deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-0604
Published: 2006-02-08
Description: check.php in Hinton Design phphg Guestbook 1.2 does not check the user password when authenticating via cookies, which allows remote attackers to gain unauthorized access.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/58/description.html; http://secunia.com/advisories/18758; http://securitytracker.com/id?1015620
CVE: CVE-2006-0605
Published: 2006-02-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in Unknown Domain Shoutbox 2005.07.21 allow remote attackers to inject arbitrary web script or HTML, possibly via the (1) Handle or (2) Message fields.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/55/summary.html; http://secunia.com/advisories/18759; http://www.securityfocus.com/archive/1/424679/100/0/threaded
CVE: CVE-2006-0606
Published: 2006-02-08
Description: SQL injection vulnerability in Unknown Domain Shoutbox 2005.07.21 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/55/summary.html; http://secunia.com/advisories/18759; http://www.securityfocus.com/archive/1/424679/100/0/threaded
CVE: CVE-2006-0607
Published: 2006-02-08
Description: check.php in Hinton Design phphd 1.0 does not check passwords when certain cookies are provided, which allows remote attackers to bypass authentication.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18793; http://www.evuln.com/vulns/60/summary.html; http://www.osvdb.org/23026
CVE: CVE-2006-0608
Published: 2006-02-08
Description: Multiple SQL injection vulnerabilities in Hinton Design phphd 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the username parameter to check.php or (2) unknown attack vectors to scripts that display information from the database.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18793; http://www.evuln.com/vulns/60/summary.html; http://www.osvdb.org/23025
CVE: CVE-2006-0609
Published: 2006-02-08
Description: Cross-site scripting (XSS) vulnerability in add.php in Hinton Design phphd 1.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18793; http://www.evuln.com/vulns/60/summary.html; http://www.osvdb.org/23027
CVE: CVE-2006-0610
Published: 2006-02-09
Description: Multiple SQL injection vulnerabilities in 2200net Calendar system 1.2, with gpc_magic_quotes disabled, allow remote attackers to execute arbitrary SQL commands and bypass authentication via (1) the fm_data[id] parameter to calendar.php and (2) the $ad['acc'] variable in adminlogin.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1861&w=2; http://secunia.com/advisories/18781; http://www.evuln.com/vulns/62/summary.html
CVE: CVE-2006-0611
Published: 2006-02-09
Description: Directory traversal vulnerability in compose.pl in @Mail 4.3 and earlier for Windows allows remote attackers to upload arbitrary files to arbitrary locations via a .. (dot dot) in the unique parameter.
CVSS Score: 7.5 (HIGH)
References: http://kb.atmail.com/view_article.php?num=374; http://secunia.com/advisories/18646; http://www.osvdb.org/22882
CVE: CVE-2006-0612
Published: 2006-02-09
Description: Powersave daemon before 0.10.15.2 allows local users to gain privileges (unauthorized access to an X session) via unspecified vectors. NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/18651; http://sourceforge.net/project/shownotes.php?release_id=379792&group_id=124576; http://www.securityfocus.com/bid/16469
CVE: CVE-2006-0613
Published: 2006-02-09
Description: Unspecified vulnerability in Java Web Start after 1.0.1_02, as used in J2SE 5.0 Update 5 and earlier, allows remote attackers to obtain privileges via unspecified vectors involving untrusted applications.
CVSS Score: 4.0 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=303658; http://secunia.com/advisories/18762; http://securitytracker.com/id?1015597
CVE: CVE-2006-0614
Published: 2006-02-09
Description: Unspecified vulnerability in Sun Java JDK and JRE 5.0 Update 3 and earlier, SDK and JRE 1.3.x through 1.3.1_16 and 1.4.x through 1.4.2_08 allows remote attackers to bypass Java sandbox security and obtain privileges via unspecified vectors involving the reflection APIs, aka the "first issue."
CVSS Score: 6.4 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=303658; http://secunia.com/advisories/18760; http://secunia.com/advisories/18884
CVE: CVE-2006-0615
Published: 2006-02-09
Description: Multiple unspecified vulnerabilities in Sun Java JDK and JRE 5.0 Update 4 and earlier, SDK and JRE 1.4.x through 1.4.2_09 allow remote attackers to bypass Java sandbox security and obtain privileges via unspecified vectors involving the reflection APIs, aka the "second and third issues."
CVSS Score: 4.0 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=303658; http://secunia.com/advisories/18760; http://secunia.com/advisories/18884
CVE: CVE-2006-0616
Published: 2006-02-09
Description: Unspecified vulnerability in Sun Java JDK and JRE 5.0 Update 4 and earlier allows remote attackers to bypass Java sandbox security and obtain privileges via unspecified vectors involving the reflection APIs, aka the "fourth issue."
CVSS Score: 4.0 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=303658; http://secunia.com/advisories/18760; http://secunia.com/advisories/18884
CVE: CVE-2006-0617
Published: 2006-02-09
Description: Multiple unspecified vulnerabilities in Sun Java JDK and JRE 5.0 Update 5 and earlier allow remote attackers to bypass Java sandbox security and obtain privileges via unspecified vectors involving the reflection APIs, aka the "fifth, sixth, and seventh issues."
CVSS Score: 4.0 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=303658; http://secunia.com/advisories/18760; http://secunia.com/advisories/18884
CVE: CVE-2006-0618
Published: 2006-02-09
Description: Format string vulnerability in fontsleuth in QNX Neutrino RTOS 6.3.0 allows local users to execute arbitrary code via format string specifiers in the zeroth argument (program name).
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/18750; http://securitytracker.com/id?1015599; http://www.idefense.com/intelligence/vulnerabilities/display.php?id=380
CVE: CVE-2006-0619
Published: 2006-02-09
Description: Multiple stack-based buffer overflows in QNX Neutrino RTOS 6.3.0 allow local users to execute arbitrary code via long (1) ABLPATH or (2) ABLANG environment variables in the libAP library (libAp.so.2) or (3) a long PHOTON_PATH environment variable to the setitem function in the libph library.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/18750; http://securitytracker.com/id?1015599; http://www.idefense.com/intelligence/vulnerabilities/display.php?id=381
CVE: CVE-2006-0620
Published: 2006-02-09
Description: Race condition in phfont in QNX Neutrino RTOS 6.2.1 allows local users to execute arbitrary code via unspecified manipulations of the PHFONT and PHOTON2_PATH environment variables.
CVSS Score: 6.2 (MEDIUM)
References: http://secunia.com/advisories/18750; http://securitytracker.com/id?1015599; http://www.idefense.com/intelligence/vulnerabilities/display.php?id=383
CVE: CVE-2006-0621
Published: 2006-02-09
Description: Multiple buffer overflows in QNX Neutrino RTOS 6.2.0 allow local users to execute arbitrary code via a long first argument to the (1) su or (2) passwd commands.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/18750; http://securitytracker.com/id?1015599; http://www.idefense.com/intelligence/vulnerabilities/display.php?id=385
CVE: CVE-2006-0622
Published: 2006-02-09
Description: QNX Neutrino RTOS 6.3.0 allows local users to cause a denial of service (hang) by supplying a "break *0xb032d59f" command to gdb.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/18750; http://securitytracker.com/id?1015598; http://www.idefense.com/intelligence/vulnerabilities/display.php?id=386
CVE: CVE-2006-0623
Published: 2006-02-09
Description: QNX Neutrino RTOS 6.3.0 ships /etc/rc.d/rc.local with world-writable permissions, which allows local users to modify the file and execute arbitrary code at system startup.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/18750; http://securitytracker.com/id?1015598; http://www.idefense.com/intelligence/vulnerabilities/display.php?id=387
CVE: CVE-2006-0624
Published: 2006-02-09
Description: SQL injection vulnerability in check.asp in Whomp Real Estate Manager XP 2005 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18780; http://securityreason.com/securityalert/418; http://www.osvdb.org/22969
CVE: CVE-2006-0625
Published: 2006-02-09
Description: Directory traversal vulnerability in Spip_RSS.PHP in SPIP 1.8.2g and earlier allows remote attackers to read or include arbitrary files via ".."  sequences in the GLOBALS[type_urls] parameter, which could then be used to execute arbitrary code via resultant direct static code injection in the file parameter to spip_acces_doc.php3.
CVSS Score: 6.4 (MEDIUM)
References: http://retrogod.altervista.org/spip_182g_shell_inj_xpl.html; http://secunia.com/advisories/18676; http://securitytracker.com/id?1015602
CVE: CVE-2006-0626
Published: 2006-02-09
Description: SQL injection vulnerability in spip_acces_doc.php3 in SPIP 1.8.2g and earlier allows remote attackers to execute arbitrary SQL commands via the file parameter.
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/spip_182g_shell_inj_xpl.html; http://secunia.com/advisories/18676; http://securitytracker.com/id?1015602
CVE: CVE-2006-0627
Published: 2006-02-09
Description: Cross-site scripting (XSS) vulnerability in Clever Copy 2.0, 2.0a, and 3.0 allows remote attackers to inject arbitrary web script or HTML via the (1) Referer or (2) X-Forwarded-For headers in an HTTP request, which are not properly handled when the administrator accesses Site Stats.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18790; http://www.evuln.com/vulns/64/summary.html; http://www.securityfocus.com/archive/1/424831/100/0/threaded
CVE: CVE-2006-0628
Published: 2006-02-10
Description: myquiz.pl in Dale Ray MyQuiz 1.01 allows remote attackers to execute arbitrary commands via shell metacharacters in the URL, which are not properly handled as part of the PATH_INFO environment variable.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2006-February/000537.html; http://secunia.com/advisories/18737; http://securityreason.com/securityalert/409
CVE: CVE-2006-0629
Published: 2006-02-10
Description: Unspecified vulnerability in AOL Instant Messenger (AIM) 5.9.3861 allows user-assisted remote attackers to cause a denial of service (client crash) and possibly execute arbitrary code by tricking the user into requesting Buddy Info about a long screen name, which might cause a buffer overflow.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0948.html; http://www.securityfocus.com/archive/1/423906/100/0/threaded; http://www.securityfocus.com/archive/1/423920/100/0/threaded
CVE: CVE-2006-0630
Published: 2006-02-10
Description: RITLabs The Bat! before 3.0.0.15 displays certain important headers from encapsulated data in message/partial MIME messages, instead of the real headers, which is in violation of RFC2046 header merging rules and allows remote attackers to spoof the origin of e-mail by sending a fragmented message, as demonstrated using spoofed Received: and Message-ID: headers.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041973.html; http://secunia.com/advisories/18713; http://www.security.nnov.ru/advisories/thebatspoof.asp
CVE: CVE-2006-0631
Published: 2006-02-10
Description: CRLF injection vulnerability in mailback.pl in Erik C. Thauvin mailback allows remote attackers to use mailback as a "spam proxy" by modifying mail headers, including recipient e-mail addresses, via newline characters in the Subject field.
CVSS Score: 5.0 (MEDIUM)
References: http://seclists.org/lists/bugtraq/2006/Feb/0094.html; http://seclists.org/lists/bugtraq/2006/Feb/0154.html; http://secunia.com/advisories/18748
CVE: CVE-2006-0632
Published: 2006-02-10
Description: The gen_rand_string function in phpBB 2.0.19 uses insufficiently random data (small value space) to create the activation key ("validation ID") that is sent by e-mail when establishing a password, which makes it easier for remote attackers to obtain the key and modify passwords for existing accounts or create new accounts.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/18727; http://www.osvdb.org/22949; http://www.r-security.net/tutorials/view/readtutorial.php?id=4
CVE: CVE-2006-0633
Published: 2006-02-10
Description: The make_password function in ipsclass.php in Invision Power Board (IPB) 2.1.4 uses random data generated from partially predictable seeds to create the authentication code that is sent by e-mail to a user with a lost password, which might make it easier for remote attackers to guess the code and change the password for an IPB account, possibly involving millions of requests.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://forums.invisionpower.com/lofiversion/index.php/t200085.html; http://www.r-security.net/tutorials/view/readtutorial.php?id=4; http://forums.invisionpower.com/lofiversion/index.php/t200085.html
CVE: CVE-2006-0634
Published: 2006-02-10
Description: Borland C++Builder 6 (BCB6) with Update Pack 4 Enterprise edition (ent_upd4) evaluates the "i>sizeof(int)" expression to false when i equals -1, which might introduce integer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.
CVSS Score: 4.6 (MEDIUM)
References: http://securitytracker.com/id?1015588; http://www.osvdb.org/22953; http://www.securityfocus.com/archive/1/424085/100/0/threaded
CVE: CVE-2006-0635
Published: 2006-02-10
Description: Tiny C Compiler (TCC) 0.9.23 (aka TinyCC) evaluates the "i>sizeof(int)" expression to false when i equals -1, which might introduce integer overflow vulnerabilities into applications that could be exploited by context-dependent attackers.
CVSS Score: 4.6 (MEDIUM)
References: http://www.osvdb.org/22956; http://www.securityfocus.com/archive/1/424257/100/0/threaded; http://www.osvdb.org/22956
CVE: CVE-2006-0636
Published: 2006-02-10
Description: desktop.php in eyeOS 0.8.9 and earlier tests for the existence of the _SESSION variable before calling the session_start function, which allows remote attackers to execute arbitrary PHP code and possibly conduct other attacks by modifying critical assumed-immutable variables, as demonstrated using PHP code in the _SESSION[apps][eyeOptions.eyeapp][wrapup] variable.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18757; http://securityreason.com/securityalert/419; http://securitytracker.com/id?1015609
CVE: CVE-2006-0637
Published: 2006-02-10
Description: Buffer overflow in cram.dll in QUALCOMM Eudora WorldMail 3.0 allows remote attackers to execute arbitrary code via an IMAP APPEND command with a long message literal argument, as demonstrated by Worldmail.pl. NOTE: this is a different vector and a different manipulation than CVE-2005-4267, so it might be a different vulnerability than CVE-2005-4267.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/424157/100/0/threaded; http://www.securityfocus.com/archive/1/424157/100/0/threaded
CVE: CVE-2006-0638
Published: 2006-02-10
Description: SQL injection vulnerability in moderation.php in MyBB (aka MyBulletinBoard) 1.0.3 allows remote authenticated users, with certain privileges for moderating and merging posts, to execute arbitrary SQL commands via the posts parameter.
CVSS Score: 6.5 (MEDIUM)
References: http://myimei.com/security/2006-02-07/mybb103moderationphpsqlinject-while-merging-posts.html; http://secunia.com/advisories/18754; http://www.osvdb.org/22957
CVE: CVE-2006-0639
Published: 2006-02-10
Description: Cross-site scripting (XSS) vulnerability in search.php in MyBB (aka MyBulletinBoard) 1.0.2 allows remote attackers with knowledge of the table prefix to inject arbitrary web script or HTML via a URL encoded value of the keywords parameter, as demonstrated by %3Cscript%3E.
CVSS Score: 4.3 (MEDIUM)
References: http://myimei.com/security/2006-01-14/mybb-102searchphpxss-attackandmore.html; http://www.securityfocus.com/archive/1/424334/100/0/threaded; http://www.securityfocus.com/archive/1/424375/100/0/threaded
CVE: CVE-2006-0640
Published: 2006-02-10
Description: Orbicule Undercover allows attackers with physical or root access to disable the protection by using the chmod command to change the permissions of the /private/etc/uc.app/Contents/MacOS/uc file, which prevents the service from being started in LaunchDaemon.
CVSS Score: 2.1 (LOW)
References: http://www.securityfocus.com/archive/1/423955/100/0/threaded; http://www.securityfocus.com/archive/1/423955/100/0/threaded
CVE: CVE-2006-0641
Published: 2006-02-10
Description: Orbicule Undercover uses a third-party web server to determine the IP address through which the computer is accessing the Internet, but does not document this third-party disclosure, which leads to a potential privacy leak that might allow transmission of sensitive information to an unintended remote destination.
CVSS Score: 2.6 (LOW)
References: http://www.securityfocus.com/archive/1/423955/100/0/threaded; http://www.securityfocus.com/archive/1/423955/100/0/threaded
CVE: CVE-2006-0642
Published: 2006-02-10
Description: Trend Micro ServerProtect 5.58, and possibly InterScan Messaging Security Suite and InterScan Web Security Suite, have a default configuration setting of "Do not scan compressed files when Extracted file count exceeds 500 files," which may be too low in certain circumstances, which allows remote attackers to bypass anti-virus checks by sending compressed archives containing many small files. NOTE: since this is related to a configuration setting that has an operational impact that might vary depending on the environment, and the product is claimed to report a message when the compressed file exceeds specified limits, perhaps this should not be included in CVE.
CVSS Score: 5.1 (MEDIUM)
References: http://www.packetstormsecurity.org/0602-advisories/Bypass.pdf; http://www.packetstormsecurity.org/filedesc/Bypass.pdf.html; http://www.securityfocus.com/archive/1/423896/100/0/threaded
CVE: CVE-2006-0643
Published: 2006-02-10
Description: Cross-site scripting (XSS) vulnerability in WiredRed e/pop Web Conferencing 4.1.0.755 allows remote authenticated users to inject arbitrary web script or HTML via the topic name of a conference.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18753; http://securityreason.com/securityalert/421; http://www.osvdb.org/22997
CVE: CVE-2006-0644
Published: 2006-02-10
Description: Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS (aka CPG Dragonfly CMS) 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in (1) the newlang parameter and (2) the installlang parameter in a cookie, as demonstrated by using error.php to insert malicious code into a log file, or uploading a malicious .png file, which is then included using install.php.
CVSS Score: 7.5 (HIGH)
References: http://dragonflycms.org/Forums/viewtopic/p=98034.html; http://dragonflycms.org/Forums/viewtopic/p=98034.html#98034; http://retrogod.altervista.org/dragonfly9.0.6.1_incl_xpl.html
CVE: CVE-2006-0645
Published: 2006-02-10
Description: Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via "out-of-bounds access" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.
CVSS Score: 7.5 (HIGH)
References: http://josefsson.org/cgi-bin/viewcvs.cgi/gnutls/tests/certder.c?view=markup; http://josefsson.org/cgi-bin/viewcvs.cgi/libtasn1/NEWS?root=gnupg-mirror&view=markup; http://josefsson.org/gnutls/releases/libtasn1/libtasn1-0.2.18-from-0.2.17.patch
CVE: CVE-2006-0646
Published: 2006-02-11
Description: ld in SUSE Linux 9.1 through 10.0, and SLES 9, in certain circumstances when linking binaries, can leave an empty RPATH or RUNPATH, which allows local attackers to execute arbitrary code as other users via by running an ld-linked application from the current directory, which could contain an attacker-controlled library file.
CVSS Score: 4.4 (MEDIUM)
References: http://lists.suse.com/archive/suse-security-announce/2006-Feb/0003.html; http://secunia.com/advisories/18811; http://www.securityfocus.com/bid/16581
CVE: CVE-2006-0046
Published: 2006-02-13
Description: squid_redirect script in adzapper before 2006-01-29 allows remote attackers to cause a denial of service (CPU consumption) via a URL with a large number of trailing / (forward slashes), which might produce inefficient regular expressions.
CVSS Score: 7.8 (HIGH)
References: http://adzapper.sourceforge.net/cvslog.html; http://bugs.debian.org/cgi-bin/bugreport.cgi/squid_redirect.diff?bug=350308%3Bmsg=5%3Batt=1; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350308
CVE: CVE-2006-0056
Published: 2006-02-13
Description: Double free vulnerability in the authentication and authentication token alteration code in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords, which lead to a double free of a pointer that was created by the pam_get_item function.  NOTE: this issue only occurs in certain configurations in which there are multiple PAM modules, PAM-MySQL is not evaluated first, and there are no requisite modules before PAM-MySQL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://jvn.jp/cert/JVNVU%23693909/index.html; http://secunia.com/advisories/18598; http://secunia.com/advisories/20690
CVE: CVE-2006-0597
Published: 2006-02-13
Description: Multiple stack-based buffer overflows in elogd.c in elog before 2.5.7 r1558-4 allow attackers to cause a denial of service (application crash) and possibly execute code via long "revision attributes".
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi/0001-r1333-Fixed-crashes-with-very-long-revisions-attributes.txt?bug=349528%3Bmsg=15%3Batt=1; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349528; http://secunia.com/advisories/18783
CVE: CVE-2006-0598
Published: 2006-02-13
Description: Buffer overflow in elogd.c in elog before 2.5.7 r1558-4 allows attackers to execute code via unspecified variables, when writing to the log file.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi/0002-r1335-Applied-patch-from-Emiliano-to-fix-possible-buffer-overflow.txt?bug=349528%3Bmsg=15%3Batt=2; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349528; http://secunia.com/advisories/18783
CVE: CVE-2006-0599
Published: 2006-02-13
Description: The (1) elog.c and (2) elogd.c components in elog before 2.5.7 r1558-4 generate different responses depending on whether or not a username is valid, which allows remote attackers to determine valid usernames.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi/0003-r1472-Do-not-distinguish-between-invalid-user-name-and-invalid-password.txt?bug=349528%3Bmsg=15%3Batt=3; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349528; http://secunia.com/advisories/18783