MEDIUM)
References: http://fedoranews.org/cms/node/2401; http://secunia.com/advisories/22237; http://secunia.com/advisories/22277
CVE: CVE-2006-5142
Published: 2006-10-10
Description: Stack-based buffer overflow in CA BrightStor ARCserve Backup R11.5 client and server allows remote attackers to execute arbitrary code via long messages to the CheyenneDS Mailslot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/22283; http://supportconnectw.ca.com/public/storage/infodocs/basbr-secnotice.asp; http://www.securityfocus.com/archive/1/447839/100/100/threaded
CVE: CVE-2006-5143
Published: 2006-10-10
Description: Multiple buffer overflows in CA BrightStor ARCserve Backup r11.5 SP1 and earlier, r11.1, and 9.01; BrightStor ARCserve Backup for Windows r11; BrightStor Enterprise Backup 10.5; Server Protection Suite r2; and Business Protection Suite r2 allow remote attackers to execute arbitrary code via crafted data on TCP port 6071 to the Backup Agent RPC Server (DBASVR.exe) using the RPC routines with opcode (1) 0x01, (2) 0x02, or (3) 0x18; invalid stub data on TCP port 6503 to the RPC routines with opcode (4) 0x2b or (5) 0x2d in ASCORE.dll in the Message Engine RPC Server (msgeng.exe); (6) a long hostname on TCP port 41523 to ASBRDCST.DLL in the Discovery Service (casdscsvc.exe); or unspecified vectors related to the (7) Job Engine Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/22285; http://securitytracker.com/id?1017003; http://securitytracker.com/id?1017004
CVE: CVE-2006-5168
Published: 2006-10-10
Description: Cross-site scripting (XSS) vulnerability in the search functionality in Simon Brown Pebble 2.0.0 RC1 and RC2 allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/1689; http://svn.sourceforge.net/viewvc/pebble/trunk/src/net/sourceforge/pebble/search/SearchResults.java?r1=136&r2=206; http://www.securityfocus.com/archive/1/447503/100/0/threaded
CVE: CVE-2006-5169
Published: 2006-10-10
Description: Cross-site scripting (XSS) vulnerability in John Himmelman (aka DaRk2k1) PowerPortal 1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to registering a user.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
References: http://www.securityfocus.com/bid/20279; http://www.securityfocus.com/bid/20279
CVE: CVE-2006-5170
Published: 2006-10-10
Description: pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: http://bugzilla.padl.com/show_bug.cgi?id=291; http://rhn.redhat.com/errata/RHSA-2006-0719.html; http://secunia.com/advisories/22682
CVE: CVE-2006-5174
Published: 2006-10-10
Description: The copy_from_user function in the uaccess code in Linux kernel 2.6 before 2.6.19-rc1, when running on s390, does not properly clear a kernel buffer, which allows local user space programs to read portions of kernel memory by "appending to a file from a bad address," which triggers a fault that prevents the unused memory from being cleared in the kernel buffer.
CVSS Score: 2.1 (LOW)
References: http://lkml.org/lkml/2006/11/5/46; http://rhn.redhat.com/errata/RHSA-2007-0014.html; http://secunia.com/advisories/22289
CVE: CVE-2006-5175
Published: 2006-10-10
Description: Cross-site request forgery (CSRF) vulnerability in the administrative interface for the TeraStation HD-HTGL firmware 2.05 beta 1 and earlier allows remote attackers to modify configurations or delete arbitrary data via unspecified vectors.
CVSS Score: 7.6 (HIGH)
CWE: CWE-352
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/22248; http://www.vupen.com/english/advisories/2006/3891
CVE: CVE-2006-5176
Published: 2006-10-10
Description: Buffer overflow in NTLM authentication in MailEnable Professional 2.0 and Enterprise 2.0 allows remote attackers to execute arbitrary code via "the signature field of NTLM Type 1 messages".
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.musecurity.com/advisories/MU-200609-01.txt; http://secunia.com/advisories/22179; http://www.mailenable.com/hotfix/
CVE: CVE-2006-5177
Published: 2006-10-10
Description: The NTLM authentication in MailEnable Professional 2.0 and Enterprise 2.0 allows remote attackers to (1) execute arbitrary code via unspecified vectors involving crafted base64 encoded NTLM Type 3 messages, or (2) cause a denial of service via crafted base64 encoded NTLM Type 1 messages, which trigger a buffer over-read.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.musecurity.com/advisories/MU-200609-01.txt; http://secunia.com/advisories/22179; http://www.mailenable.com/hotfix/
CVE: CVE-2006-5178
Published: 2006-10-10
Description: Race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions to change the file path after the open_basedir check and before the file is opened by the underlying system, as demonstrated by symlinking a symlink into a subdirectory, to point to a parent directory via .. (dot dot) sequences, and then unlinking the resulting symlink.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-362
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049850.html; http://secunia.com/advisories/22235; http://secunia.com/advisories/22424
CVE: CVE-2006-5179
Published: 2006-10-10
Description: Intoto iGateway VPN and iGateway SSL-VPN allow context-dependent attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) "public exponent" or (2) "public modulus" values in X.509 certificates that require extra time to process when using RSA signature verification, a related issue to CVE-2006-2940.
CVSS Score: 5.4 (MEDIUM)
References: http://secunia.com/advisories/22206; http://www.uniras.gov.uk/niscc/docs/re-20[PII_REDACTED]1.pdf?lang=en; http://www.vupen.com/english/advisories/2006/3859
CVE: CVE-2006-5180
Published: 2006-10-10
Description: PHP remote file inclusion vulnerability in include/main.inc.php in Sebastian Baumann and Philipp Wolfer Newswriter SW 1.42 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the NWCONF_SYSTEM[server_path] parameter, a different vector than CVE-2006-5102.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1695; http://www.securityfocus.com/archive/1/447253/100/0/threaded; https://www.exploit-db.com/exploits/2443
CVE: CVE-2006-5181
Published: 2006-10-10
Description: Multiple PHP remote file inclusion vulnerabilities in Joshua Muheim phpMyWebmin 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the target parameter in (1) change_preferences2.php, (2) create_file.php, (3) upload_local.php, and (4) upload_multi.php, different vectors than CVE-2006-5124.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22178; http://securityreason.com/securityalert/1693; http://www.securityfocus.com/archive/1/447489/100/0/threaded
CVE: CVE-2006-5182
Published: 2006-10-10
Description: PHP remote file inclusion vulnerability in frontpage.php in Dan Jensen Travelsized CMS 0.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the setup_folder parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22194; http://www.securityfocus.com/bid/20321; http://www.vupen.com/english/advisories/2006/3897
CVE: CVE-2006-5183
Published: 2006-10-10
Description: Multiple PHP remote file inclusion vulnerabilities in Dayfox Designs Dayfox Blog 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the slogin parameter in the (1) adminlog.php, (2) postblog.php, (3) index.php, or (4) index2.php script in /edit.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1694; http://www.securityfocus.com/archive/1/447500/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/29310
CVE: CVE-2006-5184
Published: 2006-10-10
Description: SQL injection vulnerability in PKR Internet Taskjitsu before 2.0.6 allows remote attackers to execute arbitrary SQL commands via the key parameter, when the limit query parameter is set to customerid.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22257; http://securitytracker.com/id?1016978; http://www.securityfocus.com/bid/20332
CVE: CVE-2006-5185
Published: 2006-10-10
Description: Eval injection vulnerability in Template.php in HAMweather 3.9.8.4 and earlier allows remote attackers to execute arbitrary code via a modified query string, which is supplied to an eval function call within the do_parse_code function.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22242; http://support.hamweather.com/viewtopic.php?t=6548; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]6
CVE: CVE-2006-5186
Published: 2006-10-10
Description: PHP remote file inclusion vulnerability in functions.php in phpMyProfiler 0.9.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pmp_rel_path parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://forum.phpmyprofiler.de/viewtopic.php?p=2745#2745; http://secunia.com/advisories/22144; http://securityreason.com/securityalert/1696
CVE: CVE-2006-5187
Published: 2006-10-10
Description: PHP remote file inclusion vulnerability in includes/functions.php in Bulletin Board Ace (BBaCE) 3.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22137; http://www.securityfocus.com/bid/20302; http://www.vupen.com/english/advisories/2006/3887