deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3830
Published: 2006-07-25
Description: The Languages selection in the admin interface in Kailash Nadh boastMachine (formerly bMachine) 3.1 and earlier allows remote authenticated administrators to upload files with arbitrary extensions to the bmc/Inc/Lang directory.  NOTE: because the uploaded files cannot be accessed through HTTP, this issue is a vulnerability only if there is a likely usage pattern in which the files would be opened or executed by local users, e.g., malware files with names that entice local users to open the files.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/21066; http://www.acid-root.new.fr/advisories/boastmachine.txt; http://secunia.com/advisories/21066
CVE: CVE-2006-3831
Published: 2006-07-25
Description: The Backup selection in Kailash Nadh boastMachine (formerly bMachine) 3.1 and earlier uses predicable filenames for database backups and stores the files under the web root with insufficient access control, which allows remote attackers to obtain sensitive information by downloading a backup file.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21066; http://securityreason.com/securityalert/1271; http://securitytracker.com/id?1016515
CVE: CVE-2006-3832
Published: 2006-07-25
Description: SQL injection vulnerability in index.php in Gerrit van Aaken Loudblog 0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://loudblog.de/forum/viewtopic.php?id=762; http://loudblog.de/forum/viewtopic.php?id=770; http://retrogod.altervista.org/loudblog_05_sql.html
CVE: CVE-2006-3833
Published: 2006-07-25
Description: index.php in EJ3 TOPo 2.2.178 allows remote attackers to overwrite existing entries and establish new passwords for the overwritten entries via a URL with a modified entry ID.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1279; http://www.securityfocus.com/archive/1/439890/100/100/threaded; http://www.securityfocus.com/bid/18959
CVE: CVE-2006-3834
Published: 2006-07-25
Description: EJ3 TOPo 2.2.178 includes the password in cleartext in the ID field to index.php, which allows context-dependent attackers to obtain entry passwords via log files, referrers, or other vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1279; http://www.securityfocus.com/archive/1/439890/100/100/threaded; http://securityreason.com/securityalert/1279
CVE: CVE-2006-3835
Published: 2006-07-25
Description: Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0467.html; http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
CVE: CVE-2006-3836
Published: 2006-07-25
Description: Directory traversal vulnerability in index.php in UNIDOmedia Chameleon LE 1.203 and earlier, and possibly Chameleon PRO, allows remote attackers to read arbitrary files via the rmid parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21156; http://securityreason.com/securityalert/1280; http://www.securityfocus.com/archive/1/440765/100/0/threaded
CVE: CVE-2006-3837
Published: 2006-07-25
Description: delcookie.php in Professional Home Page Tools Guestbook changes the expiration date of a cookie instead of deleting the cookie's value, which makes it easier for attackers to steal the cookie and obtain the administrator's password hash after logout.
CVSS Score: 5.0 (MEDIUM)
References: http://artemis.abenteuer-mittelerde.de/pub/adv02-phptgb.txt; http://secunia.com/advisories/21102; http://securityreason.com/securityalert/1275
CVE: CVE-2006-3619
Published: 2006-07-25
Description: Directory traversal vulnerability in FastJar 0.93, as used in Gnu GCC 4.1.1 and earlier, and 3.4.6 and earlier, allows user-assisted attackers to overwrite arbitrary files via a .jar file containing filenames with "../" sequences.
CVSS Score: 2.6 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc; http://gcc.gnu.org/bugzilla/show_bug.cgi?id=28359; http://lists.debian.org/debian-gcc/2006/05/msg00317.html
CVE: CVE-2006-3119
Published: 2006-07-25
Description: The fbgs framebuffer Postscript/PDF viewer in fbi before 2.01 has a typo that prevents a filter from working correctly, which allows user-assisted attackers to bypass the filter and execute malicious Postscript commands.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21169; http://secunia.com/advisories/21191; http://secunia.com/advisories/21459
CVE: CVE-2006-3841
Published: 2006-07-25
Description: Cross-site scripting (XSS) vulnerability in WebScarab before 20[PII_REDACTED], when used with Microsoft Internet Explorer 6 SP2 or Konqueror 3.5.3, allows remote attackers to inject arbitrary web script or HTML via the URL, which is not sanitized before being returned in an error message when WebScarab is not able to access the URL.
CVSS Score: 2.6 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047995.html; http://moritz-naumann.com/adv/0012/webscarabxss/0012.txt; http://secunia.com/advisories/21114
CVE: CVE-2006-3842
Published: 2006-07-25
Description: Cross-site scripting (XSS) vulnerability in Zoho Virtual Office 3.2 Build 3210 allows remote attackers to execute arbitrary web script or HTML via an HTML message.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21085; http://securityreason.com/securityalert/1273; http://www.securityfocus.com/archive/1/440417/100/0/threaded
CVE: CVE-2006-3843
Published: 2006-07-25
Description: PHP remote file inclusion vulnerability in com_calendar.php in Calendar Mambo Module 1.5.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1272; http://www.securityfocus.com/archive/1/440407/100/0/threaded; http://www.securityfocus.com/bid/19027
CVE: CVE-2006-3844
Published: 2006-07-25
Description: Buffer overflow in Quick 'n Easy FTP Server 3.0 allows remote authenticated users to execute arbitrary commands via a long argument to the LIST command, a different issue than CVE-2006-2027.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/21127; http://www.osvdb.org/27400; http://www.securiteam.com/exploits/5WP0C2AJ5W.html
CVE: CVE-2006-3845
Published: 2006-07-25
Description: Stack-based buffer overflow in lzh.fmt in WinRAR 3.00 through 3.60 beta 6 allows remote attackers to execute arbitrary code via a long filename in a LHA archive.
CVSS Score: 9.3 (HIGH)
References: http://hustlelabs.com/advisories/04072006_rarlabs.pdf; http://secunia.com/advisories/21080; http://www.rarlabs.com/rarnew.htm
CVE: CVE-2006-3846
Published: 2006-07-25
Description: PHP remote file inclusion vulnerability in extadminmenus.class.php in the MultiBanners 1.0.1 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/21168; http://securityreason.com/securityalert/1277; http://solpotcrew.org/adv/BlueSpy-adv-multibanners.txt
CVE: CVE-2006-3847
Published: 2006-07-25
Description: PHP remote file inclusion vulnerability in (1) admin.php, and possibly (2) details.php, (3) modify.php, (4) newgroup.php, (5) newtask.php, and (6) rss.php, in MoSpray (aka com_mospray) 1.8 RC1 allows remote attackers to execute arbitrary PHP code via a URL in the basedir parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://kurdishsecurity.blogspot.com/2006/07/kurdish-security-14-mospray-basedir.html; http://secunia.com/advisories/21166; http://www.securityfocus.com/archive/1/440939/100/200/threaded
CVE: CVE-2006-3848
Published: 2006-07-25
Description: Cross-site scripting (XSS) vulnerability in CGI wrapper for IP Calculator (IPCalc) 0.40 allows remote attackers to inject arbitrary web script or HTML via the URI (REQUEST_URI environment variable), which is used in the actionurl variable.
CVSS Score: 2.6 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0487.html; http://archives.neohapsis.com/archives/fulldisclosure/2006-07/att-0487/NDSA20060705.txt.asc; http://secunia.com/advisories/21151
CVE: CVE-2006-3849
Published: 2006-07-25
Description: Stack-based buffer overflow in Warzone 2100 and Warzone Resurrection 2.0.3 and earlier allows remote attackers to execute arbitrary code via a (1) long message handled by the recvTextMessage function in multiplay.c or a (2) long filename handled by NETrecvFile function in netplay/netplay.c.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/warzonebof-adv.txt; http://secunia.com/advisories/21474; http://securityreason.com/securityalert/1283
CVE: CVE-2006-3850
Published: 2006-07-25
Description: PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to execute arbitrary PHP code via a URL in the RootDirectory parameter.  NOTE: this issue has been disputed by a third party who states that the RootDirectory parameter is initialized before being used, for version 1.0.  CVE analysis concurs with the dispute, but it is unclear whether older versions are affected
CVSS Score: 5.1 (MEDIUM)
References: http://securityreason.com/securityalert/1281; http://securitytracker.com/id?1016568; http://www.attrition.org/pipermail/vim/2006-July/000937.html
CVE: CVE-2006-3851
Published: 2006-07-25
Description: SQL injection vulnerability in upgradev1.php in X7 Chat 2.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the old_prefix parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19123; http://www.vupen.com/english/advisories/2006/2941; https://exchange.xforce.ibmcloud.com/vulnerabilities/27921
CVE: CVE-2006-3852
Published: 2006-07-25
Description: Cross-site scripting (XSS) vulnerability in index.php in Micro GuestBook allows remote attackers to execute arbitrary SQL commands via the (1) name or (2) comment ("text") fields.
CVSS Score: 4.3 (MEDIUM)
References: http://it.security.netsons.org/exploit/MicroGuestBook.txt; http://secunia.com/advisories/21155; http://securityreason.com/securityalert/1285
CVE: CVE-2006-3678
Published: 2006-07-26
Description: TippingPoint IPS running the TippingPoint Operating System (TOS) before 2.2.4.6519 allows remote attackers to "force the device into layer 2 fallback (L2FB)", causing a denial of service (page fault), via a malformed packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://secunia.com/advisories/21154; http://securityreason.com/securityalert/1286; http://securitytracker.com/id?1016562
CVE: CVE-2006-3633
Published: 2006-07-27
Description: OSSP shiela 1.1.5 and earlier allows remote authenticated users to execute arbitrary commands on the CVS server via shell metacharacters in a filename that is committed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/21209; http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.014-shiela.html; http://www.securityfocus.com/bid/19199
CVE: CVE-2006-3819
Published: 2006-07-27
Description: Eval injection vulnerability in the configure script in TWiki 4.0.0 through 4.0.4 allows remote attackers to execute arbitrary Perl code via an HTTP POST request containing a parameter name starting with "TYPEOF".
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21235; http://securitytracker.com/id?1016603; http://twiki.org/cgi-bin/view/Codev/SecurityAlertCmdExecWithConfigure
CVE: CVE-2006-3838
Published: 2006-07-27
Description: Multiple stack-based buffer overflows in eIQnetworks Enterprise Security Analyzer (ESA) before 2.5.0, as used in products including (a) Sidewinder, (b) iPolicy Security Manager, (c) Astaro Report Manager, (d) Fortinet FortiReporter, (e) Top Layer Network Security Analyzer, and possibly other products, allow remote attackers to execute arbitrary code via long (1) DELTAINTERVAL, (2) LOGFOLDER, (3) DELETELOGS, (4) FWASERVER, (5) SYSLOGPUBLICIP, (6) GETFWAIMPORTLOG, (7) GETFWADELTA, (8) DELETERDEPDEVICE, (9) COMPRESSRAWLOGFILE, (10) GETSYSLOGFIREWALLS, (11) ADDPOLICY, and (12) EDITPOLICY commands to the Syslog daemon (syslogserver.exe); (13) GUIADDDEVICE, (14) ADDDEVICE, and (15) DELETEDEVICE commands to the Topology server (Topology.exe); the (15) LICMGR_ADDLICENSE command to the License Manager (EnterpriseSecurityAnalyzer.exe); the (16) TRACE and (17) QUERYMONITOR commands to the Monitoring agent (Monitoring.exe); and possibly other vectors related to the Syslog daemon (syslogserver.exe).
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archive.cert.uni-stuttgart.de/bugtraq/2006/08/msg00152.html; http://secunia.com/advisories/21211; http://secunia.com/advisories/21213
CVE: CVE-2006-3878
Published: 2006-07-27
Description: Opsware Network Automation System (NAS) 6.0 installs /etc/init.d/mysql with insecure permissions, which allows local users to read the root password for the MySQL MAX database or gain privileges by modifying /etc/init.d/mysql.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/21192; http://securityreason.com/securityalert/1289; http://securitytracker.com/id?1016566
CVE: CVE-2006-3879
Published: 2006-07-27
Description: Integer overflow in the loadChunk function in loaders/load_gt2.c in libmikmod in Mikmod Sound System 3.2.2 allows remote attackers to cause a denial of service via a GRAOUMF TRACKER (GT2) module file with a large (0xffffffff) comment length value in an XCOM chunk.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://aluigi.altervista.org/adv/lmmgt2ho-adv.txt; http://aluigi.org/poc/lmmgt2ho.zip; http://secunia.com/advisories/21196
CVE: CVE-2006-3880
Published: 2006-07-27
Description: Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Small Business Server 2003 allow remote attackers to cause a denial of service (IP stack hang) via a continuous stream of packets on TCP port 135 that have incorrect TCP header checksums and random numbers in certain TCP header fields, as demonstrated by the Achilles Windows Attack Tool.  NOTE: the researcher reports that the Microsoft Security Response Center has stated "Our investigation which has included code review, review of the TCPDump, and attempts on reproing the issue on multiple fresh installs of various Windows Operating Systems have all resulted in non confirmation.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1282; http://www.securityfocus.com/archive/1/441007/100/0/threaded; http://www.securityfocus.com/bid/19135
CVE: CVE-2006-3881
Published: 2006-07-27
Description: Cross-site scripting (XSS) vulnerability in Shalwan MusicBox 2.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter in a request for the top-level URI.  NOTE: the id parameter in index.php, and the type and show parameters in a top action, are already covered by CVE-2006-1349; and the term parameter in a search action is already covered by CVE-2006-1806.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1284; http://www.securityfocus.com/archive/1/441000/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/27925
CVE: CVE-2006-3882
Published: 2006-07-27
Description: Shalwan MusicBox 2.3.4 and earlier allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1284; http://www.securityfocus.com/archive/1/441000/100/0/threaded; http://securityreason.com/securityalert/1284
CVE: CVE-2006-3883
Published: 2006-07-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in Gonafish LinksCaffe 3.0 allow remote attackers to inject arbitrary web script or HTML via (1) the tablewidth parameter in (a) counter.php; (2) the newdays parameter in (b) links.php; and the (3) tableborder, (4) menucolor, (5) textcolor, and (6) bodycolor parameters in (c) menu.inc.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21212; http://securityreason.com/securityalert/1287; http://securitytracker.com/id?1016584
CVE: CVE-2006-3884
Published: 2006-07-27
Description: Multiple SQL injection vulnerabilities in links.php in Gonafish LinksCaffe 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) offset and (2) limit parameters, (3) newdays parameter in a new action, and the (4) link_id parameter in a deadlink action.  NOTE: this issue can also be used for path disclosure by a forced SQL error, or to modify PHP files using OUTFILE.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21212; http://securityreason.com/securityalert/1287; http://securitytracker.com/id?1016584
CVE: CVE-2006-3885
Published: 2006-07-27
Description: Directory traversal vulnerability in Check Point Firewall-1 R55W before HFA03 allows remote attackers to read arbitrary files via an encoded .. (dot dot) in the URL on TCP port 18264.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21200; http://securityreason.com/securityalert/1290; http://securitytracker.com/id?1016563
CVE: CVE-2006-3886
Published: 2006-07-27
Description: SQL injection vulnerability in Shalwan MusicBox 2.3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter in a viewgallery action in a request for the top-level URI. NOTE: the start parameter/search action is already covered by CVE-2006-1807, and the show parameter/top action is already covered by CVE-2006-1360.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1284; http://www.securityfocus.com/archive/1/441000/100/0/threaded; http://www.securityfocus.com/bid/19129
CVE: CVE-2006-3840
Published: 2006-07-27
Description: The SMB Mailslot parsing functionality in PAM in multiple ISS products with XPU (24.39/1.78/epj/x.x.x.1780), including Proventia A, G, M, Server, and Desktop, BlackICE PC and Server Protection 3.6, and RealSecure 7.0, allows remote attackers to cause a denial of service (infinite loop) via a crafted SMB packet that is not properly handled by the SMB_Mailslot_Heap_Overflow decode.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/21219; http://securitytracker.com/id?1016590; http://securitytracker.com/id?1016591
CVE: CVE-2006-3897
Published: 2006-07-27
Description: Stack overflow in Microsoft Internet Explorer 6 on Windows 2000 allows remote attackers to cause a denial of service (application crash) by creating an NMSA.ASFSourceMediaDescription.1 ActiveX object with a long dispValue property.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-787
References: http://browserfun.blogspot.com/2006/07/mobb-23-nmsaasfsourcemediadescription.html; http://www.osvdb.org/27232; http://www.securityfocus.com/bid/19114
CVE: CVE-2006-3898
Published: 2006-07-27
Description: Microsoft Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to cause a denial of service (application crash) by calling the Click method of the Internet.HHCtrl.1 ActiveX object before initializing the URL, which triggers a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://browserfun.blogspot.com/2006/07/mobb-22-internethhctrl-click.html; http://www.osvdb.org/27231; http://www.securityfocus.com/bid/19109
CVE: CVE-2006-3899
Published: 2006-07-27
Description: Microsoft Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to cause a denial of service (application crash) by calling the stringToBinary function of the CEnroll.CEnroll.2 ActiveX object with a long second argument, which triggers an invalid memory access inside the SysAllocStringLen function.
CVSS Score: 5.0 (MEDIUM)
References: http://browserfun.blogspot.com/2006/07/mobb-21-cenroll-stringtobinary.html; http://www.osvdb.org/27230; http://www.securityfocus.com/bid/19102
CVE: CVE-2006-3900
Published: 2006-07-27
Description: Cross-site scripting (XSS) vulnerability in guestbook.php in TP-Book 1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9949&w=2; http://secunia.com/advisories/21205; http://securitytracker.com/id?1016583
CVE: CVE-2006-3901
Published: 2006-07-27
Description: Multiple stack-based buffer overflows in Tumbleweed Email Firewall (EMF) allow remote attackers to execute arbitrary code via an email attachment with an LHA archive that contains a (1) file or (2) directory with a long LHA extended header, (3) an LHA archive in which the "temporary pathname" field for decompressed output is greater than 2 bytes, or (4) an LHA archive with a long filename.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8939&w=2; http://secunia.com/advisories/21194; http://www.hustlelabs.com/advisories/04072006_tweed.pdf
CVE: CVE-2006-3677
Published: 2006-07-27
Description: Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properties of the window navigator object (window.navigator) that are accessed when Java starts up, which causes a crash that leads to code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc; http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/19873
CVE: CVE-2006-3803
Published: 2006-07-27
Description: Race condition in the JavaScript garbage collection in Mozilla Firefox 1.5 before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 might allow remote attackers to execute arbitrary code by causing the garbage collector to delete a temporary variable while it is still being used during the creation of a new Function object.
CVSS Score: 5.1 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc; http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/19873
CVE: CVE-2006-3804
Published: 2006-07-27
Description: Heap-based buffer overflow in Mozilla Thunderbird before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to cause a denial of service (crash) via a VCard attachment with a malformed base64 field, which copies more data than expected due to an integer underflow.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc; http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/21228
CVE: CVE-2006-3806
Published: 2006-07-27
Description: Multiple integer overflows in the Javascript engine in Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 might allow remote attackers to execute arbitrary code via vectors involving (1) long strings in the toSource method of the Object, Array, and String objects; and (2) unspecified "string function arguments."
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc; http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/19873
CVE: CVE-2006-3807
Published: 2006-07-27
Description: Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code via script that changes the standard Object() constructor to return a reference to a privileged object and calling "named JavaScript functions" that use the constructor.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc; http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/19873