deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6762
Published: 2006-12-27
Description: The IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to cause a denial of service via an APPEND command with a single "(" (parenthesis) in the argument.
CVSS Score: 4.0 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=455; http://secunia.com/advisories/23437; http://www.kb.cert.org/vuls/id/944273
CVE: CVE-2006-6763
Published: 2006-12-27
Description: Multiple PHP remote file inclusion vulnerabilities in the Keep It Simple Guest Book (KISGB) allow remote attackers to execute arbitrary PHP code via a URL in the (1) path_to_themes parameter in (a) authenticate.php, and the (2) default_path_for_themes parameter in (b) admin.php and (c) upconfig.php.
CVSS Score: 7.5 (HIGH)
References: http://www.security.nnov.ru/Pdocument470.html; http://www.securityfocus.com/archive/1/455198/100/0/threaded; http://www.security.nnov.ru/Pdocument470.html
CVE: CVE-2006-6764
Published: 2006-12-27
Description: PHP remote file inclusion vulnerability in authenticate.php in Keep It Simple Guest Book (KISGB), when executing PHP through CGI, allows remote attackers to execute arbitrary PHP code via a URL in the default_path_to_themes parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23477; http://www.securityfocus.com/bid/21721; http://www.vupen.com/english/advisories/2006/5147
CVE: CVE-2006-6765
Published: 2006-12-27
Description: Multiple PHP file inclusion vulnerabilities in src/admin/pt_upload.php in Pagetool 1.07 allow remote attackers to execute arbitrary PHP code via (1) a local filename or FTP/share URI in the config_file parameter or (2) a URL in the ptconf[src] parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23508; http://www.vupen.com/english/advisories/2006/5163; https://www.exploit-db.com/exploits/3000
CVE: CVE-2006-6766
Published: 2006-12-27
Description: Multiple SQL injection vulnerabilities in cwmExplorer 1.1.0 and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: The provenance of this information is unknown; details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/5117; https://exchange.xforce.ibmcloud.com/vulnerabilities/31148; http://www.vupen.com/english/advisories/2006/5117
CVE: CVE-2006-6768
Published: 2006-12-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in default.asp in PWP Technologies The Classified Ad System allow remote attackers to inject arbitrary web script or HTML via the (1) cat or (2) main parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23289; http://securityreason.com/securityalert/2075; http://www.securityfocus.com/archive/1/452194/100/200/threaded
CVE: CVE-2006-6769
Published: 2006-12-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHP Live! 3.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) search_string parameter in (a) setup/transcripts.php, the (2) l parameter in (b) index.php, the (3) login field in (c) phplive/index.php, and the (4) deptid and (5) x parameters in (d) phplive/message_box.php.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23488; http://securityreason.com/securityalert/2068; http://www.hackerscenter.com/archive/view.asp?id=26833
CVE: CVE-2006-6770
Published: 2006-12-27
Description: Multiple PHP remote file inclusion vulnerabilities in Jinzora Media Jukebox 2.7 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter in (1) popup.php, (2) rss.php, (3) ajax_request.php, and (4) mediabroadcast.php.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23501; http://www.securityfocus.com/bid/21741; http://www.vupen.com/english/advisories/2006/5177
CVE: CVE-2006-6771
Published: 2006-12-27
Description: Multiple PHP remote file inclusion vulnerabilities in Irokez CMS 0.7.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[PTH][func] parameter in (a) scripts/gallery.scr.php; the (2) GLOBALS[PTH][spaw] parameter in (b) scripts/xtextarea.scr.php; and the (3) GLOBALS[PTH][classes] parameter in (c) sitemap.scr.php, (d) news.scr.php, (e) polls.scr.php, (f) rss.scr.php, (g) search.scr.php in scripts/, and (h) form.fun.php, (i) general.func.php, (j) groups.func.php, (k) js.func.php, (l) sections.func.php, and (m) users.func.php in functions/.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23497; http://www.securityfocus.com/bid/21769; http://www.vupen.com/english/advisories/2006/5178
CVE: CVE-2006-6772
Published: 2006-12-27
Description: Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run with the dump or backend option, allows remote attackers to execute arbitrary code via format string specifiers in the Common Name (CN) field of an SSL certificate associated with an https URL.
CVSS Score: 9.3 (HIGH)
CWE: CWE-134
References: http://fedoranews.org/cms/node/2415; http://fedoranews.org/cms/node/2416; http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051457.html
CVE: CVE-2006-6773
Published: 2006-12-27
Description: pages/register/register.php in Fishyshoop 0.930 beta allows remote attackers to create arbitrary administrative users by setting the is_admin HTTP POST parameter to 1.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23490; http://securityreason.com/securityalert/2077; http://www.securityfocus.com/archive/1/455260/100/0/threaded
CVE: CVE-2006-6774
Published: 2006-12-27
Description: PHP remote file inclusion vulnerability in socios/maquetacion_socio.php (members/maquetacion_member.php) in Ciberia Content Federator 1.0 allows remote attackers to execute arbitrary PHP code via the path parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23498; http://www.securityfocus.com/bid/21757; http://www.vupen.com/english/advisories/2006/5180
CVE: CVE-2006-6775
Published: 2006-12-27
Description: acFTP 1.5 allows remote authenticated users to cause a denial of service via a crafted argument to the (1) REST or (2) PBSZ command.
CVSS Score: 3.5 (LOW)
References: http://secunia.com/advisories/23481; http://www.securityfocus.com/bid/21767; http://www.vupen.com/english/advisories/2006/5149
CVE: CVE-2006-6776
Published: 2006-12-28
Description: Multiple SQL injection vulnerabilities in Future Internet allow remote attackers to execute arbitrary SQL commands via the (1) newsId or (2) categoryid parameter in a Portal.Showpage action in index.cfm, or (3) the langId parameter in index.cfm.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2061; http://www.securityfocus.com/archive/1/455206/100/0/threaded; http://www.securityfocus.com/bid/21727
CVE: CVE-2006-6777
Published: 2006-12-28
Description: Cross-site scripting (XSS) vulnerability in index.cfm in Future Internet allows remote attackers to inject arbitrary web script or HTML via the categoryId parameter in a Portal.ShowPage action.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2061; http://www.securityfocus.com/archive/1/455206/100/0/threaded; http://www.securityfocus.com/bid/21727
CVE: CVE-2006-6778
Published: 2006-12-28
Description: Cross-site scripting (XSS) vulnerability in shownews.php in TimberWolf 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the nid parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23494; http://securityreason.com/securityalert/2062; http://securitytracker.com/id?1017438
CVE: CVE-2006-6779
Published: 2006-12-28
Description: Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin allows remote attackers to inject arbitrary web script or HTML via an SWF file that uses ActionScript to trigger execution of JavaScript.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2084; http://www.securityfocus.com/archive/1/455265/100/0/threaded; http://www.securityfocus.com/archive/1/455351/100/0/threaded
CVE: CVE-2006-6780
Published: 2006-12-28
Description: SQL injection vulnerability in the login form in HLstats 1.20 through 1.34 allows remote attackers to execute arbitrary SQL commands via the killLimit parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23505; http://securityreason.com/securityalert/2064; http://www.securityfocus.com/archive/1/455305/100/0/threaded
CVE: CVE-2006-6781
Published: 2006-12-28
Description: HLstats 1.20 through 1.34 allows remote attackers to obtain sensitive information via playinfo mode, with certain values of the player and playerdata[lastName][] parameters, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/2064; http://www.securityfocus.com/archive/1/455305/100/0/threaded; http://www.securityfocus.com/bid/21740
CVE: CVE-2006-6782
Published: 2006-12-28
Description: Cross-site scripting (XSS) vulnerability in pnamazu 2006.02.28 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/23507; http://securitytracker.com/id?1017446
CVE: CVE-2006-6783
Published: 2006-12-28
Description: logahead UNU 1.0 before 20061226 allows remote attackers to upload arbitrary files via unspecified vectors related to plugins/widged/_widged.php (aka the WidgEd plugin), possibly because of an authentication bypass. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://logahead.com/forums/comments.php?DiscussionID=216; http://secunia.com/advisories/23470; http://securityreason.com/securityalert/2071
CVE: CVE-2006-6784
Published: 2006-12-28
Description: SQL injection vulnerability in Netbula Anyboard allows remote attackers to execute arbitrary SQL commands via the user name in the login form.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2063; http://www.securityfocus.com/archive/1/455263/100/0/threaded; http://www.securityfocus.com/bid/21734
CVE: CVE-2006-6785
Published: 2006-12-28
Description: The (1) settings.php and (2) subscribers.php scripts in Open Newsletter 2.5 and earlier do not exit when authentication fails, which allows remote attackers to perform unauthorized administrative actions, or execute arbitrary code in conjunction with another vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23476; http://www.securityfocus.com/bid/21775; https://www.exploit-db.com/exploits/2981
CVE: CVE-2006-6786
Published: 2006-12-28
Description: Open Newsletter 2.5 and earlier allows remote authenticated administrators to execute arbitrary PHP code by inserting the code into the email parameter to (1) subscribe.php or (2) unsubscribe.php.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/21775; https://www.exploit-db.com/exploits/2981; http://www.securityfocus.com/bid/21775
CVE: CVE-2006-6787
Published: 2006-12-28
Description: SQL injection vulnerability in admin/admin_mail_adressee.asp in Newsletter MX 1.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23510; http://www.securityfocus.com/bid/21746; http://www.vupen.com/english/advisories/2006/5175
CVE: CVE-2006-6788
Published: 2006-12-28
Description: Multiple PHP remote file inclusion vulnerabilities in LuckyBot 3 allow remote attackers to execute arbitrary PHP code via a URL in the dir parameter to (1) run.php or (2) ircbot.class.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2067; http://www.securityfocus.com/archive/1/455301/100/0/threaded; http://www.securityfocus.com/archive/1/470802/100/100/threaded
CVE: CVE-2006-6789
Published: 2006-12-28
Description: PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in Phpbbxtra 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23496; http://securityreason.com/securityalert/2065; http://securitytracker.com/id?1017443
CVE: CVE-2006-6790
Published: 2006-12-28
Description: Direct static code injection vulnerability in chat/login.php in Ultimate PHP Board (UPB) 2.0b1 and earlier allows remote attackers to inject arbitrary PHP code via the username parameter, which is injected into chat/text.php.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/21760; http://www.securityfocus.com/data/vulnerabilities/exploits/21760.pl; http://www.vupen.com/english/advisories/2006/5181
CVE: CVE-2006-6791
Published: 2006-12-28
Description: SQL injection vulnerability in SelGruFra.asp in chatwm 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) txtUse and (2) txtPas parameters.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2070; http://securitytracker.com/id?1017439; http://www.securityfocus.com/archive/1/455261/100/0/threaded
CVE: CVE-2006-6792
Published: 2006-12-28
Description: SQL injection vulnerability in calendar_detail.asp in Calendar MX BASIC 1.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23515; http://www.securityfocus.com/bid/21763; http://www.vupen.com/english/advisories/2006/5151
CVE: CVE-2006-6793
Published: 2006-12-28
Description: PHP remote file inclusion vulnerability in ataturk.php in Okul Merkezi Portal 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2069; http://www.securityfocus.com/archive/1/455259/100/0/threaded; http://www.securityfocus.com/bid/21730
CVE: CVE-2006-6794
Published: 2006-12-28
Description: SQL injection vulnerability in default.asp in Efkan Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the grup parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2066; http://www.securityfocus.com/archive/1/455205/100/0/threaded; http://www.securityfocus.com/bid/21726
CVE: CVE-2006-6795
Published: 2006-12-28
Description: PHP remote file inclusion vulnerability in gallery/displayCategory.php in the My_eGallery 2.5.6 module in myPHPNuke (MPN) allows remote attackers to execute arbitrary PHP code via a URL in the basepath parameter.
CVSS Score: 7.5 (HIGH)
References: http://cyber-security.org/DataDetayAll.asp?Data_id=586; http://www.securityfocus.com/bid/21744; https://exchange.xforce.ibmcloud.com/vulnerabilities/31136
CVE: CVE-2006-6796
Published: 2006-12-28
Description: PHP remote file inclusion vulnerability in admin/admin_settings.php in MTCMS 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ins_file parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23503; http://www.securityfocus.com/bid/21770; http://www.vupen.com/english/advisories/2006/5185
CVE: CVE-2006-6797
Published: 2006-12-28
Description: The Client Server Run-Time Subsystem (CSRSS) in Microsoft Windows allows local users to cause a denial of service (crash) or read arbitrary memory from csrss.exe via crafted arguments to the NtRaiseHardError function with status 0x50000018, a different vulnerability than CVE-2006-6696.
CVSS Score: 6.6 (MEDIUM)
References: http://secunia.com/advisories/23491; http://securityreason.com/securityalert/2086; http://securitytracker.com/id?1017454
CVE: CVE-2006-6318
Published: 2006-12-28
Description: The show_elog_list function in elogd.c in elog 2.6.2 and earlier allows remote authenticated users to cause a denial of service (daemon crash) by attempting to access a logbook whose name begins with "global," which results in a NULL pointer dereference.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0198.html; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=397875; http://secunia.com/advisories/22800
CVE: CVE-2006-6799
Published: 2006-12-28
Description: SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php.  NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23528; http://secunia.com/advisories/23665; http://secunia.com/advisories/23917
CVE: CVE-2006-6800
Published: 2006-12-28
Description: PHP remote file inclusion in eventcal/mod_eventcal.php in the event module 1.0 for Limbo CMS allows remote attackers to execute arbitrary PHP code via a URL in the lm_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23527; http://securityreason.com/securityalert/2059; http://securitytracker.com/id?1017452
CVE: CVE-2006-6801
Published: 2006-12-28
Description: PHP remote file inclusion vulnerability in misc.php in SH-News 0.93, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the news_cfg[path] parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23524; http://www.securityfocus.com/bid/21761; http://www.vupen.com/english/advisories/2006/5161
CVE: CVE-2006-6802
Published: 2006-12-28
Description: SQL injection vulnerability in actualpic.asp in Enthrallweb ePages allows remote attackers to execute arbitrary SQL commands via the Biz_ID parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23522; http://www.securityfocus.com/bid/21750; http://www.vupen.com/english/advisories/2006/5159
CVE: CVE-2006-6803
Published: 2006-12-28
Description: SQL injection vulnerability in Types.asp in Enthrallweb eCars 1.0 allows remote attackers to execute arbitrary SQL commands via the Type_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/31681; http://secunia.com/advisories/23566; http://www.securityfocus.com/bid/21748
CVE: CVE-2006-6804
Published: 2006-12-28
Description: SQL injection vulnerability in bus_details.asp in Dragon Business Directory - Pro (aka Dragon Internet Business Search Directory - Pro) 3.01.12 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23523; http://www.securityfocus.com/bid/21747; http://www.vupen.com/english/advisories/2006/5152
CVE: CVE-2006-6805
Published: 2006-12-28
Description: SQL injection vulnerability in newsdetail.asp in Enthrallweb eJobs allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23520; http://www.vupen.com/english/advisories/2006/5157; https://www.exploit-db.com/exploits/2988
CVE: CVE-2006-6806
Published: 2006-12-28
Description: SQL injection vulnerability in newsdetail.asp in Enthrallweb eMates 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23521; http://www.vupen.com/english/advisories/2006/5158; https://www.exploit-db.com/exploits/2990
CVE: CVE-2006-6807
Published: 2006-12-28
Description: SQL injection vulnerability in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the agent parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23506; http://www.securityfocus.com/bid/21771; http://www.vupen.com/english/advisories/2006/5179
CVE: CVE-2006-6808
Published: 2006-12-28
Description: Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter.  NOTE: some sources have reported this as a vulnerability in the get_file_description function in wp-admin/admin-functions.php.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1087&w=2; http://michaeldaw.org/; http://secunia.com/advisories/23587
CVE: CVE-2006-6809
Published: 2006-12-29
Description: Multiple PHP remote file inclusion vulnerabilities in process.php in Vladimir Menshakov buratinable templator (aka bubla) 1.0.0rc2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) bu_dir or (2) bu_config[dir] parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/21793; http://www.vupen.com/english/advisories/2006/5195; https://exchange.xforce.ibmcloud.com/vulnerabilities/31135
CVE: CVE-2006-6810
Published: 2006-12-29
Description: Unspecified vulnerability in the clear_user_list function in src/main.c in DB Hub 0.3 allows remote attackers to cause a denial of service (application crash) via crafted network traffic, which triggers memory corruption.
CVSS Score: 5.0 (MEDIUM)
References: http://dbhub.ir.pl/; http://mieszkancy.ds.pg.gda.pl/~centurion/darkbot/stat/click.php?id=22; http://secunia.com/advisories/23489
CVE: CVE-2006-6811
Published: 2006-12-29
Description: KsIRC 1.3.12 allows remote attackers to cause a denial of service (crash) via a long PRIVMSG string when connecting to an Internet Relay Chat (IRC) server, which causes an assertion failure and results in a NULL pointer dereference.  NOTE: this issue was originally reported as a buffer overflow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: http://osvdb.org/33443; http://security.gentoo.org/glsa/glsa-200701-26.xml; http://securitytracker.com/id?1017453
CVE: CVE-2006-6812
Published: 2006-12-29
Description: Multiple PHP remote file inclusion vulnerabilities in myPHPCalendar 10.1 allow remote attackers to execute arbitrary PHP code via a URL in the cal_dir parameter to (1) admin.php, (2) contacts.php, or (3) convert-date.php.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/21785; https://www.exploit-db.com/exploits/3019; http://www.securityfocus.com/bid/21785
CVE: CVE-2006-6813
Published: 2006-12-29
Description: SQL injection vulnerability in detail.asp in Mxmania File Upload Manager (FUM) 1.0.6 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23509; http://www.securityfocus.com/bid/21754; http://www.vupen.com/english/advisories/2006/5176
CVE: CVE-2006-6814
Published: 2006-12-29
Description: Directory traversal vulnerability in FolderManager/FolderManager.aspx in Hosting Controller 7c allows remote authenticated users to read and modify arbitrary files, and list arbitrary directories via ..\ (dot dot backslash) sequences in the BrowsePath parameter.
CVSS Score: 6.3 (MEDIUM)
References: http://secunia.com/advisories/23585; http://securitytracker.com/id?1017447; http://www.kapda.ir/advisory-458.html
CVE: CVE-2006-6815
Published: 2006-12-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in DMXReady Secure Login Manager 1.0 allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified parameters to (1) set_preferences.asp, (2) send_password_preferences.asp, and (3) SecureLoginManager/list.asp in the Local-Admin Panel.
CVSS Score: 6.0 (MEDIUM)
References: http://securitytracker.com/id?1017448; http://www.securityfocus.com/archive/1/455353/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/31157