deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3867
Published: 2006-10-10
Description: Unspecified vulnerability in Microsoft Excel 2000, 2002, 2003, 2004 for Mac, v.X for Mac, and Excel Viewer 2003 allows user-assisted attackers to execute arbitrary code via a crafted Lotus 1-2-3 file, a different vulnerability than CVE-2006-2387 and CVE-2006-3875.
CVSS Score: 5.1 (MEDIUM)
References: http://securitytracker.com/id?1017031; http://www.kb.cert.org/vuls/id/821772; http://www.securityfocus.com/archive/1/449179/100/0/threaded
CVE: CVE-2006-3868
Published: 2006-10-10
Description: Unspecified vulnerability in Microsoft Office XP and 2003 allows remote user-assisted attackers to execute arbitrary code via a malformed Smart Tag.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22339; http://securitytracker.com/id?1017034; http://www.kb.cert.org/vuls/id/807780
CVE: CVE-2006-3875
Published: 2006-10-10
Description: Unspecified vulnerability in Microsoft Excel 2000, 2002, 2003, 2004 for Mac, v.X for Mac, and Excel Viewer 2003 allows user-assisted attackers to execute arbitrary code via a crafted COLINFO record in an XLS file, a different vulnerability than CVE-2006-2387 and CVE-2006-3867.
CVSS Score: 5.1 (MEDIUM)
References: http://securitytracker.com/id?1017031; http://www.kb.cert.org/vuls/id/252500; http://www.securityfocus.com/archive/1/449179/100/0/threaded
CVE: CVE-2006-3877
Published: 2006-10-10
Description: Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allows user-assisted attackers to execute arbitrary code via an unspecified "crafted file," a different vulnerability than CVE-2006-3435, CVE-2006-4694, and CVE-2006-3876.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://securitytracker.com/id?1017030; http://www.kb.cert.org/vuls/id/205948; http://www.osvdb.org/29448
CVE: CVE-2006-3978
Published: 2006-10-10
Description: Unspecified vulnerability in a Verity third party library, as used on Adobe ColdFusion MX 7 through MX 7.0.2 and possibly other products, allows local users to execute arbitrary code via unknown attack vectors.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/22312; http://securitytracker.com/id?1017040; http://www.adobe.com/support/security/bulletins/apsb06-17.html
CVE: CVE-2006-4685
Published: 2006-10-10
Description: The XMLHTTP ActiveX control in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 does not properly handle HTTP server-side redirects, which allows remote user-assisted attackers to access content from other domains.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/22333; http://securitytracker.com/id?1017033; http://www.kb.cert.org/vuls/id/547212
CVE: CVE-2006-4686
Published: 2006-10-10
Description: Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted Web page.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22333; http://securitytracker.com/id?1017033; http://www.kb.cert.org/vuls/id/562788
CVE: CVE-2006-4692
Published: 2006-10-10
Description: Argument injection vulnerability in the Windows Object Packager (packager.exe) in Microsoft Windows XP SP1 and SP2 and Server 2003 SP1 and earlier allows remote user-assisted attackers to execute arbitrary commands via a crafted file with a "/" (slash) character in the filename of the Command Line property, followed by a valid file extension, which causes the command before the slash to be executed, aka "Object Packager Dialogue Spoofing Vulnerability."
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-88
References: http://secunia.com/advisories/20717; http://secunia.com/secunia_research/2006-54/advisory/; http://securitytracker.com/id?1017037
CVE: CVE-2006-4693
Published: 2006-10-10
Description: Unspecified vulnerability in Microsoft Word 2004 for Mac and v.X for Mac allows remote user-assisted attackers to execute arbitrary code via a crafted string in a Word file, a different issue than CVE-2006-3647 and CVE-2006-3651.
CVSS Score: 9.3 (HIGH)
References: http://securitytracker.com/id?1017032; http://www.osvdb.org/29442; http://www.securityfocus.com/archive/1/449179/100/0/threaded
CVE: CVE-2006-4696
Published: 2006-10-10
Description: Unspecified vulnerability in the Server service in Microsoft Windows 2000 SP4, Server 2003 SP1 and earlier, and XP SP2 and earlier allows remote attackers to execute arbitrary code via a crafted packet, aka "SMB Rename Vulnerability."
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://securitytracker.com/id?1017035; http://www.kb.cert.org/vuls/id/820628; http://www.securityfocus.com/archive/1/449179/100/0/threaded
CVE: CVE-2006-5199
Published: 2006-10-10
Description: Adobe Contribute Publishing Server leaks the administrator password in logs that are created during product installation, which allows local users to gain privileges to the server.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/22329; http://securitytracker.com/id?1017038; http://www.adobe.com/support/security/bulletins/apsb06-15.html
CVE: CVE-2006-5200
Published: 2006-10-10
Description: Unspecified vulnerability in Adobe Breeze 5 Licensed Server and Breeze 5.1 Licensed Server allows attackers to read arbitrary files via unknown vectors related to "URL parsing."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22327; http://securitytracker.com/id?1017039; http://www.adobe.com/support/security/bulletins/apsb06-16.html
CVE: CVE-2006-3887
Published: 2006-10-10
Description: Buffer overflow in AOL You've Got Pictures (YGP) Screensaver ActiveX control allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22304; http://securitytracker.com/id?1017024; http://www.kb.cert.org/vuls/id/154641
CVE: CVE-2006-3888
Published: 2006-10-10
Description: Buffer overflow in AOL You've Got Pictures (YGP) Pic Downloader YGPPDownload ActiveX control (AOL.PicDownloadCtrl.1, YGPPicDownload.dll), as used in America Online 9.0 Security Edition, allows remote attackers to execute arbitrary code via a long argument to the SetAlbumName method.
CVSS Score: 7.5 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=420; http://secunia.com/advisories/22304; http://securitytracker.com/id?1017024
CVE: CVE-2006-5229
Published: 2006-10-10
Description: OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as demonstrated by sshtime.  NOTE: as of 20061014, it appears that this issue is dependent on the use of manually-set passwords that causes delays when processing /etc/shadow due to an increased number of rounds.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/25979; http://www.osvdb.org/32721; http://www.securityfocus.com/archive/1/448025/100/0/threaded
CVE: CVE-2006-5230
Published: 2006-10-11
Description: PHP remote file inclusion vulnerability in forum.php in FreeForum 0.9.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the fpath parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22320; http://securityreason.com/securityalert/1710; http://www.securityfocus.com/archive/1/447931/100/0/threaded
CVE: CVE-2006-5231
Published: 2006-10-11
Description: Grandstream GXP-2000 VoIP Desktop Phone, firmware version 1.1.0.5, allows remote attackers to cause a denial of service (hang or reboot) via a large amount of ASCII data sent to port (1) 5060/UDP, (2) 5062/UDP, (3) 5064/UDP, (4) 5066/UDP, (5) 9876/UDP, or (6) 26789/UDP.
CVSS Score: 7.8 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049876.html; http://secunia.com/advisories/22265; http://securityreason.com/securityalert/1718
CVE: CVE-2006-5232
Published: 2006-10-11
Description: Multiple PHP remote file inclusion vulnerabilities in iSearch 2.16 allow remote attackers to execute arbitrary PHP code via a URL in the isearch_path parameter in (1) index.php, (2) viewcache.php, (3) sitemap.php, (4) isearch.inc.php, (5) google_sitemap.php, (6) stats.php, or (7) auto_spider_img.php.  NOTE: this issue has been disputed by a third party who shows that $isearch_path is set to a constant value.  CVE analysis as of 20061010 is inconclusive, although the original researcher is known to make mistakes
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/448006/100/0/threaded; http://www.securityfocus.com/archive/1/448099/100/0/threaded; http://www.securityfocus.com/archive/1/448225/100/100/threaded
CVE: CVE-2006-5233
Published: 2006-10-11
Description: Polycom SoundPoint IP 301 VoIP Desktop Phone, firmware version 1.4.1.0040, allows remote attackers to cause a denial of service (reboot) via (1) a long URL sent to the HTTP daemon and (2) unspecified manipulations as demonstrated by the Nessus http_fingerprinting_hmap.nasl script.
CVSS Score: 7.8 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0090.html; http://secunia.com/advisories/22266; http://www.securityfocus.com/bid/20351
CVE: CVE-2006-5234
Published: 2006-10-11
Description: Multiple PHP remote file inclusion vulnerabilities in phpWebSite 0.10.2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPWS_SOURCE_DIR parameter in (1) init.php, (2) users.php, (3) Cookie.php, (4) forms.php, (5) Groups.php, (6) ModSetting.php, (7) Calendar.php, (8) DateTime.php, (9) core.php, (10) ImgLibrary.php, (11) Manager.php, and (12) Template.php, and (13) EZform.php.  NOTE: CVE disputes this report, since "PHPWS_SOURCE_DIR" is defined as a constant, not accessed as a variable
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1716; http://www.attrition.org/pipermail/vim/2006-October/001079.html; http://www.securityfocus.com/archive/1/448098/100/0/threaded
CVE: CVE-2006-5235
Published: 2006-10-11
Description: PHP remote file inclusion vulnerability in includes/functions_kb.php in Dimension of phpBB 0.2.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/3923; http://www.vupen.com/english/advisories/2006/3923
CVE: CVE-2006-5236
Published: 2006-10-11
Description: SQL injection vulnerability in search.php in 4images 1.7.x allows remote authenticated users to execute arbitrary SQL commands via the search_user parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22349; http://securityreason.com/securityalert/1711; http://securitytracker.com/id?1017074
CVE: CVE-2006-4516
Published: 2006-10-12
Description: Integer signedness error in FreeBSD 6.0-RELEASE allows local users to cause a denial of service (memory corruption and kernel panic) via a PT_LWPINFO ptrace command with a large negative data value that satisfies a signed maximum value check but is used in an unsigned copyout function call.
CVSS Score: 4.9 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=419; http://secunia.com/advisories/22367; http://www.securityfocus.com/bid/20440
CVE: CVE-2006-4840
Published: 2006-10-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-3888.  Reason: This candidate is a reservation duplicate of CVE-2006-3888.  Notes: All CVE users should reference CVE-2006-3888 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-4842
Published: 2006-10-12
Description: The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in Sun Solaris 10, trusts user-specified environment variables for specifying log files even when running from setuid programs, which allows local users to create or overwrite arbitrary files.
CVSS Score: 3.6 (LOW)
CWE: CWE-20
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=418; http://secunia.com/advisories/22348; http://securitytracker.com/id?1017050
CVE: CVE-2006-5237
Published: 2006-10-12
Description: SQL injection vulnerability in Blue Smiley Organizer before 4.46 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22310; http://www.bookmark-manager.com/CHANGES; http://www.securityfocus.com/bid/20417
CVE: CVE-2006-5238
Published: 2006-10-12
Description: Unspecified vulnerability in the file upload module in Blue Smiley Organizer before 4.45 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.bookmark-manager.com/CHANGES; http://www.osvdb.org/29542; http://www.vupen.com/english/advisories/2006/3958
CVE: CVE-2006-5239
Published: 2006-10-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in eXpBlog 0.3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the query string (PHP_SELF) in kalender.php or (2) the captcha_session_code parameter in pre_details.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9660&w=2; http://secunia.com/advisories/22328; http://securitytracker.com/id?1017028
CVE: CVE-2006-5240
Published: 2006-10-12
Description: PHP remote file inclusion vulnerability in engine/require.php in Docmint 2.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the MY_ENV[BASE_ENGINE_LOC] parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://advisories.echo.or.id/adv/adv51-K-159-2006.txt; http://secunia.com/advisories/22343; http://securityreason.com/securityalert/1709
CVE: CVE-2006-5241
Published: 2006-10-12
Description: Multiple PHP remote file inclusion vulnerabilities in OpenDock Easy Gallery 1.4 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the doc_directory parameter in (1) file.php; (2) find_user.php, (3) lib_user.php, (4) lib_form_user.php, and (5) user.php in sw/lib_user/; (6) find_session.php and (7) session.php in sw/lib_session/; (8) comment.php and (9) lib_comment.php in sw/lib_comment/; and other unspecified PHP scripts.
CVSS Score: 5.1 (MEDIUM)
References: http://advisories.echo.or.id/adv/adv52-theday-2006.txt; http://secunia.com/advisories/22337; http://securityreason.com/securityalert/1708
CVE: CVE-2006-5242
Published: 2006-10-12
Description: SQL injection vulnerability in Etomite Content Management System (CMS) before 0.6.1.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/22217; http://www.etomite.org/forums/index.php?showtopic=6095; http://www.securityfocus.com/bid/20449
CVE: CVE-2006-5243
Published: 2006-10-12
Description: Multiple PHP remote file inclusion vulnerabilities in OpenDock Easy Doc 1.4 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the doc_directory parameter in (1) down_stat.php, (2) file.php, (3) find_file.php, (4) lib_file.php, and (5) lib_form_file.php in sw/lib_up_file/; (6) find_comment.php, (7) comment.php, and (8) lib_comment.php in sw/lib_comment/; (9) sw/lib_find/find.php; and other unspecified PHP scripts.
CVSS Score: 7.5 (HIGH)
References: http://advisories.echo.or.id/adv/adv49-theday-2006.txt; http://secunia.com/advisories/22334; http://securityreason.com/securityalert/1715
CVE: CVE-2006-5244
Published: 2006-10-12
Description: Multiple PHP remote file inclusion vulnerabilities in OpenDock Easy Blog 1.4 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the doc_directory parameter in (1) down_stat.php, (2) file.php, (3) find_file.php, (4) lib_read_file.php, and (5) lib_form_file.php in sw/lib_up_file; (6) find_comment.php, (7) comment.php, and (8) lib_comment.php in sw/lib_comment/; (9) sw/lib_find/find.php; and other unspecified vectors.
CVSS Score: 5.1 (MEDIUM)
References: http://advisories.echo.or.id/adv/adv50-theday-2006.txt; http://secunia.com/advisories/22335; http://securitytracker.com/id?1017027
CVE: CVE-2006-5245
Published: 2006-10-12
Description: Eazy Cart allows remote attackers to bypass authentication and gain administrative access via a direct request for admin/home/index.php, and possibly other PHP scripts under admin/.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22286; http://securityreason.com/securityalert/1717; http://securitytracker.com/id?1017041
CVE: CVE-2006-5246
Published: 2006-10-12
Description: Eazy Cart allows remote attackers to change prices and other critical fields via unspecified vectors to easycart.php, probably including the price parameter.  NOTE: some details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22286; http://securityreason.com/securityalert/1717; http://securitytracker.com/id?1017041
CVE: CVE-2006-5247
Published: 2006-10-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Eazy Cart allow remote attackers to inject arbitrary web script or HTML via easycart.php, possibly related to the (1) des and (2) qty parameters in an add action, and via other unspecified vectors.  NOTE: some details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22286; http://securityreason.com/securityalert/1717; http://securitytracker.com/id?1017041
CVE: CVE-2006-5248
Published: 2006-10-12
Description: Eazy Cart stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a customer database via a direct request for admin/config/customer.dat.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/22286; http://secunia.com/advisories/22286
CVE: CVE-2006-5249
Published: 2006-10-12
Description: PHP remote file inclusion vulnerability in tagmin/delTagUser.php in TagIt! Tagboard 2.1.B Build 2 (tagit2b) allows remote attackers to execute arbitrary PHP code via a URL in the configpath parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1714; http://securitytracker.com/id?1017045; http://www.attrition.org/pipermail/vim/2006-October/001083.html
CVE: CVE-2006-5250
Published: 2006-10-12
Description: PHP remote file inclusion vulnerability in lib/googlesearch/GoogleSearch.php in BlueShoes 4.6_public and earlier allows remote attackers to execute arbitrary PHP code via a URL in the APP[path][lib] parameter, a different vector than CVE-2006-2864.
CVSS Score: 5.1 (MEDIUM)
References: http://securityreason.com/securityalert/1713; http://www.blueshoes.org/en/news/; http://www.securityfocus.com/archive/1/448182/100/0/threaded
CVE: CVE-2006-4813
Published: 2006-10-12
Description: The __block_prepare_write function in fs/buffer.c for Linux kernel 2.6.x before 2.6.13 does not properly clear buffers during certain error conditions, which allows local users to read portions of files that have been unlinked.
CVSS Score: 2.1 (LOW)
References: http://osvdb.org/31376; http://rhn.redhat.com/errata/RHSA-2007-0014.html; http://secunia.com/advisories/23370
CVE: CVE-2006-5251
Published: 2006-10-12
Description: PHP remote file inclusion vulnerability in index.php in Deep CMS 2.0a allows remote attackers to execute arbitrary PHP code via a URL in the ConfigDir parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20402; http://www.securityfocus.com/bid/20402
CVE: CVE-2006-5252
Published: 2006-10-12
Description: PHP remote file inclusion vulnerability in includes/core.lib.php in Webmedia Explorer 2.8.7 allows remote attackers to execute arbitrary PHP code via a URL in the path_include parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22318; http://www.osvdb.org/29587; http://www.rahim.webd.pl/exploity/Exploits/96.txt
CVE: CVE-2006-5253
Published: 2006-10-12
Description: PHP remote file inclusion vulnerability in strload.php in Dayana Networks phpOnline (aka PHP-Online) 2.1 allows remote attackers to execute arbitrary PHP code via a URL in the LangFile parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-10/0085.html; http://securityreason.com/securityalert/1721; https://exchange.xforce.ibmcloud.com/vulnerabilities/29382
CVE: CVE-2006-5254
Published: 2006-10-12
Description: PHP remote file inclusion vulnerability in registration_detailed.inc.php in Mark Van Bellen Detailed User Registration (com_registration_detailed), aka regdetailed, 4.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20072; https://exchange.xforce.ibmcloud.com/vulnerabilities/28982; https://www.exploit-db.com/exploits/2379
CVE: CVE-2006-5255
Published: 2006-10-12
Description: PHP remote file inclusion vulnerability in addnews.php in Greg Neustaetter gCards 1.13 allows remote attackers to execute arbitrary PHP code via a URL in the languagefile parameter.  NOTE: another researcher has observed that languageFile is defined before use.  CVE analysis as of 20061012 concurs with the dispute
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5095&w=2; http://www.securityfocus.com/archive/1/448293/100/0/threaded; http://www.securityfocus.com/bid/20461
CVE: CVE-2006-5256
Published: 2006-10-12
Description: PHP remote file inclusion vulnerability in claroline/inc/lib/import.lib.php in Claroline 1.8.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the includePath parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22364; http://securityreason.com/securityalert/1719; http://securitytracker.com/id?1017044
CVE: CVE-2006-5257
Published: 2006-10-12
Description: PHP remote file inclusion vulnerability in modules/forum/include/config.php in Ciamos Content Management System (CMS) 0.9.6b and earlier allows remote attackers to execute arbitrary PHP code via a URL in the module_cache_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20403; https://exchange.xforce.ibmcloud.com/vulnerabilities/29398; https://www.exploit-db.com/exploits/2489
CVE: CVE-2006-5258
Published: 2006-10-12
Description: The spell checking component of (1) Asbru Web Content Management before 6.1.22, (2) Asbru Web Content Editor before 6.0.22, and (3) Asbru Website Manager before 6.0.22 allows remote attackers to execute arbitrary commands via an unspecified parameter that is not sanitized before Aspell is invoked.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0306.html; http://editor.asbrusoft.com/page.php/id=727; http://secunia.com/advisories/22344
CVE: CVE-2006-5259
Published: 2006-10-12
Description: PHP remote file inclusion vulnerability in param_editor.php in Compteur 2 allows remote attackers to execute arbitrary PHP code via a URL in the folder parameter.
CVSS Score: 7.5 (HIGH)
References: http://acid-root.new.fr/poc/13061007.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0942&w=2; http://secunia.com/advisories/22373