deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-4076
Published: 2006-08-11
Description: Multiple PHP remote file inclusion vulnerabilities in Wim Fleischhauer docpile: wim's edition (docpile:we) 0.2.2 allow remote attackers to execute arbitrary PHP code via a URL in the INIT_PATH parameter to (1) lib/access.inc.php, (2) lib/folders.inc.php, (3) lib/init.inc.php or (4) lib/templates.inc.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21412; http://www.osvdb.org/27863; http://www.osvdb.org/27864
CVE: CVE-2006-4077
Published: 2006-08-11
Description: PHP remote file inclusion vulnerability in CheckUpload.php in Vincenzo Valvano Comet WebFileManager (CWFM) 0.9.1, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the Language parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21432; http://www.bb-pcsecurity.de/Websecurity/301/org/Cwfm-0.9.1_%28Language%29_Remote_File_Inclusion.htm; http://www.securityfocus.com/archive/1/442714/100/0/threaded
CVE: CVE-2006-4078
Published: 2006-08-11
Description: pm.php (aka the PM system) in DeluxeBB 1.08, and possibly earlier, allows remote attackers to bypass authentication by providing an arbitrary username in the membercookie cookie parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21387; http://securityreason.com/securityalert/1381; http://www.osvdb.org/27834
CVE: CVE-2006-4079
Published: 2006-08-11
Description: Cross-site scripting (XSS) vulnerability in newpost.php in DeluxeBB 1.08, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the subject parameter (aka the topic title field).
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1381; http://www.osvdb.org/27833; http://www.securityfocus.com/archive/1/442464/100/0/threaded
CVE: CVE-2006-4080
Published: 2006-08-11
Description: DeluxeBB 1.08, and possibly earlier, uses cookies that include the MD5 hash of a password, which allows remote attackers to gain privileges by sniffing or cross-site scripting (XSS) and conduct password guessing attacks.
CVSS Score: 2.6 (LOW)
References: http://securityreason.com/securityalert/1381; http://www.securityfocus.com/archive/1/442464/100/0/threaded; http://securityreason.com/securityalert/1381
CVE: CVE-2006-3817
Published: 2006-08-11
Description: Cross-site scripting (XSS) vulnerability in Novell GroupWise WebAccess 6.5 and 7 before 20060727 allows remote attackers to inject arbitrary web script or HTML via an encoded SCRIPT element in an e-mail message with the UTF-7 character set, as demonstrated by the "+ADw-SCRIPT+AD4-" sequence.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048593.html; http://secunia.com/advisories/21411; http://securitytracker.com/id?1016648
CVE: CVE-2006-3818
Published: 2006-08-11
Description: Cross-site scripting (XSS) vulnerability in the login page in Novell GroupWise WebAccess 6.5 before 20060721 and WebAccess 7 before 20060727 allows remote attackers to inject arbitrary web script or HTML via the GWAP.version parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21411; http://securitytracker.com/id?1016648; http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974176.htm
CVE: CVE-2006-4081
Published: 2006-08-11
Description: preview_email.cgi in Barracuda Spam Firewall (BSF) 3.3.01.001 through 3.3.03.053 allows remote attackers to execute commands via shell metacharacters ("|" pipe symbol) in the file parameter.  NOTE: the attack can be extended to arbitrary commands by the presence of CVE-2006-4000.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0110.html; http://secunia.com/advisories/21258; http://securityreason.com/securityalert/1363
CVE: CVE-2006-4082
Published: 2006-08-11
Description: Barracuda Spam Firewall (BSF), possibly 3.3.03.053, contains a hardcoded password for the admin account for logins from 127.0.0.1 (localhost), which allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0110.html; http://secunia.com/advisories/21258; http://securityreason.com/securityalert/1363
CVE: CVE-2006-4083
Published: 2006-08-11
Description: PHP remote file inclusion vulnerability in viewevent.php in myWebland myEvent 1.x allows remote attackers to execute arbitrary PHP code via a URL in the myevent_path parameter, a different vector than CVE-2006-4040.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19680; http://www.vupen.com/english/advisories/2006/1384; https://exchange.xforce.ibmcloud.com/vulnerabilities/28347
CVE: CVE-2006-4084
Published: 2006-08-11
Description: Unspecified vulnerability in phpAutoMembersArea (phpAMA) before 3.2.4 has unknown impact and attack vectors, related to "a potential security exploit which is critical."
CVSS Score: 10.0 (HIGH)
References: http://dwalker.co.uk/forum/viewtopic.php?t=516; http://dwalker.co.uk/forum/viewtopic.php?t=516
CVE: CVE-2006-4085
Published: 2006-08-11
Description: PHP remote file inclusion vulnerability in Olaf Noehring The Search Engine Project (TSEP) 0.942 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the tsep_config[absPath] parameter to pagenavigation.php, a different vector than CVE-2006-4055.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21291; https://exchange.xforce.ibmcloud.com/vulnerabilities/28107; http://secunia.com/advisories/21291
CVE: CVE-2006-4086
Published: 2006-08-11
Description: Cross-site scripting (XSS) vulnerability in index.php in Elaine Aquino Online Zone Journals (OZJournals) 1.5 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21311; http://www.vupen.com/english/advisories/2006/3142; http://secunia.com/advisories/21311
CVE: CVE-2006-4087
Published: 2006-08-11
Description: Cross-site scripting (XSS) vulnerability in admin.cgi in mojoscripts.com mojoGallery allows remote attackers to inject arbitrary web script or HTML via the username parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21438; http://www.vupen.com/english/advisories/2006/3220; https://exchange.xforce.ibmcloud.com/vulnerabilities/28293
CVE: CVE-2006-4088
Published: 2006-08-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in CivicSpace 0.8.5 allow remote attackers to inject arbitrary web script or HTML via the (1) Subject, (2) Comment, and (3) Add new comment sections.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1357; http://www.securityfocus.com/archive/1/442704/100/0/threaded; http://www.securityfocus.com/bid/19438
CVE: CVE-2006-4089
Published: 2006-08-11
Description: Multiple buffer overflows in Andy Lo-A-Foe AlsaPlayer 0.99.76 and earlier allow remote attackers to cause a denial of service (application crash), or have other unknown impact, via (1) a long Location field sent by a web server, which triggers an overflow in the reconnect function in reader/http/http.c; (2) a long URL sent by a web server when AlsaPlayer is seeking a media file for the playlist, which triggers overflows in new_list_item and CbUpdated in interface/gtk/PlaylistWindow.cpp; and (3) a long response sent by a CDDB server, which triggers an overflow in cddb_lookup in input/ccda/cdda_engine.c.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/alsapbof-adv.txt; http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0249.html; http://secunia.com/advisories/21422
CVE: CVE-2006-4090
Published: 2006-08-11
Description: Cross-site scripting (XSS) vulnerability in Webligo BlogHoster 2.2 allows remote attackers to inject arbitrary web script or HTML via the "From: part of the comment post," probably involving the nickname parameter to previewcomment.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21420; http://securityreason.com/securityalert/1359; http://www.osvdb.org/27886
CVE: CVE-2006-4091
Published: 2006-08-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in Archangel Management Archangel Weblog 0.90.02 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Comment section.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1360; http://securitytracker.com/id?1016670; http://www.securityfocus.com/archive/1/442580/100/0/threaded
CVE: CVE-2006-4092
Published: 2006-08-11
Description: Simpliciti Locked Browser does not properly limit a user's actions to ones within the intended Internet Explorer environment, which allows local users to perform unauthorized actions by visiting a web site that executes a JavaScript window.blur loop to remove focus from the browser window, then pressing CTRL-SHIFT-ESC to invoke the Task Manager.
CVSS Score: 3.6 (LOW)
References: http://secunia.com/advisories/21321; http://securityreason.com/securityalert/1365; http://www.securityfocus.com/archive/1/442058/100/100/threaded
CVE: CVE-2006-3813
Published: 2006-08-11
Description: A regression error in the Perl package for Red Hat Enterprise Linux 4 omits the patch for CVE-2005-0155, which allows local users to overwrite arbitrary files with debugging information.
CVSS Score: 2.1 (LOW)
References: http://rhn.redhat.com/errata/RHSA-2006-0605.html; http://secunia.com/advisories/21646; http://support.avaya.com/elmodocs2/security/ASA-2006-163.htm
CVE: CVE-2006-4019
Published: 2006-08-11
Description: Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.
CVSS Score: 6.4 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc; http://attrition.org/pipermail/vim/2006-August/000970.html; http://docs.info.apple.com/article.html?artnum=306172
CVE: CVE-2006-1168
Published: 2006-08-14
Description: The decompress function in compress42.c in (1) ncompress 4.2.4 and (2) liblzw allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code, via crafted data that leads to a buffer underflow.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc; http://bugs.gentoo.org/show_bug.cgi?id=141728; http://downloads.avaya.com/css/P8/documents/100158840
CVE: CVE-2006-4102
Published: 2006-08-14
Description: PHP remote file inclusion vulnerability in tpl.inc.php in Falko Timme and Till Brehm SQLiteWebAdmin 0.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the conf[classpath] parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/3195; https://exchange.xforce.ibmcloud.com/vulnerabilities/28249; https://www.exploit-db.com/exploits/2123
CVE: CVE-2006-4103
Published: 2006-08-14
Description: PHP remote file inclusion vulnerability in article-raw.php in Jason Alexander phNNTP 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the file_newsportal parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21407; http://securityreason.com/securityalert/1373; http://securitytracker.com/id?1016668
CVE: CVE-2006-4104
Published: 2006-08-14
Description: Cross-site scripting (XSS) vulnerability in admin.cgi in mojoscripts.com mojoGallery allows remote attackers to inject arbitrary web script or HTML via "password input."
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21438; http://securityreason.com/securityalert/1374; http://www.securityfocus.com/archive/1/442596
CVE: CVE-2006-4105
Published: 2006-08-14
Description: Cross-site scripting (XSS) vulnerability in Fill Threads Database (FTD) 3.7.3 allows remote attackers to inject arbitrary web script or HTML via the (1) search field or (2) an e-mail message.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1371; http://securitytracker.com/id?1016642; http://www.securityfocus.com/archive/1/442419/100/0/threaded
CVE: CVE-2006-4106
Published: 2006-08-14
Description: Cross-site scripting (XSS) vulnerability in blursoft blur6ex 0.3 allows remote attackers to inject arbitrary web script or HTML via a comment title.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1372; http://www.securityfocus.com/archive/1/442435/100/0/threaded; http://www.securityfocus.com/bid/19392
CVE: CVE-2006-4107
Published: 2006-08-14
Description: SQL injection vulnerability in the Job Search module (job.module) 4.6 before revision 1.3.2.1 in Drupal allows remote attackers to execute arbitrary SQL commands via a job or resume search.
CVSS Score: 7.5 (HIGH)
References: http://drupal.org/node/77537; http://secunia.com/advisories/21380; http://www.securityfocus.com/bid/19420
CVE: CVE-2006-4108
Published: 2006-08-14
Description: SQL injection vulnerability in Bibliography (biblio.module) 4.6 before revision 1.1.1.1.4.11 and 4.7 before revision 1.13.2.5 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://drupal.org/node/77756; http://secunia.com/advisories/21435; http://www.securityfocus.com/bid/19441
CVE: CVE-2006-4109
Published: 2006-08-14
Description: Cross-site scripting (XSS) vulnerability in Bibliography (biblio.module) 4.6 before revision 1.1.1.1.4.11 and 4.7 before revision 1.13.2.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://drupal.org/node/77756; http://secunia.com/advisories/21435; http://www.securityfocus.com/bid/19441
CVE: CVE-2006-4110
Published: 2006-08-14
Description: Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase (or alternate case) characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file systems.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21490; http://securityreason.com/securityalert/1370; http://www.osvdb.org/27913
CVE: CVE-2006-4111
Published: 2006-08-14
Description: Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://blog.koehntopp.de/archives/1367-Ruby-On-Rails-Mandatory-Mystery-Patch.html; http://secunia.com/advisories/21466; http://secunia.com/advisories/21749
CVE: CVE-2006-4112
Published: 2006-08-14
Description: Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or "data loss," a different vulnerability than CVE-2006-4111.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21424; http://secunia.com/advisories/21466; http://secunia.com/advisories/21749
CVE: CVE-2006-4113
Published: 2006-08-14
Description: PHP remote file inclusion vulnerability in genpage-cgi.php in Brian Fraval hitweb 4.2 and possibly earlier versions allows remote attackers to execute arbitrary PHP code via the REP_INC parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21430; http://www.osvdb.org/27880; http://www.securityfocus.com/bid/19436
CVE: CVE-2006-4114
Published: 2006-08-14
Description: SQL injection vulnerability in view_com.php in Nicolas Grandjean PHPMyRing 4.2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the idsite parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-08/0184.html; http://secunia.com/advisories/21451; http://securitytracker.com/id?1016686
CVE: CVE-2006-4115
Published: 2006-08-14
Description: PHP remote file inclusion vulnerability in common.inc.php in PgMarket 2.2.3, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the CFG[libdir] parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://securityreason.com/securityalert/1375; http://www.securityfocus.com/archive/1/442684/100/0/threaded; http://www.securityfocus.com/bid/19439
CVE: CVE-2006-4116
Published: 2006-08-14
Description: Multiple stack-based buffer overflows in Lhaz before 1.32 allow user-assisted attackers to execute arbitrary code via a long filename in (1) an LHZ archive, when saving the filename during extraction; and (2) an LHZ archive with an invalid CRC checksum, when constructing an error message.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21348; http://securityreason.com/securityalert/1378; http://vuln.sg/lhaz131-en.html
CVE: CVE-2006-4117
Published: 2006-08-14
Description: The squeue_drain function in Sun Solaris 10, possibly only when run on CMT processors, allows remote attackers to cause a denial of service ("bad trap" and system panic) by opening and closing a large number of TCP connections ("heavy TCP/IP loads").  NOTE: the original report specifies the function name as "drain_squeue," but this is likely incorrect.
CVSS Score: 5.4 (MEDIUM)
References: http://secunia.com/advisories/21453; http://securitytracker.com/id?1016674; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102554-1
CVE: CVE-2006-4118
Published: 2006-08-14
Description: Multiple SQL injection vulnerabilities in GeheimChaos 0.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) Temp_entered_login or (2) Temp_entered_email parameters to (a) gc.php, and in multiple parameters in (b) include/registrieren.php, possibly involving the (3) $form_email, (4) $form_vorname, (5) $form_nachname, (6) $form_strasse, (7) $form_plzort, (8) $form_land, (9) $form_homepage, (10) $form_bildpfad, (11) $form_profilsichtbar, (12) $Temp_sprache, (13) $form_tag, (14) $form_monat, (15) $form_jahr, (16) $Temp_akt_string, (17) $form_icq, (18) $form_msn, (19) $form_yahoo, (20) $form_username, and (21) $Temp_form_pass variables.
CVSS Score: 5.1 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]4573&w=2; http://secunia.com/advisories/21355; http://securityreason.com/securityalert/1376
CVE: CVE-2006-4119
Published: 2006-08-14
Description: SQL injection vulnerability in gc.php in GeheimChaos 0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the Temp_entered_password parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21355; https://exchange.xforce.ibmcloud.com/vulnerabilities/28221; http://secunia.com/advisories/21355
CVE: CVE-2006-4120
Published: 2006-08-14
Description: Cross-site scripting (XSS) vulnerability in the Recipe module (recipe.module) before 1.54 for Drupal 4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.1 (MEDIUM)
References: http://drupal.org/node/77538; http://drupal.org/node/77753; http://secunia.com/advisories/21381
CVE: CVE-2006-4121
Published: 2006-08-14
Description: PHP remote file inclusion vulnerability in owimg.php3 in See-Commerce 1.0.625 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21460; http://www.securityfocus.com/bid/19443; http://www.vupen.com/english/advisories/2006/3233
CVE: CVE-2006-4122
Published: 2006-08-14
Description: Simple one-file guestbook 1.0 and earlier allows remote attackers to bypass authentication and delete guestbook entries via a modified id parameter to guestbook.php.
CVSS Score: 7.5 (HIGH)
References: http://it.security.netsons.org/exploit/simplegb.txt; http://secunia.com/advisories/21429; http://www.securityfocus.com/archive/1/442884/100/0/threaded
CVE: CVE-2006-4123
Published: 2006-08-14
Description: PHP remote file inclusion vulnerability in boitenews4/index.php in Boite de News 4.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the url_index parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19440; https://exchange.xforce.ibmcloud.com/vulnerabilities/28297; https://www.exploit-db.com/exploits/2153
CVE: CVE-2006-4124
Published: 2006-08-14
Description: The libXm library in LessTif 0.95.0 and earlier allows local users to gain privileges via the DEBUG_FILE environment variable, which is used to create world-writable files when libXm is run from a setuid program.
CVSS Score: 4.6 (MEDIUM)
References: http://karol.wiesek.pl/files/lesstif-advisory.pdf; http://secunia.com/advisories/21428; http://www.securityfocus.com/bid/19430
CVE: CVE-2006-4125
Published: 2006-08-14
Description: Stack-based buffer overflow in main.c in DConnect Daemon 0.7.0 and earlier allows remote attackers to execute arbitrary code via a large nickname, which is not properly handled by the listen_thread_udp function.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21384; http://securityreason.com/securityalert/1377; http://securitytracker.com/id?1016641
CVE: CVE-2006-4126
Published: 2006-08-14
Description: The dc_chat function in cmd.dc.c in DConnect Daemon 0.7.0 and earlier allows remote attackers to cause a denial of service (application crash) by sending a client message before providing the nickname, which triggers a null pointer dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21384; http://securityreason.com/securityalert/1377; http://securitytracker.com/id?1016641
CVE: CVE-2006-4127
Published: 2006-08-14
Description: Multiple format string vulnerabilities in DConnect Daemon 0.7.0 and earlier allow remote administrators to execute arbitrary code via format string specifiers that are not properly handled when calling the (1) privmsg() or (2) pubmsg functions from (a) cmd.user.c, (b) penalties.c, or (c) cmd.dc.c.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/21384; http://securityreason.com/securityalert/1377; http://securitytracker.com/id?1016641
CVE: CVE-2006-4128
Published: 2006-08-14
Description: Multiple heap-based buffer overflows in Symantec VERITAS Backup Exec for Netware Server Remote Agent for Windows Server 9.1 and 9.2 (all builds), Backup Exec Continuous Protection Server Remote Agent for Windows Server 10.1 (builds 10.1.325.6301, 10.1.326.1401, 10.1.326.2501, 10.1.326.3301, and 10.1.327.401), and Backup Exec for Windows Server and Remote Agent 9.1 (build 9.1.4691), 10.0 (builds 10.0.5484 and 10.0.5520), and 10.1 (build 10.1.5629) allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted RPC message.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/21472; http://securityreason.com/securityalert/1380; http://securityresponse.symantec.com/avcenter/security/Content/2006.08.11.html
CVE: CVE-2006-4129
Published: 2006-08-14
Description: PHP remote file inclusion vulnerability in admin.webring.docs.php in the Webring Component (com_webring) 1.0 and earlier for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the component_dir parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21495; http://www.securityfocus.com/archive/1/443211/100/0/threaded; http://www.securityfocus.com/bid/19492